From 8258a48bb8aa226d9b34bb880b650927ca0f814b Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Thu, 23 Jan 2020 11:26:56 -0500
Subject: [PATCH] fixes for 4.19

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../6lowpan-off-by-one-handling-nexthdr.patch |  41 ++
 ...einitialize-button-state-upon-resume.patch |  51 ++
 ...e-poweroff-callbacks-for-acpi-pm-dom.patch | 206 ++++++
 ...-and-fix-pm-domain-hibernation-callb.patch | 265 ++++++++
 ...ix-mirred_init_module-error-handling.patch |  40 ++
 ...fs-fix-a-memory-leak-in-affs_remount.patch |  60 ++
 ...date-callback-if-afs_vnode_dir_valid.patch |  46 ++
 ...-locking-to-allow-fine-grained-locks.patch |  83 +++
 ...afs-fix-double-inc-of-vnode-cb_break.patch |  46 ++
 ...k-in-afs_release-and-afs_evict_inode.patch |  69 ++
 queue-4.19/afs-fix-large-file-support.patch   |  45 ++
 ...k-wait-callback-break-double-locking.patch |  64 ++
 .../afs-fix-missing-timeout-reset.patch       |  51 ++
 ...s.cell-and-afs.volume-xattr-handlers.patch |  46 ++
 queue-4.19/afs-further-fix-file-locking.patch | 638 ++++++++++++++++++
 ...-but-not-used-variables-before-after.patch |  86 +++
 ...port-local-variable-ahci_em_messages.patch |  41 ++
 ...-aica-fix-a-long-time-build-breakage.patch |  70 ++
 ...lways-initialize-register-read-value.patch |  43 ++
 ...alsa-hda-fix-unused-variable-warning.patch |  53 ++
 ...andle-the-error-from-snd_usb_mixer_a.patch |  39 ++
 ...pdate-quirk-for-b-w-px-to-remove-mic.patch |  64 ++
 ...ry-to-replace-stale-label-in-ptrace-.patch |  64 ++
 ...work-performance-issue-in-aa_label_s.patch |  88 +++
 ...x-hyp-svc-mode-mismatch-when-mcpm-is.patch |  97 +++
 ...align-gic-version-check-with-arm64-c.patch |  40 ++
 ...-fix-encodings-for-pmsav8-s-prbar4-p.patch |  48 ++
 ...6-1-vdso-don-t-leak-kernel-addresses.patch |  43 ++
 ...peed-g5-fixe-gpio-ranges-upper-limit.patch |  41 ++
 ...91-nattis-make-the-sd-card-slot-work.patch |  36 +
 ...tis-set-the-prlud-and-hipow-signals-.patch |  46 ++
 ...m283x-correct-mailbox-register-sizes.patch |  37 +
 ...d-q7-common-fix-sdhi1-vccq-regularor.patch |  42 ++
 ...cpd-som-lv-fix-i2c2-and-i2c3-pin-mux.patch |  78 +++
 ...-logicpd-som-lv-fix-mmc1-card-detect.patch |  38 ++
 ...add-required-clocks-property-to-keyp.patch |  38 ++
 ...fix-arm-primecell-lcd-controller-clo.patch |  38 ++
 ...fix-arm-primecell-lcd-controller-var.patch |  36 +
 ...phy3250-fix-sd-card-regulator-voltag.patch |  39 ++
 ...x-reparent-keypad-controller-to-sic1.patch |  43 ++
 ...ix-sgmii-pcs-link-remaining-down-aft.patch |  96 +++
 ...remove-generic-compatible-string-fro.patch |  39 ++
 ...d-missing-vdda-supply-to-adc-on-stm3.patch |  36 +
 ...3-a33-move-nand-controller-device-no.patch |  72 ++
 ...3-reintroduce-default-pinctrl-muxing.patch |  39 ++
 ...s-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch |  50 ++
 ...s-sun9i-optimus-fix-fixed-regulators.patch |  49 ++
 ...tentially-uninitialized-return-value.patch |  44 ++
 ...warning-invalid-free-of-devm_-alloca.patch |  47 ++
 .../arm-qcom_defconfig-enable-mailbox.patch   |  46 ++
 ...ack-of-keyboard-interrupts-after-irq.patch |  42 ++
 ...epends-on-instead-of-if-after-prompt.patch |  36 +
 ...fig-re-enable-bcm2835-thermal-driver.patch |  37 +
 ...allwinner-a64-add-missing-pio-clocks.patch |  40 ++
 ...ner-h6-move-gic-device-node-fix-base.patch |  65 ++
 ...ner-h6-pine-h64-add-interrupt-line-f.patch |  38 ++
 ...6-sbc-increase-load-on-l11-for-sdcar.patch |  42 ++
 .../arm64-dts-juno-fix-uart-frequency.patch   |  54 ++
 ...gx-add-hdmi_5v-regulator-as-hdmi-tx-.patch |  87 +++
 ...gxm-khadas-vim2-fix-bluetooth-suppor.patch |  53 ++
 ...gxm-khadas-vim2-fix-gpio-keys-polled.patch |  46 ++
 ...gxm-khadas-vim2-fix-uart_a-bluetooth.patch |  35 +
 ...n-libretech-cc-set-emmc-as-removable.patch |  37 +
 ...6-remove-bogus-argument-to-the-cpu-c.patch |  68 ++
 ...s-ebisu-remove-renesas-no-ether-link.patch |  68 ++
 ...s-r8a7795-es1-add-missing-power-doma.patch |  45 ++
 ...s-r8a77995-fix-register-range-of-dis.patch |  38 ++
 ...hibernate-check-pgd-table-allocation.patch |  54 ++
 ...m64-vdso-don-t-leak-kernel-addresses.patch |  41 ++
 ...-cs4349-use-pm-ops-cs4349_runtime_pm.patch |  40 ++
 ...copy-paste-error-in-es8328_right_lin.patch |  37 +
 .../asoc-fix-valid-stream-condition.patch     |  40 ++
 ...0-put-of-nodes-if-finding-codec-fail.patch |  40 ++
 ...n-axg-tdmin-right_j-is-not-supported.patch |  35 +
 ...-axg-tdmout-right_j-is-not-supported.patch |  35 +
 ...-node-refcount-unbalance-in-apq8016_.patch |  89 +++
 ...x-and-tx-counter-registers-are-swapp.patch |  38 ++
 ...un8i-codec-add-missing-route-for-adc.patch |  40 ++
 ...mcasp-fix-slot-mask-settings-when-us.patch |  51 ++
 ...copy-paste-error-in-wm8737_snd_contr.patch |  41 ++
 ...c-wm9712-fix-unused-variable-warning.patch |  47 ++
 ...uninitialized-regmap-pointer-problem.patch | 177 +++++
 ...b-length-in-ath10k_sdio_mbox_rx_pack.patch | 101 +++
 ...nmap-direction-for-management-frames.patch |  75 ++
 ...ding-for-protected-management-frames.patch |  48 ++
 ...h-of-wmi-tlv-command-for-protected-m.patch |  49 ++
 ...-possible-deadlock-in-ath_dynack_nod.patch | 136 ++++
 ...a-return-0-on-success-in-update_stat.patch |  50 ++
 ...-fix-heuristic-to-determine-number-o.patch |  88 +++
 ...e-fix-an-error-code-in-bch_dump_read.patch |  41 ++
 ...ct-update-of-bcma_core_pci_mdio_data.patch |  48 ++
 ...bio-bi_vcnt-to-figure-out-segment-nu.patch |  50 ++
 ...ool-selftest-crash-under-error-condi.patch |  51 ++
 ...ling-frag_err-when-nvm_install_updat.patch |  57 ++
 ...-timeout-for-hwrm_dbg_coredump_xx-co.patch |  50 ++
 ...-error-messages-when-querying-dscp-d.patch |  37 +
 ...ssed-newline-in-verifier-verbose-log.patch |  45 ++
 queue-4.19/bpf-fix-btf-limits.patch           |  41 ++
 ...k-that-forwarding-is-enabled-in-bpf_.patch |  43 ++
 ...ck-on-error-in-bpf_offload_dev_creat.patch |  40 ++
 ...debugfs-files-for-bus-specific-layer.patch | 115 ++++
 ...x-leak-of-mypkt-on-error-return-path.patch |  51 ++
 ..._proxy-set-icmp6_router-if-neigh-has.patch |  33 +
 ...hen-loading-existing-inode-cache-off.patch |  86 +++
 ...cache-waiters-hanging-on-failure-to-.patch |  80 +++
 ...cache-waiters-hanging-on-path-alloca.patch |  43 ++
 ...rrect-count-in-btrfs_file_write_iter.patch |  55 ++
 ...-sysc-add-mcasp-optional-clocks-flag.patch |  71 ++
 ...sysc_unprepare-when-no-clocks-have-b.patch |  37 +
 ...timer-handling-with-drop-pm_runtime_.patch | 101 +++
 ...eturn-value-of-recover_from_urb_loss.patch |  35 +
 ...eph-fix-ceph.dir.rctime-vxattr-value.patch |  38 ++
 ...tory-make-initialization-more-robust.patch |  44 ++
 ...egression-in-cifs.ko-caused-by-force.patch |  38 ++
 ...-fix-factor-clk-struct-member-access.patch |  63 ++
 ...0-fix-refcount-leak-in-a370_clk_init.patch |  41 ++
 ...xp-fix-refcount-leak-in-axp_clk_init.patch |  40 ++
 ...e-fix-refcount-leak-in-dove_clk_init.patch |  47 ++
 ...ank-fix-refcount-leak-in-hb_clk_init.patch |  36 +
 ...x-refcount-leak-in-imx6q_clocks_init.patch |  36 +
 ...-refcount-leak-in-imx6sx_clocks_init.patch |  36 +
 ...x-refcount-leak-in-imx7d_clocks_init.patch |  36 +
 ...genic-jz4740-fix-gating-of-udc-clock.patch |  36 +
 ...x-refcount-leak-in-kirkwood_clk_init.patch |  38 ++
 ...eson-axg-spread-spectrum-is-on-mpll2.patch |  50 ++
 ...son-gxbb-no-spread-spectrum-on-mpll0.patch |  41 ++
 ...ix-refcount-leak-in-mv98dx3236_clk_i.patch |  40 ++
 .../clk-qcom-fix-wunused-const-variable.patch |  98 +++
 ...lt-checks-on-gcc_pcie_0_pipe_clk-for.patch |  42 ++
 ...q-fix-refcount-leak-in-clockgen_init.patch |  36 +
 ...os4-fix-refcount-leak-in-exynos4_get.patch |  36 +
 .../clk-socfpga-fix-refcount-leak.patch       |  50 ++
 ...50i-h6-r-fix-incorrect-w1-clock-gate.patch |  44 ++
 ...8i-a23-enable-pll-mipi-ldos-when-ung.patch |  39 ++
 ...unxi-ng-v3s-add-the-missing-pll_ddr1.patch | 114 ++++
 ...fcount-leak-in-ti_dt_clocks_register.patch |  44 ++
 ...x-refcount-leak-in-vf610_clocks_init.patch |  36 +
 ...ers-exynos_mct-fix-error-path-in-tim.patch |  53 ++
 ...ers-sun5i-fail-gracefully-when-clock.patch |  58 ++
 ...resight-catu-fix-clang-build-warning.patch |  78 +++
 ...avs-cpufreq-fix-initial-command-chec.patch |  40 ++
 ...avs-cpufreq-fix-types-for-voltage-fr.patch |  61 ++
 ...cm-fix-some-set-but-not-used-warning.patch |  65 ++
 ...caam_dump_sg-that-iterates-through-s.patch |  40 ++
 ...-resources-in-case-caam_rng-registra.patch |  40 ++
 ...des-complaint-from-ccp-crypto-module.patch |  77 +++
 ...es-cfb-error-exposed-by-new-test-vec.patch |  63 ++
 ...rypto-ccp-reduce-maximum-stack-usage.patch | 178 +++++
 ...reduce-kernel-stack-usage-with-clang.patch |  52 ++
 ...-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch |  49 ++
 ...-matching-the-dma-address-for-dma_po.patch |  93 +++
 ...de-secure-fix-queued-len-computation.patch |  44 ++
 ...cure-fix-zeroing-of-the-request-in-a.patch |  38 ++
 .../crypto-talitos-fix-aead-processing.patch  | 349 ++++++++++
 ...o-tgr192-fix-unaligned-memory-access.patch |  50 ++
 .../cxgb4-signedness-bug-in-init_one.patch    |  36 +
 ...smt-add-lock-for-atomic_dec_and_test.patch |  52 ++
 ...evres-allow-const-resource-arguments.patch |  63 ++
 ...ac-don-t-check-the-number-of-frames-.patch |  45 ++
 ...tform-switch-to-acpi_dma_controller_.patch |  64 ++
 ...vert-set-hsu_ch_mtsr-to-memory-width.patch |  51 ++
 ...ma-fix-size-check-for-sdma-script_nu.patch |  73 ++
 ...v_xor-use-correct-device-for-dma-api.patch |  53 ++
 ...tegra210-adma-fix-crash-during-probe.patch |  92 +++
 ...tegra210-adma-restore-channel-status.patch | 124 ++++
 ...-ti-edma-fix-missed-failure-handling.patch |  41 ++
 ...-avoid-timestamp-read-on-error-paths.patch |  93 +++
 ...th-perform-dma-unmapping-before-read.patch |  78 +++
 ...d-careless-re-use-of-existing-device.patch |  79 +++
 ...ot-call-rpm_put_suppliers-in-pm_runt.patch |  61 ++
 ...ot-resume-suppliers-under-device_lin.patch |  80 +++
 ...dl_flag_autoremove_supplier-device-l.patch |  80 +++
 ...handling-of-runtime-pm-flags-in-devi.patch | 222 ++++++
 ...pm-runtime-for-links-added-during-co.patch | 165 +++++
 ...possible-supplier-pm-usage-counter-i.patch | 179 +++++
 ...ossible-memory-leak-in-__uio_registe.patch |  41 ++
 ...ossible-use-after-free-in-__uio_regi.patch |  58 ++
 ...rio_cm.c-fix-potential-oops-in-riocm.patch |  44 ++
 ...validating-ports-during-destruction-.patch |  90 +++
 ...drm-etnaviv-fix-some-off-by-one-bugs.patch |  58 ++
 ...l-vs-is_err-buf-in-etnaviv_core_dump.patch |  36 +
 ...m-etnaviv-potential-null-dereference.patch |  38 ++
 ...neric-call-drm_client_add-after-setu.patch |  52 ++
 ...-helper-generic-fix-setup-error-path.patch | 224 ++++++
 ...-error-handling-in-drm_legacy_addctx.patch |  61 ++
 ...bmc-don-t-overwrite-fb-helper-surfac.patch |  42 ++
 ...-a3xx-remove-tpl1-regs-from-snapshot.patch |  60 ++
 ...rm-msm-dsi-implement-reset-correctly.patch |  73 ++
 ...igned-comparison-with-less-than-zero.patch |  41 ++
 ...-mdp5-fix-mdp5_cfg_init-error-return.patch |  39 ++
 ...-ramcfg-fix-missing-parentheses-when.patch |  43 ++
 ...ix-missing-break-in-switch-statement.patch |  40 ++
 ...don-t-print-reply-values-if-exec-is-.patch |  44 ++
 ...otential-oops-in-probe-error-handlin.patch |  81 +++
 ...anel-make-drm_panel.h-self-contained.patch |  51 ++
 ...eon-fix-bad-dma-from-interrupt_cntl2.patch |  77 +++
 ...the-return-value-in-case-of-error-in.patch |  40 ++
 ...rm-rcar-du-fix-vblank-initialization.patch |  37 +
 ...rcar-du-lvds-fix-bridge_to_rcar_lvds.patch |  48 ++
 ...eturn-value-check-in-shmob_drm_probe.patch |  42 ++
 ...emove-the-drm_bridge-that-was-never-.patch |  55 ++
 ...n4i-hdmi-fix-double-flag-assignation.patch |  42 ++
 ...ounds-check-in-virtio_gpu_cmd_get_ca.patch |  55 ++
 ...ve-set-but-not-used-variable-restart.patch |  61 ++
 ...x-mmap-attributes-for-display-buffer.patch |  60 ++
 ...completed-transfer-size-calculation-.patch |  39 ++
 ...c_mc_find-in-case-no-device-is-found.patch |  65 ++
 ...copy-paste-err-in-ehea_init_port_res.patch |  38 ++
 ...-fix-passing-zero-to-err_ptr-warning.patch |  38 ++
 ...eturn-correctly-when-ext4_htree_stor.patch |  39 ++
 ...ror-path-of-f2fs_convert_inline_page.patch |  35 +
 ...d-accessing-uninitialized-field-of-i.patch |  75 ++
 ...rror-injection-path-in-inc_valid_blo.patch |  45 ++
 ...emove-set-but-not-used-variable-size.patch |  51 ++
 ...i-fix-bitfield-definitions-for-senso.patch |  48 ++
 ...i-fix-of_node-leak-in-scmi_mailbox_c.patch |  42 ++
 ...i-update-rate_discrete-in-clock_desc.patch |  39 ++
 ...t-let-of-core-populate-platform-devi.patch |  99 +++
 ...-unlikely-out-of-bounds-read-in-save.patch |  41 ++
 ..._thread_stack_node-needs-to-set-tsk-.patch |  55 ++
 .../fork-memcg-fix-cached_stacks-case.patch   |  47 ++
 ...rash-in-free_thread_stack-on-memcg-c.patch |  95 +++
 ...arse_devname-to-not-modify-it-s-argu.patch |  38 ++
 ...si-core-fix-error-paths-on-cfam-init.patch |  94 +++
 ...t-fail-operations-when-in-sbe-ipl-st.patch |  44 ++
 ...einstate-full-of-path-for-domain-nam.patch |  47 ++
 ...aspeed-fix-incorrect-number-of-banks.patch |  41 ++
 ...ix-offset-usage-in-netvsc_send_table.patch | 116 ++++
 ...nd_table-offset-in-case-of-a-host-bu.patch |  83 +++
 ...vsc-flag-software-created-hash-value.patch |  50 ++
 ...rite-operations-for-negative-tempera.patch |  40 ++
 ...3679-fix-driver-info-initialization-.patch |  48 ++
 ...on-shtc1-fix-shtc1-and-shtw1-id-mask.patch |  39 ++
 ...se-request_muxed_region-for-super-io.patch | 121 ++++
 ...bcm2835-fix-probe-as-platform-device.patch |  58 ++
 ...fix-missing-clock-by-probing-with-de.patch | 187 +++++
 ...tm32f7-report-dma-error-during-probe.patch |  91 +++
 ...0e-reduce-stack-usage-in-i40e_set_fc.patch | 166 +++++
 ...d-mtu-check-for-operational-data-vls.patch |  74 ++
 ...tly-process-fecn-and-becn-in-packets.patch | 474 +++++++++++++
 ...fi1-handle-port-down-properly-in-pio.patch | 113 ++++
 ...b-iser-fix-dma_nents-type-definition.patch |  41 ++
 ...-correct-number-of-entries-for-dma-m.patch |  61 ++
 ...ing-xrc-options-to-qp-optional-param.patch |  90 +++
 ...-don-t-override-existing-ip_protocol.patch | 132 ++++
 ...ncorrect-cache-cleanup-in-error-flow.patch |  75 ++
 .../ib-rxe-replace-kvfree-with-vfree.patch    |  77 +++
 ...-of-bounds-index-check-in-query-pkey.patch |  37 +
 ...5380-fix-incorrect-assignment-to-val.patch |  39 ++
 ...fix-position-relative-kernel-version.patch |  35 +
 ...devm_add_action_or_reset-for-tsl2772.patch |  74 ++
 ...inet_frags_fini-after-unregister_per.patch |  56 ++
 ...k-ske-keypad-fix-a-loop-timeout-test.patch |  35 +
 ...mu-add-missing-new-line-for-dma-type.patch |  35 +
 .../iommu-amd-make-iommu_disable-safer.patch  |  40 ++
 ...or-completion-of-iotlb-flush-in-atta.patch |  37 +
 .../iommu-fix-iommu-debugfs-fallout.patch     |  74 ++
 ...ix-iova_to_phys-pa-start-for-4gb-mod.patch |  96 +++
 ...ght-function-to-get-group-for-device.patch |  42 ++
 ...cate-iommu_resv_region-objects-per-d.patch | 135 ++++
 ...ull-pointer-reference-in-intel_svm_b.patch |  43 ++
 ...kernel-parameter-igfx_off-work-with-.patch |  49 ++
 ...scard-nodes-with-valid-routing-infor.patch |  63 ++
 ...-the-incorrect-mtu-limit-for-ip6ersp.patch |  41 ++
 ...-route-fl4-init-in-ip_md_tunnel_xmit.patch |  40 ++
 ...c-handle-devm_kasprintf-failure-case.patch |  45 ++
 ...ssing-tx-timestamping-on-ipproto_raw.patch |  40 ++
 ...ts-fix-some-definitions-of-inner-cac.patch |  81 +++
 ...e-missing-assignment-of-domain-fwnod.patch |  61 ++
 ...gb4-use-tos-when-finding-ipv6-routes.patch |  46 ++
 ...-use-tos-when-importing-the-endpoint.patch |  35 +
 ...m-avoid-possible-access-out-of-array.patch |  66 ++
 ...-mvm-fix-a-mpdu-reference-assignment.patch |  52 ++
 .../iwlwifi-mvm-fix-rss-config-command.patch  |  46 ++
 ...et-num-of-hw-addresses-from-firmware.patch | 123 ++++
 ...ear-ipsec-sa-counters-on-hw-clearing.patch |  47 ++
 ...c-the-first-fragment-unconditionally.patch |  78 +++
 ...x-bogus-variable-self-initialization.patch |  45 ++
 ...are0-as-phony-to-fix-external-module.patch |  72 ++
 ...nity-check-on-the-cpu-in-kdb_per_cpu.patch |  38 ++
 queue-4.19/keys-timestamp-new-keys.patch      |  34 +
 ...v-fix-lockdep-warning-when-entering-.patch | 100 +++
 ...all-hardware-tce-tables-attached-to-.patch |  48 ++
 ...ix-possible-null-pointer-dereference.patch |  92 +++
 ...rs-fix-dereferencing-of-null-pointer.patch |  45 ++
 ...correct-channel-range-in-lbtf_geo_in.patch |  38 ++
 ...x-lock-order-in-pblk_rb_tear_down_ch.patch |  43 ++
 ...potential-sk_buff-leak-in-llc_ui_sen.patch | 196 ++++++
 ...refcounting-in-llc_conn_state_proces.patch | 125 ++++
 ...r_interrupt-with-interrupts-disabled.patch | 422 ++++++++++++
 ...k-mac-fix-via-timer-counter-accesses.patch | 156 +++++
 ...11-accept-deauth-frames-in-ibss-mode.patch |  49 ++
 ...l_ht-fix-per-group-max-throughput-ra.patch |  38 ++
 ...-add-check-for-possible-failure-of-k.patch |  41 ++
 ...box-qcom-apcs-fix-max_register-value.patch |  36 +
 ...mgr-off-by-one-in-ti_msgmgr_of_xlate.patch |  40 ++
 ..._err-usage-after-initialization-to-c.patch |  49 ++
 ...l-isi-fix-timeout-value-for-stop-str.patch |  43 ++
 ...pdate-pos-correctly-in-cx18_read_pos.patch |  37 +
 ...edia-cx23885-check-allocation-return.patch |  43 ++
 ...sif-avoid-uninitialized-variable-use.patch |  78 +++
 ...be-array-underflow-in-vpbe_enum_outp.patch |  54 ++
 ...pt1-fix-wrong-initialization-for-dem.patch | 125 ++++
 ...-exception-handling-in-em28xx_alloc_.patch |  41 ++
 ...pdate-pos-correctly-in-ivtv_read_pos.patch |  37 +
 ...potential-buffer-overflow-in-vidioc_.patch |  68 ++
 ...659-fix-unbalanced-mutex_lock-unlock.patch |  39 ++
 ...lean-up-correct-notifier-in-error-pa.patch |  43 ++
 ...orrect-step-and-max-values-for-v4l2_.patch |  45 ++
 ...r-include-missing-dma-mapping-header.patch |  40 ++
 ...dia-release-the-correct-resource-in-.patch |  58 ++
 ...-possible-null-pointer-dereference-i.patch |  47 ++
 ...unregister-subdevice-with-v4l2-async.patch |  39 ++
 ...incorrect-assignment-operation-when-.patch |  42 ++
 ...-an-error-code-in-fm_download_firmwa.patch |  40 ++
 ...ace-poll-with-epoll-for-write-queues.patch |  47 ++
 ...-t-invoke-tegra30-specific-memory-ti.patch |  50 ++
 ...mfd-intel-lpss-release-ida-resources.patch |  36 +
 ...statically-declaring-a-struct-device.patch | 118 ++++
 ...cit-ub-in-assignment-of-mips_io_port.patch | 103 +++
 ...p-unused-and-broken-dsp-platform-dev.patch | 228 +++++++
 ...x-return-value-of-loongson_hwmon_ini.patch |  42 ++
 ...erly-initialize-buf-in-xpc_get_rsvd_.patch |  70 ++
 ...w-reg-qeec-add-minimum-shaper-fields.patch |  77 +++
 ...pectrum-set-minimum-shaper-on-mc-tcs.patch |  83 +++
 ...-fix-possible-use-after-free-of-host.patch |  40 ++
 .../mmc-core-fix-wl1251-sdio-quirks.patch     |  43 ++
 ...b-handle-mmc_of_parse-errors-during-.patch |  38 ++
 .../mmc-sdio-fix-wl1251-vendor-id.patch       |  44 ++
 ...s-fix-warning-with-multi-label-encap.patch |  45 ++
 ...ssible-memory-leak-in-mt76u_buf_free.patch |  65 ++
 ...te-_once-annotations-on-rskq_accept_.patch |  76 +++
 ...-always-register-net_device-notifier.patch |  84 +++
 ...build-proper-skbs-for-hipertransport.patch |  88 +++
 .../net-always-initialize-pagedlen.patch      |  72 ++
 ...a-fix-aq_vec_isr_legacy-return-value.patch |  67 ++
 ...tia-fixed-instack-structure-overflow.patch |  58 ++
 ...le-false-sharing-in-sk_leave_memory_.patch |  48 ++
 ...xienet-fix-a-signedness-bug-in-probe.patch |  37 +
 ...sysport-fix-signedness-in-bcm_syspor.patch |  38 ++
 ...pport-xdp-generic-on-stacked-devices.patch | 123 ++++
 ...sock-sk-early-to-avoid-trouble-in-st.patch |  85 +++
 ...ll-pointer-when-failing-to-connect-t.patch |  55 ++
 ...a-b53-do-not-program-cpu-port-s-pvid.patch |  37 +
 .../net-dsa-b53-fix-default-vlan-id.patch     |  96 +++
 ...-properly-account-for-vlan-filtering.patch | 152 +++++
 ...tended-change-of-bridge-interface-st.patch |  72 ++
 ...qca8k-enable-delay-for-rgmii_id-mode.patch |  64 ++
 ...com_fill_hash_function-implementatio.patch |  35 +
 ...ree-napi-resources-when-ena_up-fails.patch |  38 ++
 ...rrect-test-of-supported-hash-functio.patch |  40 ++
 ...ped-parameters-when-calling-ena_com_.patch |  39 ++
 ...mac-fix-signedness-bug-in-ipq806x_gm.patch |  37 +
 ...adjust_head-regression-for-generic-x.patch |  57 ++
 ...x-signedness-bug-in-hix5hd2_dev_prob.patch |  36 +
 ...or-handler-for-hns3_nic_init_vector_.patch |  58 ++
 ...emory-leak-issue-for-hclge_map_unmap.patch |  48 ++
 ...g-of-ethtool_ops.get_channels-for-vf.patch |  51 ++
 ...or-handling-int-the-hns3_get_vector_.patch |  55 ++
 ...or-vf-index-when-setting-vlan-offloa.patch |  76 +++
 ...-for-vport-bw_limit-overflow-problem.patch |  41 ++
 ...p-condition-of-hns3_get_tx_timeo_que.patch |  39 ++
 ...ng-combined-count-returned-by-ethtoo.patch |  55 ++
 ...mlx5-delete-unused-fpga-qpn-variable.patch |  49 ++
 ...mlx5-fix-mlx5_ifc_query_lag_out_bits.patch |  36 +
 ...tiple-updates-of-steering-rules-in-p.patch |  49 ++
 ...ck-with-irqs-disabled-to-avoid-deadl.patch |  82 +++
 ...ib-fix-rx-checksum-statistics-update.patch |  51 ++
 ...use-long-type-to-store-jiffies-delta.patch |  37 +
 ...t-the-parent-s-backlog-when-corrupte.patch |  40 ++
 ...cklog-accounting-for-corrupted-gso-f.patch |  84 +++
 ...-error-path-for-corrupted-gso-frames.patch |  74 ++
 ...c-fix-signedness-bug-in-netsec_probe.patch |  37 +
 ...-fix-a-signedness-bug-in-nixge_probe.patch |  36 +
 ...n-use-after-free-in-pasemi_mac_phy_i.patch |  49 ++
 ...on-t-clear-bmcr-in-genphy_soft_reset.patch |  46 ++
 ...to-call-phy_resume-if-phy-is-not-att.patch |  68 ++
 ..._phy-fix-fixed_phy-not-checking-gpio.patch |  46 ++
 ...et-soft_reset-callback-to-genphy_sof.patch |  42 ++
 ...pi-move-reset_count-to-struct-qcaspi.patch |  68 ++
 ...a-few-missing-rds_stat_names-entries.patch |  44 ++
 ...vt_handler_call-element-in-rds_ib_st.patch |  40 ++
 ...sum-fix-csum-calc-for-tagged-packets.patch |  91 +++
 ...oid-division-by-zero-when-calculatin.patch |  40 ++
 ...bs-fix-error-path-of-cbs_module_init.patch |  48 ++
 ...hed-cbs-fix-port_rate-miscalculation.patch | 227 +++++++
 ...t-default-link-speed-to-10-mbps-in-c.patch |  66 ++
 ...x-a-missing-check-of-of_get_phy_mode.patch |  49 ++
 ...inal-socket-family-in-inet_sock_diag.patch |  56 ++
 ...eive-pending-data-after-rcv_shutdown.patch |  77 +++
 ...net-smc-receive-returns-without-data.patch |  52 ++
 ...d-dummy-phy-register-read-in-phy_wri.patch |  77 +++
 ...xt-fix-a-signedness-bug-in-ave_probe.patch |  37 +
 ...e-dev_kfree_skb-in-sonic_send_packet.patch |  37 +
 ...-netdev_tx_ok-if-failed-to-map-buffe.patch |  42 ++
 ...-meson8b-fix-signedness-bug-in-probe.patch |  37 +
 ...ac-fix-disabling-flexible-pps-output.patch |  47 ++
 ...ix-length-of-ptp-clock-s-name-string.patch |  51 ++
 ...-not-all-unicast-addresses-may-be-av.patch |  36 +
 ...et-wmem-accounting-on-fallback-with-.patch |  40 ++
 ..._gso-allow-tx-timestamp-with-udp-gso.patch |  80 +++
 ...ter-ctnetlink-honor-ips_offload-flag.patch |  48 ++
 ...es-config_compat-reject-trailing-dat.patch |  44 ++
 ...w_table-do-not-remove-offload-when-o.patch |  54 ++
 ...ables-correct-nft_loglevel_max-value.patch |  35 +
 ...ow_offload-add-entry-to-flowtable-af.patch |  45 ++
 ...f-usage-from-output-path-is-not-vali.patch |  51 ++
 ...t_hash-bogus-element-self-comparison.patch |  38 ++
 ...t_hash-fix-lookups-with-fixed-size-h.patch |  73 ++
 .../netvsc-unshare-skb-in-vf-rx-handler.patch |  45 ++
 ...ic-check-error-through-tightening-sh.patch |  66 ++
 .../nfp-fix-simple-vnic-mailbox-length.patch  |  41 ++
 ...encode-decode-sequence_maxsz-to-v4.2.patch |  88 +++
 ...upt-file-writeout-due-to-fatal-error.patch |  37 +
 ...ockup-in-the-delegation-recovery-cod.patch |  83 +++
 ...stroy-of-layouts-needs-to-be-safe-w..patch |  94 +++
 ...fix-invalid-deref-in-ff_layout_devid.patch |  73 ++
 ...os2-ksyms-add-missing-symbol-exports.patch |  67 ++
 ...eplace-is_err_or_null-with-regular-n.patch |  54 ++
 ...-debug-print-64bit-aligned-crosslink.patch |  39 ++
 ...-nt-req-id-mapping-table-register-en.patch |  42 ++
 ...-potential-shift-wrapping-bug-in-swi.patch |  43 ++
 ...t-access-workaround-for-capability-r.patch |  57 ++
 ...change-timing-calculation-to-u-boot-.patch |  99 +++
 ...ensure-wait-bits-are-preserved-when-.patch |  47 ++
 ...erty-name-in-of_node_get_device_type.patch |  38 ++
 ...gnedness-bug-in-of_phy_get_and_conne.patch |  36 +
 ...unction-prototype-for-of_overlay_fdt.patch |  40 ++
 ...ng-debugfs-supply-directory-for-opps.patch | 162 +++++
 ...fix-data-race-in-fanout_flow_is_huge.patch | 134 ++++
 ...g-msg_name-return-at-least-sizeof-so.patch |  69 ++
 ...-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch |  62 ++
 ...cie_ep_find_capability-to-return-cor.patch |  67 ++
 ...ctions-use-memcpy_fromio-memcpy_toio.patch |  58 ++
 ...-try-semantics-of-bus-and-slot-reset.patch | 163 +++++
 ...-enable-iproc-config-read-for-paxbv2.patch |  43 ++
 ...-paxc-slot-check-to-allow-vf-support.patch |  45 ++
 ...-devfn-check-in-mobiveil_pcie_valid_.patch |  41 ++
 ...-the-valid-check-for-inbound-and-out.patch |  48 ++
 ...move-the-flag-msi_flag_multi_pci_msi.patch |  45 ++
 ...avoid-possible-suspend-to-idle-issue.patch |  89 +++
 ...ip-devices-in-d0-for-suspend-to-idle.patch | 126 ++++
 ...-rockchip_pcie_ep_assert_intx-bitwis.patch |  42 ++
 ...-use-format-specifier-in-kobject_add.patch |  43 ++
 ...nt-s-address-filter-offsets-on-clone.patch |  63 ++
 ...f-core-fix-the-address-filtering-fix.patch | 106 +++
 ...dd-check-for-the-sample_period-value.patch |  57 ++
 ...t-fix-address-filters-for-vmas-with-.patch | 298 ++++++++
 ...ix-missing-assignment-of-ret-when-ca.patch |  39 ++
 ...-usb-remove-sysfs-attributes-upon-dr.patch |  52 ++
 ...io-fix-incorrect-pinconf-configurati.patch | 227 +++++++
 ...gxl-remove-invalid-gpiox-tsin_a-pins.patch |  64 ++
 ...c-emev2-add-missing-pinmux-functions.patch |  82 +++
 ...8a7740-add-missing-lcd0-marks-to-lcd.patch |  36 +
 ...8a7740-add-missing-ref125ck-pin-to-g.patch |  37 +
 ...-r8a7791-fix-scifb2_data_c-pin-group.patch |  36 +
 ...8a7791-remove-bogus-ctrl-marks-from-.patch |  40 ++
 ...8a7791-remove-bogus-marks-from-vin1_.patch |  47 ++
 ...-r8a7792-fix-vin1_data18_b-pin-group.patch |  35 +
 ...pfc-r8a7794-remove-bogus-ipsr9-field.patch |  36 +
 ...-r8a77970-add-missing-mod_sel0-field.patch |  37 +
 ...-r8a77980-add-missing-mod_sel0-field.patch |  37 +
 ...8a77995-remove-bogus-sel_pwm-0-3-_3-.patch |  45 ++
 ...-pfc-sh7269-add-missing-pcior0-field.patch |  39 ++
 ...h73a0-add-missing-to-pin-to-tpu4_to3.patch |  37 +
 ...pfc-sh73a0-fix-fsic_spdif-pin-groups.patch |  37 +
 ...-pfc-sh7734-add-missing-ipsr11-field.patch |  37 +
 ...pfc-sh7734-remove-bogus-ipsr10-value.patch |  42 ++
 ...enware-wmi-fix-kfree-on-potentially-.patch |  65 ++
 ...enware-wmi-printing-the-wrong-error-.patch |  38 ++
 ...-fix-potential-null-pointer-derefere.patch |  42 ++
 ...esume-all-devices-during-hibernation.patch |  89 +++
 ...sible-overflow-in-pm_system_cancel_w.patch |  38 ++
 ...-init-device-wakeup-after-device_add.patch |  69 ++
 ...logic-when-handling-unknown-cpu-feat.patch |  83 +++
 ...x-fix-memory-hot-unplug-page-table-s.patch |  41 ++
 ...o-add-cacheinfo_teardown-cacheinfo_r.patch |  71 ++
 ...-add-kgdb_arch_set-remove_breakpoint.patch | 136 ++++
 ...c-mm-check-secondary-hash-page-table.patch |  38 ++
 ...eep-irqs-disabled-during-lockless-pa.patch |  73 ++
 ...memory-hotplug-fix-return-value-type.patch | 139 ++++
 ...mobility-rebuild-cacheinfo-hierarchy.patch |  81 +++
 ...e-vdso32-installation-conditional-in.patch |  39 ++
 ...-runtime-pm-reference-from-the-drive.patch |  45 ++
 ...son-consider-128-a-valid-pre-divider.patch |  54 ++
 ...disable-pwm-when-setting-duty-repeat.patch |  43 ++
 ...qed-iwarp-fix-uninitialized-callback.patch |  35 +
 ...ad_once-and-smp_store_release-to-acc.patch |  80 +++
 .../qed-reduce-maximum-stack-frame-size.patch | 103 +++
 ...d-on-error-from-rbd_obj_issue_copyup.patch |  33 +
 ...add-missing-spin-lock-initialization.patch |  47 ++
 .../rdma-cma-fix-false-error-message.patch    |  44 ++
 ...for-slab-out-of-bounds-when-loading-.patch | 126 ++++
 ...for-slab-out-of-bounds-when-unloadin.patch | 159 +++++
 ...s-hw-access-invalid-dma-memory-error.patch |  48 ++
 ...gb4-fix-the-unchecked-ep-dereference.patch |  57 ++
 ...mory-leak-in-case-we-fail-to-add-an-.patch |  44 ++
 ...out-of-bounds-index-check-in-query-p.patch |  36 +
 .../rdma-qedr-fix-incorrect-device-rate.patch |  95 +++
 ...t-of-bounds-index-check-in-query-pke.patch |  37 +
 ...r-skb-reserve-space-based-on-netdev-.patch |  39 ++
 ...k-for-allocation-failure-in-uapi_add.patch |  39 ++
 ...default-enable-high-on-dt-regulators.patch |  67 ++
 ...5-fix-missing-register-for-lp87565_b.patch |  36 +
 ...88060-fix-array-out-of-bounds-access.patch |  36 +
 ...88080-fix-array-out-of-bounds-access.patch |  36 +
 ...88090-fix-array-out-of-bounds-access.patch |  36 +
 ...86-fix-tps65086_ldoa1_ranges-for-sel.patch |  45 ++
 ...-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch |  40 ++
 ...q6v5-mss-add-missing-clocks-for-msm8.patch |  47 ++
 ...q6v5-mss-add-missing-regulator-for-m.patch |  40 ++
 ...8pm80x-fix-unintended-sign-extension.patch |  93 +++
 ...pm860x-fix-unintended-sign-extension.patch |  90 +++
 .../rtc-cmos-ignore-bogus-century-byte.patch  |  45 ++
 ...rtc-ds1307-rx8130-fix-alarm-handling.patch |  57 ++
 ...ds1672-fix-unintended-sign-extension.patch |  43 ++
 ...p-value-for-rtc_timestamp_begin_1900.patch |  35 +
 ...t6397-don-t-call-irq_dispose_mapping.patch |  61 ++
 ...27-bugfix-read-rtc-disables-watchdog.patch |  91 +++
 ...r-event-flags-and-disable-interrupts.patch |  61 ++
 ...pcf8563-fix-interrupt-trigger-method.patch |  38 ++
 ...pm8xxx-fix-unintended-sign-extension.patch |  53 ++
 ...t-error-handling-patch-to-rv3029_eep.patch |  66 ++
 ...rtlwifi-fix-file-release-memory-leak.patch |  38 ++
 ...e-replace-_rtl8821ae_mrate_idx_to_ar.patch | 121 ++++
 ...c-fix-detection-of-out-of-order-acks.patch | 114 ++++
 ...f-conn-cleanup-when-local-endpoint-i.patch | 179 +++++
 ...after-put-looking-at-the-put-connect.patch | 174 +++++
 ...ialized-error-code-in-rxrpc_send_dat.patch |  52 ++
 ...fix-potential-segment-overlap-in-elf.patch |  37 +
 ...ror-handling-during-vnicc-initializa.patch |  63 ++
 ...itialization-of-vnicc-cmd-masks-duri.patch |  51 ++
 ...broken-xdp_rxq_info-due-to-map-order.patch |  66 ++
 ...i-fnic-fix-msix-interrupt-allocation.patch |  47 ++
 ...ull-pointer-dereference-on-a-null-lp.patch |  39 ++
 ...megaraid_sas-reduce-module-load-time.patch |  67 ++
 ...id-that-qlt_send_resp_ctio-corrupts-.patch |  55 ++
 .../scsi-qla2xxx-fix-a-format-specifier.patch |  39 ++
 ...-error-handling-in-qlt_alloc_qfull_c.patch |  52 ++
 ...egister-chrdev-if-module-initializat.patch | 100 +++
 ...-fix-a-race-condition-in-the-lun-loo.patch |  52 ++
 ...to-sk_backlog-when-the-newsk-sk_sock.patch | 129 ++++
 ...sts-ipc-fix-msgque-compiler-warnings.patch |  76 +++
 ...2-add-support-of-tc-bit-status-check.patch |  97 +++
 ...-a-recursive-locking-in-stm32_config.patch |  45 ++
 ...2-fix-clearing-interrupt-error-flags.patch |  52 ++
 ...x-rx-data-length-when-parity-enabled.patch |  76 +++
 .../serial-stm32-fix-rx-error-handling.patch  | 164 +++++
 ...ix-transmit_chars-when-tx-is-stopped.patch |  52 ++
 ...m32-fix-wakeup-source-initialization.patch | 102 +++
 ...-stm32-fix-word-length-configuration.patch | 135 ++++
 queue-4.19/series                             | 622 +++++++++++++++++
 ...s-and-drbd-to-receive-their-terminat.patch | 136 ++++
 ...fix-bpfilter_kernl-to-use-send_sig-n.patch |  49 ++
 ...cifs_put_tcp_session-to-call-send_si.patch |  54 ++
 ...the-force_sig-sigsegv-.-in-ia64_rt_s.patch |  64 ++
 ...the-generic-force_sigsegv-in-setup_f.patch | 122 ++++
 ...ocinfo-add-mask-for-each-soc-package.patch |  95 +++
 ...n-gx-pwrc-vpu-fix-power-on-off-regis.patch |  59 ++
 ...-fix-an-error-code-in-qe_pin_request.patch |  38 ++
 ...fix-an-error-code-in-cmd_db_dev_prob.patch |  40 ++
 ...-bspi-quad-and-dual-mode-support-whe.patch |  49 ++
 ...ix-driver-to-not-allow-65535-1-cs-gp.patch |  61 ++
 ...correct-initialisation-of-runtime-pm.patch |  63 ++
 ...call-spi_finalize_current_message-at.patch |  44 ++
 ...4-clear-packed-bit-for-unpacked-mode.patch |  38 ++
 ...figure-dma-burst-size-to-fifo-trig-l.patch | 135 ++++
 ...a114-fix-for-unpacked-mode-transfers.patch | 164 +++++
 queue-4.19/spi-tegra114-flush-fifos.patch     | 107 +++
 ...minate-dma-and-reset-on-transfer-tim.patch |  43 ++
 ...-fix-potential-null-dereference-on-a.patch |  47 ++
 ...roid-vsoc-fix-copy_from_user-overrun.patch |  43 ++
 ...camera-abort-probe-if-there-is-no-ca.patch |  53 ++
 ...cm2835-camera-fix-module-autoloading.patch |  37 +
 ...i_mio_common-protect-register-write-.patch |  90 +++
 ...ybus-light-fix-a-couple-double-frees.patch |  69 ++
 ...v-add-missing-check-for-cdev_add-fai.patch |  49 ++
 ...r8822be-check-kzalloc-return-or-bail.patch |  41 ++
 ...use-proper-enum-for-return-in-halmac.patch |  49 ++
 ...-immediate-status-check-after-submit.patch |  53 ++
 ...ckless-access-to-tcp_memory_pressure.patch |  63 ++
 ...ing-actually-trace-cpu-load-in-therm.patch |  59 ++
 ...al-mediatek-fix-register-index-error.patch |  47 ++
 ...rcar_gen3_thermal-fix-interrupt-type.patch | 119 ++++
 ...essage-disordering-during-binding-ta.patch | 129 ++++
 ...duce-risk-of-wakeup-queue-starvation.patch |  86 +++
 ...tipc_rmem-and-named_timeout-right-ra.patch |  60 ++
 queue-4.19/tipc-tipc-clang-warning.patch      |  69 ++
 ...x-arguments-for-p_err-in-do_event_pi.patch |  48 ++
 ...x-format-strings-and-arguments-for-j.patch |  60 ++
 ...se-correct-argument-in-cgroup-errors.patch |  56 ++
 ...ix-potential-null-pointer-dereferenc.patch |  36 +
 ...puart-use-appropriate-lpuart32_-i-o-.patch | 100 +++
 ...ontroller-regression-on-console-read.patch | 121 ++++
 ...-off-by-one-error-in-irq-enumeration.patch |  36 +
 ...-dwc3-add-extcon-dependency-for-qcom.patch |  44 ++
 ...uilding-usb_dwc3_qcom-without-extcon.patch |  49 ++
 ...ix-link-error-against-usb-gadget-mod.patch |  41 ++
 ...dc_core-check-allocation-return-valu.patch |  95 +++
 ...-hub-fix-extra-endianness-conversion.patch |  44 ++
 ...usb-fix-possible-use-after-free-on-r.patch |  41 ++
 ...otify-the-tcpc-to-start-connection-d.patch | 269 ++++++++
 ...8x-fix-build-error-without-config_re.patch |  42 ++
 ...release-parent-reference-during-erro.patch |  40 ++
 ...orting-mdev-child-device-removal-if-.patch |  77 +++
 ...-mdev-follow-correct-remove-sequence.patch |  39 ++
 ...memory-accesses-before-calling-pci_m.patch |  69 ++
 .../vhost-test-stop-device-before-reset.patch |  43 ++
 ...link-fix-handling-of-default-remotes.patch |  94 +++
 ...hdog-rtd119x_wdt-fix-remove-function.patch |  43 ++
 ...namic-allocation-for-large-variables.patch | 345 ++++++++++
 ...-kgbd-use-nmi_vector-not-apic_dm_nmi.patch |  41 ++
 .../x86-mm-remove-unused-variable-cpu.patch   |  50 ++
 ...-dependency-of-the-x86-insn-decoder-.patch |  40 ++
 ...pgtable-32-fix-lowmem_pages-constant.patch |  47 ++
 .../xdp-fix-possible-cq-entry-leak.patch      |  69 ++
 ...plug-prevent-an-out-of-bounds-access.patch |  38 ++
 ...nterface-ifname-may-be-wrong-in-logs.patch |  72 ++
 ...use-after-free-in-rpcrdma_post_recvs.patch |  42 ++
 .../xsk-add-missing-smp_rmb-in-xsk_mmap.patch |  52 ++
 ...-store-tearing-when-assigning-queues.patch |  41 ++
 ...id-store-tearing-when-assigning-umem.patch |  50 ++
 ...-fix-registration-of-rx-only-sockets.patch |  60 ++
 623 files changed, 41359 insertions(+)
 create mode 100644 queue-4.19/6lowpan-off-by-one-handling-nexthdr.patch
 create mode 100644 queue-4.19/acpi-button-reinitialize-button-state-upon-resume.patch
 create mode 100644 queue-4.19/acpi-pm-introduce-poweroff-callbacks-for-acpi-pm-dom.patch
 create mode 100644 queue-4.19/acpi-pm-simplify-and-fix-pm-domain-hibernation-callb.patch
 create mode 100644 queue-4.19/act_mirred-fix-mirred_init_module-error-handling.patch
 create mode 100644 queue-4.19/affs-fix-a-memory-leak-in-affs_remount.patch
 create mode 100644 queue-4.19/afs-don-t-invalidate-callback-if-afs_vnode_dir_valid.patch
 create mode 100644 queue-4.19/afs-fix-afs-file-locking-to-allow-fine-grained-locks.patch
 create mode 100644 queue-4.19/afs-fix-double-inc-of-vnode-cb_break.patch
 create mode 100644 queue-4.19/afs-fix-key-leak-in-afs_release-and-afs_evict_inode.patch
 create mode 100644 queue-4.19/afs-fix-large-file-support.patch
 create mode 100644 queue-4.19/afs-fix-lock-wait-callback-break-double-locking.patch
 create mode 100644 queue-4.19/afs-fix-missing-timeout-reset.patch
 create mode 100644 queue-4.19/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch
 create mode 100644 queue-4.19/afs-further-fix-file-locking.patch
 create mode 100644 queue-4.19/afs-remove-set-but-not-used-variables-before-after.patch
 create mode 100644 queue-4.19/ahci-do-not-export-local-variable-ahci_em_messages.patch
 create mode 100644 queue-4.19/alsa-aica-fix-a-long-time-build-breakage.patch
 create mode 100644 queue-4.19/alsa-aoa-onyx-always-initialize-register-read-value.patch
 create mode 100644 queue-4.19/alsa-hda-fix-unused-variable-warning.patch
 create mode 100644 queue-4.19/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
 create mode 100644 queue-4.19/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
 create mode 100644 queue-4.19/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch
 create mode 100644 queue-4.19/apparmor-fix-network-performance-issue-in-aa_label_s.patch
 create mode 100644 queue-4.19/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
 create mode 100644 queue-4.19/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
 create mode 100644 queue-4.19/arm-8849-1-nommu-fix-encodings-for-pmsav8-s-prbar4-p.patch
 create mode 100644 queue-4.19/arm-8896-1-vdso-don-t-leak-kernel-addresses.patch
 create mode 100644 queue-4.19/arm-dts-aspeed-g5-fixe-gpio-ranges-upper-limit.patch
 create mode 100644 queue-4.19/arm-dts-at91-nattis-make-the-sd-card-slot-work.patch
 create mode 100644 queue-4.19/arm-dts-at91-nattis-set-the-prlud-and-hipow-signals-.patch
 create mode 100644 queue-4.19/arm-dts-bcm283x-correct-mailbox-register-sizes.patch
 create mode 100644 queue-4.19/arm-dts-iwg20d-q7-common-fix-sdhi1-vccq-regularor.patch
 create mode 100644 queue-4.19/arm-dts-logicpd-som-lv-fix-i2c2-and-i2c3-pin-mux.patch
 create mode 100644 queue-4.19/arm-dts-logicpd-som-lv-fix-mmc1-card-detect.patch
 create mode 100644 queue-4.19/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
 create mode 100644 queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
 create mode 100644 queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
 create mode 100644 queue-4.19/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
 create mode 100644 queue-4.19/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
 create mode 100644 queue-4.19/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
 create mode 100644 queue-4.19/arm-dts-r8a7743-remove-generic-compatible-string-fro.patch
 create mode 100644 queue-4.19/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch
 create mode 100644 queue-4.19/arm-dts-sun8i-a23-a33-move-nand-controller-device-no.patch
 create mode 100644 queue-4.19/arm-dts-sun8i-a33-reintroduce-default-pinctrl-muxing.patch
 create mode 100644 queue-4.19/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch
 create mode 100644 queue-4.19/arm-dts-sun9i-optimus-fix-fixed-regulators.patch
 create mode 100644 queue-4.19/arm-omap2-fix-potentially-uninitialized-return-value.patch
 create mode 100644 queue-4.19/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
 create mode 100644 queue-4.19/arm-qcom_defconfig-enable-mailbox.patch
 create mode 100644 queue-4.19/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
 create mode 100644 queue-4.19/arm-stm32-use-depends-on-instead-of-if-after-prompt.patch
 create mode 100644 queue-4.19/arm64-defconfig-re-enable-bcm2835-thermal-driver.patch
 create mode 100644 queue-4.19/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch
 create mode 100644 queue-4.19/arm64-dts-allwinner-h6-move-gic-device-node-fix-base.patch
 create mode 100644 queue-4.19/arm64-dts-allwinner-h6-pine-h64-add-interrupt-line-f.patch
 create mode 100644 queue-4.19/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
 create mode 100644 queue-4.19/arm64-dts-juno-fix-uart-frequency.patch
 create mode 100644 queue-4.19/arm64-dts-meson-gx-add-hdmi_5v-regulator-as-hdmi-tx-.patch
 create mode 100644 queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-bluetooth-suppor.patch
 create mode 100644 queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-gpio-keys-polled.patch
 create mode 100644 queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-uart_a-bluetooth.patch
 create mode 100644 queue-4.19/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch
 create mode 100644 queue-4.19/arm64-dts-msm8916-remove-bogus-argument-to-the-cpu-c.patch
 create mode 100644 queue-4.19/arm64-dts-renesas-ebisu-remove-renesas-no-ether-link.patch
 create mode 100644 queue-4.19/arm64-dts-renesas-r8a7795-es1-add-missing-power-doma.patch
 create mode 100644 queue-4.19/arm64-dts-renesas-r8a77995-fix-register-range-of-dis.patch
 create mode 100644 queue-4.19/arm64-hibernate-check-pgd-table-allocation.patch
 create mode 100644 queue-4.19/arm64-vdso-don-t-leak-kernel-addresses.patch
 create mode 100644 queue-4.19/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
 create mode 100644 queue-4.19/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
 create mode 100644 queue-4.19/asoc-fix-valid-stream-condition.patch
 create mode 100644 queue-4.19/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
 create mode 100644 queue-4.19/asoc-meson-axg-tdmin-right_j-is-not-supported.patch
 create mode 100644 queue-4.19/asoc-meson-axg-tdmout-right_j-is-not-supported.patch
 create mode 100644 queue-4.19/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
 create mode 100644 queue-4.19/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
 create mode 100644 queue-4.19/asoc-sun8i-codec-add-missing-route-for-adc.patch
 create mode 100644 queue-4.19/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
 create mode 100644 queue-4.19/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
 create mode 100644 queue-4.19/asoc-wm9712-fix-unused-variable-warning.patch
 create mode 100644 queue-4.19/asoc-wm97xx-fix-uninitialized-regmap-pointer-problem.patch
 create mode 100644 queue-4.19/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch
 create mode 100644 queue-4.19/ath10k-fix-dma-unmap-direction-for-management-frames.patch
 create mode 100644 queue-4.19/ath10k-fix-encoding-for-protected-management-frames.patch
 create mode 100644 queue-4.19/ath10k-fix-length-of-wmi-tlv-command-for-protected-m.patch
 create mode 100644 queue-4.19/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
 create mode 100644 queue-4.19/backlight-lm3630a-return-0-on-success-in-update_stat.patch
 create mode 100644 queue-4.19/backlight-pwm_bl-fix-heuristic-to-determine-number-o.patch
 create mode 100644 queue-4.19/bcache-fix-an-error-code-in-bch_dump_read.patch
 create mode 100644 queue-4.19/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
 create mode 100644 queue-4.19/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
 create mode 100644 queue-4.19/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch
 create mode 100644 queue-4.19/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch
 create mode 100644 queue-4.19/bnxt_en-increase-timeout-for-hwrm_dbg_coredump_xx-co.patch
 create mode 100644 queue-4.19/bnxt_en-suppress-error-messages-when-querying-dscp-d.patch
 create mode 100644 queue-4.19/bpf-add-missed-newline-in-verifier-verbose-log.patch
 create mode 100644 queue-4.19/bpf-fix-btf-limits.patch
 create mode 100644 queue-4.19/bpf-fix-the-check-that-forwarding-is-enabled-in-bpf_.patch
 create mode 100644 queue-4.19/bpf-offload-unlock-on-error-in-bpf_offload_dev_creat.patch
 create mode 100644 queue-4.19/brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
 create mode 100644 queue-4.19/brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
 create mode 100644 queue-4.19/bridge-br_arp_nd_proxy-set-icmp6_router-if-neigh-has.patch
 create mode 100644 queue-4.19/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
 create mode 100644 queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch
 create mode 100644 queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch
 create mode 100644 queue-4.19/btrfs-use-correct-count-in-btrfs_file_write_iter.patch
 create mode 100644 queue-4.19/bus-ti-sysc-add-mcasp-optional-clocks-flag.patch
 create mode 100644 queue-4.19/bus-ti-sysc-fix-sysc_unprepare-when-no-clocks-have-b.patch
 create mode 100644 queue-4.19/bus-ti-sysc-fix-timer-handling-with-drop-pm_runtime_.patch
 create mode 100644 queue-4.19/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
 create mode 100644 queue-4.19/ceph-fix-ceph.dir.rctime-vxattr-value.patch
 create mode 100644 queue-4.19/cfg80211-regulatory-make-initialization-more-robust.patch
 create mode 100644 queue-4.19/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
 create mode 100644 queue-4.19/clk-actions-fix-factor-clk-struct-member-access.patch
 create mode 100644 queue-4.19/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
 create mode 100644 queue-4.19/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
 create mode 100644 queue-4.19/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
 create mode 100644 queue-4.19/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
 create mode 100644 queue-4.19/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
 create mode 100644 queue-4.19/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
 create mode 100644 queue-4.19/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
 create mode 100644 queue-4.19/clk-ingenic-jz4740-fix-gating-of-udc-clock.patch
 create mode 100644 queue-4.19/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
 create mode 100644 queue-4.19/clk-meson-axg-spread-spectrum-is-on-mpll2.patch
 create mode 100644 queue-4.19/clk-meson-gxbb-no-spread-spectrum-on-mpll0.patch
 create mode 100644 queue-4.19/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch
 create mode 100644 queue-4.19/clk-qcom-fix-wunused-const-variable.patch
 create mode 100644 queue-4.19/clk-qcom-skip-halt-checks-on-gcc_pcie_0_pipe_clk-for.patch
 create mode 100644 queue-4.19/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
 create mode 100644 queue-4.19/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
 create mode 100644 queue-4.19/clk-socfpga-fix-refcount-leak.patch
 create mode 100644 queue-4.19/clk-sunxi-ng-sun50i-h6-r-fix-incorrect-w1-clock-gate.patch
 create mode 100644 queue-4.19/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
 create mode 100644 queue-4.19/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch
 create mode 100644 queue-4.19/clk-ti-fix-refcount-leak-in-ti_dt_clocks_register.patch
 create mode 100644 queue-4.19/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
 create mode 100644 queue-4.19/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
 create mode 100644 queue-4.19/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
 create mode 100644 queue-4.19/coresight-catu-fix-clang-build-warning.patch
 create mode 100644 queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch
 create mode 100644 queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch
 create mode 100644 queue-4.19/crypto-brcm-fix-some-set-but-not-used-warning.patch
 create mode 100644 queue-4.19/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch
 create mode 100644 queue-4.19/crypto-caam-free-resources-in-case-caam_rng-registra.patch
 create mode 100644 queue-4.19/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch
 create mode 100644 queue-4.19/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
 create mode 100644 queue-4.19/crypto-ccp-reduce-maximum-stack-usage.patch
 create mode 100644 queue-4.19/crypto-ccree-reduce-kernel-stack-usage-with-clang.patch
 create mode 100644 queue-4.19/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
 create mode 100644 queue-4.19/crypto-hisilicon-matching-the-dma-address-for-dma_po.patch
 create mode 100644 queue-4.19/crypto-inside-secure-fix-queued-len-computation.patch
 create mode 100644 queue-4.19/crypto-inside-secure-fix-zeroing-of-the-request-in-a.patch
 create mode 100644 queue-4.19/crypto-talitos-fix-aead-processing.patch
 create mode 100644 queue-4.19/crypto-tgr192-fix-unaligned-memory-access.patch
 create mode 100644 queue-4.19/cxgb4-signedness-bug-in-init_one.patch
 create mode 100644 queue-4.19/cxgb4-smt-add-lock-for-atomic_dec_and_test.patch
 create mode 100644 queue-4.19/devres-allow-const-resource-arguments.patch
 create mode 100644 queue-4.19/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
 create mode 100644 queue-4.19/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
 create mode 100644 queue-4.19/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
 create mode 100644 queue-4.19/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
 create mode 100644 queue-4.19/dmaengine-mv_xor-use-correct-device-for-dma-api.patch
 create mode 100644 queue-4.19/dmaengine-tegra210-adma-fix-crash-during-probe.patch
 create mode 100644 queue-4.19/dmaengine-tegra210-adma-restore-channel-status.patch
 create mode 100644 queue-4.19/dmaengine-ti-edma-fix-missed-failure-handling.patch
 create mode 100644 queue-4.19/dpaa_eth-avoid-timestamp-read-on-error-paths.patch
 create mode 100644 queue-4.19/dpaa_eth-perform-dma-unmapping-before-read.patch
 create mode 100644 queue-4.19/driver-core-avoid-careless-re-use-of-existing-device.patch
 create mode 100644 queue-4.19/driver-core-do-not-call-rpm_put_suppliers-in-pm_runt.patch
 create mode 100644 queue-4.19/driver-core-do-not-resume-suppliers-under-device_lin.patch
 create mode 100644 queue-4.19/driver-core-fix-dl_flag_autoremove_supplier-device-l.patch
 create mode 100644 queue-4.19/driver-core-fix-handling-of-runtime-pm-flags-in-devi.patch
 create mode 100644 queue-4.19/driver-core-fix-pm-runtime-for-links-added-during-co.patch
 create mode 100644 queue-4.19/driver-core-fix-possible-supplier-pm-usage-counter-i.patch
 create mode 100644 queue-4.19/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch
 create mode 100644 queue-4.19/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch
 create mode 100644 queue-4.19/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
 create mode 100644 queue-4.19/drm-dp_mst-skip-validating-ports-during-destruction-.patch
 create mode 100644 queue-4.19/drm-etnaviv-fix-some-off-by-one-bugs.patch
 create mode 100644 queue-4.19/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
 create mode 100644 queue-4.19/drm-etnaviv-potential-null-dereference.patch
 create mode 100644 queue-4.19/drm-fb-helper-generic-call-drm_client_add-after-setu.patch
 create mode 100644 queue-4.19/drm-fb-helper-generic-fix-setup-error-path.patch
 create mode 100644 queue-4.19/drm-fix-error-handling-in-drm_legacy_addctx.patch
 create mode 100644 queue-4.19/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch
 create mode 100644 queue-4.19/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
 create mode 100644 queue-4.19/drm-msm-dsi-implement-reset-correctly.patch
 create mode 100644 queue-4.19/drm-msm-fix-unsigned-comparison-with-less-than-zero.patch
 create mode 100644 queue-4.19/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
 create mode 100644 queue-4.19/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
 create mode 100644 queue-4.19/drm-nouveau-fix-missing-break-in-switch-statement.patch
 create mode 100644 queue-4.19/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
 create mode 100644 queue-4.19/drm-panel-lvds-potential-oops-in-probe-error-handlin.patch
 create mode 100644 queue-4.19/drm-panel-make-drm_panel.h-self-contained.patch
 create mode 100644 queue-4.19/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
 create mode 100644 queue-4.19/drm-rcar-du-fix-the-return-value-in-case-of-error-in.patch
 create mode 100644 queue-4.19/drm-rcar-du-fix-vblank-initialization.patch
 create mode 100644 queue-4.19/drm-rcar-du-lvds-fix-bridge_to_rcar_lvds.patch
 create mode 100644 queue-4.19/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch
 create mode 100644 queue-4.19/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
 create mode 100644 queue-4.19/drm-sun4i-hdmi-fix-double-flag-assignation.patch
 create mode 100644 queue-4.19/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
 create mode 100644 queue-4.19/drm-vmwgfx-remove-set-but-not-used-variable-restart.patch
 create mode 100644 queue-4.19/drm-xen-front-fix-mmap-attributes-for-display-buffer.patch
 create mode 100644 queue-4.19/dwc2-gadget-fix-completed-transfer-size-calculation-.patch
 create mode 100644 queue-4.19/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch
 create mode 100644 queue-4.19/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
 create mode 100644 queue-4.19/exportfs-fix-passing-zero-to-err_ptr-warning.patch
 create mode 100644 queue-4.19/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
 create mode 100644 queue-4.19/f2fs-fix-error-path-of-f2fs_convert_inline_page.patch
 create mode 100644 queue-4.19/f2fs-fix-to-avoid-accessing-uninitialized-field-of-i.patch
 create mode 100644 queue-4.19/f2fs-fix-wrong-error-injection-path-in-inc_valid_blo.patch
 create mode 100644 queue-4.19/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
 create mode 100644 queue-4.19/firmware-arm_scmi-fix-bitfield-definitions-for-senso.patch
 create mode 100644 queue-4.19/firmware-arm_scmi-fix-of_node-leak-in-scmi_mailbox_c.patch
 create mode 100644 queue-4.19/firmware-arm_scmi-update-rate_discrete-in-clock_desc.patch
 create mode 100644 queue-4.19/firmware-coreboot-let-of-core-populate-platform-devi.patch
 create mode 100644 queue-4.19/firmware-dmi-fix-unlikely-out-of-bounds-read-in-save.patch
 create mode 100644 queue-4.19/fork-memcg-alloc_thread_stack_node-needs-to-set-tsk-.patch
 create mode 100644 queue-4.19/fork-memcg-fix-cached_stacks-case.patch
 create mode 100644 queue-4.19/fork-memcg-fix-crash-in-free_thread_stack-on-memcg-c.patch
 create mode 100644 queue-4.19/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
 create mode 100644 queue-4.19/fsi-core-fix-error-paths-on-cfam-init.patch
 create mode 100644 queue-4.19/fsi-sbefifo-don-t-fail-operations-when-in-sbe-ipl-st.patch
 create mode 100644 queue-4.19/genirq-debugfs-reinstate-full-of-path-for-domain-nam.patch
 create mode 100644 queue-4.19/gpio-aspeed-fix-incorrect-number-of-banks.patch
 create mode 100644 queue-4.19/hv_netvsc-fix-offset-usage-in-netvsc_send_table.patch
 create mode 100644 queue-4.19/hv_netvsc-fix-send_table-offset-in-case-of-a-host-bu.patch
 create mode 100644 queue-4.19/hv_netvsc-flag-software-created-hash-value.patch
 create mode 100644 queue-4.19/hwmon-lm75-fix-write-operations-for-negative-tempera.patch
 create mode 100644 queue-4.19/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch
 create mode 100644 queue-4.19/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
 create mode 100644 queue-4.19/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
 create mode 100644 queue-4.19/hwrng-bcm2835-fix-probe-as-platform-device.patch
 create mode 100644 queue-4.19/hwrng-omap3-rom-fix-missing-clock-by-probing-with-de.patch
 create mode 100644 queue-4.19/i2c-stm32f7-report-dma-error-during-probe.patch
 create mode 100644 queue-4.19/i40e-reduce-stack-usage-in-i40e_set_fc.patch
 create mode 100644 queue-4.19/ib-hfi1-add-mtu-check-for-operational-data-vls.patch
 create mode 100644 queue-4.19/ib-hfi1-correctly-process-fecn-and-becn-in-packets.patch
 create mode 100644 queue-4.19/ib-hfi1-handle-port-down-properly-in-pio.patch
 create mode 100644 queue-4.19/ib-iser-fix-dma_nents-type-definition.patch
 create mode 100644 queue-4.19/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
 create mode 100644 queue-4.19/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
 create mode 100644 queue-4.19/ib-mlx5-don-t-override-existing-ip_protocol.patch
 create mode 100644 queue-4.19/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch
 create mode 100644 queue-4.19/ib-rxe-replace-kvfree-with-vfree.patch
 create mode 100644 queue-4.19/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
 create mode 100644 queue-4.19/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
 create mode 100644 queue-4.19/iio-fix-position-relative-kernel-version.patch
 create mode 100644 queue-4.19/iio-tsl2772-use-devm_add_action_or_reset-for-tsl2772.patch
 create mode 100644 queue-4.19/inet-frags-call-inet_frags_fini-after-unregister_per.patch
 create mode 100644 queue-4.19/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
 create mode 100644 queue-4.19/iommu-add-missing-new-line-for-dma-type.patch
 create mode 100644 queue-4.19/iommu-amd-make-iommu_disable-safer.patch
 create mode 100644 queue-4.19/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
 create mode 100644 queue-4.19/iommu-fix-iommu-debugfs-fallout.patch
 create mode 100644 queue-4.19/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch
 create mode 100644 queue-4.19/iommu-use-right-function-to-get-group-for-device.patch
 create mode 100644 queue-4.19/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch
 create mode 100644 queue-4.19/iommu-vt-d-fix-null-pointer-reference-in-intel_svm_b.patch
 create mode 100644 queue-4.19/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
 create mode 100644 queue-4.19/ip6_fib-don-t-discard-nodes-with-valid-routing-infor.patch
 create mode 100644 queue-4.19/ip6erspan-remove-the-incorrect-mtu-limit-for-ip6ersp.patch
 create mode 100644 queue-4.19/ip_tunnel-fix-route-fl4-init-in-ip_md_tunnel_xmit.patch
 create mode 100644 queue-4.19/ipmi-kcs_bmc-handle-devm_kasprintf-failure-case.patch
 create mode 100644 queue-4.19/ipv6-add-missing-tx-timestamping-on-ipproto_raw.patch
 create mode 100644 queue-4.19/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch
 create mode 100644 queue-4.19/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch
 create mode 100644 queue-4.19/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
 create mode 100644 queue-4.19/iw_cxgb4-use-tos-when-importing-the-endpoint.patch
 create mode 100644 queue-4.19/iwlwifi-mvm-avoid-possible-access-out-of-array.patch
 create mode 100644 queue-4.19/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
 create mode 100644 queue-4.19/iwlwifi-mvm-fix-rss-config-command.patch
 create mode 100644 queue-4.19/iwlwifi-nvm-get-num-of-hw-addresses-from-firmware.patch
 create mode 100644 queue-4.19/ixgbe-don-t-clear-ipsec-sa-counters-on-hw-clearing.patch
 create mode 100644 queue-4.19/ixgbe-sync-the-first-fragment-unconditionally.patch
 create mode 100644 queue-4.19/jfs-fix-bogus-variable-self-initialization.patch
 create mode 100644 queue-4.19/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch
 create mode 100644 queue-4.19/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
 create mode 100644 queue-4.19/keys-timestamp-new-keys.patch
 create mode 100644 queue-4.19/kvm-ppc-book3s-hv-fix-lockdep-warning-when-entering-.patch
 create mode 100644 queue-4.19/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch
 create mode 100644 queue-4.19/l2tp-fix-possible-null-pointer-dereference.patch
 create mode 100644 queue-4.19/led-triggers-fix-dereferencing-of-null-pointer.patch
 create mode 100644 queue-4.19/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
 create mode 100644 queue-4.19/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch
 create mode 100644 queue-4.19/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
 create mode 100644 queue-4.19/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
 create mode 100644 queue-4.19/m68k-call-timer_interrupt-with-interrupts-disabled.patch
 create mode 100644 queue-4.19/m68k-mac-fix-via-timer-counter-accesses.patch
 create mode 100644 queue-4.19/mac80211-accept-deauth-frames-in-ibss-mode.patch
 create mode 100644 queue-4.19/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
 create mode 100644 queue-4.19/mailbox-mediatek-add-check-for-possible-failure-of-k.patch
 create mode 100644 queue-4.19/mailbox-qcom-apcs-fix-max_register-value.patch
 create mode 100644 queue-4.19/mailbox-ti-msgmgr-off-by-one-in-ti_msgmgr_of_xlate.patch
 create mode 100644 queue-4.19/mdio_bus-fix-ptr_err-usage-after-initialization-to-c.patch
 create mode 100644 queue-4.19/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch
 create mode 100644 queue-4.19/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
 create mode 100644 queue-4.19/media-cx23885-check-allocation-return.patch
 create mode 100644 queue-4.19/media-davinci-isif-avoid-uninitialized-variable-use.patch
 create mode 100644 queue-4.19/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
 create mode 100644 queue-4.19/media-dvb-earth-pt1-fix-wrong-initialization-for-dem.patch
 create mode 100644 queue-4.19/media-em28xx-fix-exception-handling-in-em28xx_alloc_.patch
 create mode 100644 queue-4.19/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
 create mode 100644 queue-4.19/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
 create mode 100644 queue-4.19/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
 create mode 100644 queue-4.19/media-rcar-vin-clean-up-correct-notifier-in-error-pa.patch
 create mode 100644 queue-4.19/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
 create mode 100644 queue-4.19/media-sh-migor-include-missing-dma-mapping-header.patch
 create mode 100644 queue-4.19/media-staging-media-release-the-correct-resource-in-.patch
 create mode 100644 queue-4.19/media-tw5864-fix-possible-null-pointer-dereference-i.patch
 create mode 100644 queue-4.19/media-tw9910-unregister-subdevice-with-v4l2-async.patch
 create mode 100644 queue-4.19/media-vivid-fix-incorrect-assignment-operation-when-.patch
 create mode 100644 queue-4.19/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
 create mode 100644 queue-4.19/mei-replace-poll-with-epoll-for-write-queues.patch
 create mode 100644 queue-4.19/memory-tegra-don-t-invoke-tegra30-specific-memory-ti.patch
 create mode 100644 queue-4.19/mfd-intel-lpss-release-ida-resources.patch
 create mode 100644 queue-4.19/mic-avoid-statically-declaring-a-struct-device.patch
 create mode 100644 queue-4.19/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
 create mode 100644 queue-4.19/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch
 create mode 100644 queue-4.19/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
 create mode 100644 queue-4.19/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
 create mode 100644 queue-4.19/mlxsw-reg-qeec-add-minimum-shaper-fields.patch
 create mode 100644 queue-4.19/mlxsw-spectrum-set-minimum-shaper-on-mc-tcs.patch
 create mode 100644 queue-4.19/mmc-core-fix-possible-use-after-free-of-host.patch
 create mode 100644 queue-4.19/mmc-core-fix-wl1251-sdio-quirks.patch
 create mode 100644 queue-4.19/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
 create mode 100644 queue-4.19/mmc-sdio-fix-wl1251-vendor-id.patch
 create mode 100644 queue-4.19/mpls-fix-warning-with-multi-label-encap.patch
 create mode 100644 queue-4.19/mt76-usb-fix-possible-memory-leak-in-mt76u_buf_free.patch
 create mode 100644 queue-4.19/net-add-read-write-_once-annotations-on-rskq_accept_.patch
 create mode 100644 queue-4.19/net-af_iucv-always-register-net_device-notifier.patch
 create mode 100644 queue-4.19/net-af_iucv-build-proper-skbs-for-hipertransport.patch
 create mode 100644 queue-4.19/net-always-initialize-pagedlen.patch
 create mode 100644 queue-4.19/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch
 create mode 100644 queue-4.19/net-aquantia-fixed-instack-structure-overflow.patch
 create mode 100644 queue-4.19/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch
 create mode 100644 queue-4.19/net-axienet-fix-a-signedness-bug-in-probe.patch
 create mode 100644 queue-4.19/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
 create mode 100644 queue-4.19/net-core-support-xdp-generic-on-stacked-devices.patch
 create mode 100644 queue-4.19/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch
 create mode 100644 queue-4.19/net-dsa-avoid-null-pointer-when-failing-to-connect-t.patch
 create mode 100644 queue-4.19/net-dsa-b53-do-not-program-cpu-port-s-pvid.patch
 create mode 100644 queue-4.19/net-dsa-b53-fix-default-vlan-id.patch
 create mode 100644 queue-4.19/net-dsa-b53-properly-account-for-vlan-filtering.patch
 create mode 100644 queue-4.19/net-dsa-fix-unintended-change-of-bridge-interface-st.patch
 create mode 100644 queue-4.19/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
 create mode 100644 queue-4.19/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
 create mode 100644 queue-4.19/net-ena-fix-free-napi-resources-when-ena_up-fails.patch
 create mode 100644 queue-4.19/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
 create mode 100644 queue-4.19/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
 create mode 100644 queue-4.19/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
 create mode 100644 queue-4.19/net-fix-bpf_xdp_adjust_head-regression-for-generic-x.patch
 create mode 100644 queue-4.19/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
 create mode 100644 queue-4.19/net-hns3-add-error-handler-for-hns3_nic_init_vector_.patch
 create mode 100644 queue-4.19/net-hns3-fix-a-memory-leak-issue-for-hclge_map_unmap.patch
 create mode 100644 queue-4.19/net-hns3-fix-bug-of-ethtool_ops.get_channels-for-vf.patch
 create mode 100644 queue-4.19/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch
 create mode 100644 queue-4.19/net-hns3-fix-error-vf-index-when-setting-vlan-offloa.patch
 create mode 100644 queue-4.19/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch
 create mode 100644 queue-4.19/net-hns3-fix-loop-condition-of-hns3_get_tx_timeo_que.patch
