--- /dev/null
+From 5ffdd1d985d737207b11caf474598ee1238baac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Dec 2019 17:07:06 +0000
+Subject: ARM: dts: am335x-sancloud-bbe: fix phy mode
+
+From: Mans Rullgard <mans@mansr.com>
+
+[ Upstream commit c842b8c4ff9859f750447f3ca08f64b2ed23cebc ]
+
+The phy mode should be rgmii-id. For some reason, it used to work with
+rgmii-txid but doesn't any more.
+
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-sancloud-bbe.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/am335x-sancloud-bbe.dts b/arch/arm/boot/dts/am335x-sancloud-bbe.dts
+index 8678e6e35493..e5fdb7abb0d5 100644
+--- a/arch/arm/boot/dts/am335x-sancloud-bbe.dts
++++ b/arch/arm/boot/dts/am335x-sancloud-bbe.dts
+@@ -108,7 +108,7 @@
+
+ &cpsw_emac0 {
+ phy-handle = <ðphy0>;
+- phy-mode = "rgmii-txid";
++ phy-mode = "rgmii-id";
+ };
+
+ &i2c0 {
+--
+2.20.1
+
--- /dev/null
+From 5dd962b7c0bb6c4f51afb28c2a6ba236c36edfe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 11:39:48 +0200
+Subject: ARM: dts: am437x-gp/epos-evm: fix panel compatible
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+[ Upstream commit c6b16761c6908d3dc167a0a566578b4b0b972905 ]
+
+The LCD panel on AM4 GP EVMs and ePOS boards seems to be
+osd070t1718-19ts. The current dts files say osd057T0559-34ts. Possibly
+the panel has changed since the early EVMs, or there has been a mistake
+with the panel type.
+
+Update the DT files accordingly.
+
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am437x-gp-evm.dts | 2 +-
+ arch/arm/boot/dts/am43x-epos-evm.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts
+index cae4500194fe..811c8cae315b 100644
+--- a/arch/arm/boot/dts/am437x-gp-evm.dts
++++ b/arch/arm/boot/dts/am437x-gp-evm.dts
+@@ -86,7 +86,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
+ label = "lcd";
+
+ backlight = <&lcd_bl>;
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 95314121d111..078cb473fa7d 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -42,7 +42,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
+ label = "lcd";
+
+ backlight = <&lcd_bl>;
+--
+2.20.1
+
--- /dev/null
+From 90d52e78a26a3ade8891a1a774132c5b2a9d02fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Nov 2019 13:31:13 +0100
+Subject: ARM: dts: bcm283x: Fix critical trip point
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit 30e647a764d446723a7e0fb08d209e0104f16173 ]
+
+During definition of the CPU thermal zone of BCM283x SoC family there
+was a misunderstanding of the meaning "criticial trip point" and the
+thermal throttling range of the VideoCore firmware. The latter one takes
+effect when the core temperature is at least 85 degree celsius or higher
+
+So the current critical trip point doesn't make sense, because the
+thermal shutdown appears before the firmware has a chance to throttle
+the ARM core(s).
+
+Fix these unwanted shutdowns by increasing the critical trip point
+to a value which shouldn't be reached with working thermal throttling.
+
+Fixes: 0fe4d2181cc4 ("ARM: dts: bcm283x: Add CPU thermal zone with 1 trip point")
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm283x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
+index 2d191fcbc2cc..90125ce19a1b 100644
+--- a/arch/arm/boot/dts/bcm283x.dtsi
++++ b/arch/arm/boot/dts/bcm283x.dtsi
+@@ -40,7 +40,7 @@
+
+ trips {
+ cpu-crit {
+- temperature = <80000>;
++ temperature = <90000>;
+ hysteresis = <0>;
+ type = "critical";
+ };
+--
+2.20.1
+
--- /dev/null
+From f41a2b352533c093ea3536a0d8c5cd574bc054e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 16:01:20 -0800
+Subject: ARM: dts: BCM5301X: Fix MDIO node address/size cells
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 093c3f94e922d83a734fc4da08cc5814990f32c6 ]
+
+The MDIO node on BCM5301X had an reversed #address-cells and
+ #size-cells properties, correct those, silencing checker warnings:
+
+.../linux/arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dt.yaml: mdio@18003000: #address-cells:0:0: 1 was expected
+
+Reported-by: Simon Horman <simon.horman@netronome.com>
+Fixes: 23f1eca6d59b ("ARM: dts: BCM5301X: Specify MDIO bus in the DT")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 372dc1eb88a0..2d9b4dd05830 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -353,8 +353,8 @@
+ mdio: mdio@18003000 {
+ compatible = "brcm,iproc-mdio";
+ reg = <0x18003000 0x8>;
+- #size-cells = <1>;
+- #address-cells = <0>;
++ #size-cells = <0>;
++ #address-cells = <1>;
+ };
+
+ mdio-bus-mux@18003000 {
+--
+2.20.1
+
--- /dev/null
+From 978e4074eea8771e63ac993cc501c9faa83f1395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 10:19:09 -0800
+Subject: ARM: dts: Cygnus: Fix MDIO node address/size cells
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit fac2c2da3596d77c343988bb0d41a8c533b2e73c ]
+
+The MDIO node on Cygnus had an reversed #address-cells and
+ #size-cells properties, correct those.
+
+Fixes: 40c26d3af60a ("ARM: dts: Cygnus: Add the ethernet switch and ethernet PHY")
+Reported-by: Simon Horman <simon.horman@netronome.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-cygnus.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi
+index 2dac3efc7640..1bc45cfd5453 100644
+--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
+@@ -174,8 +174,8 @@
+ mdio: mdio@18002000 {
+ compatible = "brcm,iproc-mdio";
+ reg = <0x18002000 0x8>;
+- #size-cells = <1>;
+- #address-cells = <0>;
++ #size-cells = <0>;
++ #address-cells = <1>;
+ status = "disabled";
+
+ gphy0: ethernet-phy@0 {
+--
+2.20.1
+
--- /dev/null
+From a2ec68fce1fa31a49069ea5094cc224f28487b47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:04:56 +0100
+Subject: ARM: dts: imx6ul: imx6ul-14x14-evk.dtsi: Fix SPI NOR probing
+
+From: Stefan Roese <sr@denx.de>
+
+[ Upstream commit 0aeb1f2b74f3402e9cdb7c0b8e2c369c9767301e ]
+
+Without this "jedec,spi-nor" compatible property, probing of the SPI NOR
+does not work on the NXP i.MX6ULL EVK. Fix this by adding this
+compatible property to the DT.
+
+Fixes: 7d77b8505aa9 ("ARM: dts: imx6ull: fix the imx6ull-14x14-evk configuration")
+Signed-off-by: Stefan Roese <sr@denx.de>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+index c2a9dd57e56a..aa86341adaaa 100644
+--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+@@ -215,7 +215,7 @@
+ flash0: n25q256a@0 {
+ #address-cells = <1>;
+ #size-cells = <1>;
+- compatible = "micron,n25q256a";
++ compatible = "micron,n25q256a", "jedec,spi-nor";
+ spi-max-frequency = <29000000>;
+ spi-rx-bus-width = <4>;
+ spi-tx-bus-width = <4>;
+--
+2.20.1
+
--- /dev/null
+From a602ca1b2d48af25e2b5dc26d24d7a6ad0ef833b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 13:47:21 +0100
+Subject: ARM: exynos_defconfig: Restore debugfs support
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit a2315d3aea5976acd919d3d3fcf82f752562c25b ]
+
+Commit 9f532d26c75c ("ARM: exynos_defconfig: Trim and reorganize with
+savedefconfig") removed explicit enable line for CONFIG_DEBUG_FS, because
+that feature has been selected by other enabled options: CONFIG_TRACING,
+which in turn had been selected by CONFIG_PERF_EVENTS and
+CONFIG_PROVE_LOCKING.
+
+In meantime, commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS
+dependency") removed the dependency between CONFIG_DEBUG_FS and
+CONFIG_TRACING, so CONFIG_DEBUG_FS is no longer enabled in default builds.
+
+Enable it again explicitly, as debugfs support is essential for various
+automated testing tools.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/exynos_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
+index 08db1c83eb2d..736ed7a7bcf8 100644
+--- a/arch/arm/configs/exynos_defconfig
++++ b/arch/arm/configs/exynos_defconfig
+@@ -348,6 +348,7 @@ CONFIG_PRINTK_TIME=y
+ CONFIG_DYNAMIC_DEBUG=y
+ CONFIG_DEBUG_INFO=y
+ CONFIG_MAGIC_SYSRQ=y
++CONFIG_DEBUG_FS=y
+ CONFIG_DEBUG_KERNEL=y
+ CONFIG_SOFTLOCKUP_DETECTOR=y
+ # CONFIG_DETECT_HUNG_TASK is not set
+--
+2.20.1
+
--- /dev/null
+From 0ee7cbba19dbc29e5cc7408f4c68c4c086c4b7da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 19:34:20 +0200
+Subject: ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 46db63abb79524209c15c683feccfba116746757 ]
+
+This is currently off and that's not desirable: default imx config is
+meant to be generally useful for development and debugging.
+
+Running git bisect between v5.4 and v5.5-rc1 finds this started from
+commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency")
+
+Explicit CONFIG_DEBUG_FS=y was earlier removed by
+commit c29d541f590c ("ARM: imx_v6_v7_defconfig: Remove unneeded options")
+
+A very similar fix was required before:
+commit 7e9eb6268809 ("ARM: imx_v6_v7_defconfig: Explicitly restore CONFIG_DEBUG_FS")
+
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/imx_v6_v7_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
+index 0f7381ee0c37..dabb80453249 100644
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -460,6 +460,7 @@ CONFIG_FONT_8x8=y
+ CONFIG_FONT_8x16=y
+ CONFIG_PRINTK_TIME=y
+ CONFIG_MAGIC_SYSRQ=y
++CONFIG_DEBUG_FS=y
+ # CONFIG_SCHED_DEBUG is not set
+ CONFIG_PROVE_LOCKING=y
+ # CONFIG_DEBUG_BUGVERBOSE is not set
+--
+2.20.1
+
--- /dev/null
+From 6caefc0761dd4dd902a7fe284ccb589588a8bab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 13:41:17 -0800
+Subject: ARM: omap2plus_defconfig: Add back DEBUG_FS
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit e00b59d30506dc9ef91caf2f3c584209cc9f61e4 ]
+
+Commit 0e4a459f56c3 ("tracing: Remove unnecessary DEBUG_FS dependency")
+removed select for DEBUG_FS but we still need it at least for enabling
+deeper idle states for the SoCs.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/omap2plus_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
+index 40d7f1a4fc45..4ec69fb8a698 100644
+--- a/arch/arm/configs/omap2plus_defconfig
++++ b/arch/arm/configs/omap2plus_defconfig
+@@ -552,5 +552,6 @@ CONFIG_DEBUG_INFO=y
+ CONFIG_DEBUG_INFO_SPLIT=y
+ CONFIG_DEBUG_INFO_DWARF4=y
+ CONFIG_MAGIC_SYSRQ=y
++CONFIG_DEBUG_FS=y
+ CONFIG_SCHEDSTATS=y
+ # CONFIG_DEBUG_BUGVERBOSE is not set
+--
+2.20.1
+
--- /dev/null
+From b56e3b1467eba2ba55bca05e3c8697b23304f12b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 11:13:27 +0100
+Subject: ARM: shmobile: defconfig: Restore debugfs support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit fa2cdb1762d15f701b83efa60b04f0d04e71bf89 ]
+
+Since commit 0e4a459f56c32d3e ("tracing: Remove unnecessary DEBUG_FS
+dependency"), CONFIG_DEBUG_FS is no longer auto-enabled. This breaks
+booting Debian 9, as systemd needs debugfs:
+
+ [FAILED] Failed to mount /sys/kernel/debug.
+ See 'systemctl status sys-kernel-debug.mount' for details.
+ [DEPEND] Dependency failed for Local File Systems.
+ ...
+ You are in emergGive root password for maintenance
+ (or press Control-D to continue):
+
+Fix this by enabling CONFIG_DEBUG_FS explicitly.
+
+See also commit 18977008f44c66bd ("ARM: multi_v7_defconfig: Restore
+debugfs support").
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/20191209101327.26571-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/shmobile_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/shmobile_defconfig b/arch/arm/configs/shmobile_defconfig
+index c6c70355141c..7e7b678ae153 100644
+--- a/arch/arm/configs/shmobile_defconfig
++++ b/arch/arm/configs/shmobile_defconfig
+@@ -215,4 +215,5 @@ CONFIG_DMA_CMA=y
+ CONFIG_CMA_SIZE_MBYTES=64
+ CONFIG_PRINTK_TIME=y
+ # CONFIG_ENABLE_MUST_CHECK is not set
++CONFIG_DEBUG_FS=y
+ CONFIG_DEBUG_KERNEL=y
+--
+2.20.1
+
--- /dev/null
+From f5e8571e584c0ac469567f8aaafda20433cfde03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 15:56:40 +0000
+Subject: ARM: vexpress: Set-up shared OPP table instead of individual for each
+ CPU
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 2a76352ad2cc6b78e58f737714879cc860903802 ]
+
+Currently we add individual copy of same OPP table for each CPU within
+the cluster. This is redundant and doesn't reflect the reality.
+
+We can't use core cpumask to set policy->cpus in ve_spc_cpufreq_init()
+anymore as it gets called via cpuhp_cpufreq_online()->cpufreq_online()
+->cpufreq_driver->init() and the cpumask gets updated upon CPU hotplug
+operations. It also may cause issues when the vexpress_spc_cpufreq
+driver is built as a module.
+
+Since ve_spc_clk_init is built-in device initcall, we should be able to
+use the same topology_core_cpumask to set the opp sharing cpumask via
+dev_pm_opp_set_sharing_cpus and use the same later in the driver via
+dev_pm_opp_get_sharing_cpus.
+
+Cc: Liviu Dudau <liviu.dudau@arm.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-vexpress/spc.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
+index 354e0e7025ae..1da11bdb1dfb 100644
+--- a/arch/arm/mach-vexpress/spc.c
++++ b/arch/arm/mach-vexpress/spc.c
+@@ -551,8 +551,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev)
+
+ static int __init ve_spc_clk_init(void)
+ {
+- int cpu;
++ int cpu, cluster;
+ struct clk *clk;
++ bool init_opp_table[MAX_CLUSTERS] = { false };
+
+ if (!info)
+ return 0; /* Continue only if SPC is initialised */
+@@ -578,8 +579,17 @@ static int __init ve_spc_clk_init(void)
+ continue;
+ }
+
++ cluster = topology_physical_package_id(cpu_dev->id);
++ if (init_opp_table[cluster])
++ continue;
++
+ if (ve_init_opp_table(cpu_dev))
+ pr_warn("failed to initialise cpu%d opp table\n", cpu);
++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev,
++ topology_core_cpumask(cpu_dev->id)))
++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu);
++ else
++ init_opp_table[cluster] = true;
+ }
+
+ platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0);
+--
+2.20.1
+
--- /dev/null
+From bf0faee9c549467293529cf5ef877e09c275eb01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 17:17:10 +0800
+Subject: arm64: cpu_errata: Add Hisilicon TSV110 to spectre-v2 safe list
+
+From: Wei Li <liwei391@huawei.com>
+
+[ Upstream commit aa638cfe3e7358122a15cb1d295b622aae69e006 ]
+
+HiSilicon Taishan v110 CPUs didn't implement CSV2 field of the
+ID_AA64PFR0_EL1, but spectre-v2 is mitigated by hardware, so
+whitelist the MIDR in the safe list.
+
+Signed-off-by: Wei Li <liwei391@huawei.com>
+[hanjun: re-write the commit log]
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpu_errata.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 93f34b4eca25..96f576e9ea46 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -575,6 +575,7 @@ static const struct midr_range spectre_v2_safe_list[] = {
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
+ MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53),
++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ { /* sentinel */ }
+ };
+
+--
+2.20.1
+
--- /dev/null
+From bbfca2fa074df1bc6bc85a717e63048b2fdb2393 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 18:11:45 +0100
+Subject: arm64: dts: ls1028a: fix reboot node
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 3f0fb37b22b460e3dec62bee284932881574acb9 ]
+
+The reboot register isn't located inside the DCFG controller, but in its
+own RST controller. Fix it.
+
+Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index c7dae9ec17da..bb960fe2bb64 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -102,7 +102,7 @@
+
+ reboot {
+ compatible ="syscon-reboot";
+- regmap = <&dcfg>;
++ regmap = <&rst>;
+ offset = <0xb0>;
+ mask = <0x02>;
+ };
+@@ -161,6 +161,12 @@
+ big-endian;
+ };
+
++ rst: syscon@1e60000 {
++ compatible = "syscon";
++ reg = <0x0 0x1e60000 0x0 0x10000>;
++ little-endian;
++ };
++
+ scfg: syscon@1fc0000 {
+ compatible = "fsl,ls1028a-scfg", "syscon";
+ reg = <0x0 0x1fc0000 0x0 0x10000>;
+--
+2.20.1
+
--- /dev/null
+From 25a03710fabd3aef2587cfc52ed507f649776a3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 00:43:46 +0100
+Subject: arm64: dts: ls1028a: fix typo in TMU calibration data
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 961f8209c8d5ef5d33da42e6656d7c8179899da0 ]
+
+The temperature sensor may jump backwards because there is a wrong
+calibration value. Both values have to be monotonically increasing.
+Fix it.
+
+This was tested on a custom board.
+
+Fixes: 571cebfe8e2b ("arm64: dts: ls1028a: Add Thermal Monitor Unit node")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Acked-by: Tang Yuantian <andy.tang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 72b9a75976a1..c7dae9ec17da 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -567,7 +567,7 @@
+ 0x00010004 0x0000003d
+ 0x00010005 0x00000045
+ 0x00010006 0x0000004d
+- 0x00010007 0x00000045
++ 0x00010007 0x00000055
+ 0x00010008 0x0000005e
+ 0x00010009 0x00000066
+ 0x0001000a 0x0000006e
+--
+2.20.1
+
--- /dev/null
+From 2c0abd02dc01d4e5c1d3ff50486760a1ec9ee25b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 23:14:42 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Update quirk for Teclast X89
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7eccc05c7101f34cc36afe9405d15de6d4099fb4 ]
+
+When the Teclast X89 quirk was added we did not have jack-detection
+support yet.
+
+Note the over-current detection limit is set to 2mA instead of the usual
+1.5mA because this tablet tends to give false-positive button-presses
+when it is set to 1.5mA.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191203221442.2657-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index dd2b5ad08659..243f683bc02a 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -707,13 +707,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MCLK_EN),
+ },
+ {
++ /* Teclast X89 */
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+ DMI_MATCH(DMI_BOARD_NAME, "tPAD"),
+ },
+ .driver_data = (void *)(BYT_RT5640_IN3_MAP |
+- BYT_RT5640_MCLK_EN |
+- BYT_RT5640_SSP0_AIF1),
++ BYT_RT5640_JD_SRC_JD1_IN4P |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_1P0 |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
+ },
+ { /* Toshiba Satellite Click Mini L9W-B */
+ .matches = {
+--
+2.20.1
+
--- /dev/null
+From 6150229efc88b9e187b8fde22872b457409a1eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 15:31:14 +0800
+Subject: ASoC: max98090: fix possible race conditions
+
+From: Tzung-Bi Shih <tzungbi@google.com>
+
+[ Upstream commit 45dfbf56975994822cce00b7475732a49f8aefed ]
+
+max98090_interrupt() and max98090_pll_work() run in 2 different threads.
+There are 2 possible races:
+
+Note: M98090_REG_DEVICE_STATUS = 0x01.
+Note: ULK == 0, PLL is locked; ULK == 1, PLL is unlocked.
+
+max98090_interrupt max98090_pll_work
+----------------------------------------------
+schedule max98090_pll_work
+ restart max98090 codec
+receive ULK INT
+ assert ULK == 0
+schedule max98090_pll_work (1).
+
+In the case (1), the PLL is locked but max98090_interrupt unnecessarily
+schedules another max98090_pll_work.
+
+max98090_interrupt max98090_pll_work max98090 codec
+----------------------------------------------------------------------
+ ULK = 1
+receive ULK INT
+read 0x01
+ ULK = 0 (clear on read)
+schedule max98090_pll_work
+ restart max98090 codec
+ ULK = 1
+receive ULK INT
+read 0x01
+ ULK = 0 (clear on read)
+ read 0x01
+ assert ULK == 0 (2).
+
+In the case (2), both max98090_interrupt and max98090_pll_work read
+the same clear-on-read register. max98090_pll_work would falsely
+thought PLL is locked.
+Note: the case (2) race is introduced by the previous commit ("ASoC:
+max98090: exit workaround earlier if PLL is locked") to check the status
+and exit the loop earlier in max98090_pll_work.
+
+There are 2 possible solution options:
+A. turn off ULK interrupt before scheduling max98090_pll_work; and turn
+on again before exiting max98090_pll_work.
+B. remove the second thread of execution.
+
+Option A cannot fix the case (2) race because it still has 2 threads
+access the same clear-on-read register simultaneously. Although we
+could suppose the register is volatile and read the status via I2C could
+be much slower than the hardware raises the bits.
+
+Option B introduces a maximum 10~12 msec penalty delay in the interrupt
+handler. However, it could only punish the jack detection by extra
+10~12 msec.
+
+Adopts option B which is the better solution overall.
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Link: https://lore.kernel.org/r/20191122073114.219945-4-tzungbi@google.com
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 8 ++------
+ sound/soc/codecs/max98090.h | 1 -
+ 2 files changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index f6bf4cfbea23..45da2b51543e 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -2103,10 +2103,8 @@ static void max98090_pll_det_disable_work(struct work_struct *work)
+ M98090_IULK_MASK, 0);
+ }
+
+-static void max98090_pll_work(struct work_struct *work)
++static void max98090_pll_work(struct max98090_priv *max98090)
+ {
+- struct max98090_priv *max98090 =
+- container_of(work, struct max98090_priv, pll_work);
+ struct snd_soc_component *component = max98090->component;
+
+ if (!snd_soc_component_is_active(component))
+@@ -2259,7 +2257,7 @@ static irqreturn_t max98090_interrupt(int irq, void *data)
+
+ if (active & M98090_ULK_MASK) {
+ dev_dbg(component->dev, "M98090_ULK_MASK\n");
+- schedule_work(&max98090->pll_work);
++ max98090_pll_work(max98090);
+ }
+
+ if (active & M98090_JDET_MASK) {
+@@ -2422,7 +2420,6 @@ static int max98090_probe(struct snd_soc_component *component)
+ max98090_pll_det_enable_work);
+ INIT_WORK(&max98090->pll_det_disable_work,
+ max98090_pll_det_disable_work);
+- INIT_WORK(&max98090->pll_work, max98090_pll_work);
+
+ /* Enable jack detection */
+ snd_soc_component_write(component, M98090_REG_JACK_DETECT,
+@@ -2475,7 +2472,6 @@ static void max98090_remove(struct snd_soc_component *component)
+ cancel_delayed_work_sync(&max98090->jack_work);
+ cancel_delayed_work_sync(&max98090->pll_det_enable_work);
+ cancel_work_sync(&max98090->pll_det_disable_work);
+- cancel_work_sync(&max98090->pll_work);
+ max98090->component = NULL;
+ }
+
+diff --git a/sound/soc/codecs/max98090.h b/sound/soc/codecs/max98090.h
+index 57965cd678b4..a197114b0dad 100644
+--- a/sound/soc/codecs/max98090.h
++++ b/sound/soc/codecs/max98090.h
+@@ -1530,7 +1530,6 @@ struct max98090_priv {
+ struct delayed_work jack_work;
+ struct delayed_work pll_det_enable_work;
+ struct work_struct pll_det_disable_work;
+- struct work_struct pll_work;
+ struct snd_soc_jack *jack;
+ unsigned int dai_fmt;
+ int tdm_slots;
+--
+2.20.1
+
--- /dev/null
+From 0b4e4987ecb6f9cf5d5b45d532f2b933c720a3ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 17:19:40 +0800
+Subject: ASoC: rt5682: fix i2c arbitration lost issue
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit bc094709de0192a756c6946a7c89c543243ae609 ]
+
+This patch modified the HW initial setting to fix i2c arbitration lost issue.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Link: https://lore.kernel.org/r/20191125091940.11953-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index c50b75ce82e0..05e883a65d7a 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -72,6 +72,7 @@ struct rt5682_priv {
+ static const struct reg_sequence patch_list[] = {
+ {RT5682_HP_IMP_SENS_CTRL_19, 0x1000},
+ {RT5682_DAC_ADC_DIG_VOL1, 0xa020},
++ {RT5682_I2C_CTRL, 0x000f},
+ };
+
+ static const struct reg_default rt5682_reg[] = {
+@@ -2481,6 +2482,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682)
+ mutex_lock(&rt5682->calibrate_mutex);
+
+ rt5682_reset(rt5682->regmap);
++ regmap_write(rt5682->regmap, RT5682_I2C_CTRL, 0x000f);
+ regmap_write(rt5682->regmap, RT5682_PWR_ANLG_1, 0xa2af);
+ usleep_range(15000, 20000);
+ regmap_write(rt5682->regmap, RT5682_PWR_ANLG_1, 0xf2af);
+--
+2.20.1
+
--- /dev/null
+From 038d477f7bb30e6ac09c40501a1bba662fe9dd8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 18:48:52 -0600
+Subject: ASoC: SOF: Intel: split cht and byt debug window sizes
+
+From: Curtis Malainey <cujomalainey@chromium.org>
+
+[ Upstream commit f84337c3fb8ff4d533ccbed0d2db4e8587d0ff58 ]
+
+Turns out SSP 3-5 are only available on cht, to avoid dumping on
+undefined registers let's split the definition.
+
+Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191210004854.16845-7-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/byt.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sof/intel/byt.c b/sound/soc/sof/intel/byt.c
+index a1e514f71739..41008c974ac6 100644
+--- a/sound/soc/sof/intel/byt.c
++++ b/sound/soc/sof/intel/byt.c
+@@ -24,7 +24,8 @@
+ #define DRAM_OFFSET 0x100000
+ #define DRAM_SIZE (160 * 1024)
+ #define SHIM_OFFSET 0x140000
+-#define SHIM_SIZE 0x100
++#define SHIM_SIZE_BYT 0x100
++#define SHIM_SIZE_CHT 0x118
+ #define MBOX_OFFSET 0x144000
+ #define MBOX_SIZE 0x1000
+ #define EXCEPT_OFFSET 0x800
+@@ -75,7 +76,7 @@ static const struct snd_sof_debugfs_map byt_debugfs[] = {
+ SOF_DEBUGFS_ACCESS_D0_ONLY},
+ {"dram", BYT_DSP_BAR, DRAM_OFFSET, DRAM_SIZE,
+ SOF_DEBUGFS_ACCESS_D0_ONLY},
+- {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE,
++ {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE_BYT,
+ SOF_DEBUGFS_ACCESS_ALWAYS},
+ };
+
+@@ -102,7 +103,7 @@ static const struct snd_sof_debugfs_map cht_debugfs[] = {
+ SOF_DEBUGFS_ACCESS_D0_ONLY},
+ {"dram", BYT_DSP_BAR, DRAM_OFFSET, DRAM_SIZE,
+ SOF_DEBUGFS_ACCESS_D0_ONLY},
+- {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE,
++ {"shim", BYT_DSP_BAR, SHIM_OFFSET, SHIM_SIZE_CHT,
+ SOF_DEBUGFS_ACCESS_ALWAYS},
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 1d6c6f34e59cf92e09c1eaa699a650c1236eb197 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 18:48:48 -0600
+Subject: ASoC: SOF: loader: snd_sof_fw_parse_ext_data log warning on unknown
+ header
+
+From: Karol Trzcinski <karolx.trzcinski@linux.intel.com>
+
+[ Upstream commit 8edc95667646a75f0fc97e08ecb180581fdff300 ]
+
+Added warning log when found some unknown FW boot ext header,
+to improve debuggability.
+
+Signed-off-by: Karol Trzcinski <karolx.trzcinski@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191210004854.16845-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/loader.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c
+index 9a9a381a908d..a041adf0669d 100644
+--- a/sound/soc/sof/loader.c
++++ b/sound/soc/sof/loader.c
+@@ -66,6 +66,8 @@ int snd_sof_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 bar, u32 offset)
+ ret = get_ext_windows(sdev, ext_hdr);
+ break;
+ default:
++ dev_warn(sdev->dev, "warning: unknown ext header type %d size 0x%x\n",
++ ext_hdr->type, ext_hdr->hdr.size);
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dc8b0415b38b52ce1ff835d2ec5834c21b1cb79d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 18:39:38 -0600
+Subject: ASoC: topology: Check return value for snd_soc_add_dai_link()
+
+From: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+
+[ Upstream commit 76d2703649321c296df7ec0dafd50add96215de4 ]
+
+snd_soc_add_dai_link() might fail. This situation occurs for
+instance in a very specific use case where a PCM device and a
+Back End DAI link are given identical names in the topology.
+When this happens, soc_new_pcm_runtime() fails and then
+snd_soc_add_dai_link() returns -ENOMEM when called from
+soc_tplg_fe_link_create(). Because of that, the link will not
+get added into the card list, so any attempt to remove it later
+ends up in a panic.
+
+Fix that by checking the return status and free the memory in case
+of an error.
+
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191210003939.15752-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 0fd032914a31..c92e360d27b8 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1918,11 +1918,13 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg,
+ ret = soc_tplg_dai_link_load(tplg, link, NULL);
+ if (ret < 0) {
+ dev_err(tplg->comp->dev, "ASoC: FE link loading failed\n");
+- kfree(link->name);
+- kfree(link->stream_name);
+- kfree(link->cpus->dai_name);
+- kfree(link);
+- return ret;
++ goto err;
++ }
++
++ ret = snd_soc_add_dai_link(tplg->comp->card, link);
++ if (ret < 0) {
++ dev_err(tplg->comp->dev, "ASoC: adding FE link failed\n");
++ goto err;
+ }
+
+ link->dobj.index = tplg->index;
+@@ -1930,8 +1932,13 @@ static int soc_tplg_fe_link_create(struct soc_tplg *tplg,
+ link->dobj.type = SND_SOC_DOBJ_DAI_LINK;
+ list_add(&link->dobj.list, &tplg->comp->dobj_list);
+
+- snd_soc_add_dai_link(tplg->comp->card, link);
+ return 0;
++err:
++ kfree(link->name);
++ kfree(link->stream_name);
++ kfree(link->cpus->dai_name);
++ kfree(link);
++ return ret;
+ }
+
+ /* create a FE DAI and DAI link from the PCM object */
+--
+2.20.1
+
--- /dev/null
+From 46a1e200b7706300aea8680f91842bc37fcf47ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 18:39:39 -0600
+Subject: ASoC: topology: Check return value for soc_tplg_pcm_create()
+
+From: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+
+[ Upstream commit a3039aef52d9ffeb67e9211899cd3e8a2953a01f ]
+
+The return value of soc_tplg_pcm_create() is currently not checked
+in soc_tplg_pcm_elems_load(). If an error is to occur there, the
+topology ignores it and continues loading.
+
+Fix that by checking the status and rejecting the topology on error.
+
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191210003939.15752-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index c92e360d27b8..fd2d22ddc81b 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2031,6 +2031,7 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
+ int size;
+ int i;
+ bool abi_match;
++ int ret;
+
+ count = le32_to_cpu(hdr->count);
+
+@@ -2072,7 +2073,12 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
+ }
+
+ /* create the FE DAIs and DAI links */
+- soc_tplg_pcm_create(tplg, _pcm);
++ ret = soc_tplg_pcm_create(tplg, _pcm);
++ if (ret < 0) {
++ if (!abi_match)
++ kfree(_pcm);
++ return ret;
++ }
+
+ /* offset by version-specific struct size and
+ * real priv data size
+--
+2.20.1
+
--- /dev/null
+From 9e4ac6ac2b5b64154f5a93bb45a5d5c8f7867368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 19:57:22 +0800
+Subject: ASoC: wm8962: fix lambda value
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 556672d75ff486e0b6786056da624131679e0576 ]
+
+According to user manual, it is required that FLL_LAMBDA > 0
+in all cases (Integer and Franctional modes).
+
+Fixes: 9a76f1ff6e29 ("ASoC: Add initial WM8962 CODEC driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/1576065442-19763-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 3e5c69fbc33a..d9d59f45833f 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -2788,7 +2788,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref,
+
+ if (target % Fref == 0) {
+ fll_div->theta = 0;
+- fll_div->lambda = 0;
++ fll_div->lambda = 1;
+ } else {
+ gcd_fll = gcd(target, fratio * Fref);
+
+@@ -2858,7 +2858,7 @@ static int wm8962_set_fll(struct snd_soc_component *component, int fll_id, int s
+ return -EINVAL;
+ }
+
+- if (fll_div.theta || fll_div.lambda)
++ if (fll_div.theta)
+ fll1 |= WM8962_FLL_FRAC;
+
+ /* Stop the FLL while we reconfigure */
+--
+2.20.1
+
--- /dev/null
+From 6ba7848ba19bf9dd3dfeba9f87b615ea4ffb2ad3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 16:54:07 +0100
+Subject: block: end bio with BLK_STS_AGAIN in case of non-mq devs and
+ REQ_NOWAIT
+
+From: Roman Penyaev <rpenyaev@suse.de>
+
+[ Upstream commit c58c1f83436b501d45d4050fd1296d71a9760bcb ]
+
+Non-mq devs do not honor REQ_NOWAIT so give a chance to the caller to repeat
+request gracefully on -EAGAIN error.
+
+The problem is well reproduced using io_uring:
+
+ mkfs.ext4 /dev/ram0
+ mount /dev/ram0 /mnt
+
+ # Preallocate a file
+ dd if=/dev/zero of=/mnt/file bs=1M count=1
+
+ # Start fio with io_uring and get -EIO
+ fio --rw=write --ioengine=io_uring --size=1M --direct=1 --name=job --filename=/mnt/file
+
+Signed-off-by: Roman Penyaev <rpenyaev@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index d5e668ec751b..1075aaff606d 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -886,11 +886,14 @@ generic_make_request_checks(struct bio *bio)
+ }
+
+ /*
+- * For a REQ_NOWAIT based request, return -EOPNOTSUPP
+- * if queue is not a request based queue.
++ * Non-mq queues do not honor REQ_NOWAIT, so complete a bio
++ * with BLK_STS_AGAIN status in order to catch -EAGAIN and
++ * to give a chance to the caller to repeat request gracefully.
+ */
+- if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q))
+- goto not_supported;
++ if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) {
++ status = BLK_STS_AGAIN;
++ goto end_io;
++ }
+
+ if (should_fail_bio(bio))
+ goto end_io;
+--
+2.20.1
+
--- /dev/null
+From 1ae156f113ca1f2e59fbf0b5836fb882015ee392 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 16:24:35 -0800
+Subject: block: Fix a lockdep complaint triggered by request queue flushing
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit b3c6a59975415bde29cfd76ff1ab008edbf614a9 ]
+
+Avoid that running test nvme/012 from the blktests suite triggers the
+following false positive lockdep complaint:
+
+============================================
+WARNING: possible recursive locking detected
+5.0.0-rc3-xfstests-00015-g1236f7d60242 #841 Not tainted
+--------------------------------------------
+ksoftirqd/1/16 is trying to acquire lock:
+000000000282032e (&(&fq->mq_flush_lock)->rlock){..-.}, at: flush_end_io+0x4e/0x1d0
+
+but task is already holding lock:
+00000000cbadcbc2 (&(&fq->mq_flush_lock)->rlock){..-.}, at: flush_end_io+0x4e/0x1d0
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&(&fq->mq_flush_lock)->rlock);
+ lock(&(&fq->mq_flush_lock)->rlock);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+1 lock held by ksoftirqd/1/16:
+ #0: 00000000cbadcbc2 (&(&fq->mq_flush_lock)->rlock){..-.}, at: flush_end_io+0x4e/0x1d0
+
+stack backtrace:
+CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.0.0-rc3-xfstests-00015-g1236f7d60242 #841
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ dump_stack+0x67/0x90
+ __lock_acquire.cold.45+0x2b4/0x313
+ lock_acquire+0x98/0x160
+ _raw_spin_lock_irqsave+0x3b/0x80
+ flush_end_io+0x4e/0x1d0
+ blk_mq_complete_request+0x76/0x110
+ nvmet_req_complete+0x15/0x110 [nvmet]
+ nvmet_bio_done+0x27/0x50 [nvmet]
+ blk_update_request+0xd7/0x2d0
+ blk_mq_end_request+0x1a/0x100
+ blk_flush_complete_seq+0xe5/0x350
+ flush_end_io+0x12f/0x1d0
+ blk_done_softirq+0x9f/0xd0
+ __do_softirq+0xca/0x440
+ run_ksoftirqd+0x24/0x50
+ smpboot_thread_fn+0x113/0x1e0
+ kthread+0x121/0x140
+ ret_from_fork+0x3a/0x50
+
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-flush.c | 5 +++++
+ block/blk.h | 1 +
+ 2 files changed, 6 insertions(+)
+
+diff --git a/block/blk-flush.c b/block/blk-flush.c
+index 1eec9cbe5a0a..b1f0a1ac505c 100644
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -69,6 +69,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/gfp.h>
+ #include <linux/blk-mq.h>
++#include <linux/lockdep.h>
+
+ #include "blk.h"
+ #include "blk-mq.h"
+@@ -492,6 +493,9 @@ struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q,
+ INIT_LIST_HEAD(&fq->flush_queue[1]);
+ INIT_LIST_HEAD(&fq->flush_data_in_flight);
+
++ lockdep_register_key(&fq->key);
++ lockdep_set_class(&fq->mq_flush_lock, &fq->key);
++
+ return fq;
+
+ fail_rq:
+@@ -506,6 +510,7 @@ void blk_free_flush_queue(struct blk_flush_queue *fq)
+ if (!fq)
+ return;
+
++ lockdep_unregister_key(&fq->key);
+ kfree(fq->flush_rq);
+ kfree(fq);
+ }
+diff --git a/block/blk.h b/block/blk.h
+index 47fba9362e60..ffea1691470e 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -30,6 +30,7 @@ struct blk_flush_queue {
+ * at the same time
+ */
+ struct request *orig_rq;
++ struct lock_class_key key;
+ spinlock_t mq_flush_lock;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 0126026f41dd9fa6ae20dd58974391be32d4c2bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 16:44:04 +0800
+Subject: block: fix memleak when __blk_rq_map_user_iov() is failed
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 3b7995a98ad76da5597b488fa84aa5a56d43b608 ]
+
+When I doing fuzzy test, get the memleak report:
+
+BUG: memory leak
+unreferenced object 0xffff88837af80000 (size 4096):
+ comm "memleak", pid 3557, jiffies 4294817681 (age 112.499s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 20 00 00 00 10 01 00 00 00 00 00 00 01 00 00 00 ...............
