From 636a7392c5f020f7800ed0ccaece2c5c551ed60e Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sun, 1 Dec 2019 10:05:11 -0500
Subject: [PATCH] fixes for 4.19

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...wait-to-serialise-with-oops-messages.patch |  55 ++++
 ...h-estatus-pool-to-use-vmalloc-memory.patch |  93 +++++++
 ...-acpi_device_fix_up_power-return-val.patch |  54 ++++
 ...the-dentry-in-aafs_remove-to-avoid-a.patch |  43 +++
 ...ly-define-debug_imx_uart_port-if-nee.patch |  70 +++++
 .../arm-dts-fix-hsi-gdd-range-for-omap4.patch |  46 +++
 .../arm-dts-fix-up-sq201-flash-access.patch   |  78 ++++++
 ...dts-imx1-fix-memory-node-duplication.patch |  70 +++++
 ...ts-imx23-fix-memory-node-duplication.patch | 109 ++++++++
 ...ts-imx25-fix-memory-node-duplication.patch |  83 ++++++
 ...ts-imx27-fix-memory-node-duplication.patch | 109 ++++++++
 ...ts-imx31-fix-memory-node-duplication.patch |  72 +++++
 ...ts-imx35-fix-memory-node-duplication.patch |  70 +++++
 ...ts-imx50-fix-memory-node-duplication.patch |  57 ++++
 ...ts-imx51-fix-memory-node-duplication.patch | 148 ++++++++++
 ...ts-imx53-fix-memory-node-duplication.patch | 148 ++++++++++
 ...ipac-dmm-668-fix-memory-node-duplica.patch |  44 +++
 ...sabreauto-fix-storm-of-accelerometer.patch |  99 +++++++
 ...s-imx6sl-fix-memory-node-duplication.patch |  83 ++++++
 ...s-imx6sx-fix-memory-node-duplication.patch | 135 +++++++++
 ...s-imx6ul-fix-memory-node-duplication.patch | 161 +++++++++++
 ...dts-imx7-fix-memory-node-duplication.patch | 155 +++++++++++
 ...3t-tbs-a711-fix-wifi-resume-from-sus.patch |  44 +++
 ...-ks8695-fix-section-mismatch-warning.patch |  38 +++
 ...b-configuration-for-device-only-setu.patch |  51 ++++
 ...l-armada-37xx-enable-emmc-on-espress.patch |  59 ++++
 ...m64-dts-renesas-draak-fix-cvbs-input.patch |  37 +++
 ...prevent-mismatched-52-bit-va-support.patch | 101 +++++++
 ...x-big-endian-when-checking-preempt-c.patch |  74 +++++
 ...ndle-errors-reported-by-the-firmware.patch |  39 +++
 ...-fix-unsigned-integer-overflow-check.patch |  38 +++
 ...-kirkwood-fix-device-remove-ordering.patch |  61 ++++
 ...kwood-fix-external-clock-probe-defer.patch |  51 ++++
 ...-analog-fix-rx1-selection-in-rdac2-m.patch |  56 ++++
 ...phone-jack-sense-inverts-on-the-latt.patch |  60 ++++
 ...-fix-prescaler-setting-for-the-secon.patch |  63 +++++
 ...-sai-add-restriction-on-mmap-support.patch |  54 ++++
 ...o-armada-38x-configuration-only-on-r.patch | 158 +++++++++++
 ...-off-by-one-error-in-scan-completion.patch |  38 +++
 ...match-sets-when-firmware-supports-it.patch |  40 +++
 ...ng-the-status-of-atl1e_write_phy_reg.patch |  37 +++
 ...eck-if-debug-dentry-is-err-or-null-e.patch |  55 ++++
 ...not-mark-writeback_running-too-early.patch |  95 +++++++
 ...lktrace-show-requests-without-sector.patch |  45 +++
 ...e-a-stray-unlock-in-__drbd_send_prot.patch |  35 +++
 ...m-handle-specific-unknown-packets-af.patch |  84 ++++++
 ...rce-speeds-before-disabling-autoneg-.patch |  68 +++++
 ...inux-standard-errors-in-bnxt_ethtool.patch | 149 ++++++++++
 ...en-save-ring-statistics-before-reset.patch | 130 +++++++++
 ...sure-frame_size-for-build_skb-is-ali.patch |  44 +++
 ...rcnt-if-bpf_map_new_fd-fails-in-bpf_.patch |  39 +++
 ...t-if-bpf_map_new_fd-fails-in-map_cre.patch |  45 +++
 .../brcmfmac-fix-access-point-mode.patch      |  51 ++++
 ...mac-set-f2-watermark-to-256-for-4373.patch |  83 ++++++
 ...-set-sdio-f1-mesbusyctrl-for-cyw4373.patch |  67 +++++
 ...don-t-crash-when-using-dnat-target-i.patch |  66 +++++
 ...r_extent_dirty-to-receive-a-cached-e.patch | 116 ++++++++
 ...missing-device-before-bio-submission.patch |  64 +++++
 ...e-set-result-code-of-cancel-by-statu.patch |  64 +++++
 ...rfs-fix-ncopies-raid_attr-for-raid56.patch |  45 +++
 ...ack-ref_heads-in-delayed_ref_updates.patch |  51 ++++
 ...k-for-no-reset-and-no-idle-flags-at-.patch | 101 +++++++
 ...c_can_chip_config-perform-a-sofware-.patch |  79 ++++++
 ...ease-error-counters-if-skb-enqueuein.patch |  72 +++++
 ...51x_restart_work_handler-fix-potenti.patch |  50 ++++
 ...peak_usb-report-bus-recovery-as-well.patch |  67 +++++
 ...an_rx_offload_irq_offload_fifo-conti.patch |  55 ++++
 ...an_rx_offload_irq_offload_timestamp-.patch |  46 +++
 ...an_rx_offload_offload_one-do-not-inc.patch |  43 +++
 ...an_rx_offload_offload_one-increment-.patch |  40 +++
 ...an_rx_offload_offload_one-use-err_pt.patch | 166 +++++++++++
 ...an_rx_offload_queue_tail-fix-error-h.patch |  51 ++++
 ...al-if-given-fsc-mount-option-on-kern.patch |  65 +++++
 .../clk-at91-avoid-sleeping-early.patch       | 104 +++++++
 ...et-sar_adc_clk_div-set-the-parent-cl.patch |  41 +++
 ...os5420-preserve-pll-configuration-du.patch |  51 ++++
 ...k-samsung-exynos5433-fix-error-paths.patch |  71 +++++
 ...erator-precedence-in-sunxi_divs_clk_.patch |  61 ++++
 ...0-fix-the-zero-ing-of-bits-16-and-18.patch |  39 +++
 ...ix-failed-to-enable-error-with-doubl.patch |  56 ++++
 ...l-clock-remove-ti_clk_add_alias-call.patch |  47 ++++
 ...ers-fttmr010-fix-invalid-interrupt-r.patch | 206 ++++++++++++++
 ...-drivers-mediatek-fix-error-handling.patch | 139 +++++++++
 ...o-chtls-listen-fails-with-multiadapt.patch | 149 ++++++++++
 ...-mxc-scc-fix-build-warnings-on-arm64.patch |  71 +++++
 ...-support-incremental-algorithm-dumps.patch | 116 ++++++++
 queue-4.19/decnet-fix-dn_ifreq_size.patch     |  67 +++++
 ...key-properly-corrupt-multi-page-bios.patch |  76 +++++
 ...e-ebusy-when-handling-check-repair-m.patch |  40 +++
 ...k-when-adjusting-disk-options-while-.patch |  91 ++++++
 ...t_err-s-prototype-to-match-the-defin.patch |  39 +++
 ...-zero-peer-volume-sizes-in-handshake.patch | 116 ++++++++
 ...ch-of-unsuitable-uuids-even-if-conne.patch | 102 +++++++
 ...tform.c-kmemleak-ignore-a-known-leak.patch |  83 ++++++
 ...r-fix-a-missing-check-of-return-valu.patch |  46 +++
 ...ofs_mount-fix-leaks-on-failure-exits.patch |  94 +++++++
 ...block-address-for-__check_sit_bitmap.patch |  36 +++
 ...-block-override-node-segment-by-mist.patch |  69 +++++
 ...2fs-fix-to-dirty-inode-synchronously.patch |  36 +++
 ...sdei-fix-dt-platform-device-creation.patch |  53 ++++
 ...i-fix-wrong-of_node_put-in-init-func.patch |  40 +++
 ...ix-some-wmissing-prototypes-warnings.patch |  83 ++++++
 ...-net_udp_tunnel-dependency-to-select.patch |  44 +++
 ...data-unstuff-into-account-in-do_grow.patch |  37 +++
 ...-pca953x-fix-ai-overflow-on-pcal6524.patch |  41 +++
 ...-exp-decrease-refcount-on-firmware-d.patch |  36 +++
 ...rn-value-of-gpio_to_desc-stub-if-gpi.patch |  39 +++
 ...on-t-trigger-update-if-buffer-addres.patch |  62 +++++
 ...g-data-structure-reference-for-uhid_.patch |  32 +++
 ...h-hid-fixes-incorrect-error-handling.patch |  37 +++
 ...an-error-code-in-qib_sdma_verbs_send.patch |  38 +++
 .../ib-rxe-make-counters-thread-safe.patch    |  62 +++++
 ...-fix-idr_alloc_u32-on-32-bit-systems.patch |  35 +++
 ...teger-overflow-in-idr_for_each_entry.patch |  38 +++
 ...re-qplib-check-the-return-value-of-s.patch |  39 +++
 ...potential-null-ptr-dereference-of-qp.patch |  36 +++
 ...ull-dereference-bug-in-match_hid_uid.patch |  44 +++
 ...one-tunnel-dst-tunnel-port-work-with.patch |  53 ++++
 ...-move-iwl_nvm_check_version-into-dvm.patch | 130 +++++++++
 ...orce-tcm-re-evaluation-on-tcm-resume.patch |  66 +++++
 .../iwlwifi-pcie-fix-erroneous-print.patch    |  55 ++++
 ...cie-set-cmd_len-in-the-correct-place.patch |  66 +++++
 ...t-symbols-in-arch-defined-prohibited.patch | 149 ++++++++++
 ...-x86-64-specific-blacklisted-symbols.patch |  52 ++++
 ...blacklist-non-attachable-xen-interru.patch |  45 +++
 ...check-debugfs-dentry-before-using-it.patch |  49 ++++
 ...ter-debug-feature-on-failing-arch-in.patch |  67 +++++
 ...-ia32_tsc_aux-for-legacy-mode-guests.patch |  52 ++++
 ...ix-allocation-of-aligned-buffer-from.patch | 167 +++++++++++
 .../lib-genalloc.c-include-vmalloc.h.patch    |  43 +++
 ...se-vzalloc_node-to-allocate-the-bitm.patch |  52 ++++
 ...tion-inactive_time-shortly-after-boo.patch |  47 ++++
 ...omap-gpmc-get-the-header-of-the-enum.patch |  48 ++++
 ...adjust-the-help-to-the-real-behavior.patch |  61 ++++
 ...ultiple-bugs-in-arch-microblaze-boot.patch | 111 ++++++++
 ....-is-ready-messages-to-arch-microbla.patch |  66 +++++
 ...invalid-pfns-from-pfn_to_online_page.patch | 129 +++++++++
 ...deduplicate-__memblock_free_early-an.patch |  42 +++
 ...free-order-0-pages-through-pcp-in-pa.patch | 112 ++++++++
 ...c-use-a-single-function-to-free-page.patch |  99 +++++++
 ...ax-segment-size-with-logical-block-s.patch |  77 +++++
 ...e-sure-the-descriptor-is-stopped-on-.patch | 181 ++++++++++++
 .../mtd-check-add_mtd_device-ret-code.patch   | 113 ++++++++
 ...i-write-pageprog-related-opcodes-to-.patch |  38 +++
 ...td-remove-a-debug-trace-in-mtdpart.c.patch |  35 +++
 ...correct-histogram-spacing-formatting.patch |  67 +++++
 ...ntial-null-dereference-and-use-after.patch |  55 ++++
 ...t-reapply-manual-settings-to-the-phy.patch |  58 ++++
 ...net-use-rgmii-loopback-for-mac-reset.patch | 130 +++++++++
 ...ur-fix-kmemleak-minimal-reference-co.patch |  37 +++
 ...bour-tell-kmemleak-about-hash-tables.patch |  83 ++++++
 ...s-fix-a-missing-check-of-clk_prepare.patch |  37 +++
 ...gned-integer-as-an-argument-to-left-.patch |  35 +++
 ...propagate-error-value-from-mdio_writ.patch |  41 +++
 ...ssed-clk_disable_unprepare-in-remove.patch |  35 +++
 ...-overflow-in-__sk_mem_raise_allocate.patch |  52 ++++
 ...ch-to-kvmalloc-for-memory-allocation.patch |  54 ++++
 ...fw-error-code-not_exec-to-not_suppor.patch |  51 ++++
 ...fix-an-issue-for-hclgevf_ae_get_hdev.patch |  42 +++
 ...-an-issue-for-hns3_update_new_int_gl.patch |  38 +++
 ...c-not-setting-problem-for-dcb-module.patch |  81 ++++++
 ...ot-report-erspan_ver-for-ip6gre-or-i.patch |  93 +++++++
 ...t-report-erspan_ver-for-gre-or-greta.patch |  81 ++++++
 ...a-missing-check-of-acpi_match_device.patch |  37 +++
 ...e-driver-initialization-despite-debu.patch |  44 +++
 ...ocelot-fix-__ocelot_rmw_ix-prototype.patch |  39 +++
 ...e-check-the-return-value-of-register.patch |  38 +++
 ...at-fix-a-missing-check-of-nla_parse_.patch |  41 +++
 ...it-for-send-buffer-space-when-data-w.patch |  49 ++++
 ...fix-byte_order-for-rx_curs_confirmed.patch |  81 ++++++
 .../net-smc-fix-sender_free-computation.patch | 122 ++++++++
 ...races-between-smc_lgr_terminate-and-.patch |  49 ++++
 ...o-fix-a-missing-check-of-clk_prepare.patch |  37 +++
 ...hdlc-avoid-double-free-in-ucc_hdlc_p.patch |  39 +++
 ..._sip-fix-rtp-rtcp-source-port-transl.patch | 109 ++++++++
 ...les-fix-a-missing-check-of-nla_put_f.patch |  35 +++
 queue-4.19/nvme-fix-kernel-paging-oops.patch  |  35 +++
 ...e-fallback-for-discard-alloc-failure.patch | 133 +++++++++
 ...nal-dirty-flag-after-shutdown-journa.patch |  57 ++++
 ...enrisc-fix-broken-paths-to-arch-or32.patch |  49 ++++
 ...parisc-fix-hp-sdc-hpa-address-output.patch |  36 +++
 .../parisc-fix-serio-address-output.patch     |  40 +++
 ...nospc-from-pci_alloc_irq_vectors_aff.patch |  97 +++++++
 ...cherryview-allocate-irq-chip-dynamic.patch |  96 +++++++
 ...8a77990-fix-mod_sel0-sel_i2c1-field-.patch |  43 +++
 ...h7264-fix-pfcr3-and-pfcr0-register-c.patch |  57 ++++
 ...-sh7734-fix-shifted-values-in-ipsr10.patch |  62 +++++
 ...way-fix-gpio-hog-related-boot-issues.patch |  89 ++++++
 ...6-mlx-platform-fix-led-configuration.patch |  50 ++++
 ...ex-null-check-before-some-freeing-fu.patch |  37 +++
 ...2-avoid-unsupported-flags-with-clang.patch |  85 ++++++
 .../powerpc-44x-bamboo-fix-pci-range.patch    |  44 +++
 ...dle-machine-check-caused-by-watchdog.patch | 142 ++++++++++
 ...2-fix-number-of-bats-in-p-v_block_ma.patch |  44 +++
 ...rpc-bpf-fix-tail-call-implementation.patch |  78 ++++++
 ...-on-big-endian-with-config_relocatab.patch |  40 +++
 ...null-pointer-deferences-explicit-on-.patch |  63 +++++
 ...c-perf-fix-unit_sel-cache_sel-checks.patch |  98 +++++++
 ...eeh-npu-fix-uninitialized-variables-.patch |  85 ++++++
 ...owerpc-prom-fix-early-debug-messages.patch |  55 ++++
 ...dlpar-fix-a-missing-check-in-dlpar_p.patch |  39 +++
 ...fix-node-leak-in-update_lmb_associat.patch |  36 +++
 .../powerpc-xmon-fix-dump_segments.patch      |  35 +++
 ...event-unloading-the-driver-module-wh.patch |  40 +++
 .../pwm-clps711x-fix-period-calculation.patch |  47 ++++
 ...for-the-scene-without-receiver-queue.patch |  36 +++
 ...x-the-bug-while-use-multi-hop-of-pbl.patch |  42 +++
 ...-bug-with-updating-rq-head-pointer-w.patch |  55 ++++
 .../rdma-hns-fix-the-state-of-rereg-mr.patch  |  36 +++
 ...-gfp_atomic-in-hns_roce_v2_modify_qp.patch |  36 +++
 ...te-ib_post_send-failures-to-the-scsi.patch |  38 +++
 ...use-atomic-memory-allocation-in-crea.patch |  38 +++
 ...10-fix-a-missing-check-of-return-val.patch |  38 +++
 ...mory-leak-in-reset_control_array_put.patch |  55 ++++
 ...-reset_control_ops-kerneldoc-comment.patch |  35 +++
 ...rtl818x-fix-potential-use-after-free.patch |  43 +++
 ...-sysfs-reset-attribute-trigger-queue.patch |  75 +++++
 ...build-by-setting-have_attr_test-to-z.patch |  47 ++++
 ...debugging-modules-compiled-with-hot-.patch |  59 ++++
 ...x-incorrect-dma-device-in-case-of-vp.patch |  35 +++
 ...utdown-axi-bus-to-avoid-exception-cq.patch |  60 ++++
 ...heck-smp-phy-control-function-result.patch |  50 ++++
 ...ort-sata-phy-connection-rate-unmatch.patch | 101 +++++++
 ...le-management-features-for-if_type-6.patch | 110 ++++++++
 ...f-and-first-burst-use-in-write-comma.patch |  77 +++++
 ...rnel-oops-due-to-null-pring-pointers.patch |  93 +++++++
 ...xxx-deadlock-by-configfs_depend_item.patch | 127 +++++++++
 ...-for-fc-nvme-discovery-for-npiv-port.patch |  62 +++++
 ...la2xxx-fix-npiv-handling-for-fc-nvme.patch |  80 ++++++
 ...-tcmu-fix-queue_cmd_ring-declaration.patch |  41 +++
 ...re-hb_timer-expire-date-before-start.patch |  59 ++++
 ...-fix-serial8250-initialization-crash.patch |  72 +++++
 ...-limit-serial-port-rx-interrupts-dur.patch | 146 ++++++++++
 ...serial-max310x-fix-tx_empty-callback.patch |  43 +++
 ...x-crash-in-rx_timer_fn-on-pio-fallba.patch |  39 +++
 queue-4.19/series                             | 263 ++++++++++++++++++
 ...e-found-bitmap-in-efx_ef10_mtd_probe.patch |  37 +++
 ...licate-nvmem-partition-types-in-efx_.patch | 100 +++++++
 ...c-fix-a-missing-check-of-genlmsg_put.patch |  35 +++
 ...ory-leak-in-tipc_nl_compat_publ_dump.patch |  42 +++
 ...-skb-may-be-leaky-in-tipc_link_input.patch |  48 ++++
 ...pes.c-fix-kpagecount-returned-fewer-.patch |  44 +++
 ...event_mutex-before-synth_event_mutex.patch | 234 ++++++++++++++++
 ...op-ubi-device-reference-before-using.patch |  41 +++
 ...-put-mtd-device-after-it-is-not-used.patch |  40 +++
 ...fault-compression-selection-in-ubifs.patch |  56 ++++
 .../um-include-sys-uio.h-to-have-writev.patch |  34 +++
 queue-4.19/um-make-gcov-depend-on-kcov.patch  |  34 +++
 ...-fix-deferred-probe-for-phy-handling.patch |  56 ++++
 ...s-use-u8-instead-of-char-for-handle-.patch | 152 ++++++++++
 ...ce-get-rid-of-possible-infinite-loop.patch |  56 ++++
 ...de_reclaim_noscan-in-node_reclaim-wh.patch |  78 ++++++
 ...d-to-random-port-for-vmaddr_port_any.patch |  55 ++++
 ...fix-error-path-in-__vxlan_dev_create.patch |  83 ++++++
 ...son-fix-the-wrong-value-of-left-time.patch |  47 ++++
 ...ent-null-pointer-dereference-when-re.patch |  59 ++++
 ...fix-cpumap-redirect-skb-creation-bug.patch | 104 +++++++
 ...iback-check-dev_data-before-using-it.patch |  38 +++
 ...-attrlist_by_handle-with-native-impl.patch |  56 ++++
 ...uffer-i-o-properly-on-shutdown-error.patch |  50 ++++
 ...kstat-compat-ioctls-on-x32-userspace.patch |  94 +++++++
 ...equire-both-realtime-inodes-to-mount.patch |  45 +++
 ...s-zero-length-symlinks-are-not-valid.patch | 165 +++++++++++
 ...-prevent-leak-of-rpcrdma_rep-objects.patch |  86 ++++++
 264 files changed, 18021 insertions(+)
 create mode 100644 queue-4.19/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch
 create mode 100644 queue-4.19/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
 create mode 100644 queue-4.19/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
 create mode 100644 queue-4.19/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch
 create mode 100644 queue-4.19/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
 create mode 100644 queue-4.19/arm-dts-fix-hsi-gdd-range-for-omap4.patch
 create mode 100644 queue-4.19/arm-dts-fix-up-sq201-flash-access.patch
 create mode 100644 queue-4.19/arm-dts-imx1-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx23-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx25-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx27-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx31-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx35-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx50-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx51-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx53-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
 create mode 100644 queue-4.19/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch
 create mode 100644 queue-4.19/arm-dts-imx6sl-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx6sx-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx6ul-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-imx7-fix-memory-node-duplication.patch
 create mode 100644 queue-4.19/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch
 create mode 100644 queue-4.19/arm-ks8695-fix-section-mismatch-warning.patch
 create mode 100644 queue-4.19/arm-omap1-fix-usb-configuration-for-device-only-setu.patch
 create mode 100644 queue-4.19/arm64-dts-marvell-armada-37xx-enable-emmc-on-espress.patch
 create mode 100644 queue-4.19/arm64-dts-renesas-draak-fix-cvbs-input.patch
 create mode 100644 queue-4.19/arm64-mm-prevent-mismatched-52-bit-va-support.patch
 create mode 100644 queue-4.19/arm64-preempt-fix-big-endian-when-checking-preempt-c.patch
 create mode 100644 queue-4.19/arm64-smp-handle-errors-reported-by-the-firmware.patch
 create mode 100644 queue-4.19/asoc-compress-fix-unsigned-integer-overflow-check.patch
 create mode 100644 queue-4.19/asoc-kirkwood-fix-device-remove-ordering.patch
 create mode 100644 queue-4.19/asoc-kirkwood-fix-external-clock-probe-defer.patch
 create mode 100644 queue-4.19/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
 create mode 100644 queue-4.19/asoc-rt5645-headphone-jack-sense-inverts-on-the-latt.patch
 create mode 100644 queue-4.19/asoc-samsung-i2s-fix-prescaler-setting-for-the-secon.patch
 create mode 100644 queue-4.19/asoc-stm32-sai-add-restriction-on-mmap-support.patch
 create mode 100644 queue-4.19/ata-ahci-mvebu-do-armada-38x-configuration-only-on-r.patch
 create mode 100644 queue-4.19/ath6kl-fix-off-by-one-error-in-scan-completion.patch
 create mode 100644 queue-4.19/ath6kl-only-use-match-sets-when-firmware-supports-it.patch
 create mode 100644 queue-4.19/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
 create mode 100644 queue-4.19/bcache-do-not-check-if-debug-dentry-is-err-or-null-e.patch
 create mode 100644 queue-4.19/bcache-do-not-mark-writeback_running-too-early.patch
 create mode 100644 queue-4.19/blktrace-show-requests-without-sector.patch
 create mode 100644 queue-4.19/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
 create mode 100644 queue-4.19/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch
 create mode 100644 queue-4.19/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch
 create mode 100644 queue-4.19/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch
 create mode 100644 queue-4.19/bnxt_en-save-ring-statistics-before-reset.patch
 create mode 100644 queue-4.19/bpf-cpumap-make-sure-frame_size-for-build_skb-is-ali.patch
 create mode 100644 queue-4.19/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch
 create mode 100644 queue-4.19/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch
 create mode 100644 queue-4.19/brcmfmac-fix-access-point-mode.patch
 create mode 100644 queue-4.19/brcmfmac-set-f2-watermark-to-256-for-4373.patch
 create mode 100644 queue-4.19/brcmfmac-set-sdio-f1-mesbusyctrl-for-cyw4373.patch
 create mode 100644 queue-4.19/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
 create mode 100644 queue-4.19/btrfs-allow-clear_extent_dirty-to-receive-a-cached-e.patch
 create mode 100644 queue-4.19/btrfs-check-for-missing-device-before-bio-submission.patch
 create mode 100644 queue-4.19/btrfs-dev-replace-set-result-code-of-cancel-by-statu.patch
 create mode 100644 queue-4.19/btrfs-fix-ncopies-raid_attr-for-raid56.patch
 create mode 100644 queue-4.19/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
 create mode 100644 queue-4.19/bus-ti-sysc-check-for-no-reset-and-no-idle-flags-at-.patch
 create mode 100644 queue-4.19/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
 create mode 100644 queue-4.19/can-flexcan-increase-error-counters-if-skb-enqueuein.patch
 create mode 100644 queue-4.19/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch
 create mode 100644 queue-4.19/can-peak_usb-report-bus-recovery-as-well.patch
 create mode 100644 queue-4.19/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
 create mode 100644 queue-4.19/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
 create mode 100644 queue-4.19/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
 create mode 100644 queue-4.19/can-rx-offload-can_rx_offload_offload_one-increment-.patch
 create mode 100644 queue-4.19/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
 create mode 100644 queue-4.19/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
 create mode 100644 queue-4.19/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
 create mode 100644 queue-4.19/clk-at91-avoid-sleeping-early.patch
 create mode 100644 queue-4.19/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
 create mode 100644 queue-4.19/clk-samsung-exynos5420-preserve-pll-configuration-du.patch
 create mode 100644 queue-4.19/clk-samsung-exynos5433-fix-error-paths.patch
 create mode 100644 queue-4.19/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch
 create mode 100644 queue-4.19/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
 create mode 100644 queue-4.19/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch
 create mode 100644 queue-4.19/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
 create mode 100644 queue-4.19/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch
 create mode 100644 queue-4.19/clocksource-drivers-mediatek-fix-error-handling.patch
 create mode 100644 queue-4.19/crypto-chelsio-chtls-listen-fails-with-multiadapt.patch
 create mode 100644 queue-4.19/crypto-mxc-scc-fix-build-warnings-on-arm64.patch
 create mode 100644 queue-4.19/crypto-user-support-incremental-algorithm-dumps.patch
 create mode 100644 queue-4.19/decnet-fix-dn_ifreq_size.patch
 create mode 100644 queue-4.19/dm-flakey-properly-corrupt-multi-page-bios.patch
 create mode 100644 queue-4.19/dm-raid-fix-false-ebusy-when-handling-check-repair-m.patch
 create mode 100644 queue-4.19/drbd-do-not-block-when-adjusting-disk-options-while-.patch
 create mode 100644 queue-4.19/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
 create mode 100644 queue-4.19/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
 create mode 100644 queue-4.19/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
 create mode 100644 queue-4.19/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
 create mode 100644 queue-4.19/drivers-regulator-fix-a-missing-check-of-return-valu.patch
 create mode 100644 queue-4.19/exofs_mount-fix-leaks-on-failure-exits.patch
 create mode 100644 queue-4.19/f2fs-fix-block-address-for-__check_sit_bitmap.patch
 create mode 100644 queue-4.19/f2fs-fix-to-data-block-override-node-segment-by-mist.patch
 create mode 100644 queue-4.19/f2fs-fix-to-dirty-inode-synchronously.patch
 create mode 100644 queue-4.19/firmware-arm_sdei-fix-dt-platform-device-creation.patch
 create mode 100644 queue-4.19/firmware-arm_sdei-fix-wrong-of_node_put-in-init-func.patch
 create mode 100644 queue-4.19/fork-fix-some-wmissing-prototypes-warnings.patch
 create mode 100644 queue-4.19/geneve-change-net_udp_tunnel-dependency-to-select.patch
 create mode 100644 queue-4.19/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
 create mode 100644 queue-4.19/gpio-pca953x-fix-ai-overflow-on-pcal6524.patch
 create mode 100644 queue-4.19/gpio-raspberrypi-exp-decrease-refcount-on-firmware-d.patch
 create mode 100644 queue-4.19/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
 create mode 100644 queue-4.19/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch
 create mode 100644 queue-4.19/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
 create mode 100644 queue-4.19/hid-intel-ish-hid-fixes-incorrect-error-handling.patch
 create mode 100644 queue-4.19/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
 create mode 100644 queue-4.19/ib-rxe-make-counters-thread-safe.patch
 create mode 100644 queue-4.19/idr-fix-idr_alloc_u32-on-32-bit-systems.patch
 create mode 100644 queue-4.19/idr-fix-integer-overflow-in-idr_for_each_entry.patch
 create mode 100644 queue-4.19/infiniband-bnxt_re-qplib-check-the-return-value-of-s.patch
 create mode 100644 queue-4.19/infiniband-qedr-potential-null-ptr-dereference-of-qp.patch
 create mode 100644 queue-4.19/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
 create mode 100644 queue-4.19/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
 create mode 100644 queue-4.19/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch
 create mode 100644 queue-4.19/iwlwifi-mvm-force-tcm-re-evaluation-on-tcm-resume.patch
 create mode 100644 queue-4.19/iwlwifi-pcie-fix-erroneous-print.patch
 create mode 100644 queue-4.19/iwlwifi-pcie-set-cmd_len-in-the-correct-place.patch
 create mode 100644 queue-4.19/kprobes-blacklist-symbols-in-arch-defined-prohibited.patch
 create mode 100644 queue-4.19/kprobes-x86-show-x86-64-specific-blacklisted-symbols.patch
 create mode 100644 queue-4.19/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch
 create mode 100644 queue-4.19/kvm-properly-check-debugfs-dentry-before-using-it.patch
 create mode 100644 queue-4.19/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
 create mode 100644 queue-4.19/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch
 create mode 100644 queue-4.19/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
 create mode 100644 queue-4.19/lib-genalloc.c-include-vmalloc.h.patch
 create mode 100644 queue-4.19/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
 create mode 100644 queue-4.19/mac80211-fix-station-inactive_time-shortly-after-boo.patch
 create mode 100644 queue-4.19/memory-omap-gpmc-get-the-header-of-the-enum.patch
 create mode 100644 queue-4.19/microblaze-adjust-the-help-to-the-real-behavior.patch
 create mode 100644 queue-4.19/microblaze-fix-multiple-bugs-in-arch-microblaze-boot.patch
 create mode 100644 queue-4.19/microblaze-move-.-is-ready-messages-to-arch-microbla.patch
 create mode 100644 queue-4.19/mm-hotplug-invalid-pfns-from-pfn_to_online_page.patch
 create mode 100644 queue-4.19/mm-page_alloc.c-deduplicate-__memblock_free_early-an.patch
 create mode 100644 queue-4.19/mm-page_alloc.c-free-order-0-pages-through-pcp-in-pa.patch
 create mode 100644 queue-4.19/mm-page_alloc.c-use-a-single-function-to-free-page.patch
 create mode 100644 queue-4.19/mmc-core-align-max-segment-size-with-logical-block-s.patch
 create mode 100644 queue-4.19/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch
 create mode 100644 queue-4.19/mtd-check-add_mtd_device-ret-code.patch
 create mode 100644 queue-4.19/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
 create mode 100644 queue-4.19/mtd-remove-a-debug-trace-in-mtdpart.c.patch
 create mode 100644 queue-4.19/mwifiex-debugfs-correct-histogram-spacing-formatting.patch
 create mode 100644 queue-4.19/mwifiex-fix-potential-null-dereference-and-use-after.patch
 create mode 100644 queue-4.19/net-bcmgenet-reapply-manual-settings-to-the-phy.patch
 create mode 100644 queue-4.19/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch
 create mode 100644 queue-4.19/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
 create mode 100644 queue-4.19/net-core-neighbour-tell-kmemleak-about-hash-tables.patch
 create mode 100644 queue-4.19/net-cpts-fix-a-missing-check-of-clk_prepare.patch
 create mode 100644 queue-4.19/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
 create mode 100644 queue-4.19/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
 create mode 100644 queue-4.19/net-fec-add-missed-clk_disable_unprepare-in-remove.patch
 create mode 100644 queue-4.19/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
 create mode 100644 queue-4.19/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch
 create mode 100644 queue-4.19/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch
 create mode 100644 queue-4.19/net-hns3-fix-an-issue-for-hclgevf_ae_get_hdev.patch
 create mode 100644 queue-4.19/net-hns3-fix-an-issue-for-hns3_update_new_int_gl.patch
 create mode 100644 queue-4.19/net-hns3-fix-pfc-not-setting-problem-for-dcb-module.patch
 create mode 100644 queue-4.19/net-ip6_gre-do-not-report-erspan_ver-for-ip6gre-or-i.patch
 create mode 100644 queue-4.19/net-ip_gre-do-not-report-erspan_ver-for-gre-or-greta.patch
 create mode 100644 queue-4.19/net-marvell-fix-a-missing-check-of-acpi_match_device.patch
 create mode 100644 queue-4.19/net-mlx5-continue-driver-initialization-despite-debu.patch
 create mode 100644 queue-4.19/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch
 create mode 100644 queue-4.19/net-net_namespace-check-the-return-value-of-register.patch
 create mode 100644 queue-4.19/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch
 create mode 100644 queue-4.19/net-smc-don-t-wait-for-send-buffer-space-when-data-w.patch
 create mode 100644 queue-4.19/net-smc-fix-byte_order-for-rx_curs_confirmed.patch
 create mode 100644 queue-4.19/net-smc-fix-sender_free-computation.patch
 create mode 100644 queue-4.19/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch
 create mode 100644 queue-4.19/net-stmicro-fix-a-missing-check-of-clk_prepare.patch
 create mode 100644 queue-4.19/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
 create mode 100644 queue-4.19/netfilter-nf_nat_sip-fix-rtp-rtcp-source-port-transl.patch
 create mode 100644 queue-4.19/netfilter-nf_tables-fix-a-missing-check-of-nla_put_f.patch
 create mode 100644 queue-4.19/nvme-fix-kernel-paging-oops.patch
 create mode 100644 queue-4.19/nvme-provide-fallback-for-discard-alloc-failure.patch
 create mode 100644 queue-4.19/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
 create mode 100644 queue-4.19/openrisc-fix-broken-paths-to-arch-or32.patch
 create mode 100644 queue-4.19/parisc-fix-hp-sdc-hpa-address-output.patch
 create mode 100644 queue-4.19/parisc-fix-serio-address-output.patch
 create mode 100644 queue-4.19/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch
 create mode 100644 queue-4.19/pinctrl-cherryview-allocate-irq-chip-dynamic.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a77990-fix-mod_sel0-sel_i2c1-field-.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
 create mode 100644 queue-4.19/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
 create mode 100644 queue-4.19/platform-x86-mlx-platform-fix-led-configuration.patch
 create mode 100644 queue-4.19/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
 create mode 100644 queue-4.19/powerpc-32-avoid-unsupported-flags-with-clang.patch
 create mode 100644 queue-4.19/powerpc-44x-bamboo-fix-pci-range.patch
 create mode 100644 queue-4.19/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
 create mode 100644 queue-4.19/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
 create mode 100644 queue-4.19/powerpc-bpf-fix-tail-call-implementation.patch
 create mode 100644 queue-4.19/powerpc-fix-hmis-on-big-endian-with-config_relocatab.patch
 create mode 100644 queue-4.19/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
 create mode 100644 queue-4.19/powerpc-perf-fix-unit_sel-cache_sel-checks.patch
 create mode 100644 queue-4.19/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
 create mode 100644 queue-4.19/powerpc-prom-fix-early-debug-messages.patch
 create mode 100644 queue-4.19/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
 create mode 100644 queue-4.19/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
 create mode 100644 queue-4.19/powerpc-xmon-fix-dump_segments.patch
 create mode 100644 queue-4.19/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
 create mode 100644 queue-4.19/pwm-clps711x-fix-period-calculation.patch
 create mode 100644 queue-4.19/rdma-hns-bugfix-for-the-scene-without-receiver-queue.patch
 create mode 100644 queue-4.19/rdma-hns-fix-the-bug-while-use-multi-hop-of-pbl.patch
 create mode 100644 queue-4.19/rdma-hns-fix-the-bug-with-updating-rq-head-pointer-w.patch
 create mode 100644 queue-4.19/rdma-hns-fix-the-state-of-rereg-mr.patch
 create mode 100644 queue-4.19/rdma-hns-use-gfp_atomic-in-hns_roce_v2_modify_qp.patch
 create mode 100644 queue-4.19/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
 create mode 100644 queue-4.19/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch
 create mode 100644 queue-4.19/regulator-tps65910-fix-a-missing-check-of-return-val.patch
 create mode 100644 queue-4.19/reset-fix-memory-leak-in-reset_control_array_put.patch
 create mode 100644 queue-4.19/reset-fix-reset_control_ops-kerneldoc-comment.patch
 create mode 100644 queue-4.19/rtl818x-fix-potential-use-after-free.patch
 create mode 100644 queue-4.19/s390-zcrypt-make-sysfs-reset-attribute-trigger-queue.patch
 create mode 100644 queue-4.19/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch
 create mode 100644 queue-4.19/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
 create mode 100644 queue-4.19/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
 create mode 100644 queue-4.19/scsi-hisi_sas-shutdown-axi-bus-to-avoid-exception-cq.patch
 create mode 100644 queue-4.19/scsi-libsas-check-smp-phy-control-function-result.patch
 create mode 100644 queue-4.19/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
 create mode 100644 queue-4.19/scsi-lpfc-enable-management-features-for-if_type-6.patch
 create mode 100644 queue-4.19/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
 create mode 100644 queue-4.19/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-fix-for-fc-nvme-discovery-for-npiv-port.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-fix-npiv-handling-for-fc-nvme.patch
 create mode 100644 queue-4.19/scsi-target-tcmu-fix-queue_cmd_ring-declaration.patch
 create mode 100644 queue-4.19/sctp-don-t-compare-hb_timer-expire-date-before-start.patch
 create mode 100644 queue-4.19/serial-8250-fix-serial8250-initialization-crash.patch
 create mode 100644 queue-4.19/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch
 create mode 100644 queue-4.19/serial-max310x-fix-tx_empty-callback.patch
 create mode 100644 queue-4.19/serial-sh-sci-fix-crash-in-rx_timer_fn-on-pio-fallba.patch
 create mode 100644 queue-4.19/series
 create mode 100644 queue-4.19/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
 create mode 100644 queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
 create mode 100644 queue-4.19/tipc-fix-a-missing-check-of-genlmsg_put.patch
 create mode 100644 queue-4.19/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
 create mode 100644 queue-4.19/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
 create mode 100644 queue-4.19/tools-vm-page-types.c-fix-kpagecount-returned-fewer-.patch
 create mode 100644 queue-4.19/tracing-lock-event_mutex-before-synth_event_mutex.patch
 create mode 100644 queue-4.19/ubi-do-not-drop-ubi-device-reference-before-using.patch
 create mode 100644 queue-4.19/ubi-put-mtd-device-after-it-is-not-used.patch
 create mode 100644 queue-4.19/ubifs-fix-default-compression-selection-in-ubifs.patch
 create mode 100644 queue-4.19/um-include-sys-uio.h-to-have-writev.patch
 create mode 100644 queue-4.19/um-make-gcov-depend-on-kcov.patch
 create mode 100644 queue-4.19/usb-ehci-omap-fix-deferred-probe-for-phy-handling.patch
 create mode 100644 queue-4.19/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch
 create mode 100644 queue-4.19/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
 create mode 100644 queue-4.19/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
 create mode 100644 queue-4.19/vsock-bind-to-random-port-for-vmaddr_port_any.patch
 create mode 100644 queue-4.19/vxlan-fix-error-path-in-__vxlan_dev_create.patch
 create mode 100644 queue-4.19/watchdog-meson-fix-the-wrong-value-of-left-time.patch
 create mode 100644 queue-4.19/x86-resctrl-prevent-null-pointer-dereference-when-re.patch
 create mode 100644 queue-4.19/xdp-fix-cpumap-redirect-skb-creation-bug.patch
 create mode 100644 queue-4.19/xen-pciback-check-dev_data-before-using-it.patch
 create mode 100644 queue-4.19/xfs-align-compat-attrlist_by_handle-with-native-impl.patch
 create mode 100644 queue-4.19/xfs-end-sync-buffer-i-o-properly-on-shutdown-error.patch
 create mode 100644 queue-4.19/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
 create mode 100644 queue-4.19/xfs-require-both-realtime-inodes-to-mount.patch
 create mode 100644 queue-4.19/xfs-zero-length-symlinks-are-not-valid.patch
 create mode 100644 queue-4.19/xprtrdma-prevent-leak-of-rpcrdma_rep-objects.patch

diff --git a/queue-4.19/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch b/queue-4.19/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch
new file mode 100644
index 00000000000..9cef5c7def1
--- /dev/null
+++ b/queue-4.19/acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch
@@ -0,0 +1,55 @@
+From aa7c46b5a8f30eec20aeb6360d74552553cc135a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:37 +0000
+Subject: ACPI / APEI: Don't wait to serialise with oops messages when
+ panic()ing
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 78b0b690f6558ed788dccafa45965325dd11ba89 ]
+
+oops_begin() exists to group printk() messages with the oops message
+printed by die(). To reach this caller we know that platform firmware
+took this error first, then notified the OS via NMI with a 'panic'
+severity.
+
+Don't wait for another CPU to release the die-lock before panic()ing,
+our only goal is to print this fatal error and panic().
+
+This code is always called in_nmi(), and since commit 42a0bb3f7138
+("printk/nmi: generic solution for safe printk in NMI"), it has been
+safe to call printk() from this context. Messages are batched in a
+per-cpu buffer and printed via irq-work, or a call back from panic().
+
+Link: https://patchwork.kernel.org/patch/10313555/
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index f008ba7c9cedc..0c46b79e31b1e 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -33,7 +33,6 @@
+ #include <linux/interrupt.h>
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+-#include <linux/kdebug.h>
+ #include <linux/platform_device.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+@@ -949,7 +948,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs)
+ 
+ 		sev = ghes_severity(ghes->estatus->error_severity);
+ 		if (sev >= GHES_SEV_PANIC) {
+-			oops_begin();
+ 			ghes_print_queued_estatus();
+ 			__ghes_panic(ghes);
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch b/queue-4.19/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
new file mode 100644
index 00000000000..449c1b2a03a
--- /dev/null
+++ b/queue-4.19/acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
@@ -0,0 +1,93 @@
+From c6dff47dbef9da434b9e94f3b259346d1cd0e1f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:39 +0000
+Subject: ACPI / APEI: Switch estatus pool to use vmalloc memory
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 0ac234be1a9497498e57d958f4251f5257b116b4 ]
+
+The ghes code is careful to parse and round firmware's advertised
+memory requirements for CPER records, up to a maximum of 64K.
+However when ghes_estatus_pool_expand() does its work, it splits
+the requested size into PAGE_SIZE granules.
+
+This means if firmware generates 5K of CPER records, and correctly
+describes this in the table, __process_error() will silently fail as it
+is unable to allocate more than PAGE_SIZE.
+
+Switch the estatus pool to vmalloc() memory. On x86 vmalloc() memory
+may fault and be fixed up by vmalloc_fault(). To prevent this call
+vmalloc_sync_all() before an NMI handler could discover the memory.
+
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 0c46b79e31b1e..73177b8a07bd1 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -170,40 +170,40 @@ static int ghes_estatus_pool_init(void)
+ 	return 0;
+ }
+ 
+-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool,
++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool,
+ 					      struct gen_pool_chunk *chunk,
+ 					      void *data)
+ {
+-	free_page(chunk->start_addr);
++	vfree((void *)chunk->start_addr);
+ }
+ 
+ static void ghes_estatus_pool_exit(void)
+ {
+ 	gen_pool_for_each_chunk(ghes_estatus_pool,
+-				ghes_estatus_pool_free_chunk_page, NULL);
++				ghes_estatus_pool_free_chunk, NULL);
+ 	gen_pool_destroy(ghes_estatus_pool);
+ }
+ 
+ static int ghes_estatus_pool_expand(unsigned long len)
+ {
+-	unsigned long i, pages, size, addr;
+-	int ret;
++	unsigned long size, addr;
+ 
+ 	ghes_estatus_pool_size_request += PAGE_ALIGN(len);
+ 	size = gen_pool_size(ghes_estatus_pool);
+ 	if (size >= ghes_estatus_pool_size_request)
+ 		return 0;
+-	pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE;
+-	for (i = 0; i < pages; i++) {
+-		addr = __get_free_page(GFP_KERNEL);
+-		if (!addr)
+-			return -ENOMEM;
+-		ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1);
+-		if (ret)
+-			return ret;
+-	}
+ 
+-	return 0;
++	addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
++	if (!addr)
++		return -ENOMEM;
++
++	/*
++	 * New allocation must be visible in all pgd before it can be found by
++	 * an NMI allocating from the pool.
++	 */
++	vmalloc_sync_all();
++
++	return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+ 
+ static int map_gen_v2(struct ghes *ghes)
+-- 
+2.20.1
+
diff --git a/queue-4.19/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch b/queue-4.19/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
new file mode 100644
index 00000000000..4c2d2d3ef29
--- /dev/null
+++ b/queue-4.19/acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
@@ -0,0 +1,54 @@
+From a2340ffcec39e497cf6d07d0c05f879c62081cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 13:59:24 +0100
+Subject: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1a2fa02f7489dc4d746f2a15fb77b3ce1affade8 ]
+
+Ignore acpi_device_fix_up_power() return value. If we return an error
+we end up with acpi_default_enumeration() still creating a platform-
+device for the device and we end up with the device still being used
+but without the special LPSS related handling which is not useful.
+
+Specicifically ignoring the error fixes the touchscreen no longer
+working after a suspend/resume on a Prowise PT301 tablet.
+
+This tablet has a broken _PS0 method on the touchscreen's I2C controller,
+causing acpi_device_fix_up_power() to fail, causing fallback to standard
+platform-dev handling and specifically causing acpi_lpss_save/restore_ctx
+to not run.
+
+The I2C controllers _PS0 method does actually turn on the device, but then
+does some more nonsense which fails when run during early boot trying to
+use I2C opregion handling on another not-yet registered I2C controller.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index b21c241aaab9f..30ccd94f87d24 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -665,12 +665,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ 	 * have _PS0 and _PS3 without _PSC (and no power resources), so
+ 	 * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+ 	 */
+-	ret = acpi_device_fix_up_power(adev);
+-	if (ret) {
+-		/* Skip the device, but continue the namespace scan. */
+-		ret = 0;
+-		goto err_out;
+-	}
++	acpi_device_fix_up_power(adev);
+ 
+ 	adev->driver_data = pdata;
+ 	pdev = acpi_create_platform_device(adev, dev_desc->properties);
+-- 
+2.20.1
+
diff --git a/queue-4.19/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch b/queue-4.19/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch
new file mode 100644
index 00000000000..19263da5473
--- /dev/null
+++ b/queue-4.19/apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch
@@ -0,0 +1,43 @@
+From 453c35cdd39dcf39e2a9e263716d9c62c25d1af0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Feb 2019 10:21:23 +0000
+Subject: apparmor: delete the dentry in aafs_remove() to avoid a leak
+
+From: Chris Coulson <chris.coulson@canonical.com>
+
+[ Upstream commit 201218e4d3dfa1346e30997f48725acce3f26d01 ]
+
+Although the apparmorfs dentries are always dropped from the dentry cache
+when the usage count drops to zero, there is no guarantee that this will
+happen in aafs_remove(), as another thread might still be using it. In
+this scenario, this means that the dentry will temporarily continue to
+appear in the results of lookups, even after the call to aafs_remove().
+
+In the case of removal of a profile - it also causes simple_rmdir()
+on the profile directory to fail, as the directory won't be empty until
+the usage counts of all child dentries have decreased to zero. This
+results in the dentry for the profile directory leaking and appearing
+empty in the file system tree forever.
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/apparmorfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 40e3a098f6fb5..d95a7e41a29d4 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -361,6 +361,7 @@ static void aafs_remove(struct dentry *dentry)
+ 			simple_rmdir(dir, dentry);
+ 		else
+ 			simple_unlink(dir, dentry);
++		d_delete(dentry);
+ 		dput(dentry);
+ 	}
+ 	inode_unlock(dir);
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch b/queue-4.19/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
new file mode 100644
index 00000000000..eb974df78ba
--- /dev/null
+++ b/queue-4.19/arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
@@ -0,0 +1,70 @@
+From c7c6bbc726dea06607a81f00bce3ebd1450c9bc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:04:16 +0100
+Subject: ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 7c41ea57beb2aee96fa63091a457b1a2826f3c42 ]
+
+If debugging on i.MX is enabled DEBUG_IMX_UART_PORT defines which UART
+is used for the debug output. If however debugging is off don't only
+hide the then unused config item but drop it completely by using a
+dependency instead of a conditional prompt.
+
+This fixes DEBUG_IMX_UART_PORT being present in the kernel config even
+if DEBUG_LL is disabled.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index f6fcb8a798890..f95a90dfc282a 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1432,21 +1432,21 @@ config DEBUG_OMAP2PLUS_UART
+ 	depends on ARCH_OMAP2PLUS
+ 
+ config DEBUG_IMX_UART_PORT
+-	int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
+-						DEBUG_IMX25_UART || \
+-						DEBUG_IMX21_IMX27_UART || \
+-						DEBUG_IMX31_UART || \
+-						DEBUG_IMX35_UART || \
+-						DEBUG_IMX50_UART || \
+-						DEBUG_IMX51_UART || \
+-						DEBUG_IMX53_UART || \
+-						DEBUG_IMX6Q_UART || \
+-						DEBUG_IMX6SL_UART || \
+-						DEBUG_IMX6SX_UART || \
+-						DEBUG_IMX6UL_UART || \
+-						DEBUG_IMX7D_UART
++	int "i.MX Debug UART Port Selection"
++	depends on DEBUG_IMX1_UART || \
++		   DEBUG_IMX25_UART || \
++		   DEBUG_IMX21_IMX27_UART || \
++		   DEBUG_IMX31_UART || \
++		   DEBUG_IMX35_UART || \
++		   DEBUG_IMX50_UART || \
++		   DEBUG_IMX51_UART || \
++		   DEBUG_IMX53_UART || \
++		   DEBUG_IMX6Q_UART || \
++		   DEBUG_IMX6SL_UART || \
++		   DEBUG_IMX6SX_UART || \
++		   DEBUG_IMX6UL_UART || \
++		   DEBUG_IMX7D_UART
+ 	default 1
+-	depends on ARCH_MXC
+ 	help
+ 	  Choose UART port on which kernel low-level debug messages
+ 	  should be output.
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-fix-hsi-gdd-range-for-omap4.patch b/queue-4.19/arm-dts-fix-hsi-gdd-range-for-omap4.patch
new file mode 100644
index 00000000000..e2a7bcafe59
--- /dev/null
+++ b/queue-4.19/arm-dts-fix-hsi-gdd-range-for-omap4.patch
@@ -0,0 +1,46 @@
+From bdedec7ba6b67f57c5818f8029dea26130844635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 14:48:51 -0800
+Subject: ARM: dts: Fix hsi gdd range for omap4
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit e9e685480b74aef3f3d0967dadb52eea3ff625d2 ]
+
+While reviewing the missing mcasp ranges I noticed omap4 hsi range
+for gdd is wrong so let's fix it.
+
+I'm not aware of any omap4 devices in mainline kernel though that use
+hsi though.
+
+Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe
+them with ti-sysc")
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap4-l4.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap4-l4.dtsi b/arch/arm/boot/dts/omap4-l4.dtsi
+index 6eb26b837446c..5059ecac44787 100644
+--- a/arch/arm/boot/dts/omap4-l4.dtsi
++++ b/arch/arm/boot/dts/omap4-l4.dtsi
+@@ -196,12 +196,12 @@
+ 			clock-names = "fck";
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+-			ranges = <0x0 0x58000 0x4000>;
++			ranges = <0x0 0x58000 0x5000>;
+ 
+ 			hsi: hsi@0 {
+ 				compatible = "ti,omap4-hsi";
+ 				reg = <0x0 0x4000>,
+-				      <0x4a05c000 0x1000>;
++				      <0x5000 0x1000>;
+ 				reg-names = "sys", "gdd";
+ 
+ 				clocks = <&l3_init_clkctrl OMAP4_HSI_CLKCTRL 0>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-fix-up-sq201-flash-access.patch b/queue-4.19/arm-dts-fix-up-sq201-flash-access.patch
new file mode 100644
index 00000000000..51c0846b31f
--- /dev/null
+++ b/queue-4.19/arm-dts-fix-up-sq201-flash-access.patch
@@ -0,0 +1,78 @@
+From 7da70bb287a3f45f38cc409063189a83ae111505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 09:00:51 +0200
+Subject: ARM: dts: Fix up SQ201 flash access
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit d88b11ef91b15d0af9c0676cbf4f441a0dff0c56 ]
+
+This sets the partition information on the SQ201 to be read
+out from the RedBoot partition table, removes the static
+partition table and sets our boot options to mount root from
+/dev/mtdblock2 where the squashfs+JFFS2 resides.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/gemini-sq201.dts | 37 ++++--------------------------
+ 1 file changed, 5 insertions(+), 32 deletions(-)
+
+diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts
+index 3787cf3763c41..e9e4a8a02600b 100644
+--- a/arch/arm/boot/dts/gemini-sq201.dts
++++ b/arch/arm/boot/dts/gemini-sq201.dts
+@@ -20,7 +20,7 @@
+ 	};
+ 
+ 	chosen {
+-		bootargs = "console=ttyS0,115200n8";
++		bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait";
+ 		stdout-path = &uart0;
+ 	};
+ 
+@@ -138,37 +138,10 @@
+ 			/* 16MB of flash */
+ 			reg = <0x30000000 0x01000000>;
+ 
+-			partition@0 {
+-				label = "RedBoot";
+-				reg = <0x00000000 0x00120000>;
+-				read-only;
+-			};
+-			partition@120000 {
+-				label = "Kernel";
+-				reg = <0x00120000 0x00200000>;
+-			};
+-			partition@320000 {
+-				label = "Ramdisk";
+-				reg = <0x00320000 0x00600000>;
+-			};
+-			partition@920000 {
+-				label = "Application";
+-				reg = <0x00920000 0x00600000>;
+-			};
+-			partition@f20000 {
+-				label = "VCTL";
+-				reg = <0x00f20000 0x00020000>;
+-				read-only;
+-			};
+-			partition@f40000 {
+-				label = "CurConf";
+-				reg = <0x00f40000 0x000a0000>;
+-				read-only;
+-			};
+-			partition@fe0000 {
+-				label = "FIS directory";
+-				reg = <0x00fe0000 0x00020000>;
+-				read-only;
++			partitions {
++				compatible = "redboot-fis";
++				/* Eraseblock at 0xfe0000 */
++				fis-index-block = <0x1fc>;
+ 			};
+ 		};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx1-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx1-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..273e0260948
--- /dev/null
+++ b/queue-4.19/arm-dts-imx1-fix-memory-node-duplication.patch
@@ -0,0 +1,70 @@
+From 260a118cbf331fbe8c3966c95361e3448cb21f79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:40:52 -0200
+Subject: ARM: dts: imx1: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 62864d5665c4fc636d3021f829b3ac00fa058e30 ]
+
+Boards based on imx1 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx1.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx1-ads.dts     | 1 +
+ arch/arm/boot/dts/imx1-apf9328.dts | 1 +
+ arch/arm/boot/dts/imx1.dtsi        | 2 --
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx1-ads.dts b/arch/arm/boot/dts/imx1-ads.dts
+index a1d81badb5c8a..119b19ba53b6d 100644
+--- a/arch/arm/boot/dts/imx1-ads.dts
++++ b/arch/arm/boot/dts/imx1-ads.dts
+@@ -21,6 +21,7 @@
+ 	};
+ 
+ 	memory@8000000 {
++		device_type = "memory";
+ 		reg = <0x08000000 0x04000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx1-apf9328.dts b/arch/arm/boot/dts/imx1-apf9328.dts
+index 11515c0cb195c..ee4b1b106b1ae 100644
+--- a/arch/arm/boot/dts/imx1-apf9328.dts
++++ b/arch/arm/boot/dts/imx1-apf9328.dts
+@@ -21,6 +21,7 @@
+ 	};
+ 
+ 	memory@8000000 {
++		device_type = "memory";
+ 		reg = <0x08000000 0x00800000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx1.dtsi b/arch/arm/boot/dts/imx1.dtsi
+index 3edc7b5550d88..2b6e77029de4d 100644
+--- a/arch/arm/boot/dts/imx1.dtsi
++++ b/arch/arm/boot/dts/imx1.dtsi
+@@ -15,10 +15,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		gpio0 = &gpio1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx23-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx23-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..5550e5e2c61
--- /dev/null
+++ b/queue-4.19/arm-dts-imx23-fix-memory-node-duplication.patch
@@ -0,0 +1,109 @@
+From 5160623d566cbce5f2af7e8a22ebcf35992055fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:08:55 -0200
+Subject: ARM: dts: imx23: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit b629e83520fafe6f4c2f3e8c88c78a496fc4987c ]
+
+Boards based on imx23 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx23.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx23-evk.dts           | 1 +
+ arch/arm/boot/dts/imx23-olinuxino.dts     | 1 +
+ arch/arm/boot/dts/imx23-sansa.dts         | 1 +
+ arch/arm/boot/dts/imx23-stmp378x_devb.dts | 1 +
+ arch/arm/boot/dts/imx23-xfi3.dts          | 1 +
+ arch/arm/boot/dts/imx23.dtsi              | 2 --
+ 6 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
+index ad2ae25b7b4db..aca27aa2d44bd 100644
+--- a/arch/arm/boot/dts/imx23-evk.dts
++++ b/arch/arm/boot/dts/imx23-evk.dts
+@@ -10,6 +10,7 @@
+ 	compatible = "fsl,imx23-evk", "fsl,imx23";
+ 
+ 	memory@40000000 {
++		device_type = "memory";
+ 		reg = <0x40000000 0x08000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts
+index e9351774c6199..109f51603d45e 100644
+--- a/arch/arm/boot/dts/imx23-olinuxino.dts
++++ b/arch/arm/boot/dts/imx23-olinuxino.dts
+@@ -20,6 +20,7 @@
+ 	compatible = "olimex,imx23-olinuxino", "fsl,imx23";
+ 
+ 	memory@40000000 {
++		device_type = "memory";
+ 		reg = <0x40000000 0x04000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx23-sansa.dts b/arch/arm/boot/dts/imx23-sansa.dts
+index 67de7863ad795..fa22fd9b24129 100644
+--- a/arch/arm/boot/dts/imx23-sansa.dts
++++ b/arch/arm/boot/dts/imx23-sansa.dts
+@@ -50,6 +50,7 @@
+ 	compatible = "sandisk,sansa_fuze_plus", "fsl,imx23";
+ 
+ 	memory@40000000 {
++		device_type = "memory";
+ 		reg = <0x40000000 0x04000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx23-stmp378x_devb.dts b/arch/arm/boot/dts/imx23-stmp378x_devb.dts
+index 95c7b918f6d60..aab029349420d 100644
+--- a/arch/arm/boot/dts/imx23-stmp378x_devb.dts
++++ b/arch/arm/boot/dts/imx23-stmp378x_devb.dts
+@@ -17,6 +17,7 @@
+ 	compatible = "fsl,stmp378x-devb", "fsl,imx23";
+ 
+ 	memory@40000000 {
++		device_type = "memory";
+ 		reg = <0x40000000 0x04000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx23-xfi3.dts b/arch/arm/boot/dts/imx23-xfi3.dts
+index 9616e500b9961..2b5df8dfd3ff3 100644
+--- a/arch/arm/boot/dts/imx23-xfi3.dts
++++ b/arch/arm/boot/dts/imx23-xfi3.dts
+@@ -49,6 +49,7 @@
+ 	compatible = "creative,x-fi3", "fsl,imx23";
+ 
+ 	memory@40000000 {
++		device_type = "memory";
+ 		reg = <0x40000000 0x04000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
+index 71bfd2b15609a..aaaa987d8eff9 100644
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -13,10 +13,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		gpio0 = &gpio0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx25-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx25-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..7e183a1ed7f
--- /dev/null
+++ b/queue-4.19/arm-dts-imx25-fix-memory-node-duplication.patch
@@ -0,0 +1,83 @@
+From 48c7a0249de8f50e2f3d078369479751a67b4034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:40:54 -0200
+Subject: ARM: dts: imx25: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 59d8bb363f563e4a147a291037bf979cb8ff9a59 ]
+
+Boards based on imx25 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx25.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi | 1 +
+ arch/arm/boot/dts/imx25-karo-tx25.dts        | 1 +
+ arch/arm/boot/dts/imx25-pdk.dts              | 1 +
+ arch/arm/boot/dts/imx25.dtsi                 | 2 --
+ 4 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+index e316fe08837a3..e4d7da267532d 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
++++ b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+@@ -18,6 +18,7 @@
+ 	compatible = "eukrea,cpuimx25", "fsl,imx25";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x4000000>; /* 64M */
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx25-karo-tx25.dts b/arch/arm/boot/dts/imx25-karo-tx25.dts
+index 5cb6967866c0a..f37e9a75a3ca7 100644
+--- a/arch/arm/boot/dts/imx25-karo-tx25.dts
++++ b/arch/arm/boot/dts/imx25-karo-tx25.dts
+@@ -37,6 +37,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x02000000 0x90000000 0x02000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
+index a5626b46ac4e1..f8544a9e46330 100644
+--- a/arch/arm/boot/dts/imx25-pdk.dts
++++ b/arch/arm/boot/dts/imx25-pdk.dts
+@@ -12,6 +12,7 @@
+ 	compatible = "fsl,imx25-pdk", "fsl,imx25";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x4000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index 85c15ee632727..8c8ad80de4614 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -12,10 +12,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx27-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx27-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..92e46840154
--- /dev/null
+++ b/queue-4.19/arm-dts-imx27-fix-memory-node-duplication.patch
@@ -0,0 +1,109 @@
+From 7c709869b19b4acc4f5a209fa64781142ed7f67a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:40:53 -0200
+Subject: ARM: dts: imx27: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 38715dcd49b4430ac5b6bc1293278d91a4d32bd5 ]
+
+Boards based on imx27 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx27.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx27-apf27.dts                 | 1 +
+ arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi      | 1 +
+ arch/arm/boot/dts/imx27-pdk.dts                   | 1 +
+ arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi | 1 +
+ arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi   | 1 +
+ arch/arm/boot/dts/imx27.dtsi                      | 2 --
+ 6 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx27-apf27.dts b/arch/arm/boot/dts/imx27-apf27.dts
+index 3eddd805a793a..f635d5c5029c4 100644
+--- a/arch/arm/boot/dts/imx27-apf27.dts
++++ b/arch/arm/boot/dts/imx27-apf27.dts
+@@ -20,6 +20,7 @@
+ 	compatible = "armadeus,imx27-apf27", "fsl,imx27";
+ 
+ 	memory@a0000000 {
++		device_type = "memory";
+ 		reg = <0xa0000000 0x04000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+index 9c455dcbe6ebf..c85f9d01768a1 100644
+--- a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
++++ b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+@@ -17,6 +17,7 @@
+ 	compatible = "eukrea,cpuimx27", "fsl,imx27";
+ 
+ 	memory@a0000000 {
++		device_type = "memory";
+ 		reg = <0xa0000000 0x04000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx27-pdk.dts b/arch/arm/boot/dts/imx27-pdk.dts
+index f9a882d991329..35123b7cb6b3e 100644
+--- a/arch/arm/boot/dts/imx27-pdk.dts
++++ b/arch/arm/boot/dts/imx27-pdk.dts
+@@ -10,6 +10,7 @@
+ 	compatible = "fsl,imx27-pdk", "fsl,imx27";
+ 
+ 	memory@a0000000 {
++		device_type = "memory";
+ 		reg = <0xa0000000 0x08000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
+index cbad7c88c58cc..b0b4f7c00246d 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
+@@ -18,6 +18,7 @@
+ 	compatible = "phytec,imx27-pca100", "fsl,imx27";
+ 
+ 	memory@a0000000 {
++		device_type = "memory";
+ 		reg = <0xa0000000 0x08000000>; /* 128MB */
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+index ec466b4bfd410..0935e1400e5d2 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+@@ -17,6 +17,7 @@
+ 	compatible = "phytec,imx27-pcm038", "fsl,imx27";
+ 
+ 	memory@a0000000 {
++		device_type = "memory";
+ 		reg = <0xa0000000 0x08000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
+index 753d88df16274..39e75b997bdc8 100644
+--- a/arch/arm/boot/dts/imx27.dtsi
++++ b/arch/arm/boot/dts/imx27.dtsi
+@@ -16,10 +16,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx31-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx31-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..17cfdbf49b6
--- /dev/null
+++ b/queue-4.19/arm-dts-imx31-fix-memory-node-duplication.patch
@@ -0,0 +1,72 @@
+From 8b798c2c5b72afb798da4dffb5d82cc0f33d6b05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:40:45 -0200
+Subject: ARM: dts: imx31: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 013d37e4707e24c7b9bc3fc55aeda55ce9c2b262 ]
+
+Boards based on imx31 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx31.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Tested-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx31-bug.dts  | 1 +
+ arch/arm/boot/dts/imx31-lite.dts | 1 +
+ arch/arm/boot/dts/imx31.dtsi     | 2 --
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx31-bug.dts b/arch/arm/boot/dts/imx31-bug.dts
+index 6ee4ff8e4e8f0..9eb960cc02cc5 100644
+--- a/arch/arm/boot/dts/imx31-bug.dts
++++ b/arch/arm/boot/dts/imx31-bug.dts
+@@ -17,6 +17,7 @@
+ 	compatible = "buglabs,imx31-bug", "fsl,imx31";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x8000000>; /* 128M */
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx31-lite.dts b/arch/arm/boot/dts/imx31-lite.dts
+index db52ddccabc33..d17abdfb6330c 100644
+--- a/arch/arm/boot/dts/imx31-lite.dts
++++ b/arch/arm/boot/dts/imx31-lite.dts
+@@ -18,6 +18,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x8000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
+index ca1419ca303c3..2fc64d2c7c88e 100644
+--- a/arch/arm/boot/dts/imx31.dtsi
++++ b/arch/arm/boot/dts/imx31.dtsi
+@@ -10,10 +10,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		gpio0 = &gpio1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx35-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx35-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..86b95c39b03
--- /dev/null
+++ b/queue-4.19/arm-dts-imx35-fix-memory-node-duplication.patch
@@ -0,0 +1,70 @@
+From 914a005705dbae192278528084ee4e43d8e699cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:40:46 -0200
+Subject: ARM: dts: imx35: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 8721610a6c2b8c42fc57819d8c3bfbb9166f95a3 ]
+
+Boards based on imx35 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx35.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi | 1 +
+ arch/arm/boot/dts/imx35-pdk.dts              | 1 +
+ arch/arm/boot/dts/imx35.dtsi                 | 2 --
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi b/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
+index ba39d938f2891..5f8a47a9fcd40 100644
+--- a/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
++++ b/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
+@@ -18,6 +18,7 @@
+ 	compatible = "eukrea,cpuimx35", "fsl,imx35";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x8000000>; /* 128M */
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx35-pdk.dts b/arch/arm/boot/dts/imx35-pdk.dts
+index df613e88fd2c1..ddce0a844758b 100644
+--- a/arch/arm/boot/dts/imx35-pdk.dts
++++ b/arch/arm/boot/dts/imx35-pdk.dts
+@@ -11,6 +11,7 @@
+ 	compatible = "fsl,imx35-pdk", "fsl,imx35";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x8000000>,
+ 		      <0x90000000 0x8000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
+index 1c50b785cad47..b36b97b655dda 100644
+--- a/arch/arm/boot/dts/imx35.dtsi
++++ b/arch/arm/boot/dts/imx35.dtsi
+@@ -13,10 +13,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx50-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx50-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..7243e24d235
--- /dev/null
+++ b/queue-4.19/arm-dts-imx50-fix-memory-node-duplication.patch
@@ -0,0 +1,57 @@
+From 22434d8e39c865304f05570643f1e58d5ebb98dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 11:25:19 -0200
+Subject: ARM: dts: imx50: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit aab5e3ea95b958cf22a24e756a84e635bdb081c1 ]
+
+imx50-evk has duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx50.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-evk.dts | 1 +
+ arch/arm/boot/dts/imx50.dtsi    | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index 682a99783ee69..a25da415cb02e 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -12,6 +12,7 @@
+ 	compatible = "fsl,imx50-evk", "fsl,imx50";
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x80000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
+index ab522c2da6df6..9e9e92acceb27 100644
+--- a/arch/arm/boot/dts/imx50.dtsi
++++ b/arch/arm/boot/dts/imx50.dtsi
+@@ -22,10 +22,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx51-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx51-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..c57c721a7b7
--- /dev/null
+++ b/queue-4.19/arm-dts-imx51-fix-memory-node-duplication.patch
@@ -0,0 +1,148 @@
+From c9e4095011f500f1e226cc50defa234830e9ac2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 19:14:45 -0200
+Subject: ARM: dts: imx51: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 6a9681168b83c62abfa457c709f2f4b126bd6b92 ]
+
+Boards based on imx51 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx51.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx51-apf51.dts                 | 1 +
+ arch/arm/boot/dts/imx51-babbage.dts               | 1 +
+ arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi | 1 +
+ arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi      | 1 +
+ arch/arm/boot/dts/imx51-ts4800.dts                | 1 +
+ arch/arm/boot/dts/imx51-zii-rdu1.dts              | 1 +
+ arch/arm/boot/dts/imx51-zii-scu2-mezz.dts         | 1 +
+ arch/arm/boot/dts/imx51-zii-scu3-esb.dts          | 1 +
+ arch/arm/boot/dts/imx51.dtsi                      | 2 --
+ 9 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx51-apf51.dts b/arch/arm/boot/dts/imx51-apf51.dts
+index 79d80036f74de..1eddf2908b3f2 100644
+--- a/arch/arm/boot/dts/imx51-apf51.dts
++++ b/arch/arm/boot/dts/imx51-apf51.dts
+@@ -22,6 +22,7 @@
+ 	compatible = "armadeus,imx51-apf51", "fsl,imx51";
+ 
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
+index ba60b0cb3cc13..99191466a8085 100644
+--- a/arch/arm/boot/dts/imx51-babbage.dts
++++ b/arch/arm/boot/dts/imx51-babbage.dts
+@@ -15,6 +15,7 @@
+ 	};
+ 
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi b/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
+index 5761a66e8a0d3..82d8df097ef1f 100644
+--- a/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
++++ b/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
+@@ -17,6 +17,7 @@
+ 	compatible = "digi,connectcore-ccxmx51-som", "fsl,imx51";
+ 
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0x08000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi b/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
+index f8902a338e49a..2e3125391bc49 100644
+--- a/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
++++ b/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
+@@ -23,6 +23,7 @@
+ 	compatible = "eukrea,cpuimx51", "fsl,imx51";
+ 
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0x10000000>; /* 256M */
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx51-ts4800.dts b/arch/arm/boot/dts/imx51-ts4800.dts
+index 39eb067904c3d..4344632f79400 100644
+--- a/arch/arm/boot/dts/imx51-ts4800.dts
++++ b/arch/arm/boot/dts/imx51-ts4800.dts
+@@ -18,6 +18,7 @@
+ 	};
+ 
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0x10000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+index 3fb66ddfe93a5..9235fd45a824e 100644
+--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+@@ -53,6 +53,7 @@
+ 
+ 	/* Will be filled by the bootloader */
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts b/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
+index 26cf08549df40..f5b2d768fe47f 100644
+--- a/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
++++ b/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
+@@ -18,6 +18,7 @@
+ 
+ 	/* Will be filled by the bootloader */
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx51-zii-scu3-esb.dts b/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
+index e6ebac8f43e4f..ad90d66ccca6c 100644
+--- a/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
++++ b/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
+@@ -18,6 +18,7 @@
+ 
+ 	/* Will be filled by the bootloader */
+ 	memory@90000000 {
++		device_type = "memory";
+ 		reg = <0x90000000 0>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
+index ef2abc0978439..81f60c96a2e41 100644
+--- a/arch/arm/boot/dts/imx51.dtsi
++++ b/arch/arm/boot/dts/imx51.dtsi
+@@ -16,10 +16,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx53-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx53-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..62abcb4e66a
--- /dev/null
+++ b/queue-4.19/arm-dts-imx53-fix-memory-node-duplication.patch
@@ -0,0 +1,148 @@
+From 9311b50747beff4b1ff5de84e8e071fd8ca232be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 19:14:46 -0200
+Subject: ARM: dts: imx53: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit e8fd17b900a4a1e3a8bef7b44727cbad35db05a7 ]
+
+Boards based on imx53 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx53.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-ard.dts         | 1 +
+ arch/arm/boot/dts/imx53-cx9020.dts      | 1 +
+ arch/arm/boot/dts/imx53-m53.dtsi        | 1 +
+ arch/arm/boot/dts/imx53-qsb-common.dtsi | 1 +
+ arch/arm/boot/dts/imx53-smd.dts         | 1 +
+ arch/arm/boot/dts/imx53-tqma53.dtsi     | 1 +
+ arch/arm/boot/dts/imx53-tx53.dtsi       | 1 +
+ arch/arm/boot/dts/imx53-usbarmory.dts   | 1 +
+ arch/arm/boot/dts/imx53.dtsi            | 2 --
+ 9 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-ard.dts b/arch/arm/boot/dts/imx53-ard.dts
+index 117bd002dd1d1..7d5a48250f867 100644
+--- a/arch/arm/boot/dts/imx53-ard.dts
++++ b/arch/arm/boot/dts/imx53-ard.dts
+@@ -19,6 +19,7 @@
+ 	compatible = "fsl,imx53-ard", "fsl,imx53";
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx53-cx9020.dts b/arch/arm/boot/dts/imx53-cx9020.dts
+index cf70ebc4399a2..c875e23ee45fb 100644
+--- a/arch/arm/boot/dts/imx53-cx9020.dts
++++ b/arch/arm/boot/dts/imx53-cx9020.dts
+@@ -22,6 +22,7 @@
+ 	};
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x20000000>,
+ 		      <0xb0000000 0x20000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx53-m53.dtsi b/arch/arm/boot/dts/imx53-m53.dtsi
+index ce45f08e30514..db2e5bce9b6a1 100644
+--- a/arch/arm/boot/dts/imx53-m53.dtsi
++++ b/arch/arm/boot/dts/imx53-m53.dtsi
+@@ -16,6 +16,7 @@
+ 	compatible = "aries,imx53-m53", "denx,imx53-m53", "fsl,imx53";
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x20000000>,
+ 		      <0xb0000000 0x20000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+index 50dde84b72ed7..f00dda334976a 100644
+--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+@@ -11,6 +11,7 @@
+ 	};
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x20000000>,
+ 		      <0xb0000000 0x20000000>;
+ 	};
+diff --git a/arch/arm/boot/dts/imx53-smd.dts b/arch/arm/boot/dts/imx53-smd.dts
+index 462071c9ddd73..09071ca11c6cf 100644
+--- a/arch/arm/boot/dts/imx53-smd.dts
++++ b/arch/arm/boot/dts/imx53-smd.dts
+@@ -12,6 +12,7 @@
+ 	compatible = "fsl,imx53-smd", "fsl,imx53";
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx53-tqma53.dtsi b/arch/arm/boot/dts/imx53-tqma53.dtsi
+index a72b8981fc3bd..c77d58f06c949 100644
+--- a/arch/arm/boot/dts/imx53-tqma53.dtsi
++++ b/arch/arm/boot/dts/imx53-tqma53.dtsi
+@@ -17,6 +17,7 @@
+ 	compatible = "tq,tqma53", "fsl,imx53";
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x40000000>; /* Up to 1GiB */
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
+index 54cf3e67069a9..4ab135906949f 100644
+--- a/arch/arm/boot/dts/imx53-tx53.dtsi
++++ b/arch/arm/boot/dts/imx53-tx53.dtsi
+@@ -51,6 +51,7 @@
+ 
+ 	/* Will be filled by the bootloader */
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx53-usbarmory.dts b/arch/arm/boot/dts/imx53-usbarmory.dts
+index f6268d0ded296..ee6263d1c2d3d 100644
+--- a/arch/arm/boot/dts/imx53-usbarmory.dts
++++ b/arch/arm/boot/dts/imx53-usbarmory.dts
+@@ -58,6 +58,7 @@
+ 	};
+ 
+ 	memory@70000000 {
++		device_type = "memory";
+ 		reg = <0x70000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
+index b6b0818343c4e..8accbe16b7584 100644
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -23,10 +23,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch b/queue-4.19/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
new file mode 100644
index 00000000000..1711d418e0b
--- /dev/null
+++ b/queue-4.19/arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
@@ -0,0 +1,44 @@
+From 0d42fa793f4d769d71dfbd4a371148f73331e4b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 16:10:01 -0200
+Subject: ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 998a84c27a7f3f9133d32af64e19c05cec161a1a ]
+
+imx53-voipac-dmm-668 has two memory nodes, but the correct representation
+would be to use a single one with two reg entries - one for each RAM chip
+select, so fix it accordingly.
