From 4ac9df539c5ba713a9fcde0326ec0c30bfe9573c Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Thu, 23 Jan 2020 11:26:57 -0500
Subject: [PATCH] fixes for 4.9

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../6lowpan-off-by-one-handling-nexthdr.patch |  41 ++
 ...ix-mirred_init_module-error-handling.patch |  40 ++
 queue-4.9/afs-fix-large-file-support.patch    |  45 ++
 ...port-local-variable-ahci_em_messages.patch |  41 ++
 ...lways-initialize-register-read-value.patch |  43 ++
 ...alsa-hda-fix-unused-variable-warning.patch |  53 +++
 ...andle-the-error-from-snd_usb_mixer_a.patch |  39 ++
 ...pdate-quirk-for-b-w-px-to-remove-mic.patch |  64 +++
 ...x-hyp-svc-mode-mismatch-when-mcpm-is.patch |  97 ++++
 ...align-gic-version-check-with-arm64-c.patch |  40 ++
 ...add-required-clocks-property-to-keyp.patch |  38 ++
 ...fix-arm-primecell-lcd-controller-clo.patch |  38 ++
 ...fix-arm-primecell-lcd-controller-var.patch |  36 ++
 ...phy3250-fix-sd-card-regulator-voltag.patch |  39 ++
 ...x-reparent-keypad-controller-to-sic1.patch |  43 ++
 ...ix-sgmii-pcs-link-remaining-down-aft.patch |  95 ++++
 ...tentially-uninitialized-return-value.patch |  44 ++
 ...warning-invalid-free-of-devm_-alloca.patch |  47 ++
 ...ack-of-keyboard-interrupts-after-irq.patch |  42 ++
 ...6-sbc-increase-load-on-l11-for-sdcar.patch |  42 ++
 .../arm64-dts-juno-fix-uart-frequency.patch   |  54 +++
 ...-cs4349-use-pm-ops-cs4349_runtime_pm.patch |  40 ++
 ...copy-paste-error-in-es8328_right_lin.patch |  37 ++
 .../asoc-fix-valid-stream-condition.patch     |  40 ++
 ...0-put-of-nodes-if-finding-codec-fail.patch |  40 ++
 ...-node-refcount-unbalance-in-apq8016_.patch |  90 ++++
 ...x-and-tx-counter-registers-are-swapp.patch |  38 ++
 ...mcasp-fix-slot-mask-settings-when-us.patch |  51 +++
 ...copy-paste-error-in-wm8737_snd_contr.patch |  41 ++
 ...-possible-deadlock-in-ath_dynack_nod.patch | 136 ++++++
 ...a-return-0-on-success-in-update_stat.patch |  50 +++
 ...ct-update-of-bcma_core_pci_mdio_data.patch |  48 ++
 ...bio-bi_vcnt-to-figure-out-segment-nu.patch |  50 +++
 ...hen-loading-existing-inode-cache-off.patch |  86 ++++
 ...eturn-value-of-recover_from_urb_loss.patch |  35 ++
 ...egression-in-cifs.ko-caused-by-force.patch |  38 ++
 ...0-fix-refcount-leak-in-a370_clk_init.patch |  41 ++
 ...xp-fix-refcount-leak-in-axp_clk_init.patch |  40 ++
 ...e-fix-refcount-leak-in-dove_clk_init.patch |  47 ++
 ...ank-fix-refcount-leak-in-hb_clk_init.patch |  36 ++
 ...x-refcount-leak-in-imx6q_clocks_init.patch |  36 ++
 ...-refcount-leak-in-imx6sx_clocks_init.patch |  36 ++
 ...x-refcount-leak-in-imx7d_clocks_init.patch |  36 ++
 ...x-refcount-leak-in-kirkwood_clk_init.patch |  38 ++
 .../clk-qcom-fix-wunused-const-variable.patch |  98 ++++
 ...q-fix-refcount-leak-in-clockgen_init.patch |  36 ++
 ...os4-fix-refcount-leak-in-exynos4_get.patch |  36 ++
 queue-4.9/clk-socfpga-fix-refcount-leak.patch |  50 +++
 ...8i-a23-enable-pll-mipi-ldos-when-ung.patch |  39 ++
 ...x-refcount-leak-in-vf610_clocks_init.patch |  36 ++
 ...ers-exynos_mct-fix-error-path-in-tim.patch |  53 +++
 ...ers-sun5i-fail-gracefully-when-clock.patch |  58 +++
 ...-resources-in-case-caam_rng-registra.patch |  40 ++
 ...es-cfb-error-exposed-by-new-test-vec.patch |  63 +++
 ...-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch |  49 ++
 ...o-tgr192-fix-unaligned-memory-access.patch |  50 +++
 ...evres-allow-const-resource-arguments.patch |  63 +++
 ...ac-don-t-check-the-number-of-frames-.patch |  45 ++
 ...tform-switch-to-acpi_dma_controller_.patch |  64 +++
 ...vert-set-hsu_ch_mtsr-to-memory-width.patch |  51 +++
 ...ma-fix-size-check-for-sdma-script_nu.patch |  73 +++
 ...v_xor-use-correct-device-for-dma-api.patch |  53 +++
 ...tegra210-adma-fix-crash-during-probe.patch |  92 ++++
 ...tegra210-adma-restore-channel-status.patch | 124 +++++
 ...-ti-edma-fix-missed-failure-handling.patch |  41 ++
 ...rio_cm.c-fix-potential-oops-in-riocm.patch |  44 ++
 ...validating-ports-during-destruction-.patch |  90 ++++
 ...l-vs-is_err-buf-in-etnaviv_core_dump.patch |  36 ++
 ...-a3xx-remove-tpl1-regs-from-snapshot.patch |  60 +++
 ...rm-msm-dsi-implement-reset-correctly.patch |  73 +++
 ...-mdp5-fix-mdp5_cfg_init-error-return.patch |  39 ++
 ...-ramcfg-fix-missing-parentheses-when.patch |  43 ++
 ...don-t-print-reply-values-if-exec-is-.patch |  44 ++
 ...eon-fix-bad-dma-from-interrupt_cntl2.patch |  77 ++++
 ...emove-the-drm_bridge-that-was-never-.patch |  55 +++
 ...ounds-check-in-virtio_gpu_cmd_get_ca.patch |  55 +++
 ...copy-paste-err-in-ehea_init_port_res.patch |  38 ++
 ...-fix-passing-zero-to-err_ptr-warning.patch |  38 ++
 ...eturn-correctly-when-ext4_htree_stor.patch |  39 ++
 ...emove-set-but-not-used-variable-size.patch |  51 +++
 ...arse_devname-to-not-modify-it-s-argu.patch |  38 ++
 ...rite-operations-for-negative-tempera.patch |  40 ++
 ...on-shtc1-fix-shtc1-and-shtw1-id-mask.patch |  39 ++
 ...se-request_muxed_region-for-super-io.patch | 121 +++++
 ...b-iser-fix-dma_nents-type-definition.patch |  41 ++
 ...-correct-number-of-entries-for-dma-m.patch |  61 +++
 ...ing-xrc-options-to-qp-optional-param.patch |  90 ++++
 .../ib-rxe-replace-kvfree-with-vfree.patch    |  77 ++++
 ...-of-bounds-index-check-in-query-pkey.patch |  37 ++
 ...5380-fix-incorrect-assignment-to-val.patch |  39 ++
 ...inet_frags_fini-after-unregister_per.patch |  56 +++
 ...k-ske-keypad-fix-a-loop-timeout-test.patch |  35 ++
 .../iommu-amd-make-iommu_disable-safer.patch  |  40 ++
 ...or-completion-of-iotlb-flush-in-atta.patch |  37 ++
 ...ght-function-to-get-group-for-device.patch |  42 ++
 ...kernel-parameter-igfx_off-work-with-.patch |  49 ++
 ...gb4-use-tos-when-finding-ipv6-routes.patch |  46 ++
 ...-use-tos-when-importing-the-endpoint.patch |  35 ++
 ...-mvm-fix-a-mpdu-reference-assignment.patch |  50 +++
 .../iwlwifi-mvm-fix-rss-config-command.patch  |  46 ++
 ...x-bogus-variable-self-initialization.patch |  45 ++
 ...nity-check-on-the-cpu-in-kdb_per_cpu.patch |  38 ++
 queue-4.9/keys-timestamp-new-keys.patch       |  34 ++
 ...ix-possible-null-pointer-dereference.patch |  92 ++++
 ...correct-channel-range-in-lbtf_geo_in.patch |  38 ++
 ...potential-sk_buff-leak-in-llc_ui_sen.patch | 196 ++++++++
 ...refcounting-in-llc_conn_state_proces.patch | 125 ++++++
 ...r_interrupt-with-interrupts-disabled.patch | 422 ++++++++++++++++++
 ...k-mac-fix-via-timer-counter-accesses.patch | 156 +++++++
 ...11-accept-deauth-frames-in-ibss-mode.patch |  49 ++
 ...l_ht-fix-per-group-max-throughput-ra.patch |  38 ++
 ...pdate-pos-correctly-in-cx18_read_pos.patch |  37 ++
 ...edia-cx23885-check-allocation-return.patch |  43 ++
 ...sif-avoid-uninitialized-variable-use.patch |  78 ++++
 ...be-array-underflow-in-vpbe_enum_outp.patch |  54 +++
 ...pdate-pos-correctly-in-ivtv_read_pos.patch |  37 ++
 ...potential-buffer-overflow-in-vidioc_.patch |  68 +++
 ...659-fix-unbalanced-mutex_lock-unlock.patch |  39 ++
 ...-.get_fmt-v4l2_subdev_format_try-sup.patch |  56 +++
 ...fix-incorrect-use-of-jpeg-colorspace.patch |  97 ++++
 ...-some-format-attributes-not-under-co.patch | 132 ++++++
 ...orrect-step-and-max-values-for-v4l2_.patch |  45 ++
 ...-possible-null-pointer-dereference-i.patch |  47 ++
 ...incorrect-assignment-operation-when-.patch |  42 ++
 ...-an-error-code-in-fm_download_firmwa.patch |  40 ++
 ...mfd-intel-lpss-release-ida-resources.patch |  36 ++
 ...statically-declaring-a-struct-device.patch | 118 +++++
 ...cit-ub-in-assignment-of-mips_io_port.patch | 103 +++++
 ...x-return-value-of-loongson_hwmon_ini.patch |  42 ++
 ...erly-initialize-buf-in-xpc_get_rsvd_.patch |  70 +++
 ...w-reg-qeec-add-minimum-shaper-fields.patch |  77 ++++
 ...b-handle-mmc_of_parse-errors-during-.patch |  38 ++
 ...-always-register-net_device-notifier.patch |  84 ++++
 ...sysport-fix-signedness-in-bcm_syspor.patch |  38 ++
 ...qca8k-enable-delay-for-rgmii_id-mode.patch |  64 +++
 ...com_fill_hash_function-implementatio.patch |  35 ++
 ...ree-napi-resources-when-ena_up-fails.patch |  38 ++
 ...rrect-test-of-supported-hash-functio.patch |  40 ++
 ...ped-parameters-when-calling-ena_com_.patch |  39 ++
 ...mac-fix-signedness-bug-in-ipq806x_gm.patch |  37 ++
 ...x-signedness-bug-in-hix5hd2_dev_prob.patch |  36 ++
 ...mlx5-fix-mlx5_ifc_query_lag_out_bits.patch |  36 ++
 ...use-long-type-to-store-jiffies-delta.patch |  37 ++
 ...t-the-parent-s-backlog-when-corrupte.patch |  40 ++
 ...cklog-accounting-for-corrupted-gso-f.patch |  84 ++++
 ...-error-path-for-corrupted-gso-frames.patch |  74 +++
 ...n-use-after-free-in-pasemi_mac_phy_i.patch |  49 ++
 ...to-call-phy_resume-if-phy-is-not-att.patch |  68 +++
 ..._phy-fix-fixed_phy-not-checking-gpio.patch |  46 ++
 ...pi-move-reset_count-to-struct-qcaspi.patch |  68 +++
 ...vt_handler_call-element-in-rds_ib_st.patch |  40 ++
 ...x-a-missing-check-of-of_get_phy_mode.patch |  49 ++
 ...e-dev_kfree_skb-in-sonic_send_packet.patch |  37 ++
 ...-netdev_tx_ok-if-failed-to-map-buffe.patch |  42 ++
 ...-meson8b-fix-signedness-bug-in-probe.patch |  37 ++
 ...ix-length-of-ptp-clock-s-name-string.patch |  51 +++
 ...-not-all-unicast-addresses-may-be-av.patch |  36 ++
 ...es-config_compat-reject-trailing-dat.patch |  44 ++
 ...ockup-in-the-delegation-recovery-cod.patch |  83 ++++
 ...os2-ksyms-add-missing-symbol-exports.patch |  67 +++
 ...t-access-workaround-for-capability-r.patch |  57 +++
 ...gnedness-bug-in-of_phy_get_and_conne.patch |  36 ++
 ...fix-data-race-in-fanout_flow_is_huge.patch | 134 ++++++
 ...g-msg_name-return-at-least-sizeof-so.patch |  69 +++
 ...-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch |  62 +++
 ...-use-format-specifier-in-kobject_add.patch |  43 ++
 ...dd-check-for-the-sample_period-value.patch |  57 +++
 ...c-emev2-add-missing-pinmux-functions.patch |  82 ++++
 ...8a7740-add-missing-lcd0-marks-to-lcd.patch |  36 ++
 ...8a7740-add-missing-ref125ck-pin-to-g.patch |  37 ++
 ...-r8a7791-fix-scifb2_data_c-pin-group.patch |  36 ++
 ...8a7791-remove-bogus-ctrl-marks-from-.patch |  40 ++
 ...8a7791-remove-bogus-marks-from-vin1_.patch |  47 ++
 ...-r8a7792-fix-vin1_data18_b-pin-group.patch |  35 ++
 ...pfc-r8a7794-remove-bogus-ipsr9-field.patch |  36 ++
 ...-pfc-sh7269-add-missing-pcior0-field.patch |  39 ++
 ...h73a0-add-missing-to-pin-to-tpu4_to3.patch |  37 ++
 ...pfc-sh73a0-fix-fsic_spdif-pin-groups.patch |  37 ++
 ...-pfc-sh7734-add-missing-ipsr11-field.patch |  37 ++
 ...pfc-sh7734-remove-bogus-ipsr10-value.patch |  42 ++
 ...enware-wmi-printing-the-wrong-error-.patch |  38 ++
 ...-init-device-wakeup-after-device_add.patch |  69 +++
 ...o-add-cacheinfo_teardown-cacheinfo_r.patch |  71 +++
 ...e-vdso32-installation-conditional-in.patch |  39 ++
 ...-runtime-pm-reference-from-the-drive.patch |  45 ++
 ...disable-pwm-when-setting-duty-repeat.patch |  43 ++
 .../qed-reduce-maximum-stack-frame-size.patch | 103 +++++
 ...s-hw-access-invalid-dma-memory-error.patch |  48 ++
 ...out-of-bounds-index-check-in-query-p.patch |  36 ++
 ...t-of-bounds-index-check-in-query-pke.patch |  37 ++
 ...default-enable-high-on-dt-regulators.patch |  67 +++
 ...88060-fix-array-out-of-bounds-access.patch |  36 ++
 ...88080-fix-array-out-of-bounds-access.patch |  36 ++
 ...88090-fix-array-out-of-bounds-access.patch |  36 ++
 ...86-fix-tps65086_ldoa1_ranges-for-sel.patch |  45 ++
 ...-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch |  40 ++
 ...8pm80x-fix-unintended-sign-extension.patch |  93 ++++
 ...pm860x-fix-unintended-sign-extension.patch |  90 ++++
 .../rtc-cmos-ignore-bogus-century-byte.patch  |  45 ++
 ...ds1672-fix-unintended-sign-extension.patch |  43 ++
 ...r-event-flags-and-disable-interrupts.patch |  61 +++
 ...pm8xxx-fix-unintended-sign-extension.patch |  53 +++
 ...ialized-error-code-in-rxrpc_send_dat.patch |  52 +++
 ...ull-pointer-dereference-on-a-null-lp.patch |  39 ++
 ...megaraid_sas-reduce-module-load-time.patch |  67 +++
 ...egister-chrdev-if-module-initializat.patch | 100 +++++
 ...ix-transmit_chars-when-tx-is-stopped.patch |  52 +++
 queue-4.9/series                              | 229 ++++++++++
 ...s-and-drbd-to-receive-their-terminat.patch | 136 ++++++
 ...cifs_put_tcp_session-to-call-send_si.patch |  54 +++
 ...-fix-an-error-code-in-qe_pin_request.patch |  38 ++
 ...ix-driver-to-not-allow-65535-1-cs-gp.patch |  61 +++
 ...call-spi_finalize_current_message-at.patch |  44 ++
 ...4-clear-packed-bit-for-unpacked-mode.patch |  38 ++
 ...a114-fix-for-unpacked-mode-transfers.patch | 164 +++++++
 ...i_mio_common-protect-register-write-.patch |  90 ++++
 ...ybus-light-fix-a-couple-double-frees.patch |  69 +++
 ...v-add-missing-check-for-cdev_add-fai.patch |  49 ++
 ...ing-actually-trace-cpu-load-in-therm.patch |  59 +++
 ...al-mediatek-fix-register-index-error.patch |  47 ++
 ...tipc_rmem-and-named_timeout-right-ra.patch |  60 +++
 queue-4.9/tipc-tipc-clang-warning.patch       |  69 +++
 ...ix-potential-null-pointer-dereferenc.patch |  36 ++
 ...ix-link-error-against-usb-gadget-mod.patch |  41 ++
 ...-hub-fix-extra-endianness-conversion.patch |  44 ++
 ...usb-fix-possible-use-after-free-on-r.patch |  41 ++
 ...memory-accesses-before-calling-pci_m.patch |  69 +++
 ...-kgbd-use-nmi_vector-not-apic_dm_nmi.patch |  41 ++
 ...-dependency-of-the-x86-insn-decoder-.patch |  40 ++
 ...plug-prevent-an-out-of-bounds-access.patch |  38 ++
 230 files changed, 13137 insertions(+)
 create mode 100644 queue-4.9/6lowpan-off-by-one-handling-nexthdr.patch
 create mode 100644 queue-4.9/act_mirred-fix-mirred_init_module-error-handling.patch
 create mode 100644 queue-4.9/afs-fix-large-file-support.patch
 create mode 100644 queue-4.9/ahci-do-not-export-local-variable-ahci_em_messages.patch
 create mode 100644 queue-4.9/alsa-aoa-onyx-always-initialize-register-read-value.patch
 create mode 100644 queue-4.9/alsa-hda-fix-unused-variable-warning.patch
 create mode 100644 queue-4.9/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
 create mode 100644 queue-4.9/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
 create mode 100644 queue-4.9/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
 create mode 100644 queue-4.9/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
 create mode 100644 queue-4.9/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
 create mode 100644 queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
 create mode 100644 queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
 create mode 100644 queue-4.9/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
 create mode 100644 queue-4.9/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
 create mode 100644 queue-4.9/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
 create mode 100644 queue-4.9/arm-omap2-fix-potentially-uninitialized-return-value.patch
 create mode 100644 queue-4.9/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
 create mode 100644 queue-4.9/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
 create mode 100644 queue-4.9/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
 create mode 100644 queue-4.9/arm64-dts-juno-fix-uart-frequency.patch
 create mode 100644 queue-4.9/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
 create mode 100644 queue-4.9/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
 create mode 100644 queue-4.9/asoc-fix-valid-stream-condition.patch
 create mode 100644 queue-4.9/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
 create mode 100644 queue-4.9/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
 create mode 100644 queue-4.9/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
 create mode 100644 queue-4.9/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
 create mode 100644 queue-4.9/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
 create mode 100644 queue-4.9/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
 create mode 100644 queue-4.9/backlight-lm3630a-return-0-on-success-in-update_stat.patch
 create mode 100644 queue-4.9/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
 create mode 100644 queue-4.9/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
 create mode 100644 queue-4.9/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
 create mode 100644 queue-4.9/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
 create mode 100644 queue-4.9/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
 create mode 100644 queue-4.9/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
 create mode 100644 queue-4.9/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
 create mode 100644 queue-4.9/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
 create mode 100644 queue-4.9/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
 create mode 100644 queue-4.9/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
 create mode 100644 queue-4.9/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
 create mode 100644 queue-4.9/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
 create mode 100644 queue-4.9/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
 create mode 100644 queue-4.9/clk-qcom-fix-wunused-const-variable.patch
 create mode 100644 queue-4.9/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
 create mode 100644 queue-4.9/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
 create mode 100644 queue-4.9/clk-socfpga-fix-refcount-leak.patch
 create mode 100644 queue-4.9/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
 create mode 100644 queue-4.9/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
 create mode 100644 queue-4.9/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
 create mode 100644 queue-4.9/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
 create mode 100644 queue-4.9/crypto-caam-free-resources-in-case-caam_rng-registra.patch
 create mode 100644 queue-4.9/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
 create mode 100644 queue-4.9/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
 create mode 100644 queue-4.9/crypto-tgr192-fix-unaligned-memory-access.patch
 create mode 100644 queue-4.9/devres-allow-const-resource-arguments.patch
 create mode 100644 queue-4.9/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
 create mode 100644 queue-4.9/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
 create mode 100644 queue-4.9/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
 create mode 100644 queue-4.9/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
 create mode 100644 queue-4.9/dmaengine-mv_xor-use-correct-device-for-dma-api.patch
 create mode 100644 queue-4.9/dmaengine-tegra210-adma-fix-crash-during-probe.patch
 create mode 100644 queue-4.9/dmaengine-tegra210-adma-restore-channel-status.patch
 create mode 100644 queue-4.9/dmaengine-ti-edma-fix-missed-failure-handling.patch
 create mode 100644 queue-4.9/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
 create mode 100644 queue-4.9/drm-dp_mst-skip-validating-ports-during-destruction-.patch
 create mode 100644 queue-4.9/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
 create mode 100644 queue-4.9/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
 create mode 100644 queue-4.9/drm-msm-dsi-implement-reset-correctly.patch
 create mode 100644 queue-4.9/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
 create mode 100644 queue-4.9/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
 create mode 100644 queue-4.9/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
 create mode 100644 queue-4.9/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
 create mode 100644 queue-4.9/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
 create mode 100644 queue-4.9/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
 create mode 100644 queue-4.9/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
 create mode 100644 queue-4.9/exportfs-fix-passing-zero-to-err_ptr-warning.patch
 create mode 100644 queue-4.9/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
 create mode 100644 queue-4.9/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
 create mode 100644 queue-4.9/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
 create mode 100644 queue-4.9/hwmon-lm75-fix-write-operations-for-negative-tempera.patch
 create mode 100644 queue-4.9/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
 create mode 100644 queue-4.9/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
 create mode 100644 queue-4.9/ib-iser-fix-dma_nents-type-definition.patch
 create mode 100644 queue-4.9/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
 create mode 100644 queue-4.9/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
 create mode 100644 queue-4.9/ib-rxe-replace-kvfree-with-vfree.patch
 create mode 100644 queue-4.9/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
 create mode 100644 queue-4.9/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
 create mode 100644 queue-4.9/inet-frags-call-inet_frags_fini-after-unregister_per.patch
 create mode 100644 queue-4.9/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
 create mode 100644 queue-4.9/iommu-amd-make-iommu_disable-safer.patch
 create mode 100644 queue-4.9/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
 create mode 100644 queue-4.9/iommu-use-right-function-to-get-group-for-device.patch
 create mode 100644 queue-4.9/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
 create mode 100644 queue-4.9/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
 create mode 100644 queue-4.9/iw_cxgb4-use-tos-when-importing-the-endpoint.patch
 create mode 100644 queue-4.9/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
 create mode 100644 queue-4.9/iwlwifi-mvm-fix-rss-config-command.patch
 create mode 100644 queue-4.9/jfs-fix-bogus-variable-self-initialization.patch
 create mode 100644 queue-4.9/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
 create mode 100644 queue-4.9/keys-timestamp-new-keys.patch
 create mode 100644 queue-4.9/l2tp-fix-possible-null-pointer-dereference.patch
 create mode 100644 queue-4.9/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
 create mode 100644 queue-4.9/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
 create mode 100644 queue-4.9/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
 create mode 100644 queue-4.9/m68k-call-timer_interrupt-with-interrupts-disabled.patch
 create mode 100644 queue-4.9/m68k-mac-fix-via-timer-counter-accesses.patch
 create mode 100644 queue-4.9/mac80211-accept-deauth-frames-in-ibss-mode.patch
 create mode 100644 queue-4.9/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
 create mode 100644 queue-4.9/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
 create mode 100644 queue-4.9/media-cx23885-check-allocation-return.patch
 create mode 100644 queue-4.9/media-davinci-isif-avoid-uninitialized-variable-use.patch
 create mode 100644 queue-4.9/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
 create mode 100644 queue-4.9/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
 create mode 100644 queue-4.9/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
 create mode 100644 queue-4.9/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
 create mode 100644 queue-4.9/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-sup.patch
 create mode 100644 queue-4.9/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch
 create mode 100644 queue-4.9/media-ov6650-fix-some-format-attributes-not-under-co.patch
 create mode 100644 queue-4.9/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
 create mode 100644 queue-4.9/media-tw5864-fix-possible-null-pointer-dereference-i.patch
 create mode 100644 queue-4.9/media-vivid-fix-incorrect-assignment-operation-when-.patch
 create mode 100644 queue-4.9/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
 create mode 100644 queue-4.9/mfd-intel-lpss-release-ida-resources.patch
 create mode 100644 queue-4.9/mic-avoid-statically-declaring-a-struct-device.patch
 create mode 100644 queue-4.9/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
 create mode 100644 queue-4.9/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
 create mode 100644 queue-4.9/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
 create mode 100644 queue-4.9/mlxsw-reg-qeec-add-minimum-shaper-fields.patch
 create mode 100644 queue-4.9/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
 create mode 100644 queue-4.9/net-af_iucv-always-register-net_device-notifier.patch
 create mode 100644 queue-4.9/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
 create mode 100644 queue-4.9/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
 create mode 100644 queue-4.9/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
 create mode 100644 queue-4.9/net-ena-fix-free-napi-resources-when-ena_up-fails.patch
 create mode 100644 queue-4.9/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
 create mode 100644 queue-4.9/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
 create mode 100644 queue-4.9/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
 create mode 100644 queue-4.9/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
 create mode 100644 queue-4.9/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
 create mode 100644 queue-4.9/net-neigh-use-long-type-to-store-jiffies-delta.patch
 create mode 100644 queue-4.9/net-netem-correct-the-parent-s-backlog-when-corrupte.patch
 create mode 100644 queue-4.9/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
 create mode 100644 queue-4.9/net-netem-fix-error-path-for-corrupted-gso-frames.patch
 create mode 100644 queue-4.9/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
 create mode 100644 queue-4.9/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
 create mode 100644 queue-4.9/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
 create mode 100644 queue-4.9/net-qca_spi-move-reset_count-to-struct-qcaspi.patch
 create mode 100644 queue-4.9/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
 create mode 100644 queue-4.9/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
 create mode 100644 queue-4.9/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
 create mode 100644 queue-4.9/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
 create mode 100644 queue-4.9/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
 create mode 100644 queue-4.9/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
 create mode 100644 queue-4.9/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
 create mode 100644 queue-4.9/netfilter-ebtables-config_compat-reject-trailing-dat.patch
 create mode 100644 queue-4.9/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
 create mode 100644 queue-4.9/nios2-ksyms-add-missing-symbol-exports.patch
 create mode 100644 queue-4.9/nvme-retain-split-access-workaround-for-capability-r.patch
 create mode 100644 queue-4.9/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
 create mode 100644 queue-4.9/packet-fix-data-race-in-fanout_flow_is_huge.patch
 create mode 100644 queue-4.9/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
 create mode 100644 queue-4.9/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
 create mode 100644 queue-4.9/pcrypt-use-format-specifier-in-kobject_add.patch
 create mode 100644 queue-4.9/perf-ioctl-add-check-for-the-sample_period-value.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
 create mode 100644 queue-4.9/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
 create mode 100644 queue-4.9/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
 create mode 100644 queue-4.9/power-supply-init-device-wakeup-after-device_add.patch
 create mode 100644 queue-4.9/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
 create mode 100644 queue-4.9/powerpc-vdso-make-vdso32-installation-conditional-in.patch
 create mode 100644 queue-4.9/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
 create mode 100644 queue-4.9/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
 create mode 100644 queue-4.9/qed-reduce-maximum-stack-frame-size.patch
 create mode 100644 queue-4.9/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
 create mode 100644 queue-4.9/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
 create mode 100644 queue-4.9/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
 create mode 100644 queue-4.9/regulator-fixed-default-enable-high-on-dt-regulators.patch
 create mode 100644 queue-4.9/regulator-pv88060-fix-array-out-of-bounds-access.patch
 create mode 100644 queue-4.9/regulator-pv88080-fix-array-out-of-bounds-access.patch
 create mode 100644 queue-4.9/regulator-pv88090-fix-array-out-of-bounds-access.patch
 create mode 100644 queue-4.9/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
 create mode 100644 queue-4.9/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
 create mode 100644 queue-4.9/rtc-88pm80x-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.9/rtc-88pm860x-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.9/rtc-cmos-ignore-bogus-century-byte.patch
 create mode 100644 queue-4.9/rtc-ds1672-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.9/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
 create mode 100644 queue-4.9/rtc-pm8xxx-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.9/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
 create mode 100644 queue-4.9/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
 create mode 100644 queue-4.9/scsi-megaraid_sas-reduce-module-load-time.patch
 create mode 100644 queue-4.9/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
 create mode 100644 queue-4.9/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
 create mode 100644 queue-4.9/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
 create mode 100644 queue-4.9/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
 create mode 100644 queue-4.9/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
 create mode 100644 queue-4.9/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
 create mode 100644 queue-4.9/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
 create mode 100644 queue-4.9/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
 create mode 100644 queue-4.9/spi-tegra114-fix-for-unpacked-mode-transfers.patch
 create mode 100644 queue-4.9/staging-comedi-ni_mio_common-protect-register-write-.patch
 create mode 100644 queue-4.9/staging-greybus-light-fix-a-couple-double-frees.patch
 create mode 100644 queue-4.9/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
 create mode 100644 queue-4.9/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
 create mode 100644 queue-4.9/thermal-mediatek-fix-register-index-error.patch
 create mode 100644 queue-4.9/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
 create mode 100644 queue-4.9/tipc-tipc-clang-warning.patch
 create mode 100644 queue-4.9/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
 create mode 100644 queue-4.9/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
 create mode 100644 queue-4.9/usb-host-xhci-hub-fix-extra-endianness-conversion.patch
 create mode 100644 queue-4.9/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
 create mode 100644 queue-4.9/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
 create mode 100644 queue-4.9/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
 create mode 100644 queue-4.9/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
 create mode 100644 queue-4.9/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch

diff --git a/queue-4.9/6lowpan-off-by-one-handling-nexthdr.patch b/queue-4.9/6lowpan-off-by-one-handling-nexthdr.patch
new file mode 100644
index 00000000000..7f163b90af4
--- /dev/null
+++ b/queue-4.9/6lowpan-off-by-one-handling-nexthdr.patch
@@ -0,0 +1,41 @@
+From f25c2f1045b4c55eb6208c812944e2dc1aac6cb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 08:34:16 +0300
+Subject: 6lowpan: Off by one handling ->nexthdr
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]
+
+NEXTHDR_MAX is 255.  What happens here is that we take a u8 value
+"hdr->nexthdr" from the network and then look it up in
+lowpan_nexthdr_nhcs[].  The problem is that if hdr->nexthdr is 0xff then
+we read one element beyond the end of the array so the array needs to
+be one element larger.
+
+Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Acked-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/6lowpan/nhc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
+index 7008d53e455c5..e61679bf09085 100644
+--- a/net/6lowpan/nhc.c
++++ b/net/6lowpan/nhc.c
+@@ -18,7 +18,7 @@
+ #include "nhc.h"
+ 
+ static struct rb_root rb_root = RB_ROOT;
+-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
+ static DEFINE_SPINLOCK(lowpan_nhc_lock);
+ 
+ static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
+-- 
+2.20.1
+
diff --git a/queue-4.9/act_mirred-fix-mirred_init_module-error-handling.patch b/queue-4.9/act_mirred-fix-mirred_init_module-error-handling.patch
new file mode 100644
index 00000000000..b3d858e0d8a
--- /dev/null
+++ b/queue-4.9/act_mirred-fix-mirred_init_module-error-handling.patch
@@ -0,0 +1,40 @@
+From 08bab02fc0b2bbaf9c94def3169a527f57bff73a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 11:10:52 +0800
+Subject: act_mirred: Fix mirred_init_module error handling
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 11c9a7d38af524217efb7a176ad322b97ac2f163 ]
+
+If tcf_register_action failed, mirred_device_notifier
+should be unregistered.
+
+Fixes: 3b87956ea645 ("net sched: fix race in mirred device removal")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_mirred.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index fc3650b061924..9b4c7c42c932d 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -332,7 +332,11 @@ static int __init mirred_init_module(void)
+ 		return err;
+ 
+ 	pr_info("Mirror/redirect action on\n");
+-	return tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++	err = tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++	if (err)
++		unregister_netdevice_notifier(&mirred_device_notifier);
++
++	return err;
+ }
+ 
+ static void __exit mirred_cleanup_module(void)
+-- 
+2.20.1
+
diff --git a/queue-4.9/afs-fix-large-file-support.patch b/queue-4.9/afs-fix-large-file-support.patch
new file mode 100644
index 00000000000..e8114f40c6b
--- /dev/null
+++ b/queue-4.9/afs-fix-large-file-support.patch
@@ -0,0 +1,45 @@
+From 4af2f2051cff6388179fc9fc01a7554bf67e8863 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 15:37:26 +0000
+Subject: afs: Fix large file support
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit b485275f1aca8a9da37fd35e4fad673935e827da ]
+
+By default s_maxbytes is set to MAX_NON_LFS, which limits the usable
+file size to 2GB, enforced by the vfs.
+
+Commit b9b1f8d5930a ("AFS: write support fixes") added support for the
+64-bit fetch and store server operations, but did not change this value.
+As a result, attempts to write past the 2G mark result in EFBIG errors:
+
+ $ dd if=/dev/zero of=foo bs=1M count=1 seek=2048
+ dd: error writing 'foo': File too large
+
+Set s_maxbytes to MAX_LFS_FILESIZE.
+
+Fixes: b9b1f8d5930a ("AFS: write support fixes")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index fbdb022b75a27..65389394e2028 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -317,6 +317,7 @@ static int afs_fill_super(struct super_block *sb,
+ 	/* fill in the superblock */
+ 	sb->s_blocksize		= PAGE_SIZE;
+ 	sb->s_blocksize_bits	= PAGE_SHIFT;
++	sb->s_maxbytes		= MAX_LFS_FILESIZE;
+ 	sb->s_magic		= AFS_FS_MAGIC;
+ 	sb->s_op		= &afs_super_ops;
+ 	sb->s_bdi		= &as->volume->bdi;
+-- 
+2.20.1
+
diff --git a/queue-4.9/ahci-do-not-export-local-variable-ahci_em_messages.patch b/queue-4.9/ahci-do-not-export-local-variable-ahci_em_messages.patch
new file mode 100644
index 00000000000..98486c071c9
--- /dev/null
+++ b/queue-4.9/ahci-do-not-export-local-variable-ahci_em_messages.patch
@@ -0,0 +1,41 @@
+From 64854d3c337339e88321f939b44fb46b42dad49e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 22:42:55 +0300
+Subject: ahci: Do not export local variable ahci_em_messages
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ]
+
+The commit ed08d40cdec4
+  ("ahci: Changing two module params with static and __read_mostly")
+moved ahci_em_messages to be static while missing the fact of exporting it.
+
+WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL
+
+Drop export for the local variable ahci_em_messages.
+
+Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly")
+Cc: Chuansheng Liu <chuansheng.liu@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index f233ce60a6781..1610fff19bb39 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -190,7 +190,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
+ EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
+ 
+ static bool ahci_em_messages __read_mostly = true;
+-EXPORT_SYMBOL_GPL(ahci_em_messages);
+ module_param(ahci_em_messages, bool, 0444);
+ /* add other LED protocol types when they become supported */
+ MODULE_PARM_DESC(ahci_em_messages,
+-- 
+2.20.1
+
diff --git a/queue-4.9/alsa-aoa-onyx-always-initialize-register-read-value.patch b/queue-4.9/alsa-aoa-onyx-always-initialize-register-read-value.patch
new file mode 100644
index 00000000000..601d7e20b7d
--- /dev/null
+++ b/queue-4.9/alsa-aoa-onyx-always-initialize-register-read-value.patch
@@ -0,0 +1,43 @@
+From babe6a25f75a10f6e2c72600014dcdd9a4fd630d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 09:14:22 +0200
+Subject: ALSA: aoa: onyx: always initialize register read value
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ]
+
+A lot of places in the driver use onyx_read_register() without
+checking the return value, and it's been working OK for ~10 years
+or so, so probably never fails ... Rather than trying to check the
+return value everywhere, which would be relatively intrusive, at
+least make sure we don't use an uninitialized value.
+
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/aoa/codecs/onyx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index a04edff8b729e..ae50d59fb810f 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
+ 		return 0;
+ 	}
+ 	v = i2c_smbus_read_byte_data(onyx->i2c, reg);
+-	if (v < 0)
++	if (v < 0) {
++		*value = 0;
+ 		return -1;
++	}
+ 	*value = (u8)v;
+ 	onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.9/alsa-hda-fix-unused-variable-warning.patch b/queue-4.9/alsa-hda-fix-unused-variable-warning.patch
new file mode 100644
index 00000000000..ea287616f83
--- /dev/null
+++ b/queue-4.9/alsa-hda-fix-unused-variable-warning.patch
@@ -0,0 +1,53 @@
+From 570d13aca73f08763ec479ca9213092e41cd0284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 16:18:36 +0200
+Subject: ALSA: hda: fix unused variable warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]
+
+When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
+only returns true.
+
+sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
+sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
+  struct azx *chip = bus_to_azx(bus);
+              ^~~~
+
+Create a inline function of azx_snoop.
+
+Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_controller.h | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index b83feecf1e40c..8f93869982703 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -171,11 +171,10 @@ struct azx {
+ #define azx_bus(chip)	(&(chip)->bus.core)
+ #define bus_to_azx(_bus)	container_of(_bus, struct azx, bus.core)
+ 
+-#ifdef CONFIG_X86
+-#define azx_snoop(chip)		((chip)->snoop)
+-#else
+-#define azx_snoop(chip)		true
+-#endif
++static inline bool azx_snoop(struct azx *chip)
++{
++	return !IS_ENABLED(CONFIG_X86) || chip->snoop;
++}
+ 
+ /*
+  * macros for easy use
+-- 
+2.20.1
+
diff --git a/queue-4.9/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch b/queue-4.9/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
new file mode 100644
index 00000000000..420bbd35a2d
--- /dev/null
+++ b/queue-4.9/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
@@ -0,0 +1,39 @@
+From 2a48f4e46f9636c422c11bf150e2cd62d5fc89f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: ALSA: usb-audio: Handle the error from
+ snd_usb_mixer_apply_create_quirk()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error.  Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 64fa1bbf0acb3..54011f8543a72 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2626,7 +2626,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ 	    (err = snd_usb_mixer_status_create(mixer)) < 0)
+ 		goto _error;
+ 
+-	snd_usb_mixer_apply_create_quirk(mixer);
++	err = snd_usb_mixer_apply_create_quirk(mixer);
++	if (err < 0)
++		goto _error;
+ 
+ 	err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ 	if (err < 0)
+-- 
+2.20.1
+
diff --git a/queue-4.9/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch b/queue-4.9/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
new file mode 100644
index 00000000000..d8183b9c01a
--- /dev/null
+++ b/queue-4.9/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
@@ -0,0 +1,64 @@
+From 5bd74e6fdb22e8497908f0fd576b62a43302a8bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 16:42:05 +0200
+Subject: ALSA: usb-audio: update quirk for B&W PX to remove microphone
+
+From: Nicolas Huaman <nicolas@herochao.de>
+
+[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]
+
+A quirk in snd-usb-audio was added to automate setting sample rate to
+4800k and remove the previously exposed nonfunctional microphone for
+the Bowers & Wilkins PX:
+commit 240a8af929c7c57dcde28682725b29cf8474e8e5
+https://lore.kernel.org/patchwork/patch/919689/
+
+However the headphones where updated shortly after that to remove the
+unintentional microphone functionality. I guess because of this the
+headphones now crash when connecting them via USB while the quirk is
+active. Dmesg:
+
+snd-usb-audio: probe of 2-3:1.0 failed with error -22
+usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)
+
+This patch removes the microfone and allows the headphones to connect
+and work out of the box. It is based on the current mainline kernel
+ and successfully applied an tested on my machine (4.18.10.arch1-1).
+
+Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
+Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks-table.h | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index d32727c74a168..c892b4d1e733f 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ 				.ifnum = 0,
+ 				.type = QUIRK_AUDIO_STANDARD_MIXER,
+ 			},
+-			/* Capture */
+-			{
+-				.ifnum = 1,
+-				.type = QUIRK_IGNORE_INTERFACE,
+-			},
+ 			/* Playback */
+ 			{
+-				.ifnum = 2,
++				.ifnum = 1,
+ 				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+ 				.data = &(const struct audioformat) {
+ 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
+ 					.channels = 2,
+-					.iface = 2,
++					.iface = 1,
+ 					.altsetting = 1,
+ 					.altset_idx = 1,
+ 					.attributes = UAC_EP_CS_ATTR_FILL_MAX |
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch b/queue-4.9/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
new file mode 100644
index 00000000000..4d87c9936aa
--- /dev/null
+++ b/queue-4.9/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
@@ -0,0 +1,97 @@
+From 9b3d61d0876d7fba43cf885c151d9b7dc81e2778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 09:31:41 +0100
+Subject: ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]
+
+MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
+perform low-level platform initialization. This results in a try to install
+HYP stubs for the second time for each CPU and results in false HYP/SVC
+mode mismatch detection. The HYP stubs are already installed at the
+beginning of the kernel initialization on the boot CPU (head.S) or in the
+secondary_startup() for other CPUs. To fix this issue MCPM code should use
+a cpu_resume() routine without HYP stubs installation.
+
+This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
+XU3/XU4/HC1 boards.
+
+Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Tested-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/common/mcpm_entry.c   |  2 +-
+ arch/arm/include/asm/suspend.h |  1 +
+ arch/arm/kernel/sleep.S        | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
+index a923524d10407..8617323eb2735 100644
+--- a/arch/arm/common/mcpm_entry.c
++++ b/arch/arm/common/mcpm_entry.c
+@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg)
+ 	unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+ 	phys_reset_t phys_reset;
+ 
+-	mcpm_set_entry_vector(cpu, cluster, cpu_resume);
++	mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
+ 	setup_mm_for_reboot();
+ 
+ 	__mcpm_cpu_going_down(cpu, cluster);
+diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
+index 6c7182f32cefe..e6c2f426f8c86 100644
+--- a/arch/arm/include/asm/suspend.h
++++ b/arch/arm/include/asm/suspend.h
+@@ -7,6 +7,7 @@ struct sleep_save_sp {
+ };
+ 
+ extern void cpu_resume(void);
++extern void cpu_resume_no_hyp(void);
+ extern void cpu_resume_arm(void);
+ extern int cpu_suspend(unsigned long, int (*)(unsigned long));
+ 
+diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
+index 0f6c1000582c3..c8569390e7e7e 100644
+--- a/arch/arm/kernel/sleep.S
++++ b/arch/arm/kernel/sleep.S
+@@ -119,6 +119,14 @@ ENDPROC(cpu_resume_after_mmu)
+ 	.text
+ 	.align
+ 
++#ifdef CONFIG_MCPM
++	.arm
++THUMB(	.thumb			)
++ENTRY(cpu_resume_no_hyp)
++ARM_BE8(setend be)			@ ensure we are in BE mode
++	b	no_hyp
++#endif
++
+ #ifdef CONFIG_MMU
+ 	.arm
+ ENTRY(cpu_resume_arm)
+@@ -134,6 +142,7 @@ ARM_BE8(setend be)			@ ensure we are in BE mode
+ 	bl	__hyp_stub_install_secondary
+ #endif
+ 	safe_svcmode_maskall r1
++no_hyp:
+ 	mov	r1, #0
+ 	ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
+ 	ALT_UP_B(1f)
+@@ -162,6 +171,9 @@ ENDPROC(cpu_resume)
+ 
+ #ifdef CONFIG_MMU
+ ENDPROC(cpu_resume_arm)
++#endif
++#ifdef CONFIG_MCPM
++ENDPROC(cpu_resume_no_hyp)
+ #endif
+ 
+ 	.align 2
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch b/queue-4.9/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
new file mode 100644
index 00000000000..7a95fdb1f4d
--- /dev/null
+++ b/queue-4.9/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
@@ -0,0 +1,40 @@
+From 7798e7e44750e1c36d786e0fd0e909308b105eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 15:00:13 +0100
+Subject: ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ]
+
+arm64 has got relaxation on GIC version check at early boot stage due
+to update of the GIC architecture let's align ARM with that.
+
+To help backports (even though the code was correct at the time of writing)
+Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/hyp-stub.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index 15d073ae5da2a..f5e5e3e196592 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -179,8 +179,8 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
+ 	@ Check whether GICv3 system registers are available
+ 	mrc	p15, 0, r7, c0, c1, 1	@ ID_PFR1
+ 	ubfx	r7, r7, #28, #4
+-	cmp	r7, #1
+-	bne	2f
++	teq	r7, #0
++	beq	2f
+ 
+ 	@ Enable system register accesses
+ 	mrc	p15, 4, r7, c12, c9, 5	@ ICC_HSRE
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch b/queue-4.9/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
new file mode 100644
index 00000000000..3ec5f3e2eb1
--- /dev/null
+++ b/queue-4.9/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
@@ -0,0 +1,38 @@
+From 0110d15936c06cc11a62f6fc117a825e9040d4a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 16:29:20 +0200
+Subject: ARM: dts: lpc32xx: add required clocks property to keypad device node
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ]
+
+NXP LPC32xx keypad controller requires a clock property to be defined.
+
+The change fixes the driver initialization problem:
+
+  lpc32xx_keys 40050000.key: failed to get clock
+  lpc32xx_keys: probe of 40050000.key failed with error -2
+
+Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 5fa3111731cb0..da375813afd04 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -462,6 +462,7 @@
+ 			key: key@40050000 {
+ 				compatible = "nxp,lpc3220-key";
+ 				reg = <0x40050000 0x1000>;
++				clocks = <&clk LPC32XX_CLK_KEY>;
+ 				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
+ 				status = "disabled";
+ 			};
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch b/queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
new file mode 100644
index 00000000000..5d08b804758
--- /dev/null
+++ b/queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
@@ -0,0 +1,38 @@
+From 0ac8319524c16852fca93aee6e45a79ccc27c30c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:40 +0200
+Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ]
+
+The originally added ARM PrimeCell PL111 clocks property misses
+the required "clcdclk" clock, which is the same as a clock to enable
+the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs.
+
+Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 3adbbaff79715..2802c9565b6ca 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -142,8 +142,8 @@
+ 			compatible = "arm,pl111", "arm,primecell";
+ 			reg = <0x31040000 0x1000>;
+ 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&clk LPC32XX_CLK_LCD>;
+-			clock-names = "apb_pclk";
++			clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
++			clock-names = "clcdclk", "apb_pclk";
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch b/queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
new file mode 100644
index 00000000000..e0e2c65229a
--- /dev/null
+++ b/queue-4.9/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
@@ -0,0 +1,36 @@
+From 08a9f133eb71aeeff06289d57390cfe1878b6c6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:39 +0200
+Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ]
+
+ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230
+and LPC3250 SoCs variants, the original reference in compatible
+property to an older one ARM PrimeCell PL110 is invalid.