 create mode 100644 queue-4.19/net-hns3-fix-wrong-combined-count-returned-by-ethtoo.patch
 create mode 100644 queue-4.19/net-mlx5-delete-unused-fpga-qpn-variable.patch
 create mode 100644 queue-4.19/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
 create mode 100644 queue-4.19/net-mlx5-fix-multiple-updates-of-steering-rules-in-p.patch
 create mode 100644 queue-4.19/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch
 create mode 100644 queue-4.19/net-mlx5e-ipoib-fix-rx-checksum-statistics-update.patch
 create mode 100644 queue-4.19/net-neigh-use-long-type-to-store-jiffies-delta.patch
 create mode 100644 queue-4.19/net-netem-correct-the-parent-s-backlog-when-corrupte.patch
 create mode 100644 queue-4.19/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
 create mode 100644 queue-4.19/net-netem-fix-error-path-for-corrupted-gso-frames.patch
 create mode 100644 queue-4.19/net-netsec-fix-signedness-bug-in-netsec_probe.patch
 create mode 100644 queue-4.19/net-nixge-fix-a-signedness-bug-in-nixge_probe.patch
 create mode 100644 queue-4.19/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
 create mode 100644 queue-4.19/net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch
 create mode 100644 queue-4.19/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
 create mode 100644 queue-4.19/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
 create mode 100644 queue-4.19/net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch
 create mode 100644 queue-4.19/net-qca_spi-move-reset_count-to-struct-qcaspi.patch
 create mode 100644 queue-4.19/net-rds-add-a-few-missing-rds_stat_names-entries.patch
 create mode 100644 queue-4.19/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
 create mode 100644 queue-4.19/net-sched-act_csum-fix-csum-calc-for-tagged-packets.patch
 create mode 100644 queue-4.19/net-sched-cbs-avoid-division-by-zero-when-calculatin.patch
 create mode 100644 queue-4.19/net-sched-cbs-fix-error-path-of-cbs_module_init.patch
 create mode 100644 queue-4.19/net-sched-cbs-fix-port_rate-miscalculation.patch
 create mode 100644 queue-4.19/net-sched-cbs-set-default-link-speed-to-10-mbps-in-c.patch
 create mode 100644 queue-4.19/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
 create mode 100644 queue-4.19/net-smc-original-socket-family-in-inet_sock_diag.patch
 create mode 100644 queue-4.19/net-smc-receive-pending-data-after-rcv_shutdown.patch
 create mode 100644 queue-4.19/net-smc-receive-returns-without-data.patch
 create mode 100644 queue-4.19/net-socionext-add-dummy-phy-register-read-in-phy_wri.patch
 create mode 100644 queue-4.19/net-socionext-fix-a-signedness-bug-in-ave_probe.patch
 create mode 100644 queue-4.19/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
 create mode 100644 queue-4.19/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
 create mode 100644 queue-4.19/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
 create mode 100644 queue-4.19/net-stmmac-fix-disabling-flexible-pps-output.patch
 create mode 100644 queue-4.19/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
 create mode 100644 queue-4.19/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
 create mode 100644 queue-4.19/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
 create mode 100644 queue-4.19/net-udp_gso-allow-tx-timestamp-with-udp-gso.patch
 create mode 100644 queue-4.19/netfilter-ctnetlink-honor-ips_offload-flag.patch
 create mode 100644 queue-4.19/netfilter-ebtables-config_compat-reject-trailing-dat.patch
 create mode 100644 queue-4.19/netfilter-nf_flow_table-do-not-remove-offload-when-o.patch
 create mode 100644 queue-4.19/netfilter-nf_tables-correct-nft_loglevel_max-value.patch
 create mode 100644 queue-4.19/netfilter-nft_flow_offload-add-entry-to-flowtable-af.patch
 create mode 100644 queue-4.19/netfilter-nft_osf-usage-from-output-path-is-not-vali.patch
 create mode 100644 queue-4.19/netfilter-nft_set_hash-bogus-element-self-comparison.patch
 create mode 100644 queue-4.19/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch
 create mode 100644 queue-4.19/netvsc-unshare-skb-in-vf-rx-handler.patch
 create mode 100644 queue-4.19/nfp-bpf-fix-static-check-error-through-tightening-sh.patch
 create mode 100644 queue-4.19/nfp-fix-simple-vnic-mailbox-length.patch
 create mode 100644 queue-4.19/nfs-add-missing-encode-decode-sequence_maxsz-to-v4.2.patch
 create mode 100644 queue-4.19/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch
 create mode 100644 queue-4.19/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
 create mode 100644 queue-4.19/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch
 create mode 100644 queue-4.19/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch
 create mode 100644 queue-4.19/nios2-ksyms-add-missing-symbol-exports.patch
 create mode 100644 queue-4.19/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch
 create mode 100644 queue-4.19/ntb_hw_switchtec-debug-print-64bit-aligned-crosslink.patch
 create mode 100644 queue-4.19/ntb_hw_switchtec-nt-req-id-mapping-table-register-en.patch
 create mode 100644 queue-4.19/ntb_hw_switchtec-potential-shift-wrapping-bug-in-swi.patch
 create mode 100644 queue-4.19/nvme-retain-split-access-workaround-for-capability-r.patch
 create mode 100644 queue-4.19/nvmem-imx-ocotp-change-timing-calculation-to-u-boot-.patch
 create mode 100644 queue-4.19/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch
 create mode 100644 queue-4.19/of-fix-property-name-in-of_node_get_device_type.patch
 create mode 100644 queue-4.19/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
 create mode 100644 queue-4.19/of-use-correct-function-prototype-for-of_overlay_fdt.patch
 create mode 100644 queue-4.19/opp-fix-missing-debugfs-supply-directory-for-opps.patch
 create mode 100644 queue-4.19/packet-fix-data-race-in-fanout_flow_is_huge.patch
 create mode 100644 queue-4.19/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
 create mode 100644 queue-4.19/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
 create mode 100644 queue-4.19/pci-dwc-fix-dw_pcie_ep_find_capability-to-return-cor.patch
 create mode 100644 queue-4.19/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch
 create mode 100644 queue-4.19/pci-fix-try-semantics-of-bus-and-slot-reset.patch
 create mode 100644 queue-4.19/pci-iproc-enable-iproc-config-read-for-paxbv2.patch
 create mode 100644 queue-4.19/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch
 create mode 100644 queue-4.19/pci-mobiveil-fix-devfn-check-in-mobiveil_pcie_valid_.patch
 create mode 100644 queue-4.19/pci-mobiveil-fix-the-valid-check-for-inbound-and-out.patch
 create mode 100644 queue-4.19/pci-mobiveil-remove-the-flag-msi_flag_multi_pci_msi.patch
 create mode 100644 queue-4.19/pci-pm-avoid-possible-suspend-to-idle-issue.patch
 create mode 100644 queue-4.19/pci-pm-skip-devices-in-d0-for-suspend-to-idle.patch
 create mode 100644 queue-4.19/pci-rockchip-fix-rockchip_pcie_ep_assert_intx-bitwis.patch
 create mode 100644 queue-4.19/pcrypt-use-format-specifier-in-kobject_add.patch
 create mode 100644 queue-4.19/perf-copy-parent-s-address-filter-offsets-on-clone.patch
 create mode 100644 queue-4.19/perf-core-fix-the-address-filtering-fix.patch
 create mode 100644 queue-4.19/perf-ioctl-add-check-for-the-sample_period-value.patch
 create mode 100644 queue-4.19/perf-pt-coresight-fix-address-filters-for-vmas-with-.patch
 create mode 100644 queue-4.19/phy-qcom-qusb2-fix-missing-assignment-of-ret-when-ca.patch
 create mode 100644 queue-4.19/phy-usb-phy-brcm-usb-remove-sysfs-attributes-upon-dr.patch
 create mode 100644 queue-4.19/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch
 create mode 100644 queue-4.19/pinctrl-meson-gxl-remove-invalid-gpiox-tsin_a-pins.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a77970-add-missing-mod_sel0-field.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a77980-add-missing-mod_sel0-field.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
 create mode 100644 queue-4.19/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
 create mode 100644 queue-4.19/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch
 create mode 100644 queue-4.19/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
 create mode 100644 queue-4.19/platform-x86-wmi-fix-potential-null-pointer-derefere.patch
 create mode 100644 queue-4.19/pm-acpi-pci-resume-all-devices-during-hibernation.patch
 create mode 100644 queue-4.19/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch
 create mode 100644 queue-4.19/power-supply-init-device-wakeup-after-device_add.patch
 create mode 100644 queue-4.19/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch
 create mode 100644 queue-4.19/powerpc-64s-radix-fix-memory-hot-unplug-page-table-s.patch
 create mode 100644 queue-4.19/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
 create mode 100644 queue-4.19/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch
 create mode 100644 queue-4.19/powerpc-mm-check-secondary-hash-page-table.patch
 create mode 100644 queue-4.19/powerpc-mm-mce-keep-irqs-disabled-during-lockless-pa.patch
 create mode 100644 queue-4.19/powerpc-pseries-memory-hotplug-fix-return-value-type.patch
 create mode 100644 queue-4.19/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
 create mode 100644 queue-4.19/powerpc-vdso-make-vdso32-installation-conditional-in.patch
 create mode 100644 queue-4.19/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
 create mode 100644 queue-4.19/pwm-meson-consider-128-a-valid-pre-divider.patch
 create mode 100644 queue-4.19/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
 create mode 100644 queue-4.19/qed-iwarp-fix-uninitialized-callback.patch
 create mode 100644 queue-4.19/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch
 create mode 100644 queue-4.19/qed-reduce-maximum-stack-frame-size.patch
 create mode 100644 queue-4.19/rbd-clear-xferred-on-error-from-rbd_obj_issue_copyup.patch
 create mode 100644 queue-4.19/rdma-bnxt_re-add-missing-spin-lock-initialization.patch
 create mode 100644 queue-4.19/rdma-cma-fix-false-error-message.patch
 create mode 100644 queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch
 create mode 100644 queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-unloadin.patch
 create mode 100644 queue-4.19/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
 create mode 100644 queue-4.19/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch
 create mode 100644 queue-4.19/rdma-mlx5-fix-memory-leak-in-case-we-fail-to-add-an-.patch
 create mode 100644 queue-4.19/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
 create mode 100644 queue-4.19/rdma-qedr-fix-incorrect-device-rate.patch
 create mode 100644 queue-4.19/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
 create mode 100644 queue-4.19/rdma-rxe-consider-skb-reserve-space-based-on-netdev-.patch
 create mode 100644 queue-4.19/rdma-uverbs-check-for-allocation-failure-in-uapi_add.patch
 create mode 100644 queue-4.19/regulator-fixed-default-enable-high-on-dt-regulators.patch
 create mode 100644 queue-4.19/regulator-lp87565-fix-missing-register-for-lp87565_b.patch
 create mode 100644 queue-4.19/regulator-pv88060-fix-array-out-of-bounds-access.patch
 create mode 100644 queue-4.19/regulator-pv88080-fix-array-out-of-bounds-access.patch
 create mode 100644 queue-4.19/regulator-pv88090-fix-array-out-of-bounds-access.patch
 create mode 100644 queue-4.19/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
 create mode 100644 queue-4.19/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
 create mode 100644 queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-clocks-for-msm8.patch
 create mode 100644 queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-regulator-for-m.patch
 create mode 100644 queue-4.19/rtc-88pm80x-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.19/rtc-88pm860x-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.19/rtc-cmos-ignore-bogus-century-byte.patch
 create mode 100644 queue-4.19/rtc-ds1307-rx8130-fix-alarm-handling.patch
 create mode 100644 queue-4.19/rtc-ds1672-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.19/rtc-fix-timestamp-value-for-rtc_timestamp_begin_1900.patch
 create mode 100644 queue-4.19/rtc-mt6397-don-t-call-irq_dispose_mapping.patch
 create mode 100644 queue-4.19/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch
 create mode 100644 queue-4.19/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
 create mode 100644 queue-4.19/rtc-pcf8563-fix-interrupt-trigger-method.patch
 create mode 100644 queue-4.19/rtc-pm8xxx-fix-unintended-sign-extension.patch
 create mode 100644 queue-4.19/rtc-rv3029-revert-error-handling-patch-to-rv3029_eep.patch
 create mode 100644 queue-4.19/rtlwifi-fix-file-release-memory-leak.patch
 create mode 100644 queue-4.19/rtlwifi-rtl8821ae-replace-_rtl8821ae_mrate_idx_to_ar.patch
 create mode 100644 queue-4.19/rxrpc-fix-detection-of-out-of-order-acks.patch
 create mode 100644 queue-4.19/rxrpc-fix-lack-of-conn-cleanup-when-local-endpoint-i.patch
 create mode 100644 queue-4.19/rxrpc-fix-trace-after-put-looking-at-the-put-connect.patch
 create mode 100644 queue-4.19/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
 create mode 100644 queue-4.19/s390-kexec_file-fix-potential-segment-overlap-in-elf.patch
 create mode 100644 queue-4.19/s390-qeth-fix-error-handling-during-vnicc-initializa.patch
 create mode 100644 queue-4.19/s390-qeth-fix-initialization-of-vnicc-cmd-masks-duri.patch
 create mode 100644 queue-4.19/samples-bpf-fix-broken-xdp_rxq_info-due-to-map-order.patch
 create mode 100644 queue-4.19/scsi-fnic-fix-msix-interrupt-allocation.patch
 create mode 100644 queue-4.19/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
 create mode 100644 queue-4.19/scsi-megaraid_sas-reduce-module-load-time.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-fix-a-format-specifier.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-fix-error-handling-in-qlt_alloc_qfull_c.patch
 create mode 100644 queue-4.19/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
 create mode 100644 queue-4.19/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch
 create mode 100644 queue-4.19/sctp-add-chunks-to-sk_backlog-when-the-newsk-sk_sock.patch
 create mode 100644 queue-4.19/selftests-ipc-fix-msgque-compiler-warnings.patch
 create mode 100644 queue-4.19/serial-stm32-add-support-of-tc-bit-status-check.patch
 create mode 100644 queue-4.19/serial-stm32-fix-a-recursive-locking-in-stm32_config.patch
 create mode 100644 queue-4.19/serial-stm32-fix-clearing-interrupt-error-flags.patch
 create mode 100644 queue-4.19/serial-stm32-fix-rx-data-length-when-parity-enabled.patch
 create mode 100644 queue-4.19/serial-stm32-fix-rx-error-handling.patch
 create mode 100644 queue-4.19/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
 create mode 100644 queue-4.19/serial-stm32-fix-wakeup-source-initialization.patch
 create mode 100644 queue-4.19/serial-stm32-fix-word-length-configuration.patch
 create mode 100644 queue-4.19/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
 create mode 100644 queue-4.19/signal-bpfilter-fix-bpfilter_kernl-to-use-send_sig-n.patch
 create mode 100644 queue-4.19/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
 create mode 100644 queue-4.19/signal-ia64-use-the-force_sig-sigsegv-.-in-ia64_rt_s.patch
 create mode 100644 queue-4.19/signal-ia64-use-the-generic-force_sigsegv-in-setup_f.patch
 create mode 100644 queue-4.19/soc-amlogic-gx-socinfo-add-mask-for-each-soc-package.patch
 create mode 100644 queue-4.19/soc-amlogic-meson-gx-pwrc-vpu-fix-power-on-off-regis.patch
 create mode 100644 queue-4.19/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
 create mode 100644 queue-4.19/soc-qcom-cmd-db-fix-an-error-code-in-cmd_db_dev_prob.patch
 create mode 100644 queue-4.19/spi-bcm-qspi-fix-bspi-quad-and-dual-mode-support-whe.patch
 create mode 100644 queue-4.19/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
 create mode 100644 queue-4.19/spi-cadence-correct-initialisation-of-runtime-pm.patch
 create mode 100644 queue-4.19/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
 create mode 100644 queue-4.19/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
 create mode 100644 queue-4.19/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch
 create mode 100644 queue-4.19/spi-tegra114-fix-for-unpacked-mode-transfers.patch
 create mode 100644 queue-4.19/spi-tegra114-flush-fifos.patch
 create mode 100644 queue-4.19/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch
 create mode 100644 queue-4.19/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch
 create mode 100644 queue-4.19/staging-android-vsoc-fix-copy_from_user-overrun.patch
 create mode 100644 queue-4.19/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch
 create mode 100644 queue-4.19/staging-bcm2835-camera-fix-module-autoloading.patch
 create mode 100644 queue-4.19/staging-comedi-ni_mio_common-protect-register-write-.patch
 create mode 100644 queue-4.19/staging-greybus-light-fix-a-couple-double-frees.patch
 create mode 100644 queue-4.19/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
 create mode 100644 queue-4.19/staging-r8822be-check-kzalloc-return-or-bail.patch
 create mode 100644 queue-4.19/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch
 create mode 100644 queue-4.19/switchtec-remove-immediate-status-check-after-submit.patch
 create mode 100644 queue-4.19/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch
 create mode 100644 queue-4.19/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
 create mode 100644 queue-4.19/thermal-mediatek-fix-register-index-error.patch
 create mode 100644 queue-4.19/thermal-rcar_gen3_thermal-fix-interrupt-type.patch
 create mode 100644 queue-4.19/tipc-eliminate-message-disordering-during-binding-ta.patch
 create mode 100644 queue-4.19/tipc-reduce-risk-of-wakeup-queue-starvation.patch
 create mode 100644 queue-4.19/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
 create mode 100644 queue-4.19/tipc-tipc-clang-warning.patch
 create mode 100644 queue-4.19/tools-bpftool-fix-arguments-for-p_err-in-do_event_pi.patch
 create mode 100644 queue-4.19/tools-bpftool-fix-format-strings-and-arguments-for-j.patch
 create mode 100644 queue-4.19/tools-bpftool-use-correct-argument-in-cgroup-errors.patch
 create mode 100644 queue-4.19/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
 create mode 100644 queue-4.19/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch
 create mode 100644 queue-4.19/um-fix-irq-controller-regression-on-console-read.patch
 create mode 100644 queue-4.19/um-fix-off-by-one-error-in-irq-enumeration.patch
 create mode 100644 queue-4.19/usb-dwc3-add-extcon-dependency-for-qcom.patch
 create mode 100644 queue-4.19/usb-dwc3-allow-building-usb_dwc3_qcom-without-extcon.patch
 create mode 100644 queue-4.19/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
 create mode 100644 queue-4.19/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
 create mode 100644 queue-4.19/usb-host-xhci-hub-fix-extra-endianness-conversion.patch
 create mode 100644 queue-4.19/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
 create mode 100644 queue-4.19/usb-typec-tcpm-notify-the-tcpc-to-start-connection-d.patch
 create mode 100644 queue-4.19/usb-typec-tps6598x-fix-build-error-without-config_re.patch
 create mode 100644 queue-4.19/vfio-mdev-avoid-release-parent-reference-during-erro.patch
 create mode 100644 queue-4.19/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch
 create mode 100644 queue-4.19/vfio-mdev-follow-correct-remove-sequence.patch
 create mode 100644 queue-4.19/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
 create mode 100644 queue-4.19/vhost-test-stop-device-before-reset.patch
 create mode 100644 queue-4.19/vxlan-changelink-fix-handling-of-default-remotes.patch
 create mode 100644 queue-4.19/watchdog-rtd119x_wdt-fix-remove-function.patch
 create mode 100644 queue-4.19/wcn36xx-use-dynamic-allocation-for-large-variables.patch
 create mode 100644 queue-4.19/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
 create mode 100644 queue-4.19/x86-mm-remove-unused-variable-cpu.patch
 create mode 100644 queue-4.19/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
 create mode 100644 queue-4.19/x86-pgtable-32-fix-lowmem_pages-constant.patch
 create mode 100644 queue-4.19/xdp-fix-possible-cq-entry-leak.patch
 create mode 100644 queue-4.19/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
 create mode 100644 queue-4.19/xfrm-interface-ifname-may-be-wrong-in-logs.patch
 create mode 100644 queue-4.19/xprtrdma-fix-use-after-free-in-rpcrdma_post_recvs.patch
 create mode 100644 queue-4.19/xsk-add-missing-smp_rmb-in-xsk_mmap.patch
 create mode 100644 queue-4.19/xsk-avoid-store-tearing-when-assigning-queues.patch
 create mode 100644 queue-4.19/xsk-avoid-store-tearing-when-assigning-umem.patch
 create mode 100644 queue-4.19/xsk-fix-registration-of-rx-only-sockets.patch

diff --git a/queue-4.19/6lowpan-off-by-one-handling-nexthdr.patch b/queue-4.19/6lowpan-off-by-one-handling-nexthdr.patch
new file mode 100644
index 00000000000..a3d89b1639b
--- /dev/null
+++ b/queue-4.19/6lowpan-off-by-one-handling-nexthdr.patch
@@ -0,0 +1,41 @@
+From 066879c4bee2631563d3b74508add93fa1dedf9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 08:34:16 +0300
+Subject: 6lowpan: Off by one handling ->nexthdr
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]
+
+NEXTHDR_MAX is 255.  What happens here is that we take a u8 value
+"hdr->nexthdr" from the network and then look it up in
+lowpan_nexthdr_nhcs[].  The problem is that if hdr->nexthdr is 0xff then
+we read one element beyond the end of the array so the array needs to
+be one element larger.
+
+Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Acked-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/6lowpan/nhc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
+index 4fa2fdda174d0..9e56fb98f33cf 100644
+--- a/net/6lowpan/nhc.c
++++ b/net/6lowpan/nhc.c
+@@ -18,7 +18,7 @@
+ #include "nhc.h"
+ 
+ static struct rb_root rb_root = RB_ROOT;
+-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
+ static DEFINE_SPINLOCK(lowpan_nhc_lock);
+ 
+ static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
+-- 
+2.20.1
+
diff --git a/queue-4.19/acpi-button-reinitialize-button-state-upon-resume.patch b/queue-4.19/acpi-button-reinitialize-button-state-upon-resume.patch
new file mode 100644
index 00000000000..a0e56a771d8
--- /dev/null
+++ b/queue-4.19/acpi-button-reinitialize-button-state-upon-resume.patch
@@ -0,0 +1,51 @@
+From 07c93f91f9c9722edf92dd102642342743062eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2019 21:38:32 +0800
+Subject: ACPI: button: reinitialize button state upon resume
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 13e962140be671f31a011543f11477af67a6c33e ]
+
+With commit dfa46c50f65b ("ACPI / button: Fix an issue in
+button.lid_init_state=ignore mode"), the lid device is considered to be
+not compliant to SW_LID if the Lid state is unchanged when updating it.
+
+This is not wrong, but we overlooked the resume case, where Lid state is
+updated unconditionally in the button driver .resume() callback. And this
+results in warning message "ACPI: button: The lid device is not compliant
+to  SW_LID." after resume, if the machine is suspended with Lid opened and
+then resumed with Lid opened.
+
+Fix this by flushing the cached lid state before updating the Lid device
+in .resume() callback.
+
+Fixes: dfa46c50f65b ("ACPI / button: Fix an issue in button.lid_init_state=ignore mode")
+Reported-and-tested-by: Zhao Lijian <lijian.zhao@intel.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/button.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index 870eb5c7516a5..a25d77b3a16ad 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -467,8 +467,11 @@ static int acpi_button_resume(struct device *dev)
+ 	struct acpi_button *button = acpi_driver_data(device);
+ 
+ 	button->suspended = false;
+-	if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users)
++	if (button->type == ACPI_BUTTON_TYPE_LID && button->input->users) {
++		button->last_state = !!acpi_lid_evaluate_state(device);
++		button->last_time = ktime_get();
+ 		acpi_lid_initialize_state(device);
++	}
+ 	return 0;
+ }
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-4.19/acpi-pm-introduce-poweroff-callbacks-for-acpi-pm-dom.patch b/queue-4.19/acpi-pm-introduce-poweroff-callbacks-for-acpi-pm-dom.patch
new file mode 100644
index 00000000000..f9f79cc6b1d
--- /dev/null
+++ b/queue-4.19/acpi-pm-introduce-poweroff-callbacks-for-acpi-pm-dom.patch
@@ -0,0 +1,206 @@
+From bdf1ef1dd8e9cde1f5d366ffcb2d0b6edcb92a39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2019 12:54:29 +0200
+Subject: ACPI: PM: Introduce "poweroff" callbacks for ACPI PM domain and LPSS
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit c95b7595f85c688d5c569ddbbd6ab6a4bdae2f36 ]
+
+In general, it is not correct to call pm_generic_suspend(),
+pm_generic_suspend_late() and pm_generic_suspend_noirq() during the
+hibernation's "poweroff" transition, because device drivers may
+provide special callbacks to be invoked then and the wrappers in
+question cause system suspend callbacks to be run.  Unfortunately,
+that happens in the ACPI PM domain and ACPI LPSS.
+
+To address this potential issue, introduce "poweroff" callbacks
+for the ACPI PM and LPSS that will use pm_generic_poweroff(),
+pm_generic_poweroff_late() and pm_generic_poweroff_noirq() as
+appropriate.
+
+Fixes: 05087360fd7a (ACPI / PM: Take SMART_SUSPEND driver flag into account)
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 50 +++++++++++++++++++++++++++++++---
+ drivers/acpi/device_pm.c | 58 +++++++++++++++++++++++++++++++++++++---
+ include/linux/acpi.h     |  2 ++
+ 3 files changed, 104 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 11c460ab9de9c..ded6c5c17fd73 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -1056,6 +1056,13 @@ static int acpi_lpss_suspend_noirq(struct device *dev)
+ 	int ret;
+ 
+ 	if (pdata->dev_desc->resume_from_noirq) {
++		/*
++		 * The driver's ->suspend_late callback will be invoked by
++		 * acpi_lpss_do_suspend_late(), with the assumption that the
++		 * driver really wanted to run that code in ->suspend_noirq, but
++		 * it could not run after acpi_dev_suspend() and the driver
++		 * expected the latter to be called in the "late" phase.
++		 */
+ 		ret = acpi_lpss_do_suspend_late(dev);
+ 		if (ret)
+ 			return ret;
+@@ -1142,6 +1149,43 @@ static int acpi_lpss_restore_noirq(struct device *dev)
+ 	/* This is analogous to what happens in acpi_lpss_resume_noirq(). */
+ 	return acpi_lpss_do_restore_early(dev);
+ }
++
++static int acpi_lpss_do_poweroff_late(struct device *dev)
++{
++	int ret = pm_generic_poweroff_late(dev);
++
++	return ret ? ret : acpi_lpss_suspend(dev, device_may_wakeup(dev));
++}
++
++static int acpi_lpss_poweroff_late(struct device *dev)
++{
++	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++	if (dev_pm_smart_suspend_and_suspended(dev))
++		return 0;
++
++	if (pdata->dev_desc->resume_from_noirq)
++		return 0;
++
++	return acpi_lpss_do_poweroff_late(dev);
++}
++
++static int acpi_lpss_poweroff_noirq(struct device *dev)
++{
++	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++	if (dev_pm_smart_suspend_and_suspended(dev))
++		return 0;
++
++	if (pdata->dev_desc->resume_from_noirq) {
++		/* This is analogous to the acpi_lpss_suspend_noirq() case. */
++		int ret = acpi_lpss_do_poweroff_late(dev);
++		if (ret)
++			return ret;
++	}
++
++	return pm_generic_poweroff_noirq(dev);
++}
+ #endif /* CONFIG_PM_SLEEP */
+ 
+ static int acpi_lpss_runtime_suspend(struct device *dev)
+@@ -1175,9 +1219,9 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
+ 		.resume_noirq = acpi_lpss_resume_noirq,
+ 		.resume_early = acpi_lpss_resume_early,
+ 		.freeze = acpi_subsys_freeze,
+-		.poweroff = acpi_subsys_suspend,
+-		.poweroff_late = acpi_lpss_suspend_late,
+-		.poweroff_noirq = acpi_lpss_suspend_noirq,
++		.poweroff = acpi_subsys_poweroff,
++		.poweroff_late = acpi_lpss_poweroff_late,
++		.poweroff_noirq = acpi_lpss_poweroff_noirq,
+ 		.restore_noirq = acpi_lpss_restore_noirq,
+ 		.restore_early = acpi_lpss_restore_early,
+ #endif
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 5a88a63e902dd..54b6547d32b24 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1137,6 +1137,58 @@ int acpi_subsys_restore_early(struct device *dev)
+ 	return ret ? ret : pm_generic_restore_early(dev);
+ }
+ EXPORT_SYMBOL_GPL(acpi_subsys_restore_early);
++
++/**
++ * acpi_subsys_poweroff - Run the device driver's poweroff callback.
++ * @dev: Device to handle.
++ *
++ * Follow PCI and resume devices from runtime suspend before running their
++ * system poweroff callbacks, unless the driver can cope with runtime-suspended
++ * devices during system suspend and there are no ACPI-specific reasons for
++ * resuming them.
++ */
++int acpi_subsys_poweroff(struct device *dev)
++{
++	if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND) ||
++	    acpi_dev_needs_resume(dev, ACPI_COMPANION(dev)))
++		pm_runtime_resume(dev);
++
++	return pm_generic_poweroff(dev);
++}
++EXPORT_SYMBOL_GPL(acpi_subsys_poweroff);
++
++/**
++ * acpi_subsys_poweroff_late - Run the device driver's poweroff callback.
++ * @dev: Device to handle.
++ *
++ * Carry out the generic late poweroff procedure for @dev and use ACPI to put
++ * it into a low-power state during system transition into a sleep state.
++ */
++static int acpi_subsys_poweroff_late(struct device *dev)
++{
++	int ret;
++
++	if (dev_pm_smart_suspend_and_suspended(dev))
++		return 0;
++
++	ret = pm_generic_poweroff_late(dev);
++	if (ret)
++		return ret;
++
++	return acpi_dev_suspend(dev, device_may_wakeup(dev));
++}
++
++/**
++ * acpi_subsys_poweroff_noirq - Run the driver's "noirq" poweroff callback.
++ * @dev: Device to suspend.
++ */
++static int acpi_subsys_poweroff_noirq(struct device *dev)
++{
++	if (dev_pm_smart_suspend_and_suspended(dev))
++		return 0;
++
++	return pm_generic_poweroff_noirq(dev);
++}
+ #endif /* CONFIG_PM_SLEEP */
+ 
+ static struct dev_pm_domain acpi_general_pm_domain = {
+@@ -1152,9 +1204,9 @@ static struct dev_pm_domain acpi_general_pm_domain = {
+ 		.resume_noirq = acpi_subsys_resume_noirq,
+ 		.resume_early = acpi_subsys_resume_early,
+ 		.freeze = acpi_subsys_freeze,
+-		.poweroff = acpi_subsys_suspend,
+-		.poweroff_late = acpi_subsys_suspend_late,
+-		.poweroff_noirq = acpi_subsys_suspend_noirq,
++		.poweroff = acpi_subsys_poweroff,
++		.poweroff_late = acpi_subsys_poweroff_late,
++		.poweroff_noirq = acpi_subsys_poweroff_noirq,
+ 		.restore_early = acpi_subsys_restore_early,
+ #endif
+ 	},
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 32fabeeda5e30..cd412817654fa 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -919,6 +919,7 @@ int acpi_subsys_suspend_late(struct device *dev);
+ int acpi_subsys_suspend_noirq(struct device *dev);
+ int acpi_subsys_suspend(struct device *dev);
+ int acpi_subsys_freeze(struct device *dev);
++int acpi_subsys_poweroff(struct device *dev);
+ #else
+ static inline int acpi_dev_resume_early(struct device *dev) { return 0; }
+ static inline int acpi_subsys_prepare(struct device *dev) { return 0; }
+@@ -927,6 +928,7 @@ static inline int acpi_subsys_suspend_late(struct device *dev) { return 0; }
+ static inline int acpi_subsys_suspend_noirq(struct device *dev) { return 0; }
+ static inline int acpi_subsys_suspend(struct device *dev) { return 0; }
+ static inline int acpi_subsys_freeze(struct device *dev) { return 0; }
++static inline int acpi_subsys_poweroff(struct device *dev) { return 0; }
+ #endif
+ 
+ #ifdef CONFIG_ACPI
+-- 
+2.20.1
+
diff --git a/queue-4.19/acpi-pm-simplify-and-fix-pm-domain-hibernation-callb.patch b/queue-4.19/acpi-pm-simplify-and-fix-pm-domain-hibernation-callb.patch
new file mode 100644
index 00000000000..fe433b5fa91
--- /dev/null
+++ b/queue-4.19/acpi-pm-simplify-and-fix-pm-domain-hibernation-callb.patch
@@ -0,0 +1,265 @@
+From fc120df6187f1dddaff01948401c25f4f039f865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2019 12:54:10 +0200
+Subject: ACPI: PM: Simplify and fix PM domain hibernation callbacks
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 3cd7957e85e67120bb9f6bfb75d81dcc19af282b ]
+
+First, after a previous change causing all runtime-suspended devices
+in the ACPI PM domain (and ACPI LPSS devices) to be resumed before
+creating a snapshot image of memory during hibernation, it is not
+necessary to worry about the case in which them might be left in
+runtime-suspend any more, so get rid of the code related to that from
+ACPI PM domain and ACPI LPSS hibernation callbacks.
+
+Second, it is not correct to use pm_generic_resume_early() and
+acpi_subsys_resume_noirq() in hibernation "restore" callbacks (which
+currently happens in the ACPI PM domain and ACPI LPSS), so introduce
+proper _restore_late and _restore_noirq callbacks for the ACPI PM
+domain and ACPI LPSS.
+
+Fixes: 05087360fd7a (ACPI / PM: Take SMART_SUSPEND driver flag into account)
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 61 ++++++++++++++++++++++++++++++++++------
+ drivers/acpi/device_pm.c | 61 ++++++----------------------------------
+ include/linux/acpi.h     | 10 -------
+ 3 files changed, 61 insertions(+), 71 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 30ccd94f87d24..11c460ab9de9c 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -1086,16 +1086,62 @@ static int acpi_lpss_resume_noirq(struct device *dev)
+ 	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
+ 	int ret;
+ 
+-	ret = acpi_subsys_resume_noirq(dev);
++	/* Follow acpi_subsys_resume_noirq(). */
++	if (dev_pm_may_skip_resume(dev))
++		return 0;
++
++	if (dev_pm_smart_suspend_and_suspended(dev))
++		pm_runtime_set_active(dev);
++
++	ret = pm_generic_resume_noirq(dev);
+ 	if (ret)
+ 		return ret;
+ 
+-	if (!dev_pm_may_skip_resume(dev) && pdata->dev_desc->resume_from_noirq)
+-		ret = acpi_lpss_do_resume_early(dev);
++	if (!pdata->dev_desc->resume_from_noirq)
++		return 0;
+ 
+-	return ret;
++	/*
++	 * The driver's ->resume_early callback will be invoked by
++	 * acpi_lpss_do_resume_early(), with the assumption that the driver
++	 * really wanted to run that code in ->resume_noirq, but it could not
++	 * run before acpi_dev_resume() and the driver expected the latter to be
++	 * called in the "early" phase.
++	 */
++	return acpi_lpss_do_resume_early(dev);
++}
++
++static int acpi_lpss_do_restore_early(struct device *dev)
++{
++	int ret = acpi_lpss_resume(dev);
++
++	return ret ? ret : pm_generic_restore_early(dev);
++}
++
++static int acpi_lpss_restore_early(struct device *dev)
++{
++	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++
++	if (pdata->dev_desc->resume_from_noirq)
++		return 0;
++
++	return acpi_lpss_do_restore_early(dev);
+ }
+ 
++static int acpi_lpss_restore_noirq(struct device *dev)
++{
++	struct lpss_private_data *pdata = acpi_driver_data(ACPI_COMPANION(dev));
++	int ret;
++
++	ret = pm_generic_restore_noirq(dev);
++	if (ret)
++		return ret;
++
++	if (!pdata->dev_desc->resume_from_noirq)
++		return 0;
++
++	/* This is analogous to what happens in acpi_lpss_resume_noirq(). */
++	return acpi_lpss_do_restore_early(dev);
++}
+ #endif /* CONFIG_PM_SLEEP */
+ 
+ static int acpi_lpss_runtime_suspend(struct device *dev)
+@@ -1129,14 +1175,11 @@ static struct dev_pm_domain acpi_lpss_pm_domain = {
+ 		.resume_noirq = acpi_lpss_resume_noirq,
+ 		.resume_early = acpi_lpss_resume_early,
+ 		.freeze = acpi_subsys_freeze,
+-		.freeze_late = acpi_subsys_freeze_late,
+-		.freeze_noirq = acpi_subsys_freeze_noirq,
+-		.thaw_noirq = acpi_subsys_thaw_noirq,
+ 		.poweroff = acpi_subsys_suspend,
+ 		.poweroff_late = acpi_lpss_suspend_late,
+ 		.poweroff_noirq = acpi_lpss_suspend_noirq,
+-		.restore_noirq = acpi_lpss_resume_noirq,
+-		.restore_early = acpi_lpss_resume_early,
++		.restore_noirq = acpi_lpss_restore_noirq,
++		.restore_early = acpi_lpss_restore_early,
+ #endif
+ 		.runtime_suspend = acpi_lpss_runtime_suspend,
+ 		.runtime_resume = acpi_lpss_runtime_resume,
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 11b7a1632e5aa..5a88a63e902dd 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1077,7 +1077,7 @@ EXPORT_SYMBOL_GPL(acpi_subsys_suspend_noirq);
+  * acpi_subsys_resume_noirq - Run the device driver's "noirq" resume callback.
+  * @dev: Device to handle.
+  */
+-int acpi_subsys_resume_noirq(struct device *dev)
++static int acpi_subsys_resume_noirq(struct device *dev)
+ {
+ 	if (dev_pm_may_skip_resume(dev))
+ 		return 0;
+@@ -1092,7 +1092,6 @@ int acpi_subsys_resume_noirq(struct device *dev)
+ 
+ 	return pm_generic_resume_noirq(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_resume_noirq);
+ 
+ /**
+  * acpi_subsys_resume_early - Resume device using ACPI.
+@@ -1102,12 +1101,11 @@ EXPORT_SYMBOL_GPL(acpi_subsys_resume_noirq);
+  * generic early resume procedure for it during system transition into the
+  * working state.
+  */
+-int acpi_subsys_resume_early(struct device *dev)
++static int acpi_subsys_resume_early(struct device *dev)
+ {
+ 	int ret = acpi_dev_resume(dev);
+ 	return ret ? ret : pm_generic_resume_early(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_resume_early);
+ 
+ /**
+  * acpi_subsys_freeze - Run the device driver's freeze callback.
+@@ -1130,52 +1128,15 @@ int acpi_subsys_freeze(struct device *dev)
+ EXPORT_SYMBOL_GPL(acpi_subsys_freeze);
+ 
+ /**
+- * acpi_subsys_freeze_late - Run the device driver's "late" freeze callback.
+- * @dev: Device to handle.
+- */
+-int acpi_subsys_freeze_late(struct device *dev)
+-{
+-
+-	if (dev_pm_smart_suspend_and_suspended(dev))
+-		return 0;
+-
+-	return pm_generic_freeze_late(dev);
+-}
+-EXPORT_SYMBOL_GPL(acpi_subsys_freeze_late);
+-
+-/**
+- * acpi_subsys_freeze_noirq - Run the device driver's "noirq" freeze callback.
+- * @dev: Device to handle.
+- */
+-int acpi_subsys_freeze_noirq(struct device *dev)
+-{
+-
+-	if (dev_pm_smart_suspend_and_suspended(dev))
+-		return 0;
+-
+-	return pm_generic_freeze_noirq(dev);
+-}
+-EXPORT_SYMBOL_GPL(acpi_subsys_freeze_noirq);
+-
+-/**
+- * acpi_subsys_thaw_noirq - Run the device driver's "noirq" thaw callback.
+- * @dev: Device to handle.
++ * acpi_subsys_restore_early - Restore device using ACPI.
++ * @dev: Device to restore.
+  */
+-int acpi_subsys_thaw_noirq(struct device *dev)
++int acpi_subsys_restore_early(struct device *dev)
+ {
+-	/*
+-	 * If the device is in runtime suspend, the "thaw" code may not work
+-	 * correctly with it, so skip the driver callback and make the PM core
+-	 * skip all of the subsequent "thaw" callbacks for the device.
+-	 */
+-	if (dev_pm_smart_suspend_and_suspended(dev)) {
+-		dev_pm_skip_next_resume_phases(dev);
+-		return 0;
+-	}
+-
+-	return pm_generic_thaw_noirq(dev);
++	int ret = acpi_dev_resume(dev);
++	return ret ? ret : pm_generic_restore_early(dev);
+ }
+-EXPORT_SYMBOL_GPL(acpi_subsys_thaw_noirq);
++EXPORT_SYMBOL_GPL(acpi_subsys_restore_early);
+ #endif /* CONFIG_PM_SLEEP */
+ 
+ static struct dev_pm_domain acpi_general_pm_domain = {
+@@ -1191,14 +1152,10 @@ static struct dev_pm_domain acpi_general_pm_domain = {
+ 		.resume_noirq = acpi_subsys_resume_noirq,
+ 		.resume_early = acpi_subsys_resume_early,
+ 		.freeze = acpi_subsys_freeze,
+-		.freeze_late = acpi_subsys_freeze_late,
+-		.freeze_noirq = acpi_subsys_freeze_noirq,
+-		.thaw_noirq = acpi_subsys_thaw_noirq,
+ 		.poweroff = acpi_subsys_suspend,
+ 		.poweroff_late = acpi_subsys_suspend_late,
+ 		.poweroff_noirq = acpi_subsys_suspend_noirq,
+-		.restore_noirq = acpi_subsys_resume_noirq,
+-		.restore_early = acpi_subsys_resume_early,
++		.restore_early = acpi_subsys_restore_early,
+ #endif
+ 	},
+ };
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index df1252e22dcfd..32fabeeda5e30 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -917,26 +917,16 @@ int acpi_subsys_prepare(struct device *dev);
+ void acpi_subsys_complete(struct device *dev);
+ int acpi_subsys_suspend_late(struct device *dev);
+ int acpi_subsys_suspend_noirq(struct device *dev);
+-int acpi_subsys_resume_noirq(struct device *dev);
+-int acpi_subsys_resume_early(struct device *dev);
+ int acpi_subsys_suspend(struct device *dev);
+ int acpi_subsys_freeze(struct device *dev);
+-int acpi_subsys_freeze_late(struct device *dev);
+-int acpi_subsys_freeze_noirq(struct device *dev);
+-int acpi_subsys_thaw_noirq(struct device *dev);
+ #else
+ static inline int acpi_dev_resume_early(struct device *dev) { return 0; }
+ static inline int acpi_subsys_prepare(struct device *dev) { return 0; }
+ static inline void acpi_subsys_complete(struct device *dev) {}
+ static inline int acpi_subsys_suspend_late(struct device *dev) { return 0; }
+ static inline int acpi_subsys_suspend_noirq(struct device *dev) { return 0; }
+-static inline int acpi_subsys_resume_noirq(struct device *dev) { return 0; }
+-static inline int acpi_subsys_resume_early(struct device *dev) { return 0; }
+ static inline int acpi_subsys_suspend(struct device *dev) { return 0; }
+ static inline int acpi_subsys_freeze(struct device *dev) { return 0; }
+-static inline int acpi_subsys_freeze_late(struct device *dev) { return 0; }
+-static inline int acpi_subsys_freeze_noirq(struct device *dev) { return 0; }
+-static inline int acpi_subsys_thaw_noirq(struct device *dev) { return 0; }
+ #endif
+ 
+ #ifdef CONFIG_ACPI
+-- 
+2.20.1
+
diff --git a/queue-4.19/act_mirred-fix-mirred_init_module-error-handling.patch b/queue-4.19/act_mirred-fix-mirred_init_module-error-handling.patch
new file mode 100644
index 00000000000..1b08994e6ed
--- /dev/null
+++ b/queue-4.19/act_mirred-fix-mirred_init_module-error-handling.patch
@@ -0,0 +1,40 @@
+From 9e2bf5ba58254c8de4c96c0fae00858c3e7bfcab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 11:10:52 +0800
+Subject: act_mirred: Fix mirred_init_module error handling
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 11c9a7d38af524217efb7a176ad322b97ac2f163 ]
+
+If tcf_register_action failed, mirred_device_notifier
+should be unregistered.
+
+Fixes: 3b87956ea645 ("net sched: fix race in mirred device removal")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_mirred.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 399e3beae6cf4..a30c17a282819 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -445,7 +445,11 @@ static int __init mirred_init_module(void)
+ 		return err;
+ 
+ 	pr_info("Mirror/redirect action on\n");
+-	return tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++	err = tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++	if (err)
++		unregister_netdevice_notifier(&mirred_device_notifier);
++
++	return err;
+ }
+ 
+ static void __exit mirred_cleanup_module(void)
+-- 
+2.20.1
+
diff --git a/queue-4.19/affs-fix-a-memory-leak-in-affs_remount.patch b/queue-4.19/affs-fix-a-memory-leak-in-affs_remount.patch
new file mode 100644
index 00000000000..289be260270
--- /dev/null
+++ b/queue-4.19/affs-fix-a-memory-leak-in-affs_remount.patch
@@ -0,0 +1,60 @@
+From de5f5d8535f1d578e49f09b8757edc9a6412af05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 16:52:37 -0500
+Subject: affs: fix a memory leak in affs_remount
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 450c3d4166837c496ebce03650c08800991f2150 ]
+
+In affs_remount if data is provided it is duplicated into new_opts.  The
+allocated memory for new_opts is only released if parse_options fails.
+
+There's a bit of history behind new_options, originally there was
+save/replace options on the VFS layer so the 'data' passed must not
+change (thus strdup), this got cleaned up in later patches. But not
+completely.
+
+There's no reason to do the strdup in cases where the filesystem does
+not need to reuse the 'data' again, because strsep would modify it
+directly.
+
+Fixes: c8f33d0bec99 ("affs: kstrdup() memory handling")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+[ update changelog ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/affs/super.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/fs/affs/super.c b/fs/affs/super.c
+index d1ad11a8a4a59..b6ce0c36029bd 100644
+--- a/fs/affs/super.c
++++ b/fs/affs/super.c
+@@ -561,14 +561,9 @@ affs_remount(struct super_block *sb, int *flags, char *data)
+ 	int			 root_block;
+ 	unsigned long		 mount_flags;
+ 	int			 res = 0;
+-	char			*new_opts;
+ 	char			 volume[32];
+ 	char			*prefix = NULL;
+ 
+-	new_opts = kstrdup(data, GFP_KERNEL);
+-	if (data && !new_opts)
+-		return -ENOMEM;
+-
+ 	pr_debug("%s(flags=0x%x,opts=\"%s\")\n", __func__, *flags, data);
+ 
+ 	sync_filesystem(sb);
+@@ -579,7 +574,6 @@ affs_remount(struct super_block *sb, int *flags, char *data)
+ 			   &blocksize, &prefix, volume,
+ 			   &mount_flags)) {
+ 		kfree(prefix);
+-		kfree(new_opts);
+ 		return -EINVAL;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-don-t-invalidate-callback-if-afs_vnode_dir_valid.patch b/queue-4.19/afs-don-t-invalidate-callback-if-afs_vnode_dir_valid.patch
new file mode 100644
index 00000000000..8655bc159e7
--- /dev/null
+++ b/queue-4.19/afs-don-t-invalidate-callback-if-afs_vnode_dir_valid.patch
@@ -0,0 +1,46 @@
+From 95fe27c5ec2c40dce8ba8b11e0b01994b3ba46f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 11:52:03 +0100
+Subject: afs: Don't invalidate callback if AFS_VNODE_DIR_VALID not set
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit d9052dda8a39069312218f913d22d99c48d90004 ]
+
+Don't invalidate the callback promise on a directory if the
+AFS_VNODE_DIR_VALID flag is not set (which indicates that the directory
+contents are invalid, due to edit failure, callback break, page reclaim).
+
+The directory will be reloaded next time the directory is accessed, so
+clearing the callback flag at this point may race with a reload of the
+directory and cancel it's recorded callback promise.
+
+Fixes: f3ddee8dc4e2 ("afs: Fix directory handling")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 718fab2f151a1..e6f11da5461be 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -398,12 +398,9 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ 			vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+ 			vnode->cb_v_break = vnode->volume->cb_v_break;
+ 			valid = false;
+-		} else if (vnode->status.type == AFS_FTYPE_DIR &&
+-			   (!test_bit(AFS_VNODE_DIR_VALID, &vnode->flags) ||
+-			    vnode->cb_expires_at - 10 <= now)) {
++		} else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) {
+ 			valid = false;
+-		} else if (test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags) ||
+-			   vnode->cb_expires_at - 10 <= now) {
++		} else if (vnode->cb_expires_at - 10 <= now) {
+ 			valid = false;
+ 		} else {
+ 			valid = true;
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-afs-file-locking-to-allow-fine-grained-locks.patch b/queue-4.19/afs-fix-afs-file-locking-to-allow-fine-grained-locks.patch
new file mode 100644
index 00000000000..3e50063bc4f
--- /dev/null
+++ b/queue-4.19/afs-fix-afs-file-locking-to-allow-fine-grained-locks.patch
@@ -0,0 +1,83 @@
+From d8da029eda2f1d348367bdb1d283f7b11eceffa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2019 14:26:50 +0100
+Subject: afs: Fix AFS file locking to allow fine grained locks
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 68ce801ffd82e72d5005ab5458e8b9e59f24d9cc ]
+
+Fix AFS file locking to allow fine grained locks as some applications, such
+as firefox, won't work if they can't take such locks on certain state files
+- thereby preventing the use of kAFS to distribute a home directory.
+
+Note that this cannot be made completely functional as the protocol only
+has provision for whole-file locks, so there exists the possibility of a
+process deadlocking itself by getting a partial read-lock on a file first
+and then trying to get a non-overlapping write-lock - but we got the
+server's read lock with the first lock, so we're now stuck.
+
+OpenAFS solves this by just granting any partial-range lock directly
+without consulting the server - and hoping there's no remote collision.  I
+want to implement that in a separate patch and it requires a bit more
+thought.
+
+Fixes: 8d6c554126b8 ("AFS: implement file locking")
+Reported-by: Jonathan Billings <jsbillings@jsbillings.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/flock.c | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index 1bb300ef362b0..dffbb456629c9 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -432,10 +432,6 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
+ 
+ 	_enter("{%x:%u},%u", vnode->fid.vid, vnode->fid.vnode, fl->fl_type);
+ 
+-	/* only whole-file locks are supported */
+-	if (fl->fl_start != 0 || fl->fl_end != OFFSET_MAX)
+-		return -EINVAL;
+-
+ 	fl->fl_ops = &afs_lock_ops;
+ 	INIT_LIST_HEAD(&fl->fl_u.afs.link);
+ 	fl->fl_u.afs.state = AFS_LOCK_PENDING;
+@@ -587,10 +583,6 @@ static int afs_do_unlk(struct file *file, struct file_lock *fl)
+ 	/* Flush all pending writes before doing anything with locks. */
+ 	vfs_fsync(file, 0);
+ 
+-	/* only whole-file unlocks are supported */
+-	if (fl->fl_start != 0 || fl->fl_end != OFFSET_MAX)
+-		return -EINVAL;
+-
+ 	ret = posix_lock_file(file, fl, NULL);
+ 	_leave(" = %d [%u]", ret, vnode->lock_state);
+ 	return ret;
+@@ -618,12 +610,15 @@ static int afs_do_getlk(struct file *file, struct file_lock *fl)
+ 			goto error;
+ 
+ 		lock_count = READ_ONCE(vnode->status.lock_count);
+-		if (lock_count > 0)
+-			fl->fl_type = F_RDLCK;
+-		else
+-			fl->fl_type = F_WRLCK;
+-		fl->fl_start = 0;
+-		fl->fl_end = OFFSET_MAX;
++		if (lock_count != 0) {
++			if (lock_count > 0)
++				fl->fl_type = F_RDLCK;
++			else
++				fl->fl_type = F_WRLCK;
++			fl->fl_start = 0;
++			fl->fl_end = OFFSET_MAX;
++			fl->fl_pid = 0;
++		}
+ 	}
+ 
+ 	ret = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-double-inc-of-vnode-cb_break.patch b/queue-4.19/afs-fix-double-inc-of-vnode-cb_break.patch
new file mode 100644
index 00000000000..75476097ffc
--- /dev/null
+++ b/queue-4.19/afs-fix-double-inc-of-vnode-cb_break.patch
@@ -0,0 +1,46 @@
+From bed981cac99b237acbde056083587d8d773f1311 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 May 2019 23:14:41 +0100
+Subject: afs: Fix double inc of vnode->cb_break
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit fd711586bb7d63f257da5eff234e68c446ac35ea ]
+
+When __afs_break_callback() clears the CB_PROMISED flag, it increments
+vnode->cb_break to trigger a future refetch of the status and callback -
+however it also calls afs_clear_permits(), which also increments
+vnode->cb_break.
+
+Fix this by removing the increment from afs_clear_permits().
+
+Whilst we're at it, fix the conditional call to afs_put_permits() as the
+function checks to see if the argument is NULL, so the check is redundant.
+
+Fixes: be080a6f43c4 ("afs: Overhaul permit caching");
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/security.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/afs/security.c b/fs/afs/security.c
+index 81dfedb7879ff..66042b432baa8 100644
+--- a/fs/afs/security.c
++++ b/fs/afs/security.c
+@@ -87,11 +87,9 @@ void afs_clear_permits(struct afs_vnode *vnode)
+ 	permits = rcu_dereference_protected(vnode->permit_cache,
+ 					    lockdep_is_held(&vnode->lock));
+ 	RCU_INIT_POINTER(vnode->permit_cache, NULL);
+-	vnode->cb_break++;
+ 	spin_unlock(&vnode->lock);
+ 
+-	if (permits)
+-		afs_put_permits(permits);
++	afs_put_permits(permits);
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-key-leak-in-afs_release-and-afs_evict_inode.patch b/queue-4.19/afs-fix-key-leak-in-afs_release-and-afs_evict_inode.patch
new file mode 100644
index 00000000000..f227086e176
--- /dev/null
+++ b/queue-4.19/afs-fix-key-leak-in-afs_release-and-afs_evict_inode.patch
@@ -0,0 +1,69 @@
+From 6bf68b2dc309b9bfd075f450d67106dc31c35cf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 12:09:17 +0100
+Subject: afs: Fix key leak in afs_release() and afs_evict_inode()
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit a1b879eefc2b34cd3f17187ef6fc1cf3960e9518 ]
+
+Fix afs_release() to go through the cleanup part of the function if
+FMODE_WRITE is set rather than exiting through vfs_fsync() (which skips the
+cleanup).  The cleanup involves discarding the refs on the key used for
+file ops and the writeback key record.
+
+Also fix afs_evict_inode() to clean up any left over wb keys attached to
+the inode/vnode when it is removed.
+
+Fixes: 5a8132761609 ("afs: Do better accretion of small writes on newly created content")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/file.c  | 7 ++++---
+ fs/afs/inode.c | 1 +
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index 843d3b970b845..0bd78df6a64e6 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -169,11 +169,12 @@ int afs_release(struct inode *inode, struct file *file)
+ {
+ 	struct afs_vnode *vnode = AFS_FS_I(inode);
+ 	struct afs_file *af = file->private_data;
++	int ret = 0;
+ 
+ 	_enter("{%x:%u},", vnode->fid.vid, vnode->fid.vnode);
+ 
+ 	if ((file->f_mode & FMODE_WRITE))
+-		return vfs_fsync(file, 0);
++		ret = vfs_fsync(file, 0);
+ 
+ 	file->private_data = NULL;
+ 	if (af->wb)
+@@ -181,8 +182,8 @@ int afs_release(struct inode *inode, struct file *file)
+ 	key_put(af->key);
+ 	kfree(af);
+ 	afs_prune_wb_keys(vnode);
+-	_leave(" = 0");
+-	return 0;
++	_leave(" = %d", ret);
++	return ret;
+ }
+ 
+ /*
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 0726e40db0f8b..718fab2f151a1 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -541,6 +541,7 @@ void afs_evict_inode(struct inode *inode)
+ 	}
+ #endif
+ 
++	afs_prune_wb_keys(vnode);
+ 	afs_put_permits(rcu_access_pointer(vnode->permit_cache));
+ 	key_put(vnode->lock_key);
+ 	vnode->lock_key = NULL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-large-file-support.patch b/queue-4.19/afs-fix-large-file-support.patch
new file mode 100644
index 00000000000..40027669d87
--- /dev/null
+++ b/queue-4.19/afs-fix-large-file-support.patch
@@ -0,0 +1,45 @@
+From 54ee9b81dce491811874dc04dcdfa400a409d7c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 15:37:26 +0000
+Subject: afs: Fix large file support
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit b485275f1aca8a9da37fd35e4fad673935e827da ]
+
+By default s_maxbytes is set to MAX_NON_LFS, which limits the usable
+file size to 2GB, enforced by the vfs.
+
+Commit b9b1f8d5930a ("AFS: write support fixes") added support for the
+64-bit fetch and store server operations, but did not change this value.
+As a result, attempts to write past the 2G mark result in EFBIG errors:
+
+ $ dd if=/dev/zero of=foo bs=1M count=1 seek=2048
+ dd: error writing 'foo': File too large
+
+Set s_maxbytes to MAX_LFS_FILESIZE.
+
+Fixes: b9b1f8d5930a ("AFS: write support fixes")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 18b9b7ca20c92..4961d32ccd1e0 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -393,6 +393,7 @@ static int afs_fill_super(struct super_block *sb,
+ 	/* fill in the superblock */
+ 	sb->s_blocksize		= PAGE_SIZE;
+ 	sb->s_blocksize_bits	= PAGE_SHIFT;
++	sb->s_maxbytes		= MAX_LFS_FILESIZE;
+ 	sb->s_magic		= AFS_FS_MAGIC;
+ 	sb->s_op		= &afs_super_ops;
+ 	if (!as->dyn_root)
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-lock-wait-callback-break-double-locking.patch b/queue-4.19/afs-fix-lock-wait-callback-break-double-locking.patch
new file mode 100644
index 00000000000..ded5d27603a
--- /dev/null
+++ b/queue-4.19/afs-fix-lock-wait-callback-break-double-locking.patch
@@ -0,0 +1,64 @@
+From b675cc12bbef205ab05fdc97903d88fab5e0b925 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 May 2019 23:03:31 +0100
+Subject: afs: Fix lock-wait/callback-break double locking
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit c7226e407b6065d3bda8bd9dc627663d2c505ea3 ]
+
+__afs_break_callback() holds vnode->lock around its call of
+afs_lock_may_be_available() - which also takes that lock.
+
+Fix this by not taking the lock in __afs_break_callback().
+
+Also, there's no point checking the granted_locks and pending_locks queues;
+it's sufficient to check lock_state, so move that check out of
+afs_lock_may_be_available() into __afs_break_callback() to replace the
+queue checks.
+
+Fixes: e8d6c554126b ("AFS: implement file locking")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/callback.c | 8 +-------
+ fs/afs/flock.c    | 3 ---
+ 2 files changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/fs/afs/callback.c b/fs/afs/callback.c
+index 4ad7012502998..97283b04fa6fd 100644
+--- a/fs/afs/callback.c
++++ b/fs/afs/callback.c
+@@ -221,14 +221,8 @@ void afs_break_callback(struct afs_vnode *vnode)
+ 		vnode->cb_break++;
+ 		afs_clear_permits(vnode);
+ 
+-		spin_lock(&vnode->lock);
+-
+-		_debug("break callback");
+-
+-		if (list_empty(&vnode->granted_locks) &&
+-		    !list_empty(&vnode->pending_locks))
++		if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
+ 			afs_lock_may_be_available(vnode);
+-		spin_unlock(&vnode->lock);
+ 	}
+ 
+ 	write_sequnlock(&vnode->cb_lock);
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index aea7224ba1981..fbf4986b12245 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -39,9 +39,6 @@ void afs_lock_may_be_available(struct afs_vnode *vnode)
+ {
+ 	_enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
+ 
+-	if (vnode->lock_state != AFS_VNODE_LOCK_WAITING_FOR_CB)
+-		return;
+-
+ 	spin_lock(&vnode->lock);
+ 	if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
+ 		afs_next_locker(vnode, 0);
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-missing-timeout-reset.patch b/queue-4.19/afs-fix-missing-timeout-reset.patch
new file mode 100644
index 00000000000..3cf96776f19
--- /dev/null
+++ b/queue-4.19/afs-fix-missing-timeout-reset.patch
@@ -0,0 +1,51 @@
+From ef60cf73ba32de8369a451ddb24685f599660e16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 21:00:36 +0000
+Subject: afs: Fix missing timeout reset
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit c74386d50fbaf4a54fd3fe560f1abc709c0cff4b ]
+
+In afs_wait_for_call_to_complete(), rather than immediately aborting an
+operation if a signal occurs, the code attempts to wait for it to
+complete, using a schedule timeout of 2*RTT (or min 2 jiffies) and a
+check that we're still receiving relevant packets from the server before
+we consider aborting the call.  We may even ping the server to check on
+the status of the call.
+
+However, there's a missing timeout reset in the event that we do
+actually get a packet to process, such that if we then get a couple of
+short stalls, we then time out when progress is actually being made.
+
+Fix this by resetting the timeout any time we get something to process.
+If it's the failure of the call then the call state will get changed and
+we'll exit the loop shortly thereafter.
+
+A symptom of this is data fetches and stores failing with EINTR when
+they really shouldn't.
+
+Fixes: bc5e3a546d55 ("rxrpc: Use MSG_WAITALL to tell sendmsg() to temporarily ignore signals")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/rxrpc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
+index 2543f24d23f8d..560dd5ff5a151 100644
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -573,6 +573,7 @@ static long afs_wait_for_call_to_complete(struct afs_call *call,
+ 			call->need_attention = false;
+ 			__set_current_state(TASK_RUNNING);
+ 			afs_deliver_to_call(call);
++			timeout = rtt2;
+ 			continue;
+ 		}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch b/queue-4.19/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch
new file mode 100644
index 00000000000..006d76dba6e
--- /dev/null
+++ b/queue-4.19/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch
@@ -0,0 +1,46 @@
+From a6b4a36e6a4c61f1ec671050669e6cc27998b882 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 13:27:09 +0100
+Subject: afs: Fix the afs.cell and afs.volume xattr handlers
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit c73aa4102f5b9f261a907c3b3df94cd2c478504d ]
+
+Fix the ->get handlers for the afs.cell and afs.volume xattrs to pass the
+source data size to memcpy() rather than target buffer size.
+
+Overcopying the source data occasionally causes the kernel to oops.
+
+Fixes: d3e3b7eac886 ("afs: Add metadata xattrs")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/xattr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c
+index cfcc674e64a55..411f67c79f090 100644
+--- a/fs/afs/xattr.c
++++ b/fs/afs/xattr.c
+@@ -50,7 +50,7 @@ static int afs_xattr_get_cell(const struct xattr_handler *handler,
+ 		return namelen;
+ 	if (namelen > size)
+ 		return -ERANGE;
+-	memcpy(buffer, cell->name, size);
++	memcpy(buffer, cell->name, namelen);
+ 	return namelen;
+ }
+ 
+@@ -104,7 +104,7 @@ static int afs_xattr_get_volume(const struct xattr_handler *handler,
+ 		return namelen;
+ 	if (namelen > size)
+ 		return -ERANGE;
+-	memcpy(buffer, volname, size);
++	memcpy(buffer, volname, namelen);
+ 	return namelen;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-further-fix-file-locking.patch b/queue-4.19/afs-further-fix-file-locking.patch
new file mode 100644
index 00000000000..50853224e82
--- /dev/null
+++ b/queue-4.19/afs-further-fix-file-locking.patch
@@ -0,0 +1,638 @@
+From 751b1307c5888d2660ec30c7d9ea214baee7a2d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2019 14:26:50 +0100
+Subject: afs: Further fix file locking
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 4be5975aea154e164696128d049dec9ed341585c ]
+
+Further fix the file locking in the afs filesystem client in a number of
+ways, including:
+
+ (1) Don't submit the operation to obtain a lock from the server in a work
+     queue context, but rather do it in the process context of whoever
+     issued the requesting system call.
+
+ (2) The owner of the file_lock struct at the front of the pending_locks
+     queue now owns right to talk to the server.
+
+ (3) Write locks can be instantly granted if they don't overlap with any
+     other locks *and* we have a write lock on the server.
+
+ (4) In the event of an authentication/permission error, all other matching
+     pending locks requests are also immediately aborted.
+
+ (5) Properly use VFS core locks_lock_file_wait() to distribute the server
+     lock amongst local client locks, including waiting for the lock to
+     become available.
+
+Test with:
+
+	sqlite3 /afs/.../scratch/billings.sqlite <<EOF
+	CREATE TABLE hosts (
+	    hostname varchar(80),
+	    shorthost varchar(80),
+	    room varchar(30),
+	    building varchar(30),
+	    PRIMARY KEY(shorthost)
+	    );
+	EOF
+
+With the version of sqlite3 that I have, this should fail consistently with
+EAGAIN, whether or not the program is straced (which introduces some delays
+between lock syscalls).
+
+Fixes: 0fafdc9f888b ("afs: Fix file locking")
+Reported-by: Jonathan Billings <jsbillin@umich.edu>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/flock.c | 392 ++++++++++++++++++++++++-------------------------
+ 1 file changed, 196 insertions(+), 196 deletions(-)
+
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index dffbb456629c9..aea7224ba1981 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -13,9 +13,11 @@
+ 
+ #define AFS_LOCK_GRANTED	0
+ #define AFS_LOCK_PENDING	1
++#define AFS_LOCK_YOUR_TRY	2
+ 
+ struct workqueue_struct *afs_lock_manager;
+ 
++static void afs_next_locker(struct afs_vnode *vnode, int error);
+ static void afs_fl_copy_lock(struct file_lock *new, struct file_lock *fl);
+ static void afs_fl_release_private(struct file_lock *fl);
+ 
+@@ -24,6 +26,12 @@ static const struct file_lock_operations afs_lock_ops = {
+ 	.fl_release_private	= afs_fl_release_private,
+ };
+ 
++static inline void afs_set_lock_state(struct afs_vnode *vnode, enum afs_lock_state state)
++{
++	_debug("STATE %u -> %u", vnode->lock_state, state);
++	vnode->lock_state = state;
++}
++
+ /*
+  * if the callback is broken on this vnode, then the lock may now be available
+  */
+@@ -31,14 +39,20 @@ void afs_lock_may_be_available(struct afs_vnode *vnode)
+ {
+ 	_enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
+ 
+-	queue_delayed_work(afs_lock_manager, &vnode->lock_work, 0);
++	if (vnode->lock_state != AFS_VNODE_LOCK_WAITING_FOR_CB)
++		return;
++
++	spin_lock(&vnode->lock);
++	if (vnode->lock_state == AFS_VNODE_LOCK_WAITING_FOR_CB)
++		afs_next_locker(vnode, 0);
++	spin_unlock(&vnode->lock);
+ }
+ 
+ /*
+  * the lock will time out in 5 minutes unless we extend it, so schedule
+  * extension in a bit less than that time
+  */
+-static void afs_schedule_lock_extension(struct afs_vnode *vnode)
++static void __maybe_unused afs_schedule_lock_extension(struct afs_vnode *vnode)
+ {
+ 	queue_delayed_work(afs_lock_manager, &vnode->lock_work,
+ 			   AFS_LOCKWAIT * HZ / 2);
+@@ -49,22 +63,65 @@ static void afs_schedule_lock_extension(struct afs_vnode *vnode)
+  * first lock in the queue is itself a readlock)
+  * - the caller must hold the vnode lock
+  */
+-static void afs_grant_locks(struct afs_vnode *vnode, struct file_lock *fl)
++static void afs_grant_locks(struct afs_vnode *vnode)
+ {
+ 	struct file_lock *p, *_p;
++	bool exclusive = (vnode->lock_type == AFS_LOCK_WRITE);
+ 
+-	list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
+-	if (fl->fl_type == F_RDLCK) {
+-		list_for_each_entry_safe(p, _p, &vnode->pending_locks,
+-					 fl_u.afs.link) {
+-			if (p->fl_type == F_RDLCK) {
+-				p->fl_u.afs.state = AFS_LOCK_GRANTED;
+-				list_move_tail(&p->fl_u.afs.link,
+-					       &vnode->granted_locks);
+-				wake_up(&p->fl_wait);
+-			}
++	list_for_each_entry_safe(p, _p, &vnode->pending_locks, fl_u.afs.link) {
++		if (!exclusive && p->fl_type == F_WRLCK)
++			continue;
++
++		list_move_tail(&p->fl_u.afs.link, &vnode->granted_locks);
++		p->fl_u.afs.state = AFS_LOCK_GRANTED;
++		wake_up(&p->fl_wait);
++	}
++}
++
++/*
++ * If an error is specified, reject every pending lock that matches the
++ * authentication and type of the lock we failed to get.  If there are any
++ * remaining lockers, try to wake up one of them to have a go.