+
+Reported-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+index f83a8c62ea531..d595034f3f1bf 100644
+--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+@@ -17,12 +17,8 @@
+ 
+ 	memory@70000000 {
+ 		device_type = "memory";
+-		reg = <0x70000000 0x20000000>;
+-	};
+-
+-	memory@b0000000 {
+-		device_type = "memory";
+-		reg = <0xb0000000 0x20000000>;
++		reg = <0x70000000 0x20000000>,
++		      <0xb0000000 0x20000000>;
+ 	};
+ 
+ 	regulators {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch b/queue-4.19/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch
new file mode 100644
index 00000000000..4f7e31c0f5f
--- /dev/null
+++ b/queue-4.19/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch
@@ -0,0 +1,99 @@
+From f515219215829e6b754ec1c89991aed11b4bfbe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:43:43 -0300
+Subject: ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 7e5d0bf6afcc7bd72f78e7f33570e2e0945624f0 ]
+
+Since commit a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
+a storm of accelerometer interrupts is seen:
+
+[  114.211283] irq 260: nobody cared (try booting with the "irqpoll" option)
+[  114.218108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.4 #1
+[  114.223960] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+[  114.230531] [<c0112858>] (unwind_backtrace) from [<c010cdc8>] (show_stack+0x10/0x14)
+[  114.238301] [<c010cdc8>] (show_stack) from [<c0c1aa1c>] (dump_stack+0xd8/0x110)
+[  114.245644] [<c0c1aa1c>] (dump_stack) from [<c0193594>] (__report_bad_irq+0x30/0xc0)
+[  114.253417] [<c0193594>] (__report_bad_irq) from [<c01933ac>] (note_interrupt+0x108/0x298)
+[  114.261707] [<c01933ac>] (note_interrupt) from [<c018ffe4>] (handle_irq_event_percpu+0x70/0x80)
+[  114.270433] [<c018ffe4>] (handle_irq_event_percpu) from [<c019002c>] (handle_irq_event+0x38/0x5c)
+[  114.279326] [<c019002c>] (handle_irq_event) from [<c019438c>] (handle_level_irq+0xc8/0x154)
+[  114.287701] [<c019438c>] (handle_level_irq) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
+[  114.296166] [<c018eda0>] (generic_handle_irq) from [<c0534214>] (mxc_gpio_irq_handler+0x30/0xf0)
+[  114.304975] [<c0534214>] (mxc_gpio_irq_handler) from [<c0534334>] (mx3_gpio_irq_handler+0x60/0xb0)
+[  114.313955] [<c0534334>] (mx3_gpio_irq_handler) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
+[  114.322762] [<c018eda0>] (generic_handle_irq) from [<c018f3ac>] (__handle_domain_irq+0x64/0xe0)
+[  114.331485] [<c018f3ac>] (__handle_domain_irq) from [<c05215a8>] (gic_handle_irq+0x4c/0xa8)
+[  114.339862] [<c05215a8>] (gic_handle_irq) from [<c0101a70>] (__irq_svc+0x70/0x98)
+[  114.347361] Exception stack(0xc1301ec0 to 0xc1301f08)
+[  114.352435] 1ec0: 00000001 00000006 00000000 c130c340 00000001 c130f688 9785636d c13ea2e8
+[  114.360635] 1ee0: 9784907d 0000001a eaf99d78 0000001a 00000000 c1301f10 c0182b00 c0878de4
+[  114.368830] 1f00: 20000013 ffffffff
+[  114.372349] [<c0101a70>] (__irq_svc) from [<c0878de4>] (cpuidle_enter_state+0x168/0x5f4)
+[  114.380464] [<c0878de4>] (cpuidle_enter_state) from [<c08792ac>] (cpuidle_enter+0x28/0x38)
+[  114.388751] [<c08792ac>] (cpuidle_enter) from [<c015ef9c>] (do_idle+0x224/0x2a8)
+[  114.396168] [<c015ef9c>] (do_idle) from [<c015f3b8>] (cpu_startup_entry+0x18/0x20)
+[  114.403765] [<c015f3b8>] (cpu_startup_entry) from [<c1200e54>] (start_kernel+0x43c/0x500)
+[  114.411958] handlers:
+[  114.414302] [<a01028b8>] irq_default_primary_handler threaded [<fd7a3b08>] mma8452_interrupt
+[  114.422974] Disabling IRQ #260
+
+           CPU0       CPU1
+....
+260:     100001          0  gpio-mxc  31 Level     mma8451
+
+The MMA8451 interrupt triggers as low level, so the GPIO6_IO31 pin
+needs to activate its pull up, otherwise it will stay always at low level
+generating multiple interrupts.
+
+The current device tree does not configure the IOMUX for this pin, so
+it uses whathever comes configured from the bootloader.
+
+The IOMUXC_SW_PAD_CTL_PAD_EIM_BCLK register value comes as 0x8000 from
+the bootloader, which has PKE bit cleared, hence disabling the
+pull-up.
+
+Instead of relying on a previous configuration from the bootloader,
+configure the GPIO6_IO31 pin with pull-up enabled in order to fix
+this problem.
+
+Fixes: a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-By: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+index 9f11f1fcc3e6c..9d086a3b5ffc0 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+@@ -177,6 +177,8 @@
+ 			accelerometer@1c {
+ 				compatible = "fsl,mma8451";
+ 				reg = <0x1c>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pinctrl_mma8451_int>;
+ 				interrupt-parent = <&gpio6>;
+ 				interrupts = <31 IRQ_TYPE_LEVEL_LOW>;
+ 			};
+@@ -522,6 +524,12 @@
+ 			>;
+ 		};
+ 
++		pinctrl_mma8451_int: mma8451intgrp {
++			fsl,pins = <
++				MX6QDL_PAD_EIM_BCLK__GPIO6_IO31		0xb0b1
++			>;
++		};
++
+ 		pinctrl_pwm3: pwm1grp {
+ 			fsl,pins = <
+ 				MX6QDL_PAD_SD4_DAT1__PWM3_OUT		0x1b0b1
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx6sl-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx6sl-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..cb6db2480b5
--- /dev/null
+++ b/queue-4.19/arm-dts-imx6sl-fix-memory-node-duplication.patch
@@ -0,0 +1,83 @@
+From bf2e42703abe79ee16399247a1c024d97a8e6db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 13:59:45 -0200
+Subject: ARM: dts: imx6sl: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 7fa8ab65ee15e386558ac5e971004712da91e2dd ]
+
+Boards based on imx6sl have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx6sl.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sl-evk.dts  | 1 +
+ arch/arm/boot/dts/imx6sl-warp.dts | 1 +
+ arch/arm/boot/dts/imx6sl.dtsi     | 2 --
+ arch/arm/boot/dts/imx6sll-evk.dts | 1 +
+ 4 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
+index 679b4482ab13a..f7a48e4622e1b 100644
+--- a/arch/arm/boot/dts/imx6sl-evk.dts
++++ b/arch/arm/boot/dts/imx6sl-evk.dts
+@@ -17,6 +17,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6sl-warp.dts b/arch/arm/boot/dts/imx6sl-warp.dts
+index 404e602e67813..408da704c459b 100644
+--- a/arch/arm/boot/dts/imx6sl-warp.dts
++++ b/arch/arm/boot/dts/imx6sl-warp.dts
+@@ -55,6 +55,7 @@
+ 	compatible = "warp,imx6sl-warp", "fsl,imx6sl";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index 2fa88c6f18820..55d1872aa81a8 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -13,10 +13,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
+index c8e115564ba2c..0c2406ac8a638 100644
+--- a/arch/arm/boot/dts/imx6sll-evk.dts
++++ b/arch/arm/boot/dts/imx6sll-evk.dts
+@@ -20,6 +20,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x80000000>;
+ 	};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx6sx-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx6sx-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..1f4fe27fc41
--- /dev/null
+++ b/queue-4.19/arm-dts-imx6sx-fix-memory-node-duplication.patch
@@ -0,0 +1,135 @@
+From 21a86b306ddcd922862ef66265bc97ba87fb03e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 13:59:44 -0200
+Subject: ARM: dts: imx6sx: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 216f35fedd8688c8b654ebfbad18c6e64713fad7 ]
+
+Boards based on imx6sx have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx6sx.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sx-nitrogen6sx.dts         | 1 +
+ arch/arm/boot/dts/imx6sx-sabreauto.dts           | 1 +
+ arch/arm/boot/dts/imx6sx-sdb.dtsi                | 1 +
+ arch/arm/boot/dts/imx6sx-softing-vining-2000.dts | 1 +
+ arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts      | 1 +
+ arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts   | 1 +
+ arch/arm/boot/dts/imx6sx-udoo-neo-full.dts       | 1 +
+ arch/arm/boot/dts/imx6sx.dtsi                    | 2 --
+ 8 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts b/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
+index adb5cc7d8ce2f..832b5c5d7441a 100644
+--- a/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
++++ b/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
+@@ -12,6 +12,7 @@
+ 	compatible = "boundary,imx6sx-nitrogen6sx", "fsl,imx6sx";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+index 841a27f3198ff..48aede543612b 100644
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -11,6 +11,7 @@
+ 	compatible = "fsl,imx6sx-sabreauto", "fsl,imx6sx";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x80000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+index d6d517e4922ff..91f809ed1370a 100644
+--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
++++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+@@ -21,6 +21,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts b/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
+index 252175b592475..2bc51623a8060 100644
+--- a/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
++++ b/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
+@@ -21,6 +21,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
+index 40ccdf43dffc5..db0feb9b9f5d7 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
+@@ -49,6 +49,7 @@
+ 	compatible = "udoo,neobasic", "fsl,imx6sx";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
+index 42bfc8f8f7f6b..5c7a2bb9141cb 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
+@@ -49,6 +49,7 @@
+ 	compatible = "udoo,neoextended", "fsl,imx6sx";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
+index c84c877f09d49..13dfe2afaba56 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
+@@ -49,6 +49,7 @@
+ 	compatible = "udoo,neofull", "fsl,imx6sx";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index 7b62e6fb47ebe..ae0728df542e9 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -15,10 +15,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		can0 = &flexcan1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx6ul-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx6ul-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..4733f6da0c0
--- /dev/null
+++ b/queue-4.19/arm-dts-imx6ul-fix-memory-node-duplication.patch
@@ -0,0 +1,161 @@
+From 1ce7076854be34f1e1b59165fd07c5288074b8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 13:59:43 -0200
+Subject: ARM: dts: imx6ul: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 750d8df6e7b269b828f66631a1d39ea027afc92a ]
+
+Boards based on imx6ul have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx6ul.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6ul-14x14-evk.dtsi        | 1 +
+ arch/arm/boot/dts/imx6ul-geam.dts              | 1 +
+ arch/arm/boot/dts/imx6ul-isiot.dtsi            | 1 +
+ arch/arm/boot/dts/imx6ul-litesom.dtsi          | 1 +
+ arch/arm/boot/dts/imx6ul-opos6ul.dtsi          | 1 +
+ arch/arm/boot/dts/imx6ul-pico-hobbit.dts       | 1 +
+ arch/arm/boot/dts/imx6ul-tx6ul.dtsi            | 1 +
+ arch/arm/boot/dts/imx6ul.dtsi                  | 2 --
+ arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi | 1 +
+ arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi    | 1 +
+ 10 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+index 32a07232c0345..8180211265592 100644
+--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+@@ -12,6 +12,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6ul-geam.dts b/arch/arm/boot/dts/imx6ul-geam.dts
+index d81d20f8fc8dd..85cfad080f15c 100644
+--- a/arch/arm/boot/dts/imx6ul-geam.dts
++++ b/arch/arm/boot/dts/imx6ul-geam.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "engicam,imx6ul-geam", "fsl,imx6ul";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x08000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6ul-isiot.dtsi b/arch/arm/boot/dts/imx6ul-isiot.dtsi
+index cd99285511544..1cb52744f58ad 100644
+--- a/arch/arm/boot/dts/imx6ul-isiot.dtsi
++++ b/arch/arm/boot/dts/imx6ul-isiot.dtsi
+@@ -46,6 +46,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6ul-litesom.dtsi b/arch/arm/boot/dts/imx6ul-litesom.dtsi
+index 8f775f6974d1c..8d6893210842b 100644
+--- a/arch/arm/boot/dts/imx6ul-litesom.dtsi
++++ b/arch/arm/boot/dts/imx6ul-litesom.dtsi
+@@ -48,6 +48,7 @@
+ 	compatible = "grinn,imx6ul-litesom", "fsl,imx6ul";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx6ul-opos6ul.dtsi b/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
+index a031bee311df4..cf7faf4b9c47e 100644
+--- a/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
+@@ -49,6 +49,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0>; /* will be filled by U-Boot */
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
+index 0c09420f99512..797262d2f27fd 100644
+--- a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
++++ b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
+@@ -53,6 +53,7 @@
+ 
+ 	/* Will be filled by the bootloader */
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+index 02b5ba42cd591..bb6dbfd5546b4 100644
+--- a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+@@ -71,6 +71,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0>; /* will be filled by U-Boot */
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 336cdead3da54..50834a43e5fb2 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -15,10 +15,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		ethernet0 = &fec1;
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
+index 10ab4697950f5..fb213bec46543 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
+@@ -7,6 +7,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x10000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+index 183193e8580dd..038d8c90f6dfe 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+@@ -7,6 +7,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-imx7-fix-memory-node-duplication.patch b/queue-4.19/arm-dts-imx7-fix-memory-node-duplication.patch
new file mode 100644
index 00000000000..a6d0af4f0ce
--- /dev/null
+++ b/queue-4.19/arm-dts-imx7-fix-memory-node-duplication.patch
@@ -0,0 +1,155 @@
+From e5dd25c1c2628393a14cbaa888efc1fa3f09c103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:40:47 -0200
+Subject: ARM: dts: imx7: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 29988e867cb17de7119e971f9acfad2c3fccdb47 ]
+
+Boards based on imx7 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx7s.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-cl-som-imx7.dts   | 3 ++-
+ arch/arm/boot/dts/imx7d-colibri-emmc.dtsi | 1 +
+ arch/arm/boot/dts/imx7d-colibri.dtsi      | 1 +
+ arch/arm/boot/dts/imx7d-nitrogen7.dts     | 1 +
+ arch/arm/boot/dts/imx7d-pico.dtsi         | 1 +
+ arch/arm/boot/dts/imx7d-sdb.dts           | 1 +
+ arch/arm/boot/dts/imx7s-colibri.dtsi      | 1 +
+ arch/arm/boot/dts/imx7s-warp.dts          | 1 +
+ arch/arm/boot/dts/imx7s.dtsi              | 2 --
+ 9 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+index 584418f517a88..62d5e9a4a7818 100644
+--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+@@ -19,6 +19,7 @@
+ 	compatible = "compulab,cl-som-imx7", "fsl,imx7d";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x10000000>; /* 256 MB - minimal configuration */
+ 	};
+ 
+@@ -284,4 +285,4 @@
+ 			MX7D_PAD_LPSR_GPIO1_IO05__GPIO1_IO5	0x14 /* OTG PWREN */
+ 		>;
+ 	};
+-};
+\ No newline at end of file
++};
+diff --git a/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi b/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
+index 04d24ee17b142..898f4b8d7421f 100644
+--- a/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
++++ b/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
+@@ -8,6 +8,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx7d-colibri.dtsi b/arch/arm/boot/dts/imx7d-colibri.dtsi
+index d9f8fb69511b6..e2e327f437e35 100644
+--- a/arch/arm/boot/dts/imx7d-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7d-colibri.dtsi
+@@ -45,6 +45,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index 177d21fdeb288..6b4acea1ef795 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -12,6 +12,7 @@
+ 	compatible = "boundary,imx7d-nitrogen7", "fsl,imx7d";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x40000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx7d-pico.dtsi b/arch/arm/boot/dts/imx7d-pico.dtsi
+index f27b3849d3ff3..934a019f341e4 100644
+--- a/arch/arm/boot/dts/imx7d-pico.dtsi
++++ b/arch/arm/boot/dts/imx7d-pico.dtsi
+@@ -49,6 +49,7 @@
+ 	compatible = "technexion,imx7d-pico", "fsl,imx7d";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x80000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
+index c9b3c60b0eb22..317f1bcc56e2a 100644
+--- a/arch/arm/boot/dts/imx7d-sdb.dts
++++ b/arch/arm/boot/dts/imx7d-sdb.dts
+@@ -15,6 +15,7 @@
+ 	};
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x80000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx7s-colibri.dtsi b/arch/arm/boot/dts/imx7s-colibri.dtsi
+index fe8344cee8641..1fb1ec5d3d707 100644
+--- a/arch/arm/boot/dts/imx7s-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7s-colibri.dtsi
+@@ -45,6 +45,7 @@
+ 
+ / {
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x10000000>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/imx7s-warp.dts b/arch/arm/boot/dts/imx7s-warp.dts
+index fa390da636de7..97d5c711eb0ca 100644
+--- a/arch/arm/boot/dts/imx7s-warp.dts
++++ b/arch/arm/boot/dts/imx7s-warp.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "warp,imx7s-warp", "fsl,imx7s";
+ 
+ 	memory@80000000 {
++		device_type = "memory";
+ 		reg = <0x80000000 0x20000000>;
+ 	};
+ 
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 90f5bdfa9b3ce..7eaf96b425bed 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -17,10 +17,8 @@
+ 	 * The decompressor and also some bootloaders rely on a
+ 	 * pre-existing /chosen node to be available to insert the
+ 	 * command line and merge other ATAGS info.
+-	 * Also for U-Boot there must be a pre-existing /memory node.
+ 	 */
+ 	chosen {};
+-	memory { device_type = "memory"; };
+ 
+ 	aliases {
+ 		gpio0 = &gpio1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch b/queue-4.19/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch
new file mode 100644
index 00000000000..13c3425ae0e
--- /dev/null
+++ b/queue-4.19/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch
@@ -0,0 +1,44 @@
+From f7d6702f0a96756003869fca67c767418079739a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 22:58:58 +0100
+Subject: ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit e614f341253f8541baf0230a8dc6a016b544b1e2 ]
+
+Without enabling keep-power-in-suspend, we can't wake the device
+up using WOL packet, and the log is flooded with these messages
+on resume:
+
+sunxi-mmc 1c10000.mmc: send stop command failed
+sunxi-mmc 1c10000.mmc: data error, sending stop command
+sunxi-mmc 1c10000.mmc: send stop command failed
+sunxi-mmc 1c10000.mmc: data error, sending stop command
+
+So to make the WiFi really a wakeup-source, we need to keep it powered
+during suspend.
+
+Fixes: 0e23372080def7 ("arm: dts: sun8i: Add the TBS A711 tablet devicetree")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+index 1537ce148cc19..49547a43cc90a 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+@@ -171,6 +171,7 @@
+ 	vqmmc-supply = <&reg_dldo1>;
+ 	non-removable;
+ 	wakeup-source;
++	keep-power-in-suspend;
+ 	status = "okay";
+ 
+ 	brcmf: wifi@1 {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-ks8695-fix-section-mismatch-warning.patch b/queue-4.19/arm-ks8695-fix-section-mismatch-warning.patch
new file mode 100644
index 00000000000..d446ca8e219
--- /dev/null
+++ b/queue-4.19/arm-ks8695-fix-section-mismatch-warning.patch
@@ -0,0 +1,38 @@
+From 8139547b03607c008712aad5960054b044a462a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 22:58:38 +0100
+Subject: ARM: ks8695: fix section mismatch warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4aa64677330beeeed721b4b122884dabad845d66 ]
+
+WARNING: vmlinux.o(.text+0x13250): Section mismatch in reference from the function acs5k_i2c_init() to the (unknown reference) .init.data:(unknown)
+The function acs5k_i2c_init() references
+the (unknown reference) __initdata (unknown).
+This is often because acs5k_i2c_init lacks a __initdata
+annotation or the annotation of (unknown) is wrong.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ks8695/board-acs5k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c
+index ef835d82cdb95..5783062224c39 100644
+--- a/arch/arm/mach-ks8695/board-acs5k.c
++++ b/arch/arm/mach-ks8695/board-acs5k.c
+@@ -100,7 +100,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = {
+ 	},
+ };
+ 
+-static void acs5k_i2c_init(void)
++static void __init acs5k_i2c_init(void)
+ {
+ 	/* The gpio interface */
+ 	gpiod_add_lookup_table(&acs5k_i2c_gpiod_table);
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-omap1-fix-usb-configuration-for-device-only-setu.patch b/queue-4.19/arm-omap1-fix-usb-configuration-for-device-only-setu.patch
new file mode 100644
index 00000000000..9a29335ef57
--- /dev/null
+++ b/queue-4.19/arm-omap1-fix-usb-configuration-for-device-only-setu.patch
@@ -0,0 +1,51 @@
+From 68dd0da42cdb375bdbb017175f6632a7094aeec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 19:57:42 +0200
+Subject: ARM: OMAP1: fix USB configuration for device-only setups
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit c7b7b5cbd0c859b1546a5a3455d457708bdadf4c ]
+
+Currently we do USB configuration only if the host mode (CONFIG_USB)
+is enabled. But it should be done also in the case of device-only setups,
+so change the condition to CONFIG_USB_SUPPORT. This allows to use
+omap_udc on Palm Tungsten E.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/Makefile           | 2 +-
+ arch/arm/mach-omap1/include/mach/usb.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
+index e8ccf51c6f292..ec0235899de20 100644
+--- a/arch/arm/mach-omap1/Makefile
++++ b/arch/arm/mach-omap1/Makefile
+@@ -25,7 +25,7 @@ obj-y					+= $(i2c-omap-m) $(i2c-omap-y)
+ 
+ led-y := leds.o
+ 
+-usb-fs-$(CONFIG_USB)			:= usb.o
++usb-fs-$(CONFIG_USB_SUPPORT)		:= usb.o
+ obj-y					+= $(usb-fs-m) $(usb-fs-y)
+ 
+ # Specific board support
+diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h
+index 77867778d4ec7..5429d86c7190d 100644
+--- a/arch/arm/mach-omap1/include/mach/usb.h
++++ b/arch/arm/mach-omap1/include/mach/usb.h
+@@ -11,7 +11,7 @@
+ 
+ #include <linux/platform_data/usb-omap1.h>
+ 
+-#if IS_ENABLED(CONFIG_USB)
++#if IS_ENABLED(CONFIG_USB_SUPPORT)
+ void omap1_usb_init(struct omap_usb_config *pdata);
+ #else
+ static inline void omap1_usb_init(struct omap_usb_config *pdata)
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-marvell-armada-37xx-enable-emmc-on-espress.patch b/queue-4.19/arm64-dts-marvell-armada-37xx-enable-emmc-on-espress.patch
new file mode 100644
index 00000000000..c50b874cd17
--- /dev/null
+++ b/queue-4.19/arm64-dts-marvell-armada-37xx-enable-emmc-on-espress.patch
@@ -0,0 +1,59 @@
+From 8c77bafa4bd80898f2892d83037dbe382528df36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 11:50:28 +0000
+Subject: arm64: dts: marvell: armada-37xx: Enable emmc on espressobin
+
+From: Ding Tao <miyatsu@qq.com>
+
+[ Upstream commit 43ebc7c1b3ed8198b9acf3019eca16e722f7331c ]
+
+The ESPRESSObin board has a emmc interface available on U11: declare it
+and let the bootloader enable it if the emmc is present.
+
+[gregory.clement@bootlin.com: disable the emmc by default]
+Signed-off-by: Ding Tao <miyatsu@qq.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/marvell/armada-3720-espressobin.dts   | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+index 3ab25ad402b90..846003bb480cd 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -60,9 +60,31 @@
+ 	cd-gpios = <&gpionb 3 GPIO_ACTIVE_LOW>;
+ 	marvell,pad-type = "sd";
+ 	vqmmc-supply = <&vcc_sd_reg1>;
++
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdio_pins>;
+ 	status = "okay";
+ };
+ 
++/* U11 */
++&sdhci0 {
++	non-removable;
++	bus-width = <8>;
++	mmc-ddr-1_8v;
++	mmc-hs400-1_8v;
++	marvell,xenon-emmc;
++	marvell,xenon-tun-count = <9>;
++	marvell,pad-type = "fixed-1-8v";
++
++	pinctrl-names = "default";
++	pinctrl-0 = <&mmc_pins>;
++/*
++ * This eMMC is not populated on all boards, so disable it by
++ * default and let the bootloader enable it, if it is present
++ */
++	status = "disabled";
++};
++
+ &spi0 {
+ 	status = "okay";
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-renesas-draak-fix-cvbs-input.patch b/queue-4.19/arm64-dts-renesas-draak-fix-cvbs-input.patch
new file mode 100644
index 00000000000..0318929877c
--- /dev/null
+++ b/queue-4.19/arm64-dts-renesas-draak-fix-cvbs-input.patch
@@ -0,0 +1,37 @@
+From 6f7f9d0fb57dd9cd52bc95336d6366fcf12a15a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:43:55 +0200
+Subject: arm64: dts: renesas: draak: Fix CVBS input
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 6f61a2c8f1f6163c7e08c77c5f71df0427e4d2f6 ]
+
+A typo in the adv7180 DT node prevents successful probing of the VIN.
+Fix it.
+
+Fixes: 6a0942c20f5c ("arm64: dts: renesas: draak: Describe CVBS input")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Acked-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+index a8e8f2669d4c5..1b8f19ee257f0 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+@@ -188,7 +188,7 @@
+ 		compatible = "adi,adv7180cp";
+ 		reg = <0x20>;
+ 
+-		port {
++		ports {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-mm-prevent-mismatched-52-bit-va-support.patch b/queue-4.19/arm64-mm-prevent-mismatched-52-bit-va-support.patch
new file mode 100644
index 00000000000..7dbe1eba540
--- /dev/null
+++ b/queue-4.19/arm64-mm-prevent-mismatched-52-bit-va-support.patch
@@ -0,0 +1,101 @@
+From a6c90edc170b9762f20812ce7b977b42b55d8586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 22:50:40 +0000
+Subject: arm64: mm: Prevent mismatched 52-bit VA support
+
+From: Steve Capper <steve.capper@arm.com>
+
+[ Upstream commit a96a33b1ca57dbea4285893dedf290aeb8eb090b ]
+
+For cases where there is a mismatch in ARMv8.2-LVA support between CPUs
+we have to be careful in allowing secondary CPUs to boot if 52-bit
+virtual addresses have already been enabled on the boot CPU.
+
+This patch adds code to the secondary startup path. If the boot CPU has
+enabled 52-bit VAs then ID_AA64MMFR2_EL1 is checked to see if the
+secondary can also enable 52-bit support. If not, the secondary is
+prevented from booting and an error message is displayed indicating why.
+
+Technically this patch could be implemented using the cpufeature code
+when considering 52-bit userspace support. However, we employ low level
+checks here as the cpufeature code won't be able to run if we have
+mismatched 52-bit kernel va support.
+
+Signed-off-by: Steve Capper <steve.capper@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 26 ++++++++++++++++++++++++++
+ arch/arm64/kernel/smp.c  |  5 +++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 77ca59598c8b1..06058fba5f86c 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -703,6 +703,7 @@ secondary_startup:
+ 	/*
+ 	 * Common entry point for secondary CPUs.
+ 	 */
++	bl	__cpu_secondary_check52bitva
+ 	bl	__cpu_setup			// initialise processor
+ 	bl	__enable_mmu
+ 	ldr	x8, =__secondary_switched
+@@ -779,6 +780,31 @@ ENTRY(__enable_mmu)
+ 	ret
+ ENDPROC(__enable_mmu)
+ 
++ENTRY(__cpu_secondary_check52bitva)
++#ifdef CONFIG_ARM64_52BIT_VA
++	ldr_l	x0, vabits_user
++	cmp	x0, #52
++	b.ne	2f
++
++	mrs_s	x0, SYS_ID_AA64MMFR2_EL1
++	and	x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT)
++	cbnz	x0, 2f
++
++	adr_l	x0, va52mismatch
++	mov	w1, #1
++	strb	w1, [x0]
++	dmb	sy
++	dc	ivac, x0	// Invalidate potentially stale cache line
++
++	update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1
++1:	wfe
++	wfi
++	b	1b
++
++#endif
++2:	ret
++ENDPROC(__cpu_secondary_check52bitva)
++
+ __no_granule_support:
+ 	/* Indicate that this CPU can't boot and is stuck in the kernel */
+ 	update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 25fcd22a4bb24..2c31d65bc541b 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -108,6 +108,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle)
+ }
+ 
+ static DECLARE_COMPLETION(cpu_running);
++bool va52mismatch __ro_after_init;
+ 
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+@@ -137,6 +138,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ 
+ 		if (!cpu_online(cpu)) {
+ 			pr_crit("CPU%u: failed to come online\n", cpu);
++
++			if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch)
++				pr_crit("CPU%u: does not support 52-bit VAs\n", cpu);
++
+ 			ret = -EIO;
+ 		}
+ 	} else {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-preempt-fix-big-endian-when-checking-preempt-c.patch b/queue-4.19/arm64-preempt-fix-big-endian-when-checking-preempt-c.patch
new file mode 100644
index 00000000000..b4dfaf9f9c3
--- /dev/null
+++ b/queue-4.19/arm64-preempt-fix-big-endian-when-checking-preempt-c.patch
@@ -0,0 +1,74 @@
+From 1250475e9cdc3ede9d71b4d6d175c8e77605e5c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:41:32 +0000
+Subject: arm64: preempt: Fix big-endian when checking preempt count in
+ assembly
+
+From: Will Deacon <will.deacon@arm.com>
+
+[ Upstream commit 7faa313f05cad184e8b17750f0cbe5216ac6debb ]
+
+Commit 396244692232 ("arm64: preempt: Provide our own implementation of
+asm/preempt.h") extended the preempt count field in struct thread_info
+to 64 bits, so that it consists of a 32-bit count plus a 32-bit flag
+indicating whether or not the current task needs rescheduling.
+
+Whilst the asm-offsets definition of TSK_TI_PREEMPT was updated to point
+to this new field, the assembly usage was left untouched meaning that a
+32-bit load from TSK_TI_PREEMPT on a big-endian machine actually returns
+the reschedule flag instead of the count.
+
+Whilst we could fix this by pointing TSK_TI_PREEMPT at the count field,
+we're actually better off reworking the two assembly users so that they
+operate on the whole 64-bit value in favour of inspecting the thread
+flags separately in order to determine whether a reschedule is needed.
+
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/assembler.h | 8 +++-----
+ arch/arm64/kernel/entry.S          | 6 ++----
+ 2 files changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index 5a97ac8531682..0c100506a29aa 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -683,11 +683,9 @@ USER(\label, ic	ivau, \tmp2)			// invalidate I line PoU
+ 	.macro		if_will_cond_yield_neon
+ #ifdef CONFIG_PREEMPT
+ 	get_thread_info	x0
+-	ldr		w1, [x0, #TSK_TI_PREEMPT]
+-	ldr		x0, [x0, #TSK_TI_FLAGS]
+-	cmp		w1, #PREEMPT_DISABLE_OFFSET
+-	csel		x0, x0, xzr, eq
+-	tbnz		x0, #TIF_NEED_RESCHED, .Lyield_\@	// needs rescheduling?
++	ldr		x0, [x0, #TSK_TI_PREEMPT]
++	sub		x0, x0, #PREEMPT_DISABLE_OFFSET
++	cbz		x0, .Lyield_\@
+ 	/* fall through to endif_yield_neon */
+ 	.subsection	1
+ .Lyield_\@ :
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 5f800384cb9a8..bb68323530458 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -622,10 +622,8 @@ el1_irq:
+ 	irq_handler
+ 
+ #ifdef CONFIG_PREEMPT
+-	ldr	w24, [tsk, #TSK_TI_PREEMPT]	// get preempt count
+-	cbnz	w24, 1f				// preempt count != 0
+-	ldr	x0, [tsk, #TSK_TI_FLAGS]	// get flags
+-	tbz	x0, #TIF_NEED_RESCHED, 1f	// needs rescheduling?
++	ldr	x24, [tsk, #TSK_TI_PREEMPT]	// get preempt count
++	cbnz	x24, 1f				// preempt count != 0
+ 	bl	el1_preempt
+ 1:
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-smp-handle-errors-reported-by-the-firmware.patch b/queue-4.19/arm64-smp-handle-errors-reported-by-the-firmware.patch
new file mode 100644
index 00000000000..65819d79e9a
--- /dev/null
+++ b/queue-4.19/arm64-smp-handle-errors-reported-by-the-firmware.patch
@@ -0,0 +1,39 @@
+From 7566a3f2350d7e4c72d4dbf7f527affa4da383d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 18:07:33 +0000
+Subject: arm64: smp: Handle errors reported by the firmware
+
+From: Suzuki K Poulose <Suzuki.Poulose@arm.com>
+
+[ Upstream commit f357b3a7e17af7736d67d8267edc1ed3d1dd9391 ]
+
+The __cpu_up() routine ignores the errors reported by the firmware
+for a CPU bringup operation and looks for the error status set by the
+booting CPU. If the CPU never entered the kernel, we could end up
+in assuming stale error status, which otherwise would have been
+set/cleared appropriately by the booting CPU.
+
+Reported-by: Steve Capper <steve.capper@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 2c31d65bc541b..52aa51f6310b0 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -146,6 +146,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ 		}
+ 	} else {
+ 		pr_err("CPU%u: failed to boot: %d\n", cpu, ret);
++		return ret;
+ 	}
+ 
+ 	secondary_data.task = NULL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-compress-fix-unsigned-integer-overflow-check.patch b/queue-4.19/asoc-compress-fix-unsigned-integer-overflow-check.patch
new file mode 100644
index 00000000000..163b5010a54
--- /dev/null
+++ b/queue-4.19/asoc-compress-fix-unsigned-integer-overflow-check.patch
@@ -0,0 +1,38 @@
+From 208c44a812f751f81d252c6120db2db567750e26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:54:32 +0100
+Subject: ASoC: compress: fix unsigned integer overflow check
+
+From: Xiaojun Sang <xsang@codeaurora.org>
+
+[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]
+
+Parameter fragments and fragment_size are type of u32. U32_MAX is
+the correct check.
+
+Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 516ec35873256..509038d6bccdb 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ 	/* first let's check the buffer parameter's */
+ 	if (params->buffer.fragment_size == 0 ||
+-	    params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++	    params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ 	    params->buffer.fragments == 0)
+ 		return -EINVAL;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-kirkwood-fix-device-remove-ordering.patch b/queue-4.19/asoc-kirkwood-fix-device-remove-ordering.patch
new file mode 100644
index 00000000000..ef78afc43ad
--- /dev/null
+++ b/queue-4.19/asoc-kirkwood-fix-device-remove-ordering.patch
@@ -0,0 +1,61 @@
+From 0a0fd64db891a41ed3ed9f3c8ad1af2faf8a7e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:49 +0100
+Subject: ASoC: kirkwood: fix device remove ordering
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit dc39596a906d5b604f4e64597b6e904fc14625e8 ]
+
+The devm conversion of kirkwood was incorrect; on removal, devm takes
+effect after the "remove" function has returned.  So, the effect of
+the conversion was to change the order during remove from:
+
+  - snd_soc_unregister_component() (unpublishes interfaces)
+  - clk_disable_unprepare()
+  - cleanup resources
+
+After the conversion, this became:
+
+  - clk_disable_unprepare() - while the device may still be active
+  - snd_soc_unregister_component()
+  - cleanup resources
+
+Hence, it introduces a bug, where the internal clock for the device
+may be shut down before the device itself has been shut down.  It is
+known that Marvell SoCs, including Dove, locks up if registers for a
+peripheral that has its clocks disabled are accessed.
+
+Fixes: f98fc0f8154e ("ASoC: kirkwood: replace platform to component")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyP-0004oN-BA@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index b84a504168473..4395bb7029a06 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -595,7 +595,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ 		priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128;
+ 	}
+ 
+-	err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
++	err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
+ 					 soc_dai, 2);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "snd_soc_register_component failed\n");
+@@ -618,6 +618,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev)
+ {
+ 	struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev);
+ 
++	snd_soc_unregister_component(&pdev->dev);
+ 	if (!IS_ERR(priv->extclk))
+ 		clk_disable_unprepare(priv->extclk);
+ 	clk_disable_unprepare(priv->clk);
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-kirkwood-fix-external-clock-probe-defer.patch b/queue-4.19/asoc-kirkwood-fix-external-clock-probe-defer.patch
new file mode 100644
index 00000000000..2c3b5a694f3
--- /dev/null
+++ b/queue-4.19/asoc-kirkwood-fix-external-clock-probe-defer.patch
@@ -0,0 +1,51 @@
+From d8942f83579d542768f2f562162d7be725e7c14d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:44 +0100
+Subject: ASoC: kirkwood: fix external clock probe defer
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]
+
+When our call to get the external clock fails, we forget to clean up
+the enabled internal clock correctly.  Enable the clock after we have
+obtained all our resources.
+
+Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 9a2777b72dcd0..b84a504168473 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -563,10 +563,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ 		return PTR_ERR(priv->clk);
+ 	}
+ 
+-	err = clk_prepare_enable(priv->clk);
+-	if (err < 0)
+-		return err;
+-
+ 	priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ 	if (IS_ERR(priv->extclk)) {
+ 		if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -582,6 +578,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ 		}
+ 	}
+ 
++	err = clk_prepare_enable(priv->clk);
++	if (err < 0)
++		return err;
++
+ 	/* Some sensible defaults - this reflects the powerup values */
+ 	priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ 	priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch b/queue-4.19/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
new file mode 100644
index 00000000000..e88c535f9f3
--- /dev/null
+++ b/queue-4.19/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
@@ -0,0 +1,56 @@
+From 96bf75984d86f0d27655982f17a48d25ccd1eb44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Oct 2019 17:30:06 +0200
+Subject: ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ]
+
+According to the PM8916 Hardware Register Description,
+CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL)
+to switch between RX1 (0) and RX2 (1). It is not possible to
+disable it entirely to achieve the "ZERO" state.
+
+However, at the moment the "RDAC2 MUX" mixer defines three possible
+values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO"
+actually configures it to RX1. Setting the mixer to "RX1" has
+(seemingly) no effect.
+
+Remove "ZERO" and replace it with "RX1" to fix this.
+
+Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index b7cf7cce95fec..4f0497ab1aa80 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv {
+ };
+ 
+ static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
+-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
++static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
+ static const char *const hph_text[] = { "ZERO", "Switch", };
+ 
+ static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
+@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
+ 
+ /* RDAC2 MUX */
+ static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
+-			CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
++			CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
+ 
+ static const struct snd_kcontrol_new spkr_switch[] = {
+ 	SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-rt5645-headphone-jack-sense-inverts-on-the-latt.patch b/queue-4.19/asoc-rt5645-headphone-jack-sense-inverts-on-the-latt.patch
new file mode 100644
index 00000000000..50d6f3fd0cf
--- /dev/null
+++ b/queue-4.19/asoc-rt5645-headphone-jack-sense-inverts-on-the-latt.patch
@@ -0,0 +1,60 @@
+From a1894bca56d97a10c18b6cdbe95395e665407050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:44:07 +0800
+Subject: ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 406dcbc55a0a20fd155be889a4a0c4b812f7c18e ]
+
+The LattePanda board has a sound card chtrt5645, when there is nothing
+plugged in the headphone jack, the system thinks the headphone is
+plugged in, while we plug a headphone in the jack, the system thinks
+the headphone is unplugged.
+
+If adding quirk=0x21 in the module parameter, the headphone jack can
+work well. So let us fix it via platform_data.
+
+https://bugs.launchpad.net/bugs/182459
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5645.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 1dc70f452c1b9..f842db498c741 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3662,6 +3662,11 @@ static const struct rt5645_platform_data jd_mode3_platform_data = {
+ 	.jd_mode = 3,
+ };
+ 
++static const struct rt5645_platform_data lattepanda_board_platform_data = {
++	.jd_mode = 2,
++	.inv_jd1_1 = true
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ 	{
+ 		.ident = "Chrome Buddy",
+@@ -3759,6 +3764,15 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ 		},
+ 		.driver_data = (void *)&intel_braswell_platform_data,
+ 	},
++	{
++		.ident = "LattePanda board",
++		.matches = {
++		  DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++		  DMI_EXACT_MATCH(DMI_BOARD_VERSION, "Default string"),
++		},
++		.driver_data = (void *)&lattepanda_board_platform_data,
++	},
+ 	{ }
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-samsung-i2s-fix-prescaler-setting-for-the-secon.patch b/queue-4.19/asoc-samsung-i2s-fix-prescaler-setting-for-the-secon.patch
new file mode 100644
index 00000000000..7ff8a361e40
--- /dev/null
+++ b/queue-4.19/asoc-samsung-i2s-fix-prescaler-setting-for-the-secon.patch
@@ -0,0 +1,63 @@
+From 46e1ef4aab1d2e08d9bb055ccd320646bba508f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 18:00:12 +0100
+Subject: ASoC: samsung: i2s: Fix prescaler setting for the secondary DAI
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+[ Upstream commit 323fb7b947b265753de34703dbbf8acc8ea3a4de ]
+
+Make sure i2s->rclk_srcrate is properly initialized also during
+playback through the secondary DAI.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/samsung/i2s.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index ce00fe2f6aae3..d4bde4834ce5f 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -604,6 +604,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
+ 	unsigned int fmt)
+ {
+ 	struct i2s_dai *i2s = to_info(dai);
++	struct i2s_dai *other = get_other_dai(i2s);
+ 	int lrp_shift, sdf_shift, sdf_mask, lrp_rlow, mod_slave;
+ 	u32 mod, tmp = 0;
+ 	unsigned long flags;
+@@ -661,7 +662,8 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
+ 		 * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any
+ 		 * clock configuration assigned in DT is not overwritten.
+ 		 */
+-		if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL)
++		if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL &&
++		    other->clk_data.clks == NULL)
+ 			i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0,
+ 							0, SND_SOC_CLOCK_IN);
+ 		break;
+@@ -699,6 +701,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ 	struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+ {
+ 	struct i2s_dai *i2s = to_info(dai);
++	struct i2s_dai *other = get_other_dai(i2s);
+ 	u32 mod, mask = 0, val = 0;
+ 	struct clk *rclksrc;
+ 	unsigned long flags;
+@@ -784,6 +787,9 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ 	i2s->frmclk = params_rate(params);
+ 
+ 	rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
++	if (!rclksrc || IS_ERR(rclksrc))
++		rclksrc = other->clk_table[CLK_I2S_RCLK_SRC];
++
+ 	if (rclksrc && !IS_ERR(rclksrc))
+ 		i2s->rclk_srcrate = clk_get_rate(rclksrc);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-stm32-sai-add-restriction-on-mmap-support.patch b/queue-4.19/asoc-stm32-sai-add-restriction-on-mmap-support.patch
new file mode 100644
index 00000000000..c6f5a4341da
--- /dev/null
+++ b/queue-4.19/asoc-stm32-sai-add-restriction-on-mmap-support.patch
@@ -0,0 +1,54 @@
+From c3fc28696c4037b0b7de20b31acb4916c536063c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 14:36:54 +0100
+Subject: ASoC: stm32: sai: add restriction on mmap support
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+[ Upstream commit eaf072e512d54c95b0977eda06cbca3151ace1e5 ]
+
+Do not support mmap in S/PDIF mode. In S/PDIF mode
+the buffer has to be copied, to allow the channel status
+bits insertion.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191104133654.28750-1-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 2fb2b914e78b4..6c2e69e32c864 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -994,6 +994,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream,
+ 	return 0;
+ }
+ 
++/* No support of mmap in S/PDIF mode */
++static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = {
++	.info = SNDRV_PCM_INFO_INTERLEAVED,
++	.buffer_bytes_max = 8 * PAGE_SIZE,
++	.period_bytes_min = 1024,
++	.period_bytes_max = PAGE_SIZE,
++	.periods_min = 2,
++	.periods_max = 8,
++};
++
+ static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
+ 	.info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+ 	.buffer_bytes_max = 8 * PAGE_SIZE,
+@@ -1050,7 +1060,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
+ };
+ 
+ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = {
+-	.pcm_hardware = &stm32_sai_pcm_hw,
++	.pcm_hardware = &stm32_sai_pcm_hw_spdif,
+ 	.prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+ 	.process = stm32_sai_pcm_process_spdif,
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/ata-ahci-mvebu-do-armada-38x-configuration-only-on-r.patch b/queue-4.19/ata-ahci-mvebu-do-armada-38x-configuration-only-on-r.patch
new file mode 100644
index 00000000000..356917c6cff
--- /dev/null
+++ b/queue-4.19/ata-ahci-mvebu-do-armada-38x-configuration-only-on-r.patch
@@ -0,0 +1,158 @@
+From 6dada8a73ae2c68162ea3bd1c26dbfe53b10ada5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 20:28:27 +0100
+Subject: ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 96dbcb40e4b1a387cdb9b21f43638c759aebb5a4 ]
+
+At the beginning, only Armada 38x SoCs where supported by the
+ahci_mvebu.c driver. Commit 15d3ce7b63bd ("ata: ahci_mvebu: add
+support for Armada 3700 variant") introduced Armada 3700 support. As
+opposed to Armada 38x SoCs, the 3700 variants do not have to configure
+mbus and the regret option. This patch took care of avoiding such
+configuration when not needed in the probe function, but failed to do
+the same in the resume path. While doing so looks harmless by
+experience, let's clean the driver logic and avoid doing this useless
+configuration with Armada 3700 SoCs.
+
+Because the logic is very similar between these two places, it has
+been decided to factorize this code and put it in a "Armada 38x
+configuration function". This function is part of a new
+(per-compatible) platform data structure, so that the addition of such
+configuration function for Armada 3700 will be eased.
+
+Fixes: 15d3ce7b63bd ("ata: ahci_mvebu: add support for Armada 3700 variant")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci_mvebu.c | 68 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 51 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
+index f9cb51be38ebf..a54214291481f 100644
+--- a/drivers/ata/ahci_mvebu.c
++++ b/drivers/ata/ahci_mvebu.c
+@@ -28,6 +28,10 @@
+ #define AHCI_WINDOW_BASE(win)	(0x64 + ((win) << 4))
+ #define AHCI_WINDOW_SIZE(win)	(0x68 + ((win) << 4))
+ 
++struct ahci_mvebu_plat_data {
++	int (*plat_config)(struct ahci_host_priv *hpriv);
++};
++
+ static void ahci_mvebu_mbus_config(struct ahci_host_priv *hpriv,
+ 				   const struct mbus_dram_target_info *dram)
+ {
+@@ -62,6 +66,22 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
+ 	writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
+ }
+ 
++static int ahci_mvebu_armada_380_config(struct ahci_host_priv *hpriv)
++{
++	const struct mbus_dram_target_info *dram;
++	int rc = 0;
++
++	dram = mv_mbus_dram_info();
++	if (dram)
++		ahci_mvebu_mbus_config(hpriv, dram);
++	else
++		rc = -ENODEV;
++
++	ahci_mvebu_regret_option(hpriv);
++
++	return rc;
++}
++
+ /**
+  * ahci_mvebu_stop_engine
+  *
+@@ -126,13 +146,10 @@ static int ahci_mvebu_resume(struct platform_device *pdev)
+ {
+ 	struct ata_host *host = platform_get_drvdata(pdev);
+ 	struct ahci_host_priv *hpriv = host->private_data;
+-	const struct mbus_dram_target_info *dram;
++	const struct ahci_mvebu_plat_data *pdata = hpriv->plat_data;
+ 
+-	dram = mv_mbus_dram_info();
+-	if (dram)
+-		ahci_mvebu_mbus_config(hpriv, dram);
+-
+-	ahci_mvebu_regret_option(hpriv);
++	if (pdata->plat_config)
++		pdata->plat_config(hpriv);
+ 
+ 	return ahci_platform_resume_host(&pdev->dev);
+ }
+@@ -154,28 +171,31 @@ static struct scsi_host_template ahci_platform_sht = {
+ 
+ static int ahci_mvebu_probe(struct platform_device *pdev)
+ {
++	const struct ahci_mvebu_plat_data *pdata;
+ 	struct ahci_host_priv *hpriv;
+-	const struct mbus_dram_target_info *dram;
+ 	int rc;
+ 
++	pdata = of_device_get_match_data(&pdev->dev);
++	if (!pdata)
++		return -EINVAL;
++
+ 	hpriv = ahci_platform_get_resources(pdev, 0);
+ 	if (IS_ERR(hpriv))
+ 		return PTR_ERR(hpriv);
+ 
++	hpriv->plat_data = (void *)pdata;
++
+ 	rc = ahci_platform_enable_resources(hpriv);
+ 	if (rc)
+ 		return rc;
+ 
+ 	hpriv->stop_engine = ahci_mvebu_stop_engine;
+ 
+-	if (of_device_is_compatible(pdev->dev.of_node,
+-				    "marvell,armada-380-ahci")) {
+-		dram = mv_mbus_dram_info();
+-		if (!dram)
+-			return -ENODEV;
+-
+-		ahci_mvebu_mbus_config(hpriv, dram);
+-		ahci_mvebu_regret_option(hpriv);
++	pdata = hpriv->plat_data;
++	if (pdata->plat_config) {
++		rc = pdata->plat_config(hpriv);
++		if (rc)
++			goto disable_resources;
+ 	}
+ 
+ 	rc = ahci_platform_init_host(pdev, hpriv, &ahci_mvebu_port_info,
+@@ -190,9 +210,23 @@ disable_resources:
+ 	return rc;
+ }
+ 
++static const struct ahci_mvebu_plat_data ahci_mvebu_armada_380_plat_data = {
++	.plat_config = ahci_mvebu_armada_380_config,
++};
++
++static const struct ahci_mvebu_plat_data ahci_mvebu_armada_3700_plat_data = {
++	.plat_config = NULL,
++};
++
+ static const struct of_device_id ahci_mvebu_of_match[] = {
+-	{ .compatible = "marvell,armada-380-ahci", },
+-	{ .compatible = "marvell,armada-3700-ahci", },
++	{
++		.compatible = "marvell,armada-380-ahci",
++		.data = &ahci_mvebu_armada_380_plat_data,
++	},
++	{
++		.compatible = "marvell,armada-3700-ahci",
++		.data = &ahci_mvebu_armada_3700_plat_data,
++	},
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(of, ahci_mvebu_of_match);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath6kl-fix-off-by-one-error-in-scan-completion.patch b/queue-4.19/ath6kl-fix-off-by-one-error-in-scan-completion.patch
new file mode 100644
index 00000000000..f317667570e
--- /dev/null
+++ b/queue-4.19/ath6kl-fix-off-by-one-error-in-scan-completion.patch
@@ -0,0 +1,38 @@
+From 6f38e174d7f6184ae2deede35ac4aea563fe04b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:13 +0200
+Subject: ath6kl: Fix off by one error in scan completion
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b ]
+
+When ath6kl was reworked to share code between regular and scheduled scans
+in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"),
+probed SSID entry changed from 1-index to 0-indexed. However,
+ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its
+indexing so that we correctly clear out the probed SSID list.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 6c98d7903ffb6..d7c626d9594e1 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted)
+ 	if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) {
+ 		for (i = 0; i < vif->scan_req->n_ssids; i++) {
+ 			ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
+-						  i + 1, DISABLE_SSID_FLAG,
++						  i, DISABLE_SSID_FLAG,
+ 						  0, NULL);
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath6kl-only-use-match-sets-when-firmware-supports-it.patch b/queue-4.19/ath6kl-only-use-match-sets-when-firmware-supports-it.patch
new file mode 100644
index 00000000000..b310cca0076
--- /dev/null
+++ b/queue-4.19/ath6kl-only-use-match-sets-when-firmware-supports-it.patch
@@ -0,0 +1,40 @@
+From f45cb87d72a858e3ba9f4dd7e062ee625a5ff2f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:11 +0200
+Subject: ath6kl: Only use match sets when firmware supports it
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 ]
+
+Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+merged the probed and matched SSID lists before sending them to the
+firmware. In the process, it assumed match set support is always available
+in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check
+that the firmware supports matching SSIDs in scheduled scans before setting
+MATCH_SSID_FLAG.
+
+Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index e121187f371ff..6c98d7903ffb6 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ 		else
+ 			ssid_list[i].flag = ANY_SSID_FLAG;
+ 
+-		if (n_match_ssid == 0)
++		if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ 			ssid_list[i].flag |= MATCH_SSID_FLAG;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch b/queue-4.19/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
new file mode 100644
index 00000000000..008fe58fa43
--- /dev/null
+++ b/queue-4.19/atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
@@ -0,0 +1,37 @@
+From 3837b3dbc67337a66477a2388eae3f3f24c844b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:23:19 -0600
+Subject: atl1e: checking the status of atl1e_write_phy_reg
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef ]
+
+atl1e_write_phy_reg() could fail. The fix issues an error message when
+it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 9dc6da039a6d9..3164aad29bcf8 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -473,7 +473,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
+ {
+ 	struct atl1e_adapter *adapter = netdev_priv(netdev);
+ 
+-	atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val);
++	if (atl1e_write_phy_reg(&adapter->hw,
++				reg_num & MDIO_REG_ADDR_MASK, val))
++		netdev_err(netdev, "write phy register failed\n");
+ }
+ 
+ static int atl1e_mii_ioctl(struct net_device *netdev,
+-- 
+2.20.1
+
diff --git a/queue-4.19/bcache-do-not-check-if-debug-dentry-is-err-or-null-e.patch b/queue-4.19/bcache-do-not-check-if-debug-dentry-is-err-or-null-e.patch
new file mode 100644
index 00000000000..c491779e9bf
--- /dev/null
+++ b/queue-4.19/bcache-do-not-check-if-debug-dentry-is-err-or-null-e.patch
@@ -0,0 +1,55 @@
+From 7884f72ca383dce78fab9ad79cbbf7abd7116246 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 22:53:47 +0800
+Subject: bcache: do not check if debug dentry is ERR or NULL explicitly on
+ remove
+
+From: Shenghui Wang <shhuiw@foxmail.com>
+
+[ Upstream commit ae17102316550b4b230a283febe31b2a9ff30084 ]
+
+debugfs_remove and debugfs_remove_recursive will check if the dentry
+pointer is NULL or ERR, and will do nothing in that case.
+
+Remove the check in cache_set_free and bch_debug_init.
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/debug.c | 3 +--
+ drivers/md/bcache/super.c | 3 +--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
+index 06da66b2488ae..8c53d874ada4a 100644
+--- a/drivers/md/bcache/debug.c
++++ b/drivers/md/bcache/debug.c
+@@ -249,8 +249,7 @@ void bch_debug_init_cache_set(struct cache_set *c)
+ 
+ void bch_debug_exit(void)
+ {
+-	if (!IS_ERR_OR_NULL(bcache_debug))
+-		debugfs_remove_recursive(bcache_debug);
++	debugfs_remove_recursive(bcache_debug);
+ }
+ 
+ void __init bch_debug_init(struct kobject *kobj)
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 4998b4cae9c11..14d381cc6d747 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1491,8 +1491,7 @@ static void cache_set_free(struct closure *cl)
+ 	struct cache *ca;
+ 	unsigned int i;
+ 
+-	if (!IS_ERR_OR_NULL(c->debug))
+-		debugfs_remove(c->debug);
++	debugfs_remove(c->debug);
+ 
+ 	bch_open_buckets_free(c);
+ 	bch_btree_cache_free(c);
+-- 
+2.20.1
+
diff --git a/queue-4.19/bcache-do-not-mark-writeback_running-too-early.patch b/queue-4.19/bcache-do-not-mark-writeback_running-too-early.patch
new file mode 100644
index 00000000000..74d5ec27b83
--- /dev/null
+++ b/queue-4.19/bcache-do-not-mark-writeback_running-too-early.patch
@@ -0,0 +1,95 @@
+From 85a58265c9dba38a5ac4a1115a8545969974c800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 22:53:50 +0800
+Subject: bcache: do not mark writeback_running too early
+
+From: Shenghui Wang <shhuiw@foxmail.com>
+
+[ Upstream commit 79b791466e525c98f6aeee9acf5726e7b27f4231 ]
+
+A fresh backing device is not attached to any cache_set, and
+has no writeback kthread created until first attached to some
+cache_set.
+
+But bch_cached_dev_writeback_init run
+"
+	dc->writeback_running		= true;
+	WARN_ON(test_and_clear_bit(BCACHE_DEV_WB_RUNNING,
+			&dc->disk.flags));
+"
+for any newly formatted backing devices.
+
+For a fresh standalone backing device, we can get something like
+following even if no writeback kthread created:
+------------------------
+/sys/block/bcache0/bcache# cat writeback_running
+1
+/sys/block/bcache0/bcache# cat writeback_rate_debug
+rate:		512.0k/sec
+dirty:		0.0k
+target:		0.0k
+proportional:	0.0k
+integral:	0.0k
+change:		0.0k/sec
+next io:	-15427384ms
+
+The none ZERO fields are misleading as no alive writeback kthread yet.
+
+Set dc->writeback_running false as no writeback thread created in
+bch_cached_dev_writeback_init().
+
+We have writeback thread created and woken up in bch_cached_dev_writeback
+_start(). Set dc->writeback_running true before bch_writeback_queue()
+called, as a writeback thread will check if dc->writeback_running is true
+before writing back dirty data, and hung if false detected.
+
+After the change, we can get the following output for a fresh standalone
+backing device:
+-----------------------
+/sys/block/bcache0/bcache$ cat writeback_running
+0
+/sys/block/bcache0/bcache# cat writeback_rate_debug
+rate:		0.0k/sec
+dirty:		0.0k
+target:		0.0k
+proportional:	0.0k
+integral:	0.0k
+change:		0.0k/sec
+next io:	0ms
+
+v1 -> v2:
+  Set dc->writeback_running before bch_writeback_queue() called,
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/writeback.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index ba5395fd386d5..b5fc3c6c7178e 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -781,7 +781,7 @@ void bch_cached_dev_writeback_init(struct cached_dev *dc)
+ 	bch_keybuf_init(&dc->writeback_keys);
+ 
+ 	dc->writeback_metadata		= true;
+-	dc->writeback_running		= true;
++	dc->writeback_running		= false;
+ 	dc->writeback_percent		= 10;
+ 	dc->writeback_delay		= 30;
+ 	atomic_long_set(&dc->writeback_rate.rate, 1024);
+@@ -810,6 +810,7 @@ int bch_cached_dev_writeback_start(struct cached_dev *dc)
+ 		destroy_workqueue(dc->writeback_write_wq);
+ 		return PTR_ERR(dc->writeback_thread);
+ 	}
++	dc->writeback_running = true;
+ 
+ 	WARN_ON(test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags));
+ 	schedule_delayed_work(&dc->writeback_rate_update,
+-- 
+2.20.1
+
diff --git a/queue-4.19/blktrace-show-requests-without-sector.patch b/queue-4.19/blktrace-show-requests-without-sector.patch
new file mode 100644
index 00000000000..2423b8a6307
--- /dev/null
+++ b/queue-4.19/blktrace-show-requests-without-sector.patch
@@ -0,0 +1,45 @@
+From 356cca2455bc15ee93db7e45f3bb0bd1913e7044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 11:55:39 +0100
+Subject: blktrace: Show requests without sector
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 0803de78049fe1b0baf44bcddc727b036fb9139b ]
+
+Currently, blktrace will not show requests that don't have any data as
+rq->__sector is initialized to -1 which is out of device range and thus
+discarded by act_log_check(). This is most notably the case for cache
+flush requests sent to the device. Fix the problem by making
+blk_rq_trace_sector() return 0 for requests without initialized sector.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/blktrace_api.h | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 8804753805ac5..7bb2d8de9f308 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes);
+ 
+ static inline sector_t blk_rq_trace_sector(struct request *rq)
+ {
+-	return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq);
++	/*
++	 * Tracing should ignore starting sector for passthrough requests and
++	 * requests where starting sector didn't get set.
++	 */
++	if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1)
++		return 0;
++	return blk_rq_pos(rq);
+ }
+ 
+ static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq)
+-- 
+2.20.1
+
diff --git a/queue-4.19/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch b/queue-4.19/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
new file mode 100644
index 00000000000..6d7c0e36d1d
--- /dev/null
+++ b/queue-4.19/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
@@ -0,0 +1,35 @@
+From 0ebb64471c58257f0f0ff2c8d3c2f49341dd279e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 10:48:47 +0300
+Subject: block: drbd: remove a stray unlock in __drbd_send_protocol()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]
+
+There are two callers of this function and they both unlock the mutex so
+this ends up being a double unlock.
+
+Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index ef8212a4b73ef..a49a8d91a5990 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -796,7 +796,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+ 
+ 	if (nc->tentative && connection->agreed_pro_version < 92) {
+ 		rcu_read_unlock();
+-		mutex_unlock(&sock->mutex);
+ 		drbd_err(connection, "--dry-run is not supported by peer");
+ 		return -EOPNOTSUPP;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch b/queue-4.19/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch
new file mode 100644
index 00000000000..2d70d3671e7
--- /dev/null
+++ b/queue-4.19/bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch
@@ -0,0 +1,84 @@
+From a146dce1cd61aae9458584207392acdc4a61228d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 12:22:28 +0100
+Subject: Bluetooth: hci_bcm: Handle specific unknown packets after firmware
+ loading
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+[ Upstream commit 22bba80500fdf624a7cfbb65fdfa97a038ae224d ]
+
+The Broadcom controller on aries S5PV210 boards sends out a couple of
+unknown packets after the firmware is loaded.  This will cause
+logging of errors such as:
+	Bluetooth: hci0: Frame reassembly failed (-84)
+
+This is probably also the case with other boards, as there are related
+Android userspace patches for custom ROMs such as
+https://review.lineageos.org/#/c/LineageOS/android_system_bt/+/142721/
+Since this appears to be intended behaviour, treated them as diagnostic
+packets.
+
+Note that this is another variant of commit 01d5e44ace8a
+("Bluetooth: hci_bcm: Handle empty packet after firmware loading")
+
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcm.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index aa6b7ed9fdf12..59e5fc5eec8f8 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -51,6 +51,12 @@
+ #define BCM_LM_DIAG_PKT 0x07
+ #define BCM_LM_DIAG_SIZE 63
+ 
++#define BCM_TYPE49_PKT 0x31
++#define BCM_TYPE49_SIZE 0
++
++#define BCM_TYPE52_PKT 0x34
++#define BCM_TYPE52_SIZE 0
++
+ #define BCM_AUTOSUSPEND_DELAY	5000 /* default autosleep delay */
+ 
+ /**
+@@ -564,12 +570,28 @@ finalize:
+ 	.lsize = 0, \
+ 	.maxlen = BCM_NULL_SIZE
+ 
++#define BCM_RECV_TYPE49 \
++	.type = BCM_TYPE49_PKT, \
++	.hlen = BCM_TYPE49_SIZE, \
++	.loff = 0, \
++	.lsize = 0, \
++	.maxlen = BCM_TYPE49_SIZE
++
++#define BCM_RECV_TYPE52 \
++	.type = BCM_TYPE52_PKT, \
++	.hlen = BCM_TYPE52_SIZE, \
++	.loff = 0, \
++	.lsize = 0, \
++	.maxlen = BCM_TYPE52_SIZE
++
+ static const struct h4_recv_pkt bcm_recv_pkts[] = {
+ 	{ H4_RECV_ACL,      .recv = hci_recv_frame },
+ 	{ H4_RECV_SCO,      .recv = hci_recv_frame },
+ 	{ H4_RECV_EVENT,    .recv = hci_recv_frame },
+ 	{ BCM_RECV_LM_DIAG, .recv = hci_recv_diag  },
+ 	{ BCM_RECV_NULL,    .recv = hci_recv_diag  },
++	{ BCM_RECV_TYPE49,  .recv = hci_recv_diag  },
++	{ BCM_RECV_TYPE52,  .recv = hci_recv_diag  },
+ };
+ 
+ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch b/queue-4.19/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch
new file mode 100644
index 00000000000..fafaa7c71c2
--- /dev/null
+++ b/queue-4.19/bnxt_en-query-force-speeds-before-disabling-autoneg-.patch
@@ -0,0 +1,68 @@
+From f8933c8181c3272eb7edc5d03e8073da2674a76a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:31 -0500
+Subject: bnxt_en: query force speeds before disabling autoneg mode.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 56d374624778652d2a999e18c87a25338b127b41 ]
+
+With autoneg enabled, PHY loopback test fails. To disable autoneg,
+driver needs to send a valid forced speed to FW. FW is not sending
+async event for invalid speeds. To fix this, query forced speeds
+and send the correct speed when disabling autoneg mode.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 22 ++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index eaa285bf908b9..2240c23b0a4c9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2390,17 +2390,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable)
+ 	return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ }
+ 
++static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds)
++{
++	struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr;
++	struct hwrm_port_phy_qcaps_input req = {0};
++	int rc;
++
++	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1);
++	mutex_lock(&bp->hwrm_cmd_lock);
++	rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	if (!rc)
++		*force_speeds = le16_to_cpu(resp->supported_speeds_force_mode);
++
++	mutex_unlock(&bp->hwrm_cmd_lock);
++	return rc;
++}
++
+ static int bnxt_disable_an_for_lpbk(struct bnxt *bp,
+ 				    struct hwrm_port_phy_cfg_input *req)
+ {
+ 	struct bnxt_link_info *link_info = &bp->link_info;
+-	u16 fw_advertising = link_info->advertising;
++	u16 fw_advertising;
+ 	u16 fw_speed;
+ 	int rc;
+ 
+ 	if (!link_info->autoneg)
+ 		return 0;
+ 
++	rc = bnxt_query_force_speeds(bp, &fw_advertising);
++	if (rc)
++		return rc;
++
+ 	fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB;
+ 	if (netif_carrier_ok(bp->dev))
+ 		fw_speed = bp->link_info.link_speed;
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch b/queue-4.19/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch
new file mode 100644
index 00000000000..26088bce83b
--- /dev/null
+++ b/queue-4.19/bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch
@@ -0,0 +1,149 @@
+From 8e87eb2201e00e17872662de16ec33d2d303fb86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:28 -0500
+Subject: bnxt_en: Return linux standard errors in bnxt_ethtool.c
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 7c675421afef18253a86ffc383f57bc15ef32ea8 ]
+
+Currently firmware specific errors are returned directly in flash_device
+and reset ethtool hooks. Modify it to return linux standard errors
+to userspace when flashing operations fail.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 56 +++++++++++++------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index da9b876899963..eaa285bf908b9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1444,14 +1444,22 @@ static int bnxt_flash_nvram(struct net_device *dev,
+ 	rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT);
+ 	dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle);
+ 
++	if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++		netdev_info(dev,
++			    "PF does not have admin privileges to flash the device\n");
++		rc = -EACCES;
++	} else if (rc) {
++		rc = -EIO;
++	}
+ 	return rc;
+ }
+ 
+ static int bnxt_firmware_reset(struct net_device *dev,
+ 			       u16 dir_type)
+ {
+-	struct bnxt *bp = netdev_priv(dev);
+ 	struct hwrm_fw_reset_input req = {0};
++	struct bnxt *bp = netdev_priv(dev);
++	int rc;
+ 
+ 	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1);
+ 
+@@ -1491,7 +1499,15 @@ static int bnxt_firmware_reset(struct net_device *dev,
+ 		return -EINVAL;
+ 	}
+ 
+-	return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++		netdev_info(dev,
++			    "PF does not have admin privileges to reset the device\n");
++		rc = -EACCES;
++	} else if (rc) {
++		rc = -EIO;
++	}
++	return rc;
+ }
+ 
+ static int bnxt_flash_firmware(struct net_device *dev,
+@@ -1698,9 +1714,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 	struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr;
+ 	struct hwrm_nvm_install_update_input install = {0};
+ 	const struct firmware *fw;
++	int rc, hwrm_err = 0;
+ 	u32 item_len;
+ 	u16 index;
+-	int rc;
+ 
+ 	bnxt_hwrm_fw_set_time(bp);
+ 
+@@ -1743,15 +1759,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 			memcpy(kmem, fw->data, fw->size);
+ 			modify.host_src_addr = cpu_to_le64(dma_handle);
+ 
+-			rc = hwrm_send_message(bp, &modify, sizeof(modify),
+-					       FLASH_PACKAGE_TIMEOUT);
++			hwrm_err = hwrm_send_message(bp, &modify,
++						     sizeof(modify),
++						     FLASH_PACKAGE_TIMEOUT);
+ 			dma_free_coherent(&bp->pdev->dev, fw->size, kmem,
+ 					  dma_handle);
+ 		}
+ 	}
+ 	release_firmware(fw);
+-	if (rc)
+-		return rc;
++	if (rc || hwrm_err)
++		goto err_exit;
+ 
+ 	if ((install_type & 0xffff) == 0)
+ 		install_type >>= 16;
+@@ -1759,12 +1776,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 	install.install_type = cpu_to_le32(install_type);
+ 
+ 	mutex_lock(&bp->hwrm_cmd_lock);
+-	rc = _hwrm_send_message(bp, &install, sizeof(install),
+-				INSTALL_PACKAGE_TIMEOUT);
+-	if (rc) {
+-		rc = -EOPNOTSUPP;
++	hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
++				      INSTALL_PACKAGE_TIMEOUT);
++	if (hwrm_err)
+ 		goto flash_pkg_exit;
+-	}
+ 
+ 	if (resp->error_code) {
+ 		u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+@@ -1772,12 +1787,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 		if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ 			install.flags |= cpu_to_le16(
+ 			       NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+-			rc = _hwrm_send_message(bp, &install, sizeof(install),
+-						INSTALL_PACKAGE_TIMEOUT);
+-			if (rc) {
+-				rc = -EOPNOTSUPP;
++			hwrm_err = _hwrm_send_message(bp, &install,
++						      sizeof(install),
++						      INSTALL_PACKAGE_TIMEOUT);
++			if (hwrm_err)
+ 				goto flash_pkg_exit;
+-			}
+ 		}
+ 	}
+ 
+@@ -1788,6 +1802,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 	}
+ flash_pkg_exit:
+ 	mutex_unlock(&bp->hwrm_cmd_lock);
++err_exit:
++	if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++		netdev_info(dev,
++			    "PF does not have admin privileges to flash the device\n");
++		rc = -EACCES;
++	} else if (hwrm_err) {
++		rc = -EOPNOTSUPP;
++	}
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-save-ring-statistics-before-reset.patch b/queue-4.19/bnxt_en-save-ring-statistics-before-reset.patch
new file mode 100644
index 00000000000..4114305c22d
--- /dev/null
+++ b/queue-4.19/bnxt_en-save-ring-statistics-before-reset.patch
@@ -0,0 +1,130 @@
+From 57ba8949461045de596ea41954fc4589d1272f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:29 -0500
+Subject: bnxt_en: Save ring statistics before reset.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit b8875ca356f1c0b17ec68be6666269373a62288e ]
+
+With the current driver, the statistics reported by .ndo_get_stats64()
+are reset when the device goes down.  Store a snapshot of the
+rtnl_link_stats64 before shutdown.  This snapshot is added to the
+current counters in .ndo_get_stats64() so that the counters will not
+get reset when the device is down.
+
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 57 +++++++++++++++++------
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h |  1 +
+ 2 files changed, 44 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index c54a74de7b088..2f61175f5655a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7148,6 +7148,9 @@ static bool bnxt_drv_busy(struct bnxt *bp)
+ 		test_bit(BNXT_STATE_READ_STATS, &bp->state));
+ }
+ 
++static void bnxt_get_ring_stats(struct bnxt *bp,
++				struct rtnl_link_stats64 *stats);
++
+ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ 			     bool link_re_init)
+ {
+@@ -7173,6 +7176,9 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ 	del_timer_sync(&bp->timer);
+ 	bnxt_free_skbs(bp);
+ 
++	/* Save ring stats before shutdown */
++	if (bp->bnapi)
++		bnxt_get_ring_stats(bp, &bp->net_stats_prev);
+ 	if (irq_re_init) {
+ 		bnxt_free_irq(bp);
+ 		bnxt_del_napi(bp);
+@@ -7234,23 +7240,12 @@ static int bnxt_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ 	return -EOPNOTSUPP;
+ }
+ 
+-static void
+-bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++static void bnxt_get_ring_stats(struct bnxt *bp,
++				struct rtnl_link_stats64 *stats)
+ {
+-	u32 i;
+-	struct bnxt *bp = netdev_priv(dev);
++	int i;
+ 
+-	set_bit(BNXT_STATE_READ_STATS, &bp->state);
+-	/* Make sure bnxt_close_nic() sees that we are reading stats before
+-	 * we check the BNXT_STATE_OPEN flag.
+-	 */
+-	smp_mb__after_atomic();
+-	if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
+-		clear_bit(BNXT_STATE_READ_STATS, &bp->state);
+-		return;
+-	}
+ 
+-	/* TODO check if we need to synchronize with bnxt_close path */
+ 	for (i = 0; i < bp->cp_nr_rings; i++) {
+ 		struct bnxt_napi *bnapi = bp->bnapi[i];
+ 		struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+@@ -7279,6 +7274,40 @@ bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+ 
+ 		stats->tx_dropped += le64_to_cpu(hw_stats->tx_drop_pkts);
+ 	}
++}
++
++static void bnxt_add_prev_stats(struct bnxt *bp,
++				struct rtnl_link_stats64 *stats)
++{
++	struct rtnl_link_stats64 *prev_stats = &bp->net_stats_prev;
++
++	stats->rx_packets += prev_stats->rx_packets;
++	stats->tx_packets += prev_stats->tx_packets;
++	stats->rx_bytes += prev_stats->rx_bytes;
++	stats->tx_bytes += prev_stats->tx_bytes;
++	stats->rx_missed_errors += prev_stats->rx_missed_errors;
++	stats->multicast += prev_stats->multicast;
++	stats->tx_dropped += prev_stats->tx_dropped;
++}
++
++static void
++bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++{
++	struct bnxt *bp = netdev_priv(dev);
++
++	set_bit(BNXT_STATE_READ_STATS, &bp->state);
++	/* Make sure bnxt_close_nic() sees that we are reading stats before
++	 * we check the BNXT_STATE_OPEN flag.
++	 */
++	smp_mb__after_atomic();
++	if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
++		clear_bit(BNXT_STATE_READ_STATS, &bp->state);
++		*stats = bp->net_stats_prev;
++		return;
++	}
++
++	bnxt_get_ring_stats(bp, stats);
++	bnxt_add_prev_stats(bp, stats);
+ 
+ 	if (bp->flags & BNXT_FLAG_PORT_STATS) {
+ 		struct rx_port_stats *rx = bp->hw_rx_port_stats;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index cf2d4a6583d55..f9e253b705ece 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1302,6 +1302,7 @@ struct bnxt {
+ 	void			*hwrm_cmd_resp_addr;
+ 	dma_addr_t		hwrm_cmd_resp_dma_addr;
+ 
++	struct rtnl_link_stats64	net_stats_prev;
+ 	struct rx_port_stats	*hw_rx_port_stats;
+ 	struct tx_port_stats	*hw_tx_port_stats;
+ 	struct rx_port_stats_ext	*hw_rx_port_stats_ext;
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-cpumap-make-sure-frame_size-for-build_skb-is-ali.patch b/queue-4.19/bpf-cpumap-make-sure-frame_size-for-build_skb-is-ali.patch
new file mode 100644
index 00000000000..95e4a1df54f
--- /dev/null
+++ b/queue-4.19/bpf-cpumap-make-sure-frame_size-for-build_skb-is-ali.patch
@@ -0,0 +1,44 @@
+From 5b119118504a823af253c972645061e64f8b45d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 17:00:23 +0100
+Subject: bpf/cpumap: make sure frame_size for build_skb is aligned if headroom
+ isn't
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 77ea5f4cbe2084db9ab021ba73fb7eadf1610884 ]
+
+The frame_size passed to build_skb must be aligned, else it is
+possible that the embedded struct skb_shared_info gets unaligned.
+
+For correctness make sure that xdpf->headroom in included in the
+alignment. No upstream drivers can hit this, as all XDP drivers provide
+an aligned headroom.  This was discovered when playing with implementing
+XDP support for mvneta, which have a 2 bytes DSA header, and this
+Marvell ARM64 platform didn't like doing atomic operations on an
+unaligned skb_shinfo(skb)->dataref addresses.
+
+Fixes: 1c601d829ab0 ("bpf: cpumap xdp_buff to skb conversion and allocation")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cpumap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 24aac0d0f4127..8974b3755670e 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -183,7 +183,7 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ 	 * is not at a fixed memory location, with mixed length
+ 	 * packets, which is bad for cache-line hotness.
+ 	 */
+-	frame_size = SKB_DATA_ALIGN(xdpf->len) + xdpf->headroom +
++	frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
+ 		SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 
+ 	pkt_data_start = xdpf->data - xdpf->headroom;
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch b/queue-4.19/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch
new file mode 100644
index 00000000000..d632022565e
--- /dev/null
+++ b/queue-4.19/bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch
@@ -0,0 +1,39 @@
+From ce2392603d1658560303b13f0583b1b0c8d00886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 22:15:37 +0800
+Subject: bpf: decrease usercnt if bpf_map_new_fd() fails in
+ bpf_map_get_fd_by_id()
+
+From: Peng Sun <sironhide0null@gmail.com>
+
+[ Upstream commit 781e62823cb81b972dc8652c1827205cda2ac9ac ]
+
+In bpf/syscall.c, bpf_map_get_fd_by_id() use bpf_map_inc_not_zero()
+to increase the refcount, both map->refcnt and map->usercnt. Then, if
+bpf_map_new_fd() fails, should handle map->usercnt too.
+
+Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID")
+Signed-off-by: Peng Sun <sironhide0null@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 6e544e364821e..90bb0c05c10e9 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1887,7 +1887,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
+ 
+ 	fd = bpf_map_new_fd(map, f_flags);
+ 	if (fd < 0)
+-		bpf_map_put(map);
++		bpf_map_put_with_uref(map);
+ 
+ 	return fd;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch b/queue-4.19/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch
new file mode 100644
index 00000000000..596aa8193f0
--- /dev/null
+++ b/queue-4.19/bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch
@@ -0,0 +1,45 @@
+From 0cb5c7c7d017aeee63efaf022865cec79a7493e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 22:36:25 +0800
+Subject: bpf: drop refcount if bpf_map_new_fd() fails in map_create()
+
+From: Peng Sun <sironhide0null@gmail.com>
+
+[ Upstream commit 352d20d611414715353ee65fc206ee57ab1a6984 ]
+
+In bpf/syscall.c, map_create() first set map->usercnt to 1, a file
+descriptor is supposed to return to userspace. When bpf_map_new_fd()
+fails, drop the refcount.
+
+Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID")
+Signed-off-by: Peng Sun <sironhide0null@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 90bb0c05c10e9..596959288eb9e 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -559,12 +559,12 @@ static int map_create(union bpf_attr *attr)
+ 	err = bpf_map_new_fd(map, f_flags);
+ 	if (err < 0) {
+ 		/* failed to allocate fd.