+
+Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 6bd196457ccc2..3adbbaff79715 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -139,7 +139,7 @@
+ 		};
+ 
+ 		clcd: clcd@31040000 {
+-			compatible = "arm,pl110", "arm,primecell";
++			compatible = "arm,pl111", "arm,primecell";
+ 			reg = <0x31040000 0x1000>;
+ 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&clk LPC32XX_CLK_LCD>;
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch b/queue-4.9/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
new file mode 100644
index 00000000000..35f0c28f2ab
--- /dev/null
+++ b/queue-4.9/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
@@ -0,0 +1,39 @@
+From b64154f4737efba590593e69be965c4af6243e6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:41 +0200
+Subject: ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ]
+
+The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which
+supplies SD/MMC card's power, has a constant output voltage level
+of either 3.15V or 3.3V, the actual value depends on JP4 position,
+the power rail is referenced as VCC_SDIO in the board hardware manual.
+
+Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
+index b7bd3a110a8dd..dd0bdf765599d 100644
+--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
+@@ -49,8 +49,8 @@
+ 		sd_reg: regulator@2 {
+ 			compatible = "regulator-fixed";
+ 			regulator-name = "sd_reg";
+-			regulator-min-microvolt = <1800000>;
+-			regulator-max-microvolt = <1800000>;
++			regulator-min-microvolt = <3300000>;
++			regulator-max-microvolt = <3300000>;
+ 			gpio = <&gpio 5 5 0>;
+ 			enable-active-high;
+ 		};
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch b/queue-4.9/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
new file mode 100644
index 00000000000..b7b8b10c0f5
--- /dev/null
+++ b/queue-4.9/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
@@ -0,0 +1,43 @@
+From 0b3e62af6aff92abd8765654750b3f1541a054d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 16:29:21 +0200
+Subject: ARM: dts: lpc32xx: reparent keypad controller to SIC1
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ]
+
+After switching to a new interrupt controller scheme by separating SIC1
+and SIC2 from MIC interrupt controller just one SoC keypad controller
+was not taken into account, fix it now:
+
+  WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0
+  error: hwirq 0x36 is too large for interrupt-controller@40008000
+  ...
+  lpc32xx_keys 40050000.key: failed to get platform irq
+  lpc32xx_keys: probe of 40050000.key failed with error -22
+
+Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index da375813afd04..6bd196457ccc2 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -463,7 +463,8 @@
+ 				compatible = "nxp,lpc3220-key";
+ 				reg = <0x40050000 0x1000>;
+ 				clocks = <&clk LPC32XX_CLK_KEY>;
+-				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-parent = <&sic1>;
++				interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
+ 				status = "disabled";
+ 			};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch b/queue-4.9/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
new file mode 100644
index 00000000000..9558bbed092
--- /dev/null
+++ b/queue-4.9/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
@@ -0,0 +1,95 @@
+From a8c41b30d3f269f8bb2a148bd8cd848a871ba164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2019 02:23:14 +0300
+Subject: ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY
+ disconnect
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]
+
+Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
+But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
+are pointing towards the same internal PCS. Therefore nobody is
+controlling the internal PCS of eTSEC0.
+
+Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
+initialization. But upon an ifdown/ifup sequence, the code path from
+ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
+the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
+link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
+failure condition, the PHY driver keeps printing
+'803x_aneg_done: SGMII link is not ok'.
+
+Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
+mdio1 device.
+
+Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a-twr.dts |  9 ++++++++-
+ arch/arm/boot/dts/ls1021a.dtsi    | 11 ++++++++++-
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
+index 44715c8ef756b..72a3fc63d0ece 100644
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -143,7 +143,7 @@
+ };
+ 
+ &enet0 {
+-	tbi-handle = <&tbi1>;
++	tbi-handle = <&tbi0>;
+ 	phy-handle = <&sgmii_phy2>;
+ 	phy-connection-type = "sgmii";
+ 	status = "okay";
+@@ -222,6 +222,13 @@
+ 	sgmii_phy2: ethernet-phy@2 {
+ 		reg = <0x2>;
+ 	};
++	tbi0: tbi-phy@1f {
++		reg = <0x1f>;
++		device_type = "tbi-phy";
++	};
++};
++
++&mdio1 {
+ 	tbi1: tbi-phy@1f {
+ 		reg = <0x1f>;
+ 		device_type = "tbi-phy";
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 825f6eae3d1c1..27133c3a4b122 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -505,13 +505,22 @@
+ 		};
+ 
+ 		mdio0: mdio@2d24000 {
+-			compatible = "gianfar";
++			compatible = "fsl,etsec2-mdio";
+ 			device_type = "mdio";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			reg = <0x0 0x2d24000 0x0 0x4000>;
+ 		};
+ 
++		mdio1: mdio@2d64000 {
++			compatible = "fsl,etsec2-mdio";
++			device_type = "mdio";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			reg = <0x0 0x2d64000 0x0 0x4000>,
++			      <0x0 0x2d50030 0x0 0x4>;
++		};
++
+ 		ptp_clock@2d10e00 {
+ 			compatible = "fsl,etsec-ptp";
+ 			reg = <0x0 0x2d10e00 0x0 0xb0>;
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-omap2-fix-potentially-uninitialized-return-value.patch b/queue-4.9/arm-omap2-fix-potentially-uninitialized-return-value.patch
new file mode 100644
index 00000000000..548dc734af6
--- /dev/null
+++ b/queue-4.9/arm-omap2-fix-potentially-uninitialized-return-value.patch
@@ -0,0 +1,44 @@
+From a51865bb248ebdbba3cfcfeba0ca28f667c86451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2019 11:00:21 -0700
+Subject: ARM: OMAP2+: Fix potentially uninitialized return value for
+ _setup_reset()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]
+
+Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
+the call to _enable() conditional based on no oh->rst_lines_cnt. This
+caused the return value to be potentially uninitialized. Curiously we see
+no compiler warnings for this, probably as this gets inlined.
+
+We call _setup_reset() from _setup() and only _setup_postsetup() if the
+return value is zero. Currently the return value can be uninitialized for
+cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.
+
+Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index bfc74954540ce..9421b78f869d3 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2588,7 +2588,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
+  */
+ static int _setup_reset(struct omap_hwmod *oh)
+ {
+-	int r;
++	int r = 0;
+ 
+ 	if (oh->_state != _HWMOD_STATE_INITIALIZED)
+ 		return -EINVAL;
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch b/queue-4.9/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
new file mode 100644
index 00000000000..d475b3edd98
--- /dev/null
+++ b/queue-4.9/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
@@ -0,0 +1,47 @@
+From a9081a75df128dcecc82e1974ce071189c64654f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 16:03:24 +0800
+Subject: ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]
+
+Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+kfree, iounmap, clk_put etc are not needed anymore in remove path.
+
+Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+[ commit message spelling fix ]
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/plat-pxa/ssp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
+index b92673efffffb..97bd43c16cd87 100644
+--- a/arch/arm/plat-pxa/ssp.c
++++ b/arch/arm/plat-pxa/ssp.c
+@@ -230,18 +230,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
+ 
+ static int pxa_ssp_remove(struct platform_device *pdev)
+ {
+-	struct resource *res;
+ 	struct ssp_device *ssp;
+ 
+ 	ssp = platform_get_drvdata(pdev);
+ 	if (ssp == NULL)
+ 		return -ENODEV;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	release_mem_region(res->start, resource_size(res));
+-
+-	clk_put(ssp->clk);
+-
+ 	mutex_lock(&ssp_lock);
+ 	list_del(&ssp->node);
+ 	mutex_unlock(&ssp_lock);
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch b/queue-4.9/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
new file mode 100644
index 00000000000..cd9aa62ed46
--- /dev/null
+++ b/queue-4.9/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
@@ -0,0 +1,42 @@
+From d3786704c31ffc289ba20676d5f925d941d15c7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Apr 2019 22:43:49 +0100
+Subject: ARM: riscpc: fix lack of keyboard interrupts after irq conversion
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]
+
+Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.
+
+Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-rpc/irq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
+index 66502e6207fea..fce7fecbd8fa4 100644
+--- a/arch/arm/mach-rpc/irq.c
++++ b/arch/arm/mach-rpc/irq.c
+@@ -117,7 +117,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
+ 
+ void __init rpc_init_irq(void)
+ {
+-	unsigned int irq, clr, set = 0;
++	unsigned int irq, clr, set;
+ 
+ 	iomd_writeb(0, IOMD_IRQMASKA);
+ 	iomd_writeb(0, IOMD_IRQMASKB);
+@@ -129,6 +129,7 @@ void __init rpc_init_irq(void)
+ 
+ 	for (irq = 0; irq < NR_IRQS; irq++) {
+ 		clr = IRQ_NOREQUEST;
++		set = 0;
+ 
+ 		if (irq <= 6 || (irq >= 9 && irq <= 15))
+ 			clr |= IRQ_NOPROBE;
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch b/queue-4.9/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
new file mode 100644
index 00000000000..6b4504d0b0e
--- /dev/null
+++ b/queue-4.9/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
@@ -0,0 +1,42 @@
+From 15bf2960196fd0edf1d0a2d6657235ace491b079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:01:02 +0100
+Subject: arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ]
+
+In the same way as for msm8974-hammerhead, l11 load, used for SDCARD
+VMMC, needs to be increased in order to prevent any voltage drop issues
+(due to limited current) happening with some SDCARDS or during specific
+operations (e.g. write).
+
+Tested on Dragonboard-410c and DART-SD410 boards.
+
+Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support)
+Reported-by: Manabu Igusa <migusa@arrowjapan.com>
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+index 601be6127628a..948efff7d830c 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -355,6 +355,8 @@
+ 	l11 {
+ 		regulator-min-microvolt = <1750000>;
+ 		regulator-max-microvolt = <3337000>;
++		regulator-allow-set-load;
++		regulator-system-load = <200000>;
+ 	};
+ 
+ 	l12 {
+-- 
+2.20.1
+
diff --git a/queue-4.9/arm64-dts-juno-fix-uart-frequency.patch b/queue-4.9/arm64-dts-juno-fix-uart-frequency.patch
new file mode 100644
index 00000000000..a6955d88837
--- /dev/null
+++ b/queue-4.9/arm64-dts-juno-fix-uart-frequency.patch
@@ -0,0 +1,54 @@
+From 120fd25660ee5c5272e2b920fd71b10c434c7e40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 12:03:31 +0000
+Subject: arm64: dts: juno: Fix UART frequency
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ]
+
+Older versions of the Juno *SoC* TRM [1] recommended that the UART clock
+source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more
+correct value of 7.3728 MHz. Somehow the wrong value managed to end up in
+our DT.
+
+Doing a prime factorisation, a modulo divide by 115200 and trying
+to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest
+that the old value was actually a typo. The actual UART clock is driven
+by a PLL, configured via a parameter in some board.txt file in the
+firmware, which reads 7.37 MHz (sic!).
+
+Fix this to correct the baud rate divisor calculation on the Juno board.
+
+[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf
+[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf
+
+Fixes: 71f867ec130e ("arm64: Add Juno board device tree.")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+index 25352ed943e6e..00bcbf7688c77 100644
+--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+@@ -8,10 +8,10 @@
+  */
+ 
+ 	/* SoC fixed clocks */
+-	soc_uartclk: refclk7273800hz {
++	soc_uartclk: refclk7372800hz {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
+-		clock-frequency = <7273800>;
++		clock-frequency = <7372800>;
+ 		clock-output-names = "juno:uartclk";
+ 	};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch b/queue-4.9/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
new file mode 100644
index 00000000000..94cc32751c1
--- /dev/null
+++ b/queue-4.9/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
@@ -0,0 +1,40 @@
+From c0387c39118d836e26b409d679891c90486131a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:01:57 +0800
+Subject: ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ]
+
+sound/soc/codecs/cs4349.c:358:32: warning:
+ cs4349_runtime_pm defined but not used [-Wunused-const-variable=]
+
+cs4349_runtime_pm ops already defined, it seems
+we should enable it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4349.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
+index 231ca935cdf3b..c232c42ccead0 100644
+--- a/sound/soc/codecs/cs4349.c
++++ b/sound/soc/codecs/cs4349.c
+@@ -380,6 +380,7 @@ static struct i2c_driver cs4349_i2c_driver = {
+ 	.driver = {
+ 		.name		= "cs4349",
+ 		.of_match_table	= cs4349_of_match,
++		.pm = &cs4349_runtime_pm,
+ 	},
+ 	.id_table	= cs4349_i2c_id,
+ 	.probe		= cs4349_i2c_probe,
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch b/queue-4.9/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
new file mode 100644
index 00000000000..4d364228494
--- /dev/null
+++ b/queue-4.9/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
@@ -0,0 +1,37 @@
+From d1bdaa5a4cd63eaaf928645511628b5dc51c71b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:23:00 +0800
+Subject: ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ]
+
+It seems 'es8328_rline_enum' should be used
+in es8328_right_line_controls
+
+Fixes: 567e4f98922c ("ASoC: add es8328 codec driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index 37722194b107e..6b22700842e26 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -234,7 +234,7 @@ static const struct soc_enum es8328_rline_enum =
+ 			      ARRAY_SIZE(es8328_line_texts),
+ 			      es8328_line_texts);
+ static const struct snd_kcontrol_new es8328_right_line_controls =
+-	SOC_DAPM_ENUM("Route", es8328_lline_enum);
++	SOC_DAPM_ENUM("Route", es8328_rline_enum);
+ 
+ /* Left Mixer */
+ static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-fix-valid-stream-condition.patch b/queue-4.9/asoc-fix-valid-stream-condition.patch
new file mode 100644
index 00000000000..815ebd1b288
--- /dev/null
+++ b/queue-4.9/asoc-fix-valid-stream-condition.patch
@@ -0,0 +1,40 @@
+From 018c3e5f59bfd50edf469b6e47c420ef9f35b4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: ASoC: fix valid stream condition
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index d69559e458725..635b22fa1101a 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ 	else
+ 		codec_stream = &dai->driver->capture;
+ 
+-	/* If the codec specifies any rate at all, it supports the stream. */
+-	return codec_stream->rates;
++	/* If the codec specifies any channels at all, it supports the stream */
++	return codec_stream->channels_min;
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch b/queue-4.9/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
new file mode 100644
index 00000000000..25433a2a6fb
--- /dev/null
+++ b/queue-4.9/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
@@ -0,0 +1,40 @@
+From dd2fd640f179f5f85c7b3dadbb4effca34db9de4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jan 2019 10:06:52 +0100
+Subject: ASoC: imx-sgtl5000: put of nodes if finding codec fails
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]
+
+Make sure to properly put the of node in case finding the codec
+fails.
+
+Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-sgtl5000.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
+index 8e525f7ac08d1..3d99a8579c99f 100644
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
+ 	codec_dev = of_find_i2c_device_by_node(codec_np);
+ 	if (!codec_dev) {
+ 		dev_err(&pdev->dev, "failed to find codec platform device\n");
+-		return -EPROBE_DEFER;
++		ret = -EPROBE_DEFER;
++		goto fail;
+ 	}
+ 
+ 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch b/queue-4.9/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
new file mode 100644
index 00000000000..ed6d5baff93
--- /dev/null
+++ b/queue-4.9/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
@@ -0,0 +1,90 @@
+From 0f7c11ad0d275337ef8c188b7d8757801a905173 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 16:46:50 +0100
+Subject: ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]
+
+The apq8016 driver leaves the of-node refcount at aborting from the
+loop of for_each_child_of_node() in the error path.  Not only the
+iterator node of for_each_child_of_node(), the children nodes referred
+from it for codec and cpu have to be properly unreferenced.
+
+Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
+Cc: Patrick Lai <plai@codeaurora.org>
+Cc: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
+index 07f91e918b234..754742018515a 100644
+--- a/sound/soc/qcom/apq8016_sbc.c
++++ b/sound/soc/qcom/apq8016_sbc.c
+@@ -114,13 +114,15 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+ 
+ 		if (!cpu || !codec) {
+ 			dev_err(dev, "Can't find cpu/codec DT node\n");
+-			return ERR_PTR(-EINVAL);
++			ret = -EINVAL;
++			goto error;
+ 		}
+ 
+ 		link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+ 		if (!link->cpu_of_node) {
+ 			dev_err(card->dev, "error getting cpu phandle\n");
+-			return ERR_PTR(-EINVAL);
++			ret = -EINVAL;
++			goto error;
+ 		}
+ 
+ 		link->codec_of_node = of_parse_phandle(codec, "sound-dai", 0);
+@@ -132,28 +134,37 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+ 		ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
+ 		if (ret) {
+ 			dev_err(card->dev, "error getting cpu dai name\n");
+-			return ERR_PTR(ret);
++			goto error;
+ 		}
+ 
+ 		ret = snd_soc_of_get_dai_name(codec, &link->codec_dai_name);
+ 		if (ret) {
+ 			dev_err(card->dev, "error getting codec dai name\n");
+-			return ERR_PTR(ret);
++			goto error;
+ 		}
+ 
+ 		link->platform_of_node = link->cpu_of_node;
+ 		ret = of_property_read_string(np, "link-name", &link->name);
+ 		if (ret) {
+ 			dev_err(card->dev, "error getting codec dai_link name\n");
+-			return ERR_PTR(ret);
++			goto error;
+ 		}
+ 
+ 		link->stream_name = link->name;
+ 		link->init = apq8016_sbc_dai_init;
+ 		link++;
++
++		of_node_put(cpu);
++		of_node_put(codec);
+ 	}
+ 
+ 	return data;
++
++ error:
++	of_node_put(np);
++	of_node_put(cpu);
++	of_node_put(codec);
++	return ERR_PTR(ret);
+ }
+ 
+ static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch b/queue-4.9/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
new file mode 100644
index 00000000000..dcfbb9489ce
--- /dev/null
+++ b/queue-4.9/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
@@ -0,0 +1,38 @@
+From 0dc6cb907fac664287e5afc6647a4f9e7cfa0eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 21:25:17 +0200
+Subject: ASoC: sun4i-i2s: RX and TX counter registers are swapped
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit cf2c0e1ce9544df42170fb921f12da82dc0cc8d6 ]
+
+The RX and TX counters registers offset have been swapped, fix that.
+
+Fixes: fa7c0d13cb26 ("ASoC: sunxi: Add Allwinner A10 Digital Audio driver")
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://lore.kernel.org/r/8b26477560ad5fd8f69e037b167c5e61de5c26a3.1566242458.git-series.maxime.ripard@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index 15c92400cea42..02c373c65e194 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -78,8 +78,8 @@
+ #define SUN4I_I2S_CLK_DIV_MCLK_MASK		GENMASK(3, 0)
+ #define SUN4I_I2S_CLK_DIV_MCLK(mclk)			((mclk) << 0)
+ 
+-#define SUN4I_I2S_RX_CNT_REG		0x28
+-#define SUN4I_I2S_TX_CNT_REG		0x2c
++#define SUN4I_I2S_TX_CNT_REG		0x28
++#define SUN4I_I2S_RX_CNT_REG		0x2c
+ 
+ #define SUN4I_I2S_TX_CHAN_SEL_REG	0x30
+ #define SUN4I_I2S_TX_CHAN_SEL(num_chan)		(((num_chan) - 1) << 0)
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch b/queue-4.9/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
new file mode 100644
index 00000000000..e15a1676de8
--- /dev/null
+++ b/queue-4.9/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
@@ -0,0 +1,51 @@
+From e384f76bc3517a7d8cd99e5a3cdcd3a1acf8756f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jun 2019 12:20:02 +0300
+Subject: ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple
+ AXRs
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ]
+
+If multiple serializers are connected in the system and the number of
+channels will need to use more than one serializer the mask to enable the
+serializers were left to 0 if tdm_mask is provided
+
+Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support")
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/davinci/davinci-mcasp.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 624c209c94981..d1935c5c3602b 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -882,14 +882,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
+ 		active_slots = hweight32(mcasp->tdm_mask[stream]);
+ 		active_serializers = (channels + active_slots - 1) /
+ 			active_slots;
+-		if (active_serializers == 1) {
++		if (active_serializers == 1)
+ 			active_slots = channels;
+-			for (i = 0; i < total_slots; i++) {
+-				if ((1 << i) & mcasp->tdm_mask[stream]) {
+-					mask |= (1 << i);
+-					if (--active_slots <= 0)
+-						break;
+-				}
++		for (i = 0; i < total_slots; i++) {
++			if ((1 << i) & mcasp->tdm_mask[stream]) {
++				mask |= (1 << i);
++				if (--active_slots <= 0)
++					break;
+ 			}
+ 		}
+ 	} else {
+-- 
+2.20.1
+
diff --git a/queue-4.9/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch b/queue-4.9/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
new file mode 100644
index 00000000000..cd057f1bba0
--- /dev/null
+++ b/queue-4.9/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
@@ -0,0 +1,41 @@
+From 8ec9e308626589f2dafd84bd2e3e5ba52f42cbf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:19:20 +0800
+Subject: ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ]
+
+sound/soc/codecs/wm8737.c:112:29: warning:
+ high_3d defined but not used [-Wunused-const-variable=]
+
+'high_3d' should be used for 3D High Cut-off.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8737.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index f0cb1c4afe3ce..c5a8d758f58b8 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
+ SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
+ SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
+ SOC_ENUM("3D Low Cut-off", low_3d),
+-SOC_ENUM("3D High Cut-off", low_3d),
++SOC_ENUM("3D High Cut-off", high_3d),
+ SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
+ 
+ SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
+-- 
+2.20.1
+
diff --git a/queue-4.9/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch b/queue-4.9/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
new file mode 100644
index 00000000000..7e334462549
--- /dev/null
+++ b/queue-4.9/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
@@ -0,0 +1,136 @@
+From d9af05a8b00d038f6279690d0207279a6f0bf85c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 09:41:39 +0200
+Subject: ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ]
+
+Fix following lockdep warning disabling bh in
+ath_dynack_node_init/ath_dynack_node_deinit
+
+[   75.955878] --------------------------------
+[   75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
+[   75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
+[   75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.955905] {SOFTIRQ-ON-W} state was registered at:
+[   75.955912]   lock_acquire+0x9a/0x160
+[   75.955917]   _raw_spin_lock+0x2c/0x70
+[   75.955927]   ath_dynack_node_init+0x2a/0x60 [ath9k_hw]
+[   75.955934]   ath9k_sta_state+0xec/0x160 [ath9k]
+[   75.955976]   drv_sta_state+0xb2/0x740 [mac80211]
+[   75.956008]   sta_info_insert_finish+0x21a/0x420 [mac80211]
+[   75.956039]   sta_info_insert_rcu+0x12b/0x2c0 [mac80211]
+[   75.956069]   sta_info_insert+0x7/0x70 [mac80211]
+[   75.956093]   ieee80211_prep_connection+0x42e/0x730 [mac80211]
+[   75.956120]   ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211]
+[   75.956152]   cfg80211_mlme_auth+0x143/0x350 [cfg80211]
+[   75.956169]   nl80211_authenticate+0x25e/0x2b0 [cfg80211]
+[   75.956172]   genl_family_rcv_msg+0x198/0x400
+[   75.956174]   genl_rcv_msg+0x42/0x90
+[   75.956176]   netlink_rcv_skb+0x35/0xf0
+[   75.956178]   genl_rcv+0x1f/0x30
+[   75.956180]   netlink_unicast+0x154/0x200
+[   75.956182]   netlink_sendmsg+0x1bf/0x3d0
+[   75.956186]   ___sys_sendmsg+0x2c2/0x2f0
+[   75.956187]   __sys_sendmsg+0x44/0x80
+[   75.956190]   do_syscall_64+0x55/0x1a0
+[   75.956192]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[   75.956194] irq event stamp: 2357092
+[   75.956196] hardirqs last  enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50
+[   75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80
+[   75.956202] softirqs last  enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60
+[   75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0
+[   75.956206]
+               other info that might help us debug this:
+[   75.956207]  Possible unsafe locking scenario:
+
+[   75.956208]        CPU0
+[   75.956209]        ----
+[   75.956210]   lock(&(&da->qlock)->rlock);
+[   75.956213]   <Interrupt>
+[   75.956214]     lock(&(&da->qlock)->rlock);
+[   75.956216]
+                *** DEADLOCK ***
+
+[   75.956217] 1 lock held by swapper/0/0:
+[   75.956219]  #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k]
+[   75.956225]
+               stack backtrace:
+[   75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13
+[   75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
+[   75.956231] Call Trace:
+[   75.956233]  <IRQ>
+[   75.956236]  dump_stack+0x67/0x90
+[   75.956239]  mark_lock+0x4c1/0x640
+[   75.956242]  ? check_usage_backwards+0x130/0x130
+[   75.956245]  ? sched_clock_local+0x12/0x80
+[   75.956247]  __lock_acquire+0x484/0x7a0
+[   75.956250]  ? __lock_acquire+0x3b9/0x7a0
+[   75.956252]  lock_acquire+0x9a/0x160
+[   75.956259]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.956262]  _raw_spin_lock_bh+0x34/0x80
+[   75.956268]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.956275]  ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.956280]  ath_rx_tasklet+0xd09/0xe90 [ath9k]
+[   75.956286]  ath9k_tasklet+0x102/0x240 [ath9k]
+[   75.956288]  tasklet_action_common.isra.0+0x6d/0x170
+[   75.956291]  __do_softirq+0xcc/0x425
+[   75.956294]  irq_exit+0xae/0xc0
+[   75.956296]  do_IRQ+0x8a/0x110
+[   75.956298]  common_interrupt+0xf/0xf
+[   75.956300]  </IRQ>
+[   75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400
+[   75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7
+[   75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000
+[   75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800
+[   75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000
+[   75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
+[   75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800
+[   75.956321]  cpuidle_enter+0x24/0x40
+[   75.956323]  do_idle+0x1ac/0x220
+[   75.956326]  cpu_startup_entry+0x14/0x20
+[   75.956329]  start_kernel+0x482/0x489
+[   75.956332]  secondary_startup_64+0xa4/0xb0
+
+Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
+index 6e236a4854311..71b4888b30e71 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
+ 
+ 	an->ackto = ackto;
+ 
+-	spin_lock(&da->qlock);
++	spin_lock_bh(&da->qlock);
+ 	list_add_tail(&an->list, &da->nodes);
+-	spin_unlock(&da->qlock);
++	spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_init);
+ 
+@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
+ {
+ 	struct ath_dynack *da = &ah->dynack;
+ 
+-	spin_lock(&da->qlock);
++	spin_lock_bh(&da->qlock);
+ 	list_del(&an->list);
+-	spin_unlock(&da->qlock);
++	spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_deinit);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/backlight-lm3630a-return-0-on-success-in-update_stat.patch b/queue-4.9/backlight-lm3630a-return-0-on-success-in-update_stat.patch
new file mode 100644
index 00000000000..c285e3a3ceb
--- /dev/null
+++ b/queue-4.9/backlight-lm3630a-return-0-on-success-in-update_stat.patch
@@ -0,0 +1,50 @@
+From 1cb844887b07a9581f107446fc0af04479442ece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:25:03 -0400
+Subject: backlight: lm3630a: Return 0 on success in update_status functions
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]
+
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
+both return the brightness value if the brightness was successfully
+updated. Writing to these attributes via sysfs would cause a 'Bad
+address' error to be returned. These functions should return 0 on
+success, so let's change it to correct that error.
+
+Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 60d6c2ac87aa5..1771220b2437f 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -200,7 +200,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ 				      LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ 	if (ret < 0)
+ 		goto out_i2c_err;
+-	return bl->props.brightness;
++	return 0;
+ 
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access\n");
+@@ -277,7 +277,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ 				      LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ 	if (ret < 0)
+ 		goto out_i2c_err;
+-	return bl->props.brightness;
++	return 0;
+ 
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+-- 
+2.20.1
+
diff --git a/queue-4.9/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch b/queue-4.9/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
new file mode 100644
index 00000000000..1424a8c2d15
--- /dev/null
+++ b/queue-4.9/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
@@ -0,0 +1,48 @@
+From 64947c92a67b24d4cd1d67d0963675196219f976 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 09:16:20 +0100
+Subject: bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ]
+
+An earlier commit re-worked the setting of the bitmask and is now
+assigning v with some bit flags rather than bitwise or-ing them
+into v, consequently the earlier bit-settings of v are being lost.
+Fix this by replacing an assignment with the bitwise or instead.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bcma/driver_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
+index f499a469e66d0..12b2cc9a3fbe8 100644
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
+ 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_START;
+ 	v |= BCMA_CORE_PCI_MDIODATA_READ;
+ 	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 
+@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
+ 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_START;
+ 	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
+ 	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-- 
+2.20.1
+
diff --git a/queue-4.9/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch b/queue-4.9/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
new file mode 100644
index 00000000000..55bd63f17fd
--- /dev/null
+++ b/queue-4.9/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
@@ -0,0 +1,50 @@
+From 712d8ee7dc96c58f9277e73d6189e1846821300b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 19:13:08 +0800
+Subject: block: don't use bio->bi_vcnt to figure out segment number
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]
+
+It is wrong to use bio->bi_vcnt to figure out how many segments
+there are in the bio even though CLONED flag isn't set on this bio,
+because this bio may be splitted or advanced.
+
+So always use bio_segments() in blk_recount_segments(), and it shouldn't
+cause any performance loss now because the physical segment number is figured
+out in blk_queue_split() and BIO_SEG_VALID is set meantime since
+bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 2642e5fc8b69a..66795cca662a3 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -305,13 +305,7 @@ void blk_recalc_rq_segments(struct request *rq)
+ 
+ void blk_recount_segments(struct request_queue *q, struct bio *bio)
+ {
+-	unsigned short seg_cnt;
+-
+-	/* estimate segment number by bi_vcnt for non-cloned bio */
+-	if (bio_flagged(bio, BIO_CLONED))
+-		seg_cnt = bio_segments(bio);
+-	else
+-		seg_cnt = bio->bi_vcnt;
++	unsigned short seg_cnt = bio_segments(bio);
+ 
+ 	if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
+ 			(seg_cnt < queue_max_segments(q)))
+-- 
+2.20.1
+
diff --git a/queue-4.9/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch b/queue-4.9/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
new file mode 100644
index 00000000000..1dc93d2d704
--- /dev/null
+++ b/queue-4.9/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
@@ -0,0 +1,86 @@
+From cb54998edd768b41bd89627ae505d0f4982f1225 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:09 +0100
+Subject: Btrfs: fix hang when loading existing inode cache off disk
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ]
+
+If we are able to load an existing inode cache off disk, we set the state
+of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting
+for the cache to be available. This means that anyone waiting for the
+cache to be available, waiting on the condition that either its state is
+BTRFS_CACHE_FINISHED or its available free space is greather than zero,
+can hang forever.
+
+This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache",
+in particular test case generic/161 triggered it very frequently for me,
+producing a trace like the following:
+
+  [63795.739712] BTRFS info (device sdc): enabling inode map caching
+  [63795.739714] BTRFS info (device sdc): disk space caching is enabled
+  [63795.739716] BTRFS info (device sdc): has skinny extents
+  [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds.
+  [64036.654079]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
+  [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+  [64036.654232] btrfs-transacti D    0  3917      2 0x80004000
+  [64036.654239] Call Trace:
+  [64036.654258]  ? __schedule+0x3ae/0x7b0
+  [64036.654271]  schedule+0x3a/0xb0
+  [64036.654325]  btrfs_commit_transaction+0x978/0xae0 [btrfs]
+  [64036.654339]  ? remove_wait_queue+0x60/0x60
+  [64036.654395]  transaction_kthread+0x146/0x180 [btrfs]
+  [64036.654450]  ? btrfs_cleanup_transaction+0x620/0x620 [btrfs]
+  [64036.654456]  kthread+0x103/0x140
+  [64036.654464]  ? kthread_create_worker_on_cpu+0x70/0x70
+  [64036.654476]  ret_from_fork+0x3a/0x50
+  [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds.
+  [64036.654568]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
+  [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+  [64036.654685] xfs_io          D    0  3919   3633 0x00000000
+  [64036.654691] Call Trace:
+  [64036.654703]  ? __schedule+0x3ae/0x7b0
+  [64036.654716]  schedule+0x3a/0xb0
+  [64036.654756]  btrfs_find_free_ino+0xa9/0x120 [btrfs]
+  [64036.654764]  ? remove_wait_queue+0x60/0x60
+  [64036.654809]  btrfs_create+0x72/0x1f0 [btrfs]
+  [64036.654822]  lookup_open+0x6bc/0x790
+  [64036.654849]  path_openat+0x3bc/0xc00
+  [64036.654854]  ? __lock_acquire+0x331/0x1cb0
+  [64036.654869]  do_filp_open+0x99/0x110
+  [64036.654884]  ? __alloc_fd+0xee/0x200
+  [64036.654895]  ? do_raw_spin_unlock+0x49/0xc0
+  [64036.654909]  ? do_sys_open+0x132/0x220
+  [64036.654913]  do_sys_open+0x132/0x220
+  [64036.654926]  do_syscall_64+0x60/0x1d0
+  [64036.654933]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fix this by adding a wake_up() call right after setting the cache state to
+BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the
+cache from disk.
+
+Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index d27014b8bf727..075b59516c8c0 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -159,6 +159,7 @@ static void start_caching(struct btrfs_root *root)
+ 		spin_lock(&root->ino_cache_lock);
+ 		root->ino_cache_state = BTRFS_CACHE_FINISHED;
+ 		spin_unlock(&root->ino_cache_lock);
++		wake_up(&root->ino_cache_wait);
+ 		return;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch b/queue-4.9/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
new file mode 100644
index 00000000000..13aa646b230
--- /dev/null
+++ b/queue-4.9/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
@@ -0,0 +1,35 @@
+From ce569988d18af3b30b3cb4148740741fdcab0715 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 22:34:51 +0800
+Subject: cdc-wdm: pass return value of recover_from_urb_loss
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]
+
+'rv' is the correct return value, pass it upstream instead of 0
+
+Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 217a479165e03..09337a973335c 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -1098,7 +1098,7 @@ static int wdm_post_reset(struct usb_interface *intf)
+ 	rv = recover_from_urb_loss(desc);
+ 	mutex_unlock(&desc->wlock);
+ 	mutex_unlock(&desc->rlock);
+-	return 0;
++	return rv;
+ }
+ 
+ static struct usb_driver wdm_driver = {
+-- 
+2.20.1
+
diff --git a/queue-4.9/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch b/queue-4.9/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
new file mode 100644
index 00000000000..504695d8a3b
--- /dev/null
+++ b/queue-4.9/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
@@ -0,0 +1,38 @@
+From 902aa36480986f214e1e2c3d569df24ab2a9d134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 22:14:29 -0500
+Subject: cifs: fix rmmod regression in cifs.ko caused by force_sig changes
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ]
+
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+
+The global change from force_sig caused module unloading of cifs.ko
+to fail (since the cifsd process could not be killed, "rmmod cifs"
+now would always fail)
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+CC: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 110febd697379..7d46025d5e899 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -885,6 +885,7 @@ cifs_demultiplex_thread(void *p)
+ 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+ 
+ 	set_freezable();
++	allow_signal(SIGKILL);
+ 	while (server->tcpStatus != CifsExiting) {
+ 		if (try_to_freeze())
+ 			continue;
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch b/queue-4.9/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
new file mode 100644
index 00000000000..1d4284bd2f3
--- /dev/null
+++ b/queue-4.9/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
@@ -0,0 +1,41 @@
+From 9a8d5ecb75df262b38cd50a66522a7dcc24b877d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:36:58 -0500
+Subject: clk: armada-370: fix refcount leak in a370_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-370.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
+index 2c7c1085f8830..8fdfa97900cd8 100644
+--- a/drivers/clk/mvebu/armada-370.c
++++ b/drivers/clk/mvebu/armada-370.c
+@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &a370_coreclks);
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, a370_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch b/queue-4.9/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
new file mode 100644
index 00000000000..2b2471f103c
--- /dev/null
+++ b/queue-4.9/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
@@ -0,0 +1,40 @@
+From 8b6e0ccb9aef1c5804d96226ba322d3bb3336a9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:42:26 -0500
+Subject: clk: armada-xp: fix refcount leak in axp_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-xp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
+index b3094315a3c0f..2fa15a2747190 100644
+--- a/drivers/clk/mvebu/armada-xp.c
++++ b/drivers/clk/mvebu/armada-xp.c
+@@ -202,7 +202,9 @@ static void __init axp_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &axp_coreclks);
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, axp_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-dove-fix-refcount-leak-in-dove_clk_init.patch b/queue-4.9/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
new file mode 100644
index 00000000000..f09d89eea73
--- /dev/null
+++ b/queue-4.9/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
@@ -0,0 +1,47 @@
+From 9367086e1b3c744e2d060d73071cdefb5e818b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:50:13 -0500
+Subject: clk: dove: fix refcount leak in dove_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order")
+Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/dove.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
+index 59fad9546c847..5f258c9bb68bf 100644
+--- a/drivers/clk/mvebu/dove.c
++++ b/drivers/clk/mvebu/dove.c
+@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &dove_coreclks);
+ 
+-	if (ddnp)
++	if (ddnp) {
+ 		dove_divider_clk_init(ddnp);
++		of_node_put(ddnp);
++	}
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, dove_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch b/queue-4.9/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
new file mode 100644
index 00000000000..38b0fd2ad38
--- /dev/null
+++ b/queue-4.9/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
@@ -0,0 +1,36 @@
+From 95df93257d7e9806fc97a1934a7082899b7420c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:10:01 -0500
+Subject: clk: highbank: fix refcount leak in hb_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-highbank.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
+index 727ed8e1bb726..8e4581004695c 100644
+--- a/drivers/clk/clk-highbank.c
++++ b/drivers/clk/clk-highbank.c
+@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
+ 	/* Map system registers */
+ 	srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
+ 	hb_clk->reg = of_iomap(srnp, 0);
++	of_node_put(srnp);
+ 	BUG_ON(!hb_clk->reg);
+ 	hb_clk->reg += reg;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch b/queue-4.9/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
new file mode 100644
index 00000000000..32c98fb79a4
--- /dev/null
+++ b/queue-4.9/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
@@ -0,0 +1,36 @@
+From f178eb8cdef93ff2f68ca8e6c504666571501f93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:53:00 -0500
+Subject: clk: imx6q: fix refcount leak in imx6q_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6q.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index 14682df5d3123..d83f6221f1b00 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -174,6 +174,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
+ 	base = of_iomap(np, 0);
+ 	WARN_ON(!base);
++	of_node_put(np);
+ 
+ 	/* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
+ 	if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch b/queue-4.9/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
new file mode 100644
index 00000000000..390433203d3
--- /dev/null
+++ b/queue-4.9/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
@@ -0,0 +1,36 @@
+From 4aca3d692c07b11195e86621b02e8a9da7f43154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:55:10 -0500
+Subject: clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6sx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
+index b5c96de41ccf9..8bbc2542f2f70 100644
+--- a/drivers/clk/imx/clk-imx6sx.c
++++ b/drivers/clk/imx/clk-imx6sx.c
+@@ -164,6 +164,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
+ 	base = of_iomap(np, 0);
+ 	WARN_ON(!base);
++	of_node_put(np);
+ 
+ 	clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ 	clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch b/queue-4.9/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
new file mode 100644
index 00000000000..ac5cacc39e4
--- /dev/null
+++ b/queue-4.9/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
@@ -0,0 +1,36 @@
+From 376ba5d1d53692e09dabc22754de6408ff3fd6b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:57:16 -0500
+Subject: clk: imx7d: fix refcount leak in imx7d_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx7d.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index e7c7353a86fc6..8c0c0d0151321 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -415,6 +415,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
+ 	base = of_iomap(np, 0);
+ 	WARN_ON(!base);
++	of_node_put(np);
+ 
+ 	clks[IMX7D_PLL_ARM_MAIN_SRC]  = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+ 	clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch b/queue-4.9/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
new file mode 100644
index 00000000000..a5069cc6064
--- /dev/null
+++ b/queue-4.9/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
@@ -0,0 +1,38 @@
+From 4546825a8ffe81d4e6d2a2832ee01861c5fcd604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:40:19 -0500
+Subject: clk: kirkwood: fix refcount leak in kirkwood_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/kirkwood.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
+index a2a8d614039da..890ebf623261b 100644
+--- a/drivers/clk/mvebu/kirkwood.c
++++ b/drivers/clk/mvebu/kirkwood.c
+@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
+ 	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
+ 		kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
++
++		of_node_put(cgnp);
+ 	}
+ }
+ CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-qcom-fix-wunused-const-variable.patch b/queue-4.9/clk-qcom-fix-wunused-const-variable.patch
new file mode 100644
index 00000000000..0d8a5372842
--- /dev/null
+++ b/queue-4.9/clk-qcom-fix-wunused-const-variable.patch
@@ -0,0 +1,98 @@
+From b1b17cece532494433e139bb3311b4dad83f69c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 14:11:34 -0700
+Subject: clk: qcom: Fix -Wunused-const-variable
+
+From: Nathan Huckleberry <nhuck@google.com>
+
+[ Upstream commit da642427bd7710ec4f4140f693f59aa8521a358c ]
+
+Clang produces the following warning
+
+drivers/clk/qcom/gcc-msm8996.c:133:32: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map' [-Wunused-const-variable]
+static const struct
+parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] =
+{ ^drivers/clk/qcom/gcc-msm8996.c:141:27: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div' [-Wunused-const-variable] static
+const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { ^
+drivers/clk/qcom/gcc-msm8996.c:187:32: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map'
+[-Wunused-const-variable] static const struct parent_map
+gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { ^
+drivers/clk/qcom/gcc-msm8996.c:197:27: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div'
+[-Wunused-const-variable] static const char * const
+gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+
+It looks like these were never used.
+
+Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
+Cc: clang-built-linux@googlegroups.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/518
+Suggested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Nathan Huckleberry <nhuck@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8996.c | 36 ----------------------------------
+ 1 file changed, 36 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
+index fe03e6fbc7df5..ea6c227331fcf 100644
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -140,22 +140,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
+ 	"gpll0_early_div"
+ };
+ 
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL2, 2 },
+-	{ P_GPLL3, 3 },
+-	{ P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll2",
+-	"gpll3",
+-	"gpll0_early_div"
+-};
+-
+ static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = {
+ 	{ P_XO, 0 },
+ 	{ P_GPLL0, 1 },
+@@ -194,26 +178,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early
+ 	"gpll0_early_div"
+ };
+ 
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL2, 2 },
+-	{ P_GPLL3, 3 },
+-	{ P_GPLL1, 4 },
+-	{ P_GPLL4, 5 },
+-	{ P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll2",
+-	"gpll3",
+-	"gpll1",
+-	"gpll4",
+-	"gpll0_early_div"
+-};
+-
+ static struct clk_fixed_factor xo = {
+ 	.mult = 1,
+ 	.div = 1,
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch b/queue-4.9/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
new file mode 100644
index 00000000000..ed71ead7ab3
--- /dev/null
+++ b/queue-4.9/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
@@ -0,0 +1,36 @@
+From d97a90800804ff8c0250874329792dd235eda500 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:14:42 -0500
+Subject: clk: qoriq: fix refcount leak in clockgen_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-qoriq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index cdce49f6476aa..65876ff6df411 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -1245,6 +1245,7 @@ static void __init clockgen_init(struct device_node *np)
+ 				pr_err("%s: Couldn't map %s regs\n", __func__,
+ 				       guts->full_name);
+ 			}
++			of_node_put(guts);
+ 		}
+ 
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch b/queue-4.9/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
new file mode 100644
index 00000000000..c64c498a83b
--- /dev/null
+++ b/queue-4.9/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
@@ -0,0 +1,36 @@
+From 8234dbdae3cd3f7a1d85f0bb4692275903a8bdc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:32:15 -0500
+Subject: clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos4.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index faab9b31baf5b..91f9b79e39411 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1225,6 +1225,7 @@ static unsigned long __init exynos4_get_xom(void)
+ 			xom = readl(chipid_base + 8);
+ 
+ 		iounmap(chipid_base);
++		of_node_put(np);
+ 	}
+ 
+ 	return xom;
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-socfpga-fix-refcount-leak.patch b/queue-4.9/clk-socfpga-fix-refcount-leak.patch
new file mode 100644
index 00000000000..d4fd42e4d85
--- /dev/null
+++ b/queue-4.9/clk-socfpga-fix-refcount-leak.patch
@@ -0,0 +1,50 @@
+From 6386bbded4e3367aeda7aae2b6dd58b164e706ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:29:02 -0500
+Subject: clk: socfpga: fix refcount leak
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
+Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/socfpga/clk-pll-a10.c | 1 +
+ drivers/clk/socfpga/clk-pll.c     | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
+index 35fabe1a32c30..269467e8e07e1 100644
+--- a/drivers/clk/socfpga/clk-pll-a10.c
++++ b/drivers/clk/socfpga/clk-pll-a10.c
+@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
+ 
+ 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ 	clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
++	of_node_put(clkmgr_np);
+ 	BUG_ON(!clk_mgr_a10_base_addr);
+ 	pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
+ 
+diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
+index c7f463172e4b9..b4b44e9b59011 100644
+--- a/drivers/clk/socfpga/clk-pll.c
++++ b/drivers/clk/socfpga/clk-pll.c
+@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
+ 
+ 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ 	clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
++	of_node_put(clkmgr_np);
+ 	BUG_ON(!clk_mgr_base_addr);
+ 	pll_clk->hw.reg = clk_mgr_base_addr + reg;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch b/queue-4.9/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
new file mode 100644
index 00000000000..1e694df72e7
--- /dev/null
+++ b/queue-4.9/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
@@ -0,0 +1,39 @@
+From 46ed8479a2e70d547108a5e830b91263f6baf5b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 11:23:04 +0800
+Subject: clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ]
+
+The PLL-MIPI clock is somewhat special as it has its own LDOs which
+need to be turned on for this PLL to actually work and output a clock
+signal.
+
+Add the 2 LDO enable bits to the gate bits.
+
+Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+index 5c6d37bdf247c..765c6977484e7 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+@@ -132,7 +132,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
+ 				    8, 4,		/* N */
+ 				    4, 2,		/* K */
+ 				    0, 4,		/* M */
+-				    BIT(31),		/* gate */
++				    BIT(31) | BIT(23) | BIT(22), /* gate */
+ 				    BIT(28),		/* lock */
+ 				    CLK_SET_RATE_UNGATE);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch b/queue-4.9/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
new file mode 100644
index 00000000000..05c59fd28d7
--- /dev/null
+++ b/queue-4.9/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
@@ -0,0 +1,36 @@
+From a3d94e63ddf04e9cfb73026fb5eee11f6d783f31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:59:36 -0500
+Subject: clk: vf610: fix refcount leak in vf610_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-vf610.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
+index 0476353ab423f..a19ab032d0731 100644
+--- a/drivers/clk/imx/clk-vf610.c
++++ b/drivers/clk/imx/clk-vf610.c
+@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
+ 	anatop_base = of_iomap(np, 0);
+ 	BUG_ON(!anatop_base);
++	of_node_put(np);
+ 
+ 	np = ccm_node;
+ 	ccm_base = of_iomap(np, 0);
+-- 
+2.20.1
+
diff --git a/queue-4.9/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch b/queue-4.9/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
new file mode 100644
index 00000000000..5898d92ad85
--- /dev/null
+++ b/queue-4.9/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
@@ -0,0 +1,53 @@
+From 039dfb45b8b58390d01a55044793acb73df20515 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 11:57:04 +0200
+Subject: clocksource/drivers/exynos_mct: Fix error path in timer resources
+ initialization
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ]
+
+While freeing interrupt handlers in error path, don't assume that all
+requested interrupts are per-processor interrupts and properly release
+standard interrupts too.