+ backtrace:
+ [<000000001c894df8>] bio_alloc_bioset+0x393/0x590
+ [<000000008b139a3c>] bio_copy_user_iov+0x300/0xcd0
+ [<00000000a998bd8c>] blk_rq_map_user_iov+0x2f1/0x5f0
+ [<000000005ceb7f05>] blk_rq_map_user+0xf2/0x160
+ [<000000006454da92>] sg_common_write.isra.21+0x1094/0x1870
+ [<00000000064bb208>] sg_write.part.25+0x5d9/0x950
+ [<000000004fc670f6>] sg_write+0x5f/0x8c
+ [<00000000b0d05c7b>] __vfs_write+0x7c/0x100
+ [<000000008e177714>] vfs_write+0x1c3/0x500
+ [<0000000087d23f34>] ksys_write+0xf9/0x200
+ [<000000002c8dbc9d>] do_syscall_64+0x9f/0x4f0
+ [<00000000678d8e9a>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+If __blk_rq_map_user_iov() is failed in blk_rq_map_user_iov(),
+the bio(s) which is allocated before this failing will leak. The
+refcount of the bio(s) is init to 1 and increased to 2 by calling
+bio_get(), but __blk_rq_unmap_user() only decrease it to 1, so
+the bio cannot be freed. Fix it by calling blk_rq_unmap_user().
+
+Reviewed-by: Bob Liu <bob.liu@oracle.com>
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-map.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-map.c b/block/blk-map.c
+index 3a62e471d81b..b0790268ed9d 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -151,7 +151,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ return 0;
+
+ unmap_rq:
+- __blk_rq_unmap_user(bio);
++ blk_rq_unmap_user(bio);
+ fail:
+ rq->bio = NULL;
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From e02551064b92228c06a84b69f0f201b63874c49e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 09:59:55 -0800
+Subject: bnx2x: Do not handle requests from VFs after parity
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 7113f796bbbced2470cd6d7379d50d7a7a78bf34 ]
+
+Parity error from the hardware will cause PF to lose the state
+of their VFs due to PF's internal reload and hardware reset following
+the parity error. Restrict any configuration request from the VFs after
+the parity as it could cause unexpected hardware behavior, only way
+for VFs to recover would be to trigger FLR on VFs and reload them.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 12 ++++++++++--
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 +
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 12 ++++++++++++
+ 3 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 192ff8d5da32..cff64e43bdd8 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9976,10 +9976,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp)
+ */
+ static void bnx2x_parity_recover(struct bnx2x *bp)
+ {
+- bool global = false;
+ u32 error_recovered, error_unrecovered;
+- bool is_parity;
++ bool is_parity, global = false;
++#ifdef CONFIG_BNX2X_SRIOV
++ int vf_idx;
++
++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) {
++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx);
+
++ if (vf)
++ vf->state = VF_LOST;
++ }
++#endif
+ DP(NETIF_MSG_HW, "Handling parity\n");
+ while (1) {
+ switch (bp->recovery_state) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+index b6ebd92ec565..3a716c015415 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+@@ -139,6 +139,7 @@ struct bnx2x_virtf {
+ #define VF_ACQUIRED 1 /* VF acquired, but not initialized */
+ #define VF_ENABLED 2 /* VF Enabled */
+ #define VF_RESET 3 /* VF FLR'd, pending cleanup */
++#define VF_LOST 4 /* Recovery while VFs are loaded */
+
+ bool flr_clnup_stage; /* true during flr cleanup */
+ bool malicious; /* true if FW indicated so, until FLR */
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+index 0752b7fa4d9c..ea0e9394f898 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+@@ -2107,6 +2107,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
+ {
+ int i;
+
++ if (vf->state == VF_LOST) {
++ /* Just ack the FW and return if VFs are lost
++ * in case of parity error. VFs are supposed to be timedout
++ * on waiting for PF response.
++ */
++ DP(BNX2X_MSG_IOV,
++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid);
++
++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
++ return;
++ }
++
+ /* check if tlv type is known */
+ if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) {
+ /* Lock the per vf op mutex and note the locker's identity.
+--
+2.20.1
+
--- /dev/null
+From 46e8fe20a4dd1b71ec8e4a005cf7239f1d05c050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 09:59:56 -0800
+Subject: bnx2x: Fix logic to get total no. of PFs per engine
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit ee699f89bdbaa19c399804504241b5c531b48888 ]
+
+Driver doesn't calculate total number of PFs configured on a
+given engine correctly which messed up resources in the PFs
+loaded on that engine, leading driver to exceed configuration
+of resources (like vlan filters etc.) beyond the limit per
+engine, which ended up with asserts from the firmware.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index 8b08cb18e363..3f63ffd7561b 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -1109,7 +1109,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
+ for (i = 0; i < E1H_FUNC_MAX / 2; i++) {
+ u32 func_config =
+ MF_CFG_RD(bp,
+- func_mf_config[BP_PORT(bp) + 2 * i].
++ func_mf_config[BP_PATH(bp) + 2 * i].
+ config);
+ func_num +=
+ ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1);
+--
+2.20.1
+
--- /dev/null
+From 48af9711f450f75d1cdc3079de8155db32370cd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 18:08:17 +0000
+Subject: bpf: Clear skb->tstamp in bpf_redirect when necessary
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit 5133498f4ad1123a5ffd4c08df6431dab882cc32 ]
+
+Redirecting a packet from ingress to egress by using bpf_redirect
+breaks if the egress interface has an fq qdisc installed. This is the same
+problem as fixed in 'commit 8203e2d844d3 ("net: clear skb->tstamp in forwarding paths")
+
+Clear skb->tstamp when redirecting into the egress path.
+
+Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.")
+Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC")
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Link: https://lore.kernel.org/bpf/20191213180817.2510-1-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 6d0111bfdb4a..2f76461c120d 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -2055,6 +2055,7 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
+ }
+
+ skb->dev = dev;
++ skb->tstamp = 0;
+
+ dev_xmit_recursion_inc();
+ ret = dev_queue_xmit(skb);
+--
+2.20.1
+
--- /dev/null
+From 1b4a30d3b1867d44887149b75104c4091f35223e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 19:52:52 +0100
+Subject: bpf, mips: Limit to 33 tail calls
+
+From: Paul Chaignon <paul.chaignon@orange.com>
+
+[ Upstream commit e49e6f6db04e915dccb494ae10fa14888fea6f89 ]
+
+All BPF JIT compilers except RISC-V's and MIPS' enforce a 33-tail calls
+limit at runtime. In addition, a test was recently added, in tailcalls2,
+to check this limit.
+
+This patch updates the tail call limit in MIPS' JIT compiler to allow
+33 tail calls.
+
+Fixes: b6bd53f9c4e8 ("MIPS: Add missing file for eBPF JIT.")
+Reported-by: Mahshid Khezri <khezri.mahshid@gmail.com>
+Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/b8eb2caac1c25453c539248e56ca22f74b5316af.1575916815.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/net/ebpf_jit.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
+index a2405d5f7d1e..561154cbcc40 100644
+--- a/arch/mips/net/ebpf_jit.c
++++ b/arch/mips/net/ebpf_jit.c
+@@ -604,6 +604,7 @@ static void emit_const_to_reg(struct jit_ctx *ctx, int dst, u64 value)
+ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx)
+ {
+ int off, b_off;
++ int tcc_reg;
+
+ ctx->flags |= EBPF_SEEN_TC;
+ /*
+@@ -616,14 +617,14 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx, int this_idx)
+ b_off = b_imm(this_idx + 1, ctx);
+ emit_instr(ctx, bne, MIPS_R_AT, MIPS_R_ZERO, b_off);
+ /*
+- * if (--TCC < 0)
++ * if (TCC-- < 0)
+ * goto out;
+ */
+ /* Delay slot */
+- emit_instr(ctx, daddiu, MIPS_R_T5,
+- (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4, -1);
++ tcc_reg = (ctx->flags & EBPF_TCC_IN_V1) ? MIPS_R_V1 : MIPS_R_S4;
++ emit_instr(ctx, daddiu, MIPS_R_T5, tcc_reg, -1);
+ b_off = b_imm(this_idx + 1, ctx);
+- emit_instr(ctx, bltz, MIPS_R_T5, b_off);
++ emit_instr(ctx, bltz, tcc_reg, b_off);
+ /*
+ * prog = array->ptrs[index];
+ * if (prog == NULL)
+--
+2.20.1
+
--- /dev/null
+From f522c2c36e486d2225b323abfc278aad7c51812a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 19:52:07 +0100
+Subject: bpf, riscv: Limit to 33 tail calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Chaignon <paul.chaignon@orange.com>
+
+[ Upstream commit 96bc4432f5ade1045521f3b247f516b1478166bd ]
+
+All BPF JIT compilers except RISC-V's and MIPS' enforce a 33-tail calls
+limit at runtime. In addition, a test was recently added, in tailcalls2,
+to check this limit.
+
+This patch updates the tail call limit in RISC-V's JIT compiler to allow
+33 tail calls. I tested it using the above selftest on an emulated
+RISCV64.
+
+Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
+Reported-by: Mahshid Khezri <khezri.mahshid@gmail.com>
+Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Björn Töpel <bjorn.topel@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/966fe384383bf23a0ee1efe8d7291c78a3fb832b.1575916815.git.paul.chaignon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/net/bpf_jit_comp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/net/bpf_jit_comp.c b/arch/riscv/net/bpf_jit_comp.c
+index 5451ef3845f2..7fbf56aab661 100644
+--- a/arch/riscv/net/bpf_jit_comp.c
++++ b/arch/riscv/net/bpf_jit_comp.c
+@@ -631,14 +631,14 @@ static int emit_bpf_tail_call(int insn, struct rv_jit_context *ctx)
+ return -1;
+ emit(rv_bgeu(RV_REG_A2, RV_REG_T1, off >> 1), ctx);
+
+- /* if (--TCC < 0)
++ /* if (TCC-- < 0)
+ * goto out;
+ */
+ emit(rv_addi(RV_REG_T1, tcc, -1), ctx);
+ off = (tc_ninsn - (ctx->ninsns - start_insn)) << 2;
+ if (is_13b_check(off, insn))
+ return -1;
+- emit(rv_blt(RV_REG_T1, RV_REG_ZERO, off >> 1), ctx);
++ emit(rv_blt(tcc, RV_REG_ZERO, off >> 1), ctx);
+
+ /* prog = array->ptrs[index];
+ * if (!prog)
+--
+2.20.1
+
--- /dev/null
+From 4ddd23d1319cca4ff483c5e18dc3b29c248e3f1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 19:14:12 +0100
+Subject: bpftool: Don't crash on missing jited insns or ksyms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 5b79bcdf03628a3a9ee04d9cd5fabcf61a8e20be ]
+
+When the kptr_restrict sysctl is set, the kernel can fail to return
+jited_ksyms or jited_prog_insns, but still have positive values in
+nr_jited_ksyms and jited_prog_len. This causes bpftool to crash when
+trying to dump the program because it only checks the len fields not
+the actual pointers to the instructions and ksyms.
+
+Fix this by adding the missing checks.
+
+Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool")
+Fixes: f84192ee00b7 ("tools: bpftool: resolve calls without using imm field")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20191210181412.151226-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/prog.c | 2 +-
+ tools/bpf/bpftool/xlated_dumper.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index 43fdbbfe41bb..ea0bcd58bcb9 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -493,7 +493,7 @@ static int do_dump(int argc, char **argv)
+
+ info = &info_linear->info;
+ if (mode == DUMP_JITED) {
+- if (info->jited_prog_len == 0) {
++ if (info->jited_prog_len == 0 || !info->jited_prog_insns) {
+ p_info("no instructions returned");
+ goto err_free;
+ }
+diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
+index 494d7ae3614d..5b91ee65a080 100644
+--- a/tools/bpf/bpftool/xlated_dumper.c
++++ b/tools/bpf/bpftool/xlated_dumper.c
+@@ -174,7 +174,7 @@ static const char *print_call(void *private_data,
+ struct kernel_sym *sym;
+
+ if (insn->src_reg == BPF_PSEUDO_CALL &&
+- (__u32) insn->imm < dd->nr_jited_ksyms)
++ (__u32) insn->imm < dd->nr_jited_ksyms && dd->jited_ksyms)
+ address = dd->jited_ksyms[insn->imm];
+
+ sym = kernel_syms_search(dd, address);
+--
+2.20.1
+
--- /dev/null
+From ea6695bec0e0600e245605a82b22e749b8614713 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 16:57:39 +0000
+Subject: Btrfs: fix cloning range with a hole when using the NO_HOLES feature
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit fcb970581dd900675c4371c2b688a57924a8368c ]
+
+When using the NO_HOLES feature if we clone a range that contains a hole
+and a temporary ENOSPC happens while dropping extents from the target
+inode's range, we can end up failing and aborting the transaction with
+-EEXIST or with a corrupt file extent item, that has a length greater
+than it should and overlaps with other extents. For example when cloning
+the following range from inode A to inode B:
+
+ Inode A:
+
+ extent A1 extent A2
+ [ ----------- ] [ hole, implicit, 4MB length ] [ ------------- ]
+ 0 1MB 5MB 6MB
+
+ Range to clone: [1MB, 6MB)
+
+ Inode B:
+
+ extent B1 extent B2 extent B3 extent B4
+ [ ---------- ] [ --------- ] [ ---------- ] [ ---------- ]
+ 0 1MB 1MB 2MB 2MB 5MB 5MB 6MB
+
+ Target range: [1MB, 6MB) (same as source, to make it easier to explain)
+
+The following can happen:
+
+1) btrfs_punch_hole_range() gets -ENOSPC from __btrfs_drop_extents();
+
+2) At that point, 'cur_offset' is set to 1MB and __btrfs_drop_extents()
+ set 'drop_end' to 2MB, meaning it was able to drop only extent B2;
+
+3) We then compute 'clone_len' as 'drop_end' - 'cur_offset' = 2MB - 1MB =
+ 1MB;
+
+4) We then attempt to insert a file extent item at inode B with a file
+ offset of 5MB, which is the value of clone_info->file_offset. This
+ fails with error -EEXIST because there's already an extent at that
+ offset (extent B4);
+
+5) We abort the current transaction with -EEXIST and return that error
+ to user space as well.
+
+Another example, for extent corruption:
+
+ Inode A:
+
+ extent A1 extent A2
+ [ ----------- ] [ hole, implicit, 10MB length ] [ ------------- ]
+ 0 1MB 11MB 12MB
+
+ Inode B:
+
+ extent B1 extent B2
+ [ ----------- ] [ --------- ] [ ----------------------------- ]
+ 0 1MB 1MB 5MB 5MB 12MB
+
+ Target range: [1MB, 12MB) (same as source, to make it easier to explain)
+
+1) btrfs_punch_hole_range() gets -ENOSPC from __btrfs_drop_extents();
+
+2) At that point, 'cur_offset' is set to 1MB and __btrfs_drop_extents()
+ set 'drop_end' to 5MB, meaning it was able to drop only extent B2;
+
+3) We then compute 'clone_len' as 'drop_end' - 'cur_offset' = 5MB - 1MB =
+ 4MB;
+
+4) We then insert a file extent item at inode B with a file offset of 11MB
+ which is the value of clone_info->file_offset, and a length of 4MB (the
+ value of 'clone_len'). So we get 2 extents items with ranges that
+ overlap and an extent length of 4MB, larger then the extent A2 from
+ inode A (1MB length);
+
+5) After that we end the transaction, balance the btree dirty pages and
+ then start another or join the previous transaction. It might happen
+ that the transaction which inserted the incorrect extent was committed
+ by another task so we end up with extent corruption if a power failure
+ happens.
+
+So fix this by making sure we attempt to insert the extent to clone at
+the destination inode only if we are past dropping the sub-range that
+corresponds to a hole.
+
+Fixes: 690a5dbfc51315 ("Btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning extents")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index c332968f9056..eaafd00f93d4 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2601,8 +2601,8 @@ int btrfs_punch_hole_range(struct inode *inode, struct btrfs_path *path,
+ }
+ }
+
+- if (clone_info) {
+- u64 clone_len = drop_end - cur_offset;
++ if (clone_info && drop_end > clone_info->file_offset) {
++ u64 clone_len = drop_end - clone_info->file_offset;
+
+ ret = btrfs_insert_clone_extent(trans, inode, path,
+ clone_info, clone_len);
+--
+2.20.1
+
--- /dev/null
+From d11bd0b860a8522faa83f27a9a3ad007170df94d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 14:16:44 +0200
+Subject: btrfs: Fix error messages in qgroup_rescan_init
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit 37d02592f11bb76e4ab1dcaa5b8a2a0715403207 ]
+
+The branch of qgroup_rescan_init which is executed from the mount
+path prints wrong errors messages. The textual print out in case
+BTRFS_QGROUP_STATUS_FLAG_RESCAN/BTRFS_QGROUP_STATUS_FLAG_ON are not
+set are transposed. Fix it by exchanging their place.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 27a903aaf43b..aeb5f2f3cdd7 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3232,12 +3232,12 @@ qgroup_rescan_init(struct btrfs_fs_info *fs_info, u64 progress_objectid,
+ if (!(fs_info->qgroup_flags &
+ BTRFS_QGROUP_STATUS_FLAG_RESCAN)) {
+ btrfs_warn(fs_info,
+- "qgroup rescan init failed, qgroup is not enabled");
++ "qgroup rescan init failed, qgroup rescan is not queued");
+ ret = -EINVAL;
+ } else if (!(fs_info->qgroup_flags &
+ BTRFS_QGROUP_STATUS_FLAG_ON)) {
+ btrfs_warn(fs_info,
+- "qgroup rescan init failed, qgroup rescan is not queued");
++ "qgroup rescan init failed, qgroup is not enabled");
+ ret = -EINVAL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From da0dbfa867ef345b79441b3ebae253c2d6741ab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 16:58:41 +0000
+Subject: Btrfs: fix hole extent items with a zero size after range cloning
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 147271e35ba267506dde6550f58ccf8d287db3ef ]
+
+Normally when cloning a file range if we find an implicit hole at the end
+of the range we assume it is because the NO_HOLES feature is enabled.
+However that is not always the case. One well known case [1] is when we
+have a power failure after mixing buffered and direct IO writes against
+the same file.
+
+In such cases we need to punch a hole in the destination file, and if
+the NO_HOLES feature is not enabled, we need to insert explicit file
+extent items to represent the hole. After commit 690a5dbfc51315
+("Btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning
+extents"), we started to insert file extent items representing the hole
+with an item size of 0, which is invalid and should be 53 bytes (the size
+of a btrfs_file_extent_item structure), resulting in all sorts of
+corruptions and invalid memory accesses. This is detected by the tree
+checker when we attempt to write a leaf to disk.
+
+The problem can be sporadically triggered by test case generic/561 from
+fstests. That test case does not exercise power failure and creates a new
+filesystem when it starts, so it does not use a filesystem created by any
+previous test that tests power failure. However the test does both
+buffered and direct IO writes (through fsstress) and it's precisely that
+which is creating the implicit holes in files. That happens even before
+the commit mentioned earlier. I need to investigate why we get those
+implicit holes to check if there is a real problem or not. For now this
+change fixes the regression of introducing file extent items with an item
+size of 0 bytes.
+
+Fix the issue by calling btrfs_punch_hole_range() without passing a
+btrfs_clone_extent_info structure, which ensures file extent items are
+inserted to represent the hole with a correct item size. We were passing
+a btrfs_clone_extent_info with a value of 0 for its 'item_size' field,
+which was causing the insertion of file extent items with an item size
+of 0.
+
+[1] https://www.spinics.net/lists/linux-btrfs/msg75350.html
+
+Reported-by: David Sterba <dsterba@suse.com>
+Fixes: 690a5dbfc51315 ("Btrfs: fix ENOSPC errors, leading to transaction aborts, when cloning extents")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ioctl.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index a56dcc0c9c2a..5720e450a46f 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3727,24 +3727,18 @@ static int btrfs_clone(struct inode *src, struct inode *inode,
+ ret = 0;
+
+ if (last_dest_end < destoff + len) {
+- struct btrfs_clone_extent_info clone_info = { 0 };
+ /*
+- * We have an implicit hole (NO_HOLES feature is enabled) that
+- * fully or partially overlaps our cloning range at its end.
++ * We have an implicit hole that fully or partially overlaps our
++ * cloning range at its end. This means that we either have the
++ * NO_HOLES feature enabled or the implicit hole happened due to
++ * mixing buffered and direct IO writes against this file.
+ */
+ btrfs_release_path(path);
+ path->leave_spinning = 0;
+
+- /*
+- * We are dealing with a hole and our clone_info already has a
+- * disk_offset of 0, we only need to fill the data length and
+- * file offset.
+- */
+- clone_info.data_len = destoff + len - last_dest_end;
+- clone_info.file_offset = last_dest_end;
+ ret = btrfs_punch_hole_range(inode, path,
+ last_dest_end, destoff + len - 1,
+- &clone_info, &trans);
++ NULL, &trans);
+ if (ret)
+ goto out;
+
+--
+2.20.1
+
--- /dev/null
+From b2f9cdae2b5b5a541818d800230576a2613fbd36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 13:59:00 -0500
+Subject: btrfs: handle error in btrfs_cache_block_group
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit db8fe64f9ce61d1d89d3c3c34d111a43afb9f053 ]
+
+We have a BUG_ON(ret < 0) in find_free_extent from
+btrfs_cache_block_group. If we fail to allocate our ctl we'll just
+panic, which is not good. Instead just go on to another block group.
+If we fail to find a block group we don't want to return ENOSPC, because
+really we got a ENOMEM and that's the root of the problem. Save our
+return from btrfs_cache_block_group(), and then if we still fail to make
+our allocation return that ret so we get the right error back.
+
+Tested with inject-error.py from bcc.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index eb95ed78a18e..dc50605ecbda 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3781,6 +3781,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ u64 flags, int delalloc)
+ {
+ int ret = 0;
++ int cache_block_group_error = 0;
+ struct btrfs_free_cluster *last_ptr = NULL;
+ struct btrfs_block_group_cache *block_group = NULL;
+ struct find_free_extent_ctl ffe_ctl = {0};
+@@ -3940,7 +3941,20 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ if (unlikely(!ffe_ctl.cached)) {
+ ffe_ctl.have_caching_bg = true;
+ ret = btrfs_cache_block_group(block_group, 0);
+- BUG_ON(ret < 0);
++
++ /*
++ * If we get ENOMEM here or something else we want to
++ * try other block groups, because it may not be fatal.
++ * However if we can't find anything else we need to
++ * save our return here so that we return the actual
++ * error that caused problems, not ENOSPC.
++ */
++ if (ret < 0) {
++ if (!cache_block_group_error)
++ cache_block_group_error = ret;
++ ret = 0;
++ goto loop;
++ }
+ ret = 0;
+ }
+
+@@ -4027,7 +4041,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ if (ret > 0)
+ goto search;
+
+- if (ret == -ENOSPC) {
++ if (ret == -ENOSPC && !cache_block_group_error) {
+ /*
+ * Use ffe_ctl->total_free_space as fallback if we can't find
+ * any contiguous hole.
+@@ -4038,6 +4052,8 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ space_info->max_extent_size = ffe_ctl.max_extent_size;
+ spin_unlock(&space_info->lock);
+ ins->offset = ffe_ctl.max_extent_size;
++ } else if (ret == -ENOSPC) {
++ ret = cache_block_group_error;
+ }
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3fa81c391fe83ae477fa47c55c7c20fbcf5a304c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 08:20:10 -0800
+Subject: bus: ti-sysc: Fix missing reset delay handling
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit e709ed70d122e94cb426b1e1f905829eae19a009 ]
+
+We have dts property for "ti,sysc-delay-us", and we're using it, but the
+wait after OCP softreset only happens if devices are probed in legacy mode.
+
+Let's add a delay after writing the OCP softreset when specified.
+
+Fixes: e0db94fe87da ("bus: ti-sysc: Make OCP reset work for sysstatus and sysconfig reset bits")
+Cc: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 2b6670daf7fc..34bd9bf4e68a 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1594,6 +1594,10 @@ static int sysc_reset(struct sysc *ddata)
+ sysc_val |= sysc_mask;
+ sysc_write(ddata, sysc_offset, sysc_val);
+
++ if (ddata->cfg.srst_udelay)
++ usleep_range(ddata->cfg.srst_udelay,
++ ddata->cfg.srst_udelay * 2);
++
+ if (ddata->clk_enable_quirk)
+ ddata->clk_enable_quirk(ddata);
+
+--
+2.20.1
+
--- /dev/null
+From 8ce8223d389befbc650e34327caebb1db2a42c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 11:05:44 +0100
+Subject: cfg80211: fix double-free after changing network namespace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Bühler <source@stbuehler.de>
+
+[ Upstream commit 56cb31e185adb61f930743a9b70e700a43625386 ]
+
+If wdev->wext.keys was initialized it didn't get reset to NULL on
+unregister (and it doesn't get set in cfg80211_init_wdev either), but
+wdev is reused if unregister was triggered through
+cfg80211_switch_netns.
+
+The next unregister (for whatever reason) will try to free
+wdev->wext.keys again.
+
+Signed-off-by: Stefan Bühler <source@stbuehler.de>
+Link: https://lore.kernel.org/r/20191126100543.782023-1-stefan.buehler@tik.uni-stuttgart.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 350513744575..3e25229a059d 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1102,6 +1102,7 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync)
+
+ #ifdef CONFIG_CFG80211_WEXT
+ kzfree(wdev->wext.keys);
++ wdev->wext.keys = NULL;
+ #endif
+ /* only initialized if we have a netdev */
+ if (wdev->netdev)
+--
+2.20.1
+
--- /dev/null
+From a525c6e2e4321eb261986d9fc98e9702d2b58451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 11:25:31 +0100
+Subject: clk: at91: fix possible deadlock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 6956eb33abb5deab2cd916b4c31226b57736bc3c ]
+
+Lockdep warns about a possible circular locking dependency because using
+syscon_node_to_regmap() will make the created regmap get and enable the
+first clock it can parse from the device tree. This clock is not needed to
+access the registers and should not be enabled at that time.
+
+Use the recently introduced device_node_to_regmap to solve that as it looks
+up the regmap in the same list but doesn't care about the clocks.
+
+Reported-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lkml.kernel.org/r/20191128102531.817549-1-alexandre.belloni@bootlin.com
+Tested-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/at91sam9260.c | 2 +-
+ drivers/clk/at91/at91sam9rl.c | 2 +-
+ drivers/clk/at91/at91sam9x5.c | 2 +-
+ drivers/clk/at91/pmc.c | 2 +-
+ drivers/clk/at91/sama5d2.c | 2 +-
+ drivers/clk/at91/sama5d4.c | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/at91/at91sam9260.c b/drivers/clk/at91/at91sam9260.c
+index 0aabe49aed09..a9d4234758d7 100644
+--- a/drivers/clk/at91/at91sam9260.c
++++ b/drivers/clk/at91/at91sam9260.c
+@@ -348,7 +348,7 @@ static void __init at91sam926x_pmc_setup(struct device_node *np,
+ return;
+ mainxtal_name = of_clk_get_parent_name(np, i);
+
+- regmap = syscon_node_to_regmap(np);
++ regmap = device_node_to_regmap(np);
+ if (IS_ERR(regmap))
+ return;
+
+diff --git a/drivers/clk/at91/at91sam9rl.c b/drivers/clk/at91/at91sam9rl.c
+index 0ac34cdaa106..77fe83a73bf4 100644
+--- a/drivers/clk/at91/at91sam9rl.c
++++ b/drivers/clk/at91/at91sam9rl.c
+@@ -83,7 +83,7 @@ static void __init at91sam9rl_pmc_setup(struct device_node *np)
+ return;
+ mainxtal_name = of_clk_get_parent_name(np, i);
+
+- regmap = syscon_node_to_regmap(np);
++ regmap = device_node_to_regmap(np);
+ if (IS_ERR(regmap))
+ return;
+
+diff --git a/drivers/clk/at91/at91sam9x5.c b/drivers/clk/at91/at91sam9x5.c
+index 0855f3a80cc7..086cf0b4955c 100644
+--- a/drivers/clk/at91/at91sam9x5.c
++++ b/drivers/clk/at91/at91sam9x5.c
+@@ -146,7 +146,7 @@ static void __init at91sam9x5_pmc_setup(struct device_node *np,
+ return;
+ mainxtal_name = of_clk_get_parent_name(np, i);
+
+- regmap = syscon_node_to_regmap(np);
++ regmap = device_node_to_regmap(np);
+ if (IS_ERR(regmap))
+ return;
+
+diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c
+index 0b03cfae3a9d..b71515acdec1 100644
+--- a/drivers/clk/at91/pmc.c
++++ b/drivers/clk/at91/pmc.c
+@@ -275,7 +275,7 @@ static int __init pmc_register_ops(void)
+
+ np = of_find_matching_node(NULL, sama5d2_pmc_dt_ids);
+
+- pmcreg = syscon_node_to_regmap(np);
++ pmcreg = device_node_to_regmap(np);
+ if (IS_ERR(pmcreg))
+ return PTR_ERR(pmcreg);
+
+diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c
+index 0de1108737db..ff7e3f727082 100644
+--- a/drivers/clk/at91/sama5d2.c
++++ b/drivers/clk/at91/sama5d2.c
+@@ -162,7 +162,7 @@ static void __init sama5d2_pmc_setup(struct device_node *np)
+ return;
+ mainxtal_name = of_clk_get_parent_name(np, i);
+
+- regmap = syscon_node_to_regmap(np);
++ regmap = device_node_to_regmap(np);
+ if (IS_ERR(regmap))
+ return;
+
+diff --git a/drivers/clk/at91/sama5d4.c b/drivers/clk/at91/sama5d4.c
+index 25b156d4e645..a6dee4a3b6e4 100644
+--- a/drivers/clk/at91/sama5d4.c
++++ b/drivers/clk/at91/sama5d4.c
+@@ -136,7 +136,7 @@ static void __init sama5d4_pmc_setup(struct device_node *np)
+ return;
+ mainxtal_name = of_clk_get_parent_name(np, i);
+
+- regmap = syscon_node_to_regmap(np);
++ regmap = device_node_to_regmap(np);
+ if (IS_ERR(regmap))
+ return;
+
+--
+2.20.1
+
--- /dev/null
+From b9362613c27e6b70d607c4443a525444057fdadc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 09:56:21 -0800
+Subject: clk: Move clk_core_reparent_orphans() under CONFIG_OF
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit c771256ee7a03d3fb3c0443319ae6249c455849d ]
+
+A recent addition exposed a helper that is only used for CONFIG_OF. Move
+it into the CONFIG_OF zone in this file to make the compiler stop
+warning about an unused function.
+
+Fixes: 66d9506440bb ("clk: walk orphan list on clock provider registration")
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Link: https://lkml.kernel.org/r/20191217082501.424892072D@mail.kernel.org
+[sboyd@kernel.org: "Simply" move the function instead]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 9c570bfc40d6..27a95c86a80b 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3259,13 +3259,6 @@ static void clk_core_reparent_orphans_nolock(void)
+ }
+ }
+
+-static void clk_core_reparent_orphans(void)
+-{
+- clk_prepare_lock();
+- clk_core_reparent_orphans_nolock();
+- clk_prepare_unlock();
+-}
+-
+ /**
+ * __clk_core_init - initialize the data structures in a struct clk_core
+ * @core: clk_core being initialized
+@@ -4174,6 +4167,13 @@ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
+ EXPORT_SYMBOL_GPL(clk_notifier_unregister);
+
+ #ifdef CONFIG_OF
++static void clk_core_reparent_orphans(void)
++{
++ clk_prepare_lock();
++ clk_core_reparent_orphans_nolock();
++ clk_prepare_unlock();
++}
++
+ /**
+ * struct of_clk_provider - Clock provider registration structure
+ * @link: Entry in global list of clock providers
+--
+2.20.1
+
--- /dev/null
+From 9aa4248cf27eb071d66340691e135c921bec79df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 09:08:05 +0100
+Subject: clk: walk orphan list on clock provider registration
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 66d9506440bb05289eb4867059e7b8c6ed209717 ]
+
+So far, we walked the orphan list every time a new clock was registered
+in CCF. This was fine since the clocks were only referenced by name.
+
+Now that the clock can be referenced through DT, it is not enough:
+* Controller A register first a reference clocks from controller B
+ through DT.
+* Controller B register all its clocks then register the provider.
+
+Each time controller B registers a new clock, the orphan list is walked
+but it can't match since the provider is registered yet. When the
+provider is finally registered, the orphan list is not walked unless
+another clock is registered afterward.
+
+This can lead to situation where some clocks remain orphaned even if
+the parent is available.
+
+Walking the orphan list on provider registration solves the problem.
+
+Reported-by: Jian Hu <jian.hu@amlogic.com>
+Fixes: fc0c209c147f ("clk: Allow parents to be specified without string names")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lkml.kernel.org/r/20191203080805.104628-1-jbrunet@baylibre.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 62 ++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 40 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 1c677d7f7f53..9c570bfc40d6 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3231,6 +3231,41 @@ static inline void clk_debug_unregister(struct clk_core *core)
+ }
+ #endif
+
++static void clk_core_reparent_orphans_nolock(void)
++{
++ struct clk_core *orphan;
++ struct hlist_node *tmp2;
++
++ /*
++ * walk the list of orphan clocks and reparent any that newly finds a
++ * parent.
++ */
++ hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) {
++ struct clk_core *parent = __clk_init_parent(orphan);
++
++ /*
++ * We need to use __clk_set_parent_before() and _after() to
++ * to properly migrate any prepare/enable count of the orphan
++ * clock. This is important for CLK_IS_CRITICAL clocks, which
++ * are enabled during init but might not have a parent yet.
++ */
++ if (parent) {
++ /* update the clk tree topology */
++ __clk_set_parent_before(orphan, parent);
++ __clk_set_parent_after(orphan, parent, NULL);
++ __clk_recalc_accuracies(orphan);
++ __clk_recalc_rates(orphan, 0);
++ }
++ }
++}
++
++static void clk_core_reparent_orphans(void)
++{
++ clk_prepare_lock();
++ clk_core_reparent_orphans_nolock();
++ clk_prepare_unlock();
++}
++
+ /**
+ * __clk_core_init - initialize the data structures in a struct clk_core
+ * @core: clk_core being initialized
+@@ -3241,8 +3276,6 @@ static inline void clk_debug_unregister(struct clk_core *core)
+ static int __clk_core_init(struct clk_core *core)
+ {
+ int ret;
+- struct clk_core *orphan;
+- struct hlist_node *tmp2;
+ unsigned long rate;
+
+ if (!core)
+@@ -3389,27 +3422,8 @@ static int __clk_core_init(struct clk_core *core)
+ clk_enable_unlock(flags);
+ }
+
+- /*
+- * walk the list of orphan clocks and reparent any that newly finds a
+- * parent.
+- */
+- hlist_for_each_entry_safe(orphan, tmp2, &clk_orphan_list, child_node) {
+- struct clk_core *parent = __clk_init_parent(orphan);
++ clk_core_reparent_orphans_nolock();
+
+- /*
+- * We need to use __clk_set_parent_before() and _after() to
+- * to properly migrate any prepare/enable count of the orphan
+- * clock. This is important for CLK_IS_CRITICAL clocks, which
+- * are enabled during init but might not have a parent yet.
+- */
+- if (parent) {
+- /* update the clk tree topology */
+- __clk_set_parent_before(orphan, parent);
+- __clk_set_parent_after(orphan, parent, NULL);
+- __clk_recalc_accuracies(orphan);
+- __clk_recalc_rates(orphan, 0);
+- }
+- }
+
+ kref_init(&core->ref);
+ out:
+@@ -4255,6 +4269,8 @@ int of_clk_add_provider(struct device_node *np,
+ mutex_unlock(&of_clk_mutex);
+ pr_debug("Added clock from %pOF\n", np);
+
++ clk_core_reparent_orphans();
++
+ ret = of_clk_set_defaults(np, true);
+ if (ret < 0)
+ of_clk_del_provider(np);
+@@ -4290,6 +4306,8 @@ int of_clk_add_hw_provider(struct device_node *np,
+ mutex_unlock(&of_clk_mutex);
+ pr_debug("Added clk_hw provider from %pOF\n", np);
+
++ clk_core_reparent_orphans();
++
+ ret = of_clk_set_defaults(np, true);
+ if (ret < 0)
+ of_clk_del_provider(np);
+--
+2.20.1
+
--- /dev/null
+From 6ce8d1f08cad35a8403eb81a583e815b6a5ecb2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 06:39:39 +0530
+Subject: cxgb4: Fix kernel panic while accessing sge_info
+
+From: Vishal Kulkarni <vishal@chelsio.com>
+
+[ Upstream commit 479a0d1376f6d97c60871442911f1394d4446a25 ]
+
+The sge_info debugfs collects offload queue info even when offload
+capability is disabled and leads to panic.