+-		 * bpf_map_put() is needed because the above
++		 * bpf_map_put_with_uref() is needed because the above
+ 		 * bpf_map_alloc_id() has published the map
+ 		 * to the userspace and the userspace may
+ 		 * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID.
+ 		 */
+-		bpf_map_put(map);
++		bpf_map_put_with_uref(map);
+ 		return err;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/brcmfmac-fix-access-point-mode.patch b/queue-4.19/brcmfmac-fix-access-point-mode.patch
new file mode 100644
index 00000000000..70adcad959b
--- /dev/null
+++ b/queue-4.19/brcmfmac-fix-access-point-mode.patch
@@ -0,0 +1,51 @@
+From d279a61843b1bfd3236046b7a4f807a49115f54f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 20:20:06 +0100
+Subject: brcmfmac: Fix access point mode
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 861cb5eb467f5e38dce1aabe4e8db379255bd89b ]
+
+Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with
+hostapd (device_ap_sme=1 use_monitor=0):
+
+brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
+
+So add the missing mgmt_stypes for AP mode to fix this.
+
+Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index c7c520f327f2b..bbdc6000afb9b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6314,6 +6314,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
+ 		.tx = 0xffff,
+ 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+ 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
++	},
++	[NL80211_IFTYPE_AP] = {
++		.tx = 0xffff,
++		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
++		      BIT(IEEE80211_STYPE_AUTH >> 4) |
++		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
++		      BIT(IEEE80211_STYPE_ACTION >> 4)
+ 	}
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/brcmfmac-set-f2-watermark-to-256-for-4373.patch b/queue-4.19/brcmfmac-set-f2-watermark-to-256-for-4373.patch
new file mode 100644
index 00000000000..9229cc08737
--- /dev/null
+++ b/queue-4.19/brcmfmac-set-f2-watermark-to-256-for-4373.patch
@@ -0,0 +1,83 @@
+From d45a02c1c61e777478e0eebbc1328d6ead613af6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 07:53:44 +0000
+Subject: brcmfmac: set F2 watermark to 256 for 4373
+
+From: Wright Feng <wright.feng@cypress.com>
+
+[ Upstream commit e1a08730eeb0bad4d82c3bc40e74854872de618d ]
+
+We got SDIO_CRC_ERROR with 4373 on SDR104 when doing bi-directional
+throughput test. Enable watermark to 256 to guarantee the operation
+stability.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 26 +++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 53e4962ceb8ae..e487dd78cc024 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -49,6 +49,10 @@
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
+ 
++/* watermark expressed in number of words */
++#define DEFAULT_F2_WATERMARK    0x8
++#define CY_4373_F2_WATERMARK    0x40
++
+ #ifdef DEBUG
+ 
+ #define BRCMF_TRAP_INFO_SIZE	80
+@@ -138,6 +142,8 @@ struct rte_console {
+ /* 1: isolate internal sdio signals, put external pads in tri-state; requires
+  * sdio bus power cycle to clear (rev 9) */
+ #define SBSDIO_DEVCTL_PADS_ISO		0x08
++/* 1: enable F2 Watermark */
++#define SBSDIO_DEVCTL_F2WM_ENAB		0x10
+ /* Force SD->SB reset mapping (rev 11) */
+ #define SBSDIO_DEVCTL_SB_RST_CTL	0x30
+ /*   Determined by CoreControl bit */
+@@ -4060,6 +4066,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 	void *nvram;
+ 	u32 nvram_len;
+ 	u8 saveclk;
++	u8 devctl;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
+@@ -4115,8 +4122,23 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
+ 				   bus->hostintmask, NULL);
+ 
+-
+-		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
++		switch (sdiod->func1->device) {
++		case SDIO_DEVICE_ID_CYPRESS_4373:
++			brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++				  CY_4373_F2_WATERMARK);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   CY_4373_F2_WATERMARK, &err);
++			devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++						   &err);
++			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++					   &err);
++			break;
++		default:
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   DEFAULT_F2_WATERMARK, &err);
++			break;
++		}
+ 	} else {
+ 		/* Disable F2 again */
+ 		sdio_disable_func(sdiod->func2);
+-- 
+2.20.1
+
diff --git a/queue-4.19/brcmfmac-set-sdio-f1-mesbusyctrl-for-cyw4373.patch b/queue-4.19/brcmfmac-set-sdio-f1-mesbusyctrl-for-cyw4373.patch
new file mode 100644
index 00000000000..9aa5aa0405e
--- /dev/null
+++ b/queue-4.19/brcmfmac-set-sdio-f1-mesbusyctrl-for-cyw4373.patch
@@ -0,0 +1,67 @@
+From 0e992aa526913444af44abff01a4ba2b6deeb0f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 07:53:45 +0000
+Subject: brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373
+
+From: Madhan Mohan R <MadhanMohan.R@cypress.com>
+
+[ Upstream commit 58e4bbea0c1d9b5ace11df968c5dc096ce052a73 ]
+
+Along with F2 watermark (existing) configuration, F1 MesBusyCtrl
+should be enabled & sdio device RX FIFO watermark should be
+configured to avoid overflow errors.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 9 ++++++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index e487dd78cc024..abaed2fa2defd 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4133,6 +4133,9 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ 			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
+ 					   &err);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
++					   CY_4373_F2_WATERMARK |
++					   SBSDIO_MESBUSYCTRL_ENAB, &err);
+ 			break;
+ 		default:
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+index 7faed831f07d5..34b031154da93 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -77,7 +77,7 @@
+ #define SBSDIO_GPIO_OUT			0x10006
+ /* gpio enable */
+ #define SBSDIO_GPIO_EN			0x10007
+-/* rev < 7, watermark for sdio device */
++/* rev < 7, watermark for sdio device TX path */
+ #define SBSDIO_WATERMARK		0x10008
+ /* control busy signal generation */
+ #define SBSDIO_DEVICE_CTL		0x10009
+@@ -104,6 +104,13 @@
+ #define SBSDIO_FUNC1_RFRAMEBCHI		0x1001C
+ /* MesBusyCtl (rev 11) */
+ #define SBSDIO_FUNC1_MESBUSYCTRL	0x1001D
++/* Watermark for sdio device RX path */
++#define SBSDIO_MESBUSY_RXFIFO_WM_MASK	0x7F
++#define SBSDIO_MESBUSY_RXFIFO_WM_SHIFT	0
++/* Enable busy capability for MES access */
++#define SBSDIO_MESBUSYCTRL_ENAB		0x80
++#define SBSDIO_MESBUSYCTRL_ENAB_SHIFT	7
++
+ /* Sdio Core Rev 12 */
+ #define SBSDIO_FUNC1_WAKEUPCTRL		0x1001E
+ #define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK		0x1
+-- 
+2.20.1
+
diff --git a/queue-4.19/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch b/queue-4.19/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
new file mode 100644
index 00000000000..ce60006f82a
--- /dev/null
+++ b/queue-4.19/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
@@ -0,0 +1,66 @@
+From 04a07de8a32b84225efeec0c1d4ba73b6d47200b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 20:54:28 +0100
+Subject: bridge: ebtables: don't crash when using dnat target in output chains
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]
+
+xt_in() returns NULL in the output hook, skip the pkt_type change for
+that case, redirection only makes sense in broute/prerouting hooks.
+
+Reported-by: Tom Yan <tom.ty89@gmail.com>
+Cc: Linus Lüssing <linus.luessing@c0d3.blue>
+Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index dfc86a0199dab..1d8c834d90189 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -19,7 +19,6 @@ static unsigned int
+ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ 	const struct ebt_nat_info *info = par->targinfo;
+-	struct net_device *dev;
+ 
+ 	if (!skb_make_writable(skb, 0))
+ 		return EBT_DROP;
+@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ 		else
+ 			skb->pkt_type = PACKET_MULTICAST;
+ 	} else {
+-		if (xt_hooknum(par) != NF_BR_BROUTING)
+-			dev = br_port_get_rcu(xt_in(par))->br->dev;
+-		else
++		const struct net_device *dev;
++
++		switch (xt_hooknum(par)) {
++		case NF_BR_BROUTING:
+ 			dev = xt_in(par);
++			break;
++		case NF_BR_PRE_ROUTING:
++			dev = br_port_get_rcu(xt_in(par))->br->dev;
++			break;
++		default:
++			dev = NULL;
++			break;
++		}
++
++		if (!dev) /* NF_BR_LOCAL_OUT */
++			return info->target;
+ 
+ 		if (ether_addr_equal(info->mac, dev->dev_addr))
+ 			skb->pkt_type = PACKET_HOST;
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-allow-clear_extent_dirty-to-receive-a-cached-e.patch b/queue-4.19/btrfs-allow-clear_extent_dirty-to-receive-a-cached-e.patch
new file mode 100644
index 00000000000..ecc0188b456
--- /dev/null
+++ b/queue-4.19/btrfs-allow-clear_extent_dirty-to-receive-a-cached-e.patch
@@ -0,0 +1,116 @@
+From b87e3de9fc319036c5863d1c7f55d463fce14601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 13:04:44 +0000
+Subject: Btrfs: allow clear_extent_dirty() to receive a cached extent state
+ record
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 0e6ec385b55f6001da8c6b1532494241e52c550d ]
+
+We can have a lot freed extents during the life span of transaction, so
+the red black tree that keeps track of the ranges of each freed extent
+(fs_info->freed_extents[]) can get quite big. When finishing a
+transaction commit we find each range, process it (discard the extents,
+unpin them) and then remove it from the red black tree.
+
+We can use an extent state record as a cache when searching for a range,
+so that when we clean the range we can use the cached extent state we
+passed to the search function instead of iterating the red black tree
+again. Doing things as fast as possible when finishing a transaction (in
+state TRANS_STATE_UNBLOCKED) is convenient as it reduces the time we
+block another task that wants to commit the next transaction.
+
+So change clear_extent_dirty() to allow an optional extent state record to
+be passed as an argument, which will be passed down to __clear_extent_bit.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/disk-io.c     | 7 +++++--
+ fs/btrfs/extent-tree.c | 7 +++++--
+ fs/btrfs/extent_io.h   | 4 ++--
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b2dc613ebed2c..96296dc7d2ea4 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4350,6 +4350,8 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
+ 	unpin = pinned_extents;
+ again:
+ 	while (1) {
++		struct extent_state *cached_state = NULL;
++
+ 		/*
+ 		 * The btrfs_finish_extent_commit() may get the same range as
+ 		 * ours between find_first_extent_bit and clear_extent_dirty.
+@@ -4358,13 +4360,14 @@ again:
+ 		 */
+ 		mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ 		ret = find_first_extent_bit(unpin, 0, &start, &end,
+-					    EXTENT_DIRTY, NULL);
++					    EXTENT_DIRTY, &cached_state);
+ 		if (ret) {
+ 			mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ 			break;
+ 		}
+ 
+-		clear_extent_dirty(unpin, start, end);
++		clear_extent_dirty(unpin, start, end, &cached_state);
++		free_extent_state(cached_state);
+ 		btrfs_error_unpin_extent_range(fs_info, start, end);
+ 		mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ 		cond_resched();
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 024dd336b20ae..4bda5c09cdfe7 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6618,9 +6618,11 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
+ 		unpin = &fs_info->freed_extents[0];
+ 
+ 	while (!trans->aborted) {
++		struct extent_state *cached_state = NULL;
++
+ 		mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ 		ret = find_first_extent_bit(unpin, 0, &start, &end,
+-					    EXTENT_DIRTY, NULL);
++					    EXTENT_DIRTY, &cached_state);
+ 		if (ret) {
+ 			mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ 			break;
+@@ -6630,9 +6632,10 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
+ 			ret = btrfs_discard_extent(fs_info, start,
+ 						   end + 1 - start, NULL);
+ 
+-		clear_extent_dirty(unpin, start, end);
++		clear_extent_dirty(unpin, start, end, &cached_state);
+ 		unpin_extent_range(fs_info, start, end, true);
+ 		mutex_unlock(&fs_info->unused_bg_unpin_mutex);
++		free_extent_state(cached_state);
+ 		cond_resched();
+ 	}
+ 
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index ed27becd963c5..a3598b24441e1 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -348,11 +348,11 @@ static inline int set_extent_dirty(struct extent_io_tree *tree, u64 start,
+ }
+ 
+ static inline int clear_extent_dirty(struct extent_io_tree *tree, u64 start,
+-		u64 end)
++				     u64 end, struct extent_state **cached)
+ {
+ 	return clear_extent_bit(tree, start, end,
+ 				EXTENT_DIRTY | EXTENT_DELALLOC |
+-				EXTENT_DO_ACCOUNTING, 0, 0, NULL);
++				EXTENT_DO_ACCOUNTING, 0, 0, cached);
+ }
+ 
+ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-check-for-missing-device-before-bio-submission.patch b/queue-4.19/btrfs-check-for-missing-device-before-bio-submission.patch
new file mode 100644
index 00000000000..c586a245fbc
--- /dev/null
+++ b/queue-4.19/btrfs-check-for-missing-device-before-bio-submission.patch
@@ -0,0 +1,64 @@
+From 46d7e9e862eeca0e2cb8264ca63df5e5aaefc54c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 16:16:38 +0200
+Subject: btrfs: Check for missing device before bio submission in
+ btrfs_map_bio
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit fc8a168aa9ab1680c2bd52bf9db7c994e0f2524f ]
+
+Before btrfs_map_bio submits all stripe bios it does a number of checks
+to ensure the device for every stripe is present. However, it doesn't do
+a DEV_STATE_MISSING check, instead this is relegated to the lower level
+btrfs_schedule_bio (in the async submission case, sync submission
+doesn't check DEV_STATE_MISSING at all). Additionally
+btrfs_schedule_bios does the duplicate device->bdev check which has
+already been performed in btrfs_map_bio.
+
+This patch moves the DEV_STATE_MISSING check in btrfs_map_bio and
+removes the duplicate device->bdev check. Doing so ensures that no bio
+cloning/submission happens for both async/sync requests in the face of
+missing device. This makes the async io submission path slightly shorter
+in terms of instruction count. No functional changes.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index a8297e7489d98..f84c18e86c816 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6106,12 +6106,6 @@ static noinline void btrfs_schedule_bio(struct btrfs_device *device,
+ 	int should_queue = 1;
+ 	struct btrfs_pending_bios *pending_bios;
+ 
+-	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) ||
+-	    !device->bdev) {
+-		bio_io_error(bio);
+-		return;
+-	}
+-
+ 	/* don't bother with additional async steps for reads, right now */
+ 	if (bio_op(bio) == REQ_OP_READ) {
+ 		btrfsic_submit_bio(bio);
+@@ -6240,7 +6234,8 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+ 
+ 	for (dev_nr = 0; dev_nr < total_devs; dev_nr++) {
+ 		dev = bbio->stripes[dev_nr].dev;
+-		if (!dev || !dev->bdev ||
++		if (!dev || !dev->bdev || test_bit(BTRFS_DEV_STATE_MISSING,
++						   &dev->dev_state) ||
+ 		    (bio_op(first_bio) == REQ_OP_WRITE &&
+ 		    !test_bit(BTRFS_DEV_STATE_WRITEABLE, &dev->dev_state))) {
+ 			bbio_error(bbio, first_bio, logical);
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-dev-replace-set-result-code-of-cancel-by-statu.patch b/queue-4.19/btrfs-dev-replace-set-result-code-of-cancel-by-statu.patch
new file mode 100644
index 00000000000..014750630f9
--- /dev/null
+++ b/queue-4.19/btrfs-dev-replace-set-result-code-of-cancel-by-statu.patch
@@ -0,0 +1,64 @@
+From 6b2bf4dc9146ed44cedcb351a3c74062040f34e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Nov 2018 22:22:20 +0800
+Subject: btrfs: dev-replace: set result code of cancel by status of scrub
+
+From: Anand Jain <anand.jain@oracle.com>
+
+[ Upstream commit b47dda2ef6d793b67fd5979032dcd106e3f0a5c9 ]
+
+The device-replace needs to check the result code of the scrub workers
+in btrfs_dev_replace_cancel and distinguish if successful cancel
+operation and when the there was no operation running.
+
+If btrfs_scrub_cancel() fails, return
+BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED so that user can try
+to cancel the replace again.
+
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ update changelog ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/dev-replace.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 23b13fbecdc22..96763805787ed 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -810,16 +810,23 @@ int btrfs_dev_replace_cancel(struct btrfs_fs_info *fs_info)
+ 		btrfs_dev_replace_write_unlock(dev_replace);
+ 		break;
+ 	case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+-		result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
+ 		tgt_device = dev_replace->tgtdev;
+ 		src_device = dev_replace->srcdev;
+ 		btrfs_dev_replace_write_unlock(dev_replace);
+-		btrfs_scrub_cancel(fs_info);
+-		/* btrfs_dev_replace_finishing() will handle the cleanup part */
+-		btrfs_info_in_rcu(fs_info,
+-			"dev_replace from %s (devid %llu) to %s canceled",
+-			btrfs_dev_name(src_device), src_device->devid,
+-			btrfs_dev_name(tgt_device));
++		ret = btrfs_scrub_cancel(fs_info);
++		if (ret < 0) {
++			result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED;
++		} else {
++			result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
++			/*
++			 * btrfs_dev_replace_finishing() will handle the
++			 * cleanup part
++			 */
++			btrfs_info_in_rcu(fs_info,
++				"dev_replace from %s (devid %llu) to %s canceled",
++				btrfs_dev_name(src_device), src_device->devid,
++				btrfs_dev_name(tgt_device));
++		}
+ 		break;
+ 	case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
+ 		/*
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-fix-ncopies-raid_attr-for-raid56.patch b/queue-4.19/btrfs-fix-ncopies-raid_attr-for-raid56.patch
new file mode 100644
index 00000000000..82c3aeee54c
--- /dev/null
+++ b/queue-4.19/btrfs-fix-ncopies-raid_attr-for-raid56.patch
@@ -0,0 +1,45 @@
+From 4ad941a54e54c13cef8428a61a9c342a3b7f6f82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 23:24:41 +0200
+Subject: btrfs: fix ncopies raid_attr for RAID56
+
+From: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+
+[ Upstream commit da612e31aee51bd13231c78a47c714b543bd3ad8 ]
+
+RAID5 and RAID6 profile store one copy of the data, not 2 or 3. These
+values are not yet used anywhere so there's no change.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index f84c18e86c816..5bbcdcff68a9e 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -96,7 +96,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ 		.devs_min	= 2,
+ 		.tolerated_failures = 1,
+ 		.devs_increment	= 1,
+-		.ncopies	= 2,
++		.ncopies	= 1,
+ 		.raid_name	= "raid5",
+ 		.bg_flag	= BTRFS_BLOCK_GROUP_RAID5,
+ 		.mindev_error	= BTRFS_ERROR_DEV_RAID5_MIN_NOT_MET,
+@@ -108,7 +108,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ 		.devs_min	= 3,
+ 		.tolerated_failures = 2,
+ 		.devs_increment	= 1,
+-		.ncopies	= 3,
++		.ncopies	= 1,
+ 		.raid_name	= "raid6",
+ 		.bg_flag	= BTRFS_BLOCK_GROUP_RAID6,
+ 		.mindev_error	= BTRFS_ERROR_DEV_RAID6_MIN_NOT_MET,
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch b/queue-4.19/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
new file mode 100644
index 00000000000..5c69a493243
--- /dev/null
+++ b/queue-4.19/btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
@@ -0,0 +1,51 @@
+From 808b97fdab3748d72c72032e1565ec28d8eadc9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 10:20:32 -0500
+Subject: btrfs: only track ref_heads in delayed_ref_updates
+
+From: Josef Bacik <jbacik@fb.com>
+
+[ Upstream commit 158ffa364bf723fa1ef128060646d23dc3942994 ]
+
+We use this number to figure out how many delayed refs to run, but
+__btrfs_run_delayed_refs really only checks every time we need a new
+delayed ref head, so we always run at least one ref head completely no
+matter what the number of items on it.  Fix the accounting to only be
+adjusted when we add/remove a ref head.
+
+In addition to using this number to limit the number of delayed refs
+run, a future patch is also going to use it to calculate the amount of
+space required for delayed refs space reservation.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-ref.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 62ff545ba1f71..7e5c81e80e15d 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -234,8 +234,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ 	ref->in_tree = 0;
+ 	btrfs_put_delayed_ref(ref);
+ 	atomic_dec(&delayed_refs->num_entries);
+-	if (trans->delayed_ref_updates)
+-		trans->delayed_ref_updates--;
+ }
+ 
+ static bool merge_ref(struct btrfs_trans_handle *trans,
+@@ -446,7 +444,6 @@ inserted:
+ 	if (ref->action == BTRFS_ADD_DELAYED_REF)
+ 		list_add_tail(&ref->add_list, &href->ref_add_list);
+ 	atomic_inc(&root->num_entries);
+-	trans->delayed_ref_updates++;
+ 	spin_unlock(&href->lock);
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/bus-ti-sysc-check-for-no-reset-and-no-idle-flags-at-.patch b/queue-4.19/bus-ti-sysc-check-for-no-reset-and-no-idle-flags-at-.patch
new file mode 100644
index 00000000000..dc2d0d65ae3
--- /dev/null
+++ b/queue-4.19/bus-ti-sysc-check-for-no-reset-and-no-idle-flags-at-.patch
@@ -0,0 +1,101 @@
+From b845f1bad28146fbf5c6e12f86897d556722aca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 14:11:26 -0800
+Subject: bus: ti-sysc: Check for no-reset and no-idle flags at the child level
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4014c08ba39476a18af546186da625a6833a1529 ]
+
+With ti-sysc, we need to now have the device tree properties for
+ti,no-reset-on-init and ti,no-idle-on-init at the module level instead
+of the child device level.
+
+Let's check for these properties at the child device level to enable
+quirks, and warn about moving the properties to the module level.
+
+Otherwise am335x-evm based boards tagging gpio1 with ti,no-reset-on-init
+will have their DDR power disabled if wired up in such a tricky way.
+
+Note that this should not be an issue for earlier kernels as we don't
+rely on this until the dts files have been updated to probe with ti-sysc
+interconnect target driver.
+
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index e95b26319cd91..5b31131d0cba2 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -91,6 +91,9 @@ struct sysc {
+ 	struct delayed_work idle_work;
+ };
+ 
++static void sysc_parse_dts_quirks(struct sysc *ddata, struct device_node *np,
++				  bool is_child);
++
+ void sysc_write(struct sysc *ddata, int offset, u32 value)
+ {
+ 	writel_relaxed(value, ddata->module_va + offset);
+@@ -374,6 +377,7 @@ static int sysc_check_one_child(struct sysc *ddata,
+ 		dev_warn(ddata->dev, "really a child ti,hwmods property?");
+ 
+ 	sysc_check_quirk_stdout(ddata, np);
++	sysc_parse_dts_quirks(ddata, np, true);
+ 
+ 	return 0;
+ }
+@@ -1343,23 +1347,37 @@ static const struct sysc_dts_quirk sysc_dts_quirks[] = {
+ 	  .mask = SYSC_QUIRK_NO_RESET_ON_INIT, },
+ };
+ 
+-static int sysc_init_dts_quirks(struct sysc *ddata)
++static void sysc_parse_dts_quirks(struct sysc *ddata, struct device_node *np,
++				  bool is_child)
+ {
+-	struct device_node *np = ddata->dev->of_node;
+ 	const struct property *prop;
+-	int i, len, error;
+-	u32 val;
+-
+-	ddata->legacy_mode = of_get_property(np, "ti,hwmods", NULL);
++	int i, len;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(sysc_dts_quirks); i++) {
+-		prop = of_get_property(np, sysc_dts_quirks[i].name, &len);
++		const char *name = sysc_dts_quirks[i].name;
++
++		prop = of_get_property(np, name, &len);
+ 		if (!prop)
+ 			continue;
+ 
+ 		ddata->cfg.quirks |= sysc_dts_quirks[i].mask;
++		if (is_child) {
++			dev_warn(ddata->dev,
++				 "dts flag should be at module level for %s\n",
++				 name);
++		}
+ 	}
++}
++
++static int sysc_init_dts_quirks(struct sysc *ddata)
++{
++	struct device_node *np = ddata->dev->of_node;
++	int error;
++	u32 val;
++
++	ddata->legacy_mode = of_get_property(np, "ti,hwmods", NULL);
+ 
++	sysc_parse_dts_quirks(ddata, np, false);
+ 	error = of_property_read_u32(np, "ti,sysc-delay-us", &val);
+ 	if (!error) {
+ 		if (val > 255) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch b/queue-4.19/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
new file mode 100644
index 00000000000..098e69b6fba
--- /dev/null
+++ b/queue-4.19/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
@@ -0,0 +1,79 @@
+From 5f3362165c70b9bca869cf00a6640b8a86dc37c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:01:20 +0000
+Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on
+ open
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]
+
+When the CAN interface is closed it the hardwre is put in power down
+mode, but does not reset the error counters / state. Reset the D_CAN on
+open, so the reported state and the actual state match.
+
+According to [1], the C_CAN module doesn't have the software reset.
+
+[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 9b61bfbea6cd1..24c6015f6c92b 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR		BIT(8)
+ 
+ /* control register */
++#define CONTROL_SWR		BIT(15)
+ #define CONTROL_TEST		BIT(7)
+ #define CONTROL_CCE		BIT(6)
+ #define CONTROL_DISABLE_AR	BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ 				   IF_MCONT_RCV_EOB);
+ }
+ 
++static int c_can_software_reset(struct net_device *dev)
++{
++	struct c_can_priv *priv = netdev_priv(dev);
++	int retry = 0;
++
++	if (priv->type != BOSCH_D_CAN)
++		return 0;
++
++	priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++	while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++		msleep(20);
++		if (retry++ > 100) {
++			netdev_err(dev, "CCTRL: software reset failed\n");
++			return -EIO;
++		}
++	}
++
++	return 0;
++}
++
+ /*
+  * Configure C_CAN chip:
+  * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ 	struct c_can_priv *priv = netdev_priv(dev);
++	int err;
++
++	err = c_can_software_reset(dev);
++	if (err)
++		return err;
+ 
+ 	/* enable automatic retransmission */
+ 	priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-flexcan-increase-error-counters-if-skb-enqueuein.patch b/queue-4.19/can-flexcan-increase-error-counters-if-skb-enqueuein.patch
new file mode 100644
index 00000000000..496d61c94d4
--- /dev/null
+++ b/queue-4.19/can-flexcan-increase-error-counters-if-skb-enqueuein.patch
@@ -0,0 +1,72 @@
+From 5160836108e8c6695172df7b1b8c6650fedb7afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 20:53:08 +0200
+Subject: can: flexcan: increase error counters if skb enqueueing via
+ can_rx_offload_queue_sorted() fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 758124335a9dd649ab820bfb5b328170919ee7dc ]
+
+The call to can_rx_offload_queue_sorted() may fail and return an error
+(in the current implementation due to resource shortage). The passed skb
+is consumed.
+
+This patch adds incrementing of the appropriate error counters to let
+the device statistics reflect that there's a problem.
+
+Reported-by: Martin Hundebøll <martin@geanix.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 581e84d8e2c89..bfe13c6627bed 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -566,6 +566,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ 	struct can_frame *cf;
+ 	bool rx_errors = false, tx_errors = false;
+ 	u32 timestamp;
++	int err;
+ 
+ 	timestamp = priv->read(&regs->timer) << 16;
+ 
+@@ -614,7 +615,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ 	if (tx_errors)
+ 		dev->stats.tx_errors++;
+ 
+-	can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++	err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++	if (err)
++		dev->stats.rx_fifo_errors++;
+ }
+ 
+ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+@@ -627,6 +630,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ 	int flt;
+ 	struct can_berr_counter bec;
+ 	u32 timestamp;
++	int err;
+ 
+ 	timestamp = priv->read(&regs->timer) << 16;
+ 
+@@ -658,7 +662,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ 	if (unlikely(new_state == CAN_STATE_BUS_OFF))
+ 		can_bus_off(dev);
+ 
+-	can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++	err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++	if (err)
++		dev->stats.rx_fifo_errors++;
+ }
+ 
+ static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch b/queue-4.19/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch
new file mode 100644
index 00000000000..92585b81348
--- /dev/null
+++ b/queue-4.19/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch
@@ -0,0 +1,50 @@
+From 7480c68a87d09ff53286a546fbd191c83fe466b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 15:38:19 +0200
+Subject: can: mcp251x: mcp251x_restart_work_handler(): Fix potential
+ force_quit race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timo Schlüßler <schluessler@krause.de>
+
+[ Upstream commit 27a0e54bae09d2dd023a01254db506d61cc50ba1 ]
+
+In mcp251x_restart_work_handler() the variable to stop the interrupt
+handler (priv->force_quit) is reset after the chip is restarted and thus
+a interrupt might occur.
+
+This patch fixes the potential race condition by resetting force_quit
+before enabling interrupts.
+
+Signed-off-by: Timo Schlüßler <schluessler@krause.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index de8d9dceb1236..0b0dd3f096dc6 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -773,6 +773,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ 	if (priv->after_suspend) {
+ 		mcp251x_hw_reset(spi);
+ 		mcp251x_setup(net, spi);
++		priv->force_quit = 0;
+ 		if (priv->after_suspend & AFTER_SUSPEND_RESTART) {
+ 			mcp251x_set_normal_mode(spi);
+ 		} else if (priv->after_suspend & AFTER_SUSPEND_UP) {
+@@ -784,7 +785,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ 			mcp251x_hw_sleep(spi);
+ 		}
+ 		priv->after_suspend = 0;
+-		priv->force_quit = 0;
+ 	}
+ 
+ 	if (priv->restart_tx) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-peak_usb-report-bus-recovery-as-well.patch b/queue-4.19/can-peak_usb-report-bus-recovery-as-well.patch
new file mode 100644
index 00000000000..a28f127d2df
--- /dev/null
+++ b/queue-4.19/can-peak_usb-report-bus-recovery-as-well.patch
@@ -0,0 +1,67 @@
+From 93e660f1d26923b0292c958947ea2b6085fefcf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 08:58:45 +0000
+Subject: can: peak_usb: report bus recovery as well
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]
+
+While the state changes are reported when the error counters increase
+and decrease, there is no event when the bus recovers and the error
+counters decrease again. So add those as well.
+
+Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
+ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Cc: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index 61f33c2fb1cd7..215cd74800df4 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -444,8 +444,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ 		}
+ 		if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ 			/* no error (back to active state) */
+-			mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+-			return 0;
++			new_state = CAN_STATE_ERROR_ACTIVE;
++			break;
+ 		}
+ 		break;
+ 
+@@ -468,9 +468,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ 		}
+ 
+ 		if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+-			/* no error (back to active state) */
+-			mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+-			return 0;
++			/* no error (back to warning state) */
++			new_state = CAN_STATE_ERROR_WARNING;
++			break;
+ 		}
+ 		break;
+ 
+@@ -509,6 +509,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ 		mc->pdev->dev.can.can_stats.error_warning++;
+ 		break;
+ 
++	case CAN_STATE_ERROR_ACTIVE:
++		cf->can_id |= CAN_ERR_CRTL;
++		cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++		break;
++
+ 	default:
+ 		/* CAN_STATE_MAX (trick to handle other errors) */
+ 		cf->can_id |= CAN_ERR_CRTL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch b/queue-4.19/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
new file mode 100644
index 00000000000..b8a903ab976
--- /dev/null
+++ b/queue-4.19/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
@@ -0,0 +1,55 @@
+From d55e4481a4ddba4ceac6f3cb1dc859c28d960f0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+If the hardware FIFO is empty can_rx_offload_offload_one() will return
+NULL.
+
+In case a CAN frame was read from the hardware,
+can_rx_offload_offload_one() returns the skb containing it.
+
+Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb
+returned, regardless of the reason.
+
+Similar to can_rx_offload_irq_offload_timestamp() in case of a resource
+shortage the whole FIFO should be discarded, to avoid an IRQ storm and
+give the system some time to recover. However if the FIFO is empty the
+loop can be left.
+
+With this patch the loop is left in case of empty FIFO, but not on
+errors.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 0dded7a1067bb..5f7e97d54733c 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -257,7 +257,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ 
+ 	while (1) {
+ 		skb = can_rx_offload_offload_one(offload, 0);
+-		if (IS_ERR_OR_NULL(skb))
++		if (IS_ERR(skb))
++			continue;
++		if (!skb)
+ 			break;
+ 
+ 		skb_queue_tail(&offload->skb_queue, skb);
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch b/queue-4.19/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
new file mode 100644
index 00000000000..6a8d6ae6a37
--- /dev/null
+++ b/queue-4.19/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
@@ -0,0 +1,46 @@
+From 194349dfe4403f5ea48fbdde8f385f38b6661841 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on
+ error
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+However can_rx_offload_irq_offload_timestamp() bails out in the error
+case. In case of a resource shortage all mailboxes should be discarded,
+to avoid an IRQ storm and give the system some time to recover.
+
+Since can_rx_offload_irq_offload_timestamp() is typically called from a
+while loop, all message will eventually be discarded. So let's continue
+on error instead to discard them directly.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 1b3ce70c55bc7..0dded7a1067bb 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -225,7 +225,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+ 
+ 		skb = can_rx_offload_offload_one(offload, i);
+ 		if (IS_ERR_OR_NULL(skb))
+-			break;
++			continue;
+ 
+ 		__skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch b/queue-4.19/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
new file mode 100644
index 00000000000..df0f551b2b8
--- /dev/null
+++ b/queue-4.19/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
@@ -0,0 +1,43 @@
+From b4b85b4349dff567b126d8c448fc4eeb167ed2d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 16:03:18 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): do not increase the
+ skb_queue beyond skb_queue_len_max
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ]
+
+The skb_queue is a linked list, holding the skb to be processed in the
+next NAPI call.
+
+Without this patch, the queue length in can_rx_offload_offload_one() is
+limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no
+array or other resources are accessed out-of-bound, however this
+behaviour is counterintuitive.
+
+This patch limits the rx-offload skb_queue length to skb_queue_len_max.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index a90005eac8b17..e32b65599a5f2 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -124,7 +124,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+ 	int ret;
+ 
+ 	/* If queue is full or skb not available, read to discard mailbox */
+-	if (likely(skb_queue_len(&offload->skb_queue) <=
++	if (likely(skb_queue_len(&offload->skb_queue) <
+ 		   offload->skb_queue_len_max))
+ 		skb = alloc_can_skb(offload->dev, &cf);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-rx-offload-can_rx_offload_offload_one-increment-.patch b/queue-4.19/can-rx-offload-can_rx_offload_offload_one-increment-.patch
new file mode 100644
index 00000000000..0db68141bff
--- /dev/null
+++ b/queue-4.19/can-rx-offload-can_rx_offload_offload_one-increment-.patch
@@ -0,0 +1,40 @@
+From aff372608ba6b1ac02ebe1c920d9e9f422d4a3fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:15:07 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): increment
+ rx_fifo_errors on queue overflow or OOM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ]
+
+If the rx-offload skb_queue is full or the skb allocation fails (due to OOM),
+the mailbox contents is discarded.
+
+This patch adds the incrementing of the rx_fifo_errors statistics counter.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index e32b65599a5f2..16af09c71cfed 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -134,8 +134,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+ 
+ 		ret = offload->mailbox_read(offload, &cf_overflow,
+ 					    &timestamp, n);
+-		if (ret)
++		if (ret) {
+ 			offload->dev->stats.rx_dropped++;
++			offload->dev->stats.rx_fifo_errors++;
++		}
+ 
+ 		return NULL;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch b/queue-4.19/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
new file mode 100644
index 00000000000..42576f65462
--- /dev/null
+++ b/queue-4.19/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
@@ -0,0 +1,166 @@
+From 74a2ebebd4ce00d8ee5cfef153cf34c408f73e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 21:00:32 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to
+ propagate error value in case of errors
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ]
+
+Before this patch can_rx_offload_offload_one() returns a pointer to a
+skb containing the read CAN frame or a NULL pointer.
+
+However the meaning of the NULL pointer is ambiguous, it can either mean
+the requested mailbox is empty or there was an error.
+
+This patch fixes this situation by returning:
+- pointer to skb on success
+- NULL pointer if mailbox is empty
+- ERR_PTR() in case of an error
+
+All users of can_rx_offload_offload_one() have been adopted, no
+functional change intended.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------
+ 1 file changed, 73 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 16af09c71cfed..1b3ce70c55bc7 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -116,39 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
+ 	return cb_b->timestamp - cb_a->timestamp;
+ }
+ 
+-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
++/**
++ * can_rx_offload_offload_one() - Read one CAN frame from HW
++ * @offload: pointer to rx_offload context
++ * @n: number of mailbox to read
++ *
++ * The task of this function is to read a CAN frame from mailbox @n
++ * from the device and return the mailbox's content as a struct
++ * sk_buff.
++ *
++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
++ * allocated, the mailbox contents is discarded by reading it into an
++ * overflow buffer. This way the mailbox is marked as free by the
++ * driver.
++ *
++ * Return: A pointer to skb containing the CAN frame on success.
++ *
++ *         NULL if the mailbox @n is empty.
++ *
++ *         ERR_PTR() in case of an error
++ */
++static struct sk_buff *
++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+ {
+-	struct sk_buff *skb = NULL;
++	struct sk_buff *skb = NULL, *skb_error = NULL;
+ 	struct can_rx_offload_cb *cb;
+ 	struct can_frame *cf;
+ 	int ret;
+ 
+-	/* If queue is full or skb not available, read to discard mailbox */
+ 	if (likely(skb_queue_len(&offload->skb_queue) <
+-		   offload->skb_queue_len_max))
++		   offload->skb_queue_len_max)) {
+ 		skb = alloc_can_skb(offload->dev, &cf);
++		if (unlikely(!skb))
++			skb_error = ERR_PTR(-ENOMEM);	/* skb alloc failed */
++	} else {
++		skb_error = ERR_PTR(-ENOBUFS);		/* skb_queue is full */
++	}
+ 
+-	if (!skb) {
++	/* If queue is full or skb not available, drop by reading into
++	 * overflow buffer.
++	 */
++	if (unlikely(skb_error)) {
+ 		struct can_frame cf_overflow;
+ 		u32 timestamp;
+ 
+ 		ret = offload->mailbox_read(offload, &cf_overflow,
+ 					    &timestamp, n);
+-		if (ret) {
+-			offload->dev->stats.rx_dropped++;
+-			offload->dev->stats.rx_fifo_errors++;
+-		}
+ 
+-		return NULL;
++		/* Mailbox was empty. */
++		if (unlikely(!ret))
++			return NULL;
++
++		/* Mailbox has been read and we're dropping it or
++		 * there was a problem reading the mailbox.
++		 *
++		 * Increment error counters in any case.
++		 */
++		offload->dev->stats.rx_dropped++;
++		offload->dev->stats.rx_fifo_errors++;
++
++		/* There was a problem reading the mailbox, propagate
++		 * error value.
++		 */
++		if (unlikely(ret < 0))
++			return ERR_PTR(ret);
++
++		return skb_error;
+ 	}
+ 
+ 	cb = can_rx_offload_get_cb(skb);
+ 	ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
+-	if (!ret) {
++
++	/* Mailbox was empty. */
++	if (unlikely(!ret)) {
+ 		kfree_skb(skb);
+ 		return NULL;
+ 	}
+ 
++	/* There was a problem reading the mailbox, propagate error value. */
++	if (unlikely(ret < 0)) {
++		kfree_skb(skb);
++
++		offload->dev->stats.rx_dropped++;
++		offload->dev->stats.rx_fifo_errors++;
++
++		return ERR_PTR(ret);
++	}
++
++	/* Mailbox was read. */
+ 	return skb;
+ }
+ 
+@@ -168,7 +224,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+ 			continue;
+ 
+ 		skb = can_rx_offload_offload_one(offload, i);
+-		if (!skb)
++		if (IS_ERR_OR_NULL(skb))
+ 			break;
+ 
+ 		__skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+@@ -199,7 +255,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ 	struct sk_buff *skb;
+ 	int received = 0;
+ 
+-	while ((skb = can_rx_offload_offload_one(offload, 0))) {
++	while (1) {
++		skb = can_rx_offload_offload_one(offload, 0);
++		if (IS_ERR_OR_NULL(skb))
++			break;
++
+ 		skb_queue_tail(&offload->skb_queue, skb);
+ 		received++;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch b/queue-4.19/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
new file mode 100644
index 00000000000..70b068edcf6
--- /dev/null
+++ b/queue-4.19/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
@@ -0,0 +1,51 @@
+From 9db0d9e8f05b788305082a7562a1d0a0de13891d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:48:48 +0200
+Subject: can: rx-offload: can_rx_offload_queue_tail(): fix error handling,
+ avoid skb mem leak
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ]
+
+If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not
+queue the skb and return with an error.
+
+This patch frees the skb in case of a full queue, which brings
+can_rx_offload_queue_tail() in line with the
+can_rx_offload_queue_sorted() function, which has been adjusted in the
+previous patch.
+
+The return value is adjusted to -ENOBUFS to better reflect the actual
+problem.
+
+The device stats handling is left to the caller.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Reported-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 6cf0d0bc1e8d6..a90005eac8b17 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -261,8 +261,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+ 			      struct sk_buff *skb)
+ {
+ 	if (skb_queue_len(&offload->skb_queue) >
+-	    offload->skb_queue_len_max)
+-		return -ENOMEM;
++	    offload->skb_queue_len_max) {
++		kfree_skb(skb);
++		return -ENOBUFS;
++	}
+ 
+ 	skb_queue_tail(&offload->skb_queue, skb);
+ 	can_rx_offload_schedule(offload);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch b/queue-4.19/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
new file mode 100644
index 00000000000..5d2a58a95a1
--- /dev/null
+++ b/queue-4.19/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
@@ -0,0 +1,65 @@
+From 97bc2c789cd20a78bd15908bb1cb271625c56e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 09:39:32 -0500
+Subject: ceph: return -EINVAL if given fsc mount option on kernel w/o support
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ]
+
+If someone requests fscache on the mount, and the kernel doesn't
+support it, it should fail the mount.
+
+[ Drop ceph prefix -- it's provided by pr_err. ]
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/super.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index ccab249a37f6a..2bd0b1ed9708e 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -248,6 +248,7 @@ static int parse_fsopt_token(char *c, void *private)
+ 			return -ENOMEM;
+ 		break;
+ 	case Opt_fscache_uniq:
++#ifdef CONFIG_CEPH_FSCACHE
+ 		kfree(fsopt->fscache_uniq);
+ 		fsopt->fscache_uniq = kstrndup(argstr[0].from,
+ 					       argstr[0].to-argstr[0].from,
+@@ -256,7 +257,10 @@ static int parse_fsopt_token(char *c, void *private)
+ 			return -ENOMEM;
+ 		fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ 		break;
+-		/* misc */
++#else
++		pr_err("fscache support is disabled\n");
++		return -EINVAL;
++#endif
+ 	case Opt_wsize:
+ 		if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
+ 			return -EINVAL;
+@@ -328,10 +332,15 @@ static int parse_fsopt_token(char *c, void *private)
+ 		fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
+ 		break;
+ 	case Opt_fscache:
++#ifdef CONFIG_CEPH_FSCACHE
+ 		fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ 		kfree(fsopt->fscache_uniq);
+ 		fsopt->fscache_uniq = NULL;
+ 		break;
++#else
++		pr_err("fscache support is disabled\n");
++		return -EINVAL;
++#endif
+ 	case Opt_nofscache:
+ 		fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
+ 		kfree(fsopt->fscache_uniq);
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-at91-avoid-sleeping-early.patch b/queue-4.19/clk-at91-avoid-sleeping-early.patch
new file mode 100644
index 00000000000..2dd99df90aa
--- /dev/null
+++ b/queue-4.19/clk-at91-avoid-sleeping-early.patch
@@ -0,0 +1,104 @@
+From 95ad497031488bd8c5cf50b3275b565014ebe7b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 17:39:06 +0200
+Subject: clk: at91: avoid sleeping early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ]
+
+It is not allowed to sleep to early in the boot process and this may lead
+to kernel issues if the bootloader didn't prepare the slow clock and main
+clock.
+
+This results in the following error and dump stack on the AriettaG25:
+   bad: scheduling from the idle thread!
+
+Ensure it is possible to sleep, else simply have a delay.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
+Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
+Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-main.c |  5 ++++-
+ drivers/clk/at91/sckc.c     | 20 ++++++++++++++++----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 2f97a843d6d6b..fb5c14af8cc8d 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
+ 		regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
+ 		if (mcfr & AT91_PMC_MAINRDY)
+ 			return 0;
+-		usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
++		if (system_state < SYSTEM_RUNNING)
++			udelay(MAINF_LOOP_MIN_WAIT);
++		else
++			usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ 	} while (time_before(prep_time, timeout));
+ 
+ 	return -ETIMEDOUT;
+diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
+index ab6ecefc49ad8..43ba2a8b03faf 100644
+--- a/drivers/clk/at91/sckc.c
++++ b/drivers/clk/at91/sckc.c
+@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
+ 
+ 	writel(tmp | AT91_SCKC_OSC32EN, sckcr);
+ 
+-	usleep_range(osc->startup_usec, osc->startup_usec + 1);
++	if (system_state < SYSTEM_RUNNING)
++		udelay(osc->startup_usec);
++	else
++		usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ 
+ 	return 0;
+ }
+@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
+ 
+ 	writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr);
+ 
+-	usleep_range(osc->startup_usec, osc->startup_usec + 1);
++	if (system_state < SYSTEM_RUNNING)
++		udelay(osc->startup_usec);
++	else
++		usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ 
+ 	return 0;
+ }
+@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
+ 
+ 	writel(tmp, sckcr);
+ 
+-	usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
++	if (system_state < SYSTEM_RUNNING)
++		udelay(SLOWCK_SW_TIME_USEC);
++	else
++		usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+ 
+ 	return 0;
+ }
+@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
+ 		return 0;
+ 	}
+ 
+-	usleep_range(osc->startup_usec, osc->startup_usec + 1);
++	if (system_state < SYSTEM_RUNNING)
++		udelay(osc->startup_usec);
++	else
++		usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ 	osc->prepared = true;
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch b/queue-4.19/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
new file mode 100644
index 00000000000..0501328058e
--- /dev/null
+++ b/queue-4.19/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
@@ -0,0 +1,41 @@
+From 53d673e4866446ac06b88c6c60ce49e5c0e000eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Sep 2019 17:04:11 +0200
+Subject: clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ]
+
+The meson-saradc driver manually sets the input clock for
+sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB,
+GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up
+to sar_adc_clk_sel which will let the common clock framework select the
+best matching parent clock if we want that.
+
+This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk
+drivers, which both also specify CLK_SET_RATE_PARENT.
+
+Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 4d4f6d842c31c..d94b65061b9f1 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -836,6 +836,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = {
+ 		.ops = &clk_regmap_divider_ops,
+ 		.parent_names = (const char *[]){ "sar_adc_clk_sel" },
+ 		.num_parents = 1,
++		.flags = CLK_SET_RATE_PARENT,
+ 	},
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-samsung-exynos5420-preserve-pll-configuration-du.patch b/queue-4.19/clk-samsung-exynos5420-preserve-pll-configuration-du.patch
new file mode 100644
index 00000000000..edce2c7d5b0
--- /dev/null
+++ b/queue-4.19/clk-samsung-exynos5420-preserve-pll-configuration-du.patch
@@ -0,0 +1,51 @@
+From f5725926d33b470e722f08f37fe03c6556c28cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:02:01 +0200
+Subject: clk: samsung: exynos5420: Preserve PLL configuration during
+ suspend/resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]
+
+Properly save and restore all top PLL related configuration registers
+during suspend/resume cycle. So far driver only handled EPLL and RPLL
+clocks, all other were reset to default values after suspend/resume cycle.
+This caused for example lower G3D (MALI Panfrost) performance after system
+resume, even if performance governor has been selected.
+
+Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index ce30862617a6e..d5af937212992 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -171,12 +171,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ 	GATE_BUS_CPU,
+ 	GATE_SCLK_CPU,
+ 	CLKOUT_CMU_CPU,
++	CPLL_CON0,
++	DPLL_CON0,
+ 	EPLL_CON0,
+ 	EPLL_CON1,
+ 	EPLL_CON2,
+ 	RPLL_CON0,
+ 	RPLL_CON1,
+ 	RPLL_CON2,
++	IPLL_CON0,
++	SPLL_CON0,
++	VPLL_CON0,
++	MPLL_CON0,
+ 	SRC_TOP0,
+ 	SRC_TOP1,
+ 	SRC_TOP2,
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-samsung-exynos5433-fix-error-paths.patch b/queue-4.19/clk-samsung-exynos5433-fix-error-paths.patch
new file mode 100644
index 00000000000..92f7d23023b
--- /dev/null
+++ b/queue-4.19/clk-samsung-exynos5433-fix-error-paths.patch
@@ -0,0 +1,71 @@
+From 669247e5c03e505172f6453e39447a46cba1e0ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 10:53:09 +0200
+Subject: clk: samsung: exynos5433: Fix error paths
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit faac3604d05e8015567124e5ee79edc3f1568a89 ]
+
+Add checking the value returned by samsung_clk_alloc_reg_dump() and
+devm_kcalloc(). While fixing this, also release all gathered clocks.
+
+Fixes: 523d3de41f02 ("clk: samsung: exynos5433: Add support for runtime PM")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+[s.nawrocki: squashed patch from K. Kozlowski adding missing slab.h header]
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5433.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 426980514e679..302596dc79a2c 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -16,6 +16,7 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
++#include <linux/slab.h>
+ 
+ #include <dt-bindings/clock/exynos5433.h>
+ 
+@@ -5527,6 +5528,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+ 
+ 	data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs,
+ 						    info->nr_clk_regs);
++	if (!data->clk_save)
++		return -ENOMEM;
+ 	data->nr_clk_save = info->nr_clk_regs;
+ 	data->clk_suspend = info->suspend_regs;
+ 	data->nr_clk_suspend = info->nr_suspend_regs;
+@@ -5535,12 +5538,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+ 	if (data->nr_pclks > 0) {
+ 		data->pclks = devm_kcalloc(dev, sizeof(struct clk *),
+ 					   data->nr_pclks, GFP_KERNEL);
+-
++		if (!data->pclks) {
++			kfree(data->clk_save);
++			return -ENOMEM;
++		}
+ 		for (i = 0; i < data->nr_pclks; i++) {
+ 			struct clk *clk = of_clk_get(dev->of_node, i);
+ 
+-			if (IS_ERR(clk))
++			if (IS_ERR(clk)) {
++				kfree(data->clk_save);
++				while (--i >= 0)
++					clk_put(data->pclks[i]);
+ 				return PTR_ERR(clk);
++			}
+ 			data->pclks[i] = clk;
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch b/queue-4.19/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch
new file mode 100644
index 00000000000..80ddd311f63
--- /dev/null
+++ b/queue-4.19/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch
@@ -0,0 +1,61 @@
+From c0248dc4a7e7a6ffcfd3fdac2ec3fe96b1ad1eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 09:50:54 -0700
+Subject: clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit afdc74ed2d57e86c10b1d6831339770a802bab9a ]
+
+r375326 in Clang exposes an issue with operator precedence in
+sunxi_div_clk_setup:
+
+drivers/clk/sunxi/clk-sunxi.c:1083:30: warning: operator '?:' has lower
+precedence than '|'; '|' will be evaluated first
+[-Wbitwise-conditional-parentheses]
+                                                 data->div[i].critical ?
+                                                 ~~~~~~~~~~~~~~~~~~~~~ ^
+drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
+the '|' expression to silence this warning
+                                                 data->div[i].critical ?
+                                                                       ^
+                                                                      )
+drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
+the '?:' expression to evaluate it first
+                                                 data->div[i].critical ?
+                                                                       ^
+                                                 (
+1 warning generated.
+
+It appears that the intention was for ?: to be evaluated first so that
+CLK_IS_CRITICAL could be added to clkflags if the critical boolean was
+set; right now, | is being evaluated first. Add parentheses around the
+?: block to have it be evaluated first.
+
+Fixes: 9919d44ff297 ("clk: sunxi: Use CLK_IS_CRITICAL flag for critical clks")
+Link: https://github.com/ClangBuiltLinux/linux/issues/745
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi/clk-sunxi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index 012714d94b429..004b411b640b3 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -1086,8 +1086,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node,
+ 						 rate_hw, rate_ops,
+ 						 gate_hw, &clk_gate_ops,
+ 						 clkflags |
+-						 data->div[i].critical ?
+-							CLK_IS_CRITICAL : 0);
++						 (data->div[i].critical ?
++							CLK_IS_CRITICAL : 0));
+ 
+ 		WARN_ON(IS_ERR(clk_data->clks[i]));
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch b/queue-4.19/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
new file mode 100644
index 00000000000..7cd0d8b32aa
--- /dev/null
+++ b/queue-4.19/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
@@ -0,0 +1,39 @@
+From 12d2d0806b278de5017980a0957e4bea385e93dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 12:28:09 +0100
+Subject: clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ]
+
+The zero'ing of bits 16 and 18 is incorrect. Currently the code
+is masking with the bitwise-and of BIT(16) & BIT(18) which is
+0, so the updated value for val is always zero. Fix this by bitwise
+and-ing value with the correct mask that will zero bits 16 and 18.
+
+Addresses-Coverity: (" Suspicious &= or |= constant expression")
+Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+index 8936ef87652c0..c14bf782b2b33 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
+ 
+ 	/* Enforce d1 = 0, d2 = 0 for Audio PLL */
+ 	val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
+-	val &= (BIT(16) & BIT(18));
++	val &= ~(BIT(16) | BIT(18));
+ 	writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
+ 
+ 	/* Enforce P = 1 for both CPU cluster PLLs */
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch b/queue-4.19/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch
new file mode 100644
index 00000000000..3e68eb2f157
--- /dev/null
+++ b/queue-4.19/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch
@@ -0,0 +1,56 @@
+From b8bedcdf3e808f04e47cb73b4f4d6518f9f65a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 08:40:01 -0700
+Subject: clk: ti: clkctrl: Fix failed to enable error with double udelay
+ timeout
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 81a41901ffd46bac6df4c95b8290ac259e0feda8 ]
+
+Commit 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if
+timekeeping is suspended") added handling for cases when timekeeping is
+suspended. But looks like we can still get occasional "failed to enable"
+errors on the PM runtime resume path with udelay() returning faster than
+expected.
+
+With ti-sysc interconnect target module driver this leads into device
+failure with PM runtime failing with "failed to enable" clkctrl error.
+
+Let's fix the issue with a delay of two times the desired delay as in
+often done for udelay() to account for the inaccuracy.
+
+Fixes: 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if timekeeping is suspended")
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lkml.kernel.org/r/20190930154001.46581-1-tony@atomide.com
+Tested-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clkctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index dfaa5aad06927..2c2564acad227 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout)
+ 	 * can be from a timer that requires pm_runtime access, which
+ 	 * will eventually bring us here with timekeeping_suspended,
+ 	 * during both suspend entry and resume paths. This happens
+-	 * at least on am43xx platform.
++	 * at least on am43xx platform. Account for flakeyness
++	 * with udelay() by multiplying the timeout value by 2.
+ 	 */
+ 	if (unlikely(_early_timeout || timekeeping_suspended)) {
+ 		if (time->cycles++ < timeout) {
+-			udelay(1);
++			udelay(1 * 2);
+ 			return false;
+ 		}
+ 	} else {
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch b/queue-4.19/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
new file mode 100644
index 00000000000..b1c26abafff
--- /dev/null
+++ b/queue-4.19/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
@@ -0,0 +1,47 @@
+From b5c1305e5f18ea811c3048ffcd50c627f7e75f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 11:34:36 +0300
+Subject: clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ]
+
+ti_clk_register() calls it already so the driver should not create
+duplicated alias.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-dra7-atl.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 1488154704313..beb672a215b6c 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ 	struct clk_init_data init = { NULL };
+ 	const char **parent_names = NULL;
+ 	struct clk *clk;
+-	int ret;
+ 
+ 	clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
+ 	if (!clk_hw) {
+@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ 	clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
+ 
+ 	if (!IS_ERR(clk)) {
+-		ret = ti_clk_add_alias(NULL, clk, node->name);
+-		if (ret) {
+-			clk_unregister(clk);
+-			goto cleanup;
+-		}
+ 		of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ 		kfree(parent_names);
+ 		return;
+-- 
+2.20.1
+
diff --git a/queue-4.19/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch b/queue-4.19/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch
new file mode 100644
index 00000000000..c008dc0cc23
--- /dev/null
+++ b/queue-4.19/clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch
@@ -0,0 +1,206 @@
+From 8406524c0657182537feaf10b64dc2b38f3597ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:53:50 -0700
+Subject: clocksource/drivers/fttmr010: Fix invalid interrupt register access
+
+From: Tao Ren <taoren@fb.com>
+
+[ Upstream commit 86fe57fc47b17b3528fa5497fc57e158d846c4ea ]
+
+TIMER_INTR_MASK register (Base Address of Timer + 0x38) is not designed
+for masking interrupts on ast2500 chips, and it's not even listed in
+ast2400 datasheet, so it's not safe to access TIMER_INTR_MASK on aspeed
+chips.
+
+Similarly, TIMER_INTR_STATE register (Base Address of Timer + 0x34) is
+not interrupt status register on ast2400 and ast2500 chips. Although
+there is no side effect to reset the register in fttmr010_common_init(),
+it's just misleading to do so.
+
+Besides, "count_down" is renamed to "is_aspeed" in "fttmr010" structure,
+and more comments are added so the code is more readble.
+
+Signed-off-by: Tao Ren <taoren@fb.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-fttmr010.c | 73 ++++++++++++++++------------
+ 1 file changed, 42 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
+index cf93f6419b514..fadff7915dd9c 100644
+--- a/drivers/clocksource/timer-fttmr010.c
++++ b/drivers/clocksource/timer-fttmr010.c
+@@ -21,7 +21,7 @@
+ #include <linux/delay.h>
+ 
+ /*
+- * Register definitions for the timers
++ * Register definitions common for all the timer variants.
+  */
+ #define TIMER1_COUNT		(0x00)
+ #define TIMER1_LOAD		(0x04)
+@@ -36,9 +36,10 @@
+ #define TIMER3_MATCH1		(0x28)
+ #define TIMER3_MATCH2		(0x2c)
+ #define TIMER_CR		(0x30)
+-#define TIMER_INTR_STATE	(0x34)
+-#define TIMER_INTR_MASK		(0x38)
+ 
++/*
++ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers.
++ */
+ #define TIMER_1_CR_ENABLE	BIT(0)
+ #define TIMER_1_CR_CLOCK	BIT(1)
+ #define TIMER_1_CR_INT		BIT(2)
+@@ -53,8 +54,9 @@
+ #define TIMER_3_CR_UPDOWN	BIT(11)
+ 
+ /*
+- * The Aspeed AST2400 moves bits around in the control register
+- * and lacks bits for setting the timer to count upwards.
++ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers.
++ * The aspeed timers move bits around in the control register and lacks
++ * bits for setting the timer to count upwards.
+  */
+ #define TIMER_1_CR_ASPEED_ENABLE	BIT(0)
+ #define TIMER_1_CR_ASPEED_CLOCK		BIT(1)
+@@ -66,6 +68,18 @@
+ #define TIMER_3_CR_ASPEED_CLOCK		BIT(9)
+ #define TIMER_3_CR_ASPEED_INT		BIT(10)
+ 
++/*
++ * Interrupt status/mask register definitions for fttmr010/gemini/moxart
++ * timers.
++ * The registers don't exist and they are not needed on aspeed timers
++ * because:
++ *   - aspeed timer overflow interrupt is controlled by bits in Control
++ *     Register (TMC30).
++ *   - aspeed timers always generate interrupt when either one of the
++ *     Match registers equals to Status register.
++ */
++#define TIMER_INTR_STATE	(0x34)
++#define TIMER_INTR_MASK		(0x38)
+ #define TIMER_1_INT_MATCH1	BIT(0)
+ #define TIMER_1_INT_MATCH2	BIT(1)
+ #define TIMER_1_INT_OVERFLOW	BIT(2)
+@@ -80,7 +94,7 @@
+ struct fttmr010 {
+ 	void __iomem *base;
+ 	unsigned int tick_rate;
+-	bool count_down;
++	bool is_aspeed;
+ 	u32 t1_enable_val;
+ 	struct clock_event_device clkevt;
+ #ifdef CONFIG_ARM
+@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles,
+ 	cr &= ~fttmr010->t1_enable_val;
+ 	writel(cr, fttmr010->base + TIMER_CR);
+ 
+-	if (fttmr010->count_down) {
++	if (fttmr010->is_aspeed) {
+ 		/*
+ 		 * ASPEED Timer Controller will load TIMER1_LOAD register
+ 		 * into TIMER1_COUNT register when the timer is re-enabled.
+@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt)
+ 
+ 	/* Setup counter start from 0 or ~0 */
+ 	writel(0, fttmr010->base + TIMER1_COUNT);
+-	if (fttmr010->count_down)
++	if (fttmr010->is_aspeed) {
+ 		writel(~0, fttmr010->base + TIMER1_LOAD);
+-	else
++	} else {
+ 		writel(0, fttmr010->base + TIMER1_LOAD);
+ 
+-	/* Enable interrupt */
+-	cr = readl(fttmr010->base + TIMER_INTR_MASK);
+-	cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
+-	cr |= TIMER_1_INT_MATCH1;
+-	writel(cr, fttmr010->base + TIMER_INTR_MASK);
++		/* Enable interrupt */
++		cr = readl(fttmr010->base + TIMER_INTR_MASK);
++		cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
++		cr |= TIMER_1_INT_MATCH1;
++		writel(cr, fttmr010->base + TIMER_INTR_MASK);
++	}
+ 
+ 	return 0;
+ }
+@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt)
+ 	writel(cr, fttmr010->base + TIMER_CR);
+ 
+ 	/* Setup timer to fire at 1/HZ intervals. */
+-	if (fttmr010->count_down) {
++	if (fttmr010->is_aspeed) {
+ 		writel(period, fttmr010->base + TIMER1_LOAD);
+-		writel(0, fttmr010->base + TIMER1_MATCH1);
+ 	} else {
+ 		cr = 0xffffffff - (period - 1);
+ 		writel(cr, fttmr010->base + TIMER1_COUNT);
+@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ 	}
+ 
+ 	/*
+-	 * The Aspeed AST2400 moves bits around in the control register,
+-	 * otherwise it works the same.
++	 * The Aspeed timers move bits around in the control register.
+ 	 */
+ 	if (is_aspeed) {
+ 		fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE |
+ 			TIMER_1_CR_ASPEED_INT;
+-		/* Downward not available */
+-		fttmr010->count_down = true;
++		fttmr010->is_aspeed = true;
+ 	} else {
+ 		fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT;
+-	}
+ 
+-	/*
+-	 * Reset the interrupt mask and status
+-	 */
+-	writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
+-	writel(0, fttmr010->base + TIMER_INTR_STATE);
++		/*
++		 * Reset the interrupt mask and status
++		 */
++		writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
++		writel(0, fttmr010->base + TIMER_INTR_STATE);
++	}
+ 
+ 	/*
+ 	 * Enable timer 1 count up, timer 2 count up, except on Aspeed,
+@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ 	if (is_aspeed)
+ 		val = TIMER_2_CR_ASPEED_ENABLE;
+ 	else {
+-		val = TIMER_2_CR_ENABLE;
+-		if (!fttmr010->count_down)
+-			val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN;
++		val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN |
++			TIMER_2_CR_UPDOWN;
+ 	}
+ 	writel(val, fttmr010->base + TIMER_CR);
+ 
+@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ 	writel(0, fttmr010->base + TIMER2_MATCH1);
+ 	writel(0, fttmr010->base + TIMER2_MATCH2);
+ 
+-	if (fttmr010->count_down) {
++	if (fttmr010->is_aspeed) {
+ 		writel(~0, fttmr010->base + TIMER2_LOAD);
+ 		clocksource_mmio_init(fttmr010->base + TIMER2_COUNT,
+ 				      "FTTMR010-TIMER2",
+@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ 
+ #ifdef CONFIG_ARM
+ 	/* Also use this timer for delays */
+-	if (fttmr010->count_down)
++	if (fttmr010->is_aspeed)
+ 		fttmr010->delay_timer.read_current_timer =
+ 			fttmr010_read_current_timer_down;
+ 	else
+-- 
+2.20.1
+
diff --git a/queue-4.19/clocksource-drivers-mediatek-fix-error-handling.patch b/queue-4.19/clocksource-drivers-mediatek-fix-error-handling.patch
new file mode 100644
index 00000000000..a712c6b5032
--- /dev/null
+++ b/queue-4.19/clocksource-drivers-mediatek-fix-error-handling.patch
@@ -0,0 +1,139 @@
+From 1f5934b503d06f931767da46890eb0c63e69b147 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 21:13:15 +0200
+Subject: clocksource/drivers/mediatek: Fix error handling
+
+From: Fabien Parent <fparent@baylibre.com>
+
+[ Upstream commit 41d49e7939de5ec532d86494185b2ca2e99c848a ]
+
+When timer_of_init fails, it cleans up after itself by undoing
+everything it did during the initialization function.
+
+mtk_syst_init and mtk_gpt_init both call timer_of_cleanup if
+timer_of_init fails. timer_of_cleanup try to release the resource
+taken.  Since these resources have already been cleaned up by
+timer_of_init, we end up getting a few warnings printed:
+
+[    0.001935] WARNING: CPU: 0 PID: 0 at __clk_put+0xe8/0x128
+[    0.002650] Modules linked in:
+[    0.003058] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.67+ #1
+[    0.003852] Hardware name: MediaTek MT8183 (DT)
+[    0.004446] pstate: 20400085 (nzCv daIf +PAN -UAO)
+[    0.005073] pc : __clk_put+0xe8/0x128
+[    0.005555] lr : clk_put+0xc/0x14
+[    0.005988] sp : ffffff80090b3ea0
+[    0.006422] x29: ffffff80090b3ea0 x28: 0000000040e20018
+[    0.007121] x27: ffffffc07bfff780 x26: 0000000000000001
+[    0.007819] x25: ffffff80090bda80 x24: ffffff8008ec5828
+[    0.008517] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
+[    0.009216] x21: 0000000000000001 x20: fffffffffffffdfb
+[    0.009914] x19: ffffff8009166180 x18: 00000000002bffa8
+[    0.010612] x17: ffffffc012996980 x16: 0000000000000000
+[    0.011311] x15: ffffffbf004a6800 x14: 3536343038393334
+[    0.012009] x13: 2079726576652073 x12: 7eb9c62c5c38f100
+[    0.012707] x11: ffffff80090b3ba0 x10: ffffff80090b3ba0
+[    0.013405] x9 : 0000000000000004 x8 : 0000000000000040
+[    0.014103] x7 : ffffffc079400270 x6 : 0000000000000000
+[    0.014801] x5 : ffffffc079400248 x4 : 0000000000000000
+[    0.015499] x3 : 0000000000000000 x2 : 0000000000000000
+[    0.016197] x1 : ffffff80091661c0 x0 : fffffffffffffdfb
+[    0.016896] Call trace:
+[    0.017218]  __clk_put+0xe8/0x128
+[    0.017654]  clk_put+0xc/0x14
+[    0.018048]  timer_of_cleanup+0x60/0x7c
+[    0.018551]  mtk_syst_init+0x8c/0x9c
+[    0.019020]  timer_probe+0x6c/0xe0
+[    0.019469]  time_init+0x14/0x44
+[    0.019893]  start_kernel+0x2d0/0x46c
+[    0.020378] ---[ end trace 8c1efabea1267649 ]---
+[    0.020982] ------------[ cut here ]------------
+[    0.021586] Trying to vfree() nonexistent vm area ((____ptrval____))
+[    0.022427] WARNING: CPU: 0 PID: 0 at __vunmap+0xd0/0xd8
+[    0.023119] Modules linked in:
+[    0.023524] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         4.19.67+ #1
+[    0.024498] Hardware name: MediaTek MT8183 (DT)
+[    0.025091] pstate: 60400085 (nZCv daIf +PAN -UAO)
+[    0.025718] pc : __vunmap+0xd0/0xd8
+[    0.026176] lr : __vunmap+0xd0/0xd8
+[    0.026632] sp : ffffff80090b3e90
+[    0.027066] x29: ffffff80090b3e90 x28: 0000000040e20018
+[    0.027764] x27: ffffffc07bfff780 x26: 0000000000000001
+[    0.028462] x25: ffffff80090bda80 x24: ffffff8008ec5828
+[    0.029160] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
+[    0.029858] x21: 0000000000000000 x20: 0000000000000000
+[    0.030556] x19: ffffff800800d000 x18: 00000000002bffa8
+[    0.031254] x17: 0000000000000000 x16: 0000000000000000
+[    0.031952] x15: ffffffbf004a6800 x14: 3536343038393334
+[    0.032651] x13: 2079726576652073 x12: 7eb9c62c5c38f100
+[    0.033349] x11: ffffff80090b3b40 x10: ffffff80090b3b40
+[    0.034047] x9 : 0000000000000005 x8 : 5f5f6c6176727470
+[    0.034745] x7 : 5f5f5f5f28282061 x6 : ffffff80091c86ef
+[    0.035443] x5 : ffffff800852b690 x4 : 0000000000000000
+[    0.036141] x3 : 0000000000000002 x2 : 0000000000000002
+[    0.036839] x1 : 7eb9c62c5c38f100 x0 : 7eb9c62c5c38f100
+[    0.037536] Call trace:
+[    0.037859]  __vunmap+0xd0/0xd8
+[    0.038271]  vunmap+0x24/0x30
+[    0.038664]  __iounmap+0x2c/0x34
+[    0.039088]  timer_of_cleanup+0x70/0x7c
+[    0.039591]  mtk_syst_init+0x8c/0x9c
+[    0.040060]  timer_probe+0x6c/0xe0
+[    0.040507]  time_init+0x14/0x44
+[    0.040932]  start_kernel+0x2d0/0x46c
+
+This commit remove the calls to timer_of_cleanup when timer_of_init
+fails since it is unnecessary and actually cause warnings to be printed.
+
+Fixes: a0858f937960 ("mediatek: Convert the driver to timer-of")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/linux-arm-kernel/20190919191315.25190-1-fparent@baylibre.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-mediatek.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
+index eb10321f85178..8e7894a026ace 100644
+--- a/drivers/clocksource/timer-mediatek.c
++++ b/drivers/clocksource/timer-mediatek.c
+@@ -277,15 +277,12 @@ static int __init mtk_syst_init(struct device_node *node)
+ 
+ 	ret = timer_of_init(node, &to);
+ 	if (ret)
+-		goto err;
++		return ret;
+ 
+ 	clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
+ 					TIMER_SYNC_TICKS, 0xffffffff);
+ 
+ 	return 0;
+-err:
+-	timer_of_cleanup(&to);
+-	return ret;
+ }
+ 
+ static int __init mtk_gpt_init(struct device_node *node)
+@@ -302,7 +299,7 @@ static int __init mtk_gpt_init(struct device_node *node)
+ 
+ 	ret = timer_of_init(node, &to);
+ 	if (ret)
+-		goto err;
++		return ret;
+ 
+ 	/* Configure clock source */
+ 	mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
+@@ -320,9 +317,6 @@ static int __init mtk_gpt_init(struct device_node *node)
+ 	mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
+ 
+ 	return 0;
+-err:
+-	timer_of_cleanup(&to);
+-	return ret;
+ }
+ TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
+ TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-chelsio-chtls-listen-fails-with-multiadapt.patch b/queue-4.19/crypto-chelsio-chtls-listen-fails-with-multiadapt.patch
new file mode 100644
index 00000000000..b5cc7450c7e
--- /dev/null
+++ b/queue-4.19/crypto-chelsio-chtls-listen-fails-with-multiadapt.patch
@@ -0,0 +1,149 @@
+From dbcab1d73068b76c9d4aad2806d82b3b930daf55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 02:20:26 -0800
+Subject: crypto/chelsio/chtls: listen fails with multiadapt
+
+From: Atul Gupta <atul.gupta@chelsio.com>
+
+[ Upstream commit 6422ccc5fbefbd219f3fab133f698e58f5aa44eb ]
+
+listen fails when more than one tls capable device is
+registered. tls_hw_hash is called for each dev which loops
+again for each cdev_list causing listen failure. Hence
+call chtls_listen_start/stop for specific device than loop over all
+devices.
+
+Signed-off-by: Atul Gupta <atul.gupta@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chtls/chtls.h      |  5 +++
+ drivers/crypto/chelsio/chtls/chtls_main.c | 50 ++++++++++++++---------
+ 2 files changed, 36 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls.h b/drivers/crypto/chelsio/chtls/chtls.h
+index 7725b6ee14efb..fcb6747ed29ea 100644
+--- a/drivers/crypto/chelsio/chtls/chtls.h
++++ b/drivers/crypto/chelsio/chtls/chtls.h
+@@ -153,6 +153,11 @@ struct chtls_dev {
+ 	unsigned int cdev_state;
+ };
+ 
++struct chtls_listen {
++	struct chtls_dev *cdev;
++	struct sock *sk;
++};
++
+ struct chtls_hws {
+ 	struct sk_buff_head sk_recv_queue;
+ 	u8 txqid;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_main.c b/drivers/crypto/chelsio/chtls/chtls_main.c
+index f59b044ebd255..2bf084afe9b58 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_main.c
++++ b/drivers/crypto/chelsio/chtls/chtls_main.c
+@@ -55,24 +55,19 @@ static void unregister_listen_notifier(struct notifier_block *nb)
+ static int listen_notify_handler(struct notifier_block *this,
+ 				 unsigned long event, void *data)
+ {
+-	struct chtls_dev *cdev;
+-	struct sock *sk;
+-	int ret;
++	struct chtls_listen *clisten;
++	int ret = NOTIFY_DONE;
+ 
+-	sk = data;
+-	ret =  NOTIFY_DONE;
++	clisten = (struct chtls_listen *)data;
+ 
+ 	switch (event) {
+ 	case CHTLS_LISTEN_START:
++		ret = chtls_listen_start(clisten->cdev, clisten->sk);
++		kfree(clisten);
++		break;
+ 	case CHTLS_LISTEN_STOP:
+-		mutex_lock(&cdev_list_lock);
+-		list_for_each_entry(cdev, &cdev_list, list) {
+-			if (event == CHTLS_LISTEN_START)
+-				ret = chtls_listen_start(cdev, sk);
+-			else
+-				chtls_listen_stop(cdev, sk);
+-		}
+-		mutex_unlock(&cdev_list_lock);
++		chtls_listen_stop(clisten->cdev, clisten->sk);
++		kfree(clisten);
+ 		break;
+ 	}
+ 	return ret;
+@@ -90,8 +85,9 @@ static int listen_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ 	return 0;
+ }
+ 
+-static int chtls_start_listen(struct sock *sk)
++static int chtls_start_listen(struct chtls_dev *cdev, struct sock *sk)
+ {
++	struct chtls_listen *clisten;
+ 	int err;
+ 
+ 	if (sk->sk_protocol != IPPROTO_TCP)
+@@ -102,21 +98,33 @@ static int chtls_start_listen(struct sock *sk)
+ 		return -EADDRNOTAVAIL;
+ 
+ 	sk->sk_backlog_rcv = listen_backlog_rcv;
++	clisten = kmalloc(sizeof(*clisten), GFP_KERNEL);
++	if (!clisten)
++		return -ENOMEM;
++	clisten->cdev = cdev;
++	clisten->sk = sk;
+ 	mutex_lock(&notify_mutex);
+ 	err = raw_notifier_call_chain(&listen_notify_list,
+-				      CHTLS_LISTEN_START, sk);
++				      CHTLS_LISTEN_START, clisten);
+ 	mutex_unlock(&notify_mutex);
+ 	return err;
+ }
+ 
+-static void chtls_stop_listen(struct sock *sk)
++static void chtls_stop_listen(struct chtls_dev *cdev, struct sock *sk)
+ {
++	struct chtls_listen *clisten;
++
+ 	if (sk->sk_protocol != IPPROTO_TCP)
+ 		return;
+ 
++	clisten = kmalloc(sizeof(*clisten), GFP_KERNEL);
++	if (!clisten)
++		return;
++	clisten->cdev = cdev;
++	clisten->sk = sk;
+ 	mutex_lock(&notify_mutex);
+ 	raw_notifier_call_chain(&listen_notify_list,
+-				CHTLS_LISTEN_STOP, sk);
++				CHTLS_LISTEN_STOP, clisten);
+ 	mutex_unlock(&notify_mutex);
+ }
+ 
+@@ -138,15 +146,19 @@ static int chtls_inline_feature(struct tls_device *dev)
+ 
+ static int chtls_create_hash(struct tls_device *dev, struct sock *sk)
+ {
++	struct chtls_dev *cdev = to_chtls_dev(dev);
++
+ 	if (sk->sk_state == TCP_LISTEN)
+-		return chtls_start_listen(sk);
++		return chtls_start_listen(cdev, sk);
+ 	return 0;
+ }
+ 
+ static void chtls_destroy_hash(struct tls_device *dev, struct sock *sk)
+ {
++	struct chtls_dev *cdev = to_chtls_dev(dev);
++
+ 	if (sk->sk_state == TCP_LISTEN)
+-		chtls_stop_listen(sk);
++		chtls_stop_listen(cdev, sk);
+ }
+ 
+ static void chtls_register_dev(struct chtls_dev *cdev)
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-mxc-scc-fix-build-warnings-on-arm64.patch b/queue-4.19/crypto-mxc-scc-fix-build-warnings-on-arm64.patch
new file mode 100644
index 00000000000..d2e0ef1406d
--- /dev/null
+++ b/queue-4.19/crypto-mxc-scc-fix-build-warnings-on-arm64.patch
@@ -0,0 +1,71 @@
+From 6a6858fdf7d378b4656e38c89d1059fd76e7d81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 07:52:32 -0200
+Subject: crypto: mxc-scc - fix build warnings on ARM64
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 2326828ee40357b3d2b1359b8ca7526af201495b ]
+
+The following build warnings are seen when building for ARM64 allmodconfig:
+
+drivers/crypto/mxc-scc.c:181:20: warning: format '%d' expects argument of type 'int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:186:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:277:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:339:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+drivers/crypto/mxc-scc.c:340:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+
+Fix them by using the %zu specifier to print a size_t variable and using
+a plain %x to print the result of a readl().