+
+Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/exynos_mct.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index d32248e2ceab4..ae3cbaeffd9c5 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
+ 	return 0;
+ 
+ out_irq:
+-	free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++	if (mct_int_type == MCT_INT_PPI) {
++		free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++	} else {
++		for_each_possible_cpu(cpu) {
++			struct mct_clock_event_device *pcpu_mevt =
++				per_cpu_ptr(&percpu_mct_tick, cpu);
++
++			if (pcpu_mevt->evt.irq != -1) {
++				free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
++				pcpu_mevt->evt.irq = -1;
++			}
++		}
++	}
+ 	return err;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch b/queue-4.9/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
new file mode 100644
index 00000000000..d84fe042b17
--- /dev/null
+++ b/queue-4.9/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
@@ -0,0 +1,58 @@
+From fc8501e6248b55bed4bb8ef12050cfbcdfbae944 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 14:22:07 +0800
+Subject: clocksource/drivers/sun5i: Fail gracefully when clock rate is
+ unavailable
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]
+
+If the clock tree is not fully populated when the timer-sun5i init code
+is called, attempts to get the clock rate for the timer would fail and
+return 0.
+
+Make the init code for both clock events and clocksource check the
+returned clock rate and fail gracefully if the result is 0, instead of
+causing a divide by 0 exception later on.
+
+Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-sun5i.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 4f87f3e76d832..c3e96de525a24 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -201,6 +201,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
+ 	}
+ 
+ 	rate = clk_get_rate(clk);
++	if (!rate) {
++		pr_err("Couldn't get parent clock rate\n");
++		ret = -EINVAL;
++		goto err_disable_clk;
++	}
+ 
+ 	cs->timer.base = base;
+ 	cs->timer.clk = clk;
+@@ -274,6 +279,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
+ 	}
+ 
+ 	rate = clk_get_rate(clk);
++	if (!rate) {
++		pr_err("Couldn't get parent clock rate\n");
++		ret = -EINVAL;
++		goto err_disable_clk;
++	}
+ 
+ 	ce->timer.base = base;
+ 	ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+-- 
+2.20.1
+
diff --git a/queue-4.9/crypto-caam-free-resources-in-case-caam_rng-registra.patch b/queue-4.9/crypto-caam-free-resources-in-case-caam_rng-registra.patch
new file mode 100644
index 00000000000..f1c2951f8ac
--- /dev/null
+++ b/queue-4.9/crypto-caam-free-resources-in-case-caam_rng-registra.patch
@@ -0,0 +1,40 @@
+From e4e98a1a0d1bb33b229f1f710e01db82c9035286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 16:08:12 +0300
+Subject: crypto: caam - free resources in case caam_rng registration failed
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ]
+
+Check the return value of the hardware registration for caam_rng and free
+resources in case of failure.
+
+Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support")
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamrng.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index 9b92af2c72412..a77319bf221d8 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -361,7 +361,10 @@ static int __init caam_rng_init(void)
+ 		goto free_rng_ctx;
+ 
+ 	dev_info(dev, "registering rng-caam\n");
+-	return hwrng_register(&caam_rng);
++
++	err = hwrng_register(&caam_rng);
++	if (!err)
++		return err;
+ 
+ free_rng_ctx:
+ 	kfree(rng_ctx);
+-- 
+2.20.1
+
diff --git a/queue-4.9/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch b/queue-4.9/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
new file mode 100644
index 00000000000..adce9a72ee4
--- /dev/null
+++ b/queue-4.9/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
@@ -0,0 +1,63 @@
+From c978a156e29529dbb789823a31a2d6a1a95be616 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 21:53:23 +0000
+Subject: crypto: ccp - fix AES CFB error exposed by new test vectors
+
+From: Hook, Gary <Gary.Hook@amd.com>
+
+[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ]
+
+Updated testmgr will exhibit this error message when loading the
+ccp-crypto module:
+
+alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place"
+
+Update the CCP crypto driver to correctly treat CFB as a streaming mode
+cipher (instead of block mode). Update the configuration for CFB to
+specify the block size as a single byte;
+
+Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support')
+
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
+index 89291c15015cd..3f768699332ba 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes.c
+@@ -1,7 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0
+ /*
+  * AMD Cryptographic Coprocessor (CCP) AES crypto API support
+  *
+- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
++ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
+  *
+  * Author: Tom Lendacky <thomas.lendacky@amd.com>
+  *
+@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
+ 		return -EINVAL;
+ 
+ 	if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
+-	     (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
+-	     (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
++	     (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
+ 	    (req->nbytes & (AES_BLOCK_SIZE - 1)))
+ 		return -EINVAL;
+ 
+@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
+ 		.version	= CCP_VERSION(3, 0),
+ 		.name		= "cfb(aes)",
+ 		.driver_name	= "cfb-aes-ccp",
+-		.blocksize	= AES_BLOCK_SIZE,
++		.blocksize	= 1,
+ 		.ivsize		= AES_BLOCK_SIZE,
+ 		.alg_defaults	= &ccp_aes_defaults,
+ 	},
+-- 
+2.20.1
+
diff --git a/queue-4.9/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch b/queue-4.9/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
new file mode 100644
index 00000000000..9d96be2a547
--- /dev/null
+++ b/queue-4.9/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
@@ -0,0 +1,49 @@
+From 823582c977094725cf2061da9e2ddeff2add44d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 11:24:18 +0000
+Subject: crypto: crypto4xx - Fix wrong
+ ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ]
+
+When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
+drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
+drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
+In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
+drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
+drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
+drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
+In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
+drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
+
+This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.
+
+Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
+index 931d22531f515..7bbda51b7337c 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.h
++++ b/drivers/crypto/amcc/crypto4xx_trng.h
+@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
+ void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
+ #else
+ static inline void ppc4xx_trng_probe(
+-	struct crypto4xx_device *dev __maybe_unused) { }
++	struct crypto4xx_core_device *dev __maybe_unused) { }
+ static inline void ppc4xx_trng_remove(
+-	struct crypto4xx_device *dev __maybe_unused) { }
++	struct crypto4xx_core_device *dev __maybe_unused) { }
+ #endif
+ 
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-4.9/crypto-tgr192-fix-unaligned-memory-access.patch b/queue-4.9/crypto-tgr192-fix-unaligned-memory-access.patch
new file mode 100644
index 00000000000..ad3ddd74f31
--- /dev/null
+++ b/queue-4.9/crypto-tgr192-fix-unaligned-memory-access.patch
@@ -0,0 +1,50 @@
+From cabc53b245b08d102a6d840a073e653efcbf204b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 12:17:58 -0800
+Subject: crypto: tgr192 - fix unaligned memory access
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]
+
+Fix an unaligned memory access in tgr192_transform() by using the
+unaligned access helpers.
+
+Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/tgr192.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/crypto/tgr192.c b/crypto/tgr192.c
+index 321bc6ff2a9d1..904c8444aa0a2 100644
+--- a/crypto/tgr192.c
++++ b/crypto/tgr192.c
+@@ -25,8 +25,9 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/mm.h>
+-#include <asm/byteorder.h>
+ #include <linux/types.h>
++#include <asm/byteorder.h>
++#include <asm/unaligned.h>
+ 
+ #define TGR192_DIGEST_SIZE 24
+ #define TGR160_DIGEST_SIZE 20
+@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
+ 	u64 a, b, c, aa, bb, cc;
+ 	u64 x[8];
+ 	int i;
+-	const __le64 *ptr = (const __le64 *)data;
+ 
+ 	for (i = 0; i < 8; i++)
+-		x[i] = le64_to_cpu(ptr[i]);
++		x[i] = get_unaligned_le64(data + i * sizeof(__le64));
+ 
+ 	/* save */
+ 	a = aa = tctx->a;
+-- 
+2.20.1
+
diff --git a/queue-4.9/devres-allow-const-resource-arguments.patch b/queue-4.9/devres-allow-const-resource-arguments.patch
new file mode 100644
index 00000000000..b454978f641
--- /dev/null
+++ b/queue-4.9/devres-allow-const-resource-arguments.patch
@@ -0,0 +1,63 @@
+From 4398e68e186d0d6e390cd00115125cebb4957f71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 16:59:45 +0200
+Subject: devres: allow const resource arguments
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ]
+
+devm_ioremap_resource() does not currently take 'const' arguments,
+which results in a warning from the first driver trying to do it
+anyway:
+
+drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe':
+drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
+  priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores);
+                                                 ^~~~~~~~~~~~~~~~~~~
+
+Change the prototype to allow it, as there is no real reason not to.
+
+Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviwed-By: Enrico Weigelt <info@metux.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/device.h | 3 ++-
+ lib/devres.c           | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 8d732965fab77..eb865b461acc4 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -682,7 +682,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
+ 					 gfp_t gfp_mask, unsigned int order);
+ extern void devm_free_pages(struct device *dev, unsigned long addr);
+ 
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
++void __iomem *devm_ioremap_resource(struct device *dev,
++				    const struct resource *res);
+ 
+ /* allows to add/remove a custom action to devres stack */
+ int devm_add_action(struct device *dev, void (*action)(void *), void *data);
+diff --git a/lib/devres.c b/lib/devres.c
+index cb1464c411a2b..38912892053c0 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
+  *	if (IS_ERR(base))
+  *		return PTR_ERR(base);
+  */
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
++void __iomem *devm_ioremap_resource(struct device *dev,
++				    const struct resource *res)
+ {
+ 	resource_size_t size;
+ 	const char *name;
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch b/queue-4.9/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
new file mode 100644
index 00000000000..7697a69f695
--- /dev/null
+++ b/queue-4.9/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
@@ -0,0 +1,45 @@
+From b31ac294a91863306e6c203670d2f6f03c8ebc17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: dmaengine: axi-dmac: Don't check the number of frames for alignment
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index 7f0b9aa158679..9887f2a14aa98 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -451,7 +451,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+ 
+ 	if (chan->hw_2d) {
+ 		if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+-		    !axi_dmac_check_len(chan, xt->numf))
++		    xt->numf == 0)
+ 			return NULL;
+ 		if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ 		    xt->sgl[0].size + src_icg > chan->max_length)
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch b/queue-4.9/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
new file mode 100644
index 00000000000..6e7006f330c
--- /dev/null
+++ b/queue-4.9/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
@@ -0,0 +1,64 @@
+From 210e3bbfacfd728619556200474e3d40aca9d78f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 16:15:43 +0300
+Subject: dmaengine: dw: platform: Switch to acpi_dma_controller_register()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ]
+
+There is a possibility to have registered ACPI DMA controller
+while it has been gone already.
+
+To avoid the potential crash, move to non-managed
+acpi_dma_controller_register().
+
+Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw/platform.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 5bda0eb9f393f..7536fe80bc33f 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
+ 	dma_cap_set(DMA_SLAVE, info->dma_cap);
+ 	info->filter_fn = dw_dma_acpi_filter;
+ 
+-	ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
+-						info);
++	ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
+ 	if (ret)
+ 		dev_err(dev, "could not register acpi_dma_controller\n");
+ }
++
++static void dw_dma_acpi_controller_free(struct dw_dma *dw)
++{
++	struct device *dev = dw->dma.dev;
++
++	acpi_dma_controller_free(dev);
++}
+ #else /* !CONFIG_ACPI */
+ static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
+ #endif /* !CONFIG_ACPI */
+ 
+ #ifdef CONFIG_OF
+@@ -226,6 +233,9 @@ static int dw_remove(struct platform_device *pdev)
+ {
+ 	struct dw_dma_chip *chip = platform_get_drvdata(pdev);
+ 
++	if (ACPI_HANDLE(&pdev->dev))
++		dw_dma_acpi_controller_free(chip->dw);
++
+ 	if (pdev->dev.of_node)
+ 		of_dma_controller_free(pdev->dev.of_node);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch b/queue-4.9/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
new file mode 100644
index 00000000000..7b9b6347a76
--- /dev/null
+++ b/queue-4.9/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
@@ -0,0 +1,51 @@
+From 27a82916acf70c267b56c6e06fc408dd1b960e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 16:32:32 +0300
+Subject: dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c24a5c735f87d0549060de31367c095e8810b895 ]
+
+The commit
+
+  080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
+
+has been mistakenly submitted. The further investigations show that
+the original code does better job since the memory side transfer size
+has never been configured by DMA users.
+
+As per latest revision of documentation: "Channel minimum transfer size
+(CHnMTSR)... For IOSF UART, maximum value that can be programmed is 64 and
+minimum value that can be programmed is 1."
+
+This reverts commit 080edf75d337d35faa6fc3df99342b10d2848d16.
+
+Fixes: 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/hsu/hsu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
+index 29d04ca71d52e..15525a2b8ebd7 100644
+--- a/drivers/dma/hsu/hsu.c
++++ b/drivers/dma/hsu/hsu.c
+@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc)
+ 
+ 	if (hsuc->direction == DMA_MEM_TO_DEV) {
+ 		bsr = config->dst_maxburst;
+-		mtsr = config->src_addr_width;
++		mtsr = config->dst_addr_width;
+ 	} else if (hsuc->direction == DMA_DEV_TO_MEM) {
+ 		bsr = config->src_maxburst;
+-		mtsr = config->dst_addr_width;
++		mtsr = config->src_addr_width;
+ 	}
+ 
+ 	hsu_chan_disable(hsuc);
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch b/queue-4.9/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
new file mode 100644
index 00000000000..d460b88c2e9
--- /dev/null
+++ b/queue-4.9/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
@@ -0,0 +1,73 @@
+From 248bba94807384227933db13b7036232827ed927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:49:18 +0000
+Subject: dmaengine: imx-sdma: fix size check for sdma script_number
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]
+
+Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(41) exceed the size of structure sdma_script_start_addrs(40),
+thus cause memory corrupt such as slob block header so that kernel
+trap into while() loop forever in slob_free(). Please refer to below
+code piece in imx-sdma.c:
+for (i = 0; i < sdma->script_number; i++)
+	if (addr_arr[i] > 0)
+		saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
+That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
+support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(38->41 3 scripts added) not align with script number added in
+sdma_script_start_addrs(2 scripts).
+
+Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
+Cc: stable@vger.kernel
+Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
+Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
+[vkoul: update the patch title]
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c                     | 8 ++++++++
+ include/linux/platform_data/dma-imx-sdma.h | 3 +++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 9f240b2d85a54..558d509b7d855 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1441,6 +1441,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
+ 	if (!sdma->script_number)
+ 		sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
+ 
++	if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
++				  / sizeof(s32)) {
++		dev_err(sdma->dev,
++			"SDMA script number %d not match with firmware.\n",
++			sdma->script_number);
++		return;
++	}
++
+ 	for (i = 0; i < sdma->script_number; i++)
+ 		if (addr_arr[i] > 0)
+ 			saddr_arr[i] = addr_arr[i];
+diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
+index 2d08816720f6d..5bb0a119f39a3 100644
+--- a/include/linux/platform_data/dma-imx-sdma.h
++++ b/include/linux/platform_data/dma-imx-sdma.h
+@@ -50,7 +50,10 @@ struct sdma_script_start_addrs {
+ 	/* End of v2 array */
+ 	s32 zcanfd_2_mcu_addr;
+ 	s32 zqspi_2_mcu_addr;
++	s32 mcu_2_ecspi_addr;
+ 	/* End of v3 array */
++	s32 mcu_2_zqspi_addr;
++	/* End of v4 array */
+ };
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-mv_xor-use-correct-device-for-dma-api.patch b/queue-4.9/dmaengine-mv_xor-use-correct-device-for-dma-api.patch
new file mode 100644
index 00000000000..4bfef5b4e2c
--- /dev/null
+++ b/queue-4.9/dmaengine-mv_xor-use-correct-device-for-dma-api.patch
@@ -0,0 +1,53 @@
+From 1ab57b7a7dd183616b77ccaac73934e07a9891f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 18:27:06 +0000
+Subject: dmaengine: mv_xor: Use correct device for DMA API
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ]
+
+Using dma_dev->dev for mappings before it's assigned with the correct
+device is unlikely to work as expected, and with future dma-direct
+changes, passing a NULL device may end up crashing entirely. I don't
+know enough about this hardware or the mv_xor_prep_dma_interrupt()
+operation to implement the appropriate error-handling logic that would
+have revealed those dma_map_single() calls failing on arm64 for as long
+as the driver has been enabled there, but moving the assignment earlier
+will at least make the current code operate as intended.
+
+Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT")
+Reported-by: John David Anglin <dave.anglin@bell.net>
+Tested-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 23f75285a4d9c..5d524f29c5f11 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1044,6 +1044,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ 		mv_chan->op_in_desc = XOR_MODE_IN_DESC;
+ 
+ 	dma_dev = &mv_chan->dmadev;
++	dma_dev->dev = &pdev->dev;
+ 	mv_chan->xordev = xordev;
+ 
+ 	/*
+@@ -1076,7 +1077,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ 	dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
+ 	dma_dev->device_tx_status = mv_xor_status;
+ 	dma_dev->device_issue_pending = mv_xor_issue_pending;
+-	dma_dev->dev = &pdev->dev;
+ 
+ 	/* set prep routines based on capability */
+ 	if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-tegra210-adma-fix-crash-during-probe.patch b/queue-4.9/dmaengine-tegra210-adma-fix-crash-during-probe.patch
new file mode 100644
index 00000000000..32cf9198d7c
--- /dev/null
+++ b/queue-4.9/dmaengine-tegra210-adma-fix-crash-during-probe.patch
@@ -0,0 +1,92 @@
+From ac32f8f1055171bce1bedca0b9c223557fc736b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2019 16:53:52 +0100
+Subject: dmaengine: tegra210-adma: Fix crash during probe
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ]
+
+Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
+added support to save and restore the DMA channel registers when runtime
+suspending the ADMA. This change is causing the kernel to crash when
+probing the ADMA, if the device is probed deferred when looking up the
+channel interrupts. The crash occurs because not all of the channel base
+addresses have been setup at this point and in the clean-up path of the
+probe, pm_runtime_suspend() is called invoking its callback which
+expects all the channel base addresses to be initialised.
+
+Although this could be fixed by simply checking for a NULL address, on
+further review of the driver it seems more appropriate that we only call
+pm_runtime_get_sync() after all the channel interrupts and base
+addresses have been configured. Therefore, fix this crash by moving the
+calls to pm_runtime_enable(), pm_runtime_get_sync() and
+tegra_adma_init() after the DMA channels have been initialised.
+
+Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 8c3cab463354f..2d4aeba579f75 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 		return PTR_ERR(tdma->ahub_clk);
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
+-
+-	ret = pm_runtime_get_sync(&pdev->dev);
+-	if (ret < 0)
+-		goto rpm_disable;
+-
+-	ret = tegra_adma_init(tdma);
+-	if (ret)
+-		goto rpm_put;
+-
+ 	INIT_LIST_HEAD(&tdma->dma_dev.channels);
+ 	for (i = 0; i < tdma->nr_channels; i++) {
+ 		struct tegra_adma_chan *tdc = &tdma->channels[i];
+@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 		tdc->tdma = tdma;
+ 	}
+ 
++	pm_runtime_enable(&pdev->dev);
++
++	ret = pm_runtime_get_sync(&pdev->dev);
++	if (ret < 0)
++		goto rpm_disable;
++
++	ret = tegra_adma_init(tdma);
++	if (ret)
++		goto rpm_put;
++
+ 	dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
+ 	dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
+ 	dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
+@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 
+ dma_remove:
+ 	dma_async_device_unregister(&tdma->dma_dev);
+-irq_dispose:
+-	while (--i >= 0)
+-		irq_dispose_mapping(tdma->channels[i].irq);
+ rpm_put:
+ 	pm_runtime_put_sync(&pdev->dev);
+ rpm_disable:
+ 	pm_runtime_disable(&pdev->dev);
++irq_dispose:
++	while (--i >= 0)
++		irq_dispose_mapping(tdma->channels[i].irq);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-tegra210-adma-restore-channel-status.patch b/queue-4.9/dmaengine-tegra210-adma-restore-channel-status.patch
new file mode 100644
index 00000000000..1a110c6e93d
--- /dev/null
+++ b/queue-4.9/dmaengine-tegra210-adma-restore-channel-status.patch
@@ -0,0 +1,124 @@
+From 0011c8cf299169459cd6d80bd1ea4eae047627b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 18:25:17 +0530
+Subject: dmaengine: tegra210-adma: restore channel status
+
+From: Sameer Pujar <spujar@nvidia.com>
+
+[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ]
+
+Status of ADMA channel registers is not saved and restored during system
+suspend. During active playback if system enters suspend, this results in
+wrong state of channel registers during system resume and playback fails
+to resume properly. Fix this by saving following channel registers in
+runtime suspend and restore during runtime resume.
+ * ADMA_CH_LOWER_SRC_ADDR
+ * ADMA_CH_LOWER_TRG_ADDR
+ * ADMA_CH_FIFO_CTRL
+ * ADMA_CH_CONFIG
+ * ADMA_CH_CTRL
+ * ADMA_CH_CMD
+ * ADMA_CH_TC
+Runtime PM calls will be inovked during system resume path if a playback
+or capture needs to be resumed. Hence above changes work fine for system
+suspend case.
+
+Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 45 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index e9e46a5207452..8c3cab463354f 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
+ 	unsigned int src_addr;
+ 	unsigned int trg_addr;
+ 	unsigned int fifo_ctrl;
++	unsigned int cmd;
+ 	unsigned int tc;
+ };
+ 
+@@ -127,6 +128,7 @@ struct tegra_adma_chan {
+ 	enum dma_transfer_direction	sreq_dir;
+ 	unsigned int			sreq_index;
+ 	bool				sreq_reserved;
++	struct tegra_adma_chan_regs	ch_regs;
+ 
+ 	/* Transfer count and position info */
+ 	unsigned int			tx_buf_count;
+@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
+ static int tegra_adma_runtime_suspend(struct device *dev)
+ {
+ 	struct tegra_adma *tdma = dev_get_drvdata(dev);
++	struct tegra_adma_chan_regs *ch_reg;
++	struct tegra_adma_chan *tdc;
++	int i;
+ 
+ 	tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
++	if (!tdma->global_cmd)
++		goto clk_disable;
++
++	for (i = 0; i < tdma->nr_channels; i++) {
++		tdc = &tdma->channels[i];
++		ch_reg = &tdc->ch_regs;
++		ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
++		/* skip if channel is not active */
++		if (!ch_reg->cmd)
++			continue;
++		ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
++		ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
++		ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
++		ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
++		ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
++		ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
++	}
++
++clk_disable:
+ 	clk_disable_unprepare(tdma->ahub_clk);
+ 
+ 	return 0;
+@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
+ static int tegra_adma_runtime_resume(struct device *dev)
+ {
+ 	struct tegra_adma *tdma = dev_get_drvdata(dev);
+-	int ret;
++	struct tegra_adma_chan_regs *ch_reg;
++	struct tegra_adma_chan *tdc;
++	int ret, i;
+ 
+ 	ret = clk_prepare_enable(tdma->ahub_clk);
+ 	if (ret) {
+@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
+ 	}
+ 	tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
+ 
++	if (!tdma->global_cmd)
++		return 0;
++
++	for (i = 0; i < tdma->nr_channels; i++) {
++		tdc = &tdma->channels[i];
++		ch_reg = &tdc->ch_regs;
++		/* skip if channel was not active earlier */
++		if (!ch_reg->cmd)
++			continue;
++		tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
++		tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
++		tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
++		tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
++		tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
++		tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
++		tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
++	}
++
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/dmaengine-ti-edma-fix-missed-failure-handling.patch b/queue-4.9/dmaengine-ti-edma-fix-missed-failure-handling.patch
new file mode 100644
index 00000000000..73a42be85a0
--- /dev/null
+++ b/queue-4.9/dmaengine-ti-edma-fix-missed-failure-handling.patch
@@ -0,0 +1,41 @@
+From 086d7c90f14698037ef20590771280dab6815034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:38:02 +0800
+Subject: dmaengine: ti: edma: fix missed failure handling
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]
+
+When devm_kcalloc fails, it forgets to call edma_free_slot.
+Replace direct return with failure handler to fix it.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/edma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
+index 72f31e837b1d5..56ec724687456 100644
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -2340,8 +2340,10 @@ static int edma_probe(struct platform_device *pdev)
+ 
+ 		ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
+ 					    sizeof(*ecc->tc_list), GFP_KERNEL);
+-		if (!ecc->tc_list)
+-			return -ENOMEM;
++		if (!ecc->tc_list) {
++			ret = -ENOMEM;
++			goto err_reg1;
++		}
+ 
+ 		for (i = 0;; i++) {
+ 			ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
+-- 
+2.20.1
+
diff --git a/queue-4.9/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch b/queue-4.9/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
new file mode 100644
index 00000000000..799f3bd30e7
--- /dev/null
+++ b/queue-4.9/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
@@ -0,0 +1,44 @@
+From bc39d51928d5f967efd1d6d4736ef8ca8c279228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 16:29:33 -0800
+Subject: drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ]
+
+If riocm_get_channel() fails, then we should just return -EINVAL.
+Calling riocm_put_channel() will trigger a NULL dereference and
+generally we should call put() if the get() didn't succeed.
+
+Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam
+Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Alexandre Bounine <alexandre.bounine@idt.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rapidio/rio_cm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
+index ef989a15aefc4..b29fc258eeba4 100644
+--- a/drivers/rapidio/rio_cm.c
++++ b/drivers/rapidio/rio_cm.c
+@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
+ 	riocm_debug(CHOP, "(ch_%d)", ch_id);
+ 
+ 	ch = riocm_get_channel(ch_id);
+-	if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
++	if (!ch)
++		return -EINVAL;
++	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+ 		ret = -EINVAL;
+ 	riocm_put_channel(ch);
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-dp_mst-skip-validating-ports-during-destruction-.patch b/queue-4.9/drm-dp_mst-skip-validating-ports-during-destruction-.patch
new file mode 100644
index 00000000000..52628faf9a6
--- /dev/null
+++ b/queue-4.9/drm-dp_mst-skip-validating-ports-during-destruction-.patch
@@ -0,0 +1,90 @@
+From 4f86594cb9573b1ef38e4ac562c0ade6ef51c263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 17:46:14 -0500
+Subject: drm/dp_mst: Skip validating ports during destruction, just ref
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]
+
+Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
+accidentally introduced into DRM two years ago.
+
+Pretend we have a topology like this:
+
+|- DP-1: mst_primary
+   |- DP-4: active display
+   |- DP-5: disconnected
+   |- DP-6: active hub
+      |- DP-7: active display
+      |- DP-8: disconnected
+      |- DP-9: disconnected
+
+If we unplug DP-6, the topology starting at DP-7 will be destroyed but
+it's payloads will live on in DP-1's VCPI allocations and thus require
+removal. However, this removal currently fails because
+drm_dp_update_payload_part1() will (rightly so) try to validate the port
+before accessing it, fail then abort. If we keep going, eventually we
+run the MST hub out of bandwidth and all new allocations will start to
+fail (or in my case; all new displays just start flickering a ton).
+
+We could just teach drm_dp_update_payload_part1() not to drop the port
+ref in this case, but then we also need to teach
+drm_dp_destroy_payload_step1() to do the same thing, then hope no one
+ever adds anything to the that requires a validated port reference in
+drm_dp_destroy_connector_work(). Kind of sketchy.
+
+So let's go with a more clever solution: any port that
+drm_dp_destroy_connector_work() interacts with is guaranteed to still
+exist in memory until we say so. While said port might not be valid we
+don't really care: that's the whole reason we're destroying it in the
+first place! So, teach drm_dp_get_validated_port_ref() to use the all
+mighty current_work() function to avoid attempting to validate ports
+from the context of mgr->destroy_connector_work. I can't see any
+situation where this wouldn't be safe, and this avoids having to play
+whack-a-mole in the future of trying to work around port validation.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
+Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: <stable@vger.kernel.org> # v4.6+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index e05dda92398c6..17aedaaf364c1 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -980,9 +980,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
+ static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
+ {
+ 	struct drm_dp_mst_port *rport = NULL;
++
+ 	mutex_lock(&mgr->lock);
+-	if (mgr->mst_primary)
+-		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
++	/*
++	 * Port may or may not be 'valid' but we don't care about that when
++	 * destroying the port and we are guaranteed that the port pointer
++	 * will be valid until we've finished
++	 */
++	if (current_work() == &mgr->destroy_connector_work) {
++		kref_get(&port->kref);
++		rport = port;
++	} else if (mgr->mst_primary) {
++		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
++						       port);
++	}
+ 	mutex_unlock(&mgr->lock);
+ 	return rport;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch b/queue-4.9/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
new file mode 100644
index 00000000000..4702f98c5a0
--- /dev/null
+++ b/queue-4.9/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
@@ -0,0 +1,36 @@
+From e66a0084be9ffedc0061b7e63676db6617138ffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:49:46 +0300
+Subject: drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ]
+
+The etnaviv_gem_get_pages() never returns NULL.  It returns error
+pointers on error.
+
+Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+index 2bef501d4a172..5af7c2594a79e 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -206,7 +206,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ 		mutex_lock(&obj->lock);
+ 		pages = etnaviv_gem_get_pages(obj);
+ 		mutex_unlock(&obj->lock);
+-		if (pages) {
++		if (!IS_ERR(pages)) {
+ 			int j;
+ 
+ 			iter.hdr->data[0] = bomap - bomap_start;
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch b/queue-4.9/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
new file mode 100644
index 00000000000..0c920f5dd92
--- /dev/null
+++ b/queue-4.9/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
@@ -0,0 +1,60 @@
+From 1355996e7de44edfcf54a79849bc4e070581d8a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 09:09:47 -0700
+Subject: drm/msm/a3xx: remove TPL1 regs from snapshot
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ]
+
+These regs are write-only, and the hw throws a hissy-fit (ie. reboots)
+when we try to read them for GPU state snapshot, in response to a GPU
+hang.  It is rather impolite when GPU recovery triggers an insta-
+reboot, so lets remove the TPL1 registers from the snapshot.
+
+Fixes: 7198e6b03155 drm/msm: add a3xx gpu support
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+index fd266ed963b6c..25a0e7d133405 100644
+--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+@@ -383,19 +383,17 @@ static const unsigned int a3xx_registers[] = {
+ 	0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
+ 	0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+ 	0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+-	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
+-	0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
+-	0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
+-	0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
+-	0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
+-	0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
+-	0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
+-	0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
+-	0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
+-	0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
+-	0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
+-	0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
+-	0x303c, 0x303c, 0x305e, 0x305f,
++	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
++	0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
++	0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
++	0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
++	0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
++	0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
++	0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
++	0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
++	0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
++	0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
++	0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
+ 	~0   /* sentinel */
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-msm-dsi-implement-reset-correctly.patch b/queue-4.9/drm-msm-dsi-implement-reset-correctly.patch
new file mode 100644
index 00000000000..285c2627248
--- /dev/null
+++ b/queue-4.9/drm-msm-dsi-implement-reset-correctly.patch
@@ -0,0 +1,73 @@
+From 7c721d3496bd45f9aaed4c51b3cd1476e598fb94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 06:39:39 -0700
+Subject: drm/msm/dsi: Implement reset correctly
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ]
+
+On msm8998, vblank timeouts are observed because the DSI controller is not
+reset properly, which ends up stalling the MDP.  This is because the reset
+logic is not correct per the hardware documentation.
+
+The documentation states that after asserting reset, software should wait
+some time (no indication of how long), or poll the status register until it
+returns 0 before deasserting reset.
+
+wmb() is insufficient for this purpose since it just ensures ordering, not
+timing between writes.  Since asserting and deasserting reset occurs on the
+same register, ordering is already guaranteed by the architecture, making
+the wmb extraneous.
+
+Since we would define a timeout for polling the status register to avoid a
+possible infinite loop, lets just use a static delay of 20 ms, since 16.666
+ms is the time available to process one frame at 60 fps.
+
+Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
+Cc: Hai Li <hali@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Sean Paul <sean@poorly.run>
+[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS]
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 6f240021705b0..e49b414c012c6 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -33,6 +33,8 @@
+ #include "sfpb.xml.h"
+ #include "dsi_cfg.h"
+ 
++#define DSI_RESET_TOGGLE_DELAY_MS 20
++
+ static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
+ {
+ 	u32 ver;
+@@ -909,7 +911,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
+ 	wmb(); /* clocks need to be enabled before reset */
+ 
+ 	dsi_write(msm_host, REG_DSI_RESET, 1);
+-	wmb(); /* make sure reset happen */
++	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ 	dsi_write(msm_host, REG_DSI_RESET, 0);
+ }
+ 
+@@ -1288,7 +1290,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
+ 
+ 	/* dsi controller can only be reset while clocks are running */
+ 	dsi_write(msm_host, REG_DSI_RESET, 1);
+-	wmb();	/* make sure reset happen */
++	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ 	dsi_write(msm_host, REG_DSI_RESET, 0);
+ 	wmb();	/* controller out of reset */
+ 	dsi_write(msm_host, REG_DSI_CTRL, data0);
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch b/queue-4.9/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
new file mode 100644
index 00000000000..370fdc385f4
--- /dev/null
+++ b/queue-4.9/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
@@ -0,0 +1,39 @@
+From a27998345f0581b78e8d54df2f8edb4e575f8531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 08:00:30 -0700
+Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ]
+
+If mdp5_cfg_init fails because of an unknown major version, a null pointer
+dereference occurs.  This is because the caller of init expects error
+pointers, but init returns NULL on error.  Fix this by returning the
+expected values on error.
+
+Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+index 8b4e3004f4518..86b0448d2ce58 100644
+--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+@@ -542,7 +542,7 @@ fail:
+ 	if (cfg_handler)
+ 		mdp5_cfg_destroy(cfg_handler);
+ 
+-	return NULL;
++	return ERR_PTR(ret);
+ }
+ 
+ static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch b/queue-4.9/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
new file mode 100644
index 00000000000..5532b06097c
--- /dev/null
+++ b/queue-4.9/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
@@ -0,0 +1,43 @@
+From 077cb2874e2f6c0cf7418758d6f158815d7acffd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Nov 2018 17:09:18 +0000
+Subject: drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]
+
+Currently, the expression for calculating RON is always going to result
+in zero no matter the value of ram->mr[1] because the ! operator has
+higher precedence than the shift >> operator.  I believe the missing
+parentheses around the expression before appying the ! operator will
+result in the desired result.
+
+[ Note, not tested ]
+
+Detected by CoveritScan, CID#1324005 ("Operands don't affect result")
+
+Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+index 60ece0a8a2e1b..1d2d6bae73cd1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
+ 		WR  = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
+ 		/* XXX: Get these values from the VBIOS instead */
+ 		DLL = !(ram->mr[1] & 0x1);
+-		RON = !(ram->mr[1] & 0x300) >> 8;
++		RON = !((ram->mr[1] & 0x300) >> 8);
+ 		break;
+ 	default:
+ 		return -ENOSYS;
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch b/queue-4.9/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
new file mode 100644
index 00000000000..cfd88df7691
--- /dev/null
+++ b/queue-4.9/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
@@ -0,0 +1,44 @@
+From 026c50bfa53d2d5d1d924dd452b4c54cc87491fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:29:49 +0000
+Subject: drm/nouveau/pmu: don't print reply values if exec is false
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]
+
+Currently the uninitialized values in the array reply are printed out
+when exec is false and nvkm_pmu_send has not updated the array. Avoid
+confusion by only dumping out these values if they have been actually
+updated.
+
+Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
+Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+index e6f74168238c7..2ef9e942f43a2 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+@@ -87,10 +87,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
+ 	if (exec) {
+ 		nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
+ 			      memx->base, finish);
++		nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
++			   reply[0], reply[1]);
+ 	}
+ 
+-	nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+-		   reply[0], reply[1]);
+ 	kfree(memx);
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch b/queue-4.9/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
new file mode 100644
index 00000000000..9722760e71b
--- /dev/null
+++ b/queue-4.9/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
@@ -0,0 +1,77 @@
+From bf2ea531b4bc32587b558b5b12395942aabe3be6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:53:53 +1100
+Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]
+
+The INTERRUPT_CNTL2 register expects a valid DMA address, but is
+currently set with a GPU MC address.  This can cause problems on
+systems that detect the resulting DMA read from an invalid address
+(found on a Power8 guest).
+
+Instead, use the DMA address of the dummy page because it will always
+be safe.
+
+Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
+Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
+Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c  | 4 ++--
+ drivers/gpu/drm/radeon/r600.c | 4 ++--
+ drivers/gpu/drm/radeon/si.c   | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index b99f3e59011c1..5fcb5869a4891 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7026,8 +7026,8 @@ static int cik_irq_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	/* setup interrupt control */
+-	/* XXX this should actually be a bus address, not an MC address. same on older asics */
+-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index f2eac6b6c46a3..9569c35f8766a 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3697,8 +3697,8 @@ int r600_irq_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	/* setup interrupt control */
+-	/* set dummy read address to ring address */
+-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index b75d809c292e3..919d389869ceb 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6018,8 +6018,8 @@ static int si_irq_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	/* setup interrupt control */
+-	/* set dummy read address to ring address */
+-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch b/queue-4.9/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
new file mode 100644
index 00000000000..e3ec8596896
--- /dev/null
+++ b/queue-4.9/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
@@ -0,0 +1,55 @@
+From 3623f8536c05339c10b55ee13d703c6ac7085332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 08:19:09 +0200
+Subject: drm/sti: do not remove the drm_bridge that was never added
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ]
+
+Removing the drm_bridge_remove call should avoid a NULL dereference
+during list processing in drm_bridge_remove if the error path is ever
+taken.
+
+The more natural approach would perhaps be to add a drm_bridge_add,
+but there are several other bridges that never call drm_bridge_add.
+Just removing the drm_bridge_remove is the easier fix.
+
+Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sti/sti_hda.c  | 1 -
+ drivers/gpu/drm/sti/sti_hdmi.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index e7c243f708702..08808e3701de9 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -740,7 +740,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
+ 	return 0;
+ 
+ err_sysfs:
+-	drm_bridge_remove(bridge);
+ 	return -EINVAL;
+ }
+ 
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index 376b0763c874a..a5412a6fbeca2 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -1352,7 +1352,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
+ 	return 0;
+ 
+ err_sysfs:
+-	drm_bridge_remove(bridge);
+ 	hdmi->drm_connector = NULL;
+ 	return -EINVAL;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch b/queue-4.9/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
new file mode 100644
index 00000000000..b740127b4ca
--- /dev/null
+++ b/queue-4.9/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
@@ -0,0 +1,55 @@
+From c9912b3d72b39e1cb63c569f483db8040c8d924e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 12:42:50 +0300
+Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]
+
+This doesn't affect runtime because in the current code "idx" is always
+valid.
+
+First, we read from "vgdev->capsets[idx].max_size" before checking
+whether "idx" is within bounds.  And secondly the bounds check is off by
+one so we could end up reading one element beyond the end of the
+vgdev->capsets[] array.
+
+Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index a1b3ea1ccb65b..772a5a3b0ce1a 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -681,11 +681,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ 	struct virtio_gpu_get_capset *cmd_p;
+ 	struct virtio_gpu_vbuffer *vbuf;
+-	int max_size = vgdev->capsets[idx].max_size;
++	int max_size;
+ 	struct virtio_gpu_drv_cap_cache *cache_ent;
+ 	void *resp_buf;
+ 
+-	if (idx > vgdev->num_capsets)
++	if (idx >= vgdev->num_capsets)
+ 		return -EINVAL;
+ 
+ 	if (version > vgdev->capsets[idx].max_version)
+@@ -695,6 +695,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ 	if (!cache_ent)
+ 		return -ENOMEM;
+ 
++	max_size = vgdev->capsets[idx].max_size;
+ 	cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ 	if (!cache_ent->caps_cache) {
+ 		kfree(cache_ent);
+-- 
+2.20.1
+
diff --git a/queue-4.9/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch b/queue-4.9/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
new file mode 100644
index 00000000000..45e0b174eeb
--- /dev/null
+++ b/queue-4.9/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
@@ -0,0 +1,38 @@
+From d7b2c73990c9240b4e36a3153300e929be381d5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 15:47:59 +0800
+Subject: ehea: Fix a copy-paste err in ehea_init_port_res
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]
+
+pr->tx_bytes should be assigned to tx_bytes other than
+rx_bytes.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: ce45b873028f ("ehea: Fixing statistics")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 2dd17e01e3a7a..3692adb8902d1 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1476,7 +1476,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
+ 
+ 	memset(pr, 0, sizeof(struct ehea_port_res));
+ 
+-	pr->tx_bytes = rx_bytes;
++	pr->tx_bytes = tx_bytes;
+ 	pr->tx_packets = tx_packets;
+ 	pr->rx_bytes = rx_bytes;
+ 	pr->rx_packets = rx_packets;
+-- 
+2.20.1
+
diff --git a/queue-4.9/exportfs-fix-passing-zero-to-err_ptr-warning.patch b/queue-4.9/exportfs-fix-passing-zero-to-err_ptr-warning.patch
new file mode 100644
index 00000000000..09c4d3dfad5
--- /dev/null
+++ b/queue-4.9/exportfs-fix-passing-zero-to-err_ptr-warning.patch
@@ -0,0 +1,38 @@
+From 7886129c73a22f36a40a77df5a6a18b65c83d119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 11:32:41 +0800
+Subject: exportfs: fix 'passing zero to ERR_PTR()' warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]
+
+Fix a static code checker warning:
+  fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'
+
+The error path for lookup_one_len_unlocked failure
+should set err to PTR_ERR.
+
+Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exportfs/expfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 3706939e5dd5e..1730122b10e06 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -146,6 +146,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
+ 	tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
+ 	if (IS_ERR(tmp)) {
+ 		dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
++		err = PTR_ERR(tmp);
+ 		goto out_err;
+ 	}
+ 	if (tmp != dentry) {
+-- 
+2.20.1
+
diff --git a/queue-4.9/ext4-set-error-return-correctly-when-ext4_htree_stor.patch b/queue-4.9/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
new file mode 100644
index 00000000000..62408ec4a51
--- /dev/null
+++ b/queue-4.9/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
@@ -0,0 +1,39 @@
+From c9a484c8fa02c1cefc9557476a8211d7c0963263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 14:29:38 -0400
+Subject: ext4: set error return correctly when ext4_htree_store_dirent fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ]
+
+Currently when the call to ext4_htree_store_dirent fails the error return
+variable 'ret' is is not being set to the error code and variable count is
+instead, hence the error code is not being returned.  Fix this by assigning
+ret to the error return code.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 9a13f86fed626..4df4d31057b36 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1417,7 +1417,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
+ 		err = ext4_htree_store_dirent(dir_file, hinfo->hash,
+ 					      hinfo->minor_hash, de, &tmp_str);
+ 		if (err) {
+-			count = err;
++			ret = err;
+ 			goto out;
+ 		}
+ 		count++;
+-- 
+2.20.1
+
diff --git a/queue-4.9/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch b/queue-4.9/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
new file mode 100644
index 00000000000..85669f065da
--- /dev/null
+++ b/queue-4.9/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
@@ -0,0 +1,51 @@
+From 05ca619c50124d308d03faaf5aed321bbce6dfa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Feb 2019 19:24:45 +0100
+Subject: fbdev: chipsfb: remove set but not used variable 'size'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
+drivers/video/fbdev/chipsfb.c:352:22: warning:
+ variable 'size' set but not used [-Wunused-but-set-variable]
+
+Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+[b.zolnierkie: minor commit summary and description fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/chipsfb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index 59abdc6a97f66..314b7eceb81c5 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
+ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ {
+ 	struct fb_info *p;
+-	unsigned long addr, size;
++	unsigned long addr;
+ 	unsigned short cmd;
+ 	int rc = -ENODEV;
+ 
+@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ 	if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
+ 		goto err_disable;
+ 	addr = pci_resource_start(dp, 0);
+-	size = pci_resource_len(dp, 0);
+ 	if (addr == 0)
+ 		goto err_disable;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch b/queue-4.9/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
new file mode 100644
index 00000000000..c6271c8546b
--- /dev/null
+++ b/queue-4.9/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
@@ -0,0 +1,38 @@
+From 65b0b9e394352573196271d22cde660fb8c7b593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 07:58:38 -0600
+Subject: fs/nfs: Fix nfs_parse_devname to not modify it's argument
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]
+
+In the rare and unsupported case of a hostname list nfs_parse_devname
+will modify dev_name.  There is no need to modify dev_name as the all
+that is being computed is the length of the hostname, so the computed
+length can just be shorted.
+
+Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 42c31587a936c..4c21e572f2d9e 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1928,7 +1928,7 @@ static int nfs_parse_devname(const char *dev_name,
+ 		/* kill possible hostname list: not supported */
+ 		comma = strchr(dev_name, ',');
+ 		if (comma != NULL && comma < end)
+-			*comma = 0;
++			len = comma - dev_name;
+ 	}
+ 
+ 	if (len > maxnamlen)
+-- 
+2.20.1
+
diff --git a/queue-4.9/hwmon-lm75-fix-write-operations-for-negative-tempera.patch b/queue-4.9/hwmon-lm75-fix-write-operations-for-negative-tempera.patch
new file mode 100644
index 00000000000..52064bc6381
--- /dev/null
+++ b/queue-4.9/hwmon-lm75-fix-write-operations-for-negative-tempera.patch
@@ -0,0 +1,40 @@
+From de22c4d8f70b4a4c7f059872eac515e59bac0e54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 12:00:18 -0700
+Subject: hwmon: (lm75) Fix write operations for negative temperatures
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 7d82fcc9d9e81241778aaa22fda7be753e237d86 ]
+
+Writes into limit registers fail if the temperature written is negative.
+The regmap write operation checks the value range, regmap_write accepts
+an unsigned int as parameter, and the temperature value passed to
+regmap_write is kept in a variable declared as long. Negative values
+are converted large unsigned integers, which fails the range check.
+Fix by type casting the temperature to u16 when calling regmap_write().
+
+Cc: Iker Perez del Palomar Sustatxa <iker.perez@codethink.co.uk>
+Fixes: e65365fed87f ("hwmon: (lm75) Convert to use regmap")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm75.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
+index eff3b24d84737..fc31669a86ba8 100644
+--- a/drivers/hwmon/lm75.c
++++ b/drivers/hwmon/lm75.c
+@@ -164,7 +164,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type,
+ 	temp = DIV_ROUND_CLOSEST(temp  << (resolution - 8),
+ 				 1000) << (16 - resolution);
+ 
+-	return regmap_write(data->regmap, reg, temp);
++	return regmap_write(data->regmap, reg, (u16)temp);
+ }
+ 
+ static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type,
+-- 
+2.20.1
+
diff --git a/queue-4.9/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch b/queue-4.9/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
new file mode 100644
index 00000000000..3d2824c0da6
--- /dev/null
+++ b/queue-4.9/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
@@ -0,0 +1,39 @@
+From 25611b8cf7065b3bb4d1e17bf3bb48cff0f539e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 01:45:54 +0000
+Subject: hwmon: (shtc1) fix shtc1 and shtw1 id mask
+
+From: Dan Robertson <dan@dlrobertson.com>
+
+[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ]
+
+Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to
+retrieve the chip ID from the ID register. See section 5.7 of the shtw1
+or shtc1 datasheet for details.