+
+[ 144.139871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 144.139874] CR2: 0000000000000000 CR3: 000000082d456005 CR4: 00000000001606e0
+[ 144.139876] Call Trace:
+[ 144.139887] sge_queue_start+0x12/0x30 [cxgb4]
+[ 144.139897] seq_read+0x1d4/0x3d0
+[ 144.139906] full_proxy_read+0x50/0x70
+[ 144.139913] vfs_read+0x89/0x140
+[ 144.139916] ksys_read+0x55/0xd0
+[ 144.139924] do_syscall_64+0x5b/0x1d0
+[ 144.139933] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 144.139936] RIP: 0033:0x7f4b01493990
+
+Fix this crash by skipping the offload queue access in sge_qinfo when
+offload capability is disabled
+
+Signed-off-by: Herat Ramani <herat@chelsio.com>
+Signed-off-by: Vishal Kulkarni <vishal@chelsio.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index ae6a47dd7dc9..fb8ade9a05a9 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -2996,6 +2996,9 @@ static int sge_queue_entries(const struct adapter *adap)
+ int tot_uld_entries = 0;
+ int i;
+
++ if (!is_uld(adap))
++ goto lld_only;
++
+ mutex_lock(&uld_mutex);
+ for (i = 0; i < CXGB4_TX_MAX; i++)
+ tot_uld_entries += sge_qinfo_uld_txq_entries(adap, i);
+@@ -3006,6 +3009,7 @@ static int sge_queue_entries(const struct adapter *adap)
+ }
+ mutex_unlock(&uld_mutex);
+
++lld_only:
+ return DIV_ROUND_UP(adap->sge.ethqsets, 4) +
+ tot_uld_entries +
+ DIV_ROUND_UP(MAX_CTRL_QUEUES, 4) + 1;
+--
+2.20.1
+
--- /dev/null
+From 7aeec92919dc7f25ebfd08e4c2d7a9e731d5797c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 19:39:55 +0800
+Subject: drm/exynos: gsc: add missed component_del
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 84c92365b20a44c363b95390ea00dfbdd786f031 ]
+
+The driver forgets to call component_del in remove to match component_add
+in probe.
+Add the missed call to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_gsc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+index 7ae087b0504d..88b6fcaa20be 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -1313,6 +1313,7 @@ static int gsc_remove(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+
++ component_del(dev, &gsc_component_ops);
+ pm_runtime_dont_use_autosuspend(dev);
+ pm_runtime_disable(dev);
+
+--
+2.20.1
+
--- /dev/null
+From e6d5a8917a10483a734096fa45fb99da52fe503d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:55:42 +0000
+Subject: efi/earlycon: Remap entire framebuffer after page initialization
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit b418d660bb9798d2249ac6a46c844389ef50b6a5 ]
+
+When commit:
+
+ 69c1f396f25b ("efi/x86: Convert x86 EFI earlyprintk into generic earlycon implementation")
+
+moved the x86 specific EFI earlyprintk implementation to a shared location,
+it also tweaked the behaviour. In particular, it dropped a trick with full
+framebuffer remapping after page initialization, leading to two regressions:
+
+ 1) very slow scrolling after page initialization,
+ 2) kernel hang when the 'keep_bootcon' command line argument is passed.
+
+Putting the tweak back fixes #2 and mitigates #1, i.e., it limits the slow
+behavior to the early boot stages, presumably due to eliminating heavy
+map()/unmap() operations per each pixel line on the screen.
+
+ [ ardb: ensure efifb is unmapped again unless keep_bootcon is in effect. ]
+ [ mingo: speling fixes. ]
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Cc: linux-efi@vger.kernel.org
+Fixes: 69c1f396f25b ("efi/x86: Convert x86 EFI earlyprintk into generic earlycon implementation")
+Link: https://lkml.kernel.org/r/20191206165542.31469-7-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/earlycon.c | 40 +++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/drivers/firmware/efi/earlycon.c b/drivers/firmware/efi/earlycon.c
+index c9a0efca17b0..d4077db6dc97 100644
+--- a/drivers/firmware/efi/earlycon.c
++++ b/drivers/firmware/efi/earlycon.c
+@@ -13,18 +13,57 @@
+
+ #include <asm/early_ioremap.h>
+
++static const struct console *earlycon_console __initdata;
+ static const struct font_desc *font;
+ static u32 efi_x, efi_y;
+ static u64 fb_base;
+ static pgprot_t fb_prot;
++static void *efi_fb;
++
++/*
++ * EFI earlycon needs to use early_memremap() to map the framebuffer.
++ * But early_memremap() is not usable for 'earlycon=efifb keep_bootcon',
++ * memremap() should be used instead. memremap() will be available after
++ * paging_init() which is earlier than initcall callbacks. Thus adding this
++ * early initcall function early_efi_map_fb() to map the whole EFI framebuffer.
++ */
++static int __init efi_earlycon_remap_fb(void)
++{
++ /* bail if there is no bootconsole or it has been disabled already */
++ if (!earlycon_console || !(earlycon_console->flags & CON_ENABLED))
++ return 0;
++
++ if (pgprot_val(fb_prot) == pgprot_val(PAGE_KERNEL))
++ efi_fb = memremap(fb_base, screen_info.lfb_size, MEMREMAP_WB);
++ else
++ efi_fb = memremap(fb_base, screen_info.lfb_size, MEMREMAP_WC);
++
++ return efi_fb ? 0 : -ENOMEM;
++}
++early_initcall(efi_earlycon_remap_fb);
++
++static int __init efi_earlycon_unmap_fb(void)
++{
++ /* unmap the bootconsole fb unless keep_bootcon has left it enabled */
++ if (efi_fb && !(earlycon_console->flags & CON_ENABLED))
++ memunmap(efi_fb);
++ return 0;
++}
++late_initcall(efi_earlycon_unmap_fb);
+
+ static __ref void *efi_earlycon_map(unsigned long start, unsigned long len)
+ {
++ if (efi_fb)
++ return efi_fb + start;
++
+ return early_memremap_prot(fb_base + start, len, pgprot_val(fb_prot));
+ }
+
+ static __ref void efi_earlycon_unmap(void *addr, unsigned long len)
+ {
++ if (efi_fb)
++ return;
++
+ early_memunmap(addr, len);
+ }
+
+@@ -201,6 +240,7 @@ static int __init efi_earlycon_setup(struct earlycon_device *device,
+ efi_earlycon_scroll_up();
+
+ device->con->write = efi_earlycon_write;
++ earlycon_console = device->con;
+ return 0;
+ }
+ EARLYCON_DECLARE(efifb, efi_earlycon_setup);
+--
+2.20.1
+
--- /dev/null
+From a1b12fc8274e7af82d29c18c43b6a2a7110bb5e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:55:40 +0000
+Subject: efi/gop: Fix memory leak in __gop_query32/64()
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit ff397be685e410a59c34b21ce0c55d4daa466bb7 ]
+
+efi_graphics_output_protocol::query_mode() returns info in
+callee-allocated memory which must be freed by the caller, which
+we aren't doing.
+
+We don't actually need to call query_mode() in order to obtain the
+info for the current graphics mode, which is already there in
+gop->mode->info, so just access it directly in the setup_gop32/64()
+functions.
+
+Also nothing uses the size of the info structure, so don't update the
+passed-in size (which is the size of the gop_handle table in bytes)
+unnecessarily.
+
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20191206165542.31469-5-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/libstub/gop.c | 66 ++++++------------------------
+ 1 file changed, 12 insertions(+), 54 deletions(-)
+
+diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
+index 69b2b019a1d0..b7bf1e993b8b 100644
+--- a/drivers/firmware/efi/libstub/gop.c
++++ b/drivers/firmware/efi/libstub/gop.c
+@@ -83,30 +83,6 @@ setup_pixel_info(struct screen_info *si, u32 pixels_per_scan_line,
+ }
+ }
+
+-static efi_status_t
+-__gop_query32(efi_system_table_t *sys_table_arg,
+- struct efi_graphics_output_protocol_32 *gop32,
+- struct efi_graphics_output_mode_info **info,
+- unsigned long *size, u64 *fb_base)
+-{
+- struct efi_graphics_output_protocol_mode_32 *mode;
+- efi_graphics_output_protocol_query_mode query_mode;
+- efi_status_t status;
+- unsigned long m;
+-
+- m = gop32->mode;
+- mode = (struct efi_graphics_output_protocol_mode_32 *)m;
+- query_mode = (void *)(unsigned long)gop32->query_mode;
+-
+- status = __efi_call_early(query_mode, (void *)gop32, mode->mode, size,
+- info);
+- if (status != EFI_SUCCESS)
+- return status;
+-
+- *fb_base = mode->frame_buffer_base;
+- return status;
+-}
+-
+ static efi_status_t
+ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ efi_guid_t *proto, unsigned long size, void **gop_handle)
+@@ -128,6 +104,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ nr_gops = size / sizeof(u32);
+ for (i = 0; i < nr_gops; i++) {
++ struct efi_graphics_output_protocol_mode_32 *mode;
+ struct efi_graphics_output_mode_info *info = NULL;
+ efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID;
+ bool conout_found = false;
+@@ -145,9 +122,11 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ if (status == EFI_SUCCESS)
+ conout_found = true;
+
+- status = __gop_query32(sys_table_arg, gop32, &info, &size,
+- ¤t_fb_base);
+- if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
++ mode = (void *)(unsigned long)gop32->mode;
++ info = (void *)(unsigned long)mode->info;
++ current_fb_base = mode->frame_buffer_base;
++
++ if ((!first_gop || conout_found) &&
+ info->pixel_format != PIXEL_BLT_ONLY) {
+ /*
+ * Systems that use the UEFI Console Splitter may
+@@ -201,30 +180,6 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ return EFI_SUCCESS;
+ }
+
+-static efi_status_t
+-__gop_query64(efi_system_table_t *sys_table_arg,
+- struct efi_graphics_output_protocol_64 *gop64,
+- struct efi_graphics_output_mode_info **info,
+- unsigned long *size, u64 *fb_base)
+-{
+- struct efi_graphics_output_protocol_mode_64 *mode;
+- efi_graphics_output_protocol_query_mode query_mode;
+- efi_status_t status;
+- unsigned long m;
+-
+- m = gop64->mode;
+- mode = (struct efi_graphics_output_protocol_mode_64 *)m;
+- query_mode = (void *)(unsigned long)gop64->query_mode;
+-
+- status = __efi_call_early(query_mode, (void *)gop64, mode->mode, size,
+- info);
+- if (status != EFI_SUCCESS)
+- return status;
+-
+- *fb_base = mode->frame_buffer_base;
+- return status;
+-}
+-
+ static efi_status_t
+ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ efi_guid_t *proto, unsigned long size, void **gop_handle)
+@@ -246,6 +201,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ nr_gops = size / sizeof(u64);
+ for (i = 0; i < nr_gops; i++) {
++ struct efi_graphics_output_protocol_mode_64 *mode;
+ struct efi_graphics_output_mode_info *info = NULL;
+ efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID;
+ bool conout_found = false;
+@@ -263,9 +219,11 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ if (status == EFI_SUCCESS)
+ conout_found = true;
+
+- status = __gop_query64(sys_table_arg, gop64, &info, &size,
+- ¤t_fb_base);
+- if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
++ mode = (void *)(unsigned long)gop64->mode;
++ info = (void *)(unsigned long)mode->info;
++ current_fb_base = mode->frame_buffer_base;
++
++ if ((!first_gop || conout_found) &&
+ info->pixel_format != PIXEL_BLT_ONLY) {
+ /*
+ * Systems that use the UEFI Console Splitter may
+--
+2.20.1
+
--- /dev/null
+From a1825fcb0b7f6835ab7c727c5525e7ea8010c495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:55:38 +0000
+Subject: efi/gop: Return EFI_NOT_FOUND if there are no usable GOPs
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit 6fc3cec30dfeee7d3c5db8154016aff9d65503c5 ]
+
+If we don't find a usable instance of the Graphics Output Protocol
+(GOP) because none of them have a framebuffer (i.e. they were all
+PIXEL_BLT_ONLY), but all the EFI calls succeeded, we will return
+EFI_SUCCESS even though we didn't find a usable GOP.
+
+Fix this by explicitly returning EFI_NOT_FOUND if no usable GOPs are
+found, allowing the caller to probe for UGA instead.
+
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20191206165542.31469-3-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/libstub/gop.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
+index 0101ca4c13b1..08f3c1a2fb48 100644
+--- a/drivers/firmware/efi/libstub/gop.c
++++ b/drivers/firmware/efi/libstub/gop.c
+@@ -119,7 +119,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ u64 fb_base;
+ struct efi_pixel_bitmask pixel_info;
+ int pixel_format;
+- efi_status_t status = EFI_NOT_FOUND;
++ efi_status_t status;
+ u32 *handles = (u32 *)(unsigned long)gop_handle;
+ int i;
+
+@@ -175,7 +175,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ /* Did we find any GOPs? */
+ if (!first_gop)
+- goto out;
++ return EFI_NOT_FOUND;
+
+ /* EFI framebuffer */
+ si->orig_video_isVGA = VIDEO_TYPE_EFI;
+@@ -197,7 +197,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ si->lfb_size = si->lfb_linelength * si->lfb_height;
+
+ si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
+-out:
++
+ return status;
+ }
+
+@@ -237,7 +237,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ u64 fb_base;
+ struct efi_pixel_bitmask pixel_info;
+ int pixel_format;
+- efi_status_t status = EFI_NOT_FOUND;
++ efi_status_t status;
+ u64 *handles = (u64 *)(unsigned long)gop_handle;
+ int i;
+
+@@ -293,7 +293,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ /* Did we find any GOPs? */
+ if (!first_gop)
+- goto out;
++ return EFI_NOT_FOUND;
+
+ /* EFI framebuffer */
+ si->orig_video_isVGA = VIDEO_TYPE_EFI;
+@@ -315,7 +315,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ si->lfb_size = si->lfb_linelength * si->lfb_height;
+
+ si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
+-out:
++
+ return status;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c6290bd06879411596fbbc5ab26c86b88deb895b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:55:39 +0000
+Subject: efi/gop: Return EFI_SUCCESS if a usable GOP was found
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit dbd89c303b4420f6cdb689fd398349fc83b059dd ]
+
+If we've found a usable instance of the Graphics Output Protocol
+(GOP) with a framebuffer, it is possible that one of the later EFI
+calls fails while checking if any support console output. In this
+case status may be an EFI error code even though we found a usable
+GOP.
+
+Fix this by explicitly return EFI_SUCCESS if a usable GOP has been
+located.
+
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Bhupesh Sharma <bhsharma@redhat.com>
+Cc: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20191206165542.31469-4-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/libstub/gop.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
+index 08f3c1a2fb48..69b2b019a1d0 100644
+--- a/drivers/firmware/efi/libstub/gop.c
++++ b/drivers/firmware/efi/libstub/gop.c
+@@ -198,7 +198,7 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
+
+- return status;
++ return EFI_SUCCESS;
+ }
+
+ static efi_status_t
+@@ -316,7 +316,7 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+
+ si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
+
+- return status;
++ return EFI_SUCCESS;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From dbafa3c0a042af7d672ce07666047b577a808531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 10:54:23 -0600
+Subject: fs: avoid softlockups in s_inodes iterators
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+[ Upstream commit 04646aebd30b99f2cfa0182435a2ec252fcb16d0 ]
+
+Anything that walks all inodes on sb->s_inodes list without rescheduling
+risks softlockups.
+
+Previous efforts were made in 2 functions, see:
+
+c27d82f fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
+ac05fbb inode: don't softlockup when evicting inodes
+
+but there hasn't been an audit of all walkers, so do that now. This
+also consistently moves the cond_resched() calls to the bottom of each
+loop in cases where it already exists.
+
+One loop remains: remove_dquot_ref(), because I'm not quite sure how
+to deal with that one w/o taking the i_lock.
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/drop_caches.c | 2 +-
+ fs/inode.c | 7 +++++++
+ fs/notify/fsnotify.c | 1 +
+ fs/quota/dquot.c | 1 +
+ 4 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/drop_caches.c b/fs/drop_caches.c
+index d31b6c72b476..dc1a1d5d825b 100644
+--- a/fs/drop_caches.c
++++ b/fs/drop_caches.c
+@@ -35,11 +35,11 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)
+ spin_unlock(&inode->i_lock);
+ spin_unlock(&sb->s_inode_list_lock);
+
+- cond_resched();
+ invalidate_mapping_pages(inode->i_mapping, 0, -1);
+ iput(toput_inode);
+ toput_inode = inode;
+
++ cond_resched();
+ spin_lock(&sb->s_inode_list_lock);
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+diff --git a/fs/inode.c b/fs/inode.c
+index fef457a42882..96d62d97694e 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -676,6 +676,7 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty)
+ struct inode *inode, *next;
+ LIST_HEAD(dispose);
+
++again:
+ spin_lock(&sb->s_inode_list_lock);
+ list_for_each_entry_safe(inode, next, &sb->s_inodes, i_sb_list) {
+ spin_lock(&inode->i_lock);
+@@ -698,6 +699,12 @@ int invalidate_inodes(struct super_block *sb, bool kill_dirty)
+ inode_lru_list_del(inode);
+ spin_unlock(&inode->i_lock);
+ list_add(&inode->i_lru, &dispose);
++ if (need_resched()) {
++ spin_unlock(&sb->s_inode_list_lock);
++ cond_resched();
++ dispose_list(&dispose);
++ goto again;
++ }
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index 2ecef6155fc0..ac9eb273e28c 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -77,6 +77,7 @@ static void fsnotify_unmount_inodes(struct super_block *sb)
+
+ iput_inode = inode;
+
++ cond_resched();
+ spin_lock(&sb->s_inode_list_lock);
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 9b96243de081..7abc3230c21a 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -986,6 +986,7 @@ static int add_dquot_ref(struct super_block *sb, int type)
+ * later.
+ */
+ old_inode = inode;
++ cond_resched();
+ spin_lock(&sb->s_inode_list_lock);
+ }
+ spin_unlock(&sb->s_inode_list_lock);
+--
+2.20.1
+
--- /dev/null
+From 6d4506285f10f411bb0e7eb48366a1b296bf2d4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 10:55:59 -0600
+Subject: fs: call fsnotify_sb_delete after evict_inodes
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+[ Upstream commit 1edc8eb2e93130e36ac74ac9c80913815a57d413 ]
+
+When a filesystem is unmounted, we currently call fsnotify_sb_delete()
+before evict_inodes(), which means that fsnotify_unmount_inodes()
+must iterate over all inodes on the superblock looking for any inodes
+with watches. This is inefficient and can lead to livelocks as it
+iterates over many unwatched inodes.
+
+At this point, SB_ACTIVE is gone and dropping refcount to zero kicks
+the inode out out immediately, so anything processed by
+fsnotify_sb_delete / fsnotify_unmount_inodes gets evicted in that loop.
+
+After that, the call to evict_inodes will evict everything else with a
+zero refcount.
+
+This should speed things up overall, and avoid livelocks in
+fsnotify_unmount_inodes().
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/notify/fsnotify.c | 3 +++
+ fs/super.c | 4 +++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index ac9eb273e28c..f44e39c68328 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -57,6 +57,9 @@ static void fsnotify_unmount_inodes(struct super_block *sb)
+ * doing an __iget/iput with SB_ACTIVE clear would actually
+ * evict all inodes with zero i_count from icache which is
+ * unnecessarily violent and may in fact be illegal to do.
++ * However, we should have been called /after/ evict_inodes
++ * removed all zero refcount inodes, in any case. Test to
++ * be sure.
+ */
+ if (!atomic_read(&inode->i_count)) {
+ spin_unlock(&inode->i_lock);
+diff --git a/fs/super.c b/fs/super.c
+index cfadab2cbf35..cd352530eca9 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -448,10 +448,12 @@ void generic_shutdown_super(struct super_block *sb)
+ sync_filesystem(sb);
+ sb->s_flags &= ~SB_ACTIVE;
+
+- fsnotify_sb_delete(sb);
+ cgroup_writeback_umount();
+
++ /* evict all inodes with zero refcount */
+ evict_inodes(sb);
++ /* only nonzero refcount inodes can have marks */
++ fsnotify_sb_delete(sb);
+
+ if (sb->s_dio_done_wq) {
+ destroy_workqueue(sb->s_dio_done_wq);
+--
+2.20.1
+
--- /dev/null
+From ef2a572bd162fe3c67dd038f862676a216c515bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 09:37:17 +0100
+Subject: gpio: Handle counting of Freescale chipselects
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 71b8f600b034c7f5780f6fb311dabfe331c64feb ]
+
+We have a special quirk to handle the Freescale
+nonstandard SPI chipselect GPIOs in the gpiolib-of.c
+file, but it currently only handles the case where
+the GPIOs are actually requested (gpiod_*get()).
+
+We also need to handle that the SPI core attempts
+to count the GPIOs before use, and that needs a
+similar quirk in the OF part of the library.
+
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Reported-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Link: https://lore.kernel.org/r/20191128083718.39177-2-linus.walleij@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-of.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 80ea49f570f4..43ffec3a6fbb 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -23,6 +23,29 @@
+ #include "gpiolib.h"
+ #include "gpiolib-of.h"
+
++/**
++ * of_gpio_spi_cs_get_count() - special GPIO counting for SPI
++ * Some elder GPIO controllers need special quirks. Currently we handle
++ * the Freescale GPIO controller with bindings that doesn't use the
++ * established "cs-gpios" for chip selects but instead rely on
++ * "gpios" for the chip select lines. If we detect this, we redirect
++ * the counting of "cs-gpios" to count "gpios" transparent to the
++ * driver.
++ */
++int of_gpio_spi_cs_get_count(struct device *dev, const char *con_id)
++{
++ struct device_node *np = dev->of_node;
++
++ if (!IS_ENABLED(CONFIG_SPI_MASTER))
++ return 0;
++ if (!con_id || strcmp(con_id, "cs"))
++ return 0;
++ if (!of_device_is_compatible(np, "fsl,spi") &&
++ !of_device_is_compatible(np, "aeroflexgaisler,spictrl"))
++ return 0;
++ return of_gpio_named_count(np, "gpios");
++}
++
+ /*
+ * This is used by external users of of_gpio_count() from <linux/of_gpio.h>
+ *
+@@ -35,6 +58,10 @@ int of_gpio_get_count(struct device *dev, const char *con_id)
+ char propname[32];
+ unsigned int i;
+
++ ret = of_gpio_spi_cs_get_count(dev, con_id);
++ if (ret > 0)
++ return ret;
++
+ for (i = 0; i < ARRAY_SIZE(gpio_suffixes); i++) {
+ if (con_id)
+ snprintf(propname, sizeof(propname), "%s-%s",
+--
+2.20.1
+
--- /dev/null
+From cddb4c1f82f7706074f36aab807f44865765ca2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 10:12:10 +0200
+Subject: habanalabs: rate limit error msg on waiting for CS
+
+From: Oded Gabbay <oded.gabbay@gmail.com>
+
+[ Upstream commit 018e0e3594f7dcd029d258e368c485e742fa9cdb ]
+
+In case a user submits a CS, and the submission fails, and the user doesn't
+check the return value and instead use the error return value as a valid
+sequence number of a CS and ask to wait on it, the driver will print an
+error and return an error code for that wait.
+
+The real problem happens if now the user ignores the error of the wait, and
+try to wait again and again. This can lead to a flood of error messages
+from the driver and even soft lockup event.
+
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Reviewed-by: Tomer Tayar <ttayar@habana.ai>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/command_submission.c | 5 +++--
+ drivers/misc/habanalabs/context.c | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/command_submission.c b/drivers/misc/habanalabs/command_submission.c
+index a9ac045dcfde..447f307ef4d6 100644
+--- a/drivers/misc/habanalabs/command_submission.c
++++ b/drivers/misc/habanalabs/command_submission.c
+@@ -777,8 +777,9 @@ int hl_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data)
+ memset(args, 0, sizeof(*args));
+
+ if (rc < 0) {
+- dev_err(hdev->dev, "Error %ld on waiting for CS handle %llu\n",
+- rc, seq);
++ dev_err_ratelimited(hdev->dev,
++ "Error %ld on waiting for CS handle %llu\n",
++ rc, seq);
+ if (rc == -ERESTARTSYS) {
+ args->out.status = HL_WAIT_CS_STATUS_INTERRUPTED;
+ rc = -EINTR;
+diff --git a/drivers/misc/habanalabs/context.c b/drivers/misc/habanalabs/context.c
+index 17db7b3dfb4c..2df6fb87e7ff 100644
+--- a/drivers/misc/habanalabs/context.c
++++ b/drivers/misc/habanalabs/context.c
+@@ -176,7 +176,7 @@ struct dma_fence *hl_ctx_get_fence(struct hl_ctx *ctx, u64 seq)
+ spin_lock(&ctx->cs_lock);
+
+ if (seq >= ctx->cs_sequence) {
+- dev_notice(hdev->dev,
++ dev_notice_ratelimited(hdev->dev,
+ "Can't wait on seq %llu because current CS is at seq %llu\n",
+ seq, ctx->cs_sequence);
+ spin_unlock(&ctx->cs_lock);
+--
+2.20.1
+
--- /dev/null
+From 9b340abafd68e940f1d8bd642d444c9723872a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 19:06:56 +0800
+Subject: habanalabs: remove variable 'val' set but not used
+
+From: Chen Wandun <chenwandun@huawei.com>
+
+[ Upstream commit 68a1fdf2451f38b4ada0607eb6e1303f8a02e0b7 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/misc/habanalabs/goya/goya.c: In function goya_pldm_init_cpu:
+drivers/misc/habanalabs/goya/goya.c:2195:6: warning: variable val set but not used [-Wunused-but-set-variable]
+drivers/misc/habanalabs/goya/goya.c: In function goya_hw_init:
+drivers/misc/habanalabs/goya/goya.c:2505:6: warning: variable val set but not used [-Wunused-but-set-variable]
+
+Fixes: 9494a8dd8d22 ("habanalabs: add h/w queues module")
+Signed-off-by: Chen Wandun <chenwandun@huawei.com>
+Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/goya/goya.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
+index 6fba14b81f90..fe3574a83b7c 100644
+--- a/drivers/misc/habanalabs/goya/goya.c
++++ b/drivers/misc/habanalabs/goya/goya.c
+@@ -2171,7 +2171,7 @@ static int goya_push_linux_to_device(struct hl_device *hdev)
+
+ static int goya_pldm_init_cpu(struct hl_device *hdev)
+ {
+- u32 val, unit_rst_val;
++ u32 unit_rst_val;
+ int rc;
+
+ /* Must initialize SRAM scrambler before pushing u-boot to SRAM */
+@@ -2179,14 +2179,14 @@ static int goya_pldm_init_cpu(struct hl_device *hdev)
+
+ /* Put ARM cores into reset */
+ WREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL, CPU_RESET_ASSERT);
+- val = RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL);
++ RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL);
+
+ /* Reset the CA53 MACRO */
+ unit_rst_val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N);
+ WREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N, CA53_RESET);
+- val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N);
++ RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N);
+ WREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N, unit_rst_val);
+- val = RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N);
++ RREG32(mmPSOC_GLOBAL_CONF_UNIT_RST_N);
+
+ rc = goya_push_uboot_to_device(hdev);
+ if (rc)
+@@ -2207,7 +2207,7 @@ static int goya_pldm_init_cpu(struct hl_device *hdev)
+ /* Release ARM core 0 from reset */
+ WREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL,
+ CPU_RESET_CORE0_DEASSERT);
+- val = RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL);
++ RREG32(mmCPU_CA53_CFG_ARM_RST_CONTROL);
+
+ return 0;
+ }
+@@ -2475,13 +2475,12 @@ int goya_mmu_init(struct hl_device *hdev)
+ static int goya_hw_init(struct hl_device *hdev)
+ {
+ struct asic_fixed_properties *prop = &hdev->asic_prop;
+- u32 val;
+ int rc;
+
+ dev_info(hdev->dev, "Starting initialization of H/W\n");
+
+ /* Perform read from the device to make sure device is up */
+- val = RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
++ RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
+
+ /*
+ * Let's mark in the H/W that we have reached this point. We check
+@@ -2533,7 +2532,7 @@ static int goya_hw_init(struct hl_device *hdev)
+ goto disable_queues;
+
+ /* Perform read from the device to flush all MSI-X configuration */
+- val = RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
++ RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
+
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From f4830311b5c33b370737dd13754c62c0563a396e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 18:28:10 -0800
+Subject: hv_netvsc: Fix unwanted rx_table reset
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit b0689faa8efc5a3391402d7ae93bd373b7248e51 ]
+
+In existing code, the receive indirection table, rx_table, is in
+struct rndis_device, which will be reset when changing MTU, ringparam,
+etc. User configured receive indirection table values will be lost.
+
+To fix this, move rx_table to struct net_device_context, and check
+netif_is_rxfh_configured(), so rx_table will be set to default only
+if no user configured value.
+
+Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table")
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/hyperv_net.h | 3 ++-
+ drivers/net/hyperv/netvsc_drv.c | 4 ++--
+ drivers/net/hyperv/rndis_filter.c | 10 +++++++---
+ 3 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index fb547f37af1e..e74f2d1def80 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -169,7 +169,6 @@ struct rndis_device {
+
+ u8 hw_mac_adr[ETH_ALEN];
+ u8 rss_key[NETVSC_HASH_KEYLEN];
+- u16 rx_table[ITAB_NUM];
+ };
+
+
+@@ -938,6 +937,8 @@ struct net_device_context {
+
+ u32 tx_table[VRSS_SEND_TAB_SIZE];
+
++ u16 rx_table[ITAB_NUM];
++
+ /* Ethtool settings */
+ u8 duplex;
+ u32 speed;
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 963509add611..78e3e689a733 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -1659,7 +1659,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key,
+ rndis_dev = ndev->extension;
+ if (indir) {
+ for (i = 0; i < ITAB_NUM; i++)
+- indir[i] = rndis_dev->rx_table[i];
++ indir[i] = ndc->rx_table[i];
+ }
+
+ if (key)
+@@ -1689,7 +1689,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir,
+ return -EINVAL;
+
+ for (i = 0; i < ITAB_NUM; i++)
+- rndis_dev->rx_table[i] = indir[i];
++ ndc->rx_table[i] = indir[i];
+ }
+
+ if (!key) {
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index e3d3c9097ff1..f81e58267a6e 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -767,6 +767,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
+ const u8 *rss_key, u16 flag)
+ {
+ struct net_device *ndev = rdev->ndev;
++ struct net_device_context *ndc = netdev_priv(ndev);
+ struct rndis_request *request;
+ struct rndis_set_request *set;
+ struct rndis_set_complete *set_complete;
+@@ -806,7 +807,7 @@ static int rndis_set_rss_param_msg(struct rndis_device *rdev,
+ /* Set indirection table entries */
+ itab = (u32 *)(rssp + 1);
+ for (i = 0; i < ITAB_NUM; i++)
+- itab[i] = rdev->rx_table[i];
++ itab[i] = ndc->rx_table[i];
+
+ /* Set hask key values */
+ keyp = (u8 *)((unsigned long)rssp + rssp->hashkey_offset);
+@@ -1305,6 +1306,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
+ struct netvsc_device_info *device_info)
+ {
+ struct net_device *net = hv_get_drvdata(dev);
++ struct net_device_context *ndc = netdev_priv(net);
+ struct netvsc_device *net_device;
+ struct rndis_device *rndis_device;
+ struct ndis_recv_scale_cap rsscap;
+@@ -1391,9 +1393,11 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
+ /* We will use the given number of channels if available. */
+ net_device->num_chn = min(net_device->max_chn, device_info->num_chn);
+
+- for (i = 0; i < ITAB_NUM; i++)
+- rndis_device->rx_table[i] = ethtool_rxfh_indir_default(
++ if (!netif_is_rxfh_configured(net)) {
++ for (i = 0; i < ITAB_NUM; i++)
++ ndc->rx_table[i] = ethtool_rxfh_indir_default(
+ i, net_device->num_chn);
++ }
+
+ atomic_set(&net_device->open_chn, 1);
+ vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open);
+--
+2.20.1
+
--- /dev/null
+From b22988335618046bcfe00734ed739c6f369b66b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 19:53:45 +0300
+Subject: io_uring: don't wait when under-submitting
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 7c504e65206a4379ff38fe41d21b32b6c2c3e53e ]
+
+There is no reliable way to submit and wait in a single syscall, as
+io_submit_sqes() may under-consume sqes (in case of an early error).
+Then it will wait for not-yet-submitted requests, deadlocking the user
+in most cases.
+
+Don't wait/poll if can't submit all sqes
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index a60c6315a348..709671faaed6 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -3721,6 +3721,9 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
+ mutex_lock(&ctx->uring_lock);
+ submitted = io_ring_submit(ctx, to_submit);
+ mutex_unlock(&ctx->uring_lock);
++
++ if (submitted != to_submit)
++ goto out;
+ }
+ if (flags & IORING_ENTER_GETEVENTS) {
+ unsigned nr_events = 0;
+@@ -3734,6 +3737,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
+ }
+ }
+
++out:
+ percpu_ref_put(&ctx->refs);
+ out_fput:
+ fdput(f);
+--
+2.20.1
+
--- /dev/null
+From d71e5273664845d9b27f8b73ba42cf888b8a7d35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 19:47:25 +0000
+Subject: iommu/dma: Relax locking in iommu_dma_prepare_msi()
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit c18647900ec864d401ba09b3bbd5b34f331f8d26 ]
+
+Since commit ece6e6f0218b ("iommu/dma-iommu: Split iommu_dma_map_msi_msg()
+in two parts"), iommu_dma_prepare_msi() should no longer have to worry
+about preempting itself, nor being called in atomic context at all. Thus
+we can downgrade the IRQ-safe locking to a simple mutex to avoid angering
+the new might_sleep() check in iommu_map().
+
+Reported-by: Qian Cai <cai@lca.pw>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/dma-iommu.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index f321279baf9e..51456e7f264f 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -19,6 +19,7 @@
+ #include <linux/iova.h>
+ #include <linux/irq.h>
+ #include <linux/mm.h>
++#include <linux/mutex.h>
+ #include <linux/pci.h>
+ #include <linux/scatterlist.h>
+ #include <linux/vmalloc.h>
+@@ -43,7 +44,6 @@ struct iommu_dma_cookie {
+ dma_addr_t msi_iova;
+ };
+ struct list_head msi_page_list;
+- spinlock_t msi_lock;
+
+ /* Domain for flush queue callback; NULL if flush queue not in use */
+ struct iommu_domain *fq_domain;
+@@ -62,7 +62,6 @@ static struct iommu_dma_cookie *cookie_alloc(enum iommu_dma_cookie_type type)
+
+ cookie = kzalloc(sizeof(*cookie), GFP_KERNEL);
+ if (cookie) {
+- spin_lock_init(&cookie->msi_lock);
+ INIT_LIST_HEAD(&cookie->msi_page_list);
+ cookie->type = type;
+ }
+@@ -1150,7 +1149,7 @@ static struct iommu_dma_msi_page *iommu_dma_get_msi_page(struct device *dev,
+ if (msi_page->phys == msi_addr)
+ return msi_page;
+
+- msi_page = kzalloc(sizeof(*msi_page), GFP_ATOMIC);
++ msi_page = kzalloc(sizeof(*msi_page), GFP_KERNEL);
+ if (!msi_page)
+ return NULL;
+
+@@ -1180,7 +1179,7 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr)
+ struct iommu_domain *domain = iommu_get_domain_for_dev(dev);
+ struct iommu_dma_cookie *cookie;
+ struct iommu_dma_msi_page *msi_page;
+- unsigned long flags;
++ static DEFINE_MUTEX(msi_prepare_lock); /* see below */
+
+ if (!domain || !domain->iova_cookie) {
+ desc->iommu_cookie = NULL;
+@@ -1190,13 +1189,13 @@ int iommu_dma_prepare_msi(struct msi_desc *desc, phys_addr_t msi_addr)
+ cookie = domain->iova_cookie;
+
+ /*
+- * We disable IRQs to rule out a possible inversion against
+- * irq_desc_lock if, say, someone tries to retarget the affinity
+- * of an MSI from within an IPI handler.
++ * In fact the whole prepare operation should already be serialised by
++ * irq_domain_mutex further up the callchain, but that's pretty subtle
++ * on its own, so consider this locking as failsafe documentation...
+ */
+- spin_lock_irqsave(&cookie->msi_lock, flags);
++ mutex_lock(&msi_prepare_lock);
+ msi_page = iommu_dma_get_msi_page(dev, msi_addr, domain);
+- spin_unlock_irqrestore(&cookie->msi_lock, flags);
++ mutex_unlock(&msi_prepare_lock);
+
+ msi_desc_set_iommu_cookie(desc, msi_page);
+
+--
+2.20.1
+
--- /dev/null
+From 8dfc916cecc9c8188328746d603de04ffb4e326f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 12:27:04 +0800
+Subject: iommu/iova: Init the struct iova to fix the possible memleak
+
+From: Xiaotao Yin <xiaotao.yin@windriver.com>
+
+[ Upstream commit 472d26df5e8075eda677b6be730e0fbf434ff2a8 ]
+
+During ethernet(Marvell octeontx2) set ring buffer test:
+ethtool -G eth1 rx <rx ring size> tx <tx ring size>
+following kmemleak will happen sometimes:
+
+unreferenced object 0xffff000b85421340 (size 64):
+ comm "ethtool", pid 867, jiffies 4295323539 (age 550.500s)
+ hex dump (first 64 bytes):
+ 80 13 42 85 0b 00 ff ff ff ff ff ff ff ff ff ff ..B.............