++ */
++static void afs_next_locker(struct afs_vnode *vnode, int error)
++{
++	struct file_lock *p, *_p, *next = NULL;
++	struct key *key = vnode->lock_key;
++	unsigned int fl_type = F_RDLCK;
++
++	_enter("");
++
++	if (vnode->lock_type == AFS_LOCK_WRITE)
++		fl_type = F_WRLCK;
++
++	list_for_each_entry_safe(p, _p, &vnode->pending_locks, fl_u.afs.link) {
++		if (error &&
++		    p->fl_type == fl_type &&
++		    afs_file_key(p->fl_file) == key) {
++			list_del_init(&p->fl_u.afs.link);
++			p->fl_u.afs.state = error;
++			wake_up(&p->fl_wait);
+ 		}
++
++		/* Select the next locker to hand off to. */
++		if (next &&
++		    (next->fl_type == F_WRLCK || p->fl_type == F_RDLCK))
++			continue;
++		next = p;
+ 	}
++
++	vnode->lock_key = NULL;
++	key_put(key);
++
++	if (next) {
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
++		next->fl_u.afs.state = AFS_LOCK_YOUR_TRY;
++		wake_up(&next->fl_wait);
++	} else {
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_NONE);
++	}
++
++	_leave("");
+ }
+ 
+ /*
+@@ -170,8 +227,6 @@ void afs_lock_work(struct work_struct *work)
+ {
+ 	struct afs_vnode *vnode =
+ 		container_of(work, struct afs_vnode, lock_work.work);
+-	struct file_lock *fl, *next;
+-	afs_lock_type_t type;
+ 	struct key *key;
+ 	int ret;
+ 
+@@ -184,7 +239,7 @@ again:
+ 	switch (vnode->lock_state) {
+ 	case AFS_VNODE_LOCK_NEED_UNLOCK:
+ 		_debug("unlock");
+-		vnode->lock_state = AFS_VNODE_LOCK_UNLOCKING;
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_UNLOCKING);
+ 		spin_unlock(&vnode->lock);
+ 
+ 		/* attempt to release the server lock; if it fails, we just
+@@ -196,22 +251,9 @@ again:
+ 			       vnode->fid.vid, vnode->fid.vnode, ret);
+ 
+ 		spin_lock(&vnode->lock);
+-		key_put(vnode->lock_key);
+-		vnode->lock_key = NULL;
+-		vnode->lock_state = AFS_VNODE_LOCK_NONE;
+-
+-		if (list_empty(&vnode->pending_locks)) {
+-			spin_unlock(&vnode->lock);
+-			return;
+-		}
+-
+-		/* The new front of the queue now owns the state variables. */
+-		next = list_entry(vnode->pending_locks.next,
+-				  struct file_lock, fl_u.afs.link);
+-		vnode->lock_key = key_get(afs_file_key(next->fl_file));
+-		vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+-		vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+-		goto again;
++		afs_next_locker(vnode, 0);
++		spin_unlock(&vnode->lock);
++		return;
+ 
+ 	/* If we've already got a lock, then it must be time to extend that
+ 	 * lock as AFS locks time out after 5 minutes.
+@@ -222,7 +264,7 @@ again:
+ 		ASSERT(!list_empty(&vnode->granted_locks));
+ 
+ 		key = key_get(vnode->lock_key);
+-		vnode->lock_state = AFS_VNODE_LOCK_EXTENDING;
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_EXTENDING);
+ 		spin_unlock(&vnode->lock);
+ 
+ 		ret = afs_extend_lock(vnode, key); /* RPC */
+@@ -236,72 +278,26 @@ again:
+ 
+ 		if (vnode->lock_state != AFS_VNODE_LOCK_EXTENDING)
+ 			goto again;
+-		vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_GRANTED);
+ 
+-		if (ret == 0)
+-			afs_schedule_lock_extension(vnode);
+-		else
++		if (ret != 0)
+ 			queue_delayed_work(afs_lock_manager, &vnode->lock_work,
+ 					   HZ * 10);
+ 		spin_unlock(&vnode->lock);
+ 		_leave(" [ext]");
+ 		return;
+ 
+-		/* If we don't have a granted lock, then we must've been called
+-		 * back by the server, and so if might be possible to get a
+-		 * lock we're currently waiting for.
+-		 */
++	/* If we're waiting for a callback to indicate lock release, we can't
++	 * actually rely on this, so need to recheck at regular intervals.  The
++	 * problem is that the server might not notify us if the lock just
++	 * expires (say because a client died) rather than being explicitly
++	 * released.
++	 */
+ 	case AFS_VNODE_LOCK_WAITING_FOR_CB:
+-		_debug("get");
+-
+-		key = key_get(vnode->lock_key);
+-		type = vnode->lock_type;
+-		vnode->lock_state = AFS_VNODE_LOCK_SETTING;
++		_debug("retry");
++		afs_next_locker(vnode, 0);
+ 		spin_unlock(&vnode->lock);
+-
+-		ret = afs_set_lock(vnode, key, type); /* RPC */
+-		key_put(key);
+-
+-		spin_lock(&vnode->lock);
+-		switch (ret) {
+-		case -EWOULDBLOCK:
+-			_debug("blocked");
+-			break;
+-		case 0:
+-			_debug("acquired");
+-			vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
+-			/* Fall through */
+-		default:
+-			/* Pass the lock or the error onto the first locker in
+-			 * the list - if they're looking for this type of lock.
+-			 * If they're not, we assume that whoever asked for it
+-			 * took a signal.
+-			 */
+-			if (list_empty(&vnode->pending_locks)) {
+-				_debug("withdrawn");
+-				vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
+-				goto again;
+-			}
+-
+-			fl = list_entry(vnode->pending_locks.next,
+-					struct file_lock, fl_u.afs.link);
+-			type = (fl->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+-			if (vnode->lock_type != type) {
+-				_debug("changed");
+-				vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
+-				goto again;
+-			}
+-
+-			fl->fl_u.afs.state = ret;
+-			if (ret == 0)
+-				afs_grant_locks(vnode, fl);
+-			else
+-				list_del_init(&fl->fl_u.afs.link);
+-			wake_up(&fl->fl_wait);
+-			spin_unlock(&vnode->lock);
+-			_leave(" [granted]");
+-			return;
+-		}
++		return;
+ 
+ 	default:
+ 		/* Looks like a lock request was withdrawn. */
+@@ -319,14 +315,15 @@ again:
+  */
+ static void afs_defer_unlock(struct afs_vnode *vnode)
+ {
+-	_enter("");
++	_enter("%u", vnode->lock_state);
+ 
+-	if (vnode->lock_state == AFS_VNODE_LOCK_GRANTED ||
+-	    vnode->lock_state == AFS_VNODE_LOCK_EXTENDING) {
++	if (list_empty(&vnode->granted_locks) &&
++	    (vnode->lock_state == AFS_VNODE_LOCK_GRANTED ||
++	     vnode->lock_state == AFS_VNODE_LOCK_EXTENDING)) {
+ 		cancel_delayed_work(&vnode->lock_work);
+ 
+-		vnode->lock_state = AFS_VNODE_LOCK_NEED_UNLOCK;
+-		afs_lock_may_be_available(vnode);
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_NEED_UNLOCK);
++		queue_delayed_work(afs_lock_manager, &vnode->lock_work, 0);
+ 	}
+ }
+ 
+@@ -375,50 +372,6 @@ static int afs_do_setlk_check(struct afs_vnode *vnode, struct key *key,
+ 	return 0;
+ }
+ 
+-/*
+- * Remove the front runner from the pending queue.
+- * - The caller must hold vnode->lock.
+- */
+-static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
+-{
+-	struct file_lock *next;
+-
+-	_enter("");
+-
+-	/* ->lock_type, ->lock_key and ->lock_state only belong to this
+-	 * file_lock if we're at the front of the pending queue or if we have
+-	 * the lock granted or if the lock_state is NEED_UNLOCK or UNLOCKING.
+-	 */
+-	if (vnode->granted_locks.next == &fl->fl_u.afs.link &&
+-	    vnode->granted_locks.prev == &fl->fl_u.afs.link) {
+-		list_del_init(&fl->fl_u.afs.link);
+-		afs_defer_unlock(vnode);
+-		return;
+-	}
+-
+-	if (!list_empty(&vnode->granted_locks) ||
+-	    vnode->pending_locks.next != &fl->fl_u.afs.link) {
+-		list_del_init(&fl->fl_u.afs.link);
+-		return;
+-	}
+-
+-	list_del_init(&fl->fl_u.afs.link);
+-	key_put(vnode->lock_key);
+-	vnode->lock_key = NULL;
+-	vnode->lock_state = AFS_VNODE_LOCK_NONE;
+-
+-	if (list_empty(&vnode->pending_locks))
+-		return;
+-
+-	/* The new front of the queue now owns the state variables. */
+-	next = list_entry(vnode->pending_locks.next,
+-			  struct file_lock, fl_u.afs.link);
+-	vnode->lock_key = key_get(afs_file_key(next->fl_file));
+-	vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+-	vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+-	afs_lock_may_be_available(vnode);
+-}
+-
+ /*
+  * request a lock on a file on the server
+  */
+@@ -443,44 +396,66 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
+ 		return ret;
+ 
+ 	spin_lock(&vnode->lock);
++	list_add_tail(&fl->fl_u.afs.link, &vnode->pending_locks);
+ 
+-	/* If we've already got a readlock on the server then we instantly
+-	 * grant another readlock, irrespective of whether there are any
+-	 * pending writelocks.
++	/* If we've already got a lock on the server then try to move to having
++	 * the VFS grant the requested lock.  Note that this means that other
++	 * clients may get starved out.
+ 	 */
+-	if (type == AFS_LOCK_READ &&
+-	    vnode->lock_state == AFS_VNODE_LOCK_GRANTED &&
+-	    vnode->lock_type == AFS_LOCK_READ) {
+-		_debug("instant readlock");
+-		ASSERT(!list_empty(&vnode->granted_locks));
+-		goto share_existing_lock;
+-	}
++	_debug("try %u", vnode->lock_state);
++	if (vnode->lock_state == AFS_VNODE_LOCK_GRANTED) {
++		if (type == AFS_LOCK_READ) {
++			_debug("instant readlock");
++			list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
++			fl->fl_u.afs.state = AFS_LOCK_GRANTED;
++			goto vnode_is_locked_u;
++		}
+ 
+-	list_add_tail(&fl->fl_u.afs.link, &vnode->pending_locks);
++		if (vnode->lock_type == AFS_LOCK_WRITE) {
++			_debug("instant writelock");
++			list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
++			fl->fl_u.afs.state = AFS_LOCK_GRANTED;
++			goto vnode_is_locked_u;
++		}
++	}
+ 
+ 	if (vnode->lock_state != AFS_VNODE_LOCK_NONE)
+ 		goto need_to_wait;
+ 
++try_to_lock:
+ 	/* We don't have a lock on this vnode and we aren't currently waiting
+ 	 * for one either, so ask the server for a lock.
+ 	 *
+ 	 * Note that we need to be careful if we get interrupted by a signal
+ 	 * after dispatching the request as we may still get the lock, even
+ 	 * though we don't wait for the reply (it's not too bad a problem - the
+-	 * lock will expire in 10 mins anyway).
++	 * lock will expire in 5 mins anyway).
+ 	 */
+ 	_debug("not locked");
+ 	vnode->lock_key = key_get(key);
+ 	vnode->lock_type = type;
+-	vnode->lock_state = AFS_VNODE_LOCK_SETTING;
++	afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
+ 	spin_unlock(&vnode->lock);
+ 
+ 	ret = afs_set_lock(vnode, key, type); /* RPC */
+ 
+ 	spin_lock(&vnode->lock);
+ 	switch (ret) {
++	case -EKEYREJECTED:
++	case -EKEYEXPIRED:
++	case -EKEYREVOKED:
++	case -EPERM:
++	case -EACCES:
++		fl->fl_u.afs.state = ret;
++		list_del_init(&fl->fl_u.afs.link);
++		afs_next_locker(vnode, ret);
++		goto error_unlock;
++
+ 	default:
+-		goto abort_attempt;
++		fl->fl_u.afs.state = ret;
++		list_del_init(&fl->fl_u.afs.link);
++		afs_next_locker(vnode, 0);
++		goto error_unlock;
+ 
+ 	case -EWOULDBLOCK:
+ 		/* The server doesn't have a lock-waiting queue, so the client
+@@ -490,29 +465,23 @@ static int afs_do_setlk(struct file *file, struct file_lock *fl)
+ 		_debug("would block");
+ 		ASSERT(list_empty(&vnode->granted_locks));
+ 		ASSERTCMP(vnode->pending_locks.next, ==, &fl->fl_u.afs.link);
+-		vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+-		goto need_to_wait;
++		goto lock_is_contended;
+ 
+ 	case 0:
+ 		_debug("acquired");
+-		break;
++		afs_set_lock_state(vnode, AFS_VNODE_LOCK_GRANTED);
++		afs_grant_locks(vnode);
++		goto vnode_is_locked_u;
+ 	}
+ 
+-	/* we've acquired a server lock, but it needs to be renewed after 5
+-	 * mins */
+-	vnode->lock_state = AFS_VNODE_LOCK_GRANTED;
+-	afs_schedule_lock_extension(vnode);
+-
+-share_existing_lock:
+-	/* the lock has been granted as far as we're concerned... */
+-	fl->fl_u.afs.state = AFS_LOCK_GRANTED;
+-	list_move_tail(&fl->fl_u.afs.link, &vnode->granted_locks);
+-
+-given_lock:
+-	/* ... but we do still need to get the VFS's blessing */
++vnode_is_locked_u:
+ 	spin_unlock(&vnode->lock);
++vnode_is_locked:
++	/* the lock has been granted by the server... */
++	ASSERTCMP(fl->fl_u.afs.state, ==, AFS_LOCK_GRANTED);
+ 
+-	ret = posix_lock_file(file, fl, NULL);
++	/* ... but the VFS still needs to distribute access on this client. */
++	ret = locks_lock_file_wait(file, fl);
+ 	if (ret < 0)
+ 		goto vfs_rejected_lock;
+ 
+@@ -524,38 +493,61 @@ given_lock:
+ 	_leave(" = 0");
+ 	return 0;
+ 
++lock_is_contended:
++	if (!(fl->fl_flags & FL_SLEEP)) {
++		list_del_init(&fl->fl_u.afs.link);
++		afs_next_locker(vnode, 0);
++		ret = -EAGAIN;
++		goto error_unlock;
++	}
++
++	afs_set_lock_state(vnode, AFS_VNODE_LOCK_WAITING_FOR_CB);
++	queue_delayed_work(afs_lock_manager, &vnode->lock_work, HZ * 5);
++
+ need_to_wait:
+ 	/* We're going to have to wait.  Either this client doesn't have a lock
+ 	 * on the server yet and we need to wait for a callback to occur, or
+-	 * the client does have a lock on the server, but it belongs to some
+-	 * other process(es) and is incompatible with the lock we want.
++	 * the client does have a lock on the server, but it's shared and we
++	 * need an exclusive lock.
+ 	 */
+-	ret = -EAGAIN;
+-	if (fl->fl_flags & FL_SLEEP) {
+-		spin_unlock(&vnode->lock);
++	spin_unlock(&vnode->lock);
+ 
+-		_debug("sleep");
+-		ret = wait_event_interruptible(fl->fl_wait,
+-					       fl->fl_u.afs.state != AFS_LOCK_PENDING);
++	_debug("sleep");
++	ret = wait_event_interruptible(fl->fl_wait,
++				       fl->fl_u.afs.state != AFS_LOCK_PENDING);
++	_debug("wait = %d", ret);
+ 
++	if (fl->fl_u.afs.state >= 0 && fl->fl_u.afs.state != AFS_LOCK_GRANTED) {
+ 		spin_lock(&vnode->lock);
+-	}
+ 
+-	if (fl->fl_u.afs.state == AFS_LOCK_GRANTED)
+-		goto given_lock;
+-	if (fl->fl_u.afs.state < 0)
+-		ret = fl->fl_u.afs.state;
++		switch (fl->fl_u.afs.state) {
++		case AFS_LOCK_YOUR_TRY:
++			fl->fl_u.afs.state = AFS_LOCK_PENDING;
++			goto try_to_lock;
++		case AFS_LOCK_PENDING:
++			if (ret > 0) {
++				/* We need to retry the lock.  We may not be
++				 * notified by the server if it just expired
++				 * rather than being released.
++				 */
++				ASSERTCMP(vnode->lock_state, ==, AFS_VNODE_LOCK_WAITING_FOR_CB);
++				afs_set_lock_state(vnode, AFS_VNODE_LOCK_SETTING);
++				fl->fl_u.afs.state = AFS_LOCK_PENDING;
++				goto try_to_lock;
++			}
++			goto error_unlock;
++		case AFS_LOCK_GRANTED:
++		default:
++			break;
++		}
+ 
+-abort_attempt:
+-	/* we aren't going to get the lock, either because we're unwilling to
+-	 * wait, or because some signal happened */
+-	_debug("abort");
+-	afs_dequeue_lock(vnode, fl);
++		spin_unlock(&vnode->lock);
++	}
+ 
+-error_unlock:
+-	spin_unlock(&vnode->lock);
+-	_leave(" = %d", ret);
+-	return ret;
++	if (fl->fl_u.afs.state == AFS_LOCK_GRANTED)
++		goto vnode_is_locked;
++	ret = fl->fl_u.afs.state;
++	goto error;
+ 
+ vfs_rejected_lock:
+ 	/* The VFS rejected the lock we just obtained, so we have to discard
+@@ -565,9 +557,13 @@ vfs_rejected_lock:
+ 	_debug("vfs refused %d", ret);
+ 	spin_lock(&vnode->lock);
+ 	list_del_init(&fl->fl_u.afs.link);
+-	if (list_empty(&vnode->granted_locks))
+-		afs_defer_unlock(vnode);
+-	goto error_unlock;
++	afs_defer_unlock(vnode);
++
++error_unlock:
++	spin_unlock(&vnode->lock);
++error:
++	_leave(" = %d", ret);
++	return ret;
+ }
+ 
+ /*
+@@ -583,7 +579,7 @@ static int afs_do_unlk(struct file *file, struct file_lock *fl)
+ 	/* Flush all pending writes before doing anything with locks. */
+ 	vfs_fsync(file, 0);
+ 
+-	ret = posix_lock_file(file, fl, NULL);
++	ret = locks_lock_file_wait(file, fl);
+ 	_leave(" = %d [%u]", ret, vnode->lock_state);
+ 	return ret;
+ }
+@@ -705,7 +701,11 @@ static void afs_fl_release_private(struct file_lock *fl)
+ 	_enter("");
+ 
+ 	spin_lock(&vnode->lock);
+-	afs_dequeue_lock(vnode, fl);
++
++	list_del_init(&fl->fl_u.afs.link);
++	if (list_empty(&vnode->granted_locks))
++		afs_defer_unlock(vnode);
++
+ 	_debug("state %u for %p", vnode->lock_state, vnode);
+ 	spin_unlock(&vnode->lock);
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/afs-remove-set-but-not-used-variables-before-after.patch b/queue-4.19/afs-remove-set-but-not-used-variables-before-after.patch
new file mode 100644
index 00000000000..abdd048a0cb
--- /dev/null
+++ b/queue-4.19/afs-remove-set-but-not-used-variables-before-after.patch
@@ -0,0 +1,86 @@
+From 4d762449825bfad85e7b09dd375d8384b88fcf5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 09:12:18 +0000
+Subject: afs: Remove set but not used variables 'before', 'after'
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 51590df4f3306cb1f43dca54e3ccdd121ab89594 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+fs/afs/dir_edit.c: In function afs_set_contig_bits:
+fs/afs/dir_edit.c:75:20: warning: variable after set but not used [-Wunused-but-set-variable]
+fs/afs/dir_edit.c: In function afs_set_contig_bits:
+fs/afs/dir_edit.c:75:12: warning: variable before set but not used [-Wunused-but-set-variable]
+fs/afs/dir_edit.c: In function afs_clear_contig_bits:
+fs/afs/dir_edit.c:100:20: warning: variable after set but not used [-Wunused-but-set-variable]
+fs/afs/dir_edit.c: In function afs_clear_contig_bits:
+fs/afs/dir_edit.c:100:12: warning: variable before set but not used [-Wunused-but-set-variable]
+
+They are never used since commit 63a4681ff39c.
+
+Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir_edit.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
+index 8b400f5aead58..0e7162527db8c 100644
+--- a/fs/afs/dir_edit.c
++++ b/fs/afs/dir_edit.c
+@@ -72,13 +72,11 @@ static int afs_find_contig_bits(union afs_xdr_dir_block *block, unsigned int nr_
+ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ 				int bit, unsigned int nr_slots)
+ {
+-	u64 mask, before, after;
++	u64 mask;
+ 
+ 	mask = (1 << nr_slots) - 1;
+ 	mask <<= bit;
+ 
+-	before = *(u64 *)block->hdr.bitmap;
+-
+ 	block->hdr.bitmap[0] |= (u8)(mask >> 0 * 8);
+ 	block->hdr.bitmap[1] |= (u8)(mask >> 1 * 8);
+ 	block->hdr.bitmap[2] |= (u8)(mask >> 2 * 8);
+@@ -87,8 +85,6 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ 	block->hdr.bitmap[5] |= (u8)(mask >> 5 * 8);
+ 	block->hdr.bitmap[6] |= (u8)(mask >> 6 * 8);
+ 	block->hdr.bitmap[7] |= (u8)(mask >> 7 * 8);
+-
+-	after = *(u64 *)block->hdr.bitmap;
+ }
+ 
+ /*
+@@ -97,13 +93,11 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+ 				  int bit, unsigned int nr_slots)
+ {
+-	u64 mask, before, after;
++	u64 mask;
+ 
+ 	mask = (1 << nr_slots) - 1;
+ 	mask <<= bit;
+ 
+-	before = *(u64 *)block->hdr.bitmap;
+-
+ 	block->hdr.bitmap[0] &= ~(u8)(mask >> 0 * 8);
+ 	block->hdr.bitmap[1] &= ~(u8)(mask >> 1 * 8);
+ 	block->hdr.bitmap[2] &= ~(u8)(mask >> 2 * 8);
+@@ -112,8 +106,6 @@ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+ 	block->hdr.bitmap[5] &= ~(u8)(mask >> 5 * 8);
+ 	block->hdr.bitmap[6] &= ~(u8)(mask >> 6 * 8);
+ 	block->hdr.bitmap[7] &= ~(u8)(mask >> 7 * 8);
+-
+-	after = *(u64 *)block->hdr.bitmap;
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-4.19/ahci-do-not-export-local-variable-ahci_em_messages.patch b/queue-4.19/ahci-do-not-export-local-variable-ahci_em_messages.patch
new file mode 100644
index 00000000000..a2e21ede7ed
--- /dev/null
+++ b/queue-4.19/ahci-do-not-export-local-variable-ahci_em_messages.patch
@@ -0,0 +1,41 @@
+From 403a25195efcc6c5ed3d3dbf17bc84b7bd453a8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 22:42:55 +0300
+Subject: ahci: Do not export local variable ahci_em_messages
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ]
+
+The commit ed08d40cdec4
+  ("ahci: Changing two module params with static and __read_mostly")
+moved ahci_em_messages to be static while missing the fact of exporting it.
+
+WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL
+
+Drop export for the local variable ahci_em_messages.
+
+Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly")
+Cc: Chuansheng Liu <chuansheng.liu@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index b5f57c69c4878..2bdb250a2142c 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -191,7 +191,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
+ EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
+ 
+ static bool ahci_em_messages __read_mostly = true;
+-EXPORT_SYMBOL_GPL(ahci_em_messages);
+ module_param(ahci_em_messages, bool, 0444);
+ /* add other LED protocol types when they become supported */
+ MODULE_PARM_DESC(ahci_em_messages,
+-- 
+2.20.1
+
diff --git a/queue-4.19/alsa-aica-fix-a-long-time-build-breakage.patch b/queue-4.19/alsa-aica-fix-a-long-time-build-breakage.patch
new file mode 100644
index 00000000000..8162994e084
--- /dev/null
+++ b/queue-4.19/alsa-aica-fix-a-long-time-build-breakage.patch
@@ -0,0 +1,70 @@
+From 6d3c1816829ec67b5d66364a9a0352bb9f0826ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 May 2019 14:45:38 +0200
+Subject: ALSA: aica: Fix a long-time build breakage
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 534420c6ff87d3052540f1fd346e0adcff440819 ]
+
+The build of aica sound driver has been broken since the timer API
+conversion and some code rewrite.  This patch fixes the breakage by
+using the common substream field, as well as a bit cleaning up wrt the
+timer handling in the code.
+
+Fixes: d522bb6a105f ("ALSA: sh: aica: Convert timers to use timer_setup()")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/aica.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/sound/sh/aica.c b/sound/sh/aica.c
+index 2b26311405a42..ad3f71358486a 100644
+--- a/sound/sh/aica.c
++++ b/sound/sh/aica.c
+@@ -303,7 +303,7 @@ static void aica_period_elapsed(struct timer_list *t)
+ {
+ 	struct snd_card_aica *dreamcastcard = from_timer(dreamcastcard,
+ 							      t, timer);
+-	struct snd_pcm_substream *substream = dreamcastcard->timer_substream;
++	struct snd_pcm_substream *substream = dreamcastcard->substream;
+ 	/*timer function - so cannot sleep */
+ 	int play_period;
+ 	struct snd_pcm_runtime *runtime;
+@@ -335,13 +335,6 @@ static void spu_begin_dma(struct snd_pcm_substream *substream)
+ 	dreamcastcard = substream->pcm->private_data;
+ 	/*get the queue to do the work */
+ 	schedule_work(&(dreamcastcard->spu_dma_work));
+-	/* Timer may already be running */
+-	if (unlikely(dreamcastcard->timer_substream)) {
+-		mod_timer(&dreamcastcard->timer, jiffies + 4);
+-		return;
+-	}
+-	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
+-	dreamcastcard->timer_substream = substream;
+ 	mod_timer(&dreamcastcard->timer, jiffies + 4);
+ }
+ 
+@@ -379,8 +372,8 @@ static int snd_aicapcm_pcm_close(struct snd_pcm_substream
+ {
+ 	struct snd_card_aica *dreamcastcard = substream->pcm->private_data;
+ 	flush_work(&(dreamcastcard->spu_dma_work));
+-	if (dreamcastcard->timer_substream)
+-		del_timer(&dreamcastcard->timer);
++	del_timer(&dreamcastcard->timer);
++	dreamcastcard->substream = NULL;
+ 	kfree(dreamcastcard->channel);
+ 	spu_disable();
+ 	return 0;
+@@ -615,6 +608,7 @@ static int snd_aica_probe(struct platform_device *devptr)
+ 	       "Yamaha AICA Super Intelligent Sound Processor for SEGA Dreamcast");
+ 	/* Prepare to use the queue */
+ 	INIT_WORK(&(dreamcastcard->spu_dma_work), run_spu_dma);
++	timer_setup(&dreamcastcard->timer, aica_period_elapsed, 0);
+ 	/* Load the PCM 'chip' */
+ 	err = snd_aicapcmchip(dreamcastcard, 0);
+ 	if (unlikely(err < 0))
+-- 
+2.20.1
+
diff --git a/queue-4.19/alsa-aoa-onyx-always-initialize-register-read-value.patch b/queue-4.19/alsa-aoa-onyx-always-initialize-register-read-value.patch
new file mode 100644
index 00000000000..4b3d7947e7b
--- /dev/null
+++ b/queue-4.19/alsa-aoa-onyx-always-initialize-register-read-value.patch
@@ -0,0 +1,43 @@
+From 3c91334366fdb82024466e47c3f26fae10a986e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 09:14:22 +0200
+Subject: ALSA: aoa: onyx: always initialize register read value
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ]
+
+A lot of places in the driver use onyx_read_register() without
+checking the return value, and it's been working OK for ~10 years
+or so, so probably never fails ... Rather than trying to check the
+return value everywhere, which would be relatively intrusive, at
+least make sure we don't use an uninitialized value.
+
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/aoa/codecs/onyx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index d2d96ca082b71..6224fd3bbf7cc 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
+ 		return 0;
+ 	}
+ 	v = i2c_smbus_read_byte_data(onyx->i2c, reg);
+-	if (v < 0)
++	if (v < 0) {
++		*value = 0;
+ 		return -1;
++	}
+ 	*value = (u8)v;
+ 	onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/alsa-hda-fix-unused-variable-warning.patch b/queue-4.19/alsa-hda-fix-unused-variable-warning.patch
new file mode 100644
index 00000000000..181128dd1bb
--- /dev/null
+++ b/queue-4.19/alsa-hda-fix-unused-variable-warning.patch
@@ -0,0 +1,53 @@
+From 59fa84d655f9ea235bf75548c2e198674cf5c885 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 16:18:36 +0200
+Subject: ALSA: hda: fix unused variable warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]
+
+When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
+only returns true.
+
+sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
+sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
+  struct azx *chip = bus_to_azx(bus);
+              ^~~~
+
+Create a inline function of azx_snoop.
+
+Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_controller.h | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index 8a9dd4767b1ec..63cc10604afc7 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -176,11 +176,10 @@ struct azx {
+ #define azx_bus(chip)	(&(chip)->bus.core)
+ #define bus_to_azx(_bus)	container_of(_bus, struct azx, bus.core)
+ 
+-#ifdef CONFIG_X86
+-#define azx_snoop(chip)		((chip)->snoop)
+-#else
+-#define azx_snoop(chip)		true
+-#endif
++static inline bool azx_snoop(struct azx *chip)
++{
++	return !IS_ENABLED(CONFIG_X86) || chip->snoop;
++}
+ 
+ /*
+  * macros for easy use
+-- 
+2.20.1
+
diff --git a/queue-4.19/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch b/queue-4.19/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
new file mode 100644
index 00000000000..9a3f294ea54
--- /dev/null
+++ b/queue-4.19/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
@@ -0,0 +1,39 @@
+From 19965995cb87c9d1c8141f7eb9f1185773d9e59c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: ALSA: usb-audio: Handle the error from
+ snd_usb_mixer_apply_create_quirk()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error.  Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index d7778f2bcbf86..6ac6a09801245 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3480,7 +3480,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ 	if (err < 0)
+ 		goto _error;
+ 
+-	snd_usb_mixer_apply_create_quirk(mixer);
++	err = snd_usb_mixer_apply_create_quirk(mixer);
++	if (err < 0)
++		goto _error;
+ 
+ 	err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ 	if (err < 0)
+-- 
+2.20.1
+
diff --git a/queue-4.19/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch b/queue-4.19/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
new file mode 100644
index 00000000000..3eedd7b8743
--- /dev/null
+++ b/queue-4.19/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
@@ -0,0 +1,64 @@
+From 5a350b396e0a74eb6a9626b38b8f8bc24f762f9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 16:42:05 +0200
+Subject: ALSA: usb-audio: update quirk for B&W PX to remove microphone
+
+From: Nicolas Huaman <nicolas@herochao.de>
+
+[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]
+
+A quirk in snd-usb-audio was added to automate setting sample rate to
+4800k and remove the previously exposed nonfunctional microphone for
+the Bowers & Wilkins PX:
+commit 240a8af929c7c57dcde28682725b29cf8474e8e5
+https://lore.kernel.org/patchwork/patch/919689/
+
+However the headphones where updated shortly after that to remove the
+unintentional microphone functionality. I guess because of this the
+headphones now crash when connecting them via USB while the quirk is
+active. Dmesg:
+
+snd-usb-audio: probe of 2-3:1.0 failed with error -22
+usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)
+
+This patch removes the microfone and allows the headphones to connect
+and work out of the box. It is based on the current mainline kernel
+ and successfully applied an tested on my machine (4.18.10.arch1-1).
+
+Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
+Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks-table.h | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 65f9c4ba62ee1..90d4f61cc2308 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3349,19 +3349,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ 				.ifnum = 0,
+ 				.type = QUIRK_AUDIO_STANDARD_MIXER,
+ 			},
+-			/* Capture */
+-			{
+-				.ifnum = 1,
+-				.type = QUIRK_IGNORE_INTERFACE,
+-			},
+ 			/* Playback */
+ 			{
+-				.ifnum = 2,
++				.ifnum = 1,
+ 				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+ 				.data = &(const struct audioformat) {
+ 					.formats = SNDRV_PCM_FMTBIT_S16_LE,
+ 					.channels = 2,
+-					.iface = 2,
++					.iface = 1,
+ 					.altsetting = 1,
+ 					.altset_idx = 1,
+ 					.attributes = UAC_EP_CS_ATTR_FILL_MAX |
+-- 
+2.20.1
+
diff --git a/queue-4.19/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch b/queue-4.19/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch
new file mode 100644
index 00000000000..feafc134f87
--- /dev/null
+++ b/queue-4.19/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch
@@ -0,0 +1,64 @@
+From 9109aabd825e9fd6d6373000b20d24815a8905e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 18:12:09 +0200
+Subject: apparmor: don't try to replace stale label in ptrace access check
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 1f8266ff58840d698a1e96d2274189de1bdf7969 ]
+
+As a comment above begin_current_label_crit_section() explains,
+begin_current_label_crit_section() must run in sleepable context because
+when label_is_stale() is true, aa_replace_current_label() runs, which uses
+prepare_creds(), which can sleep.
+Until now, the ptrace access check (which runs with a task lock held)
+violated this rule.
+
+Also add a might_sleep() assertion to begin_current_label_crit_section(),
+because asserts are less likely to be ignored than comments.
+
+Fixes: b2d09ae449ced ("apparmor: move ptrace checks to using labels")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/include/cred.h | 2 ++
+ security/apparmor/lsm.c          | 4 ++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/include/cred.h b/security/apparmor/include/cred.h
+index e287b7d0d4beb..265ae6641a064 100644
+--- a/security/apparmor/include/cred.h
++++ b/security/apparmor/include/cred.h
+@@ -151,6 +151,8 @@ static inline struct aa_label *begin_current_label_crit_section(void)
+ {
+ 	struct aa_label *label = aa_current_raw_label();
+ 
++	might_sleep();
++
+ 	if (label_is_stale(label)) {
+ 		label = aa_get_newest_label(label);
+ 		if (aa_replace_current_label(label) == 0)
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 590ca7d8fae54..730de4638b4e2 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -114,13 +114,13 @@ static int apparmor_ptrace_access_check(struct task_struct *child,
+ 	struct aa_label *tracer, *tracee;
+ 	int error;
+ 
+-	tracer = begin_current_label_crit_section();
++	tracer = __begin_current_label_crit_section();
+ 	tracee = aa_get_task_label(child);
+ 	error = aa_may_ptrace(tracer, tracee,
+ 			(mode & PTRACE_MODE_READ) ? AA_PTRACE_READ
+ 						  : AA_PTRACE_TRACE);
+ 	aa_put_label(tracee);
+-	end_current_label_crit_section(tracer);
++	__end_current_label_crit_section(tracer);
+ 
+ 	return error;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/apparmor-fix-network-performance-issue-in-aa_label_s.patch b/queue-4.19/apparmor-fix-network-performance-issue-in-aa_label_s.patch
new file mode 100644
index 00000000000..c1afa9ea891
--- /dev/null
+++ b/queue-4.19/apparmor-fix-network-performance-issue-in-aa_label_s.patch
@@ -0,0 +1,88 @@
+From 70cc75d48b3b9883f524092780606551eba1b7c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 21:33:57 -0700
+Subject: apparmor: Fix network performance issue in aa_label_sk_perm
+
+From: Tony Jones <tonyj@suse.de>
+
+[ Upstream commit 5f997580e8b12b9f585e34cc16304925d26ce49e ]
+
+The netperf benchmark shows a 5.73% reduction in throughput for
+small (64 byte) transfers by unconfined tasks.
+
+DEFINE_AUDIT_SK() in aa_label_sk_perm() should not be performed
+unconditionally, rather only when the label is confined.
+
+netperf-tcp
+                            56974a6fc^              56974a6fc
+Min       64         563.48 (   0.00%)      531.17 (  -5.73%)
+Min       128       1056.92 (   0.00%)      999.44 (  -5.44%)
+Min       256       1945.95 (   0.00%)     1867.97 (  -4.01%)
+Min       1024      6761.40 (   0.00%)     6364.23 (  -5.87%)
+Min       2048     11110.53 (   0.00%)    10606.20 (  -4.54%)
+Min       3312     13692.67 (   0.00%)    13158.41 (  -3.90%)
+Min       4096     14926.29 (   0.00%)    14457.46 (  -3.14%)
+Min       8192     18399.34 (   0.00%)    18091.65 (  -1.67%)
+Min       16384    21384.13 (   0.00%)    21158.05 (  -1.06%)
+Hmean     64         564.96 (   0.00%)      534.38 (  -5.41%)
+Hmean     128       1064.42 (   0.00%)     1010.12 (  -5.10%)
+Hmean     256       1965.85 (   0.00%)     1879.16 (  -4.41%)
+Hmean     1024      6839.77 (   0.00%)     6478.70 (  -5.28%)
+Hmean     2048     11154.80 (   0.00%)    10671.13 (  -4.34%)
+Hmean     3312     13838.12 (   0.00%)    13249.01 (  -4.26%)
+Hmean     4096     15009.99 (   0.00%)    14561.36 (  -2.99%)
+Hmean     8192     18975.57 (   0.00%)    18326.54 (  -3.42%)
+Hmean     16384    21440.44 (   0.00%)    21324.59 (  -0.54%)
+Stddev    64           1.24 (   0.00%)        2.85 (-130.64%)
+Stddev    128          4.51 (   0.00%)        6.53 ( -44.84%)
+Stddev    256         11.67 (   0.00%)        8.50 (  27.16%)
+Stddev    1024        48.33 (   0.00%)       75.07 ( -55.34%)
+Stddev    2048        54.82 (   0.00%)       65.16 ( -18.86%)
+Stddev    3312       153.57 (   0.00%)       56.29 (  63.35%)
+Stddev    4096       100.25 (   0.00%)       88.50 (  11.72%)
+Stddev    8192       358.13 (   0.00%)      169.99 (  52.54%)
+Stddev    16384       43.99 (   0.00%)      141.82 (-222.39%)
+
+Signed-off-by: Tony Jones <tonyj@suse.de>
+Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket
+mediation")
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/net.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/security/apparmor/net.c b/security/apparmor/net.c
+index bb24cfa0a164c..d5d72dd1ca1f9 100644
+--- a/security/apparmor/net.c
++++ b/security/apparmor/net.c
+@@ -146,17 +146,20 @@ int aa_af_perm(struct aa_label *label, const char *op, u32 request, u16 family,
+ static int aa_label_sk_perm(struct aa_label *label, const char *op, u32 request,
+ 			    struct sock *sk)
+ {
+-	struct aa_profile *profile;
+-	DEFINE_AUDIT_SK(sa, op, sk);
++	int error = 0;
+ 
+ 	AA_BUG(!label);
+ 	AA_BUG(!sk);
+ 
+-	if (unconfined(label))
+-		return 0;
++	if (!unconfined(label)) {
++		struct aa_profile *profile;
++		DEFINE_AUDIT_SK(sa, op, sk);
+ 
+-	return fn_for_each_confined(label, profile,
+-			aa_profile_af_sk_perm(profile, &sa, request, sk));
++		error = fn_for_each_confined(label, profile,
++			    aa_profile_af_sk_perm(profile, &sa, request, sk));
++	}
++
++	return error;
+ }
+ 
+ int aa_sk_perm(const char *op, u32 request, struct sock *sk)
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch b/queue-4.19/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
new file mode 100644
index 00000000000..4ba36e97b7f
--- /dev/null
+++ b/queue-4.19/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
@@ -0,0 +1,97 @@
+From 4de5c8e154af0624d0ec1cc5fcf9fcfb3ebc29e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 09:31:41 +0100
+Subject: ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]
+
+MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
+perform low-level platform initialization. This results in a try to install
+HYP stubs for the second time for each CPU and results in false HYP/SVC
+mode mismatch detection. The HYP stubs are already installed at the
+beginning of the kernel initialization on the boot CPU (head.S) or in the
+secondary_startup() for other CPUs. To fix this issue MCPM code should use
+a cpu_resume() routine without HYP stubs installation.
+
+This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
+XU3/XU4/HC1 boards.
+
+Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Tested-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/common/mcpm_entry.c   |  2 +-
+ arch/arm/include/asm/suspend.h |  1 +
+ arch/arm/kernel/sleep.S        | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
+index ad574d20415c2..1b1b82b37ce03 100644
+--- a/arch/arm/common/mcpm_entry.c
++++ b/arch/arm/common/mcpm_entry.c
+@@ -381,7 +381,7 @@ static int __init nocache_trampoline(unsigned long _arg)
+ 	unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+ 	phys_reset_t phys_reset;
+ 
+-	mcpm_set_entry_vector(cpu, cluster, cpu_resume);
++	mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
+ 	setup_mm_for_reboot();
+ 
+ 	__mcpm_cpu_going_down(cpu, cluster);
+diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
+index 452bbdcbcc835..506314265c6f1 100644
+--- a/arch/arm/include/asm/suspend.h
++++ b/arch/arm/include/asm/suspend.h
+@@ -10,6 +10,7 @@ struct sleep_save_sp {
+ };
+ 
+ extern void cpu_resume(void);
++extern void cpu_resume_no_hyp(void);
+ extern void cpu_resume_arm(void);
+ extern int cpu_suspend(unsigned long, int (*)(unsigned long));
+ 
+diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
+index a8257fc9cf2a9..5dc8b80bb6938 100644
+--- a/arch/arm/kernel/sleep.S
++++ b/arch/arm/kernel/sleep.S
+@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu)
+ 	.text
+ 	.align
+ 
++#ifdef CONFIG_MCPM
++	.arm
++THUMB(	.thumb			)
++ENTRY(cpu_resume_no_hyp)
++ARM_BE8(setend be)			@ ensure we are in BE mode
++	b	no_hyp
++#endif
++
+ #ifdef CONFIG_MMU
+ 	.arm
+ ENTRY(cpu_resume_arm)
+@@ -135,6 +143,7 @@ ARM_BE8(setend be)			@ ensure we are in BE mode
+ 	bl	__hyp_stub_install_secondary
+ #endif
+ 	safe_svcmode_maskall r1
++no_hyp:
+ 	mov	r1, #0
+ 	ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
+ 	ALT_UP_B(1f)
+@@ -163,6 +172,9 @@ ENDPROC(cpu_resume)
+ 
+ #ifdef CONFIG_MMU
+ ENDPROC(cpu_resume_arm)
++#endif
++#ifdef CONFIG_MCPM
++ENDPROC(cpu_resume_no_hyp)
+ #endif
+ 
+ 	.align 2
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch b/queue-4.19/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
new file mode 100644
index 00000000000..beaf6c5edd1
--- /dev/null
+++ b/queue-4.19/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
@@ -0,0 +1,40 @@
+From c622ea3713c05ba64b0928850ae80279769c79bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 15:00:13 +0100
+Subject: ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ]
+
+arm64 has got relaxation on GIC version check at early boot stage due
+to update of the GIC architecture let's align ARM with that.
+
+To help backports (even though the code was correct at the time of writing)
+Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/hyp-stub.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index 60146e32619a5..82a942894fc04 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -180,8 +180,8 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
+ 	@ Check whether GICv3 system registers are available
+ 	mrc	p15, 0, r7, c0, c1, 1	@ ID_PFR1
+ 	ubfx	r7, r7, #28, #4
+-	cmp	r7, #1
+-	bne	2f
++	teq	r7, #0
++	beq	2f
+ 
+ 	@ Enable system register accesses
+ 	mrc	p15, 4, r7, c12, c9, 5	@ ICC_HSRE
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-8849-1-nommu-fix-encodings-for-pmsav8-s-prbar4-p.patch b/queue-4.19/arm-8849-1-nommu-fix-encodings-for-pmsav8-s-prbar4-p.patch
new file mode 100644
index 00000000000..af51722a0e4
--- /dev/null
+++ b/queue-4.19/arm-8849-1-nommu-fix-encodings-for-pmsav8-s-prbar4-p.patch
@@ -0,0 +1,48 @@
+From 5a44c1f7a8ab348817ff0f319297acf4765bd09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 15:00:53 +0100
+Subject: ARM: 8849/1: NOMMU: Fix encodings for PMSAv8's PRBAR4/PRLAR4
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit d410a8a49e3e00e07d43037e90f776d522b25a6a ]
+
+To access PRBARn, where n is referenced as a binary number:
+
+MRC p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0] ; Read PRBARn into Rt
+MCR p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0] ; Write Rt into PRBARn
+
+To access PRLARn, where n is referenced as a binary number:
+
+MRC p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0]+1 ; Read PRLARn into Rt
+MCR p15, 0, <Rt>, c6, c8+n[3:1], 4*n[0]+1 ; Write Rt into PRLARn
+
+For PR{B,L}AR4, n is 4, n[0] is 0, n[3:1] is 2, while current encoding
+done with n[0] set to 1 which is wrong. Use proper encoding instead.
+
+Fixes: 046835b4aa22b9ab6aa0bb274e3b71047c4b887d ("ARM: 8757/1: NOMMU: Support PMSAv8 MPU")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/head-nommu.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
+index 326a97aa3ea0c..22efcf48604cd 100644
+--- a/arch/arm/kernel/head-nommu.S
++++ b/arch/arm/kernel/head-nommu.S
+@@ -441,8 +441,8 @@ M_CLASS(str	r6, [r12, #PMSAv8_RLAR_A(3)])
+ 	str	r5, [r12, #PMSAv8_RBAR_A(0)]
+ 	str	r6, [r12, #PMSAv8_RLAR_A(0)]
+ #else
+-	mcr	p15, 0, r5, c6, c10, 1			@ PRBAR4
+-	mcr	p15, 0, r6, c6, c10, 2			@ PRLAR4
++	mcr	p15, 0, r5, c6, c10, 0			@ PRBAR4
++	mcr	p15, 0, r6, c6, c10, 1			@ PRLAR4
+ #endif
+ #endif
+ 	ret	lr
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-8896-1-vdso-don-t-leak-kernel-addresses.patch b/queue-4.19/arm-8896-1-vdso-don-t-leak-kernel-addresses.patch
new file mode 100644
index 00000000000..4c6269ab4a2
--- /dev/null
+++ b/queue-4.19/arm-8896-1-vdso-don-t-leak-kernel-addresses.patch
@@ -0,0 +1,43 @@
+From 3a1f537a6673a7a4073a5b2f3f7042dd84c205cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 12:38:48 +0100
+Subject: ARM: 8896/1: VDSO: Don't leak kernel addresses
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 3e07590e7248db951fed6a2039403b5a39010be7 ]
+
+Since commit ad67b74d2469d9b8 ("printk: hash addresses printed with
+%p"), an obfuscated kernel pointer is printed at every boot if
+debugging is enabled:
+
+    vdso: 1 text pages at base (____ptrval____)
+
+Remove the print completely, as it's useless without the address.
+
+Based on commit 0f1bf7e39822476b ("arm64/vdso: don't leak kernel
+addresses").
+
+Fixes: ad67b74d2469d9b8 ("printk: hash addresses printed with %p")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/vdso.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
+index f4dd7f9663c10..e8cda5e02b4ea 100644
+--- a/arch/arm/kernel/vdso.c
++++ b/arch/arm/kernel/vdso.c
+@@ -205,7 +205,6 @@ static int __init vdso_init(void)
+ 	}
+ 
+ 	text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+-	pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
+ 
+ 	/* Allocate the VDSO text pagelist */
+ 	vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-aspeed-g5-fixe-gpio-ranges-upper-limit.patch b/queue-4.19/arm-dts-aspeed-g5-fixe-gpio-ranges-upper-limit.patch
new file mode 100644
index 00000000000..668736ab373
--- /dev/null
+++ b/queue-4.19/arm-dts-aspeed-g5-fixe-gpio-ranges-upper-limit.patch
@@ -0,0 +1,41 @@
+From e821894e760f6211e8325c0f9510c10f84103a6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 13:26:43 +0000
+Subject: ARM: dts: aspeed-g5: Fixe gpio-ranges upper limit
+
+From: Oscar A Perez <linux@neuralgames.com>
+
+[ Upstream commit 89b97c429e2e77d695b5133572ca12ec256a4ea4 ]
+
+According to the AST2500/AST2520 specs, these SoCs support up to 228 GPIO
+pins. However, 'gpio-ranges' value in 'aspeed-g5.dtsi' file is currently
+setting the upper limit to 220 which isn't allowing access to all their
+GPIOs. The correct upper limit value is 232 (actual number is 228 plus a
+4-GPIO hole in GPIOAB). Without this patch, GPIOs AC5 and AC6 do not work
+correctly on a AST2500 BMC running Linux Kernel v4.19
+
+Fixes: 2039f90d136c ("ARM: dts: aspeed-g5: Add gpio controller to devicetree")
+Signed-off-by: Oscar A Perez <linux@neuralgames.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g5.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-g5.dtsi b/arch/arm/boot/dts/aspeed-g5.dtsi
+index d107459fc0f89..f2e1015d75ab4 100644
+--- a/arch/arm/boot/dts/aspeed-g5.dtsi
++++ b/arch/arm/boot/dts/aspeed-g5.dtsi
+@@ -247,7 +247,7 @@
+ 				compatible = "aspeed,ast2500-gpio";
+ 				reg = <0x1e780000 0x1000>;
+ 				interrupts = <20>;
+-				gpio-ranges = <&pinctrl 0 0 220>;
++				gpio-ranges = <&pinctrl 0 0 232>;
+ 				clocks = <&syscon ASPEED_CLK_APB>;
+ 				interrupt-controller;
+ 			};
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-at91-nattis-make-the-sd-card-slot-work.patch b/queue-4.19/arm-dts-at91-nattis-make-the-sd-card-slot-work.patch
new file mode 100644
index 00000000000..d9568b78b26
--- /dev/null
+++ b/queue-4.19/arm-dts-at91-nattis-make-the-sd-card-slot-work.patch
@@ -0,0 +1,36 @@
+From 08d3547eb91a55014ca00fba80ed3881a4b94b17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 11:48:41 +0200
+Subject: ARM: dts: at91: nattis: make the SD-card slot work
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit f52eb2067929d533babe106fbc131c88db3eff3d ]
+
+The cd-gpios signal is assumed active-low by the driver, and the
+cd-inverted property is needed if it is, in fact, active-high. Fix
+this oversight.
+
+Fixes: 0e4323899973 ("ARM: dts: at91: add devicetree for the Axentia Nattis with Natte power")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-nattis-2-natte-2.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+index bfa5815a07214..4308a07b792ea 100644
+--- a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
++++ b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+@@ -221,6 +221,7 @@
+ 		reg = <0>;
+ 		bus-width = <4>;
+ 		cd-gpios = <&pioD 5 GPIO_ACTIVE_HIGH>;
++		cd-inverted;
+ 	};
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-at91-nattis-set-the-prlud-and-hipow-signals-.patch b/queue-4.19/arm-dts-at91-nattis-set-the-prlud-and-hipow-signals-.patch
new file mode 100644
index 00000000000..305b2370eb0
--- /dev/null
+++ b/queue-4.19/arm-dts-at91-nattis-set-the-prlud-and-hipow-signals-.patch
@@ -0,0 +1,46 @@
+From e001144e06a66ab79f4b1ca0f8d191a8255732ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 11:48:40 +0200
+Subject: ARM: dts: at91: nattis: set the PRLUD and HIPOW signals low
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 29feb2c960ab32fc24249443d4434194ce96f083 ]
+
+AT91_PINCTRL_OUTPUT_VAL(0) without AT91_PINCTRL_OUTPUT is a no-op, so
+make sure the pins really output a zero.
+
+Fixes: 0e4323899973 ("ARM: dts: at91: add devicetree for the Axentia Nattis with Natte power")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-nattis-2-natte-2.dts | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+index af9f38456d04e..bfa5815a07214 100644
+--- a/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
++++ b/arch/arm/boot/dts/at91-nattis-2-natte-2.dts
+@@ -38,14 +38,16 @@
+ 						atmel,pins =
+ 							<AT91_PIOA 21
+ 							 AT91_PERIPH_GPIO
+-							 AT91_PINCTRL_OUTPUT_VAL(0)>;
++							 (AT91_PINCTRL_OUTPUT |
++							  AT91_PINCTRL_OUTPUT_VAL(0))>;
+ 					};
+ 
+ 					pinctrl_lcd_hipow0: lcd_hipow0 {
+ 						atmel,pins =
+ 							<AT91_PIOA 23
+ 							 AT91_PERIPH_GPIO
+-							 AT91_PINCTRL_OUTPUT_VAL(0)>;
++							 (AT91_PINCTRL_OUTPUT |
++							  AT91_PINCTRL_OUTPUT_VAL(0))>;
+ 					};
+ 				};
+ 			};
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-bcm283x-correct-mailbox-register-sizes.patch b/queue-4.19/arm-dts-bcm283x-correct-mailbox-register-sizes.patch
new file mode 100644
index 00000000000..b61675d625f
--- /dev/null
+++ b/queue-4.19/arm-dts-bcm283x-correct-mailbox-register-sizes.patch
@@ -0,0 +1,37 @@
+From 4f4da1faa74da0151eed3d89a20f8d58f2e517cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 09:22:24 +0100
+Subject: ARM: dts: bcm283x: Correct mailbox register sizes
+
+From: Phil Elwell <phil@raspberrypi.org>
+
+[ Upstream commit 227fa865061470a568858baa404a508f6c030fe4 ]
+
+The size field in a Device Tree "reg" property is encoded in bytes, not
+words.
+
+Fixes: 614fa22119d6 ("ARM: dts: bcm2835: Add VCHIQ node to the Raspberry Pi boards. (v3)")
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2835-rpi.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+index cb2d6d78a7fbf..c481eab1bd7c0 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+@@ -32,7 +32,7 @@
+ 
+ 		mailbox@7e00b840 {
+ 			compatible = "brcm,bcm2835-vchiq";
+-			reg = <0x7e00b840 0xf>;
++			reg = <0x7e00b840 0x3c>;
+ 			interrupts = <0 2>;
+ 		};
+ 	};
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-iwg20d-q7-common-fix-sdhi1-vccq-regularor.patch b/queue-4.19/arm-dts-iwg20d-q7-common-fix-sdhi1-vccq-regularor.patch
new file mode 100644
index 00000000000..27637f8ce3a
--- /dev/null
+++ b/queue-4.19/arm-dts-iwg20d-q7-common-fix-sdhi1-vccq-regularor.patch
@@ -0,0 +1,42 @@
+From 7ec9ed3abe860b26a8bdd617a9026873c0878cbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2019 10:53:51 +0100
+Subject: ARM: dts: iwg20d-q7-common: Fix SDHI1 VccQ regularor
+
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+
+[ Upstream commit d211650a87edc7f4130651c0ccbc0a4583fd72d3 ]
+
+SDR50 isn't working anymore because the GPIO regulator
+driver is using descriptors since
+commit d6cd33ad7102 ("regulator: gpio: Convert to use descriptors")
+which in turn causes the system to use the polarity of the
+GPIOs (as specified in the DT) for selecting the states,
+but the polarity specified in the DT is wrong.
+This patch fixes the regulator DT definition, and that fixes
+SDR50.
+
+Fixes: 029efb3a03c5 ("ARM: dts: iwg20d-q7: Add SDHI1 support")
+Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/iwg20d-q7-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+index 5cae74eb6cddf..a2c9a1e88c1a3 100644
+--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi
++++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi
+@@ -87,7 +87,7 @@
+ 		regulator-min-microvolt = <1800000>;
+ 		regulator-max-microvolt = <3300000>;
+ 
+-		gpios = <&gpio2 30 GPIO_ACTIVE_LOW>;
++		gpios = <&gpio2 30 GPIO_ACTIVE_HIGH>;
+ 		gpios-states = <1>;
+ 		states = <3300000 1
+ 			  1800000 0>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-logicpd-som-lv-fix-i2c2-and-i2c3-pin-mux.patch b/queue-4.19/arm-dts-logicpd-som-lv-fix-i2c2-and-i2c3-pin-mux.patch
new file mode 100644
index 00000000000..714cf1f8b0c
--- /dev/null
+++ b/queue-4.19/arm-dts-logicpd-som-lv-fix-i2c2-and-i2c3-pin-mux.patch
@@ -0,0 +1,78 @@
+From 3b403fa857d28cc5eb263d026d151d00414a93b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 07:17:27 -0500
+Subject: ARM: dts: logicpd-som-lv: Fix i2c2 and i2c3 Pin mux
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit a932b77b4d1939ad173f18be87da409427fb705c ]
+
+When the pinmux configuration was added, it was accidentally placed into
+the omap3_pmx_wkup node  when it should have been placed into the
+omap3_pmx_core.  This error was accidentally propagated to stable by
+me when I blindly requested the pull after seeing I2C issues without
+actually reviewing the content of the pinout.  Since the bootloader
+previously muxed these correctly in the past, was a hidden error.
+
+This patch moves the i2c2_pins and i2c3_pins to the correct node
+which should eliminate i2c bus errors and timeouts due to the fact
+the bootloader uses the save device tree that no longer properly
+assigns these pins.
+
+Fixes: 5fe3c0fa0d54 ("ARM: dts: Add pinmuxing for i2c2 and i2c3
+for LogicPD SOM-LV") #4.9+
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv.dtsi | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+index 98b682a8080cc..c5d54c4d37476 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -232,6 +232,20 @@
+ 		>;
+ 	};
+ 
++	i2c2_pins: pinmux_i2c2_pins {
++		pinctrl-single,pins = <
++			OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0)	/* i2c2_scl */
++			OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0)	/* i2c2_sda */
++		>;
++	};
++
++	i2c3_pins: pinmux_i2c3_pins {
++		pinctrl-single,pins = <
++			OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0)	/* i2c3_scl */
++			OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0)	/* i2c3_sda */
++		>;
++	};
++
+ 	tsc2004_pins: pinmux_tsc2004_pins {
+ 		pinctrl-single,pins = <
+ 			OMAP3_CORE1_IOPAD(0x2186, PIN_INPUT | MUX_MODE4)	/* mcbsp4_dr.gpio_153 */
+@@ -253,18 +267,6 @@
+ 			OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4)	/* sys_boot1.gpio_3 */
+ 		>;
+ 	};
+-	i2c2_pins: pinmux_i2c2_pins {
+-		pinctrl-single,pins = <
+-			OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT | MUX_MODE0)	/* i2c2_scl */
+-			OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT | MUX_MODE0)	/* i2c2_sda */
+-		>;
+-	};
+-	i2c3_pins: pinmux_i2c3_pins {
+-		pinctrl-single,pins = <
+-			OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT | MUX_MODE0)	/* i2c3_scl */
+-			OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT | MUX_MODE0)	/* i2c3_sda */
+-		>;
+-	};
+ };
+ 
+ &omap3_pmx_core2 {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-logicpd-som-lv-fix-mmc1-card-detect.patch b/queue-4.19/arm-dts-logicpd-som-lv-fix-mmc1-card-detect.patch
new file mode 100644
index 00000000000..9705502b535
--- /dev/null
+++ b/queue-4.19/arm-dts-logicpd-som-lv-fix-mmc1-card-detect.patch
@@ -0,0 +1,38 @@
+From 15e646ab5b479b7d1dcd81990221d455b7173235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2019 07:47:44 -0500
+Subject: ARM: dts: logicpd-som-lv: Fix MMC1 card detect
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 6a38df676a0a06bfc7ff8607ac62ccd6d95969ad ]
+
+The card detect pin was incorrectly using IRQ_TYPE_LEVEL_LOW
+instead of GPIO_ACTIVE_LOW when reading the state of the CD pin.
+
+This was previosly fixed on Torpedo, but missed on the SOM-LV
+
+Fixes: 5cb8b0fa55a9 ("ARM: dts: Move most of logicpd-som-lv-37xx-devkit.dts to logicpd-som-lv-baseboard.dtsi")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 4990ed90dcea4..3e39b9a1f35d0 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -153,7 +153,7 @@
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc1_pins>;
+ 	wp-gpios = <&gpio4 30 GPIO_ACTIVE_HIGH>;		/* gpio_126 */
+-	cd-gpios = <&gpio4 14 IRQ_TYPE_LEVEL_LOW>;		/* gpio_110 */
++	cd-gpios = <&gpio4 14 GPIO_ACTIVE_LOW>;			/* gpio_110 */
+ 	vmmc-supply = <&vmmc1>;
+ 	bus-width = <4>;
+ 	cap-power-off-card;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch b/queue-4.19/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
new file mode 100644
index 00000000000..1308098689b
--- /dev/null
+++ b/queue-4.19/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
@@ -0,0 +1,38 @@
+From a7821941f20e56197ec26d6b9ad22cac47e76671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 16:29:20 +0200
+Subject: ARM: dts: lpc32xx: add required clocks property to keypad device node
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ]
+
+NXP LPC32xx keypad controller requires a clock property to be defined.
+
+The change fixes the driver initialization problem:
+
+  lpc32xx_keys 40050000.key: failed to get clock
+  lpc32xx_keys: probe of 40050000.key failed with error -2
+
+Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index ed0d6fb20122a..d4368eeff1b9a 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -462,6 +462,7 @@
+ 			key: key@40050000 {
+ 				compatible = "nxp,lpc3220-key";
+ 				reg = <0x40050000 0x1000>;
++				clocks = <&clk LPC32XX_CLK_KEY>;
+ 				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
+ 				status = "disabled";
+ 			};
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch b/queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
new file mode 100644
index 00000000000..a96ba6fc456
--- /dev/null
+++ b/queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
@@ -0,0 +1,38 @@
+From c320a4d9df7dd69552be86cd18f09cb733b532ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:40 +0200
+Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ]
+
+The originally added ARM PrimeCell PL111 clocks property misses
+the required "clcdclk" clock, which is the same as a clock to enable
+the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs.
+
+Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index cfd422e7f774d..9ad3df11db0d8 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -142,8 +142,8 @@
+ 			compatible = "arm,pl111", "arm,primecell";
+ 			reg = <0x31040000 0x1000>;
+ 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&clk LPC32XX_CLK_LCD>;
+-			clock-names = "apb_pclk";
++			clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
++			clock-names = "clcdclk", "apb_pclk";
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch b/queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
new file mode 100644
index 00000000000..8cb1944f2f9
--- /dev/null
+++ b/queue-4.19/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
@@ -0,0 +1,36 @@
+From 9a7274697509ff62b64a051e16d3cfd9f7d290d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:39 +0200
+Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ]
+
+ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230
+and LPC3250 SoCs variants, the original reference in compatible
+property to an older one ARM PrimeCell PL110 is invalid.
+
+Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 4f8f671c3343c..cfd422e7f774d 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -139,7 +139,7 @@
+ 		};
+ 
+ 		clcd: clcd@31040000 {
+-			compatible = "arm,pl110", "arm,primecell";
++			compatible = "arm,pl111", "arm,primecell";
+ 			reg = <0x31040000 0x1000>;
+ 			interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&clk LPC32XX_CLK_LCD>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch b/queue-4.19/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
new file mode 100644
index 00000000000..52b2313d655
--- /dev/null
+++ b/queue-4.19/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
@@ -0,0 +1,39 @@
+From 05f6932bd2c4f70ccfebb3e163fb4e22e59cef16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:41 +0200
+Subject: ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ]
+
+The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which
+supplies SD/MMC card's power, has a constant output voltage level
+of either 3.15V or 3.3V, the actual value depends on JP4 position,
+the power rail is referenced as VCC_SDIO in the board hardware manual.
+
+Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
+index 1e1c2f517a82b..ffcf78631b226 100644
+--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
+@@ -49,8 +49,8 @@
+ 		sd_reg: regulator@2 {
+ 			compatible = "regulator-fixed";
+ 			regulator-name = "sd_reg";
+-			regulator-min-microvolt = <1800000>;
+-			regulator-max-microvolt = <1800000>;
++			regulator-min-microvolt = <3300000>;
++			regulator-max-microvolt = <3300000>;
+ 			gpio = <&gpio 5 5 0>;
+ 			enable-active-high;
+ 		};
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch b/queue-4.19/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
new file mode 100644
index 00000000000..8d67ee8de79
--- /dev/null
+++ b/queue-4.19/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
@@ -0,0 +1,43 @@
+From 433e8276f75f42f31e251d9e7eb17a2fbda26e1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 16:29:21 +0200
+Subject: ARM: dts: lpc32xx: reparent keypad controller to SIC1
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ]
+
+After switching to a new interrupt controller scheme by separating SIC1
+and SIC2 from MIC interrupt controller just one SoC keypad controller
+was not taken into account, fix it now:
+
+  WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0
+  error: hwirq 0x36 is too large for interrupt-controller@40008000
+  ...
+  lpc32xx_keys 40050000.key: failed to get platform irq
+  lpc32xx_keys: probe of 40050000.key failed with error -22
+
+Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index d4368eeff1b9a..4f8f671c3343c 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -463,7 +463,8 @@
+ 				compatible = "nxp,lpc3220-key";
+ 				reg = <0x40050000 0x1000>;
+ 				clocks = <&clk LPC32XX_CLK_KEY>;
+-				interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-parent = <&sic1>;
++				interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
+ 				status = "disabled";
+ 			};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch b/queue-4.19/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
new file mode 100644
index 00000000000..3696d9582ef
--- /dev/null
+++ b/queue-4.19/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
@@ -0,0 +1,96 @@
+From 186ec3fea86056da23e0a5d9af134ee8892a19ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2019 02:23:14 +0300
+Subject: ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY
+ disconnect
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]
+
+Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
+But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
+are pointing towards the same internal PCS. Therefore nobody is
+controlling the internal PCS of eTSEC0.
+
+Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
+initialization. But upon an ifdown/ifup sequence, the code path from
+ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
+the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
+link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
+failure condition, the PHY driver keeps printing
+'803x_aneg_done: SGMII link is not ok'.
+
+Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
+mdio1 device.
+
+Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a-twr.dts |  9 ++++++++-
+ arch/arm/boot/dts/ls1021a.dtsi    | 11 ++++++++++-
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
+index f0c949d748331..ec5afad3efd8e 100644
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -143,7 +143,7 @@
+ };
+ 
+ &enet0 {
+-	tbi-handle = <&tbi1>;
++	tbi-handle = <&tbi0>;
+ 	phy-handle = <&sgmii_phy2>;
+ 	phy-connection-type = "sgmii";
+ 	status = "okay";
+@@ -222,6 +222,13 @@
+ 	sgmii_phy2: ethernet-phy@2 {
+ 		reg = <0x2>;
+ 	};
++	tbi0: tbi-phy@1f {
++		reg = <0x1f>;
++		device_type = "tbi-phy";
++	};
++};
++
++&mdio1 {
+ 	tbi1: tbi-phy@1f {
+ 		reg = <0x1f>;
+ 		device_type = "tbi-phy";
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index f18490548c785..7e22309bccac7 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -584,7 +584,7 @@
+ 		};
+ 
+ 		mdio0: mdio@2d24000 {
+-			compatible = "gianfar";
++			compatible = "fsl,etsec2-mdio";
+ 			device_type = "mdio";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -592,6 +592,15 @@
+ 			      <0x0 0x2d10030 0x0 0x4>;
+ 		};
+ 
++		mdio1: mdio@2d64000 {
++			compatible = "fsl,etsec2-mdio";
++			device_type = "mdio";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			reg = <0x0 0x2d64000 0x0 0x4000>,
++			      <0x0 0x2d50030 0x0 0x4>;
++		};
++
+ 		ptp_clock@2d10e00 {
+ 			compatible = "fsl,etsec-ptp";
+ 			reg = <0x0 0x2d10e00 0x0 0xb0>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-r8a7743-remove-generic-compatible-string-fro.patch b/queue-4.19/arm-dts-r8a7743-remove-generic-compatible-string-fro.patch
new file mode 100644
index 00000000000..cfd9929eafe
--- /dev/null
+++ b/queue-4.19/arm-dts-r8a7743-remove-generic-compatible-string-fro.patch
@@ -0,0 +1,39 @@
+From 3213601afd23a9e3931c98609d18bf82d9074a63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:57:57 +0000
+Subject: ARM: dts: r8a7743: Remove generic compatible string from iic3
+
+From: Biju Das <biju.das@bp.renesas.com>
+
+[ Upstream commit 072b817589b17660ef19c31d89f7b981dbed3fd2 ]
+
+The iic3 block on RZ/G1M does not support automatic transmission, unlike
+other R-Car SoC's. So dropping the compatibility with the generic version.
+
+Fixes: f523405f2a22cc0c307 ("ARM: dts: r8a7743: Add IIC cores to dtsi")
+Signed-off-by: Biju Das <biju.das@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7743.dtsi | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/r8a7743.dtsi b/arch/arm/boot/dts/r8a7743.dtsi
+index 24715f74ae08c..5015e2273d82f 100644
+--- a/arch/arm/boot/dts/r8a7743.dtsi
++++ b/arch/arm/boot/dts/r8a7743.dtsi
+@@ -565,9 +565,7 @@
+ 			/* doesn't need pinmux */
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			compatible = "renesas,iic-r8a7743",
+-				     "renesas,rcar-gen2-iic",
+-				     "renesas,rmobile-iic";
++			compatible = "renesas,iic-r8a7743";
+ 			reg = <0 0xe60b0000 0 0x425>;
+ 			interrupts = <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 926>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch b/queue-4.19/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch
new file mode 100644
index 00000000000..4e9cb6cfe8e
--- /dev/null
+++ b/queue-4.19/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch
@@ -0,0 +1,36 @@
+From 85fd3ade878e45cf1f1686a8f54a3832bc300faa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2019 14:29:58 +0200
+Subject: ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 493e84c5dc4d703d976b5875f5db22dae08a0782 ]
+
+Add missing vdda-supply required by STM32 ADC.
+
+Fixes: 090992a9ca54 ("ARM: dts: stm32: enable ADC on stm32h743i-eval
+board")
+
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32h743i-eval.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/stm32h743i-eval.dts b/arch/arm/boot/dts/stm32h743i-eval.dts
+index 3f8e0c4a998d0..5bf64e63cdf35 100644
+--- a/arch/arm/boot/dts/stm32h743i-eval.dts
++++ b/arch/arm/boot/dts/stm32h743i-eval.dts
+@@ -79,6 +79,7 @@
+ };
+ 
+ &adc_12 {
++	vdda-supply = <&vdda>;
+ 	vref-supply = <&vdda>;
+ 	status = "okay";
+ 	adc1: adc@0 {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-sun8i-a23-a33-move-nand-controller-device-no.patch b/queue-4.19/arm-dts-sun8i-a23-a33-move-nand-controller-device-no.patch
new file mode 100644
index 00000000000..37bb5798e37
--- /dev/null
+++ b/queue-4.19/arm-dts-sun8i-a23-a33-move-nand-controller-device-no.patch
@@ -0,0 +1,72 @@
+From 486c668501b7b85da44479fd2d313762ab19d862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 11:23:10 +0800
+Subject: ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by
+ address
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit d027521497592773cd23d016d36975574d3452db ]
+
+The NAND controller device node was inserted into the wrong position,
+probably due to a rebase or merge, as the file's structure does not
+provide enough context for git to accurately match the previous device
+node block.