+
+Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor")
+Signed-off-by: Dan Robertson <dan@dlrobertson.com>
+Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com
+[groeck: Reordered to be first in series and adjusted accordingly]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/shtc1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
+index decd7df995abf..2a18539591eaf 100644
+--- a/drivers/hwmon/shtc1.c
++++ b/drivers/hwmon/shtc1.c
+@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[]	       = { 0xef, 0xc8 };
+ 
+ /* constants for reading the ID register */
+ #define SHTC1_ID	  0x07
+-#define SHTC1_ID_REG_MASK 0x1f
++#define SHTC1_ID_REG_MASK 0x3f
+ 
+ /* delays for non-blocking i2c commands, both in us */
+ #define SHTC1_NONBLOCKING_WAIT_TIME_HPM  14400
+-- 
+2.20.1
+
diff --git a/queue-4.9/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch b/queue-4.9/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
new file mode 100644
index 00000000000..bbe34a1e7af
--- /dev/null
+++ b/queue-4.9/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
@@ -0,0 +1,121 @@
+From e7093a55ecf24f575eeaef1bbf277a6f5a5d55c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Apr 2019 08:44:41 -0700
+Subject: hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 721295b9a0517..43c0f89cefdf0 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
+ 	outb(ld,  sio->sioaddr + 1);
+ }
+ 
+-static inline void
++static inline int
+ superio_enter(struct w83627hf_sio_data *sio)
+ {
++	if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
++		return -EBUSY;
++
+ 	outb(0x87, sio->sioaddr);
+ 	outb(0x87, sio->sioaddr);
++
++	return 0;
+ }
+ 
+ static inline void
+ superio_exit(struct w83627hf_sio_data *sio)
+ {
+ 	outb(0xAA, sio->sioaddr);
++	release_region(sio->sioaddr, 2);
+ }
+ 
+ #define W627_DEVID 0x52
+@@ -1275,7 +1281,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
+ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ 				struct w83627hf_sio_data *sio_data)
+ {
+-	int err = -ENODEV;
++	int err;
+ 	u16 val;
+ 
+ 	static __initconst char *const names[] = {
+@@ -1287,7 +1293,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ 	};
+ 
+ 	sio_data->sioaddr = sioaddr;
+-	superio_enter(sio_data);
++	err = superio_enter(sio_data);
++	if (err)
++		return err;
++
++	err = -ENODEV;
+ 	val = force_id ? force_id : superio_inb(sio_data, DEVID);
+ 	switch (val) {
+ 	case W627_DEVID:
+@@ -1641,9 +1651,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
+ 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ 	int res = 0xff, sel;
+ 
+-	superio_enter(sio_data);
++	if (superio_enter(sio_data)) {
++		/*
++		 * Some other driver reserved the address space for itself.
++		 * We don't want to fail driver instantiation because of that,
++		 * so display a warning and keep going.
++		 */
++		dev_warn(&pdev->dev,
++			 "Can not read VID data: Failed to enable SuperIO access\n");
++		return res;
++	}
++
+ 	superio_select(sio_data, W83627HF_LD_GPIO5);
+ 
++	res = 0xff;
++
+ 	/* Make sure these GPIO pins are enabled */
+ 	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
+ 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
+@@ -1674,7 +1696,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
+ 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ 	int res = 0xff;
+ 
+-	superio_enter(sio_data);
++	if (superio_enter(sio_data)) {
++		/*
++		 * Some other driver reserved the address space for itself.
++		 * We don't want to fail driver instantiation because of that,
++		 * so display a warning and keep going.
++		 */
++		dev_warn(&pdev->dev,
++			 "Can not read VID data: Failed to enable SuperIO access\n");
++		return res;
++	}
++
+ 	superio_select(sio_data, W83627HF_LD_HWM);
+ 
+ 	/* Make sure these GPIO pins are enabled */
+-- 
+2.20.1
+
diff --git a/queue-4.9/ib-iser-fix-dma_nents-type-definition.patch b/queue-4.9/ib-iser-fix-dma_nents-type-definition.patch
new file mode 100644
index 00000000000..55355c31446
--- /dev/null
+++ b/queue-4.9/ib-iser-fix-dma_nents-type-definition.patch
@@ -0,0 +1,41 @@
+From e1e8b2e1c0dfc9ce149676414cc2831c7eab34cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 12:22:11 +0200
+Subject: IB/iser: Fix dma_nents type definition
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit c1545f1a200f4adc4ef8dd534bf33e2f1aa22c2f ]
+
+The retured value from ib_dma_map_sg saved in dma_nents variable. To avoid
+future mismatch between types, define dma_nents as an integer instead of
+unsigned.
+
+Fixes: 57b26497fabe ("IB/iser: Pass the correct number of entries for dma mapped SGL")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Israel Rukshin <israelr@mellanox.com>
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index cb48e22afff72..a3614f7f00073 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -197,7 +197,7 @@ struct iser_data_buf {
+ 	struct scatterlist *sg;
+ 	int                size;
+ 	unsigned long      data_len;
+-	unsigned int       dma_nents;
++	int                dma_nents;
+ };
+ 
+ /* fwd declarations */
+-- 
+2.20.1
+
diff --git a/queue-4.9/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch b/queue-4.9/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
new file mode 100644
index 00000000000..574c740c49a
--- /dev/null
+++ b/queue-4.9/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
@@ -0,0 +1,61 @@
+From d1ea46319823b1724aa7e1d175e64f8ff50015c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 15:45:45 +0000
+Subject: IB/iser: Pass the correct number of entries for dma mapped SGL
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ]
+
+ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may
+change the number of entries and the lengths of each entry.
+
+Code that touches dma_address is iterating over the 'dma mapped SGL' and
+must use dma_nents which returned from ib_dma_map_sg().
+
+ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use
+dma_nents.
+
+Fixes: 39405885005a ("IB/iser: Port to new fast registration API")
+Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 9c3e9ab53a415..759c2fe033e71 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
+ 	page_vec->npages = 0;
+ 	page_vec->fake_mr.page_size = SIZE_4K;
+ 	plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
+-			      mem->size, NULL, iser_set_page);
+-	if (unlikely(plen < mem->size)) {
++			      mem->dma_nents, NULL, iser_set_page);
++	if (unlikely(plen < mem->dma_nents)) {
+ 		iser_err("page vec too short to hold this SG\n");
+ 		iser_data_buf_dump(mem, device->ib_device);
+ 		iser_dump_page_vec(page_vec);
+@@ -450,10 +450,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+ 
+ 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+ 
+-	n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
+-	if (unlikely(n != mem->size)) {
++	n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
++	if (unlikely(n != mem->dma_nents)) {
+ 		iser_err("failed to map sg (%d/%d)\n",
+-			 n, mem->size);
++			 n, mem->dma_nents);
+ 		return n < 0 ? n : -EINVAL;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch b/queue-4.9/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
new file mode 100644
index 00000000000..041966e5099
--- /dev/null
+++ b/queue-4.9/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
@@ -0,0 +1,90 @@
+From d089f8f68f85118a3f559320707a6dd145dc98f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 08:38:30 +0300
+Subject: IB/mlx5: Add missing XRC options to QP optional params mask
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]
+
+The QP transition optional parameters for the various transition for XRC
+QPs are identical to those for RC QPs.
+
+Many of the XRC QP transition optional parameter bits are missing from the
+QP optional mask table.  These omissions caused failures when doing XRC QP
+state transitions.
+
+For example, when trying to change the response timer of an XRC receive QP
+via the RTS2RTS transition, the new timer value was ignored because
+MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
+for XRC qps for the RTS2RTS transition.
+
+Fix this by adding the missing XRC optional parameters for all QP
+transitions to the opt_mask table.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index a7bc89f5dae7e..4d906a7904818 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2324,6 +2324,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX	|
+ 					  MLX5_QP_OPTPAR_Q_KEY		|
+ 					  MLX5_QP_OPTPAR_PRI_PORT,
++			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
++					  MLX5_QP_OPTPAR_RAE		|
++					  MLX5_QP_OPTPAR_RWE		|
++					  MLX5_QP_OPTPAR_PKEY_INDEX	|
++					  MLX5_QP_OPTPAR_PRI_PORT,
+ 		},
+ 		[MLX5_QP_STATE_RTR] = {
+ 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
+@@ -2357,6 +2362,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 					  MLX5_QP_OPTPAR_RWE		|
+ 					  MLX5_QP_OPTPAR_PM_STATE,
+ 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
++			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
++					  MLX5_QP_OPTPAR_RRE		|
++					  MLX5_QP_OPTPAR_RAE		|
++					  MLX5_QP_OPTPAR_RWE		|
++					  MLX5_QP_OPTPAR_PM_STATE	|
++					  MLX5_QP_OPTPAR_RNR_TIMEOUT,
+ 		},
+ 	},
+ 	[MLX5_QP_STATE_RTS] = {
+@@ -2373,6 +2384,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY		|
+ 					  MLX5_QP_OPTPAR_SRQN		|
+ 					  MLX5_QP_OPTPAR_CQN_RCV,
++			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
++					  MLX5_QP_OPTPAR_RAE		|
++					  MLX5_QP_OPTPAR_RWE		|
++					  MLX5_QP_OPTPAR_RNR_TIMEOUT	|
++					  MLX5_QP_OPTPAR_PM_STATE	|
++					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
+ 		},
+ 	},
+ 	[MLX5_QP_STATE_SQER] = {
+@@ -2384,6 +2401,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 					   MLX5_QP_OPTPAR_RWE		|
+ 					   MLX5_QP_OPTPAR_RAE		|
+ 					   MLX5_QP_OPTPAR_RRE,
++			[MLX5_QP_ST_XRC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT	|
++					   MLX5_QP_OPTPAR_RWE		|
++					   MLX5_QP_OPTPAR_RAE		|
++					   MLX5_QP_OPTPAR_RRE,
+ 		},
+ 	},
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.9/ib-rxe-replace-kvfree-with-vfree.patch b/queue-4.9/ib-rxe-replace-kvfree-with-vfree.patch
new file mode 100644
index 00000000000..3879311bad1
--- /dev/null
+++ b/queue-4.9/ib-rxe-replace-kvfree-with-vfree.patch
@@ -0,0 +1,77 @@
+From d0924f63e3a539ea90b20d6fd7d5c1f6dd5b5070 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 01:57:42 -0400
+Subject: IB/rxe: replace kvfree with vfree
+
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+
+[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ]
+
+The buf is allocated by vmalloc_user in the function rxe_queue_init.
+So it is better to free it by vfree.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index e5e6a5e7dee9c..5ac88412f1ffe 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -30,7 +30,7 @@
+  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  * SOFTWARE.
+  */
+-
++#include <linux/vmalloc.h>
+ #include "rxe.h"
+ #include "rxe_loc.h"
+ #include "rxe_queue.h"
+@@ -89,7 +89,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ 	err = do_mmap_info(rxe, udata, false, context, cq->queue->buf,
+ 			   cq->queue->buf_size, &cq->queue->ip);
+ 	if (err) {
+-		kvfree(cq->queue->buf);
++		vfree(cq->queue->buf);
+ 		kfree(cq->queue);
+ 		return err;
+ 	}
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index 44b2108253bd9..d6672127808b7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -34,6 +34,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/delay.h>
+ #include <linux/sched.h>
++#include <linux/vmalloc.h>
+ 
+ #include "rxe.h"
+ #include "rxe_loc.h"
+@@ -255,7 +256,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ 			   qp->sq.queue->buf_size, &qp->sq.queue->ip);
+ 
+ 	if (err) {
+-		kvfree(qp->sq.queue->buf);
++		vfree(qp->sq.queue->buf);
+ 		kfree(qp->sq.queue);
+ 		return err;
+ 	}
+@@ -312,7 +313,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ 				   qp->rq.queue->buf_size,
+ 				   &qp->rq.queue->ip);
+ 		if (err) {
+-			kvfree(qp->rq.queue->buf);
++			vfree(qp->rq.queue->buf);
+ 			kfree(qp->rq.queue);
+ 			return err;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.9/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch b/queue-4.9/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
new file mode 100644
index 00000000000..0237569ec3f
--- /dev/null
+++ b/queue-4.9/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
@@ -0,0 +1,37 @@
+From 7413b7379ae63a8733abb06c4a56ac16c9f2cd58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:54 +0200
+Subject: IB/usnic: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index a5bfbba6bbac0..cacb720f44a02 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -425,7 +425,7 @@ int usnic_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
+ int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+ 				u16 *pkey)
+ {
+-	if (index > 1)
++	if (index > 0)
+ 		return -EINVAL;
+ 
+ 	*pkey = 0xffff;
+-- 
+2.20.1
+
diff --git a/queue-4.9/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch b/queue-4.9/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
new file mode 100644
index 00000000000..45f06c0d4f5
--- /dev/null
+++ b/queue-4.9/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
@@ -0,0 +1,39 @@
+From d01ce74f48c05dd64371e6ffe6cd597deece31d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 12:58:46 +0100
+Subject: iio: dac: ad5380: fix incorrect assignment to val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ]
+
+Currently the pointer val is being incorrectly incremented
+instead of the value pointed to by val. Fix this by adding
+in the missing * indirection operator.
+
+Addresses-Coverity: ("Unused value")
+Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/ad5380.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
+index 97d2c5111f438..8bf7fc626a9d4 100644
+--- a/drivers/iio/dac/ad5380.c
++++ b/drivers/iio/dac/ad5380.c
+@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
+ 		if (ret)
+ 			return ret;
+ 		*val >>= chan->scan_type.shift;
+-		val -= (1 << chan->scan_type.realbits) / 2;
++		*val -= (1 << chan->scan_type.realbits) / 2;
+ 		return IIO_VAL_INT;
+ 	case IIO_CHAN_INFO_SCALE:
+ 		*val = 2 * st->vref;
+-- 
+2.20.1
+
diff --git a/queue-4.9/inet-frags-call-inet_frags_fini-after-unregister_per.patch b/queue-4.9/inet-frags-call-inet_frags_fini-after-unregister_per.patch
new file mode 100644
index 00000000000..8c8037ae524
--- /dev/null
+++ b/queue-4.9/inet-frags-call-inet_frags_fini-after-unregister_per.patch
@@ -0,0 +1,56 @@
+From d821864061c6b6f2b656488e2239b6414c837cae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 16:56:48 -0700
+Subject: inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]
+
+Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.
+
+inet_frags_fini() is dismantling a kmem_cache, that might be needed
+later when unregister_pernet_subsys() eventually has to remove
+frags queues from hash tables and free them.
+
+This fixes potential use-after-free, and is a prereq for the following patch.
+
+Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ieee802154/6lowpan/reassembly.c | 2 +-
+ net/ipv6/reassembly.c               | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
+index c01df341b5f64..5936bfafb1c43 100644
+--- a/net/ieee802154/6lowpan/reassembly.c
++++ b/net/ieee802154/6lowpan/reassembly.c
+@@ -633,7 +633,7 @@ err_sysctl:
+ 
+ void lowpan_net_frag_exit(void)
+ {
+-	inet_frags_fini(&lowpan_frags);
+ 	lowpan_frags_sysctl_unregister();
+ 	unregister_pernet_subsys(&lowpan_frags_ops);
++	inet_frags_fini(&lowpan_frags);
+ }
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 4aed9c45a91ad..3f488555999e3 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -592,8 +592,8 @@ err_protocol:
+ 
+ void ipv6_frag_exit(void)
+ {
+-	inet_frags_fini(&ip6_frags);
+ 	ip6_frags_sysctl_unregister();
+ 	unregister_pernet_subsys(&ip6_frags_ops);
+ 	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
++	inet_frags_fini(&ip6_frags);
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch b/queue-4.9/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
new file mode 100644
index 00000000000..52d17a489c3
--- /dev/null
+++ b/queue-4.9/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
@@ -0,0 +1,35 @@
+From 9b8f4017655d1f790a3907f4f8878902688458d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:38:30 -0800
+Subject: Input: nomadik-ske-keypad - fix a loop timeout test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]
+
+The loop exits with "timeout" set to -1 not to 0.
+
+Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
+index 8567ee47761e1..ae3b045570740 100644
+--- a/drivers/input/keyboard/nomadik-ske-keypad.c
++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
+@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
+ 	while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
+ 		cpu_relax();
+ 
+-	if (!timeout)
++	if (timeout == -1)
+ 		return -EINVAL;
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-4.9/iommu-amd-make-iommu_disable-safer.patch b/queue-4.9/iommu-amd-make-iommu_disable-safer.patch
new file mode 100644
index 00000000000..92dffac73d5
--- /dev/null
+++ b/queue-4.9/iommu-amd-make-iommu_disable-safer.patch
@@ -0,0 +1,40 @@
+From 5cfff40b090b254d92fa07c820f1beebaf9d23d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 14:52:03 -0700
+Subject: iommu/amd: Make iommu_disable safer
+
+From: Kevin Mitchell <kevmitch@arista.com>
+
+[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ]
+
+Make it safe to call iommu_disable during early init error conditions
+before mmio_base is set, but after the struct amd_iommu has been added
+to the amd_iommu_list. For example, this happens if firmware fails to
+fill in mmio_phys in the ACPI table leading to a NULL pointer
+dereference in iommu_feature_disable.
+
+Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 9bb8d64b6f947..c113e46fdc3ab 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -383,6 +383,9 @@ static void iommu_enable(struct amd_iommu *iommu)
+ 
+ static void iommu_disable(struct amd_iommu *iommu)
+ {
++	if (!iommu->mmio_base)
++		return;
++
+ 	/* Disable command buffer */
+ 	iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch b/queue-4.9/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
new file mode 100644
index 00000000000..0d7ca956bcf
--- /dev/null
+++ b/queue-4.9/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
@@ -0,0 +1,37 @@
+From f0e227a835d4a9354707d3a2c87a4d674489e2a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 19:49:21 +0200
+Subject: iommu/amd: Wait for completion of IOTLB flush in attach_device
+
+From: Filippo Sironi <sironi@amazon.de>
+
+[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ]
+
+To make sure the domain tlb flush completes before the
+function returns, explicitly wait for its completion.
+
+Signed-off-by: Filippo Sironi <sironi@amazon.de>
+Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device")
+[joro: Added commit message and fixes tag]
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index c898c70472bb2..bb0448c91f672 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2113,6 +2113,8 @@ skip_ats_check:
+ 	 */
+ 	domain_flush_tlb_pde(domain);
+ 
++	domain_flush_complete(domain);
++
+ 	return ret;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/iommu-use-right-function-to-get-group-for-device.patch b/queue-4.9/iommu-use-right-function-to-get-group-for-device.patch
new file mode 100644
index 00000000000..4d3f83431c5
--- /dev/null
+++ b/queue-4.9/iommu-use-right-function-to-get-group-for-device.patch
@@ -0,0 +1,42 @@
+From 383699c33901b35a84cd291b00df184d53c6c4b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 15:27:35 +0800
+Subject: iommu: Use right function to get group for device
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ]
+
+The iommu_group_get_for_dev() will allocate a group for a
+device if it isn't in any group. This isn't the use case
+in iommu_request_dm_for_dev(). Let's use iommu_group_get()
+instead.
+
+Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 71b89e47e9521..dbcc13efaf3c8 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -1582,9 +1582,9 @@ int iommu_request_dm_for_dev(struct device *dev)
+ 	int ret;
+ 
+ 	/* Device must already be in a group before calling this function */
+-	group = iommu_group_get_for_dev(dev);
+-	if (IS_ERR(group))
+-		return PTR_ERR(group);
++	group = iommu_group_get(dev);
++	if (!group)
++		return -EINVAL;
+ 
+ 	mutex_lock(&group->mutex);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch b/queue-4.9/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
new file mode 100644
index 00000000000..14294194022
--- /dev/null
+++ b/queue-4.9/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
@@ -0,0 +1,49 @@
+From 42ac14584e574e8297140e28571cf0bf952ca857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used.  This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 25cc6ae87039d..5c6e0a9fd2f36 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3345,9 +3345,12 @@ static int __init init_dmars(void)
+ 		iommu_identity_mapping |= IDENTMAP_ALL;
+ 
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+-	iommu_identity_mapping |= IDENTMAP_GFX;
++	dmar_map_gfx = 0;
+ #endif
+ 
++	if (!dmar_map_gfx)
++		iommu_identity_mapping |= IDENTMAP_GFX;
++
+ 	check_tylersburg_isoch();
+ 
+ 	if (iommu_identity_mapping) {
+-- 
+2.20.1
+
diff --git a/queue-4.9/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch b/queue-4.9/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
new file mode 100644
index 00000000000..69bf52f87e1
--- /dev/null
+++ b/queue-4.9/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
@@ -0,0 +1,46 @@
+From dfd1425efa5f539699ad9ab74e8dd975a0c76e16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 12:44:53 -0800
+Subject: iw_cxgb4: use tos when finding ipv6 routes
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ]
+
+When IPv6 support was added, the correct tos was not passed to
+cxgb_find_route6(). This potentially results in the wrong route entry.
+
+Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index a29fe11d688a5..a04a53acb24ff 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2135,7 +2135,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
+ 					   laddr6->sin6_addr.s6_addr,
+ 					   raddr6->sin6_addr.s6_addr,
+ 					   laddr6->sin6_port,
+-					   raddr6->sin6_port, 0,
++					   raddr6->sin6_port,
++					   ep->com.cm_id->tos,
+ 					   raddr6->sin6_scope_id);
+ 		iptype = 6;
+ 		ra = (__u8 *)&raddr6->sin6_addr;
+@@ -3278,7 +3279,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ 					   laddr6->sin6_addr.s6_addr,
+ 					   raddr6->sin6_addr.s6_addr,
+ 					   laddr6->sin6_port,
+-					   raddr6->sin6_port, 0,
++					   raddr6->sin6_port, cm_id->tos,
+ 					   raddr6->sin6_scope_id);
+ 	}
+ 	if (!ep->dst) {
+-- 
+2.20.1
+
diff --git a/queue-4.9/iw_cxgb4-use-tos-when-importing-the-endpoint.patch b/queue-4.9/iw_cxgb4-use-tos-when-importing-the-endpoint.patch
new file mode 100644
index 00000000000..00165d0a63a
--- /dev/null
+++ b/queue-4.9/iw_cxgb4-use-tos-when-importing-the-endpoint.patch
@@ -0,0 +1,35 @@
+From 1c30a2c924eef3c80f82c4649026bb6566017030 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 12:44:41 -0800
+Subject: iw_cxgb4: use tos when importing the endpoint
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ]
+
+import_ep() is passed the correct tos, but doesn't use it correctly.
+
+Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 605d50ad123cc..a29fe11d688a5 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2044,7 +2044,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
+ 	} else {
+ 		pdev = get_real_dev(n->dev);
+ 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
+-					n, pdev, 0);
++					n, pdev, rt_tos2priority(tos));
+ 		if (!ep->l2t)
+ 			goto out;
+ 		ep->mtu = dst_mtu(dst);
+-- 
+2.20.1
+
diff --git a/queue-4.9/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch b/queue-4.9/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
new file mode 100644
index 00000000000..5ba52bb591b
--- /dev/null
+++ b/queue-4.9/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
@@ -0,0 +1,50 @@
+From f30ad07418cdaf767c8d3c83d05c9bfaabf698dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 09:51:56 +0100
+Subject: iwlwifi: mvm: fix A-MPDU reference assignment
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ]
+
+The current code assigns the reference, and then goes to increment
+it if the toggle bit has changed. That way, we get
+
+Toggle  0  0  0  0  1  1  1  1
+ID      1  1  1  1  1  2  2  2
+
+Fix that by assigning the post-toggle ID to get
+
+Toggle  0  0  0  0  1  1  1  1
+ID      1  1  1  1  2  2  2  2
+
+Reported-by: Danny Alexander <danny.alexander@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index c2bbc8c17beb9..bc06d87a0106c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -810,12 +810,12 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ 		bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
+ 
+ 		rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
+-		rx_status->ampdu_reference = mvm->ampdu_ref;
+ 		/* toggle is switched whenever new aggregation starts */
+ 		if (toggle_bit != mvm->ampdu_toggle) {
+ 			mvm->ampdu_ref++;
+ 			mvm->ampdu_toggle = toggle_bit;
+ 		}
++		rx_status->ampdu_reference = mvm->ampdu_ref;
+ 	}
+ 
+ 	rcu_read_lock();
+-- 
+2.20.1
+
diff --git a/queue-4.9/iwlwifi-mvm-fix-rss-config-command.patch b/queue-4.9/iwlwifi-mvm-fix-rss-config-command.patch
new file mode 100644
index 00000000000..56569a3d377
--- /dev/null
+++ b/queue-4.9/iwlwifi-mvm-fix-rss-config-command.patch
@@ -0,0 +1,46 @@
+From 7a756774b64b125b6141e4e79e6e96774d3a63ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 09:45:11 +0200
+Subject: iwlwifi: mvm: fix RSS config command
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ]
+
+The hash mask is a bitmap, so we should use BIT() on
+the enum values.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 2ec3a91a0f6b6..bba7ace1a744d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -106,12 +106,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
+ 	int i;
+ 	struct iwl_rss_config_cmd cmd = {
+ 		.flags = cpu_to_le32(IWL_RSS_ENABLE),
+-		.hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
+-			     IWL_RSS_HASH_TYPE_IPV4_UDP |
+-			     IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
+-			     IWL_RSS_HASH_TYPE_IPV6_TCP |
+-			     IWL_RSS_HASH_TYPE_IPV6_UDP |
+-			     IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
++		.hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
+ 	};
+ 
+ 	if (mvm->trans->num_rx_queues == 1)
+-- 
+2.20.1
+
diff --git a/queue-4.9/jfs-fix-bogus-variable-self-initialization.patch b/queue-4.9/jfs-fix-bogus-variable-self-initialization.patch
new file mode 100644
index 00000000000..0565408447d
--- /dev/null
+++ b/queue-4.9/jfs-fix-bogus-variable-self-initialization.patch
@@ -0,0 +1,45 @@
+From c7c2750f54b9f94a5ee8d18794c5d3a9c26209ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:19:16 +0100
+Subject: jfs: fix bogus variable self-initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]
+
+A statement was originally added in 2006 to shut up a gcc warning,
+now but now clang warns about it:
+
+fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
+      [-Werror,-Wuninitialized]
+                pxd_t pxd = pxd;        /* truncated extent of xad */
+                      ~~~   ^~~
+
+Modern versions of gcc are fine without the silly assignment, so just
+drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.
+
+Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index 4d973524c8879..224ef034004b7 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+ 	 * header ?
+ 	 */
+ 	if (tlck->type & tlckTRUNCATE) {
+-		/* This odd declaration suppresses a bogus gcc warning */
+-		pxd_t pxd = pxd;	/* truncated extent of xad */
++		pxd_t pxd;	/* truncated extent of xad */
+ 		int twm;
+ 
+ 		/*
+-- 
+2.20.1
+
diff --git a/queue-4.9/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch b/queue-4.9/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
new file mode 100644
index 00000000000..961e40f7a05
--- /dev/null
+++ b/queue-4.9/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
@@ -0,0 +1,38 @@
+From 4c975abe3236eb7b7d0a1c24e9b2d6022a3ae319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 15:50:18 +0300
+Subject: kdb: do a sanity check on the cpu in kdb_per_cpu()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]
+
+The "whichcpu" comes from argv[3].  The cpu_online() macro looks up the
+cpu in a bitmap of online cpus, but if the value is too high then it
+could read beyond the end of the bitmap and possibly Oops.
+
+Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/debug/kdb/kdb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 5a58421d7e2d7..a52a6da8c3d09 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2632,7 +2632,7 @@ static int kdb_per_cpu(int argc, const char **argv)
+ 		diag = kdbgetularg(argv[3], &whichcpu);
+ 		if (diag)
+ 			return diag;
+-		if (!cpu_online(whichcpu)) {
++		if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
+ 			kdb_printf("cpu %ld is not online\n", whichcpu);
+ 			return KDB_BADCPUNUM;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.9/keys-timestamp-new-keys.patch b/queue-4.9/keys-timestamp-new-keys.patch
new file mode 100644
index 00000000000..6c2d06e334b
--- /dev/null
+++ b/queue-4.9/keys-timestamp-new-keys.patch
@@ -0,0 +1,34 @@
+From 4e1bce39db0d6677f52ddc502a23cc3d0c6bd5a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Feb 2019 16:20:37 +0000
+Subject: keys: Timestamp new keys
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ]
+
+Set the timestamp on new keys rather than leaving it unset.
+
+Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/key.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 7276d1a009d49..280b4feccdc00 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -296,6 +296,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ 	key->gid = gid;
+ 	key->perm = perm;
+ 	key->restrict_link = restrict_link;
++	key->last_used_at = ktime_get_real_seconds();
+ 
+ 	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
+ 		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
+-- 
+2.20.1
+
diff --git a/queue-4.9/l2tp-fix-possible-null-pointer-dereference.patch b/queue-4.9/l2tp-fix-possible-null-pointer-dereference.patch
new file mode 100644
index 00000000000..43a77ebcbba
--- /dev/null
+++ b/queue-4.9/l2tp-fix-possible-null-pointer-dereference.patch
@@ -0,0 +1,92 @@
+From 765c5884c95c5d5b156d3cb61d911cee366c0014 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 22:44:04 +0800
+Subject: l2tp: Fix possible NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ]
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
+PGD 0 P4D 0
+Oops: 0000 [#1
+CPU: 0 PID: 5697 Comm: modprobe Tainted: G        W         5.1.0-rc7+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+RIP: 0010:__lock_acquire+0x53/0x10b0
+Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a
+RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002
+RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128
+RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
+R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000
+FS:  00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0
+Call Trace:
+ ? __lock_acquire+0x24e/0x10b0
+ lock_acquire+0xdf/0x230
+ ? flush_workqueue+0x71/0x530
+ flush_workqueue+0x97/0x530
+ ? flush_workqueue+0x71/0x530
+ l2tp_exit_net+0x170/0x2b0 [l2tp_core
+ ? l2tp_exit_net+0x93/0x2b0 [l2tp_core
+ ops_exit_list.isra.6+0x36/0x60
+ unregister_pernet_operations+0xb8/0x110
+ unregister_pernet_device+0x25/0x40
+ l2tp_init+0x55/0x1000 [l2tp_core
+ ? 0xffffffffa018d000
+ do_one_initcall+0x6c/0x3cc
+ ? do_init_module+0x22/0x1f1
+ ? rcu_read_lock_sched_held+0x97/0xb0
+ ? kmem_cache_alloc_trace+0x325/0x3b0
+ do_init_module+0x5b/0x1f1
+ load_module+0x1db1/0x2690
+ ? m_show+0x1d0/0x1d0
+ __do_sys_finit_module+0xc5/0xd0
+ __x64_sys_finit_module+0x15/0x20
+ do_syscall_64+0x6b/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x7fead031a839
+Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48
+RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839
+RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003
+RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80
+R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
+R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80
+Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core
+CR2: 0000000000000128
+---[ end trace 8322b2b8bf83f8e1
+
+If alloc_workqueue fails in l2tp_init, l2tp_net_ops
+is unregistered on failure path. Then l2tp_exit_net
+is called which will flush NULL workqueue, this patch
+add a NULL check to fix it.
+
+Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 4ae758bcb2cf4..394a1ddb07827 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1947,7 +1947,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
+ 	}
+ 	rcu_read_unlock_bh();
+ 
+-	flush_workqueue(l2tp_wq);
++	if (l2tp_wq)
++		flush_workqueue(l2tp_wq);
+ 	rcu_barrier();
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch b/queue-4.9/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
new file mode 100644
index 00000000000..a6d032e1bf5
--- /dev/null
+++ b/queue-4.9/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
@@ -0,0 +1,38 @@
+From 5693f160124a2bf7e83783677e30f648c43c0421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 22:42:18 +0800
+Subject: libertas_tf: Use correct channel range in lbtf_geo_init
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ]
+
+It seems we should use 'range' instead of 'priv->range'
+in lbtf_geo_init(), because 'range' is the corret one
+related to current regioncode.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas_tf/cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+index 909ac3685010f..2b193f1257a5a 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c
++++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
+ 			break;
+ 		}
+ 
+-	for (ch = priv->range.start; ch < priv->range.end; ch++)
++	for (ch = range->start; ch < range->end; ch++)
+ 		priv->channels[CHAN_TO_IDX(ch)].flags = 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch b/queue-4.9/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
new file mode 100644
index 00000000000..602a89b9acc
--- /dev/null
+++ b/queue-4.9/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
@@ -0,0 +1,196 @@
+From 5164a68109c378f6b85bbb0aca556b6d12316a24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:26 -0700
+Subject: llc: fix another potential sk_buff leak in llc_ui_sendmsg()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]
+
+All callers of llc_conn_state_process() except llc_build_and_send_pkt()
+(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
+consumes a reference to the skb.  Fix this caller to do the same.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/af_llc.c   | 34 ++++++++++++++++++++--------------
+ net/llc/llc_conn.c |  2 ++
+ net/llc/llc_if.c   | 12 ++++++++----
+ 3 files changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 789e66b0187a4..2a859f967c8af 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -111,22 +111,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+  *
+  *	Send data via reliable llc2 connection.
+  *	Returns 0 upon success, non-zero if action did not succeed.
++ *
++ *	This function always consumes a reference to the skb.
+  */
+ static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
+ {
+ 	struct llc_sock* llc = llc_sk(sk);
+-	int rc = 0;
+ 
+ 	if (unlikely(llc_data_accept_state(llc->state) ||
+ 		     llc->remote_busy_flag ||
+ 		     llc->p_flag)) {
+ 		long timeout = sock_sndtimeo(sk, noblock);
++		int rc;
+ 
+ 		rc = llc_ui_wait_for_busy_core(sk, timeout);
++		if (rc) {
++			kfree_skb(skb);
++			return rc;
++		}
+ 	}
+-	if (unlikely(!rc))
+-		rc = llc_build_and_send_pkt(sk, skb);
+-	return rc;
++	return llc_build_and_send_pkt(sk, skb);
+ }
+ 
+ static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
+@@ -896,7 +900,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
+ 	int flags = msg->msg_flags;
+ 	int noblock = flags & MSG_DONTWAIT;
+-	struct sk_buff *skb;
++	struct sk_buff *skb = NULL;
+ 	size_t size = 0;
+ 	int rc = -EINVAL, copied = 0, hdrlen;
+ 
+@@ -905,10 +909,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	lock_sock(sk);
+ 	if (addr) {
+ 		if (msg->msg_namelen < sizeof(*addr))
+-			goto release;
++			goto out;
+ 	} else {
+ 		if (llc_ui_addr_null(&llc->addr))
+-			goto release;
++			goto out;
+ 		addr = &llc->addr;
+ 	}
+ 	/* must bind connection to sap if user hasn't done it. */
+@@ -916,7 +920,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 		/* bind to sap with null dev, exclusive. */
+ 		rc = llc_ui_autobind(sock, addr);
+ 		if (rc)
+-			goto release;
++			goto out;
+ 	}
+ 	hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
+ 	size = hdrlen + len;
+@@ -925,12 +929,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	copied = size - hdrlen;
+ 	rc = -EINVAL;
+ 	if (copied < 0)
+-		goto release;
++		goto out;
+ 	release_sock(sk);
+ 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
+ 	lock_sock(sk);
+ 	if (!skb)
+-		goto release;
++		goto out;
+ 	skb->dev      = llc->dev;
+ 	skb->protocol = llc_proto_type(addr->sllc_arphrd);
+ 	skb_reserve(skb, hdrlen);
+@@ -940,29 +944,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
+ 		llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
+ 					  addr->sllc_sap);
++		skb = NULL;
+ 		goto out;
+ 	}
+ 	if (addr->sllc_test) {
+ 		llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
+ 					    addr->sllc_sap);
++		skb = NULL;
+ 		goto out;
+ 	}
+ 	if (addr->sllc_xid) {
+ 		llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
+ 					   addr->sllc_sap);
++		skb = NULL;
+ 		goto out;
+ 	}
+ 	rc = -ENOPROTOOPT;
+ 	if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
+ 		goto out;
+ 	rc = llc_ui_send_data(sk, skb, noblock);
++	skb = NULL;
+ out:
+-	if (rc) {
+-		kfree_skb(skb);
+-release:
++	kfree_skb(skb);
++	if (rc)
+ 		dprintk("%s: failed sending from %02X to %02X: %d\n",
+ 			__func__, llc->laddr.lsap, llc->daddr.lsap, rc);
+-	}
+ 	release_sock(sk);
+ 	return rc ? : copied;
+ }
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 94c78cc49d3e0..2689e95471dc4 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
+  *	(executing it's actions and changing state), upper layer will be
+  *	indicated or confirmed, if needed. Returns 0 for success, 1 for
+  *	failure. The socket lock has to be held before calling this function.
++ *
++ *	This function always consumes a reference to the skb.
+  */
+ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ {
+diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
+index 6daf391b3e847..fc4d2bd8816f5 100644
+--- a/net/llc/llc_if.c
++++ b/net/llc/llc_if.c
+@@ -38,6 +38,8 @@
+  *	closed and -EBUSY when sending data is not permitted in this state or
+  *	LLC has send an I pdu with p bit set to 1 and is waiting for it's
+  *	response.
++ *
++ *	This function always consumes a reference to the skb.
+  */
+ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ 	struct llc_sock *llc = llc_sk(sk);
+ 
+ 	if (unlikely(llc->state == LLC_CONN_STATE_ADM))
+-		goto out;
++		goto out_free;
+ 	rc = -EBUSY;
+ 	if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
+ 		     llc->p_flag)) {
+ 		llc->failed_data_req = 1;
+-		goto out;
++		goto out_free;
+ 	}
+ 	ev = llc_conn_ev(skb);
+ 	ev->type      = LLC_CONN_EV_TYPE_PRIM;
+ 	ev->prim      = LLC_DATA_PRIM;
+ 	ev->prim_type = LLC_PRIM_TYPE_REQ;
+ 	skb->dev      = llc->dev;
+-	rc = llc_conn_state_process(sk, skb);
+-out:
++	return llc_conn_state_process(sk, skb);
++
++out_free:
++	kfree_skb(skb);
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch b/queue-4.9/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
new file mode 100644
index 00000000000..5323ce8f2ac
--- /dev/null
+++ b/queue-4.9/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
@@ -0,0 +1,125 @@
+From 32508e091abf9b6f158d14b3086d72578b8fdb61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:27 -0700
+Subject: llc: fix sk_buff refcounting in llc_conn_state_process()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ]
+
+If llc_conn_state_process() sees that llc_conn_service() put the skb on
+a list, it will drop one fewer references to it.  This is wrong because
+the current behavior is that llc_conn_service() never consumes a
+reference to the skb.
+
+The code also makes the number of skb references being dropped
+conditional on which of ind_prim and cfm_prim are nonzero, yet neither
+of these affects how many references are *acquired*.  So there is extra
+code that tries to fix this up by sometimes taking another reference.
+
+Remove the unnecessary/broken refcounting logic and instead just add an
+skb_get() before the only two places where an extra reference is
+actually consumed.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/llc_conn.c | 33 ++++++---------------------------
+ 1 file changed, 6 insertions(+), 27 deletions(-)
+
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 2689e95471dc4..1bdbd134bd7a8 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 	struct llc_sock *llc = llc_sk(skb->sk);
+ 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+ 
+-	/*
+-	 * We have to hold the skb, because llc_conn_service will kfree it in
+-	 * the sending path and we need to look at the skb->cb, where we encode
+-	 * llc_conn_state_ev.
+-	 */
+-	skb_get(skb);
+ 	ev->ind_prim = ev->cfm_prim = 0;
+ 	/*
+ 	 * Send event to state machine
+@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 	rc = llc_conn_service(skb->sk, skb);
+ 	if (unlikely(rc != 0)) {
+ 		printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
+-		goto out_kfree_skb;
+-	}
+-
+-	if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
+-		/* indicate or confirm not required */
+-		if (!skb->next)
+-			goto out_kfree_skb;
+ 		goto out_skb_put;
+ 	}
+ 
+-	if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
+-		skb_get(skb);
+-
+ 	switch (ev->ind_prim) {
+ 	case LLC_DATA_PRIM:
++		skb_get(skb);
+ 		llc_save_primitive(sk, skb, LLC_DATA_PRIM);
+ 		if (unlikely(sock_queue_rcv_skb(sk, skb))) {
+ 			/*
+@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 		 * skb->sk pointing to the newly created struct sock in
+ 		 * llc_conn_handler. -acme
+ 		 */
++		skb_get(skb);
+ 		skb_queue_tail(&sk->sk_receive_queue, skb);
+ 		sk->sk_state_change(sk);
+ 		break;
+@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 				sk->sk_state_change(sk);
+ 			}
+ 		}
+-		kfree_skb(skb);
+ 		sock_put(sk);
+ 		break;
+ 	case LLC_RESET_PRIM:
+@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 		 * RESET is not being notified to upper layers for now
+ 		 */
+ 		printk(KERN_INFO "%s: received a reset ind!\n", __func__);
+-		kfree_skb(skb);
+ 		break;
+ 	default:
+-		if (ev->ind_prim) {
++		if (ev->ind_prim)
+ 			printk(KERN_INFO "%s: received unknown %d prim!\n",
+ 				__func__, ev->ind_prim);
+-			kfree_skb(skb);
+-		}
+ 		/* No indication */
+ 		break;
+ 	}
+@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 		printk(KERN_INFO "%s: received a reset conf!\n", __func__);
+ 		break;
+ 	default:
+-		if (ev->cfm_prim) {
++		if (ev->cfm_prim)
+ 			printk(KERN_INFO "%s: received unknown %d prim!\n",
+ 					__func__, ev->cfm_prim);
+-			break;
+-		}
+-		goto out_skb_put; /* No confirmation */
++		/* No confirmation */
++		break;
+ 	}
+-out_kfree_skb:
+-	kfree_skb(skb);
+ out_skb_put:
+ 	kfree_skb(skb);
+ 	return rc;
+-- 
+2.20.1
+
diff --git a/queue-4.9/m68k-call-timer_interrupt-with-interrupts-disabled.patch b/queue-4.9/m68k-call-timer_interrupt-with-interrupts-disabled.patch
new file mode 100644
index 00000000000..e3be0fd03d2
--- /dev/null
+++ b/queue-4.9/m68k-call-timer_interrupt-with-interrupts-disabled.patch
@@ -0,0 +1,422 @@
+From ca2c7c4473b90184a6fed91ee3af576d83287c0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: Call timer_interrupt() with interrupts disabled
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ]
+
+Some platforms execute their timer handler with the interrupt priority
+level set below 6. That means the handler could be interrupted by another
+driver and this could lead to re-entry of the timer core.
+
+Avoid this by use of local_irq_save/restore for timer interrupt dispatch.
+This provides mutual exclusion around the timer interrupt flag access
+which is needed later in this series for the clocksource conversion.
+
+Reported-by: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/amiga/cia.c       |  9 +++++++++
+ arch/m68k/atari/ataints.c   |  4 ++--
+ arch/m68k/atari/time.c      | 15 ++++++++++++++-
+ arch/m68k/bvme6000/config.c | 20 ++++++++++----------
+ arch/m68k/hp300/time.c      | 10 ++++++++--
+ arch/m68k/mac/via.c         | 17 +++++++++++++++++
+ arch/m68k/mvme147/config.c  | 18 ++++++++++--------
+ arch/m68k/mvme16x/config.c  | 21 +++++++++++----------
+ arch/m68k/q40/q40ints.c     | 19 +++++++++++--------
+ arch/m68k/sun3/sun3ints.c   |  3 +++
+ arch/m68k/sun3x/time.c      | 16 ++++++++++------
+ 11 files changed, 105 insertions(+), 47 deletions(-)
+
+diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
+index 2081b8cd5591c..b9aee983e6f4c 100644
+--- a/arch/m68k/amiga/cia.c
++++ b/arch/m68k/amiga/cia.c
+@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
+ 	struct ciabase *base = dev_id;
+ 	int mach_irq;
+ 	unsigned char ints;
++	unsigned long flags;
+ 
++	/* Interrupts get disabled while the timer irq flag is cleared and
++	 * the timer interrupt serviced.
++	 */
+ 	mach_irq = base->cia_irq;
++	local_irq_save(flags);
+ 	ints = cia_set_irq(base, CIA_ICR_ALL);
+ 	amiga_custom.intreq = base->int_mask;
++	if (ints & 1)
++		generic_handle_irq(mach_irq);
++	local_irq_restore(flags);
++	mach_irq++, ints >>= 1;
+ 	for (; ints; mach_irq++, ints >>= 1) {
+ 		if (ints & 1)
+ 			generic_handle_irq(mach_irq);
+diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
+index 3d2b63bedf058..56f02ea2c248d 100644
+--- a/arch/m68k/atari/ataints.c
++++ b/arch/m68k/atari/ataints.c
+@@ -142,7 +142,7 @@ struct mfptimerbase {
+ 	.name		= "MFP Timer D"
+ };
+ 
+-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
+ {
+ 	struct mfptimerbase *base = dev_id;
+ 	int mach_irq;
+@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
+ 	st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
+ 
+ 	/* request timer D dispatch handler */
+-	if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
++	if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
+ 			stmfp_base.name, &stmfp_base))
+ 		pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
+ 
+diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
+index c549b48174ec8..972181c1fe4b7 100644
+--- a/arch/m68k/atari/time.c
++++ b/arch/m68k/atari/time.c
+@@ -24,6 +24,18 @@
+ DEFINE_SPINLOCK(rtc_lock);
+ EXPORT_SYMBOL_GPL(rtc_lock);
+ 
++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
++{
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
++	return IRQ_HANDLED;
++}
++
+ void __init
+ atari_sched_init(irq_handler_t timer_routine)
+ {
+@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
+     /* start timer C, div = 1:100 */
+     st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
+     /* install interrupt service routine for MFP Timer C */
+-    if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
++    if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
++                    timer_routine))
+ 	pr_err("Couldn't register timer interrupt\n");
+ }
+ 
+diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
+index 611d4d9ea2bd8..3978d71d250b4 100644
+--- a/arch/m68k/bvme6000/config.c
++++ b/arch/m68k/bvme6000/config.c
+@@ -45,11 +45,6 @@ extern int bvme6000_set_clock_mmss (unsigned long);
+ extern void bvme6000_reset (void);
+ void bvme6000_set_vectors (void);
+ 
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+ 
+ int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -159,12 +154,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
+ 
+ static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
+ {
++    irq_handler_t timer_routine = dev_id;
++    unsigned long flags;
+     volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
+-    unsigned char msr = rtc->msr & 0xc0;
++    unsigned char msr;
+ 
++    local_irq_save(flags);
++    msr = rtc->msr & 0xc0;
+     rtc->msr = msr | 0x20;		/* Ack the interrupt */
++    timer_routine(0, NULL);
++    local_irq_restore(flags);
+ 
+-    return tick_handler(irq, dev_id);
++    return IRQ_HANDLED;
+ }
+ 
+ /*
+@@ -183,9 +184,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
+ 
+     rtc->msr = 0;	/* Ensure timer registers accessible */
+ 
+-    tick_handler = timer_routine;
+-    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
+-				"timer", bvme6000_timer_int))
++    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
++                    timer_routine))
+ 	panic ("Couldn't register timer int");
+ 
+     rtc->t1cr_omr = 0x04;	/* Mode 2, ext clk */
+diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
+index 749543b425a4b..03c83b8f90328 100644
+--- a/arch/m68k/hp300/time.c
++++ b/arch/m68k/hp300/time.c
+@@ -37,13 +37,19 @@
+ 
+ static irqreturn_t hp300_tick(int irq, void *dev_id)
+ {
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
+ 	unsigned long tmp;
+-	irq_handler_t vector = dev_id;
++
++	local_irq_save(flags);
+ 	in_8(CLOCKBASE + CLKSR);
+ 	asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
+ 	/* Turn off the network and SCSI leds */
+ 	blinken_leds(0, 0xe0);
+-	return vector(irq, NULL);
++	return IRQ_HANDLED;
+ }
+ 
+ u32 hp300_gettimeoffset(void)
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index c27bf9a906be4..a435aced6e439 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -397,6 +397,8 @@ void via_nubus_irq_shutdown(int irq)
+  * via6522.c :-), disable/pending masks added.