+
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxc-scc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c
+index e01c46387df8d..519086730791b 100644
+--- a/drivers/crypto/mxc-scc.c
++++ b/drivers/crypto/mxc-scc.c
+@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx,
+ 	else
+ 		from = scc->black_memory;
+ 
+-	dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from,
++	dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from,
+ 		ctx->dst_nents * 8);
+ 	len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents,
+ 				   from, ctx->size, ctx->offset);
+ 	if (!len) {
+-		dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len);
++		dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx,
+ 	len = sg_pcopy_to_buffer(req->src, ctx->src_nents,
+ 				 to, len, ctx->offset);
+ 	if (!len) {
+-		dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len);
++		dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx,
+ 		return;
+ 	}
+ 
+-	dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n",
+-		(void *)readl(scc->base + SCC_SCM_RED_START),
+-		(void *)readl(scc->base + SCC_SCM_BLACK_START));
++	dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n",
++		readl(scc->base + SCC_SCM_RED_START),
++		readl(scc->base + SCC_SCM_BLACK_START));
+ 
+ 	/* clear interrupt control registers */
+ 	writel(SCC_SCM_INTR_CTRL_CLR_INTR,
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-user-support-incremental-algorithm-dumps.patch b/queue-4.19/crypto-user-support-incremental-algorithm-dumps.patch
new file mode 100644
index 00000000000..915525100bb
--- /dev/null
+++ b/queue-4.19/crypto-user-support-incremental-algorithm-dumps.patch
@@ -0,0 +1,116 @@
+From d8d4a6117bc419fb85f7473d8de62ac40e339dfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 15:55:41 -0800
+Subject: crypto: user - support incremental algorithm dumps
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0ac6b8fb23c724b015d9ca70a89126e8d1563166 ]
+
+CRYPTO_MSG_GETALG in NLM_F_DUMP mode sometimes doesn't return all
+registered crypto algorithms, because it doesn't support incremental
+dumps.  crypto_dump_report() only permits itself to be called once, yet
+the netlink subsystem allocates at most ~64 KiB for the skb being dumped
+to.  Thus only the first recvmsg() returns data, and it may only include
+a subset of the crypto algorithms even if the user buffer passed to
+recvmsg() is large enough to hold all of them.
+
+Fix this by using one of the arguments in the netlink_callback structure
+to keep track of the current position in the algorithm list.  Then
+userspace can do multiple recvmsg() on the socket after sending the dump
+request.  This is the way netlink dumps work elsewhere in the kernel;
+it's unclear why this was different (probably just an oversight).
+
+Also fix an integer overflow when calculating the dump buffer size hint.
+
+Fixes: a38f7907b926 ("crypto: Add userspace configuration API")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/crypto_user.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 3cca814348a26..74cb166097cd2 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -296,30 +296,33 @@ drop_alg:
+ 
+ static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+-	struct crypto_alg *alg;
++	const size_t start_pos = cb->args[0];
++	size_t pos = 0;
+ 	struct crypto_dump_info info;
+-	int err;
+-
+-	if (cb->args[0])
+-		goto out;
+-
+-	cb->args[0] = 1;
++	struct crypto_alg *alg;
++	int res;
+ 
+ 	info.in_skb = cb->skb;
+ 	info.out_skb = skb;
+ 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
+ 	info.nlmsg_flags = NLM_F_MULTI;
+ 
++	down_read(&crypto_alg_sem);
+ 	list_for_each_entry(alg, &crypto_alg_list, cra_list) {
+-		err = crypto_report_alg(alg, &info);
+-		if (err)
+-			goto out_err;
++		if (pos >= start_pos) {
++			res = crypto_report_alg(alg, &info);
++			if (res == -EMSGSIZE)
++				break;
++			if (res)
++				goto out;
++		}
++		pos++;
+ 	}
+-
++	cb->args[0] = pos;
++	res = skb->len;
+ out:
+-	return skb->len;
+-out_err:
+-	return err;
++	up_read(&crypto_alg_sem);
++	return res;
+ }
+ 
+ static int crypto_dump_report_done(struct netlink_callback *cb)
+@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 	if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
+ 	    (nlh->nlmsg_flags & NLM_F_DUMP))) {
+ 		struct crypto_alg *alg;
+-		u16 dump_alloc = 0;
++		unsigned long dump_alloc = 0;
+ 
+ 		if (link->dump == NULL)
+ 			return -EINVAL;
+@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ 		down_read(&crypto_alg_sem);
+ 		list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ 			dump_alloc += CRYPTO_REPORT_MAXSIZE;
++		up_read(&crypto_alg_sem);
+ 
+ 		{
+ 			struct netlink_dump_control c = {
+ 				.dump = link->dump,
+ 				.done = link->done,
+-				.min_dump_alloc = dump_alloc,
++				.min_dump_alloc = min(dump_alloc, 65535UL),
+ 			};
+ 			err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ 		}
+-		up_read(&crypto_alg_sem);
+ 
+ 		return err;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/decnet-fix-dn_ifreq_size.patch b/queue-4.19/decnet-fix-dn_ifreq_size.patch
new file mode 100644
index 00000000000..a6f188161b7
--- /dev/null
+++ b/queue-4.19/decnet-fix-dn_ifreq_size.patch
@@ -0,0 +1,67 @@
+From 093c8cdfbc33307014c2c1bdafc31a23d6c1f0f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 21:12:19 +0100
+Subject: decnet: fix DN_IFREQ_SIZE
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 50c2936634bcb1db78a8ca63249236810c11a80f ]
+
+Digging through the ioctls with Al because of the previous
+patches, we found that on 64-bit decnet's dn_dev_ioctl()
+is wrong, because struct ifreq::ifr_ifru is actually 24
+bytes (not 16 as expected from struct sockaddr) due to the
+ifru_map and ifru_settings members.
+
+Clearly, decnet expects the ioctl to be called with a struct
+like
+  struct ifreq_dn {
+    char ifr_name[IFNAMSIZ];
+    struct sockaddr_dn ifr_addr;
+  };
+
+since it does
+  struct ifreq *ifr = ...;
+  struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
+
+This means that DN_IFREQ_SIZE is too big for what it wants on
+64-bit, as it is
+  sizeof(struct ifreq) - sizeof(struct sockaddr) +
+  sizeof(struct sockaddr_dn)
+
+This assumes that sizeof(struct sockaddr) is the size of ifr_ifru
+but that isn't true.
+
+Fix this to use offsetof(struct ifreq, ifr_ifru).
+
+This indeed doesn't really matter much - the result is that we
+copy in/out 8 bytes more than we should on 64-bit platforms. In
+case the "struct ifreq_dn" lands just on the end of a page though
+it might lead to faults.
+
+As far as I can tell, it has been like this forever, so it seems
+very likely that nobody cares.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/decnet/dn_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index bfd43e8f2c06e..3235540f6adff 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -56,7 +56,7 @@
+ #include <net/dn_neigh.h>
+ #include <net/dn_fib.h>
+ 
+-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+ 
+ static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+ static char dn_rt_all_rt_mcast[ETH_ALEN]  = {0xAB,0x00,0x00,0x03,0x00,0x00};
+-- 
+2.20.1
+
diff --git a/queue-4.19/dm-flakey-properly-corrupt-multi-page-bios.patch b/queue-4.19/dm-flakey-properly-corrupt-multi-page-bios.patch
new file mode 100644
index 00000000000..e7bc0de861b
--- /dev/null
+++ b/queue-4.19/dm-flakey-properly-corrupt-multi-page-bios.patch
@@ -0,0 +1,76 @@
+From c365aae8fac7ec7daaf04a15b823e5d67688fa1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 08:04:24 -0500
+Subject: dm flakey: Properly corrupt multi-page bios.
+
+From: Sweet Tea <sweettea@redhat.com>
+
+[ Upstream commit a00f5276e26636cbf72f24f79831026d2e2868e7 ]
+
+The flakey target is documented to be able to corrupt the Nth byte in
+a bio, but does not corrupt byte indices after the first biovec in the
+bio. Change the corrupting function to actually corrupt the Nth byte
+no matter in which biovec that index falls.
+
+A test device generating two-page bios, atop a flakey device configured
+to corrupt a byte index on the second page, verified both the failure
+to corrupt before this patch and the expected corruption after this
+change.
+
+Signed-off-by: John Dorminy <jdorminy@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-flakey.c | 33 ++++++++++++++++++++++-----------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index b86d2439ffc76..2fcf62fb2844f 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -287,20 +287,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio)
+ 
+ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc)
+ {
+-	unsigned bio_bytes = bio_cur_bytes(bio);
+-	char *data = bio_data(bio);
++	unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1;
++
++	struct bvec_iter iter;
++	struct bio_vec bvec;
++
++	if (!bio_has_data(bio))
++		return;
+ 
+ 	/*
+-	 * Overwrite the Nth byte of the data returned.
++	 * Overwrite the Nth byte of the bio's data, on whichever page
++	 * it falls.
+ 	 */
+-	if (data && bio_bytes >= fc->corrupt_bio_byte) {
+-		data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value;
+-
+-		DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
+-			"(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n",
+-			bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
+-			(bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
+-			(unsigned long long)bio->bi_iter.bi_sector, bio_bytes);
++	bio_for_each_segment(bvec, bio, iter) {
++		if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
++			char *segment = (page_address(bio_iter_page(bio, iter))
++					 + bio_iter_offset(bio, iter));
++			segment[corrupt_bio_byte] = fc->corrupt_bio_value;
++			DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
++				"(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
++				bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
++				(bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
++				(unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size);
++			break;
++		}
++		corrupt_bio_byte -= bio_iter_len(bio, iter);
+ 	}
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/dm-raid-fix-false-ebusy-when-handling-check-repair-m.patch b/queue-4.19/dm-raid-fix-false-ebusy-when-handling-check-repair-m.patch
new file mode 100644
index 00000000000..b41a1671c3b
--- /dev/null
+++ b/queue-4.19/dm-raid-fix-false-ebusy-when-handling-check-repair-m.patch
@@ -0,0 +1,40 @@
+From f23b5dcf25d9aa39f49bb0a1455d2f7fca94b368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 17:35:41 +0100
+Subject: dm raid: fix false -EBUSY when handling check/repair message
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+[ Upstream commit 74694bcbdf7e28a5ad548cdda9ac56d30be00d13 ]
+
+Sending a check/repair message infrequently leads to -EBUSY instead of
+properly identifying an active resync.  This occurs because
+raid_message() is testing recovery bits in a racy way.
+
+Fix by calling decipher_sync_action() from raid_message() to properly
+identify the idle state of the RAID device.
+
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-raid.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 6c9b542882613..23de59a692c51 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3690,8 +3690,7 @@ static int raid_message(struct dm_target *ti, unsigned int argc, char **argv,
+ 			set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ 			md_reap_sync_thread(mddev);
+ 		}
+-	} else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+-		   test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
++	} else if (decipher_sync_action(mddev, mddev->recovery) != st_idle)
+ 		return -EBUSY;
+ 	else if (!strcasecmp(argv[0], "resync"))
+ 		; /* MD_RECOVERY_NEEDED set below */
+-- 
+2.20.1
+
diff --git a/queue-4.19/drbd-do-not-block-when-adjusting-disk-options-while-.patch b/queue-4.19/drbd-do-not-block-when-adjusting-disk-options-while-.patch
new file mode 100644
index 00000000000..481a12822f8
--- /dev/null
+++ b/queue-4.19/drbd-do-not-block-when-adjusting-disk-options-while-.patch
@@ -0,0 +1,91 @@
+From 7e4d4bdd575ad29a86c03744b1b828ed9a0e9b8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:37 +0100
+Subject: drbd: do not block when adjusting "disk-options" while IO is frozen
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit f708bd08ecbdc23d03aaedf5b3311ebe44cfdb50 ]
+
+"suspending" IO is overloaded.
+It can mean "do not allow new requests" (obviously),
+but it also may mean "must not complete pending IO",
+for example while the fencing handlers do their arbitration.
+
+When adjusting disk options, we suspend io (disallow new requests), then
+wait for the activity-log to become unused (drain all IO completions),
+and possibly replace it with a new activity log of different size.
+
+If the other "suspend IO" aspect is active, pending IO completions won't
+happen, and we would block forever (unkillable drbdsetup process).
+
+Fix this by skipping the activity log adjustment if the "al-extents"
+setting did not change. Also, in case it did change, fail early without
+blocking if it looks like we would block forever.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 37 ++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 3366c1a91ee00..5b15ffd0c7f57 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis
+ 	}
+ }
+ 
++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc)
++{
++	int err = -EBUSY;
++
++	if (device->act_log &&
++	    device->act_log->nr_elements == dc->al_extents)
++		return 0;
++
++	drbd_suspend_io(device);
++	/* If IO completion is currently blocked, we would likely wait
++	 * "forever" for the activity log to become unused. So we don't. */
++	if (atomic_read(&device->ap_bio_cnt))
++		goto out;
++
++	wait_event(device->al_wait, lc_try_lock(device->act_log));
++	drbd_al_shrink(device);
++	err = drbd_check_al_size(device, dc);
++	lc_unlock(device->act_log);
++	wake_up(&device->al_wait);
++out:
++	drbd_resume_io(device);
++	return err;
++}
++
+ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ {
+ 	struct drbd_config_context adm_ctx;
+@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ 		}
+ 	}
+ 
+-	drbd_suspend_io(device);
+-	wait_event(device->al_wait, lc_try_lock(device->act_log));
+-	drbd_al_shrink(device);
+-	err = drbd_check_al_size(device, new_disk_conf);
+-	lc_unlock(device->act_log);
+-	wake_up(&device->al_wait);
+-	drbd_resume_io(device);
+-
++	err = disk_opts_check_al_size(device, new_disk_conf);
+ 	if (err) {
++		/* Could be just "busy". Ignore?
++		 * Introduce dedicated error code? */
++		drbd_msg_put_info(adm_ctx.reply_skb,
++			"Try again without changing current al-extents setting");
+ 		retcode = ERR_NOMEM;
+ 		goto fail_unlock;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch b/queue-4.19/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
new file mode 100644
index 00000000000..5a671709f46
--- /dev/null
+++ b/queue-4.19/drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
@@ -0,0 +1,39 @@
+From e4692a848107c77f1f4984bb6830042f6ea8f485 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:39 +0100
+Subject: drbd: fix print_st_err()'s prototype to match the definition
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 2c38f035117331eb78d0504843c79ea7c7fabf37 ]
+
+print_st_err() is defined with its 4th argument taking an
+'enum drbd_state_rv' but its prototype use an int for it.
+
+Fix this by using 'enum drbd_state_rv' in the prototype too.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_state.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index ea58301d0895c..b2a390ba73a05 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state
+ 					  enum chg_state_flags,
+ 					  struct completion *done);
+ extern void print_st_err(struct drbd_device *, union drbd_state,
+-			union drbd_state, int);
++			union drbd_state, enum drbd_state_rv);
+ 
+ enum drbd_state_rv
+ _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val,
+-- 
+2.20.1
+
diff --git a/queue-4.19/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch b/queue-4.19/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
new file mode 100644
index 00000000000..eadd9059826
--- /dev/null
+++ b/queue-4.19/drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
@@ -0,0 +1,116 @@
+From c5926cca3e98a0f7ed50bfebd77e13c9fc80f57c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:31 +0100
+Subject: drbd: ignore "all zero" peer volume sizes in handshake
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit 94c43a13b8d6e3e0dd77b3536b5e04a84936b762 ]
+
+During handshake, if we are diskless ourselves, we used to accept any size
+presented by the peer.
+
+Which could be zero if that peer was just brought up and connected
+to us without having a disk attached first, in which case both
+peers would just "flip" their volume sizes.
+
+Now, even a diskless node will ignore "zero" sizes
+presented by a diskless peer.
+
+Also a currently Diskless Primary will refuse to shrink during handshake:
+it may be frozen, and waiting for a "suitable" local disk or peer to
+re-appear (on-no-data-accessible suspend-io). If the peer is smaller
+than what we used to be, it is not suitable.
+
+The logic for a diskless node during handshake is now supposed to be:
+believe the peer, if
+ - I don't have a current size myself
+ - we agree on the size anyways
+ - I do have a current size, am Secondary, and he has the only disk
+ - I do have a current size, am Primary, and he has the only disk,
+   which is larger than my current size
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 33 +++++++++++++++++++++++++++---
+ 1 file changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 3cdadf75c82da..c9e8d61dea248 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -3980,6 +3980,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ 	struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL;
+ 	enum determine_dev_size dd = DS_UNCHANGED;
+ 	sector_t p_size, p_usize, p_csize, my_usize;
++	sector_t new_size, cur_size;
+ 	int ldsc = 0; /* local disk size changed */
+ 	enum dds_flags ddsf;
+ 
+@@ -3987,6 +3988,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ 	if (!peer_device)
+ 		return config_unknown_volume(connection, pi);
+ 	device = peer_device->device;
++	cur_size = drbd_get_capacity(device->this_bdev);
+ 
+ 	p_size = be64_to_cpu(p->d_size);
+ 	p_usize = be64_to_cpu(p->u_size);
+@@ -3997,7 +3999,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ 	device->p_size = p_size;
+ 
+ 	if (get_ldev(device)) {
+-		sector_t new_size, cur_size;
+ 		rcu_read_lock();
+ 		my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size;
+ 		rcu_read_unlock();
+@@ -4015,7 +4016,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ 		/* Never shrink a device with usable data during connect.
+ 		   But allow online shrinking if we are connected. */
+ 		new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0);
+-		cur_size = drbd_get_capacity(device->this_bdev);
+ 		if (new_size < cur_size &&
+ 		    device->state.disk >= D_OUTDATED &&
+ 		    device->state.conn < C_CONNECTED) {
+@@ -4080,9 +4080,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ 		 *
+ 		 * However, if he sends a zero current size,
+ 		 * take his (user-capped or) backing disk size anyways.
++		 *
++		 * Unless of course he does not have a disk himself.
++		 * In which case we ignore this completely.
+ 		 */
++		sector_t new_size = p_csize ?: p_usize ?: p_size;
+ 		drbd_reconsider_queue_parameters(device, NULL, o);
+-		drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size);
++		if (new_size == 0) {
++			/* Ignore, peer does not know nothing. */
++		} else if (new_size == cur_size) {
++			/* nothing to do */
++		} else if (cur_size != 0 && p_size == 0) {
++			drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n",
++					(unsigned long long)new_size, (unsigned long long)cur_size);
++		} else if (new_size < cur_size && device->state.role == R_PRIMARY) {
++			drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n",
++					(unsigned long long)new_size, (unsigned long long)cur_size);
++			conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD);
++			return -EIO;
++		} else {
++			/* I believe the peer, if
++			 *  - I don't have a current size myself
++			 *  - we agree on the size anyways
++			 *  - I do have a current size, am Secondary,
++			 *    and he has the only disk
++			 *  - I do have a current size, am Primary,
++			 *    and he has the only disk,
++			 *    which is larger than my current size
++			 */
++			drbd_set_my_capacity(device, new_size);
++		}
+ 	}
+ 
+ 	if (get_ldev(device)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch b/queue-4.19/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
new file mode 100644
index 00000000000..583fb61fb3a
--- /dev/null
+++ b/queue-4.19/drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
@@ -0,0 +1,102 @@
+From e248d55290ba0a67e4848f975fcb6d71aa32914f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:35 +0100
+Subject: drbd: reject attach of unsuitable uuids even if connected
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit fe43ed97bba3b11521abd934b83ed93143470e4f ]
+
+Multiple failure scenario:
+a) all good
+   Connected Primary/Secondary UpToDate/UpToDate
+b) lose disk on Primary,
+   Connected Primary/Secondary Diskless/UpToDate
+c) continue to write to the device,
+   changes only make it to the Secondary storage.
+d) lose disk on Secondary,
+   Connected Primary/Secondary Diskless/Diskless
+e) now try to re-attach on Primary
+
+This would have succeeded before, even though that is clearly the
+wrong data set to attach to (missing the modifications from c).
+Because we only compared our "effective" and the "to-be-attached"
+data generation uuid tags if (device->state.conn < C_CONNECTED).
+
+Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE)
+compare the uuids, and reject the attach.
+
+This patch also tries to improve the reverse scenario:
+first lose Secondary, then Primary disk,
+then try to attach the disk on Secondary.
+
+Before this patch, the attach on the Secondary succeeds, but since commit
+drbd: disconnect, if the wrong UUIDs are attached on a connected peer
+the Primary will notice unsuitable data, and drop the connection hard.
+
+Though unfortunately at a point in time during the handshake where
+we cannot easily abort the attach on the peer without more
+refactoring of the handshake.
+
+We now reject any attach to "unsuitable" uuids,
+as long as we can see a Primary role,
+unless we already have access to "good" data.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c       |  6 +++---
+ drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 319fabdd63a3f..3366c1a91ee00 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1935,9 +1935,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ 		}
+ 	}
+ 
+-	if (device->state.conn < C_CONNECTED &&
+-	    device->state.role == R_PRIMARY && device->ed_uuid &&
+-	    (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
++	if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid &&
++	    (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) &&
++            (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
+ 		drbd_err(device, "Can only attach to data with current UUID=%016llX\n",
+ 		    (unsigned long long)device->ed_uuid);
+ 		retcode = ERR_DATA_NOT_CURRENT;
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index c9e8d61dea248..cbb6ef719978f 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -4395,6 +4395,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info
+ 	if (peer_state.conn == C_AHEAD)
+ 		ns.conn = C_BEHIND;
+ 
++	/* TODO:
++	 * if (primary and diskless and peer uuid != effective uuid)
++	 *     abort attach on peer;
++	 *
++	 * If this node does not have good data, was already connected, but
++	 * the peer did a late attach only now, trying to "negotiate" with me,
++	 * AND I am currently Primary, possibly frozen, with some specific
++	 * "effective" uuid, this should never be reached, really, because
++	 * we first send the uuids, then the current state.
++	 *
++	 * In this scenario, we already dropped the connection hard
++	 * when we received the unsuitable uuids (receive_uuids().
++	 *
++	 * Should we want to change this, that is: not drop the connection in
++	 * receive_uuids() already, then we would need to add a branch here
++	 * that aborts the attach of "unsuitable uuids" on the peer in case
++	 * this node is currently Diskless Primary.
++	 */
++
+ 	if (device->p_uuid && peer_state.disk >= D_NEGOTIATING &&
+ 	    get_ldev_if_state(device, D_NEGOTIATING)) {
+ 		int cr; /* consider resync */
+-- 
+2.20.1
+
diff --git a/queue-4.19/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch b/queue-4.19/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
new file mode 100644
index 00000000000..9a835a2b3ed
--- /dev/null
+++ b/queue-4.19/drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
@@ -0,0 +1,83 @@
+From 8fe266d1e3044b0ab80d0ab483e2fe7650274ae4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:29:05 -0800
+Subject: drivers/base/platform.c: kmemleak ignore a known leak
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 967d3010df8b6f6f9aa95c198edc5fe3646ebf36 ]
+
+unreferenced object 0xffff808ec6dc5a80 (size 128):
+  comm "swapper/0", pid 1, jiffies 4294938063 (age 2560.530s)
+  hex dump (first 32 bytes):
+    ff ff ff ff 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b  ........kkkkkkkk
+    6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
+  backtrace:
+    [<00000000476dcf8c>] kmem_cache_alloc_trace+0x430/0x500
+    [<000000004f708d37>] platform_device_register_full+0xbc/0x1e8
+    [<000000006c2a7ec7>] acpi_create_platform_device+0x370/0x450
+    [<00000000ef135642>] acpi_default_enumeration+0x34/0x78
+    [<000000003bd9a052>] acpi_bus_attach+0x2dc/0x3e0
+    [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+    [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+    [<000000002968643e>] acpi_bus_scan+0xb0/0x110
+    [<0000000010dd0bd7>] acpi_scan_init+0x1a8/0x410
+    [<00000000965b3c5a>] acpi_init+0x408/0x49c
+    [<00000000ed4b9fe2>] do_one_initcall+0x178/0x7f4
+    [<00000000a5ac5a74>] kernel_init_freeable+0x9d4/0xa9c
+    [<0000000070ea6c15>] kernel_init+0x18/0x138
+    [<00000000fb8fff06>] ret_from_fork+0x10/0x1c
+    [<0000000041273a0d>] 0xffffffffffffffff
+
+Then, faddr2line pointed out this line,
+
+/*
+ * This memory isn't freed when the device is put,
+ * I don't have a nice idea for that though.  Conceptually
+ * dma_mask in struct device should not be a pointer.
+ * See http://thread.gmane.org/gmane.linux.kernel.pci/9081
+ */
+pdev->dev.dma_mask =
+	kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
+
+Since this leak has existed for more than 8 years and it does not
+reference other parts of the memory, let kmemleak ignore it, so users
+don't need to waste time reporting this in the future.
+
+Link: http://lkml.kernel.org/r/20181206160751.36211-1-cai@gmx.us
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J . Wysocki" <rafael.j.wysocki@intel.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index dff82a3c2caa9..e9be1f56929af 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -26,6 +26,7 @@
+ #include <linux/clk/clk-conf.h>
+ #include <linux/limits.h>
+ #include <linux/property.h>
++#include <linux/kmemleak.h>
+ 
+ #include "base.h"
+ #include "power/power.h"
+@@ -525,6 +526,8 @@ struct platform_device *platform_device_register_full(
+ 		if (!pdev->dev.dma_mask)
+ 			goto err;
+ 
++		kmemleak_ignore(pdev->dev.dma_mask);
++
+ 		*pdev->dev.dma_mask = pdevinfo->dma_mask;
+ 		pdev->dev.coherent_dma_mask = pdevinfo->dma_mask;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/drivers-regulator-fix-a-missing-check-of-return-valu.patch b/queue-4.19/drivers-regulator-fix-a-missing-check-of-return-valu.patch
new file mode 100644
index 00000000000..69bb6e59335
--- /dev/null
+++ b/queue-4.19/drivers-regulator-fix-a-missing-check-of-return-valu.patch
@@ -0,0 +1,46 @@
+From 1d17122340135f8d29930a7c348406133062de95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 23:04:13 -0600
+Subject: drivers/regulator: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad ]
+
+If palmas_smps_read() fails, we should not use the read data in "reg"
+which may contain random value. The fix inserts a check for the return
+value of palmas_smps_read(): If it fails, we return the error code
+upstream and stop using "reg".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/palmas-regulator.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index bb5ab7d78895b..c2cc392a27d40 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg,
+ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
+ {
+ 	int id = rdev_get_id(dev);
++	int ret;
+ 	struct palmas_pmic *pmic = rdev_get_drvdata(dev);
+ 	struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata;
+ 	struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id];
+ 	unsigned int reg;
+ 	bool rail_enable = true;
+ 
+-	palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, &reg);
++	ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, &reg);
++	if (ret)
++		return ret;
+ 
+ 	reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/exofs_mount-fix-leaks-on-failure-exits.patch b/queue-4.19/exofs_mount-fix-leaks-on-failure-exits.patch
new file mode 100644
index 00000000000..a47be296379
--- /dev/null
+++ b/queue-4.19/exofs_mount-fix-leaks-on-failure-exits.patch
@@ -0,0 +1,94 @@
+From 2efa56af85e408de89c5f13a62293f61f1fa39fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 22:26:42 -0500
+Subject: exofs_mount(): fix leaks on failure exits
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 26cb5a328c6b2bda9e859307ce4cfc60df3a2c28 ]
+
+... and don't abuse mount_nodev(), while we are at it.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exofs/super.c | 37 +++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 7d61e3fa378c2..8fb98bb942372 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -705,21 +705,18 @@ out:
+ /*
+  * Read the superblock from the OSD and fill in the fields
+  */
+-static int exofs_fill_super(struct super_block *sb, void *data, int silent)
++static int exofs_fill_super(struct super_block *sb,
++				struct exofs_mountopt *opts,
++				struct exofs_sb_info *sbi,
++				int silent)
+ {
+ 	struct inode *root;
+-	struct exofs_mountopt *opts = data;
+-	struct exofs_sb_info *sbi;	/*extended info                  */
+ 	struct osd_dev *od;		/* Master device                 */
+ 	struct exofs_fscb fscb;		/*on-disk superblock info        */
+ 	struct ore_comp comp;
+ 	unsigned table_count;
+ 	int ret;
+ 
+-	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+-	if (!sbi)
+-		return -ENOMEM;
+-
+ 	/* use mount options to fill superblock */
+ 	if (opts->is_osdname) {
+ 		struct osd_dev_info odi = {.systemid_len = 0};
+@@ -863,7 +860,9 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ 			  int flags, const char *dev_name,
+ 			  void *data)
+ {
++	struct super_block *s;
+ 	struct exofs_mountopt opts;
++	struct exofs_sb_info *sbi;
+ 	int ret;
+ 
+ 	ret = parse_options(data, &opts);
+@@ -872,9 +871,31 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ 		return ERR_PTR(ret);
+ 	}
+ 
++	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
++	if (!sbi) {
++		kfree(opts.dev_name);
++		return ERR_PTR(-ENOMEM);
++	}
++
++	s = sget(type, NULL, set_anon_super, flags, NULL);
++
++	if (IS_ERR(s)) {
++		kfree(opts.dev_name);
++		kfree(sbi);
++		return ERR_CAST(s);
++	}
++
+ 	if (!opts.dev_name)
+ 		opts.dev_name = dev_name;
+-	return mount_nodev(type, flags, &opts, exofs_fill_super);
++
++
++	ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0);
++	if (ret) {
++		deactivate_locked_super(s);
++		return ERR_PTR(ret);
++	}
++	s->s_flags |= SB_ACTIVE;
++	return dget(s->s_root);
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-4.19/f2fs-fix-block-address-for-__check_sit_bitmap.patch b/queue-4.19/f2fs-fix-block-address-for-__check_sit_bitmap.patch
new file mode 100644
index 00000000000..2d55dbdeedd
--- /dev/null
+++ b/queue-4.19/f2fs-fix-block-address-for-__check_sit_bitmap.patch
@@ -0,0 +1,36 @@
+From 360b9a14929b892e13d97ccbd07ca0310eb4f576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 17:32:23 +0800
+Subject: f2fs: fix block address for __check_sit_bitmap
+
+From: Qiuyang Sun <sunqiuyang@huawei.com>
+
+[ Upstream commit 9249dded7b5cb539a8c8698b25d08a3c15261470 ]
+
+Should use lstart (logical start address) instead of start (in dev) here.
+This fixes a bug in multi-device scenarios.
+
+Signed-off-by: Qiuyang Sun <sunqiuyang@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 43a07514c3574..a807a8d5e38f0 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1103,7 +1103,7 @@ submit:
+ 		list_move_tail(&dc->list, wait_list);
+ 
+ 		/* sanity check on discard range */
+-		__check_sit_bitmap(sbi, start, start + len);
++		__check_sit_bitmap(sbi, lstart, lstart + len);
+ 
+ 		bio->bi_private = dc;
+ 		bio->bi_end_io = f2fs_submit_discard_endio;
+-- 
+2.20.1
+
diff --git a/queue-4.19/f2fs-fix-to-data-block-override-node-segment-by-mist.patch b/queue-4.19/f2fs-fix-to-data-block-override-node-segment-by-mist.patch
new file mode 100644
index 00000000000..f71d5dfc071
--- /dev/null
+++ b/queue-4.19/f2fs-fix-to-data-block-override-node-segment-by-mist.patch
@@ -0,0 +1,69 @@
+From 9db064cac1f087e2f67fcd2b60b33a8047fe4294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 09:32:25 +0800
+Subject: f2fs: fix to data block override node segment by mistake
+
+From: zhengliang <zhengliang6@huawei.com>
+
+[ Upstream commit a0770e13c8da83bdb64738c0209ab02dd3cfff8b ]
+
+v4: Rearrange the previous three versions.
+
+The following scenario could lead to data block override by mistake.
+
+TASK A            |  TASK kworker                                            |     TASK B                                            |       TASK C
+                  |                                                          |                                                       |
+open              |                                                          |                                                       |
+write             |                                                          |                                                       |
+close             |                                                          |                                                       |
+                  |  f2fs_write_data_pages                                   |                                                       |
+                  |    f2fs_write_cache_pages                                |                                                       |
+                  |      f2fs_outplace_write_data                            |                                                       |
+                  |        f2fs_allocate_data_block (get block in seg S,     |                                                       |
+                  |                                  S is full, and only     |                                                       |
+                  |                                  have this valid data    |                                                       |
+                  |                                  block)                  |                                                       |
+                  |          allocate_segment                                |                                                       |
+                  |          locate_dirty_segment (mark S as PRE)            |                                                       |
+                  |        f2fs_submit_page_write (submit but is not         |                                                       |
+                  |                                written on dev)           |                                                       |
+unlink            |                                                          |                                                       |
+ iput_final       |                                                          |                                                       |
+  f2fs_drop_inode |                                                          |                                                       |
+    f2fs_truncate |                                                          |                                                       |
+ (not evict)      |                                                          |                                                       |
+                  |                                                          | write_checkpoint                                      |
+                  |                                                          |  flush merged bio but not wait file data writeback    |
+                  |                                                          |  set_prefree_as_free (mark S as FREE)                 |
+                  |                                                          |                                                       | update NODE/DATA
+                  |                                                          |                                                       | allocate_segment (select S)
+                  |     writeback done                                       |                                                       |
+
+So we need to guarantee io complete before truncate inode in f2fs_drop_inode.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 7a9cc64f5ca37..b82b7163e0d08 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -890,6 +890,10 @@ static int f2fs_drop_inode(struct inode *inode)
+ 			sb_start_intwrite(inode->i_sb);
+ 			f2fs_i_size_write(inode, 0);
+ 
++			f2fs_submit_merged_write_cond(F2FS_I_SB(inode),
++					inode, NULL, 0, DATA);
++			truncate_inode_pages_final(inode->i_mapping);
++
+ 			if (F2FS_HAS_BLOCKS(inode))
+ 				f2fs_truncate(inode);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/f2fs-fix-to-dirty-inode-synchronously.patch b/queue-4.19/f2fs-fix-to-dirty-inode-synchronously.patch
new file mode 100644
index 00000000000..1e828213fdf
--- /dev/null
+++ b/queue-4.19/f2fs-fix-to-dirty-inode-synchronously.patch
@@ -0,0 +1,36 @@
+From fd926d9b1cd10982a82a328c03fa7cbb34539979 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 19:20:17 +0800
+Subject: f2fs: fix to dirty inode synchronously
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit b32e019049e959ee10ec359893c9dd5d057dad55 ]
+
+If user change inode's i_flags via ioctl, let's add it into global
+dirty list, so that checkpoint can guarantee its persistence before
+fsync, it can make checkpoint keeping strong consistency.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index c7ea122997695..187bf7e260c99 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1667,7 +1667,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags)
+ 
+ 	inode->i_ctime = current_time(inode);
+ 	f2fs_set_inode_flags(inode);
+-	f2fs_mark_inode_dirty_sync(inode, false);
++	f2fs_mark_inode_dirty_sync(inode, true);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-arm_sdei-fix-dt-platform-device-creation.patch b/queue-4.19/firmware-arm_sdei-fix-dt-platform-device-creation.patch
new file mode 100644
index 00000000000..5de1ec8a6d6
--- /dev/null
+++ b/queue-4.19/firmware-arm_sdei-fix-dt-platform-device-creation.patch
@@ -0,0 +1,53 @@
+From fde617ac066a533e0201d9ccb56bc59ed3fd36d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 19:25:19 +0000
+Subject: firmware: arm_sdei: Fix DT platform device creation
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit acafce48b07bf5f9994a38e7fe237193d43d092e ]
+
+It turns out the dt-probing part of this wasn't tested properly after it
+was merged. commit 3aa0582fdb82 ("of: platform: populate /firmware/ node
+from of_platform_default_populate_init()") changed the core-code to
+generate the platform devices, meaning the driver's attempt fails, and it
+bails out.
+
+Fix this by removing the manual platform-device creation for DT systems,
+core code has always done this for us.
+
+CC: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_sdei.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index dffb47c6b4801..c64c7da738297 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -1009,7 +1009,6 @@ static struct platform_driver sdei_driver = {
+ 
+ static bool __init sdei_present_dt(void)
+ {
+-	struct platform_device *pdev;
+ 	struct device_node *np, *fw_np;
+ 
+ 	fw_np = of_find_node_by_name(NULL, "firmware");
+@@ -1019,11 +1018,7 @@ static bool __init sdei_present_dt(void)
+ 	np = of_find_matching_node(fw_np, sdei_of_match);
+ 	if (!np)
+ 		return false;
+-
+-	pdev = of_platform_device_create(np, sdei_driver.driver.name, NULL);
+ 	of_node_put(np);
+-	if (!pdev)
+-		return false;
+ 
+ 	return true;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-arm_sdei-fix-wrong-of_node_put-in-init-func.patch b/queue-4.19/firmware-arm_sdei-fix-wrong-of_node_put-in-init-func.patch
new file mode 100644
index 00000000000..8fdce56c5c7
--- /dev/null
+++ b/queue-4.19/firmware-arm_sdei-fix-wrong-of_node_put-in-init-func.patch
@@ -0,0 +1,40 @@
+From 98851612b3b5240dcc3acfa3d658834867f7271c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 19:25:18 +0000
+Subject: firmware: arm_sdei: fix wrong of_node_put() in init function
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit c3790b3799f8d75d93d26f6fd7bb569fc8c8b0cb ]
+
+After finding a "firmware" dt node arm_sdei tries to match it's
+compatible string with it. To do so it's calling of_find_matching_node()
+which already takes care of decreasing the refcount on the "firmware"
+node. We are then incorrectly decreasing the refcount on that node
+again.
+
+This patch removes the unwarranted call to of_node_put().
+
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_sdei.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index 1ea71640fdc21..dffb47c6b4801 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -1017,7 +1017,6 @@ static bool __init sdei_present_dt(void)
+ 		return false;
+ 
+ 	np = of_find_matching_node(fw_np, sdei_of_match);
+-	of_node_put(fw_np);
+ 	if (!np)
+ 		return false;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/fork-fix-some-wmissing-prototypes-warnings.patch b/queue-4.19/fork-fix-some-wmissing-prototypes-warnings.patch
new file mode 100644
index 00000000000..1bcce2c7a75
--- /dev/null
+++ b/queue-4.19/fork-fix-some-wmissing-prototypes-warnings.patch
@@ -0,0 +1,83 @@
+From 125fab5e951aac0337e47fcbc972eeeb55dffe6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:28:03 -0800
+Subject: fork: fix some -Wmissing-prototypes warnings
+
+From: Yi Wang <wang.yi59@zte.com.cn>
+
+[ Upstream commit fb5bf31722d0805a3f394f7d59f2e8cd07acccb7 ]
+
+We get a warning when building kernel with W=1:
+
+  kernel/fork.c:167:13: warning: no previous prototype for `arch_release_thread_stack' [-Wmissing-prototypes]
+  kernel/fork.c:779:13: warning: no previous prototype for `fork_init' [-Wmissing-prototypes]
+
+Add the missing declaration in head file to fix this.
+
+Also, remove arch_release_thread_stack() completely because no arch
+seems to implement it since bb9d81264 (arch: remove tile port).
+
+Link: http://lkml.kernel.org/r/1542170087-23645-1-git-send-email-wang.yi59@zte.com.cn
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched/task.h | 2 ++
+ init/main.c                | 1 -
+ kernel/fork.c              | 5 -----
+ 3 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index 108ede99e5335..44c6f15800ff5 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void);
+ 
+ extern void proc_caches_init(void);
+ 
++extern void fork_init(void);
++
+ extern void release_task(struct task_struct * p);
+ 
+ #ifdef CONFIG_HAVE_COPY_THREAD_TLS
+diff --git a/init/main.c b/init/main.c
+index 020972fed1171..38a603f62b7bb 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -105,7 +105,6 @@
+ static int kernel_init(void *);
+ 
+ extern void init_IRQ(void);
+-extern void fork_init(void);
+ extern void radix_tree_init(void);
+ 
+ /*
+diff --git a/kernel/fork.c b/kernel/fork.c
+index aef1430bdce0b..8cb5cd7c97e19 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -163,10 +163,6 @@ static inline void free_task_struct(struct task_struct *tsk)
+ }
+ #endif
+ 
+-void __weak arch_release_thread_stack(unsigned long *stack)
+-{
+-}
+-
+ #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
+ 
+ /*
+@@ -376,7 +372,6 @@ static void release_task_stack(struct task_struct *tsk)
+ 		return;  /* Better to leak the stack than to free prematurely */
+ 
+ 	account_kernel_stack(tsk, -1);
+-	arch_release_thread_stack(tsk->stack);
+ 	free_thread_stack(tsk);
+ 	tsk->stack = NULL;
+ #ifdef CONFIG_VMAP_STACK
+-- 
+2.20.1
+
diff --git a/queue-4.19/geneve-change-net_udp_tunnel-dependency-to-select.patch b/queue-4.19/geneve-change-net_udp_tunnel-dependency-to-select.patch
new file mode 100644
index 00000000000..b90dc9846f8
--- /dev/null
+++ b/queue-4.19/geneve-change-net_udp_tunnel-dependency-to-select.patch
@@ -0,0 +1,44 @@
+From 75b724266aa5a6d8fff278d9934072f7e89ca3d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 15:32:36 +0100
+Subject: geneve: change NET_UDP_TUNNEL dependency to select
+
+From: Matteo Croce <mcroce@redhat.com>
+
+[ Upstream commit a7603ac1fc8ce1409f8ff70e6ce505f308b2c002 ]
+
+Due to the depends on NET_UDP_TUNNEL, at the moment it is impossible to
+compile GENEVE if no other protocol depending on NET_UDP_TUNNEL is
+selected.
+
+Fix this changing the depends to a select, and drop NET_IP_TUNNEL from the
+select list, as it already depends on NET_UDP_TUNNEL.
+
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+Reviewed-and-tested-by: Andrea Claudi <aclaudi@redhat.com>
+Tested-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index 619bf1498a662..0652caad57ec1 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -197,9 +197,9 @@ config VXLAN
+ 
+ config GENEVE
+        tristate "Generic Network Virtualization Encapsulation"
+-       depends on INET && NET_UDP_TUNNEL
++       depends on INET
+        depends on IPV6 || !IPV6
+-       select NET_IP_TUNNEL
++       select NET_UDP_TUNNEL
+        select GRO_CELLS
+        ---help---
+ 	  This allows one to create geneve virtual interfaces that provide
+-- 
+2.20.1
+
diff --git a/queue-4.19/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch b/queue-4.19/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
new file mode 100644
index 00000000000..d12c62118f5
--- /dev/null
+++ b/queue-4.19/gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
@@ -0,0 +1,37 @@
+From 8e0ee84b63f5979452dd0e249d89209558123b63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 08:29:32 -0600
+Subject: gfs2: take jdata unstuff into account in do_grow
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit bc0205612bbd4dd4026d4ba6287f5643c37366ec ]
+
+Before this patch, function do_grow would not reserve enough journal
+blocks in the transaction to unstuff jdata files while growing them.
+This patch adds the logic to add one more block if the file to grow
+is jdata.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/bmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 52feccedd7a44..096b479721395 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -2122,6 +2122,8 @@ static int do_grow(struct inode *inode, u64 size)
+ 	}
+ 
+ 	error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT +
++				 (unstuff &&
++				  gfs2_is_jdata(ip) ? RES_JDATA : 0) +
+ 				 (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ?
+ 				  0 : RES_QUOTA), 0);
+ 	if (error)
+-- 
+2.20.1
+
diff --git a/queue-4.19/gpio-pca953x-fix-ai-overflow-on-pcal6524.patch b/queue-4.19/gpio-pca953x-fix-ai-overflow-on-pcal6524.patch
new file mode 100644
index 00000000000..9439c5000e7
--- /dev/null
+++ b/queue-4.19/gpio-pca953x-fix-ai-overflow-on-pcal6524.patch
@@ -0,0 +1,41 @@
+From e0f8b760d08cc44ee5101d588e7fec79de7f63d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 02:39:50 +0100
+Subject: gpio: pca953x: Fix AI overflow on PCAL6524
+
+From: Marek Vasut <marek.vasut@gmail.com>
+
+[ Upstream commit 92f45ebe68181c2d7f76633ffae55bc9447d62cd ]
+
+The PCAL_PINCTRL_MASK is too large. The extended register block on
+PCAL6524, which is the largest chip with this block, has the block
+limited to address range 0x40..0x7f. This is because the bit 7 in
+the command register is used for the Address Increment functionality.
+
+Trim the mask to 0x60 to match the datasheet and to prevent accidental
+overwrite of the AI bit.
+
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index e0657fc72d31f..0232c25a15864 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -58,7 +58,7 @@
+ #define PCA_GPIO_MASK		0x00FF
+ 
+ #define PCAL_GPIO_MASK		0x1f
+-#define PCAL_PINCTRL_MASK	0xe0
++#define PCAL_PINCTRL_MASK	0x60
+ 
+ #define PCA_INT			0x0100
+ #define PCA_PCAL		0x0200
+-- 
+2.20.1
+
diff --git a/queue-4.19/gpio-raspberrypi-exp-decrease-refcount-on-firmware-d.patch b/queue-4.19/gpio-raspberrypi-exp-decrease-refcount-on-firmware-d.patch
new file mode 100644
index 00000000000..8085962ee7f
--- /dev/null
+++ b/queue-4.19/gpio-raspberrypi-exp-decrease-refcount-on-firmware-d.patch
@@ -0,0 +1,36 @@
+From b56d5b1c37dc0b2b1cb01ec7c94b8c2ef1f46736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:50:05 +0100
+Subject: gpio: raspberrypi-exp: decrease refcount on firmware dt node
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit 85af74c474b21940e88483fd48f6094145c89d97 ]
+
+We're getting a reference RPi's firmware node in order to be able to
+communicate with it's driver. We should decrease the reference count on
+the dt node after being done with it.
+
+Fixes: a98d90e7d588 ("gpio: raspberrypi-exp: Driver for RPi3 GPIO expander via mailbox service")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-raspberrypi-exp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpio-raspberrypi-exp.c b/drivers/gpio/gpio-raspberrypi-exp.c
+index d6d36d537e373..b77ea16ffa031 100644
+--- a/drivers/gpio/gpio-raspberrypi-exp.c
++++ b/drivers/gpio/gpio-raspberrypi-exp.c
+@@ -206,6 +206,7 @@ static int rpi_exp_gpio_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	fw = rpi_firmware_get(fw_node);
++	of_node_put(fw_node);
+ 	if (!fw)
+ 		return -EPROBE_DEFER;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch b/queue-4.19/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
new file mode 100644
index 00000000000..eb927dfc2fe
--- /dev/null
+++ b/queue-4.19/gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
@@ -0,0 +1,39 @@
+From d7c5c219e9bf544b08b598c8f82ebca9285166c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 10:45:49 +0100
+Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c5510b8dafce5f3f5a039c9b262ebcae0092c462 ]
+
+If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return
+the same type of error as regular version: NULL.  All the callers
+compare the return value of gpio_to_desc() against NULL, so returned
+ERR_PTR would be treated as non-error case leading to dereferencing of
+error value.
+
+Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index 412098b24f58b..8dfd8300d9c31 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -475,7 +475,7 @@ static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+ 
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+-	return ERR_PTR(-EINVAL);
++	return NULL;
+ }
+ 
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+-- 
+2.20.1
+
diff --git a/queue-4.19/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch b/queue-4.19/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch
new file mode 100644
index 00000000000..ccd8016048c
--- /dev/null
+++ b/queue-4.19/gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch
@@ -0,0 +1,62 @@
+From 2503ad8acf4eea396bf66663f3b459bc62b99db7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 16:46:29 +0100
+Subject: gpu: ipu-v3: pre: don't trigger update if buffer address doesn't
+ change
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit eb0200a4357da100064971689d3a0e9e3cf57f33 ]
+
+On a NOP double buffer update where current buffer address is the same
+as the next buffer address, the SDW_UPDATE bit clears too late. As we
+are now using this bit to determine when it is safe to signal flip
+completion to userspace this will delay completion of atomic commits
+where one plane doesn't change the buffer by a whole frame period.
+
+Fix this by remembering the last buffer address and just skip the
+double buffer update if it would not change the buffer address.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+[p.zabel@pengutronix.de: initialize last_bufaddr in ipu_pre_configure]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-pre.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
+index 2f8db9d625514..4a28f3fbb0a28 100644
+--- a/drivers/gpu/ipu-v3/ipu-pre.c
++++ b/drivers/gpu/ipu-v3/ipu-pre.c
+@@ -106,6 +106,7 @@ struct ipu_pre {
+ 	void			*buffer_virt;
+ 	bool			in_use;
+ 	unsigned int		safe_window_end;
++	unsigned int		last_bufaddr;
+ };
+ 
+ static DEFINE_MUTEX(ipu_pre_list_mutex);
+@@ -185,6 +186,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
+ 
+ 	writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
+ 	writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++	pre->last_bufaddr = bufaddr;
+ 
+ 	val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
+ 	      IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
+@@ -242,7 +244,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
+ 	unsigned short current_yblock;
+ 	u32 val;
+ 
++	if (bufaddr == pre->last_bufaddr)
++		return;
++
+ 	writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++	pre->last_bufaddr = bufaddr;
+ 
+ 	do {
+ 		if (time_after(jiffies, timeout)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch b/queue-4.19/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
new file mode 100644
index 00000000000..d333385a708
--- /dev/null
+++ b/queue-4.19/hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
@@ -0,0 +1,32 @@
+From dfa48b486da441488011669cb970533c03846607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:28:51 +1000
+Subject: HID: doc: fix wrong data structure reference for UHID_OUTPUT
+
+From: Peter Hutterer <peter.hutterer@who-t.net>
+
+[ Upstream commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 ]
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hid/uhid.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
+index c8656dd029a91..958fff9453044 100644
+--- a/Documentation/hid/uhid.txt
++++ b/Documentation/hid/uhid.txt
+@@ -160,7 +160,7 @@ them but you should handle them according to your needs.
+   UHID_OUTPUT:
+   This is sent if the HID device driver wants to send raw data to the I/O
+   device on the interrupt channel. You should read the payload and forward it to
+-  the device. The payload is of type "struct uhid_data_req".
++  the device. The payload is of type "struct uhid_output_req".
+   This may be received even though you haven't received UHID_OPEN, yet.
+ 
+   UHID_GET_REPORT:
+-- 
+2.20.1
+
diff --git a/queue-4.19/hid-intel-ish-hid-fixes-incorrect-error-handling.patch b/queue-4.19/hid-intel-ish-hid-fixes-incorrect-error-handling.patch
new file mode 100644
index 00000000000..233d177a0ea
--- /dev/null
+++ b/queue-4.19/hid-intel-ish-hid-fixes-incorrect-error-handling.patch
@@ -0,0 +1,37 @@
+From 5ad04712fab2a6c6027116d35bf3808bfbe8b941 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:52:33 +0800
+Subject: HID: intel-ish-hid: fixes incorrect error handling
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 6e0856d317440a950b17c00a9283114f025e5699 ]
+
+The memory chunk allocated by hid_allocate_device() should be released
+by hid_destroy_device(), not kfree().
+
+Fixes: 0b28cb4bcb1("HID: intel-ish-hid: ISH HID client driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ishtp-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c
+index cd23903ddcf19..e918d78e541c0 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.c
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c
+@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,
+ err_hid_device:
+ 	kfree(hid_data);
+ err_hid_data:
+-	kfree(hid);
++	hid_destroy_device(hid);
+ 	return rv;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch b/queue-4.19/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
new file mode 100644
index 00000000000..8de9fd0d487
--- /dev/null
+++ b/queue-4.19/ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
@@ -0,0 +1,38 @@
+From 9816d58d7bbc2e6dfd309917bcfdfeeec3a37eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 10:05:36 +0300
+Subject: IB/qib: Fix an error code in qib_sdma_verbs_send()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 ]
+
+We accidentally return success on this error path.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
+index d0723d4aef5c9..7424e88b0d918 100644
+--- a/drivers/infiniband/hw/qib/qib_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_sdma.c
+@@ -576,8 +576,10 @@ retry:
+ 		dw = (len + 3) >> 2;
+ 		addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
+ 				      dw << 2, DMA_TO_DEVICE);
+-		if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
++		if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
++			ret = -ENOMEM;
+ 			goto unmap;
++		}
+ 		sdmadesc[0] = 0;
+ 		make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
+ 		/* SDmaUseLargeBuf has to be set in every descriptor */
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-rxe-make-counters-thread-safe.patch b/queue-4.19/ib-rxe-make-counters-thread-safe.patch
new file mode 100644
index 00000000000..5b40139717c
--- /dev/null
+++ b/queue-4.19/ib-rxe-make-counters-thread-safe.patch
@@ -0,0 +1,62 @@
+From 5ea5142fd9194614025871d0308ccaec8a6fdef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 00:32:42 -0600
+Subject: IB/rxe: Make counters thread safe
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit d5108e69fe013ff47ab815b849caba9cc33ca1e5 ]
+
+Current rxe device counters are not thread safe.
+When multiple QPs are used, they can be racy.
+Make them thread safe by making it atomic64.
+
+Fixes: 0b1e5b99a48b ("IB/rxe: Add port protocol stats")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_hw_counters.c | 2 +-
+ drivers/infiniband/sw/rxe/rxe_verbs.h       | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+index 6aeb7a165e469..ea4542a9d69e6 100644
+--- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c
++++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev,
+ 		return -EINVAL;
+ 
+ 	for (cnt = 0; cnt  < ARRAY_SIZE(rxe_counter_name); cnt++)
+-		stats->value[cnt] = dev->stats_counters[cnt];
++		stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]);
+ 
+ 	return ARRAY_SIZE(rxe_counter_name);
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index a0ec28d2b71a4..6a75f96b90962 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -409,16 +409,16 @@ struct rxe_dev {
+ 	spinlock_t		mmap_offset_lock; /* guard mmap_offset */
+ 	int			mmap_offset;
+ 
+-	u64			stats_counters[RXE_NUM_OF_COUNTERS];
++	atomic64_t		stats_counters[RXE_NUM_OF_COUNTERS];
+ 
+ 	struct rxe_port		port;
+ 	struct list_head	list;
+ 	struct crypto_shash	*tfm;
+ };
+ 
+-static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt)
++static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index)
+ {
+-	rxe->stats_counters[cnt]++;
++	atomic64_inc(&rxe->stats_counters[index]);
+ }
+ 
+ static inline struct rxe_dev *to_rdev(struct ib_device *dev)
+-- 
+2.20.1
+
diff --git a/queue-4.19/idr-fix-idr_alloc_u32-on-32-bit-systems.patch b/queue-4.19/idr-fix-idr_alloc_u32-on-32-bit-systems.patch
new file mode 100644
index 00000000000..cd08b79e8e3
--- /dev/null
+++ b/queue-4.19/idr-fix-idr_alloc_u32-on-32-bit-systems.patch
@@ -0,0 +1,35 @@
+From 8dfdfa50646659cc03c46a6bad20b5c9e11a4d36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 00:25:08 -0400
+Subject: idr: Fix idr_alloc_u32 on 32-bit systems
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ]
+
+Attempting to allocate an entry at 0xffffffff when one is already
+present would succeed in allocating one at 2^32, which would confuse
+everything.  Return -ENOSPC in this case, as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/radix-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index bc03ecc4dfd2f..e5cab5c4e3830 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -2172,7 +2172,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root,
+ 			offset = radix_tree_find_next_bit(node, IDR_FREE,
+ 							offset + 1);
+ 			start = next_index(start, node, offset);
+-			if (start > max)
++			if (start > max || start == 0)
+ 				return ERR_PTR(-ENOSPC);
+ 			while (offset == RADIX_TREE_MAP_SIZE) {
+ 				offset = node->offset + 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/idr-fix-integer-overflow-in-idr_for_each_entry.patch b/queue-4.19/idr-fix-integer-overflow-in-idr_for_each_entry.patch
new file mode 100644
index 00000000000..b2883ade485
--- /dev/null
+++ b/queue-4.19/idr-fix-integer-overflow-in-idr_for_each_entry.patch
@@ -0,0 +1,38 @@
+From d5f33257b2861b219848f1d7909aac4f26c8cf62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 06:36:43 -0500
+Subject: idr: Fix integer overflow in idr_for_each_entry
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ]
+
+If there is an entry at INT_MAX then idr_for_each_entry() will increment
+id after handling it.  This is undefined behaviour, and is caught by
+UBSAN.  Adding 1U to id forces the operation to be carried out as an
+unsigned addition which (when assigned to id) will result in INT_MIN.
+Since there is never an entry stored at INT_MIN, idr_get_next() will
+return NULL, ending the loop as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/idr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/idr.h b/include/linux/idr.h
+index 3ec8628ce17f0..b6c6151c7446f 100644
+--- a/include/linux/idr.h
++++ b/include/linux/idr.h
+@@ -185,7 +185,7 @@ static inline void idr_preload_end(void)
+  * is convenient for a "not found" value.
+  */
+ #define idr_for_each_entry(idr, entry, id)			\
+-	for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)
++	for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
+ 
+ /**
+  * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
+-- 
+2.20.1
+
diff --git a/queue-4.19/infiniband-bnxt_re-qplib-check-the-return-value-of-s.patch b/queue-4.19/infiniband-bnxt_re-qplib-check-the-return-value-of-s.patch
new file mode 100644
index 00000000000..b8cbb1f3379
--- /dev/null
+++ b/queue-4.19/infiniband-bnxt_re-qplib-check-the-return-value-of-s.patch
@@ -0,0 +1,39 @@
+From 825d5b8f96c18e24cfbe7ddce2de2fbd2bc49d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 12:56:22 -0600
+Subject: infiniband: bnxt_re: qplib: Check the return value of send_message
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 94edd87a1c59f3efa6fdf4e98d6d492e6cec6173 ]
+
+In bnxt_qplib_map_tc2cos(), bnxt_qplib_rcfw_send_message() can return an
+error value but it is lost. Propagate this error to the callers.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Acked-By: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index 4097f3fa25c5f..09e7d3dd30553 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -775,9 +775,8 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids)
+ 	req.cos0 = cpu_to_le16(cids[0]);
+ 	req.cos1 = cpu_to_le16(cids[1]);
+ 
+-	bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp, NULL,
+-				     0);
+-	return 0;
++	return bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
++						NULL, 0);
+ }
+ 
+ int bnxt_qplib_get_roce_stats(struct bnxt_qplib_rcfw *rcfw,
+-- 
+2.20.1
+
diff --git a/queue-4.19/infiniband-qedr-potential-null-ptr-dereference-of-qp.patch b/queue-4.19/infiniband-qedr-potential-null-ptr-dereference-of-qp.patch
new file mode 100644
index 00000000000..16e33e5c75c
--- /dev/null
+++ b/queue-4.19/infiniband-qedr-potential-null-ptr-dereference-of-qp.patch
@@ -0,0 +1,36 @@
+From 8cd93d4d6849c740ab0ffd722be88e64e772dc90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Dec 2018 12:24:45 -0600
+Subject: infiniband/qedr: Potential null ptr dereference of qp
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 9c6260de505b63638dd86fcc33849b17f6146d94 ]
+
+idr_find() may fail and return a NULL pointer. The fix checks the return
+value of the function and returns an error in case of NULL.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index 505fa36487629..93b16237b7677 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -492,6 +492,8 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ 	int i;
+ 
+ 	qp = idr_find(&dev->qpidr.idr, conn_param->qpn);
++	if (unlikely(!qp))
++		return -EINVAL;
+ 
+ 	laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
+ 	raddr = (struct sockaddr_in *)&cm_id->m_remote_addr;
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch b/queue-4.19/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
new file mode 100644
index 00000000000..eb455b7760e
--- /dev/null
+++ b/queue-4.19/iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
@@ -0,0 +1,44 @@
+From 7c59e83f124ed1c15d43d303635d00a5b78affc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2019 21:53:24 +0800
+Subject: iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit bb6bccba390c7d743c1e4427de4ef284c8cc6869 ]
+
+Add a non-NULL check to fix potential NULL pointer dereference
+Cleanup code to call function once.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Fixes: 2bf9a0a12749b ('iommu/amd: Add iommu support for ACPI HID devices')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 1f2ed44de2438..fe18804a50083 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key;
+ static inline int match_hid_uid(struct device *dev,
+ 				struct acpihid_map_entry *entry)
+ {
++	struct acpi_device *adev = ACPI_COMPANION(dev);
+ 	const char *hid, *uid;
+ 
+-	hid = acpi_device_hid(ACPI_COMPANION(dev));
+-	uid = acpi_device_uid(ACPI_COMPANION(dev));
++	if (!adev)
++		return -ENODEV;
++
++	hid = acpi_device_hid(adev);
++	uid = acpi_device_uid(adev);
+ 
+ 	if (!hid || !(*hid))
+ 		return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.19/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch b/queue-4.19/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
new file mode 100644
index 00000000000..fd7ef49c4ce
--- /dev/null
+++ b/queue-4.19/ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
@@ -0,0 +1,53 @@
+From 8a3378a691f7cb581045282ff09d080277ea99e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 13:11:25 +0800
+Subject: ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit d71b57532d70c03f4671dd04e84157ac6bf021b0 ]
+
+ip l add dev tun type gretap key 1000
+ip a a dev tun 10.0.0.1/24
+
+Packets with tun-id 1000 can be recived by tun dev. But packet can't
+be sent through dev tun for non-tunnel-dst
+
+With this patch: tunnel-dst can be get through lwtunnel like beflow:
+ip r a 10.0.0.7 encap ip dst 172.168.0.11 dev tun
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index c4f5602308edc..054d01c16dc6a 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -644,13 +644,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	dst = tnl_params->daddr;
+ 	if (dst == 0) {
+ 		/* NBMA tunnel */
++		struct ip_tunnel_info *tun_info;
+ 
+ 		if (!skb_dst(skb)) {
+ 			dev->stats.tx_fifo_errors++;
+ 			goto tx_error;
+ 		}
+ 
+-		if (skb->protocol == htons(ETH_P_IP)) {
++		tun_info = skb_tunnel_info(skb);
++		if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
++		    ip_tunnel_info_af(tun_info) == AF_INET &&
++		    tun_info->key.u.ipv4.dst)
++			dst = tun_info->key.u.ipv4.dst;
++		else if (skb->protocol == htons(ETH_P_IP)) {
+ 			rt = skb_rtable(skb);
+ 			dst = rt_nexthop(rt, inner_iph->daddr);
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch b/queue-4.19/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch
new file mode 100644
index 00000000000..9058c4e1496
--- /dev/null
+++ b/queue-4.19/iwlwifi-move-iwl_nvm_check_version-into-dvm.patch
@@ -0,0 +1,130 @@
+From a71efe489f80d62f0150043110da5e10a8097a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 09:23:08 +0300
+Subject: iwlwifi: move iwl_nvm_check_version() into dvm
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 64866e5da1eabd0c52ff45029b245f5465920031 ]
+
+This function is only half-used by mvm (i.e. only the nvm_version part
+matters, since the calibration version is irrelevant), so it's
+pointless to export it from iwlwifi.  If mvm uses this function, it
+has the additional complexity of setting the calib version to a bogus
+value on all cfg structs.
+
+To avoid this, move the function to dvm and make a simple comparison
+of the nvm_version in mvm instead.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/main.c | 17 +++++++++++++++++
+ .../wireless/intel/iwlwifi/iwl-eeprom-parse.c | 19 -------------------
+ .../wireless/intel/iwlwifi/iwl-eeprom-parse.h |  5 ++---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c   |  4 +++-
+ 4 files changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+index 030482b357a3c..06dd4e81b7374 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+@@ -1227,6 +1227,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
+ 	return 0;
+ }
+ 
++static int iwl_nvm_check_version(struct iwl_nvm_data *data,
++				 struct iwl_trans *trans)
++{
++	if (data->nvm_version >= trans->cfg->nvm_ver ||
++	    data->calib_version >= trans->cfg->nvm_calib_ver) {
++		IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
++			       data->nvm_version, data->calib_version);
++		return 0;
++	}
++
++	IWL_ERR(trans,
++		"Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
++		data->nvm_version, trans->cfg->nvm_ver,
++		data->calib_version,  trans->cfg->nvm_calib_ver);
++	return -EINVAL;
++}
++
+ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
+ 						 const struct iwl_cfg *cfg,
+ 						 const struct iwl_fw *fw,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+index a4c96215933ba..a59bab8345f4e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ 	return NULL;
+ }
+ IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data);
+-
+-/* helper functions */
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+-			     struct iwl_trans *trans)
+-{
+-	if (data->nvm_version >= trans->cfg->nvm_ver ||
+-	    data->calib_version >= trans->cfg->nvm_calib_ver) {
+-		IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
+-			       data->nvm_version, data->calib_version);
+-		return 0;
+-	}
+-
+-	IWL_ERR(trans,
+-		"Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
+-		data->nvm_version, trans->cfg->nvm_ver,
+-		data->calib_version,  trans->cfg->nvm_calib_ver);
+-	return -EINVAL;
+-}
+-IWL_EXPORT_SYMBOL(iwl_nvm_check_version);
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+index 8be50ed12300f..c59dd47cf15d3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+@@ -7,6 +7,7 @@
+  *
+  * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of version 2 of the GNU General Public License as
+@@ -33,6 +34,7 @@
+  *
+  * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+  * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+  * All rights reserved.
+  *
+  * Redistribution and use in source and binary forms, with or without
+@@ -122,9 +124,6 @@ struct iwl_nvm_data *
+ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ 		      const u8 *eeprom, size_t eeprom_size);
+ 
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+-			  struct iwl_trans *trans);
+-
+ int iwl_init_sband_channels(struct iwl_nvm_data *data,
+ 			    struct ieee80211_supported_band *sband,
+ 			    int n_channels, enum nl80211_band band);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 2eba6d6f367f8..9808d954dca29 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -547,7 +547,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ 	if (mvm->nvm_file_name)
+ 		iwl_mvm_load_nvm_to_nic(mvm);
+ 
+-	WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans));
++	WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver,
++		  "Too old NVM version (0x%0x, required = 0x%0x)",
++		  mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver);
+ 
+ 	/*
+ 	 * abort after reading the nvm in case RF Kill is on, we will complete
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-mvm-force-tcm-re-evaluation-on-tcm-resume.patch b/queue-4.19/iwlwifi-mvm-force-tcm-re-evaluation-on-tcm-resume.patch
new file mode 100644
index 00000000000..ba4aa0d890d
--- /dev/null
+++ b/queue-4.19/iwlwifi-mvm-force-tcm-re-evaluation-on-tcm-resume.patch
@@ -0,0 +1,66 @@
+From 5f3d760983b8d42177f8b88c76ec6510845e2370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Aug 2018 12:23:39 +0300
+Subject: iwlwifi: mvm: force TCM re-evaluation on TCM resume
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 7bc2468277033e05401d5f8fd48a772f407338c2 ]
+
+When traffic load is not low or low latency is active, TCM schedules
+re-evaluation work so in case traffic stops TCM will detect that
+traffic load has become low or that low latency is no longer active.
+However, if TCM is paused when the re-evaluation work runs, it does
+not re-evaluate and the re-evaluation work is no longer scheduled.
+As a result, TCM will not indicate that low latency is no longer
+active or that traffic load is low when traffic stops.
+
+Fix this by forcing TCM re-evaluation when TCM is resumed in case
+low latency is active or traffic load is not low.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index 6a5349401aa99..00712205c05f2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -1804,6 +1804,7 @@ void iwl_mvm_pause_tcm(struct iwl_mvm *mvm, bool with_cancel)
+ void iwl_mvm_resume_tcm(struct iwl_mvm *mvm)
+ {
+ 	int mac;
++	bool low_latency = false;
+ 
+ 	spin_lock_bh(&mvm->tcm.lock);
+ 	mvm->tcm.ts = jiffies;
+@@ -1815,10 +1816,23 @@ void iwl_mvm_resume_tcm(struct iwl_mvm *mvm)
+ 		memset(&mdata->tx.pkts, 0, sizeof(mdata->tx.pkts));
+ 		memset(&mdata->rx.airtime, 0, sizeof(mdata->rx.airtime));
+ 		memset(&mdata->tx.airtime, 0, sizeof(mdata->tx.airtime));
++
++		if (mvm->tcm.result.low_latency[mac])
++			low_latency = true;
+ 	}
+ 	/* The TCM data needs to be reset before "paused" flag changes */
+ 	smp_mb();
+ 	mvm->tcm.paused = false;
++
++	/*
++	 * if the current load is not low or low latency is active, force
++	 * re-evaluation to cover the case of no traffic.
++	 */
++	if (mvm->tcm.result.global_load > IWL_MVM_TRAFFIC_LOW)
++		schedule_delayed_work(&mvm->tcm.work, MVM_TCM_PERIOD);
++	else if (low_latency)
++		schedule_delayed_work(&mvm->tcm.work, MVM_LL_PERIOD);
++
+ 	spin_unlock_bh(&mvm->tcm.lock);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-pcie-fix-erroneous-print.patch b/queue-4.19/iwlwifi-pcie-fix-erroneous-print.patch
new file mode 100644
index 00000000000..03e66b42bf0
--- /dev/null
+++ b/queue-4.19/iwlwifi-pcie-fix-erroneous-print.patch
@@ -0,0 +1,55 @@
+From 4cc76dadb8f34fc633e44420eb8289841e6455d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 13:01:09 +0300
+Subject: iwlwifi: pcie: fix erroneous print
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 0916224eaa77bff0fbbc747961d550ff8db45457 ]
+
+When removing the driver, the following flow can happen:
+1. host command is in progress, for example at index 68.
+2. RX interrupt is received with the response.
+3. Before it is processed, the remove flow kicks in, and
+   calls iwl_pcie_txq_unmap. The function cleans all DMA,
+   and promotes the read pointer to 69.
+4. RX thread proceeds with the processing, and is calling
+   iwl_pcie_cmdq_reclaim, which will print this error:
+   iwl_pcie_cmdq_reclaim: Read index for DMA queue txq id (0),
+   index 4 is out of range [0-256] 69 69.
+
+Detect this situation, and avoid the print. Change it to
+warning while at it, to make such issues more noticeable
+in the future.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 2fec394a988c1..b73582ec03a08 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1247,11 +1247,11 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
+ 
+ 	if (idx >= trans->cfg->base_params->max_tfd_queue_size ||
+ 	    (!iwl_queue_used(txq, idx))) {
+-		IWL_ERR(trans,
+-			"%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
+-			__func__, txq_id, idx,
+-			trans->cfg->base_params->max_tfd_queue_size,
+-			txq->write_ptr, txq->read_ptr);
++		WARN_ONCE(test_bit(txq_id, trans_pcie->queue_used),
++			  "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
++			  __func__, txq_id, idx,
++			  trans->cfg->base_params->max_tfd_queue_size,
++			  txq->write_ptr, txq->read_ptr);
+ 		return;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-pcie-set-cmd_len-in-the-correct-place.patch b/queue-4.19/iwlwifi-pcie-set-cmd_len-in-the-correct-place.patch
new file mode 100644
index 00000000000..2d6e3370562
--- /dev/null
+++ b/queue-4.19/iwlwifi-pcie-set-cmd_len-in-the-correct-place.patch
@@ -0,0 +1,66 @@
+From d54687dd3782d7b47855c115b55d81540cddd1e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 10:07:32 +0300
+Subject: iwlwifi: pcie: set cmd_len in the correct place
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 956343a61226e1af3d146386f70a059feb567d0c ]
+
+command len is set too early in the code, since when building
+AMSDU, the size changes. This causes the byte count table to
+have the wrong size.
+
+Fixes: a0ec0169b7a9 ("iwlwifi: support new tx api")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 61ffa1d1a00d7..316e2ba0c34d7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -560,18 +560,6 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+ 
+ 	spin_lock(&txq->lock);
+ 
+-	if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
+-		struct iwl_tx_cmd_gen3 *tx_cmd_gen3 =
+-			(void *)dev_cmd->payload;
+-
+-		cmd_len = le16_to_cpu(tx_cmd_gen3->len);
+-	} else {
+-		struct iwl_tx_cmd_gen2 *tx_cmd_gen2 =
+-			(void *)dev_cmd->payload;
+-
+-		cmd_len = le16_to_cpu(tx_cmd_gen2->len);
+-	}
+-
+ 	if (iwl_queue_space(trans, txq) < txq->high_mark) {
+ 		iwl_stop_queue(trans, txq);
+ 
+@@ -609,6 +597,18 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+ 		return -1;
+ 	}
+ 
++	if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
++		struct iwl_tx_cmd_gen3 *tx_cmd_gen3 =
++			(void *)dev_cmd->payload;
++
++		cmd_len = le16_to_cpu(tx_cmd_gen3->len);
++	} else {
++		struct iwl_tx_cmd_gen2 *tx_cmd_gen2 =
++			(void *)dev_cmd->payload;
++
++		cmd_len = le16_to_cpu(tx_cmd_gen2->len);
++	}
++
+ 	/* Set up entry for this TFD in Tx byte-count array */
+ 	iwl_pcie_gen2_update_byte_tbl(trans_pcie, txq, cmd_len,
+ 				      iwl_pcie_gen2_get_num_tbs(trans, tfd));
+-- 
+2.20.1
+
diff --git a/queue-4.19/kprobes-blacklist-symbols-in-arch-defined-prohibited.patch b/queue-4.19/kprobes-blacklist-symbols-in-arch-defined-prohibited.patch
new file mode 100644
index 00000000000..b8449ede732
--- /dev/null
+++ b/queue-4.19/kprobes-blacklist-symbols-in-arch-defined-prohibited.patch
@@ -0,0 +1,149 @@
+From 46c8231f8e641715c9886672120d9ffe65d87691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 17:20:55 +0900
+Subject: kprobes: Blacklist symbols in arch-defined prohibited area
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fb1a59fae8baa3f3c69b72a87ff94fc4fa5683ec ]
+
+Blacklist symbols in arch-defined probe-prohibited areas.
+With this change, user can see all symbols which are prohibited
+to probe in debugfs.
+
+All archtectures which have custom prohibit areas should define
+its own arch_populate_kprobe_blacklist() function, but unless that,
+all symbols marked __kprobes are blacklisted.
+
+Reported-by: Andrea Righi <righi.andrea@gmail.com>
+Tested-by: Andrea Righi <righi.andrea@gmail.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lkml.kernel.org/r/154503485491.26176.15823229545155174796.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kprobes.h |  3 ++
+ kernel/kprobes.c        | 67 ++++++++++++++++++++++++++++++++---------
+ 2 files changed, 56 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index 32cae0f35b9d4..9adb92ad24d3f 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -243,10 +243,13 @@ extern int arch_init_kprobes(void);
+ extern void show_registers(struct pt_regs *regs);
+ extern void kprobes_inc_nmissed_count(struct kprobe *p);
+ extern bool arch_within_kprobe_blacklist(unsigned long addr);
++extern int arch_populate_kprobe_blacklist(void);
+ extern bool arch_kprobe_on_func_entry(unsigned long offset);
+ extern bool kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset);
+ 
+ extern bool within_kprobe_blacklist(unsigned long addr);
++extern int kprobe_add_ksym_blacklist(unsigned long entry);
++extern int kprobe_add_area_blacklist(unsigned long start, unsigned long end);
+ 
+ struct kprobe_insn_cache {
+ 	struct mutex mutex;
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index aed90788db5c1..f4e4095ec7eae 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2096,6 +2096,47 @@ void dump_kprobe(struct kprobe *kp)
+ }
+ NOKPROBE_SYMBOL(dump_kprobe);
+ 
++int kprobe_add_ksym_blacklist(unsigned long entry)
++{
++	struct kprobe_blacklist_entry *ent;
++	unsigned long offset = 0, size = 0;
++
++	if (!kernel_text_address(entry) ||
++	    !kallsyms_lookup_size_offset(entry, &size, &offset))
++		return -EINVAL;
++
++	ent = kmalloc(sizeof(*ent), GFP_KERNEL);
++	if (!ent)
++		return -ENOMEM;
++	ent->start_addr = entry;
++	ent->end_addr = entry + size;
++	INIT_LIST_HEAD(&ent->list);
++	list_add_tail(&ent->list, &kprobe_blacklist);
++
++	return (int)size;
++}
++
++/* Add all symbols in given area into kprobe blacklist */
++int kprobe_add_area_blacklist(unsigned long start, unsigned long end)
++{
++	unsigned long entry;
++	int ret = 0;
++
++	for (entry = start; entry < end; entry += ret) {
++		ret = kprobe_add_ksym_blacklist(entry);
++		if (ret < 0)
++			return ret;
++		if (ret == 0)	/* In case of alias symbol */
++			ret = 1;
++	}
++	return 0;
++}
++
++int __init __weak arch_populate_kprobe_blacklist(void)
++{
++	return 0;
++}
++
+ /*
+  * Lookup and populate the kprobe_blacklist.
+  *
+@@ -2107,26 +2148,24 @@ NOKPROBE_SYMBOL(dump_kprobe);
+ static int __init populate_kprobe_blacklist(unsigned long *start,
+ 					     unsigned long *end)
+ {
++	unsigned long entry;
+ 	unsigned long *iter;
+-	struct kprobe_blacklist_entry *ent;
+-	unsigned long entry, offset = 0, size = 0;
++	int ret;
+ 
+ 	for (iter = start; iter < end; iter++) {
+ 		entry = arch_deref_entry_point((void *)*iter);
+-
+-		if (!kernel_text_address(entry) ||
+-		    !kallsyms_lookup_size_offset(entry, &size, &offset))
++		ret = kprobe_add_ksym_blacklist(entry);
++		if (ret == -EINVAL)
+ 			continue;
+-
+-		ent = kmalloc(sizeof(*ent), GFP_KERNEL);
+-		if (!ent)
+-			return -ENOMEM;
+-		ent->start_addr = entry;
+-		ent->end_addr = entry + size;
+-		INIT_LIST_HEAD(&ent->list);
+-		list_add_tail(&ent->list, &kprobe_blacklist);
++		if (ret < 0)
++			return ret;
+ 	}
+-	return 0;
++
++	/* Symbols in __kprobes_text are blacklisted */
++	ret = kprobe_add_area_blacklist((unsigned long)__kprobes_text_start,
++					(unsigned long)__kprobes_text_end);
++
++	return ret ? : arch_populate_kprobe_blacklist();
+ }
+ 
+ /* Module notifier call back, checking kprobes on the module */
+-- 
+2.20.1
+
diff --git a/queue-4.19/kprobes-x86-show-x86-64-specific-blacklisted-symbols.patch b/queue-4.19/kprobes-x86-show-x86-64-specific-blacklisted-symbols.patch
new file mode 100644
index 00000000000..fe0806d0579
--- /dev/null
+++ b/queue-4.19/kprobes-x86-show-x86-64-specific-blacklisted-symbols.patch
@@ -0,0 +1,52 @@
+From ec4c7f31b9b1cf14a98b574cb3f356cc3b53d28c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 17:21:24 +0900
+Subject: kprobes/x86: Show x86-64 specific blacklisted symbols correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fe6e65615415987629a2dda583b4495677d8c388 ]
+
+Show x86-64 specific blacklisted symbols in debugfs.