+
+Fixes: d7b843df13ea ("ARM: dts: sun8i: add NAND controller node for A23/A33")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a23-a33.dtsi | 28 +++++++++++++---------------
+ 1 file changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+index c16ffcc4db7da..a272a69519a26 100644
+--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
++++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+@@ -155,6 +155,19 @@
+ 			#dma-cells = <1>;
+ 		};
+ 
++		nfc: nand@1c03000 {
++			compatible = "allwinner,sun4i-a10-nand";
++			reg = <0x01c03000 0x1000>;
++			interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&ccu CLK_BUS_NAND>, <&ccu CLK_NAND>;
++			clock-names = "ahb", "mod";
++			resets = <&ccu RST_BUS_NAND>;
++			reset-names = "ahb";
++			status = "disabled";
++			#address-cells = <1>;
++			#size-cells = <0>;
++		};
++
+ 		mmc0: mmc@1c0f000 {
+ 			compatible = "allwinner,sun7i-a20-mmc";
+ 			reg = <0x01c0f000 0x1000>;
+@@ -212,21 +225,6 @@
+ 			#size-cells = <0>;
+ 		};
+ 
+-		nfc: nand@1c03000 {
+-			compatible = "allwinner,sun4i-a10-nand";
+-			reg = <0x01c03000 0x1000>;
+-			interrupts = <GIC_SPI 70 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&ccu CLK_BUS_NAND>, <&ccu CLK_NAND>;
+-			clock-names = "ahb", "mod";
+-			resets = <&ccu RST_BUS_NAND>;
+-			reset-names = "ahb";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&nand_pins &nand_pins_cs0 &nand_pins_rb0>;
+-			status = "disabled";
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-		};
+-
+ 		usb_otg: usb@1c19000 {
+ 			/* compatible gets set in SoC specific dtsi file */
+ 			reg = <0x01c19000 0x0400>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-sun8i-a33-reintroduce-default-pinctrl-muxing.patch b/queue-4.19/arm-dts-sun8i-a33-reintroduce-default-pinctrl-muxing.patch
new file mode 100644
index 00000000000..94f8c63ed5f
--- /dev/null
+++ b/queue-4.19/arm-dts-sun8i-a33-reintroduce-default-pinctrl-muxing.patch
@@ -0,0 +1,39 @@
+From b04be61b1dbd6f07799acfaf63d4be46306a42a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Mar 2019 12:00:41 +0100
+Subject: ARM: dts: sun8i: a33: Reintroduce default pinctrl muxing
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit fa44328f4eb0b762a1fcb148809068e9646e7156 ]
+
+Commit d02752149759 ("ARM: dts: sun8i-a23-a33: Move NAND controller device
+node to sort by address") moved the NAND controller node around, but
+dropped the default muxing in the process.
+
+Reintroduce it.
+
+Fixes: d02752149759 ("ARM: dts: sun8i-a23-a33: Move NAND controller device node to sort by address")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a23-a33.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+index a272a69519a26..1efad1a6bcfd9 100644
+--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
++++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+@@ -163,6 +163,8 @@
+ 			clock-names = "ahb", "mod";
+ 			resets = <&ccu RST_BUS_NAND>;
+ 			reset-names = "ahb";
++			pinctrl-names = "default";
++			pinctrl-0 = <&nand_pins &nand_pins_cs0 &nand_pins_rb0>;
+ 			status = "disabled";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch b/queue-4.19/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch
new file mode 100644
index 00000000000..b4bca44c52e
--- /dev/null
+++ b/queue-4.19/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch
@@ -0,0 +1,50 @@
+From b7d2d4b739a018ab57a014953b79f56a07615412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 May 2019 17:40:14 +0200
+Subject: ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit ca0961011db57e39880df0b5708df8aa3339dc6f ]
+
+mmc1 node where wifi module is connected doesn't have properly defined
+power supplies so wifi module is never powered up. Fix that by
+specifying additional power supplies.
+
+Additionally, this STB may have either Realtek or Broadcom based wifi
+module. One based on Broadcom module also needs external clock to work
+properly. Fix that by adding clock property to wifi_pwrseq node.
+
+Fixes: e582b47a9252 ("ARM: dts: sun8i-h3: Add dts for the Beelink X2 STB")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+index 25540b7694d59..6523d81dd9c49 100644
+--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+@@ -90,6 +90,8 @@
+ 	wifi_pwrseq: wifi_pwrseq {
+ 		compatible = "mmc-pwrseq-simple";
+ 		reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */
++		clocks = <&rtc 1>;
++		clock-names = "ext_clock";
+ 	};
+ 
+ 	sound_spdif {
+@@ -155,6 +157,8 @@
+ 
+ &mmc1 {
+ 	vmmc-supply = <&reg_vcc3v3>;
++	vqmmc-supply = <&reg_vcc3v3>;
++	mmc-pwrseq = <&wifi_pwrseq>;
+ 	bus-width = <4>;
+ 	non-removable;
+ 	status = "okay";
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-dts-sun9i-optimus-fix-fixed-regulators.patch b/queue-4.19/arm-dts-sun9i-optimus-fix-fixed-regulators.patch
new file mode 100644
index 00000000000..a3113937ba2
--- /dev/null
+++ b/queue-4.19/arm-dts-sun9i-optimus-fix-fixed-regulators.patch
@@ -0,0 +1,49 @@
+From a50fc38b49bfbb80e7d5c7b54da4114dedaf6cf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 14:52:34 +0100
+Subject: ARM: dts: sun9i: optimus: Fix fixed-regulators
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit c2a5b554751545023056559121a8ecf86aebe541 ]
+
+Commit 1848f3f44444 ("ARM: dts: sun9i: Remove GPIO pinctrl nodes to avoid
+warnings") was wrong on the optimus, and instead of droping the
+pinctrl-names property, it dropped the regulator-name one.
+
+Obviously, that wasn't what was intended. Reinstate regulator-name and drop
+pinctrl-names.
+
+Fixes: 1848f3f44444 ("ARM: dts: sun9i: Remove GPIO pinctrl nodes to avoid warnings")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun9i-a80-optimus.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+index 58a199b0e4943..d1e58a6a43432 100644
+--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
++++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+@@ -82,7 +82,7 @@
+ 
+ 	reg_usb1_vbus: usb1-vbus {
+ 		compatible = "regulator-fixed";
+-		pinctrl-names = "default";
++		regulator-name = "usb1-vbus";
+ 		regulator-min-microvolt = <5000000>;
+ 		regulator-max-microvolt = <5000000>;
+ 		enable-active-high;
+@@ -91,7 +91,7 @@
+ 
+ 	reg_usb3_vbus: usb3-vbus {
+ 		compatible = "regulator-fixed";
+-		pinctrl-names = "default";
++		regulator-name = "usb3-vbus";
+ 		regulator-min-microvolt = <5000000>;
+ 		regulator-max-microvolt = <5000000>;
+ 		enable-active-high;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-omap2-fix-potentially-uninitialized-return-value.patch b/queue-4.19/arm-omap2-fix-potentially-uninitialized-return-value.patch
new file mode 100644
index 00000000000..1c1f9285031
--- /dev/null
+++ b/queue-4.19/arm-omap2-fix-potentially-uninitialized-return-value.patch
@@ -0,0 +1,44 @@
+From 50f21b456dd776c48c48141740cda97ea1dbbee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2019 11:00:21 -0700
+Subject: ARM: OMAP2+: Fix potentially uninitialized return value for
+ _setup_reset()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]
+
+Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
+the call to _enable() conditional based on no oh->rst_lines_cnt. This
+caused the return value to be potentially uninitialized. Curiously we see
+no compiler warnings for this, probably as this gets inlined.
+
+We call _setup_reset() from _setup() and only _setup_postsetup() if the
+return value is zero. Currently the return value can be uninitialized for
+cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.
+
+Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index ec3789ba17b8b..a8269f0a87ced 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2430,7 +2430,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
+  */
+ static int _setup_reset(struct omap_hwmod *oh)
+ {
+-	int r;
++	int r = 0;
+ 
+ 	if (oh->_state != _HWMOD_STATE_INITIALIZED)
+ 		return -EINVAL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch b/queue-4.19/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
new file mode 100644
index 00000000000..2ef80878168
--- /dev/null
+++ b/queue-4.19/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
@@ -0,0 +1,47 @@
+From 13789fba3ea86ef6fb9e00c5a0c3b771e635c107 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 16:03:24 +0800
+Subject: ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]
+
+Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+kfree, iounmap, clk_put etc are not needed anymore in remove path.
+
+Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+[ commit message spelling fix ]
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/plat-pxa/ssp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
+index f519199741837..bf25f780c1c9e 100644
+--- a/arch/arm/plat-pxa/ssp.c
++++ b/arch/arm/plat-pxa/ssp.c
+@@ -183,18 +183,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
+ 
+ static int pxa_ssp_remove(struct platform_device *pdev)
+ {
+-	struct resource *res;
+ 	struct ssp_device *ssp;
+ 
+ 	ssp = platform_get_drvdata(pdev);
+ 	if (ssp == NULL)
+ 		return -ENODEV;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	release_mem_region(res->start, resource_size(res));
+-
+-	clk_put(ssp->clk);
+-
+ 	mutex_lock(&ssp_lock);
+ 	list_del(&ssp->node);
+ 	mutex_unlock(&ssp_lock);
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-qcom_defconfig-enable-mailbox.patch b/queue-4.19/arm-qcom_defconfig-enable-mailbox.patch
new file mode 100644
index 00000000000..2af58a14c0f
--- /dev/null
+++ b/queue-4.19/arm-qcom_defconfig-enable-mailbox.patch
@@ -0,0 +1,46 @@
+From 2c71f8c947ce3cadbf5e6a1f83d83a9b88461868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 21:44:48 -0700
+Subject: ARM: qcom_defconfig: Enable MAILBOX
+
+From: Frank Rowand <frank.rowand@sony.com>
+
+[ Upstream commit 54c2678cd198f61555796bbda5e1727e6e1858f1 ]
+
+Problem:
+ab460a2e72da ("rpmsg: qcom_smd: Access APCS through mailbox framework"
+added a "depends on MAILBOX") to RPMSG_QCOM_SMD, thus RPMSG_QCOM_SMD
+becomes unset since MAILBOX was not enabled in qcom_defconfig and is
+not otherwise selected for the dragonboard.  When the resulting
+kernel is booted the mmc device which contains the root file system
+is not available.
+
+Fix:
+add CONFIG_MAILBOX to qcom_defconfig
+
+Fixes: ab460a2e72da ("rpmsg: qcom_smd: Access APCS through mailbox framework"
+added a "depends on MAILBOX")
+
+Signed-off-by: Frank Rowand <frank.rowand@sony.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/qcom_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/configs/qcom_defconfig b/arch/arm/configs/qcom_defconfig
+index 6aa7046fb91ff..bd6440f234939 100644
+--- a/arch/arm/configs/qcom_defconfig
++++ b/arch/arm/configs/qcom_defconfig
+@@ -207,6 +207,7 @@ CONFIG_MSM_MMCC_8974=y
+ CONFIG_MSM_IOMMU=y
+ CONFIG_HWSPINLOCK=y
+ CONFIG_HWSPINLOCK_QCOM=y
++CONFIG_MAILBOX=y
+ CONFIG_REMOTEPROC=y
+ CONFIG_QCOM_ADSP_PIL=y
+ CONFIG_QCOM_Q6V5_PIL=y
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch b/queue-4.19/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
new file mode 100644
index 00000000000..fb3f623d720
--- /dev/null
+++ b/queue-4.19/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
@@ -0,0 +1,42 @@
+From 04a97be036f0941f5e428cbc70f6c4060370728f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Apr 2019 22:43:49 +0100
+Subject: ARM: riscpc: fix lack of keyboard interrupts after irq conversion
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]
+
+Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.
+
+Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-rpc/irq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
+index b8a61cb112073..7f0f401786344 100644
+--- a/arch/arm/mach-rpc/irq.c
++++ b/arch/arm/mach-rpc/irq.c
+@@ -118,7 +118,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
+ 
+ void __init rpc_init_irq(void)
+ {
+-	unsigned int irq, clr, set = 0;
++	unsigned int irq, clr, set;
+ 
+ 	iomd_writeb(0, IOMD_IRQMASKA);
+ 	iomd_writeb(0, IOMD_IRQMASKB);
+@@ -130,6 +130,7 @@ void __init rpc_init_irq(void)
+ 
+ 	for (irq = 0; irq < NR_IRQS; irq++) {
+ 		clr = IRQ_NOREQUEST;
++		set = 0;
+ 
+ 		if (irq <= 6 || (irq >= 9 && irq <= 15))
+ 			clr |= IRQ_NOPROBE;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm-stm32-use-depends-on-instead-of-if-after-prompt.patch b/queue-4.19/arm-stm32-use-depends-on-instead-of-if-after-prompt.patch
new file mode 100644
index 00000000000..7d1fdaebd8f
--- /dev/null
+++ b/queue-4.19/arm-stm32-use-depends-on-instead-of-if-after-prompt.patch
@@ -0,0 +1,36 @@
+From 03e14005c91cc25d350c16e84cb64c73a1d8f124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2019 14:13:20 +0900
+Subject: ARM: stm32: use "depends on" instead of "if" after prompt
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 7e8a0f10899075ac2665c78c4e49dbaf32bf3346 ]
+
+This appeared after the global fixups by commit e32465429490 ("ARM: use
+"depends on" for SoC configs instead of "if" after prompt"). Fix it now.
+
+Link: https://lore.kernel.org/r/20190710051320.8738-1-yamada.masahiro@socionext.com
+Fixes: e32465429490 ("ARM: use "depends on" for SoC configs instead of "if" after prompt")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-stm32/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
+index 713c068b953fb..adca4368d67c4 100644
+--- a/arch/arm/mach-stm32/Kconfig
++++ b/arch/arm/mach-stm32/Kconfig
+@@ -1,5 +1,6 @@
+ menuconfig ARCH_STM32
+-	bool "STMicroelectronics STM32 family" if ARM_SINGLE_ARMV7M || ARCH_MULTI_V7
++	bool "STMicroelectronics STM32 family"
++	depends on ARM_SINGLE_ARMV7M || ARCH_MULTI_V7
+ 	select ARMV7M_SYSTICK if ARM_SINGLE_ARMV7M
+ 	select HAVE_ARM_ARCH_TIMER if ARCH_MULTI_V7
+ 	select ARM_GIC if ARCH_MULTI_V7
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-defconfig-re-enable-bcm2835-thermal-driver.patch b/queue-4.19/arm64-defconfig-re-enable-bcm2835-thermal-driver.patch
new file mode 100644
index 00000000000..453c3babe9a
--- /dev/null
+++ b/queue-4.19/arm64-defconfig-re-enable-bcm2835-thermal-driver.patch
@@ -0,0 +1,37 @@
+From 95c45e953c33cdfb0826b99a6ea4df146792df57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 17:53:23 +0100
+Subject: arm64: defconfig: Re-enable bcm2835-thermal driver
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 4d9226fd9a0d747030575d7cb184b30c6e64f155 ]
+
+The bcm2835-thermal driver was added with commit ac178e4280e6
+("ARM64: bcm2835: add thermal driver to default config"). Unfortunately
+this was accidentally dropped by commit eb1e6716cc9c
+("arm64: defconfig: sync with savedefconfig"). So enable the driver again.
+
+Fixes: eb1e6716cc9c ("arm64: defconfig: sync with savedefconfig")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/configs/defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
+index db8d364f84768..1a4f8b67bbe80 100644
+--- a/arch/arm64/configs/defconfig
++++ b/arch/arm64/configs/defconfig
+@@ -365,6 +365,7 @@ CONFIG_THERMAL_EMULATION=y
+ CONFIG_ROCKCHIP_THERMAL=m
+ CONFIG_RCAR_GEN3_THERMAL=y
+ CONFIG_ARMADA_THERMAL=y
++CONFIG_BCM2835_THERMAL=m
+ CONFIG_BRCMSTB_THERMAL=m
+ CONFIG_EXYNOS_THERMAL=y
+ CONFIG_TEGRA_BPMP_THERMAL=m
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch b/queue-4.19/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch
new file mode 100644
index 00000000000..534d5a6d168
--- /dev/null
+++ b/queue-4.19/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch
@@ -0,0 +1,40 @@
+From 7f73ac44cfe153417d0779aa2fed1335dc50cc1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 14:52:50 +0100
+Subject: arm64: dts: allwinner: a64: Add missing PIO clocks
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 562bf19611c000cb7219431c3cc78aa60c2b371e ]
+
+The pinctrl binding mandates that we have the three clocks fed into the PIO
+described.
+
+Even though the old case is still supported for backward compatibility, we
+should update our DTs to fix this.
+
+Fixes: 6bc37fac30cf ("arm64: dts: add Allwinner A64 SoC .dtsi")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index d3daf90a8715c..7abc4ea305410 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -366,7 +366,8 @@
+ 			interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&ccu 58>;
++			clocks = <&ccu 58>, <&osc24M>, <&rtc 0>;
++			clock-names = "apb", "hosc", "losc";
+ 			gpio-controller;
+ 			#gpio-cells = <3>;
+ 			interrupt-controller;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-allwinner-h6-move-gic-device-node-fix-base.patch b/queue-4.19/arm64-dts-allwinner-h6-move-gic-device-node-fix-base.patch
new file mode 100644
index 00000000000..7081ccb4382
--- /dev/null
+++ b/queue-4.19/arm64-dts-allwinner-h6-move-gic-device-node-fix-base.patch
@@ -0,0 +1,65 @@
+From c3599e3b32648872457c0ce957c64a61f0224362 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jan 2019 00:39:30 +0800
+Subject: arm64: dts: allwinner: h6: Move GIC device node fix base address
+ ordering
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 52d9bcb3d0de3fa1e07aff3800f857836d30410d ]
+
+The GIC device node was placed out of order in the initial device tree
+submission. Move it so the nodes are correctly sorted by base address
+again.
+
+Fixes: e54be32d0273 ("arm64: allwinner: h6: add the basical Allwinner H6 DTSI file")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 22 ++++++++++----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index cfa5fffcf62b4..72813e7aefb8a 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -101,17 +101,6 @@
+ 			#reset-cells = <1>;
+ 		};
+ 
+-		gic: interrupt-controller@3021000 {
+-			compatible = "arm,gic-400";
+-			reg = <0x03021000 0x1000>,
+-			      <0x03022000 0x2000>,
+-			      <0x03024000 0x2000>,
+-			      <0x03026000 0x2000>;
+-			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+-			interrupt-controller;
+-			#interrupt-cells = <3>;
+-		};
+-
+ 		pio: pinctrl@300b000 {
+ 			compatible = "allwinner,sun50i-h6-pinctrl";
+ 			reg = <0x0300b000 0x400>;
+@@ -149,6 +138,17 @@
+ 			};
+ 		};
+ 
++		gic: interrupt-controller@3021000 {
++			compatible = "arm,gic-400";
++			reg = <0x03021000 0x1000>,
++			      <0x03022000 0x2000>,
++			      <0x03024000 0x2000>,
++			      <0x03026000 0x2000>;
++			interrupts = <GIC_PPI 9 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
++			interrupt-controller;
++			#interrupt-cells = <3>;
++		};
++
+ 		mmc0: mmc@4020000 {
+ 			compatible = "allwinner,sun50i-h6-mmc",
+ 				     "allwinner,sun50i-a64-mmc";
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-allwinner-h6-pine-h64-add-interrupt-line-f.patch b/queue-4.19/arm64-dts-allwinner-h6-pine-h64-add-interrupt-line-f.patch
new file mode 100644
index 00000000000..56843a1467f
--- /dev/null
+++ b/queue-4.19/arm64-dts-allwinner-h6-pine-h64-add-interrupt-line-f.patch
@@ -0,0 +1,38 @@
+From 41d4d60a44d632aad06591b7492d0a495f595d0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:37 +0800
+Subject: arm64: dts: allwinner: h6: Pine H64: Add interrupt line for RTC
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 0bb9d1876c0605815ea0452f68cb819a775a75f9 ]
+
+The external PCF8563 RTC chip's interrupt line is connected to the NMI
+line on the SoC.
+
+Add the interrupt line to the device tree.
+
+Fixes: 17ebc33afc35 ("arm64: allwinner: h6: add PCF8563 RTC on Pine H64 board")
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+index 48daec7f78ba7..6c3a47d90c793 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+@@ -176,6 +176,8 @@
+ 	pcf8563: rtc@51 {
+ 		compatible = "nxp,pcf8563";
+ 		reg = <0x51>;
++		interrupt-parent = <&r_intc>;
++		interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+ 		#clock-cells = <0>;
+ 	};
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch b/queue-4.19/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
new file mode 100644
index 00000000000..5331b07fac1
--- /dev/null
+++ b/queue-4.19/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
@@ -0,0 +1,42 @@
+From 52b4e9039d9a4ac1b675b06a33a67d317ab257e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:01:02 +0100
+Subject: arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ]
+
+In the same way as for msm8974-hammerhead, l11 load, used for SDCARD
+VMMC, needs to be increased in order to prevent any voltage drop issues
+(due to limited current) happening with some SDCARDS or during specific
+operations (e.g. write).
+
+Tested on Dragonboard-410c and DART-SD410 boards.
+
+Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support)
+Reported-by: Manabu Igusa <migusa@arrowjapan.com>
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+index 78ce3979ef096..f38b815e696d8 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -630,6 +630,8 @@
+ 	l11 {
+ 		regulator-min-microvolt = <1750000>;
+ 		regulator-max-microvolt = <3337000>;
++		regulator-allow-set-load;
++		regulator-system-load = <200000>;
+ 	};
+ 
+ 	l12 {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-juno-fix-uart-frequency.patch b/queue-4.19/arm64-dts-juno-fix-uart-frequency.patch
new file mode 100644
index 00000000000..63599f75824
--- /dev/null
+++ b/queue-4.19/arm64-dts-juno-fix-uart-frequency.patch
@@ -0,0 +1,54 @@
+From 6e0a9ea0f4ee855c28f842d2e198fe2e66371f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 12:03:31 +0000
+Subject: arm64: dts: juno: Fix UART frequency
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ]
+
+Older versions of the Juno *SoC* TRM [1] recommended that the UART clock
+source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more
+correct value of 7.3728 MHz. Somehow the wrong value managed to end up in
+our DT.
+
+Doing a prime factorisation, a modulo divide by 115200 and trying
+to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest
+that the old value was actually a typo. The actual UART clock is driven
+by a PLL, configured via a parameter in some board.txt file in the
+firmware, which reads 7.37 MHz (sic!).
+
+Fix this to correct the baud rate divisor calculation on the Juno board.
+
+[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf
+[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf
+
+Fixes: 71f867ec130e ("arm64: Add Juno board device tree.")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+index e5e265dfa9025..2870b5eeb1984 100644
+--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+@@ -8,10 +8,10 @@
+  */
+ / {
+ 	/* SoC fixed clocks */
+-	soc_uartclk: refclk7273800hz {
++	soc_uartclk: refclk7372800hz {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
+-		clock-frequency = <7273800>;
++		clock-frequency = <7372800>;
+ 		clock-output-names = "juno:uartclk";
+ 	};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-meson-gx-add-hdmi_5v-regulator-as-hdmi-tx-.patch b/queue-4.19/arm64-dts-meson-gx-add-hdmi_5v-regulator-as-hdmi-tx-.patch
new file mode 100644
index 00000000000..c81e7f8cd76
--- /dev/null
+++ b/queue-4.19/arm64-dts-meson-gx-add-hdmi_5v-regulator-as-hdmi-tx-.patch
@@ -0,0 +1,87 @@
+From 1a390d85fd1f164de95fb4a04d2d4254e585b4f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 14:24:38 +0100
+Subject: arm64: dts: meson-gx: Add hdmi_5v regulator as hdmi tx supply
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit e1f2163deac059ad39f07aba9e314ebe605d5a7a ]
+
+The hdmi_5v regulator must be enabled to provide power to the physical HDMI
+PHY and enables the HDMI 5V presence loopback for the monitor.
+
+Fixes: b409f625a6d5 ("ARM64: dts: meson-gx: Add HDMI_5V regulator on selected boards")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi          | 1 +
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts   | 1 +
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 +
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts         | 1 +
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts        | 1 +
+ 5 files changed, 5 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+index 765247bc4f247..e14e0ce7e89fe 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi
+@@ -125,6 +125,7 @@
+ 	status = "okay";
+ 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ 	pinctrl-names = "default";
++	hdmi-supply = <&hdmi_5v>;
+ };
+ 
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+index 9d858eb193ca6..062e12aa46770 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+@@ -76,6 +76,7 @@
+ 	status = "okay";
+ 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ 	pinctrl-names = "default";
++	hdmi-supply = <&hdmi_5v>;
+ };
+ 
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index b4dfb9afdef86..db293440e4cae 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -155,6 +155,7 @@
+ 	status = "okay";
+ 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ 	pinctrl-names = "default";
++	hdmi-supply = <&hdmi_5v>;
+ };
+ 
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
+index 5896e8a5d86bc..2602940c2077b 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dts
+@@ -51,6 +51,7 @@
+ 	status = "okay";
+ 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ 	pinctrl-names = "default";
++	hdmi-supply = <&hdmi_5v>;
+ };
+ 
+ &hdmi_tx_tmds_port {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index 313f88f8759e1..782e9edac8051 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -271,6 +271,7 @@
+ 	status = "okay";
+ 	pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>;
+ 	pinctrl-names = "default";
++	hdmi-supply = <&hdmi_5v>;
+ };
+ 
+ &hdmi_tx_tmds_port {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-bluetooth-suppor.patch b/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-bluetooth-suppor.patch
new file mode 100644
index 00000000000..969962c6d48
--- /dev/null
+++ b/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-bluetooth-suppor.patch
@@ -0,0 +1,53 @@
+From 6a0e472996ed6a265cc36038a4c70445394d12db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 15:21:52 +0200
+Subject: arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit 33344e2111a3a07097a66f339ad213b047ccdfd2 ]
+
+- Remove serial1 alias
+- Add support for uart_A rts/cts
+- Add bluetooth uart_A subnode qith shutdown gpio
+
+Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index bfd3a510ff162..785240733d946 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -18,7 +18,6 @@
+ 
+ 	aliases {
+ 		serial0 = &uart_AO;
+-		serial1 = &uart_A;
+ 		serial2 = &uart_AO_B;
+ 	};
+ 
+@@ -407,8 +406,14 @@
+ /* This one is connected to the Bluetooth module */
+ &uart_A {
+ 	status = "okay";
+-	pinctrl-0 = <&uart_a_pins>;
++	pinctrl-0 = <&uart_a_pins>, <&uart_a_cts_rts_pins>;
+ 	pinctrl-names = "default";
++	uart-has-rtscts;
++
++	bluetooth {
++		compatible = "brcm,bcm43438-bt";
++		shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
++	};
+ };
+ 
+ /* This is brought out on the Linux_RX (18) and Linux_TX (19) pins: */
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-gpio-keys-polled.patch b/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-gpio-keys-polled.patch
new file mode 100644
index 00000000000..d27ab5ec180
--- /dev/null
+++ b/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-gpio-keys-polled.patch
@@ -0,0 +1,46 @@
+From 02a6a6fb38946ff4040d7ffd4380b6d05bca6893 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 15:21:51 +0200
+Subject: arm64: dts: meson-gxm-khadas-vim2: fix gpio-keys-polled node
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit 0afd24c2fb61bd5163bab08ea1ee54d60d3ea37e ]
+
+Fix DTC warnings:
+
+meson-gxm-khadas-vim2.dtb: Warning (avoid_unnecessary_addr_size):
+   /gpio-keys-polled: unnecessary #address-cells/#size-cells
+	without "ranges" or child "reg" property
+
+Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index 782e9edac8051..bfd3a510ff162 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -63,11 +63,9 @@
+ 
+ 	gpio-keys-polled {
+ 		compatible = "gpio-keys-polled";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+ 		poll-interval = <100>;
+ 
+-		button@0 {
++		power-button {
+ 			label = "power";
+ 			linux,code = <KEY_POWER>;
+ 			gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_LOW>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-uart_a-bluetooth.patch b/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-uart_a-bluetooth.patch
new file mode 100644
index 00000000000..a6082935c65
--- /dev/null
+++ b/queue-4.19/arm64-dts-meson-gxm-khadas-vim2-fix-uart_a-bluetooth.patch
@@ -0,0 +1,35 @@
+From 4b6f11cb7a18fcb586f8df2b1416e600b9b67730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 19:01:24 +0400
+Subject: arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit 388a2772979b625042524d8b91280616ab4ff5ee ]
+
+Fixes: 33344e2111a3 ("arm64: dts: meson-gxm-khadas-vim2: fix Bluetooth support")
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index 785240733d946..bdf7c6c5983ce 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -413,6 +413,9 @@
+ 	bluetooth {
+ 		compatible = "brcm,bcm43438-bt";
+ 		shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
++		max-speed = <2000000>;
++		clocks = <&wifi32k>;
++		clock-names = "lpo";
+ 	};
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch b/queue-4.19/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch
new file mode 100644
index 00000000000..3a11a0f087c
--- /dev/null
+++ b/queue-4.19/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch
@@ -0,0 +1,37 @@
+From ad2d67546570012ca9dd82568b127330a99d4548 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Apr 2019 14:27:09 +0200
+Subject: arm64: dts: meson: libretech-cc: set eMMC as removable
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 9f72e321d5506fe3e162a6308a4a295d7f10bb5d ]
+
+The eMMC on this board is add-on module which is not mandatory. Removing
+'non-removable' property should prevent some errors when booting a board
+w/o an eMMC module present.
+
+Fixes: 72fb2c852188 ("ARM64: dts: meson-gxl-s905x-libretech-cc: fixup board definition")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Martin Blumenstingl<martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index db293440e4cae..daad007fac1f6 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -256,7 +256,6 @@
+ 	cap-mmc-highspeed;
+ 	mmc-ddr-3_3v;
+ 	max-frequency = <50000000>;
+-	non-removable;
+ 	disable-wp;
+ 
+ 	mmc-pwrseq = <&emmc_pwrseq>;
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-msm8916-remove-bogus-argument-to-the-cpu-c.patch b/queue-4.19/arm64-dts-msm8916-remove-bogus-argument-to-the-cpu-c.patch
new file mode 100644
index 00000000000..9c21091adf3
--- /dev/null
+++ b/queue-4.19/arm64-dts-msm8916-remove-bogus-argument-to-the-cpu-c.patch
@@ -0,0 +1,68 @@
+From fa6f20f5017c9e03e267b3241272fd65a1aa433a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jan 2019 13:45:08 +0100
+Subject: arm64: dts: msm8916: remove bogus argument to the cpu clock
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+[ Upstream commit e4f045ef38e61ba37aa4afc916fce4fc1b37aa19 ]
+
+The apcs node has #clock-cells = <0>, which means that those who
+references it should specify 0 arguments.
+
+The apcs reference in the cpu node incorrectly specifies an argument,
+remove this bogus argument.
+
+Fixes: 65afdf458360 ("arm64: dts: qcom: msm8916: Add CPU frequency scaling support")
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 7b32b8990d62f..8011e564a234b 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -114,7 +114,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			enable-method = "psci";
+ 			cpu-idle-states = <&CPU_SPC>;
+-			clocks = <&apcs 0>;
++			clocks = <&apcs>;
+ 			operating-points-v2 = <&cpu_opp_table>;
+ 			#cooling-cells = <2>;
+ 		};
+@@ -126,7 +126,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			enable-method = "psci";
+ 			cpu-idle-states = <&CPU_SPC>;
+-			clocks = <&apcs 0>;
++			clocks = <&apcs>;
+ 			operating-points-v2 = <&cpu_opp_table>;
+ 			#cooling-cells = <2>;
+ 		};
+@@ -138,7 +138,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			enable-method = "psci";
+ 			cpu-idle-states = <&CPU_SPC>;
+-			clocks = <&apcs 0>;
++			clocks = <&apcs>;
+ 			operating-points-v2 = <&cpu_opp_table>;
+ 			#cooling-cells = <2>;
+ 		};
+@@ -150,7 +150,7 @@
+ 			next-level-cache = <&L2_0>;
+ 			enable-method = "psci";
+ 			cpu-idle-states = <&CPU_SPC>;
+-			clocks = <&apcs 0>;
++			clocks = <&apcs>;
+ 			operating-points-v2 = <&cpu_opp_table>;
+ 			#cooling-cells = <2>;
+ 		};
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-renesas-ebisu-remove-renesas-no-ether-link.patch b/queue-4.19/arm64-dts-renesas-ebisu-remove-renesas-no-ether-link.patch
new file mode 100644
index 00000000000..f68ac46461a
--- /dev/null
+++ b/queue-4.19/arm64-dts-renesas-ebisu-remove-renesas-no-ether-link.patch
@@ -0,0 +1,68 @@
+From b62e74168e602ac206f3a5e2bc587a264340ae4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 08:08:08 -0800
+Subject: arm64: dts: renesas: ebisu: Remove renesas, no-ether-link property
+
+From: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+
+[ Upstream commit 90d4fa39d028f2e46c57c3d0e1b759e5287d98b7 ]
+
+It is incorrect to specify the no-ether-link property for the AVB device on
+the Ebisu board. This is because the property should only be used when a
+board does not provide a proper AVB_LINK signal. However, the Ebisu board
+does provide this signal.
+
+As per 87c059e9c39d ("arm64: dts: renesas: salvator-x: Remove renesas,
+no-ether-link property") this fixes a bug:
+
+    Steps to reproduce:
+    - start AVB TX stream (Using aplay via MSE),
+    - disconnect+reconnect the eth cable,
+    - after a reconnection the eth connection goes iteratively up/down
+      without user interaction,
+    - this may heal after some seconds or even stay for minutes.
+
+    As the documentation specifies, the "renesas,no-ether-link" option
+    should be used when a board does not provide a proper AVB_LINK signal.
+    There is no need for this option enabled on RCAR H3/M3 Salvator-X/XS
+    and ULCB starter kits since the AVB_LINK is correctly handled by HW.
+
+    Choosing to keep or remove the "renesas,no-ether-link" option will have
+    impact on the code flow in the following ways:
+    - keeping this option enabled may lead to unexpected behavior since the
+      RX & TX are enabled/disabled directly from adjust_link function
+      without any HW interrogation,
+    - removing this option, the RX & TX will only be enabled/disabled after
+      HW interrogation. The HW check is made through the LMON pin in PSR
+      register which specifies AVB_LINK signal value (0 - at low level;
+      1 - at high level).
+
+    In conclusion, the present change is also a safety improvement because
+    it removes the "renesas,no-ether-link" option leading to a proper way
+    of detecting the link state based on HW interrogation and not on
+    software heuristic.
+
+Fixes: 8441ef643d7d ("arm64: dts: renesas: r8a77990: ebisu: Enable EthernetAVB")
+Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+[simon: updated changelog]
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+index 2bc3a4884b003..470c2a35a5aff 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+@@ -33,7 +33,6 @@
+ &avb {
+ 	pinctrl-0 = <&avb_pins>;
+ 	pinctrl-names = "default";
+-	renesas,no-ether-link;
+ 	phy-handle = <&phy0>;
+ 	phy-mode = "rgmii-txid";
+ 	status = "okay";
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-renesas-r8a7795-es1-add-missing-power-doma.patch b/queue-4.19/arm64-dts-renesas-r8a7795-es1-add-missing-power-doma.patch
new file mode 100644
index 00000000000..26870b2e0d2
--- /dev/null
+++ b/queue-4.19/arm64-dts-renesas-r8a7795-es1-add-missing-power-doma.patch
@@ -0,0 +1,45 @@
+From e1766deaf2fb80fdfdf4a893ad32c79cad54e2df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 11:34:35 +0100
+Subject: arm64: dts: renesas: r8a7795-es1: Add missing power domains to IPMMU
+ nodes
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 41e30b515a003a90e336b7a456c7c82d8c3aa6a7 ]
+
+While commit 3b7e7848f0e88b36 ("arm64: dts: renesas: r8a7795: Add IPMMU
+device nodes") for R-Car H3 ES2.0 did include power-domains properties,
+they were forgotten in the counterpart for older R-Car H3 ES1.x SoCs.
+
+Fixes: e4b9a493df45075b ("arm64: dts: renesas: r8a7795-es1: Add IPMMU device nodes")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi b/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
+index 7b2fbaec9aef8..3dc61b7e1d08a 100644
+--- a/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a7795-es1.dtsi
+@@ -28,6 +28,7 @@
+ 		compatible = "renesas,ipmmu-r8a7795";
+ 		reg = <0 0xec680000 0 0x1000>;
+ 		renesas,ipmmu-main = <&ipmmu_mm 5>;
++		power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ 		#iommu-cells = <1>;
+ 	};
+ 
+@@ -35,6 +36,7 @@
+ 		compatible = "renesas,ipmmu-r8a7795";
+ 		reg = <0 0xe7730000 0 0x1000>;
+ 		renesas,ipmmu-main = <&ipmmu_mm 8>;
++		power-domains = <&sysc R8A7795_PD_ALWAYS_ON>;
+ 		#iommu-cells = <1>;
+ 	};
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-dts-renesas-r8a77995-fix-register-range-of-dis.patch b/queue-4.19/arm64-dts-renesas-r8a77995-fix-register-range-of-dis.patch
new file mode 100644
index 00000000000..5ef66072567
--- /dev/null
+++ b/queue-4.19/arm64-dts-renesas-r8a77995-fix-register-range-of-dis.patch
@@ -0,0 +1,38 @@
+From 7c154271c6cd692a598f260cdd95d236d72b3acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 05:18:16 +0900
+Subject: arm64: dts: renesas: r8a77995: Fix register range of display node
+
+From: Yoshihiro Kaneko <ykaneko0929@gmail.com>
+
+[ Upstream commit 56d651e890f3befd616b6962a862f5ffa1a514fa ]
+
+Since the R8A77995 SoC uses DU{0,1}, the range from the base address to
+the 0x4000 address is used.
+This patch fixed it.
+
+Fixes: 18f1a773e3f9e6d1 ("arm64: dts: renesas: r8a77995: add DU support")
+Signed-off-by: Yoshihiro Kaneko <ykaneko0929@gmail.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77995.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995.dtsi b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+index fe77bc43c4474..fb3ecb2c385d1 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77995.dtsi
+@@ -938,7 +938,7 @@
+ 
+ 		du: display@feb00000 {
+ 			compatible = "renesas,du-r8a77995";
+-			reg = <0 0xfeb00000 0 0x80000>;
++			reg = <0 0xfeb00000 0 0x40000>;
+ 			interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 268 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 724>,
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-hibernate-check-pgd-table-allocation.patch b/queue-4.19/arm64-hibernate-check-pgd-table-allocation.patch
new file mode 100644
index 00000000000..84ef819422a
--- /dev/null
+++ b/queue-4.19/arm64-hibernate-check-pgd-table-allocation.patch
@@ -0,0 +1,54 @@
+From 5743ed145301c185ed1e82153d4ef87e2bc8601f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 10:48:24 -0400
+Subject: arm64: hibernate: check pgd table allocation
+
+From: Pavel Tatashin <pasha.tatashin@soleen.com>
+
+[ Upstream commit 8c551f919a73c1dfa690a70a691be1da394145e8 ]
+
+There is a bug in create_safe_exec_page(), when page table is allocated
+it is not checked that table is allocated successfully:
+
+But it is dereferenced in: pgd_none(READ_ONCE(*pgdp)).  Check that
+allocation was successful.
+
+Fixes: 82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk")
+Reviewed-by: James Morse <james.morse@arm.com>
+Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/hibernate.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
+index 9859e1178e6be..dbeeeffdb9c9e 100644
+--- a/arch/arm64/kernel/hibernate.c
++++ b/arch/arm64/kernel/hibernate.c
+@@ -202,6 +202,7 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ 				 gfp_t mask)
+ {
+ 	int rc = 0;
++	pgd_t *trans_pgd;
+ 	pgd_t *pgdp;
+ 	pud_t *pudp;
+ 	pmd_t *pmdp;
+@@ -216,7 +217,13 @@ static int create_safe_exec_page(void *src_start, size_t length,
+ 	memcpy((void *)dst, src_start, length);
+ 	__flush_icache_range(dst, dst + length);
+ 
+-	pgdp = pgd_offset_raw(allocator(mask), dst_addr);
++	trans_pgd = allocator(mask);
++	if (!trans_pgd) {
++		rc = -ENOMEM;
++		goto out;
++	}
++
++	pgdp = pgd_offset_raw(trans_pgd, dst_addr);
+ 	if (pgd_none(READ_ONCE(*pgdp))) {
+ 		pudp = allocator(mask);
+ 		if (!pudp) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/arm64-vdso-don-t-leak-kernel-addresses.patch b/queue-4.19/arm64-vdso-don-t-leak-kernel-addresses.patch
new file mode 100644
index 00000000000..33b822ad9c4
--- /dev/null
+++ b/queue-4.19/arm64-vdso-don-t-leak-kernel-addresses.patch
@@ -0,0 +1,41 @@
+From a8aacd086517b137539e365544c20bdae22fb44f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 12:44:47 +0200
+Subject: arm64/vdso: don't leak kernel addresses
+
+From: Matteo Croce <mcroce@redhat.com>
+
+[ Upstream commit 0f1bf7e39822476b2f921435cf990f67a61f5f92 ]
+
+Since commit ad67b74d2469d9b8 ("printk: hash addresses printed with %p"),
+two obfuscated kernel pointer are printed at every boot:
+
+    vdso: 2 pages (1 code @ (____ptrval____), 1 data @ (____ptrval____))
+
+Remove the the print completely, as it's useless without the addresses.
+
+Fixes: ad67b74d2469d9b8 ("printk: hash addresses printed with %p")
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/vdso.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
+index ec0bb588d7553..42b7082029e1d 100644
+--- a/arch/arm64/kernel/vdso.c
++++ b/arch/arm64/kernel/vdso.c
+@@ -146,8 +146,6 @@ static int __init vdso_init(void)
+ 	}
+ 
+ 	vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
+-	pr_info("vdso: %ld pages (%ld code @ %p, %ld data @ %p)\n",
+-		vdso_pages + 1, vdso_pages, vdso_start, 1L, vdso_data);
+ 
+ 	/* Allocate the vDSO pagelist, plus a page for the data. */
+ 	vdso_pagelist = kcalloc(vdso_pages + 1, sizeof(struct page *),
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch b/queue-4.19/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
new file mode 100644
index 00000000000..ee1c8a19083
--- /dev/null
+++ b/queue-4.19/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
@@ -0,0 +1,40 @@
+From 273138e23afe4887898520d920e72c41c37f7fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:01:57 +0800
+Subject: ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ]
+
+sound/soc/codecs/cs4349.c:358:32: warning:
+ cs4349_runtime_pm defined but not used [-Wunused-const-variable=]
+
+cs4349_runtime_pm ops already defined, it seems
+we should enable it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4349.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
+index bee0e343723fe..f08d7a296c0cc 100644
+--- a/sound/soc/codecs/cs4349.c
++++ b/sound/soc/codecs/cs4349.c
+@@ -381,6 +381,7 @@ static struct i2c_driver cs4349_i2c_driver = {
+ 	.driver = {
+ 		.name		= "cs4349",
+ 		.of_match_table	= cs4349_of_match,
++		.pm = &cs4349_runtime_pm,
+ 	},
+ 	.id_table	= cs4349_i2c_id,
+ 	.probe		= cs4349_i2c_probe,
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch b/queue-4.19/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
new file mode 100644
index 00000000000..e17db7afcc8
--- /dev/null
+++ b/queue-4.19/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
@@ -0,0 +1,37 @@
+From e2e00090e1316c3ad69d302402e036b779f4aea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:23:00 +0800
+Subject: ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ]
+
+It seems 'es8328_rline_enum' should be used
+in es8328_right_line_controls
+
+Fixes: 567e4f98922c ("ASoC: add es8328 codec driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index e9fc2fd97d2f4..3afa163f7652d 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -231,7 +231,7 @@ static const struct soc_enum es8328_rline_enum =
+ 			      ARRAY_SIZE(es8328_line_texts),
+ 			      es8328_line_texts);
+ static const struct snd_kcontrol_new es8328_right_line_controls =
+-	SOC_DAPM_ENUM("Route", es8328_lline_enum);
++	SOC_DAPM_ENUM("Route", es8328_rline_enum);
+ 
+ /* Left Mixer */
+ static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-fix-valid-stream-condition.patch b/queue-4.19/asoc-fix-valid-stream-condition.patch
new file mode 100644
index 00000000000..58a244f0068
--- /dev/null
+++ b/queue-4.19/asoc-fix-valid-stream-condition.patch
@@ -0,0 +1,40 @@
+From 85f3450b46dcac4088c6181289b827c673d3a367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: ASoC: fix valid stream condition
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 551bfc581fc12..53fefa7c982f8 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -42,8 +42,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ 	else
+ 		codec_stream = &dai->driver->capture;
+ 
+-	/* If the codec specifies any rate at all, it supports the stream. */
+-	return codec_stream->rates;
++	/* If the codec specifies any channels at all, it supports the stream */
++	return codec_stream->channels_min;
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch b/queue-4.19/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
new file mode 100644
index 00000000000..8d2fca6d20d
--- /dev/null
+++ b/queue-4.19/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
@@ -0,0 +1,40 @@
+From 83041a254e6a00b50f4a72ca0293e5c056cd3deb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jan 2019 10:06:52 +0100
+Subject: ASoC: imx-sgtl5000: put of nodes if finding codec fails
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]
+
+Make sure to properly put the of node in case finding the codec
+fails.
+
+Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-sgtl5000.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
+index 9b9a7ec529055..4bd8da3a5f5b8 100644
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -112,7 +112,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
+ 	codec_dev = of_find_i2c_device_by_node(codec_np);
+ 	if (!codec_dev) {
+ 		dev_err(&pdev->dev, "failed to find codec platform device\n");
+-		return -EPROBE_DEFER;
++		ret = -EPROBE_DEFER;
++		goto fail;
+ 	}
+ 
+ 	data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-meson-axg-tdmin-right_j-is-not-supported.patch b/queue-4.19/asoc-meson-axg-tdmin-right_j-is-not-supported.patch
new file mode 100644
index 00000000000..9c785760a0d
--- /dev/null
+++ b/queue-4.19/asoc-meson-axg-tdmin-right_j-is-not-supported.patch
@@ -0,0 +1,35 @@
+From 92ee0550b0a56de1016e6d3a7ecbc48e2ba67b33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 13:42:30 +0200
+Subject: ASoC: meson: axg-tdmin: right_j is not supported
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 47c317b786b6c1efc2cb3cdb894fd323422fe5ea ]
+
+Right justified format is actually not supported by the amlogic tdm input
+decoder.
+
+Fixes: 13a22e6a98f8 ("ASoC: meson: add tdm input driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdmin.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c
+index bbac44c816886..37207bbebb2a4 100644
+--- a/sound/soc/meson/axg-tdmin.c
++++ b/sound/soc/meson/axg-tdmin.c
+@@ -119,7 +119,6 @@ static int axg_tdmin_prepare(struct regmap *map, struct axg_tdm_stream *ts)
+ 		break;
+ 
+ 	case SND_SOC_DAIFMT_LEFT_J:
+-	case SND_SOC_DAIFMT_RIGHT_J:
+ 	case SND_SOC_DAIFMT_DSP_B:
+ 		val = TDMIN_CTRL_IN_BIT_SKEW(2);
+ 		break;
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-meson-axg-tdmout-right_j-is-not-supported.patch b/queue-4.19/asoc-meson-axg-tdmout-right_j-is-not-supported.patch
new file mode 100644
index 00000000000..8e44e29eb0a
--- /dev/null
+++ b/queue-4.19/asoc-meson-axg-tdmout-right_j-is-not-supported.patch
@@ -0,0 +1,35 @@
+From a5f83f8bda0c50f3da3e89170ecf10d8d44e88ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 13:42:31 +0200
+Subject: ASoC: meson: axg-tdmout: right_j is not supported
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 7e0d7d0fbd06af0507611f85dba8daf24832abd9 ]
+
+Right justified format is actually not supported by the amlogic tdm output
+encoder.
+
+Fixes: c41c2a355b86 ("ASoC: meson: add tdm output driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdmout.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/meson/axg-tdmout.c b/sound/soc/meson/axg-tdmout.c
+index f73368ee1088f..d11acb3cc696f 100644
+--- a/sound/soc/meson/axg-tdmout.c
++++ b/sound/soc/meson/axg-tdmout.c
+@@ -136,7 +136,6 @@ static int axg_tdmout_prepare(struct regmap *map, struct axg_tdm_stream *ts)
+ 		break;
+ 
+ 	case SND_SOC_DAIFMT_LEFT_J:
+-	case SND_SOC_DAIFMT_RIGHT_J:
+ 	case SND_SOC_DAIFMT_DSP_B:
+ 		val |= TDMOUT_CTRL0_INIT_BITNUM(2);
+ 		break;
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch b/queue-4.19/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
new file mode 100644
index 00000000000..8b245843d3a
--- /dev/null
+++ b/queue-4.19/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
@@ -0,0 +1,89 @@
+From b43deb5e3386ac6df6b85ad3d9d75c1315af5aab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 16:46:50 +0100
+Subject: ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]
+
+The apq8016 driver leaves the of-node refcount at aborting from the
+loop of for_each_child_of_node() in the error path.  Not only the
+iterator node of for_each_child_of_node(), the children nodes referred
+from it for codec and cpu have to be properly unreferenced.
+
+Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
+Cc: Patrick Lai <plai@codeaurora.org>
+Cc: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
+index 1dd23bba1bedb..4b559932adc33 100644
+--- a/sound/soc/qcom/apq8016_sbc.c
++++ b/sound/soc/qcom/apq8016_sbc.c
+@@ -164,41 +164,52 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+ 
+ 		if (!cpu || !codec) {
+ 			dev_err(dev, "Can't find cpu/codec DT node\n");
+-			return ERR_PTR(-EINVAL);
++			ret = -EINVAL;
++			goto error;
+ 		}
+ 
+ 		link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+ 		if (!link->cpu_of_node) {
+ 			dev_err(card->dev, "error getting cpu phandle\n");
+-			return ERR_PTR(-EINVAL);
++			ret = -EINVAL;
++			goto error;
+ 		}
+ 
+ 		ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
+ 		if (ret) {
+ 			dev_err(card->dev, "error getting cpu dai name\n");
+-			return ERR_PTR(ret);
++			goto error;
+ 		}
+ 
+ 		ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
+ 
+ 		if (ret < 0) {
+ 			dev_err(card->dev, "error getting codec dai name\n");
+-			return ERR_PTR(ret);
++			goto error;
+ 		}
+ 
+ 		link->platform_of_node = link->cpu_of_node;
+ 		ret = of_property_read_string(np, "link-name", &link->name);
+ 		if (ret) {
+ 			dev_err(card->dev, "error getting codec dai_link name\n");
+-			return ERR_PTR(ret);
++			goto error;
+ 		}
+ 
+ 		link->stream_name = link->name;
+ 		link->init = apq8016_sbc_dai_init;
+ 		link++;
++
++		of_node_put(cpu);
++		of_node_put(codec);
+ 	}
+ 
+ 	return data;
++
++ error:
++	of_node_put(np);
++	of_node_put(cpu);
++	of_node_put(codec);
++	return ERR_PTR(ret);
+ }
+ 
+ static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch b/queue-4.19/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
new file mode 100644
index 00000000000..b615a221a32
--- /dev/null
+++ b/queue-4.19/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
@@ -0,0 +1,38 @@
+From 416245b686b3188eeb9d45214e2f9b87c042736b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 21:25:17 +0200
+Subject: ASoC: sun4i-i2s: RX and TX counter registers are swapped
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit cf2c0e1ce9544df42170fb921f12da82dc0cc8d6 ]
+
+The RX and TX counters registers offset have been swapped, fix that.
+
+Fixes: fa7c0d13cb26 ("ASoC: sunxi: Add Allwinner A10 Digital Audio driver")
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://lore.kernel.org/r/8b26477560ad5fd8f69e037b167c5e61de5c26a3.1566242458.git-series.maxime.ripard@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index 18cf8404d27ca..f248e563986c3 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -80,8 +80,8 @@
+ #define SUN4I_I2S_CLK_DIV_MCLK_MASK		GENMASK(3, 0)
+ #define SUN4I_I2S_CLK_DIV_MCLK(mclk)			((mclk) << 0)
+ 
+-#define SUN4I_I2S_RX_CNT_REG		0x28
+-#define SUN4I_I2S_TX_CNT_REG		0x2c
++#define SUN4I_I2S_TX_CNT_REG		0x28
++#define SUN4I_I2S_RX_CNT_REG		0x2c
+ 
+ #define SUN4I_I2S_TX_CHAN_SEL_REG	0x30
+ #define SUN4I_I2S_CHAN_SEL(num_chan)		(((num_chan) - 1) << 0)
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-sun8i-codec-add-missing-route-for-adc.patch b/queue-4.19/asoc-sun8i-codec-add-missing-route-for-adc.patch
new file mode 100644
index 00000000000..ffce30eb5df
--- /dev/null
+++ b/queue-4.19/asoc-sun8i-codec-add-missing-route-for-adc.patch
@@ -0,0 +1,40 @@
+From da1b9fb37ce6bf2960ae11b875119630caf99b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 20:24:19 -0800
+Subject: ASoC: sun8i-codec: add missing route for ADC
+
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+
+[ Upstream commit 9ee325d029c4abb75716851ce38863845911d605 ]
+
+sun8i-codec misses a route from ADC to AIF1 Slot 0 ADC. Add it
+to the driver to avoid adding it to every dts.
+
+Fixes: eda85d1fee05d ("ASoC: sun8i-codec: Add ADC support for a33")
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun8i-codec.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sunxi/sun8i-codec.c b/sound/soc/sunxi/sun8i-codec.c
+index bf615fa16dc8a..a3db6a68dfe6d 100644
+--- a/sound/soc/sunxi/sun8i-codec.c
++++ b/sound/soc/sunxi/sun8i-codec.c
+@@ -465,7 +465,11 @@ static const struct snd_soc_dapm_route sun8i_codec_dapm_routes[] = {
+ 	{ "Right Digital DAC Mixer", "AIF1 Slot 0 Digital DAC Playback Switch",
+ 	  "AIF1 Slot 0 Right"},
+ 
+-	/* ADC routes */
++	/* ADC Routes */
++	{ "AIF1 Slot 0 Right ADC", NULL, "ADC" },
++	{ "AIF1 Slot 0 Left ADC", NULL, "ADC" },
++
++	/* ADC Mixer Routes */
+ 	{ "Left Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
+ 	  "AIF1 Slot 0 Left ADC" },
+ 	{ "Right Digital ADC Mixer", "AIF1 Data Digital ADC Capture Switch",
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch b/queue-4.19/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
new file mode 100644
index 00000000000..6cf04cd7b57
--- /dev/null
+++ b/queue-4.19/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
@@ -0,0 +1,51 @@
+From 86919ca3907c1d29673dcad7bed801308812338c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jun 2019 12:20:02 +0300
+Subject: ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple
+ AXRs
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ]
+
+If multiple serializers are connected in the system and the number of
+channels will need to use more than one serializer the mask to enable the
+serializers were left to 0 if tdm_mask is provided
+
+Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support")
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/davinci/davinci-mcasp.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 6a8c279a4b20b..14ab16e1369f8 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -874,14 +874,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
+ 		active_slots = hweight32(mcasp->tdm_mask[stream]);
+ 		active_serializers = (channels + active_slots - 1) /
+ 			active_slots;
+-		if (active_serializers == 1) {
++		if (active_serializers == 1)
+ 			active_slots = channels;
+-			for (i = 0; i < total_slots; i++) {
+-				if ((1 << i) & mcasp->tdm_mask[stream]) {
+-					mask |= (1 << i);
+-					if (--active_slots <= 0)
+-						break;
+-				}
++		for (i = 0; i < total_slots; i++) {
++			if ((1 << i) & mcasp->tdm_mask[stream]) {
++				mask |= (1 << i);
++				if (--active_slots <= 0)
++					break;
+ 			}
+ 		}
+ 	} else {
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch b/queue-4.19/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
new file mode 100644
index 00000000000..e05802e4f0d
--- /dev/null
+++ b/queue-4.19/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
@@ -0,0 +1,41 @@
+From 4c73ff766a40259b3bafb60bd3aad12e6ca28087 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:19:20 +0800
+Subject: ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ]
+
+sound/soc/codecs/wm8737.c:112:29: warning:
+ high_3d defined but not used [-Wunused-const-variable=]
+
+'high_3d' should be used for 3D High Cut-off.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8737.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index e9ae821e76098..568b77692f5f0 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
+ SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
+ SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
+ SOC_ENUM("3D Low Cut-off", low_3d),
+-SOC_ENUM("3D High Cut-off", low_3d),
++SOC_ENUM("3D High Cut-off", high_3d),
+ SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
+ 
+ SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-wm9712-fix-unused-variable-warning.patch b/queue-4.19/asoc-wm9712-fix-unused-variable-warning.patch
new file mode 100644
index 00000000000..6dd1b42fdb7
--- /dev/null
+++ b/queue-4.19/asoc-wm9712-fix-unused-variable-warning.patch
@@ -0,0 +1,47 @@
+From 9e2eb5902d7b1c418259a3800eb149b7bab74119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 21:37:40 +0200
+Subject: ASoC: wm9712: fix unused variable warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 18380dcc52cc8965e5144ce33fdfad7e168679a5 ]
+
+The 'ret' variable is now only used in an #ifdef, and causes a
+warning if it is declared outside of that block:
+
+sound/soc/codecs/wm9712.c: In function 'wm9712_soc_probe':
+sound/soc/codecs/wm9712.c:641:6: error: unused variable 'ret' [-Werror=unused-variable]
+
+Fixes: 2ed1a8e0ce8d ("ASoC: wm9712: add ac97 new bus support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm9712.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
+index ade34c26ad2f3..e873baa9e7780 100644
+--- a/sound/soc/codecs/wm9712.c
++++ b/sound/soc/codecs/wm9712.c
+@@ -638,13 +638,14 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+ {
+ 	struct wm9712_priv *wm9712 = snd_soc_component_get_drvdata(component);
+ 	struct regmap *regmap;
+-	int ret;
+ 
+ 	if (wm9712->mfd_pdata) {
+ 		wm9712->ac97 = wm9712->mfd_pdata->ac97;
+ 		regmap = wm9712->mfd_pdata->regmap;
+ 	} else {
+ #ifdef CONFIG_SND_SOC_AC97_BUS
++		int ret;
++
+ 		wm9712->ac97 = snd_soc_new_ac97_component(component, WM9712_VENDOR_ID,
+ 						      WM9712_VENDOR_ID_MASK);
+ 		if (IS_ERR(wm9712->ac97)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/asoc-wm97xx-fix-uninitialized-regmap-pointer-problem.patch b/queue-4.19/asoc-wm97xx-fix-uninitialized-regmap-pointer-problem.patch
new file mode 100644
index 00000000000..5e703a4396a
--- /dev/null
+++ b/queue-4.19/asoc-wm97xx-fix-uninitialized-regmap-pointer-problem.patch
@@ -0,0 +1,177 @@
+From 7144b98805a6b60a84d3175884fda0e45bb2aa4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 16:18:21 +0100
+Subject: ASoC: wm97xx: fix uninitialized regmap pointer problem
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 576ce4075bfa0f03e0e91a89eecc539b3b828b08 ]
+
+gcc notices that without either the ac97 bus or the pdata, we never
+initialize the regmap pointer, which leads to an uninitialized variable
+access:
+
+sound/soc/codecs/wm9712.c: In function 'wm9712_soc_probe':
+sound/soc/codecs/wm9712.c:666:2: error: 'regmap' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+Since that configuration is invalid, it's better to return an error
+here. I tried to avoid adding complexity to the conditions, and turned
+the #ifdef into a regular if(IS_ENABLED()) check for readability.
+This in turn requires moving some header file declarations out of
+an #ifdef.
+
+The same code is used in three drivers, all of which I'm changing
+the same way.
+
+Fixes: 2ed1a8e0ce8d ("ASoC: wm9712: add ac97 new bus support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc.h       |  2 +-
+ sound/soc/codecs/wm9705.c | 10 ++++------
+ sound/soc/codecs/wm9712.c | 10 ++++------
+ sound/soc/codecs/wm9713.c | 10 ++++------
+ 4 files changed, 13 insertions(+), 19 deletions(-)
+
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index 41cec42fb456a..88aa48e5485f9 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -548,12 +548,12 @@ static inline void snd_soc_jack_free_gpios(struct snd_soc_jack *jack, int count,
+ }
+ #endif
+ 
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ struct snd_ac97 *snd_soc_alloc_ac97_component(struct snd_soc_component *component);
+ struct snd_ac97 *snd_soc_new_ac97_component(struct snd_soc_component *component,
+ 	unsigned int id, unsigned int id_mask);
+ void snd_soc_free_ac97_component(struct snd_ac97 *ac97);
+ 
++#ifdef CONFIG_SND_SOC_AC97_BUS
+ int snd_soc_set_ac97_ops(struct snd_ac97_bus_ops *ops);
+ int snd_soc_set_ac97_ops_of_reset(struct snd_ac97_bus_ops *ops,
+ 		struct platform_device *pdev);
+diff --git a/sound/soc/codecs/wm9705.c b/sound/soc/codecs/wm9705.c
+index ccdf088461b7f..54c306707c02c 100644
+--- a/sound/soc/codecs/wm9705.c
++++ b/sound/soc/codecs/wm9705.c
+@@ -325,8 +325,7 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
+ 	if (wm9705->mfd_pdata) {
+ 		wm9705->ac97 = wm9705->mfd_pdata->ac97;
+ 		regmap = wm9705->mfd_pdata->regmap;
+-	} else {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
++	} else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
+ 		wm9705->ac97 = snd_soc_new_ac97_component(component, WM9705_VENDOR_ID,
+ 						      WM9705_VENDOR_ID_MASK);
+ 		if (IS_ERR(wm9705->ac97)) {
+@@ -339,7 +338,8 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
+ 			snd_soc_free_ac97_component(wm9705->ac97);
+ 			return PTR_ERR(regmap);
+ 		}
+-#endif
++	} else {
++		return -ENXIO;
+ 	}
+ 
+ 	snd_soc_component_set_drvdata(component, wm9705->ac97);
+@@ -350,14 +350,12 @@ static int wm9705_soc_probe(struct snd_soc_component *component)
+ 
+ static void wm9705_soc_remove(struct snd_soc_component *component)
+ {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ 	struct wm9705_priv *wm9705 = snd_soc_component_get_drvdata(component);
+ 
+-	if (!wm9705->mfd_pdata) {
++	if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9705->mfd_pdata) {
+ 		snd_soc_component_exit_regmap(component);
+ 		snd_soc_free_ac97_component(wm9705->ac97);
+ 	}
+-#endif
+ }
+ 
+ static const struct snd_soc_component_driver soc_component_dev_wm9705 = {
+diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
+index e873baa9e7780..01949eaba4fd4 100644
+--- a/sound/soc/codecs/wm9712.c
++++ b/sound/soc/codecs/wm9712.c
+@@ -642,8 +642,7 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+ 	if (wm9712->mfd_pdata) {
+ 		wm9712->ac97 = wm9712->mfd_pdata->ac97;
+ 		regmap = wm9712->mfd_pdata->regmap;
+-	} else {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
++	} else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
+ 		int ret;
+ 
+ 		wm9712->ac97 = snd_soc_new_ac97_component(component, WM9712_VENDOR_ID,
+@@ -660,7 +659,8 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+ 			snd_soc_free_ac97_component(wm9712->ac97);
+ 			return PTR_ERR(regmap);
+ 		}
+-#endif
++	} else {
++		return -ENXIO;
+ 	}
+ 
+ 	snd_soc_component_init_regmap(component, regmap);
+@@ -673,14 +673,12 @@ static int wm9712_soc_probe(struct snd_soc_component *component)
+ 
+ static void wm9712_soc_remove(struct snd_soc_component *component)
+ {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ 	struct wm9712_priv *wm9712 = snd_soc_component_get_drvdata(component);
+ 
+-	if (!wm9712->mfd_pdata) {
++	if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9712->mfd_pdata) {
+ 		snd_soc_component_exit_regmap(component);
+ 		snd_soc_free_ac97_component(wm9712->ac97);
+ 	}
+-#endif
+ }
+ 
+ static const struct snd_soc_component_driver soc_component_dev_wm9712 = {
+diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
+index 643863bb32e0d..5a2fdf4f69bf3 100644
+--- a/sound/soc/codecs/wm9713.c
++++ b/sound/soc/codecs/wm9713.c
+@@ -1214,8 +1214,7 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
+ 	if (wm9713->mfd_pdata) {
+ 		wm9713->ac97 = wm9713->mfd_pdata->ac97;
+ 		regmap = wm9713->mfd_pdata->regmap;
+-	} else {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
++	} else if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS)) {
+ 		wm9713->ac97 = snd_soc_new_ac97_component(component, WM9713_VENDOR_ID,
+ 						      WM9713_VENDOR_ID_MASK);
+ 		if (IS_ERR(wm9713->ac97))
+@@ -1225,7 +1224,8 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
+ 			snd_soc_free_ac97_component(wm9713->ac97);
+ 			return PTR_ERR(regmap);
+ 		}
+-#endif
++	} else {
++		return -ENXIO;
+ 	}
+ 
+ 	snd_soc_component_init_regmap(component, regmap);
+@@ -1238,14 +1238,12 @@ static int wm9713_soc_probe(struct snd_soc_component *component)
+ 
+ static void wm9713_soc_remove(struct snd_soc_component *component)
+ {
+-#ifdef CONFIG_SND_SOC_AC97_BUS
+ 	struct wm9713_priv *wm9713 = snd_soc_component_get_drvdata(component);
+ 
+-	if (!wm9713->mfd_pdata) {
++	if (IS_ENABLED(CONFIG_SND_SOC_AC97_BUS) && !wm9713->mfd_pdata) {
+ 		snd_soc_component_exit_regmap(component);
+ 		snd_soc_free_ac97_component(wm9713->ac97);
+ 	}
+-#endif
+ }
+ 
+ static const struct snd_soc_component_driver soc_component_dev_wm9713 = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch b/queue-4.19/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch
new file mode 100644
index 00000000000..045dcb9b0d2
--- /dev/null
+++ b/queue-4.19/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch
@@ -0,0 +1,101 @@
+From 320ed5d75315619444715d4b20c3a1a00c11ac0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 16:46:17 +0300
+Subject: ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit b7139960832eb56fa15d390a4b5c8c5739bd0d1a ]
+
+When the FW bundles multiple packets, pkt->act_len may be incorrect
+as it refers to the first packet only (however, the FW will only
+bundle packets that fit into the same pkt->alloc_len).
+
+Before this patch, the skb length would be set (incorrectly) to
+pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually
+adjusted in ath10k_sdio_mbox_rx_process_packet.
+
+The first problem is that ath10k_sdio_mbox_rx_process_packet does not
+use proper skb_put commands to adjust the length (it directly changes
+skb->len), so we end up with a mismatch between skb->head + skb->tail
+and skb->data + skb->len. This is quite serious, and causes corruptions
+in the TCP stack, as the stack tries to coalesce packets, and relies
+on skb->tail being correct (that is, skb_tail_pointer must point to
+the first byte_after_ the data).
+
+Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet,
+this moves the code to ath10k_sdio_mbox_rx_packet, and also add a
+bounds check, as skb_put would crash the kernel if not enough space is
+available.
+
+Tested with QCA6174 SDIO with firmware
+WLAN.RMH.4.4.1-00007-QCARMSWP-1.
+
+Fixes: 8530b4e7b22bc3b ("ath10k: sdio: set skb len for all rx packets")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/sdio.c | 29 +++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 686759b5613f2..0ecaba824fb28 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -392,16 +392,11 @@ static int ath10k_sdio_mbox_rx_process_packet(struct ath10k *ar,
+ 	struct ath10k_htc_hdr *htc_hdr = (struct ath10k_htc_hdr *)skb->data;
+ 	bool trailer_present = htc_hdr->flags & ATH10K_HTC_FLAG_TRAILER_PRESENT;
+ 	enum ath10k_htc_ep_id eid;
+-	u16 payload_len;
+ 	u8 *trailer;
+ 	int ret;
+ 
+-	payload_len = le16_to_cpu(htc_hdr->len);
+-	skb->len = payload_len + sizeof(struct ath10k_htc_hdr);
+-
+ 	if (trailer_present) {
+-		trailer = skb->data + sizeof(*htc_hdr) +
+-			  payload_len - htc_hdr->trailer_len;
++		trailer = skb->data + skb->len - htc_hdr->trailer_len;
+ 
+ 		eid = pipe_id_to_eid(htc_hdr->eid);
+ 
+@@ -638,13 +633,31 @@ static int ath10k_sdio_mbox_rx_packet(struct ath10k *ar,
+ {
+ 	struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
+ 	struct sk_buff *skb = pkt->skb;
++	struct ath10k_htc_hdr *htc_hdr;
+ 	int ret;
+ 
+ 	ret = ath10k_sdio_readsb(ar, ar_sdio->mbox_info.htc_addr,
+ 				 skb->data, pkt->alloc_len);
++	if (ret)
++		goto out;
++
++	/* Update actual length. The original length may be incorrect,
++	 * as the FW will bundle multiple packets as long as their sizes
++	 * fit within the same aligned length (pkt->alloc_len).
++	 */
++	htc_hdr = (struct ath10k_htc_hdr *)skb->data;
++	pkt->act_len = le16_to_cpu(htc_hdr->len) + sizeof(*htc_hdr);
++	if (pkt->act_len > pkt->alloc_len) {
++		ath10k_warn(ar, "rx packet too large (%zu > %zu)\n",
++			    pkt->act_len, pkt->alloc_len);
++		ret = -EMSGSIZE;
++		goto out;
++	}
++
++	skb_put(skb, pkt->act_len);
++
++out:
+ 	pkt->status = ret;
+-	if (!ret)
+-		skb_put(skb, pkt->act_len);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath10k-fix-dma-unmap-direction-for-management-frames.patch b/queue-4.19/ath10k-fix-dma-unmap-direction-for-management-frames.patch
new file mode 100644
index 00000000000..c793feb7fc5
--- /dev/null
+++ b/queue-4.19/ath10k-fix-dma-unmap-direction-for-management-frames.patch
@@ -0,0 +1,75 @@
+From 7e4bc7e73651de024256ba6529fa8e5df269ebf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 09:51:06 +0530
+Subject: ath10k: fix dma unmap direction for management frames
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 6e8a8991e2103dcb6a9cff28f460390e8e360848 ]
+
+The management frames transmitted are dma mapped with
+direction TO_DEVICE, but incorrectly mapped with
+direction FROM_DEVICE during tx complete and error cases.
+
+Fix the direction of dma during dma unmap of the
+transmitted management frames.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1
+
+Fixes: 38a1390e02b7 ("ath10k: dma unmap mgmt tx buffer if wmi cmd send fails")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 4 ++--
+ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 448e3a8c33a6d..a09d7a07e90a8 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1,7 +1,7 @@
+ /*
+  * Copyright (c) 2005-2011 Atheros Communications Inc.
+  * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
+- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+  *
+  * Permission to use, copy, modify, and/or distribute this software for any
+  * purpose with or without fee is hereby granted, provided that the above
+@@ -3853,7 +3853,7 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
+ 				ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
+ 					    ret);
+ 				dma_unmap_single(ar->dev, paddr, skb->len,
+-						 DMA_FROM_DEVICE);
++						 DMA_TO_DEVICE);
+ 				ieee80211_free_txskb(ar->hw, skb);
+ 			}
+ 		} else {
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index aefc92d2c09b9..0f6ff7a78e49d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1,7 +1,7 @@
+ /*
+  * Copyright (c) 2005-2011 Atheros Communications Inc.
+  * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
+- * Copyright (c) 2018, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2018-2019, The Linux Foundation. All rights reserved.
+  *
+  * Permission to use, copy, modify, and/or distribute this software for any
+  * purpose with or without fee is hereby granted, provided that the above
+@@ -2340,7 +2340,7 @@ static int wmi_process_mgmt_tx_comp(struct ath10k *ar, u32 desc_id,
+ 
+ 	msdu = pkt_addr->vaddr;
+ 	dma_unmap_single(ar->dev, pkt_addr->paddr,
+-			 msdu->len, DMA_FROM_DEVICE);
++			 msdu->len, DMA_TO_DEVICE);
+ 	info = IEEE80211_SKB_CB(msdu);
+ 
+ 	if (status)
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath10k-fix-encoding-for-protected-management-frames.patch b/queue-4.19/ath10k-fix-encoding-for-protected-management-frames.patch
new file mode 100644
index 00000000000..2d24c13dcd6
--- /dev/null
+++ b/queue-4.19/ath10k-fix-encoding-for-protected-management-frames.patch
@@ -0,0 +1,48 @@
+From 8bd220f52a4b7c2fd3049989c412fc111b4cd084 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2019 18:12:50 +0530
+Subject: ath10k: Fix encoding for protected management frames
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 42f1bc43e6a97b9ddbe976eba9bd05306c990c75 ]
+
+Currently the protected management frames are
+not appended with the MIC_LEN which results in
+the protected management frames being encoded
+incorrectly.