+  */
+ 
++#define VIA_TIMER_1_INT BIT(6)
++
+ void via1_irq(struct irq_desc *desc)
+ {
+ 	int irq_num;
+@@ -406,6 +408,21 @@ void via1_irq(struct irq_desc *desc)
+ 	if (!events)
+ 		return;
+ 
++	irq_num = IRQ_MAC_TIMER_1;
++	irq_bit = VIA_TIMER_1_INT;
++	if (events & irq_bit) {
++		unsigned long flags;
++
++		local_irq_save(flags);
++		via1[vIFR] = irq_bit;
++		generic_handle_irq(irq_num);
++		local_irq_restore(flags);
++
++		events &= ~irq_bit;
++		if (!events)
++			return;
++	}
++
+ 	irq_num = VIA1_SOURCE_BASE;
+ 	irq_bit = 1;
+ 	do {
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index c11d38dfad08f..1a095443790b9 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -46,11 +46,6 @@ extern void mvme147_reset (void);
+ 
+ static int bcd2int (unsigned char b);
+ 
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme147_process_int() */
+-
+-irq_handler_t tick_handler;
+-
+ 
+ int __init mvme147_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -106,16 +101,23 @@ void __init config_mvme147(void)
+ 
+ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ {
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
++
++	local_irq_save(flags);
+ 	m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+ 	m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
+-	return tick_handler(irq, dev_id);
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
++	return IRQ_HANDLED;
+ }
+ 
+ 
+ void mvme147_sched_init (irq_handler_t timer_routine)
+ {
+-	tick_handler = timer_routine;
+-	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
++	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
++			timer_routine))
+ 		pr_err("Couldn't register timer interrupt\n");
+ 
+ 	/* Init the clock with a value */
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index 58e240939d265..ac49fa7ec46b4 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -51,11 +51,6 @@ extern void mvme16x_reset (void);
+ 
+ int bcd2int (unsigned char b);
+ 
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+ 
+ unsigned short mvme16x_config;
+ EXPORT_SYMBOL(mvme16x_config);
+@@ -354,8 +349,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
+ 
+ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ {
+-    *(volatile unsigned char *)0xfff4201b |= 8;
+-    return tick_handler(irq, dev_id);
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	*(volatile unsigned char *)0xfff4201b |= 8;
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
++	return IRQ_HANDLED;
+ }
+ 
+ void mvme16x_sched_init (irq_handler_t timer_routine)
+@@ -363,14 +365,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
+     uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
+     int irq;
+ 
+-    tick_handler = timer_routine;
+     /* Using PCCchip2 or MC2 chip tick timer 1 */
+     *(volatile unsigned long *)0xfff42008 = 0;
+     *(volatile unsigned long *)0xfff42004 = 10000;	/* 10ms */
+     *(volatile unsigned char *)0xfff42017 |= 3;
+     *(volatile unsigned char *)0xfff4201b = 0x16;
+-    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
+-				"timer", mvme16x_timer_int))
++    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
++                    timer_routine))
+ 	panic ("Couldn't register timer int");
+ 
+     if (brdno == 0x0162 || brdno == 0x172)
+diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
+index 513f9bb17b9cf..60b51f5b9cfc0 100644
+--- a/arch/m68k/q40/q40ints.c
++++ b/arch/m68k/q40/q40ints.c
+@@ -126,10 +126,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
+ 	sound_ticks = ticks << 1;
+ }
+ 
+-static irq_handler_t q40_timer_routine;
+-
+-static irqreturn_t q40_timer_int (int irq, void * dev)
++static irqreturn_t q40_timer_int(int irq, void *dev_id)
+ {
++	irq_handler_t timer_routine = dev_id;
++
+ 	ql_ticks = ql_ticks ? 0 : 1;
+ 	if (sound_ticks) {
+ 		unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
+@@ -138,8 +138,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
+ 		*DAC_RIGHT=sval;
+ 	}
+ 
+-	if (!ql_ticks)
+-		q40_timer_routine(irq, dev);
++	if (!ql_ticks) {
++		unsigned long flags;
++
++		local_irq_save(flags);
++		timer_routine(0, NULL);
++		local_irq_restore(flags);
++	}
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -147,11 +152,9 @@ void q40_sched_init (irq_handler_t timer_routine)
+ {
+ 	int timer_irq;
+ 
+-	q40_timer_routine = timer_routine;
+ 	timer_irq = Q40_IRQ_FRAME;
+ 
+-	if (request_irq(timer_irq, q40_timer_int, 0,
+-				"timer", q40_timer_int))
++	if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
+ 		panic("Couldn't register timer int");
+ 
+ 	master_outb(-1, FRAME_CLEAR_REG);
+diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
+index 6bbca30c91884..a5824abb4a39c 100644
+--- a/arch/m68k/sun3/sun3ints.c
++++ b/arch/m68k/sun3/sun3ints.c
+@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
+ 
+ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ {
++	unsigned long flags;
+ 	unsigned int cnt;
+ 
++	local_irq_save(flags);
+ #ifdef CONFIG_SUN3
+ 	intersil_clear();
+ #endif
+@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ 	cnt = kstat_irqs_cpu(irq, 0);
+ 	if (!(cnt % 20))
+ 		sun3_leds(led_pattern[cnt % 160 / 20]);
++	local_irq_restore(flags);
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
+index 431d3c4306dd8..a4f6a44d34189 100644
+--- a/arch/m68k/sun3x/time.c
++++ b/arch/m68k/sun3x/time.c
+@@ -77,15 +77,19 @@ u32 sun3x_gettimeoffset(void)
+ }
+ 
+ #if 0
+-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
+ {
+-    void (*vector)(int, void *, struct pt_regs *) = dev_id;
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
+ 
+-    /* Clear the pending interrupt - pulse the enable line low */
+-    disable_irq(5);
+-    enable_irq(5);
++	local_irq_save(flags);
++	/* Clear the pending interrupt - pulse the enable line low */
++	disable_irq(5);
++	enable_irq(5);
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
+ 
+-    vector(irq, NULL, regs);
++	return IRQ_HANDLED;
+ }
+ #endif
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/m68k-mac-fix-via-timer-counter-accesses.patch b/queue-4.9/m68k-mac-fix-via-timer-counter-accesses.patch
new file mode 100644
index 00000000000..ac729f8973b
--- /dev/null
+++ b/queue-4.9/m68k-mac-fix-via-timer-counter-accesses.patch
@@ -0,0 +1,156 @@
+From ef7e3954ca1158430180aa31d2b3e77b592fd79c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: mac: Fix VIA timer counter accesses
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]
+
+This resolves some bugs that affect VIA timer counter accesses.
+Avoid lost interrupts caused by reading the counter low byte register.
+Make allowance for the fact that the counter will be decremented to
+0xFFFF before being reloaded.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
+ 1 file changed, 53 insertions(+), 49 deletions(-)
+
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index 920ff63d4a81d..c27bf9a906be4 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -53,16 +53,6 @@ static __u8 rbv_clear;
+ 
+ static int gIER,gIFR,gBufA,gBufB;
+ 
+-/*
+- * Timer defs.
+- */
+-
+-#define TICK_SIZE		10000
+-#define MAC_CLOCK_TICK		(783300/HZ)		/* ticks per HZ */
+-#define MAC_CLOCK_LOW		(MAC_CLOCK_TICK&0xFF)
+-#define MAC_CLOCK_HIGH		(MAC_CLOCK_TICK>>8)
+-
+-
+ /*
+  * On Macs with a genuine VIA chip there is no way to mask an individual slot
+  * interrupt. This limitation also seems to apply to VIA clone logic cores in
+@@ -277,22 +267,6 @@ void __init via_init(void)
+ 	}
+ }
+ 
+-/*
+- * Start the 100 Hz clock
+- */
+-
+-void __init via_init_clock(irq_handler_t func)
+-{
+-	via1[vACR] |= 0x40;
+-	via1[vT1LL] = MAC_CLOCK_LOW;
+-	via1[vT1LH] = MAC_CLOCK_HIGH;
+-	via1[vT1CL] = MAC_CLOCK_LOW;
+-	via1[vT1CH] = MAC_CLOCK_HIGH;
+-
+-	if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
+-		pr_err("Couldn't register %s interrupt\n", "timer");
+-}
+-
+ /*
+  * Debugging dump, used in various places to see what's going on.
+  */
+@@ -320,29 +294,6 @@ void via_debug_dump(void)
+ 	}
+ }
+ 
+-/*
+- * This is always executed with interrupts disabled.
+- *
+- * TBI: get time offset between scheduling timer ticks
+- */
+-
+-u32 mac_gettimeoffset(void)
+-{
+-	unsigned long ticks, offset = 0;
+-
+-	/* read VIA1 timer 2 current value */
+-	ticks = via1[vT1CL] | (via1[vT1CH] << 8);
+-	/* The probability of underflow is less than 2% */
+-	if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
+-		/* Check for pending timer interrupt in VIA1 IFR */
+-		if (via1[vIFR] & 0x40) offset = TICK_SIZE;
+-
+-	ticks = MAC_CLOCK_TICK - ticks;
+-	ticks = ticks * 10000L / MAC_CLOCK_TICK;
+-
+-	return (ticks + offset) * 1000;
+-}
+-
+ /*
+  * Flush the L2 cache on Macs that have it by flipping
+  * the system into 24-bit mode for an instant.
+@@ -619,3 +570,56 @@ int via2_scsi_drq_pending(void)
+ 	return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
+ }
+ EXPORT_SYMBOL(via2_scsi_drq_pending);
++
++/* timer and clock source */
++
++#define VIA_CLOCK_FREQ     783360                /* VIA "phase 2" clock in Hz */
++#define VIA_TIMER_INTERVAL (1000000 / HZ)        /* microseconds per jiffy */
++#define VIA_TIMER_CYCLES   (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
++
++#define VIA_TC             (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
++#define VIA_TC_LOW         (VIA_TC & 0xFF)
++#define VIA_TC_HIGH        (VIA_TC >> 8)
++
++void __init via_init_clock(irq_handler_t timer_routine)
++{
++	if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
++		pr_err("Couldn't register %s interrupt\n", "timer");
++		return;
++	}
++
++	via1[vT1LL] = VIA_TC_LOW;
++	via1[vT1LH] = VIA_TC_HIGH;
++	via1[vT1CL] = VIA_TC_LOW;
++	via1[vT1CH] = VIA_TC_HIGH;
++	via1[vACR] |= 0x40;
++}
++
++u32 mac_gettimeoffset(void)
++{
++	unsigned long flags;
++	u8 count_high;
++	u16 count, offset = 0;
++
++	/*
++	 * Timer counter wrap-around is detected with the timer interrupt flag
++	 * but reading the counter low byte (vT1CL) would reset the flag.
++	 * Also, accessing both counter registers is essentially a data race.
++	 * These problems are avoided by ignoring the low byte. Clock accuracy
++	 * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
++	 * reduced by avoiding slow VIA register accesses.
++	 */
++
++	local_irq_save(flags);
++	count_high = via1[vT1CH];
++	if (count_high == 0xFF)
++		count_high = 0;
++	if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
++		offset = VIA_TIMER_CYCLES;
++	local_irq_restore(flags);
++
++	count = count_high << 8;
++	count = VIA_TIMER_CYCLES - count + offset;
++
++	return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
++}
+-- 
+2.20.1
+
diff --git a/queue-4.9/mac80211-accept-deauth-frames-in-ibss-mode.patch b/queue-4.9/mac80211-accept-deauth-frames-in-ibss-mode.patch
new file mode 100644
index 00000000000..d362329c37a
--- /dev/null
+++ b/queue-4.9/mac80211-accept-deauth-frames-in-ibss-mode.patch
@@ -0,0 +1,49 @@
+From de71dc9d0948031595155d11cfefe90086d47350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 15:37:05 +0300
+Subject: mac80211: accept deauth frames in IBSS mode
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ]
+
+We can process deauth frames and all, but we drop them very
+early in the RX path today - this could never have worked.
+
+Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 3b423c50ec8fa..74652eb2f90fd 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3205,9 +3205,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
+ 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+ 		/* process for all: mesh, mlme, ibss */
+ 		break;
++	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
++		if (is_multicast_ether_addr(mgmt->da) &&
++		    !is_broadcast_ether_addr(mgmt->da))
++			return RX_DROP_MONITOR;
++
++		/* process only for station/IBSS */
++		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
++			return RX_DROP_MONITOR;
++		break;
+ 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+-	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+ 	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+ 		if (is_multicast_ether_addr(mgmt->da) &&
+ 		    !is_broadcast_ether_addr(mgmt->da))
+-- 
+2.20.1
+
diff --git a/queue-4.9/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch b/queue-4.9/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
new file mode 100644
index 00000000000..9a9aa42e24a
--- /dev/null
+++ b/queue-4.9/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
@@ -0,0 +1,38 @@
+From 09ea718e3bcaab2806d62af9ec9317355718d71c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 11:54:46 +0200
+Subject: mac80211: minstrel_ht: fix per-group max throughput rate
+ initialization
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ]
+
+The group number needs to be multiplied by the number of rates per group
+to get the full rate index
+
+Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rc80211_minstrel_ht.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 593184d14b3ef..e1b0e26c1f174 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -547,7 +547,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+ 
+ 		/* (re)Initialize group rate indexes */
+ 		for(j = 0; j < MAX_THR_RATES; j++)
+-			tmp_group_tp_rate[j] = group;
++			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
+ 
+ 		for (i = 0; i < MCS_GROUP_RATES; i++) {
+ 			if (!(mg->supported & BIT(i)))
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-cx18-update-pos-correctly-in-cx18_read_pos.patch b/queue-4.9/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
new file mode 100644
index 00000000000..39dfd4499e8
--- /dev/null
+++ b/queue-4.9/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
@@ -0,0 +1,37 @@
+From e22fb2c31bbc8646ecddd2aca48809a1f193fa6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: media: cx18: update *pos correctly in cx18_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]
+
+We should be updating *pos.  The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index df837408efd59..0171dc5b8809e 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -490,7 +490,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+ 
+ 	CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ 	if (rc > 0)
+-		pos += rc;
++		*pos += rc;
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-cx23885-check-allocation-return.patch b/queue-4.9/media-cx23885-check-allocation-return.patch
new file mode 100644
index 00000000000..2c238084785
--- /dev/null
+++ b/queue-4.9/media-cx23885-check-allocation-return.patch
@@ -0,0 +1,43 @@
+From 1267f44b7c3557d97eb6e3b9621f249f8a66ad51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: media: cx23885: check allocation return
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here.  While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 818f3c2fc98d8..1d86e57f4d9fd 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1471,8 +1471,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ 		if (fe0->dvb.frontend != NULL) {
+ 			struct i2c_adapter *tun_i2c;
+ 
+-			fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+-			memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++			fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++			if (!fe0->dvb.frontend->sec_priv)
++				return -ENOMEM;
+ 			tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ 			if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ 				return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-davinci-isif-avoid-uninitialized-variable-use.patch b/queue-4.9/media-davinci-isif-avoid-uninitialized-variable-use.patch
new file mode 100644
index 00000000000..3a9f2020ea3
--- /dev/null
+++ b/queue-4.9/media-davinci-isif-avoid-uninitialized-variable-use.patch
@@ -0,0 +1,78 @@
+From ed63eeeebffb096a2973af4e2bd0018169ebaad7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: media: davinci-isif: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+      [-Werror,-Wuninitialized]
+                dm365_vpss_set_pg_frame_size(frame_size);
+                                             ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+        struct vpss_pg_frame_size frame_size;
+        ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 78e37cf3470f2..b51b875c5a612 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -890,9 +890,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ 	struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+-	struct vpss_pg_frame_size frame_size;
+ 	u32 modeset = 0, ccdcfg = 0;
+-	struct vpss_sync_pol sync;
+ 
+ 	dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+ 
+@@ -980,13 +978,6 @@ static int isif_config_ycbcr(void)
+ 		/* two fields are interleaved in memory */
+ 		regw(0x00000249, SDOFST);
+ 
+-	/* Setup test pattern if enabled */
+-	if (isif_cfg.bayer.config_params.test_pat_gen) {
+-		sync.ccdpg_hdpol = params->hd_pol;
+-		sync.ccdpg_vdpol = params->vd_pol;
+-		dm365_vpss_set_sync_pol(sync);
+-		dm365_vpss_set_pg_frame_size(frame_size);
+-	}
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch b/queue-4.9/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
new file mode 100644
index 00000000000..062fedc6c74
--- /dev/null
+++ b/queue-4.9/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
@@ -0,0 +1,54 @@
+From 70b0a5f9b5bab8e6b617bdea0df2fb55161b6f81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:46:27 -0400
+Subject: media: davinci/vpbe: array underflow in vpbe_enum_outputs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]
+
+In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
+the problem is that "temp_index" can be negative.  This patch changes
+the types to unsigned to address this array underflow bug.
+
+Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe.c | 2 +-
+ include/media/davinci/vpbe.h          | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
+index abce9c4a1a8ec..59518c08528b8 100644
+--- a/drivers/media/platform/davinci/vpbe.c
++++ b/drivers/media/platform/davinci/vpbe.c
+@@ -130,7 +130,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
+ 			     struct v4l2_output *output)
+ {
+ 	struct vpbe_config *cfg = vpbe_dev->cfg;
+-	int temp_index = output->index;
++	unsigned int temp_index = output->index;
+ 
+ 	if (temp_index >= cfg->num_outputs)
+ 		return -EINVAL;
+diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
+index 4376beeb28c2c..5d8ceeddc7973 100644
+--- a/include/media/davinci/vpbe.h
++++ b/include/media/davinci/vpbe.h
+@@ -96,7 +96,7 @@ struct vpbe_config {
+ 	struct encoder_config_info *ext_encoders;
+ 	/* amplifier information goes here */
+ 	struct amp_config_info *amp;
+-	int num_outputs;
++	unsigned int num_outputs;
+ 	/* Order is venc outputs followed by LCD and then external encoders */
+ 	struct vpbe_output *outputs;
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch b/queue-4.9/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
new file mode 100644
index 00000000000..38df48aaca0
--- /dev/null
+++ b/queue-4.9/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
@@ -0,0 +1,37 @@
+From 9765dd147da265681eb8897297a1dbadeafa2dbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: media: ivtv: update *pos correctly in ivtv_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index c9bd018e53de6..e2b19c3eaa876 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+ 
+ 	IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ 	if (rc > 0)
+-		pos += rc;
++		*pos += rc;
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch b/queue-4.9/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
new file mode 100644
index 00000000000..a65241d16fc
--- /dev/null
+++ b/queue-4.9/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
@@ -0,0 +1,68 @@
+From 46429c5a869abaed90d6a438519a600bb1890361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2019 05:01:57 -0400
+Subject: media: omap_vout: potential buffer overflow in vidioc_dqbuf()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]
+
+The "b->index" is a u32 the comes from the user in the ioctl.  It hasn't
+been checked.  We aren't supposed to use it but we're instead supposed
+to use the value that gets written to it when we call videobuf_dqbuf().
+
+The videobuf_dqbuf() first memsets it to zero and then re-initializes it
+inside the videobuf_status() function.  It's this final value which we
+want.
+
+Hans Verkuil pointed out that we need to check the return from
+videobuf_dqbuf().  I ended up doing a little cleanup related to that as
+well.
+
+Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
+index a31b95cb3b09c..77ec70f5fef66 100644
+--- a/drivers/media/platform/omap/omap_vout.c
++++ b/drivers/media/platform/omap/omap_vout.c
+@@ -1526,23 +1526,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
+ 	unsigned long size;
+ 	struct videobuf_buffer *vb;
+ 
+-	vb = q->bufs[b->index];
+-
+ 	if (!vout->streaming)
+ 		return -EINVAL;
+ 
+-	if (file->f_flags & O_NONBLOCK)
+-		/* Call videobuf_dqbuf for non blocking mode */
+-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
+-	else
+-		/* Call videobuf_dqbuf for  blocking mode */
+-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
++	ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
++	if (ret)
++		return ret;
++
++	vb = q->bufs[b->index];
+ 
+ 	addr = (unsigned long) vout->buf_phy_addr[vb->i];
+ 	size = (unsigned long) vb->size;
+ 	dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
+ 				size, DMA_TO_DEVICE);
+-	return ret;
++	return 0;
+ }
+ 
+ static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch b/queue-4.9/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
new file mode 100644
index 00000000000..59b7f1902d3
--- /dev/null
+++ b/queue-4.9/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
@@ -0,0 +1,39 @@
+From e7dd20be25578b5fdb4eda6f30cf4c9180cb4709 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: media: ov2659: fix unbalanced mutex_lock/unlock
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index ade3c48e2e0cf..18546f950d792 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1137,7 +1137,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ 		mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ 		*mf = fmt->format;
+ #else
+-		return -ENOTTY;
++		ret = -ENOTTY;
+ #endif
+ 	} else {
+ 		s64 val;
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-sup.patch b/queue-4.9/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-sup.patch
new file mode 100644
index 00000000000..a08ea4e8224
--- /dev/null
+++ b/queue-4.9/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-sup.patch
@@ -0,0 +1,56 @@
+From 0d82bae0ddefb015e2a671cd3271024bac0a4084 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:41 -0300
+Subject: media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 39034bb0c26b76a2c3abc54aa28c185f18b40c2f ]
+
+Commit da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad
+op get_fmt") converted a former ov6650_g_fmt() video operation callback
+to an ov6650_get_fmt() pad operation callback.  However, the converted
+function disregards a format->which flag that pad operations should
+obey and always returns active frame format settings.
+
+That can be fixed by always responding to V4L2_SUBDEV_FORMAT_TRY with
+-EINVAL, or providing the response from a pad config argument, likely
+updated by a former user call to V4L2_SUBDEV_FORMAT_TRY .set_fmt().
+Since implementation of the latter is trivial, go for it.
+
+Fixes: da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad op get_fmt")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
+index 3b118d45d433b..3c959e48855c3 100644
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -526,10 +526,16 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ 	*mf = ov6650_def_fmt;
+ 
+ 	/* update media bus format code and frame size */
+-	mf->width	= priv->rect.width >> priv->half_scale;
+-	mf->height	= priv->rect.height >> priv->half_scale;
+-	mf->code	= priv->code;
++	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++		mf->width = cfg->try_fmt.width;
++		mf->height = cfg->try_fmt.height;
++		mf->code = cfg->try_fmt.code;
+ 
++	} else {
++		mf->width = priv->rect.width >> priv->half_scale;
++		mf->height = priv->rect.height >> priv->half_scale;
++		mf->code = priv->code;
++	}
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch b/queue-4.9/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch
new file mode 100644
index 00000000000..f61f32902b7
--- /dev/null
+++ b/queue-4.9/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch
@@ -0,0 +1,97 @@
+From 1ffb285791d064483cf514df717f3cacd0548a01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:39 -0300
+Subject: media: ov6650: Fix incorrect use of JPEG colorspace
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 12500731895ef09afc5b66b86b76c0884fb9c7bf ]
+
+Since its initial submission, the driver selects V4L2_COLORSPACE_JPEG
+for supported formats other than V4L2_MBUS_FMT_SBGGR8_1X8.  According
+to v4l2-compliance test program, V4L2_COLORSPACE_JPEG applies
+exclusively to V4L2_PIX_FMT_JPEG.  Since the sensor does not support
+JPEG format, fix it to always select V4L2_COLORSPACE_SRGB.
+
+Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
+index 7a119466f9734..e9271ad9ee4c1 100644
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -203,7 +203,6 @@ struct ov6650 {
+ 	unsigned long		pclk_max;	/* from resolution and format */
+ 	struct v4l2_fract	tpf;		/* as requested with s_parm */
+ 	u32 code;
+-	enum v4l2_colorspace	colorspace;
+ };
+ 
+ 
+@@ -515,7 +514,7 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ 	mf->width	= priv->rect.width >> priv->half_scale;
+ 	mf->height	= priv->rect.height >> priv->half_scale;
+ 	mf->code	= priv->code;
+-	mf->colorspace	= priv->colorspace;
++	mf->colorspace	= V4L2_COLORSPACE_SRGB;
+ 	mf->field	= V4L2_FIELD_NONE;
+ 
+ 	return 0;
+@@ -624,11 +623,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 		priv->pclk_max = 8000000;
+ 	}
+ 
+-	if (code == MEDIA_BUS_FMT_SBGGR8_1X8)
+-		priv->colorspace = V4L2_COLORSPACE_SRGB;
+-	else if (code != 0)
+-		priv->colorspace = V4L2_COLORSPACE_JPEG;
+-
+ 	if (half_scale) {
+ 		dev_dbg(&client->dev, "max resolution: QCIF\n");
+ 		coma_set |= COMA_QCIF;
+@@ -685,7 +679,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 		priv->code = code;
+ 
+ 	if (!ret) {
+-		mf->colorspace	= priv->colorspace;
+ 		mf->width = priv->rect.width >> half_scale;
+ 		mf->height = priv->rect.height >> half_scale;
+ 	}
+@@ -708,6 +701,7 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 				&mf->height, 2, H_CIF, 1, 0);
+ 
+ 	mf->field = V4L2_FIELD_NONE;
++	mf->colorspace = V4L2_COLORSPACE_SRGB;
+ 
+ 	switch (mf->code) {
+ 	case MEDIA_BUS_FMT_Y10_1X10:
+@@ -717,12 +711,10 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 	case MEDIA_BUS_FMT_YUYV8_2X8:
+ 	case MEDIA_BUS_FMT_VYUY8_2X8:
+ 	case MEDIA_BUS_FMT_UYVY8_2X8:
+-		mf->colorspace = V4L2_COLORSPACE_JPEG;
+ 		break;
+ 	default:
+ 		mf->code = MEDIA_BUS_FMT_SBGGR8_1X8;
+ 	case MEDIA_BUS_FMT_SBGGR8_1X8:
+-		mf->colorspace = V4L2_COLORSPACE_SRGB;
+ 		break;
+ 	}
+ 
+@@ -1048,7 +1040,6 @@ static int ov6650_probe(struct i2c_client *client,
+ 	priv->rect.height = H_CIF;
+ 	priv->half_scale  = false;
+ 	priv->code	  = MEDIA_BUS_FMT_YUYV8_2X8;
+-	priv->colorspace  = V4L2_COLORSPACE_JPEG;
+ 
+ 	ret = ov6650_video_probe(client);
+ 	if (ret)
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-ov6650-fix-some-format-attributes-not-under-co.patch b/queue-4.9/media-ov6650-fix-some-format-attributes-not-under-co.patch
new file mode 100644
index 00000000000..ba66aac8234
--- /dev/null
+++ b/queue-4.9/media-ov6650-fix-some-format-attributes-not-under-co.patch
@@ -0,0 +1,132 @@
+From 2a53db2a4e98d6fcefd27e5a8e638bb10ad64991 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:40 -0300
+Subject: media: ov6650: Fix some format attributes not under control
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 1c6a2b63095154bbf9e8f38d79487a728331bf65 ]
+
+User arguments passed to .get/set_fmt() pad operation callbacks may
+contain unsupported values.  The driver takes control over frame size
+and pixel code as well as colorspace and field attributes but has never
+cared for remainig format attributes, i.e., ycbcr_enc, quantization
+and xfer_func, introduced by commit 11ff030c7365 ("[media]
+v4l2-mediabus: improve colorspace support").  Fix it.
+
+Set up a static v4l2_mbus_framefmt structure with attributes
+initialized to reasonable defaults and use it for updating content of
+user provided arguments.  In case of V4L2_SUBDEV_FORMAT_ACTIVE,
+postpone frame size update, now performed from inside ov6650_s_fmt()
+helper, util the user argument is first updated in ov6650_set_fmt() with
+default frame format content.  For V4L2_SUBDEV_FORMAT_TRY, don't copy
+all attributes to pad config, only those handled by the driver, then
+fill the response with the default frame format updated with resulting
+pad config format code and frame size.
+
+Fixes: 11ff030c7365 ("[media] v4l2-mediabus: improve colorspace support")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 51 ++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
+index e9271ad9ee4c1..3b118d45d433b 100644
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -215,6 +215,17 @@ static u32 ov6650_codes[] = {
+ 	MEDIA_BUS_FMT_Y8_1X8,
+ };
+ 
++static const struct v4l2_mbus_framefmt ov6650_def_fmt = {
++	.width		= W_CIF,
++	.height		= H_CIF,
++	.code		= MEDIA_BUS_FMT_SBGGR8_1X8,
++	.colorspace	= V4L2_COLORSPACE_SRGB,
++	.field		= V4L2_FIELD_NONE,
++	.ycbcr_enc	= V4L2_YCBCR_ENC_DEFAULT,
++	.quantization	= V4L2_QUANTIZATION_DEFAULT,
++	.xfer_func	= V4L2_XFER_FUNC_DEFAULT,
++};
++
+ /* read a register */
+ static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val)
+ {
+@@ -511,11 +522,13 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ 	if (format->pad)
+ 		return -EINVAL;
+ 
++	/* initialize response with default media bus frame format */
++	*mf = ov6650_def_fmt;
++
++	/* update media bus format code and frame size */
+ 	mf->width	= priv->rect.width >> priv->half_scale;
+ 	mf->height	= priv->rect.height >> priv->half_scale;
+ 	mf->code	= priv->code;
+-	mf->colorspace	= V4L2_COLORSPACE_SRGB;
+-	mf->field	= V4L2_FIELD_NONE;
+ 
+ 	return 0;
+ }
+@@ -678,10 +691,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ 	if (!ret)
+ 		priv->code = code;
+ 
+-	if (!ret) {
+-		mf->width = priv->rect.width >> half_scale;
+-		mf->height = priv->rect.height >> half_scale;
+-	}
+ 	return ret;
+ }
+ 
+@@ -700,9 +709,6 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 		v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
+ 				&mf->height, 2, H_CIF, 1, 0);
+ 
+-	mf->field = V4L2_FIELD_NONE;
+-	mf->colorspace = V4L2_COLORSPACE_SRGB;
+-
+ 	switch (mf->code) {
+ 	case MEDIA_BUS_FMT_Y10_1X10:
+ 		mf->code = MEDIA_BUS_FMT_Y8_1X8;
+@@ -718,10 +724,31 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ 		break;
+ 	}
+ 
+-	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
+-		return ov6650_s_fmt(sd, mf);
+-	cfg->try_fmt = *mf;
++	if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++		/* store media bus format code and frame size in pad config */
++		cfg->try_fmt.width = mf->width;
++		cfg->try_fmt.height = mf->height;
++		cfg->try_fmt.code = mf->code;
+ 
++		/* return default mbus frame format updated with pad config */
++		*mf = ov6650_def_fmt;
++		mf->width = cfg->try_fmt.width;
++		mf->height = cfg->try_fmt.height;
++		mf->code = cfg->try_fmt.code;
++
++	} else {
++		/* apply new media bus format code and frame size */
++		int ret = ov6650_s_fmt(sd, mf);
++
++		if (ret)
++			return ret;
++
++		/* return default format updated with active size and code */
++		*mf = ov6650_def_fmt;
++		mf->width = priv->rect.width >> priv->half_scale;
++		mf->height = priv->rect.height >> priv->half_scale;
++		mf->code = priv->code;
++	}
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch b/queue-4.9/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
new file mode 100644
index 00000000000..1070e5231e9
--- /dev/null
+++ b/queue-4.9/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
@@ -0,0 +1,45 @@
+From 96bce9c58cad1b2b3b183868c49dbaa4da3a2af6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jan 2019 13:00:41 -0500
+Subject: media: s5p-jpeg: Correct step and max values for
+ V4L2_CID_JPEG_RESTART_INTERVAL
+
+From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]
+
+This commit corrects max and step values for v4l2 control for
+V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
+It was found by using v4l2-compliance tool and checking result of
+VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
+Previously it was complaining that step was bigger than difference
+between max and min.
+
+Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")
+
+Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index c89922fb42cef..a63f4eec366eb 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -1963,7 +1963,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
+ 
+ 		v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
+ 				  V4L2_CID_JPEG_RESTART_INTERVAL,
+-				  0, 3, 0xffff, 0);
++				  0, 0xffff, 1, 0);
+ 		if (ctx->jpeg->variant->version == SJPEG_S5P)
+ 			mask = ~0x06; /* 422, 420 */
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-tw5864-fix-possible-null-pointer-dereference-i.patch b/queue-4.9/media-tw5864-fix-possible-null-pointer-dereference-i.patch
new file mode 100644
index 00000000000..9e9d528e5c7
--- /dev/null
+++ b/queue-4.9/media-tw5864-fix-possible-null-pointer-dereference-i.patch
@@ -0,0 +1,47 @@
+From 14885a6de14cf5b05c7fb6955983e3d3e3c9a3a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2019 22:01:24 -0400
+Subject: media: tw5864: Fix possible NULL pointer dereference in
+ tw5864_handle_frame
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]
+
+'vb' null check should be done before dereferencing it in
+tw5864_handle_frame, otherwise a NULL pointer dereference
+may occur.
+
+Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index 1ddf80f85c248..27ff6e0d98453 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1386,13 +1386,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ 	input->vb = NULL;
+ 	spin_unlock_irqrestore(&input->slock, flags);
+ 
+-	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ 	if (!vb) { /* Gone because of disabling */
+ 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ 		return;
+ 	}
+ 
++	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ 	/*
+ 	 * Check for space.
+ 	 * Mind the overhead of startcode emulation prevention.
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-vivid-fix-incorrect-assignment-operation-when-.patch b/queue-4.9/media-vivid-fix-incorrect-assignment-operation-when-.patch
new file mode 100644
index 00000000000..d8d87952f6c
--- /dev/null
+++ b/queue-4.9/media-vivid-fix-incorrect-assignment-operation-when-.patch
@@ -0,0 +1,42 @@
+From d0930753a2a1a92560f937f45a66df7b95492a38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 10:55:15 -0400
+Subject: media: vivid: fix incorrect assignment operation when setting video
+ mode
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ]
+
+The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
+bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
+otherwise the previous clearing of the FB_VMODE_MASK bits of
+var->vmode makes no sense and is redundant.
+
+Addresses-Coverity: ("Unused value")
+Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-osd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
+index bdc380b14e0c4..a95b7c56569e3 100644
+--- a/drivers/media/platform/vivid/vivid-osd.c
++++ b/drivers/media/platform/vivid/vivid-osd.c
+@@ -167,7 +167,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
+ 	var->nonstd = 0;
+ 
+ 	var->vmode &= ~FB_VMODE_MASK;
+-	var->vmode = FB_VMODE_NONINTERLACED;
++	var->vmode |= FB_VMODE_NONINTERLACED;
+ 
+ 	/* Dummy values */
+ 	var->hsync_len = 24;
+-- 
+2.20.1
+
diff --git a/queue-4.9/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch b/queue-4.9/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
new file mode 100644
index 00000000000..3e16210a06c
--- /dev/null
+++ b/queue-4.9/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
@@ -0,0 +1,40 @@
+From f7745bd8a2a8ab9ed846ad3fce2e3576d603b0bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: media: wl128x: Fix an error code in fm_download_firmware()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index c1457cf466981..db987dda356e0 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1278,8 +1278,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+ 
+ 		switch (action->type) {
+ 		case ACTION_SEND_COMMAND:	/* Send */
+-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
+-						action->size, NULL, NULL))
++			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++					   action->size, NULL, NULL);
++			if (ret)
+ 				goto rel_fw;
+ 
+ 			cmd_cnt++;
+-- 
+2.20.1
+
diff --git a/queue-4.9/mfd-intel-lpss-release-ida-resources.patch b/queue-4.9/mfd-intel-lpss-release-ida-resources.patch
new file mode 100644
index 00000000000..e98ee8d8e11
--- /dev/null
+++ b/queue-4.9/mfd-intel-lpss-release-ida-resources.patch
@@ -0,0 +1,36 @@
+From ced7eccb2df20778eb1aed34fb807e435b13a030 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 15:56:31 +0300
+Subject: mfd: intel-lpss: Release IDA resources
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ]
+
+ida instances allocate some internal memory for ->free_bitmap
+in addition to the base 'struct ida'. Use ida_destroy() to release
+that memory at module_exit().
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index 22dd8c055048c..71cecd7aeea0c 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -533,6 +533,7 @@ module_init(intel_lpss_init);
+ 
+ static void __exit intel_lpss_exit(void)
+ {
++	ida_destroy(&intel_lpss_devid_ida);
+ 	debugfs_remove(intel_lpss_debugfs);
+ }
+ module_exit(intel_lpss_exit);
+-- 
+2.20.1
+
diff --git a/queue-4.9/mic-avoid-statically-declaring-a-struct-device.patch b/queue-4.9/mic-avoid-statically-declaring-a-struct-device.patch
new file mode 100644
index 00000000000..5492b076bb6
--- /dev/null
+++ b/queue-4.9/mic-avoid-statically-declaring-a-struct-device.patch
@@ -0,0 +1,118 @@
+From 8c9f57ca885a9d7f3d77664b9285bd2284ecd0f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 11:24:09 +0200
+Subject: mic: avoid statically declaring a 'struct device'.
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ]
+
+Generally, declaring a platform device as a static variable is
+a bad idea and can cause all kinds of problems, in particular
+with the DMA configuration and lifetime rules.
+
+A specific problem we hit here is from a bug in clang that warns
+about certain (otherwise valid) macros when used in static variables:
+
+drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow]
+static u64 mic_dma_mask = DMA_BIT_MASK(64);
+                          ^~~~~~~~~~~~~~~~
+include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK'
+ #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+                                                     ^ ~~~
+
+A slightly better way here is to create the platform device dynamically
+and set the dma mask in the probe function.
+This avoids the warning and some other problems, but is still not ideal
+because the device creation should really be separated from the driver,
+and the fact that the device has no parent means we have to force
+the dma mask rather than having it set up from the bus that the device
+is actually on.
+
+Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++----------------
+ 1 file changed, 12 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
+index b9f0710ffa6b0..4007adc666f37 100644
+--- a/drivers/misc/mic/card/mic_x100.c
++++ b/drivers/misc/mic/card/mic_x100.c
+@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
+ 	mdrv->dev = &pdev->dev;
+ 	snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
+ 
++	/* FIXME: use dma_set_mask_and_coherent() and check result */
++	dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++
+ 	mdev->mmio.pa = MIC_X100_MMIO_BASE;
+ 	mdev->mmio.len = MIC_X100_MMIO_LEN;
+ 	mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
+@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
+ 	mic_remove(pdev);
+ }
+ 
+-static u64 mic_dma_mask = DMA_BIT_MASK(64);
+-
+-static struct platform_device mic_platform_dev = {
+-	.name = mic_driver_name,
+-	.id   = 0,
+-	.num_resources = 0,
+-	.dev = {
+-		.dma_mask = &mic_dma_mask,
+-		.coherent_dma_mask = DMA_BIT_MASK(64),
+-	},
+-};
+-
+ static struct platform_driver __refdata mic_platform_driver = {
+ 	.probe = mic_probe,
+ 	.remove = mic_remove,
+@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
+ 	},
+ };
+ 
++static struct platform_device *mic_platform_dev;
++
+ static int __init mic_init(void)
+ {
+ 	int ret;
+@@ -328,9 +321,12 @@ static int __init mic_init(void)
+ 
+ 	request_module("mic_x100_dma");
+ 	mic_init_card_debugfs();
+-	ret = platform_device_register(&mic_platform_dev);
++
++	mic_platform_dev = platform_device_register_simple(mic_driver_name,
++							   0, NULL, 0);
++	ret = PTR_ERR_OR_ZERO(mic_platform_dev);
+ 	if (ret) {
+-		pr_err("platform_device_register ret %d\n", ret);
++		pr_err("platform_device_register_full ret %d\n", ret);
+ 		goto cleanup_debugfs;
+ 	}
+ 	ret = platform_driver_register(&mic_platform_driver);
+@@ -341,7 +337,7 @@ static int __init mic_init(void)
+ 	return ret;
+ 
+ device_unregister:
+-	platform_device_unregister(&mic_platform_dev);
++	platform_device_unregister(mic_platform_dev);
+ cleanup_debugfs:
+ 	mic_exit_card_debugfs();
+ done:
+@@ -351,7 +347,7 @@ done:
+ static void __exit mic_exit(void)
+ {
+ 	platform_driver_unregister(&mic_platform_driver);
+-	platform_device_unregister(&mic_platform_dev);
++	platform_device_unregister(mic_platform_dev);
+ 	mic_exit_card_debugfs();
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch b/queue-4.9/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
new file mode 100644
index 00000000000..ac4f747153a
--- /dev/null
+++ b/queue-4.9/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
@@ -0,0 +1,103 @@
+From 4cd5f75f3255a1820a1d30f3728deeb79ff5e4db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 14:10:12 -0700
+Subject: mips: avoid explicit UB in assignment of mips_io_port_base
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ]
+
+The code in question is modifying a variable declared const through
+pointer manipulation.  Such code is explicitly undefined behavior, and
+is the lone issue preventing malta_defconfig from booting when built
+with Clang:
+
+If an attempt is made to modify an object defined with a const-qualified
+type through use of an lvalue with non-const-qualified type, the
+behavior is undefined.
+
+LLVM is removing such assignments. A simple fix is to not declare
+variables const that you plan on modifying.  Limiting the scope would be
+a better method of preventing unwanted writes to such a variable.
+
+Further, the code in question mentions "compiler bugs" without any links
+to bug reports, so it is difficult to know if the issue is resolved in
+GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or
+4.1.1. The minimal supported version of GCC in the Linux kernel is
+currently 4.6.
+
+For what its worth, there was UB before the commit in question, it just
+added a barrier and got lucky IRT codegen. I don't think there's any
+actual compiler bugs related, just runtime bugs due to UB.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/610
+Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for <asm/io.h>.")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Debugged-by: Nathan Chancellor <natechancellor@gmail.com>
+Suggested-by: Eli Friedman <efriedma@quicinc.com>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Hassan Naveed <hnaveed@wavecomp.com>
+Cc: Stephen Kitt <steve@sk2.org>
+Cc: Serge Semin <fancer.lancer@gmail.com>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/io.h | 14 ++------------
+ arch/mips/kernel/setup.c   |  2 +-
+ 2 files changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
+index 06049b6b3dddb..5dfae80264b9b 100644
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -60,21 +60,11 @@
+  * instruction, so the lower 16 bits must be zero.  Should be true on
+  * on any sane architecture; generic code does not use this assumption.
+  */
+-extern const unsigned long mips_io_port_base;
++extern unsigned long mips_io_port_base;
+ 
+-/*
+- * Gcc will generate code to load the value of mips_io_port_base after each
+- * function call which may be fairly wasteful in some cases.  So we don't
+- * play quite by the book.  We tell gcc mips_io_port_base is a long variable
+- * which solves the code generation issue.  Now we need to violate the
+- * aliasing rules a little to make initialization possible and finally we
+- * will need the barrier() to fight side effects of the aliasing chat.
+- * This trickery will eventually collapse under gcc's optimizer.  Oh well.
+- */
+ static inline void set_io_port_base(unsigned long base)
+ {
+-	* (unsigned long *) &mips_io_port_base = base;
+-	barrier();
++	mips_io_port_base = base;
+ }
+ 
+ /*
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 695950361d2a7..7cc1d29334ee1 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -74,7 +74,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+  * mips_io_port_base is the begin of the address space to which x86 style
+  * I/O ports are mapped.
+  */
+-const unsigned long mips_io_port_base = -1;
++unsigned long mips_io_port_base = -1;
+ EXPORT_SYMBOL(mips_io_port_base);
+ 
+ static struct resource code_resource = { .name = "Kernel code", };
+-- 
+2.20.1
+
diff --git a/queue-4.9/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch b/queue-4.9/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
new file mode 100644
index 00000000000..455e53d39cb
--- /dev/null
+++ b/queue-4.9/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
@@ -0,0 +1,42 @@
+From f4ad069e60e625d2cd004daf9adf60ef8a751236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:33:50 +0800
+Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ]
+
+When call function hwmon_device_register failed, use the actual
+return value instead of always -ENOMEM.
+
+Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mips/cpu_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
+index 4300a558d0f39..d02214a3f8e3f 100644
+--- a/drivers/platform/mips/cpu_hwmon.c
++++ b/drivers/platform/mips/cpu_hwmon.c
+@@ -155,7 +155,7 @@ static int __init loongson_hwmon_init(void)
+ 
+ 	cpu_hwmon_dev = hwmon_device_register(NULL);
+ 	if (IS_ERR(cpu_hwmon_dev)) {
+-		ret = -ENOMEM;
++		ret = PTR_ERR(cpu_hwmon_dev);
+ 		pr_err("hwmon_device_register fail!\n");
+ 		goto fail_hwmon_device_register;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.9/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch b/queue-4.9/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
new file mode 100644
index 00000000000..a66d380a5d0
--- /dev/null
+++ b/queue-4.9/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
@@ -0,0 +1,70 @@
+From 2125fdb2a8e9f19a578c0d68b912b9fa57db7d19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2019 09:15:17 -0700
+Subject: misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]
+
+Clang warns:
+
+drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is
+uninitialized when used within its own initialization [-Wuninitialized]
+        void *buf = buf;
+              ~~~   ^~~
+1 warning generated.
+
+Arnd's explanation during review:
+
+  /*
+   * Returns the physical address of the partition's reserved page through
+   * an iterative number of calls.
+   *
+   * On first call, 'cookie' and 'len' should be set to 0, and 'addr'
+   * set to the nasid of the partition whose reserved page's address is
+   * being sought.
+   * On subsequent calls, pass the values, that were passed back on the
+   * previous call.
+   *
+   * While the return status equals SALRET_MORE_PASSES, keep calling
+   * this function after first copying 'len' bytes starting at 'addr'
+   * into 'buf'. Once the return status equals SALRET_OK, 'addr' will
+   * be the physical address of the partition's reserved page. If the
+   * return status equals neither of these, an error as occurred.
+   */
+  static inline s64
+  sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len)
+
+  so *len is set to zero on the first call and tells the bios how many
+  bytes are accessible at 'buf', and it does get updated by the BIOS to
+  tell us how many bytes it needs, and then we allocate that and try again.
+
+Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page")
+Link: https://github.com/ClangBuiltLinux/linux/issues/466
+Suggested-by: Stephen Hines <srhines@google.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/sgi-xp/xpc_partition.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
+index 6956f7e7d4392..ca5f0102daef4 100644
+--- a/drivers/misc/sgi-xp/xpc_partition.c
++++ b/drivers/misc/sgi-xp/xpc_partition.c
+@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
+ 	unsigned long rp_pa = nasid;	/* seed with nasid */
+ 	size_t len = 0;
+ 	size_t buf_len = 0;
+-	void *buf = buf;
++	void *buf = NULL;
+ 	void *buf_base = NULL;
+ 	enum xp_retval (*get_partition_rsvd_page_pa)
+ 		(void *, u64 *, unsigned long *, size_t *) =
+-- 
+2.20.1
+
diff --git a/queue-4.9/mlxsw-reg-qeec-add-minimum-shaper-fields.patch b/queue-4.9/mlxsw-reg-qeec-add-minimum-shaper-fields.patch
new file mode 100644
index 00000000000..2bebfb94a3b
--- /dev/null
+++ b/queue-4.9/mlxsw-reg-qeec-add-minimum-shaper-fields.patch
@@ -0,0 +1,77 @@
+From 57ac91addb8d2f3f5c261a8055db621babed5c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 09:56:42 +0000
+Subject: mlxsw: reg: QEEC: Add minimum shaper fields
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ]
+
+Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable
+configuration of minimum shaper.
+
+Increase the QEEC length to 0x20 as well: that's the length that the
+register has had for a long time now, but with the configurations that
+mlxsw typically exercises, the firmware tolerated 0x1C-sized packets.
+With mise=true however, FW rejects packets unless they have the full
+required length.
+
+Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+index b2a745b579fd1..fdc69218c8cac 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -1873,7 +1873,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
+  * Configures the ETS elements.