+
+Since x86-64 prohibits probing on symbols which are in
+entry text, those should be shown.
+
+Tested-by: Andrea Righi <righi.andrea@gmail.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lkml.kernel.org/r/154503488425.26176.17136784384033608516.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index e83a057564d1b..173e915e11d54 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1140,6 +1140,12 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
+ 		is_in_entry_trampoline_section;
+ }
+ 
++int __init arch_populate_kprobe_blacklist(void)
++{
++	return kprobe_add_area_blacklist((unsigned long)__entry_text_start,
++					 (unsigned long)__entry_text_end);
++}
++
+ int __init arch_init_kprobes(void)
+ {
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch b/queue-4.19/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch
new file mode 100644
index 00000000000..72273e6ba51
--- /dev/null
+++ b/queue-4.19/kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch
@@ -0,0 +1,45 @@
+From e8f9335250ba29ae75f188b6796f5d9fd126280a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 16:12:57 +0100
+Subject: kprobes/x86/xen: blacklist non-attachable xen interrupt functions
+
+From: Andrea Righi <righi.andrea@gmail.com>
+
+[ Upstream commit bf9445a33ae6ac2f0822d2f1ce1365408387d568 ]
+
+Blacklist symbols in Xen probe-prohibited areas, so that user can see
+these prohibited symbols in debugfs.
+
+See also: a50480cb6d61.
+
+Signed-off-by: Andrea Righi <righi.andrea@gmail.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/xen-asm_64.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
+index 3a6feed76dfc1..a93d8a7cef26c 100644
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -12,6 +12,7 @@
+ #include <asm/segment.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/asm.h>
+ 
+ #include <xen/interface/xen.h>
+ 
+@@ -24,6 +25,7 @@ ENTRY(xen_\name)
+ 	pop %r11
+ 	jmp  \name
+ END(xen_\name)
++_ASM_NOKPROBE(xen_\name)
+ .endm
+ 
+ xen_pv_trap divide_error
+-- 
+2.20.1
+
diff --git a/queue-4.19/kvm-properly-check-debugfs-dentry-before-using-it.patch b/queue-4.19/kvm-properly-check-debugfs-dentry-before-using-it.patch
new file mode 100644
index 00000000000..17f176518f2
--- /dev/null
+++ b/queue-4.19/kvm-properly-check-debugfs-dentry-before-using-it.patch
@@ -0,0 +1,49 @@
+From d930caf7b155c0986c2f0719bbe0da3ee1e9d70f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 16:34:37 +0100
+Subject: kvm: properly check debugfs dentry before using it
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 8ed0579c12b2fe56a1fac2f712f58fc26c1dc49b ]
+
+debugfs can now report an error code if something went wrong instead of
+just NULL.  So if the return value is to be used as a "real" dentry, it
+needs to be checked if it is an error before dereferencing it.
+
+This is now happening because of ff9fb72bc077 ("debugfs: return error
+values, not NULL").  syzbot has found a way to trigger multiple debugfs
+files attempting to be created, which fails, and then the error code
+gets passed to dentry_path_raw() which obviously does not like it.
+
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Reported-and-tested-by: syzbot+7857962b4d45e602b8ad@syzkaller.appspotmail.com
+Cc: "Radim Krčmář" <rkrcmar@redhat.com>
+Cc: kvm@vger.kernel.org
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ virt/kvm/kvm_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index df3fc0f214ece..9502b1a44232c 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3990,7 +3990,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
+ 	}
+ 	add_uevent_var(env, "PID=%d", kvm->userspace_pid);
+ 
+-	if (kvm->debugfs_dentry) {
++	if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) {
+ 		char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);
+ 
+ 		if (p) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch b/queue-4.19/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
new file mode 100644
index 00000000000..c47bb2a62f6
--- /dev/null
+++ b/queue-4.19/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
@@ -0,0 +1,67 @@
+From f2ae51cb976b711f15aad8e0ef08331d969e9046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 15:32:06 +0100
+Subject: KVM: s390: unregister debug feature on failing arch init
+
+From: Michael Mueller <mimu@linux.ibm.com>
+
+[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
+
+Make sure the debug feature and its allocated resources get
+released upon unsuccessful architecture initialization.
+
+A related indication of the issue will be reported as kernel
+message.
+
+Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 3c317bc6b7997..db3196aebaa1c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -416,19 +416,30 @@ static void kvm_s390_cpu_feat_init(void)
+ 
+ int kvm_arch_init(void *opaque)
+ {
++	int rc;
++
+ 	kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
+ 	if (!kvm_s390_dbf)
+ 		return -ENOMEM;
+ 
+ 	if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
+-		debug_unregister(kvm_s390_dbf);
+-		return -ENOMEM;
++		rc = -ENOMEM;
++		goto out_debug_unreg;
+ 	}
+ 
+ 	kvm_s390_cpu_feat_init();
+ 
+ 	/* Register floating interrupt controller interface. */
+-	return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++	rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++	if (rc) {
++		pr_err("Failed to register FLIC rc=%d\n", rc);
++		goto out_debug_unreg;
++	}
++	return 0;
++
++out_debug_unreg:
++	debug_unregister(kvm_s390_dbf);
++	return rc;
+ }
+ 
+ void kvm_arch_exit(void)
+-- 
+2.20.1
+
diff --git a/queue-4.19/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch b/queue-4.19/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch
new file mode 100644
index 00000000000..1be5d971aad
--- /dev/null
+++ b/queue-4.19/kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch
@@ -0,0 +1,52 @@
+From 5095098fd6e2cdb8167bb12c6e69297c304b860c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 15:28:58 -0800
+Subject: kvm: vmx: Set IA32_TSC_AUX for legacy mode guests
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit 0023ef39dc35c773c436eaa46ca539a26b308b55 ]
+
+RDTSCP is supported in legacy mode as well as long mode. The
+IA32_TSC_AUX MSR should be set to the correct guest value before
+entering any guest that supports RDTSCP.
+
+Fixes: 4e47c7a6d714 ("KVM: VMX: Add instruction rdtscp support for guest")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Peter Shier <pshier@google.com>
+Reviewed-by: Marc Orr <marcorr@google.com>
+Reviewed-by: Liran Alon <liran.alon@oracle.com>
+Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 0b7559bf15ea7..38293386db875 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3404,9 +3404,6 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ 		index = __find_msr_index(vmx, MSR_CSTAR);
+ 		if (index >= 0)
+ 			move_msr_up(vmx, index, save_nmsrs++);
+-		index = __find_msr_index(vmx, MSR_TSC_AUX);
+-		if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
+-			move_msr_up(vmx, index, save_nmsrs++);
+ 		/*
+ 		 * MSR_STAR is only needed on long mode guests, and only
+ 		 * if efer.sce is enabled.
+@@ -3419,6 +3416,9 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ 	index = __find_msr_index(vmx, MSR_EFER);
+ 	if (index >= 0 && update_transition_efer(vmx, index))
+ 		move_msr_up(vmx, index, save_nmsrs++);
++	index = __find_msr_index(vmx, MSR_TSC_AUX);
++	if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
++		move_msr_up(vmx, index, save_nmsrs++);
+ 
+ 	vmx->save_nmsrs = save_nmsrs;
+ 	vmx->guest_msrs_dirty = true;
+-- 
+2.20.1
+
diff --git a/queue-4.19/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch b/queue-4.19/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
new file mode 100644
index 00000000000..9d5285fc354
--- /dev/null
+++ b/queue-4.19/lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
@@ -0,0 +1,167 @@
+From ade05847ef0a972099d9829747ea57b3dd354f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:44 -0800
+Subject: lib/genalloc.c: fix allocation of aligned buffer from non-aligned
+ chunk
+
+From: Alexey Skidanov <alexey.skidanov@intel.com>
+
+[ Upstream commit 52fbf1134d479234d7e64ba9dcbaea23405f229e ]
+
+gen_pool_alloc_algo() uses different allocation functions implementing
+different allocation algorithms.  With gen_pool_first_fit_align()
+allocation function, the returned address should be aligned on the
+requested boundary.
+
+If chunk start address isn't aligned on the requested boundary, the
+returned address isn't aligned too.  The only way to get properly
+aligned address is to initialize the pool with chunks aligned on the
+requested boundary.  If want to have an ability to allocate buffers
+aligned on different boundaries (for example, 4K, 1MB, ...), the chunk
+start address should be aligned on the max possible alignment.
+
+This happens because gen_pool_first_fit_align() looks for properly
+aligned memory block without taking into account the chunk start address
+alignment.
+
+To fix this, we provide chunk start address to
+gen_pool_first_fit_align() and change its implementation such that it
+starts looking for properly aligned block with appropriate offset
+(exactly as is done in CMA).
+
+Link: https://lkml.kernel.org/lkml/a170cf65-6884-3592-1de9-4c235888cc8a@intel.com
+Link: http://lkml.kernel.org/r/1541690953-4623-1-git-send-email-alexey.skidanov@intel.com
+Signed-off-by: Alexey Skidanov <alexey.skidanov@intel.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Logan Gunthorpe <logang@deltatee.com>
+Cc: Daniel Mentz <danielmentz@google.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/genalloc.h | 13 +++++++------
+ lib/genalloc.c           | 20 ++++++++++++--------
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
+index 872f930f1b06d..dd0a452373e71 100644
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map,
+ 			unsigned long size,
+ 			unsigned long start,
+ 			unsigned int nr,
+-			void *data, struct gen_pool *pool);
++			void *data, struct gen_pool *pool,
++			unsigned long start_addr);
+ 
+ /*
+  *  General purpose special memory pool descriptor.
+@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo,
+ 
+ extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ 		unsigned long start, unsigned int nr, void *data,
+-		struct gen_pool *pool);
++		struct gen_pool *pool, unsigned long start_addr);
+ 
+ extern unsigned long gen_pool_fixed_alloc(unsigned long *map,
+ 		unsigned long size, unsigned long start, unsigned int nr,
+-		void *data, struct gen_pool *pool);
++		void *data, struct gen_pool *pool, unsigned long start_addr);
+ 
+ extern unsigned long gen_pool_first_fit_align(unsigned long *map,
+ 		unsigned long size, unsigned long start, unsigned int nr,
+-		void *data, struct gen_pool *pool);
++		void *data, struct gen_pool *pool, unsigned long start_addr);
+ 
+ 
+ extern unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ 		unsigned long size, unsigned long start, unsigned int nr,
+-		void *data, struct gen_pool *pool);
++		void *data, struct gen_pool *pool, unsigned long start_addr);
+ 
+ extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ 		unsigned long start, unsigned int nr, void *data,
+-		struct gen_pool *pool);
++		struct gen_pool *pool, unsigned long start_addr);
+ 
+ 
+ extern struct gen_pool *devm_gen_pool_create(struct device *dev,
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index ca06adc4f4451..5deb25c40a5a1 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -311,7 +311,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ 		end_bit = chunk_size(chunk) >> order;
+ retry:
+ 		start_bit = algo(chunk->bits, end_bit, start_bit,
+-				 nbits, data, pool);
++				 nbits, data, pool, chunk->start_addr);
+ 		if (start_bit >= end_bit)
+ 			continue;
+ 		remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
+@@ -525,7 +525,7 @@ EXPORT_SYMBOL(gen_pool_set_algo);
+  */
+ unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ 		unsigned long start, unsigned int nr, void *data,
+-		struct gen_pool *pool)
++		struct gen_pool *pool, unsigned long start_addr)
+ {
+ 	return bitmap_find_next_zero_area(map, size, start, nr, 0);
+ }
+@@ -543,16 +543,19 @@ EXPORT_SYMBOL(gen_pool_first_fit);
+  */
+ unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+ 		unsigned long start, unsigned int nr, void *data,
+-		struct gen_pool *pool)
++		struct gen_pool *pool, unsigned long start_addr)
+ {
+ 	struct genpool_data_align *alignment;
+-	unsigned long align_mask;
++	unsigned long align_mask, align_off;
+ 	int order;
+ 
+ 	alignment = data;
+ 	order = pool->min_alloc_order;
+ 	align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+-	return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
++	align_off = (start_addr & (alignment->align - 1)) >> order;
++
++	return bitmap_find_next_zero_area_off(map, size, start, nr,
++					      align_mask, align_off);
+ }
+ EXPORT_SYMBOL(gen_pool_first_fit_align);
+ 
+@@ -567,7 +570,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align);
+  */
+ unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+ 		unsigned long start, unsigned int nr, void *data,
+-		struct gen_pool *pool)
++		struct gen_pool *pool, unsigned long start_addr)
+ {
+ 	struct genpool_data_fixed *fixed_data;
+ 	int order;
+@@ -601,7 +604,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc);
+  */
+ unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ 		unsigned long size, unsigned long start,
+-		unsigned int nr, void *data, struct gen_pool *pool)
++		unsigned int nr, void *data, struct gen_pool *pool,
++		unsigned long start_addr)
+ {
+ 	unsigned long align_mask = roundup_pow_of_two(nr) - 1;
+ 
+@@ -624,7 +628,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
+  */
+ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ 		unsigned long start, unsigned int nr, void *data,
+-		struct gen_pool *pool)
++		struct gen_pool *pool, unsigned long start_addr)
+ {
+ 	unsigned long start_bit = size;
+ 	unsigned long len = size + 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/lib-genalloc.c-include-vmalloc.h.patch b/queue-4.19/lib-genalloc.c-include-vmalloc.h.patch
new file mode 100644
index 00000000000..00a1e40c751
--- /dev/null
+++ b/queue-4.19/lib-genalloc.c-include-vmalloc.h.patch
@@ -0,0 +1,43 @@
+From 6abdc67f78c2246c6f3bf4c85b58716a9431cd7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 13:21:18 -0800
+Subject: lib/genalloc.c: include vmalloc.h
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit 35004f2e55807a1a1491db24ab512dd2f770a130 ]
+
+Fixes build break on most ARM/ARM64 defconfigs:
+
+  lib/genalloc.c: In function 'gen_pool_add_virt':
+  lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'?
+  lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+  lib/genalloc.c: In function 'gen_pool_destroy':
+  lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'?
+
+Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap')
+Cc: Huang Shijie <sjhuang@iluvatar.ai>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index f365d71cdc774..7e85d1e37a6ea 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -35,6 +35,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/genalloc.h>
+ #include <linux/of_device.h>
++#include <linux/vmalloc.h>
+ 
+ static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
+ {
+-- 
+2.20.1
+
diff --git a/queue-4.19/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch b/queue-4.19/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
new file mode 100644
index 00000000000..70a218e5e51
--- /dev/null
+++ b/queue-4.19/lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
@@ -0,0 +1,52 @@
+From f34ab42c1639dc51c77157151d224ca83a5cf93f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:51 -0800
+Subject: lib/genalloc.c: use vzalloc_node() to allocate the bitmap
+
+From: Huang Shijie <sjhuang@iluvatar.ai>
+
+[ Upstream commit 6862d2fc81859f88c1f3f660886427893f2b4f3f ]
+
+Some devices may have big memory on chip, such as over 1G.  In some
+cases, the nbytes maybe bigger then 4M which is the bounday of the
+memory buddy system (4K default).
+
+So use vzalloc_node() to allocate the bitmap.  Also use vfree to free
+it.
+
+Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai
+Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 5deb25c40a5a1..f365d71cdc774 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -187,7 +187,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ 	int nbytes = sizeof(struct gen_pool_chunk) +
+ 				BITS_TO_LONGS(nbits) * sizeof(long);
+ 
+-	chunk = kzalloc_node(nbytes, GFP_KERNEL, nid);
++	chunk = vzalloc_node(nbytes, nid);
+ 	if (unlikely(chunk == NULL))
+ 		return -ENOMEM;
+ 
+@@ -251,7 +251,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ 		bit = find_next_bit(chunk->bits, end_bit, 0);
+ 		BUG_ON(bit < end_bit);
+ 
+-		kfree(chunk);
++		vfree(chunk);
+ 	}
+ 	kfree_const(pool->name);
+ 	kfree(pool);
+-- 
+2.20.1
+
diff --git a/queue-4.19/mac80211-fix-station-inactive_time-shortly-after-boo.patch b/queue-4.19/mac80211-fix-station-inactive_time-shortly-after-boo.patch
new file mode 100644
index 00000000000..aa1d7a28d69
--- /dev/null
+++ b/queue-4.19/mac80211-fix-station-inactive_time-shortly-after-boo.patch
@@ -0,0 +1,47 @@
+From e8f5171dd917f1789c237050c538ffa7fb7dfa3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 06:12:43 -0600
+Subject: mac80211: fix station inactive_time shortly after boot
+
+From: Ahmed Zaki <anzaki@gmail.com>
+
+[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ]
+
+In the first 5 minutes after boot (time of INITIAL_JIFFIES),
+ieee80211_sta_last_active() returns zero if last_ack is zero. This
+leads to "inactive time" showing jiffies_to_msecs(jiffies).
+
+ # iw wlan0 station get fc:ec:da:64:a6:dd
+ Station fc:ec:da:64:a6:dd (on wlan0)
+	inactive time:	4294894049 ms
+	.
+	.
+	connected time:	70 seconds
+
+Fix by returning last_rx if last_ack == 0.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index f34202242d24d..507409e3fd39c 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2356,7 +2356,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+ 	struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
+ 
+-	if (time_after(stats->last_rx, sta->status_stats.last_ack))
++	if (!sta->status_stats.last_ack ||
++	    time_after(stats->last_rx, sta->status_stats.last_ack))
+ 		return stats->last_rx;
+ 	return sta->status_stats.last_ack;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/memory-omap-gpmc-get-the-header-of-the-enum.patch b/queue-4.19/memory-omap-gpmc-get-the-header-of-the-enum.patch
new file mode 100644
index 00000000000..7a2f1f9d6ce
--- /dev/null
+++ b/queue-4.19/memory-omap-gpmc-get-the-header-of-the-enum.patch
@@ -0,0 +1,48 @@
+From 8455d20bc1d1edd288f680c270f399493eb0760a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 14:11:08 +0100
+Subject: memory: omap-gpmc: Get the header of the enum
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit a0752e9c3097b2c4fccd618802938e0951038dfa ]
+
+Commit 21abf103818a
+("gpio: Pass a flag to gpiochip_request_own_desc()")
+started to pass an enum gpiod_flags but this file is
+not including the header file that defines that enum
+and the compiler spits:
+
+drivers/memory/omap-gpmc.c: In function
+			    'gpmc_probe_generic_child':
+drivers/memory/omap-gpmc.c:2174:9: error: type of formal
+				   parameter 4 is incomplete
+         0);
+         ^
+
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: 21abf103818a ("gpio: Pass a flag to gpiochip_request_own_desc()")
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/omap-gpmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index c215287e80cf3..1c6a7c16e0c17 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/io.h>
+ #include <linux/gpio/driver.h>
++#include <linux/gpio/consumer.h> /* GPIO descriptor enum */
+ #include <linux/interrupt.h>
+ #include <linux/irqdomain.h>
+ #include <linux/platform_device.h>
+-- 
+2.20.1
+
diff --git a/queue-4.19/microblaze-adjust-the-help-to-the-real-behavior.patch b/queue-4.19/microblaze-adjust-the-help-to-the-real-behavior.patch
new file mode 100644
index 00000000000..5918530b210
--- /dev/null
+++ b/queue-4.19/microblaze-adjust-the-help-to-the-real-behavior.patch
@@ -0,0 +1,61 @@
+From f971a4744a14f118093a113dbc0d14cd2b43f98c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:52 +0900
+Subject: microblaze: adjust the help to the real behavior
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit bafcc61d998c1ca18f556d92a0e95335ac68c7da ]
+
+"make ARCH=microblaze help" mentions simpleImage.<dt>.unstrip,
+but it is not a real Make target. It does not work because Makefile
+assumes "system.unstrip" is the name of DT.
+
+$ make ARCH=microblaze CROSS_COMPILE=microblaze-linux- simpleImage.system.unstrip
+  [ snip ]
+make[1]: *** No rule to make target 'arch/microblaze/boot/dts/system.unstrip.dtb', needed by 'arch/microblaze/boot/dts/system.dtb'.  Stop.
+make: *** [Makefile;1060: arch/microblaze/boot/dts] Error 2
+make: *** Waiting for unfinished jobs....
+
+simpleImage.<dt> works like a phony target that generates multiple
+images. Reflect the real behavior. I removed the DT directory path
+information because it is already explained a few lines below.
+
+While I am here, I deleted the redundant *_defconfig explanation.
+
+The top-level Makefile caters to list available defconfig files:
+
+  mmu_defconfig            - Build for mmu
+  nommu_defconfig          - Build for nommu
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 4f3ab57072652..eecf37276521c 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -91,11 +91,11 @@ define archhelp
+   echo '* linux.bin    - Create raw binary'
+   echo '  linux.bin.gz - Create compressed raw binary'
+   echo '  linux.bin.ub - Create U-Boot wrapped raw binary'
+-  echo '  simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
+-  echo '                   - stripped elf with fdt blob'
+-  echo '  simpleImage.<dt>.unstrip - full ELF image with fdt blob'
+-  echo '  *_defconfig      - Select default config from arch/microblaze/configs'
+-  echo ''
++  echo '  simpleImage.<dt> - Create the following images with <dt>.dtb linked in'
++  echo '                    simpleImage.<dt>        : raw image'
++  echo '                    simpleImage.<dt>.ub     : raw image with U-Boot header'
++  echo '                    simpleImage.<dt>.unstrip: ELF (identical to vmlinux)'
++  echo '                    simpleImage.<dt>.strip  : stripped ELF'
+   echo '  Targets with <dt> embed a device tree blob inside the image'
+   echo '  These targets support board with firmware that does not'
+   echo '  support passing a device tree directly. Replace <dt> with the'
+-- 
+2.20.1
+
diff --git a/queue-4.19/microblaze-fix-multiple-bugs-in-arch-microblaze-boot.patch b/queue-4.19/microblaze-fix-multiple-bugs-in-arch-microblaze-boot.patch
new file mode 100644
index 00000000000..6e42c758e27
--- /dev/null
+++ b/queue-4.19/microblaze-fix-multiple-bugs-in-arch-microblaze-boot.patch
@@ -0,0 +1,111 @@
+From 9c38dc523437413faa25c3415b5c7fd4e85fd406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:54 +0900
+Subject: microblaze: fix multiple bugs in arch/microblaze/boot/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 4722a3e6b716d9d4594c3cf3856b03bbd24a59a8 ]
+
+This commit fixes some build issues.
+
+The first issue is the breakage of linux.bin.ub target since commit
+ece97f3a5fb5 ("microblaze: Fix simpleImage format generation")
+because the addition of UIMAGE_{IN,OUT} affected it.
+
+make ARCH=microblaze CROSS_COMPILE=microblaze-linux- linux.bin.ub
+  [ snip ]
+  OBJCOPY arch/microblaze/boot/linux.bin
+  UIMAGE  arch/microblaze/boot/linux.bin.ub.ub
+/usr/bin/mkimage: Can't open arch/microblaze/boot/linux.bin.ub: No such file or directory
+make[1]: *** [arch/microblaze/boot/Makefile;14: arch/microblaze/boot/linux.bin.ub] Error 1
+make: *** [arch/microblaze/Makefile;83: linux.bin.ub] Error 2
+
+The second issue is the use of the "if_changed" multiple times for
+the same target.
+
+As commit 92a4728608a8 ("x86/boot: Fix if_changed build flip/flop bug")
+pointed out, this never works properly. Moreover, generating multiple
+images as a side-effect is confusing.
+
+Let's split the build recipe for each image.
+
+simpleImage.<dt>*.unstrip is just a copy of vmlinux.
+
+simpleImage.<dt> and simpleImage.<dt>.ub are created in the same way
+as linux.bin and linux.bin.ub, respectively.
+
+I kept simpleImage.* recipes independent of linux.bin.* ones to not
+change the behavior.
+
+Lastly, this commit fixes "make ARCH=microblaze clean". Previously,
+it only cleaned up the unstrip image. Now, all the simpleImage files
+are cleaned.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile      |  2 +-
+ arch/microblaze/boot/Makefile | 19 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index b9808ddaf985f..548bac6c60f8c 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -86,7 +86,7 @@ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ 	@echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+ 
+ simpleImage.%: vmlinux
+-	$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++	$(Q)$(MAKE) $(build)=$(boot) $(addprefix $(boot)/$@., ub unstrip strip)
+ 	@echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+ 
+ define archhelp
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 96eefdca0d9b3..cff570a719461 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -3,7 +3,7 @@
+ # arch/microblaze/boot/Makefile
+ #
+ 
+-targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.%
++targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.*
+ 
+ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+ 
+@@ -16,21 +16,20 @@ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ 	$(call if_changed,gzip)
+ 
+-quiet_cmd_cp = CP      $< $@$2
+-	cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+-
+ quiet_cmd_strip = STRIP   $< $@$2
+ 	cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
+ 				-K _fdt_start $< -o $@$2
+ 
+ UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
+-UIMAGE_IN = $@
+-UIMAGE_OUT = $@.ub
+ 
+-$(obj)/simpleImage.%: vmlinux FORCE
+-	$(call if_changed,cp,.unstrip)
++$(obj)/simpleImage.$(DTB): vmlinux FORCE
+ 	$(call if_changed,objcopy)
++
++$(obj)/simpleImage.$(DTB).ub: $(obj)/simpleImage.$(DTB) FORCE
+ 	$(call if_changed,uimage)
+-	$(call if_changed,strip,.strip)
+ 
+-clean-files += simpleImage.*.unstrip linux.bin.ub
++$(obj)/simpleImage.$(DTB).unstrip: vmlinux FORCE
++	$(call if_changed,shipped)
++
++$(obj)/simpleImage.$(DTB).strip: vmlinux FORCE
++	$(call if_changed,strip)
+-- 
+2.20.1
+
diff --git a/queue-4.19/microblaze-move-.-is-ready-messages-to-arch-microbla.patch b/queue-4.19/microblaze-move-.-is-ready-messages-to-arch-microbla.patch
new file mode 100644
index 00000000000..40a5e75da0d
--- /dev/null
+++ b/queue-4.19/microblaze-move-.-is-ready-messages-to-arch-microbla.patch
@@ -0,0 +1,66 @@
+From fa7a09992ee94bec7768689dead408e7baa4593a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:53 +0900
+Subject: microblaze: move "... is ready" messages to arch/microblaze/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 2e14f94cf4bc2f15ca5362e81ca3a987c79e3062 ]
+
+To prepare for more fixes, move this to arch/microblaze/Makefile.
+Otherwise, the same "... is ready" would be printed multiple times.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile      | 2 ++
+ arch/microblaze/boot/Makefile | 4 ----
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index eecf37276521c..b9808ddaf985f 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -83,9 +83,11 @@ archclean:
+ 
+ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ 	$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++	@echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+ 
+ simpleImage.%: vmlinux
+ 	$(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++	@echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+ 
+ define archhelp
+   echo '* linux.bin    - Create raw binary'
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 600e5a198bd2a..96eefdca0d9b3 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -9,15 +9,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+ 
+ $(obj)/linux.bin: vmlinux FORCE
+ 	$(call if_changed,objcopy)
+-	@echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+ 
+ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ 	$(call if_changed,uimage)
+-	@echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+ 
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ 	$(call if_changed,gzip)
+-	@echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+ 
+ quiet_cmd_cp = CP      $< $@$2
+ 	cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+@@ -35,6 +32,5 @@ $(obj)/simpleImage.%: vmlinux FORCE
+ 	$(call if_changed,objcopy)
+ 	$(call if_changed,uimage)
+ 	$(call if_changed,strip,.strip)
+-	@echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+ 
+ clean-files += simpleImage.*.unstrip linux.bin.ub
+-- 
+2.20.1
+
diff --git a/queue-4.19/mm-hotplug-invalid-pfns-from-pfn_to_online_page.patch b/queue-4.19/mm-hotplug-invalid-pfns-from-pfn_to_online_page.patch
new file mode 100644
index 00000000000..7cd68d40645
--- /dev/null
+++ b/queue-4.19/mm-hotplug-invalid-pfns-from-pfn_to_online_page.patch
@@ -0,0 +1,129 @@
+From 52d1bd966cdc025e1d10926f75a807ed89537382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 14:20:51 -0800
+Subject: mm/hotplug: invalid PFNs from pfn_to_online_page()
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit b13bc35193d9e7a8c050a24928ca5c9e7c9a009b ]
+
+On an arm64 ThunderX2 server, the first kmemleak scan would crash [1]
+with CONFIG_DEBUG_VM_PGFLAGS=y due to page_to_nid() found a pfn that is
+not directly mapped (MEMBLOCK_NOMAP).  Hence, the page->flags is
+uninitialized.
+
+This is due to the commit 9f1eb38e0e11 ("mm, kmemleak: little
+optimization while scanning") starts to use pfn_to_online_page() instead
+of pfn_valid().  However, in the CONFIG_MEMORY_HOTPLUG=y case,
+pfn_to_online_page() does not call memblock_is_map_memory() while
+pfn_valid() does.
+
+Historically, the commit 68709f45385a ("arm64: only consider memblocks
+with NOMAP cleared for linear mapping") causes pages marked as nomap
+being no long reassigned to the new zone in memmap_init_zone() by
+calling __init_single_page().
+
+Since the commit 2d070eab2e82 ("mm: consider zone which is not fully
+populated to have holes") introduced pfn_to_online_page() and was
+designed to return a valid pfn only, but it is clearly broken on arm64.
+
+Therefore, let pfn_to_online_page() call pfn_valid_within(), so it can
+handle nomap thanks to the commit f52bb98f5ade ("arm64: mm: always
+enable CONFIG_HOLES_IN_ZONE"), while it will be optimized away on
+architectures where have no HOLES_IN_ZONE.
+
+[1]
+  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000006
+  Mem abort info:
+    ESR = 0x96000005
+    Exception class = DABT (current EL), IL = 32 bits
+    SET = 0, FnV = 0
+    EA = 0, S1PTW = 0
+  Data abort info:
+    ISV = 0, ISS = 0x00000005
+    CM = 0, WnR = 0
+  Internal error: Oops: 96000005 [#1] SMP
+  CPU: 60 PID: 1408 Comm: kmemleak Not tainted 5.0.0-rc2+ #8
+  pstate: 60400009 (nZCv daif +PAN -UAO)
+  pc : page_mapping+0x24/0x144
+  lr : __dump_page+0x34/0x3dc
+  sp : ffff00003a5cfd10
+  x29: ffff00003a5cfd10 x28: 000000000000802f
+  x27: 0000000000000000 x26: 0000000000277d00
+  x25: ffff000010791f56 x24: ffff7fe000000000
+  x23: ffff000010772f8b x22: ffff00001125f670
+  x21: ffff000011311000 x20: ffff000010772f8b
+  x19: fffffffffffffffe x18: 0000000000000000
+  x17: 0000000000000000 x16: 0000000000000000
+  x15: 0000000000000000 x14: ffff802698b19600
+  x13: ffff802698b1a200 x12: ffff802698b16f00
+  x11: ffff802698b1a400 x10: 0000000000001400
+  x9 : 0000000000000001 x8 : ffff00001121a000
+  x7 : 0000000000000000 x6 : ffff0000102c53b8
+  x5 : 0000000000000000 x4 : 0000000000000003
+  x3 : 0000000000000100 x2 : 0000000000000000
+  x1 : ffff000010772f8b x0 : ffffffffffffffff
+  Process kmemleak (pid: 1408, stack limit = 0x(____ptrval____))
+  Call trace:
+   page_mapping+0x24/0x144
+   __dump_page+0x34/0x3dc
+   dump_page+0x28/0x4c
+   kmemleak_scan+0x4ac/0x680
+   kmemleak_scan_thread+0xb4/0xdc
+   kthread+0x12c/0x13c
+   ret_from_fork+0x10/0x18
+  Code: d503201f f9400660 36000040 d1000413 (f9400661)
+  ---[ end trace 4d4bd7f573490c8e ]---
+  Kernel panic - not syncing: Fatal exception
+  SMP: stopping secondary CPUs
+  Kernel Offset: disabled
+  CPU features: 0x002,20000c38
+  Memory Limit: none
+  ---[ end Kernel panic - not syncing: Fatal exception ]---
+
+Link: http://lkml.kernel.org/r/20190122132916.28360-1-cai@lca.pw
+Fixes: 9f1eb38e0e11 ("mm, kmemleak: little optimization while scanning")
+Signed-off-by: Qian Cai <cai@lca.pw>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/memory_hotplug.h | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 16487052017d5..4915e6cd7fd56 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -21,14 +21,16 @@ struct vmem_altmap;
+  * walkers which rely on the fully initialized page->flags and others
+  * should use this rather than pfn_valid && pfn_to_page
+  */
+-#define pfn_to_online_page(pfn)				\
+-({							\
+-	struct page *___page = NULL;			\
+-	unsigned long ___nr = pfn_to_section_nr(pfn);	\
+-							\
+-	if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr))\
+-		___page = pfn_to_page(pfn);		\
+-	___page;					\
++#define pfn_to_online_page(pfn)					   \
++({								   \
++	struct page *___page = NULL;				   \
++	unsigned long ___pfn = pfn;				   \
++	unsigned long ___nr = pfn_to_section_nr(___pfn);	   \
++								   \
++	if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr) && \
++	    pfn_valid_within(___pfn))				   \
++		___page = pfn_to_page(___pfn);			   \
++	___page;						   \
+ })
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-4.19/mm-page_alloc.c-deduplicate-__memblock_free_early-an.patch b/queue-4.19/mm-page_alloc.c-deduplicate-__memblock_free_early-an.patch
new file mode 100644
index 00000000000..cb2f1a79fe2
--- /dev/null
+++ b/queue-4.19/mm-page_alloc.c-deduplicate-__memblock_free_early-an.patch
@@ -0,0 +1,42 @@
+From 8bf842de6a0da9390dd23a5eb37b783de66c8bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:35:26 -0800
+Subject: mm/page_alloc.c: deduplicate __memblock_free_early() and
+ memblock_free()
+
+From: Wentao Wang <witallwang@gmail.com>
+
+[ Upstream commit d31cfe7bff9109476da92c245b56083e9b48d60a ]
+
+Link: http://lkml.kernel.org/r/C8ECE1B7A767434691FEEFA3A01765D72AFB8E78@MX203CL03.corp.emc.com
+Signed-off-by: Wentao Wang <witallwang@gmail.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memblock.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 237944479d25a..bb4e32c6b19e9 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1537,12 +1537,7 @@ void * __init memblock_virt_alloc_try_nid(
+  */
+ void __init __memblock_free_early(phys_addr_t base, phys_addr_t size)
+ {
+-	phys_addr_t end = base + size - 1;
+-
+-	memblock_dbg("%s: [%pa-%pa] %pF\n",
+-		     __func__, &base, &end, (void *)_RET_IP_);
+-	kmemleak_free_part_phys(base, size);
+-	memblock_remove_range(&memblock.reserved, base, size);
++	memblock_free(base, size);
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/mm-page_alloc.c-free-order-0-pages-through-pcp-in-pa.patch b/queue-4.19/mm-page_alloc.c-free-order-0-pages-through-pcp-in-pa.patch
new file mode 100644
index 00000000000..396e0783d08
--- /dev/null
+++ b/queue-4.19/mm-page_alloc.c-free-order-0-pages-through-pcp-in-pa.patch
@@ -0,0 +1,112 @@
+From 1bcaca6e448f0f04378a13c92b053e4640376b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:35:18 -0800
+Subject: mm/page_alloc.c: free order-0 pages through PCP in page_frag_free()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+[ Upstream commit 65895b67ad27df0f62bfaf82dd5622f95ea29196 ]
+
+page_frag_free() calls __free_pages_ok() to free the page back to Buddy.
+This is OK for high order page, but for order-0 pages, it misses the
+optimization opportunity of using Per-Cpu-Pages and can cause zone lock
+contention when called frequently.
+
+Pawel Staszewski recently shared his result of 'how Linux kernel handles
+normal traffic'[1] and from perf data, Jesper Dangaard Brouer found the
+lock contention comes from page allocator:
+
+  mlx5e_poll_tx_cq
+  |
+   --16.34%--napi_consume_skb
+             |
+             |--12.65%--__free_pages_ok
+             |          |
+             |           --11.86%--free_one_page
+             |                     |
+             |                     |--10.10%--queued_spin_lock_slowpath
+             |                     |
+             |                      --0.65%--_raw_spin_lock
+             |
+             |--1.55%--page_frag_free
+             |
+              --1.44%--skb_release_data
+
+Jesper explained how it happened: mlx5 driver RX-page recycle mechanism is
+not effective in this workload and pages have to go through the page
+allocator.  The lock contention happens during mlx5 DMA TX completion
+cycle.  And the page allocator cannot keep up at these speeds.[2]
+
+I thought that __free_pages_ok() are mostly freeing high order pages and
+thought this is an lock contention for high order pages but Jesper
+explained in detail that __free_pages_ok() here are actually freeing
+order-0 pages because mlx5 is using order-0 pages to satisfy its page pool
+allocation request.[3]
+
+The free path as pointed out by Jesper is:
+skb_free_head()
+  -> skb_free_frag()
+    -> page_frag_free()
+And the pages being freed on this path are order-0 pages.
+
+Fix this by doing similar things as in __page_frag_cache_drain() - send
+the being freed page to PCP if it's an order-0 page, or directly to Buddy
+if it is a high order page.
+
+With this change, Paweł hasn't noticed lock contention yet in his
+workload and Jesper has noticed a 7% performance improvement using a micro
+benchmark and lock contention is gone.  Ilias' test on a 'low' speed 1Gbit
+interface on an cortex-a53 shows ~11% performance boost testing with
+64byte packets and __free_pages_ok() disappeared from perf top.
+
+[1]: https://www.spinics.net/lists/netdev/msg531362.html
+[2]: https://www.spinics.net/lists/netdev/msg531421.html
+[3]: https://www.spinics.net/lists/netdev/msg531556.html
+
+[akpm@linux-foundation.org: add comment]
+Link: http://lkml.kernel.org/r/20181120014544.GB10657@intel.com
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Reported-by: Pawel Staszewski <pstaszewski@itcare.pl>
+Analysed-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Acked-by: Mel Gorman <mgorman@techsingularity.net>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Tested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Acked-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Acked-by: Tariq Toukan <tariqt@mellanox.com>
+Acked-by: Pankaj gupta <pagupta@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index b34348a41bfed..dcc46d955df2e 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4581,8 +4581,14 @@ void page_frag_free(void *addr)
+ {
+ 	struct page *page = virt_to_head_page(addr);
+ 
+-	if (unlikely(put_page_testzero(page)))
+-		__free_pages_ok(page, compound_order(page));
++	if (unlikely(put_page_testzero(page))) {
++		unsigned int order = compound_order(page);
++
++		if (order == 0)		/* Via pcp? */
++			free_unref_page(page);
++		else
++			__free_pages_ok(page, order);
++	}
+ }
+ EXPORT_SYMBOL(page_frag_free);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mm-page_alloc.c-use-a-single-function-to-free-page.patch b/queue-4.19/mm-page_alloc.c-use-a-single-function-to-free-page.patch
new file mode 100644
index 00000000000..dd1c2d90712
--- /dev/null
+++ b/queue-4.19/mm-page_alloc.c-use-a-single-function-to-free-page.patch
@@ -0,0 +1,99 @@
+From b98addd21deb092196b8e09cdb6c6b58a51f25c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:35:22 -0800
+Subject: mm/page_alloc.c: use a single function to free page
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+[ Upstream commit 742aa7fb52c56fb3b307e704f93e67b698959cc2 ]
+
+There are multiple places of freeing a page, they all do the same things
+so a common function can be used to reduce code duplicate.
+
+It also avoids bug fixed in one function but left in another.
+
+Link: http://lkml.kernel.org/r/20181119134834.17765-3-aaron.lu@intel.com
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Cc: Jesper Dangaard Brouer <brouer@redhat.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Pankaj gupta <pagupta@redhat.com>
+Cc: Pawel Staszewski <pstaszewski@itcare.pl>
+Cc: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 37 ++++++++++++++-----------------------
+ 1 file changed, 14 insertions(+), 23 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index dcc46d955df2e..74fb5c338e8fb 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4451,16 +4451,19 @@ unsigned long get_zeroed_page(gfp_t gfp_mask)
+ }
+ EXPORT_SYMBOL(get_zeroed_page);
+ 
+-void __free_pages(struct page *page, unsigned int order)
++static inline void free_the_page(struct page *page, unsigned int order)
+ {
+-	if (put_page_testzero(page)) {
+-		if (order == 0)
+-			free_unref_page(page);
+-		else
+-			__free_pages_ok(page, order);
+-	}
++	if (order == 0)		/* Via pcp? */
++		free_unref_page(page);
++	else
++		__free_pages_ok(page, order);
+ }
+ 
++void __free_pages(struct page *page, unsigned int order)
++{
++	if (put_page_testzero(page))
++		free_the_page(page, order);
++}
+ EXPORT_SYMBOL(__free_pages);
+ 
+ void free_pages(unsigned long addr, unsigned int order)
+@@ -4509,14 +4512,8 @@ void __page_frag_cache_drain(struct page *page, unsigned int count)
+ {
+ 	VM_BUG_ON_PAGE(page_ref_count(page) == 0, page);
+ 
+-	if (page_ref_sub_and_test(page, count)) {
+-		unsigned int order = compound_order(page);
+-
+-		if (order == 0)
+-			free_unref_page(page);
+-		else
+-			__free_pages_ok(page, order);
+-	}
++	if (page_ref_sub_and_test(page, count))
++		free_the_page(page, compound_order(page));
+ }
+ EXPORT_SYMBOL(__page_frag_cache_drain);
+ 
+@@ -4581,14 +4578,8 @@ void page_frag_free(void *addr)
+ {
+ 	struct page *page = virt_to_head_page(addr);
+ 
+-	if (unlikely(put_page_testzero(page))) {
+-		unsigned int order = compound_order(page);
+-
+-		if (order == 0)		/* Via pcp? */
+-			free_unref_page(page);
+-		else
+-			__free_pages_ok(page, order);
+-	}
++	if (unlikely(put_page_testzero(page)))
++		free_the_page(page, compound_order(page));
+ }
+ EXPORT_SYMBOL(page_frag_free);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mmc-core-align-max-segment-size-with-logical-block-s.patch b/queue-4.19/mmc-core-align-max-segment-size-with-logical-block-s.patch
new file mode 100644
index 00000000000..7ddc2ea978d
--- /dev/null
+++ b/queue-4.19/mmc-core-align-max-segment-size-with-logical-block-s.patch
@@ -0,0 +1,77 @@
+From 58afa0e7a71a414fcf8532ff65d607741646742c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 00:02:11 +0800
+Subject: mmc: core: align max segment size with logical block size
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit c53336c8f5f29043fded57912cc06c24e12613d7 ]
+
+Logical block size is the lowest possible block size that the storage
+device can address. Max segment size is often related with controller's
+DMA capability. And it is reasonable to align max segment size with
+logical block size.
+
+SDHCI sets un-aligned max segment size, and causes ADMA error, so
+fix it by aligning max segment size with logical block size.
+
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
+Cc: Faiz Abbas <faiz_abbas@ti.com>
+Cc: linux-block@vger.kernel.org
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 6 ------
+ drivers/mmc/core/queue.c | 9 ++++++++-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index eee004fb3c3e3..527ab15c421f9 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2384,12 +2384,6 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ 	snprintf(md->disk->disk_name, sizeof(md->disk->disk_name),
+ 		 "mmcblk%u%s", card->host->index, subname ? subname : "");
+ 
+-	if (mmc_card_mmc(card))
+-		blk_queue_logical_block_size(md->queue.queue,
+-					     card->ext_csd.data_sector_size);
+-	else
+-		blk_queue_logical_block_size(md->queue.queue, 512);
+-
+ 	set_capacity(md->disk, size);
+ 
+ 	if (mmc_host_cmd23(card->host)) {
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 18aae28845ec9..becc6594a8a47 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -355,6 +355,7 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ {
+ 	struct mmc_host *host = card->host;
+ 	u64 limit = BLK_BOUNCE_HIGH;
++	unsigned block_size = 512;
+ 
+ 	if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
+ 		limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
+@@ -368,7 +369,13 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ 	blk_queue_max_hw_sectors(mq->queue,
+ 		min(host->max_blk_count, host->max_req_size / 512));
+ 	blk_queue_max_segments(mq->queue, host->max_segs);
+-	blk_queue_max_segment_size(mq->queue, host->max_seg_size);
++
++	if (mmc_card_mmc(card))
++		block_size = card->ext_csd.data_sector_size;
++
++	blk_queue_logical_block_size(mq->queue, block_size);
++	blk_queue_max_segment_size(mq->queue,
++			round_down(host->max_seg_size, block_size));
+ 
+ 	INIT_WORK(&mq->recovery_work, mmc_mq_recovery_handler);
+ 	INIT_WORK(&mq->complete_work, mmc_blk_mq_complete_work);
+-- 
+2.20.1
+
diff --git a/queue-4.19/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch b/queue-4.19/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch
new file mode 100644
index 00000000000..c8116754c3f
--- /dev/null
+++ b/queue-4.19/mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch
@@ -0,0 +1,181 @@
+From a2a6649ee1829261f2efa428057bbf4933d63fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:18:25 +0100
+Subject: mmc: meson-gx: make sure the descriptor is stopped on errors
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 18f92bc02f1739b5c4d5b70009fbb7eada45bca3 ]
+
+On errors, if we don't stop the descriptor chain, it may continue to
+run and raise IRQ after we have called mmc_request_done(). This is bad
+because we won't be able to get cmd anymore and properly deal with the
+IRQ.
+
+This patch makes sure the descriptor chain is stopped before
+calling mmc_request_done()
+
+Fixes: 79ed05e329c3 ("mmc: meson-gx: add support for descriptor chain mode")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/meson-gx-mmc.c | 73 ++++++++++++++++++++++++++++-----
+ 1 file changed, 63 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index ddd98cdd33bcd..72f34a58928ca 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
++#include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+@@ -90,9 +91,11 @@
+ #define   CFG_CLK_ALWAYS_ON BIT(18)
+ #define   CFG_CHK_DS BIT(20)
+ #define   CFG_AUTO_CLK BIT(23)
++#define   CFG_ERR_ABORT BIT(27)
+ 
+ #define SD_EMMC_STATUS 0x48
+ #define   STATUS_BUSY BIT(31)
++#define   STATUS_DESC_BUSY BIT(30)
+ #define   STATUS_DATI GENMASK(23, 16)
+ 
+ #define SD_EMMC_IRQ_EN 0x4c
+@@ -930,6 +933,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
+ 
+ 	cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode);
+ 	cmd_cfg |= CMD_CFG_OWNER;  /* owned by CPU */
++	cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */
+ 
+ 	meson_mmc_set_response_bits(cmd, &cmd_cfg);
+ 
+@@ -1024,6 +1028,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ 	u32 irq_en, status, raw_status;
+ 	irqreturn_t ret = IRQ_NONE;
+ 
++	irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
++	raw_status = readl(host->regs + SD_EMMC_STATUS);
++	status = raw_status & irq_en;
++
++	if (!status) {
++		dev_dbg(host->dev,
++			"Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n",
++			 irq_en, raw_status);
++		return IRQ_NONE;
++	}
++
+ 	if (WARN_ON(!host) || WARN_ON(!host->cmd))
+ 		return IRQ_NONE;
+ 
+@@ -1031,22 +1046,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ 
+ 	cmd = host->cmd;
+ 	data = cmd->data;
+-	irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
+-	raw_status = readl(host->regs + SD_EMMC_STATUS);
+-	status = raw_status & irq_en;
+-
+ 	cmd->error = 0;
+ 	if (status & IRQ_CRC_ERR) {
+ 		dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status);
+ 		cmd->error = -EILSEQ;
+-		ret = IRQ_HANDLED;
++		ret = IRQ_WAKE_THREAD;
+ 		goto out;
+ 	}
+ 
+ 	if (status & IRQ_TIMEOUTS) {
+ 		dev_dbg(host->dev, "Timeout - status 0x%08x\n", status);
+ 		cmd->error = -ETIMEDOUT;
+-		ret = IRQ_HANDLED;
++		ret = IRQ_WAKE_THREAD;
+ 		goto out;
+ 	}
+ 
+@@ -1071,17 +1082,49 @@ out:
+ 	/* ack all enabled interrupts */
+ 	writel(irq_en, host->regs + SD_EMMC_STATUS);
+ 
++	if (cmd->error) {
++		/* Stop desc in case of errors */
++		u32 start = readl(host->regs + SD_EMMC_START);
++
++		start &= ~START_DESC_BUSY;
++		writel(start, host->regs + SD_EMMC_START);
++	}
++
+ 	if (ret == IRQ_HANDLED)
+ 		meson_mmc_request_done(host->mmc, cmd->mrq);
+-	else if (ret == IRQ_NONE)
+-		dev_warn(host->dev,
+-			 "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n",
+-			 raw_status, irq_en);
+ 
+ 	spin_unlock(&host->lock);
+ 	return ret;
+ }
+ 
++static int meson_mmc_wait_desc_stop(struct meson_host *host)
++{
++	int loop;
++	u32 status;
++
++	/*
++	 * It may sometimes take a while for it to actually halt. Here, we
++	 * are giving it 5ms to comply
++	 *
++	 * If we don't confirm the descriptor is stopped, it might raise new
++	 * IRQs after we have called mmc_request_done() which is bad.
++	 */
++	for (loop = 50; loop; loop--) {
++		status = readl(host->regs + SD_EMMC_STATUS);
++		if (status & (STATUS_BUSY | STATUS_DESC_BUSY))
++			udelay(100);
++		else
++			break;
++	}
++
++	if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) {
++		dev_err(host->dev, "Timed out waiting for host to stop\n");
++		return -ETIMEDOUT;
++	}
++
++	return 0;
++}
++
+ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ {
+ 	struct meson_host *host = dev_id;
+@@ -1092,6 +1135,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ 	if (WARN_ON(!cmd))
+ 		return IRQ_NONE;
+ 
++	if (cmd->error) {
++		meson_mmc_wait_desc_stop(host);
++		meson_mmc_request_done(host->mmc, cmd->mrq);
++
++		return IRQ_HANDLED;
++	}
++
+ 	data = cmd->data;
+ 	if (meson_mmc_bounce_buf_read(data)) {
+ 		xfer_bytes = data->blksz * data->blocks;
+@@ -1132,6 +1182,9 @@ static void meson_mmc_cfg_init(struct meson_host *host)
+ 	cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP));
+ 	cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE));
+ 
++	/* abort chain on R/W errors */
++	cfg |= CFG_ERR_ABORT;
++
+ 	writel(cfg, host->regs + SD_EMMC_CFG);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mtd-check-add_mtd_device-ret-code.patch b/queue-4.19/mtd-check-add_mtd_device-ret-code.patch
new file mode 100644
index 00000000000..110b54a78f1
--- /dev/null
+++ b/queue-4.19/mtd-check-add_mtd_device-ret-code.patch
@@ -0,0 +1,113 @@
+From eb345f2d4393aeca4e34fe9bb2913b0166a7817d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jan 2019 15:36:54 +0100
+Subject: mtd: Check add_mtd_device() ret code
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit 2b6f0090a3335b7bdd03ca520c35591159463041 ]
+
+add_mtd_device() can fail. We should always check its return value
+and gracefully handle the failure case. Fix the call sites where this
+not done (in mtdpart.c) and add a __must_check attribute to the
+prototype to avoid this kind of mistakes.
+
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.h |  2 +-
+ drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++-----
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
+index 9887bda317cd9..b31c868019ada 100644
+--- a/drivers/mtd/mtdcore.h
++++ b/drivers/mtd/mtdcore.h
+@@ -7,7 +7,7 @@
+ extern struct mutex mtd_table_mutex;
+ 
+ struct mtd_info *__mtd_next_device(int i);
+-int add_mtd_device(struct mtd_info *mtd);
++int __must_check add_mtd_device(struct mtd_info *mtd);
+ int del_mtd_device(struct mtd_info *mtd);
+ int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
+ int del_mtd_partitions(struct mtd_info *);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 0bbb23b014f1b..b9b308cde0a5d 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -612,10 +612,22 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
+ 	list_add(&new->list, &mtd_partitions);
+ 	mutex_unlock(&mtd_partitions_mutex);
+ 
+-	add_mtd_device(&new->mtd);
++	ret = add_mtd_device(&new->mtd);
++	if (ret)
++		goto err_remove_part;
+ 
+ 	mtd_add_partition_attrs(new);
+ 
++	return 0;
++
++err_remove_part:
++	mutex_lock(&mtd_partitions_mutex);
++	list_del(&new->list);
++	mutex_unlock(&mtd_partitions_mutex);
++
++	free_partition(new);
++	pr_info("%s:%i\n", __func__, __LINE__);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(mtd_add_partition);
+@@ -706,22 +718,31 @@ int add_mtd_partitions(struct mtd_info *master,
+ {
+ 	struct mtd_part *slave;
+ 	uint64_t cur_offset = 0;
+-	int i;
++	int i, ret;
+ 
+ 	printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+ 
+ 	for (i = 0; i < nbparts; i++) {
+ 		slave = allocate_partition(master, parts + i, i, cur_offset);
+ 		if (IS_ERR(slave)) {
+-			del_mtd_partitions(master);
+-			return PTR_ERR(slave);
++			ret = PTR_ERR(slave);
++			goto err_del_partitions;
+ 		}
+ 
+ 		mutex_lock(&mtd_partitions_mutex);
+ 		list_add(&slave->list, &mtd_partitions);
+ 		mutex_unlock(&mtd_partitions_mutex);
+ 
+-		add_mtd_device(&slave->mtd);
++		ret = add_mtd_device(&slave->mtd);
++		if (ret) {
++			mutex_lock(&mtd_partitions_mutex);
++			list_del(&slave->list);
++			mutex_unlock(&mtd_partitions_mutex);
++
++			free_partition(slave);
++			goto err_del_partitions;
++		}
++
+ 		mtd_add_partition_attrs(slave);
+ 		/* Look for subpartitions */
+ 		parse_mtd_partitions(&slave->mtd, parts[i].types, NULL);
+@@ -730,6 +751,11 @@ int add_mtd_partitions(struct mtd_info *master,
+ 	}
+ 
+ 	return 0;
++
++err_del_partitions:
++	del_mtd_partitions(master);
++
++	return ret;
+ }
+ 
+ static DEFINE_SPINLOCK(part_parser_lock);
+-- 
+2.20.1
+
diff --git a/queue-4.19/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch b/queue-4.19/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
new file mode 100644
index 00000000000..9a1e07aa4d4
--- /dev/null
+++ b/queue-4.19/mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
@@ -0,0 +1,38 @@
+From 5aaf829d93bcd4b15fe4c2cc18a7c7827496a558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 09:34:17 +0100
+Subject: mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET
+
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+
+[ Upstream commit 732774437ae01d9882e60314e303898e63c7f038 ]
+
+The opcodes used by the controller when doing batched page prog should
+be written in NFC_REG_WCMD_SET not FC_REG_RCMD_SET. Luckily, the
+default NFC_REG_WCMD_SET value matches the one we set in the driver
+which explains why we didn't notice the problem.
+
+Fixes: 614049a8d904 ("mtd: nand: sunxi: add support for DMA assisted operations")
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 1f0b7ee38df56..5b5f4d25a3e12 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1397,7 +1397,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd,
+ 	sunxi_nfc_randomizer_enable(mtd);
+ 
+ 	writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
+-	       nfc->regs + NFC_REG_RCMD_SET);
++	       nfc->regs + NFC_REG_WCMD_SET);
+ 
+ 	dma_async_issue_pending(nfc->dmac);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mtd-remove-a-debug-trace-in-mtdpart.c.patch b/queue-4.19/mtd-remove-a-debug-trace-in-mtdpart.c.patch
new file mode 100644
index 00000000000..52c747c7131
--- /dev/null
+++ b/queue-4.19/mtd-remove-a-debug-trace-in-mtdpart.c.patch
@@ -0,0 +1,35 @@
+From 2a95073ead157b0906379fa0820dda1e196518f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 09:47:00 +0100
+Subject: mtd: Remove a debug trace in mtdpart.c
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit bda2ab56356b9acdfab150f31c4bac9846253092 ]
+
+Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained
+a leftover of the debug session that led to this bug fix. Remove this
+pr_info().
+
+Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code")
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index b9b308cde0a5d..10c53364aa70c 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -626,7 +626,6 @@ err_remove_part:
+ 	mutex_unlock(&mtd_partitions_mutex);
+ 
+ 	free_partition(new);
+-	pr_info("%s:%i\n", __func__, __LINE__);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/mwifiex-debugfs-correct-histogram-spacing-formatting.patch b/queue-4.19/mwifiex-debugfs-correct-histogram-spacing-formatting.patch
new file mode 100644
index 00000000000..956fbdeff51
--- /dev/null
+++ b/queue-4.19/mwifiex-debugfs-correct-histogram-spacing-formatting.patch
@@ -0,0 +1,67 @@
+From c6db9b05b3a3d017b4f994fdaed01f271b518446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 14:26:55 -0800
+Subject: mwifiex: debugfs: correct histogram spacing, formatting
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 4cb777c64e030778c569f605398d7604d8aabc0f ]
+
+Currently, snippets of this file look like:
+
+rx rates (in Mbps): 0=1M   1=2M2=5.5M  3=11M   4=6M   5=9M  6=12M
+7=18M  8=24M  9=36M  10=48M  11=54M12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)
+44-53=MCS0-9(VHT:BW20)54-63=MCS0-9(VHT:BW40)64-73=MCS0-9(VHT:BW80)
+...
+noise_flr[--96dBm] = 22
+noise_flr[--95dBm] = 149
+noise_flr[--94dBm] = 9
+noise_flr[--93dBm] = 2
+
+We're missing some spaces, and we're adding a minus sign ('-') on values
+that are already negative signed integers.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index cce70252fd96b..cbe4493b32664 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -273,15 +273,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ 		     "total samples = %d\n",
+ 		     atomic_read(&phist_data->num_samples));
+ 
+-	p += sprintf(p, "rx rates (in Mbps): 0=1M   1=2M");
+-	p += sprintf(p, "2=5.5M  3=11M   4=6M   5=9M  6=12M\n");
+-	p += sprintf(p, "7=18M  8=24M  9=36M  10=48M  11=54M");
+-	p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
++	p += sprintf(p,
++		     "rx rates (in Mbps): 0=1M   1=2M 2=5.5M  3=11M   4=6M   5=9M  6=12M\n"
++		     "7=18M  8=24M  9=36M  10=48M  11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+ 
+ 	if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+-		p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+-		p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+-		p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
++		p += sprintf(p,
++			     "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n");
+ 	} else {
+ 		p += sprintf(p, "\n");
+ 	}
+@@ -310,7 +308,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ 	for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+ 		value = atomic_read(&phist_data->noise_flr[i]);
+ 		if (value)
+-			p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
++			p += sprintf(p, "noise_flr[%02ddBm] = %d\n",
+ 				(int)(i-128), value);
+ 	}
+ 	for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/mwifiex-fix-potential-null-dereference-and-use-after.patch b/queue-4.19/mwifiex-fix-potential-null-dereference-and-use-after.patch
new file mode 100644
index 00000000000..cc7929ce747
--- /dev/null
+++ b/queue-4.19/mwifiex-fix-potential-null-dereference-and-use-after.patch
@@ -0,0 +1,55 @@
+From 85496989543f48305fab072efda68e42e1c40929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:25:19 +0800
+Subject: mwifiex: fix potential NULL dereference and use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]
+
+There are two defects: (1) passing a NULL bss to
+mwifiex_save_hidden_ssid_channels will result in NULL dereference,
+(2) using bss after dropping the reference to it via cfg80211_put_bss.
+To fix them, the patch moves the buggy code to the branch that bss is
+not NULL and puts it before cfg80211_put_bss.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/scan.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index ed27147efcb37..dd02bbd9544e7 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1906,15 +1906,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ 					    ETH_ALEN))
+ 					mwifiex_update_curr_bss_params(priv,
+ 								       bss);
+-				cfg80211_put_bss(priv->wdev.wiphy, bss);
+-			}
+ 
+-			if ((chan->flags & IEEE80211_CHAN_RADAR) ||
+-			    (chan->flags & IEEE80211_CHAN_NO_IR)) {
+-				mwifiex_dbg(adapter, INFO,
+-					    "radar or passive channel %d\n",
+-					    channel);
+-				mwifiex_save_hidden_ssid_channels(priv, bss);
++				if ((chan->flags & IEEE80211_CHAN_RADAR) ||
++				    (chan->flags & IEEE80211_CHAN_NO_IR)) {
++					mwifiex_dbg(adapter, INFO,
++						    "radar or passive channel %d\n",
++						    channel);
++					mwifiex_save_hidden_ssid_channels(priv,
++									  bss);
++				}
++
++				cfg80211_put_bss(priv->wdev.wiphy, bss);
+ 			}
+ 		}
+ 	} else {
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-bcmgenet-reapply-manual-settings-to-the-phy.patch b/queue-4.19/net-bcmgenet-reapply-manual-settings-to-the-phy.patch
new file mode 100644
index 00000000000..e74861c67f4
--- /dev/null
+++ b/queue-4.19/net-bcmgenet-reapply-manual-settings-to-the-phy.patch
@@ -0,0 +1,58 @@
+From 4c87e1e683d5f7f5cdddd77549aa7c98f582a7eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:26 -0800
+Subject: net: bcmgenet: reapply manual settings to the PHY
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ]
+
+The phy_init_hw() function may reset the PHY to a configuration
+that does not match manual network settings stored in the phydev
+structure. If the phy state machine is polled rather than event
+driven this can create a timing hazard where the phy state machine
+might alter the settings stored in the phydev structure from the
+value read from the BMCR.
+
+This commit follows invocations of phy_init_hw() by the bcmgenet
+driver with invocations of the genphy_config_aneg() function to
+ensure that the BMCR is written to match the settings held in the
+phydev structure. This prevents the risk of manual settings being
+accidentally altered.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 6f7278d2ce4f2..b7d75011cede5 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2619,8 +2619,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ 	spin_unlock_irq(&priv->lock);
+ 
+ 	if (status & UMAC_IRQ_PHY_DET_R &&
+-	    priv->dev->phydev->autoneg != AUTONEG_ENABLE)
++	    priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
+ 		phy_init_hw(priv->dev->phydev);
++		genphy_config_aneg(priv->dev->phydev);
++	}
+ 
+ 	/* Link UP/DOWN event */
+ 	if (status & UMAC_IRQ_LINK_EVENT)
+@@ -3673,6 +3675,7 @@ static int bcmgenet_resume(struct device *d)
+ 	phy_init_hw(dev->phydev);
+ 
+ 	/* Speed settings must be restored */
++	genphy_config_aneg(dev->phydev);
+ 	bcmgenet_mii_config(priv->dev, false);
+ 
+ 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch b/queue-4.19/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch
new file mode 100644
index 00000000000..c516f0cf6fe
--- /dev/null
+++ b/queue-4.19/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch
@@ -0,0 +1,130 @@
+From b5e62023bb24c8924d6875f2aeabd738c7f9e7de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:24 -0800
+Subject: net: bcmgenet: use RGMII loopback for MAC reset
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 3a55402c93877d291b0a612d25edb03d1b4b93ac ]
+
+As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback
+during UniMAC sw_reset") the UniMAC must be clocked while sw_reset
+is asserted for its state machines to reset cleanly.
+
+The transmit and receive clocks used by the UniMAC are derived from
+the signals used on its PHY interface. The bcmgenet MAC can be
+configured to work with different PHY interfaces including MII,
+GMII, RGMII, and Reverse MII on internal and external interfaces.
+Unfortunately for the UniMAC, when configured for MII the Tx clock
+is always driven from the PHY which places it outside of the direct
+control of the MAC.
+
+The earlier commit enabled a local loopback mode within the UniMAC
+so that the receive clock would be derived from the transmit clock
+which addressed the observed issue with an external GPHY disabling
+it's Rx clock. However, when a Tx clock is not available this
+loopback is insufficient.
+
+This commit implements a workaround that leverages the fact that
+the MAC can reliably generate all of its necessary clocking by
+enterring the external GPHY RGMII interface mode with the UniMAC in
+local loopback during the sw_reset interval. Unfortunately, this
+has the undesirable side efect of the RGMII GTXCLK signal being
+driven during the same window.
+
+In most configurations this is a benign side effect as the signal
+is either not routed to a pin or is already expected to drive the
+pin. The one exception is when an external MII PHY is expected to
+drive the same pin with its TX_CLK output creating output driver
+contention.
+
+This commit exploits the IEEE 802.3 clause 22 standard defined
+isolate mode to force an external MII PHY to present a high
+impedance on its TX_CLK output during the window to prevent any
+contention at the pin.
+
+The MII interface is used internally with the 40nm internal EPHY
+which agressively disables its clocks for power savings leading to
+incomplete resets of the UniMAC and many instabilities observed
+over the years. The workaround of this commit is expected to put
+an end to those problems.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/genet/bcmgenet.c    |  2 --
+ drivers/net/ethernet/broadcom/genet/bcmmii.c  | 33 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 338d223804343..6f7278d2ce4f2 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1998,8 +1998,6 @@ static void reset_umac(struct bcmgenet_priv *priv)
+ 
+ 	/* issue soft reset with (rg)mii loopback to ensure a stable rxclk */
+ 	bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD);
+-	udelay(2);
+-	bcmgenet_umac_writel(priv, 0, UMAC_CMD);
+ }
+ 
+ static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index b0592fd4135b3..a5049d637791d 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -184,8 +184,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ 	const char *phy_name = NULL;
+ 	u32 id_mode_dis = 0;
+ 	u32 port_ctrl;
++	int bmcr = -1;
++	int ret;
+ 	u32 reg;
+ 
++	/* MAC clocking workaround during reset of umac state machines */
++	reg = bcmgenet_umac_readl(priv, UMAC_CMD);
++	if (reg & CMD_SW_RESET) {
++		/* An MII PHY must be isolated to prevent TXC contention */
++		if (priv->phy_interface == PHY_INTERFACE_MODE_MII) {
++			ret = phy_read(phydev, MII_BMCR);
++			if (ret >= 0) {
++				bmcr = ret;
++				ret = phy_write(phydev, MII_BMCR,
++						bmcr | BMCR_ISOLATE);
++			}
++			if (ret) {
++				netdev_err(dev, "failed to isolate PHY\n");
++				return ret;
++			}
++		}
++		/* Switch MAC clocking to RGMII generated clock */
++		bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
++		/* Ensure 5 clks with Rx disabled
++		 * followed by 5 clks with Reset asserted
++		 */
++		udelay(4);
++		reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN);
++		bcmgenet_umac_writel(priv, reg, UMAC_CMD);
++		/* Ensure 5 more clocks before Rx is enabled */
++		udelay(2);
++	}
++
+ 	priv->ext_phy = !priv->internal_phy &&
+ 			(priv->phy_interface != PHY_INTERFACE_MODE_MOCA);
+ 
+@@ -217,6 +247,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ 		phydev->supported &= PHY_BASIC_FEATURES;
+ 		bcmgenet_sys_writel(priv,
+ 				    PORT_MODE_EXT_EPHY, SYS_PORT_CTRL);
++		/* Restore the MII PHY after isolation */
++		if (bmcr >= 0)
++			phy_write(phydev, MII_BMCR, bmcr);
+ 		break;
+ 
+ 	case PHY_INTERFACE_MODE_REVMII:
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch b/queue-4.19/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
new file mode 100644
index 00000000000..88a347ca063
--- /dev/null
+++ b/queue-4.19/net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
@@ -0,0 +1,37 @@
+From 0dd2324effe7aacfc107cb0ea664fb17bfe2ee1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:38:43 +0300
+Subject: net/core/neighbour: fix kmemleak minimal reference count for hash
+ tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 01b833ab44c9e484060aad72267fc7e71beb559b ]
+
+This should be 1 for normal allocations, 0 disables leak reporting.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
+Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 4721793babed5..7597afee70680 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -370,7 +370,7 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ 		buckets = (struct neighbour __rcu **)
+ 			  __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ 					   get_order(size));
+-		kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++		kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+ 	}
+ 	if (!buckets) {
+ 		kfree(ret);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-core-neighbour-tell-kmemleak-about-hash-tables.patch b/queue-4.19/net-core-neighbour-tell-kmemleak-about-hash-tables.patch
new file mode 100644
index 00000000000..d25e8ea6f24
--- /dev/null
+++ b/queue-4.19/net-core-neighbour-tell-kmemleak-about-hash-tables.patch
@@ -0,0 +1,83 @@
+From da97bd74d18a10e3c5f58569bd32d8f176a80670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jan 2019 12:30:00 +0300
+Subject: net/core/neighbour: tell kmemleak about hash tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 ]
+
+This fixes false-positive kmemleak reports about leaked neighbour entries:
+
+unreferenced object 0xffff8885c6e4d0a8 (size 1024):
+  comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s)
+  hex dump (first 32 bytes):
+    00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff  ........ ,......
+    08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00  ..._......}.....
+  backtrace:
+    [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40
+    [<0000000036d7a0d8>] ip6_output+0x1ba/0x600
+    [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0
+    [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0
+    [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0
+    [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0
+    [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0
+    [<000000008698009d>] __sys_sendmsg+0xde/0x170
+    [<00000000889dacf1>] do_syscall_64+0x9b/0x400
+    [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+    [<000000005767ed39>] 0xffffffffffffffff
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index c52d6e6b341cf..4721793babed5 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -18,6 +18,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
+ #include <linux/slab.h>
++#include <linux/kmemleak.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -363,12 +364,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ 	ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
+ 	if (!ret)
+ 		return NULL;
+-	if (size <= PAGE_SIZE)
++	if (size <= PAGE_SIZE) {
+ 		buckets = kzalloc(size, GFP_ATOMIC);
+-	else
++	} else {
+ 		buckets = (struct neighbour __rcu **)
+ 			  __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ 					   get_order(size));
++		kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++	}
+ 	if (!buckets) {
+ 		kfree(ret);
+ 		return NULL;
+@@ -388,10 +391,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
+ 	size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
+ 	struct neighbour __rcu **buckets = nht->hash_buckets;
+ 
+-	if (size <= PAGE_SIZE)
++	if (size <= PAGE_SIZE) {
+ 		kfree(buckets);
+-	else
++	} else {
++		kmemleak_free(buckets);
+ 		free_pages((unsigned long)buckets, get_order(size));
++	}
+ 	kfree(nht);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-cpts-fix-a-missing-check-of-clk_prepare.patch b/queue-4.19/net-cpts-fix-a-missing-check-of-clk_prepare.patch
new file mode 100644
index 00000000000..883583732fd
--- /dev/null
+++ b/queue-4.19/net-cpts-fix-a-missing-check-of-clk_prepare.patch
@@ -0,0 +1,37 @@
+From 5838680681280a765a44e43763a9c94ab1f9bc6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:55:37 -0600
+Subject: net: (cpts) fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 2d822f2dbab7f4c820f72eb8570aacf3f35855bd ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index b96b93c686bf1..4f644ac314fe8 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -572,7 +572,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
+ 		return ERR_CAST(cpts->refclk);
+ 	}
+ 
+-	clk_prepare(cpts->refclk);
++	ret = clk_prepare(cpts->refclk);
++	if (ret)
++		return ERR_PTR(ret);
+ 
+ 	cpts->cc.read = cpts_systim_read;
+ 	cpts->cc.mask = CLOCKSOURCE_MASK(32);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch b/queue-4.19/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
new file mode 100644
index 00000000000..88f5d0adbb9
--- /dev/null
+++ b/queue-4.19/net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
@@ -0,0 +1,35 @@
+From 05b7ac13642e87440995d08c906502997dd9dd70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 13:37:26 +0300
+Subject: net: dev: Use unsigned integer as an argument to left-shift
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f4d7b3e23d259c44f1f1c39645450680fcd935d6 ]
+
+1 << 31 is Undefined Behaviour according to the C standard.
+Use U type modifier to avoid theoretical overflow.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 8c2fec0bcb265..5ada5fd9652dd 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3790,7 +3790,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ 	if (debug_value == 0)	/* no output */
+ 		return 0;
+ 	/* set low N bits */
+-	return (1 << debug_value) - 1;
++	return (1U << debug_value) - 1;
+ }
+ 
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch b/queue-4.19/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
new file mode 100644
index 00000000000..cc27161e6e3
--- /dev/null
+++ b/queue-4.19/net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
@@ -0,0 +1,41 @@
+From 7dcbb8d2cbf4907dca9321a0e8705ebbb02f3252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:08:18 -0600
+Subject: net: dsa: bcm_sf2: Propagate error value from mdio_write
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit e49505f7255be8ced695919c08a29bf2c3d79616 ]
+
+Both bcm_sf2_sw_indir_rw and mdiobus_write_nested could fail, so let's
+return their error codes upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 17cec68e56b4f..02a4187d81bd0 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -309,11 +309,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum,
+ 	 * send them to our master MDIO bus controller
+ 	 */
+ 	if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr))
+-		bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
++		return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
+ 	else
+-		mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val);
+-
+-	return 0;
++		return mdiobus_write_nested(priv->master_mii_bus, addr,
++				regnum, val);
+ }
+ 
+ static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-fec-add-missed-clk_disable_unprepare-in-remove.patch b/queue-4.19/net-fec-add-missed-clk_disable_unprepare-in-remove.patch
new file mode 100644
index 00000000000..7b9952ca2f4
--- /dev/null
+++ b/queue-4.19/net-fec-add-missed-clk_disable_unprepare-in-remove.patch
@@ -0,0 +1,35 @@
+From abb2b4ec34f1de2974c36d53e326c8a61722e8d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 23:50:00 +0800
+Subject: net: fec: add missed clk_disable_unprepare in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ]
+
+This driver forgets to disable and unprepare clks when remove.
+Add calls to clk_disable_unprepare to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 4cf80de4c471c..1c62a102a223c 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3606,6 +3606,8 @@ fec_drv_remove(struct platform_device *pdev)
+ 		regulator_disable(fep->reg_phy);
+ 	pm_runtime_put(&pdev->dev);
+ 	pm_runtime_disable(&pdev->dev);
++	clk_disable_unprepare(fep->clk_ahb);
++	clk_disable_unprepare(fep->clk_ipg);
+ 	if (of_phy_is_fixed_link(np))
+ 		of_phy_deregister_fixed_link(np);
+ 	of_node_put(fep->phy_node);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch b/queue-4.19/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
new file mode 100644
index 00000000000..d5fa94a749d
--- /dev/null
+++ b/queue-4.19/net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
@@ -0,0 +1,52 @@
+From e45bd5dce6a6fd97539a7c56d47ed78348dce44c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 12:26:27 -0800
+Subject: net: fix possible overflow in __sk_mem_raise_allocated()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5bf325a53202b8728cf7013b72688c46071e212e ]
+
+With many active TCP sockets, fat TCP sockets could fool
+__sk_mem_raise_allocated() thanks to an overflow.
+
+They would increase their share of the memory, instead
+of decreasing it.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ net/core/sock.c    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 0252c0d003104..4545a9ecc2193 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1272,7 +1272,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
+ 	percpu_counter_inc(sk->sk_prot->sockets_allocated);
+ }
+ 
+-static inline int
++static inline u64
+ sk_sockets_allocated_read_positive(struct sock *sk)
+ {
+ 	return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index ba4f843cdd1d1..bbde5f6a7dc91 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2435,7 +2435,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 	}
+ 
+ 	if (sk_has_memory_pressure(sk)) {
+-		int alloc;
++		u64 alloc;
+ 
+ 		if (!sk_under_memory_pressure(sk))
+ 			return 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch b/queue-4.19/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch
new file mode 100644
index 00000000000..1a75ad658f9
--- /dev/null
+++ b/queue-4.19/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch
@@ -0,0 +1,54 @@
+From 63847c1df2b89b78fc5ce98942e146fb870b8150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 16:57:50 +0100
+Subject: net/fq_impl: Switch to kvmalloc() for memory allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 71e67c3bd127cfe7863f54e4b087eba1cc8f9a7a ]
+
+The FQ implementation used by mac80211 allocates memory using kmalloc(),
+which can fail; and Johannes reported that this actually happens in
+practice.
+
+To avoid this, switch the allocation to kvmalloc() instead; this also
+brings fq_impl in line with all the FQ qdiscs.
+
+Fixes: 557fc4a09803 ("fq: add fair queuing framework")
+Reported-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20191105155750.547379-1-toke@redhat.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/fq_impl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
+index 89a012905ef0b..4b3e18ff8e6f2 100644
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -312,7 +312,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
+ 	fq->limit = 8192;
+ 	fq->memory_limit = 16 << 20; /* 16 MBytes */
+ 
+-	fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
++	fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
+ 	if (!fq->flows)
+ 		return -ENOMEM;
+ 
+@@ -330,7 +330,7 @@ static void fq_reset(struct fq *fq,
+ 	for (i = 0; i < fq->flows_cnt; i++)
+ 		fq_flow_reset(fq, &fq->flows[i], free_func);
+ 
+-	kfree(fq->flows);
++	kvfree(fq->flows);
+ 	fq->flows = NULL;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch b/queue-4.19/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch
new file mode 100644
index 00000000000..4ff6d3855d2
--- /dev/null
+++ b/queue-4.19/net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch
@@ -0,0 +1,51 @@
+From 952c5401b9c14e71272911beeea7b404cec43c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 07:39:34 +0800
+Subject: net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 4a402f47cfce904051cd8b31bef4fe2910d9dce9 ]
+
+According to firmware error code definition, the error code of 2
+means NOT_SUPPORTED, this patch changes it to NOT_SUPPORTED.