+
+Add the extra space at the end of the protected
+management frames to fix this encoding error for
+the protected management frames.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
+
+Fixes: 1807da49733e ("ath10k: wmi: add management tx by reference support over wmi")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index a90990b8008de..248decb494c28 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -2692,8 +2692,10 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
+ 	if ((ieee80211_is_action(hdr->frame_control) ||
+ 	     ieee80211_is_deauth(hdr->frame_control) ||
+ 	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control))
++	     ieee80211_has_protected(hdr->frame_control)) {
++		skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+ 		buf_len += IEEE80211_CCMP_MIC_LEN;
++	}
+ 
+ 	buf_len = min_t(u32, buf_len, WMI_TLV_MGMT_TX_FRAME_MAX_LEN);
+ 	buf_len = round_up(buf_len, 4);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath10k-fix-length-of-wmi-tlv-command-for-protected-m.patch b/queue-4.19/ath10k-fix-length-of-wmi-tlv-command-for-protected-m.patch
new file mode 100644
index 00000000000..7cb12215740
--- /dev/null
+++ b/queue-4.19/ath10k-fix-length-of-wmi-tlv-command-for-protected-m.patch
@@ -0,0 +1,49 @@
+From 0841cf6cceb566d65c5f45a80e01aa47297eb23d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 20:49:37 +0530
+Subject: ath10k: Fix length of wmi tlv command for protected mgmt frames
+
+From: Surabhi Vishnoi <svishnoi@codeaurora.org>
+
+[ Upstream commit 761156ff573d1002983416e4fd1fe8d3489c4bd8 ]
+
+The length of wmi tlv command for management tx send is calculated
+incorrectly in case of protected management frames as there is addition
+of IEEE80211_CCMP_MIC_LEN twice. This leads to improper behaviour of
+firmware as the wmi tlv mgmt tx send command for protected mgmt frames
+is formed wrongly.
+
+Fix the length calculation of wmi tlv command for mgmt tx send in case
+of protected management frames by adding the IEEE80211_CCMP_MIC_LEN only
+once.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
+
+Fixes: 1807da49733e "ath10k: wmi: add management tx by reference support over wmi"
+Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index cdc1e64d52ad5..a90990b8008de 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -2692,10 +2692,8 @@ ath10k_wmi_tlv_op_gen_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu,
+ 	if ((ieee80211_is_action(hdr->frame_control) ||
+ 	     ieee80211_is_deauth(hdr->frame_control) ||
+ 	     ieee80211_is_disassoc(hdr->frame_control)) &&
+-	     ieee80211_has_protected(hdr->frame_control)) {
+-		len += IEEE80211_CCMP_MIC_LEN;
++	     ieee80211_has_protected(hdr->frame_control))
+ 		buf_len += IEEE80211_CCMP_MIC_LEN;
+-	}
+ 
+ 	buf_len = min_t(u32, buf_len, WMI_TLV_MGMT_TX_FRAME_MAX_LEN);
+ 	buf_len = round_up(buf_len, 4);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch b/queue-4.19/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
new file mode 100644
index 00000000000..ac2b87c0ca0
--- /dev/null
+++ b/queue-4.19/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
@@ -0,0 +1,136 @@
+From a2cd72467062a2f010b62c8a5718df80aedb2499 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 09:41:39 +0200
+Subject: ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ]
+
+Fix following lockdep warning disabling bh in
+ath_dynack_node_init/ath_dynack_node_deinit
+
+[   75.955878] --------------------------------
+[   75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
+[   75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
+[   75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.955905] {SOFTIRQ-ON-W} state was registered at:
+[   75.955912]   lock_acquire+0x9a/0x160
+[   75.955917]   _raw_spin_lock+0x2c/0x70
+[   75.955927]   ath_dynack_node_init+0x2a/0x60 [ath9k_hw]
+[   75.955934]   ath9k_sta_state+0xec/0x160 [ath9k]
+[   75.955976]   drv_sta_state+0xb2/0x740 [mac80211]
+[   75.956008]   sta_info_insert_finish+0x21a/0x420 [mac80211]
+[   75.956039]   sta_info_insert_rcu+0x12b/0x2c0 [mac80211]
+[   75.956069]   sta_info_insert+0x7/0x70 [mac80211]
+[   75.956093]   ieee80211_prep_connection+0x42e/0x730 [mac80211]
+[   75.956120]   ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211]
+[   75.956152]   cfg80211_mlme_auth+0x143/0x350 [cfg80211]
+[   75.956169]   nl80211_authenticate+0x25e/0x2b0 [cfg80211]
+[   75.956172]   genl_family_rcv_msg+0x198/0x400
+[   75.956174]   genl_rcv_msg+0x42/0x90
+[   75.956176]   netlink_rcv_skb+0x35/0xf0
+[   75.956178]   genl_rcv+0x1f/0x30
+[   75.956180]   netlink_unicast+0x154/0x200
+[   75.956182]   netlink_sendmsg+0x1bf/0x3d0
+[   75.956186]   ___sys_sendmsg+0x2c2/0x2f0
+[   75.956187]   __sys_sendmsg+0x44/0x80
+[   75.956190]   do_syscall_64+0x55/0x1a0
+[   75.956192]   entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[   75.956194] irq event stamp: 2357092
+[   75.956196] hardirqs last  enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50
+[   75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80
+[   75.956202] softirqs last  enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60
+[   75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0
+[   75.956206]
+               other info that might help us debug this:
+[   75.956207]  Possible unsafe locking scenario:
+
+[   75.956208]        CPU0
+[   75.956209]        ----
+[   75.956210]   lock(&(&da->qlock)->rlock);
+[   75.956213]   <Interrupt>
+[   75.956214]     lock(&(&da->qlock)->rlock);
+[   75.956216]
+                *** DEADLOCK ***
+
+[   75.956217] 1 lock held by swapper/0/0:
+[   75.956219]  #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k]
+[   75.956225]
+               stack backtrace:
+[   75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13
+[   75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
+[   75.956231] Call Trace:
+[   75.956233]  <IRQ>
+[   75.956236]  dump_stack+0x67/0x90
+[   75.956239]  mark_lock+0x4c1/0x640
+[   75.956242]  ? check_usage_backwards+0x130/0x130
+[   75.956245]  ? sched_clock_local+0x12/0x80
+[   75.956247]  __lock_acquire+0x484/0x7a0
+[   75.956250]  ? __lock_acquire+0x3b9/0x7a0
+[   75.956252]  lock_acquire+0x9a/0x160
+[   75.956259]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.956262]  _raw_spin_lock_bh+0x34/0x80
+[   75.956268]  ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.956275]  ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[   75.956280]  ath_rx_tasklet+0xd09/0xe90 [ath9k]
+[   75.956286]  ath9k_tasklet+0x102/0x240 [ath9k]
+[   75.956288]  tasklet_action_common.isra.0+0x6d/0x170
+[   75.956291]  __do_softirq+0xcc/0x425
+[   75.956294]  irq_exit+0xae/0xc0
+[   75.956296]  do_IRQ+0x8a/0x110
+[   75.956298]  common_interrupt+0xf/0xf
+[   75.956300]  </IRQ>
+[   75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400
+[   75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7
+[   75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000
+[   75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800
+[   75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000
+[   75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
+[   75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800
+[   75.956321]  cpuidle_enter+0x24/0x40
+[   75.956323]  do_idle+0x1ac/0x220
+[   75.956326]  cpu_startup_entry+0x14/0x20
+[   75.956329]  start_kernel+0x482/0x489
+[   75.956332]  secondary_startup_64+0xa4/0xb0
+
+Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
+index 6e236a4854311..71b4888b30e71 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
+ 
+ 	an->ackto = ackto;
+ 
+-	spin_lock(&da->qlock);
++	spin_lock_bh(&da->qlock);
+ 	list_add_tail(&an->list, &da->nodes);
+-	spin_unlock(&da->qlock);
++	spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_init);
+ 
+@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
+ {
+ 	struct ath_dynack *da = &ah->dynack;
+ 
+-	spin_lock(&da->qlock);
++	spin_lock_bh(&da->qlock);
+ 	list_del(&an->list);
+-	spin_unlock(&da->qlock);
++	spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_deinit);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/backlight-lm3630a-return-0-on-success-in-update_stat.patch b/queue-4.19/backlight-lm3630a-return-0-on-success-in-update_stat.patch
new file mode 100644
index 00000000000..b148a78ab03
--- /dev/null
+++ b/queue-4.19/backlight-lm3630a-return-0-on-success-in-update_stat.patch
@@ -0,0 +1,50 @@
+From cfc546f045646d134c16f7b23c13e15f70a81d3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:25:03 -0400
+Subject: backlight: lm3630a: Return 0 on success in update_status functions
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]
+
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
+both return the brightness value if the brightness was successfully
+updated. Writing to these attributes via sysfs would cause a 'Bad
+address' error to be returned. These functions should return 0 on
+success, so let's change it to correct that error.
+
+Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 2030a6b77a097..ef2553f452ca9 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ 				      LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ 	if (ret < 0)
+ 		goto out_i2c_err;
+-	return bl->props.brightness;
++	return 0;
+ 
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access\n");
+@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ 				      LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ 	if (ret < 0)
+ 		goto out_i2c_err;
+-	return bl->props.brightness;
++	return 0;
+ 
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+-- 
+2.20.1
+
diff --git a/queue-4.19/backlight-pwm_bl-fix-heuristic-to-determine-number-o.patch b/queue-4.19/backlight-pwm_bl-fix-heuristic-to-determine-number-o.patch
new file mode 100644
index 00000000000..882dd8cfd95
--- /dev/null
+++ b/queue-4.19/backlight-pwm_bl-fix-heuristic-to-determine-number-o.patch
@@ -0,0 +1,88 @@
+From cf6bfa5d5e0a2418e8a2a5c224203c7dd92dbbe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 11:00:03 -0700
+Subject: backlight: pwm_bl: Fix heuristic to determine number of brightness
+ levels
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit 73fbfc499448455f1e1c77717040e09e25f1d976 ]
+
+With commit 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of
+LED linearly to human eye") the number of set bits (aka hweight())
+in the PWM period is used in the heuristic to determine the number
+of brightness levels, when the brightness table isn't specified in
+the DT. The number of set bits doesn't provide a reliable clue about
+the length of the period, instead change the heuristic to:
+
+ nlevels = period / fls(period)
+
+Also limit the maximum number of brightness levels to 4096 to avoid
+excessively large tables.
+
+With this the number of levels increases monotonically with the PWM
+period, until the maximum of 4096 levels is reached:
+
+period (ns)    # levels
+
+100    	       16
+500	       62
+1000	       111
+5000	       416
+10000	       769
+50000	       3333
+100000	       4096
+
+Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Tested-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/pwm_bl.c | 24 ++++++------------------
+ 1 file changed, 6 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index 7ddc0930e98c6..3a3098d4873be 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -199,29 +199,17 @@ int pwm_backlight_brightness_default(struct device *dev,
+ 				     struct platform_pwm_backlight_data *data,
+ 				     unsigned int period)
+ {
+-	unsigned int counter = 0;
+-	unsigned int i, n;
++	unsigned int i;
+ 	u64 retval;
+ 
+ 	/*
+-	 * Count the number of bits needed to represent the period number. The
+-	 * number of bits is used to calculate the number of levels used for the
+-	 * brightness-levels table, the purpose of this calculation is have a
+-	 * pre-computed table with enough levels to get linear brightness
+-	 * perception. The period is divided by the number of bits so for a
+-	 * 8-bit PWM we have 255 / 8 = 32 brightness levels or for a 16-bit PWM
+-	 * we have 65535 / 16 = 4096 brightness levels.
+-	 *
+-	 * Note that this method is based on empirical testing on different
+-	 * devices with PWM of 8 and 16 bits of resolution.
++	 * Once we have 4096 levels there's little point going much higher...
++	 * neither interactive sliders nor animation benefits from having
++	 * more values in the table.
+ 	 */
+-	n = period;
+-	while (n) {
+-		counter += n % 2;
+-		n >>= 1;
+-	}
++	data->max_brightness =
++		min((int)DIV_ROUND_UP(period, fls(period)), 4096);
+ 
+-	data->max_brightness = DIV_ROUND_UP(period, counter);
+ 	data->levels = devm_kcalloc(dev, data->max_brightness,
+ 				    sizeof(*data->levels), GFP_KERNEL);
+ 	if (!data->levels)
+-- 
+2.20.1
+
diff --git a/queue-4.19/bcache-fix-an-error-code-in-bch_dump_read.patch b/queue-4.19/bcache-fix-an-error-code-in-bch_dump_read.patch
new file mode 100644
index 00000000000..0364c3432f6
--- /dev/null
+++ b/queue-4.19/bcache-fix-an-error-code-in-bch_dump_read.patch
@@ -0,0 +1,41 @@
+From c7c1267c03e5296758ad0908f6a9f6ebaebbccf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 21:25:44 +0800
+Subject: bcache: Fix an error code in bch_dump_read()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d66c9920c0cf984cf99cab5036fd5f3a1b7fba46 ]
+
+The copy_to_user() function returns the number of bytes remaining to be
+copied, but the intention here was to return -EFAULT if the copy fails.
+
+Fixes: cafe56359144 ("bcache: A block layer cache")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/debug.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
+index 8c53d874ada4a..f6b60d5908f70 100644
+--- a/drivers/md/bcache/debug.c
++++ b/drivers/md/bcache/debug.c
+@@ -178,10 +178,9 @@ static ssize_t bch_dump_read(struct file *file, char __user *buf,
+ 	while (size) {
+ 		struct keybuf_key *w;
+ 		unsigned int bytes = min(i->bytes, size);
+-		int err = copy_to_user(buf, i->buf, bytes);
+ 
+-		if (err)
+-			return err;
++		if (copy_to_user(buf, i->buf, bytes))
++			return -EFAULT;
+ 
+ 		ret	 += bytes;
+ 		buf	 += bytes;
+-- 
+2.20.1
+
diff --git a/queue-4.19/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch b/queue-4.19/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
new file mode 100644
index 00000000000..7a9ca236e14
--- /dev/null
+++ b/queue-4.19/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
@@ -0,0 +1,48 @@
+From ee1f1091a6284095c2180b90415bf7af1e3f6aa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 09:16:20 +0100
+Subject: bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ]
+
+An earlier commit re-worked the setting of the bitmask and is now
+assigning v with some bit flags rather than bitwise or-ing them
+into v, consequently the earlier bit-settings of v are being lost.
+Fix this by replacing an assignment with the bitwise or instead.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bcma/driver_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
+index f499a469e66d0..12b2cc9a3fbe8 100644
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
+ 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_START;
+ 	v |= BCMA_CORE_PCI_MDIODATA_READ;
+ 	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 
+@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
+ 		v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ 	}
+ 
+-	v = BCMA_CORE_PCI_MDIODATA_START;
++	v |= BCMA_CORE_PCI_MDIODATA_START;
+ 	v |= BCMA_CORE_PCI_MDIODATA_WRITE;
+ 	v |= BCMA_CORE_PCI_MDIODATA_TA;
+ 	v |= data;
+-- 
+2.20.1
+
diff --git a/queue-4.19/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch b/queue-4.19/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
new file mode 100644
index 00000000000..0bc0d97cdc4
--- /dev/null
+++ b/queue-4.19/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
@@ -0,0 +1,50 @@
+From 3366938c2a2a9688c5b5b3f736dbd87bd72d95ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 19:13:08 +0800
+Subject: block: don't use bio->bi_vcnt to figure out segment number
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]
+
+It is wrong to use bio->bi_vcnt to figure out how many segments
+there are in the bio even though CLONED flag isn't set on this bio,
+because this bio may be splitted or advanced.
+
+So always use bio_segments() in blk_recount_segments(), and it shouldn't
+cause any performance loss now because the physical segment number is figured
+out in blk_queue_split() and BIO_SEG_VALID is set meantime since
+bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 2776ee6c5c3dc..7efa8c3e2b727 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -309,13 +309,7 @@ void blk_recalc_rq_segments(struct request *rq)
+ 
+ void blk_recount_segments(struct request_queue *q, struct bio *bio)
+ {
+-	unsigned short seg_cnt;
+-
+-	/* estimate segment number by bi_vcnt for non-cloned bio */
+-	if (bio_flagged(bio, BIO_CLONED))
+-		seg_cnt = bio_segments(bio);
+-	else
+-		seg_cnt = bio->bi_vcnt;
++	unsigned short seg_cnt = bio_segments(bio);
+ 
+ 	if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
+ 			(seg_cnt < queue_max_segments(q)))
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch b/queue-4.19/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch
new file mode 100644
index 00000000000..0ebc4a4ad3f
--- /dev/null
+++ b/queue-4.19/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch
@@ -0,0 +1,51 @@
+From 9e7140c7d29ab651082b3476ba13f8df2978bae1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jun 2019 11:16:45 -0400
+Subject: bnxt_en: Fix ethtool selftest crash under error conditions.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit d27e2ca1166aefd54d9c48fb6647dee8115a5dfc ]
+
+After ethtool loopback packet tests, we re-open the nic for the next
+IRQ test.  If the open fails, we must not proceed with the IRQ test
+or we will crash with NULL pointer dereference.  Fix it by checking
+the bnxt_open_nic() return code before proceeding.
+
+Reported-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
+Fixes: 67fea463fd87 ("bnxt_en: Add interrupt test to ethtool -t selftest.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 0a409ba4012a3..dc63d269f01dc 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2600,7 +2600,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ 	bool offline = false;
+ 	u8 test_results = 0;
+ 	u8 test_mask = 0;
+-	int rc, i;
++	int rc = 0, i;
+ 
+ 	if (!bp->num_tests || !BNXT_SINGLE_PF(bp))
+ 		return;
+@@ -2671,9 +2671,9 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ 		}
+ 		bnxt_hwrm_phy_loopback(bp, false, false);
+ 		bnxt_half_close_nic(bp);
+-		bnxt_open_nic(bp, false, true);
++		rc = bnxt_open_nic(bp, false, true);
+ 	}
+-	if (bnxt_test_irq(bp)) {
++	if (rc || bnxt_test_irq(bp)) {
+ 		buf[BNXT_IRQ_TEST_IDX] = 1;
+ 		etest->flags |= ETH_TEST_FL_FAILED;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch b/queue-4.19/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch
new file mode 100644
index 00000000000..67043ba471a
--- /dev/null
+++ b/queue-4.19/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch
@@ -0,0 +1,57 @@
+From 369214ab2b93904ed8b5a9f11544821d748875d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Aug 2019 17:04:49 -0400
+Subject: bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit dd2ebf3404c7c295014bc025dea23960960ceb1a ]
+
+If FW returns FRAG_ERR in response error code, driver is resending the
+command only when HWRM command returns success. Fix the code to resend
+NVM_INSTALL_UPDATE command with DEFRAG install flags, if FW returns
+FRAG_ERR in its response error code.
+
+Fixes: cb4d1d626145 ("bnxt_en: Retry failed NVM_INSTALL_UPDATE with defragmentation flag enabled.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index dc63d269f01dc..cdbb8940a4ae5 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1778,21 +1778,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ 	mutex_lock(&bp->hwrm_cmd_lock);
+ 	hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
+ 				      INSTALL_PACKAGE_TIMEOUT);
+-	if (hwrm_err)
+-		goto flash_pkg_exit;
+-
+-	if (resp->error_code) {
++	if (hwrm_err) {
+ 		u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+ 
+-		if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
++		if (resp->error_code && error_code ==
++		    NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ 			install.flags |= cpu_to_le16(
+ 			       NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+ 			hwrm_err = _hwrm_send_message(bp, &install,
+ 						      sizeof(install),
+ 						      INSTALL_PACKAGE_TIMEOUT);
+-			if (hwrm_err)
+-				goto flash_pkg_exit;
+ 		}
++		if (hwrm_err)
++			goto flash_pkg_exit;
+ 	}
+ 
+ 	if (resp->result) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-increase-timeout-for-hwrm_dbg_coredump_xx-co.patch b/queue-4.19/bnxt_en-increase-timeout-for-hwrm_dbg_coredump_xx-co.patch
new file mode 100644
index 00000000000..048030f0101
--- /dev/null
+++ b/queue-4.19/bnxt_en-increase-timeout-for-hwrm_dbg_coredump_xx-co.patch
@@ -0,0 +1,50 @@
+From 552bc5df1d6b9444d3dc862a15001f49e2110ba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2019 00:01:39 -0400
+Subject: bnxt_en: Increase timeout for HWRM_DBG_COREDUMP_XX commands
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 57a8730b1f7a0be7bf8a0a0bb665329074ba764f ]
+
+Firmware coredump messages take much longer than standard messages,
+so increase the timeout accordingly.
+
+Fixes: 6c5657d085ae ("bnxt_en: Add support for ethtool get dump.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h         | 1 +
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index f9e253b705ece..585f5aef0a45b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -527,6 +527,7 @@ struct rx_tpa_end_cmp_ext {
+ #define DFLT_HWRM_CMD_TIMEOUT		500
+ #define HWRM_CMD_TIMEOUT		(bp->hwrm_cmd_timeout)
+ #define HWRM_RESET_TIMEOUT		((HWRM_CMD_TIMEOUT) * 4)
++#define HWRM_COREDUMP_TIMEOUT		((HWRM_CMD_TIMEOUT) * 12)
+ #define HWRM_RESP_ERR_CODE_MASK		0xffff
+ #define HWRM_RESP_LEN_OFFSET		4
+ #define HWRM_RESP_LEN_MASK		0xffff0000
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index cdbb8940a4ae5..047024717d654 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2833,7 +2833,7 @@ static int bnxt_hwrm_dbg_coredump_initiate(struct bnxt *bp, u16 component_id,
+ 	req.component_id = cpu_to_le16(component_id);
+ 	req.segment_id = cpu_to_le16(segment_id);
+ 
+-	return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	return hwrm_send_message(bp, &req, sizeof(req), HWRM_COREDUMP_TIMEOUT);
+ }
+ 
+ static int bnxt_hwrm_dbg_coredump_retrieve(struct bnxt *bp, u16 component_id,
+-- 
+2.20.1
+
diff --git a/queue-4.19/bnxt_en-suppress-error-messages-when-querying-dscp-d.patch b/queue-4.19/bnxt_en-suppress-error-messages-when-querying-dscp-d.patch
new file mode 100644
index 00000000000..9fed593296e
--- /dev/null
+++ b/queue-4.19/bnxt_en-suppress-error-messages-when-querying-dscp-d.patch
@@ -0,0 +1,37 @@
+From 007477d82667f59dd85ed2b2555dae8bad1239ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jun 2019 11:16:48 -0400
+Subject: bnxt_en: Suppress error messages when querying DSCP DCB capabilities.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 4ca5fa39e1aea2f85eb9c4257075c4077c6531da ]
+
+Some firmware versions do not support this so use the silent variant
+to send the message to firmware to suppress the harmless error.  This
+error message is unnecessarily alarming the user.
+
+Fixes: afdc8a84844a ("bnxt_en: Add DCBNL DSCP application protocol support.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+index a85d2be986af4..0e4e0b47f5d85 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -396,7 +396,7 @@ static int bnxt_hwrm_queue_dscp_qcaps(struct bnxt *bp)
+ 
+ 	bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_DSCP_QCAPS, -1, -1);
+ 	mutex_lock(&bp->hwrm_cmd_lock);
+-	rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++	rc = _hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ 	if (!rc) {
+ 		bp->max_dscp_value = (1 << resp->num_dscp_bits) - 1;
+ 		if (bp->max_dscp_value < 0x3f)
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-add-missed-newline-in-verifier-verbose-log.patch b/queue-4.19/bpf-add-missed-newline-in-verifier-verbose-log.patch
new file mode 100644
index 00000000000..dfcd5e7e78d
--- /dev/null
+++ b/queue-4.19/bpf-add-missed-newline-in-verifier-verbose-log.patch
@@ -0,0 +1,45 @@
+From cea9b7517cd5fc2bf46fba94b9e78df21ba2b5bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 23:22:43 -0700
+Subject: bpf: Add missed newline in verifier verbose log
+
+From: Andrey Ignatov <rdna@fb.com>
+
+[ Upstream commit 1fbd20f8b77b366ea4aeb92ade72daa7f36a7e3b ]
+
+check_stack_access() that prints verbose log is used in
+adjust_ptr_min_max_vals() that prints its own verbose log and now they
+stick together, e.g.:
+
+  variable stack access var_off=(0xfffffffffffffff0; 0x4) off=-16
+  size=1R2 stack pointer arithmetic goes out of range, prohibited for
+  !root
+
+Add missing newline so that log is more readable:
+  variable stack access var_off=(0xfffffffffffffff0; 0x4) off=-16 size=1
+  R2 stack pointer arithmetic goes out of range, prohibited for !root
+
+Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 9bbfb1ff4ac94..e85636fb81b9c 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1253,7 +1253,7 @@ static int check_stack_access(struct bpf_verifier_env *env,
+ 		char tn_buf[48];
+ 
+ 		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+-		verbose(env, "variable stack access var_off=%s off=%d size=%d",
++		verbose(env, "variable stack access var_off=%s off=%d size=%d\n",
+ 			tn_buf, off, size);
+ 		return -EACCES;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-fix-btf-limits.patch b/queue-4.19/bpf-fix-btf-limits.patch
new file mode 100644
index 00000000000..b26f05eb16c
--- /dev/null
+++ b/queue-4.19/bpf-fix-btf-limits.patch
@@ -0,0 +1,41 @@
+From 22a74ddebaf02f40c54a4910103809b5750da5e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2019 10:45:38 -0700
+Subject: bpf: fix BTF limits
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit a0791f0df7d212c245761538b17a9ea93607b667 ]
+
+vmlinux BTF has more than 64k types.
+Its string section is also at the offset larger than 64k.
+Adjust both limits to make in-kernel BTF verifier successfully parse in-kernel BTF.
+
+Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/btf.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/btf.h b/include/uapi/linux/btf.h
+index 972265f328717..1e2662ff05291 100644
+--- a/include/uapi/linux/btf.h
++++ b/include/uapi/linux/btf.h
+@@ -22,9 +22,9 @@ struct btf_header {
+ };
+ 
+ /* Max # of type identifier */
+-#define BTF_MAX_TYPE	0x0000ffff
++#define BTF_MAX_TYPE	0x000fffff
+ /* Max offset into the string section */
+-#define BTF_MAX_NAME_OFFSET	0x0000ffff
++#define BTF_MAX_NAME_OFFSET	0x00ffffff
+ /* Max # of struct/union/enum members or func args */
+ #define BTF_MAX_VLEN	0xffff
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-fix-the-check-that-forwarding-is-enabled-in-bpf_.patch b/queue-4.19/bpf-fix-the-check-that-forwarding-is-enabled-in-bpf_.patch
new file mode 100644
index 00000000000..5ce5a797585
--- /dev/null
+++ b/queue-4.19/bpf-fix-the-check-that-forwarding-is-enabled-in-bpf_.patch
@@ -0,0 +1,43 @@
+From b44a9bcba0fb7348b48d589ff39f9e5e37117abc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Jun 2019 22:53:48 +0000
+Subject: bpf: fix the check that forwarding is enabled in bpf_ipv6_fib_lookup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anton Protopopov <a.s.protopopov@gmail.com>
+
+[ Upstream commit 56f0f84e69c7a7f229dfa524b13b0ceb6ce9b09e ]
+
+The bpf_ipv6_fib_lookup function should return BPF_FIB_LKUP_RET_FWD_DISABLED
+when forwarding is disabled for the input device.  However instead of checking
+if forwarding is enabled on the input device, it checked the global
+net->ipv6.devconf_all->forwarding flag.  Change it to behave as expected.
+
+Fixes: 87f5fc7e48dd ("bpf: Provide helper to do forwarding lookups in kernel FIB table")
+Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 91b9502619757..9daf1a4118b51 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4367,7 +4367,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
+ 		return -ENODEV;
+ 
+ 	idev = __in6_dev_get_safely(dev);
+-	if (unlikely(!idev || !net->ipv6.devconf_all->forwarding))
++	if (unlikely(!idev || !idev->cnf.forwarding))
+ 		return BPF_FIB_LKUP_RET_FWD_DISABLED;
+ 
+ 	if (flags & BPF_FIB_LOOKUP_OUTPUT) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/bpf-offload-unlock-on-error-in-bpf_offload_dev_creat.patch b/queue-4.19/bpf-offload-unlock-on-error-in-bpf_offload_dev_creat.patch
new file mode 100644
index 00000000000..945ce7ffa14
--- /dev/null
+++ b/queue-4.19/bpf-offload-unlock-on-error-in-bpf_offload_dev_creat.patch
@@ -0,0 +1,40 @@
+From 1553cb764ae0eec1ad6b3f57d95d4943a2a651ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 12:15:36 +0300
+Subject: bpf, offload: Unlock on error in bpf_offload_dev_create()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d0fbb51dfaa612f960519b798387be436e8f83c5 ]
+
+We need to drop the bpf_devs_lock on error before returning.
+
+Fixes: 9fd7c5559165 ("bpf: offload: aggregate offloads per-device")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Link: https://lore.kernel.org/bpf/20191104091536.GB31509@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c
+index 177a524363942..86477f3894e52 100644
+--- a/kernel/bpf/offload.c
++++ b/kernel/bpf/offload.c
+@@ -645,8 +645,10 @@ struct bpf_offload_dev *bpf_offload_dev_create(void)
+ 	down_write(&bpf_devs_lock);
+ 	if (!offdevs_inited) {
+ 		err = rhashtable_init(&offdevs, &offdevs_params);
+-		if (err)
++		if (err) {
++			up_write(&bpf_devs_lock);
+ 			return ERR_PTR(err);
++		}
+ 		offdevs_inited = true;
+ 	}
+ 	up_write(&bpf_devs_lock);
+-- 
+2.20.1
+
diff --git a/queue-4.19/brcmfmac-create-debugfs-files-for-bus-specific-layer.patch b/queue-4.19/brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
new file mode 100644
index 00000000000..64656ed1eda
--- /dev/null
+++ b/queue-4.19/brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
@@ -0,0 +1,115 @@
+From 9bf3edc2584a85404fa95c7ff2d0ab2d6f1a3d8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Feb 2019 13:43:49 +0100
+Subject: brcmfmac: create debugfs files for bus-specific layer
+
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+
+[ Upstream commit aaf6a5e86e36766abbeedf220462bde8031f9a72 ]
+
+Since we moved the drivers debugfs directory under ieee80211 debugfs the
+debugfs entries need to be added after wiphy_register() has been called.
+For most part that has been done accordingly, but for the debugfs entries
+added by SDIO it was not and failed silently. This patch fixes that by
+adding a bus-layer callback for it.
+
+Fixes: 856d5a011c86 ("brcmfmac: allocate struct brcmf_pub instance using wiphy_new()")
+Reported-by: Russel King <linux@armlinux.org.uk>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h   | 10 ++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c  |  1 +
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 +++++++-----
+ 3 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+index c4965184cdf37..3d441c5c745cc 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -90,6 +90,7 @@ struct brcmf_bus_ops {
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
+ 	int (*get_fwname)(struct device *dev, const char *ext,
+ 			  unsigned char *fw_name);
++	void (*debugfs_create)(struct device *dev);
+ };
+ 
+ 
+@@ -235,6 +236,15 @@ int brcmf_bus_get_fwname(struct brcmf_bus *bus, const char *ext,
+ 	return bus->ops->get_fwname(bus->dev, ext, fw_name);
+ }
+ 
++static inline
++void brcmf_bus_debugfs_create(struct brcmf_bus *bus)
++{
++	if (!bus->ops->debugfs_create)
++		return;
++
++	return bus->ops->debugfs_create(bus->dev);
++}
++
+ /*
+  * interface functions from common layer
+  */
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+index 584e05fdca6ad..9d7b8834b8545 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1105,6 +1105,7 @@ static int brcmf_bus_started(struct brcmf_pub *drvr, struct cfg80211_ops *ops)
+ 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
+ 	brcmf_feat_debugfs_create(drvr);
+ 	brcmf_proto_debugfs_create(drvr);
++	brcmf_bus_debugfs_create(bus_if);
+ 
+ 	return 0;
+ 
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index abaed2fa2defd..5c3b62e619807 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3131,9 +3131,12 @@ static int brcmf_debugfs_sdio_count_read(struct seq_file *seq, void *data)
+ 	return 0;
+ }
+ 
+-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
++static void brcmf_sdio_debugfs_create(struct device *dev)
+ {
+-	struct brcmf_pub *drvr = bus->sdiodev->bus_if->drvr;
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_sdio *bus = sdiodev->bus;
+ 	struct dentry *dentry = brcmf_debugfs_get_devdir(drvr);
+ 
+ 	if (IS_ERR_OR_NULL(dentry))
+@@ -3153,7 +3156,7 @@ static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
+ 	return 0;
+ }
+ 
+-static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
++static void brcmf_sdio_debugfs_create(struct device *dev)
+ {
+ }
+ #endif /* DEBUG */
+@@ -3438,8 +3441,6 @@ static int brcmf_sdio_bus_preinit(struct device *dev)
+ 	if (bus->rxbuf)
+ 		bus->rxblen = value;
+ 
+-	brcmf_sdio_debugfs_create(bus);
+-
+ 	/* the commands below use the terms tx and rx from
+ 	 * a device perspective, ie. bus:txglom affects the
+ 	 * bus transfers from device to host.
+@@ -4050,6 +4051,7 @@ static const struct brcmf_bus_ops brcmf_sdio_bus_ops = {
+ 	.get_ramsize = brcmf_sdio_bus_get_ramsize,
+ 	.get_memdump = brcmf_sdio_bus_get_memdump,
+ 	.get_fwname = brcmf_sdio_get_fwname,
++	.debugfs_create = brcmf_sdio_debugfs_create
+ };
+ 
+ #define BRCMF_SDIO_FW_CODE	0
+-- 
+2.20.1
+
diff --git a/queue-4.19/brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch b/queue-4.19/brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
new file mode 100644
index 00000000000..e166afe4bd1
--- /dev/null
+++ b/queue-4.19/brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
@@ -0,0 +1,51 @@
+From a6c6763a702c61e3f05b44387b8dc07eb3d8455f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Apr 2019 12:43:33 +0100
+Subject: brcmfmac: fix leak of mypkt on error return path
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit a927e8d8ab57e696800e20cf09a72b7dfe3bbebb ]
+
+Currently if the call to brcmf_sdiod_set_backplane_window fails then
+error return path leaks mypkt. Fix this by returning by a new
+error path labelled 'out' that calls brcmu_pkt_buf_free_skb to free
+mypkt.  Also remove redundant check on err before calling
+brcmf_sdiod_skbuff_write.
+
+Addresses-Coverity: ("Resource Leak")
+Fixes: a7c3aa1509e2 ("brcmfmac: Remove brcmf_sdiod_addrprep()")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+index d2f788d886681..710dc59c5d34d 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -617,15 +617,13 @@ int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
+ 
+ 	err = brcmf_sdiod_set_backplane_window(sdiodev, addr);
+ 	if (err)
+-		return err;
++		goto out;
+ 
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	if (!err)
+-		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
+-					       mypkt);
+-
++	err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr, mypkt);
++out:
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+ 	return err;
+-- 
+2.20.1
+
diff --git a/queue-4.19/bridge-br_arp_nd_proxy-set-icmp6_router-if-neigh-has.patch b/queue-4.19/bridge-br_arp_nd_proxy-set-icmp6_router-if-neigh-has.patch
new file mode 100644
index 00000000000..e8c5cff06e7
--- /dev/null
+++ b/queue-4.19/bridge-br_arp_nd_proxy-set-icmp6_router-if-neigh-has.patch
@@ -0,0 +1,33 @@
+From a03b6b2747bd1a5f2fd7cb1cb7809d8b313cf63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 14:39:14 -0700
+Subject: bridge: br_arp_nd_proxy: set icmp6_router if neigh has NTF_ROUTER
+
+From: Roopa Prabhu <roopa@cumulusnetworks.com>
+
+[ Upstream commit 7aca011f88eb57be1b17b0216247f4e32ac54e29 ]
+
+Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports")
+Signed-off-by: Roopa Prabhu <roopa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_arp_nd_proxy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c
+index 2cf7716254be6..d42e3904b4987 100644
+--- a/net/bridge/br_arp_nd_proxy.c
++++ b/net/bridge/br_arp_nd_proxy.c
+@@ -311,7 +311,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
+ 	/* Neighbor Advertisement */
+ 	memset(na, 0, sizeof(*na) + na_olen);
+ 	na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
+-	na->icmph.icmp6_router = 0; /* XXX: should be 1 ? */
++	na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
+ 	na->icmph.icmp6_override = 1;
+ 	na->icmph.icmp6_solicited = 1;
+ 	na->target = ns->target;
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch b/queue-4.19/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
new file mode 100644
index 00000000000..2cf1bc85f35
--- /dev/null
+++ b/queue-4.19/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
@@ -0,0 +1,86 @@
+From 1a674850f0f6108af8cf5fdd75a6ed162a609323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:09 +0100
+Subject: Btrfs: fix hang when loading existing inode cache off disk
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ]
+
+If we are able to load an existing inode cache off disk, we set the state
+of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting
+for the cache to be available. This means that anyone waiting for the
+cache to be available, waiting on the condition that either its state is
+BTRFS_CACHE_FINISHED or its available free space is greather than zero,
+can hang forever.
+
+This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache",
+in particular test case generic/161 triggered it very frequently for me,
+producing a trace like the following:
+
+  [63795.739712] BTRFS info (device sdc): enabling inode map caching
+  [63795.739714] BTRFS info (device sdc): disk space caching is enabled
+  [63795.739716] BTRFS info (device sdc): has skinny extents
+  [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds.
+  [64036.654079]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
+  [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+  [64036.654232] btrfs-transacti D    0  3917      2 0x80004000
+  [64036.654239] Call Trace:
+  [64036.654258]  ? __schedule+0x3ae/0x7b0
+  [64036.654271]  schedule+0x3a/0xb0
+  [64036.654325]  btrfs_commit_transaction+0x978/0xae0 [btrfs]
+  [64036.654339]  ? remove_wait_queue+0x60/0x60
+  [64036.654395]  transaction_kthread+0x146/0x180 [btrfs]
+  [64036.654450]  ? btrfs_cleanup_transaction+0x620/0x620 [btrfs]
+  [64036.654456]  kthread+0x103/0x140
+  [64036.654464]  ? kthread_create_worker_on_cpu+0x70/0x70
+  [64036.654476]  ret_from_fork+0x3a/0x50
+  [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds.
+  [64036.654568]       Not tainted 5.2.0-rc4-btrfs-next-50 #1
+  [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+  [64036.654685] xfs_io          D    0  3919   3633 0x00000000
+  [64036.654691] Call Trace:
+  [64036.654703]  ? __schedule+0x3ae/0x7b0
+  [64036.654716]  schedule+0x3a/0xb0
+  [64036.654756]  btrfs_find_free_ino+0xa9/0x120 [btrfs]
+  [64036.654764]  ? remove_wait_queue+0x60/0x60
+  [64036.654809]  btrfs_create+0x72/0x1f0 [btrfs]
+  [64036.654822]  lookup_open+0x6bc/0x790
+  [64036.654849]  path_openat+0x3bc/0xc00
+  [64036.654854]  ? __lock_acquire+0x331/0x1cb0
+  [64036.654869]  do_filp_open+0x99/0x110
+  [64036.654884]  ? __alloc_fd+0xee/0x200
+  [64036.654895]  ? do_raw_spin_unlock+0x49/0xc0
+  [64036.654909]  ? do_sys_open+0x132/0x220
+  [64036.654913]  do_sys_open+0x132/0x220
+  [64036.654926]  do_syscall_64+0x60/0x1d0
+  [64036.654933]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fix this by adding a wake_up() call right after setting the cache state to
+BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the
+cache from disk.
+
+Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index e1b50c62ba650..b3bd270706176 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -145,6 +145,7 @@ static void start_caching(struct btrfs_root *root)
+ 		spin_lock(&root->ino_cache_lock);
+ 		root->ino_cache_state = BTRFS_CACHE_FINISHED;
+ 		spin_unlock(&root->ino_cache_lock);
++		wake_up(&root->ino_cache_wait);
+ 		return;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch b/queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch
new file mode 100644
index 00000000000..bac0f5fa29c
--- /dev/null
+++ b/queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch
@@ -0,0 +1,80 @@
+From dc6dba11a2008551b2fc58a9d58dc66eab77cf1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:32 +0100
+Subject: Btrfs: fix inode cache waiters hanging on failure to start caching
+ thread
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a68ebe0790fc88b4314d17984a2cf99ce2361901 ]
+
+If we fail to start the inode caching thread, we print an error message
+and disable the inode cache, however we never wake up any waiters, so they
+hang forever waiting for the caching to finish. Fix this by waking them
+up and have them fallback to a call to btrfs_find_free_objectid().
+
+Fixes: e60efa84252c05 ("Btrfs: avoid triggering bug_on() when we fail to start inode caching task")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index b3bd270706176..7c4d0107c6fb9 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -12,6 +12,19 @@
+ #include "inode-map.h"
+ #include "transaction.h"
+ 
++static void fail_caching_thread(struct btrfs_root *root)
++{
++	struct btrfs_fs_info *fs_info = root->fs_info;
++
++	btrfs_warn(fs_info, "failed to start inode caching task");
++	btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
++				     "disabling inode map caching");
++	spin_lock(&root->ino_cache_lock);
++	root->ino_cache_state = BTRFS_CACHE_ERROR;
++	spin_unlock(&root->ino_cache_lock);
++	wake_up(&root->ino_cache_wait);
++}
++
+ static int caching_kthread(void *data)
+ {
+ 	struct btrfs_root *root = data;
+@@ -164,11 +177,8 @@ static void start_caching(struct btrfs_root *root)
+ 
+ 	tsk = kthread_run(caching_kthread, root, "btrfs-ino-cache-%llu",
+ 			  root->root_key.objectid);
+-	if (IS_ERR(tsk)) {
+-		btrfs_warn(fs_info, "failed to start inode caching task");
+-		btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
+-					     "disabling inode map caching");
+-	}
++	if (IS_ERR(tsk))
++		fail_caching_thread(root);
+ }
+ 
+ int btrfs_find_free_ino(struct btrfs_root *root, u64 *objectid)
+@@ -186,11 +196,14 @@ again:
+ 
+ 	wait_event(root->ino_cache_wait,
+ 		   root->ino_cache_state == BTRFS_CACHE_FINISHED ||
++		   root->ino_cache_state == BTRFS_CACHE_ERROR ||
+ 		   root->free_ino_ctl->free_space > 0);
+ 
+ 	if (root->ino_cache_state == BTRFS_CACHE_FINISHED &&
+ 	    root->free_ino_ctl->free_space == 0)
+ 		return -ENOSPC;
++	else if (root->ino_cache_state == BTRFS_CACHE_ERROR)
++		return btrfs_find_free_objectid(root, objectid);
+ 	else
+ 		goto again;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch b/queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch
new file mode 100644
index 00000000000..a7aaf46aef2
--- /dev/null
+++ b/queue-4.19/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch
@@ -0,0 +1,43 @@
+From 3d7945f0c2eb404f7429e9b9178385c09748bb3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:44 +0100
+Subject: Btrfs: fix inode cache waiters hanging on path allocation failure
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 9d123a35d7e97bb2139747b16127c9b22b6a593e ]
+
+If the caching thread fails to allocate a path, it returns without waking
+up any cache waiters, leaving them hang forever. Fix this by following the
+same approach as when we fail to start the caching thread: print an error
+message, disable inode caching and make the wakers fallback to non-caching
+mode behaviour (calling btrfs_find_free_objectid()).
+
+Fixes: 581bb050941b4f ("Btrfs: Cache free inode numbers in memory")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index 7c4d0107c6fb9..c7dcb7c521086 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -41,8 +41,10 @@ static int caching_kthread(void *data)
+ 		return 0;
+ 
+ 	path = btrfs_alloc_path();
+-	if (!path)
++	if (!path) {
++		fail_caching_thread(root);
+ 		return -ENOMEM;
++	}
+ 
+ 	/* Since the commit root is read-only, we can safely skip locking. */
+ 	path->skip_locking = 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/btrfs-use-correct-count-in-btrfs_file_write_iter.patch b/queue-4.19/btrfs-use-correct-count-in-btrfs_file_write_iter.patch
new file mode 100644
index 00000000000..bbe3d89638f
--- /dev/null
+++ b/queue-4.19/btrfs-use-correct-count-in-btrfs_file_write_iter.patch
@@ -0,0 +1,55 @@
+From 4e4f72144c38e9e96db136c8ef3eb4c17d17f822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 14:04:02 -0700
+Subject: btrfs: use correct count in btrfs_file_write_iter()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit c09767a8960ca0500fb636bf73686723337debf4 ]
+
+generic_write_checks() may modify iov_iter_count(), so we must get the
+count after the call, not before. Using the wrong one has a couple of
+consequences:
+
+1. We check a longer range in check_can_nocow() for nowait than we're
+   actually writing.
+2. We create extra hole extent maps in btrfs_cont_expand(). As far as I
+   can tell, this is harmless, but I might be missing something.
+
+These issues are pretty minor, but let's fix it before something more
+important trips on it.
+
+Fixes: edf064e7c6fe ("btrfs: nowait aio support")
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 78490e544c91e..c2c93fe9d7fd5 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1895,7 +1895,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ 	bool sync = (file->f_flags & O_DSYNC) || IS_SYNC(file->f_mapping->host);
+ 	ssize_t err;
+ 	loff_t pos;
+-	size_t count = iov_iter_count(from);
++	size_t count;
+ 	loff_t oldsize;
+ 	int clean_page = 0;
+ 
+@@ -1917,6 +1917,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ 	}
+ 
+ 	pos = iocb->ki_pos;
++	count = iov_iter_count(from);
+ 	if (iocb->ki_flags & IOCB_NOWAIT) {
+ 		/*
+ 		 * We will allocate space in case nodatacow is not set,
+-- 
+2.20.1
+
diff --git a/queue-4.19/bus-ti-sysc-add-mcasp-optional-clocks-flag.patch b/queue-4.19/bus-ti-sysc-add-mcasp-optional-clocks-flag.patch
new file mode 100644
index 00000000000..b3c44f109de
--- /dev/null
+++ b/queue-4.19/bus-ti-sysc-add-mcasp-optional-clocks-flag.patch
@@ -0,0 +1,71 @@
+From 9318a1dd59bd2b9d0ec6ed840dbc3f1a4a847105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 14:46:53 -0800
+Subject: bus: ti-sysc: Add mcasp optional clocks flag
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 2c63a833e4500b341a62bf97e67488909ae12086 ]
+
+We have OPT_CLKS_NEEDED in legacy platform data, but it's missing
+from the ti-sysc driver for device tree based configuration.
+
+In order to pass OPT_CLKS_NEEDED quirk flag we need to update omap4 module
+data and add a new compatible for dra7 as the module layout is different
+from sysc_regbits_omap4_mcasp.
+
+Fixes: 70a65240efb1 ("bus: ti-sysc: Add register bits for interconnect
+target modules")
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/bus/ti-sysc.txt |  1 +
+ drivers/bus/ti-sysc.c                             | 11 +++++++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/bus/ti-sysc.txt b/Documentation/devicetree/bindings/bus/ti-sysc.txt
+index 91dc2333af012..85a23f551f024 100644
+--- a/Documentation/devicetree/bindings/bus/ti-sysc.txt
++++ b/Documentation/devicetree/bindings/bus/ti-sysc.txt
+@@ -35,6 +35,7 @@ Required standard properties:
+ 		"ti,sysc-omap3-sham"
+ 		"ti,sysc-omap-aes"
+ 		"ti,sysc-mcasp"
++		"ti,sysc-dra7-mcasp"
+ 		"ti,sysc-usb-host-fs"
+ 		"ti,sysc-dra7-mcan"
+ 
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index b6f63e7620214..926c83398b27b 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1593,6 +1593,16 @@ static const struct sysc_regbits sysc_regbits_omap4_mcasp = {
+ static const struct sysc_capabilities sysc_omap4_mcasp = {
+ 	.type = TI_SYSC_OMAP4_MCASP,
+ 	.regbits = &sysc_regbits_omap4_mcasp,
++	.mod_quirks = SYSC_QUIRK_OPT_CLKS_NEEDED,
++};
++
++/*
++ * McASP found on dra7 and later
++ */
++static const struct sysc_capabilities sysc_dra7_mcasp = {
++	.type = TI_SYSC_OMAP4_SIMPLE,
++	.regbits = &sysc_regbits_omap4_simple,
++	.mod_quirks = SYSC_QUIRK_OPT_CLKS_NEEDED,
+ };
+ 
+ /*
+@@ -1821,6 +1831,7 @@ static const struct of_device_id sysc_match[] = {
+ 	{ .compatible = "ti,sysc-omap3-sham", .data = &sysc_omap3_sham, },
+ 	{ .compatible = "ti,sysc-omap-aes", .data = &sysc_omap3_aes, },
+ 	{ .compatible = "ti,sysc-mcasp", .data = &sysc_omap4_mcasp, },
++	{ .compatible = "ti,sysc-dra7-mcasp", .data = &sysc_dra7_mcasp, },
+ 	{ .compatible = "ti,sysc-usb-host-fs",
+ 	  .data = &sysc_omap4_usb_host_fs, },
+ 	{ .compatible = "ti,sysc-dra7-mcan", .data = &sysc_dra7_mcan, },
+-- 
+2.20.1
+
diff --git a/queue-4.19/bus-ti-sysc-fix-sysc_unprepare-when-no-clocks-have-b.patch b/queue-4.19/bus-ti-sysc-fix-sysc_unprepare-when-no-clocks-have-b.patch
new file mode 100644
index 00000000000..8a81248384f
--- /dev/null
+++ b/queue-4.19/bus-ti-sysc-fix-sysc_unprepare-when-no-clocks-have-b.patch
@@ -0,0 +1,37 @@
+From 4d61d9365f27064caf11478e3db1183c23702359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2019 11:00:21 -0700
+Subject: bus: ti-sysc: Fix sysc_unprepare() when no clocks have been allocated
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit aaa29bb01cc4bf5a87dbdb219efba3b09f259d8e ]
+
+If we return early before ddata->clocks have been allocated we will get a
+NULL pointer dereference in sysc_unprepare(). Let's fix this by returning
+early when no clocks are allocated.
+
+Fixes: 0eecc636e5a2 ("bus: ti-sysc: Add minimal TI sysc interconnect target driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 2813f9ed57c0d..54c8c8644df2e 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1400,6 +1400,9 @@ static void sysc_unprepare(struct sysc *ddata)
+ {
+ 	int i;
+ 
++	if (!ddata->clocks)
++		return;
++
+ 	for (i = 0; i < SYSC_MAX_CLOCKS; i++) {
+ 		if (!IS_ERR_OR_NULL(ddata->clocks[i]))
+ 			clk_unprepare(ddata->clocks[i]);
+-- 
+2.20.1
+
diff --git a/queue-4.19/bus-ti-sysc-fix-timer-handling-with-drop-pm_runtime_.patch b/queue-4.19/bus-ti-sysc-fix-timer-handling-with-drop-pm_runtime_.patch
new file mode 100644
index 00000000000..4b0c9f014cb
--- /dev/null
+++ b/queue-4.19/bus-ti-sysc-fix-timer-handling-with-drop-pm_runtime_.patch
@@ -0,0 +1,101 @@
+From fddc80e120aad68eddcbb7e082e457dbf65b7ac5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 09:03:08 -0800
+Subject: bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 9bd34c63f5536c490c152833c77fa47f59aeade3 ]
+
+Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe
+them with ti-sysc") started producing a warning for pwm-omap-dmtimer:
+
+WARNING: CPU: 0 PID: 77 at drivers/bus/omap_l3_noc.c:147
+l3_interrupt_handler+0x2f8/0x388
+44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4PER2 (Idle):
+Data Access in Supervisor mode during Functional access
+...
+__pm_runtime_idle
+omap_dm_timer_disable
+pwm_omap_dmtimer_start
+pwm_omap_dmtimer_enable
+pwm_apply_state
+pwm_vibrator_start
+pwm_vibrator_play_work
+
+This is because the timer that pwm-omap-dmtimer is using is now being
+probed with ti-sysc interconnect target module instead of omap_device
+and the ti-sysc quirk for SYSC_QUIRK_LEGACY_IDLE is not fully
+compatible with what omap_device has been doing.
+
+We could fix this by reverting the timer changes and have the timer
+probe again with omap_device. Or we could add more quirk handling to
+ti-sysc driver. But as these options don't work nicely as longer term
+solutions, let's just make timers probe with ti-sysc without any
+quirks.
+
+To do this, all we need to do is remove quirks for timers for ti-sysc,
+and drop the bogus pm_runtime_irq_safe() flag for timer-ti-dm.
+
+We should not use pm_runtime_irq_safe() anyways for drivers as it will
+take a permanent use count on the parent device blocking the parent
+devices from idling and has been forcing ti-sysc driver to use a
+quirk flag.
+
+Note that we will move the timer data to DEBUG section later on in
+clean-up patches.
+
+Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc")
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Tero Kristo <t-kristo@ti.com>
+Cc: Thierry Reding <thierry.reding@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
+Tested-By: Andreas Kemnade <andreas@kemnade.info>
+Tested-By: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c             | 4 ++--
+ drivers/clocksource/timer-ti-dm.c | 1 -
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 926c83398b27b..2813f9ed57c0d 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -888,10 +888,10 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ 	SYSC_QUIRK("smartreflex", 0, -1, 0x38, -1, 0x00000000, 0xffffffff,
+ 		   SYSC_QUIRK_LEGACY_IDLE),
+ 	SYSC_QUIRK("timer", 0, 0, 0x10, 0x14, 0x00000015, 0xffffffff,
+-		   SYSC_QUIRK_LEGACY_IDLE),
++		   0),
+ 	/* Some timers on omap4 and later */
+ 	SYSC_QUIRK("timer", 0, 0, 0x10, -1, 0x4fff1301, 0xffffffff,
+-		   SYSC_QUIRK_LEGACY_IDLE),
++		   0),
+ 	SYSC_QUIRK("uart", 0, 0x50, 0x54, 0x58, 0x00000052, 0xffffffff,
+ 		   SYSC_QUIRK_LEGACY_IDLE),
+ 	/* Uarts on omap4 and later */
+diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c
+index 3ecf84706640b..23414dddc3bae 100644
+--- a/drivers/clocksource/timer-ti-dm.c
++++ b/drivers/clocksource/timer-ti-dm.c
+@@ -868,7 +868,6 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
+ 	timer->pdev = pdev;
+ 
+ 	pm_runtime_enable(dev);
+-	pm_runtime_irq_safe(dev);
+ 
+ 	if (!timer->reserved) {
+ 		ret = pm_runtime_get_sync(dev);
+-- 
+2.20.1
+
diff --git a/queue-4.19/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch b/queue-4.19/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
new file mode 100644
index 00000000000..4a93c0d5930
--- /dev/null
+++ b/queue-4.19/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
@@ -0,0 +1,35 @@
+From ef202378c3108dfe1e1578dfc76ebbcda141b9b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 22:34:51 +0800
+Subject: cdc-wdm: pass return value of recover_from_urb_loss
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]
+
+'rv' is the correct return value, pass it upstream instead of 0
+
+Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index b8a1fdefb5150..4929c58830688 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -1107,7 +1107,7 @@ static int wdm_post_reset(struct usb_interface *intf)
+ 	rv = recover_from_urb_loss(desc);
+ 	mutex_unlock(&desc->wlock);
+ 	mutex_unlock(&desc->rlock);
+-	return 0;
++	return rv;
+ }
+ 
+ static struct usb_driver wdm_driver = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/ceph-fix-ceph.dir.rctime-vxattr-value.patch b/queue-4.19/ceph-fix-ceph.dir.rctime-vxattr-value.patch
new file mode 100644
index 00000000000..a2cc8e767c5
--- /dev/null
+++ b/queue-4.19/ceph-fix-ceph.dir.rctime-vxattr-value.patch
@@ -0,0 +1,38 @@
+From 4579dde5af599ccf3d79c3d10e90bf51b8b07d0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 16:56:39 +0200
+Subject: ceph: fix "ceph.dir.rctime" vxattr value
+
+From: David Disseldorp <ddiss@suse.de>
+
+[ Upstream commit 718807289d4130be1fe13f24f018733116958070 ]
+
+The vxattr value incorrectly places a "09" prefix to the nanoseconds
+field, instead of providing it as a zero-pad width specifier after '%'.
+
+Fixes: 3489b42a72a4 ("ceph: fix three bugs, two in ceph_vxattrcb_file_layout()")
+Link: https://tracker.ceph.com/issues/39943
+Signed-off-by: David Disseldorp <ddiss@suse.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
+index 5e4f3f833e85e..a09ce27ab2204 100644
+--- a/fs/ceph/xattr.c
++++ b/fs/ceph/xattr.c
+@@ -221,7 +221,7 @@ static size_t ceph_vxattrcb_dir_rbytes(struct ceph_inode_info *ci, char *val,
+ static size_t ceph_vxattrcb_dir_rctime(struct ceph_inode_info *ci, char *val,
+ 				       size_t size)
+ {
+-	return snprintf(val, size, "%lld.09%ld", ci->i_rctime.tv_sec,
++	return snprintf(val, size, "%lld.%09ld", ci->i_rctime.tv_sec,
+ 			ci->i_rctime.tv_nsec);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/cfg80211-regulatory-make-initialization-more-robust.patch b/queue-4.19/cfg80211-regulatory-make-initialization-more-robust.patch
new file mode 100644
index 00000000000..1c0dfbf3f05
--- /dev/null
+++ b/queue-4.19/cfg80211-regulatory-make-initialization-more-robust.patch
@@ -0,0 +1,44 @@
+From 524bb5c403264c4380482464e3de14123f58491c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 11:43:00 +0200
+Subject: cfg80211: regulatory: make initialization more robust
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 71e5e886806ee3f8e0c44ed945eb2e4d6659c6e3 ]
+
+Since my change to split out the regulatory init to occur later,
+any issues during earlier cfg80211_init() or errors during the
+platform device allocation would lead to crashes later. Make this
+more robust by checking that the earlier initialization succeeded.
+
+Fixes: d7be102f2945 ("cfg80211: initialize regulatory keys/database later")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 64841238df855..5643bdee7198f 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3870,6 +3870,15 @@ static int __init regulatory_init_db(void)
+ {
+ 	int err;
+ 
++	/*
++	 * It's possible that - due to other bugs/issues - cfg80211
++	 * never called regulatory_init() below, or that it failed;
++	 * in that case, don't try to do any further work here as
++	 * it's doomed to lead to crashes.
++	 */
++	if (IS_ERR_OR_NULL(reg_pdev))
++		return -EINVAL;
++
+ 	err = load_builtin_regdb_keys();
+ 	if (err)
+ 		return err;
+-- 
+2.20.1
+
diff --git a/queue-4.19/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch b/queue-4.19/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
new file mode 100644
index 00000000000..316848507e7
--- /dev/null
+++ b/queue-4.19/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
@@ -0,0 +1,38 @@
+From c4ffbae050aa7161a24dd2413646b75a55b7402b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 22:14:29 -0500
+Subject: cifs: fix rmmod regression in cifs.ko caused by force_sig changes
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ]
+
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+
+The global change from force_sig caused module unloading of cifs.ko
+to fail (since the cifsd process could not be killed, "rmmod cifs"
+now would always fail)
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+CC: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index a59dcda075343..a8790bf04e95d 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -970,6 +970,7 @@ cifs_demultiplex_thread(void *p)
+ 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+ 
+ 	set_freezable();
++	allow_signal(SIGKILL);
+ 	while (server->tcpStatus != CifsExiting) {
+ 		if (try_to_freeze())
+ 			continue;
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-actions-fix-factor-clk-struct-member-access.patch b/queue-4.19/clk-actions-fix-factor-clk-struct-member-access.patch
new file mode 100644
index 00000000000..2794ad7749e
--- /dev/null
+++ b/queue-4.19/clk-actions-fix-factor-clk-struct-member-access.patch
@@ -0,0 +1,63 @@
+From 0e383184ae1fd0c49cde93ba12f4f84701c1d2d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 21:15:40 +0530
+Subject: clk: actions: Fix factor clk struct member access
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit ed309bfb4812e8b31a3eb877e157b8028a49e50c ]
+
+Since the helper "owl_factor_helper_round_rate" is shared between factor
+and composite clocks, using the factor clk specific helper function
+like "hw_to_owl_factor" to access its members will create issues when
+called from composite clk specific code. Hence, pass the "factor_hw"
+struct pointer directly instead of fetching it using factor clk specific
+helpers.
+
+This issue has been observed when a composite clock like "sd0_clk" tried
+to call "owl_factor_helper_round_rate" resulting in pointer dereferencing
+error.
+
+While we are at it, let's rename the "clk_val_best" function to
+"owl_clk_val_best" since this is an owl SoCs specific helper.
+
+Fixes: 4bb78fc9744a ("clk: actions: Add factor clock support")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20190916154546.24982-2-manivannan.sadhasivam@linaro.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/actions/owl-factor.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/actions/owl-factor.c b/drivers/clk/actions/owl-factor.c
+index 317d4a9e112ee..f15e2621fa185 100644
+--- a/drivers/clk/actions/owl-factor.c
++++ b/drivers/clk/actions/owl-factor.c
+@@ -64,11 +64,10 @@ static unsigned int _get_table_val(const struct clk_factor_table *table,
+ 	return val;
+ }
+ 
+-static int clk_val_best(struct clk_hw *hw, unsigned long rate,
++static int owl_clk_val_best(const struct owl_factor_hw *factor_hw,
++			struct clk_hw *hw, unsigned long rate,
+ 			unsigned long *best_parent_rate)
+ {
+-	struct owl_factor *factor = hw_to_owl_factor(hw);
+-	struct owl_factor_hw *factor_hw = &factor->factor_hw;
+ 	const struct clk_factor_table *clkt = factor_hw->table;
+ 	unsigned long parent_rate, try_parent_rate, best = 0, cur_rate;
+ 	unsigned long parent_rate_saved = *best_parent_rate;
+@@ -126,7 +125,7 @@ long owl_factor_helper_round_rate(struct owl_clk_common *common,
+ 	const struct clk_factor_table *clkt = factor_hw->table;
+ 	unsigned int val, mul = 0, div = 1;
+ 
+-	val = clk_val_best(&common->hw, rate, parent_rate);
++	val = owl_clk_val_best(factor_hw, &common->hw, rate, parent_rate);
+ 	_get_table_div_mul(clkt, val, &mul, &div);
+ 
+ 	return *parent_rate * mul / div;
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch b/queue-4.19/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
new file mode 100644
index 00000000000..e932f02ab95
--- /dev/null
+++ b/queue-4.19/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
@@ -0,0 +1,41 @@
+From 6c87c452cd1547ffa3e59fdf547584ebdd6d4cb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:36:58 -0500
+Subject: clk: armada-370: fix refcount leak in a370_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-370.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
+index 2c7c1085f8830..8fdfa97900cd8 100644
+--- a/drivers/clk/mvebu/armada-370.c
++++ b/drivers/clk/mvebu/armada-370.c
+@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &a370_coreclks);
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, a370_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch b/queue-4.19/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
new file mode 100644
index 00000000000..50192b85104
--- /dev/null
+++ b/queue-4.19/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
@@ -0,0 +1,40 @@
+From 09fa94e88753912a71d0c4682eb63f94cca5978f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:42:26 -0500
+Subject: clk: armada-xp: fix refcount leak in axp_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-xp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
+index 0ec44ae9a2a26..df529982adc97 100644
+--- a/drivers/clk/mvebu/armada-xp.c
++++ b/drivers/clk/mvebu/armada-xp.c
+@@ -228,7 +228,9 @@ static void __init axp_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &axp_coreclks);
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, axp_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-dove-fix-refcount-leak-in-dove_clk_init.patch b/queue-4.19/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
new file mode 100644
index 00000000000..0835268bb40
--- /dev/null
+++ b/queue-4.19/clk-dove-fix-refcount-leak-in-dove_clk_init.patch
@@ -0,0 +1,47 @@
+From 4e44f17ab1e449ec752ebc07a55f94cdcb62c460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:50:13 -0500
+Subject: clk: dove: fix refcount leak in dove_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order")
+Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/dove.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
+index 59fad9546c847..5f258c9bb68bf 100644
+--- a/drivers/clk/mvebu/dove.c
++++ b/drivers/clk/mvebu/dove.c
+@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &dove_coreclks);
+ 
+-	if (ddnp)
++	if (ddnp) {
+ 		dove_divider_clk_init(ddnp);
++		of_node_put(ddnp);
++	}
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, dove_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch b/queue-4.19/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
new file mode 100644
index 00000000000..ecf57ca1ea0
--- /dev/null
+++ b/queue-4.19/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
@@ -0,0 +1,36 @@
+From b823e6fc284bf9b8f8e7e1c916cec5b67cd70e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:10:01 -0500
+Subject: clk: highbank: fix refcount leak in hb_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-highbank.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
+index 727ed8e1bb726..8e4581004695c 100644
+--- a/drivers/clk/clk-highbank.c
++++ b/drivers/clk/clk-highbank.c
+@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
+ 	/* Map system registers */
+ 	srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
+ 	hb_clk->reg = of_iomap(srnp, 0);
++	of_node_put(srnp);
+ 	BUG_ON(!hb_clk->reg);
+ 	hb_clk->reg += reg;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch b/queue-4.19/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
new file mode 100644
index 00000000000..692425fa9e1
--- /dev/null
+++ b/queue-4.19/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
@@ -0,0 +1,36 @@
+From 95372b10abb8ea4437ee20553a287c0b764708d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:53:00 -0500
+Subject: clk: imx6q: fix refcount leak in imx6q_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6q.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index c509324f63385..8ddf9b1f1677c 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -424,6 +424,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
+ 	anatop_base = base = of_iomap(np, 0);
+ 	WARN_ON(!base);
++	of_node_put(np);
+ 
+ 	/* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
+ 	if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch b/queue-4.19/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
new file mode 100644
index 00000000000..243e6ea6e9c
--- /dev/null
+++ b/queue-4.19/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
@@ -0,0 +1,36 @@
+From ca5d4f89c9949607ff5e0d62e51a0e91267d6f06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:55:10 -0500
+Subject: clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6sx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
+index d9f2890ffe62b..57ab96a477756 100644
+--- a/drivers/clk/imx/clk-imx6sx.c
++++ b/drivers/clk/imx/clk-imx6sx.c
+@@ -151,6 +151,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
+ 	base = of_iomap(np, 0);
+ 	WARN_ON(!base);
++	of_node_put(np);
+ 
+ 	clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ 	clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch b/queue-4.19/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
new file mode 100644
index 00000000000..d5bf9721463
--- /dev/null
+++ b/queue-4.19/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
@@ -0,0 +1,36 @@
+From 89ab9bb92c07bc7f99fccfb511f25454102d9448 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:57:16 -0500
+Subject: clk: imx7d: fix refcount leak in imx7d_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx7d.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index 881b772c4ac97..83412bc36ebfb 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -413,6 +413,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
+ 	base = of_iomap(np, 0);
+ 	WARN_ON(!base);
++	of_node_put(np);
+ 
+ 	clks[IMX7D_PLL_ARM_MAIN_SRC]  = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+ 	clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-ingenic-jz4740-fix-gating-of-udc-clock.patch b/queue-4.19/clk-ingenic-jz4740-fix-gating-of-udc-clock.patch
new file mode 100644
index 00000000000..4fc366d52f2
--- /dev/null
+++ b/queue-4.19/clk-ingenic-jz4740-fix-gating-of-udc-clock.patch
@@ -0,0 +1,36 @@
+From 08e7e345c818d13a42a444714f9df4684df9d4ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 12:34:36 -0300
+Subject: clk: ingenic: jz4740: Fix gating of UDC clock
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit b7e29924a1a628aec60d18651b493fa1601bf944 ]
+
+The UDC clock is gated when the bit is cleared, not when it is set.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Artur Rojek <contact@artur-rojek.eu>
+Fixes: 2b555a4b9cae ("clk: ingenic: Add missing flag for UDC clock")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ingenic/jz4740-cgu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/ingenic/jz4740-cgu.c b/drivers/clk/ingenic/jz4740-cgu.c
+index 4479c102e8994..b86edd3282493 100644
+--- a/drivers/clk/ingenic/jz4740-cgu.c
++++ b/drivers/clk/ingenic/jz4740-cgu.c
+@@ -165,7 +165,7 @@ static const struct ingenic_cgu_clk_info jz4740_cgu_clocks[] = {
+ 		.parents = { JZ4740_CLK_EXT, JZ4740_CLK_PLL_HALF, -1, -1 },
+ 		.mux = { CGU_REG_CPCCR, 29, 1 },
+ 		.div = { CGU_REG_CPCCR, 23, 1, 6, -1, -1, -1 },
+-		.gate = { CGU_REG_SCR, 6 },
++		.gate = { CGU_REG_SCR, 6, true },
+ 	},
+ 
+ 	/* Gate-only clocks */
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch b/queue-4.19/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
new file mode 100644
index 00000000000..8fdf8ab4743
--- /dev/null
+++ b/queue-4.19/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
@@ -0,0 +1,38 @@
+From 05fd77d2d4b97cb2190bf44729831c072edb67de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:40:19 -0500
+Subject: clk: kirkwood: fix refcount leak in kirkwood_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/kirkwood.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
+index a2a8d614039da..890ebf623261b 100644
+--- a/drivers/clk/mvebu/kirkwood.c
++++ b/drivers/clk/mvebu/kirkwood.c
+@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
+ 	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
+ 		kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
++
++		of_node_put(cgnp);
+ 	}
+ }
+ CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-meson-axg-spread-spectrum-is-on-mpll2.patch b/queue-4.19/clk-meson-axg-spread-spectrum-is-on-mpll2.patch
new file mode 100644
index 00000000000..5b1d4daa2bc
--- /dev/null
+++ b/queue-4.19/clk-meson-axg-spread-spectrum-is-on-mpll2.patch
@@ -0,0 +1,50 @@
+From f8a6b9e8c2b13d89de480dbc6b74d3c4e1585763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2019 14:31:11 +0200
+Subject: clk: meson: axg: spread spectrum is on mpll2
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit dc4e62d373f881cbf51513296a6db7806516a01a ]
+
+After testing, it appears that the SSEN bit controls the spread
+spectrum function on MPLL2, not MPLL0.
+
+Fixes: 78b4af312f91 ("clk: meson-axg: add clock controller drivers")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/axg.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 02229d051d778..4e7dac24948b8 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -461,11 +461,6 @@ static struct clk_regmap axg_mpll0_div = {
+ 			.shift   = 16,
+ 			.width   = 9,
+ 		},
+-		.ssen = {
+-			.reg_off = HHI_MPLL_CNTL,
+-			.shift   = 25,
+-			.width	 = 1,
+-		},
+ 		.misc = {
+ 			.reg_off = HHI_PLL_TOP_MISC,
+ 			.shift   = 0,
+@@ -560,6 +555,11 @@ static struct clk_regmap axg_mpll2_div = {
+ 			.shift   = 16,
+ 			.width   = 9,
+ 		},
++		.ssen = {
++			.reg_off = HHI_MPLL_CNTL,
++			.shift   = 25,
++			.width	 = 1,
++		},
+ 		.misc = {
+ 			.reg_off = HHI_PLL_TOP_MISC,
+ 			.shift   = 2,
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-meson-gxbb-no-spread-spectrum-on-mpll0.patch b/queue-4.19/clk-meson-gxbb-no-spread-spectrum-on-mpll0.patch
new file mode 100644
index 00000000000..be4f2e63956
--- /dev/null
+++ b/queue-4.19/clk-meson-gxbb-no-spread-spectrum-on-mpll0.patch
@@ -0,0 +1,41 @@
+From 740fca27a84ef564237af0b99a4f3df77efc6ead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2019 14:31:10 +0200
+Subject: clk: meson: gxbb: no spread spectrum on mpll0
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 8925dbd03bb29b1b0de30ac4e02c18faf8ddc9db ]
+
+The documentation says there is an SSEN bit on mpll0 but, after testing
+it, no spread spectrum function appears to be enabled by this bit on any
+of the MPLLs.