+  */
+ #define MLXSW_REG_QEEC_ID 0x400D
+-#define MLXSW_REG_QEEC_LEN 0x1C
++#define MLXSW_REG_QEEC_LEN 0x20
+ 
+ static const struct mlxsw_reg_info mlxsw_reg_qeec = {
+ 	.id = MLXSW_REG_QEEC_ID,
+@@ -1918,6 +1918,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
+  */
+ MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
+ 
++/* reg_qeec_mise
++ * Min shaper configuration enable. Enables configuration of the min
++ * shaper on this ETS element
++ * 0 - Disable
++ * 1 - Enable
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
++
+ enum {
+ 	MLXSW_REG_QEEC_BYTES_MODE,
+ 	MLXSW_REG_QEEC_PACKETS_MODE,
+@@ -1934,6 +1943,17 @@ enum {
+  */
+ MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
+ 
++/* The smallest permitted min shaper rate. */
++#define MLXSW_REG_QEEC_MIS_MIN	200000		/* Kbps */
++
++/* reg_qeec_min_shaper_rate
++ * Min shaper information rate.
++ * For CPU port, can only be configured for port hierarchy.
++ * When in bytes mode, value is specified in units of 1000bps.
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
++
+ /* reg_qeec_mase
+  * Max shaper configuration enable. Enables configuration of the max
+  * shaper on this ETS element.
+-- 
+2.20.1
+
diff --git a/queue-4.9/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch b/queue-4.9/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
new file mode 100644
index 00000000000..35f301f8f5a
--- /dev/null
+++ b/queue-4.9/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
@@ -0,0 +1,38 @@
+From 39b3a1c4cf251a3fddef585d8a09946540eab127 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 21:59:18 +0100
+Subject: mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ]
+
+We need to handle mmc_of_parse() errors during probe otherwise the
+MMC driver could start without proper initialization (e.g. power sequence).
+
+Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
+index 159f6f64c68e7..ed6473731b458 100644
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -90,7 +90,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
+ 	host->mmc->caps2 |= MMC_CAP2_HC_ERASE_SZ;
+ 
+ 	sdhci_get_of_property(pdev);
+-	mmc_of_parse(host->mmc);
++	res = mmc_of_parse(host->mmc);
++	if (res)
++		goto err;
+ 
+ 	/*
+ 	 * Supply the existing CAPS, but clear the UHS modes. This
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-af_iucv-always-register-net_device-notifier.patch b/queue-4.9/net-af_iucv-always-register-net_device-notifier.patch
new file mode 100644
index 00000000000..4e5dbbbc2a8
--- /dev/null
+++ b/queue-4.9/net-af_iucv-always-register-net_device-notifier.patch
@@ -0,0 +1,84 @@
+From 5c30d3ce5fcd829d81a1438e0da70c6bb41fe8d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 20:43:01 +0200
+Subject: net/af_iucv: always register net_device notifier
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ]
+
+Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still
+open HiperTransport-based connections. For robust operation these
+connections require the af_iucv_netdev_notifier, so register it
+unconditionally.
+
+Also handle any error that register_netdevice_notifier() returns.
+
+Fixes: 9fbd87d41392 ("af_iucv: handle netdev events")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/iucv/af_iucv.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index c2dfc32eb9f21..02e10deef5b45 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -2431,6 +2431,13 @@ out:
+ 	return err;
+ }
+ 
++static void afiucv_iucv_exit(void)
++{
++	device_unregister(af_iucv_dev);
++	driver_unregister(&af_iucv_driver);
++	pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++}
++
+ static int __init afiucv_init(void)
+ {
+ 	int err;
+@@ -2464,11 +2471,18 @@ static int __init afiucv_init(void)
+ 		err = afiucv_iucv_init();
+ 		if (err)
+ 			goto out_sock;
+-	} else
+-		register_netdevice_notifier(&afiucv_netdev_notifier);
++	}
++
++	err = register_netdevice_notifier(&afiucv_netdev_notifier);
++	if (err)
++		goto out_notifier;
++
+ 	dev_add_pack(&iucv_packet_type);
+ 	return 0;
+ 
++out_notifier:
++	if (pr_iucv)
++		afiucv_iucv_exit();
+ out_sock:
+ 	sock_unregister(PF_IUCV);
+ out_proto:
+@@ -2482,12 +2496,11 @@ out:
+ static void __exit afiucv_exit(void)
+ {
+ 	if (pr_iucv) {
+-		device_unregister(af_iucv_dev);
+-		driver_unregister(&af_iucv_driver);
+-		pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++		afiucv_iucv_exit();
+ 		symbol_put(iucv_if);
+-	} else
+-		unregister_netdevice_notifier(&afiucv_netdev_notifier);
++	}
++
++	unregister_netdevice_notifier(&afiucv_netdev_notifier);
+ 	dev_remove_pack(&iucv_packet_type);
+ 	sock_unregister(PF_IUCV);
+ 	proto_unregister(&iucv_proto);
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch b/queue-4.9/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
new file mode 100644
index 00000000000..258f7218e10
--- /dev/null
+++ b/queue-4.9/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
@@ -0,0 +1,38 @@
+From 9a19913cdbbd6dbd00e7d54f7a82961864e233cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:56:04 +0300
+Subject: net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ]
+
+The "priv->phy_interface" variable is an enum and in this context GCC
+will treat it as unsigned so the error handling will never be
+triggered.
+
+Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 95874c10c23b6..e3b41af65d188 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1773,7 +1773,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+ 
+ 	priv->phy_interface = of_get_phy_mode(dn);
+ 	/* Default to GMII interface mode */
+-	if (priv->phy_interface < 0)
++	if ((int)priv->phy_interface < 0)
+ 		priv->phy_interface = PHY_INTERFACE_MODE_GMII;
+ 
+ 	/* In the case of a fixed PHY, the DT node associated
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch b/queue-4.9/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
new file mode 100644
index 00000000000..baa8795b062
--- /dev/null
+++ b/queue-4.9/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
@@ -0,0 +1,64 @@
+From 8a2e3e8287c9b423ad0608505e83a6eb1df2f10e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 12:29:43 +0530
+Subject: net: dsa: qca8k: Enable delay for RGMII_ID mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ]
+
+RGMII_ID specifies that we should have internal delay, so resurrect the
+delay addition routine but under the RGMII_ID mode.
+
+Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode")
+Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca8k.c | 12 ++++++++++++
+ drivers/net/dsa/qca8k.h |  1 +
+ 2 files changed, 13 insertions(+)
+
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index ebfbaf8597f40..3bbe85aae49bb 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -460,6 +460,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
+ 		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+ 			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+ 		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		/* RGMII_ID needs internal delay. This is enabled through
++		 * PORT5_PAD_CTRL for all ports, rather than individual port
++		 * registers
++		 */
++		qca8k_write(priv, reg,
++			    QCA8K_PORT_PAD_RGMII_EN |
++			    QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
++			    QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
++		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
++			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
++		break;
+ 	case PHY_INTERFACE_MODE_SGMII:
+ 		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
+ 		break;
+diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
+index 9c22bc3210cdf..db95168ca111d 100644
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -40,6 +40,7 @@
+ 						((0x8 + (x & 0x3)) << 22)
+ #define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		\
+ 						((0x10 + (x & 0x3)) << 20)
++#define   QCA8K_MAX_DELAY				3
+ #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
+ #define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
+ #define QCA8K_REG_MODULE_EN				0x030
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-ena-fix-ena_com_fill_hash_function-implementatio.patch b/queue-4.9/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
new file mode 100644
index 00000000000..cc0c7a8fe0d
--- /dev/null
+++ b/queue-4.9/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
@@ -0,0 +1,35 @@
+From 9650d0225443d7debd369aa2ef37693e1fb0b659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:09 +0300
+Subject: net: ena: fix ena_com_fill_hash_function() implementation
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ]
+
+ena_com_fill_hash_function() didn't configure the rss->hash_func.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 2d196d521b836..912dc09bc7a74 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2052,6 +2052,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
+ 		return -EINVAL;
+ 	}
+ 
++	rss->hash_func = func;
+ 	rc = ena_com_set_hash_function(ena_dev);
+ 
+ 	/* Restore the old function */
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-ena-fix-free-napi-resources-when-ena_up-fails.patch b/queue-4.9/net-ena-fix-free-napi-resources-when-ena_up-fails.patch
new file mode 100644
index 00000000000..6023bb3336c
--- /dev/null
+++ b/queue-4.9/net-ena-fix-free-napi-resources-when-ena_up-fails.patch
@@ -0,0 +1,38 @@
+From 9fdf281b3567e9df1a95b9dd08ea1ca42e695644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:05 +0300
+Subject: net: ena: fix: Free napi resources when ena_up() fails
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ]
+
+ena_up() calls ena_init_napi() but does not call ena_del_napi() in
+case of failure. This causes a segmentation fault upon rmmod when
+netif_napi_del() is called. Fix this bug by calling ena_del_napi()
+before returning error from ena_up().
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 961f31c8356b7..da21886609e30 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1702,6 +1702,7 @@ err_setup_rx:
+ err_setup_tx:
+ 	ena_free_io_irq(adapter);
+ err_req_irq:
++	ena_del_napi(adapter);
+ 
+ 	return rc;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-ena-fix-incorrect-test-of-supported-hash-functio.patch b/queue-4.9/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
new file mode 100644
index 00000000000..607c95ce4d7
--- /dev/null
+++ b/queue-4.9/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
@@ -0,0 +1,40 @@
+From 105dcca7110694a33da8722348c2addf0307d60e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:06 +0300
+Subject: net: ena: fix incorrect test of supported hash function
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ]
+
+ena_com_set_hash_function() tests if a hash function is supported
+by the device before setting it.
+The test returns the opposite result than needed.
+Reverse the condition to return the correct value.
+Also use the BIT macro instead of inline shift.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index bcd993140f841..2d196d521b836 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -1967,7 +1967,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
+ 	if (unlikely(ret))
+ 		return ret;
+ 
+-	if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
++	if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
+ 		pr_err("Func hash %d isn't supported by device, abort\n",
+ 		       rss->hash_func);
+ 		return -EPERM;
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch b/queue-4.9/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
new file mode 100644
index 00000000000..a8af0161673
--- /dev/null
+++ b/queue-4.9/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
@@ -0,0 +1,39 @@
+From e78b57e9a5b012b1bf00a4d00d81d9cc5a3a3559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:03 +0300
+Subject: net: ena: fix swapped parameters when calling
+ ena_com_indirect_table_fill_entry
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ]
+
+second parameter should be the index of the table rather than the value.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Saeed Bshara <saeedb@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 67b2338f8fb34..06fd061a20e9a 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -697,8 +697,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
+ 	if (indir) {
+ 		for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
+ 			rc = ena_com_indirect_table_fill_entry(ena_dev,
+-							       ENA_IO_RXQ_IDX(indir[i]),
+-							       i);
++							       i,
++							       ENA_IO_RXQ_IDX(indir[i]));
+ 			if (unlikely(rc)) {
+ 				netif_err(adapter, drv, netdev,
+ 					  "Cannot fill indirect table (index is too large)\n");
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch b/queue-4.9/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
new file mode 100644
index 00000000000..d7fada5df1a
--- /dev/null
+++ b/queue-4.9/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
@@ -0,0 +1,37 @@
+From d35ce862380a49e6ed46e656c9e8195f274a88fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:05:54 +0300
+Subject: net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ]
+
+The "gmac->phy_mode" variable is an enum and in this context GCC will
+treat it as an unsigned int so the error handling will never be
+triggered.
+
+Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 866444b6c82fa..11a4a81b0397c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -203,7 +203,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
+ 	struct device *dev = &gmac->pdev->dev;
+ 
+ 	gmac->phy_mode = of_get_phy_mode(dev->of_node);
+-	if (gmac->phy_mode < 0) {
++	if ((int)gmac->phy_mode < 0) {
+ 		dev_err(dev, "missing phy mode property\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch b/queue-4.9/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
new file mode 100644
index 00000000000..ebbf721c049
--- /dev/null
+++ b/queue-4.9/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
@@ -0,0 +1,36 @@
+From 28ff319074745bc1fc01fc20c8185c1a6549d4be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:55:32 +0300
+Subject: net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ]
+
+The "priv->phy_mode" variable is an enum and in this context GCC will
+treat it as unsigned to the error handling will never trigger.
+
+Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index e69a6bed31a95..dd24c352b2000 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -929,7 +929,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
+ 		goto err_free_mdio;
+ 
+ 	priv->phy_mode = of_get_phy_mode(node);
+-	if (priv->phy_mode < 0) {
++	if ((int)priv->phy_mode < 0) {
+ 		netdev_err(ndev, "not find phy-mode\n");
+ 		ret = -EINVAL;
+ 		goto err_mdiobus;
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch b/queue-4.9/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
new file mode 100644
index 00000000000..89dad27a27e
--- /dev/null
+++ b/queue-4.9/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
@@ -0,0 +1,36 @@
+From 9d3ef3297c497a7153f243afbc825647671b0bcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 14:40:13 +0300
+Subject: net/mlx5: Fix mlx5_ifc_query_lag_out_bits
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit ea77388b02270b0af8dc57f668f311235ea068f0 ]
+
+Remove the "reserved_at_40" field to match the device specification.
+
+Fixes: 84df61ebc69b ("net/mlx5: Add HW interfaces used by LAG")
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 20ee90c47cd50..6dd276227217e 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -7909,8 +7909,6 @@ struct mlx5_ifc_query_lag_out_bits {
+ 
+ 	u8         syndrome[0x20];
+ 
+-	u8         reserved_at_40[0x40];
+-
+ 	struct mlx5_ifc_lagc_bits ctx;
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-neigh-use-long-type-to-store-jiffies-delta.patch b/queue-4.9/net-neigh-use-long-type-to-store-jiffies-delta.patch
new file mode 100644
index 00000000000..cd8401e7eef
--- /dev/null
+++ b/queue-4.9/net-neigh-use-long-type-to-store-jiffies-delta.patch
@@ -0,0 +1,37 @@
+From 5448214f92270de77ec35af0661a9f7700e3f134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:11:49 -0800
+Subject: net: neigh: use long type to store jiffies delta
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]
+
+A difference of two unsigned long needs long storage.
+
+Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index cd85cee14bd03..6578d1f8e6c4a 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1834,8 +1834,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
+ 		goto nla_put_failure;
+ 	{
+ 		unsigned long now = jiffies;
+-		unsigned int flush_delta = now - tbl->last_flush;
+-		unsigned int rand_delta = now - tbl->last_rand;
++		long flush_delta = now - tbl->last_flush;
++		long rand_delta = now - tbl->last_rand;
+ 		struct neigh_hash_table *nht;
+ 		struct ndt_config ndc = {
+ 			.ndtc_key_len		= tbl->key_len,
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-netem-correct-the-parent-s-backlog-when-corrupte.patch b/queue-4.9/net-netem-correct-the-parent-s-backlog-when-corrupte.patch
new file mode 100644
index 00000000000..8bc1589e0ab
--- /dev/null
+++ b/queue-4.9/net-netem-correct-the-parent-s-backlog-when-corrupte.patch
@@ -0,0 +1,40 @@
+From 1092fa5d454dbc95fe7130a0319a8651ffcd55df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:16:58 -0700
+Subject: net: netem: correct the parent's backlog when corrupted packet was
+ dropped
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit e0ad032e144731a5928f2d75e91c2064ba1a764c ]
+
+If packet corruption failed we jump to finish_segs and return
+NET_XMIT_SUCCESS. Seeing success will make the parent qdisc
+increment its backlog, that's incorrect - we need to return
+NET_XMIT_DROP.
+
+Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 11c4c93f5ded7..e06491314d592 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -609,6 +609,8 @@ finish_segs:
+ 		}
+ 		/* Parent qdiscs accounted for 1 skb of size @prev_len */
+ 		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
++	} else if (!skb) {
++		return NET_XMIT_DROP;
+ 	}
+ 	return NET_XMIT_SUCCESS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch b/queue-4.9/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
new file mode 100644
index 00000000000..c33fe83403c
--- /dev/null
+++ b/queue-4.9/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
@@ -0,0 +1,84 @@
+From 3893f4af103f18817694357dc23f7432b5000d24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2019 11:11:10 -0700
+Subject: net: netem: fix backlog accounting for corrupted GSO frames
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 177b8007463c4f36c9a2c7ce7aa9875a4cad9bd5 ]
+
+When GSO frame has to be corrupted netem uses skb_gso_segment()
+to produce the list of frames, and re-enqueues the segments one
+by one.  The backlog length has to be adjusted to account for
+new frames.
+
+The current calculation is incorrect, leading to wrong backlog
+lengths in the parent qdisc (both bytes and packets), and
+incorrect packet backlog count in netem itself.
+
+Parent backlog goes negative, netem's packet backlog counts
+all non-first segments twice (thus remaining non-zero even
+after qdisc is emptied).
+
+Move the variables used to count the adjustment into local
+scope to make 100% sure they aren't used at any stage in
+backports.
+
+Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 95002e56fa48b..308d92491757e 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -437,8 +437,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 	struct netem_skb_cb *cb;
+ 	struct sk_buff *skb2;
+ 	struct sk_buff *segs = NULL;
+-	unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
+-	int nb = 0;
++	unsigned int prev_len = qdisc_pkt_len(skb);
+ 	int count = 1;
+ 	int rc = NET_XMIT_SUCCESS;
+ 	int rc_drop = NET_XMIT_DROP;
+@@ -495,6 +494,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 			segs = netem_segment(skb, sch, to_free);
+ 			if (!segs)
+ 				return rc_drop;
++			qdisc_skb_cb(segs)->pkt_len = segs->len;
+ 		} else {
+ 			segs = skb;
+ 		}
+@@ -585,6 +585,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 
+ finish_segs:
+ 	if (segs) {
++		unsigned int len, last_len;
++		int nb = 0;
++
++		len = skb->len;
++
+ 		while (segs) {
+ 			skb2 = segs->next;
+ 			segs->next = NULL;
+@@ -600,9 +605,7 @@ finish_segs:
+ 			}
+ 			segs = skb2;
+ 		}
+-		sch->q.qlen += nb;
+-		if (nb > 1)
+-			qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
++		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
+ 	}
+ 	return NET_XMIT_SUCCESS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-netem-fix-error-path-for-corrupted-gso-frames.patch b/queue-4.9/net-netem-fix-error-path-for-corrupted-gso-frames.patch
new file mode 100644
index 00000000000..e06fe65ffd2
--- /dev/null
+++ b/queue-4.9/net-netem-fix-error-path-for-corrupted-gso-frames.patch
@@ -0,0 +1,74 @@
+From 3f6a1a4a0413901b83aa03dcf8843308fc6aebcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:16:57 -0700
+Subject: net: netem: fix error path for corrupted GSO frames
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit a7fa12d15855904aff1716e1fc723c03ba38c5cc ]
+
+To corrupt a GSO frame we first perform segmentation.  We then
+proceed using the first segment instead of the full GSO skb and
+requeue the rest of the segments as separate packets.
+
+If there are any issues with processing the first segment we
+still want to process the rest, therefore we jump to the
+finish_segs label.
+
+Commit 177b8007463c ("net: netem: fix backlog accounting for
+corrupted GSO frames") started using the pointer to the first
+segment in the "rest of segments processing", but as mentioned
+above the first segment may had already been freed at this point.
+
+Backlog corrections for parent qdiscs have to be adjusted.
+
+Fixes: 177b8007463c ("net: netem: fix backlog accounting for corrupted GSO frames")
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 308d92491757e..11c4c93f5ded7 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -510,6 +510,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 		if (skb->ip_summed == CHECKSUM_PARTIAL &&
+ 		    skb_checksum_help(skb)) {
+ 			qdisc_drop(skb, sch, to_free);
++			skb = NULL;
+ 			goto finish_segs;
+ 		}
+ 
+@@ -586,9 +587,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ finish_segs:
+ 	if (segs) {
+ 		unsigned int len, last_len;
+-		int nb = 0;
++		int nb;
+ 
+-		len = skb->len;
++		len = skb ? skb->len : 0;
++		nb = skb ? 1 : 0;
+ 
+ 		while (segs) {
+ 			skb2 = segs->next;
+@@ -605,7 +607,8 @@ finish_segs:
+ 			}
+ 			segs = skb2;
+ 		}
+-		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
++		/* Parent qdiscs accounted for 1 skb of size @prev_len */
++		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
+ 	}
+ 	return NET_XMIT_SUCCESS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch b/queue-4.9/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
new file mode 100644
index 00000000000..aebd80856e8
--- /dev/null
+++ b/queue-4.9/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
@@ -0,0 +1,49 @@
+From ef33257058e3d4cfc52edd76af62ba2be3d4f07a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jul 2019 12:23:41 +0800
+Subject: net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]
+
+The phy_dn variable is still being used in of_phy_connect() after the
+of_node_put() call, which may result in use-after-free.
+
+Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 2f4a837f0d6ad..dcd56ac687482 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ 
+ 	dn = pci_device_to_OF_node(mac->pdev);
+ 	phy_dn = of_parse_phandle(dn, "phy-handle", 0);
+-	of_node_put(phy_dn);
+ 
+ 	mac->link = 0;
+ 	mac->speed = 0;
+@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ 	phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
+ 				PHY_INTERFACE_MODE_SGMII);
+ 
++	of_node_put(phy_dn);
+ 	if (!phydev) {
+ 		printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
+ 		return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch b/queue-4.9/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
new file mode 100644
index 00000000000..29f2d73b6b3
--- /dev/null
+++ b/queue-4.9/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
@@ -0,0 +1,68 @@
+From 8d1db79256d68acef2dcbd112e96313e66ab66a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 09:02:41 +0000
+Subject: net: phy: Fix not to call phy_resume() if PHY is not attached
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ]
+
+This patch fixes an issue that mdio_bus_phy_resume() doesn't call
+phy_resume() if the PHY is not attached.
+
+Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 3289fd910c4a6..487d0372a4441 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -80,7 +80,7 @@ static LIST_HEAD(phy_fixup_list);
+ static DEFINE_MUTEX(phy_fixup_lock);
+ 
+ #ifdef CONFIG_PM
+-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
+ {
+ 	struct device_driver *drv = phydev->mdio.dev.driver;
+ 	struct phy_driver *phydrv = to_phy_driver(drv);
+@@ -92,10 +92,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ 	/* PHY not attached? May suspend if the PHY has not already been
+ 	 * suspended as part of a prior call to phy_disconnect() ->
+ 	 * phy_detach() -> phy_suspend() because the parent netdev might be the
+-	 * MDIO bus driver and clock gated at this point.
++	 * MDIO bus driver and clock gated at this point. Also may resume if
++	 * PHY is not attached.
+ 	 */
+ 	if (!netdev)
+-		return !phydev->suspended;
++		return suspend ? !phydev->suspended : phydev->suspended;
+ 
+ 	/* Don't suspend PHY if the attached netdev parent may wakeup.
+ 	 * The parent may point to a PCI device, as in tg3 driver.
+@@ -125,7 +126,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
+ 	if (phydev->attached_dev && phydev->adjust_link)
+ 		phy_stop_machine(phydev);
+ 
+-	if (!mdio_bus_phy_may_suspend(phydev))
++	if (!mdio_bus_phy_may_suspend(phydev, true))
+ 		return 0;
+ 
+ 	return phy_suspend(phydev);
+@@ -136,7 +137,7 @@ static int mdio_bus_phy_resume(struct device *dev)
+ 	struct phy_device *phydev = to_phy_device(dev);
+ 	int ret;
+ 
+-	if (!mdio_bus_phy_may_suspend(phydev))
++	if (!mdio_bus_phy_may_suspend(phydev, false))
+ 		goto no_resume;
+ 
+ 	ret = phy_resume(phydev);
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch b/queue-4.9/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
new file mode 100644
index 00000000000..08795d721f6
--- /dev/null
+++ b/queue-4.9/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
@@ -0,0 +1,46 @@
+From 733d96ef347e44d6d88d0852d1a25fb6da872c0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 21:45:29 -0800
+Subject: net: phy: fixed_phy: Fix fixed_phy not checking GPIO
+
+From: Moritz Fischer <mdf@kernel.org>
+
+[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ]
+
+Fix fixed_phy not checking GPIO if no link_update callback
+is registered.
+
+In the original version all users registered a link_update
+callback so the issue was masked.
+
+Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/fixed_phy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index eb51672106811..3ab2eb677a599 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
+ 			do {
+ 				s = read_seqcount_begin(&fp->seqcount);
+ 				/* Issue callback if user registered it. */
+-				if (fp->link_update) {
++				if (fp->link_update)
+ 					fp->link_update(fp->phydev->attached_dev,
+ 							&fp->status);
+-					fixed_phy_update(fp);
+-				}
++				/* Check the GPIO for change in status */
++				fixed_phy_update(fp);
+ 				state = fp->status;
+ 			} while (read_seqcount_retry(&fp->seqcount, s));
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-qca_spi-move-reset_count-to-struct-qcaspi.patch b/queue-4.9/net-qca_spi-move-reset_count-to-struct-qcaspi.patch
new file mode 100644
index 00000000000..720dddda623
--- /dev/null
+++ b/queue-4.9/net-qca_spi-move-reset_count-to-struct-qcaspi.patch
@@ -0,0 +1,68 @@
+From 9e59c21a46a20d67d88ae5fa2cf49a07df6f684e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 18:29:13 +0100
+Subject: net: qca_spi: Move reset_count to struct qcaspi
+
+From: Stefan Wahren <stefan.wahren@in-tech.com>
+
+[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ]
+
+The reset counter is specific for every QCA700x chip. So move this
+into the private driver struct. Otherwise we get unpredictable reset
+behavior in setups with multiple QCA700x chips.
+
+Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
+Signed-off-by: Stefan Wahren <stefan.wahren@in-tech.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++-----
+ drivers/net/ethernet/qualcomm/qca_spi.h | 1 +
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 21f546587e3d5..31583d6f044f4 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -438,7 +438,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ 	u16 signature = 0;
+ 	u16 spi_config;
+ 	u16 wrbuf_space = 0;
+-	static u16 reset_count;
+ 
+ 	if (event == QCASPI_EVENT_CPUON) {
+ 		/* Read signature twice, if not valid
+@@ -491,13 +490,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ 
+ 		qca->sync = QCASPI_SYNC_RESET;
+ 		qca->stats.trig_reset++;
+-		reset_count = 0;
++		qca->reset_count = 0;
+ 		break;
+ 	case QCASPI_SYNC_RESET:
+-		reset_count++;
++		qca->reset_count++;
+ 		netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
+-			   reset_count);
+-		if (reset_count >= QCASPI_RESET_TIMEOUT) {
++			   qca->reset_count);
++		if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
+ 			/* reset did not seem to take place, try again */
+ 			qca->sync = QCASPI_SYNC_UNKNOWN;
+ 			qca->stats.reset_timeout++;
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
+index 6e31a0e744a45..c48c314ca4dfa 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.h
++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
+@@ -97,6 +97,7 @@ struct qcaspi {
+ 
+ 	unsigned int intr_req;
+ 	unsigned int intr_svc;
++	u16 reset_count;
+ 
+ #ifdef CONFIG_DEBUG_FS
+ 	struct dentry *device_root;
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch b/queue-4.9/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
new file mode 100644
index 00000000000..3d496c37e50
--- /dev/null
+++ b/queue-4.9/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
@@ -0,0 +1,40 @@
+From 6776d126b782e046352558a2aae5f0f7b93a1af8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 13:49:41 -0700
+Subject: net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ]
+
+All entries in 'rds_ib_stat_names' are stringified versions
+of the corresponding "struct rds_ib_statistics" element
+without the "s_"-prefix.
+
+Fix entry 'ib_evt_handler_call' to do the same.
+
+Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance")
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/ib_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
+index 7e78dca1f252c..aaf4b3d102039 100644
+--- a/net/rds/ib_stats.c
++++ b/net/rds/ib_stats.c
+@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
+ static const char *const rds_ib_stat_names[] = {
+ 	"ib_connect_raced",
+ 	"ib_listen_closed_stale",
+-	"s_ib_evt_handler_call",
++	"ib_evt_handler_call",
+ 	"ib_tasklet_call",
+ 	"ib_tx_cq_event",
+ 	"ib_tx_ring_full",
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch b/queue-4.9/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
new file mode 100644
index 00000000000..0c4979b5f35
--- /dev/null
+++ b/queue-4.9/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
@@ -0,0 +1,49 @@
+From 47faccde0c01111a5ffede26b02223e7ec6cf9a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2019 02:43:18 -0500
+Subject: net: sh_eth: fix a missing check of of_get_phy_mode
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]
+
+of_get_phy_mode may fail and return a negative error code;
+the fix checks the return value of of_get_phy_mode and
+returns NULL of it fails.
+
+Fixes: b356e978e92f ("sh_eth: add device tree support")
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 49300194d3f9f..6f8d4810ce979 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2929,12 +2929,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
+ 	struct device_node *np = dev->of_node;
+ 	struct sh_eth_plat_data *pdata;
+ 	const char *mac_addr;
++	int ret;
+ 
+ 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
+ 	if (!pdata)
+ 		return NULL;
+ 
+-	pdata->phy_interface = of_get_phy_mode(np);
++	ret = of_get_phy_mode(np);
++	if (ret < 0)
++		return NULL;
++	pdata->phy_interface = ret;
+ 
+ 	mac_addr = of_get_mac_address(np);
+ 	if (mac_addr)
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch b/queue-4.9/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
new file mode 100644
index 00000000000..b80ed4b16d6
--- /dev/null
+++ b/queue-4.9/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
@@ -0,0 +1,37 @@
+From 117b7f2710dac30b0c8f840bdfaa1ae5db2fd7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 09:36:23 +0800
+Subject: net: sonic: replace dev_kfree_skb in sonic_send_packet
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ]
+
+sonic_send_packet will be processed in irq or non-irq
+context, so it would better use dev_kfree_skb_any
+instead of dev_kfree_skb.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 11f472fd5d477..a051dddcbd768 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -222,7 +222,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ 	if (!laddr) {
+ 		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch b/queue-4.9/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
new file mode 100644
index 00000000000..28f649e7266
--- /dev/null
+++ b/queue-4.9/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
@@ -0,0 +1,42 @@
+From 8a6f4fae45d1c3c42af340e223750b0d13714f1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 09:57:12 +0800
+Subject: net: sonic: return NETDEV_TX_OK if failed to map buffer
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ]
+
+NETDEV_TX_BUSY really should only be used by drivers that call
+netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
+failed to map tx DMA buffer, it might trigger an infinite loop.
+This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
+printk to pr_err_ratelimited.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 23821540ab078..11f472fd5d477 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -221,9 +221,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ 
+ 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ 	if (!laddr) {
+-		printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
++		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+ 		dev_kfree_skb(skb);
+-		return NETDEV_TX_BUSY;
++		return NETDEV_TX_OK;
+ 	}
+ 
+ 	sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0);       /* clear status */
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch b/queue-4.9/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
new file mode 100644
index 00000000000..05305fad9ff
--- /dev/null
+++ b/queue-4.9/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
@@ -0,0 +1,37 @@
+From cbdb3a79e71a2303b75f95bf6ea24429678ab4b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:58:22 +0300
+Subject: net: stmmac: dwmac-meson8b: Fix signedness bug in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f10210517a2f37feea2edf85eb34c98977265c16 ]
+
+The "dwmac->phy_mode" is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: 566e82516253 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index f356a44bcb811..6704d3e0392dc 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -280,7 +280,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
+ 
+ 	dwmac->pdev = pdev;
+ 	dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+-	if (dwmac->phy_mode < 0) {
++	if ((int)dwmac->phy_mode < 0) {
+ 		dev_err(&pdev->dev, "missing phy-mode property\n");
+ 		ret = -EINVAL;
+ 		goto err_remove_config_dt;
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch b/queue-4.9/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
new file mode 100644
index 00000000000..457a07db377
--- /dev/null
+++ b/queue-4.9/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
@@ -0,0 +1,51 @@
+From 91de911eb0b62dbea3e1b3684425c0f47a6c8376 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 17:43:04 +0200
+Subject: net: stmmac: fix length of PTP clock's name string
+
+From: Antonio Borneo <antonio.borneo@st.com>
+
+[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ]
+
+The field "name" in struct ptp_clock_info has a fixed size of 16
+chars and is used as zero terminated string by clock_name_show()
+in drivers/ptp/ptp_sysfs.c
+The current initialization value requires 17 chars to fit also the
+null termination, and this causes overflow to the next bytes in
+the struct when the string is read as null terminated:
+	hexdump -C /sys/class/ptp/ptp0/clock_name
+	00000000  73 74 6d 6d 61 63 5f 70  74 70 5f 63 6c 6f 63 6b  |stmmac_ptp_clock|
+	00000010  a0 ac b9 03 0a                                    |.....|
+where the extra 4 bytes (excluding the newline) after the string
+represent the integer 0x03b9aca0 = 62500000 assigned to the field
+"max_adj" that follows "name" in the same struct.
+
+There is no strict requirement for the "name" content and in the
+comment in ptp_clock_kernel.h it's reported it should just be 'A
+short "friendly name" to identify the clock'.
+Replace it with "stmmac ptp".
+
+Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
+Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index 3eb281d1db08a..2313308090370 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -158,7 +158,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
+ /* structure describing a PTP hardware clock */
+ static struct ptp_clock_info stmmac_ptp_clock_ops = {
+ 	.owner = THIS_MODULE,
+-	.name = "stmmac_ptp_clock",
++	.name = "stmmac ptp",
+ 	.max_adj = 62500000,
+ 	.n_alarm = 0,
+ 	.n_ext_ts = 0,
+-- 
+2.20.1
+
diff --git a/queue-4.9/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch b/queue-4.9/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
new file mode 100644
index 00000000000..508a2bf2640
--- /dev/null
+++ b/queue-4.9/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
@@ -0,0 +1,36 @@
+From 070d6a3c8b443ee107225fea4ca2af1b0040da4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 13:08:56 +0200
+Subject: net: stmmac: gmac4+: Not all Unicast addresses may be available
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 25683bab09a70542b9f8e3e28f79b3369e56701f ]
+
+Some setups may not have all Unicast addresses filters available. Check
+the number of available filters before trying to setup it.
+
+Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index f46f2bfc2cc09..4216c0a5eaf5a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -168,7 +168,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ 	}
+ 
+ 	/* Handle multiple unicast addresses */
+-	if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
++	if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
+ 		/* Switch to promiscuous mode if more than 128 addrs
+ 		 * are required
+ 		 */
+-- 
+2.20.1
+
diff --git a/queue-4.9/netfilter-ebtables-config_compat-reject-trailing-dat.patch b/queue-4.9/netfilter-ebtables-config_compat-reject-trailing-dat.patch
new file mode 100644
index 00000000000..8c54c07eab9
--- /dev/null
+++ b/queue-4.9/netfilter-ebtables-config_compat-reject-trailing-dat.patch
@@ -0,0 +1,44 @@
+From e554690cb6fa4f94d7895994f6e42bd55519fb60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2019 18:47:33 +0200
+Subject: netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last
+ rule
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]
+
+If userspace provides a rule blob with trailing data after last target,
+we trigger a splat, then convert ruleset to 64bit format (with trailing
+data), then pass that to do_replace_finish() which then returns -EINVAL.
+
+Erroring out right away avoids the splat plus unneeded translation and
+error unwind.
+
+Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebtables.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 56b7197f03739..1d850edecd724 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2182,7 +2182,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	WARN_ON(size_remaining);
++	if (size_remaining)
++		return -EINVAL;
++
+ 	return state->buf_kern_offset;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch b/queue-4.9/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
new file mode 100644
index 00000000000..b9311173c11
--- /dev/null
+++ b/queue-4.9/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
@@ -0,0 +1,83 @@
+From 7378564e1aa0073a8e4f0f3a87d741206b82c69b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Feb 2019 14:51:25 -0500
+Subject: NFS: Fix a soft lockup in the delegation recovery code
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ]
+
+Fix a soft lockup when NFS client delegation recovery is attempted
+but the inode is in the process of being freed. When the
+igrab(inode) call fails, and we have to restart the recovery process,
+we need to ensure that we won't attempt to recover the same delegation
+again.
+
+Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 20 ++++++++++++--------
+ fs/nfs/delegation.h |  1 +
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 9a8830a0f31f9..014039618cff0 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -234,6 +234,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
+ 	spin_lock(&delegation->lock);
+ 	if (delegation->inode != NULL)
+ 		inode = igrab(delegation->inode);
++	if (!inode)
++		set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
+ 	spin_unlock(&delegation->lock);
+ 	return inode;
+ }
+@@ -867,10 +869,11 @@ restart:
+ 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ 		list_for_each_entry_rcu(delegation, &server->delegations,
+ 								super_list) {
+-			if (test_bit(NFS_DELEGATION_RETURNING,
+-						&delegation->flags))
+-				continue;
+-			if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
++			if (test_bit(NFS_DELEGATION_INODE_FREEING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_RETURNING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_NEED_RECLAIM,
+ 						&delegation->flags) == 0)
+ 				continue;
+ 			if (!nfs_sb_active(server->super))
+@@ -975,10 +978,11 @@ restart:
+ 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ 		list_for_each_entry_rcu(delegation, &server->delegations,
+ 								super_list) {
+-			if (test_bit(NFS_DELEGATION_RETURNING,
+-						&delegation->flags))
+-				continue;
+-			if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
++			if (test_bit(NFS_DELEGATION_INODE_FREEING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_RETURNING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_TEST_EXPIRED,
+ 						&delegation->flags) == 0)
+ 				continue;
+ 			if (!nfs_sb_active(server->super))
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index 2c6cb7fb7d5ee..f72095bf9e107 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -33,6 +33,7 @@ enum {
+ 	NFS_DELEGATION_RETURNING,
+ 	NFS_DELEGATION_REVOKED,
+ 	NFS_DELEGATION_TEST_EXPIRED,
++	NFS_DELEGATION_INODE_FREEING,
+ };
+ 
+ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
+-- 
+2.20.1
+
diff --git a/queue-4.9/nios2-ksyms-add-missing-symbol-exports.patch b/queue-4.9/nios2-ksyms-add-missing-symbol-exports.patch
new file mode 100644
index 00000000000..a807629fd1d
--- /dev/null
+++ b/queue-4.9/nios2-ksyms-add-missing-symbol-exports.patch
@@ -0,0 +1,67 @@
+From f6731d14daa405103f460c3ef4f85b07cb7ebc0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:36:10 +0800
+Subject: nios2: ksyms: Add missing symbol exports
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]
+
+Building nios2:allmodconfig fails as follows (each symbol is only listed
+once).
+
+ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
+ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
+ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
+ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
+ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
+ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!
+
+The problem is seen with gcc 7.3.0.
+
+Export the missing symbols.
+
+Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
+index bf2f55d10a4d8..4e704046a150c 100644
+--- a/arch/nios2/kernel/nios2_ksyms.c
++++ b/arch/nios2/kernel/nios2_ksyms.c
+@@ -9,12 +9,20 @@
+ #include <linux/export.h>
+ #include <linux/string.h>
+ 
++#include <asm/cacheflush.h>
++#include <asm/pgtable.h>
++
+ /* string functions */
+ 
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memmove);
+ 
++/* memory management */
++
++EXPORT_SYMBOL(empty_zero_page);
++EXPORT_SYMBOL(flush_icache_range);
++
+ /*
+  * libgcc functions - functions that are used internally by the
+  * compiler...  (prototypes are not correct though, but that
+@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
+ DECLARE_EXPORT(__umoddi3);
+ DECLARE_EXPORT(__umodsi3);
+ DECLARE_EXPORT(__muldi3);
++DECLARE_EXPORT(__ucmpdi2);
++DECLARE_EXPORT(__lshrdi3);
++DECLARE_EXPORT(__ashldi3);
++DECLARE_EXPORT(__ashrdi3);
+-- 
+2.20.1
+
diff --git a/queue-4.9/nvme-retain-split-access-workaround-for-capability-r.patch b/queue-4.9/nvme-retain-split-access-workaround-for-capability-r.patch
new file mode 100644
index 00000000000..dac7b69cfe8
--- /dev/null
+++ b/queue-4.9/nvme-retain-split-access-workaround-for-capability-r.patch
@@ -0,0 +1,57 @@
+From 875ff1b1c1d969c1886bdcb39c736fc450705221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 13:57:29 +0200
+Subject: nvme: retain split access workaround for capability reads
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 3a8ecc935efabdad106b5e06d07b150c394b4465 ]
+
+Commit 7fd8930f26be4
+
+  "nvme: add a common helper to read Identify Controller data"
+
+has re-introduced an issue that we have attempted to work around in the
+past, in commit a310acd7a7ea ("NVMe: use split lo_hi_{read,write}q").
+
+The problem is that some PCIe NVMe controllers do not implement 64-bit
+outbound accesses correctly, which is why the commit above switched
+to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in
+the code.
+
+In the mean time, the NVMe subsystem has been refactored, and now calls
+into the PCIe support layer for NVMe via a .reg_read64() method, which
+fails to use lo_hi_readq(), and thus reintroduces the problem that the
+workaround above aimed to address.
+
+Given that, at the moment, .reg_read64() is only used to read the
+capability register [which is known to tolerate split reads], let's
+switch .reg_read64() to lo_hi_readq() as well.
+
+This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys
+DesignWare PCIe host controller.
+
+Fixes: 7fd8930f26be4 ("nvme: add a common helper to read Identify Controller data")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 1ac4cec5f4f7c..e2bce9385eda6 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1863,7 +1863,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val)
+ 
+ static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
+ {
+-	*val = readq(to_nvme_dev(ctrl)->bar + off);
++	*val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch b/queue-4.9/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
new file mode 100644
index 00000000000..0ff1ac1d063
--- /dev/null
+++ b/queue-4.9/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
@@ -0,0 +1,36 @@
+From 9b764aadd84daa5454b3d0a677d64b11f0e72eec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:01:00 +0300
+Subject: of: mdio: Fix a signedness bug in of_phy_get_and_connect()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d7eb651212fdbafa82d485d8e76095ac3b14c193 ]
+
+The "iface" variable is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: b78624125304 ("of_mdio: Abstract a general interface for phy connect")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_mdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 262281bd68fa3..1e70851b15308 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -353,7 +353,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev,
+ 	struct phy_device *phy;
+ 
+ 	iface = of_get_phy_mode(np);
+-	if (iface < 0)
++	if ((int)iface < 0)
+ 		return NULL;
+ 
+ 	phy_np = of_parse_phandle(np, "phy-handle", 0);
+-- 
+2.20.1
+
diff --git a/queue-4.9/packet-fix-data-race-in-fanout_flow_is_huge.patch b/queue-4.9/packet-fix-data-race-in-fanout_flow_is_huge.patch
new file mode 100644
index 00000000000..c85e9f2ea9a
--- /dev/null
+++ b/queue-4.9/packet-fix-data-race-in-fanout_flow_is_huge.patch
@@ -0,0 +1,134 @@
+From 1ea84dd746eca078c1a32be6ab9101a8b1441423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 05:07:46 -0800
+Subject: packet: fix data-race in fanout_flow_is_huge()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]
+
+KCSAN reported the following data-race [1]
+
+Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.
+
+Since the report hinted about multiple cpus using the history
+concurrently, I added a test avoiding writing on it if the
+victim slot already contains the desired value.
+
+[1]
+
+BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover
+
+read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
+ fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
+ fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
+ fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
+ fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 47a862cc7b349..fb643945e4244 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1332,15 +1332,21 @@ static void packet_sock_destruct(struct sock *sk)
+ 
+ static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
+ {
+-	u32 rxhash;
++	u32 *history = po->rollover->history;
++	u32 victim, rxhash;
+ 	int i, count = 0;
+ 
+ 	rxhash = skb_get_hash(skb);
+ 	for (i = 0; i < ROLLOVER_HLEN; i++)
+-		if (po->rollover->history[i] == rxhash)
++		if (READ_ONCE(history[i]) == rxhash)
+ 			count++;
+ 
+-	po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
++	victim = prandom_u32() % ROLLOVER_HLEN;
++
++	/* Avoid dirtying the cache line if possible */
++	if (READ_ONCE(history[victim]) != rxhash)
++		WRITE_ONCE(history[victim], rxhash);
++
+ 	return count > (ROLLOVER_HLEN >> 1);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch b/queue-4.9/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
new file mode 100644
index 00000000000..06760b74e7c
--- /dev/null
+++ b/queue-4.9/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
@@ -0,0 +1,69 @@
+From 17f505a8488a460918b2f53120b375e410ac3ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:46:55 -0400
+Subject: packet: in recvmsg msg_name return at least sizeof sockaddr_ll
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]
+
+Packet send checks that msg_name is at least sizeof sockaddr_ll.
+Packet recv must return at least this length, so that its output
+can be passed unmodified to packet send.
+
+This ceased to be true since adding support for lladdr longer than
+sll_addr. Since, the return value uses true address length.
+
+Always return at least sizeof sockaddr_ll, even if address length
+is shorter. Zero the padding bytes.
+
+Change v1->v2: do not overwrite zeroed padding again. use copy_len.
+
+Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
+Suggested-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 40cade140222f..47a862cc7b349 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3404,20 +3404,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	sock_recv_ts_and_drops(msg, sk, skb);
+ 
+ 	if (msg->msg_name) {
++		int copy_len;
++
+ 		/* If the address length field is there to be filled
+ 		 * in, we fill it in now.
+ 		 */
+ 		if (sock->type == SOCK_PACKET) {
+ 			__sockaddr_check_size(sizeof(struct sockaddr_pkt));
+ 			msg->msg_namelen = sizeof(struct sockaddr_pkt);
++			copy_len = msg->msg_namelen;
+ 		} else {
+ 			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+ 
+ 			msg->msg_namelen = sll->sll_halen +
+ 				offsetof(struct sockaddr_ll, sll_addr);
++			copy_len = msg->msg_namelen;
++			if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
++				memset(msg->msg_name +
++				       offsetof(struct sockaddr_ll, sll_addr),
++				       0, sizeof(sll->sll_addr));
++				msg->msg_namelen = sizeof(struct sockaddr_ll);
++			}
+ 		}
+-		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
+-		       msg->msg_namelen);
++		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ 	}
+ 
+ 	if (pkt_sk(sk)->auxdata) {
+-- 
+2.20.1
+
diff --git a/queue-4.9/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch b/queue-4.9/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
new file mode 100644
index 00000000000..a4831ee65e1
--- /dev/null
+++ b/queue-4.9/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
@@ -0,0 +1,62 @@
+From 64b011a5812107954edc50dc82fac42d440d7a76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 18:47:15 -0700
+Subject: Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ]
+
+Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made
+the kfifo code round the number of elements up.  That was good for
+__kfifo_alloc(), but it's actually wrong for __kfifo_init().
+
+The difference? __kfifo_alloc() will allocate the rounded-up number of
+elements, but __kfifo_init() uses an allocation done by the caller.  We
+can't just say "use more elements than the caller allocated", and have
+to round down.
+
+The good news? All the normal cases will be using power-of-two arrays
+anyway, and most users of kfifo's don't use kfifo_init() at all, but one
+of the helper macros to declare a KFIFO that enforce the proper
+power-of-two behavior.  But it looks like at least ibmvscsis might be
+affected.
+
+The bad news? Will Deacon refers to an old thread and points points out
+that the memory ordering in kfifo's is questionable.  See
+
+  https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/
+
+for more.