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index 690f62ed87dca..09a4d87429cea 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -260,6 +260,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num)
+ 
+ 			if (desc_ret == HCLGE_CMD_EXEC_SUCCESS)
+ 				retval = 0;
++			else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED)
++				retval = -EOPNOTSUPP;
+ 			else
+ 				retval = -EIO;
+ 			hw->cmq.last_status = desc_ret;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 821d4c2f84bd3..d7520686509fd 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -39,7 +39,7 @@ struct hclge_cmq_ring {
+ enum hclge_cmd_return_status {
+ 	HCLGE_CMD_EXEC_SUCCESS	= 0,
+ 	HCLGE_CMD_NO_AUTH	= 1,
+-	HCLGE_CMD_NOT_EXEC	= 2,
++	HCLGE_CMD_NOT_SUPPORTED	= 2,
+ 	HCLGE_CMD_QUEUE_FULL	= 3,
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-an-issue-for-hclgevf_ae_get_hdev.patch b/queue-4.19/net-hns3-fix-an-issue-for-hclgevf_ae_get_hdev.patch
new file mode 100644
index 00000000000..ebcfff8d4ee
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-an-issue-for-hclgevf_ae_get_hdev.patch
@@ -0,0 +1,42 @@
+From 1d5bb8f6ec16b782f6e0372df844558c0467251c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jan 2019 04:55:50 +0800
+Subject: net: hns3: fix an issue for hclgevf_ae_get_hdev
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit eed9535f9f716a532ec0c5d6cc7a48584acdf435 ]
+
+HNS3 VF driver support NIC and Roce, hdev stores NIC
+handle and Roce handle, should use correct parameter for
+container_of.
+
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index beae1e2cd59b1..67db19709deaa 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -26,7 +26,12 @@ MODULE_DEVICE_TABLE(pci, ae_algovf_pci_tbl);
+ static inline struct hclgevf_dev *hclgevf_ae_get_hdev(
+ 	struct hnae3_handle *handle)
+ {
+-	return container_of(handle, struct hclgevf_dev, nic);
++	if (!handle->client)
++		return container_of(handle, struct hclgevf_dev, nic);
++	else if (handle->client->type == HNAE3_CLIENT_ROCE)
++		return container_of(handle, struct hclgevf_dev, roce);
++	else
++		return container_of(handle, struct hclgevf_dev, nic);
+ }
+ 
+ static int hclgevf_tqps_update_stats(struct hnae3_handle *handle)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-an-issue-for-hns3_update_new_int_gl.patch b/queue-4.19/net-hns3-fix-an-issue-for-hns3_update_new_int_gl.patch
new file mode 100644
index 00000000000..6066b71e9fc
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-an-issue-for-hns3_update_new_int_gl.patch
@@ -0,0 +1,38 @@
+From 1cf675a1adf7ea2d11553055e5e4b8aeded7ccae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Feb 2019 22:39:27 +0800
+Subject: net: hns3: fix an issue for hns3_update_new_int_gl
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit 6241e71e7207102ffc733991f7a00f74098d7da0 ]
+
+HNS3 supports setting rx-usecs|tx-usecs as 0, but it will not
+update dynamically when adaptive-tx or adaptive-rx is enable.
+This patch removes the Redundant check.
+
+Fixes: a95e1f8666e9 ("net: hns3: change the time interval of int_gl calculating")
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 3708f149d0a6a..b2860087a7dc7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2366,7 +2366,7 @@ static bool hns3_get_new_int_gl(struct hns3_enet_ring_group *ring_group)
+ 	u32 time_passed_ms;
+ 	u16 new_int_gl;
+ 
+-	if (!ring_group->coal.int_gl || !tqp_vector->last_jiffies)
++	if (!tqp_vector->last_jiffies)
+ 		return false;
+ 
+ 	if (ring_group->total_packets == 0) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-pfc-not-setting-problem-for-dcb-module.patch b/queue-4.19/net-hns3-fix-pfc-not-setting-problem-for-dcb-module.patch
new file mode 100644
index 00000000000..2d2bd2b3ced
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-pfc-not-setting-problem-for-dcb-module.patch
@@ -0,0 +1,81 @@
+From 19c8ce9a07c38837935e999ddcc46bb2657a07f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 07:39:38 +0800
+Subject: net: hns3: fix PFC not setting problem for DCB module
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit d3ad430ac531e65f29c9737f86744c425c9173ef ]
+
+The PFC enabling is based on user priority, currently it is
+based on TC, which may cause PFC not setting correctly when pri
+to TC mapping is not one to one relation.
+
+This patch adds pfc_en in tm_info to fix it.
+
+Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c  | 7 ++++---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c   | 2 +-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index 92f19384e2585..a75d7c826fc2b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -245,6 +245,9 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ 	    hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE)
+ 		return -EINVAL;
+ 
++	if (pfc->pfc_en == hdev->tm_info.pfc_en)
++		return 0;
++
+ 	prio_tc = hdev->tm_info.prio_tc;
+ 	pfc_map = 0;
+ 
+@@ -257,10 +260,8 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ 		}
+ 	}
+ 
+-	if (pfc_map == hdev->tm_info.hw_pfc_map)
+-		return 0;
+-
+ 	hdev->tm_info.hw_pfc_map = pfc_map;
++	hdev->tm_info.pfc_en = pfc->pfc_en;
+ 
+ 	return hclge_pause_setup_hw(hdev);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 1528fb3fa6be6..260b1e7796908 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -249,6 +249,7 @@ struct hclge_tm_info {
+ 	struct hclge_tc_info tc_info[HNAE3_MAX_TC];
+ 	enum hclge_fc_mode fc_mode;
+ 	u8 hw_pfc_map; /* Allow for packet drop or not on this TC */
++	u8 pfc_en;	/* PFC enabled or not for user priority */
+ };
+ 
+ struct hclge_comm_stats_str {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 0d45d045706c7..3180ae4528895 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -1162,7 +1162,7 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
+ 				HCLGE_RX_MAC_PAUSE_EN_MSK;
+ 
+ 	return hclge_pfc_pause_en_cfg(hdev, enable_bitmap,
+-				      hdev->tm_info.hw_pfc_map);
++				      hdev->tm_info.pfc_en);
+ }
+ 
+ /* Each Tc has a 1024 queue sets to backpress, it divides to
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ip6_gre-do-not-report-erspan_ver-for-ip6gre-or-i.patch b/queue-4.19/net-ip6_gre-do-not-report-erspan_ver-for-ip6gre-or-i.patch
new file mode 100644
index 00000000000..6b6fceb21db
--- /dev/null
+++ b/queue-4.19/net-ip6_gre-do-not-report-erspan_ver-for-ip6gre-or-i.patch
@@ -0,0 +1,93 @@
+From 239a6dffce156e5b2db8fd434d956d65f9eced08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 17:42:06 +0100
+Subject: net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit 103d0244d29fcaf38f1339d4538919bbbc051490 ]
+
+Report erspan version field to userspace in ip6gre_fill_info just for
+erspan_v6 tunnels. Moreover report IFLA_GRE_ERSPAN_INDEX only for
+erspan version 1.
+The issue can be triggered with the following reproducer:
+
+$ip link add name gre6 type ip6gre local 2001::1 remote 2002::2
+$ip link set gre6 up
+$ip -d link sh gre6
+14: grep6@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1448 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+    link/gre6 2001::1 peer 2002::2 promiscuity 0 minmtu 0 maxmtu 0
+    ip6gre remote 2002::2 local 2001::1 hoplimit 64 encaplimit 4 tclass 0x00 flowlabel 0x00000 erspan_index 0 erspan_ver 0 addrgenmode eui64
+
+Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_gre.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index dee4113f21a9a..8fd28edd6ac57 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2135,9 +2135,23 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 	struct __ip6_tnl_parm *p = &t->parms;
+ 	__be16 o_flags = p->o_flags;
+ 
+-	if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
+-	    !p->collect_md)
+-		o_flags |= TUNNEL_KEY;
++	if (p->erspan_ver == 1 || p->erspan_ver == 2) {
++		if (!p->collect_md)
++			o_flags |= TUNNEL_KEY;
++
++		if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
++			goto nla_put_failure;
++
++		if (p->erspan_ver == 1) {
++			if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
++				goto nla_put_failure;
++		} else {
++			if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
++				goto nla_put_failure;
++			if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
++				goto nla_put_failure;
++		}
++	}
+ 
+ 	if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ 	    nla_put_be16(skb, IFLA_GRE_IFLAGS,
+@@ -2152,8 +2166,7 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 	    nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
+ 	    nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
+ 	    nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags) ||
+-	    nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark) ||
+-	    nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
++	    nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark))
+ 		goto nla_put_failure;
+ 
+ 	if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
+@@ -2171,19 +2184,6 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 			goto nla_put_failure;
+ 	}
+ 
+-	if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
+-		goto nla_put_failure;
+-
+-	if (p->erspan_ver == 1) {
+-		if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
+-			goto nla_put_failure;
+-	} else if (p->erspan_ver == 2) {
+-		if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
+-			goto nla_put_failure;
+-		if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
+-			goto nla_put_failure;
+-	}
+-
+ 	return 0;
+ 
+ nla_put_failure:
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ip_gre-do-not-report-erspan_ver-for-gre-or-greta.patch b/queue-4.19/net-ip_gre-do-not-report-erspan_ver-for-gre-or-greta.patch
new file mode 100644
index 00000000000..e6b38f33c9e
--- /dev/null
+++ b/queue-4.19/net-ip_gre-do-not-report-erspan_ver-for-gre-or-greta.patch
@@ -0,0 +1,81 @@
+From 4c25ec8ebdc981b61c77cd132524a5061888ff8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 17:42:05 +0100
+Subject: net: ip_gre: do not report erspan_ver for gre or gretap
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit 2bdf700e538828d6456150b9319e5f689b062d54 ]
+
+Report erspan version field to userspace in ipgre_fill_info just for
+erspan tunnels. The issue can be triggered with the following reproducer:
+
+$ip link add name gre1 type gre local 192.168.0.1 remote 192.168.1.1
+$ip link set dev gre1 up
+$ip -d link sh gre1
+13: gre1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1476 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+    link/gre 192.168.0.1 peer 192.168.1.1 promiscuity 0 minmtu 0 maxmtu 0
+    gre remote 192.168.1.1 local 192.168.0.1 ttl inherit erspan_ver 0 addrgenmode eui64 numtxqueues 1 numrxqueues 1
+
+Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 681276111310b..a3f77441f3e69 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1466,9 +1466,23 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 	struct ip_tunnel_parm *p = &t->parms;
+ 	__be16 o_flags = p->o_flags;
+ 
+-	if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
+-	    !t->collect_md)
+-		o_flags |= TUNNEL_KEY;
++	if (t->erspan_ver == 1 || t->erspan_ver == 2) {
++		if (!t->collect_md)
++			o_flags |= TUNNEL_KEY;
++
++		if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
++			goto nla_put_failure;
++
++		if (t->erspan_ver == 1) {
++			if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
++				goto nla_put_failure;
++		} else {
++			if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
++				goto nla_put_failure;
++			if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
++				goto nla_put_failure;
++		}
++	}
+ 
+ 	if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ 	    nla_put_be16(skb, IFLA_GRE_IFLAGS,
+@@ -1504,19 +1518,6 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ 			goto nla_put_failure;
+ 	}
+ 
+-	if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
+-		goto nla_put_failure;
+-
+-	if (t->erspan_ver == 1) {
+-		if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
+-			goto nla_put_failure;
+-	} else if (t->erspan_ver == 2) {
+-		if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
+-			goto nla_put_failure;
+-		if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
+-			goto nla_put_failure;
+-	}
+-
+ 	return 0;
+ 
+ nla_put_failure:
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-marvell-fix-a-missing-check-of-acpi_match_device.patch b/queue-4.19/net-marvell-fix-a-missing-check-of-acpi_match_device.patch
new file mode 100644
index 00000000000..c6737d132ec
--- /dev/null
+++ b/queue-4.19/net-marvell-fix-a-missing-check-of-acpi_match_device.patch
@@ -0,0 +1,37 @@
+From 10d27ac18c74c7cd863d1b49c5639ae8697f2c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:31:08 -0600
+Subject: net: marvell: fix a missing check of acpi_match_device
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 92ee77d148bf06d8c52664be4d1b862583fd5c0e ]
+
+When acpi_match_device fails, its return value is NULL. Directly using
+the return value without a check may result in a NULL-pointer
+dereference. The fix checks if acpi_match_device fails, and if so,
+returns -EINVAL.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 1cc0e8fda4d5e..a50977ce40766 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -5132,6 +5132,8 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 	if (has_acpi_companion(&pdev->dev)) {
+ 		acpi_id = acpi_match_device(pdev->dev.driver->acpi_match_table,
+ 					    &pdev->dev);
++		if (!acpi_id)
++			return -EINVAL;
+ 		priv->hw_version = (unsigned long)acpi_id->driver_data;
+ 	} else {
+ 		priv->hw_version =
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mlx5-continue-driver-initialization-despite-debu.patch b/queue-4.19/net-mlx5-continue-driver-initialization-despite-debu.patch
new file mode 100644
index 00000000000..c6ae7bbb9f6
--- /dev/null
+++ b/queue-4.19/net-mlx5-continue-driver-initialization-despite-debu.patch
@@ -0,0 +1,44 @@
+From 80aeac70414858b17f941ae33a2b69b1e2cf9946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 13:15:11 +0200
+Subject: net/mlx5: Continue driver initialization despite debugfs failure
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 199fa087dc6b503baad06712716fac645a983e8a ]
+
+The failure to create debugfs entry is unpleasant event, but not enough
+to abort drier initialization. Align the mlx5_core code to debugfs design
+and continue execution whenever debugfs_create_dir() successes or not.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 231ed508c240a..5fac00ea62457 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -859,11 +859,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+ 
+ 	priv->numa_node = dev_to_node(&dev->pdev->dev);
+ 
+-	priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+-	if (!priv->dbg_root) {
+-		dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+-		return -ENOMEM;
+-	}
++	if (mlx5_debugfs_root)
++		priv->dbg_root =
++			debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root);
+ 
+ 	err = mlx5_pci_enable_device(dev);
+ 	if (err) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch b/queue-4.19/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch
new file mode 100644
index 00000000000..ae45aaa7ef1
--- /dev/null
+++ b/queue-4.19/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch
@@ -0,0 +1,39 @@
+From d90354e0f1e9b03a3adb48931276c9f1042f250c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 00:01:40 +0200
+Subject: net: mscc: ocelot: fix __ocelot_rmw_ix prototype
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit 17fdd7638cb687cd7f15a48545f25d738f0101e0 ]
+
+The "read-modify-write register index" function is declared with a
+confusing prototype: the "mask" and "reg" arguments are swapped.
+
+Fortunately, this does not affect callers so far. Both arguments are
+u32, and the wrapper macros (ocelot_rmw_ix etc) have the arguments in
+the correct order (the one from ocelot_io.c).
+
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h
+index 616bec30dfa3f..3d8c6f38e76b9 100644
+--- a/drivers/net/ethernet/mscc/ocelot.h
++++ b/drivers/net/ethernet/mscc/ocelot.h
+@@ -541,7 +541,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
+ #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri))
+ #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0)
+ 
+-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask,
++void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
+ 		     u32 offset);
+ #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri))
+ #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi))
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-net_namespace-check-the-return-value-of-register.patch b/queue-4.19/net-net_namespace-check-the-return-value-of-register.patch
new file mode 100644
index 00000000000..16afcc5a5f8
--- /dev/null
+++ b/queue-4.19/net-net_namespace-check-the-return-value-of-register.patch
@@ -0,0 +1,38 @@
+From a3c3a75042af710b18637b4b5716a9a6f8949bda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 19:42:38 -0600
+Subject: net/net_namespace: Check the return value of register_pernet_subsys()
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c ]
+
+In net_ns_init(), register_pernet_subsys() could fail while registering
+network namespace subsystems. The fix checks the return value and
+sends a panic() on failure.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/net_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 6dab186d4b8f6..c60123dff8039 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -913,7 +913,8 @@ static int __init net_ns_init(void)
+ 	init_net_initialized = true;
+ 	up_write(&pernet_ops_rwsem);
+ 
+-	register_pernet_subsys(&net_ns_ops);
++	if (register_pernet_subsys(&net_ns_ops))
++		panic("Could not register network namespace subsystems");
+ 
+ 	rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
+ 		      RTNL_FLAG_DOIT_UNLOCKED);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch b/queue-4.19/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch
new file mode 100644
index 00000000000..2db980c0e39
--- /dev/null
+++ b/queue-4.19/net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch
@@ -0,0 +1,41 @@
+From adecf35e9f15ad9a9d4e431c640dbca0aace0b1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 18:54:53 -0600
+Subject: net/netlink_compat: Fix a missing check of nla_parse_nested
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 89dfd0083751d00d5d7ead36f6d8b045bf89c5e1 ]
+
+In tipc_nl_compat_sk_dump(), if nla_parse_nested() fails, it could return
+an error. To be consistent with other invocations of the function call,
+on error, the fix passes the return value upstream.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 318c541970ecd..6494d6b5e1b24 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -1030,8 +1030,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg,
+ 		u32 node;
+ 		struct nlattr *con[TIPC_NLA_CON_MAX + 1];
+ 
+-		nla_parse_nested(con, TIPC_NLA_CON_MAX,
+-				 sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++		err = nla_parse_nested(con, TIPC_NLA_CON_MAX,
++				       sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++
++		if (err)
++			return err;
+ 
+ 		node = nla_get_u32(con[TIPC_NLA_CON_NODE]);
+ 		tipc_tlv_sprintf(msg->rep, "  connected to <%u.%u.%u:%u>",
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-don-t-wait-for-send-buffer-space-when-data-w.patch b/queue-4.19/net-smc-don-t-wait-for-send-buffer-space-when-data-w.patch
new file mode 100644
index 00000000000..4dcb4bd2d64
--- /dev/null
+++ b/queue-4.19/net-smc-don-t-wait-for-send-buffer-space-when-data-w.patch
@@ -0,0 +1,49 @@
+From 7973fe904744bcf31f1384ddb6ffaf038617dc77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:51:03 +0100
+Subject: net/smc: don't wait for send buffer space when data was already sent
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 6889b36da78a21a312d8b462c1fa25a03c2ff192 ]
+
+When there is no more send buffer space and at least 1 byte was already
+sent then return to user space. The wait is only done when no data was
+sent by the sendmsg() call.
+This fixes smc_tx_sendmsg() which tried to always send all user data and
+started to wait for free send buffer space when needed. During this wait
+the user space program was blocked in the sendmsg() call and hence not
+able to receive incoming data. When both sides were in such a situation
+then the connection stalled forever.
+
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_tx.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index 28361aef99825..f1f621675db01 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -163,12 +163,11 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
+ 			conn->local_tx_ctrl.prod_flags.urg_data_pending = 1;
+ 
+ 		if (!atomic_read(&conn->sndbuf_space) || conn->urg_tx_pend) {
++			if (send_done)
++				return send_done;
+ 			rc = smc_tx_wait(smc, msg->msg_flags);
+-			if (rc) {
+-				if (send_done)
+-					return send_done;
++			if (rc)
+ 				goto out_err;
+-			}
+ 			continue;
+ 		}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-fix-byte_order-for-rx_curs_confirmed.patch b/queue-4.19/net-smc-fix-byte_order-for-rx_curs_confirmed.patch
new file mode 100644
index 00000000000..3cefee06ca9
--- /dev/null
+++ b/queue-4.19/net-smc-fix-byte_order-for-rx_curs_confirmed.patch
@@ -0,0 +1,81 @@
+From d06a79be0f801f2c5d0e8164b5be10d149d4d9bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 14:52:54 +0100
+Subject: net/smc: fix byte_order for rx_curs_confirmed
+
+From: Ursula Braun <ubraun@linux.ibm.com>
+
+[ Upstream commit ccc8ca9b90acb45a3309f922b2591b07b4e070ec ]
+
+The recent change in the rx_curs_confirmed assignment disregards
+byte order, which causes problems on little endian architectures.
+This patch fixes it.
+
+Fixes: b8649efad879 ("net/smc: fix sender_free computation") (net-tree)
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_cdc.c |  4 +---
+ net/smc/smc_cdc.h | 19 ++++++++++---------
+ 2 files changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
+index 8f691b5a44ddf..333e4353498f8 100644
+--- a/net/smc/smc_cdc.c
++++ b/net/smc/smc_cdc.c
+@@ -106,9 +106,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+ 
+ 	conn->tx_cdc_seq++;
+ 	conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
+-	smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
+-			    &conn->local_tx_ctrl, conn);
+-	smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
++	smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
+ 	rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
+ 	if (!rc)
+ 		smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
+diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
+index 2377a51772d51..34d2e1450320a 100644
+--- a/net/smc/smc_cdc.h
++++ b/net/smc/smc_cdc.h
+@@ -186,26 +186,27 @@ static inline int smc_curs_diff_large(unsigned int size,
+ 
+ static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
+ 					  union smc_host_cursor *local,
++					  union smc_host_cursor *save,
+ 					  struct smc_connection *conn)
+ {
+-	union smc_host_cursor temp;
+-
+-	smc_curs_copy(&temp, local, conn);
+-	peer->count = htonl(temp.count);
+-	peer->wrap = htons(temp.wrap);
++	smc_curs_copy(save, local, conn);
++	peer->count = htonl(save->count);
++	peer->wrap = htons(save->wrap);
+ 	/* peer->reserved = htons(0); must be ensured by caller */
+ }
+ 
+ static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
+-				       struct smc_host_cdc_msg *local,
+-				       struct smc_connection *conn)
++				       struct smc_connection *conn,
++				       union smc_host_cursor *save)
+ {
++	struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
++
+ 	peer->common.type = local->common.type;
+ 	peer->len = local->len;
+ 	peer->seqno = htons(local->seqno);
+ 	peer->token = htonl(local->token);
+-	smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
+-	smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
++	smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
++	smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
+ 	peer->prod_flags = local->prod_flags;
+ 	peer->conn_state_flags = local->conn_state_flags;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-fix-sender_free-computation.patch b/queue-4.19/net-smc-fix-sender_free-computation.patch
new file mode 100644
index 00000000000..1a3b976958d
--- /dev/null
+++ b/queue-4.19/net-smc-fix-sender_free-computation.patch
@@ -0,0 +1,122 @@
+From 4c79ee99ac3591b5cc63d9ce346e81135a9855f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Feb 2019 13:44:45 +0100
+Subject: net/smc: fix sender_free computation
+
+From: Ursula Braun <ubraun@linux.ibm.com>
+
+[ Upstream commit b8649efad879c69c7ab1f19ce8814fcabef1f72b ]
+
+In some scenarios a separate consumer cursor update is necessary.
+The decision is made in smc_tx_consumer_cursor_update(). The
+sender_free computation could be wrong:
+
+The rx confirmed cursor is always smaller than or equal to the
+rx producer cursor. The parameters in the smc_curs_diff() call
+have to be exchanged, otherwise sender_free might even be negative.
+
+And if more data arrives local_rx_ctrl.prod might be updated, enabling
+a cursor difference between local_rx_ctrl.prod and rx confirmed cursor
+larger than the RMB size. This case is not covered by smc_curs_diff().
+Thus function smc_curs_diff_large() is introduced here.
+
+If a recvmsg() is processed in parallel, local_tx_ctrl.cons might
+change during smc_cdc_msg_send. Make sure rx_curs_confirmed is updated
+with the actually sent local_tx_ctrl.cons value.
+
+Fixes: e82f2e31f559 ("net/smc: optimize consumer cursor updates")
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_cdc.c |  5 +++--
+ net/smc/smc_cdc.h | 26 +++++++++++++++++++++++++-
+ net/smc/smc_tx.c  |  3 ++-
+ 3 files changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
+index ed5dcf03fe0b6..8f691b5a44ddf 100644
+--- a/net/smc/smc_cdc.c
++++ b/net/smc/smc_cdc.c
+@@ -96,6 +96,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+ 		     struct smc_wr_buf *wr_buf,
+ 		     struct smc_cdc_tx_pend *pend)
+ {
++	union smc_host_cursor cfed;
+ 	struct smc_link *link;
+ 	int rc;
+ 
+@@ -107,10 +108,10 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+ 	conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
+ 	smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
+ 			    &conn->local_tx_ctrl, conn);
++	smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
+ 	rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
+ 	if (!rc)
+-		smc_curs_copy(&conn->rx_curs_confirmed,
+-			      &conn->local_tx_ctrl.cons, conn);
++		smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
+ 
+ 	return rc;
+ }
+diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
+index 934df4473a7ce..2377a51772d51 100644
+--- a/net/smc/smc_cdc.h
++++ b/net/smc/smc_cdc.h
+@@ -135,7 +135,9 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
+ #endif
+ }
+ 
+-/* calculate cursor difference between old and new, where old <= new */
++/* calculate cursor difference between old and new, where old <= new and
++ * difference cannot exceed size
++ */
+ static inline int smc_curs_diff(unsigned int size,
+ 				union smc_host_cursor *old,
+ 				union smc_host_cursor *new)
+@@ -160,6 +162,28 @@ static inline int smc_curs_comp(unsigned int size,
+ 	return smc_curs_diff(size, old, new);
+ }
+ 
++/* calculate cursor difference between old and new, where old <= new and
++ * difference may exceed size
++ */
++static inline int smc_curs_diff_large(unsigned int size,
++				      union smc_host_cursor *old,
++				      union smc_host_cursor *new)
++{
++	if (old->wrap < new->wrap)
++		return min_t(int,
++			     (size - old->count) + new->count +
++			     (new->wrap - old->wrap - 1) * size,
++			     size);
++
++	if (old->wrap > new->wrap) /* wrap has switched from 0xffff to 0x0000 */
++		return min_t(int,
++			     (size - old->count) + new->count +
++			     (new->wrap + 0xffff - old->wrap) * size,
++			     size);
++
++	return max_t(int, 0, (new->count - old->count));
++}
++
+ static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
+ 					  union smc_host_cursor *local,
+ 					  struct smc_connection *conn)
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index f1f621675db01..0ecbbdc337b82 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -595,7 +595,8 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
+ 	if (to_confirm > conn->rmbe_update_limit) {
+ 		smc_curs_copy(&prod, &conn->local_rx_ctrl.prod, conn);
+ 		sender_free = conn->rmb_desc->len -
+-			      smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
++			      smc_curs_diff_large(conn->rmb_desc->len,
++						  &cfed, &prod);
+ 	}
+ 
+ 	if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch b/queue-4.19/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch
new file mode 100644
index 00000000000..052ab3bc91d
--- /dev/null
+++ b/queue-4.19/net-smc-prevent-races-between-smc_lgr_terminate-and-.patch
@@ -0,0 +1,49 @@
+From c888405948f1d04eda384205e7023a6dc3e3b81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:51:02 +0100
+Subject: net/smc: prevent races between smc_lgr_terminate() and
+ smc_conn_free()
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 77f838ace755d2f466536c44dac6c856f62cd901 ]
+
+To prevent races between smc_lgr_terminate() and smc_conn_free() add an
+extra check of the lgr field before accessing it, and cancel a delayed
+free_work when a new smc connection is created.
+This fixes the problem that free_work cleared the lgr variable but
+smc_lgr_terminate() or smc_conn_free() still access it in parallel.
+
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 18daebcef1813..2c9baf8bf1189 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -128,6 +128,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
+ {
+ 	struct smc_link_group *lgr = conn->lgr;
+ 
++	if (!lgr)
++		return;
+ 	write_lock_bh(&lgr->conns_lock);
+ 	if (conn->alert_token_local) {
+ 		__smc_lgr_unregister_conn(conn);
+@@ -612,6 +614,8 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
+ 			local_contact = SMC_REUSE_CONTACT;
+ 			conn->lgr = lgr;
+ 			smc_lgr_register_conn(conn); /* add smc conn to lgr */
++			if (delayed_work_pending(&lgr->free_work))
++				cancel_delayed_work(&lgr->free_work);
+ 			write_unlock_bh(&lgr->conns_lock);
+ 			break;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-stmicro-fix-a-missing-check-of-clk_prepare.patch b/queue-4.19/net-stmicro-fix-a-missing-check-of-clk_prepare.patch
new file mode 100644
index 00000000000..ec1d44694ef
--- /dev/null
+++ b/queue-4.19/net-stmicro-fix-a-missing-check-of-clk_prepare.patch
@@ -0,0 +1,37 @@
+From e7ba8f7e8e5650d8c51588e7e09394bec1765e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:57:14 -0600
+Subject: net: stmicro: fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit f86a3b83833e7cfe558ca4d70b64ebc48903efec ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index d07520fb969e6..62ccbd47c1db2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ 		gmac->clk_enabled = 1;
+ 	} else {
+ 		clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+-		clk_prepare(gmac->tx_clk);
++		ret = clk_prepare(gmac->tx_clk);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch b/queue-4.19/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
new file mode 100644
index 00000000000..29449f11689
--- /dev/null
+++ b/queue-4.19/net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
@@ -0,0 +1,39 @@
+From d12eeef772de889d1e82435c8e3229f653b3ee41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 16:28:30 +0800
+Subject: net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit 40752b3eae29f8ca2378e978a02bd6dbeeb06d16 ]
+
+This patch fixes potential double frees if register_hdlc_device() fails.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Peng Hao <peng.hao2@zte.com.cn>
+CC: Zhao Qiang <qiang.zhao@nxp.com>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: netdev@vger.kernel.org
+CC: linuxppc-dev@lists.ozlabs.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 5f0366a125e26..0212f576a838c 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -1113,7 +1113,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ 	if (register_hdlc_device(dev)) {
+ 		ret = -ENOBUFS;
+ 		pr_err("ucc_hdlc: unable to register hdlc device\n");
+-		free_netdev(dev);
+ 		goto free_dev;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nf_nat_sip-fix-rtp-rtcp-source-port-transl.patch b/queue-4.19/netfilter-nf_nat_sip-fix-rtp-rtcp-source-port-transl.patch
new file mode 100644
index 00000000000..5f203b2a944
--- /dev/null
+++ b/queue-4.19/netfilter-nf_nat_sip-fix-rtp-rtcp-source-port-transl.patch
@@ -0,0 +1,109 @@
+From 49c84e51ece78ff87d1ba6ce2277c25e31dcf56a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:10:37 +0100
+Subject: netfilter: nf_nat_sip: fix RTP/RTCP source port translations
+
+From: Alin Nastac <alin.nastac@gmail.com>
+
+[ Upstream commit 8294059931448aa1ca112615bdffa3eab552c382 ]
+
+Each media stream negotiation between 2 SIP peers will trigger creation
+of 4 different expectations (2 RTP and 2 RTCP):
+ - INVITE will create expectations for the media packets sent by the
+   called peer
+ - reply to the INVITE will create expectations for media packets sent
+   by the caller
+
+The dport used by these expectations usually match the ones selected
+by the SIP peers, but they might get translated due to conflicts with
+another expectation. When such event occur, it is important to do
+this translation in both directions, dport translation on the receiving
+path and sport translation on the sending path.
+
+This commit fixes the sport translation when the peer requiring it is
+also the one that starts the media stream. In this scenario, first media
+stream packet is forwarded from LAN to WAN and will rely on
+nf_nat_sip_expected() to do the necessary sport translation. However, the
+expectation matched by this packet does not contain the necessary information
+for doing SNAT, this data being stored in the paired expectation created by
+the sender's SIP message (INVITE or reply to it).
+
+Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_nat_sip.c | 39 ++++++++++++++++++++++++++++++++++----
+ 1 file changed, 35 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
+index 1f30860749817..aa1be643d7a09 100644
+--- a/net/netfilter/nf_nat_sip.c
++++ b/net/netfilter/nf_nat_sip.c
+@@ -18,6 +18,7 @@
+ 
+ #include <net/netfilter/nf_nat.h>
+ #include <net/netfilter/nf_nat_helper.h>
++#include <net/netfilter/nf_conntrack_core.h>
+ #include <net/netfilter/nf_conntrack_helper.h>
+ #include <net/netfilter/nf_conntrack_expect.h>
+ #include <net/netfilter/nf_conntrack_seqadj.h>
+@@ -316,6 +317,9 @@ static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
+ static void nf_nat_sip_expected(struct nf_conn *ct,
+ 				struct nf_conntrack_expect *exp)
+ {
++	struct nf_conn_help *help = nfct_help(ct->master);
++	struct nf_conntrack_expect *pair_exp;
++	int range_set_for_snat = 0;
+ 	struct nf_nat_range2 range;
+ 
+ 	/* This must be a fresh one. */
+@@ -327,15 +331,42 @@ static void nf_nat_sip_expected(struct nf_conn *ct,
+ 	range.min_addr = range.max_addr = exp->saved_addr;
+ 	nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
+ 
+-	/* Change src to where master sends to, but only if the connection
+-	 * actually came from the same source. */
+-	if (nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
++	/* Do media streams SRC manip according with the parameters
++	 * found in the paired expectation.
++	 */
++	if (exp->class != SIP_EXPECT_SIGNALLING) {
++		spin_lock_bh(&nf_conntrack_expect_lock);
++		hlist_for_each_entry(pair_exp, &help->expectations, lnode) {
++			if (pair_exp->tuple.src.l3num == nf_ct_l3num(ct) &&
++			    pair_exp->tuple.dst.protonum == ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum &&
++			    nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, &pair_exp->saved_addr) &&
++			    ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == pair_exp->saved_proto.all) {
++				range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
++				range.min_proto.all = range.max_proto.all = pair_exp->tuple.dst.u.all;
++				range.min_addr = range.max_addr = pair_exp->tuple.dst.u3;
++				range_set_for_snat = 1;
++				break;
++			}
++		}
++		spin_unlock_bh(&nf_conntrack_expect_lock);
++	}
++
++	/* When no paired expectation has been found, change src to
++	 * where master sends to, but only if the connection actually came
++	 * from the same source.
++	 */
++	if (!range_set_for_snat &&
++	    nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
+ 			     &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
+ 		range.flags = NF_NAT_RANGE_MAP_IPS;
+ 		range.min_addr = range.max_addr
+ 			= ct->master->tuplehash[!exp->dir].tuple.dst.u3;
+-		nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
++		range_set_for_snat = 1;
+ 	}
++
++	/* Perform SRC manip. */
++	if (range_set_for_snat)
++		nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
+ }
+ 
+ static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nf_tables-fix-a-missing-check-of-nla_put_f.patch b/queue-4.19/netfilter-nf_tables-fix-a-missing-check-of-nla_put_f.patch
new file mode 100644
index 00000000000..6aad0c0ec95
--- /dev/null
+++ b/queue-4.19/netfilter-nf_tables-fix-a-missing-check-of-nla_put_f.patch
@@ -0,0 +1,35 @@
+From 712bbf11e2aebabe8764bae47fa9c5412c0987e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:46:23 -0600
+Subject: netfilter: nf_tables: fix a missing check of nla_put_failure
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit eb8950861c1bfd3eecc8f6faad213e3bca0dc395 ]
+
+If nla_nest_start() may fail. The fix checks its return value and goes
+to nla_put_failure if it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 289d079008ee8..ec0f8b5bde0aa 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5737,6 +5737,8 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
+ 		goto nla_put_failure;
+ 
+ 	nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
++	if (!nest)
++		goto nla_put_failure;
+ 	if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
+ 	    nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
+ 		goto nla_put_failure;
+-- 
+2.20.1
+
diff --git a/queue-4.19/nvme-fix-kernel-paging-oops.patch b/queue-4.19/nvme-fix-kernel-paging-oops.patch
new file mode 100644
index 00000000000..4729e116659
--- /dev/null
+++ b/queue-4.19/nvme-fix-kernel-paging-oops.patch
@@ -0,0 +1,35 @@
+From 69af1f53d59fe9d42fb6d9093a2793a94950eb96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 12:34:07 -0800
+Subject: nvme: fix kernel paging oops
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 092ff0520070fad8407b196f3bb6156ce77a6f98 ]
+
+free the controller discard_page correctly.
+
+Fixes: cb5b7262b011 ("nvme: provide fallback for discard alloc failure")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 250ccf3108e98..c4ff4f079448e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3569,7 +3569,7 @@ static void nvme_free_ctrl(struct device *dev)
+ 	ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ 	kfree(ctrl->effects);
+ 	nvme_mpath_uninit(ctrl);
+-	kfree(ctrl->discard_page);
++	__free_page(ctrl->discard_page);
+ 
+ 	if (subsys) {
+ 		mutex_lock(&subsys->lock);
+-- 
+2.20.1
+
diff --git a/queue-4.19/nvme-provide-fallback-for-discard-alloc-failure.patch b/queue-4.19/nvme-provide-fallback-for-discard-alloc-failure.patch
new file mode 100644
index 00000000000..ad15f9ad781
--- /dev/null
+++ b/queue-4.19/nvme-provide-fallback-for-discard-alloc-failure.patch
@@ -0,0 +1,133 @@
+From bb4ead48deb7d079ff61459e4398b1933716f2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 09:18:11 -0700
+Subject: nvme: provide fallback for discard alloc failure
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit cb5b7262b011cfb793519bf97e54dff5282da23c ]
+
+When boxes are run near (or to) OOM, we have a problem with the discard
+page allocation in nvme. If we fail allocating the special page, we
+return busy, and it'll get retried. But since ordering is honored for
+dispatch requests, we can keep retrying this same IO and failing. Behind
+that IO could be requests that want to free memory, but they never get
+the chance.
+
+Allocate a fixed discard page per controller for a safe fallback, and use
+that if the initial allocation fails.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 41 ++++++++++++++++++++++++++++++++++------
+ drivers/nvme/host/nvme.h |  3 +++
+ 2 files changed, 38 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 44da9fe5b27b8..250ccf3108e98 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -551,9 +551,19 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ 	struct nvme_dsm_range *range;
+ 	struct bio *bio;
+ 
+-	range = kmalloc_array(segments, sizeof(*range), GFP_ATOMIC);
+-	if (!range)
+-		return BLK_STS_RESOURCE;
++	range = kmalloc_array(segments, sizeof(*range),
++				GFP_ATOMIC | __GFP_NOWARN);
++	if (!range) {
++		/*
++		 * If we fail allocation our range, fallback to the controller
++		 * discard page. If that's also busy, it's safe to return
++		 * busy, as we know we can make progress once that's freed.
++		 */
++		if (test_and_set_bit_lock(0, &ns->ctrl->discard_page_busy))
++			return BLK_STS_RESOURCE;
++
++		range = page_address(ns->ctrl->discard_page);
++	}
+ 
+ 	__rq_for_each_bio(bio, req) {
+ 		u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
+@@ -568,7 +578,10 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ 	}
+ 
+ 	if (WARN_ON_ONCE(n != segments)) {
+-		kfree(range);
++		if (virt_to_page(range) == ns->ctrl->discard_page)
++			clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
++		else
++			kfree(range);
+ 		return BLK_STS_IOERR;
+ 	}
+ 
+@@ -653,8 +666,13 @@ void nvme_cleanup_cmd(struct request *req)
+ 				blk_rq_bytes(req) >> ns->lba_shift);
+ 	}
+ 	if (req->rq_flags & RQF_SPECIAL_PAYLOAD) {
+-		kfree(page_address(req->special_vec.bv_page) +
+-		      req->special_vec.bv_offset);
++		struct nvme_ns *ns = req->rq_disk->private_data;
++		struct page *page = req->special_vec.bv_page;
++
++		if (page == ns->ctrl->discard_page)
++			clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
++		else
++			kfree(page_address(page) + req->special_vec.bv_offset);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);
+@@ -3551,6 +3569,7 @@ static void nvme_free_ctrl(struct device *dev)
+ 	ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ 	kfree(ctrl->effects);
+ 	nvme_mpath_uninit(ctrl);
++	kfree(ctrl->discard_page);
+ 
+ 	if (subsys) {
+ 		mutex_lock(&subsys->lock);
+@@ -3592,6 +3611,14 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+ 	memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+ 	ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
+ 
++	BUILD_BUG_ON(NVME_DSM_MAX_RANGES * sizeof(struct nvme_dsm_range) >
++			PAGE_SIZE);
++	ctrl->discard_page = alloc_page(GFP_KERNEL);
++	if (!ctrl->discard_page) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
+ 	ret = ida_simple_get(&nvme_instance_ida, 0, 0, GFP_KERNEL);
+ 	if (ret < 0)
+ 		goto out;
+@@ -3629,6 +3656,8 @@ out_free_name:
+ out_release_instance:
+ 	ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ out:
++	if (ctrl->discard_page)
++		__free_page(ctrl->discard_page);
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(nvme_init_ctrl);
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 2653e1f4196d5..cc4273f119894 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -238,6 +238,9 @@ struct nvme_ctrl {
+ 	u16 maxcmd;
+ 	int nr_reconnects;
+ 	struct nvmf_ctrl_options *opts;
++
++	struct page *discard_page;
++	unsigned long discard_page_busy;
+ };
+ 
+ struct nvme_subsystem {
+-- 
+2.20.1
+
diff --git a/queue-4.19/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch b/queue-4.19/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
new file mode 100644
index 00000000000..7d2d4bef0da
--- /dev/null
+++ b/queue-4.19/ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
@@ -0,0 +1,57 @@
+From 7ebd358cb418b77cf5fc225bd33ac7ea749e3b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:32:53 -0800
+Subject: ocfs2: clear journal dirty flag after shutdown journal
+
+From: Junxiao Bi <junxiao.bi@oracle.com>
+
+[ Upstream commit d85400af790dba2aa294f0a77e712f166681f977 ]
+
+Dirty flag of the journal should be cleared at the last stage of umount,
+if do it before jbd2_journal_destroy(), then some metadata in uncommitted
+transaction could be lost due to io error, but as dirty flag of journal
+was already cleared, we can't find that until run a full fsck.  This may
+cause system panic or other corruption.
+
+Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index babb0ec76d676..fc1f209e5db06 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ 			mlog_errno(status);
+ 	}
+ 
+-	if (status == 0) {
++	/* Shutdown the kernel journal system */
++	if (!jbd2_journal_destroy(journal->j_journal) && !status) {
+ 		/*
+ 		 * Do not toggle if flush was unsuccessful otherwise
+ 		 * will leave dirty metadata in a "clean" journal
+@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ 		if (status < 0)
+ 			mlog_errno(status);
+ 	}
+-
+-	/* Shutdown the kernel journal system */
+-	jbd2_journal_destroy(journal->j_journal);
+ 	journal->j_journal = NULL;
+ 
+ 	OCFS2_I(inode)->ip_open_count--;
+-- 
+2.20.1
+
diff --git a/queue-4.19/openrisc-fix-broken-paths-to-arch-or32.patch b/queue-4.19/openrisc-fix-broken-paths-to-arch-or32.patch
new file mode 100644
index 00000000000..cd0b918b413
--- /dev/null
+++ b/queue-4.19/openrisc-fix-broken-paths-to-arch-or32.patch
@@ -0,0 +1,49 @@
+From 0cddd1f0a84821cc921a8f5b6d5162b2197dd969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:20:47 +0100
+Subject: openrisc: Fix broken paths to arch/or32
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff ]
+
+OpenRISC was mainlined as "openrisc", not "or32".
+vmlinux.lds is generated from vmlinux.lds.S.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 2 +-
+ arch/openrisc/kernel/head.S  | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 0c826ad6e994c..ee6159d2ed22e 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -240,7 +240,7 @@ handler:							;\
+  *	 occured. in fact they never do. if you need them use
+  *	 values saved on stack (for SPR_EPC, SPR_ESR) or content
+  *       of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
+- *       in 'arch/or32/kernel/head.S'
++ *       in 'arch/openrisc/kernel/head.S'
+  */
+ 
+ /* =====================================================[ exceptions] === */
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index 9fc6b60140f00..31ed257ff0618 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -1728,7 +1728,7 @@ _string_nl:
+ 
+ /*
+  * .data section should be page aligned
+- *	(look into arch/or32/kernel/vmlinux.lds)
++ *	(look into arch/openrisc/kernel/vmlinux.lds.S)
+  */
+ 	.section .data,"aw"
+ 	.align	8192
+-- 
+2.20.1
+
diff --git a/queue-4.19/parisc-fix-hp-sdc-hpa-address-output.patch b/queue-4.19/parisc-fix-hp-sdc-hpa-address-output.patch
new file mode 100644
index 00000000000..e6ef5ed4a8a
--- /dev/null
+++ b/queue-4.19/parisc-fix-hp-sdc-hpa-address-output.patch
@@ -0,0 +1,36 @@
+From 681b9c6ec593cc1901555b3fbef9f02a2a17344b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:06:34 +0100
+Subject: parisc: Fix HP SDC hpa address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit c4bff35ca1bfba886da6223c9fed76a2b1382b8e ]
+
+Show the hpa address of the HP SDC instead of a hashed value, e.g.:
+HP SDC: HP SDC at 0xf0201000, IRQ 23 (NMI IRQ 24)
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/hp_sdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
+index 0b8a25c58d02e..654252361653d 100644
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -884,8 +884,8 @@ static int __init hp_sdc_init(void)
+ 			"HP SDC NMI", &hp_sdc))
+ 		goto err2;
+ 
+-	printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n",
+-	       (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
++	pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n",
++	       hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
+ 
+ 	hp_sdc_status_in8();
+ 	hp_sdc_data_in8();
+-- 
+2.20.1
+
diff --git a/queue-4.19/parisc-fix-serio-address-output.patch b/queue-4.19/parisc-fix-serio-address-output.patch
new file mode 100644
index 00000000000..57ddb62dc61
--- /dev/null
+++ b/queue-4.19/parisc-fix-serio-address-output.patch
@@ -0,0 +1,40 @@
+From a515fef7320a72ad52ed0288e6953982ad4e898b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:09:59 +0100
+Subject: parisc: Fix serio address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 785145171d17af2554128becd6a7c8f89e101141 ]
+
+We want the hpa addresses printed in the serio modules, not some
+virtual ioremap()ed address, e.g.:
+
+ serio: gsc-ps2-keyboard port at 0xf0108000 irq 22 @ 2:0:11
+ serio: gsc-ps2-mouse port at 0xf0108100 irq 22 @ 2:0:12
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/gscps2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index 49d8d53e50b7b..96f9b5397367f 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -381,9 +381,9 @@ static int __init gscps2_probe(struct parisc_device *dev)
+ 		goto fail;
+ #endif
+ 
+-	printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n",
++	pr_info("serio: %s port at 0x%08lx irq %d @ %s\n",
+ 		ps2port->port->name,
+-		ps2port->addr,
++		hpa,
+ 		ps2port->padev->irq,
+ 		ps2port->port->phys);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch b/queue-4.19/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch
new file mode 100644
index 00000000000..acd96c5b2bc
--- /dev/null
+++ b/queue-4.19/pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch
@@ -0,0 +1,97 @@
+From 6c3232ba9ff0fe46aa228a90c27bdcc9cfc7748d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jan 2019 17:31:29 -0600
+Subject: PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 77f88abd4a6f73a1a68dbdc0e3f21575fd508fc3 ]
+
+The API of pci_alloc_irq_vectors_affinity() says it returns -ENOSPC if
+fewer than @min_vecs interrupt vectors are available for @dev.
+
+However, if a device supports MSI-X but not MSI and a caller requests
+@min_vecs that can't be satisfied by MSI-X, we previously returned -EINVAL
+(from the failed attempt to enable MSI), not -ENOSPC.
+
+When -ENOSPC is returned, callers may reduce the number IRQs they request
+and try again.  Most callers can use the @min_vecs and @max_vecs
+parameters to avoid this retry loop, but that doesn't work when using IRQ
+affinity "nr_sets" because rebalancing the sets is driver-specific.
+
+This return value bug has been present since pci_alloc_irq_vectors() was
+added in v4.10 by aff171641d18 ("PCI: Provide sensible IRQ vector
+alloc/free routines"), but it wasn't an issue because @min_vecs/@max_vecs
+removed the need for callers to iteratively reduce the number of IRQs
+requested and retry the allocation, so they didn't need to distinguish
+-ENOSPC from -EINVAL.
+
+In v5.0, 6da4b3ab9a6e ("genirq/affinity: Add support for allocating
+interrupt sets") added IRQ sets to the interface, which reintroduced the
+need to check for -ENOSPC and possibly reduce the number of IRQs requested
+and retry the allocation.
+
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Jens Axboe <axboe@fb.com>
+Cc: Keith Busch <keith.busch@intel.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index af24ed50a2452..971dddf62374f 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -1155,7 +1155,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ 				   const struct irq_affinity *affd)
+ {
+ 	static const struct irq_affinity msi_default_affd;
+-	int vecs = -ENOSPC;
++	int msix_vecs = -ENOSPC;
++	int msi_vecs = -ENOSPC;
+ 
+ 	if (flags & PCI_IRQ_AFFINITY) {
+ 		if (!affd)
+@@ -1166,16 +1167,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ 	}
+ 
+ 	if (flags & PCI_IRQ_MSIX) {
+-		vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+-				affd);
+-		if (vecs > 0)
+-			return vecs;
++		msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs,
++						    max_vecs, affd);
++		if (msix_vecs > 0)
++			return msix_vecs;
+ 	}
+ 
+ 	if (flags & PCI_IRQ_MSI) {
+-		vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd);
+-		if (vecs > 0)
+-			return vecs;
++		msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs,
++						  affd);
++		if (msi_vecs > 0)
++			return msi_vecs;
+ 	}
+ 
+ 	/* use legacy irq if allowed */
+@@ -1186,7 +1188,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ 		}
+ 	}
+ 
+-	return vecs;
++	if (msix_vecs == -ENOSPC)
++		return -ENOSPC;
++	return msi_vecs;
+ }
+ EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-cherryview-allocate-irq-chip-dynamic.patch b/queue-4.19/pinctrl-cherryview-allocate-irq-chip-dynamic.patch
new file mode 100644
index 00000000000..e24a60dd6f2
--- /dev/null
+++ b/queue-4.19/pinctrl-cherryview-allocate-irq-chip-dynamic.patch
@@ -0,0 +1,96 @@
+From bdcc5bb6466c51deca858b1e086002fdee1941aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 16:34:41 +0300
+Subject: pinctrl: cherryview: Allocate IRQ chip dynamic
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 67d33aecd030226f0a577eb683aaa6853ecf8f91 ]
+
+Keeping the IRQ chip definition static shares it with multiple instances
+of the GPIO chip in the system. This is bad and now we get this warning
+from GPIO library:
+
+"detected irqchip that is shared with multiple gpiochips: please fix the driver."
+
+Hence, move the IRQ chip definition from being driver static into the struct
+intel_pinctrl. So a unique IRQ chip is used for each GPIO chip instance.
+
+This patch is heavily based on the attachment to the bug by Christoph Marz.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=202543
+Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support")
+Depends-on: 83b9dc11312f ("pinctrl: cherryview: Associate IRQ descriptors to irqdomain")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 24 +++++++++++-----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 9eab508395814..f16baf9b86962 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -157,6 +157,7 @@ struct chv_pin_context {
+  * @pctldesc: Pin controller description
+  * @pctldev: Pointer to the pin controller device
+  * @chip: GPIO chip in this pin controller
++ * @irqchip: IRQ chip in this pin controller
+  * @regs: MMIO registers
+  * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
+  *		offset (in GPIO number space)
+@@ -170,6 +171,7 @@ struct chv_pinctrl {
+ 	struct pinctrl_desc pctldesc;
+ 	struct pinctrl_dev *pctldev;
+ 	struct gpio_chip chip;
++	struct irq_chip irqchip;
+ 	void __iomem *regs;
+ 	unsigned intr_lines[16];
+ 	const struct chv_community *community;
+@@ -1477,16 +1479,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
+ 	return 0;
+ }
+ 
+-static struct irq_chip chv_gpio_irqchip = {
+-	.name = "chv-gpio",
+-	.irq_startup = chv_gpio_irq_startup,
+-	.irq_ack = chv_gpio_irq_ack,
+-	.irq_mask = chv_gpio_irq_mask,
+-	.irq_unmask = chv_gpio_irq_unmask,
+-	.irq_set_type = chv_gpio_irq_type,
+-	.flags = IRQCHIP_SKIP_SET_WAKE,
+-};
+-
+ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ {
+ 	struct gpio_chip *gc = irq_desc_get_handler_data(desc);
+@@ -1626,7 +1618,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ 		}
+ 	}
+ 
+-	ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
++	pctrl->irqchip.name = "chv-gpio";
++	pctrl->irqchip.irq_startup = chv_gpio_irq_startup;
++	pctrl->irqchip.irq_ack = chv_gpio_irq_ack;
++	pctrl->irqchip.irq_mask = chv_gpio_irq_mask;
++	pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask;
++	pctrl->irqchip.irq_set_type = chv_gpio_irq_type;
++	pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE;
++
++	ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0,
+ 				   handle_bad_irq, IRQ_TYPE_NONE);
+ 	if (ret) {
+ 		dev_err(pctrl->dev, "failed to add IRQ chip\n");
+@@ -1643,7 +1643,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ 		}
+ 	}
+ 
+-	gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
++	gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq,
+ 				     chv_gpio_irq_handler);
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a77990-fix-mod_sel0-sel_i2c1-field-.patch b/queue-4.19/pinctrl-sh-pfc-r8a77990-fix-mod_sel0-sel_i2c1-field-.patch
new file mode 100644
index 00000000000..c730355c5e2
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a77990-fix-mod_sel0-sel_i2c1-field-.patch
@@ -0,0 +1,43 @@
+From 5317d8b2ed09e72f7e6fb19e71cdb151ca37313e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 10:53:11 +0100
+Subject: pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 755a5b805fa7ff22e2934d67501efd92109f41ea ]
+
+The SEL_I2C1 (MOD_SEL0[21:20]) field in Module Select Register 0 has a
+width of 2 bits, i.e. it allows programming one out of 4 different
+configurations.
+However, the MOD_SEL0_21_20 macro contains 8 values instead of 4,
+overflowing into the subsequent fields in the register, and thus breaking
+the configuration of the latter.
+
+Fix this by dropping the bogus last 4 values, including the non-existent
+SEL_I2C1_4 configuration.
+
+Fixes: 6d4036a1e3b3ac0f ("pinctrl: sh-pfc: Initial R8A77990 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+index b81c807ac54d5..d2fcf7f7b9668 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+@@ -395,7 +395,7 @@ FM(IP12_31_28)	IP12_31_28	FM(IP13_31_28)	IP13_31_28	FM(IP14_31_28)	IP14_31_28	FM
+ #define MOD_SEL0_24		FM(SEL_HSCIF0_0)		FM(SEL_HSCIF0_1)
+ #define MOD_SEL0_23		FM(SEL_HSCIF1_0)		FM(SEL_HSCIF1_1)
+ #define MOD_SEL0_22		FM(SEL_HSCIF2_0)		FM(SEL_HSCIF2_1)
+-#define MOD_SEL0_21_20		FM(SEL_I2C1_0)			FM(SEL_I2C1_1)			FM(SEL_I2C1_2)			FM(SEL_I2C1_3)		FM(SEL_I2C1_4)		F_(0, 0)	F_(0, 0)	F_(0, 0)
++#define MOD_SEL0_21_20		FM(SEL_I2C1_0)			FM(SEL_I2C1_1)			FM(SEL_I2C1_2)			FM(SEL_I2C1_3)
+ #define MOD_SEL0_19_18_17	FM(SEL_I2C2_0)			FM(SEL_I2C2_1)			FM(SEL_I2C2_2)			FM(SEL_I2C2_3)		FM(SEL_I2C2_4)		F_(0, 0)	F_(0, 0)	F_(0, 0)
+ #define MOD_SEL0_16		FM(SEL_NDFC_0)			FM(SEL_NDFC_1)
+ #define MOD_SEL0_15		FM(SEL_PWM0_0)			FM(SEL_PWM0_1)
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch b/queue-4.19/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
new file mode 100644
index 00000000000..4e390813980
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
@@ -0,0 +1,57 @@
+From 9174901b74b52b744f6155519d5cb309029ec7dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:09:56 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d ]
+
+The Port F Control Register 3 (PFCR3) contains only a single field.
+However, counting from left to right, it is the fourth field, not the
+first field.
+Insert the missing dummy configuration values (3 fields of 16 values) to
+fix this.
+
+The descriptor for the Port F Control Register 0 (PFCR0) lacks the
+description for the 4th field (PF0 Mode, PF0MD[2:0]).
+Add the missing configuration values to fix this.
+
+Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 8070765311dbf..e1c34e19222ee 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 	},
+ 
+ 	{ PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
++		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 		PF12MD_000, PF12MD_001, 0, PF12MD_011,
+ 		PF12MD_100, PF12MD_101, 0, 0,
+ 		0, 0, 0, 0, 0, 0, 0, 0 }
+@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		0, 0, 0, 0, 0, 0, 0, 0,
+ 		PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
+ 		PF1MD_100, PF1MD_101, 0, 0,
+-		0, 0, 0, 0, 0, 0, 0, 0
+-	 }
++		0, 0, 0, 0, 0, 0, 0, 0,
++		PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
++		PF0MD_100, PF0MD_101, 0, 0,
++		0, 0, 0, 0, 0, 0, 0, 0 }
+ 	},
+ 
+ 	{ PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch b/queue-4.19/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
new file mode 100644
index 00000000000..bb7416feffc
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
@@ -0,0 +1,62 @@
+From 7f491b2237291efb8eace46cdef426f14d0af862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:41:11 +0100
+Subject: pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 054f2400f706327f96770219c3065b5131f8f154 ]
+
+Some values in the Peripheral Function Select Register 10 descriptor are
+shifted by one position, which may cause a peripheral function to be
+programmed incorrectly.
+
+Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was
+already the case for the HSCK0 pin in field IP10[5:3].
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 6502e676d3686..33232041ee86d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 	    /* IP10_22 [1] */
+ 		FN_CAN_CLK_A, FN_RX4_D,
+ 	    /* IP10_21_19 [3] */
+-		FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
+-		FN_LCD_M_DISP_B, 0, 0, 0,
++		FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
++		FN_LCD_M_DISP_B, 0, 0,
+ 	    /* IP10_18_16 [3] */
+-		FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
+-		FN_LCD_VEPWC_B, 0, 0, 0,
++		FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
++		FN_LCD_VEPWC_B, 0, 0,
+ 	    /* IP10_15 [1] */
+ 		FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
+ 	    /* IP10_14_12 [3] */
+ 		FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
+ 		FN_LCD_FLM_B, 0, 0, 0,
+ 	    /* IP10_11_9 [3] */
+-		FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
+-		FN_LCD_CL2_B, 0, 0, 0,
++		FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
++		FN_LCD_CL2_B, 0, 0,
+ 	    /* IP10_8_6 [3] */
+-		FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
+-		FN_LCD_CL1_B, 0, 0, 0,
++		FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
++		FN_LCD_CL1_B, 0, 0,
+ 	    /* IP10_5_3 [3] */
+ 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+ 		FN_LCD_DON_B, 0, 0, 0,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch b/queue-4.19/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
new file mode 100644
index 00000000000..62d78f443af
--- /dev/null
+++ b/queue-4.19/pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
@@ -0,0 +1,89 @@
+From 1f772932eb41d00e0656ce4d1c5b66a67ee314ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 08:48:25 +0100
+Subject: pinctrl: xway: fix gpio-hog related boot issues
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 9b4924da4711674e62d97d4f5360446cc78337af ]
+
+This patch is based on commit a86caa9ba5d7 ("pinctrl: msm: fix gpio-hog
+related boot issues").
+
+It fixes the issue that the gpio ranges needs to be defined before
+gpiochip_add().
+
+Therefore, we also have to swap the order of registering the pinctrl
+driver and registering the gpio chip.
+
+You also have to add the "gpio-ranges" property to the pinctrl device
+node to get it finally working.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Acked-by: John Crispin <john@phrozen.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-xway.c | 39 +++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index 93f8bd04e7fe6..ae74b260b014b 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -1746,14 +1746,6 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ 	}
+ 	xway_pctrl_desc.pins = xway_info.pads;
+ 
+-	/* register the gpio chip */
+-	xway_chip.parent = &pdev->dev;
+-	ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
+-	if (ret) {
+-		dev_err(&pdev->dev, "Failed to register gpio chip\n");
+-		return ret;
+-	}
+-
+ 	/* setup the data needed by pinctrl */
+ 	xway_pctrl_desc.name	= dev_name(&pdev->dev);
+ 	xway_pctrl_desc.npins	= xway_chip.ngpio;
+@@ -1775,10 +1767,33 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	/* finish with registering the gpio range in pinctrl */
+-	xway_gpio_range.npins = xway_chip.ngpio;
+-	xway_gpio_range.base = xway_chip.base;
+-	pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++	/* register the gpio chip */
++	xway_chip.parent = &pdev->dev;
++	xway_chip.owner = THIS_MODULE;
++	xway_chip.of_node = pdev->dev.of_node;
++	ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
++	if (ret) {
++		dev_err(&pdev->dev, "Failed to register gpio chip\n");
++		return ret;
++	}
++
++	/*
++	 * For DeviceTree-supported systems, the gpio core checks the
++	 * pinctrl's device node for the "gpio-ranges" property.
++	 * If it is present, it takes care of adding the pin ranges
++	 * for the driver. In this case the driver can skip ahead.
++	 *
++	 * In order to remain compatible with older, existing DeviceTree
++	 * files which don't set the "gpio-ranges" property or systems that
++	 * utilize ACPI the driver has to call gpiochip_add_pin_range().
++	 */
++	if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) {
++		/* finish with registering the gpio range in pinctrl */
++		xway_gpio_range.npins = xway_chip.ngpio;
++		xway_gpio_range.base = xway_chip.base;
++		pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++	}
++
+ 	dev_info(&pdev->dev, "Init done\n");
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/platform-x86-mlx-platform-fix-led-configuration.patch b/queue-4.19/platform-x86-mlx-platform-fix-led-configuration.patch
new file mode 100644
index 00000000000..ebb95559ca4
--- /dev/null
+++ b/queue-4.19/platform-x86-mlx-platform-fix-led-configuration.patch
@@ -0,0 +1,50 @@
+From c70829ff595a1f60d9525e6c56600cb1ea790702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 17:26:57 +0000
+Subject: platform/x86: mlx-platform: Fix LED configuration
+
+From: Vadim Pasternak <vadimp@mellanox.com>
+
+[ Upstream commit 440f343df1996302d9a3904647ff11b689bf27bc ]
+
+Exchange LED configuration between msn201x and next generation systems
+types.
+
+Bug was introduced when LED driver activation was added to mlx-platform.
+LED configuration for the three new system MQMB7, MSN37, MSN34 was
+assigned to MSN21 and vice versa. This bug affects MSN21 only and
+likely requires backport to v4.19.
+
+Fixes: 1189456b1cce ("platform/x86: mlx-platform: Add LED platform driver activation")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index d17db140cb1fc..69e28c12d5915 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -1421,7 +1421,7 @@ static int __init mlxplat_dmi_msn201x_matched(const struct dmi_system_id *dmi)
+ 	mlxplat_hotplug = &mlxplat_mlxcpld_msn201x_data;
+ 	mlxplat_hotplug->deferred_nr =
+ 		mlxplat_default_channels[i - 1][MLXPLAT_CPLD_GRP_CHNL_NUM - 1];
+-	mlxplat_led = &mlxplat_default_ng_led_data;
++	mlxplat_led = &mlxplat_msn21xx_led_data;
+ 	mlxplat_regs_io = &mlxplat_msn21xx_regs_io_data;
+ 
+ 	return 1;
+@@ -1439,7 +1439,7 @@ static int __init mlxplat_dmi_qmb7xx_matched(const struct dmi_system_id *dmi)
+ 	mlxplat_hotplug = &mlxplat_mlxcpld_default_ng_data;
+ 	mlxplat_hotplug->deferred_nr =
+ 		mlxplat_msn21xx_channels[MLXPLAT_CPLD_GRP_CHNL_NUM - 1];
+-	mlxplat_led = &mlxplat_msn21xx_led_data;
++	mlxplat_led = &mlxplat_default_ng_led_data;
+ 	mlxplat_fan = &mlxplat_default_fan_data;
+ 
+ 	return 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch b/queue-4.19/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
new file mode 100644
index 00000000000..dce01573f70
--- /dev/null
+++ b/queue-4.19/pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
@@ -0,0 +1,37 @@
+From 1ab6add9819546c3732824a24ebd05f91ebd81bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 21:52:11 +0100
+Subject: PM / AVS: SmartReflex: NULL check before some freeing functions is
+ not needed
+
+From: Thomas Meyer <thomas@m3y3r.de>
+
+[ Upstream commit 14d338a857f05f894ba3badd9e6d3039c68b8180 ]
+
+NULL check before some freeing functions is not needed.
+
+Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/avs/smartreflex.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index 1360a7fa542c5..8760477d0e8af 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -1010,8 +1010,7 @@ static int omap_sr_remove(struct platform_device *pdev)
+ 
+ 	if (sr_info->autocomp_active)
+ 		sr_stop_vddautocomp(sr_info);
+-	if (sr_info->dbg_dir)
+-		debugfs_remove_recursive(sr_info->dbg_dir);
++	debugfs_remove_recursive(sr_info->dbg_dir);
+ 
+ 	pm_runtime_disable(&pdev->dev);
+ 	list_del(&sr_info->node);
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-32-avoid-unsupported-flags-with-clang.patch b/queue-4.19/powerpc-32-avoid-unsupported-flags-with-clang.patch
new file mode 100644
index 00000000000..5dcd584f05b
--- /dev/null
+++ b/queue-4.19/powerpc-32-avoid-unsupported-flags-with-clang.patch
@@ -0,0 +1,85 @@
+From 1148dc5331b461df1ea331b4894a91eb26d12dc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 15:58:06 +1030
+Subject: powerpc/32: Avoid unsupported flags with clang
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 72e7bcc2cdf82bf03caaa5e6c9b0134c2fc2ee7d ]
+
+When building for ppc32 with clang these flags are unsupported:
+
+  -ffixed-r2 and -mmultiple
+
+llvm's lib/Target/PowerPC/PPCRegisterInfo.cpp marks r2 as reserved on
+when building for SVR4ABI and !ppc64:
+
+  // The SVR4 ABI reserves r2 and r13
+  if (Subtarget.isSVR4ABI()) {
+    // We only reserve r2 if we need to use the TOC pointer. If we have no
+    // explicit uses of the TOC pointer (meaning we're a leaf function with
+    // no constant-pool loads, etc.) and we have no potential uses inside an
+    // inline asm block, then we can treat r2 has an ordinary callee-saved
+    // register.
+    const PPCFunctionInfo *FuncInfo = MF.getInfo<PPCFunctionInfo>();
+    if (!TM.isPPC64() || FuncInfo->usesTOCBasePtr() || MF.hasInlineAsm())
+      markSuperRegs(Reserved, PPC::R2);  // System-reserved register
+    markSuperRegs(Reserved, PPC::R13); // Small Data Area pointer register
+  }
+
+This means we can safely omit -ffixed-r2 when building for 32-bit
+targets.
+
+The -mmultiple/-mno-multiple flags are not supported by clang, so
+platforms that might support multiple miss out on using multiple word
+instructions.
+
+We wrap these flags in cc-option so that when Clang gains support the
+kernel will be able use these flags.
+
+Clang 8 can then build a ppc44x_defconfig which boots in Qemu:
+
+  make CC=clang-8 ARCH=powerpc CROSS_COMPILE=powerpc-linux-gnu-  ppc44x_defconfig
+  ./scripts/config -e CONFIG_DEVTMPFS -d DEVTMPFS_MOUNT
+  make CC=clang-8 ARCH=powerpc CROSS_COMPILE=powerpc-linux-gnu-
+
+  qemu-system-ppc -M bamboo \
+   -kernel arch/powerpc/boot/zImage \
+   -dtb arch/powerpc/boot/dts/bamboo.dtb \
+   -initrd ~/ppc32-440-rootfs.cpio \
+   -nographic -serial stdio -monitor pty -append "console=ttyS0"
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/261
+Link: https://bugs.llvm.org/show_bug.cgi?id=39556
+Link: https://bugs.llvm.org/show_bug.cgi?id=39555
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index c4c03992ee828..dfcb698ec8f3b 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -145,7 +145,14 @@ endif
+ CFLAGS-$(CONFIG_PPC64)	+= $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
+ CFLAGS-$(CONFIG_PPC64)	+= $(call cc-option,-mno-pointers-to-nested-functions)
+ 
+-CFLAGS-$(CONFIG_PPC32)	:= -ffixed-r2 $(MULTIPLEWORD)
++# Clang unconditionally reserves r2 on ppc32 and does not support the flag
++# https://bugs.llvm.org/show_bug.cgi?id=39555
++CFLAGS-$(CONFIG_PPC32)	:= $(call cc-option, -ffixed-r2)
++
++# Clang doesn't support -mmultiple / -mno-multiple
++# https://bugs.llvm.org/show_bug.cgi?id=39556
++CFLAGS-$(CONFIG_PPC32)	+= $(call cc-option, $(MULTIPLEWORD))
++
+ CFLAGS-$(CONFIG_PPC32)	+= $(call cc-option,-mno-readonly-in-sdata)
+ 
+ ifdef CONFIG_PPC_BOOK3S_64
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-44x-bamboo-fix-pci-range.patch b/queue-4.19/powerpc-44x-bamboo-fix-pci-range.patch
new file mode 100644
index 00000000000..57e55042cac
--- /dev/null
+++ b/queue-4.19/powerpc-44x-bamboo-fix-pci-range.patch
@@ -0,0 +1,44 @@
+From 036e85e694f91fc643bd48a49bea7bd3eed182a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:27:33 +1100
+Subject: powerpc/44x/bamboo: Fix PCI range
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 ]
+
+The bamboo dts has a bug: it uses a non-naturally aligned range
+for PCI memory space. This isnt' supported by the code, thus
+causing PCI to break on this system.
+
+This is due to the fact that while the chip memory map has 1G
+reserved for PCI memory, it's only 512M aligned. The code doesn't
+know how to split that into 2 different PMMs and fails, so limit
+the region to 512M.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/bamboo.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts
+index 538e42b1120d8..b5861fa3836c1 100644
+--- a/arch/powerpc/boot/dts/bamboo.dts
++++ b/arch/powerpc/boot/dts/bamboo.dts
+@@ -268,8 +268,10 @@
+ 			/* Outbound ranges, one memory and one IO,
+ 			 * later cannot be changed. Chip supports a second
+ 			 * IO range but we don't use it for now
++			 * The chip also supports a larger memory range but
++			 * it's not naturally aligned, so our code will break
+ 			 */
+-			ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000
++			ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000
+ 				  0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000
+ 				  0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch b/queue-4.19/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
new file mode 100644
index 00000000000..99690b34009
--- /dev/null
+++ b/queue-4.19/powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
@@ -0,0 +1,142 @@
+From baa07d8bc754517270e37131c824c75e54b958e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:41:29 +0000
+Subject: powerpc/83xx: handle machine check caused by watchdog timer
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 0deae39cec6dab3a66794f3e9e83ca4dc30080f1 ]
+
+When the watchdog timer is set in interrupt mode, it causes a
+machine check when it times out. The purpose of this mode is to
+ease debugging, not to crash the kernel and reboot the machine.
+
+This patch implements a special handling for that, in order to not
+crash the kernel if the watchdog times out while in interrupt or
+within the idle task.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[scottwood: added missing #include]
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/cputable.h |  1 +
+ arch/powerpc/include/asm/reg.h      |  2 ++
+ arch/powerpc/kernel/cputable.c      | 10 ++++++----
+ arch/powerpc/platforms/83xx/misc.c  | 17 +++++++++++++++++
+ 4 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 3ce690e5f345c..59b35b93eadec 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -44,6 +44,7 @@ extern int machine_check_e500(struct pt_regs *regs);
+ extern int machine_check_e200(struct pt_regs *regs);
+ extern int machine_check_47x(struct pt_regs *regs);
+ int machine_check_8xx(struct pt_regs *regs);
++int machine_check_83xx(struct pt_regs *regs);
+ 
+ extern void cpu_down_flush_e500v2(void);
+ extern void cpu_down_flush_e500mc(void);
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 640a4d818772a..af99716615122 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -768,6 +768,8 @@
+ #define   SRR1_PROGTRAP		0x00020000 /* Trap */
+ #define   SRR1_PROGADDR		0x00010000 /* SRR0 contains subsequent addr */
+ 
++#define   SRR1_MCE_MCP		0x00080000 /* Machine check signal caused interrupt */
++
+ #define SPRN_HSRR0	0x13A	/* Save/Restore Register 0 */
+ #define SPRN_HSRR1	0x13B	/* Save/Restore Register 1 */
+ #define   HSRR1_DENORM		0x00100000 /* Denorm exception */
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index 2da01340c84c3..1eab54bc6ee93 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -1141,6 +1141,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ 		.machine_check		= machine_check_generic,
+ 		.platform		= "ppc603",
+ 	},
++#ifdef CONFIG_PPC_83xx
+ 	{	/* e300c1 (a 603e core, plus some) on 83xx */
+ 		.pvr_mask		= 0x7fff0000,
+ 		.pvr_value		= 0x00830000,
+@@ -1151,7 +1152,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ 		.icache_bsize		= 32,
+ 		.dcache_bsize		= 32,
+ 		.cpu_setup		= __setup_cpu_603,
+-		.machine_check		= machine_check_generic,
++		.machine_check		= machine_check_83xx,
+ 		.platform		= "ppc603",
+ 	},
+ 	{	/* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */
+@@ -1165,7 +1166,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ 		.icache_bsize		= 32,
+ 		.dcache_bsize		= 32,
+ 		.cpu_setup		= __setup_cpu_603,
+-		.machine_check		= machine_check_generic,
++		.machine_check		= machine_check_83xx,
+ 		.platform		= "ppc603",
+ 	},
+ 	{	/* e300c3 (e300c1, plus one IU, half cache size) on 83xx */
+@@ -1179,7 +1180,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ 		.icache_bsize		= 32,
+ 		.dcache_bsize		= 32,
+ 		.cpu_setup		= __setup_cpu_603,
+-		.machine_check		= machine_check_generic,
++		.machine_check		= machine_check_83xx,
+ 		.num_pmcs		= 4,
+ 		.oprofile_cpu_type	= "ppc/e300",
+ 		.oprofile_type		= PPC_OPROFILE_FSL_EMB,
+@@ -1196,12 +1197,13 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ 		.icache_bsize		= 32,
+ 		.dcache_bsize		= 32,
+ 		.cpu_setup		= __setup_cpu_603,
+-		.machine_check		= machine_check_generic,
++		.machine_check		= machine_check_83xx,
+ 		.num_pmcs		= 4,
+ 		.oprofile_cpu_type	= "ppc/e300",
+ 		.oprofile_type		= PPC_OPROFILE_FSL_EMB,
+ 		.platform		= "ppc603",
+ 	},
++#endif
+ 	{	/* default match, we assume split I/D cache & TB (non-601)... */
+ 		.pvr_mask		= 0x00000000,
+ 		.pvr_value		= 0x00000000,
+diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c
+index d75c9816a5c92..2b6589fe812dd 100644
+--- a/arch/powerpc/platforms/83xx/misc.c
++++ b/arch/powerpc/platforms/83xx/misc.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/pci.h>
+ 
++#include <asm/debug.h>
+ #include <asm/io.h>
+ #include <asm/hw_irq.h>
+ #include <asm/ipic.h>
+@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void)
+ 
+ 	mpc83xx_setup_pci();
+ }
++
++int machine_check_83xx(struct pt_regs *regs)
++{
++	u32 mask = 1 << (31 - IPIC_MCP_WDT);
++
++	if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask))
++		return machine_check_generic(regs);
++	ipic_clear_mcp_status(mask);
++
++	if (debugger_fault_handler(regs))
++		return 1;
++
++	die("Watchdog NMI Reset", regs, 0);
++
++	return 1;
++}
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch b/queue-4.19/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
new file mode 100644
index 00000000000..7c7c2d9a486
--- /dev/null
+++ b/queue-4.19/powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
@@ -0,0 +1,44 @@
+From 0f2d7c67fb5bca83e8bdc45931d6cb72c6132e65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:27:42 +0000
+Subject: powerpc/book3s/32: fix number of bats in p/v_block_mapped()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e93ba1b7eb5b188c749052df7af1c90821c5f320 ]
+
+This patch fixes the loop in p_block_mapped() and v_block_mapped()
+to scan the entire bat_addrs[] array.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/ppc_mmu_32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c
+index bea6c544e38f9..06783270a1242 100644
+--- a/arch/powerpc/mm/ppc_mmu_32.c
++++ b/arch/powerpc/mm/ppc_mmu_32.c
+@@ -52,7 +52,7 @@ struct batrange {		/* stores address ranges mapped by BATs */
+ phys_addr_t v_block_mapped(unsigned long va)
+ {
+ 	int b;
+-	for (b = 0; b < 4; ++b)
++	for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ 		if (va >= bat_addrs[b].start && va < bat_addrs[b].limit)
+ 			return bat_addrs[b].phys + (va - bat_addrs[b].start);
+ 	return 0;
+@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va)
+ unsigned long p_block_mapped(phys_addr_t pa)
+ {
+ 	int b;
+-	for (b = 0; b < 4; ++b)
++	for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ 		if (pa >= bat_addrs[b].phys
+ 	    	    && pa < (bat_addrs[b].limit-bat_addrs[b].start)
+ 		              +bat_addrs[b].phys)
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-bpf-fix-tail-call-implementation.patch b/queue-4.19/powerpc-bpf-fix-tail-call-implementation.patch
new file mode 100644
index 00000000000..fe0ca5b87f9
--- /dev/null
+++ b/queue-4.19/powerpc-bpf-fix-tail-call-implementation.patch
@@ -0,0 +1,78 @@
+From 9ba25b3b6b147967e15d9df47f7eb757e56aed75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 20:34:44 -0700
+Subject: powerpc/bpf: Fix tail call implementation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7de086909365cd60a5619a45af3f4152516fd75c ]
+
+We have seen many crashes on powerpc hosts while loading bpf programs.
+
+The problem here is that bpf_int_jit_compile() does a first pass
+to compute the program length.
+
+Then it allocates memory to store the generated program and
+calls bpf_jit_build_body() a second time (and a third time
+later)
+
+What I have observed is that the second bpf_jit_build_body()
+could end up using few more words than expected.
+
+If bpf_jit_binary_alloc() put the space for the program
+at the end of the allocated page, we then write on
+a non mapped memory.
+
+It appears that bpf_jit_emit_tail_call() calls
+bpf_jit_emit_common_epilogue() while ctx->seen might not
+be stable.
+
+Only after the second pass we can be sure ctx->seen wont be changed.
+
+Trying to avoid a second pass seems quite complex and probably
+not worth it.
+
+Fixes: ce0761419faef ("powerpc/bpf: Implement support for tail calls")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+Cc: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20191101033444.143741-1-edumazet@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/net/bpf_jit_comp64.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 279a51bf94d05..7e3ab477f67fe 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -949,6 +949,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ 		goto out_addrs;
+ 	}
+ 
++	/*
++	 * If we have seen a tail call, we need a second pass.