+
+Let's remove it until we know more
+
+Fixes: 1f737ffa13ef ("clk: meson: mpll: fix mpll0 fractional part ignored")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index b039909e03cf8..38ffa51a5bade 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -650,11 +650,6 @@ static struct clk_regmap gxbb_mpll0_div = {
+ 			.shift   = 16,
+ 			.width   = 9,
+ 		},
+-		.ssen = {
+-			.reg_off = HHI_MPLL_CNTL,
+-			.shift   = 25,
+-			.width	 = 1,
+-		},
+ 		.lock = &meson_clk_lock,
+ 	},
+ 	.hw.init = &(struct clk_init_data){
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch b/queue-4.19/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch
new file mode 100644
index 00000000000..713b523d686
--- /dev/null
+++ b/queue-4.19/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch
@@ -0,0 +1,40 @@
+From a412642930704b2a8783bd61211e8b181b26cd56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:48:05 -0500
+Subject: clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 9b4eedf627045ae5ddcff60a484200cdd554c413 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 337072604224 ("clk: mvebu: Expand mv98dx3236-core-clock support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/mv98dx3236.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/mv98dx3236.c b/drivers/clk/mvebu/mv98dx3236.c
+index 6e203af73cac1..c8a0d03d2cd60 100644
+--- a/drivers/clk/mvebu/mv98dx3236.c
++++ b/drivers/clk/mvebu/mv98dx3236.c
+@@ -174,7 +174,9 @@ static void __init mv98dx3236_clk_init(struct device_node *np)
+ 
+ 	mvebu_coreclk_setup(np, &mv98dx3236_core_clocks);
+ 
+-	if (cgnp)
++	if (cgnp) {
+ 		mvebu_clk_gating_setup(cgnp, mv98dx3236_gating_desc);
++		of_node_put(cgnp);
++	}
+ }
+ CLK_OF_DECLARE(mv98dx3236_clk, "marvell,mv98dx3236-core-clock", mv98dx3236_clk_init);
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-qcom-fix-wunused-const-variable.patch b/queue-4.19/clk-qcom-fix-wunused-const-variable.patch
new file mode 100644
index 00000000000..6c850096a9a
--- /dev/null
+++ b/queue-4.19/clk-qcom-fix-wunused-const-variable.patch
@@ -0,0 +1,98 @@
+From c5ce6e32c60e4f25309a996109aaa2b9b9cba86c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 14:11:34 -0700
+Subject: clk: qcom: Fix -Wunused-const-variable
+
+From: Nathan Huckleberry <nhuck@google.com>
+
+[ Upstream commit da642427bd7710ec4f4140f693f59aa8521a358c ]
+
+Clang produces the following warning
+
+drivers/clk/qcom/gcc-msm8996.c:133:32: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map' [-Wunused-const-variable]
+static const struct
+parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] =
+{ ^drivers/clk/qcom/gcc-msm8996.c:141:27: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div' [-Wunused-const-variable] static
+const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { ^
+drivers/clk/qcom/gcc-msm8996.c:187:32: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map'
+[-Wunused-const-variable] static const struct parent_map
+gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { ^
+drivers/clk/qcom/gcc-msm8996.c:197:27: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div'
+[-Wunused-const-variable] static const char * const
+gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+
+It looks like these were never used.
+
+Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
+Cc: clang-built-linux@googlegroups.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/518
+Suggested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Nathan Huckleberry <nhuck@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8996.c | 36 ----------------------------------
+ 1 file changed, 36 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
+index 9a3290fdd01b1..bea55c461cee9 100644
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -138,22 +138,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
+ 	"gpll0_early_div"
+ };
+ 
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL2, 2 },
+-	{ P_GPLL3, 3 },
+-	{ P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll2",
+-	"gpll3",
+-	"gpll0_early_div"
+-};
+-
+ static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = {
+ 	{ P_XO, 0 },
+ 	{ P_GPLL0, 1 },
+@@ -192,26 +176,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early
+ 	"gpll0_early_div"
+ };
+ 
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = {
+-	{ P_XO, 0 },
+-	{ P_GPLL0, 1 },
+-	{ P_GPLL2, 2 },
+-	{ P_GPLL3, 3 },
+-	{ P_GPLL1, 4 },
+-	{ P_GPLL4, 5 },
+-	{ P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+-	"xo",
+-	"gpll0",
+-	"gpll2",
+-	"gpll3",
+-	"gpll1",
+-	"gpll4",
+-	"gpll0_early_div"
+-};
+-
+ static struct clk_fixed_factor xo = {
+ 	.mult = 1,
+ 	.div = 1,
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-qcom-skip-halt-checks-on-gcc_pcie_0_pipe_clk-for.patch b/queue-4.19/clk-qcom-skip-halt-checks-on-gcc_pcie_0_pipe_clk-for.patch
new file mode 100644
index 00000000000..fd2b509dcb2
--- /dev/null
+++ b/queue-4.19/clk-qcom-skip-halt-checks-on-gcc_pcie_0_pipe_clk-for.patch
@@ -0,0 +1,42 @@
+From bf99a4a75116059a43c803faf5a3b3bafea59888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 14:49:54 +0100
+Subject: clk: qcom: Skip halt checks on gcc_pcie_0_pipe_clk for 8998
+
+From: Marc Gonzalez <marc.w.gonzalez@free.fr>
+
+[ Upstream commit c0ee0e43c049a13d11e913edf875e4ee376dc84b ]
+
+See similar issue solved by commit 5f2420ed2189
+("clk: qcom: Skip halt checks on gcc_usb3_phy_pipe_clk for 8998")
+
+Without this patch, PCIe PHY init fails:
+
+qcom-qmp-phy 1c06000.phy: pipe_clk enable failed err=-16
+phy phy-1c06000.phy.0: phy init failed --> -16
+
+Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Reviewed-by: Jeffrey Hugo <jhugo@codeaurora.org>
+Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8998.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 4e23973b6cd16..772a08101ddf2 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -2144,7 +2144,7 @@ static struct clk_branch gcc_pcie_0_mstr_axi_clk = {
+ 
+ static struct clk_branch gcc_pcie_0_pipe_clk = {
+ 	.halt_reg = 0x6b018,
+-	.halt_check = BRANCH_HALT,
++	.halt_check = BRANCH_HALT_SKIP,
+ 	.clkr = {
+ 		.enable_reg = 0x6b018,
+ 		.enable_mask = BIT(0),
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch b/queue-4.19/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
new file mode 100644
index 00000000000..120e99b7aaa
--- /dev/null
+++ b/queue-4.19/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
@@ -0,0 +1,36 @@
+From a7125f7bd3d4ccb764959ba877ea30331fb5ef83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:14:42 -0500
+Subject: clk: qoriq: fix refcount leak in clockgen_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-qoriq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index 8abc5c8cb8b8c..a0713b2a12f37 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -1389,6 +1389,7 @@ static void __init clockgen_init(struct device_node *np)
+ 				pr_err("%s: Couldn't map %pOF regs\n", __func__,
+ 				       guts);
+ 			}
++			of_node_put(guts);
+ 		}
+ 
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch b/queue-4.19/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
new file mode 100644
index 00000000000..e2d3e005a05
--- /dev/null
+++ b/queue-4.19/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
@@ -0,0 +1,36 @@
+From 03cd8e537d2732c036627680b43cad13bc602f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:32:15 -0500
+Subject: clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos4.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 0421960eb9633..442309b569203 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1226,6 +1226,7 @@ static unsigned long __init exynos4_get_xom(void)
+ 			xom = readl(chipid_base + 8);
+ 
+ 		iounmap(chipid_base);
++		of_node_put(np);
+ 	}
+ 
+ 	return xom;
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-socfpga-fix-refcount-leak.patch b/queue-4.19/clk-socfpga-fix-refcount-leak.patch
new file mode 100644
index 00000000000..6701ce9622c
--- /dev/null
+++ b/queue-4.19/clk-socfpga-fix-refcount-leak.patch
@@ -0,0 +1,50 @@
+From 4d4419e41a0d8b227a57a3310a97441291ff505d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:29:02 -0500
+Subject: clk: socfpga: fix refcount leak
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
+Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/socfpga/clk-pll-a10.c | 1 +
+ drivers/clk/socfpga/clk-pll.c     | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
+index 35fabe1a32c30..269467e8e07e1 100644
+--- a/drivers/clk/socfpga/clk-pll-a10.c
++++ b/drivers/clk/socfpga/clk-pll-a10.c
+@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
+ 
+ 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ 	clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
++	of_node_put(clkmgr_np);
+ 	BUG_ON(!clk_mgr_a10_base_addr);
+ 	pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
+ 
+diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
+index c7f463172e4b9..b4b44e9b59011 100644
+--- a/drivers/clk/socfpga/clk-pll.c
++++ b/drivers/clk/socfpga/clk-pll.c
+@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
+ 
+ 	clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ 	clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
++	of_node_put(clkmgr_np);
+ 	BUG_ON(!clk_mgr_base_addr);
+ 	pll_clk->hw.reg = clk_mgr_base_addr + reg;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-sunxi-ng-sun50i-h6-r-fix-incorrect-w1-clock-gate.patch b/queue-4.19/clk-sunxi-ng-sun50i-h6-r-fix-incorrect-w1-clock-gate.patch
new file mode 100644
index 00000000000..52a2767c228
--- /dev/null
+++ b/queue-4.19/clk-sunxi-ng-sun50i-h6-r-fix-incorrect-w1-clock-gate.patch
@@ -0,0 +1,44 @@
+From c7e6942d6ece950098852d63a029b4b01bccb103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 17:40:36 +0200
+Subject: clk: sunxi-ng: sun50i-h6-r: Fix incorrect W1 clock gate register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit f167675486c37b88620d344fbb12d06e34f11d47 ]
+
+The current code defines W1 clock gate to be at 0x1cc, overlaying it
+with the IR gate.
+
+Clock gate for r-apb1-w1 is at 0x1ec. This fixes issues with IR receiver
+causing interrupt floods on H6 (because interrupt flags can't be cleared,
+due to IR module's bus being disabled).
+
+Fixes: b7c7b05065aa77ae ("clk: sunxi-ng: add support for H6 PRCM CCU")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Acked-by: Clément Péron <peron.clem@gmail.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+index 27554eaf69298..8d05d4f1f8a1e 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+@@ -104,7 +104,7 @@ static SUNXI_CCU_GATE(r_apb2_i2c_clk,	"r-apb2-i2c",	"r-apb2",
+ static SUNXI_CCU_GATE(r_apb1_ir_clk,	"r-apb1-ir",	"r-apb1",
+ 		      0x1cc, BIT(0), 0);
+ static SUNXI_CCU_GATE(r_apb1_w1_clk,	"r-apb1-w1",	"r-apb1",
+-		      0x1cc, BIT(0), 0);
++		      0x1ec, BIT(0), 0);
+ 
+ /* Information of IR(RX) mod clock is gathered from BSP source code */
+ static const char * const r_mod0_default_parents[] = { "osc32k", "osc24M" };
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch b/queue-4.19/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
new file mode 100644
index 00000000000..ce536d1f0f1
--- /dev/null
+++ b/queue-4.19/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
@@ -0,0 +1,39 @@
+From af99631ca179befdf7b68ee834e4662a209b6b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 11:23:04 +0800
+Subject: clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ]
+
+The PLL-MIPI clock is somewhat special as it has its own LDOs which
+need to be turned on for this PLL to actually work and output a clock
+signal.
+
+Add the 2 LDO enable bits to the gate bits.
+
+Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+index a4fa2945f2302..4b5f8f4e4ab8c 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+@@ -144,7 +144,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
+ 				    8, 4,		/* N */
+ 				    4, 2,		/* K */
+ 				    0, 4,		/* M */
+-				    BIT(31),		/* gate */
++				    BIT(31) | BIT(23) | BIT(22), /* gate */
+ 				    BIT(28),		/* lock */
+ 				    CLK_SET_RATE_UNGATE);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch b/queue-4.19/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch
new file mode 100644
index 00000000000..b905d542cfb
--- /dev/null
+++ b/queue-4.19/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch
@@ -0,0 +1,114 @@
+From 8c85bf0f6fce63f78ac801b72cd1eef9705ae01d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jul 2019 11:46:28 +0800
+Subject: clk: sunxi-ng: v3s: add the missing PLL_DDR1
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit c5ed9475c22c89d5409402055142372e35d26a3f ]
+
+The user manual of V3/V3s/S3 declares a PLL_DDR1, however it's forgot
+when developing the V3s CCU driver.
+
+Add back the missing PLL_DDR1.
+
+Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 19 +++++++++++++++----
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.h |  6 ++++--
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index 9e3f4088724b4..c7f9d974b10d5 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -84,7 +84,7 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_ve_clk, "pll-ve",
+ 					BIT(28),	/* lock */
+ 					0);
+ 
+-static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr_clk, "pll-ddr",
++static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr0_clk, "pll-ddr0",
+ 				    "osc24M", 0x020,
+ 				    8, 5,	/* N */
+ 				    4, 2,	/* K */
+@@ -123,6 +123,14 @@ static SUNXI_CCU_NK_WITH_GATE_LOCK_POSTDIV(pll_periph1_clk, "pll-periph1",
+ 					   2,		/* post-div */
+ 					   0);
+ 
++static SUNXI_CCU_NM_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1",
++				   "osc24M", 0x04c,
++				   8, 7,	/* N */
++				   0, 2,	/* M */
++				   BIT(31),	/* gate */
++				   BIT(28),	/* lock */
++				   0);
++
+ static const char * const cpu_parents[] = { "osc32k", "osc24M",
+ 					     "pll-cpu", "pll-cpu" };
+ static SUNXI_CCU_MUX(cpu_clk, "cpu", cpu_parents,
+@@ -310,7 +318,8 @@ static SUNXI_CCU_GATE(usb_phy0_clk,	"usb-phy0",	"osc24M",
+ static SUNXI_CCU_GATE(usb_ohci0_clk,	"usb-ohci0",	"osc24M",
+ 		      0x0cc, BIT(16), 0);
+ 
+-static const char * const dram_parents[] = { "pll-ddr", "pll-periph0-2x" };
++static const char * const dram_parents[] = { "pll-ddr0", "pll-ddr1",
++					     "pll-periph0-2x" };
+ static SUNXI_CCU_M_WITH_MUX(dram_clk, "dram", dram_parents,
+ 			    0x0f4, 0, 4, 20, 2, CLK_IS_CRITICAL);
+ 
+@@ -369,10 +378,11 @@ static struct ccu_common *sun8i_v3s_ccu_clks[] = {
+ 	&pll_audio_base_clk.common,
+ 	&pll_video_clk.common,
+ 	&pll_ve_clk.common,
+-	&pll_ddr_clk.common,
++	&pll_ddr0_clk.common,
+ 	&pll_periph0_clk.common,
+ 	&pll_isp_clk.common,
+ 	&pll_periph1_clk.common,
++	&pll_ddr1_clk.common,
+ 	&cpu_clk.common,
+ 	&axi_clk.common,
+ 	&ahb1_clk.common,
+@@ -457,11 +467,12 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
+ 		[CLK_PLL_AUDIO_8X]	= &pll_audio_8x_clk.hw,
+ 		[CLK_PLL_VIDEO]		= &pll_video_clk.common.hw,
+ 		[CLK_PLL_VE]		= &pll_ve_clk.common.hw,
+-		[CLK_PLL_DDR]		= &pll_ddr_clk.common.hw,
++		[CLK_PLL_DDR0]		= &pll_ddr0_clk.common.hw,
+ 		[CLK_PLL_PERIPH0]	= &pll_periph0_clk.common.hw,
+ 		[CLK_PLL_PERIPH0_2X]	= &pll_periph0_2x_clk.hw,
+ 		[CLK_PLL_ISP]		= &pll_isp_clk.common.hw,
+ 		[CLK_PLL_PERIPH1]	= &pll_periph1_clk.common.hw,
++		[CLK_PLL_DDR1]		= &pll_ddr1_clk.common.hw,
+ 		[CLK_CPU]		= &cpu_clk.common.hw,
+ 		[CLK_AXI]		= &axi_clk.common.hw,
+ 		[CLK_AHB1]		= &ahb1_clk.common.hw,
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+index 4a4d36fdad960..a091b7217dfd5 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+@@ -29,7 +29,7 @@
+ #define CLK_PLL_AUDIO_8X	5
+ #define CLK_PLL_VIDEO		6
+ #define CLK_PLL_VE		7
+-#define CLK_PLL_DDR		8
++#define CLK_PLL_DDR0		8
+ #define CLK_PLL_PERIPH0		9
+ #define CLK_PLL_PERIPH0_2X	10
+ #define CLK_PLL_ISP		11
+@@ -58,6 +58,8 @@
+ 
+ /* And the GPU module clock is exported */
+ 
+-#define CLK_NUMBER		(CLK_MIPI_CSI + 1)
++#define CLK_PLL_DDR1		74
++
++#define CLK_NUMBER		(CLK_PLL_DDR1 + 1)
+ 
+ #endif /* _CCU_SUN8I_H3_H_ */
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-ti-fix-refcount-leak-in-ti_dt_clocks_register.patch b/queue-4.19/clk-ti-fix-refcount-leak-in-ti_dt_clocks_register.patch
new file mode 100644
index 00000000000..5559dd4ec1f
--- /dev/null
+++ b/queue-4.19/clk-ti-fix-refcount-leak-in-ti_dt_clocks_register.patch
@@ -0,0 +1,44 @@
+From e382e0e04f5573d48f3cf128db5fc205eba62a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:21:31 -0500
+Subject: clk: ti: fix refcount leak in ti_dt_clocks_register()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 2274d8001fbb5e1942fbcab5ad2eb15553b09ed2 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 5b385a45e001 ("clk: ti: add support for clkctrl aliases")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c
+index 27e0979b31586..0cc87c6ae91c9 100644
+--- a/drivers/clk/ti/clk.c
++++ b/drivers/clk/ti/clk.c
+@@ -188,9 +188,13 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[])
+ 			clkdev_add(&c->lk);
+ 		} else {
+ 			if (num_args && !has_clkctrl_data) {
+-				if (of_find_compatible_node(NULL, NULL,
+-							    "ti,clkctrl")) {
++				struct device_node *np;
++
++				np = of_find_compatible_node(NULL, NULL,
++							     "ti,clkctrl");
++				if (np) {
+ 					has_clkctrl_data = true;
++					of_node_put(np);
+ 				} else {
+ 					clkctrl_nodes_missing = true;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch b/queue-4.19/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
new file mode 100644
index 00000000000..2dfb6ed72bd
--- /dev/null
+++ b/queue-4.19/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
@@ -0,0 +1,36 @@
+From 2a6f8394c6b5ae50ebc73361f62da69acc38540c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:59:36 -0500
+Subject: clk: vf610: fix refcount leak in vf610_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-vf610.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
+index 6dae54325a91d..a334667c450a1 100644
+--- a/drivers/clk/imx/clk-vf610.c
++++ b/drivers/clk/imx/clk-vf610.c
+@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
+ 	np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
+ 	anatop_base = of_iomap(np, 0);
+ 	BUG_ON(!anatop_base);
++	of_node_put(np);
+ 
+ 	np = ccm_node;
+ 	ccm_base = of_iomap(np, 0);
+-- 
+2.20.1
+
diff --git a/queue-4.19/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch b/queue-4.19/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
new file mode 100644
index 00000000000..4bb6e1d8dfd
--- /dev/null
+++ b/queue-4.19/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
@@ -0,0 +1,53 @@
+From ef9fea950d6e6d2d3507b359db5365a25b1d7c87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 11:57:04 +0200
+Subject: clocksource/drivers/exynos_mct: Fix error path in timer resources
+ initialization
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ]
+
+While freeing interrupt handlers in error path, don't assume that all
+requested interrupts are per-processor interrupts and properly release
+standard interrupts too.
+
+Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/exynos_mct.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index aaf5bfa9bd9c9..e3ae041ac30e1 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
+ 	return 0;
+ 
+ out_irq:
+-	free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++	if (mct_int_type == MCT_INT_PPI) {
++		free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++	} else {
++		for_each_possible_cpu(cpu) {
++			struct mct_clock_event_device *pcpu_mevt =
++				per_cpu_ptr(&percpu_mct_tick, cpu);
++
++			if (pcpu_mevt->evt.irq != -1) {
++				free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
++				pcpu_mevt->evt.irq = -1;
++			}
++		}
++	}
+ 	return err;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch b/queue-4.19/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
new file mode 100644
index 00000000000..23e5a517c1b
--- /dev/null
+++ b/queue-4.19/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
@@ -0,0 +1,58 @@
+From 5eebcce9828771e04eaaeb0291246aefb8125cac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 14:22:07 +0800
+Subject: clocksource/drivers/sun5i: Fail gracefully when clock rate is
+ unavailable
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]
+
+If the clock tree is not fully populated when the timer-sun5i init code
+is called, attempts to get the clock rate for the timer would fail and
+return 0.
+
+Make the init code for both clock events and clocksource check the
+returned clock rate and fail gracefully if the result is 0, instead of
+causing a divide by 0 exception later on.
+
+Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-sun5i.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 3b56ea3f52afc..552c5254390cb 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -202,6 +202,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
+ 	}
+ 
+ 	rate = clk_get_rate(clk);
++	if (!rate) {
++		pr_err("Couldn't get parent clock rate\n");
++		ret = -EINVAL;
++		goto err_disable_clk;
++	}
+ 
+ 	cs->timer.base = base;
+ 	cs->timer.clk = clk;
+@@ -275,6 +280,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
+ 	}
+ 
+ 	rate = clk_get_rate(clk);
++	if (!rate) {
++		pr_err("Couldn't get parent clock rate\n");
++		ret = -EINVAL;
++		goto err_disable_clk;
++	}
+ 
+ 	ce->timer.base = base;
+ 	ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+-- 
+2.20.1
+
diff --git a/queue-4.19/coresight-catu-fix-clang-build-warning.patch b/queue-4.19/coresight-catu-fix-clang-build-warning.patch
new file mode 100644
index 00000000000..a5523cb8792
--- /dev/null
+++ b/queue-4.19/coresight-catu-fix-clang-build-warning.patch
@@ -0,0 +1,78 @@
+From 093e70e7749e2271b9f5336c1e07badcfd575ff4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Apr 2019 13:52:39 -0600
+Subject: coresight: catu: fix clang build warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 59d63de076607a9334b11628b5c3ddda1d8f56cd ]
+
+Clang points out a syntax error, as the etr_catu_buf_ops structure is
+declared 'static' before the type is known:
+
+In file included from drivers/hwtracing/coresight/coresight-tmc-etr.c:12:
+drivers/hwtracing/coresight/coresight-catu.h:116:40: warning: tentative definition of variable with internal linkage has incomplete non-array type 'const struct etr_buf_operations' [-Wtentative-definition-incomplete-type]
+static const struct etr_buf_operations etr_catu_buf_ops;
+                                       ^
+drivers/hwtracing/coresight/coresight-catu.h:116:21: note: forward declaration of 'struct etr_buf_operations'
+static const struct etr_buf_operations etr_catu_buf_ops;
+
+This seems worth fixing in the code, so replace pointer to the empty
+constant structure with a NULL pointer. We need an extra NULL pointer
+check here, but the result should be better object code otherwise,
+avoiding the silly empty structure.
+
+Fixes: 434d611cddef ("coresight: catu: Plug in CATU as a backend for ETR buffer")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+[Fixed line over 80 characters]
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-catu.h    | 5 -----
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +++--
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-catu.h b/drivers/hwtracing/coresight/coresight-catu.h
+index 1b281f0dcccca..1d2ad183fd92d 100644
+--- a/drivers/hwtracing/coresight/coresight-catu.h
++++ b/drivers/hwtracing/coresight/coresight-catu.h
+@@ -109,11 +109,6 @@ static inline bool coresight_is_catu_device(struct coresight_device *csdev)
+ 	return true;
+ }
+ 
+-#ifdef CONFIG_CORESIGHT_CATU
+ extern const struct etr_buf_operations etr_catu_buf_ops;
+-#else
+-/* Dummy declaration for the CATU ops */
+-static const struct etr_buf_operations etr_catu_buf_ops;
+-#endif
+ 
+ #endif
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 2d6f428176ff8..3b684687b5a7d 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -747,7 +747,8 @@ static inline void tmc_etr_disable_catu(struct tmc_drvdata *drvdata)
+ static const struct etr_buf_operations *etr_buf_ops[] = {
+ 	[ETR_MODE_FLAT] = &etr_flat_buf_ops,
+ 	[ETR_MODE_ETR_SG] = &etr_sg_buf_ops,
+-	[ETR_MODE_CATU] = &etr_catu_buf_ops,
++	[ETR_MODE_CATU] = IS_ENABLED(CONFIG_CORESIGHT_CATU)
++						? &etr_catu_buf_ops : NULL,
+ };
+ 
+ static inline int tmc_etr_mode_alloc_buf(int mode,
+@@ -761,7 +762,7 @@ static inline int tmc_etr_mode_alloc_buf(int mode,
+ 	case ETR_MODE_FLAT:
+ 	case ETR_MODE_ETR_SG:
+ 	case ETR_MODE_CATU:
+-		if (etr_buf_ops[mode]->alloc)
++		if (etr_buf_ops[mode] && etr_buf_ops[mode]->alloc)
+ 			rc = etr_buf_ops[mode]->alloc(drvdata, etr_buf,
+ 						      node, pages);
+ 		if (!rc)
+-- 
+2.20.1
+
diff --git a/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch
new file mode 100644
index 00000000000..0936f15f486
--- /dev/null
+++ b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch
@@ -0,0 +1,40 @@
+From 924cf77ac4707071b913f06bef92e0489588ad99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:45:46 -0700
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix initial command check
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 22a26cc6a51ef73dcfeb64c50513903f6b2d53d8 ]
+
+There is a logical error in brcm_avs_is_firmware_loaded() whereby if the
+firmware returns -EINVAL, we will be reporting this as an error. The
+comment is correct, the code was not.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index e6f9cbe5835f9..6ed53ca8aa980 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -446,8 +446,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
+ 	rc = brcm_avs_get_pmap(priv, NULL);
+ 	magic = readl(priv->base + AVS_MBOX_MAGIC);
+ 
+-	return (magic == AVS_FIRMWARE_MAGIC) && (rc != -ENOTSUPP) &&
+-		(rc != -EINVAL);
++	return (magic == AVS_FIRMWARE_MAGIC) && ((rc != -ENOTSUPP) ||
++		(rc != -EINVAL));
+ }
+ 
+ static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
+-- 
+2.20.1
+
diff --git a/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch
new file mode 100644
index 00000000000..2ab4d104224
--- /dev/null
+++ b/queue-4.19/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch
@@ -0,0 +1,61 @@
+From f950724e77c8cb9633a4067a5bc1ba5971ef07fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:45:47 -0700
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 4c5681fcc684c762b09435de3e82ffeee7769d21 ]
+
+What we read back from the register is going to be capped at 32-bits,
+and cpufreq_freq_table.frequency is an unsigned int. Avoid any possible
+value truncation by using the appropriate return value.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 6ed53ca8aa980..77b0e5d0fb134 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -384,12 +384,12 @@ static int brcm_avs_set_pstate(struct private_data *priv, unsigned int pstate)
+ 	return __issue_avs_command(priv, AVS_CMD_SET_PSTATE, true, args);
+ }
+ 
+-static unsigned long brcm_avs_get_voltage(void __iomem *base)
++static u32 brcm_avs_get_voltage(void __iomem *base)
+ {
+ 	return readl(base + AVS_MBOX_VOLTAGE1);
+ }
+ 
+-static unsigned long brcm_avs_get_frequency(void __iomem *base)
++static u32 brcm_avs_get_frequency(void __iomem *base)
+ {
+ 	return readl(base + AVS_MBOX_FREQUENCY) * 1000;	/* in kHz */
+ }
+@@ -653,14 +653,14 @@ static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
+ {
+ 	struct private_data *priv = policy->driver_data;
+ 
+-	return sprintf(buf, "0x%08lx\n", brcm_avs_get_voltage(priv->base));
++	return sprintf(buf, "0x%08x\n", brcm_avs_get_voltage(priv->base));
+ }
+ 
+ static ssize_t show_brcm_avs_frequency(struct cpufreq_policy *policy, char *buf)
+ {
+ 	struct private_data *priv = policy->driver_data;
+ 
+-	return sprintf(buf, "0x%08lx\n", brcm_avs_get_frequency(priv->base));
++	return sprintf(buf, "0x%08x\n", brcm_avs_get_frequency(priv->base));
+ }
+ 
+ cpufreq_freq_attr_ro(brcm_avs_pstate);
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-brcm-fix-some-set-but-not-used-warning.patch b/queue-4.19/crypto-brcm-fix-some-set-but-not-used-warning.patch
new file mode 100644
index 00000000000..0bf5db8b05f
--- /dev/null
+++ b/queue-4.19/crypto-brcm-fix-some-set-but-not-used-warning.patch
@@ -0,0 +1,65 @@
+From 768b5c909141048a99bb4ec8c6e17f4bc5ecb953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jan 2019 06:11:18 +0000
+Subject: crypto: brcm - Fix some set-but-not-used warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 707d0cf8f7cff6dfee9197002859912310532c4f ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req':
+drivers/crypto/bcm/cipher.c:720:15: warning:
+ variable 'chunk_start' set but not used [-Wunused-but-set-variable]
+
+drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback':
+drivers/crypto/bcm/cipher.c:1679:31: warning:
+ variable 'areq' set but not used [-Wunused-but-set-variable]
+
+drivers/crypto/bcm/cipher.c:1678:22: warning:
+ variable 'ctx' set but not used [-Wunused-but-set-variable]
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 49c0097fa4749..0b1fc5664b1d8 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -717,7 +717,7 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
+ 	 */
+ 	unsigned int new_data_len;
+ 
+-	unsigned int chunk_start = 0;
++	unsigned int __maybe_unused chunk_start = 0;
+ 	u32 db_size;	 /* Length of data field, incl gcm and hash padding */
+ 	int pad_len = 0; /* total pad len, including gcm, hash, stat padding */
+ 	u32 data_pad_len = 0;	/* length of GCM/CCM padding */
+@@ -1675,8 +1675,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
+ 	struct spu_hw *spu = &iproc_priv.spu;
+ 	struct brcm_message *mssg = msg;
+ 	struct iproc_reqctx_s *rctx;
+-	struct iproc_ctx_s *ctx;
+-	struct crypto_async_request *areq;
+ 	int err = 0;
+ 
+ 	rctx = mssg->ctx;
+@@ -1686,8 +1684,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
+ 		err = -EFAULT;
+ 		goto cb_finish;
+ 	}
+-	areq = rctx->parent;
+-	ctx = rctx->ctx;
+ 
+ 	/* process the SPU status */
+ 	err = spu->spu_status_process(rctx->msg_buf.rx_stat);
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch b/queue-4.19/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch
new file mode 100644
index 00000000000..64926a0dbac
--- /dev/null
+++ b/queue-4.19/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch
@@ -0,0 +1,40 @@
+From 555f749e02d8e650d8d6c9faf40ec198fb3aeac0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 May 2019 16:37:03 +0300
+Subject: crypto: caam - fix caam_dump_sg that iterates through scatterlist
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit 8c65d35435e8cbfdf953cafe5ebe3648ee9276a2 ]
+
+Fix caam_dump_sg by correctly determining the next scatterlist
+entry in the list.
+
+Fixes: 5ecf8ef9103c ("crypto: caam - fix sg dump")
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/error.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 8da88beb1abbe..832ba2afdcd57 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -22,7 +22,7 @@ void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
+ 	size_t len;
+ 	void *buf;
+ 
+-	for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
++	for (it = sg; it && tlen > 0 ; it = sg_next(it)) {
+ 		/*
+ 		 * make sure the scatterlist's page
+ 		 * has a valid virtual memory mapping
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-caam-free-resources-in-case-caam_rng-registra.patch b/queue-4.19/crypto-caam-free-resources-in-case-caam_rng-registra.patch
new file mode 100644
index 00000000000..c1b6522ba69
--- /dev/null
+++ b/queue-4.19/crypto-caam-free-resources-in-case-caam_rng-registra.patch
@@ -0,0 +1,40 @@
+From 8e98987055b0f9019ed7b3882a0a82419fe9ea07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 16:08:12 +0300
+Subject: crypto: caam - free resources in case caam_rng registration failed
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ]
+
+Check the return value of the hardware registration for caam_rng and free
+resources in case of failure.
+
+Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support")
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamrng.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index fde07d4ff0190..ff6718a11e9ec 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -353,7 +353,10 @@ static int __init caam_rng_init(void)
+ 		goto free_rng_ctx;
+ 
+ 	dev_info(dev, "registering rng-caam\n");
+-	return hwrng_register(&caam_rng);
++
++	err = hwrng_register(&caam_rng);
++	if (!err)
++		return err;
+ 
+ free_rng_ctx:
+ 	kfree(rng_ctx);
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch b/queue-4.19/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch
new file mode 100644
index 00000000000..95f1d870337
--- /dev/null
+++ b/queue-4.19/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch
@@ -0,0 +1,77 @@
+From fdd83f8adaa755c2cb53915b4dacecf0d6c4cdd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 21:53:30 +0000
+Subject: crypto: ccp - Fix 3DES complaint from ccp-crypto module
+
+From: Hook, Gary <Gary.Hook@amd.com>
+
+[ Upstream commit 89646fdda4cae203185444ac7988835f36a21ee1 ]
+
+Crypto self-tests reveal an error:
+
+alg: skcipher: cbc-des3-ccp encryption test failed (wrong output IV) on test vector 0, cfg="in-place"
+
+The offset value should not be recomputed when retrieving the context.
+Also, a code path exists which makes decisions based on older (version 3)
+hardware; a v3 device deosn't support 3DES so remove this check.
+
+Fixes: 990672d48515 ('crypto: ccp - Enable 3DES function on v5 CCPs')
+
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 1e2e42106dee0..4b48b8523a40c 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -1293,6 +1293,9 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ 	int ret;
+ 
+ 	/* Error checks */
++	if (cmd_q->ccp->vdata->version < CCP_VERSION(5, 0))
++		return -EINVAL;
++
+ 	if (!cmd_q->ccp->vdata->perform->des3)
+ 		return -EINVAL;
+ 
+@@ -1375,8 +1378,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ 	 * passthru option to convert from big endian to little endian.
+ 	 */
+ 	if (des3->mode != CCP_DES3_MODE_ECB) {
+-		u32 load_mode;
+-
+ 		op.sb_ctx = cmd_q->sb_ctx;
+ 
+ 		ret = ccp_init_dm_workarea(&ctx, cmd_q,
+@@ -1392,12 +1393,8 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ 		if (ret)
+ 			goto e_ctx;
+ 
+-		if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+-			load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
+-		else
+-			load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
+ 		ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
+-				     load_mode);
++				     CCP_PASSTHRU_BYTESWAP_256BIT);
+ 		if (ret) {
+ 			cmd->engine_error = cmd_q->cmd_error;
+ 			goto e_ctx;
+@@ -1459,10 +1456,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ 		}
+ 
+ 		/* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
+-		if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+-			dm_offset = CCP_SB_BYTES - des3->iv_len;
+-		else
+-			dm_offset = 0;
+ 		ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
+ 				DES3_EDE_BLOCK_SIZE);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch b/queue-4.19/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
new file mode 100644
index 00000000000..54857d98ebd
--- /dev/null
+++ b/queue-4.19/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
@@ -0,0 +1,63 @@
+From 96e69389bc8e2a6396646c18061bedaee7e3bbc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 21:53:23 +0000
+Subject: crypto: ccp - fix AES CFB error exposed by new test vectors
+
+From: Hook, Gary <Gary.Hook@amd.com>
+
+[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ]
+
+Updated testmgr will exhibit this error message when loading the
+ccp-crypto module:
+
+alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place"
+
+Update the CCP crypto driver to correctly treat CFB as a streaming mode
+cipher (instead of block mode). Update the configuration for CFB to
+specify the block size as a single byte;
+
+Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support')
+
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
+index 89291c15015cd..3f768699332ba 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes.c
+@@ -1,7 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0
+ /*
+  * AMD Cryptographic Coprocessor (CCP) AES crypto API support
+  *
+- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
++ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
+  *
+  * Author: Tom Lendacky <thomas.lendacky@amd.com>
+  *
+@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
+ 		return -EINVAL;
+ 
+ 	if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
+-	     (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
+-	     (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
++	     (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
+ 	    (req->nbytes & (AES_BLOCK_SIZE - 1)))
+ 		return -EINVAL;
+ 
+@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
+ 		.version	= CCP_VERSION(3, 0),
+ 		.name		= "cfb(aes)",
+ 		.driver_name	= "cfb-aes-ccp",
+-		.blocksize	= AES_BLOCK_SIZE,
++		.blocksize	= 1,
+ 		.ivsize		= AES_BLOCK_SIZE,
+ 		.alg_defaults	= &ccp_aes_defaults,
+ 	},
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-ccp-reduce-maximum-stack-usage.patch b/queue-4.19/crypto-ccp-reduce-maximum-stack-usage.patch
new file mode 100644
index 00000000000..60389e13ce8
--- /dev/null
+++ b/queue-4.19/crypto-ccp-reduce-maximum-stack-usage.patch
@@ -0,0 +1,178 @@
+From 59224eac7a638a315eefcd516ea32692dad82091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 10:59:24 +0200
+Subject: crypto: ccp - Reduce maximum stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 72c8117adfced37df101c8c0b3f363e0906f83f0 ]
+
+Each of the operations in ccp_run_cmd() needs several hundred
+bytes of kernel stack. Depending on the inlining, these may
+need separate stack slots that add up to more than the warning
+limit, as shown in this clang based build:
+
+drivers/crypto/ccp/ccp-ops.c:871:12: error: stack frame size of 1164 bytes in function 'ccp_run_aes_cmd' [-Werror,-Wframe-larger-than=]
+static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+
+The problem may also happen when there is no warning, e.g. in the
+ccp_run_cmd()->ccp_run_aes_cmd()->ccp_run_aes_gcm_cmd() call chain with
+over 2000 bytes.
+
+Mark each individual function as 'noinline_for_stack' to prevent
+this from happening, and move the calls to the two special cases for aes
+into the top-level function. This will keep the actual combined stack
+usage to the mimimum: 828 bytes for ccp_run_aes_gcm_cmd() and
+at most 524 bytes for each of the other cases.
+
+Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 52 +++++++++++++++++++++---------------
+ 1 file changed, 31 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 4b48b8523a40c..330853a2702f0 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -458,8 +458,8 @@ static int ccp_copy_from_sb(struct ccp_cmd_queue *cmd_q,
+ 	return ccp_copy_to_from_sb(cmd_q, wa, jobid, sb, byte_swap, true);
+ }
+ 
+-static int ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q,
+-				struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_aes_engine *aes = &cmd->u.aes;
+ 	struct ccp_dm_workarea key, ctx;
+@@ -614,8 +614,8 @@ e_key:
+ 	return ret;
+ }
+ 
+-static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+-			       struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_aes_engine *aes = &cmd->u.aes;
+ 	struct ccp_dm_workarea key, ctx, final_wa, tag;
+@@ -897,7 +897,8 @@ e_key:
+ 	return ret;
+ }
+ 
+-static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_aes_engine *aes = &cmd->u.aes;
+ 	struct ccp_dm_workarea key, ctx;
+@@ -907,12 +908,6 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ 	bool in_place = false;
+ 	int ret;
+ 
+-	if (aes->mode == CCP_AES_MODE_CMAC)
+-		return ccp_run_aes_cmac_cmd(cmd_q, cmd);
+-
+-	if (aes->mode == CCP_AES_MODE_GCM)
+-		return ccp_run_aes_gcm_cmd(cmd_q, cmd);
+-
+ 	if (!((aes->key_len == AES_KEYSIZE_128) ||
+ 	      (aes->key_len == AES_KEYSIZE_192) ||
+ 	      (aes->key_len == AES_KEYSIZE_256)))
+@@ -1080,8 +1075,8 @@ e_key:
+ 	return ret;
+ }
+ 
+-static int ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q,
+-			       struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_xts_aes_engine *xts = &cmd->u.xts;
+ 	struct ccp_dm_workarea key, ctx;
+@@ -1280,7 +1275,8 @@ e_key:
+ 	return ret;
+ }
+ 
+-static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_des3_engine *des3 = &cmd->u.des3;
+ 
+@@ -1476,7 +1472,8 @@ e_key:
+ 	return ret;
+ }
+ 
+-static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_sha_engine *sha = &cmd->u.sha;
+ 	struct ccp_dm_workarea ctx;
+@@ -1820,7 +1817,8 @@ e_ctx:
+ 	return ret;
+ }
+ 
+-static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_rsa_engine *rsa = &cmd->u.rsa;
+ 	struct ccp_dm_workarea exp, src, dst;
+@@ -1951,8 +1949,8 @@ e_sb:
+ 	return ret;
+ }
+ 
+-static int ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q,
+-				struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_passthru_engine *pt = &cmd->u.passthru;
+ 	struct ccp_dm_workarea mask;
+@@ -2083,7 +2081,8 @@ e_mask:
+ 	return ret;
+ }
+ 
+-static int ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
++static noinline_for_stack int
++ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
+ 				      struct ccp_cmd *cmd)
+ {
+ 	struct ccp_passthru_nomap_engine *pt = &cmd->u.passthru_nomap;
+@@ -2424,7 +2423,8 @@ e_src:
+ 	return ret;
+ }
+ 
+-static int ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ 	struct ccp_ecc_engine *ecc = &cmd->u.ecc;
+ 
+@@ -2461,7 +2461,17 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ 
+ 	switch (cmd->engine) {
+ 	case CCP_ENGINE_AES:
+-		ret = ccp_run_aes_cmd(cmd_q, cmd);
++		switch (cmd->u.aes.mode) {
++		case CCP_AES_MODE_CMAC:
++			ret = ccp_run_aes_cmac_cmd(cmd_q, cmd);
++			break;
++		case CCP_AES_MODE_GCM:
++			ret = ccp_run_aes_gcm_cmd(cmd_q, cmd);
++			break;
++		default:
++			ret = ccp_run_aes_cmd(cmd_q, cmd);
++			break;
++		}
+ 		break;
+ 	case CCP_ENGINE_XTS_AES_128:
+ 		ret = ccp_run_xts_aes_cmd(cmd_q, cmd);
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-ccree-reduce-kernel-stack-usage-with-clang.patch b/queue-4.19/crypto-ccree-reduce-kernel-stack-usage-with-clang.patch
new file mode 100644
index 00000000000..4c2a3da1691
--- /dev/null
+++ b/queue-4.19/crypto-ccree-reduce-kernel-stack-usage-with-clang.patch
@@ -0,0 +1,52 @@
+From 057a2448ea787f49f817dbe1b935c62f7729aa3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2019 10:09:44 +0100
+Subject: crypto: ccree - reduce kernel stack usage with clang
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 5db46ac29a6797541943d3c4081821747e342732 ]
+
+Building with clang for a 32-bit architecture runs over the stack
+frame limit in the setkey function:
+
+drivers/crypto/ccree/cc_cipher.c:318:12: error: stack frame size of 1152 bytes in function 'cc_cipher_setkey' [-Werror,-Wframe-larger-than=]
+
+The problem is that there are two large variables: the temporary
+'tmp' array and the SHASH_DESC_ON_STACK() declaration. Moving
+the first into the block in which it is used reduces the
+total frame size to 768 bytes, which seems more reasonable
+and is under the warning limit.
+
+Fixes: 63ee04c8b491 ("crypto: ccree - add skcipher support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-By: Gilad Ben-Yossef <gilad@benyossef.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_cipher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c
+index 54a39164aab8f..28a5b8b38fa2f 100644
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -306,7 +306,6 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
+ 	struct crypto_tfm *tfm = crypto_skcipher_tfm(sktfm);
+ 	struct cc_cipher_ctx *ctx_p = crypto_tfm_ctx(tfm);
+ 	struct device *dev = drvdata_to_dev(ctx_p->drvdata);
+-	u32 tmp[DES3_EDE_EXPKEY_WORDS];
+ 	struct cc_crypto_alg *cc_alg =
+ 			container_of(tfm->__crt_alg, struct cc_crypto_alg,
+ 				     skcipher_alg.base);
+@@ -332,6 +331,7 @@ static int cc_cipher_setkey(struct crypto_skcipher *sktfm, const u8 *key,
+ 	 * HW does the expansion on its own.
+ 	 */
+ 	if (ctx_p->flow_mode == S_DIN_to_DES) {
++		u32 tmp[DES3_EDE_EXPKEY_WORDS];
+ 		if (keylen == DES3_EDE_KEY_SIZE &&
+ 		    __des3_ede_setkey(tmp, &tfm->crt_flags, key,
+ 				      DES3_EDE_KEY_SIZE)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch b/queue-4.19/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
new file mode 100644
index 00000000000..58afde588f6
--- /dev/null
+++ b/queue-4.19/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
@@ -0,0 +1,49 @@
+From 93b237dcb1d5b52e7d140696e2792622e205259b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 11:24:18 +0000
+Subject: crypto: crypto4xx - Fix wrong
+ ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ]
+
+When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
+drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
+drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
+In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
+drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
+drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
+drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
+In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
+drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
+
+This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.
+
+Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
+index 931d22531f515..7bbda51b7337c 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.h
++++ b/drivers/crypto/amcc/crypto4xx_trng.h
+@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
+ void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
+ #else
+ static inline void ppc4xx_trng_probe(
+-	struct crypto4xx_device *dev __maybe_unused) { }
++	struct crypto4xx_core_device *dev __maybe_unused) { }
+ static inline void ppc4xx_trng_remove(
+-	struct crypto4xx_device *dev __maybe_unused) { }
++	struct crypto4xx_core_device *dev __maybe_unused) { }
+ #endif
+ 
+ #endif
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-hisilicon-matching-the-dma-address-for-dma_po.patch b/queue-4.19/crypto-hisilicon-matching-the-dma-address-for-dma_po.patch
new file mode 100644
index 00000000000..a2d4ed7497b
--- /dev/null
+++ b/queue-4.19/crypto-hisilicon-matching-the-dma-address-for-dma_po.patch
@@ -0,0 +1,93 @@
+From e2e2f0ee67cc20993473005359b361bfb36738e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Sep 2019 17:31:14 +0800
+Subject: crypto: hisilicon - Matching the dma address for dma_pool_free()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit e00371af1d4ce73d527d8ee69fda2febaf5a42c2 ]
+
+When dma_pool_zalloc() fail in sec_alloc_and_fill_hw_sgl(),
+dma_pool_free() is invoked, but the parameters that sgl_current and
+sgl_current->next_sgl is not match.
+
+Using sec_free_hw_sgl() instead of the original free routine.
+
+Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver")
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec/sec_algs.c | 44 +++++++++++--------------
+ 1 file changed, 19 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index db2983c51f1e6..bf9658800bda5 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -153,6 +153,24 @@ static void sec_alg_skcipher_init_context(struct crypto_skcipher *atfm,
+ 				       ctx->cipher_alg);
+ }
+ 
++static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
++			    dma_addr_t psec_sgl, struct sec_dev_info *info)
++{
++	struct sec_hw_sgl *sgl_current, *sgl_next;
++	dma_addr_t sgl_next_dma;
++
++	sgl_current = hw_sgl;
++	while (sgl_current) {
++		sgl_next = sgl_current->next;
++		sgl_next_dma = sgl_current->next_sgl;
++
++		dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
++
++		sgl_current = sgl_next;
++		psec_sgl = sgl_next_dma;
++	}
++}
++
+ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
+ 				     dma_addr_t *psec_sgl,
+ 				     struct scatterlist *sgl,
+@@ -199,36 +217,12 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl,
+ 	return 0;
+ 
+ err_free_hw_sgls:
+-	sgl_current = *sec_sgl;
+-	while (sgl_current) {
+-		sgl_next = sgl_current->next;
+-		dma_pool_free(info->hw_sgl_pool, sgl_current,
+-			      sgl_current->next_sgl);
+-		sgl_current = sgl_next;
+-	}
++	sec_free_hw_sgl(*sec_sgl, *psec_sgl, info);
+ 	*psec_sgl = 0;
+ 
+ 	return ret;
+ }
+ 
+-static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
+-			    dma_addr_t psec_sgl, struct sec_dev_info *info)
+-{
+-	struct sec_hw_sgl *sgl_current, *sgl_next;
+-	dma_addr_t sgl_next_dma;
+-
+-	sgl_current = hw_sgl;
+-	while (sgl_current) {
+-		sgl_next = sgl_current->next;
+-		sgl_next_dma = sgl_current->next_sgl;
+-
+-		dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
+-
+-		sgl_current = sgl_next;
+-		psec_sgl = sgl_next_dma;
+-	}
+-}
+-
+ static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,
+ 				   const u8 *key, unsigned int keylen,
+ 				   enum sec_cipher_alg alg)
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-inside-secure-fix-queued-len-computation.patch b/queue-4.19/crypto-inside-secure-fix-queued-len-computation.patch
new file mode 100644
index 00000000000..dbdd3eaf9d0
--- /dev/null
+++ b/queue-4.19/crypto-inside-secure-fix-queued-len-computation.patch
@@ -0,0 +1,44 @@
+From 9577776a1b3cd6a36dc5bc4944418d33ac2b6c1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 16:51:02 +0200
+Subject: crypto: inside-secure - fix queued len computation
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit ccd65a206a5025cf953a2e4f37e894921b131a5c ]
+
+This patch fixes the queued len computation, which could theoretically
+be wrong if req->len[1] - req->processed[1] > 1. Be future-proof here,
+and fix it.
+
+Fixes: b460edb6230a ("crypto: inside-secure - sha512 support")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/inside-secure/safexcel_hash.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
+index 9a02f64a45b96..f3b02c00b7846 100644
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -50,10 +50,12 @@ struct safexcel_ahash_req {
+ 
+ static inline u64 safexcel_queued_len(struct safexcel_ahash_req *req)
+ {
+-	if (req->len[1] > req->processed[1])
+-		return 0xffffffff - (req->len[0] - req->processed[0]);
++	u64 len, processed;
+ 
+-	return req->len[0] - req->processed[0];
++	len = (0xffffffff * req->len[1]) + req->len[0];
++	processed = (0xffffffff * req->processed[1]) + req->processed[0];
++
++	return len - processed;
+ }
+ 
+ static void safexcel_hash_token(struct safexcel_command_desc *cdesc,
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-inside-secure-fix-zeroing-of-the-request-in-a.patch b/queue-4.19/crypto-inside-secure-fix-zeroing-of-the-request-in-a.patch
new file mode 100644
index 00000000000..463527c0b8b
--- /dev/null
+++ b/queue-4.19/crypto-inside-secure-fix-zeroing-of-the-request-in-a.patch
@@ -0,0 +1,38 @@
+From fbf1bcb2f57de7bca5eec258fe5002daa7887dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 16:51:01 +0200
+Subject: crypto: inside-secure - fix zeroing of the request in ahash_exit_inv
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit b926213d6fede9c9427d7c12eaf7d9f0895deb4e ]
+
+A request is zeroed in safexcel_ahash_exit_inv(). This request total
+size is EIP197_AHASH_REQ_SIZE while the memset zeroing it uses
+sizeof(struct ahash_request), which happens to be less than
+EIP197_AHASH_REQ_SIZE. This patch fixes it.
+
+Fixes: f6beaea30487 ("crypto: inside-secure - authenc(hmac(sha256), cbc(aes)) support")
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/inside-secure/safexcel_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c
+index ac9282c1a5ec1..9a02f64a45b96 100644
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -486,7 +486,7 @@ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
+ 	struct safexcel_inv_result result = {};
+ 	int ring = ctx->base.ring;
+ 
+-	memset(req, 0, sizeof(struct ahash_request));
++	memset(req, 0, EIP197_AHASH_REQ_SIZE);
+ 
+ 	/* create invalidation request */
+ 	init_completion(&result.completion);
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-talitos-fix-aead-processing.patch b/queue-4.19/crypto-talitos-fix-aead-processing.patch
new file mode 100644
index 00000000000..f8904f17c2a
--- /dev/null
+++ b/queue-4.19/crypto-talitos-fix-aead-processing.patch
@@ -0,0 +1,349 @@
+From d35a60ff3b14729dfdb6058b096dc4c2925450c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 13:34:19 +0000
+Subject: crypto: talitos - fix AEAD processing.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e345177ded17611e36c067751d63d64bf106cb54 ]
+
+This driver is working well in 'simple cases', but as soon as
+more exotic SG lists are provided (dst different from src,
+auth part not in a single SG fragment, ...) there are
+wrong results, overruns, etc ...
+
+This patch cleans up the AEAD processing by:
+- Simplifying the location of 'out of line' ICV
+- Never using 'out of line' ICV on encryp
+- Always using 'out of line' ICV on decrypt
+- Forcing the generation of a SG table on decrypt
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Fixes: aeb4c132f33d ("crypto: talitos - Convert to new AEAD interface")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 158 +++++++++++++--------------------------
+ drivers/crypto/talitos.h |   2 +-
+ 2 files changed, 55 insertions(+), 105 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 634ae487c372e..db5f939f5aa35 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -974,8 +974,8 @@ static void ipsec_esp_unmap(struct device *dev,
+ 					 DMA_FROM_DEVICE);
+ 	unmap_single_talitos_ptr(dev, civ_ptr, DMA_TO_DEVICE);
+ 
+-	talitos_sg_unmap(dev, edesc, areq->src, areq->dst, cryptlen,
+-			 areq->assoclen);
++	talitos_sg_unmap(dev, edesc, areq->src, areq->dst,
++			 cryptlen + authsize, areq->assoclen);
+ 
+ 	if (edesc->dma_len)
+ 		dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len,
+@@ -996,30 +996,15 @@ static void ipsec_esp_encrypt_done(struct device *dev,
+ 				   struct talitos_desc *desc, void *context,
+ 				   int err)
+ {
+-	struct talitos_private *priv = dev_get_drvdata(dev);
+-	bool is_sec1 = has_ftr_sec1(priv);
+ 	struct aead_request *areq = context;
+ 	struct crypto_aead *authenc = crypto_aead_reqtfm(areq);
+-	unsigned int authsize = crypto_aead_authsize(authenc);
+ 	unsigned int ivsize = crypto_aead_ivsize(authenc);
+ 	struct talitos_edesc *edesc;
+-	void *icvdata;
+ 
+ 	edesc = container_of(desc, struct talitos_edesc, desc);
+ 
+ 	ipsec_esp_unmap(dev, edesc, areq, true);
+ 
+-	/* copy the generated ICV to dst */
+-	if (edesc->icv_ool) {
+-		if (is_sec1)
+-			icvdata = edesc->buf + areq->assoclen + areq->cryptlen;
+-		else
+-			icvdata = &edesc->link_tbl[edesc->src_nents +
+-						   edesc->dst_nents + 2];
+-		sg_pcopy_from_buffer(areq->dst, edesc->dst_nents ? : 1, icvdata,
+-				     authsize, areq->assoclen + areq->cryptlen);
+-	}
+-
+ 	dma_unmap_single(dev, edesc->iv_dma, ivsize, DMA_TO_DEVICE);
+ 
+ 	kfree(edesc);
+@@ -1036,39 +1021,15 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
+ 	unsigned int authsize = crypto_aead_authsize(authenc);
+ 	struct talitos_edesc *edesc;
+ 	char *oicv, *icv;
+-	struct talitos_private *priv = dev_get_drvdata(dev);
+-	bool is_sec1 = has_ftr_sec1(priv);
+ 
+ 	edesc = container_of(desc, struct talitos_edesc, desc);
+ 
+ 	ipsec_esp_unmap(dev, edesc, req, false);
+ 
+ 	if (!err) {
+-		char icvdata[SHA512_DIGEST_SIZE];
+-		int nents = edesc->dst_nents ? : 1;
+-		unsigned int len = req->assoclen + req->cryptlen;
+-
+ 		/* auth check */
+-		if (nents > 1) {
+-			sg_pcopy_to_buffer(req->dst, nents, icvdata, authsize,
+-					   len - authsize);
+-			icv = icvdata;
+-		} else {
+-			icv = (char *)sg_virt(req->dst) + len - authsize;
+-		}
+-
+-		if (edesc->dma_len) {
+-			if (is_sec1)
+-				oicv = (char *)&edesc->dma_link_tbl +
+-					       req->assoclen + req->cryptlen;
+-			else
+-				oicv = (char *)
+-				       &edesc->link_tbl[edesc->src_nents +
+-							edesc->dst_nents + 2];
+-			if (edesc->icv_ool)
+-				icv = oicv + authsize;
+-		} else
+-			oicv = (char *)&edesc->link_tbl[0];
++		oicv = edesc->buf + edesc->dma_len;
++		icv = oicv - authsize;
+ 
+ 		err = crypto_memneq(oicv, icv, authsize) ? -EBADMSG : 0;
+ 	}
+@@ -1104,11 +1065,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
+  * stop at cryptlen bytes
+  */
+ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+-				 unsigned int offset, int cryptlen,
++				 unsigned int offset, int datalen, int elen,
+ 				 struct talitos_ptr *link_tbl_ptr)
+ {
+-	int n_sg = sg_count;
++	int n_sg = elen ? sg_count + 1 : sg_count;
+ 	int count = 0;
++	int cryptlen = datalen + elen;
+ 
+ 	while (cryptlen && sg && n_sg--) {
+ 		unsigned int len = sg_dma_len(sg);
+@@ -1123,11 +1085,20 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ 		if (len > cryptlen)
+ 			len = cryptlen;
+ 
++		if (datalen > 0 && len > datalen) {
++			to_talitos_ptr(link_tbl_ptr + count,
++				       sg_dma_address(sg) + offset, datalen, 0);
++			to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
++			count++;
++			len -= datalen;
++			offset += datalen;
++		}
+ 		to_talitos_ptr(link_tbl_ptr + count,
+ 			       sg_dma_address(sg) + offset, len, 0);
+ 		to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
+ 		count++;
+ 		cryptlen -= len;
++		datalen -= len;
+ 		offset = 0;
+ 
+ next:
+@@ -1137,7 +1108,7 @@ next:
+ 	/* tag end of link table */
+ 	if (count > 0)
+ 		to_talitos_ptr_ext_set(link_tbl_ptr + count - 1,
+-				       DESC_PTR_LNKTBL_RETURN, 0);
++				       DESC_PTR_LNKTBL_RET, 0);
+ 
+ 	return count;
+ }
+@@ -1145,7 +1116,8 @@ next:
+ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ 			      unsigned int len, struct talitos_edesc *edesc,
+ 			      struct talitos_ptr *ptr, int sg_count,
+-			      unsigned int offset, int tbl_off, int elen)
++			      unsigned int offset, int tbl_off, int elen,
++			      bool force)
+ {
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	bool is_sec1 = has_ftr_sec1(priv);
+@@ -1155,7 +1127,7 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ 		return 1;
+ 	}
+ 	to_talitos_ptr_ext_set(ptr, elen, is_sec1);
+-	if (sg_count == 1) {
++	if (sg_count == 1 && !force) {
+ 		to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
+ 		return sg_count;
+ 	}
+@@ -1163,9 +1135,9 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ 		to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
+ 		return sg_count;
+ 	}
+-	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len + elen,
++	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen,
+ 					 &edesc->link_tbl[tbl_off]);
+-	if (sg_count == 1) {
++	if (sg_count == 1 && !force) {
+ 		/* Only one segment now, so no link tbl needed*/
+ 		copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1);
+ 		return sg_count;
+@@ -1183,7 +1155,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ 			  unsigned int offset, int tbl_off)
+ {
+ 	return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
+-				  tbl_off, 0);
++				  tbl_off, 0, false);
+ }
+ 
+ /*
+@@ -1211,6 +1183,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 	bool is_ipsec_esp = desc->hdr & DESC_HDR_TYPE_IPSEC_ESP;
+ 	struct talitos_ptr *civ_ptr = &desc->ptr[is_ipsec_esp ? 2 : 3];
+ 	struct talitos_ptr *ckey_ptr = &desc->ptr[is_ipsec_esp ? 3 : 2];
++	dma_addr_t dma_icv = edesc->dma_link_tbl + edesc->dma_len - authsize;
+ 
+ 	/* hmac key */
+ 	to_talitos_ptr(&desc->ptr[0], ctx->dma_key, ctx->authkeylen, is_sec1);
+@@ -1250,7 +1223,8 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 		elen = authsize;
+ 
+ 	ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
+-				 sg_count, areq->assoclen, tbl_off, elen);
++				 sg_count, areq->assoclen, tbl_off, elen,
++				 false);
+ 
+ 	if (ret > 1) {
+ 		tbl_off += ret;
+@@ -1264,55 +1238,35 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 			dma_map_sg(dev, areq->dst, sg_count, DMA_FROM_DEVICE);
+ 	}
+ 
+-	ret = talitos_sg_map(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+-			     sg_count, areq->assoclen, tbl_off);
+-
+-	if (is_ipsec_esp)
+-		to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
++	if (is_ipsec_esp && encrypt)
++		elen = authsize;
++	else
++		elen = 0;
++	ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
++				 sg_count, areq->assoclen, tbl_off, elen,
++				 is_ipsec_esp && !encrypt);
++	tbl_off += ret;
+ 
+ 	/* ICV data */
+-	if (ret > 1) {
+-		tbl_off += ret;
+-		edesc->icv_ool = true;
+-		sync_needed = true;
++	edesc->icv_ool = !encrypt;
+ 
+-		if (is_ipsec_esp) {
+-			struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
+-			int offset = (edesc->src_nents + edesc->dst_nents + 2) *
+-				     sizeof(struct talitos_ptr) + authsize;
++	if (!encrypt && is_ipsec_esp) {
++		struct talitos_ptr *tbl_ptr = &edesc->link_tbl[tbl_off];
+ 
+-			/* Add an entry to the link table for ICV data */
+-			to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
+-			to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RETURN,
+-					       is_sec1);
++		/* Add an entry to the link table for ICV data */
++		to_talitos_ptr_ext_set(tbl_ptr - 1, 0, is_sec1);
++		to_talitos_ptr_ext_set(tbl_ptr, DESC_PTR_LNKTBL_RET, is_sec1);
+ 
+-			/* icv data follows link tables */
+-			to_talitos_ptr(tbl_ptr, edesc->dma_link_tbl + offset,
+-				       authsize, is_sec1);
+-		} else {
+-			dma_addr_t addr = edesc->dma_link_tbl;
+-
+-			if (is_sec1)
+-				addr += areq->assoclen + cryptlen;
+-			else
+-				addr += sizeof(struct talitos_ptr) * tbl_off;
+-
+-			to_talitos_ptr(&desc->ptr[6], addr, authsize, is_sec1);
+-		}
++		/* icv data follows link tables */
++		to_talitos_ptr(tbl_ptr, dma_icv, authsize, is_sec1);
++		to_talitos_ptr_ext_or(&desc->ptr[5], authsize, is_sec1);
++		sync_needed = true;
++	} else if (!encrypt) {
++		to_talitos_ptr(&desc->ptr[6], dma_icv, authsize, is_sec1);
++		sync_needed = true;
+ 	} else if (!is_ipsec_esp) {
+-		ret = talitos_sg_map(dev, areq->dst, authsize, edesc,
+-				     &desc->ptr[6], sg_count, areq->assoclen +
+-							      cryptlen,
+-				     tbl_off);
+-		if (ret > 1) {
+-			tbl_off += ret;
+-			edesc->icv_ool = true;
+-			sync_needed = true;
+-		} else {
+-			edesc->icv_ool = false;
+-		}
+-	} else {
+-		edesc->icv_ool = false;
++		talitos_sg_map(dev, areq->dst, authsize, edesc, &desc->ptr[6],
++			       sg_count, areq->assoclen + cryptlen, tbl_off);
+ 	}
+ 
+ 	/* iv out */
+@@ -1395,18 +1349,18 @@ static struct talitos_edesc *talitos_edesc_alloc(struct device *dev,
+ 	 * and space for two sets of ICVs (stashed and generated)
+ 	 */
+ 	alloc_len = sizeof(struct talitos_edesc);
+-	if (src_nents || dst_nents) {
++	if (src_nents || dst_nents || !encrypt) {
+ 		if (is_sec1)
+ 			dma_len = (src_nents ? src_len : 0) +
+-				  (dst_nents ? dst_len : 0);
++				  (dst_nents ? dst_len : 0) + authsize;
+ 		else
+ 			dma_len = (src_nents + dst_nents + 2) *
+-				  sizeof(struct talitos_ptr) + authsize * 2;
++				  sizeof(struct talitos_ptr) + authsize;
+ 		alloc_len += dma_len;
+ 	} else {
+ 		dma_len = 0;
+-		alloc_len += icv_stashing ? authsize : 0;
+ 	}
++	alloc_len += icv_stashing ? authsize : 0;
+ 
+ 	/* if its a ahash, add space for a second desc next to the first one */
+ 	if (is_sec1 && !dst)
+@@ -1500,11 +1454,7 @@ static int aead_decrypt(struct aead_request *req)
+ 	edesc->desc.hdr = ctx->desc_hdr_template | DESC_HDR_DIR_INBOUND;
+ 
+ 	/* stash incoming ICV for later cmp with ICV generated by the h/w */
+-	if (edesc->dma_len)
+-		icvdata = (char *)&edesc->link_tbl[edesc->src_nents +
+-						   edesc->dst_nents + 2];
+-	else
+-		icvdata = &edesc->link_tbl[0];
++	icvdata = edesc->buf + edesc->dma_len;
+ 
+ 	sg_pcopy_to_buffer(req->src, edesc->src_nents ? : 1, icvdata, authsize,
+ 			   req->assoclen + req->cryptlen - authsize);
+diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
+index 979f6a61e545f..cb0137e131cc8 100644
+--- a/drivers/crypto/talitos.h
++++ b/drivers/crypto/talitos.h
+@@ -442,5 +442,5 @@ static inline bool has_ftr_sec1(struct talitos_private *priv)
+ 
+ /* link table extent field bits */
+ #define DESC_PTR_LNKTBL_JUMP			0x80
+-#define DESC_PTR_LNKTBL_RETURN			0x02
++#define DESC_PTR_LNKTBL_RET			0x02
+ #define DESC_PTR_LNKTBL_NEXT			0x01
+-- 
+2.20.1
+
diff --git a/queue-4.19/crypto-tgr192-fix-unaligned-memory-access.patch b/queue-4.19/crypto-tgr192-fix-unaligned-memory-access.patch
new file mode 100644
index 00000000000..4ab0bbca9f9
--- /dev/null
+++ b/queue-4.19/crypto-tgr192-fix-unaligned-memory-access.patch
@@ -0,0 +1,50 @@
+From 874b14ece3422941d3b19514c56179defad386f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 12:17:58 -0800
+Subject: crypto: tgr192 - fix unaligned memory access
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]
+
+Fix an unaligned memory access in tgr192_transform() by using the
+unaligned access helpers.
+
+Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/tgr192.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/crypto/tgr192.c b/crypto/tgr192.c
+index 022d3dd76c3b2..f8e1d9f9938f5 100644
+--- a/crypto/tgr192.c
++++ b/crypto/tgr192.c
+@@ -25,8 +25,9 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/mm.h>
+-#include <asm/byteorder.h>
+ #include <linux/types.h>
++#include <asm/byteorder.h>
++#include <asm/unaligned.h>
+ 
+ #define TGR192_DIGEST_SIZE 24
+ #define TGR160_DIGEST_SIZE 20
+@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
+ 	u64 a, b, c, aa, bb, cc;
+ 	u64 x[8];
+ 	int i;
+-	const __le64 *ptr = (const __le64 *)data;
+ 
+ 	for (i = 0; i < 8; i++)
+-		x[i] = le64_to_cpu(ptr[i]);
++		x[i] = get_unaligned_le64(data + i * sizeof(__le64));
+ 
+ 	/* save */
+ 	a = aa = tctx->a;
+-- 
+2.20.1
+
diff --git a/queue-4.19/cxgb4-signedness-bug-in-init_one.patch b/queue-4.19/cxgb4-signedness-bug-in-init_one.patch
new file mode 100644
index 00000000000..414d57d7ac2
--- /dev/null
+++ b/queue-4.19/cxgb4-signedness-bug-in-init_one.patch
@@ -0,0 +1,36 @@
+From b8f604e402ed4621b5e128d21450cfae7249c9a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:54:59 +0300
+Subject: cxgb4: Signedness bug in init_one()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 286183147666fb76c057836c57d86e9e6f508bca ]
+
+The "chip" variable is an enum, and it's treated as unsigned int by GCC
+in this context so the error handling isn't triggered.
+
+Fixes: e8d452923ae6 ("cxgb4: clean up init_one")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index bb04c695ab9fd..c81d6c330548d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -5452,7 +5452,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+ 	pci_read_config_word(pdev, PCI_DEVICE_ID, &device_id);
+ 	chip = t4_get_chip_type(adapter, CHELSIO_PCI_ID_VER(device_id));
+-	if (chip < 0) {
++	if ((int)chip < 0) {
+ 		dev_err(&pdev->dev, "Device %d is not supported\n", device_id);
+ 		err = chip;
+ 		goto out_free_adapter;
+-- 
+2.20.1
+
diff --git a/queue-4.19/cxgb4-smt-add-lock-for-atomic_dec_and_test.patch b/queue-4.19/cxgb4-smt-add-lock-for-atomic_dec_and_test.patch
new file mode 100644
index 00000000000..7e240b594b5
--- /dev/null
+++ b/queue-4.19/cxgb4-smt-add-lock-for-atomic_dec_and_test.patch
@@ -0,0 +1,52 @@
+From 15ba95859b9a1237ab323d9af1bc7b27597a5bd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2019 10:58:46 +0800
+Subject: cxgb4: smt: Add lock for atomic_dec_and_test
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 4a8937b83892cb69524291cae6cdabad4a8be033 ]
+
+The atomic_dec_and_test() is not safe because it is
+outside of locks.
+Move the locks of t4_smte_free() to its caller,
+cxgb4_smt_release() to protect the atomic decrement.
+
+Fixes: 3bdb376e6944 ("cxgb4: introduce SMT ops to prepare for SMAC rewrite support")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/smt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/smt.c b/drivers/net/ethernet/chelsio/cxgb4/smt.c
+index 7b2207a2a130f..9b3f4205cb4d4 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/smt.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/smt.c
+@@ -98,11 +98,9 @@ found_reuse:
+ 
+ static void t4_smte_free(struct smt_entry *e)
+ {
+-	spin_lock_bh(&e->lock);
+ 	if (atomic_read(&e->refcnt) == 0) {  /* hasn't been recycled */
+ 		e->state = SMT_STATE_UNUSED;
+ 	}
+-	spin_unlock_bh(&e->lock);
+ }
+ 
+ /**
+@@ -112,8 +110,10 @@ static void t4_smte_free(struct smt_entry *e)
+  */
+ void cxgb4_smt_release(struct smt_entry *e)
+ {
++	spin_lock_bh(&e->lock);
+ 	if (atomic_dec_and_test(&e->refcnt))
+ 		t4_smte_free(e);
++	spin_unlock_bh(&e->lock);
+ }
+ EXPORT_SYMBOL(cxgb4_smt_release);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/devres-allow-const-resource-arguments.patch b/queue-4.19/devres-allow-const-resource-arguments.patch
new file mode 100644
index 00000000000..29f639e46f1
--- /dev/null
+++ b/queue-4.19/devres-allow-const-resource-arguments.patch
@@ -0,0 +1,63 @@
+From b8cc6c9adfe0ef5a490bca385a276ec9e239fdd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 16:59:45 +0200
+Subject: devres: allow const resource arguments
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ]
+
+devm_ioremap_resource() does not currently take 'const' arguments,
+which results in a warning from the first driver trying to do it
+anyway:
+
+drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe':
+drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
+  priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores);
+                                                 ^~~~~~~~~~~~~~~~~~~
+
+Change the prototype to allow it, as there is no real reason not to.
+
+Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviwed-By: Enrico Weigelt <info@metux.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/device.h | 3 ++-
+ lib/devres.c           | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/device.h b/include/linux/device.h
+index e9d1c768f972a..c74ce473589ae 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -701,7 +701,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
+ 					 gfp_t gfp_mask, unsigned int order);
+ extern void devm_free_pages(struct device *dev, unsigned long addr);
+ 
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
++void __iomem *devm_ioremap_resource(struct device *dev,
++				    const struct resource *res);
+ 
+ void __iomem *devm_of_iomap(struct device *dev,
+ 			    struct device_node *node, int index,
+diff --git a/lib/devres.c b/lib/devres.c
+index faccf1a037d05..aa0f5308ac6be 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
+  *	if (IS_ERR(base))
+  *		return PTR_ERR(base);
+  */
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
++void __iomem *devm_ioremap_resource(struct device *dev,
++				    const struct resource *res)
+ {
+ 	resource_size_t size;
+ 	const char *name;
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch b/queue-4.19/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
new file mode 100644
index 00000000000..2547fa873b5
--- /dev/null
+++ b/queue-4.19/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
@@ -0,0 +1,45 @@
+From 08905d60539e0e69a8ed7e1aa58ea3f8dfc87e5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: dmaengine: axi-dmac: Don't check the number of frames for alignment
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index 15b2453d2647f..b2c755b74bea0 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -486,7 +486,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+ 
+ 	if (chan->hw_2d) {
+ 		if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+-		    !axi_dmac_check_len(chan, xt->numf))
++		    xt->numf == 0)
+ 			return NULL;
+ 		if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ 		    xt->sgl[0].size + src_icg > chan->max_length)
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch b/queue-4.19/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
new file mode 100644
index 00000000000..0444269b04f
--- /dev/null
+++ b/queue-4.19/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
@@ -0,0 +1,64 @@
+From 89ba3b287df180b54e18d465e12d13301a3fa425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 16:15:43 +0300
+Subject: dmaengine: dw: platform: Switch to acpi_dma_controller_register()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ]
+
+There is a possibility to have registered ACPI DMA controller
+while it has been gone already.