+
+Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()")
+Reported-by: laokz <laokz@foxmail.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg KH <greg@kroah.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kfifo.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kfifo.c b/lib/kfifo.c
+index 90ba1eb1df06e..a94227c555510 100644
+--- a/lib/kfifo.c
++++ b/lib/kfifo.c
+@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
+ {
+ 	size /= esize;
+ 
+-	size = roundup_pow_of_two(size);
++	if (!is_power_of_2(size))
++		size = rounddown_pow_of_two(size);
+ 
+ 	fifo->in = 0;
+ 	fifo->out = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.9/pcrypt-use-format-specifier-in-kobject_add.patch b/queue-4.9/pcrypt-use-format-specifier-in-kobject_add.patch
new file mode 100644
index 00000000000..d52a8a0b825
--- /dev/null
+++ b/queue-4.9/pcrypt-use-format-specifier-in-kobject_add.patch
@@ -0,0 +1,43 @@
+From ac953703728a3c3849b31a1a8e3cf83c4d8ef828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Oct 2018 15:49:26 +0100
+Subject: pcrypt: use format specifier in kobject_add
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]
+
+Passing string 'name' as the format specifier is potentially hazardous
+because name could (although very unlikely to) have a format specifier
+embedded in it causing issues when parsing the non-existent arguments
+to these.  Follow best practice by using the "%s" format string for
+the string 'name'.
+
+Cleans up clang warning:
+crypto/pcrypt.c:397:40: warning: format string is not a string literal
+(potentially insecure) [-Wformat-security]
+
+Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/pcrypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index f8ec3d4ba4a80..a5718c0a3dc4e 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
+ 	int ret;
+ 
+ 	pinst->kobj.kset = pcrypt_kset;
+-	ret = kobject_add(&pinst->kobj, NULL, name);
++	ret = kobject_add(&pinst->kobj, NULL, "%s", name);
+ 	if (!ret)
+ 		kobject_uevent(&pinst->kobj, KOBJ_ADD);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/perf-ioctl-add-check-for-the-sample_period-value.patch b/queue-4.9/perf-ioctl-add-check-for-the-sample_period-value.patch
new file mode 100644
index 00000000000..9a28cf3d7eb
--- /dev/null
+++ b/queue-4.9/perf-ioctl-add-check-for-the-sample_period-value.patch
@@ -0,0 +1,57 @@
+From 0937b71d42fdc3c972e08db8a67d9963caa93795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 09:59:53 +0530
+Subject: perf/ioctl: Add check for the sample_period value
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ]
+
+perf_event_open() limits the sample_period to 63 bits. See:
+
+  0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
+
+Make ioctl() consistent with it.
+
+Also on PowerPC, negative sample_period could cause a recursive
+PMIs leading to a hang (reported when running perf-fuzzer).
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: acme@kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: maddy@linux.vnet.ibm.com
+Cc: mpe@ellerman.id.au
+Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
+Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 5bbf7537a6121..64ace5e9af2a0 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4624,6 +4624,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ 	if (perf_event_check_period(event, value))
+ 		return -EINVAL;
+ 
++	if (!event->attr.freq && (value & (1ULL << 63)))
++		return -EINVAL;
++
+ 	event_function_call(event, __perf_event_period, &value);
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch b/queue-4.9/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
new file mode 100644
index 00000000000..bab8355cd7c
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
@@ -0,0 +1,82 @@
+From abf1dd2f0efbced2f08cf9e1b896f0f6338df984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jan 2019 13:04:52 +0100
+Subject: pinctrl: sh-pfc: emev2: Add missing pinmux functions
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]
+
+The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
+but no pinmux functions refer to them, hence they can not be selected.
+
+Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+index 1cbbe04d7df65..eafd8edbcbe95 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
+ 	"dtv_b",
+ };
+ 
++static const char * const err_rst_reqb_groups[] = {
++	"err_rst_reqb",
++};
++
++static const char * const ext_clki_groups[] = {
++	"ext_clki",
++};
++
+ static const char * const iic0_groups[] = {
+ 	"iic0",
+ };
+@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
+ 	"yuv3",
+ };
+ 
++static const char * const lowpwr_groups[] = {
++	"lowpwr",
++};
++
+ static const char * const ntsc_groups[] = {
+ 	"ntsc_clk",
+ 	"ntsc_data",
+@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
+ 	"pwm1",
+ };
+ 
++static const char * const ref_clko_groups[] = {
++	"ref_clko",
++};
++
+ static const char * const sd_groups[] = {
+ 	"sd_cki",
+ };
+@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
+ 	SH_PFC_FUNCTION(cam),
+ 	SH_PFC_FUNCTION(cf),
+ 	SH_PFC_FUNCTION(dtv),
++	SH_PFC_FUNCTION(err_rst_reqb),
++	SH_PFC_FUNCTION(ext_clki),
+ 	SH_PFC_FUNCTION(iic0),
+ 	SH_PFC_FUNCTION(iic1),
+ 	SH_PFC_FUNCTION(jtag),
+ 	SH_PFC_FUNCTION(lcd),
++	SH_PFC_FUNCTION(lowpwr),
+ 	SH_PFC_FUNCTION(ntsc),
+ 	SH_PFC_FUNCTION(pwm0),
+ 	SH_PFC_FUNCTION(pwm1),
++	SH_PFC_FUNCTION(ref_clko),
+ 	SH_PFC_FUNCTION(sd),
+ 	SH_PFC_FUNCTION(sdi0),
+ 	SH_PFC_FUNCTION(sdi1),
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch b/queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
new file mode 100644
index 00000000000..d54ed2273e4
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
@@ -0,0 +1,36 @@
+From 7b1ce05d7146b2faea0f25c085744a23363248d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:00:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]
+
+The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
+but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.
+
+Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index d8077065636e3..e9739dbcb356e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
+ 	LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
+ 	LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
+ 	LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
++	LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
+ 	LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
+ 	LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
+ 	LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch b/queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
new file mode 100644
index 00000000000..fec5a89a92c
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
@@ -0,0 +1,37 @@
+From 054faa1f3e45b967d089cbc394a838147c8588ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 10:57:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]
+
+The gether_gmii_mux[] array contains the REF125CK pin mark, but the
+gether_gmii_pins[] array lacks the corresponding pin number.
+
+Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index 35f436bcb8491..d8077065636e3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
+ 	 */
+ 	185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
+ 	171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
+-	205, 163, 206, 207,
++	205, 163, 206, 207, 158,
+ };
+ static const unsigned int gether_gmii_mux[] = {
+ 	ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch b/queue-4.9/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
new file mode 100644
index 00000000000..0b9c0d8cde2
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
@@ -0,0 +1,36 @@
+From 72cc35184520691d48aee4bd4a0bc8009d8881be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:07:43 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]
+
+The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
+typo, thus the group cannot be selected.
+
+Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 1e7f32b5dce8c..dd350e2961423 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -5078,7 +5078,7 @@ static const char * const scifb2_groups[] = {
+ 	"scifb2_data_b",
+ 	"scifb2_clk_b",
+ 	"scifb2_ctrl_b",
+-	"scifb0_data_c",
++	"scifb2_data_c",
+ 	"scifb2_clk_c",
+ 	"scifb2_data_d",
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch b/queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
new file mode 100644
index 00000000000..ecbf25f347a
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
@@ -0,0 +1,40 @@
+From cb4856f932d1208082213a988a1fc1dcaf9f8110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:05:57 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]
+
+The qspi_data4_b_mux[] array contains pin marks for the clock and chip
+select pins.  The qspi_data4_b_pins[] array rightfully does not contain
+the corresponding pin numbers, as the control pins are provided by a
+separate group (qspi_ctrl_b).
+
+Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index baa98d7fe9473..fcf731994811f 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -3136,8 +3136,7 @@ static const unsigned int qspi_data4_b_pins[] = {
+ 	RCAR_GP_PIN(6, 4),
+ };
+ static const unsigned int qspi_data4_b_mux[] = {
+-	SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
+-	IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
++	MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
+ };
+ /* - SCIF0 ------------------------------------------------------------------ */
+ static const unsigned int scif0_data_pins[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch b/queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
new file mode 100644
index 00000000000..ebd6ed3603c
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
@@ -0,0 +1,47 @@
+From 274d5a06e919ad79f01303e9d073f7e97dbc3ee4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:12:20 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]
+
+The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
+the color components.  The vin1_b_data18_pins[] array rightfully does
+not include the corresponding pin numbers, as RGB18 is subset of RGB24,
+containing only the 6 MSB bits of each component.
+
+Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index fcf731994811f..1e7f32b5dce8c 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -4264,17 +4264,14 @@ static const unsigned int vin1_b_data18_pins[] = {
+ };
+ static const unsigned int vin1_b_data18_mux[] = {
+ 	/* B */
+-	VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
+ 	VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
+ 	VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
+ 	VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
+ 	/* G */
+-	VI1_G0_B_MARK, VI1_G1_B_MARK,
+ 	VI1_G2_B_MARK, VI1_G3_B_MARK,
+ 	VI1_G4_B_MARK, VI1_G5_B_MARK,
+ 	VI1_G6_B_MARK, VI1_G7_B_MARK,
+ 	/* R */
+-	VI1_R0_B_MARK, VI1_R1_B_MARK,
+ 	VI1_R2_B_MARK, VI1_R3_B_MARK,
+ 	VI1_R4_B_MARK, VI1_R5_B_MARK,
+ 	VI1_R6_B_MARK, VI1_R7_B_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch b/queue-4.9/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
new file mode 100644
index 00000000000..326bf3f796a
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
@@ -0,0 +1,35 @@
+From 8f8d32036e141335941e3eb11eb139df4b00a3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:14:07 +0100
+Subject: pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ]
+
+The vin1_data18_b pin group itself is present, but it is not listed in
+the VIN1 pin group array, and thus cannot be selected.
+
+Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+index 21badb6166b92..97998929db938 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+@@ -1863,6 +1863,7 @@ static const char * const vin1_groups[] = {
+ 	"vin1_data8",
+ 	"vin1_data24_b",
+ 	"vin1_data20_b",
++	"vin1_data18_b",
+ 	"vin1_data16_b",
+ 	"vin1_sync",
+ 	"vin1_field",
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch b/queue-4.9/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
new file mode 100644
index 00000000000..9d9f4a68a21
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
@@ -0,0 +1,36 @@
+From 5e54cddd83869378ee0c7e709f6410d36d0a6125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:21:16 +0100
+Subject: pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]
+
+The Peripheral Function Select Register 9 contains 12 fields, but the
+variable field descriptor contains a 13th bogus field of 3 bits.
+
+Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+index ef093ac0cf2fb..fe8c9c24634d8 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+@@ -4826,7 +4826,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
+ 	},
+ 	{ PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
+-			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
++			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
+ 		/* IP9_31 [1] */
+ 		0, 0,
+ 		/* IP9_30_28 [3] */
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch b/queue-4.9/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
new file mode 100644
index 00000000000..b00e999b853
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
@@ -0,0 +1,39 @@
+From fcf294d74e5ff18409db7d5c770c8c26d33906f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:27:56 +0100
+Subject: pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]
+
+The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
+contains only dummy configuration values for 6 reserved bits, thus
+breaking the configuration of all subsequent fields in the register.
+
+Fix this by adding the two missing configuration values.
+
+Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index a50d22bef1f44..cfdb4fc177c3e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 	},
+ 
+ 	{ PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
+-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 		PC8_IN, PC8_OUT,
+ 		PC7_IN, PC7_OUT,
+ 		PC6_IN, PC6_OUT,
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch b/queue-4.9/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
new file mode 100644
index 00000000000..30150829573
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
@@ -0,0 +1,37 @@
+From 4d6b558c155056e5a31fa2d27ea6c4b77eb6c617 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:20:14 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]
+
+The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
+tpu4_to3_pins[] array lacks the corresponding pin number.
+
+Add the missing pin number, for non-GPIO pin F26.
+
+Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index d25e6f674d0ab..f8fbedb46585d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
+ };
+ static const unsigned int tpu4_to3_pins[] = {
+ 	/* TO */
++	PIN_NUMBER(6, 26),
+ };
+ static const unsigned int tpu4_to3_mux[] = {
+ 	TPU4TO3_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch b/queue-4.9/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
new file mode 100644
index 00000000000..d25aa469413
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
@@ -0,0 +1,37 @@
+From 69344f764804cb5797fba3289036a75e2e3a611f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 16:51:21 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]
+
+There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
+group array lists only one, and it refers to a nonexistent group.
+
+Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index f8fbedb46585d..6dca760f9f280 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = {
+ 	"fsic_sclk_out",
+ 	"fsic_data_in",
+ 	"fsic_data_out",
+-	"fsic_spdif",
++	"fsic_spdif_0",
++	"fsic_spdif_1",
+ };
+ 
+ static const char * const fsid_groups[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch b/queue-4.9/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
new file mode 100644
index 00000000000..5b07934760d
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
@@ -0,0 +1,37 @@
+From df23f81e523ffcaff04a58e12854545b791206cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:42:16 +0100
+Subject: pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]
+
+The Peripheral Function Select Register 11 contains 3 reserved bits and
+15 variable-width fields, but the variable field descriptor does not
+contain the 3-bit field IP11[25:23].
+
+Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 3eccc9b3ca84a..05ccb27f77818 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		FN_LCD_DATA15_B, 0, 0, 0 }
+ 	},
+ 	{ PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
+-			3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
++			3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+ 	    /* IP11_31_29 [3] */
+ 	    0, 0, 0, 0, 0, 0, 0, 0,
+ 	    /* IP11_28 [1] */
+-- 
+2.20.1
+
diff --git a/queue-4.9/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch b/queue-4.9/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
new file mode 100644
index 00000000000..242b3e13dc4
--- /dev/null
+++ b/queue-4.9/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
@@ -0,0 +1,42 @@
+From 2a249f1b58adceffdd5db9181bc717497e691b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:32:34 +0100
+Subject: pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]
+
+The IP10[5:3] field in Peripheral Function Select Register 10 has a
+width of 3 bits, i.e. it allows programming one out of 8 different
+configurations.
+However, 9 values are provided instead of 8, overflowing into the
+subsequent field in the register, and thus breaking the configuration of
+the latter.
+
+Fix this by dropping a bogus zero value.
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 05ccb27f77818..c691e5e9d9dea 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		FN_LCD_CL1_B, 0, 0,
+ 	    /* IP10_5_3 [3] */
+ 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+-		FN_LCD_DON_B, 0, 0, 0,
++		FN_LCD_DON_B, 0, 0,
+ 	    /* IP10_2_0 [3] */
+ 		FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
+ 		FN_LCD_DATA15_B, 0, 0, 0 }
+-- 
+2.20.1
+
diff --git a/queue-4.9/platform-x86-alienware-wmi-printing-the-wrong-error-.patch b/queue-4.9/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
new file mode 100644
index 00000000000..d91ac550d18
--- /dev/null
+++ b/queue-4.9/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
@@ -0,0 +1,38 @@
+From 19741b12ed00c27c3c90f71c41b904abce6b0567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: platform/x86: alienware-wmi: printing the wrong error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]
+
+The "out_data" variable is uninitialized at the point.  Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index fe419935041c1..bee2115ecf101 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -570,7 +570,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ 			return scnprintf(buf, PAGE_SIZE,
+ 					 "input [gpu] unknown\n");
+ 	}
+-	pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++	pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ 	return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/power-supply-init-device-wakeup-after-device_add.patch b/queue-4.9/power-supply-init-device-wakeup-after-device_add.patch
new file mode 100644
index 00000000000..c2184d3e377
--- /dev/null
+++ b/queue-4.9/power-supply-init-device-wakeup-after-device_add.patch
@@ -0,0 +1,69 @@
+From 37e7b0b331e9a38fb897719bc760dce01e75097e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 14:33:30 -0700
+Subject: power: supply: Init device wakeup after device_add()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ]
+
+We may want to use the device pointer in device_init_wakeup() with
+functions that expect the device to already be added with device_add().
+For example, if we were to link the device initializing wakeup to
+something in sysfs such as a class for wakeups we'll run into an error.
+It looks like this code was written with the assumption that the device
+would be added before initializing wakeup due to the order of operations
+in power_supply_unregister().
+
+Let's change the order of operations so we don't run into problems here.
+
+Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed")
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Tri Vo <trong@android.com>
+Cc: Kalesh Singh <kaleshsingh@google.com>
+Cc: Ravi Chandra Sadineni <ravisadineni@chromium.org>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/power_supply_core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 9e05ae0430a99..cb0b3d3d132fc 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -764,14 +764,14 @@ __power_supply_register(struct device *parent,
+ 	}
+ 
+ 	spin_lock_init(&psy->changed_lock);
+-	rc = device_init_wakeup(dev, ws);
+-	if (rc)
+-		goto wakeup_init_failed;
+-
+ 	rc = device_add(dev);
+ 	if (rc)
+ 		goto device_add_failed;
+ 
++	rc = device_init_wakeup(dev, ws);
++	if (rc)
++		goto wakeup_init_failed;
++
+ 	rc = psy_register_thermal(psy);
+ 	if (rc)
+ 		goto register_thermal_failed;
+@@ -808,8 +808,8 @@ register_cooler_failed:
+ 	psy_unregister_thermal(psy);
+ register_thermal_failed:
+ 	device_del(dev);
+-device_add_failed:
+ wakeup_init_failed:
++device_add_failed:
+ check_supplies_failed:
+ dev_set_name_failed:
+ 	put_device(dev);
+-- 
+2.20.1
+
diff --git a/queue-4.9/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch b/queue-4.9/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
new file mode 100644
index 00000000000..dbacacff161
--- /dev/null
+++ b/queue-4.9/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
@@ -0,0 +1,71 @@
+From 87f6ef87aaff2ca4774c5ff323cfebf42a71e78b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 23:45:04 -0500
+Subject: powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ]
+
+Allow external callers to force the cacheinfo code to release all its
+references to cache nodes, e.g. before processing device tree updates
+post-migration, and to rebuild the hierarchy afterward.
+
+CPU online/offline must be blocked by callers; enforce this.
+
+Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++
+ arch/powerpc/kernel/cacheinfo.h |  4 ++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index c641983bbdd68..0122d5ce0637d 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -867,4 +867,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
+ 	if (cache)
+ 		cache_cpu_clear(cache, cpu_id);
+ }
++
++void cacheinfo_teardown(void)
++{
++	unsigned int cpu;
++
++	lockdep_assert_cpus_held();
++
++	for_each_online_cpu(cpu)
++		cacheinfo_cpu_offline(cpu);
++}
++
++void cacheinfo_rebuild(void)
++{
++	unsigned int cpu;
++
++	lockdep_assert_cpus_held();
++
++	for_each_online_cpu(cpu)
++		cacheinfo_cpu_online(cpu);
++}
++
+ #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
+diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
+index a7b74d36acd71..2cdee87a482c5 100644
+--- a/arch/powerpc/kernel/cacheinfo.h
++++ b/arch/powerpc/kernel/cacheinfo.h
+@@ -5,4 +5,8 @@
+ extern void cacheinfo_cpu_online(unsigned int cpu_id);
+ extern void cacheinfo_cpu_offline(unsigned int cpu_id);
+ 
++/* Allow migration/suspend to tear down and rebuild the hierarchy. */
++extern void cacheinfo_teardown(void);
++extern void cacheinfo_rebuild(void);
++
+ #endif /* _PPC_CACHEINFO_H */
+-- 
+2.20.1
+
diff --git a/queue-4.9/powerpc-vdso-make-vdso32-installation-conditional-in.patch b/queue-4.9/powerpc-vdso-make-vdso32-installation-conditional-in.patch
new file mode 100644
index 00000000000..97cae421d8f
--- /dev/null
+++ b/queue-4.9/powerpc-vdso-make-vdso32-installation-conditional-in.patch
@@ -0,0 +1,39 @@
+From ea696ea7a8c48f4b3bea56b790dcf65f5ed5552e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 04:24:37 +0000
+Subject: powerpc: vdso: Make vdso32 installation conditional in vdso_install
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]
+
+The 32-bit vDSO is not needed and not normally built for 64-bit
+little-endian configurations.  However, the vdso_install target still
+builds and installs it.  Add the same config condition as is normally
+used for the build.
+
+Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index a60c9c6e5cc17..de29b88c0e700 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -373,7 +373,9 @@ vdso_install:
+ ifeq ($(CONFIG_PPC64),y)
+ 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
+ endif
++ifdef CONFIG_VDSO32
+ 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
++endif
+ 
+ archclean:
+ 	$(Q)$(MAKE) $(clean)=$(boot)
+-- 
+2.20.1
+
diff --git a/queue-4.9/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch b/queue-4.9/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
new file mode 100644
index 00000000000..7aff951e486
--- /dev/null
+++ b/queue-4.9/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
@@ -0,0 +1,45 @@
+From 5f89342df6231fd77d6b55dba0e13fda5f6fae3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 12:12:28 +0200
+Subject: pwm: lpss: Release runtime-pm reference from the driver's remove
+ callback
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ]
+
+For each pwm output which gets enabled through pwm_lpss_apply(), we do a
+pm_runtime_get_sync().
+
+This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance
+these when the driver gets removed with some of the outputs still enabled.
+
+Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM")
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lpss.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 5208b3f80ad85..239003807c085 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -205,6 +205,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
+ 
+ int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
+ {
++	int i;
++
++	for (i = 0; i < lpwm->info->npwm; i++) {
++		if (pwm_is_enabled(&lpwm->chip.pwms[i]))
++			pm_runtime_put(lpwm->chip.dev);
++	}
+ 	return pwmchip_remove(&lpwm->chip);
+ }
+ EXPORT_SYMBOL_GPL(pwm_lpss_remove);
+-- 
+2.20.1
+
diff --git a/queue-4.9/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch b/queue-4.9/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
new file mode 100644
index 00000000000..ee3cbee0a8c
--- /dev/null
+++ b/queue-4.9/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
@@ -0,0 +1,43 @@
+From 82f7e608711906fd53c79cded1bb5c1a7afff3f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 20:18:17 +0200
+Subject: pwm: meson: Don't disable PWM when setting duty repeatedly
+
+From: Bichao Zheng <bichao.zheng@amlogic.com>
+
+[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ]
+
+There is an abnormally low about 20ms,when setting duty repeatedly.
+Because setting the duty will disable PWM and then enable. Delete
+this operation now.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
+[ Dropped code instead of hiding it behind a comment ]
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-meson.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index f58a4867b5194..a196439ee14c7 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -320,11 +320,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	if (state->period != channel->state.period ||
+ 	    state->duty_cycle != channel->state.duty_cycle ||
+ 	    state->polarity != channel->state.polarity) {
+-		if (channel->state.enabled) {
+-			meson_pwm_disable(meson, pwm->hwpwm);
+-			channel->state.enabled = false;
+-		}
+-
+ 		if (state->polarity != channel->state.polarity) {
+ 			if (state->polarity == PWM_POLARITY_NORMAL)
+ 				meson->inverter_mask |= BIT(pwm->hwpwm);
+-- 
+2.20.1
+
diff --git a/queue-4.9/qed-reduce-maximum-stack-frame-size.patch b/queue-4.9/qed-reduce-maximum-stack-frame-size.patch
new file mode 100644
index 00000000000..a8ad3e4c749
--- /dev/null
+++ b/queue-4.9/qed-reduce-maximum-stack-frame-size.patch
@@ -0,0 +1,103 @@
+From efbc7f29a427483e81c2489e7d28ce65a23f2779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 17:01:23 +0200
+Subject: qed: reduce maximum stack frame size
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7c116e02a4a7575c8c62bfd2106e3e3ec8fb99dc ]
+
+clang warns about an overly large stack frame in one function
+when it decides to inline all __qed_get_vport_*() functions into
+__qed_get_vport_stats():
+
+drivers/net/ethernet/qlogic/qed/qed_l2.c:1889:13: error: stack frame size of 1128 bytes in function '_qed_get_vport_stats' [-Werror,-Wframe-larger-than=]
+
+Use a noinline_for_stack annotation to prevent clang from inlining
+these, which keeps the maximum stack usage at around half of that
+in the worst case, similar to what we get with gcc.
+
+Fixes: 86622ee75312 ("qed: Move statistics to L2 code")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 34 +++++++++++-------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 715776e2cfe50..2d198f6ee21d9 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -1328,10 +1328,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn,
+ 	}
+ }
+ 
+-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++		       struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct eth_pstorm_per_queue_stat pstats;
+ 	u32 pstats_addr = 0, pstats_len = 0;
+@@ -1351,10 +1350,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+ 	p_stats->tx_err_drop_pkts += HILO_64_REGPAIR(pstats.error_drop_pkts);
+ }
+ 
+-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++		       struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct tstorm_per_port_stat tstats;
+ 	u32 tstats_addr, tstats_len;
+@@ -1397,10 +1395,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn,
+ 	}
+ }
+ 
+-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack
++void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++			    struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct eth_ustorm_per_queue_stat ustats;
+ 	u32 ustats_addr = 0, ustats_len = 0;
+@@ -1436,10 +1433,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn,
+ 	}
+ }
+ 
+-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++		       struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct eth_mstorm_per_queue_stat mstats;
+ 	u32 mstats_addr = 0, mstats_len = 0;
+@@ -1463,9 +1459,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+ 		HILO_64_REGPAIR(mstats.tpa_coalesced_bytes);
+ }
+ 
+-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn,
+-				       struct qed_ptt *p_ptt,
+-				       struct qed_eth_stats *p_stats)
++static noinline_for_stack void
++__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++			   struct qed_eth_stats *p_stats)
+ {
+ 	struct port_stats port_stats;
+ 	int j;
+-- 
+2.20.1
+
diff --git a/queue-4.9/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch b/queue-4.9/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
new file mode 100644
index 00000000000..6dcf0424846
--- /dev/null
+++ b/queue-4.9/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
@@ -0,0 +1,48 @@
+From 5bb8b693867ea03d1d5c7c3d15d96971af836ece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 19:47:51 +0800
+Subject: RDMA/hns: Fixs hw access invalid dma memory error
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 ]
+
+When smmu is enable, if execute the perftest command and then use 'kill
+-9' to exit, follow this operation repeatedly, the kernel will have a high
+probability to print the following smmu event:
+
+  arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received:
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00007d0000000010
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x0000020900000080
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000
+
+This is because the hw will periodically refresh the qpc cache until the
+next reset.
+
+This patch fixed it by removing the action that release qpc memory in the
+'hns_roce_qp_free' function.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 33cf1035030b5..6f3c0ea99dd05 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -241,7 +241,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
+ 
+ 	if ((hr_qp->ibqp.qp_type) != IB_QPT_GSI) {
+ 		hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn);
+-		hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn);
+ 	}
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch b/queue-4.9/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
new file mode 100644
index 00000000000..cd8cd1cf82d
--- /dev/null
+++ b/queue-4.9/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
@@ -0,0 +1,36 @@
+From 47e468dd1351219415560d71318b16e7c992c8e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:55 +0200
+Subject: RDMA/ocrdma: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index 6af44f8db3d54..4d28bd8eff01c 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -55,7 +55,7 @@
+ 
+ int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+-	if (index > 1)
++	if (index > 0)
+ 		return -EINVAL;
+ 
+ 	*pkey = 0xffff;
+-- 
+2.20.1
+
diff --git a/queue-4.9/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch b/queue-4.9/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
new file mode 100644
index 00000000000..945d1428ab3
--- /dev/null
+++ b/queue-4.9/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
@@ -0,0 +1,37 @@
+From bf53da1f7a28ac592b069f6ed4fcd5f5326d9ee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:56 +0200
+Subject: RDMA/qedr: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ]
+
+The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested
+for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN.
+
+Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index cd0408c2b376f..7603a1641c7d8 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -54,7 +54,7 @@
+ 
+ int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+-	if (index > QEDR_ROCE_PKEY_TABLE_LEN)
++	if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
+ 		return -EINVAL;
+ 
+ 	*pkey = QEDR_ROCE_PKEY_DEFAULT;
+-- 
+2.20.1
+
diff --git a/queue-4.9/regulator-fixed-default-enable-high-on-dt-regulators.patch b/queue-4.9/regulator-fixed-default-enable-high-on-dt-regulators.patch
new file mode 100644
index 00000000000..9c845834164
--- /dev/null
+++ b/queue-4.9/regulator-fixed-default-enable-high-on-dt-regulators.patch
@@ -0,0 +1,67 @@
+From e3e0343fe2602ddb3c47296cfd476f167f132661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 22:43:46 +0200
+Subject: regulator: fixed: Default enable high on DT regulators
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ]
+
+commit efdfeb079cc3
+("regulator: fixed: Convert to use GPIO descriptor only")
+switched to use gpiod_get() to look up the regulator from the
+gpiolib core whether that is device tree or boardfile.
+
+This meant that we activate the code in
+a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags")
+which means the descriptors coming from the device tree already
+have the right inversion and open drain semantics set up from
+the gpiolib core.
+
+As the fixed regulator was inspected again we got the
+inverted inversion and things broke.
+
+Fix it by ignoring the config in the device tree for now: the
+later patches in the series will push all inversion handling
+over to the gpiolib core and set it up properly in the
+boardfiles for legacy devices, but I did not finish that
+for this kernel cycle.
+
+Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only")
+Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reported-by: Fabio Estevam <festevam@gmail.com>
+Reported-by: John Stultz <john.stultz@linaro.org>
+Reported-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/fixed.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
+index 988a7472c2ab5..d68ff65a5adc9 100644
+--- a/drivers/regulator/fixed.c
++++ b/drivers/regulator/fixed.c
+@@ -84,9 +84,14 @@ of_get_fixed_voltage_config(struct device *dev,
+ 
+ 	of_property_read_u32(np, "startup-delay-us", &config->startup_delay);
+ 
+-	config->enable_high = of_property_read_bool(np, "enable-active-high");
+-	config->gpio_is_open_drain = of_property_read_bool(np,
+-							   "gpio-open-drain");
++	/*
++	 * FIXME: we pulled active low/high and open drain handling into
++	 * gpiolib so it will be handled there. Delete this in the second
++	 * step when we also remove the custom inversion handling for all
++	 * legacy boardfiles.
++	 */
++	config->enable_high = 1;
++	config->gpio_is_open_drain = 0;
+ 
+ 	if (of_find_property(np, "vin-supply", NULL))
+ 		config->input_supply = "vin";
+-- 
+2.20.1
+
diff --git a/queue-4.9/regulator-pv88060-fix-array-out-of-bounds-access.patch b/queue-4.9/regulator-pv88060-fix-array-out-of-bounds-access.patch
new file mode 100644
index 00000000000..de6cc5e4428
--- /dev/null
+++ b/queue-4.9/regulator-pv88060-fix-array-out-of-bounds-access.patch
@@ -0,0 +1,36 @@
+From 26222c354c21cc93fa90cd355c2a3936f1c0fd05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:00 +0800
+Subject: regulator: pv88060: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88060-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
+index 6c4afc73ecac3..d229245d2b5e8 100644
+--- a/drivers/regulator/pv88060-regulator.c
++++ b/drivers/regulator/pv88060-regulator.c
+@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
+ 	int i;
+ 
+ 	/* search for closest to maximum */
+-	for (i = info->n_current_limits; i >= 0; i--) {
++	for (i = info->n_current_limits - 1; i >= 0; i--) {
+ 		if (min <= info->current_limits[i]
+ 			&& max >= info->current_limits[i]) {
+ 			return regmap_update_bits(rdev->regmap,
+-- 
+2.20.1
+
diff --git a/queue-4.9/regulator-pv88080-fix-array-out-of-bounds-access.patch b/queue-4.9/regulator-pv88080-fix-array-out-of-bounds-access.patch
new file mode 100644
index 00000000000..bc895043e5c
--- /dev/null
+++ b/queue-4.9/regulator-pv88080-fix-array-out-of-bounds-access.patch
@@ -0,0 +1,36 @@
+From 5a860c846b7f02930bbc1c6f7cf976d51e8c497d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:01 +0800
+Subject: regulator: pv88080: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88080-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
+index 954a20eeb26f8..a40ecfb772107 100644
+--- a/drivers/regulator/pv88080-regulator.c
++++ b/drivers/regulator/pv88080-regulator.c
+@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
+ 	int i;
+ 
+ 	/* search for closest to maximum */
+-	for (i = info->n_current_limits; i >= 0; i--) {
++	for (i = info->n_current_limits - 1; i >= 0; i--) {
+ 		if (min <= info->current_limits[i]
+ 			&& max >= info->current_limits[i]) {
+ 				return regmap_update_bits(rdev->regmap,
+-- 
+2.20.1
+
diff --git a/queue-4.9/regulator-pv88090-fix-array-out-of-bounds-access.patch b/queue-4.9/regulator-pv88090-fix-array-out-of-bounds-access.patch
new file mode 100644
index 00000000000..bd805d0fd34
--- /dev/null
+++ b/queue-4.9/regulator-pv88090-fix-array-out-of-bounds-access.patch
@@ -0,0 +1,36 @@
+From db43cef00cb6befaa24639fd2f7515e7cb5fbde7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:02 +0800
+Subject: regulator: pv88090: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88090-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
+index 4216411753529..789652c9b0142 100644
+--- a/drivers/regulator/pv88090-regulator.c
++++ b/drivers/regulator/pv88090-regulator.c
+@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
+ 	int i;
+ 
+ 	/* search for closest to maximum */
+-	for (i = info->n_current_limits; i >= 0; i--) {
++	for (i = info->n_current_limits - 1; i >= 0; i--) {
+ 		if (min <= info->current_limits[i]
+ 			&& max >= info->current_limits[i]) {
+ 			return regmap_update_bits(rdev->regmap,
+-- 
+2.20.1
+
diff --git a/queue-4.9/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch b/queue-4.9/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
new file mode 100644
index 00000000000..8003a761a84
--- /dev/null
+++ b/queue-4.9/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
@@ -0,0 +1,45 @@
+From 00984fa2ccbe74c7676ecfb6aa3a53df42559539 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 16:57:52 +0800
+Subject: regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ]
+
+selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix.
+
+Table 5-4. LDOA1 Output Voltage Options
+VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT
+0000     1.35 0100     1.8  1000     2.3  1100     2.85
+0001     1.5  0101     1.9  1001     2.4  1101     3.0
+0010     1.6  0110     2.0  1010     2.5  1110     3.3
+0011     1.7  0111     2.1  1011     2.6  1111     Not Used
+
+Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65086-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
+index 6dbf3cf3951e2..12d26261394f1 100644
+--- a/drivers/regulator/tps65086-regulator.c
++++ b/drivers/regulator/tps65086-regulator.c
+@@ -89,8 +89,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
+ static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
+ 	REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
+ 	REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
+-	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
+-	REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
++	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
++	REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
+ 	REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch b/queue-4.9/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
new file mode 100644
index 00000000000..55f47de3956
--- /dev/null
+++ b/queue-4.9/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
@@ -0,0 +1,40 @@
+From a0dc6d9424ecc7c40efd012389b2f5ff40c6120c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Feb 2019 21:16:51 +0800
+Subject: regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]
+
+The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
+with min_uA and max_uA.
+While at it also make the array const and change to use unsigned int.
+
+Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/wm831x-dcdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
+index 5a5bc4bb08d26..df591435d12a3 100644
+--- a/drivers/regulator/wm831x-dcdc.c
++++ b/drivers/regulator/wm831x-dcdc.c
+@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
+ }
+ 
+ /* Current limit options */
+-static u16 wm831x_dcdc_ilim[] = {
+-	125, 250, 375, 500, 625, 750, 875, 1000
++static const unsigned int wm831x_dcdc_ilim[] = {
++	125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
+ };
+ 
+ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
+-- 
+2.20.1
+
diff --git a/queue-4.9/rtc-88pm80x-fix-unintended-sign-extension.patch b/queue-4.9/rtc-88pm80x-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..5ae4218eafc
--- /dev/null
+++ b/queue-4.9/rtc-88pm80x-fix-unintended-sign-extension.patch
@@ -0,0 +1,93 @@
+From aba30b52654edd81a138efb69a2ec454a3f3db20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:08:11 +0000
+Subject: rtc: 88pm80x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")
+
+Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
+index 466bf7f9a285a..7da2a1fb50f89 100644
+--- a/drivers/rtc/rtc-88pm80x.c
++++ b/drivers/rtc/rtc-88pm80x.c
+@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	unsigned char buf[4];
+ 	unsigned long ticks, base, data;
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+ 
+ 	/* load 32-bit read-only counter */
+ 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ 
+ 	/* load 32-bit read-only counter */
+ 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	base = ticks - data;
+ 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	int ret;
+ 
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+ 
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
+ 
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+ 
+ 	/* load 32-bit read-only counter */
+ 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+-- 
+2.20.1
+
diff --git a/queue-4.9/rtc-88pm860x-fix-unintended-sign-extension.patch b/queue-4.9/rtc-88pm860x-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..15cd3d0e8e1
--- /dev/null
+++ b/queue-4.9/rtc-88pm860x-fix-unintended-sign-extension.patch
@@ -0,0 +1,90 @@
+From 3314800e0aa99888ab8d95a146bc1d4d9a069494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 09:50:53 +0000
+Subject: rtc: 88pm860x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")
+
+Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 166faae3a59cd..7d3e5168fcefc 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++		(buf[5] << 8) | buf[7];
+ 
+ 	/* load 32-bit read-only counter */
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ 
+ 	/* load 32-bit read-only counter */
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	base = ticks - data;
+ 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++		(buf[5] << 8) | buf[7];
+ 
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++		(buf[5] << 8) | buf[7];
+ 
+ 	/* load 32-bit read-only counter */
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+-- 
+2.20.1
+
diff --git a/queue-4.9/rtc-cmos-ignore-bogus-century-byte.patch b/queue-4.9/rtc-cmos-ignore-bogus-century-byte.patch
new file mode 100644
index 00000000000..b738d2d45c9
--- /dev/null
+++ b/queue-4.9/rtc-cmos-ignore-bogus-century-byte.patch
@@ -0,0 +1,45 @@
+From 18a60e1f5509cc04c28383814cc5e9129f4fc51b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jan 2019 08:21:03 +0000
+Subject: rtc: cmos: ignore bogus century byte
+
+From: Eric Wong <e@80x24.org>
+
+[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]
+
+Older versions of Libreboot and Coreboot had an invalid value
+(`3' in my case) in the century byte affecting the GM45 in
+the Thinkpad X200.  Not everybody's updated their firmwares,
+and Linux <= 4.2 was able to read the RTC without problems,
+so workaround this by ignoring invalid values.
+
+Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")
+
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
+Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
+Cc: linux-rtc@vger.kernel.org
+Signed-off-by: Eric Wong <e@80x24.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-mc146818-lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
+index 2f1772a358ca5..18a6f15e313d8 100644
+--- a/drivers/rtc/rtc-mc146818-lib.c
++++ b/drivers/rtc/rtc-mc146818-lib.c
+@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
+ 	time->tm_year += real_year - 72;
+ #endif
+ 
+-	if (century)
++	if (century > 20)
+ 		time->tm_year += (century - 19) * 100;
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-4.9/rtc-ds1672-fix-unintended-sign-extension.patch b/queue-4.9/rtc-ds1672-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..032635c13da
--- /dev/null
+++ b/queue-4.9/rtc-ds1672-fix-unintended-sign-extension.patch
@@ -0,0 +1,43 @@
+From dde2bc482f5be4e1f382e9959828045c186e0297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 18:04:49 +0000
+Subject: rtc: ds1672: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#138801 ("Unintended sign extension")
+
+Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1672.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
+index 5c18ac7394c42..c911f2db0af5e 100644
+--- a/drivers/rtc/rtc-ds1672.c
++++ b/drivers/rtc/rtc-ds1672.c
+@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ 		"%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
+ 		__func__, buf[0], buf[1], buf[2], buf[3]);
+ 
+-	time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++	       (buf[1] << 8) | buf[0];
+ 
+ 	rtc_time_to_tm(time, tm);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch b/queue-4.9/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
new file mode 100644
index 00000000000..7724f750998
--- /dev/null
+++ b/queue-4.9/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
@@ -0,0 +1,61 @@
+From d6e6f2057d9de150de11b8b3c555633db0578e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:36 +0800
+Subject: rtc: pcf8563: Clear event flags and disable interrupts before
+ requesting irq
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ]
+
+Besides the alarm, the PCF8563 also has a timer triggered interrupt.
+In cases where the previous system left the timer and interrupts on,
+or somehow the bits got enabled, the interrupt would keep triggering
+as the kernel doesn't know about it.
+
+Clear both the alarm and timer event flags, and disable the interrupts,
+before requesting the interrupt line.
+
+Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
+Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf8563.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index a4b8b603c807d..533fb7027f0cc 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client,
+ 	struct pcf8563 *pcf8563;
+ 	int err;
+ 	unsigned char buf;
+-	unsigned char alm_pending;
+ 
+ 	dev_dbg(&client->dev, "%s\n", __func__);
+ 
+@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client,
+ 		return err;
+ 	}
+ 
+-	err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
+-	if (err) {
+-		dev_err(&client->dev, "%s: read error\n", __func__);
++	/* Clear flags and disable interrupts */
++	buf = 0;
++	err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
++	if (err < 0) {
++		dev_err(&client->dev, "%s: write error\n", __func__);
+ 		return err;
+ 	}
+-	if (alm_pending)
+-		pcf8563_set_alarm_mode(client, 0);
+ 
+ 	pcf8563->rtc = devm_rtc_device_register(&client->dev,
+ 				pcf8563_driver.driver.name,
+-- 
+2.20.1
+
diff --git a/queue-4.9/rtc-pm8xxx-fix-unintended-sign-extension.patch b/queue-4.9/rtc-pm8xxx-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..7c0be1b455f
--- /dev/null
+++ b/queue-4.9/rtc-pm8xxx-fix-unintended-sign-extension.patch
@@ -0,0 +1,53 @@
+From 27bfdcfb450d08d630df6f93f2e6e3f2d08e64f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:31:02 +0000
+Subject: rtc: pm8xxx: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#1309693 ("Unintended sign extension")
+
+Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pm8xxx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index fac835530671f..a1b4b0ed1f196 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 		}
+ 	}
+ 
+-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++	       ((unsigned long)value[3] << 24);
+ 
+ 	rtc_time_to_tm(secs, tm);
+ 
+@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ 		return rc;
+ 	}
+ 
+-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++	       ((unsigned long)value[3] << 24);
+ 
+ 	rtc_time_to_tm(secs, &alarm->time);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch b/queue-4.9/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
new file mode 100644
index 00000000000..04361a0d864
--- /dev/null
+++ b/queue-4.9/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
@@ -0,0 +1,52 @@
+From 07530b912ac32bef78a2f9765d26be6ef04fec63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 15:55:28 +0100
+Subject: rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3427beb6375d04e9627c67343872e79341a684ea ]
+
+With gcc 4.1:
+
+    net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’:
+    net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function
+
+Indeed, if the first jump to the send_fragmentable label is made, and
+the address family is not handled in the switch() statement, ret will be
+used uninitialized.
+
+Fix this by BUG()'ing as is done in other places in rxrpc where internal
+support for future address families will need adding.  It should not be
+possible to reach this normally as the address families are checked
+up-front.
+
+Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/output.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index 59d3286033120..64389f493bb28 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -400,6 +400,9 @@ send_fragmentable:
+ 		}
+ 		break;
+ #endif
++
++	default:
++		BUG();
+ 	}
+ 
+ 	up_write(&conn->params.local->defrag_sem);
+-- 
+2.20.1
+
diff --git a/queue-4.9/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch b/queue-4.9/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
new file mode 100644
index 00000000000..b560753d72d
--- /dev/null
+++ b/queue-4.9/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
@@ -0,0 +1,39 @@
+From cd0cac6b227d0de7830fa6f3fc13587913449056 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 10:18:35 +0100
+Subject: scsi: libfc: fix null pointer dereference on a null lport
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ]
+
+Currently if lport is null then the null lport pointer is dereference when
+printing out debug via the FC_LPORT_DB macro. Fix this by using the more
+generic FC_LIBFC_DBG debug macro instead that does not use lport.
+
+Addresses-Coverity: ("Dereference after null check")
+Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_exch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 16ca31ad5ec0a..d0a86ef806522 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -2506,7 +2506,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
+ 
+ 	/* lport lock ? */
+ 	if (!lport || lport->state == LPORT_ST_DISABLED) {
+-		FC_LPORT_DBG(lport, "Receiving frames for an lport that "
++		FC_LIBFC_DBG("Receiving frames for an lport that "
+ 			     "has not been initialized correctly\n");
+ 		fc_frame_free(fp);
+ 		return;
+-- 
+2.20.1
+
diff --git a/queue-4.9/scsi-megaraid_sas-reduce-module-load-time.patch b/queue-4.9/scsi-megaraid_sas-reduce-module-load-time.patch
new file mode 100644
index 00000000000..3fd5fe72709
--- /dev/null
+++ b/queue-4.9/scsi-megaraid_sas-reduce-module-load-time.patch
@@ -0,0 +1,67 @@
+From 99e12ad9b71cd40c9301048cbfaf8fdbcd460762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 06:46:28 -0800
+Subject: scsi: megaraid_sas: reduce module load time
+
+From: Steve Sistare <steven.sistare@oracle.com>
+
+[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]
+
+megaraid_sas takes 1+ seconds to load while waiting for firmware:
+
+[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+This is due to the following loop in megasas_transition_to_ready(), which
+waits a minimum of 1 second, even though the FW becomes ready in tens of
+millisecs:
+
+        /*
+         * The cur_state should not last for more than max_wait secs
+         */
+        for (i = 0; i < max_wait; i++) {
+                ...
+                msleep(1000);
+        ...
+        dev_info(&instance->pdev->dev, "FW now in Ready state\n");
+
+This is a regression, caused by a change of the msleep granularity from 1
+to 1000 due to concern about waiting too long on systems with coarse
+jiffies.