++	 * This is because bpf_jit_emit_common_epilogue() is called
++	 * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
++	 */
++	if (cgctx.seen & SEEN_TAILCALL) {
++		cgctx.idx = 0;
++		if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) {
++			fp = org_fp;
++			goto out_addrs;
++		}
++	}
++
+ 	/*
+ 	 * Pretend to build prologue, given the features we've seen.  This will
+ 	 * update ctgtx.idx as it pretends to output instructions, then we can
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-fix-hmis-on-big-endian-with-config_relocatab.patch b/queue-4.19/powerpc-fix-hmis-on-big-endian-with-config_relocatab.patch
new file mode 100644
index 00000000000..ec302a34436
--- /dev/null
+++ b/queue-4.19/powerpc-fix-hmis-on-big-endian-with-config_relocatab.patch
@@ -0,0 +1,40 @@
+From b996e829dbba621173e3eea17f1a75a9d1cac101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 15:08:31 +1100
+Subject: powerpc: Fix HMIs on big-endian with CONFIG_RELOCATABLE=y
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 505a314fb28ce122091691c51426fa85c084e115 ]
+
+HMIs will crash the kernel due to
+
+	BRANCH_LINK_TO_FAR(hmi_exception_realmode)
+
+Calling into the OPD instead of the actual code.
+
+Fixes: 2337d207288f ("powerpc/64: CONFIG_RELOCATABLE support for hmi interrupts")
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+[mpe: Use DOTSYM() rather than #ifdef]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/exceptions-64s.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 90af86f143a91..e1dab9b1e4478 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1123,7 +1123,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
+ 	EXCEPTION_PROLOG_COMMON_2(PACA_EXGEN)
+ 	EXCEPTION_PROLOG_COMMON_3(0xe60)
+ 	addi	r3,r1,STACK_FRAME_OVERHEAD
+-	BRANCH_LINK_TO_FAR(hmi_exception_realmode) /* Function call ABI */
++	BRANCH_LINK_TO_FAR(DOTSYM(hmi_exception_realmode)) /* Function call ABI */
+ 	cmpdi	cr0,r3,0
+ 
+ 	/* Windup the stack. */
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch b/queue-4.19/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
new file mode 100644
index 00000000000..d1c5321575d
--- /dev/null
+++ b/queue-4.19/powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
@@ -0,0 +1,63 @@
+From 5a248786bd599f016bd24b0ed8893fdb349981b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 15:23:33 +0000
+Subject: powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb ]
+
+As several other arches including x86, this patch makes it explicit
+that a bad page fault is a NULL pointer dereference when the fault
+address is lower than PAGE_SIZE
+
+In the mean time, this page makes all bad_page_fault() messages
+shorter so that they remain on one single line. And it prefixes them
+by "BUG: " so that they get easily grepped.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Avoid pr_cont()]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 365526ee29b88..6e0ff8b600ced 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -633,21 +633,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+ 	switch (TRAP(regs)) {
+ 	case 0x300:
+ 	case 0x380:
+-		printk(KERN_ALERT "Unable to handle kernel paging request for "
+-			"data at address 0x%08lx\n", regs->dar);
++		pr_alert("BUG: %s at 0x%08lx\n",
++			 regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
++			 "Unable to handle kernel data access", regs->dar);
+ 		break;
+ 	case 0x400:
+ 	case 0x480:
+-		printk(KERN_ALERT "Unable to handle kernel paging request for "
+-			"instruction fetch\n");
++		pr_alert("BUG: Unable to handle kernel instruction fetch%s",
++			 regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n");
+ 		break;
+ 	case 0x600:
+-		printk(KERN_ALERT "Unable to handle kernel paging request for "
+-			"unaligned access at address 0x%08lx\n", regs->dar);
++		pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n",
++			 regs->dar);
+ 		break;
+ 	default:
+-		printk(KERN_ALERT "Unable to handle kernel paging request for "
+-			"unknown fault\n");
++		pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n",
++			 regs->dar);
+ 		break;
+ 	}
+ 	printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-perf-fix-unit_sel-cache_sel-checks.patch b/queue-4.19/powerpc-perf-fix-unit_sel-cache_sel-checks.patch
new file mode 100644
index 00000000000..b82059b815e
--- /dev/null
+++ b/queue-4.19/powerpc-perf-fix-unit_sel-cache_sel-checks.patch
@@ -0,0 +1,98 @@
+From 94e48d2016faf4b31638cf1272527c092993a274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2017 19:42:40 +0530
+Subject: powerpc/perf: Fix unit_sel/cache_sel checks
+
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+
+[ Upstream commit 2d46d4877b1afd14059393a48bdb8ce27955174c ]
+
+Raw event code has couple of fields "unit" and "cache" in it, to capture
+the "unit" to monitor for a given pmcxsel and cache reload qualifier to
+program in MMCR1.
+
+isa207_get_constraint() refers "unit" field to update the MMCRC (L2/L3)
+Event bus control fields with "cache" bits of the raw event code.
+These are power8 specific and not supported by PowerISA v3.0 pmu. So wrap
+the checks to be power8 specific. Also, "cache" bit field is referred to
+update MMCR1[16:17] and this check can be power8 specific.
+
+Fixes: 7ffd948fae4cd ('powerpc/perf: factor out power8 pmu functions')
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 25 ++++++++++++++++++-------
+ arch/powerpc/perf/isa207-common.h |  4 ++--
+ 2 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 6a2f65d3d088c..053b8e9aa9e75 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -148,6 +148,14 @@ static bool is_thresh_cmp_valid(u64 event)
+ 	return true;
+ }
+ 
++static unsigned int dc_ic_rld_quad_l1_sel(u64 event)
++{
++	unsigned int cache;
++
++	cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK;
++	return cache;
++}
++
+ static inline u64 isa207_find_source(u64 idx, u32 sub_idx)
+ {
+ 	u64 ret = PERF_MEM_NA;
+@@ -288,10 +296,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ 		 * have a cache selector of zero. The bank selector (bit 3) is
+ 		 * irrelevant, as long as the rest of the value is 0.
+ 		 */
+-		if (cache & 0x7)
++		if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7))
+ 			return -1;
+ 
+-	} else if (event & EVENT_IS_L1) {
++	} else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) {
+ 		mask  |= CNST_L1_QUAL_MASK;
+ 		value |= CNST_L1_QUAL_VAL(cache);
+ 	}
+@@ -394,11 +402,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
+ 		/* In continuous sampling mode, update SDAR on TLB miss */
+ 		mmcra_sdar_mode(event[i], &mmcra);
+ 
+-		if (event[i] & EVENT_IS_L1) {
+-			cache = event[i] >> EVENT_CACHE_SEL_SHIFT;
+-			mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT;
+-			cache >>= 1;
+-			mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT;
++		if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++			cache = dc_ic_rld_quad_l1_sel(event[i]);
++			mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++		} else {
++			if (event[i] & EVENT_IS_L1) {
++				cache = dc_ic_rld_quad_l1_sel(event[i]);
++				mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++			}
+ 		}
+ 
+ 		if (is_event_marked(event[i])) {
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index 0028f4b9490db..e5a621699a6d8 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -163,8 +163,8 @@
+ #define MMCR1_COMBINE_SHIFT(pmc)	(35 - ((pmc) - 1))
+ #define MMCR1_PMCSEL_SHIFT(pmc)		(24 - (((pmc) - 1)) * 8)
+ #define MMCR1_FAB_SHIFT			36
+-#define MMCR1_DC_QUAL_SHIFT		47
+-#define MMCR1_IC_QUAL_SHIFT		46
++#define MMCR1_DC_IC_QUAL_MASK		0x3
++#define MMCR1_DC_IC_QUAL_SHIFT		46
+ 
+ /* MMCR1 Combine bits macro for power9 */
+ #define p9_MMCR1_COMBINE_SHIFT(pmc)	(38 - ((pmc - 1) * 2))
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch b/queue-4.19/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
new file mode 100644
index 00000000000..6b93018a96c
--- /dev/null
+++ b/queue-4.19/powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
@@ -0,0 +1,85 @@
+From 299cbd871ab7d66d95a97eac289bc137970d5afb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 15:25:17 +1100
+Subject: powerpc/powernv/eeh/npu: Fix uninitialized variables in
+ opal_pci_eeh_freeze_status
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit c20577014f85f36d4e137d3d52a1f61225b4a3d2 ]
+
+The current implementation of the OPAL_PCI_EEH_FREEZE_STATUS call in
+skiboot's NPU driver does not touch the pci_error_type parameter so
+it might have garbage but the powernv code analyzes it nevertheless.
+
+This initializes pcierr and fstate to zero in all call sites.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/eeh-powernv.c | 8 ++++----
+ arch/powerpc/platforms/powernv/pci-ioda.c    | 4 ++--
+ arch/powerpc/platforms/powernv/pci.c         | 4 ++--
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 3c1beae29f2d8..9dd5b8909178b 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -578,8 +578,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe)
+ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ {
+ 	struct pnv_phb *phb = pe->phb->private_data;
+-	u8 fstate;
+-	__be16 pcierr;
++	u8 fstate = 0;
++	__be16 pcierr = 0;
+ 	s64 rc;
+ 	int result = 0;
+ 
+@@ -617,8 +617,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ static int pnv_eeh_get_pe_state(struct eeh_pe *pe)
+ {
+ 	struct pnv_phb *phb = pe->phb->private_data;
+-	u8 fstate;
+-	__be16 pcierr;
++	u8 fstate = 0;
++	__be16 pcierr = 0;
+ 	s64 rc;
+ 	int result;
+ 
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 326ca6288bb12..ee63749a2d47e 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -605,8 +605,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt)
+ static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no)
+ {
+ 	struct pnv_ioda_pe *slave, *pe;
+-	u8 fstate, state;
+-	__be16 pcierr;
++	u8 fstate = 0, state;
++	__be16 pcierr = 0;
+ 	s64 rc;
+ 
+ 	/* Sanity check on PE number */
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 13aef2323bbca..db230a35609bf 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -602,8 +602,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
+ static void pnv_pci_config_check_eeh(struct pci_dn *pdn)
+ {
+ 	struct pnv_phb *phb = pdn->phb->private_data;
+-	u8	fstate;
+-	__be16	pcierr;
++	u8	fstate = 0;
++	__be16	pcierr = 0;
+ 	unsigned int pe_no;
+ 	s64	rc;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-prom-fix-early-debug-messages.patch b/queue-4.19/powerpc-prom-fix-early-debug-messages.patch
new file mode 100644
index 00000000000..c60f4fcc3cc
--- /dev/null
+++ b/queue-4.19/powerpc-prom-fix-early-debug-messages.patch
@@ -0,0 +1,55 @@
+From e266e3f1433fafd8f5d2882094c009f8592507f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 10:27:47 +0000
+Subject: powerpc/prom: fix early DEBUG messages
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 ]
+
+This patch fixes early DEBUG messages in prom.c:
+- Use %px instead of %p to see the addresses
+- Cast memblock_phys_mem_size() with (unsigned long long) to
+avoid build failure when phys_addr_t is not 64 bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index c4d7078e5295f..8e88f78e57dba 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -129,7 +129,7 @@ static void __init move_device_tree(void)
+ 		p = __va(memblock_alloc(size, PAGE_SIZE));
+ 		memcpy(p, initial_boot_params, size);
+ 		initial_boot_params = p;
+-		DBG("Moved device tree to 0x%p\n", p);
++		DBG("Moved device tree to 0x%px\n", p);
+ 	}
+ 
+ 	DBG("<- move_device_tree\n");
+@@ -689,7 +689,7 @@ void __init early_init_devtree(void *params)
+ {
+ 	phys_addr_t limit;
+ 
+-	DBG(" -> early_init_devtree(%p)\n", params);
++	DBG(" -> early_init_devtree(%px)\n", params);
+ 
+ 	/* Too early to BUG_ON(), do it by hand */
+ 	if (!early_init_dt_verify(params))
+@@ -749,7 +749,7 @@ void __init early_init_devtree(void *params)
+ 	memblock_allow_resize();
+ 	memblock_dump_all();
+ 
+-	DBG("Phys. mem: %llx\n", memblock_phys_mem_size());
++	DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size());
+ 
+ 	/* We may need to relocate the flat tree, do it now.
+ 	 * FIXME .. and the initrd too? */
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch b/queue-4.19/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
new file mode 100644
index 00000000000..f2ef832c8e0
--- /dev/null
+++ b/queue-4.19/powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
@@ -0,0 +1,39 @@
+From fe09bad60431b2a4725d8f8ea9170fd2c5669ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2019 10:42:40 +0800
+Subject: powerpc/pseries/dlpar: Fix a missing check in
+ dlpar_parse_cc_property()
+
+From: Gen Zhang <blackgod016574@gmail.com>
+
+[ Upstream commit efa9ace68e487ddd29c2b4d6dd23242158f1f607 ]
+
+In dlpar_parse_cc_property(), 'prop->name' is allocated by kstrdup().
+kstrdup() may return NULL, so it should be checked and handle error.
+And prop should be freed if 'prop->name' is NULL.
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index e3010b14aea51..c5ffcadab7302 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
+ 
+ 	name = (char *)ccwa + be32_to_cpu(ccwa->name_offset);
+ 	prop->name = kstrdup(name, GFP_KERNEL);
++	if (!prop->name) {
++		dlpar_free_cc_property(prop);
++		return NULL;
++	}
+ 
+ 	prop->length = be32_to_cpu(ccwa->prop_length);
+ 	value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset);
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch b/queue-4.19/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
new file mode 100644
index 00000000000..e74b6a85fce
--- /dev/null
+++ b/queue-4.19/powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
@@ -0,0 +1,36 @@
+From 7364d9a357d685e84629c35dc16be46d9abb89ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 19:16:44 +1100
+Subject: powerpc/pseries: Fix node leak in update_lmb_associativity_index()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 47918bc68b7427e961035949cc1501a864578a69 ]
+
+In update_lmb_associativity_index() we lookup dr_node using
+of_find_node_by_path() which takes a reference for us. In the
+non-error case we forget to drop the reference. Note that
+find_aa_index() does modify properties of the node, but doesn't need
+an extra reference held once it's returned.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-memory.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index d93ff494e7781..7f86bc3eaadec 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -202,6 +202,7 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ 
+ 	aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+ 
++	of_node_put(dr_node);
+ 	dlpar_free_cc_nodes(lmb_node);
+ 
+ 	if (aa_index < 0) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-xmon-fix-dump_segments.patch b/queue-4.19/powerpc-xmon-fix-dump_segments.patch
new file mode 100644
index 00000000000..84a135489f8
--- /dev/null
+++ b/queue-4.19/powerpc-xmon-fix-dump_segments.patch
@@ -0,0 +1,35 @@
+From afedceec3b90abcb6fe06362d2c0686f645edd52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:31:08 +0000
+Subject: powerpc/xmon: fix dump_segments()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 32c8c4c621897199e690760c2d57054f8b84b6e6 ]
+
+mfsrin() takes segment num from bits 31-28 (IBM bits 0-3).
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Clarify bit numbering]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index bb5db7bfd8539..f0fa22e7d36c7 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -3493,7 +3493,7 @@ void dump_segments(void)
+ 
+ 	printf("sr0-15 =");
+ 	for (i = 0; i < 16; ++i)
+-		printf(" %x", mfsrin(i));
++		printf(" %x", mfsrin(i << 28));
+ 	printf("\n");
+ }
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-4.19/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch b/queue-4.19/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
new file mode 100644
index 00000000000..16c5e34f757
--- /dev/null
+++ b/queue-4.19/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
@@ -0,0 +1,40 @@
+From 44f311a221a978a2501ea3b64465a98ab8c25c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 21:22:18 +0200
+Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ]
+
+The owner member of struct pwm_ops must be set to THIS_MODULE to
+increase the reference count of the module such that the module cannot
+be removed while its code is in use.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index d961a8207b1cb..31b01035d0ab3 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ static const struct pwm_ops iproc_pwm_ops = {
+ 	.apply = iproc_pwmc_apply,
+ 	.get_state = iproc_pwmc_get_state,
++	.owner = THIS_MODULE,
+ };
+ 
+ static int iproc_pwmc_probe(struct platform_device *pdev)
+-- 
+2.20.1
+
diff --git a/queue-4.19/pwm-clps711x-fix-period-calculation.patch b/queue-4.19/pwm-clps711x-fix-period-calculation.patch
new file mode 100644
index 00000000000..2ef54f1020f
--- /dev/null
+++ b/queue-4.19/pwm-clps711x-fix-period-calculation.patch
@@ -0,0 +1,47 @@
+From 3d5a5713fdf3f2cec73f7683ac948772adb9475b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 13:39:24 +0300
+Subject: pwm: clps711x: Fix period calculation
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit b0f17570b8203c22f139459c86cfbaa0311313ed ]
+
+Commit e39c0df1be5a ("pwm: Introduce the pwm_args concept") has
+changed the variable for the period for clps711x-pwm driver, so now
+pwm_get/set_period() works with pwm->state.period variable instead
+of pwm->args.period.
+This patch changes the period variable in other places where it is used.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-clps711x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c
+index 26ec24e457b12..7e16b7def0dcb 100644
+--- a/drivers/pwm/pwm-clps711x.c
++++ b/drivers/pwm/pwm-clps711x.c
+@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v)
+ static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v)
+ {
+ 	/* Duty cycle 0..15 max */
+-	return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm));
++	return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period);
+ }
+ 
+ static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	struct clps711x_chip *priv = to_clps711x_chip(chip);
+ 	unsigned int duty;
+ 
+-	if (period_ns != pwm_get_period(pwm))
++	if (period_ns != pwm->args.period)
+ 		return -EINVAL;
+ 
+ 	duty = clps711x_get_duty(pwm, duty_ns);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-bugfix-for-the-scene-without-receiver-queue.patch b/queue-4.19/rdma-hns-bugfix-for-the-scene-without-receiver-queue.patch
new file mode 100644
index 00000000000..d401ba2848d
--- /dev/null
+++ b/queue-4.19/rdma-hns-bugfix-for-the-scene-without-receiver-queue.patch
@@ -0,0 +1,36 @@
+From 415598fb850673ccb6cf41a1b4e4c2d84a1e22dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 17:49:07 +0800
+Subject: RDMA/hns: Bugfix for the scene without receiver queue
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 4d103905eb1e4f14cb62fcf962c9d35da7005dea ]
+
+In some application scenario, the user could not have receive queue when
+run rdma write or read operation.
+
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 54d22868ffba5..af24698ff2262 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -522,7 +522,8 @@ static int hns_roce_qp_has_sq(struct ib_qp_init_attr *attr)
+ static int hns_roce_qp_has_rq(struct ib_qp_init_attr *attr)
+ {
+ 	if (attr->qp_type == IB_QPT_XRC_INI ||
+-	    attr->qp_type == IB_QPT_XRC_TGT || attr->srq)
++	    attr->qp_type == IB_QPT_XRC_TGT || attr->srq ||
++	    !attr->cap.max_recv_wr)
+ 		return 0;
+ 
+ 	return 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-fix-the-bug-while-use-multi-hop-of-pbl.patch b/queue-4.19/rdma-hns-fix-the-bug-while-use-multi-hop-of-pbl.patch
new file mode 100644
index 00000000000..68b793d938a
--- /dev/null
+++ b/queue-4.19/rdma-hns-fix-the-bug-while-use-multi-hop-of-pbl.patch
@@ -0,0 +1,42 @@
+From b88c5027f53d17a476421fb2978d928fd8c83b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 18:40:09 +0800
+Subject: RDMA/hns: Fix the bug while use multi-hop of pbl
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 4af07f01f7a787ba5158352b98c9e3cb74995a1c ]
+
+It will prevent multiply overflow when defines the pbl for u64 type.
+
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 41a538d23b802..c68596d4e8037 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -1017,14 +1017,14 @@ struct ib_mr *hns_roce_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ 			goto err_umem;
+ 		}
+ 	} else {
+-		int pbl_size = 1;
++		u64 pbl_size = 1;
+ 
+ 		bt_size = (1 << (hr_dev->caps.pbl_ba_pg_sz + PAGE_SHIFT)) / 8;
+ 		for (i = 0; i < hr_dev->caps.pbl_hop_num; i++)
+ 			pbl_size *= bt_size;
+ 		if (n > pbl_size) {
+ 			dev_err(dev,
+-			    " MR len %lld err. MR page num is limited to %d!\n",
++			    " MR len %lld err. MR page num is limited to %lld!\n",
+ 			    length, pbl_size);
+ 			ret = -EINVAL;
+ 			goto err_umem;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-fix-the-bug-with-updating-rq-head-pointer-w.patch b/queue-4.19/rdma-hns-fix-the-bug-with-updating-rq-head-pointer-w.patch
new file mode 100644
index 00000000000..a9a4fad0f98
--- /dev/null
+++ b/queue-4.19/rdma-hns-fix-the-bug-with-updating-rq-head-pointer-w.patch
@@ -0,0 +1,55 @@
+From 83f1151da24e7ded344f918e039193a9ccb16154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 17:49:06 +0800
+Subject: RDMA/hns: Fix the bug with updating rq head pointer when flush cqe
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 9c6ccc035c209dda07685e8dba829a203ba17499 ]
+
+When flush cqe with srq, the driver disable to update the rq head pointer
+into the hardware.
+
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 9e7923cf85773..1eda8a22a4252 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3503,13 +3503,16 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ 		roce_set_field(qpc_mask->byte_160_sq_ci_pi,
+ 			       V2_QPC_BYTE_160_SQ_PRODUCER_IDX_M,
+ 			       V2_QPC_BYTE_160_SQ_PRODUCER_IDX_S, 0);
+-		roce_set_field(context->byte_84_rq_ci_pi,
++
++		if (!ibqp->srq) {
++			roce_set_field(context->byte_84_rq_ci_pi,
+ 			       V2_QPC_BYTE_84_RQ_PRODUCER_IDX_M,
+ 			       V2_QPC_BYTE_84_RQ_PRODUCER_IDX_S,
+ 			       hr_qp->rq.head);
+-		roce_set_field(qpc_mask->byte_84_rq_ci_pi,
++			roce_set_field(qpc_mask->byte_84_rq_ci_pi,
+ 			       V2_QPC_BYTE_84_RQ_PRODUCER_IDX_M,
+ 			       V2_QPC_BYTE_84_RQ_PRODUCER_IDX_S, 0);
++		}
+ 	}
+ 
+ 	if (attr_mask & IB_QP_AV) {
+@@ -3971,7 +3974,8 @@ static void hns_roce_set_qps_to_err(struct hns_roce_dev *hr_dev, u32 qpn)
+ 	if (hr_qp->ibqp.uobject) {
+ 		if (hr_qp->sdb_en == 1) {
+ 			hr_qp->sq.head = *(int *)(hr_qp->sdb.virt_addr);
+-			hr_qp->rq.head = *(int *)(hr_qp->rdb.virt_addr);
++			if (hr_qp->rdb_en == 1)
++				hr_qp->rq.head = *(int *)(hr_qp->rdb.virt_addr);
+ 		} else {
+ 			dev_warn(hr_dev->dev, "flush cqe is unsupported in userspace!\n");
+ 			return;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-fix-the-state-of-rereg-mr.patch b/queue-4.19/rdma-hns-fix-the-state-of-rereg-mr.patch
new file mode 100644
index 00000000000..bf9a7ab71a9
--- /dev/null
+++ b/queue-4.19/rdma-hns-fix-the-state-of-rereg-mr.patch
@@ -0,0 +1,36 @@
+From d34c01927bdafc60aa24e047990985eceb36951b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Feb 2019 16:13:04 +0800
+Subject: RDMA/hns: Fix the state of rereg mr
+
+From: Yixian Liu <liuyixian@huawei.com>
+
+[ Upstream commit ab22bf05216a6bb4812448f3a8609489047cf311 ]
+
+The state of mr after reregister operation should be set to valid
+state. Otherwise, it will keep the same as the state before reregistered.
+
+Signed-off-by: Yixian Liu <liuyixian@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 1eda8a22a4252..a5ec900a14ae9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1776,6 +1776,9 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+ 	struct hns_roce_v2_mpt_entry *mpt_entry = mb_buf;
+ 	int ret = 0;
+ 
++	roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_MPT_ST_M,
++		       V2_MPT_BYTE_4_MPT_ST_S, V2_MPT_ST_VALID);
++
+ 	if (flags & IB_MR_REREG_PD) {
+ 		roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
+ 			       V2_MPT_BYTE_4_PD_S, pdn);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-use-gfp_atomic-in-hns_roce_v2_modify_qp.patch b/queue-4.19/rdma-hns-use-gfp_atomic-in-hns_roce_v2_modify_qp.patch
new file mode 100644
index 00000000000..c6cb7e86768
--- /dev/null
+++ b/queue-4.19/rdma-hns-use-gfp_atomic-in-hns_roce_v2_modify_qp.patch
@@ -0,0 +1,36 @@
+From 672d6765c1d98deafaa2b9a3098d6e62db968fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 10:56:20 +0800
+Subject: RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 4e69cf1fe2c52d189acdd06c1fd99cc258aba61f ]
+
+The the below commit, hns_roce_v2_modify_qp is called inside spinlock
+while using GFP_KERNEL. Change it to GFP_ATOMIC.
+
+Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index a5ec900a14ae9..7021444f18b46 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3446,7 +3446,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ 	struct device *dev = hr_dev->dev;
+ 	int ret = -EINVAL;
+ 
+-	context = kcalloc(2, sizeof(*context), GFP_KERNEL);
++	context = kcalloc(2, sizeof(*context), GFP_ATOMIC);
+ 	if (!context)
+ 		return -ENOMEM;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch b/queue-4.19/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
new file mode 100644
index 00000000000..146fcae7a75
--- /dev/null
+++ b/queue-4.19/rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
@@ -0,0 +1,38 @@
+From db1499030fbf01544fb3ba571cadf6a0c0cf8317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 13:20:36 -0800
+Subject: RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 ]
+
+This patch avoids that the SCSI mid-layer keeps retrying forever if
+ib_post_send() fails. This was discovered while testing immediate
+data support and passing a too large num_sge value to ib_post_send().
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index bc6a44a16445c..03ee53adaacd2 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2357,6 +2357,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+ 
+ 	if (srp_post_send(ch, iu, len)) {
+ 		shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
++		scmnd->result = DID_ERROR << 16;
+ 		goto err_unmap;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch b/queue-4.19/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch
new file mode 100644
index 00000000000..aadf3035270
--- /dev/null
+++ b/queue-4.19/rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch
@@ -0,0 +1,38 @@
+From ce9a72eedd33cc3205fb7099b9ab190bb7683867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:17:25 +0200
+Subject: RDMA/vmw_pvrdma: Use atomic memory allocation in create AH
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit a276a4d93bf1580d737f38d1810e5f4b166f3edd ]
+
+Create address handle callback should not sleep, use GFP_ATOMIC instead of
+GFP_KERNEL for memory allocation.
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Cc: Adit Ranadive <aditr@vmware.com>
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+index b65d10b0a8759..f4cb5cf26006f 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+@@ -555,7 +555,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr,
+ 	if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah))
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	ah = kzalloc(sizeof(*ah), GFP_KERNEL);
++	ah = kzalloc(sizeof(*ah), GFP_ATOMIC);
+ 	if (!ah) {
+ 		atomic_dec(&dev->num_ahs);
+ 		return ERR_PTR(-ENOMEM);
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-tps65910-fix-a-missing-check-of-return-val.patch b/queue-4.19/regulator-tps65910-fix-a-missing-check-of-return-val.patch
new file mode 100644
index 00000000000..e94d5ee2d85
--- /dev/null
+++ b/queue-4.19/regulator-tps65910-fix-a-missing-check-of-return-val.patch
@@ -0,0 +1,38 @@
+From 0322aff18b2460ed9e86d1dc9b94a22b3e0318b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:29:19 -0600
+Subject: regulator: tps65910: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a ]
+
+tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so,
+returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65910-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 02ccdaa226a73..5ebb6ee73f077 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, pmic);
+ 
+ 	/* Give control of all register to control port */
+-	tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
++	err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
+ 				DEVCTRL_SR_CTL_I2C_SEL_MASK);
++	if (err < 0)
++		return err;
+ 
+ 	switch (tps65910_chip_id(tps65910)) {
+ 	case TPS65910:
+-- 
+2.20.1
+
diff --git a/queue-4.19/reset-fix-memory-leak-in-reset_control_array_put.patch b/queue-4.19/reset-fix-memory-leak-in-reset_control_array_put.patch
new file mode 100644
index 00000000000..02e5d68d4b3
--- /dev/null
+++ b/queue-4.19/reset-fix-memory-leak-in-reset_control_array_put.patch
@@ -0,0 +1,55 @@
+From 9fce0af22cf3c1d6aec155e58879c8cb2fa2a847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 14:06:23 +0530
+Subject: reset: Fix memory leak in reset_control_array_put()
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ]
+
+Memory allocated for 'struct reset_control_array' in
+of_reset_control_array_get() is never freed in
+reset_control_array_put() resulting in kmemleak showing
+the following backtrace.
+
+  backtrace:
+    [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0
+    [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180
+    [<000000004cc02754>] 0xffff800008c669e4
+    [<0000000050a83b24>] platform_drv_probe+0x50/0xa0
+    [<00000000d3a0b0bc>] really_probe+0x108/0x348
+    [<000000005aa458ac>] driver_probe_device+0x58/0x100
+    [<000000008853626c>] device_driver_attach+0x6c/0x90
+    [<0000000085308d19>] __driver_attach+0x84/0xc8
+    [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8
+    [<00000000dd7f015b>] driver_attach+0x20/0x28
+    [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0
+    [<0000000061473b66>] driver_register+0x60/0x110
+    [<00000000c5bec167>] __platform_driver_register+0x40/0x48
+    [<000000007c764b4f>] 0xffff800008c6c020
+    [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0
+    [<0000000093d4b50d>] do_init_module+0x54/0x1d0
+
+Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index d1887c0ed5d3f..f7bf20493f23e 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -607,6 +607,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
+ 	for (i = 0; i < resets->num_rstcs; i++)
+ 		__reset_control_put_internal(resets->rstc[i]);
+ 	mutex_unlock(&reset_list_mutex);
++	kfree(resets);
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/reset-fix-reset_control_ops-kerneldoc-comment.patch b/queue-4.19/reset-fix-reset_control_ops-kerneldoc-comment.patch
new file mode 100644
index 00000000000..7e615eba765
--- /dev/null
+++ b/queue-4.19/reset-fix-reset_control_ops-kerneldoc-comment.patch
@@ -0,0 +1,35 @@
+From 11c3b3efc4379eba01d48a3470b5a7ad408e3032 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:57:06 -0700
+Subject: reset: fix reset_control_ops kerneldoc comment
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]
+
+Add a missing short description to the reset_control_ops documentation.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[p.zabel@pengutronix.de: rebased and updated commit message]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset-controller.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index 9326d671b6e6c..8675ec64987bb 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -7,7 +7,7 @@
+ struct reset_controller_dev;
+ 
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+  *
+  * @reset: for self-deasserting resets, does all necessary
+  *         things to reset the device
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtl818x-fix-potential-use-after-free.patch b/queue-4.19/rtl818x-fix-potential-use-after-free.patch
new file mode 100644
index 00000000000..77c3d706d00
--- /dev/null
+++ b/queue-4.19/rtl818x-fix-potential-use-after-free.patch
@@ -0,0 +1,43 @@
+From 0e0dd2672ea2f4ef11fddde46c2c84bcee8ac5f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:48:10 +0800
+Subject: rtl818x: fix potential use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit afbb1947db94eacc5a13302eee88a9772fb78935 ]
+
+entry is released via usb_put_urb just after calling usb_submit_urb.
+However, entry is used if the submission fails, resulting in a use after
+free bug. The patch fixes this.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+index 9a1d15b3ce453..518caaaf8a987 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
+ 		skb_queue_tail(&priv->rx_queue, skb);
+ 		usb_anchor_urb(entry, &priv->anchored);
+ 		ret = usb_submit_urb(entry, GFP_KERNEL);
+-		usb_put_urb(entry);
+ 		if (ret) {
+ 			skb_unlink(skb, &priv->rx_queue);
+ 			usb_unanchor_urb(entry);
++			usb_put_urb(entry);
+ 			goto err;
+ 		}
++		usb_put_urb(entry);
+ 	}
+ 	return ret;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/s390-zcrypt-make-sysfs-reset-attribute-trigger-queue.patch b/queue-4.19/s390-zcrypt-make-sysfs-reset-attribute-trigger-queue.patch
new file mode 100644
index 00000000000..f323501940c
--- /dev/null
+++ b/queue-4.19/s390-zcrypt-make-sysfs-reset-attribute-trigger-queue.patch
@@ -0,0 +1,75 @@
+From a7bce247a0c6857989c1548f2412a4331634e050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 15:50:04 +0100
+Subject: s390/zcrypt: make sysfs reset attribute trigger queue reset
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 42a87d4103ae365e18c3be1333592ab583b8ad9d ]
+
+Until now there is no way to reset a AP queue or card. Driving a card
+or queue offline and online again does only toggle the 'software'
+online state. The only way to trigger a (hardware) reset is by running
+hot-unplug/hot-plug for example on the HMC.
+
+This patch makes the queue reset attribute in sysfs writable.
+Writing into this attribute triggers a reset on the AP queue's state
+machine. So the AP queue is flushed and state machine runs through the
+initial states which cause a reset (PQAP(RAPQ)) and a re-registration
+to interrupts (PQAP(AQIC)) if available.
+
+The reset sysfs attribute is writable by root only. So only an
+administrator is allowed to initiate a reset of AP queues. Please note
+that the queue's counter values are left untouched by the reset.
+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_queue.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 0aa4b3ccc948c..576ac08777c50 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -14,6 +14,9 @@
+ #include <asm/facility.h>
+ 
+ #include "ap_bus.h"
++#include "ap_debug.h"
++
++static void __ap_flush_queue(struct ap_queue *aq);
+ 
+ /**
+  * ap_queue_enable_interruption(): Enable interruption on an AP queue.
+@@ -541,7 +544,25 @@ static ssize_t reset_show(struct device *dev,
+ 	return rc;
+ }
+ 
+-static DEVICE_ATTR_RO(reset);
++static ssize_t reset_store(struct device *dev,
++			   struct device_attribute *attr,
++			   const char *buf, size_t count)
++{
++	struct ap_queue *aq = to_ap_queue(dev);
++
++	spin_lock_bh(&aq->lock);
++	__ap_flush_queue(aq);
++	aq->state = AP_STATE_RESET_START;
++	ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
++	spin_unlock_bh(&aq->lock);
++
++	AP_DBF(DBF_INFO, "reset queue=%02x.%04x triggered by user\n",
++	       AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
++
++	return count;
++}
++
++static DEVICE_ATTR_RW(reset);
+ 
+ static ssize_t interrupt_show(struct device *dev,
+ 			      struct device_attribute *attr, char *buf)
+-- 
+2.20.1
+
diff --git a/queue-4.19/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch b/queue-4.19/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch
new file mode 100644
index 00000000000..01b736a02ab
--- /dev/null
+++ b/queue-4.19/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch
@@ -0,0 +1,47 @@
+From 3d865796d03ee66710ad6905218abad3b2f799d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 13:33:07 +0200
+Subject: samples/bpf: fix build by setting HAVE_ATTR_TEST to zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 04ec044b7d30800296824783df7d9728d16d7567 ]
+
+To remove that test_attr__{enabled/open} are used by perf-sys.h, we
+set HAVE_ATTR_TEST to zero.
+
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: KP Singh <kpsingh@google.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: bpf@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: http://lore.kernel.org/bpf/20191001113307.27796-3-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index 36f9f41d094b2..75d4b48601aaa 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -172,6 +172,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf
++KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0
+ 
+ HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
+ HOSTCFLAGS_trace_helpers.o += -I$(srctree)/tools/lib/bpf/
+-- 
+2.20.1
+
diff --git a/queue-4.19/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch b/queue-4.19/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
new file mode 100644
index 00000000000..e240c5ef851
--- /dev/null
+++ b/queue-4.19/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
@@ -0,0 +1,59 @@
+From 0c749aace086e67b4210d3ce8b8f93f716c0c1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:17:06 -0800
+Subject: scripts/gdb: fix debugging modules compiled with hot/cold
+ partitioning
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]
+
+gcc's -freorder-blocks-and-partition option makes it group frequently
+and infrequently used code in .text.hot and .text.unlikely sections
+respectively.  At least when building modules on s390, this option is
+used by default.
+
+gdb assumes that all code is located in .text section, and that .text
+section is located at module load address.  With such modules this is no
+longer the case: there is code in .text.hot and .text.unlikely, and
+either of them might precede .text.
+
+Fix by explicitly telling gdb the addresses of code sections.
+
+It might be tempting to do this for all sections, not only the ones in
+the white list.  Unfortunately, gdb appears to have an issue, when
+telling it about e.g. loadable .note.gnu.build-id section causes it to
+think that non-loadable .note.Linux section is loaded at address 0,
+which in turn causes NULL pointers to be resolved to bogus symbols.  So
+keep using the white list approach for the time being.
+
+Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 004b0ac7fa72d..4644f1a83b578 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+             attrs[n]['name'].string(): attrs[n]['address']
+             for n in range(int(sect_attrs['nsections']))}
+         args = []
+-        for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++        for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++                             ".text", ".text.hot", ".text.unlikely"]:
+             address = section_name_to_address.get(section_name)
+             if address:
+                 args.append(" -s {name} {addr}".format(
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch b/queue-4.19/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
new file mode 100644
index 00000000000..2c9a88f3ada
--- /dev/null
+++ b/queue-4.19/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
@@ -0,0 +1,35 @@
+From d1dc820de8538501dc4265627c2ecb26a688cfbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:42:50 +0530
+Subject: scsi: csiostor: fix incorrect dma device in case of vport
+
+From: Varun Prakash <varun@chelsio.com>
+
+[ Upstream commit 9934613edcb40b92a216122876cd3b7e76d08390 ]
+
+In case of ->vport_create() call scsi_add_host_with_dma() instead of
+scsi_add_host() to pass correct dma device.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index ed2dae657964b..1793981337dd9 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev,
+ 	if (csio_lnode_init(ln, hw, pln))
+ 		goto err_shost_put;
+ 
+-	if (scsi_add_host(shost, dev))
++	if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev))
+ 		goto err_lnode_exit;
+ 
+ 	return ln;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-hisi_sas-shutdown-axi-bus-to-avoid-exception-cq.patch b/queue-4.19/scsi-hisi_sas-shutdown-axi-bus-to-avoid-exception-cq.patch
new file mode 100644
index 00000000000..61c037ea50e
--- /dev/null
+++ b/queue-4.19/scsi-hisi_sas-shutdown-axi-bus-to-avoid-exception-cq.patch
@@ -0,0 +1,60 @@
+From 38658e7a19948122fcfe3580181c3f926c08bd4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 22:22:31 +0800
+Subject: scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit 5c31b0c677531c2b8b4e29b3cfb923df663f39b7 ]
+
+When injecting 2 bit ECC error, it will cause fatal AXI interrupts. Before
+the recovery of SAS controller reset, the internal of SAS controller is in
+error. If CQ interrupts return at the time, actually it is exception CQ
+interrupt, and it may cause resource release in disorder.
+
+To avoid the exception situation, shutdown AXI bus after fatal AXI
+interrupt. In SAS controller reset, it will restart AXI bus. For later
+version of v3 hw, hardware will shutdown AXI bus for this situation, so
+just fix current ver of v3 hw.
+
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index fb2a5969181b5..a7407d5376ba2 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -1520,6 +1520,7 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
+ 	u32 irq_value, irq_msk;
+ 	struct hisi_hba *hisi_hba = p;
+ 	struct device *dev = hisi_hba->dev;
++	struct pci_dev *pdev = hisi_hba->pci_dev;
+ 	int i;
+ 
+ 	irq_msk = hisi_sas_read32(hisi_hba, ENT_INT_SRC_MSK3);
+@@ -1551,6 +1552,17 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
+ 				error->msg, irq_value);
+ 			queue_work(hisi_hba->wq, &hisi_hba->rst_work);
+ 		}
++
++		if (pdev->revision < 0x21) {
++			u32 reg_val;
++
++			reg_val = hisi_sas_read32(hisi_hba,
++						  AXI_MASTER_CFG_BASE +
++						  AM_CTRL_GLOBAL);
++			reg_val |= AM_CTRL_SHUTDOWN_REQ_MSK;
++			hisi_sas_write32(hisi_hba, AXI_MASTER_CFG_BASE +
++					 AM_CTRL_GLOBAL, reg_val);
++		}
+ 	}
+ 
+ 	if (irq_value & BIT(ENT_INT_SRC3_ITC_INT_OFF)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-libsas-check-smp-phy-control-function-result.patch b/queue-4.19/scsi-libsas-check-smp-phy-control-function-result.patch
new file mode 100644
index 00000000000..4c4167c7830
--- /dev/null
+++ b/queue-4.19/scsi-libsas-check-smp-phy-control-function-result.patch
@@ -0,0 +1,50 @@
+From dfd748071294479cb793ce00861151311414bfa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:27 +0800
+Subject: scsi: libsas: Check SMP PHY control function result
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 01929a65dfa13e18d89264ab1378854a91857e59 ]
+
+Currently the SMP PHY control execution result is checked, however the
+function result for the command is not.
+
+As such, we may be missing all potential errors, like SMP FUNCTION FAILED,
+INVALID REQUEST FRAME LENGTH, etc., meaning the PHY control request has
+failed.
+
+In some scenarios we need to ensure the function result is accepted, so add
+a check for this.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index f9d4a24c14b5a..3e74fe9257617 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ 	}
+ 
+ 	res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE);
+-
++	if (res) {
++		pr_err("ex %016llx phy%02d PHY control failed: %d\n",
++		       SAS_ADDR(dev->sas_addr), phy_id, res);
++	} else if (pc_resp[2] != SMP_RESP_FUNC_ACC) {
++		pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n",
++		       SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]);
++		res = pc_resp[2];
++	}
+ 	kfree(pc_resp);
+ 	kfree(pc_req);
+ 	return res;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch b/queue-4.19/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
new file mode 100644
index 00000000000..bf32381479a
--- /dev/null
+++ b/queue-4.19/scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
@@ -0,0 +1,101 @@
+From f45557a12b10654a42b4aa47d72bc02265f0727b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:28 +0800
+Subject: scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+ discovery
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit cec9771d2e954650095aa37a6a97722c8194e7d2 ]
+
+   +----------+             +----------+
+   |          |             |          |
+   |          |--- 3.0 G ---|          |--- 6.0 G --- SAS  disk
+   |          |             |          |
+   |          |--- 3.0 G ---|          |--- 6.0 G --- SAS  disk
+   |initiator |             |          |
+   | device   |--- 3.0 G ---| Expander |--- 6.0 G --- SAS  disk
+   |          |             |          |
+   |          |--- 3.0 G ---|          |--- 6.0 G --- SATA disk  -->failed to connect
+   |          |             |          |
+   |          |             |          |--- 6.0 G --- SATA disk  -->failed to connect
+   |          |             |          |
+   +----------+             +----------+
+
+According to Serial Attached SCSI - 1.1 (SAS-1.1):
+If an expander PHY attached to a SATA PHY is using a physical link rate
+greater than the maximum connection rate supported by the pathway from an
+STP initiator port, a management application client should use the SMP PHY
+CONTROL function (see 10.4.3.10) to set the PROGRAMMED MAXIMUM PHYSICAL
+LINK RATE field of the expander PHY to the maximum connection rate
+supported by the pathway from that STP initiator port.
+
+Currently libsas does not support checking if this condition occurs, nor
+rectifying when it does.
+
+Such a condition is not at all common, however it has been seen on some
+pre-silicon environments where the initiator PHY only supports a 1.5 Gbit
+maximum linkrate, mated with 12G expander PHYs and 3/6G SATA phy.
+
+This patch adds support for checking and rectifying this condition during
+initial device discovery only.
+
+We do support checking min pathway connection rate during revalidation phase,
+when new devices can be detected in the topology. However we do not
+support in the case of the the user reprogramming PHY linkrates, such that
+min pathway condition is not met/maintained.
+
+A note on root port PHY rates:
+The libsas root port PHY rates calculation is broken. Libsas sets the
+rates (min, max, and current linkrate) of a root port to the same linkrate
+of the first PHY member of that same port. In doing so, it assumes that
+all other PHYs which subsequently join the port to have the same
+negotiated linkrate, when they could actually be different.
+
+In practice this doesn't happen, as initiator and expander PHYs are
+normally initialised with consistent min/max linkrates.
+
+This has not caused an issue so far, so leave alone for now.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 2ee9c4ec7a541..f9d4a24c14b5a 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -817,6 +817,26 @@ static struct domain_device *sas_ex_discover_end_dev(
+ 
+ #ifdef CONFIG_SCSI_SAS_ATA
+ 	if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) {
++		if (child->linkrate > parent->min_linkrate) {
++			struct sas_phy_linkrates rates = {
++				.maximum_linkrate = parent->min_linkrate,
++				.minimum_linkrate = parent->min_linkrate,
++			};
++			int ret;
++
++			pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n",
++				   SAS_ADDR(child->sas_addr), phy_id);
++			ret = sas_smp_phy_control(parent, phy_id,
++						  PHY_FUNC_LINK_RESET, &rates);
++			if (ret) {
++				pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n",
++				       SAS_ADDR(child->sas_addr), phy_id, ret);
++				goto out_free;
++			}
++			pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n",
++				  SAS_ADDR(child->sas_addr), phy_id);
++			child->linkrate = child->min_linkrate;
++		}
+ 		res = sas_get_ata_info(child, phy);
+ 		if (res)
+ 			goto out_free;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-lpfc-enable-management-features-for-if_type-6.patch b/queue-4.19/scsi-lpfc-enable-management-features-for-if_type-6.patch
new file mode 100644
index 00000000000..0cb1a295636
--- /dev/null
+++ b/queue-4.19/scsi-lpfc-enable-management-features-for-if_type-6.patch
@@ -0,0 +1,110 @@
+From 9ccc9ccc5800991f9bb2d02c0f5843ba03ab5bb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 19:37:01 -0800
+Subject: scsi: lpfc: Enable Management features for IF_TYPE=6
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 719162bd5bb968203397b9b1d0dd30a9797bbd09 ]
+
+Addition of support for if_type=6 missed several checks for interface type,
+resulting in the failure of several key management features such as
+firmware dump and loopback testing.
+
+Correct the checks on the if_type so that both SLI4 IF_TYPE's 2 and 6 are
+supported.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_attr.c    | 4 ++--
+ drivers/scsi/lpfc/lpfc_bsg.c     | 6 +++---
+ drivers/scsi/lpfc/lpfc_els.c     | 2 +-
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +-
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 55cd96e2469c6..3f69a5e4e470a 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1332,7 +1332,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode)
+ 		return -EACCES;
+ 
+ 	if ((phba->sli_rev < LPFC_SLI_REV4) ||
+-	    (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++	    (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ 	     LPFC_SLI_INTF_IF_TYPE_2))
+ 		return -EPERM;
+ 
+@@ -4264,7 +4264,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr,
+ 	uint32_t prev_val, if_type;
+ 
+ 	if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf);
+-	if (if_type == LPFC_SLI_INTF_IF_TYPE_2 &&
++	if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 &&
+ 	    phba->hba_flag & HBA_FORCED_LINK_SPEED)
+ 		return -EPERM;
+ 
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index 90745feca8080..99aea52e584b0 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job)
+ 
+ 	if (phba->sli_rev < LPFC_SLI_REV4)
+ 		rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
+-	else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) ==
++	else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
+ 		 LPFC_SLI_INTF_IF_TYPE_2)
+ 		rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
+ 	else
+@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job)
+ 
+ 	if (phba->sli_rev < LPFC_SLI_REV4)
+ 		return -ENODEV;
+-	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ 	    LPFC_SLI_INTF_IF_TYPE_2)
+ 		return -ENODEV;
+ 
+@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job)
+ 		rc = -ENODEV;
+ 		goto job_error;
+ 	}
+-	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++	if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ 	    LPFC_SLI_INTF_IF_TYPE_2) {
+ 		rc = -ENODEV;
+ 		goto job_error;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index ea2aa5f55ca44..4f4d1b3b3bbc4 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -5559,7 +5559,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
+ 	struct ls_rjt stat;
+ 
+ 	if (phba->sli_rev < LPFC_SLI_REV4 ||
+-	    bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++	    bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ 						LPFC_SLI_INTF_IF_TYPE_2) {
+ 		rjt_err = LSRJT_UNABLE_TPC;
+ 		rjt_expl = LSEXP_REQ_UNSUPPORTED;
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 68f223882d96b..b36b3da323a0a 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4780,7 +4780,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+ 				if (phba->sli_rev == LPFC_SLI_REV4 &&
+ 				    (!(vport->load_flag & FC_UNLOADING)) &&
+ 				    (bf_get(lpfc_sli_intf_if_type,
+-				     &phba->sli4_hba.sli_intf) ==
++				     &phba->sli4_hba.sli_intf) >=
+ 				      LPFC_SLI_INTF_IF_TYPE_2) &&
+ 				    (kref_read(&ndlp->kref) > 0)) {
+ 					mbox->context1 = lpfc_nlp_get(ndlp);
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch b/queue-4.19/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
new file mode 100644
index 00000000000..388053f6664
--- /dev/null
+++ b/queue-4.19/scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
@@ -0,0 +1,77 @@
+From 92092f49c32f2bb7529e143bde2632c9023cd731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:40 -0800
+Subject: scsi: lpfc: Fix dif and first burst use in write commands
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 7c4042a4d0b7532cfbc90478fd3084b2dab5849e ]
+
+When dif and first burst is used in a write command wqe, the driver was not
+properly setting fields in the io command request. This resulted in no dif
+bytes being sent and invalid xfer_rdy's, resulting in the io being aborted
+by the hardware.
+
+Correct the wqe initializaton when both dif and first burst are used.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 666495f21c246..425b83618a2e5 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -2732,6 +2732,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ 	int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ 	int prot_group_type = 0;
+ 	int fcpdl;
++	struct lpfc_vport *vport = phba->pport;
+ 
+ 	/*
+ 	 * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd
+@@ -2837,6 +2838,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ 	 */
+ 	iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+ 
++	/*
++	 * For First burst, we may need to adjust the initial transfer
++	 * length for DIF
++	 */
++	if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++	    (fcpdl < vport->cfg_first_burst_size))
++		iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ 	return 0;
+ err:
+ 	if (lpfc_cmd->seg_cnt)
+@@ -3401,6 +3410,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ 	int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ 	int prot_group_type = 0;
+ 	int fcpdl;
++	struct lpfc_vport *vport = phba->pport;
+ 
+ 	/*
+ 	 * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd
+@@ -3516,6 +3526,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ 	 */
+ 	iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+ 
++	/*
++	 * For First burst, we may need to adjust the initial transfer
++	 * length for DIF
++	 */
++	if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++	    (fcpdl < vport->cfg_first_burst_size))
++		iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ 	/*
+ 	 * If the OAS driver feature is enabled and the lun is enabled for
+ 	 * OAS, set the oas iocb related flags.
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch b/queue-4.19/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch
new file mode 100644
index 00000000000..ba0fb974c44
--- /dev/null
+++ b/queue-4.19/scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch
@@ -0,0 +1,93 @@
+From 92ba8124a71e41e20ff6c994a0ad737e68f72a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:32 -0800
+Subject: scsi: lpfc: Fix kernel Oops due to null pring pointers
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 5a9eeff57f340238c39c95d8e7e54c96fc722de7 ]
+
+Driver is hitting null pring pointers in lpfc_do_work().
+
+Pointer assignment occurs based on SLI-revision. If recovering after an
+error, its possible the sli revision for the port was cleared, making the
+lpfc_phba_elsring() not return a ring pointer, thus the null pointer.
+
+Add SLI revision checking to lpfc_phba_elsring() and status checking to all
+callers.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc.h      | 6 ++++++
+ drivers/scsi/lpfc/lpfc_els.c  | 2 ++
+ drivers/scsi/lpfc/lpfc_init.c | 7 ++++++-
+ drivers/scsi/lpfc/lpfc_sli.c  | 2 ++
+ 4 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index ebcfcbb8b4ccc..a62e85cb62eb2 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -1236,6 +1236,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
+ static inline struct lpfc_sli_ring *
+ lpfc_phba_elsring(struct lpfc_hba *phba)
+ {
++	/* Return NULL if sli_rev has become invalid due to bad fw */
++	if (phba->sli_rev != LPFC_SLI_REV4  &&
++	    phba->sli_rev != LPFC_SLI_REV3  &&
++	    phba->sli_rev != LPFC_SLI_REV2)
++		return NULL;
++
+ 	if (phba->sli_rev == LPFC_SLI_REV4) {
+ 		if (phba->sli4_hba.els_wq)
+ 			return phba->sli4_hba.els_wq->pring;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 222fa9b7f4788..ea2aa5f55ca44 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1343,6 +1343,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba)
+ 			Fabric_DID);
+ 
+ 	pring = lpfc_phba_elsring(phba);
++	if (unlikely(!pring))
++		return -EIO;
+ 
+ 	/*
+ 	 * Check the txcmplq for an iocb that matches the nport the driver is
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index a7d3e532e0f58..da63c026ba460 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -1801,7 +1801,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action,
+ 	lpfc_offline(phba);
+ 	/* release interrupt for possible resource change */
+ 	lpfc_sli4_disable_intr(phba);
+-	lpfc_sli_brdrestart(phba);
++	rc = lpfc_sli_brdrestart(phba);
++	if (rc) {
++		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
++				"6309 Failed to restart board\n");
++		return rc;
++	}
+ 	/* request and enable interrupt */
+ 	intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode);
+ 	if (intr_mode == LPFC_INTR_ERROR) {
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 3361ae75578f2..755803ff6cfef 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -4640,6 +4640,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
+ 	hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED;
+ 
+ 	rc = lpfc_sli4_brdreset(phba);
++	if (rc)
++		return rc;
+ 
+ 	spin_lock_irq(&phba->hbalock);
+ 	phba->pport->stopped = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch b/queue-4.19/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
new file mode 100644
index 00000000000..76ed976dc54
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
@@ -0,0 +1,127 @@
+From 9e1b45a33d0e60b52ae190876e03356c8425b606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:48:45 -0700
+Subject: scsi: qla2xxx: deadlock by configfs_depend_item
+
+From: Anatoliy Glagolev <glagolig@gmail.com>
+
+[ Upstream commit 17b18eaa6f59044a5172db7d07149e31ede0f920 ]
+
+The intent of invoking configfs_depend_item in commit 7474f52a82d51
+("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg")
+was to prevent a physical Fibre Channel port removal when
+virtual (NPIV) ports announced through that physical port are active.
+The change does not work as expected: it makes enabled physical port
+dependent on target configfs subsystem (the port's parent), something
+the configfs guarantees anyway.
+
+Besides, scheduling work in a worker thread and waiting for the work's
+completion is not really a valid workaround for the requirement not to call
+configfs_depend_item from a configfs callback: the call occasionally
+deadlocks.
+
+Thus, removing configfs_depend_item calls does not break anything and fixes
+the deadlock problem.
+
+Signed-off-by: Anatoliy Glagolev <glagolig@gmail.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++-------------------------
+ drivers/scsi/qla2xxx/tcm_qla2xxx.h |  3 --
+ 2 files changed, 8 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index b8c1a739dfbd1..654e1af7f542c 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -926,38 +926,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item,
+ 			atomic_read(&tpg->lport_tpg_enabled));
+ }
+ 
+-static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+-{
+-	struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+-				struct tcm_qla2xxx_tpg, tpg_base_work);
+-	struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+-	struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+-	if (!target_depend_item(&se_tpg->tpg_group.cg_item)) {
+-		atomic_set(&base_tpg->lport_tpg_enabled, 1);
+-		qlt_enable_vha(base_vha);
+-	}
+-	complete(&base_tpg->tpg_base_comp);
+-}
+-
+-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+-{
+-	struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+-				struct tcm_qla2xxx_tpg, tpg_base_work);
+-	struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+-	struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+-	if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+-		atomic_set(&base_tpg->lport_tpg_enabled, 0);
+-		target_undepend_item(&se_tpg->tpg_group.cg_item);
+-	}
+-	complete(&base_tpg->tpg_base_comp);
+-}
+-
+ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ 		const char *page, size_t count)
+ {
+ 	struct se_portal_group *se_tpg = to_tpg(item);
++	struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
++	struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
++			struct tcm_qla2xxx_lport, lport_wwn);
++	struct scsi_qla_host *vha = lport->qla_vha;
+ 	struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+ 			struct tcm_qla2xxx_tpg, se_tpg);
+ 	unsigned long op;
+@@ -976,24 +952,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ 		if (atomic_read(&tpg->lport_tpg_enabled))
+ 			return -EEXIST;
+ 
+-		INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
++		atomic_set(&tpg->lport_tpg_enabled, 1);
++		qlt_enable_vha(vha);
+ 	} else {
+ 		if (!atomic_read(&tpg->lport_tpg_enabled))
+ 			return count;
+ 
+-		INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
++		atomic_set(&tpg->lport_tpg_enabled, 0);
++		qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+ 	}
+-	init_completion(&tpg->tpg_base_comp);
+-	schedule_work(&tpg->tpg_base_work);
+-	wait_for_completion(&tpg->tpg_base_comp);
+ 
+-	if (op) {
+-		if (!atomic_read(&tpg->lport_tpg_enabled))
+-			return -ENODEV;
+-	} else {
+-		if (atomic_read(&tpg->lport_tpg_enabled))
+-			return -EPERM;
+-	}
+ 	return count;
+ }
+ 
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+index 7550ba2831c36..147cf6c903666 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg {
+ 	struct tcm_qla2xxx_tpg_attrib tpg_attrib;
+ 	/* Returned by tcm_qla2xxx_make_tpg() */
+ 	struct se_portal_group se_tpg;
+-	/* Items for dealing with configfs_depend_item */
+-	struct completion tpg_base_comp;
+-	struct work_struct tpg_base_work;
+ };
+ 
+ struct tcm_qla2xxx_fc_loopid {
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-fix-for-fc-nvme-discovery-for-npiv-port.patch b/queue-4.19/scsi-qla2xxx-fix-for-fc-nvme-discovery-for-npiv-port.patch
new file mode 100644
index 00000000000..139fd78a68c
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-fix-for-fc-nvme-discovery-for-npiv-port.patch
@@ -0,0 +1,62 @@
+From 03f547859df0e1c029c99a50987c520f3b83b167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 12:36:24 -0800
+Subject: scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port
+
+From: Giridhar Malavali <gmalavali@marvell.com>
+
+[ Upstream commit 835aa4f2691e4ed4ed16de81f3cabf17a87a164f ]
+
+This patch fixes NVMe discovery by setting SKIP_PRLI flag, so that PRLI is
+driven by driver and is retried when the NPIV port is detected to have NVMe
+capability.
+
+Signed-off-by: Giridhar Malavali <gmalavali@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_attr.c |  2 ++
+ drivers/scsi/qla2xxx/qla_init.c | 10 ++++------
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 15d493f30810f..3e9c49b3184f1 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -2161,6 +2161,8 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
+ 	    test_bit(FCPORT_UPDATE_NEEDED, &vha->dpc_flags))
+ 		msleep(1000);
+ 
++	qla_nvme_delete(vha);
++
+ 	qla24xx_disable_vp(vha);
+ 	qla2x00_wait_for_sess_deletion(vha);
+ 
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 653d535e3052f..f7dd289779b14 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -242,15 +242,13 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ 	qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+ 
+ 	sp->done = qla2x00_async_login_sp_done;
+-	if (N2N_TOPO(fcport->vha->hw) && fcport_is_bigger(fcport)) {
++	if (N2N_TOPO(fcport->vha->hw) && fcport_is_bigger(fcport))
+ 		lio->u.logio.flags |= SRB_LOGIN_PRLI_ONLY;
+-	} else {
++	else
+ 		lio->u.logio.flags |= SRB_LOGIN_COND_PLOGI;
+ 
+-		if (fcport->fc4f_nvme)
+-			lio->u.logio.flags |= SRB_LOGIN_SKIP_PRLI;
+-
+-	}
++	if (fcport->fc4f_nvme)
++		lio->u.logio.flags |= SRB_LOGIN_SKIP_PRLI;
+ 
+ 	ql_dbg(ql_dbg_disc, vha, 0x2072,
+ 	    "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-fix-npiv-handling-for-fc-nvme.patch b/queue-4.19/scsi-qla2xxx-fix-npiv-handling-for-fc-nvme.patch
new file mode 100644
index 00000000000..a0af69bcde2
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-fix-npiv-handling-for-fc-nvme.patch
@@ -0,0 +1,80 @@
+From e5f625e66c39dba60d8cd1d017227c7f20eec604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 12:36:23 -0800
+Subject: scsi: qla2xxx: Fix NPIV handling for FC-NVMe
+
+From: Himanshu Madhani <hmadhani@marvell.com>
+
+[ Upstream commit 5e6803b409ba3c18434de6693062d98a470bcb1e ]
+
+This patch fixes issues with NPIV port with FC-NVMe. Clean up code for
+remoteport delete and also call nvme_delete when deleting VPs.
+
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 16 +++-------------
+ drivers/scsi/qla2xxx/qla_os.c   |  2 ++
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index e6545cb9a2c19..5590d6e8b5762 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -474,21 +474,10 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ 	int rval = -ENODEV;
+ 	srb_t *sp;
+ 	struct qla_qpair *qpair = hw_queue_handle;
+-	struct nvme_private *priv;
++	struct nvme_private *priv = fd->private;
+ 	struct qla_nvme_rport *qla_rport = rport->private;
+ 
+-	if (!fd || !qpair) {
+-		ql_log(ql_log_warn, NULL, 0x2134,
+-		    "NO NVMe request or Queue Handle\n");
+-		return rval;
+-	}
+-
+-	priv = fd->private;
+ 	fcport = qla_rport->fcport;
+-	if (!fcport) {
+-		ql_log(ql_log_warn, NULL, 0x210e, "No fcport ptr\n");
+-		return rval;
+-	}
+ 
+ 	vha = fcport->vha;
+ 
+@@ -517,6 +506,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ 	sp->name = "nvme_cmd";
+ 	sp->done = qla_nvme_sp_done;
+ 	sp->qpair = qpair;
++	sp->vha = vha;
+ 	nvme = &sp->u.iocb_cmd;
+ 	nvme->u.nvme.desc = fd;
+ 
+@@ -564,7 +554,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
+ 		schedule_work(&fcport->free_work);
+ 	}
+ 
+-	fcport->nvme_flag &= ~(NVME_FLAG_REGISTERED | NVME_FLAG_DELETING);
++	fcport->nvme_flag &= ~NVME_FLAG_DELETING;
+ 	ql_log(ql_log_info, fcport->vha, 0x2110,
+ 	    "remoteport_delete of %p completed.\n", fcport);
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 3e892e013658d..183bfda8f5d11 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3538,6 +3538,8 @@ qla2x00_delete_all_vps(struct qla_hw_data *ha, scsi_qla_host_t *base_vha)
+ 		spin_unlock_irqrestore(&ha->vport_slock, flags);
+ 		mutex_unlock(&ha->vport_lock);
+ 
++		qla_nvme_delete(vha);
++
+ 		fc_vport_terminate(vha->fc_vport);
+ 		scsi_host_put(vha->host);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-target-tcmu-fix-queue_cmd_ring-declaration.patch b/queue-4.19/scsi-target-tcmu-fix-queue_cmd_ring-declaration.patch
new file mode 100644
index 00000000000..23e94f999f9
--- /dev/null
+++ b/queue-4.19/scsi-target-tcmu-fix-queue_cmd_ring-declaration.patch
@@ -0,0 +1,41 @@
+From 35cc0333187fcdf47c9c8e2d343b9019c9641d4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 15:51:55 -0800
+Subject: scsi: target/tcmu: Fix queue_cmd_ring() declaration
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit e7f411049f5164ee6db6c3434c07302846f09990 ]
+
+This patch does not change any functionality but avoids that sparse
+complains about the queue_cmd_ring() function and its callers.
+
+Fixes: 6fd0ce79724d ("tcmu: prep queue_cmd_ring to be used by unmap wq")
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 7159e8363b83b..7ee0a75ce4526 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -962,7 +962,7 @@ static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+  *  0 success
+  *  1 internally queued to wait for ring memory to free.
+  */
+-static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
++static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ {
+ 	struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ 	struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+-- 
+2.20.1
+
diff --git a/queue-4.19/sctp-don-t-compare-hb_timer-expire-date-before-start.patch b/queue-4.19/sctp-don-t-compare-hb_timer-expire-date-before-start.patch
new file mode 100644
index 00000000000..9f28da5a186
--- /dev/null
+++ b/queue-4.19/sctp-don-t-compare-hb_timer-expire-date-before-start.patch
@@ -0,0 +1,59 @@
+From ed332e9cfd229ebfaa91b384ba5e91bbd1481475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 09:45:26 +0100
+Subject: sctp: don't compare hb_timer expire date before starting it
+
+From: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+
+[ Upstream commit d1f20c03f48102e52eb98b8651d129b83134cae4 ]
+
+hb_timer might not start at all for a particular transport because its
+start is conditional. In a result a node is not sending heartbeats.
+
+Function sctp_transport_reset_hb_timer has two roles:
+    - initial start of hb_timer for a given transport,
+    - update expire date of hb_timer for a given transport.
+The function is optimized to update timer's expire only if it is before
+a new calculated one but this comparison is invalid for a timer which
+has not yet started. Such a timer has expire == 0 and if a new expire
+value is bigger than (MAX_JIFFIES / 2 + 2) then "time_before" macro will
+fail and timer will not start resulting in no heartbeat packets send by
+the node.
+
+This was found when association was initialized within first 5 mins
+after system boot due to jiffies init value which is near to MAX_JIFFIES.
+
+Test kernel version: 4.9.154 (ARCH=arm)
+hb_timer.expire = 0;                //initialized, not started timer
+new_expire = MAX_JIFFIES / 2 + 2;   //or more
+time_before(hb_timer.expire, new_expire) == false
+
+Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often")
+Reported-by: Marcin Stojek <marcin.stojek@nokia.com>
+Tested-by: Marcin Stojek <marcin.stojek@nokia.com>
+Signed-off-by: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/transport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 033696e6f74fb..ad158d311ffae 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -207,7 +207,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+ 
+ 	/* When a data chunk is sent, reset the heartbeat interval.  */
+ 	expires = jiffies + sctp_transport_timeout(transport);
+-	if (time_before(transport->hb_timer.expires, expires) &&
++	if ((time_before(transport->hb_timer.expires, expires) ||
++	     !timer_pending(&transport->hb_timer)) &&
+ 	    !mod_timer(&transport->hb_timer,
+ 		       expires + prandom_u32_max(transport->rto)))
+ 		sctp_transport_hold(transport);
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-8250-fix-serial8250-initialization-crash.patch b/queue-4.19/serial-8250-fix-serial8250-initialization-crash.patch
new file mode 100644
index 00000000000..a004b2cf7b9
--- /dev/null
+++ b/queue-4.19/serial-8250-fix-serial8250-initialization-crash.patch
@@ -0,0 +1,72 @@
+From 166454c55033fafea0411b77d88cbdf70db3718a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 17:00:19 +0800
+Subject: serial: 8250: Fix serial8250 initialization crash
+
+From: He Zhe <zhe.he@windriver.com>
+
+[ Upstream commit 352c4cf40c4a7d439fa5d30aa2160f54b394da82 ]
+
+The initialization code of interrupt backoff work might reference NULL
+pointer and cause the following crash, if no port was found.
+
+[   10.017727] CPU 0 Unable to handle kernel paging request at virtual address 000001b0, epc == 807088e0, ra == 8070863c
+---- snip ----
+[   11.704470] [<807088e0>] serial8250_register_8250_port+0x318/0x4ac
+[   11.747251] [<80708d74>] serial8250_probe+0x148/0x1c0
+[   11.789301] [<80728450>] platform_drv_probe+0x40/0x94
+[   11.830515] [<807264f8>] really_probe+0xf8/0x318
+[   11.870876] [<80726b7c>] __driver_attach+0x110/0x12c
+[   11.910960] [<80724374>] bus_for_each_dev+0x78/0xcc
+[   11.951134] [<80725958>] bus_add_driver+0x200/0x234
+[   11.989756] [<807273d8>] driver_register+0x84/0x148
+[   12.029832] [<80d72f84>] serial8250_init+0x138/0x198
+[   12.070447] [<80100e6c>] do_one_initcall+0x5c/0x2a0
+[   12.110104] [<80d3a208>] kernel_init_freeable+0x370/0x484
+[   12.150722] [<80a49420>] kernel_init+0x10/0xf8
+[   12.191517] [<8010756c>] ret_from_kernel_thread+0x14/0x1c
+
+This patch makes sure the initialization code can be reached only if a port
+is found.
+
+Fixes: 6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during input overruns")
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Reviewed-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_core.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 0e65d4261f94c..69aaee5d7fe14 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1074,15 +1074,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ 
+ 			ret = 0;
+ 		}
+-	}
+ 
+-	/* Initialise interrupt backoff work if required */
+-	if (up->overrun_backoff_time_ms > 0) {
+-		uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
+-		INIT_DELAYED_WORK(&uart->overrun_backoff,
+-				  serial_8250_overrun_backoff_work);
+-	} else {
+-		uart->overrun_backoff_time_ms = 0;
++		/* Initialise interrupt backoff work if required */
++		if (up->overrun_backoff_time_ms > 0) {
++			uart->overrun_backoff_time_ms =
++				up->overrun_backoff_time_ms;
++			INIT_DELAYED_WORK(&uart->overrun_backoff,
++					serial_8250_overrun_backoff_work);
++		} else {
++			uart->overrun_backoff_time_ms = 0;
++		}
+ 	}
+ 
+ 	mutex_unlock(&serial_mutex);
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch b/queue-4.19/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch
new file mode 100644
index 00000000000..e6e4ea05b81
--- /dev/null
+++ b/queue-4.19/serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch
@@ -0,0 +1,146 @@
+From cff23ff58f30810f9563a89a6c82ef972027485d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:29:09 +1300
+Subject: serial: 8250: Rate limit serial port rx interrupts during input
+ overruns
+
+From: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+
+[ Upstream commit 6d7f677a2afa1c82d7fc7af7f9159cbffd5dc010 ]
+
+When a serial port gets faulty or gets flooded with inputs, its interrupt
+handler starts to work double time to get the characters to the workqueue
+for the tty layer to handle them. When this busy time on the serial/tty
+subsystem happens during boot, where it is also busy on the userspace
+trying to initialise, some processes can continuously get preempted
+and will be on hold until the interrupts subside.
+
+The fix is to backoff on processing received characters for a specified
+amount of time when an input overrun is seen (received a new character
+before the previous one is processed). This only stops receive and will
+continue to transmit characters to serial port. After the backoff period
+is done, it receive will be re-enabled. This is optional and will only
+be enabled by setting 'overrun-throttle-ms' in the dts.
+
+Signed-off-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_core.c | 25 +++++++++++++++++++++++++
+ drivers/tty/serial/8250/8250_fsl.c  | 23 ++++++++++++++++++++++-
+ drivers/tty/serial/8250/8250_of.c   |  5 +++++
+ include/linux/serial_8250.h         |  4 ++++
+ 4 files changed, 56 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 8fe3d0ed229ed..0e65d4261f94c 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -946,6 +946,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port *
+ 	return NULL;
+ }
+ 
++static void serial_8250_overrun_backoff_work(struct work_struct *work)
++{
++	struct uart_8250_port *up =
++	    container_of(to_delayed_work(work), struct uart_8250_port,
++			 overrun_backoff);
++	struct uart_port *port = &up->port;
++	unsigned long flags;
++
++	spin_lock_irqsave(&port->lock, flags);
++	up->ier |= UART_IER_RLSI | UART_IER_RDI;
++	up->port.read_status_mask |= UART_LSR_DR;
++	serial_out(up, UART_IER, up->ier);
++	spin_unlock_irqrestore(&port->lock, flags);
++}
++
+ /**
+  *	serial8250_register_8250_port - register a serial port
+  *	@up: serial port template
+@@ -1060,6 +1075,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ 			ret = 0;
+ 		}
+ 	}
++
++	/* Initialise interrupt backoff work if required */
++	if (up->overrun_backoff_time_ms > 0) {
++		uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
++		INIT_DELAYED_WORK(&uart->overrun_backoff,
++				  serial_8250_overrun_backoff_work);
++	} else {
++		uart->overrun_backoff_time_ms = 0;
++	}
++
+ 	mutex_unlock(&serial_mutex);
+ 
+ 	return ret;
+diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c
+index 6640a4c7ddd1d..bb9571eed275d 100644
+--- a/drivers/tty/serial/8250/8250_fsl.c
++++ b/drivers/tty/serial/8250/8250_fsl.c
+@@ -45,8 +45,29 @@ int fsl8250_handle_irq(struct uart_port *port)
+ 
+ 	lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR);
+ 
+-	if (lsr & (UART_LSR_DR | UART_LSR_BI))
++	/* Process incoming characters first */
++	if ((lsr & (UART_LSR_DR | UART_LSR_BI)) &&
++	    (up->ier & (UART_IER_RLSI | UART_IER_RDI))) {
+ 		lsr = serial8250_rx_chars(up, lsr);
++	}
++
++	/* Stop processing interrupts on input overrun */
++	if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) {
++		unsigned long delay;
++
++		up->ier = port->serial_in(port, UART_IER);
++		if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++			port->ops->stop_rx(port);
++		} else {
++			/* Keep restarting the timer until
++			 * the input overrun subsides.
++			 */
++			cancel_delayed_work(&up->overrun_backoff);
++		}
++
++		delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
++		schedule_delayed_work(&up->overrun_backoff, delay);
++	}
+ 
+ 	serial8250_modem_status(up);
+ 
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 98125de2f0a6c..2488de1c4bc4b 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -244,6 +244,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
+ 	if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control"))
+ 		port8250.capabilities |= UART_CAP_AFE;
+ 
++	if (of_property_read_u32(ofdev->dev.of_node,
++			"overrun-throttle-ms",
++			&port8250.overrun_backoff_time_ms) != 0)
++		port8250.overrun_backoff_time_ms = 0;
++
+ 	ret = serial8250_register_8250_port(&port8250);
+ 	if (ret < 0)
+ 		goto err_dispose;
+diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
+index 18e21427bce43..5a655ba8d2730 100644
+--- a/include/linux/serial_8250.h
++++ b/include/linux/serial_8250.h
+@@ -134,6 +134,10 @@ struct uart_8250_port {
+ 	void			(*dl_write)(struct uart_8250_port *, int);
+ 
+ 	struct uart_8250_em485 *em485;
++
++	/* Serial port overrun backoff */
++	struct delayed_work overrun_backoff;
++	u32 overrun_backoff_time_ms;
+ };
+ 
+ static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up)
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-max310x-fix-tx_empty-callback.patch b/queue-4.19/serial-max310x-fix-tx_empty-callback.patch
new file mode 100644
index 00000000000..e7d68dcae40
--- /dev/null
+++ b/queue-4.19/serial-max310x-fix-tx_empty-callback.patch
@@ -0,0 +1,43 @@
+From c889b3e91c8b9f6050d4f29a6731ae53816a21c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 14:19:20 +0300
+Subject: serial: max310x: Fix tx_empty() callback
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit a8da3c7873ea57acb8f9cea58c0af477522965aa ]
+
+Function max310x_tx_empty() accesses the IRQSTS register, which is
+cleared by IC when reading, so if there is an interrupt status, we
+will lose it. This patch implement the transmitter check only by
+the current FIFO level.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index bd3e6cf81af5c..0c35c3c5e3734 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -844,12 +844,9 @@ static void max310x_wq_proc(struct work_struct *ws)
+ 
+ static unsigned int max310x_tx_empty(struct uart_port *port)
+ {
+-	unsigned int lvl, sts;
++	u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+ 
+-	lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+-	sts = max310x_port_read(port, MAX310X_IRQSTS_REG);
+-
+-	return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0;
++	return lvl ? 0 : TIOCSER_TEMT;
+ }
+ 
+ static unsigned int max310x_get_mctrl(struct uart_port *port)
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-sh-sci-fix-crash-in-rx_timer_fn-on-pio-fallba.patch b/queue-4.19/serial-sh-sci-fix-crash-in-rx_timer_fn-on-pio-fallba.patch
new file mode 100644
index 00000000000..43bfefbf528
--- /dev/null
+++ b/queue-4.19/serial-sh-sci-fix-crash-in-rx_timer_fn-on-pio-fallba.patch
@@ -0,0 +1,39 @@
+From 8b766b4ac773be3e7019e21d4893f6684aec5006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 19:44:42 +0100
+Subject: serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2e948218b7c1262a3830823d6620eb227e3d4e3a ]
+
+When falling back to PIO, active_rx must be set to a different value
+than cookie_rx[i], else sci_dma_rx_find_active() will incorrectly find a
+match, leading to a NULL pointer dereference in rx_timer_fn() later.