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<000000001b204ddf>] kmem_cache_alloc+0x1b0/0x350
+ [<00000000d9ef2e50>] alloc_iova+0x3c/0x168
+ [<00000000ea30f99d>] alloc_iova_fast+0x7c/0x2d8
+ [<00000000b8bb2f1f>] iommu_dma_alloc_iova.isra.0+0x12c/0x138
+ [<000000002f1a43b5>] __iommu_dma_map+0x8c/0xf8
+ [<00000000ecde7899>] iommu_dma_map_page+0x98/0xf8
+ [<0000000082004e59>] otx2_alloc_rbuf+0xf4/0x158
+ [<000000002b107f6b>] otx2_rq_aura_pool_init+0x110/0x270
+ [<00000000c3d563c7>] otx2_open+0x15c/0x734
+ [<00000000a2f5f3a8>] otx2_dev_open+0x3c/0x68
+ [<00000000456a98b5>] otx2_set_ringparam+0x1ac/0x1d4
+ [<00000000f2fbb819>] dev_ethtool+0xb84/0x2028
+ [<0000000069b67c5a>] dev_ioctl+0x248/0x3a0
+ [<00000000af38663a>] sock_ioctl+0x280/0x638
+ [<000000002582384c>] do_vfs_ioctl+0x8b0/0xa80
+ [<000000004e1a2c02>] ksys_ioctl+0x84/0xb8
+
+The reason:
+When alloc_iova_mem() without initial with Zero, sometimes fpn_lo will
+equal to IOVA_ANCHOR by chance, so when return with -ENOMEM(iova32_full)
+from __alloc_and_insert_iova_range(), the new_iova will not be freed in
+free_iova_mem().
+
+Fixes: bb68b2fbfbd6 ("iommu/iova: Add rbtree anchor node")
+Signed-off-by: Xiaotao Yin <xiaotao.yin@windriver.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iova.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 41c605b0058f..c7a914b9bbbc 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -233,7 +233,7 @@ static DEFINE_MUTEX(iova_cache_mutex);
+
+ struct iova *alloc_iova_mem(void)
+ {
+- return kmem_cache_alloc(iova_cache, GFP_ATOMIC);
++ return kmem_cache_zalloc(iova_cache, GFP_ATOMIC);
+ }
+ EXPORT_SYMBOL(alloc_iova_mem);
+
+--
+2.20.1
+
--- /dev/null
+From 544a56be502d557fad6788478d468d173c6f4579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 00:19:17 -0800
+Subject: kconfig: don't crash on NULL expressions in expr_eq()
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+[ Upstream commit 272a72103012862e3a24ea06635253ead0b6e808 ]
+
+NULL expressions are taken to always be true, as implemented by the
+expr_is_yes() macro and by several other functions in expr.c. As such,
+they ought to be valid inputs to expr_eq(), which compares two
+expressions.
+
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/expr.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
+index 77ffff3a053c..9f1de58e9f0c 100644
+--- a/scripts/kconfig/expr.c
++++ b/scripts/kconfig/expr.c
+@@ -254,6 +254,13 @@ static int expr_eq(struct expr *e1, struct expr *e2)
+ {
+ int res, old_count;
+
++ /*
++ * A NULL expr is taken to be yes, but there's also a different way to
++ * represent yes. expr_is_yes() checks for either representation.
++ */
++ if (!e1 || !e2)
++ return expr_is_yes(e1) && expr_is_yes(e2);
++
+ if (e1->type != e2->type)
+ return 0;
+ switch (e1->type) {
+--
+2.20.1
+
--- /dev/null
+From 9a2b377d7909a40123ce9f652e6e97675dd089e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 12:42:20 +0100
+Subject: kselftest/runner: Print new line in print of timeout log
+
+From: SeongJae Park <sjpark@amazon.de>
+
+[ Upstream commit d187801d1a46519d2a322f879f7c8f85c685372e ]
+
+If a timeout failure occurs, kselftest kills the test process and prints
+the timeout log. If the test process has killed while printing a log
+that ends with new line, the timeout log can be printed in middle of the
+test process output so that it can be seems like a comment, as below:
+
+ # test_process_log not ok 3 selftests: timers: nsleep-lat # TIMEOUT
+
+This commit avoids such problem by printing one more line before the
+TIMEOUT failure log.
+
+Signed-off-by: SeongJae Park <sjpark@amazon.de>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest/runner.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh
+index 84de7bc74f2c..a8d20cbb711c 100644
+--- a/tools/testing/selftests/kselftest/runner.sh
++++ b/tools/testing/selftests/kselftest/runner.sh
+@@ -79,6 +79,7 @@ run_one()
+ if [ $rc -eq $skip_rc ]; then \
+ echo "not ok $test_num $TEST_HDR_MSG # SKIP"
+ elif [ $rc -eq $timeout_rc ]; then \
++ echo "#"
+ echo "not ok $test_num $TEST_HDR_MSG # TIMEOUT"
+ else
+ echo "not ok $test_num $TEST_HDR_MSG # exit=$rc"
+--
+2.20.1
+
--- /dev/null
+From d37f204d343f0e381eb9c2f10ed0933f9869730b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 12:42:21 +0100
+Subject: kselftest: Support old perl versions
+
+From: SeongJae Park <sjpark@amazon.de>
+
+[ Upstream commit 4eac734486fd431e0756cc5e929f140911a36a53 ]
+
+On an old perl such as v5.10.1, `kselftest/prefix.pl` gives below error
+message:
+
+ Can't locate object method "autoflush" via package "IO::Handle" at kselftest/prefix.pl line 10.
+
+This commit fixes the error by explicitly specifying the use of the
+`IO::Handle` package.
+
+Signed-off-by: SeongJae Park <sjpark@amazon.de>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest/prefix.pl | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/kselftest/prefix.pl b/tools/testing/selftests/kselftest/prefix.pl
+index ec7e48118183..31f7c2a0a8bd 100755
+--- a/tools/testing/selftests/kselftest/prefix.pl
++++ b/tools/testing/selftests/kselftest/prefix.pl
+@@ -3,6 +3,7 @@
+ # Prefix all lines with "# ", unbuffered. Command being piped in may need
+ # to have unbuffering forced with "stdbuf -i0 -o0 -e0 $cmd".
+ use strict;
++use IO::Handle;
+
+ binmode STDIN;
+ binmode STDOUT;
+--
+2.20.1
+
--- /dev/null
+From fc62f30fcbf4a1860b13269290282eb47778ea47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 11:36:10 +0000
+Subject: libtraceevent: Copy pkg-config file to output folder when using O=
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+[ Upstream commit 15b3904f8e884e0d34d5f09906cf6526d0b889a2 ]
+
+When we use 'O=' with make to build libtraceevent in a separate folder
+it still copies 'libtraceevent.pc' to its source folder. Modify the
+Makefile so that it uses the output folder to copy the pkg-config file
+and install from there.
+
+Signed-off-by: Sudipm Mukherjee <sudipm.mukherjee@gmail.com>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: linux-trace-devel@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191115113610.21493-2-sudipm.mukherjee@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/traceevent/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index d008e64042ce..ecf882308d8a 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -208,10 +208,11 @@ define do_install
+ $(INSTALL) $(if $3,-m $3,) $1 '$(DESTDIR_SQ)$2'
+ endef
+
+-PKG_CONFIG_FILE = libtraceevent.pc
++PKG_CONFIG_SOURCE_FILE = libtraceevent.pc
++PKG_CONFIG_FILE := $(addprefix $(OUTPUT),$(PKG_CONFIG_SOURCE_FILE))
+ define do_install_pkgconfig_file
+ if [ -n "${pkgconfig_dir}" ]; then \
+- cp -f ${PKG_CONFIG_FILE}.template ${PKG_CONFIG_FILE}; \
++ cp -f ${PKG_CONFIG_SOURCE_FILE}.template ${PKG_CONFIG_FILE}; \
+ sed -i "s|INSTALL_PREFIX|${1}|g" ${PKG_CONFIG_FILE}; \
+ sed -i "s|LIB_VERSION|${EVENT_PARSE_VERSION}|g" ${PKG_CONFIG_FILE}; \
+ sed -i "s|LIB_DIR|${libdir}|g" ${PKG_CONFIG_FILE}; \
+--
+2.20.1
+
--- /dev/null
+From 5fc84f8d1aad21935e39ef05f7d96408eb37697f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 11:36:09 +0000
+Subject: libtraceevent: Fix lib installation with O=
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+[ Upstream commit 587db8ebdac2c5eb3a8851e16b26f2e2711ab797 ]
+
+When we use 'O=' with make to build libtraceevent in a separate folder
+it fails to install libtraceevent.a and libtraceevent.so.1.1.0 with the
+error:
+
+ INSTALL /home/sudip/linux/obj-trace/libtraceevent.a
+ INSTALL /home/sudip/linux/obj-trace/libtraceevent.so.1.1.0
+
+ cp: cannot stat 'libtraceevent.a': No such file or directory
+ Makefile:225: recipe for target 'install_lib' failed
+ make: *** [install_lib] Error 1
+
+I used the command:
+
+ make O=../../../obj-trace DESTDIR=~/test prefix==/usr install
+
+It turns out libtraceevent Makefile, even though it builds in a separate
+folder, searches for libtraceevent.a and libtraceevent.so.1.1.0 in its
+source folder.
+
+So, add the 'OUTPUT' prefix to the source path so that 'make' looks for
+the files in the correct place.
+
+Signed-off-by: Sudipm Mukherjee <sudipm.mukherjee@gmail.com>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: linux-trace-devel@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191115113610.21493-1-sudipm.mukherjee@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/traceevent/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index 5315f3787f8d..d008e64042ce 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -97,6 +97,7 @@ EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION)
+
+ LIB_TARGET = libtraceevent.a libtraceevent.so.$(EVENT_PARSE_VERSION)
+ LIB_INSTALL = libtraceevent.a libtraceevent.so*
++LIB_INSTALL := $(addprefix $(OUTPUT),$(LIB_INSTALL))
+
+ INCLUDES = -I. -I $(srctree)/tools/include $(CONFIG_INCLUDES)
+
+--
+2.20.1
+
--- /dev/null
+From fe05efc8ade6bde615dcd5874f677ee8f8a34d3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 14:16:18 +0800
+Subject: llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and
+ _test_c)
+
+From: Chan Shu Tak, Alex <alexchan@task.com.hk>
+
+[ Upstream commit af1c0e4e00f3cc76cb136ebf2e2c04e8b6446285 ]
+
+When a frame with NULL DSAP is received, llc_station_rcv is called.
+In turn, llc_stat_ev_rx_null_dsap_xid_c is called to check if it is a NULL
+XID frame. The return statement of llc_stat_ev_rx_null_dsap_xid_c returns 1
+when the incoming frame is not a NULL XID frame and 0 otherwise. Hence, a
+NULL XID response is returned unexpectedly, e.g. when the incoming frame is
+a NULL TEST command.
+
+To fix the error, simply remove the conditional operator.
+
+A similar error in llc_stat_ev_rx_null_dsap_test_c is also fixed.
+
+Signed-off-by: Chan Shu Tak, Alex <alexchan@task.com.hk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/llc_station.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
+index 204a8351efff..c29170e767a8 100644
+--- a/net/llc/llc_station.c
++++ b/net/llc/llc_station.c
+@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb)
+ return LLC_PDU_IS_CMD(pdu) && /* command PDU */
+ LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */
+ LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID &&
+- !pdu->dsap ? 0 : 1; /* NULL DSAP value */
++ !pdu->dsap; /* NULL DSAP value */
+ }
+
+ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
+@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
+ return LLC_PDU_IS_CMD(pdu) && /* command PDU */
+ LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */
+ LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST &&
+- !pdu->dsap ? 0 : 1; /* NULL DSAP */
++ !pdu->dsap; /* NULL DSAP */
+ }
+
+ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
+--
+2.20.1
+
--- /dev/null
+From 348c4d208528404816318f2226f2af78ae92abf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 16:57:15 +0100
+Subject: locking/spinlock/debug: Fix various data races
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 1a365e822372ba24c9da0822bc583894f6f3d821 ]
+
+This fixes various data races in spinlock_debug. By testing with KCSAN,
+it is observable that the console gets spammed with data races reports,
+suggesting these are extremely frequent.
+
+Example data race report:
+
+ read to 0xffff8ab24f403c48 of 4 bytes by task 221 on cpu 2:
+ debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
+ do_raw_spin_lock+0x9b/0x210 kernel/locking/spinlock_debug.c:112
+ __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
+ _raw_spin_lock+0x39/0x40 kernel/locking/spinlock.c:151
+ spin_lock include/linux/spinlock.h:338 [inline]
+ get_partial_node.isra.0.part.0+0x32/0x2f0 mm/slub.c:1873
+ get_partial_node mm/slub.c:1870 [inline]
+ <snip>
+
+ write to 0xffff8ab24f403c48 of 4 bytes by task 167 on cpu 3:
+ debug_spin_unlock kernel/locking/spinlock_debug.c:103 [inline]
+ do_raw_spin_unlock+0xc9/0x1a0 kernel/locking/spinlock_debug.c:138
+ __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline]
+ _raw_spin_unlock_irqrestore+0x2d/0x50 kernel/locking/spinlock.c:191
+ spin_unlock_irqrestore include/linux/spinlock.h:393 [inline]
+ free_debug_processing+0x1b3/0x210 mm/slub.c:1214
+ __slab_free+0x292/0x400 mm/slub.c:2864
+ <snip>
+
+As a side-effect, with KCSAN, this eventually locks up the console, most
+likely due to deadlock, e.g. .. -> printk lock -> spinlock_debug ->
+KCSAN detects data race -> kcsan_print_report() -> printk lock ->
+deadlock.
+
+This fix will 1) avoid the data races, and 2) allow using lock debugging
+together with KCSAN.
+
+Reported-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Marco Elver <elver@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Link: https://lkml.kernel.org/r/20191120155715.28089-1-elver@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/spinlock_debug.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c
+index 399669f7eba8..472dd462a40c 100644
+--- a/kernel/locking/spinlock_debug.c
++++ b/kernel/locking/spinlock_debug.c
+@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init);
+
+ static void spin_dump(raw_spinlock_t *lock, const char *msg)
+ {
+- struct task_struct *owner = NULL;
++ struct task_struct *owner = READ_ONCE(lock->owner);
+
+- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT)
+- owner = lock->owner;
++ if (owner == SPINLOCK_OWNER_INIT)
++ owner = NULL;
+ printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n",
+ msg, raw_smp_processor_id(),
+ current->comm, task_pid_nr(current));
+ printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, "
+ ".owner_cpu: %d\n",
+- lock, lock->magic,
++ lock, READ_ONCE(lock->magic),
+ owner ? owner->comm : "<none>",
+ owner ? task_pid_nr(owner) : -1,
+- lock->owner_cpu);
++ READ_ONCE(lock->owner_cpu));
+ dump_stack();
+ }
+
+@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg)
+ static inline void
+ debug_spin_lock_before(raw_spinlock_t *lock)
+ {
+- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
+- SPIN_BUG_ON(lock->owner == current, lock, "recursion");
+- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(),
++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic");
++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion");
++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(),
+ lock, "cpu recursion");
+ }
+
+ static inline void debug_spin_lock_after(raw_spinlock_t *lock)
+ {
+- lock->owner_cpu = raw_smp_processor_id();
+- lock->owner = current;
++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
++ WRITE_ONCE(lock->owner, current);
+ }
+
+ static inline void debug_spin_unlock(raw_spinlock_t *lock)
+@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock)
+ SPIN_BUG_ON(lock->owner != current, lock, "wrong owner");
+ SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ lock, "wrong CPU");
+- lock->owner = SPINLOCK_OWNER_INIT;
+- lock->owner_cpu = -1;
++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
++ WRITE_ONCE(lock->owner_cpu, -1);
+ }
+
+ /*
+@@ -187,8 +187,8 @@ static inline void debug_write_lock_before(rwlock_t *lock)
+
+ static inline void debug_write_lock_after(rwlock_t *lock)
+ {
+- lock->owner_cpu = raw_smp_processor_id();
+- lock->owner = current;
++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
++ WRITE_ONCE(lock->owner, current);
+ }
+
+ static inline void debug_write_unlock(rwlock_t *lock)
+@@ -197,8 +197,8 @@ static inline void debug_write_unlock(rwlock_t *lock)
+ RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner");
+ RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ lock, "wrong CPU");
+- lock->owner = SPINLOCK_OWNER_INIT;
+- lock->owner_cpu = -1;
++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
++ WRITE_ONCE(lock->owner_cpu, -1);
+ }
+
+ void do_raw_write_lock(rwlock_t *lock)
+--
+2.20.1
+
--- /dev/null
+From 3e71bd847aecc43e1ac0828bd047f6b4172ae498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 14:34:51 +0100
+Subject: mac80211: fix TID field in monitor mode transmit
+
+From: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
+
+[ Upstream commit 753ffad3d6243303994227854d951ff5c70fa9e0 ]
+
+Fix overwriting of the qos_ctrl.tid field for encrypted frames injected on
+a monitor interface. While qos_ctrl.tid is not encrypted, it's used as an
+input into the encryption algorithm so it's protected, and thus cannot be
+modified after encryption. For injected frames, the encryption may already
+have been done in userspace, so we cannot change any fields.
+
+Before passing the frame to the driver, the qos_ctrl.tid field is updated
+from skb->priority. Prior to dbd50a851c50 skb->priority was updated in
+ieee80211_select_queue_80211(), but this function is no longer always
+called.
+
+Update skb->priority in ieee80211_monitor_start_xmit() so that the value
+is stored, and when later code 'modifies' the TID it really sets it to
+the same value as before, preserving the encryption.
+
+Fixes: dbd50a851c50 ("mac80211: only allocate one queue when using iTXQs")
+Signed-off-by: Fredrik Olofsson <fredrik.olofsson@anyfinetworks.com>
+Link: https://lore.kernel.org/r/20191119133451.14711-1-fredrik.olofsson@anyfinetworks.com
+[rewrite commit message based on our discussion]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 1fa422782905..cbd273c0b275 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -2263,6 +2263,15 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
+ payload[7]);
+ }
+
++ /*
++ * Initialize skb->priority for QoS frames. This is put in the TID field
++ * of the frame before passing it to the driver.
++ */
++ if (ieee80211_is_data_qos(hdr->frame_control)) {
++ u8 *p = ieee80211_get_qos_ctl(hdr);
++ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
++ }
++
+ memset(info, 0, sizeof(*info));
+
+ info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+--
+2.20.1
+
--- /dev/null
+From f983d6add81b3af1272009028bb90ace0b8d630e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 18:10:54 +0800
+Subject: mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: qize wang <wangqize888888888@gmail.com>
+
+[ Upstream commit 1e58252e334dc3f3756f424a157d1b7484464c40 ]
+
+mwifiex_process_tdls_action_frame() without checking
+the incoming tdls infomation element's vality before use it,
+this may cause multi heap buffer overflows.
+
+Fix them by putting vality check before use it.
+
+IE is TLV struct, but ht_cap and ht_oper aren’t TLV struct.
+the origin marvell driver code is wrong:
+
+memcpy(&sta_ptr->tdls_cap.ht_oper, pos,....
+memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,...
+
+Fix the bug by changing pos(the address of IE) to
+pos+2 ( the address of IE value ).
+
+Signed-off-by: qize wang <wangqize888888888@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/tdls.c | 70 +++++++++++++++++++--
+ 1 file changed, 64 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
+index 09313047beed..7caf1d26124a 100644
+--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
++++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
+@@ -953,59 +953,117 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
+
+ switch (*pos) {
+ case WLAN_EID_SUPP_RATES:
++ if (pos[1] > 32)
++ return;
+ sta_ptr->tdls_cap.rates_len = pos[1];
+ for (i = 0; i < pos[1]; i++)
+ sta_ptr->tdls_cap.rates[i] = pos[i + 2];
+ break;
+
+ case WLAN_EID_EXT_SUPP_RATES:
++ if (pos[1] > 32)
++ return;
+ basic = sta_ptr->tdls_cap.rates_len;
++ if (pos[1] > 32 - basic)
++ return;
+ for (i = 0; i < pos[1]; i++)
+ sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2];
+ sta_ptr->tdls_cap.rates_len += pos[1];
+ break;
+ case WLAN_EID_HT_CAPABILITY:
+- memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,
++ if (pos > end - sizeof(struct ieee80211_ht_cap) - 2)
++ return;
++ if (pos[1] != sizeof(struct ieee80211_ht_cap))
++ return;
++ /* copy the ie's value into ht_capb*/
++ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2,
+ sizeof(struct ieee80211_ht_cap));
+ sta_ptr->is_11n_enabled = 1;
+ break;
+ case WLAN_EID_HT_OPERATION:
+- memcpy(&sta_ptr->tdls_cap.ht_oper, pos,
++ if (pos > end -
++ sizeof(struct ieee80211_ht_operation) - 2)
++ return;
++ if (pos[1] != sizeof(struct ieee80211_ht_operation))
++ return;
++ /* copy the ie's value into ht_oper*/
++ memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2,
+ sizeof(struct ieee80211_ht_operation));
+ break;
+ case WLAN_EID_BSS_COEX_2040:
++ if (pos > end - 3)
++ return;
++ if (pos[1] != 1)
++ return;
+ sta_ptr->tdls_cap.coex_2040 = pos[2];
+ break;
+ case WLAN_EID_EXT_CAPABILITY:
++ if (pos > end - sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] < sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] > 8)
++ return;
+ memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos,
+ sizeof(struct ieee_types_header) +
+ min_t(u8, pos[1], 8));
+ break;
+ case WLAN_EID_RSN:
++ if (pos > end - sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] < sizeof(struct ieee_types_header))
++ return;
++ if (pos[1] > IEEE_MAX_IE_SIZE -
++ sizeof(struct ieee_types_header))
++ return;
+ memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos,
+ sizeof(struct ieee_types_header) +
+ min_t(u8, pos[1], IEEE_MAX_IE_SIZE -
+ sizeof(struct ieee_types_header)));
+ break;
+ case WLAN_EID_QOS_CAPA:
++ if (pos > end - 3)
++ return;
++ if (pos[1] != 1)
++ return;
+ sta_ptr->tdls_cap.qos_info = pos[2];
+ break;
+ case WLAN_EID_VHT_OPERATION:
+- if (priv->adapter->is_hw_11ac_capable)
+- memcpy(&sta_ptr->tdls_cap.vhtoper, pos,
++ if (priv->adapter->is_hw_11ac_capable) {
++ if (pos > end -
++ sizeof(struct ieee80211_vht_operation) - 2)
++ return;
++ if (pos[1] !=
++ sizeof(struct ieee80211_vht_operation))
++ return;
++ /* copy the ie's value into vhtoper*/
++ memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2,
+ sizeof(struct ieee80211_vht_operation));
++ }
+ break;
+ case WLAN_EID_VHT_CAPABILITY:
+ if (priv->adapter->is_hw_11ac_capable) {
+- memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos,
++ if (pos > end -
++ sizeof(struct ieee80211_vht_cap) - 2)
++ return;
++ if (pos[1] != sizeof(struct ieee80211_vht_cap))
++ return;
++ /* copy the ie's value into vhtcap*/
++ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2,
+ sizeof(struct ieee80211_vht_cap));
+ sta_ptr->is_11ac_enabled = 1;
+ }
+ break;
+ case WLAN_EID_AID:
+- if (priv->adapter->is_hw_11ac_capable)
++ if (priv->adapter->is_hw_11ac_capable) {
++ if (pos > end - 4)
++ return;
++ if (pos[1] != 2)
++ return;
+ sta_ptr->tdls_cap.aid =
+ get_unaligned_le16((pos + 2));
++ }
++ break;
+ default:
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 58487e4eadd1e231bdf60df31b7a57f5b22788d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 16:20:45 +0000
+Subject: net/i40e: Fix concurrency issues between config flow and XSK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit b3873a5be757b44d51af542a50a6f2a3b6f95284 ]
+
+Use synchronize_rcu to wait until the XSK wakeup function finishes
+before destroying the resources it uses:
+
+1. i40e_down already calls synchronize_rcu. On i40e_down either
+__I40E_VSI_DOWN or __I40E_CONFIG_BUSY is set. Check the latter in
+i40e_xsk_wakeup (the former is already checked there).
+
+2. After switching the XDP program, call synchronize_rcu to let
+i40e_xsk_wakeup exit before the XDP program is freed.
+
+3. Changing the number of channels brings the interface down (see
+i40e_prep_for_reset and i40e_pf_quiesce_all_vsi).
+
+4. Disabling UMEM sets __I40E_CONFIG_BUSY, too.
+
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191217162023.16011-4-maximmi@mellanox.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e.h | 2 +-
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +++++++---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 ++++
+ 3 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
+index 2af9f6308f84..401304d4d553 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e.h
++++ b/drivers/net/ethernet/intel/i40e/i40e.h
+@@ -1151,7 +1151,7 @@ void i40e_set_fec_in_flags(u8 fec_cfg, u32 *flags);
+
+ static inline bool i40e_enabled_xdp_vsi(struct i40e_vsi *vsi)
+ {
+- return !!vsi->xdp_prog;
++ return !!READ_ONCE(vsi->xdp_prog);
+ }
+
+ int i40e_create_queue_channel(struct i40e_vsi *vsi, struct i40e_channel *ch);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 339925af0206..4960c9c3e773 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -6804,8 +6804,8 @@ void i40e_down(struct i40e_vsi *vsi)
+ for (i = 0; i < vsi->num_queue_pairs; i++) {
+ i40e_clean_tx_ring(vsi->tx_rings[i]);
+ if (i40e_enabled_xdp_vsi(vsi)) {
+- /* Make sure that in-progress ndo_xdp_xmit
+- * calls are completed.
++ /* Make sure that in-progress ndo_xdp_xmit and
++ * ndo_xsk_wakeup calls are completed.
+ */
+ synchronize_rcu();
+ i40e_clean_tx_ring(vsi->xdp_rings[i]);
+@@ -12526,8 +12526,12 @@ static int i40e_xdp_setup(struct i40e_vsi *vsi,
+
+ old_prog = xchg(&vsi->xdp_prog, prog);
+
+- if (need_reset)
++ if (need_reset) {
++ if (!prog)
++ /* Wait until ndo_xsk_wakeup completes. */
++ synchronize_rcu();
+ i40e_reset_and_rebuild(pf, true, true);
++ }
+
+ for (i = 0; i < vsi->num_queue_pairs; i++)
+ WRITE_ONCE(vsi->rx_rings[i]->xdp_prog, vsi->xdp_prog);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index d07e1a890428..f73cd917c44f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -787,8 +787,12 @@ int i40e_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags)
+ {
+ struct i40e_netdev_priv *np = netdev_priv(dev);
+ struct i40e_vsi *vsi = np->vsi;
++ struct i40e_pf *pf = vsi->back;
+ struct i40e_ring *ring;
+
++ if (test_bit(__I40E_CONFIG_BUSY, pf->state))
++ return -ENETDOWN;
++
+ if (test_bit(__I40E_VSI_DOWN, vsi->state))
+ return -ENETDOWN;
+
+--
+2.20.1
+
--- /dev/null
+From e664e2ecca46ae898be16a86fda46fdaaf729bc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 16:20:47 +0000
+Subject: net/ixgbe: Fix concurrency issues between config flow and XSK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit c0fdccfd226a1424683d3000d9e08384391210a2 ]
+
+Use synchronize_rcu to wait until the XSK wakeup function finishes
+before destroying the resources it uses:
+
+1. ixgbe_down already calls synchronize_rcu after setting __IXGBE_DOWN.
+
+2. After switching the XDP program, call synchronize_rcu to let
+ixgbe_xsk_wakeup exit before the XDP program is freed.
+
+3. Changing the number of channels brings the interface down.
+
+4. Disabling UMEM sets __IXGBE_TX_DISABLED before closing hardware
+resources and resetting xsk_umem. Check that bit in ixgbe_xsk_wakeup to
+avoid using the XDP ring when it's already destroyed. synchronize_rcu is
+called from ixgbe_txrx_ring_disable.
+
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191217162023.16011-5-maximmi@mellanox.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 7 ++++++-
+ drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 8 ++++++--
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 1a7203fede12..c6404abf2dd1 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -10248,7 +10248,12 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)
+
+ /* If transitioning XDP modes reconfigure rings */
+ if (need_reset) {
+- int err = ixgbe_setup_tc(dev, adapter->hw_tcs);
++ int err;
++
++ if (!prog)
++ /* Wait until ndo_xsk_wakeup completes. */
++ synchronize_rcu();
++ err = ixgbe_setup_tc(dev, adapter->hw_tcs);
+
+ if (err) {
+ rcu_assign_pointer(adapter->xdp_prog, old_prog);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+index d6feaacfbf89..b43be9f14105 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c
+@@ -709,10 +709,14 @@ int ixgbe_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags)
+ if (qid >= adapter->num_xdp_queues)
+ return -ENXIO;
+
+- if (!adapter->xdp_ring[qid]->xsk_umem)
++ ring = adapter->xdp_ring[qid];
++
++ if (test_bit(__IXGBE_TX_DISABLED, &ring->state))
++ return -ENETDOWN;
++
++ if (!ring->xsk_umem)
+ return -ENXIO;
+
+- ring = adapter->xdp_ring[qid];
+ if (!napi_if_scheduled_mark_missed(&ring->q_vector->napi)) {
+ u64 eics = BIT_ULL(ring->q_vector->v_idx);
+
+--
+2.20.1
+
--- /dev/null
+From 1c7478dc809fb23f6fc54d120c255a07b6cec973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 16:20:44 +0000
+Subject: net/mlx5e: Fix concurrency issues between config flow and XSK
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 9cf88808ad6a0f1e958e00abd9a081295fe6da0c ]
+
+After disabling resources necessary for XSK (the XDP program, channels,
+XSK queues), use synchronize_rcu to wait until the XSK wakeup function
+finishes, before freeing the resources.
+
+Suspend XSK wakeups during switching channels. If the XDP program is
+being removed, synchronize_rcu before closing the old channels to allow
+XSK wakeup to complete.
+
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191217162023.16011-3-maximmi@mellanox.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
+ .../net/ethernet/mellanox/mlx5/core/en/xdp.h | 22 ++++++++-----------
+ .../mellanox/mlx5/core/en/xsk/setup.c | 1 +
+ .../ethernet/mellanox/mlx5/core/en/xsk/tx.c | 2 +-
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 19 +---------------
+ 5 files changed, 13 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+index 2c16add0b642..9c8427698238 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -760,7 +760,7 @@ enum {
+ MLX5E_STATE_OPENED,
+ MLX5E_STATE_DESTROYING,
+ MLX5E_STATE_XDP_TX_ENABLED,
+- MLX5E_STATE_XDP_OPEN,
++ MLX5E_STATE_XDP_ACTIVE,
+ };
+
+ struct mlx5e_rqt {
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+index 36ac1e3816b9..d7587f40ecae 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+@@ -75,12 +75,18 @@ int mlx5e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames,
+ static inline void mlx5e_xdp_tx_enable(struct mlx5e_priv *priv)
+ {
+ set_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
++
++ if (priv->channels.params.xdp_prog)
++ set_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state);
+ }
+
+ static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
+ {
++ if (priv->channels.params.xdp_prog)
++ clear_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state);
++
+ clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+- /* let other device's napi(s) see our new state */
++ /* Let other device's napi(s) and XSK wakeups see our new state. */
+ synchronize_rcu();
+ }
+
+@@ -89,19 +95,9 @@ static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
+ return test_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+ }
+
+-static inline void mlx5e_xdp_set_open(struct mlx5e_priv *priv)
+-{
+- set_bit(MLX5E_STATE_XDP_OPEN, &priv->state);
+-}
+-
+-static inline void mlx5e_xdp_set_closed(struct mlx5e_priv *priv)
+-{
+- clear_bit(MLX5E_STATE_XDP_OPEN, &priv->state);
+-}
+-
+-static inline bool mlx5e_xdp_is_open(struct mlx5e_priv *priv)
++static inline bool mlx5e_xdp_is_active(struct mlx5e_priv *priv)
+ {
+- return test_bit(MLX5E_STATE_XDP_OPEN, &priv->state);
++ return test_bit(MLX5E_STATE_XDP_ACTIVE, &priv->state);
+ }
+
+ static inline void mlx5e_xmit_xdp_doorbell(struct mlx5e_xdpsq *sq)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+index 631af8dee517..c28cbae42331 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+@@ -144,6 +144,7 @@ void mlx5e_close_xsk(struct mlx5e_channel *c)
+ {
+ clear_bit(MLX5E_CHANNEL_STATE_XSK, c->state);
+ napi_synchronize(&c->napi);
++ synchronize_rcu(); /* Sync with the XSK wakeup. */
+
+ mlx5e_close_rq(&c->xskrq);
+ mlx5e_close_cq(&c->xskrq.cq);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c
+index 87827477d38c..fe2d596cb361 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c
+@@ -14,7 +14,7 @@ int mlx5e_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags)
+ struct mlx5e_channel *c;
+ u16 ix;
+
+- if (unlikely(!mlx5e_xdp_is_open(priv)))
++ if (unlikely(!mlx5e_xdp_is_active(priv)))
+ return -ENETDOWN;
+
+ if (unlikely(!mlx5e_qid_get_ch_if_in_group(params, qid, MLX5E_RQ_GROUP_XSK, &ix)))
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 6abd4ed5b69b..29a5a8c894e3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3002,12 +3002,9 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
+ int mlx5e_open_locked(struct net_device *netdev)
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+- bool is_xdp = priv->channels.params.xdp_prog;
+ int err;
+
+ set_bit(MLX5E_STATE_OPENED, &priv->state);
+- if (is_xdp)
+- mlx5e_xdp_set_open(priv);
+
+ err = mlx5e_open_channels(priv, &priv->channels);
+ if (err)
+@@ -3022,8 +3019,6 @@ int mlx5e_open_locked(struct net_device *netdev)
+ return 0;
+
+ err_clear_state_opened_flag:
+- if (is_xdp)
+- mlx5e_xdp_set_closed(priv);
+ clear_bit(MLX5E_STATE_OPENED, &priv->state);
+ return err;
+ }
+@@ -3055,8 +3050,6 @@ int mlx5e_close_locked(struct net_device *netdev)
+ if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
+ return 0;
+
+- if (priv->channels.params.xdp_prog)
+- mlx5e_xdp_set_closed(priv);
+ clear_bit(MLX5E_STATE_OPENED, &priv->state);
+
+ netif_carrier_off(priv->netdev);
+@@ -4373,16 +4366,6 @@ static int mlx5e_xdp_allowed(struct mlx5e_priv *priv, struct bpf_prog *prog)
+ return 0;
+ }
+
+-static int mlx5e_xdp_update_state(struct mlx5e_priv *priv)
+-{
+- if (priv->channels.params.xdp_prog)
+- mlx5e_xdp_set_open(priv);
+- else
+- mlx5e_xdp_set_closed(priv);
+-
+- return 0;
+-}
+-
+ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)
+ {
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+@@ -4422,7 +4405,7 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog)
+ mlx5e_set_rq_type(priv->mdev, &new_channels.params);
+ old_prog = priv->channels.params.xdp_prog;
+
+- err = mlx5e_safe_switch_channels(priv, &new_channels, mlx5e_xdp_update_state);
++ err = mlx5e_safe_switch_channels(priv, &new_channels, NULL);
+ if (err)
+ goto unlock;
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 62c264969db5dadab962e6d847ff3235491764a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:17:43 +0100
+Subject: net: stmmac: Always arm TX Timer at end of transmission start
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 4772f26db8d1fb568c4862c538344a1b5fb52081 ]
+
+If TX Coalesce timer is enabled we should always arm it, otherwise we
+may hit the case where an interrupt is missed and the TX Queue will
+timeout.
+
+Arming the timer does not necessarly mean it will run the tx_clean()
+because this function is wrapped around NAPI launcher.
+
+Fixes: 9125cdd1be11 ("stmmac: add the initial tx coalesce schema")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index cfb60b20e625..903c5d8a226e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3101,6 +3101,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
+ stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
++ stmmac_tx_timer_arm(priv, queue);
+
+ return NETDEV_TX_OK;
+
+@@ -3328,6 +3329,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ tx_q->tx_tail_addr = tx_q->dma_tx_phy + (tx_q->cur_tx * sizeof(*desc));
+ stmmac_set_tx_tail_ptr(priv, priv->ioaddr, tx_q->tx_tail_addr, queue);
++ stmmac_tx_timer_arm(priv, queue);
+
+ return NETDEV_TX_OK;
+
+--
+2.20.1
+
--- /dev/null
+From 6958d8a8b7d54325756972f9113d242682d48b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:17:36 +0100
+Subject: net: stmmac: Determine earlier the size of RX buffer
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 5d626c879e238be9585bd59a61eb606c9408178a ]
+
+Split Header feature needs to know the size of RX buffer but current
+code is determining it too late. Fix this by moving the RX buffer
+computation to earlier stage.
+
+Changes from v2:
+- Do not try to align already aligned buffer size
+
+Fixes: 67afd6d1cfdf ("net: stmmac: Add Split Header support and enable it in XGMAC cores")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 24 +++++++++----------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 271a00f24f45..d9520c029ae5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1292,19 +1292,9 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
+ struct stmmac_priv *priv = netdev_priv(dev);
+ u32 rx_count = priv->plat->rx_queues_to_use;
+ int ret = -ENOMEM;
+- int bfsize = 0;
+ int queue;
+ int i;
+
+- bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu);
+- if (bfsize < 0)
+- bfsize = 0;
+-
+- if (bfsize < BUF_SIZE_16KiB)
+- bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
+-
+- priv->dma_buf_sz = bfsize;
+-
+ /* RX INITIALIZATION */
+ netif_dbg(priv, probe, priv->dev,
+ "SKB addresses:\nskb\t\tskb data\tdma data\n");
+@@ -1346,8 +1336,6 @@ static int init_dma_rx_desc_rings(struct net_device *dev, gfp_t flags)
+ }
+ }
+
+- buf_sz = bfsize;
+-
+ return 0;
+
+ err_init_rx_buffers:
+@@ -2654,6 +2642,7 @@ static void stmmac_hw_teardown(struct net_device *dev)
+ static int stmmac_open(struct net_device *dev)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
++ int bfsize = 0;
+ u32 chan;
+ int ret;
+
+@@ -2673,7 +2662,16 @@ static int stmmac_open(struct net_device *dev)
+ memset(&priv->xstats, 0, sizeof(struct stmmac_extra_stats));
+ priv->xstats.threshold = tc;
+
+- priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
++ bfsize = stmmac_set_16kib_bfsize(priv, dev->mtu);
++ if (bfsize < 0)
++ bfsize = 0;
++
++ if (bfsize < BUF_SIZE_16KiB)
++ bfsize = stmmac_set_bfsize(dev->mtu, priv->dma_buf_sz);
++
++ priv->dma_buf_sz = bfsize;
++ buf_sz = bfsize;
++
+ priv->rx_copybreak = STMMAC_RX_COPYBREAK;
+
+ ret = alloc_dma_desc_resources(priv);
+--
+2.20.1
+
--- /dev/null
+From 51190ee94a74beedf33d6d7108b3560532b15010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:17:37 +0100
+Subject: net: stmmac: Do not accept invalid MTU values
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit eaf4fac478077d4ed57cbca2c044c4b58a96bd98 ]
+
+The maximum MTU value is determined by the maximum size of TX FIFO so
+that a full packet can fit in the FIFO. Add a check for this in the MTU
+change callback.