+
+To fix, increase iterations and use msleep(20), which results in:
+
+[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
+Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index c5cc002dfdd5c..10ae624dd2662 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3694,12 +3694,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ 		/*
+ 		 * The cur_state should not last for more than max_wait secs
+ 		 */
+-		for (i = 0; i < max_wait; i++) {
++		for (i = 0; i < max_wait * 50; i++) {
+ 			curr_abs_state = instance->instancet->
+ 				read_fw_status_reg(instance->reg_set);
+ 
+ 			if (abs_state == curr_abs_state) {
+-				msleep(1000);
++				msleep(20);
+ 			} else
+ 				break;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.9/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch b/queue-4.9/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
new file mode 100644
index 00000000000..400e0d3834a
--- /dev/null
+++ b/queue-4.9/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
@@ -0,0 +1,100 @@
+From 3d709aedc25dd64b547a0c88be9a4fd4058d851d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2019 12:44:46 -0700
+Subject: scsi: qla2xxx: Unregister chrdev if module initialization fails
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]
+
+If module initialization fails after the character device has been
+registered, unregister the character device. Additionally, avoid
+duplicating error path code.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
+Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
+ 1 file changed, 21 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 3bae56b202f87..e730aabc26d0d 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6055,8 +6055,7 @@ qla2x00_module_init(void)
+ 	/* Initialize target kmem_cache and mem_pools */
+ 	ret = qlt_init();
+ 	if (ret < 0) {
+-		kmem_cache_destroy(srb_cachep);
+-		return ret;
++		goto destroy_cache;
+ 	} else if (ret > 0) {
+ 		/*
+ 		 * If initiator mode is explictly disabled by qlt_init(),
+@@ -6075,11 +6074,10 @@ qla2x00_module_init(void)
+ 	qla2xxx_transport_template =
+ 	    fc_attach_transport(&qla2xxx_transport_functions);
+ 	if (!qla2xxx_transport_template) {
+-		kmem_cache_destroy(srb_cachep);
+ 		ql_log(ql_log_fatal, NULL, 0x0002,
+ 		    "fc_attach_transport failed...Failing load!.\n");
+-		qlt_exit();
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto qlt_exit;
+ 	}
+ 
+ 	apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
+@@ -6091,27 +6089,37 @@ qla2x00_module_init(void)
+ 	qla2xxx_transport_vport_template =
+ 	    fc_attach_transport(&qla2xxx_transport_vport_functions);
+ 	if (!qla2xxx_transport_vport_template) {
+-		kmem_cache_destroy(srb_cachep);
+-		qlt_exit();
+-		fc_release_transport(qla2xxx_transport_template);
+ 		ql_log(ql_log_fatal, NULL, 0x0004,
+ 		    "fc_attach_transport vport failed...Failing load!.\n");
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto unreg_chrdev;
+ 	}
+ 	ql_log(ql_log_info, NULL, 0x0005,
+ 	    "QLogic Fibre Channel HBA Driver: %s.\n",
+ 	    qla2x00_version_str);
+ 	ret = pci_register_driver(&qla2xxx_pci_driver);
+ 	if (ret) {
+-		kmem_cache_destroy(srb_cachep);
+-		qlt_exit();
+-		fc_release_transport(qla2xxx_transport_template);
+-		fc_release_transport(qla2xxx_transport_vport_template);
+ 		ql_log(ql_log_fatal, NULL, 0x0006,
+ 		    "pci_register_driver failed...ret=%d Failing load!.\n",
+ 		    ret);
++		goto release_vport_transport;
+ 	}
+ 	return ret;
++
++release_vport_transport:
++	fc_release_transport(qla2xxx_transport_vport_template);
++
++unreg_chrdev:
++	if (apidev_major >= 0)
++		unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
++	fc_release_transport(qla2xxx_transport_template);
++
++qlt_exit:
++	qlt_exit();
++
++destroy_cache:
++	kmem_cache_destroy(srb_cachep);
++	return ret;
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.9/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch b/queue-4.9/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
new file mode 100644
index 00000000000..8d84a83855c
--- /dev/null
+++ b/queue-4.9/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
@@ -0,0 +1,52 @@
+From 4152017313a71f210dca72c91694767bfd28c3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:44 +0200
+Subject: serial: stm32: fix transmit_chars when tx is stopped
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ]
+
+Disables the tx irq  when the transmission is ended and updates stop_tx
+conditions for code cleanup.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 033856287ca21..ea8b591dd46f4 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -293,13 +293,8 @@ static void stm32_transmit_chars(struct uart_port *port)
+ 		return;
+ 	}
+ 
+-	if (uart_tx_stopped(port)) {
+-		stm32_stop_tx(port);
+-		return;
+-	}
+-
+-	if (uart_circ_empty(xmit)) {
+-		stm32_stop_tx(port);
++	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
++		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ 		return;
+ 	}
+ 
+@@ -312,7 +307,7 @@ static void stm32_transmit_chars(struct uart_port *port)
+ 		uart_write_wakeup(port);
+ 
+ 	if (uart_circ_empty(xmit))
+-		stm32_stop_tx(port);
++		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ }
+ 
+ static irqreturn_t stm32_interrupt(int irq, void *ptr)
+-- 
+2.20.1
+
diff --git a/queue-4.9/series b/queue-4.9/series
index 839edad6e02..6fd1f5eeea9 100644
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -2,3 +2,232 @@ xfs-sanity-check-flags-of-q_xquotarm-call.patch
 powerpc-archrandom-fix-arch_get_random_seed_int.patch
 mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch
 leds-tlc591xx-update-the-maximum-brightness.patch
+drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
+drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
+alsa-hda-fix-unused-variable-warning.patch
+ib-rxe-replace-kvfree-with-vfree.patch
+regulator-fixed-default-enable-high-on-dt-regulators.patch
+alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
+staging-comedi-ni_mio_common-protect-register-write-.patch
+pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
+mlxsw-reg-qeec-add-minimum-shaper-fields.patch
+pcrypt-use-format-specifier-in-kobject_add.patch
+exportfs-fix-passing-zero-to-err_ptr-warning.patch
+drm-dp_mst-skip-validating-ports-during-destruction-.patch
+net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
+pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
+pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
+pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
+pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
+pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
+pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
+pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
+input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
+clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
+clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
+clk-socfpga-fix-refcount-leak.patch
+clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
+clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
+clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
+clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
+clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
+clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
+clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
+clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
+clk-dove-fix-refcount-leak-in-dove_clk_init.patch
+ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
+rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
+rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
+arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
+drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
+media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
+crypto-tgr192-fix-unaligned-memory-access.patch
+asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
+ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
+rtc-cmos-ignore-bogus-century-byte.patch
+clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
+iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
+tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
+crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
+arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
+arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
+arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
+arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
+arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
+iwlwifi-mvm-fix-rss-config-command.patch
+staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
+rtc-ds1672-fix-unintended-sign-extension.patch
+thermal-mediatek-fix-register-index-error.patch
+net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
+rtc-88pm860x-fix-unintended-sign-extension.patch
+rtc-88pm80x-fix-unintended-sign-extension.patch
+rtc-pm8xxx-fix-unintended-sign-extension.patch
+fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
+iw_cxgb4-use-tos-when-importing-the-endpoint.patch
+iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
+pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
+pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
+pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
+pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
+usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
+block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
+keys-timestamp-new-keys.patch
+vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
+dmaengine-mv_xor-use-correct-device-for-dma-api.patch
+cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
+regulator-pv88060-fix-array-out-of-bounds-access.patch
+regulator-pv88080-fix-array-out-of-bounds-access.patch
+regulator-pv88090-fix-array-out-of-bounds-access.patch
+net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
+drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
+drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
+asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
+fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
+nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
+clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
+clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
+mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
+arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
+arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
+regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
+nios2-ksyms-add-missing-symbol-exports.patch
+scsi-megaraid_sas-reduce-module-load-time.patch
+drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
+xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
+net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
+media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
+media-cx18-update-pos-correctly-in-cx18_read_pos.patch
+media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
+media-cx23885-check-allocation-return.patch
+regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
+jfs-fix-bogus-variable-self-initialization.patch
+tipc-tipc-clang-warning.patch
+m68k-mac-fix-via-timer-counter-accesses.patch
+arm-omap2-fix-potentially-uninitialized-return-value.patch
+media-davinci-isif-avoid-uninitialized-variable-use.patch
+media-tw5864-fix-possible-null-pointer-dereference-i.patch
+spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
+spi-tegra114-fix-for-unpacked-mode-transfers.patch
+soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
+spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
+ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
+scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
+arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
+hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
+tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
+powerpc-vdso-make-vdso32-installation-conditional-in.patch
+arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
+media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
+6lowpan-off-by-one-handling-nexthdr.patch
+dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
+alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
+packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
+asoc-fix-valid-stream-condition.patch
+usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
+ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
+iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
+net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
+net-ena-fix-free-napi-resources-when-ena_up-fails.patch
+net-ena-fix-incorrect-test-of-supported-hash-functio.patch
+net-ena-fix-ena_com_fill_hash_function-implementatio.patch
+dmaengine-tegra210-adma-restore-channel-status.patch
+l2tp-fix-possible-null-pointer-dereference.patch
+media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
+media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
+platform-x86-alienware-wmi-printing-the-wrong-error-.patch
+netfilter-ebtables-config_compat-reject-trailing-dat.patch
+pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
+arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
+kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
+backlight-lm3630a-return-0-on-success-in-update_stat.patch
+thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
+dmaengine-tegra210-adma-fix-crash-during-probe.patch
+spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
+crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
+serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
+misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
+iommu-use-right-function-to-get-group-for-device.patch
+signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
+inet-frags-call-inet_frags_fini-after-unregister_per.patch
+media-vivid-fix-incorrect-assignment-operation-when-.patch
+powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
+drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
+net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
+net-af_iucv-always-register-net_device-notifier.patch
+asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
+rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
+drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
+perf-ioctl-add-check-for-the-sample_period-value.patch
+dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
+clk-qcom-fix-wunused-const-variable.patch
+iommu-amd-make-iommu_disable-safer.patch
+mfd-intel-lpss-release-ida-resources.patch
+rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
+devres-allow-const-resource-arguments.patch
+rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
+net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
+scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
+libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
+qed-reduce-maximum-stack-frame-size.patch
+usb-host-xhci-hub-fix-extra-endianness-conversion.patch
+mic-avoid-statically-declaring-a-struct-device.patch
+x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
+alsa-aoa-onyx-always-initialize-register-read-value.patch
+net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
+cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
+crypto-caam-free-resources-in-case-caam_rng-registra.patch
+ext4-set-error-return-correctly-when-ext4_htree_stor.patch
+asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
+asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
+asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
+signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
+asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
+dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
+mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
+mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
+ahci-do-not-export-local-variable-ahci_em_messages.patch
+partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
+hwmon-lm75-fix-write-operations-for-negative-tempera.patch
+power-supply-init-device-wakeup-after-device_add.patch
+x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
+staging-greybus-light-fix-a-couple-double-frees.patch
+bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
+iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
+ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
+net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
+btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
+hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
+net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
+net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
+iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
+net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
+net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
+net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
+of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
+net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
+nvme-retain-split-access-workaround-for-capability-r.patch
+net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
+mac80211-accept-deauth-frames-in-ibss-mode.patch
+llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
+llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
+net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
+act_mirred-fix-mirred_init_module-error-handling.patch
+drm-msm-dsi-implement-reset-correctly.patch
+dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
+net-netem-fix-error-path-for-corrupted-gso-frames.patch
+net-netem-correct-the-parent-s-backlog-when-corrupte.patch
+net-qca_spi-move-reset_count-to-struct-qcaspi.patch
+afs-fix-large-file-support.patch
+media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch
+media-ov6650-fix-some-format-attributes-not-under-co.patch
+media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-sup.patch
+mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
+net-neigh-use-long-type-to-store-jiffies-delta.patch
+packet-fix-data-race-in-fanout_flow_is_huge.patch
+dmaengine-ti-edma-fix-missed-failure-handling.patch
+drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
+arm64-dts-juno-fix-uart-frequency.patch
+ib-iser-fix-dma_nents-type-definition.patch
+m68k-call-timer_interrupt-with-interrupts-disabled.patch
diff --git a/queue-4.9/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch b/queue-4.9/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
new file mode 100644
index 00000000000..66712bb52c5
--- /dev/null
+++ b/queue-4.9/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
@@ -0,0 +1,136 @@
+From 22b838ede92e4da81dbde1d18672d9f9c6ac2900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 12:33:54 -0500
+Subject: signal: Allow cifs and drbd to receive their terminating signals
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
+
+My recent to change to only use force_sig for a synchronous events
+wound up breaking signal reception cifs and drbd.  I had overlooked
+the fact that by default kthreads start out with all signals set to
+SIG_IGN.  So a change I thought was safe turned out to have made it
+impossible for those kernel thread to catch their signals.
+
+Reverting the work on force_sig is a bad idea because what the code
+was doing was very much a misuse of force_sig.  As the way force_sig
+ultimately allowed the signal to happen was to change the signal
+handler to SIG_DFL.  Which after the first signal will allow userspace
+to send signals to these kernel threads.  At least for
+wake_ack_receiver in drbd that does not appear actively wrong.
+
+So correct this problem by adding allow_kernel_signal that will allow
+signals whose siginfo reports they were sent by the kernel through,
+but will not allow userspace generated signals, and update cifs and
+drbd to call allow_kernel_signal in an appropriate place so that their
+thread can receive this signal.
+
+Fixing things this way ensures that userspace won't be able to send
+signals and cause problems, that it is clear which signals the
+threads are expecting to receive, and it guarantees that nothing
+else in the system will be affected.
+
+This change was partly inspired by similar cifs and drbd patches that
+added allow_signal.
+
+Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
+Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
+Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c |  2 ++
+ fs/cifs/connect.c              |  2 +-
+ include/linux/signal.h         | 15 ++++++++++++++-
+ kernel/signal.c                |  5 +++++
+ 4 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index f5c24459fc5c1..daa9cef96ec66 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -332,6 +332,8 @@ static int drbd_thread_setup(void *arg)
+ 		 thi->name[0],
+ 		 resource->name);
+ 
++	allow_kernel_signal(DRBD_SIGKILL);
++	allow_kernel_signal(SIGXCPU);
+ restart:
+ 	retval = thi->function(thi);
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 7d46025d5e899..751bdde6515d5 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -885,7 +885,7 @@ cifs_demultiplex_thread(void *p)
+ 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+ 
+ 	set_freezable();
+-	allow_signal(SIGKILL);
++	allow_kernel_signal(SIGKILL);
+ 	while (server->tcpStatus != CifsExiting) {
+ 		if (try_to_freeze())
+ 			continue;
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index 5308304993bea..ffa58ff53e225 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -313,6 +313,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
+ extern void exit_signals(struct task_struct *tsk);
+ extern void kernel_sigaction(int, __sighandler_t);
+ 
++#define SIG_KTHREAD ((__force __sighandler_t)2)
++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
++
+ static inline void allow_signal(int sig)
+ {
+ 	/*
+@@ -320,7 +323,17 @@ static inline void allow_signal(int sig)
+ 	 * know it'll be handled, so that they don't get converted to
+ 	 * SIGKILL or just silently dropped.
+ 	 */
+-	kernel_sigaction(sig, (__force __sighandler_t)2);
++	kernel_sigaction(sig, SIG_KTHREAD);
++}
++
++static inline void allow_kernel_signal(int sig)
++{
++	/*
++	 * Kernel threads handle their own signals. Let the signal code
++	 * know signals sent by the kernel will be handled, so that they
++	 * don't get silently dropped.
++	 */
++	kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
+ }
+ 
+ static inline void disallow_signal(int sig)
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 30914b3c76b21..57fadbe69c2e6 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -79,6 +79,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
+ 	    handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ 		return 1;
+ 
++	/* Only allow kernel generated signals to this kthread */
++	if (unlikely((t->flags & PF_KTHREAD) &&
++		     (handler == SIG_KTHREAD_KERNEL) && !force))
++		return true;
++
+ 	return sig_handler_ignored(handler, sig);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch b/queue-4.9/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
new file mode 100644
index 00000000000..a4a3b1adfd0
--- /dev/null
+++ b/queue-4.9/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
@@ -0,0 +1,54 @@
+From 33db56572375fb65729050484173260667ae5801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 12:33:50 -0500
+Subject: signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of
+ force_sig
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ]
+
+The locking in force_sig_info is not prepared to deal with a task that
+exits or execs (as sighand may change).  The is not a locking problem
+in force_sig as force_sig is only built to handle synchronous
+exceptions.
+
+Further the function force_sig_info changes the signal state if the
+signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
+delivery of the signal.  The signal SIGKILL can not be ignored and can
+not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
+delivered.
+
+So using force_sig rather than send_sig for SIGKILL is confusing
+and pointless.
+
+Because it won't impact the sending of the signal and and because
+using force_sig is wrong, replace force_sig with send_sig.
+
+Cc: Namjae Jeon <namjae.jeon@samsung.com>
+Cc: Jeff Layton <jlayton@primarydata.com>
+Cc: Steve French <smfrench@gmail.com>
+Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
+Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index e43ba6db2bdd6..110febd697379 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2221,7 +2221,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+ 
+ 	task = xchg(&server->tsk, NULL);
+ 	if (task)
+-		force_sig(SIGKILL, task);
++		send_sig(SIGKILL, task, 1);
+ }
+ 
+ static struct TCP_Server_Info *
+-- 
+2.20.1
+
diff --git a/queue-4.9/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch b/queue-4.9/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
new file mode 100644
index 00000000000..f764e4dbc3f
--- /dev/null
+++ b/queue-4.9/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
@@ -0,0 +1,38 @@
+From 2ed6a9973605472e97c667fbd76a0222f18607f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2019 17:18:41 +0300
+Subject: soc/fsl/qe: Fix an error code in qe_pin_request()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]
+
+We forgot to set "err" on this error path.
+
+Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
+index 0aaf429f31d57..b5a7107a9c0a9 100644
+--- a/drivers/soc/fsl/qe/gpio.c
++++ b/drivers/soc/fsl/qe/gpio.c
+@@ -152,8 +152,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
+ 	if (err < 0)
+ 		goto err0;
+ 	gc = gpio_to_chip(err);
+-	if (WARN_ON(!gc))
++	if (WARN_ON(!gc)) {
++		err = -ENODEV;
+ 		goto err0;
++	}
+ 
+ 	if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
+ 		pr_debug("%s: tried to get a non-qe pin\n", __func__);
+-- 
+2.20.1
+
diff --git a/queue-4.9/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch b/queue-4.9/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
new file mode 100644
index 00000000000..229408216be
--- /dev/null
+++ b/queue-4.9/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
@@ -0,0 +1,61 @@
+From f5dae6cd3d6f933bd1d57e6965ae7cec716403bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 09:31:02 +0000
+Subject: spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
+
+From: Martin Sperl <kernel@martin.sperl.org>
+
+[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]
+
+The original driver by default defines num_chipselects as -1.
+This actually allicates an array of 65535 entries in
+of_spi_register_master.
+
+There is a side-effect for buggy device trees that (contrary to
+dt-binding documentation) have no cs-gpio defined.
+
+This mode was never supported by the driver due to limitations
+of native cs and additional code complexity and is explicitly
+not stated to be implemented.
+
+To keep backwards compatibility with such buggy DTs we limit
+the number of chip_selects to 1, as for all practical purposes
+it is only ever realistic to use a single chip select in
+native cs mode without negative side-effects.
+
+Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index 5c89bbb05441b..e075712c501e8 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, master);
+ 	master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
+ 	master->bits_per_word_mask = SPI_BPW_MASK(8);
+-	master->num_chipselect = -1;
++	/* even though the driver never officially supported native CS
++	 * allow a single native CS for legacy DT support purposes when
++	 * no cs-gpio is configured.
++	 * Known limitations for native cs are:
++	 * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
++	 *     whenever there is a transfer -  this even includes SPI_NO_CS
++	 * * SPI_CS_HIGH: is ignores - cs are always asserted low
++	 * * cs_change: cs is deasserted after each spi_transfer
++	 * * cs_delay_usec: cs is always deasserted one SCK cycle after
++	 *     a spi_transfer
++	 */
++	master->num_chipselect = 1;
+ 	master->transfer_one = bcm2835aux_spi_transfer_one;
+ 	master->handle_err = bcm2835aux_spi_handle_err;
+ 	master->prepare_message = bcm2835aux_spi_prepare_message;
+-- 
+2.20.1
+
diff --git a/queue-4.9/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch b/queue-4.9/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
new file mode 100644
index 00000000000..ce6a2ed77dc
--- /dev/null
+++ b/queue-4.9/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
@@ -0,0 +1,44 @@
+From 7ff378589460524f39295d4f3155d92cadb9c526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:00:36 +0000
+Subject: spi: spi-fsl-spi: call spi_finalize_current_message() at the end
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]
+
+spi_finalize_current_message() shall be called once all
+actions are finished, otherwise the last actions might
+step over a newly started transfer.
+
+Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 8b290d9d79350..5419de19859a0 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -408,7 +408,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ 	}
+ 
+ 	m->status = status;
+-	spi_finalize_current_message(master);
+ 
+ 	if (status || !cs_change) {
+ 		ndelay(nsecs);
+@@ -416,6 +415,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ 	}
+ 
+ 	fsl_spi_setup_transfer(spi, NULL);
++	spi_finalize_current_message(master);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch b/queue-4.9/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
new file mode 100644
index 00000000000..d8b4de7b8ca
--- /dev/null
+++ b/queue-4.9/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
@@ -0,0 +1,38 @@
+From 44257f6300139c5201b83d6399ecdf0102ac162f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:23 -0700
+Subject: spi: tegra114: clear packed bit for unpacked mode
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]
+
+Fixes: Clear packed bit when not using packed mode.
+
+Packed bit is not cleared when not using packed mode. This results
+in transfer timeouts for the unpacked mode transfers followed by the
+packed mode transfers.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 705f515863d4f..d98c502a9c478 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+ 
+ 	if (tspi->is_packed)
+ 		command1 |= SPI_PACKED;
++	else
++		command1 &= ~SPI_PACKED;
+ 
+ 	command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
+ 	tspi->cur_direction = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.9/spi-tegra114-fix-for-unpacked-mode-transfers.patch b/queue-4.9/spi-tegra114-fix-for-unpacked-mode-transfers.patch
new file mode 100644
index 00000000000..032c26210c3
--- /dev/null
+++ b/queue-4.9/spi-tegra114-fix-for-unpacked-mode-transfers.patch
@@ -0,0 +1,164 @@
+From 1023af32ca81c0baf55c48499ffb1eefaa8205e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:24 -0700
+Subject: spi: tegra114: fix for unpacked mode transfers
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]
+
+Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
+mode when transfer length is not a multiple of requested bits per word.
+
+unpacked mode transfers fails when the transfer includes partial bytes in
+the last word.
+
+Total words to be written/read to/from FIFO is computed based on transfer
+length and bits per word. Unpacked mode includes 0 padding bytes for partial
+words to align with bits per word and these extra bytes are also accounted
+for calculating bytes left to transfer in the current driver.
+
+This causes extra bytes access of tx/rx buffers along with buffer index
+position crossing actual length where remain_len becomes negative and due to
+unsigned type, negative value is a 32 bit representation of signed value
+and transferred bytes never meets the actual transfer length resulting in
+transfer timeout and a hang.
+
+This patch fixes this with proper computation of the actual bytes to fill in
+FIFO during transmit and the actual bytes to read from FIFO during receive
+ignoring 0 padded bytes.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index d98c502a9c478..e37712bed0b2d 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ 		}
++
++		tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+ 	} else {
++		unsigned int write_bytes;
+ 		max_n_32bit = min(tspi->curr_dma_words,  tx_empty_count);
+ 		written_words = max_n_32bit;
+ 		nbytes = written_words * tspi->bytes_per_word;
++		if (nbytes > t->len - tspi->cur_pos)
++			nbytes = t->len - tspi->cur_pos;
++		write_bytes = nbytes;
+ 		for (count = 0; count < max_n_32bit; count++) {
+ 			u32 x = 0;
+ 
+@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ 		}
++
++		tspi->cur_tx_pos += write_bytes;
+ 	}
+-	tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
++
+ 	return written_words;
+ }
+ 
+@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
+ 			for (i = 0; len && (i < 4); i++, len--)
+ 				*rx_buf++ = (x >> i*8) & 0xFF;
+ 		}
+-		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 		read_words += tspi->curr_dma_words;
++		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 	} else {
+ 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++		u8 bytes_per_word = tspi->bytes_per_word;
++		unsigned int read_bytes;
+ 
++		len = rx_full_count * bytes_per_word;
++		if (len > t->len - tspi->cur_pos)
++			len = t->len - tspi->cur_pos;
++		read_bytes = len;
+ 		for (count = 0; count < rx_full_count; count++) {
+ 			u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
+ 
+-			for (i = 0; (i < tspi->bytes_per_word); i++)
++			for (i = 0; len && (i < bytes_per_word); i++, len--)
+ 				*rx_buf++ = (x >> (i*8)) & 0xFF;
+ 		}
+-		tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
+ 		read_words += rx_full_count;
++		tspi->cur_rx_pos += read_bytes;
+ 	}
++
+ 	return read_words;
+ }
+ 
+@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 		memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
++		tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 	} else {
+ 		unsigned int i;
+ 		unsigned int count;
+ 		u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
+ 		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++		unsigned int write_bytes;
+ 
++		if (consume > t->len - tspi->cur_pos)
++			consume = t->len - tspi->cur_pos;
++		write_bytes = consume;
+ 		for (count = 0; count < tspi->curr_dma_words; count++) {
+ 			u32 x = 0;
+ 
+@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tspi->tx_dma_buf[count] = x;
+ 		}
++
++		tspi->cur_tx_pos += write_bytes;
+ 	}
+-	tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 	/* Make the dma buffer to read by dma */
+ 	dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
+@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
+ 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 		memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
++		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 	} else {
+ 		unsigned int i;
+ 		unsigned int count;
+ 		unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
+ 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++		unsigned int read_bytes;
+ 
++		if (consume > t->len - tspi->cur_pos)
++			consume = t->len - tspi->cur_pos;
++		read_bytes = consume;
+ 		for (count = 0; count < tspi->curr_dma_words; count++) {
+ 			u32 x = tspi->rx_dma_buf[count] & rx_mask;
+ 
+-			for (i = 0; (i < tspi->bytes_per_word); i++)
++			for (i = 0; consume && (i < tspi->bytes_per_word);
++							i++, consume--)
+ 				*rx_buf++ = (x >> (i*8)) & 0xFF;
+ 		}
++
++		tspi->cur_rx_pos += read_bytes;
+ 	}
+-	tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 	/* Make the dma buffer to read by dma */
+ 	dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+-- 
+2.20.1
+
diff --git a/queue-4.9/staging-comedi-ni_mio_common-protect-register-write-.patch b/queue-4.9/staging-comedi-ni_mio_common-protect-register-write-.patch
new file mode 100644
index 00000000000..7131b7da6af
--- /dev/null
+++ b/queue-4.9/staging-comedi-ni_mio_common-protect-register-write-.patch
@@ -0,0 +1,90 @@
+From 01ff55c41b468de7a4d7da35d76482e34efc94ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:54:16 -0600
+Subject: staging: comedi: ni_mio_common: protect register write overflow
+
+From: Spencer E. Olson <olsonse@umich.edu>
+
+[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]
+
+Fixes two problems introduced as early as
+commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
+(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
+    not unduly overwritten on e-series devices.  On e-series devices, the
+    first three of the last four bits are reserved.  The last bit defines
+    the output selection of the RGOUT0 pin, otherwise known as
+    RTSI_Sub_Selection.  For m-series devices, these last four bits are
+    indeed used as the output selection of the RTSI7 pin (and the
+    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
+    RTSI_Trig_Direction register.
+(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
+    lines.
+
+This patch also cleans up the ni_get_rtsi_routing command for readability.
+
+Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
+Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/comedi/drivers/ni_mio_common.c    | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index fe03a41dc5cf5..12056eb3cbe81 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4945,7 +4945,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ 	case NI_RTSI_OUTPUT_G_SRC0:
+ 	case NI_RTSI_OUTPUT_G_GATE0:
+ 	case NI_RTSI_OUTPUT_RGOUT0:
+-	case NI_RTSI_OUTPUT_RTSI_BRD_0:
++	case NI_RTSI_OUTPUT_RTSI_BRD(0):
++	case NI_RTSI_OUTPUT_RTSI_BRD(1):
++	case NI_RTSI_OUTPUT_RTSI_BRD(2):
++	case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ 		return 1;
+ 	case NI_RTSI_OUTPUT_RTSI_OSC:
+ 		return (devpriv->is_m_series) ? 1 : 0;
+@@ -4966,11 +4969,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ 		devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ 		ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ 			      NISTC_RTSI_TRIGA_OUT_REG);
+-	} else if (chan < 8) {
++	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ 		devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ 		devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ 		ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ 			      NISTC_RTSI_TRIGB_OUT_REG);
++	} else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++		/* probably should never reach this, since the
++		 * ni_valid_rtsi_output_source above errors out if chan is too
++		 * high
++		 */
++		dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++		return -EINVAL;
+ 	}
+ 	return 2;
+ }
+@@ -4986,12 +4996,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
+ 	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ 		return NISTC_RTSI_TRIG_TO_SRC(chan,
+ 					      devpriv->rtsi_trig_b_output_reg);
+-	} else {
+-		if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+-			return NI_RTSI_OUTPUT_RTSI_OSC;
+-		dev_err(dev->class_dev, "bug! should never get here?\n");
+-		return 0;
++	} else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++		return NI_RTSI_OUTPUT_RTSI_OSC;
+ 	}
++
++	dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++	return -EINVAL;
+ }
+ 
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+-- 
+2.20.1
+
diff --git a/queue-4.9/staging-greybus-light-fix-a-couple-double-frees.patch b/queue-4.9/staging-greybus-light-fix-a-couple-double-frees.patch
new file mode 100644
index 00000000000..b2e0261164b
--- /dev/null
+++ b/queue-4.9/staging-greybus-light-fix-a-couple-double-frees.patch
@@ -0,0 +1,69 @@
+From a7bd5b38d561a49dd601a0331253b164efd814a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 15:28:39 +0300
+Subject: staging: greybus: light: fix a couple double frees
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]
+
+The problem is in gb_lights_request_handler().  If we get a request to
+change the config then we release the light with gb_lights_light_release()
+and re-allocated it.  However, if the allocation fails part way through
+then we call gb_lights_light_release() again.  This can lead to a couple
+different double frees where we haven't cleared out the original values:
+
+	gb_lights_light_v4l2_unregister(light);
+	...
+	kfree(light->channels);
+	kfree(light->name);
+
+I also made a small change to how we set "light->channels_count = 0;".
+The original code handled this part fine and did not cause a use after
+free but it was sort of complicated to read.
+
+Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/light.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
+index 9f01427f35f91..1cb82cc28aa76 100644
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -1102,21 +1102,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
+ static void gb_lights_light_release(struct gb_light *light)
+ {
+ 	int i;
+-	int count;
+ 
+ 	light->ready = false;
+ 
+-	count = light->channels_count;
+-
+ 	if (light->has_flash)
+ 		gb_lights_light_v4l2_unregister(light);
++	light->has_flash = false;
+ 
+-	for (i = 0; i < count; i++) {
++	for (i = 0; i < light->channels_count; i++)
+ 		gb_lights_channel_release(&light->channels[i]);
+-		light->channels_count--;
+-	}
++	light->channels_count = 0;
++
+ 	kfree(light->channels);
++	light->channels = NULL;
+ 	kfree(light->name);
++	light->name = NULL;
+ }
+ 
+ static void gb_lights_release(struct gb_lights *glights)
+-- 
+2.20.1
+
diff --git a/queue-4.9/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch b/queue-4.9/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
new file mode 100644
index 00000000000..ebe490882b6
--- /dev/null
+++ b/queue-4.9/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
@@ -0,0 +1,49 @@
+From 83d847283366787b577b3fe8f150aceb37f8c055 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Feb 2019 22:34:49 +0000
+Subject: staging: most: cdev: add missing check for cdev_add failure
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]
+
+Currently the call to cdev_add is missing a check for failure. Fix this by
+checking for failure and exiting via a new error path that ensures the
+allocated comp_channel struct is kfree'd.
+
+Detected by CoverityScan, CID#1462359 ("Unchecked return value")
+
+Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/most/aim-cdev/cdev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/most/aim-cdev/cdev.c b/drivers/staging/most/aim-cdev/cdev.c
+index 7f51024dc5ebb..e87b9ed4f37de 100644
+--- a/drivers/staging/most/aim-cdev/cdev.c
++++ b/drivers/staging/most/aim-cdev/cdev.c
+@@ -451,7 +451,9 @@ static int aim_probe(struct most_interface *iface, int channel_id,
+ 	c->devno = MKDEV(major, current_minor);
+ 	cdev_init(&c->cdev, &channel_fops);
+ 	c->cdev.owner = THIS_MODULE;
+-	cdev_add(&c->cdev, c->devno, 1);
++	retval = cdev_add(&c->cdev, c->devno, 1);
++	if (retval < 0)
++		goto err_free_c;
+ 	c->iface = iface;
+ 	c->cfg = cfg;
+ 	c->channel_id = channel_id;
+@@ -487,6 +489,7 @@ error_create_device:
+ 	list_del(&c->list);
+ error_alloc_kfifo:
+ 	cdev_del(&c->cdev);
++err_free_c:
+ 	kfree(c);
+ error_alloc_channel:
+ 	ida_simple_remove(&minor_id, current_minor);
+-- 
+2.20.1
+
diff --git a/queue-4.9/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch b/queue-4.9/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
new file mode 100644
index 00000000000..f787bd72c0f
--- /dev/null
+++ b/queue-4.9/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
@@ -0,0 +1,59 @@
+From 81526af9752009884e4a67e90d2a357399473573 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 11:32:38 -0700
+Subject: thermal: cpu_cooling: Actually trace CPU load in
+ thermal_power_cpu_get_power
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]
+
+The CPU load values passed to the thermal_power_cpu_get_power
+tracepoint are zero for all CPUs, unless, unless the
+thermal_power_cpu_limit tracepoint is enabled too:
+
+  irq/41-rockchip-98    [000] ....   290.972410: thermal_power_cpu_get_power:
+  cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815
+
+vs
+
+  irq/41-rockchip-96    [000] ....    95.773585: thermal_power_cpu_get_power:
+  cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
+  irq/41-rockchip-96    [000] ....    95.773596: thermal_power_cpu_limit:
+  cpus=0000000f freq=408000 cdev_state=10 power=416
+
+There seems to be no good reason for omitting the CPU load information
+depending on another tracepoint. My guess is that the intention was to
+check whether thermal_power_cpu_get_power is (still) enabled, however
+'load_cpu != NULL' already indicates that it was at least enabled when
+cpufreq_get_requested_power() was entered, there seems little gain
+from omitting the assignment if the tracepoint was just disabled, so
+just remove the check.
+
+Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Javi Merino <javi.merino@kernel.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/cpu_cooling.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
+index f49d2989d0005..984e5f5141403 100644
+--- a/drivers/thermal/cpu_cooling.c
++++ b/drivers/thermal/cpu_cooling.c
+@@ -607,7 +607,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
+ 			load = 0;
+ 
+ 		total_load += load;
+-		if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
++		if (load_cpu)
+ 			load_cpu[i] = load;
+ 
+ 		i++;
+-- 
+2.20.1
+
diff --git a/queue-4.9/thermal-mediatek-fix-register-index-error.patch b/queue-4.9/thermal-mediatek-fix-register-index-error.patch
new file mode 100644
index 00000000000..d90809e3dd8
--- /dev/null
+++ b/queue-4.9/thermal-mediatek-fix-register-index-error.patch
@@ -0,0 +1,47 @@
+From ad3ce6353508dfe7c41e92589ff87b1d05f2881f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 15:38:07 +0800
+Subject: thermal: mediatek: fix register index error
+
+From: Michael Kao <michael.kao@mediatek.com>
+
+[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ]
+
+The index of msr and adcpnp should match the sensor
+which belongs to the selected bank in the for loop.
+
+Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
+Signed-off-by: Michael Kao <michael.kao@mediatek.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mtk_thermal.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 34169c32d4956..ea9558679634b 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -348,7 +348,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
+ 	u32 raw;
+ 
+ 	for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+-		raw = readl(mt->thermal_base + conf->msr[i]);
++		raw = readl(mt->thermal_base +
++			    conf->msr[conf->bank_data[bank->id].sensors[i]]);
+ 
+ 		temp = raw_to_mcelsius(mt,
+ 				       conf->bank_data[bank->id].sensors[i],
+@@ -485,7 +486,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
+ 
+ 	for (i = 0; i < conf->bank_data[num].num_sensors; i++)
+ 		writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
+-		       mt->thermal_base + conf->adcpnp[i]);
++		       mt->thermal_base +
++		       conf->adcpnp[conf->bank_data[num].sensors[i]]);
+ 
+ 	writel((1 << conf->bank_data[num].num_sensors) - 1,
+ 	       mt->thermal_base + TEMP_MONCTL0);
+-- 
+2.20.1
+
diff --git a/queue-4.9/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch b/queue-4.9/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
new file mode 100644
index 00000000000..88683901e5f
--- /dev/null
+++ b/queue-4.9/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
@@ -0,0 +1,60 @@
+From 648e99385cf36eabfb574933b3ac28d21ec33b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 13:10:09 +0800
+Subject: tipc: set sysctl_tipc_rmem and named_timeout right range
+
+From: Jie Liu <liujie165@huawei.com>
+
+[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]
+
+We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
+setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
+And named_timeout as a timeout setting should be not less than zero.
+
+Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
+Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
+Signed-off-by: Jie Liu <liujie165@huawei.com>
+Reported-by: Qiang Ning <ningqiang1@huawei.com>
+Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/sysctl.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
+index 1a779b1e85100..40f6d82083d7b 100644
+--- a/net/tipc/sysctl.c
++++ b/net/tipc/sysctl.c
+@@ -37,6 +37,8 @@
+ 
+ #include <linux/sysctl.h>
+ 
++static int zero;
++static int one = 1;
+ static struct ctl_table_header *tipc_ctl_hdr;
+ 
+ static struct ctl_table tipc_table[] = {
+@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
+ 		.data		= &sysctl_tipc_rmem,
+ 		.maxlen		= sizeof(sysctl_tipc_rmem),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1         = &one,
+ 	},
+ 	{
+ 		.procname	= "named_timeout",
+ 		.data		= &sysctl_tipc_named_timeout,
+ 		.maxlen		= sizeof(sysctl_tipc_named_timeout),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1         = &zero,
+ 	},
+ 	{}
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.9/tipc-tipc-clang-warning.patch b/queue-4.9/tipc-tipc-clang-warning.patch
new file mode 100644
index 00000000000..056b0a0bf39
--- /dev/null
+++ b/queue-4.9/tipc-tipc-clang-warning.patch
@@ -0,0 +1,69 @@
+From b6b97f4e7e19b667ce8eb682d2a1be9696db211e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:03:51 +0100
+Subject: tipc: tipc clang warning
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ]
+
+When checking the code with clang -Wsometimes-uninitialized we get the
+following warning:
+
+if (!tipc_link_is_establishing(l)) {
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/node.c:847:46: note: uninitialized use occurs here
+      tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+
+net/tipc/node.c:831:2: note: remove the 'if' if its condition is always
+true
+if (!tipc_link_is_establishing(l)) {
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence
+this warning
+struct tipc_media_addr *maddr;
+
+We fix this by initializing 'maddr' to NULL. For the matter of clarity,
+we also test if 'xmitq' is non-empty before we use it and 'maddr'
+further down in the  function. It will never happen that 'xmitq' is non-
+empty at the same time as 'maddr' is NULL, so this is a sufficient test.
+
+Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/node.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index db8fbc076e1a5..fe7b0ad1d6f32 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -688,10 +688,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
+ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ {
+ 	struct tipc_link_entry *le = &n->links[bearer_id];
++	struct tipc_media_addr *maddr = NULL;
+ 	struct tipc_link *l = le->link;
+-	struct tipc_media_addr *maddr;
+-	struct sk_buff_head xmitq;
+ 	int old_bearer_id = bearer_id;
++	struct sk_buff_head xmitq;
+ 
+ 	if (!l)
+ 		return;
+@@ -713,7 +713,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ 	tipc_node_write_unlock(n);
+ 	if (delete)
+ 		tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
+-	tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
++	if (!skb_queue_empty(&xmitq))
++		tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+ 	tipc_sk_rcv(n->net, &le->inputq);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch b/queue-4.9/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
new file mode 100644
index 00000000000..c963e47cd27
--- /dev/null
+++ b/queue-4.9/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
@@ -0,0 +1,36 @@
+From 3583fbbb93eb1a451619b340633ba76303bd12d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:30:51 +0800
+Subject: tty: ipwireless: Fix potential NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]
+
+There is a potential NULL pointer dereference in case
+alloc_ctrl_packet() fails and returns NULL.
+
+Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/ipwireless/hardware.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
+index df0204b6148fb..4417f75684221 100644
+--- a/drivers/tty/ipwireless/hardware.c
++++ b/drivers/tty/ipwireless/hardware.c
+@@ -1515,6 +1515,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
+ 			sizeof(struct ipw_setup_get_version_query_packet),
+ 			ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
+ 			TL_SETUP_SIGNO_GET_VERSION_QRY);
++	if (!ver_packet)
++		return;
+ 	ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-4.9/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch b/queue-4.9/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
new file mode 100644
index 00000000000..9715a015af2
--- /dev/null
+++ b/queue-4.9/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
@@ -0,0 +1,41 @@
+From 0b898629592944c3bc8102828b6f455a552a1007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 14:25:32 +0200
+Subject: usb: gadget: fsl: fix link error against usb-gadget module
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]
+
+The dependency to ensure this driver links correctly fails since
+it can not be a loadable module:
+
+drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
+phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'
+
+Make the option 'tristate' so it can work correctly.
+
+Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
+index 19ce615455c1b..de70e70d02bed 100644
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -19,7 +19,7 @@ config AB8500_USB
+ 	  in host mode, low speed.
+ 
+ config FSL_USB2_OTG
+-	bool "Freescale USB OTG Transceiver Driver"
++	tristate "Freescale USB OTG Transceiver Driver"
+ 	depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
+ 	depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
+ 	select USB_PHY
+-- 
+2.20.1
+
diff --git a/queue-4.9/usb-host-xhci-hub-fix-extra-endianness-conversion.patch b/queue-4.9/usb-host-xhci-hub-fix-extra-endianness-conversion.patch
new file mode 100644
index 00000000000..4292b16883a
--- /dev/null
+++ b/queue-4.9/usb-host-xhci-hub-fix-extra-endianness-conversion.patch
@@ -0,0 +1,44 @@
+From 0b4614fb383adf3f389ac5fa0992a6d8af145028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jul 2019 15:17:19 +0300
+Subject: usb: host: xhci-hub: fix extra endianness conversion
+
+From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+
+[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]
+
+Don't do extra cpu_to_le32 conversion for
+put_unaligned_le32 because it is already implemented
+in this function.
+
+Fixes sparse error:
+xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
+xhci-hub.c:1152:44:    expected unsigned int [usertype] val
+xhci-hub.c:1152:44:    got restricted __le32 [usertype]
+
+Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
+Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 5cf5f3d9c1e59..04d36fa607342 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -989,7 +989,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ 			}
+ 			port_li = readl(port_array[wIndex] + PORTLI);
+ 			status = xhci_get_ext_port_status(temp, port_li);
+-			put_unaligned_le32(cpu_to_le32(status), &buf[4]);
++			put_unaligned_le32(status, &buf[4]);
+ 		}
+ 		break;
+ 	case SetPortFeature:
+-- 
+2.20.1
+
diff --git a/queue-4.9/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch b/queue-4.9/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
new file mode 100644
index 00000000000..b146745d8bf
--- /dev/null
+++ b/queue-4.9/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
@@ -0,0 +1,41 @@
+From 2a1dd08067ae656d8e472d9c5f27c376bb6afdd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 10:04:26 -0500
+Subject: usb: phy: twl6030-usb: fix possible use-after-free on remove
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]
+
+In remove(), use cancel_delayed_work_sync() to cancel the
+delayed work. Otherwise there's a chance that this work
+will continue to run until after the device has been removed.
+
+This issue was detected with the help of Coccinelle.
+
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: Bin Liu <b-liu@ti.com>
+Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
+Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index a72e8d670adc8..cf0b67433ac95 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -422,7 +422,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
+ {
+ 	struct twl6030_usb *twl = platform_get_drvdata(pdev);
+ 
+-	cancel_delayed_work(&twl->get_status_work);
++	cancel_delayed_work_sync(&twl->get_status_work);
+ 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+ 		REG_INT_MSK_LINE_C);
+ 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+-- 
+2.20.1
+
diff --git a/queue-4.9/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch b/queue-4.9/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
new file mode 100644
index 00000000000..7a9af4d9fa3
--- /dev/null
+++ b/queue-4.9/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
@@ -0,0 +1,69 @@
+From cfc4b7072b27f6fb4a380a4414d37cc308dd4157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 17:16:06 +0100
+Subject: vfio_pci: Enable memory accesses before calling pci_map_rom
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]
+
+pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
+In case the Memory Space accesses were disabled, readw() is likely
+to trigger a synchronous external abort on some platforms.
+
+In case memory accesses were disabled, re-enable them before the
+call and disable them back again just after.
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index da3f0ed18c769..c94167d871789 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -729,6 +729,7 @@ static long vfio_pci_ioctl(void *device_data,
+ 		{
+ 			void __iomem *io;
+ 			size_t size;
++			u16 orig_cmd;
+ 
+ 			info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ 			info.flags = 0;
+@@ -744,15 +745,23 @@ static long vfio_pci_ioctl(void *device_data,
+ 					break;
+ 			}
+ 
+-			/* Is it really there? */
++			/*
++			 * Is it really there?  Enable memory decode for
++			 * implicit access in pci_map_rom().
++			 */
++			pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++			pci_write_config_word(pdev, PCI_COMMAND,
++					      orig_cmd | PCI_COMMAND_MEMORY);
++
+ 			io = pci_map_rom(pdev, &size);
+-			if (!io || !size) {
++			if (io) {
++				info.flags = VFIO_REGION_INFO_FLAG_READ;
++				pci_unmap_rom(pdev, io);
++			} else {
+ 				info.size = 0;
+-				break;
+ 			}
+-			pci_unmap_rom(pdev, io);
+ 
+-			info.flags = VFIO_REGION_INFO_FLAG_READ;
++			pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ 			break;
+ 		}
+ 		case VFIO_PCI_VGA_REGION_INDEX:
+-- 
+2.20.1
+
diff --git a/queue-4.9/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch b/queue-4.9/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
new file mode 100644
index 00000000000..fcd1a076487
--- /dev/null
+++ b/queue-4.9/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
@@ -0,0 +1,41 @@
+From ac53b14f3112aff8488aba7c366fc2002517add4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:47:06 +0200
+Subject: x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ]
+
+apic->send_IPI_allbutself() takes a vector number as argument.
+
+APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is
+outside the vector space.
+
+Use NMI_VECTOR instead as that's what it is intended to be.
+
+Fixes: 82da3ff89dc2 ("x86: kgdb support")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kgdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
+index 8e36f249646e2..904e18bb38c52 100644
+--- a/arch/x86/kernel/kgdb.c
++++ b/arch/x86/kernel/kgdb.c
+@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
+  */
+ void kgdb_roundup_cpus(unsigned long flags)
+ {
+-	apic->send_IPI_allbutself(APIC_DM_NMI);
++	apic->send_IPI_allbutself(NMI_VECTOR);
+ }
+ #endif
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.9/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch b/queue-4.9/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
new file mode 100644
index 00000000000..0625a70002d
--- /dev/null
+++ b/queue-4.9/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
@@ -0,0 +1,40 @@
+From 2c14cf01b69d73d45d7e1e1e5dbcb4cf7de82e6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2019 12:03:08 +0900
+Subject: x86, perf: Fix the dependency of the x86 insn decoder selftest
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ]
+
+Since x86 instruction decoder is not only for kprobes,
+it should be tested when the insn.c is compiled.
+(e.g. perf is enabled but kprobes is disabled)
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index 4386440fe4635..f09a192260f8e 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -192,7 +192,7 @@ config HAVE_MMIOTRACE_SUPPORT
+ 
+ config X86_DECODER_SELFTEST
+ 	bool "x86 instruction decoder selftest"
+-	depends on DEBUG_KERNEL && KPROBES
++	depends on DEBUG_KERNEL && INSTRUCTION_DECODER
+ 	depends on !COMPILE_TEST
+ 	---help---
+ 	 Perform x86 instruction decoder selftests at build time.
+-- 
+2.20.1
+
diff --git a/queue-4.9/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch b/queue-4.9/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
new file mode 100644
index 00000000000..7aa0878ebcf
--- /dev/null
+++ b/queue-4.9/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
@@ -0,0 +1,38 @@
+From d7694782b6ab2affce16b1a98406d5e413549e2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 08:41:22 +0300
+Subject: xen, cpu_hotplug: Prevent an out of bounds access
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]
+
+The "cpu" variable comes from the sscanf() so Smatch marks it as
+untrusted data.  We can't pass a higher value than "nr_cpu_ids" to
+cpu_possible() or it results in an out of bounds access.
+
+Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/cpu_hotplug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
+index f4e59c445964d..17054d6954117 100644
+--- a/drivers/xen/cpu_hotplug.c
++++ b/drivers/xen/cpu_hotplug.c
+@@ -53,7 +53,7 @@ static int vcpu_online(unsigned int cpu)
+ }
+ static void vcpu_hotplug(unsigned int cpu)
+ {
+-	if (!cpu_possible(cpu))
++	if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
+ 		return;
+ 
+ 	switch (vcpu_online(cpu)) {
+-- 
+2.20.1
+
-- 
2.47.3