+
+To avoid the potential crash, move to non-managed
+acpi_dma_controller_register().
+
+Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw/platform.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index c299ff181bb68..62218ea0894c9 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
+ 	dma_cap_set(DMA_SLAVE, info->dma_cap);
+ 	info->filter_fn = dw_dma_acpi_filter;
+ 
+-	ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
+-						info);
++	ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
+ 	if (ret)
+ 		dev_err(dev, "could not register acpi_dma_controller\n");
+ }
++
++static void dw_dma_acpi_controller_free(struct dw_dma *dw)
++{
++	struct device *dev = dw->dma.dev;
++
++	acpi_dma_controller_free(dev);
++}
+ #else /* !CONFIG_ACPI */
+ static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
+ #endif /* !CONFIG_ACPI */
+ 
+ #ifdef CONFIG_OF
+@@ -249,6 +256,9 @@ static int dw_remove(struct platform_device *pdev)
+ {
+ 	struct dw_dma_chip *chip = platform_get_drvdata(pdev);
+ 
++	if (ACPI_HANDLE(&pdev->dev))
++		dw_dma_acpi_controller_free(chip->dw);
++
+ 	if (pdev->dev.of_node)
+ 		of_dma_controller_free(pdev->dev.of_node);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch b/queue-4.19/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
new file mode 100644
index 00000000000..8520e0b5b23
--- /dev/null
+++ b/queue-4.19/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
@@ -0,0 +1,51 @@
+From df8d59c3253a9adfb635a2cca8934aa288a46811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 16:32:32 +0300
+Subject: dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c24a5c735f87d0549060de31367c095e8810b895 ]
+
+The commit
+
+  080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
+
+has been mistakenly submitted. The further investigations show that
+the original code does better job since the memory side transfer size
+has never been configured by DMA users.
+
+As per latest revision of documentation: "Channel minimum transfer size
+(CHnMTSR)... For IOSF UART, maximum value that can be programmed is 64 and
+minimum value that can be programmed is 1."
+
+This reverts commit 080edf75d337d35faa6fc3df99342b10d2848d16.
+
+Fixes: 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/hsu/hsu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
+index 202ffa9f7611c..18f155a974db6 100644
+--- a/drivers/dma/hsu/hsu.c
++++ b/drivers/dma/hsu/hsu.c
+@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc)
+ 
+ 	if (hsuc->direction == DMA_MEM_TO_DEV) {
+ 		bsr = config->dst_maxburst;
+-		mtsr = config->src_addr_width;
++		mtsr = config->dst_addr_width;
+ 	} else if (hsuc->direction == DMA_DEV_TO_MEM) {
+ 		bsr = config->src_maxburst;
+-		mtsr = config->dst_addr_width;
++		mtsr = config->src_addr_width;
+ 	}
+ 
+ 	hsu_chan_disable(hsuc);
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch b/queue-4.19/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
new file mode 100644
index 00000000000..63bdcc44a55
--- /dev/null
+++ b/queue-4.19/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
@@ -0,0 +1,73 @@
+From a6f187a38fd0b398fb2a3422788c53af834d04a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:49:18 +0000
+Subject: dmaengine: imx-sdma: fix size check for sdma script_number
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]
+
+Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(41) exceed the size of structure sdma_script_start_addrs(40),
+thus cause memory corrupt such as slob block header so that kernel
+trap into while() loop forever in slob_free(). Please refer to below
+code piece in imx-sdma.c:
+for (i = 0; i < sdma->script_number; i++)
+	if (addr_arr[i] > 0)
+		saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
+That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
+support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(38->41 3 scripts added) not align with script number added in
+sdma_script_start_addrs(2 scripts).
+
+Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
+Cc: stable@vger.kernel
+Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
+Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
+[vkoul: update the patch title]
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c                     | 8 ++++++++
+ include/linux/platform_data/dma-imx-sdma.h | 3 +++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 3f5a01cb4ab45..ceb82e74f5b4e 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1662,6 +1662,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
+ 	if (!sdma->script_number)
+ 		sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
+ 
++	if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
++				  / sizeof(s32)) {
++		dev_err(sdma->dev,
++			"SDMA script number %d not match with firmware.\n",
++			sdma->script_number);
++		return;
++	}
++
+ 	for (i = 0; i < sdma->script_number; i++)
+ 		if (addr_arr[i] > 0)
+ 			saddr_arr[i] = addr_arr[i];
+diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
+index 6eaa53cef0bd2..30e676b36b247 100644
+--- a/include/linux/platform_data/dma-imx-sdma.h
++++ b/include/linux/platform_data/dma-imx-sdma.h
+@@ -51,7 +51,10 @@ struct sdma_script_start_addrs {
+ 	/* End of v2 array */
+ 	s32 zcanfd_2_mcu_addr;
+ 	s32 zqspi_2_mcu_addr;
++	s32 mcu_2_ecspi_addr;
+ 	/* End of v3 array */
++	s32 mcu_2_zqspi_addr;
++	/* End of v4 array */
+ };
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-mv_xor-use-correct-device-for-dma-api.patch b/queue-4.19/dmaengine-mv_xor-use-correct-device-for-dma-api.patch
new file mode 100644
index 00000000000..1706b7eb7b8
--- /dev/null
+++ b/queue-4.19/dmaengine-mv_xor-use-correct-device-for-dma-api.patch
@@ -0,0 +1,53 @@
+From dc8d8c4c2a15a43bf881d55e4c51e6bd50769773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 18:27:06 +0000
+Subject: dmaengine: mv_xor: Use correct device for DMA API
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ]
+
+Using dma_dev->dev for mappings before it's assigned with the correct
+device is unlikely to work as expected, and with future dma-direct
+changes, passing a NULL device may end up crashing entirely. I don't
+know enough about this hardware or the mv_xor_prep_dma_interrupt()
+operation to implement the appropriate error-handling logic that would
+have revealed those dma_map_single() calls failing on arm64 for as long
+as the driver has been enabled there, but moving the assignment earlier
+will at least make the current code operate as intended.
+
+Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT")
+Reported-by: John David Anglin <dave.anglin@bell.net>
+Tested-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 969534c1a6c63..abc8d3e0487b8 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1059,6 +1059,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ 		mv_chan->op_in_desc = XOR_MODE_IN_DESC;
+ 
+ 	dma_dev = &mv_chan->dmadev;
++	dma_dev->dev = &pdev->dev;
+ 	mv_chan->xordev = xordev;
+ 
+ 	/*
+@@ -1091,7 +1092,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ 	dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
+ 	dma_dev->device_tx_status = mv_xor_status;
+ 	dma_dev->device_issue_pending = mv_xor_issue_pending;
+-	dma_dev->dev = &pdev->dev;
+ 
+ 	/* set prep routines based on capability */
+ 	if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-tegra210-adma-fix-crash-during-probe.patch b/queue-4.19/dmaengine-tegra210-adma-fix-crash-during-probe.patch
new file mode 100644
index 00000000000..568c2a66760
--- /dev/null
+++ b/queue-4.19/dmaengine-tegra210-adma-fix-crash-during-probe.patch
@@ -0,0 +1,92 @@
+From 61835f606c7f91e9363a990990d70516ffe965ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2019 16:53:52 +0100
+Subject: dmaengine: tegra210-adma: Fix crash during probe
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ]
+
+Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
+added support to save and restore the DMA channel registers when runtime
+suspending the ADMA. This change is causing the kernel to crash when
+probing the ADMA, if the device is probed deferred when looking up the
+channel interrupts. The crash occurs because not all of the channel base
+addresses have been setup at this point and in the clean-up path of the
+probe, pm_runtime_suspend() is called invoking its callback which
+expects all the channel base addresses to be initialised.
+
+Although this could be fixed by simply checking for a NULL address, on
+further review of the driver it seems more appropriate that we only call
+pm_runtime_get_sync() after all the channel interrupts and base
+addresses have been configured. Therefore, fix this crash by moving the
+calls to pm_runtime_enable(), pm_runtime_get_sync() and
+tegra_adma_init() after the DMA channels have been initialised.
+
+Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index ac2a6b800db3e..4f4733d831a1a 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 		return PTR_ERR(tdma->ahub_clk);
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
+-
+-	ret = pm_runtime_get_sync(&pdev->dev);
+-	if (ret < 0)
+-		goto rpm_disable;
+-
+-	ret = tegra_adma_init(tdma);
+-	if (ret)
+-		goto rpm_put;
+-
+ 	INIT_LIST_HEAD(&tdma->dma_dev.channels);
+ 	for (i = 0; i < tdma->nr_channels; i++) {
+ 		struct tegra_adma_chan *tdc = &tdma->channels[i];
+@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 		tdc->tdma = tdma;
+ 	}
+ 
++	pm_runtime_enable(&pdev->dev);
++
++	ret = pm_runtime_get_sync(&pdev->dev);
++	if (ret < 0)
++		goto rpm_disable;
++
++	ret = tegra_adma_init(tdma);
++	if (ret)
++		goto rpm_put;
++
+ 	dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
+ 	dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
+ 	dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
+@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ 
+ dma_remove:
+ 	dma_async_device_unregister(&tdma->dma_dev);
+-irq_dispose:
+-	while (--i >= 0)
+-		irq_dispose_mapping(tdma->channels[i].irq);
+ rpm_put:
+ 	pm_runtime_put_sync(&pdev->dev);
+ rpm_disable:
+ 	pm_runtime_disable(&pdev->dev);
++irq_dispose:
++	while (--i >= 0)
++		irq_dispose_mapping(tdma->channels[i].irq);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-tegra210-adma-restore-channel-status.patch b/queue-4.19/dmaengine-tegra210-adma-restore-channel-status.patch
new file mode 100644
index 00000000000..9d2b23ca899
--- /dev/null
+++ b/queue-4.19/dmaengine-tegra210-adma-restore-channel-status.patch
@@ -0,0 +1,124 @@
+From 0f5905046717d5b41de98ac5ecd293513b0e0995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 18:25:17 +0530
+Subject: dmaengine: tegra210-adma: restore channel status
+
+From: Sameer Pujar <spujar@nvidia.com>
+
+[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ]
+
+Status of ADMA channel registers is not saved and restored during system
+suspend. During active playback if system enters suspend, this results in
+wrong state of channel registers during system resume and playback fails
+to resume properly. Fix this by saving following channel registers in
+runtime suspend and restore during runtime resume.
+ * ADMA_CH_LOWER_SRC_ADDR
+ * ADMA_CH_LOWER_TRG_ADDR
+ * ADMA_CH_FIFO_CTRL
+ * ADMA_CH_CONFIG
+ * ADMA_CH_CTRL
+ * ADMA_CH_CMD
+ * ADMA_CH_TC
+Runtime PM calls will be inovked during system resume path if a playback
+or capture needs to be resumed. Hence above changes work fine for system
+suspend case.
+
+Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 45 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 09b6756366c30..ac2a6b800db3e 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
+ 	unsigned int src_addr;
+ 	unsigned int trg_addr;
+ 	unsigned int fifo_ctrl;
++	unsigned int cmd;
+ 	unsigned int tc;
+ };
+ 
+@@ -127,6 +128,7 @@ struct tegra_adma_chan {
+ 	enum dma_transfer_direction	sreq_dir;
+ 	unsigned int			sreq_index;
+ 	bool				sreq_reserved;
++	struct tegra_adma_chan_regs	ch_regs;
+ 
+ 	/* Transfer count and position info */
+ 	unsigned int			tx_buf_count;
+@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
+ static int tegra_adma_runtime_suspend(struct device *dev)
+ {
+ 	struct tegra_adma *tdma = dev_get_drvdata(dev);
++	struct tegra_adma_chan_regs *ch_reg;
++	struct tegra_adma_chan *tdc;
++	int i;
+ 
+ 	tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
++	if (!tdma->global_cmd)
++		goto clk_disable;
++
++	for (i = 0; i < tdma->nr_channels; i++) {
++		tdc = &tdma->channels[i];
++		ch_reg = &tdc->ch_regs;
++		ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
++		/* skip if channel is not active */
++		if (!ch_reg->cmd)
++			continue;
++		ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
++		ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
++		ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
++		ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
++		ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
++		ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
++	}
++
++clk_disable:
+ 	clk_disable_unprepare(tdma->ahub_clk);
+ 
+ 	return 0;
+@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
+ static int tegra_adma_runtime_resume(struct device *dev)
+ {
+ 	struct tegra_adma *tdma = dev_get_drvdata(dev);
+-	int ret;
++	struct tegra_adma_chan_regs *ch_reg;
++	struct tegra_adma_chan *tdc;
++	int ret, i;
+ 
+ 	ret = clk_prepare_enable(tdma->ahub_clk);
+ 	if (ret) {
+@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
+ 	}
+ 	tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
+ 
++	if (!tdma->global_cmd)
++		return 0;
++
++	for (i = 0; i < tdma->nr_channels; i++) {
++		tdc = &tdma->channels[i];
++		ch_reg = &tdc->ch_regs;
++		/* skip if channel was not active earlier */
++		if (!ch_reg->cmd)
++			continue;
++		tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
++		tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
++		tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
++		tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
++		tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
++		tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
++		tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
++	}
++
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/dmaengine-ti-edma-fix-missed-failure-handling.patch b/queue-4.19/dmaengine-ti-edma-fix-missed-failure-handling.patch
new file mode 100644
index 00000000000..d501c1b42a6
--- /dev/null
+++ b/queue-4.19/dmaengine-ti-edma-fix-missed-failure-handling.patch
@@ -0,0 +1,41 @@
+From 9e7ff8646854c18ccba4e2a7cf85ab1c7586ac67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:38:02 +0800
+Subject: dmaengine: ti: edma: fix missed failure handling
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]
+
+When devm_kcalloc fails, it forgets to call edma_free_slot.
+Replace direct return with failure handler to fix it.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index 982631d4e1f8a..44158fa859737 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2345,8 +2345,10 @@ static int edma_probe(struct platform_device *pdev)
+ 
+ 		ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
+ 					    sizeof(*ecc->tc_list), GFP_KERNEL);
+-		if (!ecc->tc_list)
+-			return -ENOMEM;
++		if (!ecc->tc_list) {
++			ret = -ENOMEM;
++			goto err_reg1;
++		}
+ 
+ 		for (i = 0;; i++) {
+ 			ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
+-- 
+2.20.1
+
diff --git a/queue-4.19/dpaa_eth-avoid-timestamp-read-on-error-paths.patch b/queue-4.19/dpaa_eth-avoid-timestamp-read-on-error-paths.patch
new file mode 100644
index 00000000000..9ec9ac33029
--- /dev/null
+++ b/queue-4.19/dpaa_eth-avoid-timestamp-read-on-error-paths.patch
@@ -0,0 +1,93 @@
+From 15ed1b45d792700fff4547ea0edf63563d083f38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 16:37:50 +0200
+Subject: dpaa_eth: avoid timestamp read on error paths
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+[ Upstream commit 9a4f4f3a894ff4487f5597b7aabba9432b238292 ]
+
+The dpaa_cleanup_tx_fd() function is called by the frame transmit
+confirmation callback but also on several error paths. This function
+is reading the transmit timestamp value. Avoid reading an invalid
+timestamp value on the error paths.
+
+Fixes: 4664856e9ca2 ("dpaa_eth: add support for hardware timestamping")
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 3cd62a71ddea8..d7736c9c6339a 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1600,13 +1600,15 @@ static int dpaa_eth_refill_bpools(struct dpaa_priv *priv)
+  * Skb freeing is not handled here.
+  *
+  * This function may be called on error paths in the Tx function, so guard
+- * against cases when not all fd relevant fields were filled in.
++ * against cases when not all fd relevant fields were filled in. To avoid
++ * reading the invalid transmission timestamp for the error paths set ts to
++ * false.
+  *
+  * Return the skb backpointer, since for S/G frames the buffer containing it
+  * gets freed here.
+  */
+ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+-					  const struct qm_fd *fd)
++					  const struct qm_fd *fd, bool ts)
+ {
+ 	const enum dma_data_direction dma_dir = DMA_TO_DEVICE;
+ 	struct device *dev = priv->net_dev->dev.parent;
+@@ -1648,7 +1650,8 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ 	}
+ 
+ 	/* DMA unmapping is required before accessing the HW provided info */
+-	if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
++	if (ts && priv->tx_tstamp &&
++	    skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+ 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+ 
+ 		if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
+@@ -2118,7 +2121,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ 	if (likely(dpaa_xmit(priv, percpu_stats, queue_mapping, &fd) == 0))
+ 		return NETDEV_TX_OK;
+ 
+-	dpaa_cleanup_tx_fd(priv, &fd);
++	dpaa_cleanup_tx_fd(priv, &fd, false);
+ skb_to_fd_failed:
+ enomem:
+ 	percpu_stats->tx_errors++;
+@@ -2164,7 +2167,7 @@ static void dpaa_tx_error(struct net_device *net_dev,
+ 
+ 	percpu_priv->stats.tx_errors++;
+ 
+-	skb = dpaa_cleanup_tx_fd(priv, fd);
++	skb = dpaa_cleanup_tx_fd(priv, fd, false);
+ 	dev_kfree_skb(skb);
+ }
+ 
+@@ -2205,7 +2208,7 @@ static void dpaa_tx_conf(struct net_device *net_dev,
+ 
+ 	percpu_priv->tx_confirm++;
+ 
+-	skb = dpaa_cleanup_tx_fd(priv, fd);
++	skb = dpaa_cleanup_tx_fd(priv, fd, true);
+ 
+ 	consume_skb(skb);
+ }
+@@ -2435,7 +2438,7 @@ static void egress_ern(struct qman_portal *portal,
+ 	percpu_priv->stats.tx_fifo_errors++;
+ 	count_ern(percpu_priv, msg);
+ 
+-	skb = dpaa_cleanup_tx_fd(priv, fd);
++	skb = dpaa_cleanup_tx_fd(priv, fd, false);
+ 	dev_kfree_skb_any(skb);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/dpaa_eth-perform-dma-unmapping-before-read.patch b/queue-4.19/dpaa_eth-perform-dma-unmapping-before-read.patch
new file mode 100644
index 00000000000..9bc35d3ed26
--- /dev/null
+++ b/queue-4.19/dpaa_eth-perform-dma-unmapping-before-read.patch
@@ -0,0 +1,78 @@
+From 59eb0a1a7e6a867b0affeb45271893e7b4aba34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 16:37:49 +0200
+Subject: dpaa_eth: perform DMA unmapping before read
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+[ Upstream commit c70fd3182caef014e6c628b412f81aa57a3ef9e4 ]
+
+DMA unmapping is required before accessing the HW provided timestamping
+information.
+
+Fixes: 4664856e9ca2 ("dpaa_eth: add support for hardware timestamping")
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/freescale/dpaa/dpaa_eth.c    | 32 ++++++++++---------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 462bb8c4f80c9..3cd62a71ddea8 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1620,18 +1620,6 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ 	skbh = (struct sk_buff **)phys_to_virt(addr);
+ 	skb = *skbh;
+ 
+-	if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+-		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+-
+-		if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
+-					  &ns)) {
+-			shhwtstamps.hwtstamp = ns_to_ktime(ns);
+-			skb_tstamp_tx(skb, &shhwtstamps);
+-		} else {
+-			dev_warn(dev, "fman_port_get_tstamp failed!\n");
+-		}
+-	}
+-
+ 	if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
+ 		nr_frags = skb_shinfo(skb)->nr_frags;
+ 		dma_unmap_single(dev, addr,
+@@ -1654,14 +1642,28 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ 			dma_unmap_page(dev, qm_sg_addr(&sgt[i]),
+ 				       qm_sg_entry_get_len(&sgt[i]), dma_dir);
+ 		}
+-
+-		/* Free the page frag that we allocated on Tx */
+-		skb_free_frag(phys_to_virt(addr));
+ 	} else {
+ 		dma_unmap_single(dev, addr,
+ 				 skb_tail_pointer(skb) - (u8 *)skbh, dma_dir);
+ 	}
+ 
++	/* DMA unmapping is required before accessing the HW provided info */
++	if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
++		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
++
++		if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
++					  &ns)) {
++			shhwtstamps.hwtstamp = ns_to_ktime(ns);
++			skb_tstamp_tx(skb, &shhwtstamps);
++		} else {
++			dev_warn(dev, "fman_port_get_tstamp failed!\n");
++		}
++	}
++
++	if (qm_fd_get_format(fd) == qm_fd_sg)
++		/* Free the page frag that we allocated on Tx */
++		skb_free_frag(phys_to_virt(addr));
++
+ 	return skb;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-avoid-careless-re-use-of-existing-device.patch b/queue-4.19/driver-core-avoid-careless-re-use-of-existing-device.patch
new file mode 100644
index 00000000000..1fc68fba6a8
--- /dev/null
+++ b/queue-4.19/driver-core-avoid-careless-re-use-of-existing-device.patch
@@ -0,0 +1,79 @@
+From d938a240baa0deaaf2cacc5627bc6d0db8ed3ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 01:46:54 +0100
+Subject: driver core: Avoid careless re-use of existing device links
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit f265df550a4350dce0a4d721a77c52e4b847ea40 ]
+
+After commit ead18c23c263 ("driver core: Introduce device links
+reference counting"), if there is a link between the given supplier
+and the given consumer already, device_link_add() will refcount it
+and return it unconditionally.  However, if the flags passed to
+it on the second (or any subsequent) attempt to create a device
+link between the same consumer-supplier pair are not compatible with
+the existing link's flags, that is incorrect.
+
+First off, if the existing link is stateless and the next caller of
+device_link_add() for the same consumer-supplier pair wants a
+stateful one, or the other way around, the existing link cannot be
+returned, because it will not match the expected behavior, so make
+device_link_add() dump the stack and return NULL in that case.
+
+Moreover, if the DL_FLAG_AUTOREMOVE_CONSUMER flag is passed to
+device_link_add(), its caller will expect its reference to the link
+to be dropped automatically on consumer driver removal, which will
+not happen if that flag is not set in the link's flags (and
+analogously for DL_FLAG_AUTOREMOVE_SUPPLIER).  For this reason, make
+device_link_add() update the existing link's flags accordingly
+before returning it to the caller.
+
+Fixes: ead18c23c263 ("driver core: Introduce device links reference counting")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 055132f2292aa..562385c47fa44 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -221,12 +221,29 @@ struct device_link *device_link_add(struct device *consumer,
+ 		goto out;
+ 	}
+ 
+-	list_for_each_entry(link, &supplier->links.consumers, s_node)
+-		if (link->consumer == consumer) {
+-			kref_get(&link->kref);
++	list_for_each_entry(link, &supplier->links.consumers, s_node) {
++		if (link->consumer != consumer)
++			continue;
++
++		/*
++		 * Don't return a stateless link if the caller wants a stateful
++		 * one and vice versa.
++		 */
++		if (WARN_ON((flags & DL_FLAG_STATELESS) != (link->flags & DL_FLAG_STATELESS))) {
++			link = NULL;
+ 			goto out;
+ 		}
+ 
++		if (flags & DL_FLAG_AUTOREMOVE_CONSUMER)
++			link->flags |= DL_FLAG_AUTOREMOVE_CONSUMER;
++
++		if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
++			link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
++
++		kref_get(&link->kref);
++		goto out;
++	}
++
+ 	link = kzalloc(sizeof(*link), GFP_KERNEL);
+ 	if (!link)
+ 		goto out;
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-do-not-call-rpm_put_suppliers-in-pm_runt.patch b/queue-4.19/driver-core-do-not-call-rpm_put_suppliers-in-pm_runt.patch
new file mode 100644
index 00000000000..481da50db5b
--- /dev/null
+++ b/queue-4.19/driver-core-do-not-call-rpm_put_suppliers-in-pm_runt.patch
@@ -0,0 +1,61 @@
+From 495d963dd7d862e33bfe657e5ea3745b1978c37c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 01:52:45 +0100
+Subject: driver core: Do not call rpm_put_suppliers() in
+ pm_runtime_drop_link()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit a1fdbfbb1da2063ba98a12eb6f1bdd07451c7145 ]
+
+Calling rpm_put_suppliers() from pm_runtime_drop_link() is excessive
+as it affects all suppliers of the consumer device and not just the
+one pointed to by the device link being dropped.  Worst case it may
+cause the consumer device to stop working unexpectedly.  Moreover, in
+principle it is racy with respect to runtime PM of the consumer
+device.
+
+To avoid these problems drop runtime PM references on the particular
+supplier pointed to by the link in question only and do that after
+the link has been dropped from the consumer device's list of links to
+suppliers, which is in device_link_free().
+
+Fixes: a0504aecba76 ("PM / runtime: Drop usage count for suppliers at device link removal")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c          | 3 +++
+ drivers/base/power/runtime.c | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 20ae18f44dcdf..7599147d5f83c 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -357,6 +357,9 @@ EXPORT_SYMBOL_GPL(device_link_add);
+ 
+ static void device_link_free(struct device_link *link)
+ {
++	while (refcount_dec_not_one(&link->rpm_active))
++		pm_runtime_put(link->supplier);
++
+ 	put_device(link->consumer);
+ 	put_device(link->supplier);
+ 	kfree(link);
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index b914932d3ca1a..ab454c4533ba1 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1603,8 +1603,6 @@ void pm_runtime_new_link(struct device *dev)
+ 
+ void pm_runtime_drop_link(struct device *dev)
+ {
+-	rpm_put_suppliers(dev);
+-
+ 	spin_lock_irq(&dev->power.lock);
+ 	WARN_ON(dev->power.links_count == 0);
+ 	dev->power.links_count--;
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-do-not-resume-suppliers-under-device_lin.patch b/queue-4.19/driver-core-do-not-resume-suppliers-under-device_lin.patch
new file mode 100644
index 00000000000..d69c881d026
--- /dev/null
+++ b/queue-4.19/driver-core-do-not-resume-suppliers-under-device_lin.patch
@@ -0,0 +1,80 @@
+From fbb2e54fdc8a0ef49fe021c25619af4bbb66e020 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 01:47:53 +0100
+Subject: driver core: Do not resume suppliers under device_links_write_lock()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 5db25c9eb893df8f6b93c1d97b8006d768e1b6f5 ]
+
+It is incorrect to call pm_runtime_get_sync() under
+device_links_write_lock(), because it may end up trying to take
+device_links_read_lock() while resuming the target device and that
+will deadlock in the non-SRCU case, so avoid that by resuming the
+supplier device in device_link_add() before calling
+device_links_write_lock().
+
+Fixes: 21d5c57b3726 ("PM / runtime: Use device links")
+Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 562385c47fa44..c228b4ebf554b 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -201,12 +201,21 @@ struct device_link *device_link_add(struct device *consumer,
+ 				    struct device *supplier, u32 flags)
+ {
+ 	struct device_link *link;
++	bool rpm_put_supplier = false;
+ 
+ 	if (!consumer || !supplier ||
+ 	    (flags & DL_FLAG_STATELESS &&
+ 	     flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
+ 		return NULL;
+ 
++	if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) {
++		if (pm_runtime_get_sync(supplier) < 0) {
++			pm_runtime_put_noidle(supplier);
++			return NULL;
++		}
++		rpm_put_supplier = true;
++	}
++
+ 	device_links_write_lock();
+ 	device_pm_lock();
+ 
+@@ -250,13 +259,8 @@ struct device_link *device_link_add(struct device *consumer,
+ 
+ 	if (flags & DL_FLAG_PM_RUNTIME) {
+ 		if (flags & DL_FLAG_RPM_ACTIVE) {
+-			if (pm_runtime_get_sync(supplier) < 0) {
+-				pm_runtime_put_noidle(supplier);
+-				kfree(link);
+-				link = NULL;
+-				goto out;
+-			}
+ 			link->rpm_active = true;
++			rpm_put_supplier = false;
+ 		}
+ 		pm_runtime_new_link(consumer);
+ 		/*
+@@ -328,6 +332,10 @@ struct device_link *device_link_add(struct device *consumer,
+  out:
+ 	device_pm_unlock();
+ 	device_links_write_unlock();
++
++	if (rpm_put_supplier)
++		pm_runtime_put(supplier);
++
+ 	return link;
+ }
+ EXPORT_SYMBOL_GPL(device_link_add);
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-fix-dl_flag_autoremove_supplier-device-l.patch b/queue-4.19/driver-core-fix-dl_flag_autoremove_supplier-device-l.patch
new file mode 100644
index 00000000000..4c3845cb976
--- /dev/null
+++ b/queue-4.19/driver-core-fix-dl_flag_autoremove_supplier-device-l.patch
@@ -0,0 +1,80 @@
+From b11e859889122b2b6c4f04b07261bcacef95343e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 01:45:55 +0100
+Subject: driver core: Fix DL_FLAG_AUTOREMOVE_SUPPLIER device link flag
+ handling
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit c8d50986da5d74ddfc233b13b91d0a13369fa164 ]
+
+Change the list walk in device_links_driver_cleanup() to a safe one
+to avoid use-after-free when dropping a link from the list during the
+walk.
+
+Also, while at it, fix device_link_add() to refuse to create
+stateless device links with DL_FLAG_AUTOREMOVE_SUPPLIER set, which is
+an invalid combination (setting that flag means that the driver core
+should manage the link, so it cannot be stateless), and extend the
+kerneldoc comment of device_link_add() to cover the
+DL_FLAG_AUTOREMOVE_SUPPLIER flag properly too.
+
+Fixes: 1689cac5b32a ("driver core: Add flag to autoremove device link on supplier unbind")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 985ccced33a21..055132f2292aa 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -179,10 +179,14 @@ void device_pm_move_to_tail(struct device *dev)
+  * of the link.  If DL_FLAG_PM_RUNTIME is not set, DL_FLAG_RPM_ACTIVE will be
+  * ignored.
+  *
+- * If the DL_FLAG_AUTOREMOVE_CONSUMER is set, the link will be removed
+- * automatically when the consumer device driver unbinds from it.
+- * The combination of both DL_FLAG_AUTOREMOVE_CONSUMER and DL_FLAG_STATELESS
+- * set is invalid and will cause NULL to be returned.
++ * If the DL_FLAG_AUTOREMOVE_CONSUMER flag is set, the link will be removed
++ * automatically when the consumer device driver unbinds from it.  Analogously,
++ * if DL_FLAG_AUTOREMOVE_SUPPLIER is set in @flags, the link will be removed
++ * automatically when the supplier device driver unbinds from it.
++ *
++ * The combination of DL_FLAG_STATELESS and either DL_FLAG_AUTOREMOVE_CONSUMER
++ * or DL_FLAG_AUTOREMOVE_SUPPLIER set in @flags at the same time is invalid and
++ * will cause NULL to be returned upfront.
+  *
+  * A side effect of the link creation is re-ordering of dpm_list and the
+  * devices_kset list by moving the consumer device and all devices depending
+@@ -199,8 +203,8 @@ struct device_link *device_link_add(struct device *consumer,
+ 	struct device_link *link;
+ 
+ 	if (!consumer || !supplier ||
+-	    ((flags & DL_FLAG_STATELESS) &&
+-	     (flags & DL_FLAG_AUTOREMOVE_CONSUMER)))
++	    (flags & DL_FLAG_STATELESS &&
++	     flags & (DL_FLAG_AUTOREMOVE_CONSUMER | DL_FLAG_AUTOREMOVE_SUPPLIER)))
+ 		return NULL;
+ 
+ 	device_links_write_lock();
+@@ -539,11 +543,11 @@ void device_links_no_driver(struct device *dev)
+  */
+ void device_links_driver_cleanup(struct device *dev)
+ {
+-	struct device_link *link;
++	struct device_link *link, *ln;
+ 
+ 	device_links_write_lock();
+ 
+-	list_for_each_entry(link, &dev->links.consumers, s_node) {
++	list_for_each_entry_safe(link, ln, &dev->links.consumers, s_node) {
+ 		if (link->flags & DL_FLAG_STATELESS)
+ 			continue;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-fix-handling-of-runtime-pm-flags-in-devi.patch b/queue-4.19/driver-core-fix-handling-of-runtime-pm-flags-in-devi.patch
new file mode 100644
index 00000000000..643e3e85200
--- /dev/null
+++ b/queue-4.19/driver-core-fix-handling-of-runtime-pm-flags-in-devi.patch
@@ -0,0 +1,222 @@
+From 039b301c0109008160468ba67d46a1df617d4075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 01:49:14 +0100
+Subject: driver core: Fix handling of runtime PM flags in device_link_add()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit e2f3cd831a280fc226118d9369bf3f77aab58c56 ]
+
+After commit ead18c23c263 ("driver core: Introduce device links
+reference counting"), if there is a link between the given supplier
+and the given consumer already, device_link_add() will refcount it
+and return it unconditionally without updating its flags.  It is
+possible, however, that the second (or any subsequent) caller of
+device_link_add() for the same consumer-supplier pair will pass
+DL_FLAG_PM_RUNTIME, possibly along with DL_FLAG_RPM_ACTIVE, in flags
+to it and the existing link may not behave as expected then.
+
+First, if DL_FLAG_PM_RUNTIME is not set in the existing link's flags
+at all, it needs to be set like during the original initialization of
+the link.
+
+Second, if DL_FLAG_RPM_ACTIVE is passed to device_link_add() in flags
+(in addition to DL_FLAG_PM_RUNTIME), the existing link should to be
+updated to reflect the "active" runtime PM configuration of the
+consumer-supplier pair and extra care must be taken here to avoid
+possible destructive races with runtime PM of the consumer.
+
+To that end, redefine the rpm_active field in struct device_link
+as a refcount, initialize it to 1 and make rpm_resume() (for the
+consumer) and device_link_add() increment it whenever they acquire
+a runtime PM reference on the supplier device.  Accordingly, make
+rpm_suspend() (for the consumer) and pm_runtime_clean_up_links()
+decrement it and drop runtime PM references to the supplier
+device in a loop until rpm_active becones 1 again.
+
+Fixes: ead18c23c263 ("driver core: Introduce device links reference counting")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c          | 45 ++++++++++++++++++++++++------------
+ drivers/base/power/runtime.c | 26 +++++++++------------
+ include/linux/device.h       |  2 +-
+ 3 files changed, 42 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index c228b4ebf554b..20ae18f44dcdf 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -165,6 +165,19 @@ void device_pm_move_to_tail(struct device *dev)
+ 	device_links_read_unlock(idx);
+ }
+ 
++static void device_link_rpm_prepare(struct device *consumer,
++				    struct device *supplier)
++{
++	pm_runtime_new_link(consumer);
++	/*
++	 * If the link is being added by the consumer driver at probe time,
++	 * balance the decrementation of the supplier's runtime PM usage counter
++	 * after consumer probe in driver_probe_device().
++	 */
++	if (consumer->links.status == DL_DEV_PROBING)
++		pm_runtime_get_noresume(supplier);
++}
++
+ /**
+  * device_link_add - Create a link between two devices.
+  * @consumer: Consumer end of the link.
+@@ -201,7 +214,6 @@ struct device_link *device_link_add(struct device *consumer,
+ 				    struct device *supplier, u32 flags)
+ {
+ 	struct device_link *link;
+-	bool rpm_put_supplier = false;
+ 
+ 	if (!consumer || !supplier ||
+ 	    (flags & DL_FLAG_STATELESS &&
+@@ -213,7 +225,6 @@ struct device_link *device_link_add(struct device *consumer,
+ 			pm_runtime_put_noidle(supplier);
+ 			return NULL;
+ 		}
+-		rpm_put_supplier = true;
+ 	}
+ 
+ 	device_links_write_lock();
+@@ -249,6 +260,15 @@ struct device_link *device_link_add(struct device *consumer,
+ 		if (flags & DL_FLAG_AUTOREMOVE_SUPPLIER)
+ 			link->flags |= DL_FLAG_AUTOREMOVE_SUPPLIER;
+ 
++		if (flags & DL_FLAG_PM_RUNTIME) {
++			if (!(link->flags & DL_FLAG_PM_RUNTIME)) {
++				device_link_rpm_prepare(consumer, supplier);
++				link->flags |= DL_FLAG_PM_RUNTIME;
++			}
++			if (flags & DL_FLAG_RPM_ACTIVE)
++				refcount_inc(&link->rpm_active);
++		}
++
+ 		kref_get(&link->kref);
+ 		goto out;
+ 	}
+@@ -257,20 +277,15 @@ struct device_link *device_link_add(struct device *consumer,
+ 	if (!link)
+ 		goto out;
+ 
++	refcount_set(&link->rpm_active, 1);
++
+ 	if (flags & DL_FLAG_PM_RUNTIME) {
+-		if (flags & DL_FLAG_RPM_ACTIVE) {
+-			link->rpm_active = true;
+-			rpm_put_supplier = false;
+-		}
+-		pm_runtime_new_link(consumer);
+-		/*
+-		 * If the link is being added by the consumer driver at probe
+-		 * time, balance the decrementation of the supplier's runtime PM
+-		 * usage counter after consumer probe in driver_probe_device().
+-		 */
+-		if (consumer->links.status == DL_DEV_PROBING)
+-			pm_runtime_get_noresume(supplier);
++		if (flags & DL_FLAG_RPM_ACTIVE)
++			refcount_inc(&link->rpm_active);
++
++		device_link_rpm_prepare(consumer, supplier);
+ 	}
++
+ 	get_device(supplier);
+ 	link->supplier = supplier;
+ 	INIT_LIST_HEAD(&link->s_node);
+@@ -333,7 +348,7 @@ struct device_link *device_link_add(struct device *consumer,
+ 	device_pm_unlock();
+ 	device_links_write_unlock();
+ 
+-	if (rpm_put_supplier)
++	if ((flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) && !link)
+ 		pm_runtime_put(supplier);
+ 
+ 	return link;
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index beb85c31f3fa3..b914932d3ca1a 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -268,11 +268,8 @@ static int rpm_get_suppliers(struct device *dev)
+ 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node) {
+ 		int retval;
+ 
+-		if (!(link->flags & DL_FLAG_PM_RUNTIME))
+-			continue;
+-
+-		if (READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND ||
+-		    link->rpm_active)
++		if (!(link->flags & DL_FLAG_PM_RUNTIME) ||
++		    READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND)
+ 			continue;
+ 
+ 		retval = pm_runtime_get_sync(link->supplier);
+@@ -281,7 +278,7 @@ static int rpm_get_suppliers(struct device *dev)
+ 			pm_runtime_put_noidle(link->supplier);
+ 			return retval;
+ 		}
+-		link->rpm_active = true;
++		refcount_inc(&link->rpm_active);
+ 	}
+ 	return 0;
+ }
+@@ -290,12 +287,13 @@ static void rpm_put_suppliers(struct device *dev)
+ {
+ 	struct device_link *link;
+ 
+-	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+-		if (link->rpm_active &&
+-		    READ_ONCE(link->status) != DL_STATE_SUPPLIER_UNBIND) {
++	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node) {
++		if (READ_ONCE(link->status) == DL_STATE_SUPPLIER_UNBIND)
++			continue;
++
++		while (refcount_dec_not_one(&link->rpm_active))
+ 			pm_runtime_put(link->supplier);
+-			link->rpm_active = false;
+-		}
++	}
+ }
+ 
+ /**
+@@ -1531,7 +1529,7 @@ void pm_runtime_remove(struct device *dev)
+  *
+  * Check links from this device to any consumers and if any of them have active
+  * runtime PM references to the device, drop the usage counter of the device
+- * (once per link).
++ * (as many times as needed).
+  *
+  * Links with the DL_FLAG_STATELESS flag set are ignored.
+  *
+@@ -1553,10 +1551,8 @@ void pm_runtime_clean_up_links(struct device *dev)
+ 		if (link->flags & DL_FLAG_STATELESS)
+ 			continue;
+ 
+-		if (link->rpm_active) {
++		while (refcount_dec_not_one(&link->rpm_active))
+ 			pm_runtime_put_noidle(dev);
+-			link->rpm_active = false;
+-		}
+ 	}
+ 
+ 	device_links_read_unlock(idx);
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 19dd8852602c4..b8fd2a1f859db 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -849,7 +849,7 @@ struct device_link {
+ 	struct list_head c_node;
+ 	enum device_link_state status;
+ 	u32 flags;
+-	bool rpm_active;
++	refcount_t rpm_active;
+ 	struct kref kref;
+ #ifdef CONFIG_SRCU
+ 	struct rcu_head rcu_head;
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-fix-pm-runtime-for-links-added-during-co.patch b/queue-4.19/driver-core-fix-pm-runtime-for-links-added-during-co.patch
new file mode 100644
index 00000000000..490c4f9ebb7
--- /dev/null
+++ b/queue-4.19/driver-core-fix-pm-runtime-for-links-added-during-co.patch
@@ -0,0 +1,165 @@
+From 517cc0a38eecd0156a804565646e948a356085e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 17:53:26 +0100
+Subject: driver core: Fix PM-runtime for links added during consumer probe
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 36003d4cf57ca431fb3f94d317bcca426a2394d6 ]
+
+Commit 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage
+counter imbalance") introduced a regression that causes suppliers
+to be suspended prematurely for device links added during consumer
+driver probe if the initial PM-runtime status of the consumer is
+"suspended" and the consumer is resumed after adding the link and
+before pm_runtime_put_suppliers() is called.  In that case,
+pm_runtime_put_suppliers() will drop the rpm_active refcount for
+the link by one and (since rpm_active is equal to two after the
+preceding consumer resume) the supplier's PM-runtime usage counter
+will be decremented, which may cause the supplier to suspend even
+though the consumer's PM-runtime status is "active".
+
+For this reason, partially revert commit 4c06c4e6cf63 as the problem
+it tried to fix needs to be addressed somewhat differently, and
+change pm_runtime_get_suppliers() and pm_runtime_put_suppliers() so
+that the latter only drops rpm_active references acquired by the
+former.  [This requires adding a new field to struct device_link,
+but I coulnd't find a cleaner way to address the issue that would
+work in all cases.]
+
+This causes pm_runtime_put_suppliers() to effectively ignore device
+links added during consumer probe, so device_link_add() doesn't need
+to worry about ensuring that suppliers will remain active after
+pm_runtime_put_suppliers() for links created with DL_FLAG_RPM_ACTIVE
+set and it only needs to bump up rpm_active by one for those links,
+so pm_runtime_active_link() is not necessary any more.
+
+Fixes: 4c06c4e6cf63 ("driver core: Fix possible supplier PM-usage counter imbalance")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c          |  4 ++--
+ drivers/base/power/runtime.c | 29 ++++++-----------------------
+ include/linux/device.h       |  1 +
+ include/linux/pm_runtime.h   |  4 ----
+ 4 files changed, 9 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index ab08211ba5d2d..742bc60e9ccac 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -253,7 +253,7 @@ struct device_link *device_link_add(struct device *consumer,
+ 				link->flags |= DL_FLAG_PM_RUNTIME;
+ 			}
+ 			if (flags & DL_FLAG_RPM_ACTIVE)
+-				pm_runtime_active_link(link, supplier);
++				refcount_inc(&link->rpm_active);
+ 		}
+ 
+ 		kref_get(&link->kref);
+@@ -268,7 +268,7 @@ struct device_link *device_link_add(struct device *consumer,
+ 
+ 	if (flags & DL_FLAG_PM_RUNTIME) {
+ 		if (flags & DL_FLAG_RPM_ACTIVE)
+-			pm_runtime_active_link(link, supplier);
++			refcount_inc(&link->rpm_active);
+ 
+ 		pm_runtime_new_link(consumer);
+ 	}
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 0527890b4c191..303ce7d54a306 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1571,6 +1571,7 @@ void pm_runtime_get_suppliers(struct device *dev)
+ 
+ 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+ 		if (link->flags & DL_FLAG_PM_RUNTIME) {
++			link->supplier_preactivated = true;
+ 			refcount_inc(&link->rpm_active);
+ 			pm_runtime_get_sync(link->supplier);
+ 		}
+@@ -1590,9 +1591,11 @@ void pm_runtime_put_suppliers(struct device *dev)
+ 	idx = device_links_read_lock();
+ 
+ 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+-		if (link->flags & DL_FLAG_PM_RUNTIME &&
+-		    refcount_dec_not_one(&link->rpm_active))
+-			pm_runtime_put(link->supplier);
++		if (link->supplier_preactivated) {
++			link->supplier_preactivated = false;
++			if (refcount_dec_not_one(&link->rpm_active))
++				pm_runtime_put(link->supplier);
++		}
+ 
+ 	device_links_read_unlock(idx);
+ }
+@@ -1604,26 +1607,6 @@ void pm_runtime_new_link(struct device *dev)
+ 	spin_unlock_irq(&dev->power.lock);
+ }
+ 
+-/**
+- * pm_runtime_active_link - Set up new device link as active for PM-runtime.
+- * @link: Device link to be set up as active.
+- * @supplier: Supplier end of the link.
+- *
+- * Add 2 to the rpm_active refcount of @link and increment the PM-runtime
+- * usage counter of @supplier once more in case the link is being added while
+- * the consumer driver is probing and pm_runtime_put_suppliers() will be called
+- * subsequently.
+- *
+- * Note that this doesn't prevent rpm_put_suppliers() from decreasing the link's
+- * rpm_active refcount down to one, so runtime suspend of the consumer end of
+- * @link is not affected.
+- */
+-void pm_runtime_active_link(struct device_link *link, struct device *supplier)
+-{
+-	refcount_add(2, &link->rpm_active);
+-	pm_runtime_get_noresume(supplier);
+-}
+-
+ void pm_runtime_drop_link(struct device *dev)
+ {
+ 	spin_lock_irq(&dev->power.lock);
+diff --git a/include/linux/device.h b/include/linux/device.h
+index b8fd2a1f859db..e9d1c768f972a 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -854,6 +854,7 @@ struct device_link {
+ #ifdef CONFIG_SRCU
+ 	struct rcu_head rcu_head;
+ #endif
++	bool supplier_preactivated; /* Owned by consumer probe. */
+ };
+ 
+ /**
+diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
+index bace7df51af4d..f0fc4700b6ff5 100644
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -59,8 +59,6 @@ extern void pm_runtime_clean_up_links(struct device *dev);
+ extern void pm_runtime_get_suppliers(struct device *dev);
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
+-extern void pm_runtime_active_link(struct device_link *link,
+-				   struct device *supplier);
+ extern void pm_runtime_drop_link(struct device *dev);
+ 
+ static inline void pm_suspend_ignore_children(struct device *dev, bool enable)
+@@ -178,8 +176,6 @@ static inline void pm_runtime_clean_up_links(struct device *dev) {}
+ static inline void pm_runtime_get_suppliers(struct device *dev) {}
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
+-static inline void pm_runtime_active_link(struct device_link *link,
+-					  struct device *supplier) {}
+ static inline void pm_runtime_drop_link(struct device *dev) {}
+ 
+ #endif /* !CONFIG_PM */
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-core-fix-possible-supplier-pm-usage-counter-i.patch b/queue-4.19/driver-core-fix-possible-supplier-pm-usage-counter-i.patch
new file mode 100644
index 00000000000..badca2af21b
--- /dev/null
+++ b/queue-4.19/driver-core-fix-possible-supplier-pm-usage-counter-i.patch
@@ -0,0 +1,179 @@
+From e9a1fbb1c1e56a148b40f53739ce1e6917a937c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 13:08:10 +0100
+Subject: driver core: Fix possible supplier PM-usage counter imbalance
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 4c06c4e6cf63d7f3d5dfe62593a073253d750a59 ]
+
+If a stateless device link to a certain supplier with
+DL_FLAG_PM_RUNTIME set in the flags is added and then removed by the
+consumer driver's probe callback, the supplier's PM-runtime usage
+counter will be nonzero after that which effectively causes the
+supplier to remain "always on" going forward.
+
+Namely, device_link_add() called to add the link invokes
+device_link_rpm_prepare() which notices that the consumer driver is
+probing, so it increments the supplier's PM-runtime usage counter
+with the assumption that the link will stay around until
+pm_runtime_put_suppliers() is called by driver_probe_device(),
+but if the link goes away before that point, the supplier's
+PM-runtime usage counter will remain nonzero.
+
+To prevent that from happening, first rework pm_runtime_get_suppliers()
+and pm_runtime_put_suppliers() to use the rpm_active refounts of device
+links and make the latter only drop rpm_active and the supplier's
+PM-runtime usage counter for each link by one, unless rpm_active is
+one already for it.  Next, modify device_link_add() to bump up the
+new link's rpm_active refcount and the suppliers PM-runtime usage
+counter by two, to prevent pm_runtime_put_suppliers(), if it is
+called subsequently, from suspending the supplier prematurely (in
+case its PM-runtime usage counter goes down to 0 in there).
+
+Due to the way rpm_put_suppliers() works, this change does not
+affect runtime suspend of the consumer ends of new device links (or,
+generally, device links for which DL_FLAG_PM_RUNTIME has just been
+set).
+
+Fixes: e2f3cd831a28 ("driver core: Fix handling of runtime PM flags in device_link_add()")
+Reported-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c          | 21 ++++-----------------
+ drivers/base/power/runtime.c | 27 +++++++++++++++++++++++++--
+ include/linux/pm_runtime.h   |  4 ++++
+ 3 files changed, 33 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 7599147d5f83c..ab08211ba5d2d 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -165,19 +165,6 @@ void device_pm_move_to_tail(struct device *dev)
+ 	device_links_read_unlock(idx);
+ }
+ 
+-static void device_link_rpm_prepare(struct device *consumer,
+-				    struct device *supplier)
+-{
+-	pm_runtime_new_link(consumer);
+-	/*
+-	 * If the link is being added by the consumer driver at probe time,
+-	 * balance the decrementation of the supplier's runtime PM usage counter
+-	 * after consumer probe in driver_probe_device().
+-	 */
+-	if (consumer->links.status == DL_DEV_PROBING)
+-		pm_runtime_get_noresume(supplier);
+-}
+-
+ /**
+  * device_link_add - Create a link between two devices.
+  * @consumer: Consumer end of the link.
+@@ -262,11 +249,11 @@ struct device_link *device_link_add(struct device *consumer,
+ 
+ 		if (flags & DL_FLAG_PM_RUNTIME) {
+ 			if (!(link->flags & DL_FLAG_PM_RUNTIME)) {
+-				device_link_rpm_prepare(consumer, supplier);
++				pm_runtime_new_link(consumer);
+ 				link->flags |= DL_FLAG_PM_RUNTIME;
+ 			}
+ 			if (flags & DL_FLAG_RPM_ACTIVE)
+-				refcount_inc(&link->rpm_active);
++				pm_runtime_active_link(link, supplier);
+ 		}
+ 
+ 		kref_get(&link->kref);
+@@ -281,9 +268,9 @@ struct device_link *device_link_add(struct device *consumer,
+ 
+ 	if (flags & DL_FLAG_PM_RUNTIME) {
+ 		if (flags & DL_FLAG_RPM_ACTIVE)
+-			refcount_inc(&link->rpm_active);
++			pm_runtime_active_link(link, supplier);
+ 
+-		device_link_rpm_prepare(consumer, supplier);
++		pm_runtime_new_link(consumer);
+ 	}
+ 
+ 	get_device(supplier);
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index ab454c4533ba1..0527890b4c191 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1570,8 +1570,10 @@ void pm_runtime_get_suppliers(struct device *dev)
+ 	idx = device_links_read_lock();
+ 
+ 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+-		if (link->flags & DL_FLAG_PM_RUNTIME)
++		if (link->flags & DL_FLAG_PM_RUNTIME) {
++			refcount_inc(&link->rpm_active);
+ 			pm_runtime_get_sync(link->supplier);
++		}
+ 
+ 	device_links_read_unlock(idx);
+ }
+@@ -1588,7 +1590,8 @@ void pm_runtime_put_suppliers(struct device *dev)
+ 	idx = device_links_read_lock();
+ 
+ 	list_for_each_entry_rcu(link, &dev->links.suppliers, c_node)
+-		if (link->flags & DL_FLAG_PM_RUNTIME)
++		if (link->flags & DL_FLAG_PM_RUNTIME &&
++		    refcount_dec_not_one(&link->rpm_active))
+ 			pm_runtime_put(link->supplier);
+ 
+ 	device_links_read_unlock(idx);
+@@ -1601,6 +1604,26 @@ void pm_runtime_new_link(struct device *dev)
+ 	spin_unlock_irq(&dev->power.lock);
+ }
+ 
++/**
++ * pm_runtime_active_link - Set up new device link as active for PM-runtime.
++ * @link: Device link to be set up as active.
++ * @supplier: Supplier end of the link.
++ *
++ * Add 2 to the rpm_active refcount of @link and increment the PM-runtime
++ * usage counter of @supplier once more in case the link is being added while
++ * the consumer driver is probing and pm_runtime_put_suppliers() will be called
++ * subsequently.
++ *
++ * Note that this doesn't prevent rpm_put_suppliers() from decreasing the link's
++ * rpm_active refcount down to one, so runtime suspend of the consumer end of
++ * @link is not affected.
++ */
++void pm_runtime_active_link(struct device_link *link, struct device *supplier)
++{
++	refcount_add(2, &link->rpm_active);
++	pm_runtime_get_noresume(supplier);
++}
++
+ void pm_runtime_drop_link(struct device *dev)
+ {
+ 	spin_lock_irq(&dev->power.lock);
+diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
+index f0fc4700b6ff5..bace7df51af4d 100644
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -59,6 +59,8 @@ extern void pm_runtime_clean_up_links(struct device *dev);
+ extern void pm_runtime_get_suppliers(struct device *dev);
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
++extern void pm_runtime_active_link(struct device_link *link,
++				   struct device *supplier);
+ extern void pm_runtime_drop_link(struct device *dev);
+ 
+ static inline void pm_suspend_ignore_children(struct device *dev, bool enable)
+@@ -176,6 +178,8 @@ static inline void pm_runtime_clean_up_links(struct device *dev) {}
+ static inline void pm_runtime_get_suppliers(struct device *dev) {}
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
++static inline void pm_runtime_active_link(struct device_link *link,
++					  struct device *supplier) {}
+ static inline void pm_runtime_drop_link(struct device *dev) {}
+ 
+ #endif /* !CONFIG_PM */
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch b/queue-4.19/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch
new file mode 100644
index 00000000000..0e83726d462
--- /dev/null
+++ b/queue-4.19/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch
@@ -0,0 +1,41 @@
+From c02d122f26bf95c048aa9b9b977297f40167fa6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 06:45:37 +0800
+Subject: driver: uio: fix possible memory leak in __uio_register_device
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 1a392b3de7c5747506b38fc14b2e79977d3c7770 ]
+
+'idev' is malloced in __uio_register_device() and leak free it before
+leaving from the uio_get_minor() error handing case, it will cause
+memory leak.
+
+Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 2762148c169df..e4b418757017f 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -938,8 +938,10 @@ int __uio_register_device(struct module *owner,
+ 	atomic_set(&idev->event, 0);
+ 
+ 	ret = uio_get_minor(idev);
+-	if (ret)
++	if (ret) {
++		kfree(idev);
+ 		return ret;
++	}
+ 
+ 	idev->dev.devt = MKDEV(uio_major, idev->minor);
+ 	idev->dev.class = &uio_class;
+-- 
+2.20.1
+
diff --git a/queue-4.19/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch b/queue-4.19/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch
new file mode 100644
index 00000000000..f218a6d22a8
--- /dev/null
+++ b/queue-4.19/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch
@@ -0,0 +1,58 @@
+From db6cfd5b3790cc17efe88d3cc13cc3edc3d52d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 06:45:38 +0800
+Subject: driver: uio: fix possible use-after-free in __uio_register_device
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]
+
+In uio_dev_add_attributes() error handing case, idev is used after
+device_unregister(), in which 'idev' has been released, touch idev cause
+use-after-free.
+
+Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index e4b418757017f..9c788748bdc65 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -943,6 +943,7 @@ int __uio_register_device(struct module *owner,
+ 		return ret;
+ 	}
+ 
++	device_initialize(&idev->dev);
+ 	idev->dev.devt = MKDEV(uio_major, idev->minor);
+ 	idev->dev.class = &uio_class;
+ 	idev->dev.parent = parent;
+@@ -953,7 +954,7 @@ int __uio_register_device(struct module *owner,
+ 	if (ret)
+ 		goto err_device_create;
+ 
+-	ret = device_register(&idev->dev);
++	ret = device_add(&idev->dev);
+ 	if (ret)
+ 		goto err_device_create;
+ 
+@@ -985,9 +986,10 @@ int __uio_register_device(struct module *owner,
+ err_request_irq:
+ 	uio_dev_del_attributes(idev);
+ err_uio_dev_add_attributes:
+-	device_unregister(&idev->dev);
++	device_del(&idev->dev);
+ err_device_create:
+ 	uio_free_minor(idev);
++	put_device(&idev->dev);
+ 	return ret;
+ }
+ EXPORT_SYMBOL_GPL(__uio_register_device);
+-- 
+2.20.1
+
diff --git a/queue-4.19/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch b/queue-4.19/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
new file mode 100644
index 00000000000..c7ba192efd1
--- /dev/null
+++ b/queue-4.19/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
@@ -0,0 +1,44 @@
+From 1712063f596dd8ca3235b037b3eb61258b0f136c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 16:29:33 -0800
+Subject: drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ]
+
+If riocm_get_channel() fails, then we should just return -EINVAL.
+Calling riocm_put_channel() will trigger a NULL dereference and
+generally we should call put() if the get() didn't succeed.
+
+Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam
+Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Alexandre Bounine <alexandre.bounine@idt.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rapidio/rio_cm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
+index ef989a15aefc4..b29fc258eeba4 100644
+--- a/drivers/rapidio/rio_cm.c
++++ b/drivers/rapidio/rio_cm.c
+@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
+ 	riocm_debug(CHOP, "(ch_%d)", ch_id);
+ 
+ 	ch = riocm_get_channel(ch_id);
+-	if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
++	if (!ch)
++		return -EINVAL;
++	if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+ 		ret = -EINVAL;
+ 	riocm_put_channel(ch);
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-dp_mst-skip-validating-ports-during-destruction-.patch b/queue-4.19/drm-dp_mst-skip-validating-ports-during-destruction-.patch
new file mode 100644
index 00000000000..17921d6463a
--- /dev/null
+++ b/queue-4.19/drm-dp_mst-skip-validating-ports-during-destruction-.patch
@@ -0,0 +1,90 @@
+From c2456d9206f1b0dfab30b25cef6a65f2f4842282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 17:46:14 -0500
+Subject: drm/dp_mst: Skip validating ports during destruction, just ref
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]
+
+Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
+accidentally introduced into DRM two years ago.
+
+Pretend we have a topology like this:
+
+|- DP-1: mst_primary
+   |- DP-4: active display
+   |- DP-5: disconnected
+   |- DP-6: active hub
+      |- DP-7: active display
+      |- DP-8: disconnected
+      |- DP-9: disconnected
+
+If we unplug DP-6, the topology starting at DP-7 will be destroyed but
+it's payloads will live on in DP-1's VCPI allocations and thus require
+removal. However, this removal currently fails because
+drm_dp_update_payload_part1() will (rightly so) try to validate the port
+before accessing it, fail then abort. If we keep going, eventually we
+run the MST hub out of bandwidth and all new allocations will start to
+fail (or in my case; all new displays just start flickering a ton).
+
+We could just teach drm_dp_update_payload_part1() not to drop the port
+ref in this case, but then we also need to teach
+drm_dp_destroy_payload_step1() to do the same thing, then hope no one
+ever adds anything to the that requires a validated port reference in
+drm_dp_destroy_connector_work(). Kind of sketchy.
+
+So let's go with a more clever solution: any port that
+drm_dp_destroy_connector_work() interacts with is guaranteed to still
+exist in memory until we say so. While said port might not be valid we
+don't really care: that's the whole reason we're destroying it in the
+first place! So, teach drm_dp_get_validated_port_ref() to use the all
+mighty current_work() function to avoid attempting to validate ports
+from the context of mgr->destroy_connector_work. I can't see any
+situation where this wouldn't be safe, and this avoids having to play
+whack-a-mole in the future of trying to work around port validation.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
+Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: <stable@vger.kernel.org> # v4.6+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 4d77158453060..58fe3945494cf 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1022,9 +1022,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
+ static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
+ {
+ 	struct drm_dp_mst_port *rport = NULL;
++
+ 	mutex_lock(&mgr->lock);
+-	if (mgr->mst_primary)
+-		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
++	/*
++	 * Port may or may not be 'valid' but we don't care about that when
++	 * destroying the port and we are guaranteed that the port pointer
++	 * will be valid until we've finished
++	 */
++	if (current_work() == &mgr->destroy_connector_work) {
++		kref_get(&port->kref);
++		rport = port;
++	} else if (mgr->mst_primary) {
++		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
++						       port);
++	}
+ 	mutex_unlock(&mgr->lock);
+ 	return rport;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-etnaviv-fix-some-off-by-one-bugs.patch b/queue-4.19/drm-etnaviv-fix-some-off-by-one-bugs.patch
new file mode 100644
index 00000000000..55777f7c298
--- /dev/null
+++ b/queue-4.19/drm-etnaviv-fix-some-off-by-one-bugs.patch
@@ -0,0 +1,58 @@
+From d42bf9a11e95e7a58e34d2a46969cc22fbfe0eb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Jul 2018 18:00:18 +0300
+Subject: drm/etnaviv: fix some off by one bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f5fd9fd4000984f19db689282054953981a50534 ]
+
+The ->nr_signal is the supposed to be the number of elements in the
+->signal array.  There was one place where it was 5 but it was supposed
+to be 4.  That looks like a copy and paste bug.  There were also two
+checks that were off by one.
+
+Fixes: 9e2c2e273012 ("drm/etnaviv: add infrastructure to query perf counter")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Tested-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_perfmon.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+index 9980d81a26e3c..4227a4006c349 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
+@@ -113,7 +113,7 @@ static const struct etnaviv_pm_domain doms_3d[] = {
+ 		.name = "PE",
+ 		.profile_read = VIVS_MC_PROFILE_PE_READ,
+ 		.profile_config = VIVS_MC_PROFILE_CONFIG0,
+-		.nr_signals = 5,
++		.nr_signals = 4,
+ 		.signal = (const struct etnaviv_pm_signal[]) {
+ 			{
+ 				"PIXEL_COUNT_KILLED_BY_COLOR_PIPE",
+@@ -435,7 +435,7 @@ int etnaviv_pm_query_sig(struct etnaviv_gpu *gpu,
+ 
+ 	dom = meta->domains + signal->domain;
+ 
+-	if (signal->iter > dom->nr_signals)
++	if (signal->iter >= dom->nr_signals)
+ 		return -EINVAL;
+ 
+ 	sig = &dom->signal[signal->iter];
+@@ -461,7 +461,7 @@ int etnaviv_pm_req_validate(const struct drm_etnaviv_gem_submit_pmr *r,
+ 
+ 	dom = meta->domains + r->domain;
+ 
+-	if (r->signal > dom->nr_signals)
++	if (r->signal >= dom->nr_signals)
+ 		return -EINVAL;
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch b/queue-4.19/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
new file mode 100644
index 00000000000..3b70c0160da
--- /dev/null
+++ b/queue-4.19/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
@@ -0,0 +1,36 @@
+From 4fa344be2cd993e94e4d57852942b2138318783c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:49:46 +0300
+Subject: drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ]
+
+The etnaviv_gem_get_pages() never returns NULL.  It returns error
+pointers on error.
+
+Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+index 468dff2f79040..9d839b4fd8f78 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -217,7 +217,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ 		mutex_lock(&obj->lock);
+ 		pages = etnaviv_gem_get_pages(obj);
+ 		mutex_unlock(&obj->lock);
+-		if (pages) {
++		if (!IS_ERR(pages)) {
+ 			int j;
+ 
+ 			iter.hdr->data[0] = bomap - bomap_start;
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-etnaviv-potential-null-dereference.patch b/queue-4.19/drm-etnaviv-potential-null-dereference.patch
new file mode 100644
index 00000000000..314c288c09b
--- /dev/null
+++ b/queue-4.19/drm-etnaviv-potential-null-dereference.patch
@@ -0,0 +1,38 @@
+From 992c0e5d78bd162049ec7cd79894d6c8677323c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 12:08:19 +0300
+Subject: drm/etnaviv: potential NULL dereference
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9e05352340d3a3e68c144136db9810b26ebb88c3 ]
+
+The etnaviv_gem_prime_get_sg_table() is supposed to return error
+pointers.  Otherwise it can lead to a NULL dereference when it's called
+from drm_gem_map_dma_buf().
+
+Fixes: 5f4a4a73f437 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+index 0566171f8df22..f21529e635e3d 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+@@ -15,7 +15,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
+ 	int npages = obj->size >> PAGE_SHIFT;
+ 
+ 	if (WARN_ON(!etnaviv_obj->pages))  /* should have already pinned! */
+-		return NULL;
++		return ERR_PTR(-EINVAL);
+ 
+ 	return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-fb-helper-generic-call-drm_client_add-after-setu.patch b/queue-4.19/drm-fb-helper-generic-call-drm_client_add-after-setu.patch
new file mode 100644
index 00000000000..3389e151b55
--- /dev/null
+++ b/queue-4.19/drm-fb-helper-generic-call-drm_client_add-after-setu.patch
@@ -0,0 +1,52 @@
+From c14919ef18ba7b9b8981d77dbdcd7e52469a6525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 16:13:58 +0200
+Subject: drm/fb-helper: generic: Call drm_client_add() after setup is done
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Noralf Trønnes <noralf@tronnes.org>
+
+[ Upstream commit 6e3f17ee73f7e3c2ef0e2c8fd8624b2ece8ef2c9 ]
+
+Hotplug can happen while drm_fbdev_generic_setup() is running so move
+drm_client_add() call after setup is done to avoid
+drm_fbdev_client_hotplug() running in two threads at the same time.
+
+Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
+Cc: stable@vger.kernel.org
+Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190401141358.25309-1-noralf@tronnes.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_fb_helper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 1c87ad6667e73..da9a381d6b577 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -3257,8 +3257,6 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
+ 		return ret;
+ 	}
+ 
+-	drm_client_add(&fb_helper->client);
+-
+ 	if (!preferred_bpp)
+ 		preferred_bpp = dev->mode_config.preferred_depth;
+ 	if (!preferred_bpp)
+@@ -3267,6 +3265,8 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
+ 
+ 	drm_fbdev_client_hotplug(&fb_helper->client);
+ 
++	drm_client_add(&fb_helper->client);
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(drm_fbdev_generic_setup);
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-fb-helper-generic-fix-setup-error-path.patch b/queue-4.19/drm-fb-helper-generic-fix-setup-error-path.patch
new file mode 100644
index 00000000000..ca1c3f69e45
--- /dev/null
+++ b/queue-4.19/drm-fb-helper-generic-fix-setup-error-path.patch
@@ -0,0 +1,224 @@
+From cbdb3e25e066f6c4b7813fa493a8b8ff747abb6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 19:18:46 +0100
+Subject: drm/fb-helper: generic: Fix setup error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Noralf Trønnes <noralf@tronnes.org>
+
+[ Upstream commit 6e1490cf439aa86b104e5124c36275b964238e1f ]
+
+If register_framebuffer() fails during fbdev setup we will leak the
+framebuffer, the GEM buffer and the shadow buffer for defio. This is
+because drm_fb_helper_fbdev_setup() just calls drm_fb_helper_fini() on
+error not taking into account that register_framebuffer() can fail.
+
+Since the generic emulation uses DRM client for its framebuffer and
+backing buffer in addition to a shadow buffer, it's necessary to open code
+drm_fb_helper_fbdev_setup() to properly handle the error path.
+
+Error cleanup is removed from .fb_probe and is handled by one function for
+all paths.
+
+Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
+Reported-by: Peter Wu <peter@lekensteyn.nl>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190105181846.26495-1-noralf@tronnes.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_fb_helper.c | 98 +++++++++++++++++++--------------
+ 1 file changed, 58 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index f57fc1450b613..1c87ad6667e73 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -2979,18 +2979,16 @@ static int drm_fbdev_fb_release(struct fb_info *info, int user)
+ 	return 0;
+ }
+ 
+-/*
+- * fb_ops.fb_destroy is called by the last put_fb_info() call at the end of
+- * unregister_framebuffer() or fb_release().
+- */
+-static void drm_fbdev_fb_destroy(struct fb_info *info)
++static void drm_fbdev_cleanup(struct drm_fb_helper *fb_helper)
+ {
+-	struct drm_fb_helper *fb_helper = info->par;
+ 	struct fb_info *fbi = fb_helper->fbdev;
+ 	struct fb_ops *fbops = NULL;
+ 	void *shadow = NULL;
+ 
+-	if (fbi->fbdefio) {
++	if (!fb_helper->dev)
++		return;
++
++	if (fbi && fbi->fbdefio) {
+ 		fb_deferred_io_cleanup(fbi);
+ 		shadow = fbi->screen_buffer;
+ 		fbops = fbi->fbops;
+@@ -3004,6 +3002,12 @@ static void drm_fbdev_fb_destroy(struct fb_info *info)
+ 	}
+ 
+ 	drm_client_framebuffer_delete(fb_helper->buffer);
++}
++
++static void drm_fbdev_release(struct drm_fb_helper *fb_helper)
++{
++	drm_fbdev_cleanup(fb_helper);
++
+ 	/*
+ 	 * FIXME:
+ 	 * Remove conditional when all CMA drivers have been moved over to using
+@@ -3015,6 +3019,15 @@ static void drm_fbdev_fb_destroy(struct fb_info *info)
+ 	}
+ }
+ 
++/*
++ * fb_ops.fb_destroy is called by the last put_fb_info() call at the end of
++ * unregister_framebuffer() or fb_release().
++ */
++static void drm_fbdev_fb_destroy(struct fb_info *info)
++{
++	drm_fbdev_release(info->par);
++}
++
+ static int drm_fbdev_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ 	struct drm_fb_helper *fb_helper = info->par;
+@@ -3065,7 +3078,6 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ 	struct drm_framebuffer *fb;
+ 	struct fb_info *fbi;
+ 	u32 format;
+-	int ret;
+ 
+ 	DRM_DEBUG_KMS("surface width(%d), height(%d) and bpp(%d)\n",
+ 		      sizes->surface_width, sizes->surface_height,
+@@ -3082,10 +3094,8 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ 	fb = buffer->fb;
+ 
+ 	fbi = drm_fb_helper_alloc_fbi(fb_helper);
+-	if (IS_ERR(fbi)) {
+-		ret = PTR_ERR(fbi);
+-		goto err_free_buffer;
+-	}
++	if (IS_ERR(fbi))
++		return PTR_ERR(fbi);
+ 
+ 	fbi->par = fb_helper;
+ 	fbi->fbops = &drm_fbdev_fb_ops;
+@@ -3116,8 +3126,7 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ 		if (!fbops || !shadow) {
+ 			kfree(fbops);
+ 			vfree(shadow);
+-			ret = -ENOMEM;
+-			goto err_fb_info_destroy;
++			return -ENOMEM;
+ 		}
+ 
+ 		*fbops = *fbi->fbops;
+@@ -3129,13 +3138,6 @@ int drm_fb_helper_generic_probe(struct drm_fb_helper *fb_helper,
+ 	}
+ 
+ 	return 0;
+-
+-err_fb_info_destroy:
+-	drm_fb_helper_fini(fb_helper);
+-err_free_buffer:
+-	drm_client_framebuffer_delete(buffer);
+-
+-	return ret;
+ }
+ EXPORT_SYMBOL(drm_fb_helper_generic_probe);
+ 
+@@ -3147,18 +3149,11 @@ static void drm_fbdev_client_unregister(struct drm_client_dev *client)
+ {
+ 	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
+ 
+-	if (fb_helper->fbdev) {
+-		drm_fb_helper_unregister_fbi(fb_helper);
++	if (fb_helper->fbdev)
+ 		/* drm_fbdev_fb_destroy() takes care of cleanup */
+-		return;
+-	}
+-
+-	/* Did drm_fb_helper_fbdev_setup() run? */
+-	if (fb_helper->dev)
+-		drm_fb_helper_fini(fb_helper);
+-
+-	drm_client_release(client);
+-	kfree(fb_helper);
++		drm_fb_helper_unregister_fbi(fb_helper);
++	else
++		drm_fbdev_release(fb_helper);
+ }
+ 
+ static int drm_fbdev_client_restore(struct drm_client_dev *client)
+@@ -3174,7 +3169,7 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
+ 	struct drm_device *dev = client->dev;
+ 	int ret;
+ 
+-	/* If drm_fb_helper_fbdev_setup() failed, we only try once */
++	/* Setup is not retried if it has failed */
+ 	if (!fb_helper->dev && fb_helper->funcs)
+ 		return 0;
+ 
+@@ -3184,15 +3179,34 @@ static int drm_fbdev_client_hotplug(struct drm_client_dev *client)
+ 	if (!dev->mode_config.num_connector)
+ 		return 0;
+ 
+-	ret = drm_fb_helper_fbdev_setup(dev, fb_helper, &drm_fb_helper_generic_funcs,
+-					fb_helper->preferred_bpp, 0);
+-	if (ret) {
+-		fb_helper->dev = NULL;
+-		fb_helper->fbdev = NULL;
+-		return ret;
+-	}
++	drm_fb_helper_prepare(dev, fb_helper, &drm_fb_helper_generic_funcs);
++
++	ret = drm_fb_helper_init(dev, fb_helper, dev->mode_config.num_connector);
++	if (ret)
++		goto err;
++
++	ret = drm_fb_helper_single_add_all_connectors(fb_helper);
++	if (ret)
++		goto err_cleanup;
++
++	if (!drm_drv_uses_atomic_modeset(dev))
++		drm_helper_disable_unused_functions(dev);
++
++	ret = drm_fb_helper_initial_config(fb_helper, fb_helper->preferred_bpp);
++	if (ret)
++		goto err_cleanup;
+ 
+ 	return 0;
++
++err_cleanup:
++	drm_fbdev_cleanup(fb_helper);
++err:
++	fb_helper->dev = NULL;
++	fb_helper->fbdev = NULL;
++
++	DRM_DEV_ERROR(dev->dev, "fbdev: Failed to setup generic emulation (ret=%d)\n", ret);
++
++	return ret;
+ }
+ 
+ static const struct drm_client_funcs drm_fbdev_client_funcs = {
+@@ -3245,6 +3259,10 @@ int drm_fbdev_generic_setup(struct drm_device *dev, unsigned int preferred_bpp)
+ 
+ 	drm_client_add(&fb_helper->client);
+ 
++	if (!preferred_bpp)
++		preferred_bpp = dev->mode_config.preferred_depth;
++	if (!preferred_bpp)
++		preferred_bpp = 32;
+ 	fb_helper->preferred_bpp = preferred_bpp;
+ 
+ 	drm_fbdev_client_hotplug(&fb_helper->client);
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-fix-error-handling-in-drm_legacy_addctx.patch b/queue-4.19/drm-fix-error-handling-in-drm_legacy_addctx.patch
new file mode 100644
index 00000000000..b95f17956eb
--- /dev/null
+++ b/queue-4.19/drm-fix-error-handling-in-drm_legacy_addctx.patch
@@ -0,0 +1,61 @@
+From 25aa2856e01b6c53c880b7ade7069a6846aea7fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Dec 2018 10:49:07 +0800
+Subject: drm: Fix error handling in drm_legacy_addctx
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c39191feed4540fed98badeb484833dcf659bb96 ]
+
+'ctx->handle' is unsigned, it never less than zero.