+
+Also check if provided and rounded MTU does not passes the maximum limit
+of 16K.
+
+Changes from v2:
+- Align MTU before checking if its valid
+
+Fixes: 7ac6653a085b ("stmmac: Move the STMicroelectronics driver")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index d9520c029ae5..1b4968e4a313 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3745,12 +3745,24 @@ static void stmmac_set_rx_mode(struct net_device *dev)
+ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
++ int txfifosz = priv->plat->tx_fifo_size;
++
++ if (txfifosz == 0)
++ txfifosz = priv->dma_cap.tx_fifo_size;
++
++ txfifosz /= priv->plat->tx_queues_to_use;
+
+ if (netif_running(dev)) {
+ netdev_err(priv->dev, "must be stopped to change its MTU\n");
+ return -EBUSY;
+ }
+
++ new_mtu = STMMAC_ALIGN(new_mtu);
++
++ /* If condition true, FIFO is too small or MTU too large */
++ if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB))
++ return -EINVAL;
++
+ dev->mtu = new_mtu;
+
+ netdev_update_features(dev);
+--
+2.20.1
+
--- /dev/null
+From 9d50a561eec8b4c720f2d54df19d42234baf4d9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:17:40 +0100
+Subject: net: stmmac: RX buffer size must be 16 byte aligned
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 8d558f0294fe92e04af192e221d0d0f6a180ee7b ]
+
+We need to align the RX buffer size to at least 16 byte so that IP
+doesn't mis-behave. This is required by HW.
+
+Changes from v2:
+- Align UP and not DOWN (David)
+
+Fixes: 7ac6653a085b ("stmmac: Move the STMicroelectronics driver")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 1b4968e4a313..cfb60b20e625 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -45,7 +45,7 @@
+ #include "dwxgmac2.h"
+ #include "hwif.h"
+
+-#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES)
++#define STMMAC_ALIGN(x) ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16)
+ #define TSO_MAX_BUFF_SIZE (SZ_16K - 1)
+
+ /* Module parameters */
+--
+2.20.1
+
--- /dev/null
+From 7f3a3faa7130dac56d543b3f00f7b1ce07431af2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:17:35 +0100
+Subject: net: stmmac: selftests: Needs to check the number of Multicast regs
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 08c965430869ed423921bd9058ae59f75207feb6 ]
+
+When running the MC and UC filter tests we setup a multicast address
+that its expected to be blocked. If the number of available multicast
+registers is zero, driver will always pass the multicast packets which
+will fail the test.
+
+Check if available multicast addresses is enough before running the
+tests.
+
+Fixes: 091810dbded9 ("net: stmmac: Introduce selftests support")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
+index ac3f658105c0..a0513deab1a0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
+@@ -624,6 +624,8 @@ static int stmmac_test_mcfilt(struct stmmac_priv *priv)
+ return -EOPNOTSUPP;
+ if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
+ return -EOPNOTSUPP;
++ if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
++ return -EOPNOTSUPP;
+
+ while (--tries) {
+ /* We only need to check the mc_addr for collisions */
+@@ -666,6 +668,8 @@ static int stmmac_test_ucfilt(struct stmmac_priv *priv)
+
+ if (stmmac_filter_check(priv))
+ return -EOPNOTSUPP;
++ if (netdev_uc_count(priv->dev) >= priv->hw->unicast_filter_entries)
++ return -EOPNOTSUPP;
+ if (netdev_mc_count(priv->dev) >= priv->hw->multicast_filter_bins)
+ return -EOPNOTSUPP;
+
+--
+2.20.1
+
--- /dev/null
+From cac2f3ee230735cd09acf4e59d0619eaa9c0263a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:17:39 +0100
+Subject: net: stmmac: xgmac: Clear previous RX buffer size
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 11d55fd9975f8e46a0e5e19c14899544e81e1e15 ]
+
+When switching between buffer sizes we need to clear the previous value.
+
+Fixes: d6ddfacd95c7 ("net: stmmac: Add DMA related callbacks for XGMAC2")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h | 2 ++
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 3 ++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+index 9d08a934fe4f..ff751ab3d765 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h
+@@ -343,6 +343,8 @@
+ #define XGMAC_DMA_CH_RX_CONTROL(x) (0x00003108 + (0x80 * (x)))
+ #define XGMAC_RxPBL GENMASK(21, 16)
+ #define XGMAC_RxPBL_SHIFT 16
++#define XGMAC_RBSZ GENMASK(14, 1)
++#define XGMAC_RBSZ_SHIFT 1
+ #define XGMAC_RXST BIT(0)
+ #define XGMAC_DMA_CH_TxDESC_HADDR(x) (0x00003110 + (0x80 * (x)))
+ #define XGMAC_DMA_CH_TxDESC_LADDR(x) (0x00003114 + (0x80 * (x)))
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+index f70ca5300b82..4af7271cea56 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+@@ -489,7 +489,8 @@ static void dwxgmac2_set_bfsize(void __iomem *ioaddr, int bfsize, u32 chan)
+ u32 value;
+
+ value = readl(ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+- value |= bfsize << 1;
++ value &= ~XGMAC_RBSZ;
++ value |= bfsize << XGMAC_RBSZ_SHIFT;
+ writel(value, ioaddr + XGMAC_DMA_CH_RX_CONTROL(chan));
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3a73b572190f3f30ce79404fe61bb9eee1810331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 18:33:11 +0200
+Subject: net: usb: lan78xx: Fix error message format specifier
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit 858ce8ca62ea1530f2779d0e3f934b0176e663c3 ]
+
+Display the return code as decimal integer.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 0becc79fd431..e3cdfdde2265 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -511,7 +511,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev,
+ }
+ } else {
+ netdev_warn(dev->net,
+- "Failed to read stat ret = 0x%x", ret);
++ "Failed to read stat ret = %d", ret);
+ }
+
+ kfree(stats);
+--
+2.20.1
+
--- /dev/null
+From 85f06af8bc6bcf3be6c06c1bbba4062f9779ee2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 12:39:23 +0100
+Subject: netfilter: ctnetlink: netns exit must wait for callbacks
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 18a110b022a5c02e7dc9f6109d0bd93e58ac6ebb ]
+
+Curtis Taylor and Jon Maxwell reported and debugged a crash on 3.10
+based kernel.
+
+Crash occurs in ctnetlink_conntrack_events because net->nfnl socket is
+NULL. The nfnl socket was set to NULL by netns destruction running on
+another cpu.
+
+The exiting network namespace calls the relevant destructors in the
+following order:
+
+1. ctnetlink_net_exit_batch
+
+This nulls out the event callback pointer in struct netns.
+
+2. nfnetlink_net_exit_batch
+
+This nulls net->nfnl socket and frees it.
+
+3. nf_conntrack_cleanup_net_list
+
+This removes all remaining conntrack entries.
+
+This is order is correct. The only explanation for the crash so ar is:
+
+cpu1: conntrack is dying, eviction occurs:
+ -> nf_ct_delete()
+ -> nf_conntrack_event_report \
+ -> nf_conntrack_eventmask_report
+ -> notify->fcn() (== ctnetlink_conntrack_events).
+
+cpu1: a. fetches rcu protected pointer to obtain ctnetlink event callback.
+ b. gets interrupted.
+ cpu2: runs netns exit handlers:
+ a runs ctnetlink destructor, event cb pointer set to NULL.
+ b runs nfnetlink destructor, nfnl socket is closed and set to NULL.
+cpu1: c. resumes and trips over NULL net->nfnl.
+
+Problem appears to be that ctnetlink_net_exit_batch only prevents future
+callers of nf_conntrack_eventmask_report() from obtaining the callback.
+It doesn't wait of other cpus that might have already obtained the
+callbacks address.
+
+I don't see anything in upstream kernels that would prevent similar
+crash: We need to wait for all cpus to have exited the event callback.
+
+Fixes: 9592a5c01e79dbc59eb56fa ("netfilter: ctnetlink: netns support")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index e2d13cd18875..aa8adf930b3c 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -3602,6 +3602,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
+
+ list_for_each_entry(net, net_exit_list, exit_list)
+ ctnetlink_net_exit(net);
++
++ /* wait for other cpus until they are done with ctnl_notifiers */
++ synchronize_rcu();
+ }
+
+ static struct pernet_operations ctnetlink_net_ops = {
+--
+2.20.1
+
--- /dev/null
+From 00ac8ddafd61f13c3fdc772b3995fa6e9bd06e00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 22:25:55 +0100
+Subject: netfilter: nf_tables: skip module reference count bump on object
+ updates
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit fd57d0cbe187e93f63777d36e9f49293311d417f ]
+
+Use __nft_obj_type_get() instead, otherwise there is a module reference
+counter leak.
+
+Fixes: d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object update operation")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 4c03c14e46bc..67ca47c7ce54 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5217,7 +5217,7 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk,
+ if (nlh->nlmsg_flags & NLM_F_REPLACE)
+ return -EOPNOTSUPP;
+
+- type = nft_obj_type_get(net, objtype);
++ type = __nft_obj_type_get(objtype);
+ nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
+
+ return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj);
+--
+2.20.1
+
--- /dev/null
+From 48f97c2fad6e12d860ed5af5a3e4304af2a22f02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 22:09:14 +0100
+Subject: netfilter: nf_tables: validate NFT_DATA_VALUE after nft_data_init()
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 0d2c96af797ba149e559c5875c0151384ab6dd14 ]
+
+Userspace might bogusly sent NFT_DATA_VERDICT in several netlink
+attributes that assume NFT_DATA_VALUE. Moreover, make sure that error
+path invokes nft_data_release() to decrement the reference count on the
+chain object.
+
+Fixes: 96518518cc41 ("netfilter: add nftables")
+Fixes: 0f3cd9b36977 ("netfilter: nf_tables: add range expression")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 4 +++-
+ net/netfilter/nft_bitwise.c | 4 ++--
+ net/netfilter/nft_cmp.c | 6 ++++++
+ net/netfilter/nft_range.c | 10 ++++++++++
+ 4 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 7120eba71ac5..4c03c14e46bc 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4252,8 +4252,10 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ return err;
+
+ err = -EINVAL;
+- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen)
++ if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) {
++ nft_data_release(&elem.key.val, desc.type);
+ return err;
++ }
+
+ priv = set->ops->get(ctx->net, set, &elem, flags);
+ if (IS_ERR(priv))
+diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
+index 02afa752dd2e..10e9d50e4e19 100644
+--- a/net/netfilter/nft_bitwise.c
++++ b/net/netfilter/nft_bitwise.c
+@@ -80,7 +80,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
+ tb[NFTA_BITWISE_MASK]);
+ if (err < 0)
+ return err;
+- if (d1.len != priv->len) {
++ if (d1.type != NFT_DATA_VALUE || d1.len != priv->len) {
+ err = -EINVAL;
+ goto err1;
+ }
+@@ -89,7 +89,7 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
+ tb[NFTA_BITWISE_XOR]);
+ if (err < 0)
+ goto err1;
+- if (d2.len != priv->len) {
++ if (d2.type != NFT_DATA_VALUE || d2.len != priv->len) {
+ err = -EINVAL;
+ goto err2;
+ }
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index 0744b2bb46da..ae730dba60c8 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -80,6 +80,12 @@ static int nft_cmp_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
+ if (err < 0)
+ return err;
+
++ if (desc.type != NFT_DATA_VALUE) {
++ err = -EINVAL;
++ nft_data_release(&priv->data, desc.type);
++ return err;
++ }
++
+ priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]);
+ err = nft_validate_register_load(priv->sreg, desc.len);
+ if (err < 0)
+diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
+index 4701fa8a45e7..89efcc5a533d 100644
+--- a/net/netfilter/nft_range.c
++++ b/net/netfilter/nft_range.c
+@@ -66,11 +66,21 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
+ if (err < 0)
+ return err;
+
++ if (desc_from.type != NFT_DATA_VALUE) {
++ err = -EINVAL;
++ goto err1;
++ }
++
+ err = nft_data_init(NULL, &priv->data_to, sizeof(priv->data_to),
+ &desc_to, tb[NFTA_RANGE_TO_DATA]);
+ if (err < 0)
+ goto err1;
+
++ if (desc_to.type != NFT_DATA_VALUE) {
++ err = -EINVAL;
++ goto err2;
++ }
++
+ if (desc_from.len != desc_to.len) {
+ err = -EINVAL;
+ goto err2;
+--
+2.20.1
+
--- /dev/null
+From b86b77154624be3911531e3baecaac28f424320c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 21:55:20 +0100
+Subject: netfilter: nf_tables: validate NFT_SET_ELEM_INTERVAL_END
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit bffc124b6fe37d0ae9b428d104efb426403bb5c9 ]
+
+Only NFTA_SET_ELEM_KEY and NFTA_SET_ELEM_FLAGS make sense for elements
+whose NFT_SET_ELEM_INTERVAL_END flag is set on.
+
+Fixes: 96518518cc41 ("netfilter: add nftables")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 712a428509ad..7120eba71ac5 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4489,14 +4489,20 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ if (nla[NFTA_SET_ELEM_DATA] == NULL &&
+ !(flags & NFT_SET_ELEM_INTERVAL_END))
+ return -EINVAL;
+- if (nla[NFTA_SET_ELEM_DATA] != NULL &&
+- flags & NFT_SET_ELEM_INTERVAL_END)
+- return -EINVAL;
+ } else {
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+ return -EINVAL;
+ }
+
++ if ((flags & NFT_SET_ELEM_INTERVAL_END) &&
++ (nla[NFTA_SET_ELEM_DATA] ||
++ nla[NFTA_SET_ELEM_OBJREF] ||
++ nla[NFTA_SET_ELEM_TIMEOUT] ||
++ nla[NFTA_SET_ELEM_EXPIRATION] ||
++ nla[NFTA_SET_ELEM_USERDATA] ||
++ nla[NFTA_SET_ELEM_EXPR]))
++ return -EINVAL;
++
+ timeout = 0;
+ if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
+ if (!(set->flags & NFT_SET_TIMEOUT))
+--
+2.20.1
+
--- /dev/null
+From 7bf618360d5d818805b313d2925fede321f2ff46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 12:21:07 +0800
+Subject: netfilter: nf_tables_offload: Check for the NETDEV_UNREGISTER event
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit d1f4c966475c6dd2545c6625022cb24e878bee11 ]
+
+Check for the NETDEV_UNREGISTER event from the nft_offload_netdev_event
+function, which is the event that actually triggers the clean up.
+
+Fixes: 06d392cbe3db ("netfilter: nf_tables_offload: remove rules when the device unregisters")
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_offload.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
+index 5f6037695dee..6f7eab502e65 100644
+--- a/net/netfilter/nf_tables_offload.c
++++ b/net/netfilter/nf_tables_offload.c
+@@ -446,6 +446,9 @@ static int nft_offload_netdev_event(struct notifier_block *this,
+ struct net *net = dev_net(dev);
+ struct nft_chain *chain;
+
++ if (event != NETDEV_UNREGISTER)
++ return NOTIFY_DONE;
++
+ mutex_lock(&net->nft.commit_mutex);
+ chain = __nft_offload_get_chain(dev);
+ if (chain)
+--
+2.20.1
+
--- /dev/null
+From f6088ecb70d1d6cd77c56e4e293d08325654a268 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 22:49:58 +0100
+Subject: netfilter: nf_tables_offload: return EOPNOTSUPP if rule specifies no
+ actions
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 81ec61074bcf68acfcb2820cda3ff9d9984419c7 ]
+
+If the rule only specifies the matching side, return EOPNOTSUPP.
+Otherwise, the front-end relies on the drivers to reject this rule.
+
+Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_offload.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
+index 6f7eab502e65..e743f811245f 100644
+--- a/net/netfilter/nf_tables_offload.c
++++ b/net/netfilter/nf_tables_offload.c
+@@ -44,6 +44,9 @@ struct nft_flow_rule *nft_flow_rule_create(struct net *net,
+ expr = nft_expr_next(expr);
+ }
+
++ if (num_actions == 0)
++ return ERR_PTR(-EOPNOTSUPP);
++
+ flow = nft_flow_rule_alloc(num_actions);
+ if (!flow)
+ return ERR_PTR(-ENOMEM);
+--
+2.20.1
+
--- /dev/null
+From b49a426ba57795b0220b371f4572edcf98e4afac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 20:23:29 +0100
+Subject: netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements
+ in named sets
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit db3b665dd77b34e34df00e17d7b299c98fcfb2c5 ]
+
+The existing rbtree implementation might store consecutive elements
+where the closing element and the opening element might overlap, eg.
+
+ [ a, a+1) [ a+1, a+2)
+
+This patch removes the optimization for non-anonymous sets in the exact
+matching case, where it is assumed to stop searching in case that the
+closing element is found. Instead, invalidate candidate interval and
+keep looking further in the tree.
+
+The lookup/get operation might return false, while there is an element
+in the rbtree. Moreover, the get operation returns true as if a+2 would
+be in the tree. This happens with named sets after several set updates.
+
+The existing lookup optimization (that only works for the anonymous
+sets) might not reach the opening [ a+1,... element if the closing
+...,a+1) is found in first place when walking over the rbtree. Hence,
+walking the full tree in that case is needed.
+
+This patch fixes the lookup and get operations.
+
+Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates")
+Fixes: ba0e4d9917b4 ("netfilter: nf_tables: get set elements via netlink")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_rbtree.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index 57123259452f..a9f804f7a04a 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -74,8 +74,13 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+ parent = rcu_dereference_raw(parent->rb_left);
+ continue;
+ }
+- if (nft_rbtree_interval_end(rbe))
+- goto out;
++ if (nft_rbtree_interval_end(rbe)) {
++ if (nft_set_is_anonymous(set))
++ return false;
++ parent = rcu_dereference_raw(parent->rb_left);
++ interval = NULL;
++ continue;
++ }
+
+ *ext = &rbe->ext;
+ return true;
+@@ -88,7 +93,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
+ *ext = &interval->ext;
+ return true;
+ }
+-out:
++
+ return false;
+ }
+
+@@ -139,8 +144,10 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+ if (flags & NFT_SET_ELEM_INTERVAL_END)
+ interval = rbe;
+ } else {
+- if (!nft_set_elem_active(&rbe->ext, genmask))
++ if (!nft_set_elem_active(&rbe->ext, genmask)) {
+ parent = rcu_dereference_raw(parent->rb_left);
++ continue;
++ }
+
+ if (!nft_set_ext_exists(&rbe->ext, NFT_SET_EXT_FLAGS) ||
+ (*nft_set_ext_flags(&rbe->ext) & NFT_SET_ELEM_INTERVAL_END) ==
+@@ -148,7 +155,11 @@ static bool __nft_rbtree_get(const struct net *net, const struct nft_set *set,
+ *elem = rbe;
+ return true;
+ }
+- return false;
++
++ if (nft_rbtree_interval_end(rbe))
++ interval = NULL;
++
++ parent = rcu_dereference_raw(parent->rb_left);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5aa4995f8049baeb507b66bec17d8c9c6000013d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 13:35:11 +0100
+Subject: netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 164166558aacea01b99c8c8ffb710d930405ba69 ]
+
+With 'bytes(__u32)' being 32, a left-shift of 31 may happen which is
+undefined for the signed 32-bit value 1. Avoid this by declaring 1 as
+unsigned.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter/xt_sctp.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h
+index 4bc6d1a08781..b4d804a9fccb 100644
+--- a/include/uapi/linux/netfilter/xt_sctp.h
++++ b/include/uapi/linux/netfilter/xt_sctp.h
+@@ -41,19 +41,19 @@ struct xt_sctp_info {
+ #define SCTP_CHUNKMAP_SET(chunkmap, type) \
+ do { \
+ (chunkmap)[type / bytes(__u32)] |= \
+- 1 << (type % bytes(__u32)); \
++ 1u << (type % bytes(__u32)); \
+ } while (0)
+
+ #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
+ do { \
+ (chunkmap)[type / bytes(__u32)] &= \
+- ~(1 << (type % bytes(__u32))); \
++ ~(1u << (type % bytes(__u32))); \
+ } while (0)
+
+ #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
+ ({ \
+ ((chunkmap)[type / bytes (__u32)] & \
+- (1 << (type % bytes (__u32)))) ? 1: 0; \
++ (1u << (type % bytes (__u32)))) ? 1: 0; \
+ })
+
+ #define SCTP_CHUNKMAP_RESET(chunkmap) \
+--
+2.20.1
+
--- /dev/null
+From 6d4710e259dacef9996575d025086dd22edf6688 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 11:55:13 +0100
+Subject: ocxl: Fix potential memory leak on context creation
+
+From: Frederic Barrat <fbarrat@linux.ibm.com>
+
+[ Upstream commit 913e73c77d48aeeb50c16450a653dca9c71ae2e2 ]
+
+If we couldn't fully init a context, we were leaking memory.
+
+Fixes: b9721d275cc2 ("ocxl: Allow external drivers to use OpenCAPI contexts")
+Signed-off-by: Frederic Barrat <fbarrat@linux.ibm.com>
+Acked-by: Andrew Donnellan <ajd@linux.ibm.com>
+Reviewed-by: Greg Kurz <groug@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191209105513.8566-1-fbarrat@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/ocxl/context.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/ocxl/context.c b/drivers/misc/ocxl/context.c
+index 994563a078eb..de8a66b9d76b 100644
+--- a/drivers/misc/ocxl/context.c
++++ b/drivers/misc/ocxl/context.c
+@@ -10,18 +10,17 @@ int ocxl_context_alloc(struct ocxl_context **context, struct ocxl_afu *afu,
+ int pasid;
+ struct ocxl_context *ctx;
+
+- *context = kzalloc(sizeof(struct ocxl_context), GFP_KERNEL);
+- if (!*context)
++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++ if (!ctx)
+ return -ENOMEM;
+
+- ctx = *context;
+-
+ ctx->afu = afu;
+ mutex_lock(&afu->contexts_lock);
+ pasid = idr_alloc(&afu->contexts_idr, ctx, afu->pasid_base,
+ afu->pasid_base + afu->pasid_max, GFP_KERNEL);
+ if (pasid < 0) {
+ mutex_unlock(&afu->contexts_lock);
++ kfree(ctx);
+ return pasid;
+ }
+ afu->pasid_count++;
+@@ -43,6 +42,7 @@ int ocxl_context_alloc(struct ocxl_context **context, struct ocxl_afu *afu,
+ * duration of the life of the context
+ */
+ ocxl_afu_get(afu);
++ *context = ctx;
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(ocxl_context_alloc);
+--
+2.20.1
+
--- /dev/null
+From ebeac0cced68732d3864656317d6458ad09b81e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 20:09:27 +0100
+Subject: parisc: add missing __init annotation
+
+From: Sven Schnelle <svens@stackframe.org>
+
+[ Upstream commit aeea5eae4fd54e94d820ed17ea3b238160be723e ]
+
+compilation failed with:
+
+MODPOST vmlinux.o
+WARNING: vmlinux.o(.text.unlikely+0xa0c): Section mismatch in reference from the function walk_lower_bus() to the function .init.text:walk_native_bus()
+The function walk_lower_bus() references
+the function __init walk_native_bus().
+This is often because walk_lower_bus lacks a __init
+annotation or the annotation of walk_native_bus is wrong.
+
+FATAL: modpost: Section mismatches detected.
+Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.
+make[2]: *** [/home/svens/linux/parisc-linux/src/scripts/Makefile.modpost:64: __modpost] Error 1
+make[1]: *** [/home/svens/linux/parisc-linux/src/Makefile:1077: vmlinux] Error 2
+make[1]: Leaving directory '/home/svens/linux/parisc-linux/build'
+make: *** [Makefile:179: sub-make] Error 2
+
+Signed-off-by: Sven Schnelle <svens@stackframe.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/drivers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index 3b330e58a4f0..a6c9f49c6612 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -810,7 +810,7 @@ EXPORT_SYMBOL(device_to_hwpath);
+ static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high,
+ struct device *parent);
+
+-static void walk_lower_bus(struct parisc_device *dev)
++static void __init walk_lower_bus(struct parisc_device *dev)
+ {
+ unsigned long io_io_low, io_io_high;
+
+--
+2.20.1
+
--- /dev/null
+From 6e5f994e72b37a7cea61dd4e00ce9898a16dce75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 20:10:39 +0100
+Subject: parisc: fix compilation when KEXEC=n and KEXEC_FILE=y
+
+From: Sven Schnelle <svens@stackframe.org>
+
+[ Upstream commit e16260c21f87b16a33ae8ecac9e8c79f3a8b89bd ]
+
+Fix compilation when the CONFIG_KEXEC_FILE=y and
+CONFIG_KEXEC=n.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Sven Schnelle <svens@stackframe.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/kexec.h | 4 ----
+ arch/parisc/kernel/Makefile | 2 +-
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/arch/parisc/include/asm/kexec.h b/arch/parisc/include/asm/kexec.h
+index a99ea747d7ed..87e174006995 100644
+--- a/arch/parisc/include/asm/kexec.h
++++ b/arch/parisc/include/asm/kexec.h
+@@ -2,8 +2,6 @@
+ #ifndef _ASM_PARISC_KEXEC_H
+ #define _ASM_PARISC_KEXEC_H
+
+-#ifdef CONFIG_KEXEC
+-
+ /* Maximum physical address we can use pages from */
+ #define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can reach in physical address mode */
+@@ -32,6 +30,4 @@ static inline void crash_setup_regs(struct pt_regs *newregs,
+
+ #endif /* __ASSEMBLY__ */
+
+-#endif /* CONFIG_KEXEC */
+-
+ #endif /* _ASM_PARISC_KEXEC_H */
+diff --git a/arch/parisc/kernel/Makefile b/arch/parisc/kernel/Makefile
+index 2663c8f8be11..068d90950d93 100644
+--- a/arch/parisc/kernel/Makefile
++++ b/arch/parisc/kernel/Makefile
+@@ -37,5 +37,5 @@ obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o
+ obj-$(CONFIG_JUMP_LABEL) += jump_label.o
+ obj-$(CONFIG_KGDB) += kgdb.o
+ obj-$(CONFIG_KPROBES) += kprobes.o
+-obj-$(CONFIG_KEXEC) += kexec.o relocate_kernel.o
++obj-$(CONFIG_KEXEC_CORE) += kexec.o relocate_kernel.o
+ obj-$(CONFIG_KEXEC_FILE) += kexec_file.o
+--
+2.20.1
+
--- /dev/null
+From 18f6f5d4de960db1e03197dd5e602c518cc5697c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 21:00:19 +0100
+Subject: parisc: Fix compiler warnings in debug_core.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 75cf9797006a3a9f29a3a25c1febd6842a4a9eb2 ]
+
+Fix this compiler warning:
+kernel/debug/debug_core.c: In function ‘kgdb_cpu_enter’:
+arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value]
+ 48 | ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
+arch/parisc/include/asm/atomic.h:78:30: note: in expansion of macro ‘xchg’
+ 78 | #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+ | ^~~~
+kernel/debug/debug_core.c:596:4: note: in expansion of macro ‘atomic_xchg’
+ 596 | atomic_xchg(&kgdb_active, cpu);
+ | ^~~~~~~~~~~
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/cmpxchg.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h
+index f627c37dad9c..ab5c215cf46c 100644
+--- a/arch/parisc/include/asm/cmpxchg.h
++++ b/arch/parisc/include/asm/cmpxchg.h
+@@ -44,8 +44,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size)
+ ** if (((unsigned long)p & 0xf) == 0)
+ ** return __ldcw(p);
+ */
+-#define xchg(ptr, x) \
+- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
++#define xchg(ptr, x) \
++({ \
++ __typeof__(*(ptr)) __ret; \
++ __typeof__(*(ptr)) _x_ = (x); \
++ __ret = (__typeof__(*(ptr))) \
++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \
++ __ret; \
++})
+
+ /* bug catcher for when unsupported size is used - won't link */
+ extern void __cmpxchg_called_with_bad_pointer(void);
+--
+2.20.1
+
--- /dev/null
+From 052d4d4dafc8e60f90588336271a5359d7b1b22e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Dec 2019 17:20:56 +0100
+Subject: perf header: Fix false warning when there are no duplicate cache
+ entries
+
+From: Michael Petlan <mpetlan@redhat.com>
+
+[ Upstream commit 28707826877f84bce0977845ea529cbdd08e4e8d ]
+
+Before this patch, perf expected that there might be NPROC*4 unique
+cache entries at max, however, it also expected that some of them would
+be shared and/or of the same size, thus the final number of entries
+would be reduced to be lower than NPROC*4. In case the number of entries
+hadn't been reduced (was NPROC*4), the warning was printed.
+
+However, some systems might have unusual cache topology, such as the
+following two-processor KVM guest:
+
+ cpu level shared_cpu_list size
+ 0 1 0 32K
+ 0 1 0 64K
+ 0 2 0 512K
+ 0 3 0 8192K
+ 1 1 1 32K
+ 1 1 1 64K
+ 1 2 1 512K
+ 1 3 1 8192K
+
+This KVM guest has 8 (NPROC*4) unique cache entries, which used to make
+perf printing the message, although there actually aren't "way too many
+cpu caches".
+
+v2: Removing unused argument.
+
+v3: Unifying the way we obtain number of cpus.
+
+v4: Removed '& UINT_MAX' construct which is redundant.
+
+Signed-off-by: Michael Petlan <mpetlan@redhat.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+LPU-Reference: 20191208162056.20772-1-mpetlan@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/header.c | 21 ++++++---------------
+ 1 file changed, 6 insertions(+), 15 deletions(-)
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index becc2d109423..d3412f2c0d18 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1089,21 +1089,18 @@ static void cpu_cache_level__fprintf(FILE *out, struct cpu_cache_level *c)
+ fprintf(out, "L%d %-15s %8s [%s]\n", c->level, c->type, c->size, c->map);
+ }
+
+-static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp)
++#define MAX_CACHE_LVL 4
++
++static int build_caches(struct cpu_cache_level caches[], u32 *cntp)
+ {
+ u32 i, cnt = 0;
+- long ncpus;
+ u32 nr, cpu;
+ u16 level;
+
+- ncpus = sysconf(_SC_NPROCESSORS_CONF);
+- if (ncpus < 0)
+- return -1;
+-
+- nr = (u32)(ncpus & UINT_MAX);
++ nr = cpu__max_cpu();
+
+ for (cpu = 0; cpu < nr; cpu++) {
+- for (level = 0; level < 10; level++) {
++ for (level = 0; level < MAX_CACHE_LVL; level++) {
+ struct cpu_cache_level c;
+ int err;
+
+@@ -1123,18 +1120,12 @@ static int build_caches(struct cpu_cache_level caches[], u32 size, u32 *cntp)
+ caches[cnt++] = c;
+ else
+ cpu_cache_level__free(&c);
+-
+- if (WARN_ONCE(cnt == size, "way too many cpu caches.."))
+- goto out;
+ }
+ }
+- out:
+ *cntp = cnt;
+ return 0;
+ }
+
+-#define MAX_CACHE_LVL 4
+-
+ static int write_cache(struct feat_fd *ff,
+ struct evlist *evlist __maybe_unused)
+ {
+@@ -1143,7 +1134,7 @@ static int write_cache(struct feat_fd *ff,
+ u32 cnt = 0, i, version = 1;
+ int ret;
+
+- ret = build_caches(caches, max_caches, &cnt);
++ ret = build_caches(caches, &cnt);
+ if (ret)
+ goto out;
+
+--
+2.20.1
+
--- /dev/null
+From 37a98ba53c72a2614de723c6079993be52ef403f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 14:10:59 +0530
+Subject: perf metricgroup: Fix printing event names of metric group with
+ multiple events
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit eb573e746b9d4f0921dcb2449be3df41dae3caea ]
+
+Commit f01642e4912b ("perf metricgroup: Support multiple events for
+metricgroup") introduced support for multiple events in a metric group.
+But with the current upstream, metric events names are not printed
+properly
+
+In power9 platform:
+
+command:# ./perf stat --metric-only -M translation -C 0 -I 1000 sleep 2
+ 1.000208486
+ 2.000368863
+ 2.001400558
+
+Similarly in skylake platform:
+
+command:./perf stat --metric-only -M Power -I 1000
+ 1.000579994
+ 2.002189493
+
+With current upstream version, issue is with event name comparison logic
+in find_evsel_group(). Current logic is to compare events belonging to a
+metric group to the events in perf_evlist. Since the break statement is
+missing in the loop used for comparison between metric group and
+perf_evlist events, the loop continues to execute even after getting a
+pattern match, and end up in discarding the matches.
+
+Incase of single metric event belongs to metric group, its working fine,
+because in case of single event once it compare all events it reaches to
+end of perf_evlist.
+
+Example for single metric event in power9 platform:
+
+command:# ./perf stat --metric-only -M branches_per_inst -I 1000 sleep 1
+ 1.000094653 0.2
+ 1.001337059 0.0
+
+This patch fixes the issue by making sure once we found all events
+belongs to that metric event matched in find_evsel_group(), we
+successfully break from that loop by adding corresponding condition.
+
+With this patch:
+In power9 platform:
+
+command:# ./perf stat --metric-only -M translation -C 0 -I 1000 sleep 2
+result:#
+ time derat_4k_miss_rate_percent derat_4k_miss_ratio derat_miss_ratio derat_64k_miss_rate_percent derat_64k_miss_ratio dslb_miss_rate_percent islb_miss_rate_percent
+ 1.000135672 0.0 0.3 1.0 0.0 0.2 0.0 0.0
+ 2.000380617 0.0 0.0 0.0 0.0 0.0 0.0 0.0
+
+command:# ./perf stat --metric-only -M Power -I 1000
+
+Similarly in skylake platform:
+result:#
+ time Turbo_Utilization C3_Core_Residency C6_Core_Residency C7_Core_Residency C2_Pkg_Residency C3_Pkg_Residency C6_Pkg_Residency C7_Pkg_Residency
+ 1.000563580 0.3 0.0 2.6 44.2 21.9 0.0 0.0 0.0
+ 2.002235027 0.4 0.0 2.7 43.0 20.7 0.0 0.0 0.0
+
+Committer testing:
+
+ Before:
+
+ [root@seventh ~]# perf stat --metric-only -M Power -I 1000
+ # time
+ 1.000383223
+ 2.001168182
+ 3.001968545
+ 4.002741200
+ 5.003442022
+ ^C 5.777687244
+
+ [root@seventh ~]#
+
+ After the patch:
+
+ [root@seventh ~]# perf stat --metric-only -M Power -I 1000
+ # time Turbo_Utilization C3_Core_Residency C6_Core_Residency C7_Core_Residency C2_Pkg_Residency C3_Pkg_Residency C6_Pkg_Residency C7_Pkg_Residency
+ 1.000406577 0.4 0.1 1.4 97.0 0.0 0.0 0.0 0.0
+ 2.001481572 0.3 0.0 0.6 97.9 0.0 0.0 0.0 0.0
+ 3.002332585 0.2 0.0 1.0 97.5 0.0 0.0 0.0 0.0
+ 4.003196624 0.2 0.0 0.3 98.6 0.0 0.0 0.0 0.0
+ 5.004063851 0.3 0.0 0.7 97.7 0.0 0.0 0.0 0.0
+ ^C 5.471260276 0.2 0.0 0.5 49.3 0.0 0.0 0.0 0.0
+
+ [root@seventh ~]#
+ [root@seventh ~]# dmesg | grep -i skylake
+ [ 0.187807] Performance Events: PEBS fmt3+, Skylake events, 32-deep LBR, full-width counters, Intel PMU driver.
+ [root@seventh ~]#
+
+Fixes: f01642e4912b ("perf metricgroup: Support multiple events for metricgroup")
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Reviewed-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20191120084059.24458-1-kjain@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/metricgroup.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c
+index a7c0424dbda3..940a6e7a6854 100644
+--- a/tools/perf/util/metricgroup.c
++++ b/tools/perf/util/metricgroup.c
+@@ -103,8 +103,11 @@ static struct evsel *find_evsel_group(struct evlist *perf_evlist,
+ if (!strcmp(ev->name, ids[i])) {
+ if (!metric_events[i])
+ metric_events[i] = ev;
++ i++;
++ if (i == idnum)
++ break;
+ } else {
+- if (++i == idnum) {
++ if (i + 1 == idnum) {
+ /* Discard the whole match and start again */
+ i = 0;
+ memset(metric_events, 0,
+@@ -124,7 +127,7 @@ static struct evsel *find_evsel_group(struct evlist *perf_evlist,
+ }
+ }
+
+- if (i != idnum - 1) {
++ if (i != idnum) {
+ /* Not whole match */
+ return NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 8238924b38ee4b7049ef6e6b13fb53b3b90433eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 14:43:06 +0800
+Subject: perf/smmuv3: Remove the leftover put_cpu() in error path
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 8ae4bcf4821c18a8fbfa0b2c1df26c1085e9d923 ]
+
+In smmu_pmu_probe(), there is put_cpu() in the error path,
+which is wrong because we use raw_smp_processor_id() to
+get the cpu ID, not get_cpu(), remove it.