+
+Use zero instead, which is the same value as after driver
+initialization.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 5550289e6678b..9e1a6af23ca2b 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1359,7 +1359,7 @@ fail:
+ 		dmaengine_terminate_async(chan);
+ 	for (i = 0; i < 2; i++)
+ 		s->cookie_rx[i] = -EINVAL;
+-	s->active_rx = -EINVAL;
++	s->active_rx = 0;
+ 	s->chan_rx = NULL;
+ 	sci_start_rx(port);
+ 	if (!port_lock_held)
+-- 
+2.20.1
+
diff --git a/queue-4.19/series b/queue-4.19/series
new file mode 100644
index 00000000000..d43467b5b4d
--- /dev/null
+++ b/queue-4.19/series
@@ -0,0 +1,263 @@
+clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
+clocksource-drivers-mediatek-fix-error-handling.patch
+asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
+asoc-compress-fix-unsigned-integer-overflow-check.patch
+reset-fix-memory-leak-in-reset_control_array_put.patch
+clk-samsung-exynos5433-fix-error-paths.patch
+asoc-kirkwood-fix-external-clock-probe-defer.patch
+asoc-kirkwood-fix-device-remove-ordering.patch
+clk-samsung-exynos5420-preserve-pll-configuration-du.patch
+pinctrl-cherryview-allocate-irq-chip-dynamic.patch
+arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch
+reset-fix-reset_control_ops-kerneldoc-comment.patch
+clk-at91-avoid-sleeping-early.patch
+clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch
+clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
+arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch
+samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch
+powerpc-bpf-fix-tail-call-implementation.patch
+idr-fix-integer-overflow-in-idr_for_each_entry.patch
+idr-fix-idr_alloc_u32-on-32-bit-systems.patch
+x86-resctrl-prevent-null-pointer-dereference-when-re.patch
+clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
+clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch
+net-fec-add-missed-clk_disable_unprepare-in-remove.patch
+bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
+can-peak_usb-report-bus-recovery-as-well.patch
+can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
+can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
+can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
+can-rx-offload-can_rx_offload_offload_one-increment-.patch
+can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
+can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
+can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
+can-flexcan-increase-error-counters-if-skb-enqueuein.patch
+can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch
+watchdog-meson-fix-the-wrong-value-of-left-time.patch
+asoc-stm32-sai-add-restriction-on-mmap-support.patch
+scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
+net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch
+net-bcmgenet-reapply-manual-settings-to-the-phy.patch
+net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch
+ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
+net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch
+mac80211-fix-station-inactive_time-shortly-after-boo.patch
+block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
+pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
+scsi-target-tcmu-fix-queue_cmd_ring-declaration.patch
+scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch
+scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
+arm64-dts-marvell-armada-37xx-enable-emmc-on-espress.patch
+arm-dts-fix-up-sq201-flash-access.patch
+tracing-lock-event_mutex-before-synth_event_mutex.patch
+arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
+arm-dts-imx51-fix-memory-node-duplication.patch
+arm-dts-imx53-fix-memory-node-duplication.patch
+arm-dts-imx31-fix-memory-node-duplication.patch
+arm-dts-imx35-fix-memory-node-duplication.patch
+arm-dts-imx7-fix-memory-node-duplication.patch
+arm-dts-imx6ul-fix-memory-node-duplication.patch
+arm-dts-imx6sx-fix-memory-node-duplication.patch
+arm-dts-imx6sl-fix-memory-node-duplication.patch
+arm-dts-imx50-fix-memory-node-duplication.patch
+arm-dts-imx23-fix-memory-node-duplication.patch
+arm-dts-imx1-fix-memory-node-duplication.patch
+arm-dts-imx27-fix-memory-node-duplication.patch
+arm-dts-imx25-fix-memory-node-duplication.patch
+arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
+parisc-fix-serio-address-output.patch
+parisc-fix-hp-sdc-hpa-address-output.patch
+arm-dts-fix-hsi-gdd-range-for-omap4.patch
+arm64-mm-prevent-mismatched-52-bit-va-support.patch
+arm64-smp-handle-errors-reported-by-the-firmware.patch
+bus-ti-sysc-check-for-no-reset-and-no-idle-flags-at-.patch
+platform-x86-mlx-platform-fix-led-configuration.patch
+arm-omap1-fix-usb-configuration-for-device-only-setu.patch
+rdma-hns-fix-the-bug-while-use-multi-hop-of-pbl.patch
+arm64-preempt-fix-big-endian-when-checking-preempt-c.patch
+rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch
+pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
+xfs-zero-length-symlinks-are-not-valid.patch
+arm-ks8695-fix-section-mismatch-warning.patch
+acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
+scsi-lpfc-enable-management-features-for-if_type-6.patch
+scsi-qla2xxx-fix-npiv-handling-for-fc-nvme.patch
+scsi-qla2xxx-fix-for-fc-nvme-discovery-for-npiv-port.patch
+nvme-provide-fallback-for-discard-alloc-failure.patch
+s390-zcrypt-make-sysfs-reset-attribute-trigger-queue.patch
+crypto-user-support-incremental-algorithm-dumps.patch
+arm64-dts-renesas-draak-fix-cvbs-input.patch
+mwifiex-fix-potential-null-dereference-and-use-after.patch
+mwifiex-debugfs-correct-histogram-spacing-formatting.patch
+brcmfmac-set-f2-watermark-to-256-for-4373.patch
+brcmfmac-set-sdio-f1-mesbusyctrl-for-cyw4373.patch
+rtl818x-fix-potential-use-after-free.patch
+bcache-do-not-check-if-debug-dentry-is-err-or-null-e.patch
+bcache-do-not-mark-writeback_running-too-early.patch
+xfs-require-both-realtime-inodes-to-mount.patch
+nvme-fix-kernel-paging-oops.patch
+ubifs-fix-default-compression-selection-in-ubifs.patch
+ubi-put-mtd-device-after-it-is-not-used.patch
+ubi-do-not-drop-ubi-device-reference-before-using.patch
+microblaze-adjust-the-help-to-the-real-behavior.patch
+microblaze-move-.-is-ready-messages-to-arch-microbla.patch
+microblaze-fix-multiple-bugs-in-arch-microblaze-boot.patch
+iwlwifi-move-iwl_nvm_check_version-into-dvm.patch
+iwlwifi-mvm-force-tcm-re-evaluation-on-tcm-resume.patch
+iwlwifi-pcie-fix-erroneous-print.patch
+iwlwifi-pcie-set-cmd_len-in-the-correct-place.patch
+gpio-pca953x-fix-ai-overflow-on-pcal6524.patch
+gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
+kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch
+crypto-chelsio-chtls-listen-fails-with-multiadapt.patch
+vsock-bind-to-random-port-for-vmaddr_port_any.patch
+mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch
+mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
+usb-ehci-omap-fix-deferred-probe-for-phy-handling.patch
+btrfs-check-for-missing-device-before-bio-submission.patch
+btrfs-fix-ncopies-raid_attr-for-raid56.patch
+btrfs-dev-replace-set-result-code-of-cancel-by-statu.patch
+btrfs-allow-clear_extent_dirty-to-receive-a-cached-e.patch
+btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
+serial-sh-sci-fix-crash-in-rx_timer_fn-on-pio-fallba.patch
+hid-intel-ish-hid-fixes-incorrect-error-handling.patch
+gpio-raspberrypi-exp-decrease-refcount-on-firmware-d.patch
+serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch
+kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch
+xen-pciback-check-dev_data-before-using-it.patch
+kprobes-blacklist-symbols-in-arch-defined-prohibited.patch
+kprobes-x86-show-x86-64-specific-blacklisted-symbols.patch
+vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch
+memory-omap-gpmc-get-the-header-of-the-enum.patch
+pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
+net-mlx5-continue-driver-initialization-despite-debu.patch
+netfilter-nf_nat_sip-fix-rtp-rtcp-source-port-transl.patch
+exofs_mount-fix-leaks-on-failure-exits.patch
+bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch
+bnxt_en-save-ring-statistics-before-reset.patch
+bnxt_en-query-force-speeds-before-disabling-autoneg-.patch
+kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
+pinctrl-sh-pfc-r8a77990-fix-mod_sel0-sel_i2c1-field-.patch
+pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
+pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
+hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
+dm-flakey-properly-corrupt-multi-page-bios.patch
+gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
+dm-raid-fix-false-ebusy-when-handling-check-repair-m.patch
+xfs-align-compat-attrlist_by_handle-with-native-impl.patch
+xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
+ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
+clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch
+vxlan-fix-error-path-in-__vxlan_dev_create.patch
+powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
+powerpc-xmon-fix-dump_segments.patch
+drivers-regulator-fix-a-missing-check-of-return-valu.patch
+bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch
+serial-max310x-fix-tx_empty-callback.patch
+openrisc-fix-broken-paths-to-arch-or32.patch
+rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
+scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
+scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
+brcmfmac-fix-access-point-mode.patch
+ath6kl-only-use-match-sets-when-firmware-supports-it.patch
+ath6kl-fix-off-by-one-error-in-scan-completion.patch
+powerpc-perf-fix-unit_sel-cache_sel-checks.patch
+powerpc-32-avoid-unsupported-flags-with-clang.patch
+powerpc-prom-fix-early-debug-messages.patch
+powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
+powerpc-44x-bamboo-fix-pci-range.patch
+vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
+powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
+drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
+drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
+drbd-do-not-block-when-adjusting-disk-options-while-.patch
+drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
+ib-rxe-make-counters-thread-safe.patch
+bpf-cpumap-make-sure-frame_size-for-build_skb-is-ali.patch
+regulator-tps65910-fix-a-missing-check-of-return-val.patch
+powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
+powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
+powerpc-fix-hmis-on-big-endian-with-config_relocatab.patch
+crypto-mxc-scc-fix-build-warnings-on-arm64.patch
+pwm-clps711x-fix-period-calculation.patch
+net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch
+net-net_namespace-check-the-return-value-of-register.patch
+f2fs-fix-block-address-for-__check_sit_bitmap.patch
+f2fs-fix-to-dirty-inode-synchronously.patch
+um-include-sys-uio.h-to-have-writev.patch
+um-make-gcov-depend-on-kcov.patch
+net-cpts-fix-a-missing-check-of-clk_prepare.patch
+net-stmicro-fix-a-missing-check-of-clk_prepare.patch
+net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
+atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
+tipc-fix-a-missing-check-of-genlmsg_put.patch
+net-marvell-fix-a-missing-check-of-acpi_match_device.patch
+net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
+ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
+vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
+mm-page_alloc.c-free-order-0-pages-through-pcp-in-pa.patch
+mm-page_alloc.c-use-a-single-function-to-free-page.patch
+mm-page_alloc.c-deduplicate-__memblock_free_early-an.patch
+tools-vm-page-types.c-fix-kpagecount-returned-fewer-.patch
+netfilter-nf_tables-fix-a-missing-check-of-nla_put_f.patch
+xprtrdma-prevent-leak-of-rpcrdma_rep-objects.patch
+infiniband-bnxt_re-qplib-check-the-return-value-of-s.patch
+infiniband-qedr-potential-null-ptr-dereference-of-qp.patch
+firmware-arm_sdei-fix-wrong-of_node_put-in-init-func.patch
+firmware-arm_sdei-fix-dt-platform-device-creation.patch
+lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
+lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
+fork-fix-some-wmissing-prototypes-warnings.patch
+drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
+lib-genalloc.c-include-vmalloc.h.patch
+mtd-check-add_mtd_device-ret-code.patch
+tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
+net-core-neighbour-tell-kmemleak-about-hash-tables.patch
+ata-ahci-mvebu-do-armada-38x-configuration-only-on-r.patch
+pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch
+net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
+serial-8250-fix-serial8250-initialization-crash.patch
+gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch
+sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
+ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
+decnet-fix-dn_ifreq_size.patch
+net-smc-prevent-races-between-smc_lgr_terminate-and-.patch
+net-smc-don-t-wait-for-send-buffer-space-when-data-w.patch
+mm-hotplug-invalid-pfns-from-pfn_to_online_page.patch
+xfs-end-sync-buffer-i-o-properly-on-shutdown-error.patch
+net-smc-fix-sender_free-computation.patch
+blktrace-show-requests-without-sector.patch
+net-smc-fix-byte_order-for-rx_curs_confirmed.patch
+tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
+asoc-samsung-i2s-fix-prescaler-setting-for-the-secon.patch
+sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
+geneve-change-net_udp_tunnel-dependency-to-select.patch
+net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
+net-ip_gre-do-not-report-erspan_ver-for-gre-or-greta.patch
+net-ip6_gre-do-not-report-erspan_ver-for-ip6gre-or-i.patch
+sctp-don-t-compare-hb_timer-expire-date-before-start.patch
+bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch
+mmc-core-align-max-segment-size-with-logical-block-s.patch
+net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
+kvm-properly-check-debugfs-dentry-before-using-it.patch
+bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch
+net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch
+net-hns3-fix-pfc-not-setting-problem-for-dcb-module.patch
+net-hns3-fix-an-issue-for-hclgevf_ae_get_hdev.patch
+net-hns3-fix-an-issue-for-hns3_update_new_int_gl.patch
+iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
+apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch
+scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
+acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch
+acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
+scsi-hisi_sas-shutdown-axi-bus-to-avoid-exception-cq.patch
+scsi-libsas-check-smp-phy-control-function-result.patch
+rdma-hns-fix-the-bug-with-updating-rq-head-pointer-w.patch
+rdma-hns-bugfix-for-the-scene-without-receiver-queue.patch
+rdma-hns-fix-the-state-of-rereg-mr.patch
+rdma-hns-use-gfp_atomic-in-hns_roce_v2_modify_qp.patch
+asoc-rt5645-headphone-jack-sense-inverts-on-the-latt.patch
+f2fs-fix-to-data-block-override-node-segment-by-mist.patch
+powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
+xdp-fix-cpumap-redirect-skb-creation-bug.patch
+mtd-remove-a-debug-trace-in-mtdpart.c.patch
diff --git a/queue-4.19/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch b/queue-4.19/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
new file mode 100644
index 00000000000..69bf6f23d76
--- /dev/null
+++ b/queue-4.19/sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
@@ -0,0 +1,37 @@
+From 983b94a5dc05e3538327f0f7af79cad042eedf73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 13:10:00 +0000
+Subject: sfc: initialise found bitmap in efx_ef10_mtd_probe
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit c65285428b6e7797f1bb063f33b0ae7e93397b7b ]
+
+The bitmap of found partitions in efx_ef10_mtd_probe was not
+initialised, causing partitions to be suppressed based off whatever
+value was in the bitmap at the start.
+
+Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index a497aace7e4f4..1f971d31ec302 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6108,7 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ 	MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+-	DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
++	DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
+ 	struct efx_mcdi_mtd_partition *parts;
+ 	size_t outlen, n_parts_total, i, n_parts;
+ 	unsigned int type;
+-- 
+2.20.1
+
diff --git a/queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch b/queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
new file mode 100644
index 00000000000..cd6e873bae8
--- /dev/null
+++ b/queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
@@ -0,0 +1,100 @@
+From cb2d06da17365471ab7bf973b1f334abb7829bc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 19:02:17 +0000
+Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
+
+From: Edward Cree <ecree@solarflare.com>
+
+[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ]
+
+Use a bitmap to keep track of which partition types we've already seen;
+ for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and
+ thus skip adding that partition.
+Duplicate partitions occur because of the A/B backup scheme used by newer
+ sfc NICs.  Prior to this patch they cause sysfs_warn_dup errors because
+ they have the same name, causing us not to expose any MTDs at all.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 7eeac3d6cfe89..a497aace7e4f4 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6042,22 +6042,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ 	{ NVRAM_PARTITION_TYPE_LICENSE,		   0,    0, "sfc_license" },
+ 	{ NVRAM_PARTITION_TYPE_PHY_MIN,		   0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT	ARRAY_SIZE(efx_ef10_nvram_types)
+ 
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ 					struct efx_mcdi_mtd_partition *part,
+-					unsigned int type)
++					unsigned int type,
++					unsigned long *found)
+ {
+ 	MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ 	MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ 	const struct efx_ef10_nvram_type_info *info;
+ 	size_t size, erase_size, outlen;
++	int type_idx = 0;
+ 	bool protected;
+ 	int rc;
+ 
+-	for (info = efx_ef10_nvram_types; ; info++) {
+-		if (info ==
+-		    efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++	for (type_idx = 0; ; type_idx++) {
++		if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ 			return -ENODEV;
++		info = efx_ef10_nvram_types + type_idx;
+ 		if ((type & ~info->type_mask) == info->type)
+ 			break;
+ 	}
+@@ -6070,6 +6073,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ 	if (protected)
+ 		return -ENODEV; /* hide it */
+ 
++	/* If we've already exposed a partition of this type, hide this
++	 * duplicate.  All operations on MTDs are keyed by the type anyway,
++	 * so we can't act on the duplicate.
++	 */
++	if (__test_and_set_bit(type_idx, found))
++		return -EEXIST;
++
+ 	part->nvram_type = type;
+ 
+ 	MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -6098,6 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ 	MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++	DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+ 	struct efx_mcdi_mtd_partition *parts;
+ 	size_t outlen, n_parts_total, i, n_parts;
+ 	unsigned int type;
+@@ -6126,11 +6137,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ 	for (i = 0; i < n_parts_total; i++) {
+ 		type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ 					i);
+-		rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+-		if (rc == 0)
+-			n_parts++;
+-		else if (rc != -ENODEV)
++		rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++						  found);
++		if (rc == -EEXIST || rc == -ENODEV)
++			continue;
++		if (rc)
+ 			goto fail;
++		n_parts++;
+ 	}
+ 
+ 	rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-fix-a-missing-check-of-genlmsg_put.patch b/queue-4.19/tipc-fix-a-missing-check-of-genlmsg_put.patch
new file mode 100644
index 00000000000..ab498304e07
--- /dev/null
+++ b/queue-4.19/tipc-fix-a-missing-check-of-genlmsg_put.patch
@@ -0,0 +1,35 @@
+From 03fc11d867f429facf5922d898b7d2bf4c073010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:09:04 -0600
+Subject: tipc: fix a missing check of genlmsg_put
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 ]
+
+genlmsg_put could fail. The fix inserts a check of its return value, and
+if it fails, returns -EMSGSIZE.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 6494d6b5e1b24..fab0384d2b4b3 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -983,6 +983,8 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+ 
+ 	hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ 			  TIPC_NL_PUBL_GET);
++	if (!hdr)
++		return -EMSGSIZE;
+ 
+ 	nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ 	if (!nest) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch b/queue-4.19/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
new file mode 100644
index 00000000000..55dbf1a0bad
--- /dev/null
+++ b/queue-4.19/tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
@@ -0,0 +1,42 @@
+From 4df94008dc3e717b41a04774d3dcf2e521e8fa6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 10:52:23 -0600
+Subject: tipc: fix memory leak in tipc_nl_compat_publ_dump
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit f87d8ad9233f115db92c6c087d58403b0009ed36 ]
+
+There is a memory leak in case genlmsg_put fails.
+
+Fix this by freeing *args* before return.
+
+Addresses-Coverity-ID: 1476406 ("Resource leak")
+Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index fab0384d2b4b3..b4860084a8f56 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -983,8 +983,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+ 
+ 	hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ 			  TIPC_NL_PUBL_GET);
+-	if (!hdr)
++	if (!hdr) {
++		kfree_skb(args);
+ 		return -EMSGSIZE;
++	}
+ 
+ 	nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ 	if (!nest) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch b/queue-4.19/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
new file mode 100644
index 00000000000..70221d397a9
--- /dev/null
+++ b/queue-4.19/tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
@@ -0,0 +1,48 @@
+From 84768ca2b05768ceed502c0c9418222a17944854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 09:18:28 +0700
+Subject: tipc: fix skb may be leaky in tipc_link_input
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ]
+
+When we free skb at tipc_data_input, we return a 'false' boolean.
+Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,
+
+<snip>
+1303 int tipc_link_rcv:
+...
+1354    if (!tipc_data_input(l, skb, l->inputq))
+1355        rc |= tipc_link_input(l, skb, l->inputq);
+</snip>
+
+Fix it by simple changing to a 'true' boolean when skb is being free-ed.
+Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
+condition.
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <maloy@donjonn.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 6344aca4487b6..0fbf8ea18ce04 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1114,7 +1114,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
+ 	default:
+ 		pr_warn("Dropping received illegal msg type\n");
+ 		kfree_skb(skb);
+-		return false;
++		return true;
+ 	};
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/tools-vm-page-types.c-fix-kpagecount-returned-fewer-.patch b/queue-4.19/tools-vm-page-types.c-fix-kpagecount-returned-fewer-.patch
new file mode 100644
index 00000000000..0ecfe913b94
--- /dev/null
+++ b/queue-4.19/tools-vm-page-types.c-fix-kpagecount-returned-fewer-.patch
@@ -0,0 +1,44 @@
+From f670bac067f9ab6e70ab148603d5c41cdab881c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:37:27 -0800
+Subject: tools/vm/page-types.c: fix "kpagecount returned fewer pages than
+ expected" failures
+
+From: Anthony Yznaga <anthony.yznaga@oracle.com>
+
+[ Upstream commit b6fb87b8e3ff1ef6bcf68470f24a97c984554d5a ]
+
+Because kpagecount_read() fakes success if map counts are not being
+collected, clamp the page count passed to it by walk_pfn() to the pages
+value returned by the preceding call to kpageflags_read().
+
+Link: http://lkml.kernel.org/r/1543962269-26116-1-git-send-email-anthony.yznaga@oracle.com
+Fixes: 7f1d23e60718 ("tools/vm/page-types.c: include shared map counts")
+Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/vm/page-types.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index 37908a83ddc27..1ff3a6c0367b0 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -701,7 +701,7 @@ static void walk_pfn(unsigned long voffset,
+ 		if (kpagecgroup_read(cgi, index, pages) != pages)
+ 			fatal("kpagecgroup returned fewer pages than expected");
+ 
+-		if (kpagecount_read(cnt, index, batch) != pages)
++		if (kpagecount_read(cnt, index, pages) != pages)
+ 			fatal("kpagecount returned fewer pages than expected");
+ 
+ 		for (i = 0; i < pages; i++)
+-- 
+2.20.1
+
diff --git a/queue-4.19/tracing-lock-event_mutex-before-synth_event_mutex.patch b/queue-4.19/tracing-lock-event_mutex-before-synth_event_mutex.patch
new file mode 100644
index 00000000000..199d076ccdb
--- /dev/null
+++ b/queue-4.19/tracing-lock-event_mutex-before-synth_event_mutex.patch
@@ -0,0 +1,234 @@
+From df40fa2e4a4b41cdbc312b4d6a529cd36c081e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 18:00:43 +0900
+Subject: tracing: Lock event_mutex before synth_event_mutex
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fc800a10be26017f8f338bc8e500d48e3e6429d9 ]
+
+synthetic event is using synth_event_mutex for protecting
+synth_event_list, and event_trigger_write() path acquires
+locks as below order.
+
+event_trigger_write(event_mutex)
+  ->trigger_process_regex(trigger_cmd_mutex)
+    ->event_hist_trigger_func(synth_event_mutex)
+
+On the other hand, synthetic event creation and deletion paths
+call trace_add_event_call() and trace_remove_event_call()
+which acquires event_mutex. In that case, if we keep the
+synth_event_mutex locked while registering/unregistering synthetic
+events, its dependency will be inversed.
+
+To avoid this issue, current synthetic event is using a 2 phase
+process to create/delete events. For example, it searches existing
+events under synth_event_mutex to check for event-name conflicts, and
+unlocks synth_event_mutex, then registers a new event under event_mutex
+locked. Finally, it locks synth_event_mutex and tries to add the
+new event to the list. But it can introduce complexity and a chance
+for name conflicts.
+
+To solve this simpler, this introduces trace_add_event_call_nolock()
+and trace_remove_event_call_nolock() which don't acquire
+event_mutex inside. synthetic event can lock event_mutex before
+synth_event_mutex to solve the lock dependency issue simpler.
+
+Link: http://lkml.kernel.org/r/154140844377.17322.13781091165954002713.stgit@devbox
+
+Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Tested-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/trace_events.h     |  2 ++
+ kernel/trace/trace_events.c      | 34 ++++++++++++++++++++++++++------
+ kernel/trace/trace_events_hist.c | 24 ++++++++++------------
+ 3 files changed, 40 insertions(+), 20 deletions(-)
+
+diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
+index 78a010e19ed41..0643c083ed862 100644
+--- a/include/linux/trace_events.h
++++ b/include/linux/trace_events.h
+@@ -529,6 +529,8 @@ extern int trace_event_raw_init(struct trace_event_call *call);
+ extern int trace_define_field(struct trace_event_call *call, const char *type,
+ 			      const char *name, int offset, int size,
+ 			      int is_signed, int filter_type);
++extern int trace_add_event_call_nolock(struct trace_event_call *call);
++extern int trace_remove_event_call_nolock(struct trace_event_call *call);
+ extern int trace_add_event_call(struct trace_event_call *call);
+ extern int trace_remove_event_call(struct trace_event_call *call);
+ extern int trace_event_get_offsets(struct trace_event_call *call);
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 7345f5f8f3fe6..017f737237e60 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2302,11 +2302,11 @@ __trace_early_add_new_event(struct trace_event_call *call,
+ struct ftrace_module_file_ops;
+ static void __add_event_to_tracers(struct trace_event_call *call);
+ 
+-/* Add an additional event_call dynamically */
+-int trace_add_event_call(struct trace_event_call *call)
++int trace_add_event_call_nolock(struct trace_event_call *call)
+ {
+ 	int ret;
+-	mutex_lock(&event_mutex);
++	lockdep_assert_held(&event_mutex);
++
+ 	mutex_lock(&trace_types_lock);
+ 
+ 	ret = __register_event(call, NULL);
+@@ -2314,6 +2314,16 @@ int trace_add_event_call(struct trace_event_call *call)
+ 		__add_event_to_tracers(call);
+ 
+ 	mutex_unlock(&trace_types_lock);
++	return ret;
++}
++
++/* Add an additional event_call dynamically */
++int trace_add_event_call(struct trace_event_call *call)
++{
++	int ret;
++
++	mutex_lock(&event_mutex);
++	ret = trace_add_event_call_nolock(call);
+ 	mutex_unlock(&event_mutex);
+ 	return ret;
+ }
+@@ -2363,17 +2373,29 @@ static int probe_remove_event_call(struct trace_event_call *call)
+ 	return 0;
+ }
+ 
+-/* Remove an event_call */
+-int trace_remove_event_call(struct trace_event_call *call)
++/* no event_mutex version */
++int trace_remove_event_call_nolock(struct trace_event_call *call)
+ {
+ 	int ret;
+ 
+-	mutex_lock(&event_mutex);
++	lockdep_assert_held(&event_mutex);
++
+ 	mutex_lock(&trace_types_lock);
+ 	down_write(&trace_event_sem);
+ 	ret = probe_remove_event_call(call);
+ 	up_write(&trace_event_sem);
+ 	mutex_unlock(&trace_types_lock);
++
++	return ret;
++}
++
++/* Remove an event_call */
++int trace_remove_event_call(struct trace_event_call *call)
++{
++	int ret;
++
++	mutex_lock(&event_mutex);
++	ret = trace_remove_event_call_nolock(call);
+ 	mutex_unlock(&event_mutex);
+ 
+ 	return ret;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index dac518977e7d0..11d952650fa72 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -914,7 +914,7 @@ static int register_synth_event(struct synth_event *event)
+ 	call->data = event;
+ 	call->tp = event->tp;
+ 
+-	ret = trace_add_event_call(call);
++	ret = trace_add_event_call_nolock(call);
+ 	if (ret) {
+ 		pr_warn("Failed to register synthetic event: %s\n",
+ 			trace_event_name(call));
+@@ -938,7 +938,7 @@ static int unregister_synth_event(struct synth_event *event)
+ 	struct trace_event_call *call = &event->call;
+ 	int ret;
+ 
+-	ret = trace_remove_event_call(call);
++	ret = trace_remove_event_call_nolock(call);
+ 
+ 	return ret;
+ }
+@@ -1015,12 +1015,10 @@ static void add_or_delete_synth_event(struct synth_event *event, int delete)
+ 	if (delete)
+ 		free_synth_event(event);
+ 	else {
+-		mutex_lock(&synth_event_mutex);
+ 		if (!find_synth_event(event->name))
+ 			list_add(&event->list, &synth_event_list);
+ 		else
+ 			free_synth_event(event);
+-		mutex_unlock(&synth_event_mutex);
+ 	}
+ }
+ 
+@@ -1032,6 +1030,7 @@ static int create_synth_event(int argc, char **argv)
+ 	int i, consumed = 0, n_fields = 0, ret = 0;
+ 	char *name;
+ 
++	mutex_lock(&event_mutex);
+ 	mutex_lock(&synth_event_mutex);
+ 
+ 	/*
+@@ -1104,8 +1103,6 @@ static int create_synth_event(int argc, char **argv)
+ 		goto err;
+ 	}
+  out:
+-	mutex_unlock(&synth_event_mutex);
+-
+ 	if (event) {
+ 		if (delete_event) {
+ 			ret = unregister_synth_event(event);
+@@ -1115,10 +1112,13 @@ static int create_synth_event(int argc, char **argv)
+ 			add_or_delete_synth_event(event, ret);
+ 		}
+ 	}
++	mutex_unlock(&synth_event_mutex);
++	mutex_unlock(&event_mutex);
+ 
+ 	return ret;
+  err:
+ 	mutex_unlock(&synth_event_mutex);
++	mutex_unlock(&event_mutex);
+ 
+ 	for (i = 0; i < n_fields; i++)
+ 		free_synth_field(fields[i]);
+@@ -1129,12 +1129,10 @@ static int create_synth_event(int argc, char **argv)
+ 
+ static int release_all_synth_events(void)
+ {
+-	struct list_head release_events;
+ 	struct synth_event *event, *e;
+ 	int ret = 0;
+ 
+-	INIT_LIST_HEAD(&release_events);
+-
++	mutex_lock(&event_mutex);
+ 	mutex_lock(&synth_event_mutex);
+ 
+ 	list_for_each_entry(event, &synth_event_list, list) {
+@@ -1144,16 +1142,14 @@ static int release_all_synth_events(void)
+ 		}
+ 	}
+ 
+-	list_splice_init(&event->list, &release_events);
+-
+-	mutex_unlock(&synth_event_mutex);
+-
+-	list_for_each_entry_safe(event, e, &release_events, list) {
++	list_for_each_entry_safe(event, e, &synth_event_list, list) {
+ 		list_del(&event->list);
+ 
+ 		ret = unregister_synth_event(event);
+ 		add_or_delete_synth_event(event, !ret);
+ 	}
++	mutex_unlock(&synth_event_mutex);
++	mutex_unlock(&event_mutex);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/ubi-do-not-drop-ubi-device-reference-before-using.patch b/queue-4.19/ubi-do-not-drop-ubi-device-reference-before-using.patch
new file mode 100644
index 00000000000..fff32a7d355
--- /dev/null
+++ b/queue-4.19/ubi-do-not-drop-ubi-device-reference-before-using.patch
@@ -0,0 +1,41 @@
+From b83a0a7db50129280676531ce68d266fe4c60ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 11:20:03 +0800
+Subject: ubi: Do not drop UBI device reference before using
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e542087701f09418702673631a908429feb3eae0 ]
+
+The UBI device reference is dropped but then the device is used as a
+parameter of ubi_err. The bug is introduced in changing ubi_err's
+behavior. The old ubi_err does not require a UBI device as its first
+parameter, but the new one does.
+
+Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/kapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index e9e9ecbcedcc3..0b8f0c46268da 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -227,9 +227,9 @@ out_unlock:
+ out_free:
+ 	kfree(desc);
+ out_put_ubi:
+-	ubi_put_device(ubi);
+ 	ubi_err(ubi, "cannot open device %d, volume %d, error %d",
+ 		ubi_num, vol_id, err);
++	ubi_put_device(ubi);
+ 	return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(ubi_open_volume);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ubi-put-mtd-device-after-it-is-not-used.patch b/queue-4.19/ubi-put-mtd-device-after-it-is-not-used.patch
new file mode 100644
index 00000000000..0079ec8a32a
--- /dev/null
+++ b/queue-4.19/ubi-put-mtd-device-after-it-is-not-used.patch
@@ -0,0 +1,40 @@
+From 0b8b3ccb11c36f81f52c37942283ac153e3e2134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:57:33 +0800
+Subject: ubi: Put MTD device after it is not used
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit b95f83ab762dd6211351b9140f99f43644076ca8 ]
+
+The MTD device reference is dropped via put_mtd_device, however its
+field ->index is read and passed to ubi_msg. To fix this, the patch
+moves the reference dropping after calling ubi_msg.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index d2a726654ff11..c120c8761fcd2 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1101,10 +1101,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ 	ubi_wl_close(ubi);
+ 	ubi_free_internal_volumes(ubi);
+ 	vfree(ubi->vtbl);
+-	put_mtd_device(ubi->mtd);
+ 	vfree(ubi->peb_buf);
+ 	vfree(ubi->fm_buf);
+ 	ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
++	put_mtd_device(ubi->mtd);
+ 	put_device(&ubi->dev);
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/ubifs-fix-default-compression-selection-in-ubifs.patch b/queue-4.19/ubifs-fix-default-compression-selection-in-ubifs.patch
new file mode 100644
index 00000000000..d3dca22e0cf
--- /dev/null
+++ b/queue-4.19/ubifs-fix-default-compression-selection-in-ubifs.patch
@@ -0,0 +1,56 @@
+From 9d65242f1aa336d359820dd6327893fcc5219e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Dec 2018 18:12:13 +0100
+Subject: ubifs: Fix default compression selection in ubifs
+
+From: Gabor Juhos <juhosg@openwrt.org>
+
+[ Upstream commit d62e98ed1efcaa94caa004f622944afdce5f1c3c ]
+
+When ubifs is build without the LZO compressor and no compressor is
+given the creation of the default file system will fail. before
+selection the LZO compressor check if it is present and if not fall back
+to the zlib or none.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/sb.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
+index bf17f58908ff9..11dc3977fb64f 100644
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -63,6 +63,17 @@
+ /* Default time granularity in nanoseconds */
+ #define DEFAULT_TIME_GRAN 1000000000
+ 
++static int get_default_compressor(struct ubifs_info *c)
++{
++	if (ubifs_compr_present(c, UBIFS_COMPR_LZO))
++		return UBIFS_COMPR_LZO;
++
++	if (ubifs_compr_present(c, UBIFS_COMPR_ZLIB))
++		return UBIFS_COMPR_ZLIB;
++
++	return UBIFS_COMPR_NONE;
++}
++
+ /**
+  * create_default_filesystem - format empty UBI volume.
+  * @c: UBIFS file-system description object
+@@ -186,7 +197,7 @@ static int create_default_filesystem(struct ubifs_info *c)
+ 	if (c->mount_opts.override_compr)
+ 		sup->default_compr = cpu_to_le16(c->mount_opts.compr_type);
+ 	else
+-		sup->default_compr = cpu_to_le16(UBIFS_COMPR_LZO);
++		sup->default_compr = cpu_to_le16(get_default_compressor(c));
+ 
+ 	generate_random_uuid(sup->uuid);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/um-include-sys-uio.h-to-have-writev.patch b/queue-4.19/um-include-sys-uio.h-to-have-writev.patch
new file mode 100644
index 00000000000..bd572b2321d
--- /dev/null
+++ b/queue-4.19/um-include-sys-uio.h-to-have-writev.patch
@@ -0,0 +1,34 @@
+From 604a8bbc11f0216649456704838f818ff9cbe901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:11 +0100
+Subject: um: Include sys/uio.h to have writev()
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 0053102a869f1b909904b1b85ac282e2744deaab ]
+
+sys/uio.h gives us writev(), otherwise the build might fail on
+some systems.
+
+Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/vector_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
+index 4d6a78e31089f..00c4c2735a5f7 100644
+--- a/arch/um/drivers/vector_user.c
++++ b/arch/um/drivers/vector_user.c
+@@ -30,6 +30,7 @@
+ #include <stdlib.h>
+ #include <os.h>
+ #include <um_malloc.h>
++#include <sys/uio.h>
+ #include "vector_user.h"
+ 
+ #define ID_GRE 0
+-- 
+2.20.1
+
diff --git a/queue-4.19/um-make-gcov-depend-on-kcov.patch b/queue-4.19/um-make-gcov-depend-on-kcov.patch
new file mode 100644
index 00000000000..c8c2741742a
--- /dev/null
+++ b/queue-4.19/um-make-gcov-depend-on-kcov.patch
@@ -0,0 +1,34 @@
+From cae72101138b77573e14564edf86928a68740b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:12 +0100
+Subject: um: Make GCOV depend on !KCOV
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 550ed0e2036663b35cec12374b835444f9c60454 ]
+
+Both do more or less the same thing and are mutually exclusive.
+If both are enabled the build will fail.
+Sooner or later we can kill UML's GCOV.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug
+index 2014597605ea9..85726eeec3451 100644
+--- a/arch/um/Kconfig.debug
++++ b/arch/um/Kconfig.debug
+@@ -16,6 +16,7 @@ config GPROF
+ config GCOV
+ 	bool "Enable gcov support"
+ 	depends on DEBUG_INFO
++	depends on !KCOV
+ 	help
+ 	  This option allows developers to retrieve coverage data from a UML
+ 	  session.
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-ehci-omap-fix-deferred-probe-for-phy-handling.patch b/queue-4.19/usb-ehci-omap-fix-deferred-probe-for-phy-handling.patch
new file mode 100644
index 00000000000..8e6204ba8e8
--- /dev/null
+++ b/queue-4.19/usb-ehci-omap-fix-deferred-probe-for-phy-handling.patch
@@ -0,0 +1,56 @@
+From 68a535ede8dd925e923a79b447491ab52327a7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 11:36:15 +0200
+Subject: usb: ehci-omap: Fix deferred probe for phy handling
+
+From: Roger Quadros <rogerq@ti.com>
+
+[ Upstream commit 8dc7623bf608495b6e6743e805807c7840673573 ]
+
+PHY model is being used on omap5 platforms even if port mode
+is not OMAP_EHCI_PORT_MODE_PHY. So don't guess if PHY is required
+or not based on PHY mode.
+
+If PHY is provided in device tree, it must be required. So, if
+devm_usb_get_phy_by_phandle() gives us an error code other
+than -ENODEV (no PHY) then error out.
+
+This fixes USB Ethernet on omap5-uevm if PHY happens to
+probe after EHCI thus causing a -EPROBE_DEFER.
+
+Cc: Johan Hovold <johan@kernel.org>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-omap.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 7e4c13346a1ee..7d20296cbe9f9 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -159,11 +159,12 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 		/* get the PHY device */
+ 		phy = devm_usb_get_phy_by_phandle(dev, "phys", i);
+ 		if (IS_ERR(phy)) {
+-			/* Don't bail out if PHY is not absolutely necessary */
+-			if (pdata->port_mode[i] != OMAP_EHCI_PORT_MODE_PHY)
++			ret = PTR_ERR(phy);
++			if (ret == -ENODEV) { /* no PHY */
++				phy = NULL;
+ 				continue;
++			}
+ 
+-			ret = PTR_ERR(phy);
+ 			if (ret != -EPROBE_DEFER)
+ 				dev_err(dev, "Can't get PHY for port %d: %d\n",
+ 					i, ret);
+-- 
+2.20.1
+
diff --git a/queue-4.19/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch b/queue-4.19/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch
new file mode 100644
index 00000000000..44d6acac08b
--- /dev/null
+++ b/queue-4.19/vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch
@@ -0,0 +1,152 @@
+From 182e6ec77ae6a96f07f4cce0ee1d1406d067c7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 11:04:27 -0700
+Subject: vfio-mdev/samples: Use u8 instead of char for handle functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8ba35b3a0046d6573c98f00461d9bd1b86250d35 ]
+
+Clang warns:
+
+samples/vfio-mdev/mtty.c:592:39: warning: implicit conversion from 'int'
+to 'char' changes value from 162 to -94 [-Wconstant-conversion]
+                *buf = UART_MSR_DSR | UART_MSR_DDSR | UART_MSR_DCD;
+                     ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
+1 warning generated.
+
+Turns out that all uses of buf in this function ultimately end up stored
+or cast to an unsigned type. Just use u8, which has the same number of
+bits but can store this larger number so Clang no longer warns.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfio-mdev/mtty.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
+index 7abb79d8313d9..f6732aa16bb1f 100644
+--- a/samples/vfio-mdev/mtty.c
++++ b/samples/vfio-mdev/mtty.c
+@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid)
+ 	return NULL;
+ }
+ 
+-void dump_buffer(char *buf, uint32_t count)
++void dump_buffer(u8 *buf, uint32_t count)
+ {
+ #if defined(DEBUG)
+ 	int i;
+@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state)
+ }
+ 
+ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+-				 char *buf, u32 count)
++				 u8 *buf, u32 count)
+ {
+ 	u32 cfg_addr, bar_mask, bar_index = 0;
+ 
+@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+ }
+ 
+ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+-				u16 offset, char *buf, u32 count)
++				u16 offset, u8 *buf, u32 count)
+ {
+ 	u8 data = *buf;
+ 
+@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+ }
+ 
+ static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state,
+-			    u16 offset, char *buf, u32 count)
++			    u16 offset, u8 *buf, u32 count)
+ {
+ 	/* Handle read requests by guest */
+ 	switch (offset) {
+@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state)
+ 	}
+ }
+ 
+-static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
++static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count,
+ 			   loff_t pos, bool is_write)
+ {
+ 	struct mdev_state *mdev_state;
+@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ 			pr_info("%s: BAR%d  WR @0x%llx %s val:0x%02x dlab:%d\n",
+ 				__func__, index, offset, wr_reg[offset],
+-				(u8)*buf, mdev_state->s[index].dlab);
++				*buf, mdev_state->s[index].dlab);
+ #endif
+ 			handle_bar_write(index, mdev_state, offset, buf, count);
+ 		} else {
+@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ 			pr_info("%s: BAR%d  RD @0x%llx %s val:0x%02x dlab:%d\n",
+ 				__func__, index, offset, rd_reg[offset],
+-				(u8)*buf, mdev_state->s[index].dlab);
++				*buf, mdev_state->s[index].dlab);
+ #endif
+ 		}
+ 		break;
+@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ 		if (count >= 4 && !(*ppos % 4)) {
+ 			u32 val;
+ 
+-			ret =  mdev_access(mdev, (char *)&val, sizeof(val),
++			ret =  mdev_access(mdev, (u8 *)&val, sizeof(val),
+ 					   *ppos, false);
+ 			if (ret <= 0)
+ 				goto read_err;
+@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ 		} else if (count >= 2 && !(*ppos % 2)) {
+ 			u16 val;
+ 
+-			ret = mdev_access(mdev, (char *)&val, sizeof(val),
++			ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ 					  *ppos, false);
+ 			if (ret <= 0)
+ 				goto read_err;
+@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ 		} else {
+ 			u8 val;
+ 
+-			ret = mdev_access(mdev, (char *)&val, sizeof(val),
++			ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ 					  *ppos, false);
+ 			if (ret <= 0)
+ 				goto read_err;
+@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ 			if (copy_from_user(&val, buf, sizeof(val)))
+ 				goto write_err;
+ 
+-			ret = mdev_access(mdev, (char *)&val, sizeof(val),
++			ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ 					  *ppos, true);
+ 			if (ret <= 0)
+ 				goto write_err;
+@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ 			if (copy_from_user(&val, buf, sizeof(val)))
+ 				goto write_err;
+ 
+-			ret = mdev_access(mdev, (char *)&val, sizeof(val),
++			ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ 					  *ppos, true);
+ 			if (ret <= 0)
+ 				goto write_err;
+@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ 			if (copy_from_user(&val, buf, sizeof(val)))
+ 				goto write_err;
+ 
+-			ret = mdev_access(mdev, (char *)&val, sizeof(val),
++			ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ 					  *ppos, true);
+ 			if (ret <= 0)
+ 				goto write_err;
+-- 
+2.20.1
+
diff --git a/queue-4.19/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch b/queue-4.19/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
new file mode 100644
index 00000000000..758f695ef8b
--- /dev/null
+++ b/queue-4.19/vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
@@ -0,0 +1,56 @@
+From a09c251d5dbca41b2932af80bdf6a510e836621a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Oct 2018 13:22:31 +1000
+Subject: vfio/spapr_tce: Get rid of possible infinite loop
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 517ad4ae8aa93dccdb9a88c27257ecb421c9e848 ]
+
+As a part of cleanup, the SPAPR TCE IOMMU subdriver releases preregistered
+memory. If there is a bug in memory release, the loop in
+tce_iommu_release() becomes infinite; this actually happened to me.
+
+This makes the loop finite and prints a warning on every failure to make
+the code more bug prone.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index 96721b154454f..ec53310f16136 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -371,6 +371,7 @@ static void tce_iommu_release(void *iommu_data)
+ {
+ 	struct tce_container *container = iommu_data;
+ 	struct tce_iommu_group *tcegrp;
++	struct tce_iommu_prereg *tcemem, *tmtmp;
+ 	long i;
+ 
+ 	while (tce_groups_attached(container)) {
+@@ -393,13 +394,8 @@ static void tce_iommu_release(void *iommu_data)
+ 		tce_iommu_free_table(container, tbl);
+ 	}
+ 
+-	while (!list_empty(&container->prereg_list)) {
+-		struct tce_iommu_prereg *tcemem;
+-
+-		tcemem = list_first_entry(&container->prereg_list,
+-				struct tce_iommu_prereg, next);
+-		WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem));
+-	}
++	list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next)
++		WARN_ON(tce_iommu_prereg_free(container, tcemem));
+ 
+ 	tce_iommu_disable(container);
+ 	if (container->mm)
+-- 
+2.20.1
+
diff --git a/queue-4.19/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch b/queue-4.19/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
new file mode 100644
index 00000000000..1f6f14636c1
--- /dev/null
+++ b/queue-4.19/vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
@@ -0,0 +1,78 @@
+From 6daaf5612a4ce4ffc7a840f88a06dab7d54322bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:34:36 -0800
+Subject: vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA
+ is n
+
+From: Wei Yang <richard.weiyang@gmail.com>
+
+[ Upstream commit 8b09549c2bfd9f3f8f4cdad74107ef4f4ff9cdd7 ]
+
+Commit fa5e084e43eb ("vmscan: do not unconditionally treat zones that
+fail zone_reclaim() as full") changed the return value of
+node_reclaim().  The original return value 0 means NODE_RECLAIM_SOME
+after this commit.
+
+While the return value of node_reclaim() when CONFIG_NUMA is n is not
+changed.  This will leads to call zone_watermark_ok() again.
+
+This patch fixes the return value by adjusting to NODE_RECLAIM_NOSCAN.
+Since node_reclaim() is only called in page_alloc.c, move it to
+mm/internal.h.
+
+Link: http://lkml.kernel.org/r/20181113080436.22078-1-richard.weiyang@gmail.com
+Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swap.h |  6 ------
+ mm/internal.h        | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 7bd0a6f2ac2b0..ee8f9f554a9e1 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -371,14 +371,8 @@ extern unsigned long vm_total_pages;
+ extern int node_reclaim_mode;
+ extern int sysctl_min_unmapped_ratio;
+ extern int sysctl_min_slab_ratio;
+-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
+ #else
+ #define node_reclaim_mode 0
+-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
+-				unsigned int order)
+-{
+-	return 0;
+-}
+ #endif
+ 
+ extern int page_evictable(struct page *page);
+diff --git a/mm/internal.h b/mm/internal.h
+index 87256ae1bef86..397183c8fe47b 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -444,6 +444,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn,
+ #define NODE_RECLAIM_SOME	0
+ #define NODE_RECLAIM_SUCCESS	1
+ 
++#ifdef CONFIG_NUMA
++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
++#else
++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
++				unsigned int order)
++{
++	return NODE_RECLAIM_NOSCAN;
++}
++#endif
++
+ extern int hwpoison_filter(struct page *p);
+ 
+ extern u32 hwpoison_filter_dev_major;
+-- 
+2.20.1
+
diff --git a/queue-4.19/vsock-bind-to-random-port-for-vmaddr_port_any.patch b/queue-4.19/vsock-bind-to-random-port-for-vmaddr_port_any.patch
new file mode 100644
index 00000000000..fe4d486f3f0
--- /dev/null
+++ b/queue-4.19/vsock-bind-to-random-port-for-vmaddr_port_any.patch
@@ -0,0 +1,55 @@
+From bb629d18c3e834dd003e2dec470d85286d310e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 11:12:55 -0800
+Subject: VSOCK: bind to random port for VMADDR_PORT_ANY
+
+From: Lepton Wu <ytht.net@gmail.com>
+
+[ Upstream commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b ]
+
+The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes
+when VMM crashed, there is still orphaned vsock which is waiting for
+close timer, then it could cause connection time out for new started VM
+if they are trying to connect to same port with same guest cid since the
+new packets could hit that orphaned vsock. We could also fix this by doing
+more in vhost_vsock_reset_orphans, but any way, it should be better to start
+from a random local port instead of a fixed one.
+
+Signed-off-by: Lepton Wu <ytht.net@gmail.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index b2724fb06bbbb..62ec9182f234d 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -107,6 +107,7 @@
+ #include <linux/mutex.h>
+ #include <linux/net.h>
+ #include <linux/poll.h>
++#include <linux/random.h>
+ #include <linux/skbuff.h>
+ #include <linux/smp.h>
+ #include <linux/socket.h>
+@@ -480,9 +481,13 @@ out:
+ static int __vsock_bind_stream(struct vsock_sock *vsk,
+ 			       struct sockaddr_vm *addr)
+ {
+-	static u32 port = LAST_RESERVED_PORT + 1;
++	static u32 port = 0;
+ 	struct sockaddr_vm new_addr;
+ 
++	if (!port)
++		port = LAST_RESERVED_PORT + 1 +
++			prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
++
+ 	vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+ 
+ 	if (addr->svm_port == VMADDR_PORT_ANY) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/vxlan-fix-error-path-in-__vxlan_dev_create.patch b/queue-4.19/vxlan-fix-error-path-in-__vxlan_dev_create.patch
new file mode 100644
index 00000000000..c5551d1c073
--- /dev/null
+++ b/queue-4.19/vxlan-fix-error-path-in-__vxlan_dev_create.patch
@@ -0,0 +1,83 @@
+From bb633a21a1d5dd227f00f3b414a13ae3dc674007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 13:16:00 +0000
+Subject: vxlan: Fix error path in __vxlan_dev_create()
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 6db9246871394b3a136cd52001a0763676563840 ]
+
+When a failure occurs in rtnl_configure_link(), the current code
+calls unregister_netdevice() to roll back the earlier call to
+register_netdevice(), and jumps to errout, which calls
+vxlan_fdb_destroy().
+
+However unregister_netdevice() calls transitively ndo_uninit, which is
+vxlan_uninit(), and that already takes care of deleting the default FDB
+entry by calling vxlan_fdb_delete_default(). Since the entry added
+earlier in __vxlan_dev_create() is exactly the default entry, the
+cleanup code in the errout block always leads to double free and thus a
+panic.
+
+Besides, since vxlan_fdb_delete_default() always destroys the FDB entry
+with notification enabled, the deletion of the default entry is notified
+even before the addition was notified.
+
+Instead, move the unregister_netdevice() call after the manual destroy,
+which solves both problems.
+
+Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 2a536f84d5f69..d8a56df3933f0 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3213,6 +3213,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ 	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ 	struct vxlan_dev *vxlan = netdev_priv(dev);
+ 	struct vxlan_fdb *f = NULL;
++	bool unregister = false;
+ 	int err;
+ 
+ 	err = vxlan_dev_configure(net, dev, conf, false, extack);
+@@ -3238,12 +3239,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ 	err = register_netdevice(dev);
+ 	if (err)
+ 		goto errout;
++	unregister = true;
+ 
+ 	err = rtnl_configure_link(dev, NULL);
+-	if (err) {
+-		unregister_netdevice(dev);
++	if (err)
+ 		goto errout;
+-	}
+ 
+ 	/* notify default fdb entry */
+ 	if (f)
+@@ -3251,9 +3251,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ 
+ 	list_add(&vxlan->next, &vn->vxlan_list);
+ 	return 0;
++
+ errout:
++	/* unregister_netdevice() destroys the default FDB entry with deletion
++	 * notification. But the addition notification was not sent yet, so
++	 * destroy the entry by hand here.
++	 */
+ 	if (f)
+ 		vxlan_fdb_destroy(vxlan, f, false);
++	if (unregister)
++		unregister_netdevice(dev);
+ 	return err;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/watchdog-meson-fix-the-wrong-value-of-left-time.patch b/queue-4.19/watchdog-meson-fix-the-wrong-value-of-left-time.patch
new file mode 100644
index 00000000000..771ff8a0c89
--- /dev/null
+++ b/queue-4.19/watchdog-meson-fix-the-wrong-value-of-left-time.patch
@@ -0,0 +1,47 @@
+From 9e87783aa25e7a3c49fb410ba84e66188014fbcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 18:53:49 +0800
+Subject: watchdog: meson: Fix the wrong value of left time
+
+From: Xingyu Chen <xingyu.chen@amlogic.com>
+
+[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ]
+
+The left time value is wrong when we get it by sysfs. The left time value
+should be equal to preset timeout value minus elapsed time value. According
+to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value
+is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved
+to BIT[16-31] of the WATCHDOG_TCNT.
+
+[0]: http://linux-meson.com
+
+Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver")
+Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/meson_gxbb_wdt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
+index 69adeab3fde70..0a6672789640c 100644
+--- a/drivers/watchdog/meson_gxbb_wdt.c
++++ b/drivers/watchdog/meson_gxbb_wdt.c
+@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+ 
+ 	reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
+ 
+-	return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+-		(reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
++	return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
++		(reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
+ }
+ 
+ static const struct watchdog_ops meson_gxbb_wdt_ops = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/x86-resctrl-prevent-null-pointer-dereference-when-re.patch b/queue-4.19/x86-resctrl-prevent-null-pointer-dereference-when-re.patch
new file mode 100644
index 00000000000..b54e77b67e5
--- /dev/null
+++ b/queue-4.19/x86-resctrl-prevent-null-pointer-dereference-when-re.patch
@@ -0,0 +1,59 @@
+From 68a4991a326134d52b17bd328fac343744a3d9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 13:25:02 +0800
+Subject: x86/resctrl: Prevent NULL pointer dereference when reading mondata
+
+From: Xiaochen Shen <xiaochen.shen@intel.com>
+
+[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ]
+
+When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED
+in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed
+until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later.
+
+During the window of deleting a mon group, if an application calls
+rdtgroup_mondata_show() to read mondata under this mon group,
+'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when
+rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path:
+rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count().
+Thus it results in NULL pointer dereference in mon_event_count().
+
+Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT
+immediately when reading mondata during the window of deleting a mon
+group.
+
+Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data")
+Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: pei.p.jia@intel.com
+Cc: Reinette Chatre <reinette.chatre@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index c8b72aff55e00..2052e1e6a11c9 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -459,6 +459,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
+ 	int ret = 0;
+ 
+ 	rdtgrp = rdtgroup_kn_lock_live(of->kn);
++	if (!rdtgrp) {
++		ret = -ENOENT;
++		goto out;
++	}
+ 
+ 	md.priv = of->kn->priv;
+ 	resid = md.u.rid;
+-- 
+2.20.1
+
diff --git a/queue-4.19/xdp-fix-cpumap-redirect-skb-creation-bug.patch b/queue-4.19/xdp-fix-cpumap-redirect-skb-creation-bug.patch
new file mode 100644
index 00000000000..e0ea3bfcc24
--- /dev/null
+++ b/queue-4.19/xdp-fix-cpumap-redirect-skb-creation-bug.patch
@@ -0,0 +1,104 @@
+From 6e70cbf7b709e7775c9755d904d7b054174d4436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2019 10:18:00 +0100
+Subject: xdp: fix cpumap redirect SKB creation bug
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 676e4a6fe703f2dae699ee9d56f14516f9ada4ea ]
+
+We want to avoid leaking pointer info from xdp_frame (that is placed in
+top of frame) like commit 6dfb970d3dbd ("xdp: avoid leaking info stored in
+frame data on page reuse"), and followup commit 97e19cce05e5 ("bpf:
+reserve xdp_frame size in xdp headroom") that reserve this headroom.
+
+These changes also affected how cpumap constructed SKBs, as xdpf->headroom
+size changed, the skb data starting point were in-effect shifted with 32
+bytes (sizeof xdp_frame). This was still okay, as the cpumap frame_size
+calculation also included xdpf->headroom which were reduced by same amount.
+
+A bug was introduced in commit 77ea5f4cbe20 ("bpf/cpumap: make sure
+frame_size for build_skb is aligned if headroom isn't"), where the
+xdpf->headroom became part of the SKB_DATA_ALIGN rounding up. This
+round-up to find the frame_size is in principle still correct as it does
+not exceed the 2048 bytes frame_size (which is max for ixgbe and i40e),
+but the 32 bytes offset of pkt_data_start puts this over the 2048 bytes
+limit. This cause skb_shared_info to spill into next frame. It is a little
+hard to trigger, as the SKB need to use above 15 skb_shinfo->frags[] as
+far as I calculate. This does happen in practise for TCP streams when
+skb_try_coalesce() kicks in.
+
+KASAN can be used to detect these wrong memory accesses, I've seen:
+ BUG: KASAN: use-after-free in skb_try_coalesce+0x3cb/0x760
+ BUG: KASAN: wild-memory-access in skb_release_data+0xe2/0x250
+
+Driver veth also construct a SKB from xdp_frame in this way, but is not
+affected, as it doesn't reserve/deduct the room (used by xdp_frame) from
+the SKB headroom. Instead is clears the pointers via xdp_scrub_frame(),
+and allows SKB to use this area.
+
+The fix in this patch is to do like veth and instead allow SKB to (re)use
+the area occupied by xdp_frame, by clearing via xdp_scrub_frame().  (This
+does kill the idea of the SKB being able to access (mem) info from this
+area, but I guess it was a bad idea anyhow, and it was already killed by
+the veth changes.)
+
+Fixes: 77ea5f4cbe20 ("bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cpumap.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 8974b3755670e..3c18260403dde 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
+ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ 					 struct xdp_frame *xdpf)
+ {
++	unsigned int hard_start_headroom;
+ 	unsigned int frame_size;
+ 	void *pkt_data_start;
+ 	struct sk_buff *skb;
+ 
++	/* Part of headroom was reserved to xdpf */
++	hard_start_headroom = sizeof(struct xdp_frame) +  xdpf->headroom;
++
+ 	/* build_skb need to place skb_shared_info after SKB end, and
+ 	 * also want to know the memory "truesize".  Thus, need to
+ 	 * know the memory frame size backing xdp_buff.
+@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ 	 * is not at a fixed memory location, with mixed length
+ 	 * packets, which is bad for cache-line hotness.
+ 	 */
+-	frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
++	frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
+ 		SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+ 
+-	pkt_data_start = xdpf->data - xdpf->headroom;
++	pkt_data_start = xdpf->data - hard_start_headroom;
+ 	skb = build_skb(pkt_data_start, frame_size);
+ 	if (!skb)
+ 		return NULL;
+ 
+-	skb_reserve(skb, xdpf->headroom);
++	skb_reserve(skb, hard_start_headroom);
+ 	__skb_put(skb, xdpf->len);
+ 	if (xdpf->metasize)
+ 		skb_metadata_set(skb, xdpf->metasize);
+@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ 	 * - RX ring dev queue index	(skb_record_rx_queue)
+ 	 */
+ 
++	/* Allow SKB to reuse area used by xdp_frame */
++	xdp_scrub_frame(xdpf);
++
+ 	return skb;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/xen-pciback-check-dev_data-before-using-it.patch b/queue-4.19/xen-pciback-check-dev_data-before-using-it.patch
new file mode 100644
index 00000000000..a8591bbb7a3
--- /dev/null
+++ b/queue-4.19/xen-pciback-check-dev_data-before-using-it.patch
@@ -0,0 +1,38 @@
+From 8d21a5ccff2c08995903eeab6aff9ad0cc65d899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:55:45 +0000
+Subject: xen/pciback: Check dev_data before using it
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit 1669907e3d1abfa3f7586e2d55dbbc117b5adba2 ]
+
+If pcistub_init_device fails, the release function will be called with
+dev_data set to NULL.  Check it before using it to avoid a NULL pointer
+dereference.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/pci_stub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 59661db144e51..097410a7cdb74 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref)
+ 	 * is called from "unbind" which takes a device_lock mutex.
+ 	 */
+ 	__pci_reset_function_locked(dev);
+-	if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
++	if (dev_data &&
++	    pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+ 		dev_info(&dev->dev, "Could not reload PCI state\n");
+ 	else
+ 		pci_restore_state(dev);
+-- 
+2.20.1
+
diff --git a/queue-4.19/xfs-align-compat-attrlist_by_handle-with-native-impl.patch b/queue-4.19/xfs-align-compat-attrlist_by_handle-with-native-impl.patch
new file mode 100644
index 00000000000..60edd87b917
--- /dev/null
+++ b/queue-4.19/xfs-align-compat-attrlist_by_handle-with-native-impl.patch
@@ -0,0 +1,56 @@
+From baadb150a5ef043fc9b89f8c14a1170e448cd200 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Align compat attrlist_by_handle with native implementation.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ]
+
+While inspecting the ioctl implementations, I noticed that the compat
+implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the
+same thing as the native implementation.  Specifically, the "cursor"
+does not appear to be written out to userspace on the compat path,
+like it is on the native path.
+
+This adjusts the compat implementation to copy out the cursor just
+like the native implementation does.  The attrlist cursor does not
+require any special compat handling.  This fixes xfstests xfs/269
+on both IA-32 and x32 userspace, when running on an amd64 kernel.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace")
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index fba115f4103ac..4c34efcbf7e80 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -336,6 +336,7 @@ xfs_compat_attrlist_by_handle(
+ {
+ 	int			error;
+ 	attrlist_cursor_kern_t	*cursor;
++	compat_xfs_fsop_attrlist_handlereq_t __user *p = arg;
+ 	compat_xfs_fsop_attrlist_handlereq_t al_hreq;
+ 	struct dentry		*dentry;
+ 	char			*kbuf;
+@@ -370,6 +371,11 @@ xfs_compat_attrlist_by_handle(
+ 	if (error)
+ 		goto out_kfree;
+ 
++	if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
++		error = -EFAULT;
++		goto out_kfree;
++	}
++
+ 	if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen))
+ 		error = -EFAULT;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/xfs-end-sync-buffer-i-o-properly-on-shutdown-error.patch b/queue-4.19/xfs-end-sync-buffer-i-o-properly-on-shutdown-error.patch
new file mode 100644
index 00000000000..d5973c751f7
--- /dev/null
+++ b/queue-4.19/xfs-end-sync-buffer-i-o-properly-on-shutdown-error.patch
@@ -0,0 +1,50 @@
+From a6e9f0e7d3b5e9529913dccce4657efeb5d1433f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Feb 2019 14:03:06 -0800
+Subject: xfs: end sync buffer I/O properly on shutdown error
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit 465fa17f4a303d9fdff9eac4d45f91ece92e96ca ]
+
+As of commit e339dd8d8b ("xfs: use sync buffer I/O for sync delwri
+queue submission"), the delwri submission code uses sync buffer I/O
+for sync delwri I/O. Instead of waiting on async I/O to unlock the
+buffer, it uses the underlying sync I/O completion mechanism.
+
+If delwri buffer submission fails due to a shutdown scenario, an
+error is set on the buffer and buffer completion never occurs. This
+can cause xfs_buf_delwri_submit() to deadlock waiting on a
+completion event.
+
+We could check the error state before waiting on such buffers, but
+that doesn't serialize against the case of an error set via a racing
+I/O completion. Instead, invoke I/O completion in the shutdown case
+regardless of buffer I/O type.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_buf.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index e36124546d0db..c1f7c0d5d608a 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -1506,8 +1506,7 @@ __xfs_buf_submit(
+ 		xfs_buf_ioerror(bp, -EIO);
+ 		bp->b_flags &= ~XBF_DONE;
+ 		xfs_buf_stale(bp);
+-		if (bp->b_flags & XBF_ASYNC)
+-			xfs_buf_ioend(bp);
++		xfs_buf_ioend(bp);
+ 		return -EIO;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch b/queue-4.19/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
new file mode 100644
index 00000000000..ff1be01f316
--- /dev/null
+++ b/queue-4.19/xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
@@ -0,0 +1,94 @@
+From 2287aa566516880e56e87632ddf234781edf20b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Fix bulkstat compat ioctls on x32 userspace.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit 7ca860e3c1a74ad6bd8949364073ef1044cad758 ]
+
+The bulkstat family of ioctls are problematic on x32, because there is
+a mixup of native 32-bit and 64-bit conventions.  The xfs_fsop_bulkreq
+struct contains pointers and 32-bit integers so that matches the native
+32-bit layout, and that means the ioctl implementation goes into the
+regular compat path on x32.
+
+However, the 'ubuffer' member of that struct in turn refers to either
+struct xfs_inogrp or xfs_bstat (or an array of these).  On x32, those
+structures match the native 64-bit layout.  The compat implementation
+writes out the 32-bit version of these structures.  This is not the
+expected format for x32 userspace, causing problems.
+
+Fortunately the functions which actually output these xfs_inogrp and
+xfs_bstat structures have an easy way to select which output format
+is required, so we just need a little tweak to select the right format
+on x32.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index 4c34efcbf7e80..b044f7d36782c 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -241,6 +241,32 @@ xfs_compat_ioc_bulkstat(
+ 	int			done;
+ 	int			error;
+ 
++	/*
++	 * Output structure handling functions.  Depending on the command,
++	 * either the xfs_bstat and xfs_inogrp structures are written out
++	 * to userpace memory via bulkreq.ubuffer.  Normally the compat
++	 * functions and structure size are the correct ones to use ...
++	 */
++	inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat;
++	bulkstat_one_pf	bs_one_func = xfs_bulkstat_one_compat;
++	size_t bs_one_size = sizeof(struct compat_xfs_bstat);
++
++#ifdef CONFIG_X86_X32
++	if (in_x32_syscall()) {
++		/*
++		 * ... but on x32 the input xfs_fsop_bulkreq has pointers
++		 * which must be handled in the "compat" (32-bit) way, while
++		 * the xfs_bstat and xfs_inogrp structures follow native 64-
++		 * bit layout convention.  So adjust accordingly, otherwise
++		 * the data written out in compat layout will not match what
++		 * x32 userspace expects.
++		 */
++		inumbers_func = xfs_inumbers_fmt;
++		bs_one_func = xfs_bulkstat_one;
++		bs_one_size = sizeof(struct xfs_bstat);
++	}
++#endif
++
+ 	/* done = 1 if there are more stats to get and if bulkstat */
+ 	/* should be called again (unused here, but used in dmapi) */
+ 
+@@ -272,15 +298,15 @@ xfs_compat_ioc_bulkstat(
+ 
+ 	if (cmd == XFS_IOC_FSINUMBERS_32) {
+ 		error = xfs_inumbers(mp, &inlast, &count,
+-				bulkreq.ubuffer, xfs_inumbers_fmt_compat);
++				bulkreq.ubuffer, inumbers_func);
+ 	} else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) {
+ 		int res;
+ 
+-		error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
+-				sizeof(compat_xfs_bstat_t), NULL, &res);
++		error = bs_one_func(mp, inlast, bulkreq.ubuffer,
++				bs_one_size, NULL, &res);
+ 	} else if (cmd == XFS_IOC_FSBULKSTAT_32) {
+ 		error = xfs_bulkstat(mp, &inlast, &count,
+-			xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
++			bs_one_func, bs_one_size,
+ 			bulkreq.ubuffer, &done);
+ 	} else
+ 		error = -EINVAL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/xfs-require-both-realtime-inodes-to-mount.patch b/queue-4.19/xfs-require-both-realtime-inodes-to-mount.patch
new file mode 100644
index 00000000000..22459fc2705
--- /dev/null
+++ b/queue-4.19/xfs-require-both-realtime-inodes-to-mount.patch
@@ -0,0 +1,45 @@
+From 0545c01d4db6f06092a6ca9d4d341c6cd784104b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 15:18:52 -0800
+Subject: xfs: require both realtime inodes to mount
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ]
+
+Since mkfs always formats the filesystem with the realtime bitmap and
+summary inodes immediately after the root directory, we should expect
+that both of them are present and loadable, even if there isn't a
+realtime volume attached.  There's no reason to skip this if rbmino ==
+NULLFSINO; in fact, this causes an immediate crash if the there /is/ a
+realtime volume and someone writes to it.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Bill O'Donnell <billodo@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_rtalloc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 926ed314ffba1..484eb0adcefb2 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -1198,13 +1198,11 @@ xfs_rtmount_inodes(
+ 	xfs_sb_t	*sbp;
+ 
+ 	sbp = &mp->m_sb;
+-	if (sbp->sb_rbmino == NULLFSINO)
+-		return 0;
+ 	error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
+ 	if (error)
+ 		return error;
+ 	ASSERT(mp->m_rbmip != NULL);
+-	ASSERT(sbp->sb_rsumino != NULLFSINO);
++
+ 	error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
+ 	if (error) {
+ 		xfs_irele(mp->m_rbmip);
+-- 
+2.20.1
+
diff --git a/queue-4.19/xfs-zero-length-symlinks-are-not-valid.patch b/queue-4.19/xfs-zero-length-symlinks-are-not-valid.patch
new file mode 100644
index 00000000000..a5eb6c6b2a4
--- /dev/null
+++ b/queue-4.19/xfs-zero-length-symlinks-are-not-valid.patch
@@ -0,0 +1,165 @@
+From eba1b21139cb2f367033fdb6ba6274a4328f3b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 08:46:21 -0800
+Subject: xfs: zero length symlinks are not valid
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 43feeea88c9cb2955b9f7ba8152ec5abeea42810 ]
+
+A log recovery failure has been reproduced where a symlink inode has
+a zero length in extent form. It was caused by a shutdown during a
+combined fstress+fsmark workload.
+
+The underlying problem is the issue in xfs_inactive_symlink(): the
+inode is unlocked between the symlink inactivation/truncation and
+the inode being freed. This opens a window for the inode to be
+written to disk before it xfs_ifree() removes it from the unlinked
+list, marks it free in the inobt and zeros the mode.
+
+For shortform inodes, the fix is simple. xfs_ifree() clears the data
+fork state, so there's no need to do it in xfs_inactive_symlink().
+This means the shortform fork verifier will not see a zero length
+data fork as it mirrors the inode size through to xfs_ifree()), and
+hence if the inode gets written back and the fork verifiers are run
+they will still see a fork that matches the on-disk inode size.
+
+For extent form (remote) symlinks, it is a little more tricky. Here
+we explicitly set the inode size to zero, so the above race can lead
+to zero length symlinks on disk. Because the inode is unlinked at
+this point (i.e. on the unlinked list) and unreferenced, it can
+never be seen again by a user. Hence when we set the inode size to
+zeor, also change the type to S_IFREG. xfs_ifree() expects S_IFREG
+inodes to be of zero length, and so this avoids all the problems of
+zero length symlinks ever hitting the disk. It also avoids the
+problem of needing to handle zero length symlink inodes in log
+recovery to replay the extent free intents and the remaining
+deferops to free the extents the symlink used.
+
+Also add a couple of asserts to warn us if zero length symlinks end
+up in either the symlink create or inactivation paths.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_symlink_remote.c | 14 +++++++++----
+ fs/xfs/xfs_symlink.c               | 33 +++++++++++++++---------------
+ 2 files changed, 27 insertions(+), 20 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
+index 95374ab2dee73..77d80106f989a 100644
+--- a/fs/xfs/libxfs/xfs_symlink_remote.c
++++ b/fs/xfs/libxfs/xfs_symlink_remote.c
+@@ -199,7 +199,10 @@ xfs_symlink_local_to_remote(
+ 					ifp->if_bytes - 1);
+ }
+ 
+-/* Verify the consistency of an inline symlink. */
++/*
++ * Verify the in-memory consistency of an inline symlink data fork. This
++ * does not do on-disk format checks.
++ */
+ xfs_failaddr_t
+ xfs_symlink_shortform_verify(
+ 	struct xfs_inode	*ip)
+@@ -215,9 +218,12 @@ xfs_symlink_shortform_verify(
+ 	size = ifp->if_bytes;
+ 	endp = sfp + size;
+ 
+-	/* Zero length symlinks can exist while we're deleting a remote one. */
+-	if (size == 0)
+-		return NULL;
++	/*
++	 * Zero length symlinks should never occur in memory as they are
++	 * never alllowed to exist on disk.
++	 */
++	if (!size)
++		return __this_address;
+ 
+ 	/* No negative sizes or overly long symlink targets. */
+ 	if (size < 0 || size > XFS_SYMLINK_MAXLEN)
+diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
+index a3e98c64b6e38..b2c1177c717ff 100644
+--- a/fs/xfs/xfs_symlink.c
++++ b/fs/xfs/xfs_symlink.c
+@@ -192,6 +192,7 @@ xfs_symlink(
+ 	pathlen = strlen(target_path);
+ 	if (pathlen >= XFS_SYMLINK_MAXLEN)      /* total string too long */
+ 		return -ENAMETOOLONG;
++	ASSERT(pathlen > 0);
+ 
+ 	udqp = gdqp = NULL;
+ 	prid = xfs_get_initial_prid(dp);
+@@ -378,6 +379,12 @@ out_release_inode:
+ 
+ /*
+  * Free a symlink that has blocks associated with it.
++ *
++ * Note: zero length symlinks are not allowed to exist. When we set the size to
++ * zero, also change it to a regular file so that it does not get written to
++ * disk as a zero length symlink. The inode is on the unlinked list already, so
++ * userspace cannot find this inode anymore, so this change is not user visible
++ * but allows us to catch corrupt zero-length symlinks in the verifiers.
+  */
+ STATIC int
+ xfs_inactive_symlink_rmt(
+@@ -412,13 +419,14 @@ xfs_inactive_symlink_rmt(
+ 	xfs_trans_ijoin(tp, ip, 0);
+ 
+ 	/*
+-	 * Lock the inode, fix the size, and join it to the transaction.
+-	 * Hold it so in the normal path, we still have it locked for
+-	 * the second transaction.  In the error paths we need it
++	 * Lock the inode, fix the size, turn it into a regular file and join it
++	 * to the transaction.  Hold it so in the normal path, we still have it
++	 * locked for the second transaction.  In the error paths we need it
+ 	 * held so the cancel won't rele it, see below.
+ 	 */
+ 	size = (int)ip->i_d.di_size;
+ 	ip->i_d.di_size = 0;
++	VFS_I(ip)->i_mode = (VFS_I(ip)->i_mode & ~S_IFMT) | S_IFREG;
+ 	xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+ 	/*
+ 	 * Find the block(s) so we can inval and unmap them.
+@@ -494,17 +502,10 @@ xfs_inactive_symlink(
+ 		return -EIO;
+ 
+ 	xfs_ilock(ip, XFS_ILOCK_EXCL);
+-
+-	/*
+-	 * Zero length symlinks _can_ exist.
+-	 */
+ 	pathlen = (int)ip->i_d.di_size;
+-	if (!pathlen) {
+-		xfs_iunlock(ip, XFS_ILOCK_EXCL);
+-		return 0;
+-	}
++	ASSERT(pathlen);
+ 
+-	if (pathlen < 0 || pathlen > XFS_SYMLINK_MAXLEN) {
++	if (pathlen <= 0 || pathlen > XFS_SYMLINK_MAXLEN) {
+ 		xfs_alert(mp, "%s: inode (0x%llx) bad symlink length (%d)",
+ 			 __func__, (unsigned long long)ip->i_ino, pathlen);
+ 		xfs_iunlock(ip, XFS_ILOCK_EXCL);
+@@ -512,12 +513,12 @@ xfs_inactive_symlink(
+ 		return -EFSCORRUPTED;
+ 	}
+ 
++	/*
++	 * Inline fork state gets removed by xfs_difree() so we have nothing to
++	 * do here in that case.
++	 */
+ 	if (ip->i_df.if_flags & XFS_IFINLINE) {
+-		if (ip->i_df.if_bytes > 0) 
+-			xfs_idata_realloc(ip, -(ip->i_df.if_bytes),
+-					  XFS_DATA_FORK);
+ 		xfs_iunlock(ip, XFS_ILOCK_EXCL);
+-		ASSERT(ip->i_df.if_bytes == 0);
+ 		return 0;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/xprtrdma-prevent-leak-of-rpcrdma_rep-objects.patch b/queue-4.19/xprtrdma-prevent-leak-of-rpcrdma_rep-objects.patch
new file mode 100644
index 00000000000..65174a95a99
--- /dev/null
+++ b/queue-4.19/xprtrdma-prevent-leak-of-rpcrdma_rep-objects.patch
@@ -0,0 +1,86 @@
+From 186f214337896e699aa94f190a566ba6426e0bb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 11:11:44 -0500
+Subject: xprtrdma: Prevent leak of rpcrdma_rep objects
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 07e10308ee5da8e6132e0b737ece1c99dd651fb6 ]
+
+If a reply has been processed but the RPC is later retransmitted
+anyway, the req->rl_reply field still contains the only pointer to
+the old rpcrdma rep. When the next reply comes in, the reply handler
+will stomp on the rl_reply field, leaking the old rep.
+
+A trace event is added to capture such leaks.
+
+This problem seems to be worsened by the restructuring of the RPC
+Call path in v4.20. Fully addressing this issue will require at
+least a re-architecture of the disconnect logic, which is not
+appropriate during -rc.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/rpcrdma.h | 28 ++++++++++++++++++++++++++++
+ net/sunrpc/xprtrdma/rpc_rdma.c |  4 ++++
+ 2 files changed, 32 insertions(+)
+
+diff --git a/include/trace/events/rpcrdma.h b/include/trace/events/rpcrdma.h
+index 53df203b8057a..4c91cadd1871d 100644
+--- a/include/trace/events/rpcrdma.h
++++ b/include/trace/events/rpcrdma.h
+@@ -917,6 +917,34 @@ TRACE_EVENT(xprtrdma_cb_setup,
+ DEFINE_CB_EVENT(xprtrdma_cb_call);
+ DEFINE_CB_EVENT(xprtrdma_cb_reply);
+ 
++TRACE_EVENT(xprtrdma_leaked_rep,
++	TP_PROTO(
++		const struct rpc_rqst *rqst,
++		const struct rpcrdma_rep *rep
++	),
++
++	TP_ARGS(rqst, rep),
++
++	TP_STRUCT__entry(
++		__field(unsigned int, task_id)
++		__field(unsigned int, client_id)
++		__field(u32, xid)
++		__field(const void *, rep)
++	),
++
++	TP_fast_assign(
++		__entry->task_id = rqst->rq_task->tk_pid;
++		__entry->client_id = rqst->rq_task->tk_client->cl_clid;
++		__entry->xid = be32_to_cpu(rqst->rq_xid);
++		__entry->rep = rep;
++	),
++
++	TP_printk("task:%u@%u xid=0x%08x rep=%p",
++		__entry->task_id, __entry->client_id, __entry->xid,
++		__entry->rep
++	)
++);
++
+ /**
+  ** Server-side RPC/RDMA events
+  **/
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index c8ae983c6cc01..f2eaf264726be 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -1360,6 +1360,10 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
+ 	spin_unlock(&xprt->recv_lock);
+ 
+ 	req = rpcr_to_rdmar(rqst);
++	if (req->rl_reply) {
++		trace_xprtrdma_leaked_rep(rqst, req->rl_reply);
++		rpcrdma_recv_buffer_put(req->rl_reply);
++	}
+ 	req->rl_reply = rep;
+ 	rep->rr_rqst = rqst;
+ 	clear_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags);
+-- 
+2.20.1
+
-- 
2.47.3