+
+While we are at it, kill 'out_cpuhp_err' altogether and
+just return err if we fail to add the hotplug instance.
+
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_smmuv3_pmu.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c
+index abcf54f7d19c..191f410cf35c 100644
+--- a/drivers/perf/arm_smmuv3_pmu.c
++++ b/drivers/perf/arm_smmuv3_pmu.c
+@@ -815,7 +815,7 @@ static int smmu_pmu_probe(struct platform_device *pdev)
+ if (err) {
+ dev_err(dev, "Error %d registering hotplug, PMU @%pa\n",
+ err, &res_0->start);
+- goto out_cpuhp_err;
++ return err;
+ }
+
+ err = perf_pmu_register(&smmu_pmu->pmu, name, -1);
+@@ -834,8 +834,6 @@ static int smmu_pmu_probe(struct platform_device *pdev)
+
+ out_unregister:
+ cpuhp_state_remove_instance_nocalls(cpuhp_state_num, &smmu_pmu->node);
+-out_cpuhp_err:
+- put_cpu();
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4ebff9e128a2332485abc054bc1954f28cbf7957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 12:50:16 +0100
+Subject: perf/x86: Fix potential out-of-bounds access
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1e69a0efc0bd0e02b8327e7186fbb4a81878ea0b ]
+
+UBSAN reported out-of-bound accesses for x86_pmu.event_map(), it's
+arguments should be < x86_pmu.max_events. Make sure all users observe
+this constraint.
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/core.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index 7b21455d7504..b9673396b571 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -1641,9 +1641,12 @@ static struct attribute_group x86_pmu_format_group __ro_after_init = {
+
+ ssize_t events_sysfs_show(struct device *dev, struct device_attribute *attr, char *page)
+ {
+- struct perf_pmu_events_attr *pmu_attr = \
++ struct perf_pmu_events_attr *pmu_attr =
+ container_of(attr, struct perf_pmu_events_attr, attr);
+- u64 config = x86_pmu.event_map(pmu_attr->id);
++ u64 config = 0;
++
++ if (pmu_attr->id < x86_pmu.max_events)
++ config = x86_pmu.event_map(pmu_attr->id);
+
+ /* string trumps id */
+ if (pmu_attr->event_str)
+@@ -1712,6 +1715,9 @@ is_visible(struct kobject *kobj, struct attribute *attr, int idx)
+ {
+ struct perf_pmu_events_attr *pmu_attr;
+
++ if (idx >= x86_pmu.max_events)
++ return 0;
++
+ pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr.attr);
+ /* str trumps id */
+ return pmu_attr->event_str || x86_pmu.event_map(idx) ? attr->mode : 0;
+--
+2.20.1
+
--- /dev/null
+From 8f505d15c0a3d98db2abdacf3f9e8c9fc603dd1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 12:51:01 +0200
+Subject: perf/x86/intel: Fix PT PMI handling
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit 92ca7da4bdc24d63bb0bcd241c11441ddb63b80a ]
+
+Commit:
+
+ ccbebba4c6bf ("perf/x86/intel/pt: Bypass PT vs. LBR exclusivity if the core supports it")
+
+skips the PT/LBR exclusivity check on CPUs where PT and LBRs coexist, but
+also inadvertently skips the active_events bump for PT in that case, which
+is a bug. If there aren't any hardware events at the same time as PT, the
+PMI handler will ignore PT PMIs, as active_events reads zero in that case,
+resulting in the "Uhhuh" spurious NMI warning and PT data loss.
+
+Fix this by always increasing active_events for PT events.
+
+Fixes: ccbebba4c6bf ("perf/x86/intel/pt: Bypass PT vs. LBR exclusivity if the core supports it")
+Reported-by: Vitaly Slobodskoy <vitaly.slobodskoy@intel.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Link: https://lkml.kernel.org/r/20191210105101.77210-1-alexander.shishkin@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/core.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index b9673396b571..e622158f5659 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -375,7 +375,7 @@ int x86_add_exclusive(unsigned int what)
+ * LBR and BTS are still mutually exclusive.
+ */
+ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+- return 0;
++ goto out;
+
+ if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {
+ mutex_lock(&pmc_reserve_mutex);
+@@ -387,6 +387,7 @@ int x86_add_exclusive(unsigned int what)
+ mutex_unlock(&pmc_reserve_mutex);
+ }
+
++out:
+ atomic_inc(&active_events);
+ return 0;
+
+@@ -397,11 +398,15 @@ int x86_add_exclusive(unsigned int what)
+
+ void x86_del_exclusive(unsigned int what)
+ {
++ atomic_dec(&active_events);
++
++ /*
++ * See the comment in x86_add_exclusive().
++ */
+ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+ return;
+
+ atomic_dec(&x86_pmu.lbr_exclusive[what]);
+- atomic_dec(&active_events);
+ }
+
+ int x86_setup_perfctr(struct perf_event *event)
+--
+2.20.1
+
--- /dev/null
+From 79564880d062d621efdbcc39bc6decfb89c1bc5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 15:31:10 +1030
+Subject: pinctrl: aspeed-g6: Fix LPC/eSPI mux configuration
+
+From: Andrew Jeffery <andrew@aj.id.au>
+
+[ Upstream commit eb45f2110b036e4e35d3f3aaee1c2ccf49d92425 ]
+
+Early revisions of the AST2600 datasheet are conflicted about the state
+of the LPC/eSPI strapping bit (SCU510[6]). Conversations with ASPEED
+determined that the reference pinmux configuration tables were in error
+and the SCU documentation contained the correct configuration. Update
+the driver to reflect the state described in the SCU documentation.
+
+Fixes: 2eda1cdec49f ("pinctrl: aspeed: Add AST2600 pinmux support")
+Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
+Link: https://lore.kernel.org/r/20191202050110.15340-1-andrew@aj.id.au
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c | 24 ++++++++--------------
+ 1 file changed, 8 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
+index c6800d220920..bb07024d22ed 100644
+--- a/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed-g6.c
+@@ -1088,60 +1088,52 @@ SSSF_PIN_DECL(AF15, GPIOV7, LPCSMI, SIG_DESC_SET(SCU434, 15));
+
+ #define AB7 176
+ SIG_EXPR_LIST_DECL_SESG(AB7, LAD0, LPC, SIG_DESC_SET(SCU434, 16),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AB7, ESPID0, ESPI, SIG_DESC_SET(SCU434, 16),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AB7, ESPID0, ESPI, SIG_DESC_SET(SCU434, 16));
+ PIN_DECL_2(AB7, GPIOW0, LAD0, ESPID0);
+
+ #define AB8 177
+ SIG_EXPR_LIST_DECL_SESG(AB8, LAD1, LPC, SIG_DESC_SET(SCU434, 17),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AB8, ESPID1, ESPI, SIG_DESC_SET(SCU434, 17),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AB8, ESPID1, ESPI, SIG_DESC_SET(SCU434, 17));
+ PIN_DECL_2(AB8, GPIOW1, LAD1, ESPID1);
+
+ #define AC8 178
+ SIG_EXPR_LIST_DECL_SESG(AC8, LAD2, LPC, SIG_DESC_SET(SCU434, 18),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AC8, ESPID2, ESPI, SIG_DESC_SET(SCU434, 18),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AC8, ESPID2, ESPI, SIG_DESC_SET(SCU434, 18));
+ PIN_DECL_2(AC8, GPIOW2, LAD2, ESPID2);
+
+ #define AC7 179
+ SIG_EXPR_LIST_DECL_SESG(AC7, LAD3, LPC, SIG_DESC_SET(SCU434, 19),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AC7, ESPID3, ESPI, SIG_DESC_SET(SCU434, 19),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AC7, ESPID3, ESPI, SIG_DESC_SET(SCU434, 19));
+ PIN_DECL_2(AC7, GPIOW3, LAD3, ESPID3);
+
+ #define AE7 180
+ SIG_EXPR_LIST_DECL_SESG(AE7, LCLK, LPC, SIG_DESC_SET(SCU434, 20),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AE7, ESPICK, ESPI, SIG_DESC_SET(SCU434, 20),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AE7, ESPICK, ESPI, SIG_DESC_SET(SCU434, 20));
+ PIN_DECL_2(AE7, GPIOW4, LCLK, ESPICK);
+
+ #define AF7 181
+ SIG_EXPR_LIST_DECL_SESG(AF7, LFRAME, LPC, SIG_DESC_SET(SCU434, 21),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AF7, ESPICS, ESPI, SIG_DESC_SET(SCU434, 21),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AF7, ESPICS, ESPI, SIG_DESC_SET(SCU434, 21));
+ PIN_DECL_2(AF7, GPIOW5, LFRAME, ESPICS);
+
+ #define AD7 182
+ SIG_EXPR_LIST_DECL_SESG(AD7, LSIRQ, LSIRQ, SIG_DESC_SET(SCU434, 22),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AD7, ESPIALT, ESPIALT, SIG_DESC_SET(SCU434, 22),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AD7, ESPIALT, ESPIALT, SIG_DESC_SET(SCU434, 22));
+ PIN_DECL_2(AD7, GPIOW6, LSIRQ, ESPIALT);
+ FUNC_GROUP_DECL(LSIRQ, AD7);
+ FUNC_GROUP_DECL(ESPIALT, AD7);
+
+ #define AD8 183
+ SIG_EXPR_LIST_DECL_SESG(AD8, LPCRST, LPC, SIG_DESC_SET(SCU434, 23),
+- SIG_DESC_CLEAR(SCU510, 6));
+-SIG_EXPR_LIST_DECL_SESG(AD8, ESPIRST, ESPI, SIG_DESC_SET(SCU434, 23),
+ SIG_DESC_SET(SCU510, 6));
++SIG_EXPR_LIST_DECL_SESG(AD8, ESPIRST, ESPI, SIG_DESC_SET(SCU434, 23));
+ PIN_DECL_2(AD8, GPIOW7, LPCRST, ESPIRST);
+
+ FUNC_GROUP_DECL(LPC, AB7, AB8, AC8, AC7, AE7, AF7, AD8);
+--
+2.20.1
+
--- /dev/null
+From ecf123251be9c1f03a6c039072a85025f91edce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 15:41:06 +0100
+Subject: pinctrl: pinmux: fix a possible null pointer in
+ pinmux_can_be_used_for_gpio
+
+From: Alexandre Torgue <alexandre.torgue@st.com>
+
+[ Upstream commit 6ba2fd391ac58c1a26874f10c3054a1ea4aca2d0 ]
+
+This commit adds a check on ops pointer to avoid a kernel panic when
+ops->strict is used. Indeed, on some pinctrl driver (at least for
+pinctrl-stmfx) the pinmux ops is not implemented. Let's assume than gpio
+can be used in this case.
+
+Fixes: 472a61e777fe ("pinctrl/gpio: Take MUX usage into account")
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Link: https://lore.kernel.org/r/20191204144106.10876-1-alexandre.torgue@st.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinmux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c
+index e914f6efd39e..9503ddf2edc7 100644
+--- a/drivers/pinctrl/pinmux.c
++++ b/drivers/pinctrl/pinmux.c
+@@ -85,7 +85,7 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin)
+ const struct pinmux_ops *ops = pctldev->desc->pmxops;
+
+ /* Can't inspect pin, assume it can be used */
+- if (!desc)
++ if (!desc || !ops)
+ return true;
+
+ if (ops->strict && desc->mux_usecount)
+--
+2.20.1
+
--- /dev/null
+From 95da2247533114fbec807e31499a66a6b115be7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 12:23:48 +0100
+Subject: platform/x86: pcengines-apuv2: fix simswap GPIO assignment
+
+From: Enrico Weigelt, metux IT consult <info@metux.net>
+
+[ Upstream commit d4ac8f83dafec205c5db9b86b21587fba43bc017 ]
+
+The mapping entry has to hold the GPIO line index instead of
+controller's register number.
+
+Fixes: 5037d4ddda31 ("platform/x86: pcengines-apuv2: wire up simswitch gpio as led")
+Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/pcengines-apuv2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/pcengines-apuv2.c b/drivers/platform/x86/pcengines-apuv2.c
+index 48b112b4f0b0..c32daf087640 100644
+--- a/drivers/platform/x86/pcengines-apuv2.c
++++ b/drivers/platform/x86/pcengines-apuv2.c
+@@ -95,7 +95,7 @@ static struct gpiod_lookup_table gpios_led_table = {
+ NULL, 1, GPIO_ACTIVE_LOW),
+ GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_LINE_LED3,
+ NULL, 2, GPIO_ACTIVE_LOW),
+- GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_REG_SIMSWAP,
++ GPIO_LOOKUP_IDX(AMD_FCH_GPIO_DRIVER_NAME, APU2_GPIO_LINE_SIMSWAP,
+ NULL, 3, GPIO_ACTIVE_LOW),
+ }
+ };
+--
+2.20.1
+
--- /dev/null
+From 5879917741ae241e3be4a27f7f45d261ea1efcb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 14:35:24 +0200
+Subject: powerpc: Ensure that swiotlb buffer is allocated from low memory
+
+From: Mike Rapoport <rppt@linux.ibm.com>
+
+[ Upstream commit 8fabc623238e68b3ac63c0dd1657bf86c1fa33af ]
+
+Some powerpc platforms (e.g. 85xx) limit DMA-able memory way below 4G.
+If a system has more physical memory than this limit, the swiotlb
+buffer is not addressable because it is allocated from memblock using
+top-down mode.
+
+Force memblock to bottom-up mode before calling swiotlb_init() to
+ensure that the swiotlb buffer is DMA-able.
+
+Reported-by: Christian Zigotzky <chzigotzky@xenosoft.de>
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191204123524.22919-1-rppt@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/mem.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index d30a2e6e68b4..9f5b32163bda 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -282,6 +282,14 @@ void __init mem_init(void)
+ BUILD_BUG_ON(MMU_PAGE_COUNT > 16);
+
+ #ifdef CONFIG_SWIOTLB
++ /*
++ * Some platforms (e.g. 85xx) limit DMA-able memory way below
++ * 4G. We force memblock to bottom-up mode to ensure that the
++ * memory allocated in swiotlb_init() is DMA-able.
++ * As it's the last memblock allocation, no need to reset it
++ * back to to-down.
++ */
++ memblock_set_bottom_up(true);
+ swiotlb_init(0);
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 3729b0462c1b02928e327853e5c74126638dc248 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 13:35:24 -0500
+Subject: psi: Fix a division error in psi poll()
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+[ Upstream commit c3466952ca1514158d7c16c9cfc48c27d5c5dc0f ]
+
+The psi window size is a u64 an can be up to 10 seconds right now,
+which exceeds the lower 32 bits of the variable. We currently use
+div_u64 for it, which is meant only for 32-bit divisors. The result is
+garbage pressure sampling values and even potential div0 crashes.
+
+Use div64_u64.
+
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Suren Baghdasaryan <surenb@google.com>
+Cc: Jingfeng Xie <xiejingfeng@linux.alibaba.com>
+Link: https://lkml.kernel.org/r/20191203183524.41378-3-hannes@cmpxchg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/psi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 970db4686dd4..ce8f6748678a 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -482,7 +482,7 @@ static u64 window_update(struct psi_window *win, u64 now, u64 value)
+ u32 remaining;
+
+ remaining = win->size - elapsed;
+- growth += div_u64(win->prev_growth * remaining, win->size);
++ growth += div64_u64(win->prev_growth * remaining, win->size);
+ }
+
+ return growth;
+--
+2.20.1
+
--- /dev/null
+From 4f8bd756b49337ac1b3d126cab3ec5056abe7791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Dec 2019 11:02:50 +0800
+Subject: regulator: core: fix regulator_register() error paths to properly
+ release rdev
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit a3cde9534ebdafe18a9bbab208df724c57e6c8e8 ]
+
+There are several issues with the error handling code of
+the regulator_register() function:
+ ret = device_register(&rdev->dev);
+ if (ret != 0) {
+ put_device(&rdev->dev); --> rdev released
+ goto unset_supplies;
+ }
+...
+unset_supplies:
+...
+ unset_regulator_supplies(rdev); --> use-after-free
+...
+clean:
+ if (dangling_of_gpiod)
+ gpiod_put(config->ena_gpiod);
+ kfree(rdev); --> double free
+
+We add a variable to record the failure of device_register() and
+move put_device() down a bit to avoid the above issues.
+
+Fixes: c438b9d01736 ("regulator: core: Move registration of regulator device")
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20191201030250.38074-1-wenyang@linux.alibaba.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index d66404920976..1dba0bdf3762 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4992,6 +4992,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ struct regulator_dev *rdev;
+ bool dangling_cfg_gpiod = false;
+ bool dangling_of_gpiod = false;
++ bool reg_device_fail = false;
+ struct device *dev;
+ int ret, i;
+
+@@ -5177,7 +5178,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ dev_set_drvdata(&rdev->dev, rdev);
+ ret = device_register(&rdev->dev);
+ if (ret != 0) {
+- put_device(&rdev->dev);
++ reg_device_fail = true;
+ goto unset_supplies;
+ }
+
+@@ -5208,7 +5209,10 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ clean:
+ if (dangling_of_gpiod)
+ gpiod_put(config->ena_gpiod);
+- kfree(rdev);
++ if (reg_device_fail)
++ put_device(&rdev->dev);
++ else
++ kfree(rdev);
+ kfree(config);
+ rinse:
+ if (dangling_cfg_gpiod)
+--
+2.20.1
+
--- /dev/null
+From 6f8a46b81e4b80f695dd050188432da2f59b81a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2019 22:58:35 +0800
+Subject: regulator: fix use after free issue
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit 4affd79a125ac91e6a53be843ea3960a8fc00cbb ]
+
+This is caused by dereferencing 'rdev' after put_device() in
+the _regulator_get()/_regulator_put() functions.
+This patch just moves the put_device() down a bit to avoid the
+issue.
+
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20191124145835.25999-1-wenyang@linux.alibaba.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 87bc06b386a0..d66404920976 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1937,8 +1937,8 @@ struct regulator *_regulator_get(struct device *dev, const char *id,
+ regulator = create_regulator(rdev, dev, id);
+ if (regulator == NULL) {
+ regulator = ERR_PTR(-ENOMEM);
+- put_device(&rdev->dev);
+ module_put(rdev->owner);
++ put_device(&rdev->dev);
+ return regulator;
+ }
+
+@@ -2059,13 +2059,13 @@ static void _regulator_put(struct regulator *regulator)
+
+ rdev->open_count--;
+ rdev->exclusive = 0;
+- put_device(&rdev->dev);
+ regulator_unlock(rdev);
+
+ kfree_const(regulator->supply_name);
+ kfree(regulator);
+
+ module_put(rdev->owner);
++ put_device(&rdev->dev);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From c542681b039ca6a91b8a168c75f05da5fbedc59f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 23:16:00 +0100
+Subject: regulator: rn5t618: fix module aliases
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 62a1923cc8fe095912e6213ed5de27abbf1de77e ]
+
+platform device aliases were missing, preventing
+autoloading of module.
+
+Fixes: 811b700630ff ("regulator: rn5t618: add driver for Ricoh RN5T618 regulators")
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20191211221600.29438-1-andreas@kemnade.info
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rn5t618-regulator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c
+index eb807a059479..aa6e7c5341ce 100644
+--- a/drivers/regulator/rn5t618-regulator.c
++++ b/drivers/regulator/rn5t618-regulator.c
+@@ -148,6 +148,7 @@ static struct platform_driver rn5t618_regulator_driver = {
+
+ module_platform_driver(rn5t618_regulator_driver);
+
++MODULE_ALIAS("platform:rn5t618-regulator");
+ MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
+ MODULE_DESCRIPTION("RN5T618 regulator driver");
+ MODULE_LICENSE("GPL v2");
+--
+2.20.1
+
--- /dev/null
+From 494346b5e984c80869eede6a3156c57c61bff9da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 15:59:26 +0100
+Subject: reset: Do not register resource data for missing resets
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit db23808615e29d9a04f96806cac56f78b0fee0ef ]
+
+When an optional reset is not present, __devm_reset_control_get() and
+devm_reset_control_array_get() still register resource data to release
+the non-existing reset on cleanup, which is futile.
+
+Fix this by skipping NULL reset control pointers.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index 3c9a64c1b7a8..f343bd814d32 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -787,7 +787,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+
+ rstc = __reset_control_get(dev, id, index, shared, optional, acquired);
+- if (!IS_ERR(rstc)) {
++ if (!IS_ERR_OR_NULL(rstc)) {
+ *ptr = rstc;
+ devres_add(dev, ptr);
+ } else {
+@@ -930,7 +930,7 @@ devm_reset_control_array_get(struct device *dev, bool shared, bool optional)
+ return ERR_PTR(-ENOMEM);
+
+ rstc = of_reset_control_array_get(dev->of_node, shared, optional, true);
+- if (IS_ERR(rstc)) {
++ if (IS_ERR_OR_NULL(rstc)) {
+ devres_free(devres);
+ return rstc;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3a2308795311c0a50c0c58f01d2881d02d57634f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 09:34:08 -0600
+Subject: rfkill: Fix incorrect check to avoid NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 6fc232db9e8cd50b9b83534de9cd91ace711b2d7 ]
+
+In rfkill_register, the struct rfkill pointer is first derefernced
+and then checked for NULL. This patch removes the BUG_ON and returns
+an error to the caller in case rfkill is NULL.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Link: https://lore.kernel.org/r/20191215153409.21696-1-pakki001@umn.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rfkill/core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index 0bf9bf1ceb8f..6c089320ae4f 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -1002,10 +1002,13 @@ static void rfkill_sync_work(struct work_struct *work)
+ int __must_check rfkill_register(struct rfkill *rfkill)
+ {
+ static unsigned long rfkill_no;
+- struct device *dev = &rfkill->dev;
++ struct device *dev;
+ int error;
+
+- BUG_ON(!rfkill);
++ if (!rfkill)
++ return -EINVAL;
++
++ dev = &rfkill->dev;
+
+ mutex_lock(&rfkill_global_mutex);
+
+--
+2.20.1
+
--- /dev/null
+From 3cc2a0bb4c8c430312fe9df77b4f838df6303825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 09:43:50 +0100
+Subject: s390/dasd/cio: Interpret ccw_device_get_mdc return value correctly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Höppner <hoeppner@linux.ibm.com>
+
+[ Upstream commit dd4b3c83b9efac10d48a94c61372119fc555a077 ]
+
+The max data count (mdc) is an unsigned 16-bit integer value as per AR
+documentation and is received via ccw_device_get_mdc() for a specific
+path mask from the CIO layer. The function itself also always returns a
+positive mdc value or 0 in case mdc isn't supported or couldn't be
+determined.
+
+Though, the comment for this function describes a negative return value
+to indicate failures.
+
+As a result, the DASD device driver interprets the return value of
+ccw_device_get_mdc() incorrectly. The error case is essentially a dead
+code path.
+
+To fix this behaviour, check explicitly for a return value of 0 and
+change the comment for ccw_device_get_mdc() accordingly.
+
+This fix merely enables the error code path in the DASD functions
+get_fcx_max_data() and verify_fcx_max_data(). The actual functionality
+stays the same and is still correct.
+
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd_eckd.c | 9 +++++----
+ drivers/s390/cio/device_ops.c | 2 +-
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index c94184d080f8..f5622f4a2ecf 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -1128,7 +1128,8 @@ static u32 get_fcx_max_data(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
+ int fcx_in_css, fcx_in_gneq, fcx_in_features;
+- int tpm, mdc;
++ unsigned int mdc;
++ int tpm;
+
+ if (dasd_nofcx)
+ return 0;
+@@ -1142,7 +1143,7 @@ static u32 get_fcx_max_data(struct dasd_device *device)
+ return 0;
+
+ mdc = ccw_device_get_mdc(device->cdev, 0);
+- if (mdc < 0) {
++ if (mdc == 0) {
+ dev_warn(&device->cdev->dev, "Detecting the maximum supported data size for zHPF requests failed\n");
+ return 0;
+ } else {
+@@ -1153,12 +1154,12 @@ static u32 get_fcx_max_data(struct dasd_device *device)
+ static int verify_fcx_max_data(struct dasd_device *device, __u8 lpm)
+ {
+ struct dasd_eckd_private *private = device->private;
+- int mdc;
++ unsigned int mdc;
+ u32 fcx_max_data;
+
+ if (private->fcx_max_data) {
+ mdc = ccw_device_get_mdc(device->cdev, lpm);
+- if ((mdc < 0)) {
++ if (mdc == 0) {
+ dev_warn(&device->cdev->dev,
+ "Detecting the maximum data size for zHPF "
+ "requests failed (rc=%d) for a new path %x\n",
+diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
+index 65841af15748..ccecf6b9504e 100644
+--- a/drivers/s390/cio/device_ops.c
++++ b/drivers/s390/cio/device_ops.c
+@@ -635,7 +635,7 @@ EXPORT_SYMBOL(ccw_device_tm_start_timeout);
+ * @mask: mask of paths to use
+ *
+ * Return the number of 64K-bytes blocks all paths at least support
+- * for a transport command. Return values <= 0 indicate failures.
++ * for a transport command. Return value 0 indicates failure.
+ */
+ int ccw_device_get_mdc(struct ccw_device *cdev, u8 mask)
+ {
+--
+2.20.1
+
--- /dev/null
+From 441f0108271da04377abe5882aa034aa65ba303f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 09:43:51 +0100
+Subject: s390/dasd: fix memleak in path handling error case
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+[ Upstream commit 00b39f698a4f1ee897227cace2e3937fc4412270 ]
+
+If for whatever reason the dasd_eckd_check_characteristics() function
+exits after at least some paths have their configuration data
+allocated those data is never freed again. In the error case the
+device->private pointer is set to NULL and dasd_eckd_uncheck_device()
+will exit without freeing the path data because of this NULL pointer.
+
+Fix by calling dasd_eckd_clear_conf_data() for error cases.
+
+Also use dasd_eckd_clear_conf_data() in dasd_eckd_uncheck_device()
+to avoid code duplication.
+
+Reported-by: Qian Cai <cai@lca.pw>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd_eckd.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index f5622f4a2ecf..a28b9ff82378 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -2074,7 +2074,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
+ dasd_free_block(device->block);
+ device->block = NULL;
+ out_err1:
+- kfree(private->conf_data);
++ dasd_eckd_clear_conf_data(device);
+ kfree(device->private);
+ device->private = NULL;
+ return rc;
+@@ -2083,7 +2083,6 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
+ static void dasd_eckd_uncheck_device(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
+- int i;
+
+ if (!private)
+ return;
+@@ -2093,21 +2092,7 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device)
+ private->sneq = NULL;
+ private->vdsneq = NULL;
+ private->gneq = NULL;
+- private->conf_len = 0;
+- for (i = 0; i < 8; i++) {
+- kfree(device->path[i].conf_data);
+- if ((__u8 *)device->path[i].conf_data ==
+- private->conf_data) {
+- private->conf_data = NULL;
+- private->conf_len = 0;
+- }
+- device->path[i].conf_data = NULL;
+- device->path[i].cssid = 0;
+- device->path[i].ssid = 0;
+- device->path[i].chpid = 0;
+- }
+- kfree(private->conf_data);
+- private->conf_data = NULL;
++ dasd_eckd_clear_conf_data(device);
+ }
+
+ static struct dasd_ccw_req *
+--
+2.20.1
+
--- /dev/null
+From 833b4e1a5a78a8d209397312153791aaec4134ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 09:34:57 +0100
+Subject: s390/purgatory: do not build purgatory with kcov, kasan and friends
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+[ Upstream commit c23587c92f6e3260fe3b82bb75b38aa2553b9468 ]
+
+the purgatory must not rely on functions from the "old" kernel,
+so we must disable kasan and friends. We also need to have a
+separate copy of string.c as the default does not build memcmp
+with KASAN.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/purgatory/Makefile | 6 ++++--
+ arch/s390/purgatory/string.c | 3 +++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+ create mode 100644 arch/s390/purgatory/string.c
+
+diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
+index bc0d7a0d0394..9de56065f28c 100644
+--- a/arch/s390/purgatory/Makefile
++++ b/arch/s390/purgatory/Makefile
+@@ -15,8 +15,10 @@ CFLAGS_sha256.o := -D__DISABLE_EXPORTS
+ $(obj)/mem.o: $(srctree)/arch/s390/lib/mem.S FORCE
+ $(call if_changed_rule,as_o_S)
+
+-$(obj)/string.o: $(srctree)/arch/s390/lib/string.c FORCE
+- $(call if_changed_rule,cc_o_c)
++KCOV_INSTRUMENT := n
++GCOV_PROFILE := n
++UBSAN_SANITIZE := n
++KASAN_SANITIZE := n
+
+ KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes
+ KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare
+diff --git a/arch/s390/purgatory/string.c b/arch/s390/purgatory/string.c
+new file mode 100644
+index 000000000000..c98c22a72db7
+--- /dev/null
++++ b/arch/s390/purgatory/string.c
+@@ -0,0 +1,3 @@
++// SPDX-License-Identifier: GPL-2.0
++#define __HAVE_ARCH_MEMCMP /* arch function */
++#include "../lib/string.c"
+--
+2.20.1
+
--- /dev/null
+From 13623f697368bcb625df2a75897937179d1cae9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 16:32:28 +0100
+Subject: s390/qeth: don't return -ENOTSUPP to userspace
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 39bdbf3e648d801596498a5a625fbc9fc1c0002f ]
+
+ENOTSUPP is not uapi, use EOPNOTSUPP instead.
+
+Fixes: d66cb37e9664 ("qeth: Add new priority queueing options")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_sys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
+index 9f392497d570..4c3e222e5572 100644
+--- a/drivers/s390/net/qeth_core_sys.c
++++ b/drivers/s390/net/qeth_core_sys.c
+@@ -227,7 +227,7 @@ static ssize_t qeth_dev_prioqing_store(struct device *dev,
+ card->qdio.default_out_queue = QETH_DEFAULT_QUEUE;
+ } else if (sysfs_streq(buf, "prio_queueing_vlan")) {
+ if (IS_LAYER3(card)) {
+- rc = -ENOTSUPP;
++ rc = -EOPNOTSUPP;
+ goto out;
+ }
+ card->qdio.do_prio_queueing = QETH_PRIO_Q_ING_VLAN;
+--
+2.20.1
+
--- /dev/null
+From c93a117a719c1546f19d373c599989c89b02abfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 16:32:27 +0100
+Subject: s390/qeth: fix promiscuous mode after reset
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 0f399305cd31e5c813086eaa264f7f47e205c10e ]
+
+When managing the promiscuous mode during an RX modeset, qeth caches the
+current HW state to avoid repeated programming of the same state on each
+modeset.
+
+But while tearing down a device, we forget to clear the cached state. So
+when the device is later set online again, the initial RX modeset
+doesn't program the promiscuous mode since we believe it is already
+enabled.
+Fix this by clearing the cached state in the tear-down path.
+
+Note that for the SBP variant of promiscuous mode, this accidentally
+works right now because we unconditionally restore the SBP role while
+re-initializing.
+
+Fixes: 4a71df50047f ("qeth: new qeth device driver")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 1 +
+ drivers/s390/net/qeth_l2_sys.c | 3 ++-
+ drivers/s390/net/qeth_l3_main.c | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 4bccdce19b5a..8b7d911dccd8 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -295,6 +295,7 @@ static void qeth_l2_stop_card(struct qeth_card *card)
+
+ flush_workqueue(card->event_wq);
+ card->info.mac_bits &= ~QETH_LAYER2_MAC_REGISTERED;
++ card->info.promisc_mode = 0;
+ }
+
+ static int qeth_l2_process_inbound_buffer(struct qeth_card *card,
+diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c
+index e2bcb26105a3..fc7101ad84de 100644
+--- a/drivers/s390/net/qeth_l2_sys.c
++++ b/drivers/s390/net/qeth_l2_sys.c
+@@ -279,7 +279,8 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card)
+ return;
+
+ mutex_lock(&card->sbp_lock);
+- if (card->options.sbp.role != QETH_SBP_ROLE_NONE) {
++ if (!card->options.sbp.reflect_promisc &&
++ card->options.sbp.role != QETH_SBP_ROLE_NONE) {
+ /* Conditional to avoid spurious error messages */
+ qeth_bridgeport_setrole(card, card->options.sbp.role);
+ /* Let the callback function refresh the stored role value. */
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index d7bfc7a0e4c0..32385327539b 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -1433,6 +1433,7 @@ static void qeth_l3_stop_card(struct qeth_card *card)
+ }
+
+ flush_workqueue(card->event_wq);
++ card->info.promisc_mode = 0;
+ }
+
+ static void qeth_l3_set_promisc_mode(struct qeth_card *card)
+--
+2.20.1
+
--- /dev/null
+From faf92532d3eb02b8d119855d1c21eefe8766534b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 16:32:26 +0100
+Subject: s390/qeth: handle error due to unsupported transport mode
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 2e3d7fa5d29b7ab649fdf8f9533ae0c0888a7fac ]
+
+Along with z/VM NICs, there's additional device types that only support
+a specific transport mode (eg. external-bridged IQD).
+Identify the corresponding error code, and raise a fitting error message
+so that the user knows to adjust their device configuration.
+
+On top of that also fix the subsequent error path, so that the rejected
+cmd doesn't need to wait for a timeout but gets cancelled straight away.
+
+Fixes: 4a71df50047f ("qeth: new qeth device driver")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_main.c | 14 +++++++-------
+ drivers/s390/net/qeth_core_mpc.h | 5 +++++
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 83794d7494d4..9df47421d69c 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -653,17 +653,17 @@ static int qeth_check_idx_response(struct qeth_card *card,
+ unsigned char *buffer)
+ {
+ QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN);
+- if ((buffer[2] & 0xc0) == 0xc0) {
++ if ((buffer[2] & QETH_IDX_TERMINATE_MASK) == QETH_IDX_TERMINATE) {
+ QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#04x\n",
+ buffer[4]);
+ QETH_CARD_TEXT(card, 2, "ckidxres");
+ QETH_CARD_TEXT(card, 2, " idxterm");
+- QETH_CARD_TEXT_(card, 2, " rc%d", -EIO);
+- if (buffer[4] == 0xf6) {
++ QETH_CARD_TEXT_(card, 2, "rc%x", buffer[4]);
++ if (buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT ||
++ buffer[4] == QETH_IDX_TERM_BAD_TRANSPORT_VM) {
+ dev_err(&card->gdev->dev,
+- "The qeth device is not configured "
+- "for the OSI layer required by z/VM\n");
+- return -EPERM;
++ "The device does not support the configured transport mode\n");
++ return -EPROTONOSUPPORT;
+ }
+ return -EIO;
+ }
+@@ -740,10 +740,10 @@ static void qeth_issue_next_read_cb(struct qeth_card *card,
+ case 0:
+ break;
+ case -EIO:
+- qeth_clear_ipacmd_list(card);
+ qeth_schedule_recovery(card);
+ /* fall through */
+ default:
++ qeth_clear_ipacmd_list(card);
+ goto out;
+ }
+
+diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
+index 6420b58cf42b..b7c17b5c823b 100644
+--- a/drivers/s390/net/qeth_core_mpc.h
++++ b/drivers/s390/net/qeth_core_mpc.h
+@@ -912,6 +912,11 @@ extern unsigned char IDX_ACTIVATE_WRITE[];
+ #define QETH_IDX_ACT_ERR_AUTH 0x1E
+ #define QETH_IDX_ACT_ERR_AUTH_USER 0x20
+
++#define QETH_IDX_TERMINATE 0xc0
++#define QETH_IDX_TERMINATE_MASK 0xc0
++#define QETH_IDX_TERM_BAD_TRANSPORT 0x41
++#define QETH_IDX_TERM_BAD_TRANSPORT_VM 0xf6
++
+ #define PDU_ENCAPSULATION(buffer) \
+ (buffer + *(buffer + (*(buffer + 0x0b)) + \
+ *(buffer + *(buffer + 0x0b) + 0x11) + 0x07))
+--
+2.20.1
+
--- /dev/null
+From 15754f289124bb61df3abf24e998762ba8c1bbc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 17:01:14 +0900
+Subject: samples: bpf: fix syscall_tp due to unused syscall
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit fe3300897cbfd76c6cb825776e5ac0ca50a91ca4 ]
+
+Currently, open() is called from the user program and it calls the syscall
+'sys_openat', not the 'sys_open'. This leads to an error of the program
+of user side, due to the fact that the counter maps are zero since no
+function such 'sys_open' is called.
+
+This commit adds the kernel bpf program which are attached to the
+tracepoint 'sys_enter_openat' and 'sys_enter_openat'.
+
+Fixes: 1da236b6be963 ("bpf: add a test case for syscalls/sys_{enter|exit}_* tracepoints")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/syscall_tp_kern.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/samples/bpf/syscall_tp_kern.c b/samples/bpf/syscall_tp_kern.c
+index 1d78819ffef1..630ce8c4d5a2 100644
+--- a/samples/bpf/syscall_tp_kern.c
++++ b/samples/bpf/syscall_tp_kern.c
+@@ -47,13 +47,27 @@ static __always_inline void count(void *map)
+ SEC("tracepoint/syscalls/sys_enter_open")
+ int trace_enter_open(struct syscalls_enter_open_args *ctx)
+ {
+- count((void *)&enter_open_map);
++ count(&enter_open_map);
++ return 0;
++}
++
++SEC("tracepoint/syscalls/sys_enter_openat")
++int trace_enter_open_at(struct syscalls_enter_open_args *ctx)
++{
++ count(&enter_open_map);
+ return 0;
+ }
+
+ SEC("tracepoint/syscalls/sys_exit_open")
+ int trace_enter_exit(struct syscalls_exit_open_args *ctx)
+ {
+- count((void *)&exit_open_map);
++ count(&exit_open_map);
++ return 0;
++}
++
++SEC("tracepoint/syscalls/sys_exit_openat")
++int trace_enter_exit_at(struct syscalls_exit_open_args *ctx)
++{
++ count(&exit_open_map);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From c432ec7d871d3b565d01eb60f10b3f7ccb0de7da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 17:01:13 +0900
+Subject: samples: bpf: Replace symbol compare of trace_event
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit bba1b2a890253528c45aa66cf856f289a215bfbc ]
+
+Previously, when this sample is added, commit 1c47910ef8013
+("samples/bpf: add perf_event+bpf example"), a symbol 'sys_read' and
+'sys_write' has been used without no prefixes. But currently there are
+no exact symbols with these under kallsyms and this leads to failure.
+
+This commit changes exact compare to substring compare to keep compatible
+with exact symbol or prefixed symbol.
+
+Fixes: 1c47910ef8013 ("samples/bpf: add perf_event+bpf example")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20191205080114.19766-2-danieltimlee@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/trace_event_user.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
+index 16a16eadd509..749a50f2f9f3 100644
+--- a/samples/bpf/trace_event_user.c
++++ b/samples/bpf/trace_event_user.c
+@@ -37,9 +37,9 @@ static void print_ksym(__u64 addr)
+ }
+
+ printf("%s;", sym->name);
+- if (!strcmp(sym->name, "sys_read"))
++ if (!strstr(sym->name, "sys_read"))
+ sys_read_seen = true;
+- else if (!strcmp(sym->name, "sys_write"))
++ else if (!strstr(sym->name, "sys_write"))
+ sys_write_seen = true;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f6a7c9eaed7c69db864df16d788441d5044d765a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 11:00:24 -0500
+Subject: sbitmap: only queue kyber's wait callback if not already active
+
+From: David Jeffery <djeffery@redhat.com>
+
+[ Upstream commit df034c93f15ee71df231ff9fe311d27ff08a2a52 ]
+
+Under heavy loads where the kyber I/O scheduler hits the token limits for
+its scheduling domains, kyber can become stuck. When active requests
+complete, kyber may not be woken up leaving the I/O requests in kyber
+stuck.
+
+This stuck state is due to a race condition with kyber and the sbitmap
+functions it uses to run a callback when enough requests have completed.
+The running of a sbt_wait callback can race with the attempt to insert the
+sbt_wait. Since sbitmap_del_wait_queue removes the sbt_wait from the list
+first then sets the sbq field to NULL, kyber can see the item as not on a
+list but the call to sbitmap_add_wait_queue will see sbq as non-NULL. This
+results in the sbt_wait being inserted onto the wait list but ws_active
+doesn't get incremented. So the sbitmap queue does not know there is a
+waiter on a wait list.
+
+Since sbitmap doesn't think there is a waiter, kyber may never be
+informed that there are domain tokens available and the I/O never advances.
+With the sbt_wait on a wait list, kyber believes it has an active waiter
+so cannot insert a new waiter when reaching the domain's full state.
+
+This race can be fixed by only adding the sbt_wait to the queue if the
+sbq field is NULL. If sbq is not NULL, there is already an action active
+which will trigger the re-running of kyber. Let it run and add the
+sbt_wait to the wait list if still needing to wait.
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Reported-by: John Pittman <jpittman@redhat.com>
+Tested-by: John Pittman <jpittman@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/sbitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/sbitmap.c b/lib/sbitmap.c
+index 969e5400a615..ee3ce1494568 100644
+--- a/lib/sbitmap.c
++++ b/lib/sbitmap.c
+@@ -667,8 +667,8 @@ void sbitmap_add_wait_queue(struct sbitmap_queue *sbq,
+ if (!sbq_wait->sbq) {
+ sbq_wait->sbq = sbq;
+ atomic_inc(&sbq->ws_active);
++ add_wait_queue(&ws->wait, &sbq_wait->wait);
+ }
+- add_wait_queue(&ws->wait, &sbq_wait->wait);
+ }
+ EXPORT_SYMBOL_GPL(sbitmap_add_wait_queue);
+
+--
+2.20.1
+
--- /dev/null
+From c7eb861f8dc91d7f6bf53845fc83e5d5cc1690c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 13:35:23 -0500
+Subject: sched/psi: Fix sampling error and rare div0 crashes with cgroups and
+ high uptime
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+[ Upstream commit 3dfbe25c27eab7c90c8a7e97b4c354a9d24dd985 ]
+
+Jingfeng reports rare div0 crashes in psi on systems with some uptime:
+
+[58914.066423] divide error: 0000 [#1] SMP
+[58914.070416] Modules linked in: ipmi_poweroff ipmi_watchdog toa overlay fuse tcp_diag inet_diag binfmt_misc aisqos(O) aisqos_hotfixes(O)
+[58914.083158] CPU: 94 PID: 140364 Comm: kworker/94:2 Tainted: G W OE K 4.9.151-015.ali3000.alios7.x86_64 #1
+[58914.093722] Hardware name: Alibaba Alibaba Cloud ECS/Alibaba Cloud ECS, BIOS 3.23.34 02/14/2019
+[58914.102728] Workqueue: events psi_update_work
+[58914.107258] task: ffff8879da83c280 task.stack: ffffc90059dcc000
+[58914.113336] RIP: 0010:[] [] psi_update_stats+0x1c1/0x330
+[58914.122183] RSP: 0018:ffffc90059dcfd60 EFLAGS: 00010246
+[58914.127650] RAX: 0000000000000000 RBX: ffff8858fe98be50 RCX: 000000007744d640
+[58914.134947] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00003594f700648e
+[58914.142243] RBP: ffffc90059dcfdf8 R08: 0000359500000000 R09: 0000000000000000
+[58914.149538] R10: 0000000000000000 R11: 0000000000000000 R12: 0000359500000000
+[58914.156837] R13: 0000000000000000 R14: 0000000000000000 R15: ffff8858fe98bd78
+[58914.164136] FS: 0000000000000000(0000) GS:ffff887f7f380000(0000) knlGS:0000000000000000
+[58914.172529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[58914.178467] CR2: 00007f2240452090 CR3: 0000005d5d258000 CR4: 00000000007606f0
+[58914.185765] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[58914.193061] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[58914.200360] PKRU: 55555554
+[58914.203221] Stack:
+[58914.205383] ffff8858fe98bd48 00000000000002f0 0000002e81036d09 ffffc90059dcfde8
+[58914.213168] ffff8858fe98bec8 0000000000000000 0000000000000000 0000000000000000
+[58914.220951] 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+[58914.228734] Call Trace:
+[58914.231337] [] psi_update_work+0x22/0x60
+[58914.237067] [] process_one_work+0x189/0x420
+[58914.243063] [] worker_thread+0x4e/0x4b0
+[58914.248701] [] ? process_one_work+0x420/0x420
+[58914.254869] [] kthread+0xe6/0x100
+[58914.259994] [] ? kthread_park+0x60/0x60
+[58914.265640] [] ret_from_fork+0x39/0x50
+[58914.271193] Code: 41 29 c3 4d 39 dc 4d 0f 42 dc <49> f7 f1 48 8b 13 48 89 c7 48 c1
+[58914.279691] RIP [] psi_update_stats+0x1c1/0x330
+
+The crashing instruction is trying to divide the observed stall time
+by the sampling period. The period, stored in R8, is not 0, but we are
+dividing by the lower 32 bits only, which are all 0 in this instance.
+
+We could switch to a 64-bit division, but the period shouldn't be that
+big in the first place. It's the time between the last update and the
+next scheduled one, and so should always be around 2s and comfortably
+fit into 32 bits.
+
+The bug is in the initialization of new cgroups: we schedule the first
+sampling event in a cgroup as an offset of sched_clock(), but fail to
+initialize the last_update timestamp, and it defaults to 0. That
+results in a bogusly large sampling period the first time we run the
+sampling code, and consequently we underreport pressure for the first
+2s of a cgroup's life. But worse, if sched_clock() is sufficiently
+advanced on the system, and the user gets unlucky, the period's lower
+32 bits can all be 0 and the sampling division will crash.
+
+Fix this by initializing the last update timestamp to the creation
+time of the cgroup, thus correctly marking the start of the first
+pressure sampling period in a new cgroup.
+
+Reported-by: Jingfeng Xie <xiejingfeng@linux.alibaba.com>
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Link: https://lkml.kernel.org/r/20191203183524.41378-2-hannes@cmpxchg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/psi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 517e3719027e..970db4686dd4 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -185,7 +185,8 @@ static void group_init(struct psi_group *group)
+
+ for_each_possible_cpu(cpu)
+ seqcount_init(&per_cpu_ptr(group->pcpu, cpu)->seq);
+- group->avg_next_update = sched_clock() + psi_period;
++ group->avg_last_update = sched_clock();
++ group->avg_next_update = group->avg_last_update + psi_period;
+ INIT_DELAYED_WORK(&group->avgs_work, psi_avgs_work);
+ mutex_init(&group->avgs_lock);
+ /* Init trigger-related members */
+--
+2.20.1
+
--- /dev/null
+From c5fc1cf7fd8dfc96ea80041fae285fd4ceff35af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 21:07:19 +0100
+Subject: scripts: package: mkdebian: add missing rsync dependency
+
+From: Enrico Weigelt, metux IT consult <info@metux.net>
+
+[ Upstream commit a11391b6f50689adb22c65df783e09143fafb794 ]
+
+We've missed the dependency to rsync, so build fails on
+minimal containers.
+
+Fixes: 59b2bd05f5f4 ("kbuild: add 'headers' target to build up uapi headers in usr/include")
+Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/package/mkdebian | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
+index e0750b70453f..7c230016b08d 100755
+--- a/scripts/package/mkdebian
++++ b/scripts/package/mkdebian
+@@ -174,7 +174,7 @@ Source: $sourcename
+ Section: kernel
+ Priority: optional
+ Maintainer: $maintainer
+-Build-Depends: bc, kmod, cpio, bison, flex | flex:native $extra_build_depends
++Build-Depends: bc, rsync, kmod, cpio, bison, flex | flex:native $extra_build_depends
+ Homepage: http://www.kernel.org/
+
+ Package: $packagename
+--
+2.20.1
+
--- /dev/null
+From 45651c97d38eaab0fe9308e6cd295679dbc1e0c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 17:34:33 +0900
+Subject: selftests/ftrace: Do not to use absolute debugfs path
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit ba1b9c5048e43716921abe3a1db19cebebf4a5f5 ]
+
+Use relative path to trigger file instead of absolute debugfs path,
+because if the user uses tracefs instead of debugfs, it can be
+mounted at /sys/kernel/tracing.
+Anyway, since the ftracetest is designed to be run at the tracing
+directory, user doesn't need to use absolute path.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../test.d/trigger/inter-event/trigger-action-hist-xfail.tc | 4 ++--
+ .../trigger/inter-event/trigger-onchange-action-hist.tc | 2 +-
+ .../trigger/inter-event/trigger-snapshot-action-hist.tc | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc
+index 1221240f8cf6..3f2aee115f6e 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-action-hist-xfail.tc
+@@ -21,10 +21,10 @@ grep -q "snapshot()" README || exit_unsupported # version issue
+
+ echo "Test expected snapshot action failure"
+
+-echo 'hist:keys=comm:onmatch(sched.sched_wakeup).snapshot()' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger && exit_fail
++echo 'hist:keys=comm:onmatch(sched.sched_wakeup).snapshot()' >> events/sched/sched_waking/trigger && exit_fail
+
+ echo "Test expected save action failure"
+
+-echo 'hist:keys=comm:onmatch(sched.sched_wakeup).save(comm,prio)' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger && exit_fail
++echo 'hist:keys=comm:onmatch(sched.sched_wakeup).save(comm,prio)' >> events/sched/sched_waking/trigger && exit_fail
+
+ exit_xfail
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc
+index 064a284e4e75..c80007aa9f86 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-onchange-action-hist.tc
+@@ -16,7 +16,7 @@ grep -q "onchange(var)" README || exit_unsupported # version issue
+
+ echo "Test onchange action"
+
+-echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio) if comm=="ping"' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger
++echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio) if comm=="ping"' >> events/sched/sched_waking/trigger
+
+ ping $LOCALHOST -c 3
+ nice -n 1 ping $LOCALHOST -c 3
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc
+index 18fff69fc433..f546c1b66a9b 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-snapshot-action-hist.tc
+@@ -23,9 +23,9 @@ grep -q "snapshot()" README || exit_unsupported # version issue
+
+ echo "Test snapshot action"
+
+-echo 1 > /sys/kernel/debug/tracing/events/sched/enable
++echo 1 > events/sched/enable
+
+-echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio):onchange($newprio).snapshot() if comm=="ping"' >> /sys/kernel/debug/tracing/events/sched/sched_waking/trigger
++echo 'hist:keys=comm:newprio=prio:onchange($newprio).save(comm,prio):onchange($newprio).snapshot() if comm=="ping"' >> events/sched/sched_waking/trigger
+
+ ping $LOCALHOST -c 3
+ nice -n 1 ping $LOCALHOST -c 3
+--
+2.20.1
+
--- /dev/null
+From 83f7808320667702d931c2c9e91c4c983cf3b90f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 08:42:21 +0900
+Subject: selftests/ftrace: Fix ftrace test cases to check unsupported
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 25deae098e748d8d36bc35129a66734b8f6925c9 ]
+
+Since dynamic function tracer can be disabled, set_ftrace_filter
+can be disappeared. Test cases which depends on it, must check
+whether the set_ftrace_filter exists or not before testing
+and if not, return as unsupported.
+
+Also, if the function tracer itself is disabled, we can not
+set "function" to current_tracer. Test cases must check it
+before testing, and return as unsupported.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc | 2 ++
+ tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc
+index 36fb59f886ea..1a52f2883fe0 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-stacktrace.tc
+@@ -3,6 +3,8 @@
+ # description: ftrace - stacktrace filter command
+ # flags: instance
+
++[ ! -f set_ftrace_filter ] && exit_unsupported
++
+ echo _do_fork:stacktrace >> set_ftrace_filter
+
+ grep -q "_do_fork:stacktrace:unlimited" set_ftrace_filter
+diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc
+index 86a1f07ef2ca..71fa3f49e35e 100644
+--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc
++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_cpumask.tc
+@@ -15,6 +15,11 @@ if [ $NP -eq 1 ] ;then
+ exit_unresolved
+ fi
+
++if ! grep -q "function" available_tracers ; then
++ echo "Function trace is not enabled"
++ exit_unsupported
++fi
++
+ ORIG_CPUMASK=`cat tracing_cpumask`
+
+ do_reset() {
+--
+2.20.1
+
--- /dev/null
+From 60336bfa1b5dd893a6a4b1c5dba271c735712472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 17:34:42 +0900
+Subject: selftests/ftrace: Fix multiple kprobe testcase
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 5cc6c8d4a99d0ee4d5466498e258e593df1d3eb6 ]
+
+Fix multiple kprobe event testcase to work it correctly.
+There are 2 bugfixes.
+ - Since `wc -l FILE` returns not only line number but also
+ FILE filename, following "if" statement always failed.
+ Fix this bug by replacing it with 'cat FILE | wc -l'
+ - Since "while do-done loop" block with pipeline becomes a
+ subshell, $N local variable is not update outside of
+ the loop.
+ Fix this bug by using actual target number (256) instead
+ of $N.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/kprobe/multiple_kprobes.tc | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
+index 5862eee91e1d..6e3dbe5f96b7 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
+@@ -20,9 +20,9 @@ while read i; do
+ test $N -eq 256 && break
+ done
+
+-L=`wc -l kprobe_events`
+-if [ $L -ne $N ]; then
+- echo "The number of kprobes events ($L) is not $N"
++L=`cat kprobe_events | wc -l`
++if [ $L -ne 256 ]; then
++ echo "The number of kprobes events ($L) is not 256"
+ exit_fail
+ fi
+
+--
+2.20.1
+
--- /dev/null
+From ef68b39eb29a0a49f74b0fe4ceb3c3385356ecfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 17:34:16 +0900
+Subject: selftests/ftrace: Fix to check the existence of set_ftrace_filter
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fd1baf6ca2ea3550ea47f2bb0bdcf34ec764a779 ]
+
+If we run ftracetest on the kernel with CONFIG_DYNAMIC_FTRACE=n,
+there is no set_ftrace_filter and all test cases are failed, because
+reset_ftrace_filter() returns an error.
+Let's check whether set_ftrace_filter exists in reset_ftrace_filter()
+and clean up only set_ftrace_notrace in initialize_ftrace().
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ftrace/test.d/functions | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions
+index 86986c4bba54..5d4550591ff9 100644
+--- a/tools/testing/selftests/ftrace/test.d/functions
++++ b/tools/testing/selftests/ftrace/test.d/functions
+@@ -46,6 +46,9 @@ reset_events_filter() { # reset all current setting filters
+ }
+
+ reset_ftrace_filter() { # reset all triggers in set_ftrace_filter
++ if [ ! -f set_ftrace_filter ]; then
++ return 0
++ fi
+ echo > set_ftrace_filter
+ grep -v '^#' set_ftrace_filter | while read t; do
+ tr=`echo $t | cut -d: -f2`
+@@ -93,7 +96,7 @@ initialize_ftrace() { # Reset ftrace to initial-state
+ disable_events
+ [ -f set_event_pid ] && echo > set_event_pid
+ [ -f set_ftrace_pid ] && echo > set_ftrace_pid
+- [ -f set_ftrace_filter ] && echo | tee set_ftrace_*
++ [ -f set_ftrace_notrace ] && echo > set_ftrace_notrace
+ [ -f set_graph_function ] && echo | tee set_graph_*
+ [ -f stack_trace_filter ] && echo > stack_trace_filter
+ [ -f kprobe_events ] && echo > kprobe_events
+--
+2.20.1
+
--- /dev/null
+From 0204e7fc006d1885c9c7bb42f7718bf9c197a683 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 18:35:40 +0100
+Subject: selftests: netfilter: use randomized netns names
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 5a2e6af81807d4616f9839ad0ae7d1313b45c64d ]
+
+Using ns0, ns1, etc. isn't a good idea, they might exist already.
+Use a random suffix.
+
+Also, older nft versions don't support "-" as alias for stdin, so
+use /dev/stdin instead.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Acked-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/netfilter/nft_nat.sh | 332 ++++++++++---------
+ 1 file changed, 176 insertions(+), 156 deletions(-)
+
+diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
+index 1be55e705780..d7e07f4c3d7f 100755
+--- a/tools/testing/selftests/netfilter/nft_nat.sh
++++ b/tools/testing/selftests/netfilter/nft_nat.sh
+@@ -8,9 +8,14 @@ ksft_skip=4
+ ret=0
+ test_inet_nat=true
+
++sfx=$(mktemp -u "XXXXXXXX")
++ns0="ns0-$sfx"
++ns1="ns1-$sfx"
++ns2="ns2-$sfx"
++
+ cleanup()
+ {
+- for i in 0 1 2; do ip netns del ns$i;done
++ for i in 0 1 2; do ip netns del ns$i-"$sfx";done
+ }
+
+ nft --version > /dev/null 2>&1
+@@ -25,40 +30,49 @@ if [ $? -ne 0 ];then
+ exit $ksft_skip
+ fi
+
+-ip netns add ns0
++ip netns add "$ns0"
+ if [ $? -ne 0 ];then
+- echo "SKIP: Could not create net namespace"
++ echo "SKIP: Could not create net namespace $ns0"
+ exit $ksft_skip
+ fi
+
+ trap cleanup EXIT
+
+-ip netns add ns1
+-ip netns add ns2
++ip netns add "$ns1"
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not create net namespace $ns1"
++ exit $ksft_skip
++fi
++
++ip netns add "$ns2"
++if [ $? -ne 0 ];then
++ echo "SKIP: Could not create net namespace $ns2"
++ exit $ksft_skip
++fi
+
+-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&1
++ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1
+ if [ $? -ne 0 ];then
+ echo "SKIP: No virtual ethernet pair device support in kernel"
+ exit $ksft_skip
+ fi
+-ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
++ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2"
+
+-ip -net ns0 link set lo up
+-ip -net ns0 link set veth0 up
+-ip -net ns0 addr add 10.0.1.1/24 dev veth0
+-ip -net ns0 addr add dead:1::1/64 dev veth0
++ip -net "$ns0" link set lo up
++ip -net "$ns0" link set veth0 up
++ip -net "$ns0" addr add 10.0.1.1/24 dev veth0
++ip -net "$ns0" addr add dead:1::1/64 dev veth0
+
+-ip -net ns0 link set veth1 up
+-ip -net ns0 addr add 10.0.2.1/24 dev veth1
+-ip -net ns0 addr add dead:2::1/64 dev veth1
++ip -net "$ns0" link set veth1 up
++ip -net "$ns0" addr add 10.0.2.1/24 dev veth1
++ip -net "$ns0" addr add dead:2::1/64 dev veth1
+
+ for i in 1 2; do
+- ip -net ns$i link set lo up
+- ip -net ns$i link set eth0 up
+- ip -net ns$i addr add 10.0.$i.99/24 dev eth0
+- ip -net ns$i route add default via 10.0.$i.1
+- ip -net ns$i addr add dead:$i::99/64 dev eth0
+- ip -net ns$i route add default via dead:$i::1
++ ip -net ns$i-$sfx link set lo up
++ ip -net ns$i-$sfx link set eth0 up
++ ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0
++ ip -net ns$i-$sfx route add default via 10.0.$i.1
++ ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0
++ ip -net ns$i-$sfx route add default via dead:$i::1
+ done
+
+ bad_counter()
+@@ -66,8 +80,9 @@ bad_counter()
+ local ns=$1
+ local counter=$2
+ local expect=$3
++ local tag=$4
+
+- echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2
++ echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2
+ ip netns exec $ns nft list counter inet filter $counter 1>&2
+ }
+
+@@ -78,24 +93,24 @@ check_counters()
+
+ cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
+ if [ $? -ne 0 ]; then
+- bad_counter $ns ns0in "packets 1 bytes 84"
++ bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1"
+ lret=1
+ fi
+ cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
+ if [ $? -ne 0 ]; then
+- bad_counter $ns ns0out "packets 1 bytes 84"
++ bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2"
+ lret=1
+ fi
+
+ expect="packets 1 bytes 104"
+ cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter $ns ns0in6 "$expect"
++ bad_counter $ns ns0in6 "$expect" "check_counters 3"
+ lret=1
+ fi
+ cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter $ns ns0out6 "$expect"
++ bad_counter $ns ns0out6 "$expect" "check_counters 4"
+ lret=1
+ fi
+
+@@ -107,41 +122,41 @@ check_ns0_counters()
+ local ns=$1
+ local lret=0
+
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns0in "packets 0 bytes 0"
++ bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns0in6 "packets 0 bytes 0"
++ bad_counter "$ns0" ns0in6 "packets 0 bytes 0"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns0out "packets 0 bytes 0"
++ bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2"
+ lret=1
+ fi
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns0out6 "packets 0 bytes 0"
++ bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 "
+ lret=1
+ fi
+
+ for dir in "in" "out" ; do
+ expect="packets 1 bytes 84"
+- cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 $ns$dir "$expect"
++ bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4"
+ lret=1
+ fi
+
+ expect="packets 1 bytes 104"
+- cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 $ns$dir6 "$expect"
++ bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5"
+ lret=1
+ fi
+ done
+@@ -152,7 +167,7 @@ check_ns0_counters()
+ reset_counters()
+ {
+ for i in 0 1 2;do
+- ip netns exec ns$i nft reset counters inet > /dev/null
++ ip netns exec ns$i-$sfx nft reset counters inet > /dev/null
+ done
+ }
+
+@@ -166,7 +181,7 @@ test_local_dnat6()
+ IPF="ip6"
+ fi
+
+-ip netns exec ns0 nft -f - <<EOF
++ip netns exec "$ns0" nft -f /dev/stdin <<EOF
+ table $family nat {
+ chain output {
+ type nat hook output priority 0; policy accept;
+@@ -180,7 +195,7 @@ EOF
+ fi
+
+ # ping netns1, expect rewrite to netns2
+- ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null
++ ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null
+ if [ $? -ne 0 ]; then
+ lret=1
+ echo "ERROR: ping6 failed"
+@@ -189,18 +204,18 @@ EOF
+
+ expect="packets 0 bytes 0"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns1$dir "$expect"
++ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1"
+ lret=1
+ fi
+ done
+
+ expect="packets 1 bytes 104"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns2$dir "$expect"
++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2"
+ lret=1
+ fi
+ done
+@@ -208,9 +223,9 @@ EOF
+ # expect 0 count in ns1
+ expect="packets 0 bytes 0"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3"
+ lret=1
+ fi
+ done
+@@ -218,15 +233,15 @@ EOF
+ # expect 1 packet in ns2
+ expect="packets 1 bytes 104"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns0$dir "$expect"
++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4"
+ lret=1
+ fi
+ done
+
+- test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was $family NATted to ns2"
+- ip netns exec ns0 nft flush chain ip6 nat output
++ test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2"
++ ip netns exec "$ns0" nft flush chain ip6 nat output
+
+ return $lret
+ }
+@@ -241,7 +256,7 @@ test_local_dnat()
+ IPF="ip"
+ fi
+
+-ip netns exec ns0 nft -f - <<EOF 2>/dev/null
++ip netns exec "$ns0" nft -f /dev/stdin <<EOF 2>/dev/null
+ table $family nat {
+ chain output {
+ type nat hook output priority 0; policy accept;
+@@ -260,7 +275,7 @@ EOF
+ fi
+
+ # ping netns1, expect rewrite to netns2
+- ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
++ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
+ if [ $? -ne 0 ]; then
+ lret=1
+ echo "ERROR: ping failed"
+@@ -269,18 +284,18 @@ EOF
+
+ expect="packets 0 bytes 0"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns1$dir "$expect"
++ bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1"
+ lret=1
+ fi
+ done
+
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns2$dir "$expect"
++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2"
+ lret=1
+ fi
+ done
+@@ -288,9 +303,9 @@ EOF
+ # expect 0 count in ns1
+ expect="packets 0 bytes 0"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3"
+ lret=1
+ fi
+ done
+@@ -298,19 +313,19 @@ EOF
+ # expect 1 packet in ns2
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns0$dir "$expect"
++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4"
+ lret=1
+ fi
+ done
+
+- test $lret -eq 0 && echo "PASS: ping to ns1 was $family NATted to ns2"
++ test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2"
+
+- ip netns exec ns0 nft flush chain $family nat output
++ ip netns exec "$ns0" nft flush chain $family nat output
+
+ reset_counters
+- ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null
++ ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
+ if [ $? -ne 0 ]; then
+ lret=1
+ echo "ERROR: ping failed"
+@@ -319,17 +334,17 @@ EOF
+
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns1$dir "$expect"
++ bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5"
+ lret=1
+ fi
+ done
+ expect="packets 0 bytes 0"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns2$dir "$expect"
++ bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6"
+ lret=1
+ fi
+ done
+@@ -337,9 +352,9 @@ EOF
+ # expect 1 count in ns1
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns0 ns0$dir "$expect"
++ bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7"
+ lret=1
+ fi
+ done
+@@ -347,14 +362,14 @@ EOF
+ # expect 0 packet in ns2
+ expect="packets 0 bytes 0"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns2$dir "$expect"
++ bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8"
+ lret=1
+ fi
+ done
+
+- test $lret -eq 0 && echo "PASS: ping to ns1 OK after $family nat output chain flush"
++ test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush"
+
+ return $lret
+ }
+@@ -366,26 +381,26 @@ test_masquerade6()
+ local natflags=$2
+ local lret=0
+
+- ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
++ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 via ipv6"
++ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6"
+ return 1
+ lret=1
+ fi
+
+ expect="packets 1 bytes 104"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns2$dir "$expect"
++ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2"
+ lret=1
+ fi
+ done
+@@ -393,7 +408,7 @@ test_masquerade6()
+ reset_counters
+
+ # add masquerading rule
+-ip netns exec ns0 nft -f - <<EOF
++ip netns exec "$ns0" nft -f /dev/stdin <<EOF
+ table $family nat {
+ chain postrouting {
+ type nat hook postrouting priority 0; policy accept;
+@@ -406,24 +421,24 @@ EOF
+ return $ksft_skip
+ fi
+
+- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags"
++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
+ lret=1
+ fi
+
+ # ns1 should have seen packets from ns0, due to masquerade
+ expect="packets 1 bytes 104"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4"
+ lret=1
+ fi
+ done
+@@ -431,32 +446,32 @@ EOF
+ # ns1 should not have seen packets from ns2, due to masquerade
+ expect="packets 0 bytes 0"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6"
+ lret=1
+ fi
+ done
+
+- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerade $natflags (attempt 2)"
++ echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)"
+ lret=1
+ fi
+
+- ip netns exec ns0 nft flush chain $family nat postrouting
++ ip netns exec "$ns0" nft flush chain $family nat postrouting
+ if [ $? -ne 0 ]; then
+ echo "ERROR: Could not flush $family nat postrouting" 1>&2
+ lret=1
+ fi
+
+- test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for ns2"
++ test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2"
+
+ return $lret
+ }
+@@ -467,26 +482,26 @@ test_masquerade()
+ local natflags=$2
+ local lret=0
+
+- ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+- ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 $natflags"
++ echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
+ lret=1
+ fi
+
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns2$dir "$expect"
++ bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
+ lret=1
+ fi
+ done
+@@ -494,7 +509,7 @@ test_masquerade()
+ reset_counters
+
+ # add masquerading rule
+-ip netns exec ns0 nft -f - <<EOF
++ip netns exec "$ns0" nft -f /dev/stdin <<EOF
+ table $family nat {
+ chain postrouting {
+ type nat hook postrouting priority 0; policy accept;
+@@ -507,24 +522,24 @@ EOF
+ return $ksft_skip
+ fi
+
+- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 with active $family masquerade $natflags"
++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
+ lret=1
+ fi
+
+ # ns1 should have seen packets from ns0, due to masquerade
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4"
+ lret=1
+ fi
+ done
+@@ -532,32 +547,32 @@ EOF
+ # ns1 should not have seen packets from ns2, due to masquerade
+ expect="packets 0 bytes 0"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6"
+ lret=1
+ fi
+ done
+
+- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 with active ip masquerade $natflags (attempt 2)"
++ echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)"
+ lret=1
+ fi
+
+- ip netns exec ns0 nft flush chain $family nat postrouting
++ ip netns exec "$ns0" nft flush chain $family nat postrouting
+ if [ $? -ne 0 ]; then
+ echo "ERROR: Could not flush $family nat postrouting" 1>&2
+ lret=1
+ fi
+
+- test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for ns2"
++ test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2"
+
+ return $lret
+ }
+@@ -567,25 +582,25 @@ test_redirect6()
+ local family=$1
+ local lret=0
+
+- ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
++ ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
+
+- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannnot ping ns1 from ns2 via ipv6"
++ echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6"
+ lret=1
+ fi
+
+ expect="packets 1 bytes 104"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns2$dir "$expect"
++ bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2"
+ lret=1
+ fi
+ done
+@@ -593,7 +608,7 @@ test_redirect6()
+ reset_counters
+
+ # add redirect rule
+-ip netns exec ns0 nft -f - <<EOF
++ip netns exec "$ns0" nft -f /dev/stdin <<EOF
+ table $family nat {
+ chain prerouting {
+ type nat hook prerouting priority 0; policy accept;
+@@ -606,18 +621,18 @@ EOF
+ return $ksft_skip
+ fi
+
+- ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 via ipv6 with active $family redirect"
++ echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect"
+ lret=1
+ fi
+
+ # ns1 should have seen no packets from ns2, due to redirection
+ expect="packets 0 bytes 0"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3"
+ lret=1
+ fi
+ done
+@@ -625,20 +640,20 @@ EOF
+ # ns0 should have seen packets from ns2, due to masquerade
+ expect="packets 1 bytes 104"
+ for dir in "in6" "out6" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4"
+ lret=1
+ fi
+ done
+
+- ip netns exec ns0 nft delete table $family nat
++ ip netns exec "$ns0" nft delete table $family nat
+ if [ $? -ne 0 ]; then
+ echo "ERROR: Could not delete $family nat table" 1>&2
+ lret=1
+ fi
+
+- test $lret -eq 0 && echo "PASS: $family IPv6 redirection for ns2"
++ test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2"
+
+ return $lret
+ }
+@@ -648,26 +663,26 @@ test_redirect()
+ local family=$1
+ local lret=0
+
+- ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
+- ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
++ ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
+
+- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2"
++ echo "ERROR: cannot ping $ns1 from $ns2"
+ lret=1
+ fi
+
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns2$dir "$expect"
++ bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1"
+ lret=1
+ fi
+
+- cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns2 ns1$dir "$expect"
++ bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2"
+ lret=1
+ fi
+ done
+@@ -675,7 +690,7 @@ test_redirect()
+ reset_counters
+
+ # add redirect rule
+-ip netns exec ns0 nft -f - <<EOF
++ip netns exec "$ns0" nft -f /dev/stdin <<EOF
+ table $family nat {
+ chain prerouting {
+ type nat hook prerouting priority 0; policy accept;
+@@ -688,9 +703,9 @@ EOF
+ return $ksft_skip
+ fi
+
+- ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
++ ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
+ if [ $? -ne 0 ] ; then
+- echo "ERROR: cannot ping ns1 from ns2 with active $family ip redirect"
++ echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect"
+ lret=1
+ fi
+
+@@ -698,9 +713,9 @@ EOF
+ expect="packets 0 bytes 0"
+ for dir in "in" "out" ; do
+
+- cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3"
+ lret=1
+ fi
+ done
+@@ -708,28 +723,28 @@ EOF
+ # ns0 should have seen packets from ns2, due to masquerade
+ expect="packets 1 bytes 84"
+ for dir in "in" "out" ; do
+- cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect")
++ cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
+ if [ $? -ne 0 ]; then
+- bad_counter ns1 ns0$dir "$expect"
++ bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4"
+ lret=1
+ fi
+ done
+
+- ip netns exec ns0 nft delete table $family nat
++ ip netns exec "$ns0" nft delete table $family nat
+ if [ $? -ne 0 ]; then
+ echo "ERROR: Could not delete $family nat table" 1>&2
+ lret=1
+ fi
+
+- test $lret -eq 0 && echo "PASS: $family IP redirection for ns2"
++ test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2"
+
+ return $lret
+ }
+
+
+-# ip netns exec ns0 ping -c 1 -q 10.0.$i.99
++# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99
+ for i in 0 1 2; do
+-ip netns exec ns$i nft -f - <<EOF
++ip netns exec ns$i-$sfx nft -f /dev/stdin <<EOF
+ table inet filter {
+ counter ns0in {}
+ counter ns1in {}
+@@ -796,18 +811,18 @@ done
+ sleep 3
+ # test basic connectivity
+ for i in 1 2; do
+- ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null
++ ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null
+ if [ $? -ne 0 ];then
+ echo "ERROR: Could not reach other namespace(s)" 1>&2
+ ret=1
+ fi
+
+- ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null
++ ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null
+ if [ $? -ne 0 ];then
+ echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
+ ret=1
+ fi
+- check_counters ns$i
++ check_counters ns$i-$sfx
+ if [ $? -ne 0 ]; then
+ ret=1
+ fi
+@@ -820,7 +835,7 @@ for i in 1 2; do
+ done
+
+ if [ $ret -eq 0 ];then
+- echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2"
++ echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2"
+ fi
+
+ reset_counters
+@@ -846,4 +861,9 @@ reset_counters
+ $test_inet_nat && test_redirect inet
+ $test_inet_nat && test_redirect6 inet
+
++if [ $ret -ne 0 ];then
++ echo -n "FAIL: "
++ nft --version
++fi
++
+ exit $ret
+--
+2.20.1
+
--- /dev/null
+From 7f1ebaa199046545aa3daa036da990ffc569aa9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 15:08:06 +0800
+Subject: selftests: pmtu: fix init mtu value in description
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 152044775d0b9a9ed9509caed40efcba2677951d ]
+
+There is no a_r3, a_r4 in the testing topology.
+It should be b_r1, b_r2. Also b_r1 mtu is 1400 and b_r2 mtu is 1500.
+
+Fixes: e44e428f59e4 ("selftests: pmtu: add basic IPv4 and IPv6 PMTU tests")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/pmtu.sh | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/net/pmtu.sh b/tools/testing/selftests/net/pmtu.sh
+index d697815d2785..71a62e7e35b1 100755
+--- a/tools/testing/selftests/net/pmtu.sh
++++ b/tools/testing/selftests/net/pmtu.sh
+@@ -11,9 +11,9 @@
+ # R1 and R2 (also implemented with namespaces), with different MTUs:
+ #
+ # segment a_r1 segment b_r1 a_r1: 2000
+-# .--------------R1--------------. a_r2: 1500
+-# A B a_r3: 2000
+-# '--------------R2--------------' a_r4: 1400
++# .--------------R1--------------. b_r1: 1400
++# A B a_r2: 2000
++# '--------------R2--------------' b_r2: 1500
+ # segment a_r2 segment b_r2
+ #
+ # Check that PMTU exceptions with the correct PMTU are created. Then
+--
+2.20.1
+
--- /dev/null
+From 4d28fe03695de1eb12a7aca25addd1fcea0fe569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:21:07 +0900
+Subject: selftests: safesetid: Check the return value of setuid/setgid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 295c4e21cf27ac9af542140e3e797df9e0cf7b5f ]
+
+Check the return value of setuid() and setgid().
+This fixes the following warnings and improves test result.
+
+safesetid-test.c: In function ‘main’:
+safesetid-test.c:294:2: warning: ignoring return value of ‘setuid’, declared with attribute warn_unused_result [-Wunused-result]
+ setuid(NO_POLICY_USER);
+ ^~~~~~~~~~~~~~~~~~~~~~
+safesetid-test.c:295:2: warning: ignoring return value of ‘setgid’, declared with attribute warn_unused_result [-Wunused-result]
+ setgid(NO_POLICY_USER);
+ ^~~~~~~~~~~~~~~~~~~~~~
+safesetid-test.c:309:2: warning: ignoring return value of ‘setuid’, declared with attribute warn_unused_result [-Wunused-result]
+ setuid(RESTRICTED_PARENT);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~
+safesetid-test.c:310:2: warning: ignoring return value of ‘setgid’, declared with attribute warn_unused_result [-Wunused-result]
+ setgid(RESTRICTED_PARENT);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~
+safesetid-test.c: In function ‘test_setuid’:
+safesetid-test.c:216:3: warning: ignoring return value of ‘setuid’, declared with attribute warn_unused_result [-Wunused-result]
+ setuid(child_uid);
+ ^~~~~~~~~~~~~~~~~
+
+Fixes: c67e8ec03f3f ("LSM: SafeSetID: add selftest")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/safesetid/safesetid-test.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/safesetid/safesetid-test.c b/tools/testing/selftests/safesetid/safesetid-test.c
+index 8f40c6ecdad1..0c4d50644c13 100644
+--- a/tools/testing/selftests/safesetid/safesetid-test.c
++++ b/tools/testing/selftests/safesetid/safesetid-test.c
+@@ -213,7 +213,8 @@ static void test_setuid(uid_t child_uid, bool expect_success)
+ }
+
+ if (cpid == 0) { /* Code executed by child */
+- setuid(child_uid);
++ if (setuid(child_uid) < 0)
++ exit(EXIT_FAILURE);
+ if (getuid() == child_uid)
+ exit(EXIT_SUCCESS);
+ else
+@@ -291,8 +292,10 @@ int main(int argc, char **argv)
+
+ // First test to make sure we can write userns mappings from a user
+ // that doesn't have any restrictions (as long as it has CAP_SETUID);
+- setuid(NO_POLICY_USER);
+- setgid(NO_POLICY_USER);
++ if (setuid(NO_POLICY_USER) < 0)
++ die("Error with set uid(%d)\n", NO_POLICY_USER);
++ if (setgid(NO_POLICY_USER) < 0)
++ die("Error with set gid(%d)\n", NO_POLICY_USER);
+
+ // Take away all but setid caps
+ drop_caps(true);
+@@ -306,8 +309,10 @@ int main(int argc, char **argv)
+ die("test_userns failed when it should work\n");
+ }
+
+- setuid(RESTRICTED_PARENT);
+- setgid(RESTRICTED_PARENT);
++ if (setuid(RESTRICTED_PARENT) < 0)
++ die("Error with set uid(%d)\n", RESTRICTED_PARENT);
++ if (setgid(RESTRICTED_PARENT) < 0)
++ die("Error with set gid(%d)\n", RESTRICTED_PARENT);
+
+ test_setuid(ROOT_USER, false);
+ test_setuid(ALLOWED_CHILD1, true);
+--
+2.20.1
+
--- /dev/null
+From 773823f8eeeabd19a38c9b5cbf1912642658cfac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:21:16 +0900
+Subject: selftests: safesetid: Fix Makefile to set correct test program
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 8ef1ec0ca32c6f8a87f5b4c24b1db26da67c5609 ]
+
+Fix Makefile to set safesetid-test.sh to TEST_PROGS instead
+of non existing run_tests.sh.
+
+Without this fix, I got following error.
+ ----
+ TAP version 13
+ 1..1
+ # selftests: safesetid: run_tests.sh
+ # Warning: file run_tests.sh is missing!
+ not ok 1 selftests: safesetid: run_tests.sh
+ ----
+
+Fixes: c67e8ec03f3f ("LSM: SafeSetID: add selftest")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/safesetid/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/safesetid/Makefile b/tools/testing/selftests/safesetid/Makefile
+index cac42cd36a1b..fa02c4d5ec13 100644
+--- a/tools/testing/selftests/safesetid/Makefile
++++ b/tools/testing/selftests/safesetid/Makefile
+@@ -3,7 +3,7 @@
+ CFLAGS = -Wall -O2
+ LDLIBS = -lcap
+
+-TEST_PROGS := run_tests.sh
++TEST_PROGS := safesetid-test.sh
+ TEST_GEN_FILES := safesetid-test
+
+ include ../lib.mk
+--
+2.20.1
+
--- /dev/null
+From 28f829a45ed8f2c41983c85e1657b764845a48bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:20:58 +0900
+Subject: selftests: safesetid: Move link library to LDLIBS
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit be12252212fa3dfed6e75112865095c484c0ce87 ]
+
+Move -lcap to LDLIBS from CFLAGS because it is a library
+to be linked.
+
+Without this, safesetid failed to build with link error
+as below.
+
+----
+/usr/bin/ld: /tmp/ccL8rZHT.o: in function `drop_caps':
+safesetid-test.c:(.text+0xe7): undefined reference to `cap_get_proc'
+/usr/bin/ld: safesetid-test.c:(.text+0x107): undefined reference to `cap_set_flag'
+/usr/bin/ld: safesetid-test.c:(.text+0x10f): undefined reference to `cap_set_proc'
+/usr/bin/ld: safesetid-test.c:(.text+0x117): undefined reference to `cap_free'
+/usr/bin/ld: safesetid-test.c:(.text+0x136): undefined reference to `cap_clear'
+collect2: error: ld returned 1 exit status
+----
+
+Fixes: c67e8ec03f3f ("LSM: SafeSetID: add selftest")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/safesetid/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/safesetid/Makefile b/tools/testing/selftests/safesetid/Makefile
+index 98da7a504737..cac42cd36a1b 100644
+--- a/tools/testing/selftests/safesetid/Makefile
++++ b/tools/testing/selftests/safesetid/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Makefile for mount selftests.
+-CFLAGS = -Wall -lcap -O2
++CFLAGS = -Wall -O2
++LDLIBS = -lcap
+
+ TEST_PROGS := run_tests.sh
+ TEST_GEN_FILES := safesetid-test
+--
+2.20.1
+
usb-dummy-hcd-use-usb_urb_dir_in-instead-of-usb_pipein.patch
bpf-fix-passing-modified-ctx-to-ld-abs-ind-instruction.patch
+asoc-rt5682-fix-i2c-arbitration-lost-issue.patch
+spi-pxa2xx-add-support-for-intel-jasper-lake.patch
+regulator-fix-use-after-free-issue.patch
+asoc-max98090-fix-possible-race-conditions.patch
+spi-fsl-fix-gpio-descriptor-support.patch
+gpio-handle-counting-of-freescale-chipselects.patch
+spi-fsl-handle-the-single-hardwired-chipselect-case.patch
+locking-spinlock-debug-fix-various-data-races.patch
+netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch
+x86-intel-disable-hpet-on-intel-ice-lake-platforms.patch
+netfilter-nf_tables_offload-check-for-the-netdev_unr.patch
+mwifiex-fix-heap-overflow-in-mmwifiex_process_tdls_a.patch
+libtraceevent-fix-lib-installation-with-o.patch
+libtraceevent-copy-pkg-config-file-to-output-folder-.patch
+regulator-core-fix-regulator_register-error-paths-to.patch
+x86-efi-update-e820-with-reserved-efi-boot-services-.patch
+asoc-intel-bytcr_rt5640-update-quirk-for-teclast-x89.patch
+selftests-netfilter-use-randomized-netns-names.patch
+efi-gop-return-efi_not_found-if-there-are-no-usable-.patch
+efi-gop-return-efi_success-if-a-usable-gop-was-found.patch
+efi-gop-fix-memory-leak-in-__gop_query32-64.patch
+efi-earlycon-remap-entire-framebuffer-after-page-ini.patch
+arm-dts-imx6ul-imx6ul-14x14-evk.dtsi-fix-spi-nor-pro.patch
+arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch
+netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch
+netfilter-nft_set_rbtree-bogus-lookup-get-on-consecu.patch
+netfilter-nf_tables-validate-nft_set_elem_interval_e.patch
+netfilter-nf_tables-validate-nft_data_value-after-nf.patch
+netfilter-nf_tables-skip-module-reference-count-bump.patch
+netfilter-nf_tables_offload-return-eopnotsupp-if-rul.patch
+arm-dts-bcm5301x-fix-mdio-node-address-size-cells.patch
+selftests-ftrace-fix-to-check-the-existence-of-set_f.patch
+selftests-ftrace-fix-ftrace-test-cases-to-check-unsu.patch
+selftests-ftrace-do-not-to-use-absolute-debugfs-path.patch
+selftests-ftrace-fix-multiple-kprobe-testcase.patch
+selftests-safesetid-move-link-library-to-ldlibs.patch
+selftests-safesetid-check-the-return-value-of-setuid.patch
+selftests-safesetid-fix-makefile-to-set-correct-test.patch
+arm-exynos_defconfig-restore-debugfs-support.patch
+arm-dts-cygnus-fix-mdio-node-address-size-cells.patch
+spi-spi-cavium-thunderx-add-missing-pci_release_regi.patch
+reset-do-not-register-resource-data-for-missing-rese.patch
+asoc-topology-check-return-value-for-snd_soc_add_dai.patch
+asoc-topology-check-return-value-for-soc_tplg_pcm_cr.patch
+asoc-sof-loader-snd_sof_fw_parse_ext_data-log-warnin.patch
+asoc-sof-intel-split-cht-and-byt-debug-window-sizes.patch
+arm-dts-am335x-sancloud-bbe-fix-phy-mode.patch
+arm-omap2plus_defconfig-add-back-debug_fs.patch
+arm-dts-bcm283x-fix-critical-trip-point.patch
+arm64-dts-ls1028a-fix-typo-in-tmu-calibration-data.patch
+bpf-riscv-limit-to-33-tail-calls.patch
+bpf-mips-limit-to-33-tail-calls.patch
+bpftool-don-t-crash-on-missing-jited-insns-or-ksyms.patch
+perf-metricgroup-fix-printing-event-names-of-metric-.patch
+perf-header-fix-false-warning-when-there-are-no-dupl.patch
+spi-spi-ti-qspi-fix-a-bug-when-accessing-non-default.patch
+arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch
+kselftest-runner-print-new-line-in-print-of-timeout-.patch
+kselftest-support-old-perl-versions.patch
+samples-bpf-replace-symbol-compare-of-trace_event.patch
+samples-bpf-fix-syscall_tp-due-to-unused-syscall.patch
+arm64-dts-ls1028a-fix-reboot-node.patch
+arm-imx_v6_v7_defconfig-explicitly-restore-config_de.patch
+pinctrl-aspeed-g6-fix-lpc-espi-mux-configuration.patch
+bus-ti-sysc-fix-missing-reset-delay-handling.patch
+clk-walk-orphan-list-on-clock-provider-registration.patch
+mac80211-fix-tid-field-in-monitor-mode-transmit.patch
+cfg80211-fix-double-free-after-changing-network-name.patch
+pinctrl-pinmux-fix-a-possible-null-pointer-in-pinmux.patch
+powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch
+btrfs-fix-error-messages-in-qgroup_rescan_init.patch
+btrfs-fix-cloning-range-with-a-hole-when-using-the-n.patch
+arm-shmobile-defconfig-restore-debugfs-support.patch
+btrfs-handle-error-in-btrfs_cache_block_group.patch
+btrfs-fix-hole-extent-items-with-a-zero-size-after-r.patch
+ocxl-fix-potential-memory-leak-on-context-creation.patch
+bpf-clear-skb-tstamp-in-bpf_redirect-when-necessary.patch
+habanalabs-rate-limit-error-msg-on-waiting-for-cs.patch
+habanalabs-remove-variable-val-set-but-not-used.patch
+bnx2x-do-not-handle-requests-from-vfs-after-parity.patch
+bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch
+cxgb4-fix-kernel-panic-while-accessing-sge_info.patch
+net-usb-lan78xx-fix-error-message-format-specifier.patch
+parisc-fix-compilation-when-kexec-n-and-kexec_file-y.patch
+parisc-add-missing-__init-annotation.patch
+rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch
+asoc-wm8962-fix-lambda-value.patch
+regulator-rn5t618-fix-module-aliases.patch
+spi-nxp-fspi-ensure-width-is-respected-in-spi-mem-op.patch
+clk-at91-fix-possible-deadlock.patch
+staging-axis-fifo-add-unspecified-has_iomem-dependen.patch
+iommu-iova-init-the-struct-iova-to-fix-the-possible-.patch
+kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch
+scripts-package-mkdebian-add-missing-rsync-dependenc.patch
+perf-x86-fix-potential-out-of-bounds-access.patch
+perf-x86-intel-fix-pt-pmi-handling.patch
+sched-psi-fix-sampling-error-and-rare-div0-crashes-w.patch
+psi-fix-a-division-error-in-psi-poll.patch
+usb-typec-fusb302-fix-an-undefined-reference-to-extc.patch
+block-end-bio-with-blk_sts_again-in-case-of-non-mq-d.patch
+fs-avoid-softlockups-in-s_inodes-iterators.patch
+fs-call-fsnotify_sb_delete-after-evict_inodes.patch
+perf-smmuv3-remove-the-leftover-put_cpu-in-error-pat.patch
+iommu-dma-relax-locking-in-iommu_dma_prepare_msi.patch
+io_uring-don-t-wait-when-under-submitting.patch
+clk-move-clk_core_reparent_orphans-under-config_of.patch
+net-stmmac-selftests-needs-to-check-the-number-of-mu.patch
+net-stmmac-determine-earlier-the-size-of-rx-buffer.patch
+net-stmmac-do-not-accept-invalid-mtu-values.patch
+net-stmmac-xgmac-clear-previous-rx-buffer-size.patch
+net-stmmac-rx-buffer-size-must-be-16-byte-aligned.patch
+net-stmmac-always-arm-tx-timer-at-end-of-transmissio.patch
+s390-purgatory-do-not-build-purgatory-with-kcov-kasa.patch
+drm-exynos-gsc-add-missed-component_del.patch
+tpm-tpm_ftpm_tee-add-shutdown-call-back.patch
+xsk-add-rcu_read_lock-around-the-xsk-wakeup.patch
+net-mlx5e-fix-concurrency-issues-between-config-flow.patch
+net-i40e-fix-concurrency-issues-between-config-flow-.patch
+net-ixgbe-fix-concurrency-issues-between-config-flow.patch
+platform-x86-pcengines-apuv2-fix-simswap-gpio-assign.patch
+arm64-cpu_errata-add-hisilicon-tsv110-to-spectre-v2-.patch
+block-fix-a-lockdep-complaint-triggered-by-request-q.patch
+s390-dasd-cio-interpret-ccw_device_get_mdc-return-va.patch
+s390-dasd-fix-memleak-in-path-handling-error-case.patch
+block-fix-memleak-when-__blk_rq_map_user_iov-is-fail.patch
+parisc-fix-compiler-warnings-in-debug_core.c.patch
+sbitmap-only-queue-kyber-s-wait-callback-if-not-alre.patch
+s390-qeth-handle-error-due-to-unsupported-transport-.patch
+s390-qeth-fix-promiscuous-mode-after-reset.patch
+s390-qeth-don-t-return-enotsupp-to-userspace.patch
+llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch
+hv_netvsc-fix-unwanted-rx_table-reset.patch
+selftests-pmtu-fix-init-mtu-value-in-description.patch
--- /dev/null
+From b55a69fc6c9a64e987fa209d190ed76ff4590abe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 09:37:16 +0100
+Subject: spi: fsl: Fix GPIO descriptor support
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit f106904968e2a075e64653b9b79dda9f0f070ab5 ]
+
+This makes the driver actually support looking up GPIO
+descriptor. A coding mistake in the initial descriptor
+support patch was that it was failing to turn on the very
+feature it was implementing. Mea culpa.
+
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Reported-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Link: https://lore.kernel.org/r/20191128083718.39177-1-linus.walleij@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 2d563874b4ac..ad1abea6e8b0 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -612,6 +612,7 @@ static struct spi_master * fsl_spi_probe(struct device *dev,
+ master->setup = fsl_spi_setup;
+ master->cleanup = fsl_spi_cleanup;
+ master->transfer_one_message = fsl_spi_do_one_msg;
++ master->use_gpio_descriptors = true;
+
+ mpc8xxx_spi = spi_master_get_devdata(master);
+ mpc8xxx_spi->max_bits_per_word = 32;
+--
+2.20.1
+
--- /dev/null
+From f0858b4b54289e4053ec00dd47f5d2bd56fee0b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 09:37:18 +0100
+Subject: spi: fsl: Handle the single hardwired chipselect case
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 7251953d784baf7e5416afabe030a0e81de1a938 ]
+
+The Freescale MPC8xxx had a special quirk for handling a
+single hardwired chipselect, the case when we're using neither
+GPIO nor native chip select: when inspecting the device tree
+and finding zero "cs-gpios" on the device node the code would
+assume we have a single hardwired chipselect that leaves the
+device always selected.
+
+This quirk is not handled by the new core code, so we need
+to check the "cs-gpios" explicitly in the driver and set
+pdata->max_chipselect = 1 which will later fall through to
+the SPI master ->num_chipselect.
+
+Make sure not to assign the chip select handler in this
+case: there is no handling needed since the chip is always
+selected, and this is what the old code did as well.
+
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Reported-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Fixes: 0f0581b24bd0 ("spi: fsl: Convert to use CS GPIO descriptors")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: Christophe Leroy <christophe.leroy@c-s.fr> (No tested the
+Link: https://lore.kernel.org/r/20191128083718.39177-3-linus.walleij@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index ad1abea6e8b0..be7c6ba73072 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -729,8 +729,18 @@ static int of_fsl_spi_probe(struct platform_device *ofdev)
+ }
+ }
+ #endif
+-
+- pdata->cs_control = fsl_spi_cs_control;
++ /*
++ * Handle the case where we have one hardwired (always selected)
++ * device on the first "chipselect". Else we let the core code
++ * handle any GPIOs or native chip selects and assign the
++ * appropriate callback for dealing with the CS lines. This isn't
++ * supported on the GRLIB variant.
++ */
++ ret = gpiod_count(dev, "cs");
++ if (ret <= 0)
++ pdata->max_chipselect = 1;
++ else
++ pdata->cs_control = fsl_spi_cs_control;
+ }
+
+ ret = of_address_to_resource(np, 0, &mem);
+--
+2.20.1
+
--- /dev/null
+From 9cca2eef654d54afd51db1ecbc525d9885a523dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 20:57:30 +0100
+Subject: spi: nxp-fspi: Ensure width is respected in spi-mem operations
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit 007773e16a6f3f49d1439554078c3ba8af131998 ]
+
+Make use of a core helper to ensure the desired width is respected
+when calling spi-mem operators.
+
+Otherwise only the SPI controller will be matched with the flash chip,
+which might lead to wrong widths. Also consider the width specified by
+the user in the device tree.
+
+Fixes: a5356aef6a90 ("spi: spi-mem: Add driver for NXP FlexSPI controller")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20191211195730.26794-1-michael@walle.cc
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-nxp-fspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
+index 501b923f2c27..28ae5229f889 100644
+--- a/drivers/spi/spi-nxp-fspi.c
++++ b/drivers/spi/spi-nxp-fspi.c
+@@ -439,7 +439,7 @@ static bool nxp_fspi_supports_op(struct spi_mem *mem,
+ op->data.nbytes > f->devtype_data->txfifo)
+ return false;
+
+- return true;
++ return spi_mem_default_supports_op(mem, op);
+ }
+
+ /* Instead of busy looping invoke readl_poll_timeout functionality. */
+--
+2.20.1
+
--- /dev/null
+From b7f0f924939c511d12e00d99f817ae0cc8838ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 14:51:59 +0200
+Subject: spi: pxa2xx: Add support for Intel Jasper Lake
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit 9c7315c9fca5de203538163cf42699bb10328902 ]
+
+LPSS SPI on Intel Jasper Lake is compatible with Intel Ice Lake which
+follows Intel Cannon Lake. Add PCI IDs of Jasper Lake.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20191125125159.15404-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 2e73d75a6ac5..ae95ec0bc964 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1441,6 +1441,10 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
+ { PCI_VDEVICE(INTEL, 0x4b2a), LPSS_BXT_SSP },
+ { PCI_VDEVICE(INTEL, 0x4b2b), LPSS_BXT_SSP },
+ { PCI_VDEVICE(INTEL, 0x4b37), LPSS_BXT_SSP },
++ /* JSL */
++ { PCI_VDEVICE(INTEL, 0x4daa), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0x4dab), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0x4dfb), LPSS_CNL_SSP },
+ /* APL */
+ { PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP },
+ { PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP },
+--
+2.20.1
+
--- /dev/null
+From 0ca0d16bdbd4096e2b77bd3ef31f3979c5b0bcd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 15:55:00 +0800
+Subject: spi: spi-cavium-thunderx: Add missing pci_release_regions()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit a841e2853e1afecc2ee692b8cc5bff606bc84e4c ]
+
+The driver forgets to call pci_release_regions() in probe failure
+and remove.
+Add the missed calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191206075500.18525-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cavium-thunderx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-cavium-thunderx.c b/drivers/spi/spi-cavium-thunderx.c
+index d12e149f1a41..fd6b9caffaf0 100644
+--- a/drivers/spi/spi-cavium-thunderx.c
++++ b/drivers/spi/spi-cavium-thunderx.c
+@@ -82,6 +82,7 @@ static int thunderx_spi_probe(struct pci_dev *pdev,
+
+ error:
+ clk_disable_unprepare(p->clk);
++ pci_release_regions(pdev);
+ spi_master_put(master);
+ return ret;
+ }
+@@ -96,6 +97,7 @@ static void thunderx_spi_remove(struct pci_dev *pdev)
+ return;
+
+ clk_disable_unprepare(p->clk);
++ pci_release_regions(pdev);
+ /* Put everything in a known state. */
+ writeq(0, p->register_base + OCTEON_SPI_CFG(p));
+ }
+--
+2.20.1
+
--- /dev/null
+From 95bb02b5f697d5b076404ec9da98150a5bbd1874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 21:22:16 +0530
+Subject: spi: spi-ti-qspi: Fix a bug when accessing non default CS
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit c52c91bb9aa6bd8c38dbf9776158e33038aedd43 ]
+
+When switching ChipSelect from default CS0 to any other CS, driver fails
+to update the bits in system control module register that control which
+CS is mapped for MMIO access. This causes reads to fail when driver
+tries to access QSPI flash on CS1/2/3.
+
+Fix this by updating appropriate bits whenever active CS changes.
+
+Reported-by: Andreas Dannenberg <dannenberg@ti.com>
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20191211155216.30212-1-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-ti-qspi.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 3cb65371ae3b..66dcb6128539 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -62,6 +62,7 @@ struct ti_qspi {
+ u32 dc;
+
+ bool mmap_enabled;
++ int current_cs;
+ };
+
+ #define QSPI_PID (0x0)
+@@ -487,6 +488,7 @@ static void ti_qspi_enable_memory_map(struct spi_device *spi)
+ MEM_CS_EN(spi->chip_select));
+ }
+ qspi->mmap_enabled = true;
++ qspi->current_cs = spi->chip_select;
+ }
+
+ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+@@ -498,6 +500,7 @@ static void ti_qspi_disable_memory_map(struct spi_device *spi)
+ regmap_update_bits(qspi->ctrl_base, qspi->ctrl_reg,
+ MEM_CS_MASK, 0);
+ qspi->mmap_enabled = false;
++ qspi->current_cs = -1;
+ }
+
+ static void ti_qspi_setup_mmap_read(struct spi_device *spi, u8 opcode,
+@@ -543,7 +546,7 @@ static int ti_qspi_exec_mem_op(struct spi_mem *mem,
+
+ mutex_lock(&qspi->list_lock);
+
+- if (!qspi->mmap_enabled)
++ if (!qspi->mmap_enabled || qspi->current_cs != mem->spi->chip_select)
+ ti_qspi_enable_memory_map(mem->spi);
+ ti_qspi_setup_mmap_read(mem->spi, op->cmd.opcode, op->data.buswidth,
+ op->addr.nbytes, op->dummy.nbytes);
+@@ -799,6 +802,7 @@ static int ti_qspi_probe(struct platform_device *pdev)
+ }
+ }
+ qspi->mmap_enabled = false;
++ qspi->current_cs = -1;
+
+ ret = devm_spi_register_master(&pdev->dev, master);
+ if (!ret)
+--
+2.20.1
+
--- /dev/null
+From e2eb39539ab62b154adafc66c3a55b4e4778f3cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:27:41 -0800
+Subject: staging: axis-fifo: add unspecified HAS_IOMEM dependency
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit d3aa8de6b5d0853c43c616586b4e232aa1fa7de9 ]
+
+Currently CONFIG_XIL_AXIS_FIFO=y implicitly depends on
+CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get
+the following build error:
+
+ld: drivers/staging/axis-fifo/axis-fifo.o: in function `axis_fifo_probe':
+drivers/staging/axis-fifo/axis-fifo.c:809: undefined reference to `devm_ioremap_resource'
+
+Fix the build error by adding the unspecified dependency.
+
+Reported-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Link: https://lore.kernel.org/r/20191211192742.95699-7-brendanhiggins@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/axis-fifo/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/axis-fifo/Kconfig b/drivers/staging/axis-fifo/Kconfig
+index 3fffe4d6f327..f180a8e9f58a 100644
+--- a/drivers/staging/axis-fifo/Kconfig
++++ b/drivers/staging/axis-fifo/Kconfig
+@@ -4,7 +4,7 @@
+ #
+ config XIL_AXIS_FIFO
+ tristate "Xilinx AXI-Stream FIFO IP core driver"
+- depends on OF
++ depends on OF && HAS_IOMEM
+ help
+ This adds support for the Xilinx AXI-Stream FIFO IP core driver.
+ The AXI Streaming FIFO allows memory mapped access to a AXI Streaming
+--
+2.20.1
+
--- /dev/null
+From 6e13eed9438f17a023f4359ba1ce50a2bc82d319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 10:40:38 -0500
+Subject: tpm/tpm_ftpm_tee: add shutdown call back
+
+From: Pavel Tatashin <pasha.tatashin@soleen.com>
+
+[ Upstream commit 1760eb689ed68c6746744aff2092bff57c78d907 ]
+
+Add shutdown call back to close existing session with fTPM TA
+to support kexec scenario.
+
+Add parentheses to function names in comments as specified in kdoc.
+
+Signed-off-by: Thirupathaiah Annapureddy <thiruan@microsoft.com>
+Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Tested-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_ftpm_tee.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_ftpm_tee.c b/drivers/char/tpm/tpm_ftpm_tee.c
+index 6640a14dbe48..22bf553ccf9d 100644
+--- a/drivers/char/tpm/tpm_ftpm_tee.c
++++ b/drivers/char/tpm/tpm_ftpm_tee.c
+@@ -32,7 +32,7 @@ static const uuid_t ftpm_ta_uuid =
+ 0x82, 0xCB, 0x34, 0x3F, 0xB7, 0xF3, 0x78, 0x96);
+
+ /**
+- * ftpm_tee_tpm_op_recv - retrieve fTPM response.
++ * ftpm_tee_tpm_op_recv() - retrieve fTPM response.
+ * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h.
+ * @buf: the buffer to store data.
+ * @count: the number of bytes to read.
+@@ -61,7 +61,7 @@ static int ftpm_tee_tpm_op_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ }
+
+ /**
+- * ftpm_tee_tpm_op_send - send TPM commands through the TEE shared memory.
++ * ftpm_tee_tpm_op_send() - send TPM commands through the TEE shared memory.
+ * @chip: the tpm_chip description as specified in driver/char/tpm/tpm.h
+ * @buf: the buffer to send.
+ * @len: the number of bytes to send.
+@@ -208,7 +208,7 @@ static int ftpm_tee_match(struct tee_ioctl_version_data *ver, const void *data)
+ }
+
+ /**
+- * ftpm_tee_probe - initialize the fTPM
++ * ftpm_tee_probe() - initialize the fTPM
+ * @pdev: the platform_device description.
+ *
+ * Return:
+@@ -298,7 +298,7 @@ static int ftpm_tee_probe(struct platform_device *pdev)
+ }
+
+ /**
+- * ftpm_tee_remove - remove the TPM device
++ * ftpm_tee_remove() - remove the TPM device
+ * @pdev: the platform_device description.
+ *
+ * Return:
+@@ -328,6 +328,19 @@ static int ftpm_tee_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++/**
++ * ftpm_tee_shutdown() - shutdown the TPM device
++ * @pdev: the platform_device description.
++ */
++static void ftpm_tee_shutdown(struct platform_device *pdev)
++{
++ struct ftpm_tee_private *pvt_data = dev_get_drvdata(&pdev->dev);
++
++ tee_shm_free(pvt_data->shm);
++ tee_client_close_session(pvt_data->ctx, pvt_data->session);
++ tee_client_close_context(pvt_data->ctx);
++}
++
+ static const struct of_device_id of_ftpm_tee_ids[] = {
+ { .compatible = "microsoft,ftpm" },
+ { }
+@@ -341,6 +354,7 @@ static struct platform_driver ftpm_tee_driver = {
+ },
+ .probe = ftpm_tee_probe,
+ .remove = ftpm_tee_remove,
++ .shutdown = ftpm_tee_shutdown,
+ };
+
+ module_platform_driver(ftpm_tee_driver);
+--
+2.20.1
+
--- /dev/null
+From 68344966d59c3db840402a4c56d842b1b6739d81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 20:16:18 +0800
+Subject: usb: typec: fusb302: Fix an undefined reference to 'extcon_get_state'
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 547fc228755d79af648898187e7831a825d4f42c ]
+
+Fixes the following compile error:
+
+drivers/usb/typec/tcpm/fusb302.o: In function `tcpm_get_current_limit':
+fusb302.c:(.text+0x3ee): undefined reference to `extcon_get_state'
+fusb302.c:(.text+0x422): undefined reference to `extcon_get_state'
+fusb302.c:(.text+0x450): undefined reference to `extcon_get_state'
+fusb302.c:(.text+0x48c): undefined reference to `extcon_get_state'
+drivers/usb/typec/tcpm/fusb302.o: In function `fusb302_probe':
+fusb302.c:(.text+0x980): undefined reference to `extcon_get_extcon_dev'
+make: *** [vmlinux] Error 1
+
+It is because EXTCON is build as a module, but FUSB302 is not.
+
+Suggested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/1576239378-50795-1-git-send-email-zhongjiang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/typec/tcpm/Kconfig b/drivers/usb/typec/tcpm/Kconfig
+index 72481bbb2af3..5b986d6c801d 100644
+--- a/drivers/usb/typec/tcpm/Kconfig
++++ b/drivers/usb/typec/tcpm/Kconfig
+@@ -32,6 +32,7 @@ endif # TYPEC_TCPCI
+ config TYPEC_FUSB302
+ tristate "Fairchild FUSB302 Type-C chip driver"
+ depends on I2C
++ depends on EXTCON || !EXTCON
+ help
+ The Fairchild FUSB302 Type-C chip driver that works with
+ Type-C Port Controller Manager to provide USB PD and USB
+--
+2.20.1
+
--- /dev/null
+From 4510647113d28a977286c7c6faf24f814c2bb098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 15:52:33 +0800
+Subject: x86/efi: Update e820 with reserved EFI boot services data to fix
+ kexec breakage
+
+From: Dave Young <dyoung@redhat.com>
+
+[ Upstream commit af164898482817a1d487964b68f3c21bae7a1beb ]
+
+Michael Weiser reported that he got this error during a kexec rebooting:
+
+ esrt: Unsupported ESRT version 2904149718861218184.
+
+The ESRT memory stays in EFI boot services data, and it was reserved
+in kernel via efi_mem_reserve(). The initial purpose of the reservation
+is to reuse the EFI boot services data across kexec reboot. For example
+the BGRT image data and some ESRT memory like Michael reported.
+
+But although the memory is reserved it is not updated in the X86 E820 table,
+and kexec_file_load() iterates system RAM in the IO resource list to find places
+for kernel, initramfs and other stuff. In Michael's case the kexec loaded
+initramfs overwrote the ESRT memory and then the failure happened.
+
+Since kexec_file_load() depends on the E820 table being updated, just fix this
+by updating the reserved EFI boot services memory as reserved type in E820.
+
+Originally any memory descriptors with EFI_MEMORY_RUNTIME attribute are
+bypassed in the reservation code path because they are assumed as reserved.
+
+But the reservation is still needed for multiple kexec reboots,
+and it is the only possible case we come here thus just drop the code
+chunk, then everything works without side effects.
+
+On my machine the ESRT memory sits in an EFI runtime data range, it does
+not trigger the problem, but I successfully tested with BGRT instead.
+both kexec_load() and kexec_file_load() work and kdump works as well.
+
+[ mingo: Edited the changelog. ]
+
+Reported-by: Michael Weiser <michael@weiser.dinsnail.net>
+Tested-by: Michael Weiser <michael@weiser.dinsnail.net>
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: kexec@lists.infradead.org
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20191204075233.GA10520@dhcp-128-65.nay.redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/quirks.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
+index 3b9fd679cea9..aefe845dff59 100644
+--- a/arch/x86/platform/efi/quirks.c
++++ b/arch/x86/platform/efi/quirks.c
+@@ -260,10 +260,6 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
+ return;
+ }
+
+- /* No need to reserve regions that will never be freed. */
+- if (md.attribute & EFI_MEMORY_RUNTIME)
+- return;
+-
+ size += addr % EFI_PAGE_SIZE;
+ size = round_up(size, EFI_PAGE_SIZE);
+ addr = round_down(addr, EFI_PAGE_SIZE);
+@@ -293,6 +289,8 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
+ early_memunmap(new, new_size);
+
+ efi_memmap_install(new_phys, num_entries);
++ e820__range_update(addr, size, E820_TYPE_RAM, E820_TYPE_RESERVED);
++ e820__update_table(e820_table);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 640bf16749725ecf8180863d1245d93c592a68cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 14:23:03 +0800
+Subject: x86/intel: Disable HPET on Intel Ice Lake platforms
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit e0748539e3d594dd26f0d27a270f14720b22a406 ]
+
+Like CFL and CFL-H, ICL SoC has skewed HPET timer once it hits PC10.
+So let's disable HPET on ICL.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: bp@alien8.de
+Cc: feng.tang@intel.com
+Cc: harry.pan@intel.com
+Cc: hpa@zytor.com
+Link: https://lkml.kernel.org/r/20191129062303.18982-2-kai.heng.feng@canonical.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/early-quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
+index 606711f5ebf8..2f9ec14be3b1 100644
+--- a/arch/x86/kernel/early-quirks.c
++++ b/arch/x86/kernel/early-quirks.c
+@@ -714,6 +714,8 @@ static struct chipset early_qrk[] __initdata = {
+ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
+ { PCI_VENDOR_ID_INTEL, 0x3ec4,
+ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
++ { PCI_VENDOR_ID_INTEL, 0x8a12,
++ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
+ { PCI_VENDOR_ID_BROADCOM, 0x4331,
+ PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
+ {}
+--
+2.20.1
+
--- /dev/null
+From 2972aefb06ed472a78f4f4356bd6466545188d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 16:20:42 +0000
+Subject: xsk: Add rcu_read_lock around the XSK wakeup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 06870682087b58398671e8cdc896cd62314c4399 ]
+
+The XSK wakeup callback in drivers makes some sanity checks before
+triggering NAPI. However, some configuration changes may occur during
+this function that affect the result of those checks. For example, the
+interface can go down, and all the resources will be destroyed after the
+checks in the wakeup function, but before it attempts to use these
+resources. Wrap this callback in rcu_read_lock to allow driver to
+synchronize_rcu before actually destroying the resources.
+
+xsk_wakeup is a new function that encapsulates calling ndo_xsk_wakeup
+wrapped into the RCU lock. After this commit, xsk_poll starts using
+xsk_wakeup and checks xs->zc instead of ndo_xsk_wakeup != NULL to decide
+ndo_xsk_wakeup should be called. It also fixes a bug introduced with the
+need_wakeup feature: a non-zero-copy socket may be used with a driver
+supporting zero-copy, and in this case ndo_xsk_wakeup should not be
+called, so the xs->zc check is the correct one.
+
+Fixes: 77cd0d7b3f25 ("xsk: add support for need_wakeup flag in AF_XDP rings")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191217162023.16011-2-maximmi@mellanox.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 9044073fbf22..d426fc01c529 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -305,12 +305,21 @@ bool xsk_umem_consume_tx(struct xdp_umem *umem, struct xdp_desc *desc)
+ }
+ EXPORT_SYMBOL(xsk_umem_consume_tx);
+
+-static int xsk_zc_xmit(struct xdp_sock *xs)
++static int xsk_wakeup(struct xdp_sock *xs, u8 flags)
+ {
+ struct net_device *dev = xs->dev;
++ int err;
++
++ rcu_read_lock();
++ err = dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, flags);
++ rcu_read_unlock();
++
++ return err;
++}
+
+- return dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id,
+- XDP_WAKEUP_TX);
++static int xsk_zc_xmit(struct xdp_sock *xs)
++{
++ return xsk_wakeup(xs, XDP_WAKEUP_TX);
+ }
+
+ static void xsk_destruct_skb(struct sk_buff *skb)
+@@ -424,19 +433,16 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock,
+ unsigned int mask = datagram_poll(file, sock, wait);
+ struct sock *sk = sock->sk;
+ struct xdp_sock *xs = xdp_sk(sk);
+- struct net_device *dev;
+ struct xdp_umem *umem;
+
+ if (unlikely(!xsk_is_bound(xs)))
+ return mask;
+
+- dev = xs->dev;
+ umem = xs->umem;
+
+ if (umem->need_wakeup) {
+- if (dev->netdev_ops->ndo_xsk_wakeup)
+- dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id,
+- umem->need_wakeup);
++ if (xs->zc)
++ xsk_wakeup(xs, umem->need_wakeup);
+ else
+ /* Poll needs to drive Tx also in copy mode */
+ __xsk_sendmsg(sk);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