+This patch use int 'tmp_handle' to handle the err condition.
+
+Fixes: 62968144e673 ("drm: convert drm context code to use Linux idr")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181229024907.12852-1-yuehaibing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_context.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c
+index f973d287696a6..da5abf24f59ff 100644
+--- a/drivers/gpu/drm/drm_context.c
++++ b/drivers/gpu/drm/drm_context.c
+@@ -361,23 +361,26 @@ int drm_legacy_addctx(struct drm_device *dev, void *data,
+ {
+ 	struct drm_ctx_list *ctx_entry;
+ 	struct drm_ctx *ctx = data;
++	int tmp_handle;
+ 
+ 	if (!drm_core_check_feature(dev, DRIVER_KMS_LEGACY_CONTEXT) &&
+ 	    !drm_core_check_feature(dev, DRIVER_LEGACY))
+ 		return -EINVAL;
+ 
+-	ctx->handle = drm_legacy_ctxbitmap_next(dev);
+-	if (ctx->handle == DRM_KERNEL_CONTEXT) {
++	tmp_handle = drm_legacy_ctxbitmap_next(dev);
++	if (tmp_handle == DRM_KERNEL_CONTEXT) {
+ 		/* Skip kernel's context and get a new one. */
+-		ctx->handle = drm_legacy_ctxbitmap_next(dev);
++		tmp_handle = drm_legacy_ctxbitmap_next(dev);
+ 	}
+-	DRM_DEBUG("%d\n", ctx->handle);
+-	if (ctx->handle < 0) {
++	DRM_DEBUG("%d\n", tmp_handle);
++	if (tmp_handle < 0) {
+ 		DRM_DEBUG("Not enough free contexts.\n");
+ 		/* Should this return -EBUSY instead? */
+-		return -ENOMEM;
++		return tmp_handle;
+ 	}
+ 
++	ctx->handle = tmp_handle;
++
+ 	ctx_entry = kmalloc(sizeof(*ctx_entry), GFP_KERNEL);
+ 	if (!ctx_entry) {
+ 		DRM_DEBUG("out of memory\n");
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch b/queue-4.19/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch
new file mode 100644
index 00000000000..094a5a2a266
--- /dev/null
+++ b/queue-4.19/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch
@@ -0,0 +1,42 @@
+From d2fb46f9561dd03f47b0a590cdea28684c967479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 01:25:26 +0800
+Subject: drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 0ff9f49646353ce31312411e7e7bd2281492a40e ]
+
+Currently the driver overwrites the surface depth provided by the fb
+helper to give an invalid bpp/surface depth combination.
+
+This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy
+bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to
+fail to probe.
+
+Fix by not overwriting the surface depth.
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index 8bd29075ae4eb..edcca17615001 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ 	DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
+ 			 sizes->surface_width, sizes->surface_height,
+ 			 sizes->surface_bpp);
+-	sizes->surface_depth = 32;
+ 
+ 	bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch b/queue-4.19/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
new file mode 100644
index 00000000000..a593dfed0cb
--- /dev/null
+++ b/queue-4.19/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
@@ -0,0 +1,60 @@
+From a70e452ae50ab945dc0aa96f393e932b5f236534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 09:09:47 -0700
+Subject: drm/msm/a3xx: remove TPL1 regs from snapshot
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ]
+
+These regs are write-only, and the hw throws a hissy-fit (ie. reboots)
+when we try to read them for GPU state snapshot, in response to a GPU
+hang.  It is rather impolite when GPU recovery triggers an insta-
+reboot, so lets remove the TPL1 registers from the snapshot.
+
+Fixes: 7198e6b03155 drm/msm: add a3xx gpu support
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+index 669c2d4b070de..5c068301d817c 100644
+--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+@@ -395,19 +395,17 @@ static const unsigned int a3xx_registers[] = {
+ 	0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
+ 	0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+ 	0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+-	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
+-	0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
+-	0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
+-	0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
+-	0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
+-	0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
+-	0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
+-	0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
+-	0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
+-	0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
+-	0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
+-	0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
+-	0x303c, 0x303c, 0x305e, 0x305f,
++	0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
++	0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
++	0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
++	0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
++	0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
++	0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
++	0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
++	0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
++	0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
++	0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
++	0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
+ 	~0   /* sentinel */
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-msm-dsi-implement-reset-correctly.patch b/queue-4.19/drm-msm-dsi-implement-reset-correctly.patch
new file mode 100644
index 00000000000..5611d95b23a
--- /dev/null
+++ b/queue-4.19/drm-msm-dsi-implement-reset-correctly.patch
@@ -0,0 +1,73 @@
+From a603efadccfae358539e7ec06e03de0308a95ee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 06:39:39 -0700
+Subject: drm/msm/dsi: Implement reset correctly
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ]
+
+On msm8998, vblank timeouts are observed because the DSI controller is not
+reset properly, which ends up stalling the MDP.  This is because the reset
+logic is not correct per the hardware documentation.
+
+The documentation states that after asserting reset, software should wait
+some time (no indication of how long), or poll the status register until it
+returns 0 before deasserting reset.
+
+wmb() is insufficient for this purpose since it just ensures ordering, not
+timing between writes.  Since asserting and deasserting reset occurs on the
+same register, ordering is already guaranteed by the architecture, making
+the wmb extraneous.
+
+Since we would define a timeout for polling the status register to avoid a
+possible infinite loop, lets just use a static delay of 20 ms, since 16.666
+ms is the time available to process one frame at 60 fps.
+
+Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
+Cc: Hai Li <hali@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Sean Paul <sean@poorly.run>
+[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS]
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index cc4ea5502d6c3..3b78bca0bb4d4 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -34,6 +34,8 @@
+ #include "dsi_cfg.h"
+ #include "msm_kms.h"
+ 
++#define DSI_RESET_TOGGLE_DELAY_MS 20
++
+ static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
+ {
+ 	u32 ver;
+@@ -994,7 +996,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
+ 	wmb(); /* clocks need to be enabled before reset */
+ 
+ 	dsi_write(msm_host, REG_DSI_RESET, 1);
+-	wmb(); /* make sure reset happen */
++	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ 	dsi_write(msm_host, REG_DSI_RESET, 0);
+ }
+ 
+@@ -1402,7 +1404,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
+ 
+ 	/* dsi controller can only be reset while clocks are running */
+ 	dsi_write(msm_host, REG_DSI_RESET, 1);
+-	wmb();	/* make sure reset happen */
++	msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ 	dsi_write(msm_host, REG_DSI_RESET, 0);
+ 	wmb();	/* controller out of reset */
+ 	dsi_write(msm_host, REG_DSI_CTRL, data0);
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-msm-fix-unsigned-comparison-with-less-than-zero.patch b/queue-4.19/drm-msm-fix-unsigned-comparison-with-less-than-zero.patch
new file mode 100644
index 00000000000..4840b5c7287
--- /dev/null
+++ b/queue-4.19/drm-msm-fix-unsigned-comparison-with-less-than-zero.patch
@@ -0,0 +1,41 @@
+From fdad801b753ecc284be25e3c30f33561d9966dc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 12:55:19 +0100
+Subject: drm/msm: fix unsigned comparison with less than zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dfdb3be43ef1195c491e6c3760b922acb52e3575 ]
+
+The return from the call to _mixer_stages can be a negative error
+code however this is being assigned to an unsigned variable 'stages'
+hence the check is always false. Fix this by making 'stages' an
+int.
+
+Detected by Coccinelle ("Unsigned expression compared with zero:
+stages < 0")
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index 06be7cf7ce505..79bafea663542 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -310,7 +310,7 @@ static void dpu_hw_ctl_setup_blendstage(struct dpu_hw_ctl *ctx,
+ 	u32 mixercfg = 0, mixercfg_ext = 0, mix, ext;
+ 	u32 mixercfg_ext2 = 0, mixercfg_ext3 = 0;
+ 	int i, j;
+-	u8 stages;
++	int stages;
+ 	int pipes_per_stage;
+ 
+ 	stages = _mixer_stages(ctx->mixer_hw_caps, ctx->mixer_count, lm);
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch b/queue-4.19/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
new file mode 100644
index 00000000000..d955a5c2ca6
--- /dev/null
+++ b/queue-4.19/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
@@ -0,0 +1,39 @@
+From fa999e9d47be09bf2f12d6ac091190eeb0f08b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 08:00:30 -0700
+Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ]
+
+If mdp5_cfg_init fails because of an unknown major version, a null pointer
+dereference occurs.  This is because the caller of init expects error
+pointers, but init returns NULL on error.  Fix this by returning the
+expected values on error.
+
+Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+index 824067d2d4277..42f0ecb0cf35f 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+@@ -635,7 +635,7 @@ fail:
+ 	if (cfg_handler)
+ 		mdp5_cfg_destroy(cfg_handler);
+ 
+-	return NULL;
++	return ERR_PTR(ret);
+ }
+ 
+ static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch b/queue-4.19/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
new file mode 100644
index 00000000000..fc13910215d
--- /dev/null
+++ b/queue-4.19/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
@@ -0,0 +1,43 @@
+From 0ed62242ccfc770bdeab95af0fef9b6a60b72ffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Nov 2018 17:09:18 +0000
+Subject: drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]
+
+Currently, the expression for calculating RON is always going to result
+in zero no matter the value of ram->mr[1] because the ! operator has
+higher precedence than the shift >> operator.  I believe the missing
+parentheses around the expression before appying the ! operator will
+result in the desired result.
+
+[ Note, not tested ]
+
+Detected by CoveritScan, CID#1324005 ("Operands don't affect result")
+
+Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+index 60ece0a8a2e1b..1d2d6bae73cd1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
+ 		WR  = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
+ 		/* XXX: Get these values from the VBIOS instead */
+ 		DLL = !(ram->mr[1] & 0x1);
+-		RON = !(ram->mr[1] & 0x300) >> 8;
++		RON = !((ram->mr[1] & 0x300) >> 8);
+ 		break;
+ 	default:
+ 		return -ENOSYS;
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-nouveau-fix-missing-break-in-switch-statement.patch b/queue-4.19/drm-nouveau-fix-missing-break-in-switch-statement.patch
new file mode 100644
index 00000000000..e106af0032f
--- /dev/null
+++ b/queue-4.19/drm-nouveau-fix-missing-break-in-switch-statement.patch
@@ -0,0 +1,40 @@
+From fccc078269a5806284fca85cb600edfcb0a7aa51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 21:47:36 +0100
+Subject: drm/nouveau: fix missing break in switch statement
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 785cf1eeafa23ec63f426d322401054d13abe2a3 ]
+
+The NOUVEAU_GETPARAM_PCI_DEVICE case is missing a break statement and falls
+through to the following NOUVEAU_GETPARAM_BUS_TYPE case and may end up
+re-assigning the getparam->value to an undesired value. Fix this by adding
+in the missing break.
+
+Detected by CoverityScan, CID#1460507 ("Missing break in switch")
+
+Fixes: 359088d5b8ec ("drm/nouveau: remove trivial cases of nvxx_device() usage")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_abi16.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+index e67a471331b51..6ec745873bc55 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
++++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
+@@ -214,6 +214,7 @@ nouveau_abi16_ioctl_getparam(ABI16_IOCTL_ARGS)
+ 			WARN_ON(1);
+ 			break;
+ 		}
++		break;
+ 	case NOUVEAU_GETPARAM_FB_SIZE:
+ 		getparam->value = drm->gem.vram_available;
+ 		break;
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch b/queue-4.19/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
new file mode 100644
index 00000000000..c94eb7ff490
--- /dev/null
+++ b/queue-4.19/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
@@ -0,0 +1,44 @@
+From 2896b832bf851c9e87d4e15506a76d14f3457169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:29:49 +0000
+Subject: drm/nouveau/pmu: don't print reply values if exec is false
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]
+
+Currently the uninitialized values in the array reply are printed out
+when exec is false and nvkm_pmu_send has not updated the array. Avoid
+confusion by only dumping out these values if they have been actually
+updated.
+
+Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
+Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+index 11b28b086a062..7b052879af728 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+@@ -88,10 +88,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
+ 	if (exec) {
+ 		nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
+ 			      memx->base, finish);
++		nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
++			   reply[0], reply[1]);
+ 	}
+ 
+-	nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+-		   reply[0], reply[1]);
+ 	kfree(memx);
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-panel-lvds-potential-oops-in-probe-error-handlin.patch b/queue-4.19/drm-panel-lvds-potential-oops-in-probe-error-handlin.patch
new file mode 100644
index 00000000000..fe8b2bebd82
--- /dev/null
+++ b/queue-4.19/drm-panel-lvds-potential-oops-in-probe-error-handlin.patch
@@ -0,0 +1,81 @@
+From c8aafeeedb19b80f95dd4afd881ebc6cc50a944e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 13:49:28 +0300
+Subject: drm: panel-lvds: Potential Oops in probe error handling
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fb2ee9bf084bcaeff1e5be100decc0eacb4af2d5 ]
+
+The "lvds->backlight" pointer could be NULL in situations where
+of_parse_phandle() returns NULL.  This code is cleaner if we use the
+managed devm_of_find_backlight() so the clean up is automatic.
+
+Fixes: 7c9dff5bd643 ("drm: panels: Add LVDS panel driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190911104928.GA15930@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-lvds.c | 21 ++++-----------------
+ 1 file changed, 4 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c
+index 8a1687887ae91..bd704a36c5d0e 100644
+--- a/drivers/gpu/drm/panel/panel-lvds.c
++++ b/drivers/gpu/drm/panel/panel-lvds.c
+@@ -199,7 +199,6 @@ static int panel_lvds_parse_dt(struct panel_lvds *lvds)
+ static int panel_lvds_probe(struct platform_device *pdev)
+ {
+ 	struct panel_lvds *lvds;
+-	struct device_node *np;
+ 	int ret;
+ 
+ 	lvds = devm_kzalloc(&pdev->dev, sizeof(*lvds), GFP_KERNEL);
+@@ -245,14 +244,9 @@ static int panel_lvds_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	np = of_parse_phandle(lvds->dev->of_node, "backlight", 0);
+-	if (np) {
+-		lvds->backlight = of_find_backlight_by_node(np);
+-		of_node_put(np);
+-
+-		if (!lvds->backlight)
+-			return -EPROBE_DEFER;
+-	}
++	lvds->backlight = devm_of_find_backlight(lvds->dev);
++	if (IS_ERR(lvds->backlight))
++		return PTR_ERR(lvds->backlight);
+ 
+ 	/*
+ 	 * TODO: Handle all power supplies specified in the DT node in a generic
+@@ -268,14 +262,10 @@ static int panel_lvds_probe(struct platform_device *pdev)
+ 
+ 	ret = drm_panel_add(&lvds->panel);
+ 	if (ret < 0)
+-		goto error;
++		return ret;
+ 
+ 	dev_set_drvdata(lvds->dev, lvds);
+ 	return 0;
+-
+-error:
+-	put_device(&lvds->backlight->dev);
+-	return ret;
+ }
+ 
+ static int panel_lvds_remove(struct platform_device *pdev)
+@@ -286,9 +276,6 @@ static int panel_lvds_remove(struct platform_device *pdev)
+ 
+ 	panel_lvds_disable(&lvds->panel);
+ 
+-	if (lvds->backlight)
+-		put_device(&lvds->backlight->dev);
+-
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-panel-make-drm_panel.h-self-contained.patch b/queue-4.19/drm-panel-make-drm_panel.h-self-contained.patch
new file mode 100644
index 00000000000..bbfc89e2e6e
--- /dev/null
+++ b/queue-4.19/drm-panel-make-drm_panel.h-self-contained.patch
@@ -0,0 +1,51 @@
+From c8c14cdb2aa981c1e1de8871738fcef50c658022 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2019 18:14:57 +0200
+Subject: drm/panel: make drm_panel.h self-contained
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit bf3f5e98559360661a3d2af340d46522512c0b00 ]
+
+Fix build warning if drm_panel.h is built with CONFIG_OF=n or
+CONFIG_DRM_PANEL=n and included without the prerequisite err.h:
+
+./include/drm/drm_panel.h: In function ‘of_drm_find_panel’:
+./include/drm/drm_panel.h:203:9: error: implicit declaration of function ‘ERR_PTR’ [-Werror=implicit-function-declaration]
+  return ERR_PTR(-ENODEV);
+         ^~~~~~~
+./include/drm/drm_panel.h:203:9: error: returning ‘int’ from a function with return type ‘struct drm_panel *’ makes pointer from integer without a cast [-Werror=int-conversion]
+  return ERR_PTR(-ENODEV);
+         ^~~~~~~~~~~~~~~~
+
+Fixes: 5fa8e4a22182 ("drm/panel: Make of_drm_find_panel() return an ERR_PTR() instead of NULL")
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Reviewed-by: Sean Paul <sean@poorly.run>
+Cc: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190718161507.2047-2-sam@ravnborg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_panel.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/drm/drm_panel.h b/include/drm/drm_panel.h
+index 777814755fa62..675aa1e876ce6 100644
+--- a/include/drm/drm_panel.h
++++ b/include/drm/drm_panel.h
+@@ -24,6 +24,7 @@
+ #ifndef __DRM_PANEL_H__
+ #define __DRM_PANEL_H__
+ 
++#include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/list.h>
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch b/queue-4.19/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
new file mode 100644
index 00000000000..fd27a114b4f
--- /dev/null
+++ b/queue-4.19/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
@@ -0,0 +1,77 @@
+From 35dc669a63a5fcfa1cf6a3f3f97b8d8114773e34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:53:53 +1100
+Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]
+
+The INTERRUPT_CNTL2 register expects a valid DMA address, but is
+currently set with a GPU MC address.  This can cause problems on
+systems that detect the resulting DMA read from an invalid address
+(found on a Power8 guest).
+
+Instead, use the DMA address of the dummy page because it will always
+be safe.
+
+Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
+Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
+Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c  | 4 ++--
+ drivers/gpu/drm/radeon/r600.c | 4 ++--
+ drivers/gpu/drm/radeon/si.c   | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index ebce4601a3056..827d551962d98 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -6965,8 +6965,8 @@ static int cik_irq_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	/* setup interrupt control */
+-	/* XXX this should actually be a bus address, not an MC address. same on older asics */
+-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index e06e2d8feab39..a724bb87cfad7 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3690,8 +3690,8 @@ int r600_irq_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	/* setup interrupt control */
+-	/* set dummy read address to ring address */
+-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 85c604d292358..639f0698f961c 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5993,8 +5993,8 @@ static int si_irq_init(struct radeon_device *rdev)
+ 	}
+ 
+ 	/* setup interrupt control */
+-	/* set dummy read address to ring address */
+-	WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++	/* set dummy read address to dummy page address */
++	WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ 	interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ 	/* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ 	 * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-rcar-du-fix-the-return-value-in-case-of-error-in.patch b/queue-4.19/drm-rcar-du-fix-the-return-value-in-case-of-error-in.patch
new file mode 100644
index 00000000000..6013ec8481a
--- /dev/null
+++ b/queue-4.19/drm-rcar-du-fix-the-return-value-in-case-of-error-in.patch
@@ -0,0 +1,40 @@
+From b4b7bc01490f8f7b81dc87d8dc1dd24a0dc025c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 08:58:25 +0200
+Subject: drm: rcar-du: Fix the return value in case of error in
+ 'rcar_du_crtc_set_crc_source()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4d486f18d91b1876040bf87e9ad78981a08b15a6 ]
+
+We return 0 unconditionally in 'rcar_du_crtc_set_crc_source()'.
+However, 'ret' is set to some error codes if some function calls fail.
+
+Return 'ret' instead to propagate the error code.
+
+Fixes: 47a52d024e89 ("media: drm: rcar-du: Add support for CRC computation")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index 15dc9caa128ba..212e5e11e4b73 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -837,7 +837,7 @@ unlock:
+ 	drm_modeset_drop_locks(&ctx);
+ 	drm_modeset_acquire_fini(&ctx);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static const struct drm_crtc_funcs crtc_funcs_gen2 = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-rcar-du-fix-vblank-initialization.patch b/queue-4.19/drm-rcar-du-fix-vblank-initialization.patch
new file mode 100644
index 00000000000..90c75b064c5
--- /dev/null
+++ b/queue-4.19/drm-rcar-du-fix-vblank-initialization.patch
@@ -0,0 +1,37 @@
+From dd2cb4119426f1611c45fb8def0f1237f6cef8a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Oct 2018 22:08:31 +0300
+Subject: drm: rcar-du: Fix vblank initialization
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 3d61fe5f59dd3e6f96fc0772156d257cb04dc656 ]
+
+The drm_vblank_init() takes the total number of CRTCs as an argument,
+but the rcar-du driver passes a bitmask of the CRTC indices. Fix it.
+
+Fixes: 4bf8e1962f91 ("drm: Renesas R-Car Display Unit DRM driver")
+Reported-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_kms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index 0386b454e2218..6a9578159c2b5 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -544,7 +544,7 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+ 	 * Initialize vertical blanking interrupts handling. Start with vblank
+ 	 * disabled for all CRTCs.
+ 	 */
+-	ret = drm_vblank_init(dev, (1 << rcdu->num_crtcs) - 1);
++	ret = drm_vblank_init(dev, rcdu->num_crtcs);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-rcar-du-lvds-fix-bridge_to_rcar_lvds.patch b/queue-4.19/drm-rcar-du-lvds-fix-bridge_to_rcar_lvds.patch
new file mode 100644
index 00000000000..69d3cb4dbcb
--- /dev/null
+++ b/queue-4.19/drm-rcar-du-lvds-fix-bridge_to_rcar_lvds.patch
@@ -0,0 +1,48 @@
+From 0590bde65ab998235d2162289735c056d48b0355 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 08:34:05 +0100
+Subject: drm: rcar-du: lvds: Fix bridge_to_rcar_lvds
+
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+
+[ Upstream commit 0b936e6122738f4cf474d1f3ff636cba0edc8b94 ]
+
+Using name "bridge" for macro bridge_to_rcar_lvds argument doesn't
+work when the pointer name used by the caller is not "bridge".
+Rename the argument to "b" to allow for any pointer name.
+
+While at it, fix the connector_to_rcar_lvds macro similarly.
+
+Fixes: c6a27fa41fab ("drm: rcar-du: Convert LVDS encoder code to bridge driver")
+Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+[Fix connector_to_rcar_lvds]
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_lvds.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds.c b/drivers/gpu/drm/rcar-du/rcar_lvds.c
+index 4c39de3f4f0f3..b6dc91cdff68e 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_lvds.c
++++ b/drivers/gpu/drm/rcar-du/rcar_lvds.c
+@@ -59,11 +59,11 @@ struct rcar_lvds {
+ 	enum rcar_lvds_mode mode;
+ };
+ 
+-#define bridge_to_rcar_lvds(bridge) \
+-	container_of(bridge, struct rcar_lvds, bridge)
++#define bridge_to_rcar_lvds(b) \
++	container_of(b, struct rcar_lvds, bridge)
+ 
+-#define connector_to_rcar_lvds(connector) \
+-	container_of(connector, struct rcar_lvds, connector)
++#define connector_to_rcar_lvds(c) \
++	container_of(c, struct rcar_lvds, connector)
+ 
+ static void rcar_lvds_write(struct rcar_lvds *lvds, u32 reg, u32 data)
+ {
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch b/queue-4.19/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch
new file mode 100644
index 00000000000..e32b4b5cb08
--- /dev/null
+++ b/queue-4.19/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch
@@ -0,0 +1,42 @@
+From 195476acbf4451adfdb9236ce3a4e0459ca4ba16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 17:18:30 +0800
+Subject: drm/shmob: Fix return value check in shmob_drm_probe
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 06c3bbd3c12737a50c2e981821b5585e1786e73d ]
+
+In case of error, the function devm_ioremap_resource() returns ERR_PTR()
+and never returns NULL. The NULL test in the return value check should
+be replaced with IS_ERR().
+
+Fixes: 8f1597c8f1a5 ("drm: shmobile: Perform initialization/cleanup at probe/remove time")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/shmobile/shmob_drm_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+index 592572554eb0e..58d8a98c749b4 100644
+--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
++++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+@@ -233,8 +233,8 @@ static int shmob_drm_probe(struct platform_device *pdev)
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	sdev->mmio = devm_ioremap_resource(&pdev->dev, res);
+-	if (sdev->mmio == NULL)
+-		return -ENOMEM;
++	if (IS_ERR(sdev->mmio))
++		return PTR_ERR(sdev->mmio);
+ 
+ 	ret = shmob_drm_setup_clocks(sdev, pdata->clk_source);
+ 	if (ret < 0)
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch b/queue-4.19/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
new file mode 100644
index 00000000000..7f15f2d35c7
--- /dev/null
+++ b/queue-4.19/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
@@ -0,0 +1,55 @@
+From 73211a7c280bb263d9a221a6289691e06f508b78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 08:19:09 +0200
+Subject: drm/sti: do not remove the drm_bridge that was never added
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ]
+
+Removing the drm_bridge_remove call should avoid a NULL dereference
+during list processing in drm_bridge_remove if the error path is ever
+taken.
+
+The more natural approach would perhaps be to add a drm_bridge_add,
+but there are several other bridges that never call drm_bridge_add.
+Just removing the drm_bridge_remove is the easier fix.
+
+Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sti/sti_hda.c  | 1 -
+ drivers/gpu/drm/sti/sti_hdmi.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index 49438337f70dc..19b9b5ed12970 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
+ 	return 0;
+ 
+ err_sysfs:
+-	drm_bridge_remove(bridge);
+ 	return -EINVAL;
+ }
+ 
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index 34cdc46444350..ccf718404a1c2 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -1315,7 +1315,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
+ 	return 0;
+ 
+ err_sysfs:
+-	drm_bridge_remove(bridge);
+ 	hdmi->drm_connector = NULL;
+ 	return -EINVAL;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-sun4i-hdmi-fix-double-flag-assignation.patch b/queue-4.19/drm-sun4i-hdmi-fix-double-flag-assignation.patch
new file mode 100644
index 00000000000..d3488ac1dfc
--- /dev/null
+++ b/queue-4.19/drm-sun4i-hdmi-fix-double-flag-assignation.patch
@@ -0,0 +1,42 @@
+From 5af8b5f7c39eb8734ccbe30af65dbe41cb743534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Oct 2018 18:34:46 +0200
+Subject: drm/sun4i: hdmi: Fix double flag assignation
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 1e0ff648940e603cab6c52cf3723017d30d78f30 ]
+
+The is_double flag is a boolean currently assigned to the value of the d
+variable, that is either 1 or 2. It means that this is_double variable is
+always set to true, even though the initial intent was to have it set to
+true when d is 2.
+
+Fix this.
+
+Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Reviewed-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181021163446.29135-2-maxime.ripard@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+index 3ecffa52c8146..a74adec6c5dcd 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+@@ -52,7 +52,7 @@ static unsigned long sun4i_tmds_calc_divider(unsigned long rate,
+ 			    (rate - tmp_rate) < (rate - best_rate)) {
+ 				best_rate = tmp_rate;
+ 				best_m = m;
+-				is_double = d;
++				is_double = (d == 2) ? true : false;
+ 			}
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch b/queue-4.19/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
new file mode 100644
index 00000000000..666708b3fb0
--- /dev/null
+++ b/queue-4.19/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
@@ -0,0 +1,55 @@
+From 8e8797767517985a045bbc847247f898d203252b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 12:42:50 +0300
+Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]
+
+This doesn't affect runtime because in the current code "idx" is always
+valid.
+
+First, we read from "vgdev->capsets[idx].max_size" before checking
+whether "idx" is within bounds.  And secondly the bounds check is off by
+one so we could end up reading one element beyond the end of the
+vgdev->capsets[] array.
+
+Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index c8a581b1f4c40..608906f06cedd 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -650,11 +650,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ 	struct virtio_gpu_get_capset *cmd_p;
+ 	struct virtio_gpu_vbuffer *vbuf;
+-	int max_size = vgdev->capsets[idx].max_size;
++	int max_size;
+ 	struct virtio_gpu_drv_cap_cache *cache_ent;
+ 	void *resp_buf;
+ 
+-	if (idx > vgdev->num_capsets)
++	if (idx >= vgdev->num_capsets)
+ 		return -EINVAL;
+ 
+ 	if (version > vgdev->capsets[idx].max_version)
+@@ -664,6 +664,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ 	if (!cache_ent)
+ 		return -ENOMEM;
+ 
++	max_size = vgdev->capsets[idx].max_size;
+ 	cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ 	if (!cache_ent->caps_cache) {
+ 		kfree(cache_ent);
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-vmwgfx-remove-set-but-not-used-variable-restart.patch b/queue-4.19/drm-vmwgfx-remove-set-but-not-used-variable-restart.patch
new file mode 100644
index 00000000000..060098ebedd
--- /dev/null
+++ b/queue-4.19/drm-vmwgfx-remove-set-but-not-used-variable-restart.patch
@@ -0,0 +1,61 @@
+From 1ca4f6342731d3be3094f346cad5529a296113a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 09:47:43 -0800
+Subject: drm/vmwgfx: Remove set but not used variable 'restart'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit b2130cca9c8db5073b71d832da2a6c8311a8f3bb ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c: In function 'vmw_cmdbuf_work_func':
+drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c:514:7: warning:
+ variable 'restart' set but not used [-Wunused-but-set-variable]
+
+It not used any more after commit dc366364c4ef ("drm/vmwgfx: Fix multiple
+command buffer context use")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Deepak Rawat <drawat@vmware.com>
+Fixes: dc366364c4ef ("drm/vmwgfx: Fix multiple command buffer context use")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+index e7e4655d3f36b..ce1ad7cd78996 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+@@ -511,17 +511,14 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ 		container_of(work, struct vmw_cmdbuf_man, work);
+ 	struct vmw_cmdbuf_header *entry, *next;
+ 	uint32_t dummy;
+-	bool restart[SVGA_CB_CONTEXT_MAX];
+ 	bool send_fence = false;
+ 	struct list_head restart_head[SVGA_CB_CONTEXT_MAX];
+ 	int i;
+ 	struct vmw_cmdbuf_context *ctx;
+ 	bool global_block = false;
+ 
+-	for_each_cmdbuf_ctx(man, i, ctx) {
++	for_each_cmdbuf_ctx(man, i, ctx)
+ 		INIT_LIST_HEAD(&restart_head[i]);
+-		restart[i] = false;
+-	}
+ 
+ 	mutex_lock(&man->error_mutex);
+ 	spin_lock(&man->lock);
+@@ -533,7 +530,6 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ 		const char *cmd_name;
+ 
+ 		list_del_init(&entry->list);
+-		restart[entry->cb_context] = true;
+ 		global_block = true;
+ 
+ 		if (!vmw_cmd_describe(header, &error_cmd_size, &cmd_name)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/drm-xen-front-fix-mmap-attributes-for-display-buffer.patch b/queue-4.19/drm-xen-front-fix-mmap-attributes-for-display-buffer.patch
new file mode 100644
index 00000000000..19c66353cdf
--- /dev/null
+++ b/queue-4.19/drm-xen-front-fix-mmap-attributes-for-display-buffer.patch
@@ -0,0 +1,60 @@
+From dc18b9eda30a9e173177d716130ff1b88e6c1c75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 17:04:22 +0200
+Subject: drm/xen-front: Fix mmap attributes for display buffers
+
+From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+
+[ Upstream commit 24ded292a5c2ed476f01c77fee65f8320552cd27 ]
+
+When GEM backing storage is allocated those are normal pages,
+so there is no point using pgprot_writecombine while mmaping.
+This fixes mismatch of buffer pages' memory attributes between
+the frontend and backend which may cause screen artifacts.
+
+Fixes: c575b7eeb89f ("drm/xen-front: Add support for Xen PV display frontend")
+
+Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+Suggested-by: Julien Grall <julien.grall@arm.com>
+Acked-by: Julien Grall <julien.grall@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190129150422.19867-1-andr2000@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xen/xen_drm_front_gem.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c
+index c85bfe7571cbf..802662839e7ed 100644
+--- a/drivers/gpu/drm/xen/xen_drm_front_gem.c
++++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c
+@@ -236,8 +236,14 @@ static int gem_mmap_obj(struct xen_gem_object *xen_obj,
+ 	vma->vm_flags &= ~VM_PFNMAP;
+ 	vma->vm_flags |= VM_MIXEDMAP;
+ 	vma->vm_pgoff = 0;
+-	vma->vm_page_prot =
+-			pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
++	/*
++	 * According to Xen on ARM ABI (xen/include/public/arch-arm.h):
++	 * all memory which is shared with other entities in the system
++	 * (including the hypervisor and other guests) must reside in memory
++	 * which is mapped as Normal Inner Write-Back Outer Write-Back
++	 * Inner-Shareable.
++	 */
++	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+ 
+ 	/*
+ 	 * vm_operations_struct.fault handler will be called if CPU access
+@@ -283,8 +289,9 @@ void *xen_drm_front_gem_prime_vmap(struct drm_gem_object *gem_obj)
+ 	if (!xen_obj->pages)
+ 		return NULL;
+ 
++	/* Please see comment in gem_mmap_obj on mapping and attributes. */
+ 	return vmap(xen_obj->pages, xen_obj->num_pages,
+-		    VM_MAP, pgprot_writecombine(PAGE_KERNEL));
++		    VM_MAP, PAGE_KERNEL);
+ }
+ 
+ void xen_drm_front_gem_prime_vunmap(struct drm_gem_object *gem_obj,
+-- 
+2.20.1
+
diff --git a/queue-4.19/dwc2-gadget-fix-completed-transfer-size-calculation-.patch b/queue-4.19/dwc2-gadget-fix-completed-transfer-size-calculation-.patch
new file mode 100644
index 00000000000..f1c303855f2
--- /dev/null
+++ b/queue-4.19/dwc2-gadget-fix-completed-transfer-size-calculation-.patch
@@ -0,0 +1,39 @@
+From e74dd138c4681631f4a3050ac954b046703b6038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 15:49:19 +0400
+Subject: dwc2: gadget: Fix completed transfer size calculation in DDMA
+
+From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
+
+[ Upstream commit 5acb4b970184d189d901192d075997c933b82260 ]
+
+Fix calculation of transfer size on completion in function
+dwc2_gadget_get_xfersize_ddma().
+
+Added increment of descriptor pointer to move to next descriptor in
+the loop.
+
+Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")
+
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 3f68edde0f03a..f64d1cd08fb67 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2230,6 +2230,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ 		if (status & DEV_DMA_STS_MASK)
+ 			dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ 				i, status & DEV_DMA_STS_MASK);
++		desc++;
+ 	}
+ 
+ 	return bytes_rem;
+-- 
+2.20.1
+
diff --git a/queue-4.19/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch b/queue-4.19/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch
new file mode 100644
index 00000000000..b53472420d3
--- /dev/null
+++ b/queue-4.19/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch
@@ -0,0 +1,65 @@
+From 31dfd8ceb0463597f7fe24c7df29cc29a43a0cba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 10:49:09 +0000
+Subject: EDAC/mc: Fix edac_mc_find() in case no device is found
+
+From: Robert Richter <rrichter@marvell.com>
+
+[ Upstream commit 29a0c843973bc385918158c6976e4dbe891df969 ]
+
+The function should return NULL in case no device is found, but it
+always returns the last checked mc device from the list even if the
+index did not match. Fix that.
+
+I did some analysis why this did not raise any issues for about 3 years
+and the reason is that edac_mc_find() is mostly used to search for
+existing devices. Thus, the bug is not triggered.
+
+ [ bp: Drop the if (mci->mc_idx > idx) test in favor of readability. ]
+
+Fixes: c73e8833bec5 ("EDAC, mc: Fix locking around mc_devices list")
+Signed-off-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Link: https://lkml.kernel.org/r/20190514104838.15065-1-rrichter@marvell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/edac_mc.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index f59511bd99261..fd440b35d76ed 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -681,22 +681,18 @@ static int del_mc_from_global_list(struct mem_ctl_info *mci)
+ 
+ struct mem_ctl_info *edac_mc_find(int idx)
+ {
+-	struct mem_ctl_info *mci = NULL;
++	struct mem_ctl_info *mci;
+ 	struct list_head *item;
+ 
+ 	mutex_lock(&mem_ctls_mutex);
+ 
+ 	list_for_each(item, &mc_devices) {
+ 		mci = list_entry(item, struct mem_ctl_info, link);
+-
+-		if (mci->mc_idx >= idx) {
+-			if (mci->mc_idx == idx) {
+-				goto unlock;
+-			}
+-			break;
+-		}
++		if (mci->mc_idx == idx)
++			goto unlock;
+ 	}
+ 
++	mci = NULL;
+ unlock:
+ 	mutex_unlock(&mem_ctls_mutex);
+ 	return mci;
+-- 
+2.20.1
+
diff --git a/queue-4.19/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch b/queue-4.19/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
new file mode 100644
index 00000000000..83aace2bfa3
--- /dev/null
+++ b/queue-4.19/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
@@ -0,0 +1,38 @@
+From 0aab42e2aa7246bbc63cb288fdc31572fa11e838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 15:47:59 +0800
+Subject: ehea: Fix a copy-paste err in ehea_init_port_res
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]
+
+pr->tx_bytes should be assigned to tx_bytes other than
+rx_bytes.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: ce45b873028f ("ehea: Fixing statistics")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index e8ee69d4e4d34..0f799e8e093cd 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1464,7 +1464,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
+ 
+ 	memset(pr, 0, sizeof(struct ehea_port_res));
+ 
+-	pr->tx_bytes = rx_bytes;
++	pr->tx_bytes = tx_bytes;
+ 	pr->tx_packets = tx_packets;
+ 	pr->rx_bytes = rx_bytes;
+ 	pr->rx_packets = rx_packets;
+-- 
+2.20.1
+
diff --git a/queue-4.19/exportfs-fix-passing-zero-to-err_ptr-warning.patch b/queue-4.19/exportfs-fix-passing-zero-to-err_ptr-warning.patch
new file mode 100644
index 00000000000..022c3cd8761
--- /dev/null
+++ b/queue-4.19/exportfs-fix-passing-zero-to-err_ptr-warning.patch
@@ -0,0 +1,38 @@
+From f38874381ec0f5a70707058220f1034cd91c260b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 11:32:41 +0800
+Subject: exportfs: fix 'passing zero to ERR_PTR()' warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]
+
+Fix a static code checker warning:
+  fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'
+
+The error path for lookup_one_len_unlocked failure
+should set err to PTR_ERR.
+
+Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exportfs/expfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 808cae6d5f50f..ae3248326c449 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
+ 	tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
+ 	if (IS_ERR(tmp)) {
+ 		dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
++		err = PTR_ERR(tmp);
+ 		goto out_err;
+ 	}
+ 	if (tmp != dentry) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/ext4-set-error-return-correctly-when-ext4_htree_stor.patch b/queue-4.19/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
new file mode 100644
index 00000000000..e656202b616
--- /dev/null
+++ b/queue-4.19/ext4-set-error-return-correctly-when-ext4_htree_stor.patch
@@ -0,0 +1,39 @@
+From dfaf8391ac33d6ad49759e43d75c4af101e7f7b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 14:29:38 -0400
+Subject: ext4: set error return correctly when ext4_htree_store_dirent fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ]
+
+Currently when the call to ext4_htree_store_dirent fails the error return
+variable 'ret' is is not being set to the error code and variable count is
+instead, hence the error code is not being returned.  Fix this by assigning
+ret to the error return code.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 56f6e1782d5f7..4572cb0579518 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1419,7 +1419,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
+ 		err = ext4_htree_store_dirent(dir_file, hinfo->hash,
+ 					      hinfo->minor_hash, de, &tmp_str);
+ 		if (err) {
+-			count = err;
++			ret = err;
+ 			goto out;
+ 		}
+ 		count++;
+-- 
+2.20.1
+
diff --git a/queue-4.19/f2fs-fix-error-path-of-f2fs_convert_inline_page.patch b/queue-4.19/f2fs-fix-error-path-of-f2fs_convert_inline_page.patch
new file mode 100644
index 00000000000..be04bee2525
--- /dev/null
+++ b/queue-4.19/f2fs-fix-error-path-of-f2fs_convert_inline_page.patch
@@ -0,0 +1,35 @@
+From 7c54b6853e81161b771494fdc8c6c3cab2ea4e8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 10:06:25 +0800
+Subject: f2fs: fix error path of f2fs_convert_inline_page()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit e8c82c11c93d586d03d80305959527bcac383555 ]
+
+In error path of f2fs_convert_inline_page(), we missed to truncate newly
+reserved block in .i_addrs[0] once we failed in get_node_info(), fix it.
+
+Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/inline.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 6bbb5f6801e26..3fe0dd5313903 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -133,6 +133,7 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
+ 
+ 	err = f2fs_get_node_info(fio.sbi, dn->nid, &ni);
+ 	if (err) {
++		f2fs_truncate_data_blocks_range(dn, 1);
+ 		f2fs_put_dnode(dn);
+ 		return err;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/f2fs-fix-to-avoid-accessing-uninitialized-field-of-i.patch b/queue-4.19/f2fs-fix-to-avoid-accessing-uninitialized-field-of-i.patch
new file mode 100644
index 00000000000..3e1210c14f2
--- /dev/null
+++ b/queue-4.19/f2fs-fix-to-avoid-accessing-uninitialized-field-of-i.patch
@@ -0,0 +1,75 @@
+From f045387705327f60d827e5247e9e81f29c935a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 09:14:16 +0800
+Subject: f2fs: fix to avoid accessing uninitialized field of inode page in
+ is_alive()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 98194030554cd9b10568a9b58f5a135c7e7cba85 ]
+
+If inode is newly created, inode page may not synchronize with inode cache,
+so fields like .i_inline or .i_extra_isize could be wrong, in below call
+path, we may access such wrong fields, result in failing to migrate valid
+target block.
+
+Thread A				Thread B
+- f2fs_create
+ - f2fs_add_link
+  - f2fs_add_dentry
+   - f2fs_init_inode_metadata
+    - f2fs_add_inline_entry
+     - f2fs_new_inode_page
+     - f2fs_put_page
+     : inode page wasn't updated with inode cache
+					- gc_data_segment
+					 - is_alive
+					  - f2fs_get_node_page
+					  - datablock_addr
+					   - offset_in_addr
+					   : access uninitialized fields
+
+Fixes: 7a2af766af15 ("f2fs: enhance on-disk inode structure scalability")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/dir.c    | 5 +++++
+ fs/f2fs/inline.c | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index 0d3d848d186b9..ebe19894884be 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -572,6 +572,11 @@ add_dentry:
+ 
+ 	if (inode) {
+ 		f2fs_i_pino_write(inode, dir->i_ino);
++
++		/* synchronize inode page's data from inode cache */
++		if (is_inode_flag_set(inode, FI_NEW_INODE))
++			f2fs_update_inode(inode, page);
++
+ 		f2fs_put_page(page, 1);
+ 	}
+ 
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 3fe0dd5313903..c1ba29d10789d 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -578,6 +578,11 @@ int f2fs_add_inline_entry(struct inode *dir, const struct qstr *new_name,
+ 	/* we don't need to mark_inode_dirty now */
+ 	if (inode) {
+ 		f2fs_i_pino_write(inode, dir->i_ino);
++
++		/* synchronize inode page's data from inode cache */
++		if (is_inode_flag_set(inode, FI_NEW_INODE))
++			f2fs_update_inode(inode, page);
++
+ 		f2fs_put_page(page, 1);
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/f2fs-fix-wrong-error-injection-path-in-inc_valid_blo.patch b/queue-4.19/f2fs-fix-wrong-error-injection-path-in-inc_valid_blo.patch
new file mode 100644
index 00000000000..7cbbe1d455a
--- /dev/null
+++ b/queue-4.19/f2fs-fix-wrong-error-injection-path-in-inc_valid_blo.patch
@@ -0,0 +1,45 @@
+From a783060eea5bc7f36040240fe5c8d2fe958a4f5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 17:58:34 +0800
+Subject: f2fs: fix wrong error injection path in inc_valid_block_count()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 9ea2f0be6ceaebae1518a5f897cff2645830dd95 ]
+
+If FAULT_BLOCK type error injection is on, in inc_valid_block_count()
+we may decrease sbi->alloc_valid_block_count percpu stat count
+incorrectly, fix it.
+
+Fixes: 36b877af7992 ("f2fs: Keep alloc_valid_block_count in sync")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 72d154e71bb56..6b5b685af5990 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1701,7 +1701,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
+ 	if (time_to_inject(sbi, FAULT_BLOCK)) {
+ 		f2fs_show_injection_info(FAULT_BLOCK);
+ 		release = *count;
+-		goto enospc;
++		goto release_quota;
+ 	}
+ 
+ 	/*
+@@ -1741,6 +1741,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
+ 
+ enospc:
+ 	percpu_counter_sub(&sbi->alloc_valid_block_count, release);
++release_quota:
+ 	dquot_release_reservation_block(inode, release);
+ 	return -ENOSPC;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch b/queue-4.19/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
new file mode 100644
index 00000000000..af8042b1ae6
--- /dev/null
+++ b/queue-4.19/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
@@ -0,0 +1,51 @@
+From 96faba3b796cd9dcb9dbcb0a232a63d629f53e2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Feb 2019 19:24:45 +0100
+Subject: fbdev: chipsfb: remove set but not used variable 'size'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
+drivers/video/fbdev/chipsfb.c:352:22: warning:
+ variable 'size' set but not used [-Wunused-but-set-variable]
+
+Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+[b.zolnierkie: minor commit summary and description fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/chipsfb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index f103665cad431..f9b366d175875 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
+ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ {
+ 	struct fb_info *p;
+-	unsigned long addr, size;
++	unsigned long addr;
+ 	unsigned short cmd;
+ 	int rc = -ENODEV;
+ 
+@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ 	if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
+ 		goto err_disable;
+ 	addr = pci_resource_start(dp, 0);
+-	size = pci_resource_len(dp, 0);
+ 	if (addr == 0)
+ 		goto err_disable;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-arm_scmi-fix-bitfield-definitions-for-senso.patch b/queue-4.19/firmware-arm_scmi-fix-bitfield-definitions-for-senso.patch
new file mode 100644
index 00000000000..f15624a0339
--- /dev/null
+++ b/queue-4.19/firmware-arm_scmi-fix-bitfield-definitions-for-senso.patch
@@ -0,0 +1,48 @@
+From 1d1e49929864d97e4578de3d2110bf04ad5c1acb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 17:10:31 +0100
+Subject: firmware: arm_scmi: fix bitfield definitions for SENSOR_DESC
+ attributes
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 430daaf96ad133be5ce7c3a5c60e94247f7c6f71 ]
+
+As per the SCMI specification the bitfields for SENSOR_DESC attributes
+are as follows:
+attributes_low 	[7:0] 	Number of trip points supported
+attributes_high	[15:11]	The power-of-10 multiplier in 2's-complement
+			format that is applied to the sensor units
+
+Looks like the code developed during the draft versions of the
+specification slipped through and are wrong with respect to final
+released version. Fix them by adjusting the bitfields appropriately.
+
+Fixes: 5179c523c1ea ("firmware: arm_scmi: add initial support for sensor protocol")
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/sensors.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
+index b53d5cc9c9f6c..c00287b5f2c23 100644
+--- a/drivers/firmware/arm_scmi/sensors.c
++++ b/drivers/firmware/arm_scmi/sensors.c
+@@ -30,10 +30,10 @@ struct scmi_msg_resp_sensor_description {
+ 		__le32 id;
+ 		__le32 attributes_low;
+ #define SUPPORTS_ASYNC_READ(x)	((x) & BIT(31))
+-#define NUM_TRIP_POINTS(x)	(((x) >> 4) & 0xff)
++#define NUM_TRIP_POINTS(x)	((x) & 0xff)
+ 		__le32 attributes_high;
+ #define SENSOR_TYPE(x)		((x) & 0xff)
+-#define SENSOR_SCALE(x)		(((x) >> 11) & 0x3f)
++#define SENSOR_SCALE(x)		(((x) >> 11) & 0x1f)
+ #define SENSOR_UPDATE_SCALE(x)	(((x) >> 22) & 0x1f)
+ #define SENSOR_UPDATE_BASE(x)	(((x) >> 27) & 0x1f)
+ 		    u8 name[SCMI_MAX_STR_SIZE];
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-arm_scmi-fix-of_node-leak-in-scmi_mailbox_c.patch b/queue-4.19/firmware-arm_scmi-fix-of_node-leak-in-scmi_mailbox_c.patch
new file mode 100644
index 00000000000..5a5ef49f53d
--- /dev/null
+++ b/queue-4.19/firmware-arm_scmi-fix-of_node-leak-in-scmi_mailbox_c.patch
@@ -0,0 +1,42 @@
+From 1135884b143282d254c606e1b8d6a670ed585a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 17:37:22 +0000
+Subject: firmware: arm_scmi: fix of_node leak in scmi_mailbox_check
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit fa7fe29a645b4da08efe8ff2392898b88f9ded9f ]
+
+of_parse_phandle_with_args() requires the caller to call of_node_put() on
+the returned args->np pointer. Otherwise the reference count will remain
+incremented.
+
+However, in this case, since we don't actually use the returned pointer,
+we can simply pass in NULL.
+
+Fixes: aa4f886f3893f ("firmware: arm_scmi: add basic driver infrastructure for SCMI")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/driver.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index 09119e3f5c018..effc4c17e0fb9 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -662,9 +662,7 @@ static int scmi_xfer_info_init(struct scmi_info *sinfo)
+ 
+ static int scmi_mailbox_check(struct device_node *np)
+ {
+-	struct of_phandle_args arg;
+-
+-	return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, &arg);
++	return of_parse_phandle_with_args(np, "mboxes", "#mbox-cells", 0, NULL);
+ }
+ 
+ static int scmi_mbox_free_channel(int id, void *p, void *data)
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-arm_scmi-update-rate_discrete-in-clock_desc.patch b/queue-4.19/firmware-arm_scmi-update-rate_discrete-in-clock_desc.patch
new file mode 100644
index 00000000000..f114bad869c
--- /dev/null
+++ b/queue-4.19/firmware-arm_scmi-update-rate_discrete-in-clock_desc.patch
@@ -0,0 +1,39 @@
+From a5fd4447a4f84af1fc41fe029b071a8442cf35dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 10:15:21 +0000
+Subject: firmware: arm_scmi: update rate_discrete in clock_describe_rates_get
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit c0759b9b5d411ab27c479125cee9bae391a96436 ]
+
+The boolean rate_discrete needs to be assigned to clk->rate_discrete,
+so that clock driver can distinguish between the continuous range and
+discrete rates. It uses this in scmi_clk_round_rate could get the
+rounded value if it's a continuous range.
+
+Fixes: 5f6c6430e904 ("firmware: arm_scmi: add initial support for clock protocol")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+[sudeep.holla: updated commit message]
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/clock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
+index 30fc04e284312..0a194af924385 100644
+--- a/drivers/firmware/arm_scmi/clock.c
++++ b/drivers/firmware/arm_scmi/clock.c
+@@ -185,6 +185,8 @@ scmi_clock_describe_rates_get(const struct scmi_handle *handle, u32 clk_id,
+ 	if (rate_discrete)
+ 		clk->list.num_rates = tot_rate_cnt;
+ 
++	clk->rate_discrete = rate_discrete;
++
+ err:
+ 	scmi_xfer_put(handle, t);
+ 	return ret;
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-coreboot-let-of-core-populate-platform-devi.patch b/queue-4.19/firmware-coreboot-let-of-core-populate-platform-devi.patch
new file mode 100644
index 00000000000..d321dcf51c1
--- /dev/null
+++ b/queue-4.19/firmware-coreboot-let-of-core-populate-platform-devi.patch
@@ -0,0 +1,99 @@
+From d417b7e7db7956e66d3e1cd1beaff3dd540daa7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Aug 2018 13:37:03 -0700
+Subject: firmware: coreboot: Let OF core populate platform device
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 09ed061a4f56d50758851ca3997510f27115f81b ]
+
+Now that the /firmware/coreboot node in DT is populated by the core DT
+platform code with commit 3aa0582fdb82 ("of: platform: populate
+/firmware/ node from of_platform_default_populate_init()") we should and
+can remove the platform device creation here. Otherwise, the
+of_platform_device_create() call will fail, the coreboot of driver won't
+be registered, and this driver will never bind. At the same time, we
+should move this driver to use MODULE_DEVICE_TABLE so that module
+auto-load works properly when the coreboot device is auto-populated and
+we should drop the of_node handling that was presumably placed here to
+hold a reference to the DT node created during module init that no
+longer happens.
+
+Cc: Wei-Ning Huang <wnhuang@chromium.org>
+Cc: Julius Werner <jwerner@chromium.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Cc: Samuel Holland <samuel@sholland.org>
+Reviewed-by: Sudeep Holla <Sudeep.Holla@arm.com>
+Fixes: 3aa0582fdb82 ("of: platform: populate /firmware/ node from of_platform_default_populate_init()")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Julius Werner <jwerner@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/google/coreboot_table-of.c | 28 +++------------------
+ 1 file changed, 3 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/firmware/google/coreboot_table-of.c b/drivers/firmware/google/coreboot_table-of.c
+index f15bf404c579b..9b90c0fa4a0b4 100644
+--- a/drivers/firmware/google/coreboot_table-of.c
++++ b/drivers/firmware/google/coreboot_table-of.c
+@@ -19,7 +19,6 @@
+ #include <linux/io.h>
+ #include <linux/module.h>
+ #include <linux/of_address.h>
+-#include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ 
+ #include "coreboot_table.h"
+@@ -30,7 +29,6 @@ static int coreboot_table_of_probe(struct platform_device *pdev)
+ 	void __iomem *ptr;
+ 
+ 	ptr = of_iomap(fw_dn, 0);
+-	of_node_put(fw_dn);
+ 	if (!ptr)
+ 		return -ENOMEM;
+ 
+@@ -44,8 +42,9 @@ static int coreboot_table_of_remove(struct platform_device *pdev)
+ 
+ static const struct of_device_id coreboot_of_match[] = {
+ 	{ .compatible = "coreboot" },
+-	{},
++	{}
+ };
++MODULE_DEVICE_TABLE(of, coreboot_of_match);
+ 
+ static struct platform_driver coreboot_table_of_driver = {
+ 	.probe = coreboot_table_of_probe,
+@@ -55,28 +54,7 @@ static struct platform_driver coreboot_table_of_driver = {
+ 		.of_match_table = coreboot_of_match,
+ 	},
+ };
+-
+-static int __init platform_coreboot_table_of_init(void)
+-{
+-	struct platform_device *pdev;
+-	struct device_node *of_node;
+-
+-	/* Limit device creation to the presence of /firmware/coreboot node */
+-	of_node = of_find_node_by_path("/firmware/coreboot");
+-	if (!of_node)
+-		return -ENODEV;
+-
+-	if (!of_match_node(coreboot_of_match, of_node))
+-		return -ENODEV;
+-
+-	pdev = of_platform_device_create(of_node, "coreboot_table_of", NULL);
+-	if (!pdev)
+-		return -ENODEV;
+-
+-	return platform_driver_register(&coreboot_table_of_driver);
+-}
+-
+-module_init(platform_coreboot_table_of_init);
++module_platform_driver(coreboot_table_of_driver);
+ 
+ MODULE_AUTHOR("Google, Inc.");
+ MODULE_LICENSE("GPL");
+-- 
+2.20.1
+
diff --git a/queue-4.19/firmware-dmi-fix-unlikely-out-of-bounds-read-in-save.patch b/queue-4.19/firmware-dmi-fix-unlikely-out-of-bounds-read-in-save.patch
new file mode 100644
index 00000000000..d9c8f5cbbd8
--- /dev/null
+++ b/queue-4.19/firmware-dmi-fix-unlikely-out-of-bounds-read-in-save.patch
@@ -0,0 +1,41 @@
+From e63f458e10ed9c80c36aaa2baa6816993c2a40b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 21:41:24 +0200
+Subject: firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
+
+From: Jean Delvare <jdelvare@suse.de>
+
+[ Upstream commit 81dde26de9c08bb04c4962a15608778aaffb3cf9 ]
+
+Before reading the Extended Size field, we should ensure it fits in
+the DMI record. There is already a record length check but it does
+not cover that field.
+
+It would take a seriously corrupted DMI table to hit that bug, so no
+need to worry, but we should still fix it.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size")
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/dmi_scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index f2483548cde92..0dc0c78f1fdb2 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -407,7 +407,7 @@ static void __init save_mem_devices(const struct dmi_header *dm, void *v)
+ 		bytes = ~0ull;
+ 	else if (size & 0x8000)
+ 		bytes = (u64)(size & 0x7fff) << 10;
+-	else if (size != 0x7fff)
++	else if (size != 0x7fff || dm->length < 0x20)
+ 		bytes = (u64)size << 20;
+ 	else
+ 		bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;
+-- 
+2.20.1
+
diff --git a/queue-4.19/fork-memcg-alloc_thread_stack_node-needs-to-set-tsk-.patch b/queue-4.19/fork-memcg-alloc_thread_stack_node-needs-to-set-tsk-.patch
new file mode 100644
index 00000000000..82ec68efb2b
--- /dev/null
+++ b/queue-4.19/fork-memcg-alloc_thread_stack_node-needs-to-set-tsk-.patch
@@ -0,0 +1,55 @@
+From 98aab752d7d6803015ebe1f4d639148a12942aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 12:07:14 -0700
+Subject: fork,memcg: alloc_thread_stack_node needs to set tsk->stack
+
+From: Andrea Arcangeli <aarcange@redhat.com>
+
+[ Upstream commit 1bf4580e00a248a2c86269125390eb3648e1877c ]
+
+Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on
+memcg charge fail") corrected two instances, but there was a third
+instance of this bug.
+
+Without setting tsk->stack, if memcg_charge_kernel_stack fails, it'll
+execute free_thread_stack() on a dangling pointer.
+
+Enterprise kernels are compiled with VMAP_STACK=y so this isn't
+critical, but custom VMAP_STACK=n builds should have some performance
+advantage, with the drawback of risking to fail fork because compaction
+didn't succeed.  So as long as VMAP_STACK=n is a supported option it's
+worth fixing it upstream.
+
+Link: http://lkml.kernel.org/r/20190619011450.28048-1-aarcange@redhat.com
+Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting")
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Reviewed-by: Rik van Riel <riel@surriel.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/fork.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 1bd119530a492..1a2d18e98bf99 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -240,7 +240,11 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
+ 	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
+ 					     THREAD_SIZE_ORDER);
+ 
+-	return page ? page_address(page) : NULL;
++	if (likely(page)) {
++		tsk->stack = page_address(page);
++		return tsk->stack;
++	}
++	return NULL;
+ #endif
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/fork-memcg-fix-cached_stacks-case.patch b/queue-4.19/fork-memcg-fix-cached_stacks-case.patch
new file mode 100644
index 00000000000..974024d05e7
--- /dev/null
+++ b/queue-4.19/fork-memcg-fix-cached_stacks-case.patch
@@ -0,0 +1,47 @@
+From 0c8090add06f6df4df5cc567905ad7a8f77506ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jan 2019 15:22:57 -0800
+Subject: fork, memcg: fix cached_stacks case
+
+From: Shakeel Butt <shakeelb@google.com>
+
+[ Upstream commit ba4a45746c362b665e245c50b870615f02f34781 ]
+
+Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on
+memcg charge fail") fixes a crash caused due to failed memcg charge of
+the kernel stack.  However the fix misses the cached_stacks case which
+this patch fixes.  So, the same crash can happen if the memcg charge of
+a cached stack is failed.
+
+Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com
+Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail")
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Rik van Riel <riel@surriel.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/fork.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 5718c5decc55b..1bd119530a492 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -216,6 +216,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
+ 		memset(s->addr, 0, THREAD_SIZE);
+ 
+ 		tsk->stack_vm_area = s;
++		tsk->stack = s->addr;
+ 		return s->addr;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/fork-memcg-fix-crash-in-free_thread_stack-on-memcg-c.patch b/queue-4.19/fork-memcg-fix-crash-in-free_thread_stack-on-memcg-c.patch
new file mode 100644
index 00000000000..877ea482442
--- /dev/null
+++ b/queue-4.19/fork-memcg-fix-crash-in-free_thread_stack-on-memcg-c.patch
@@ -0,0 +1,95 @@
+From 83b14e27c11bbd2ebfdcc59af6111ad5f7f7339f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 14:30:54 -0800
+Subject: fork,memcg: fix crash in free_thread_stack on memcg charge fail
+
+From: Rik van Riel <riel@surriel.com>
+
+[ Upstream commit 5eed6f1dff87bfb5e545935def3843edf42800f2 ]
+
+Commit 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting") will
+result in fork failing if allocating a kernel stack for a task in
+dup_task_struct exceeds the kernel memory allowance for that cgroup.
+
+Unfortunately, it also results in a crash.
+
+This is due to the code jumping to free_stack and calling
+free_thread_stack when the memcg kernel stack charge fails, but without
+tsk->stack pointing at the freshly allocated stack.
+
+This in turn results in the vfree_atomic in free_thread_stack oopsing
+with a backtrace like this:
+
+#5 [ffffc900244efc88] die at ffffffff8101f0ab
+ #6 [ffffc900244efcb8] do_general_protection at ffffffff8101cb86
+ #7 [ffffc900244efce0] general_protection at ffffffff818ff082
+    [exception RIP: llist_add_batch+7]
+    RIP: ffffffff8150d487  RSP: ffffc900244efd98  RFLAGS: 00010282
+    RAX: 0000000000000000  RBX: ffff88085ef55980  RCX: 0000000000000000
+    RDX: ffff88085ef55980  RSI: 343834343531203a  RDI: 343834343531203a
+    RBP: ffffc900244efd98   R8: 0000000000000001   R9: ffff8808578c3600
+    R10: 0000000000000000  R11: 0000000000000001  R12: ffff88029f6c21c0
+    R13: 0000000000000286  R14: ffff880147759b00  R15: 0000000000000000
+    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
+ #8 [ffffc900244efda0] vfree_atomic at ffffffff811df2c7
+ #9 [ffffc900244efdb8] copy_process at ffffffff81086e37
+#10 [ffffc900244efe98] _do_fork at ffffffff810884e0
+#11 [ffffc900244eff10] sys_vfork at ffffffff810887ff
+#12 [ffffc900244eff20] do_syscall_64 at ffffffff81002a43
+    RIP: 000000000049b948  RSP: 00007ffcdb307830  RFLAGS: 00000246
+    RAX: ffffffffffffffda  RBX: 0000000000896030  RCX: 000000000049b948
+    RDX: 0000000000000000  RSI: 00007ffcdb307790  RDI: 00000000005d7421
+    RBP: 000000000067370f   R8: 00007ffcdb3077b0   R9: 000000000001ed00
+    R10: 0000000000000008  R11: 0000000000000246  R12: 0000000000000040
+    R13: 000000000000000f  R14: 0000000000000000  R15: 000000000088d018
+    ORIG_RAX: 000000000000003a  CS: 0033  SS: 002b
+
+The simplest fix is to assign tsk->stack right where it is allocated.
+
+Link: http://lkml.kernel.org/r/20181214231726.7ee4843c@imladris.surriel.com
+Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting")
+Signed-off-by: Rik van Riel <riel@surriel.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Shakeel Butt <shakeelb@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/fork.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 8cb5cd7c97e19..5718c5decc55b 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -230,8 +230,10 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
+ 	 * free_thread_stack() can be called in interrupt context,
+ 	 * so cache the vm_struct.
+ 	 */
+-	if (stack)
++	if (stack) {
+ 		tsk->stack_vm_area = find_vm_area(stack);
++		tsk->stack = stack;
++	}
+ 	return stack;
+ #else
+ 	struct page *page = alloc_pages_node(node, THREADINFO_GFP,
+@@ -268,7 +270,10 @@ static struct kmem_cache *thread_stack_cache;
+ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk,
+ 						  int node)
+ {
+-	return kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
++	unsigned long *stack;
++	stack = kmem_cache_alloc_node(thread_stack_cache, THREADINFO_GFP, node);
++	tsk->stack = stack;
++	return stack;
+ }
+ 
+ static void free_thread_stack(struct task_struct *tsk)
+-- 
+2.20.1
+
diff --git a/queue-4.19/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch b/queue-4.19/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
new file mode 100644
index 00000000000..06807444aea
--- /dev/null
+++ b/queue-4.19/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
@@ -0,0 +1,38 @@
+From 3cb46d440928a1db29ead95b2e9bbfed1d12653e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 07:58:38 -0600
+Subject: fs/nfs: Fix nfs_parse_devname to not modify it's argument
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]
+
+In the rare and unsupported case of a hostname list nfs_parse_devname
+will modify dev_name.  There is no need to modify dev_name as the all
+that is being computed is the length of the hostname, so the computed
+length can just be shorted.
+
+Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index d90efdea9fbd6..5db7aceb41907 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1930,7 +1930,7 @@ static int nfs_parse_devname(const char *dev_name,
+ 		/* kill possible hostname list: not supported */
+ 		comma = strchr(dev_name, ',');
+ 		if (comma != NULL && comma < end)
+-			*comma = 0;
++			len = comma - dev_name;
+ 	}
+ 
+ 	if (len > maxnamlen)
+-- 
+2.20.1
+
diff --git a/queue-4.19/fsi-core-fix-error-paths-on-cfam-init.patch b/queue-4.19/fsi-core-fix-error-paths-on-cfam-init.patch
new file mode 100644
index 00000000000..97bf910ed35
--- /dev/null
+++ b/queue-4.19/fsi-core-fix-error-paths-on-cfam-init.patch
@@ -0,0 +1,94 @@
+From 9937b69391141c891000e751dc606cb58657a1af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 16:07:37 +0800
+Subject: fsi/core: Fix error paths on CFAM init
+
+From: Jeremy Kerr <jk@ozlabs.org>
+
+[ Upstream commit 371975b0b07520c85098652d561639837a60a905 ]
+
+Change d1dcd67825 re-worked the struct fsi_slave initialisation in
+fsi_slave_init, but introduced a few inconsitencies: the slave->dev is
+now registered through cdev_device_add, but we may kfree() the device
+out from underneath the cdev registration. We may also leave an IDA
+allocated.
+
+This change fixes the error paths, so that we kfree() only before the
+device is registered with the core code. We also move the smode write to
+before we start creating proper devices, as it's the most likely to
+fail. We also remove the IDA-allocated minor on error, and properly
+clean up the of_node.
+
+Fixes: d1dcd6782576 ("fsi: Add cfam char devices")
+Reported-by: Lei YU <mine260309@gmail.com>
+Tested-by: John Wang <wangzqbj@inspur.com>
+Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-core.c | 32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c
+index c6fa9b393e84b..bd62236d3f975 100644
+--- a/drivers/fsi/fsi-core.c
++++ b/drivers/fsi/fsi-core.c
+@@ -1060,6 +1060,14 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
+ 
+ 	}
+ 
++	rc = fsi_slave_set_smode(slave);
++	if (rc) {
++		dev_warn(&master->dev,
++				"can't set smode on slave:%02x:%02x %d\n",
++				link, id, rc);
++		goto err_free;
++	}
++
+ 	/* Allocate a minor in the FSI space */
+ 	rc = __fsi_get_new_minor(slave, fsi_dev_cfam, &slave->dev.devt,
+ 				 &slave->cdev_idx);
+@@ -1071,17 +1079,14 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
+ 	rc = cdev_device_add(&slave->cdev, &slave->dev);
+ 	if (rc) {
+ 		dev_err(&slave->dev, "Error %d creating slave device\n", rc);
+-		goto err_free;
++		goto err_free_ida;
+ 	}
+ 
+-	rc = fsi_slave_set_smode(slave);
+-	if (rc) {
+-		dev_warn(&master->dev,
+-				"can't set smode on slave:%02x:%02x %d\n",
+-				link, id, rc);
+-		kfree(slave);
+-		return -ENODEV;
+-	}
++	/* Now that we have the cdev registered with the core, any fatal
++	 * failures beyond this point will need to clean up through
++	 * cdev_device_del(). Fortunately though, nothing past here is fatal.
++	 */
++
+ 	if (master->link_config)
+ 		master->link_config(master, link,
+ 				    slave->t_send_delay,
+@@ -1098,10 +1103,13 @@ static int fsi_slave_init(struct fsi_master *master, int link, uint8_t id)
+ 		dev_dbg(&master->dev, "failed during slave scan with: %d\n",
+ 				rc);
+ 
+-	return rc;
++	return 0;
+ 
+- err_free:
+-	put_device(&slave->dev);
++err_free_ida:
++	fsi_free_minor(slave->dev.devt);
++err_free:
++	of_node_put(slave->dev.of_node);
++	kfree(slave);
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/fsi-sbefifo-don-t-fail-operations-when-in-sbe-ipl-st.patch b/queue-4.19/fsi-sbefifo-don-t-fail-operations-when-in-sbe-ipl-st.patch
new file mode 100644
index 00000000000..4dd0584fccc
--- /dev/null
+++ b/queue-4.19/fsi-sbefifo-don-t-fail-operations-when-in-sbe-ipl-st.patch
@@ -0,0 +1,44 @@
+From 4919edc9cf0c7140404bfaefcaf5f55ab0242980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 13:56:55 -0500
+Subject: fsi: sbefifo: Don't fail operations when in SBE IPL state
+
+From: Eddie James <eajames@linux.ibm.com>
+
+[ Upstream commit 7ce98fb6c53d2311b3e9faae90b1a9c1a96534db ]
+
+SBE fifo operations should be allowed while the SBE is in any of the
+"IPL" states. Operations should succeed in this state.
+
+Fixes: 9f4a8a2d7f9d fsi/sbefifo: Add driver for the SBE FIFO
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Tested-by: Alistair Popple <alistair@popple.id.au>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/1561575415-3282-1-git-send-email-eajames@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fsi/fsi-sbefifo.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c
+index ae861342626e3..9fa3959e08554 100644
+--- a/drivers/fsi/fsi-sbefifo.c
++++ b/drivers/fsi/fsi-sbefifo.c
+@@ -289,11 +289,11 @@ static int sbefifo_check_sbe_state(struct sbefifo *sbefifo)
+ 	switch ((sbm & CFAM_SBM_SBE_STATE_MASK) >> CFAM_SBM_SBE_STATE_SHIFT) {
+ 	case SBE_STATE_UNKNOWN:
+ 		return -ESHUTDOWN;
++	case SBE_STATE_DMT:
++		return -EBUSY;
+ 	case SBE_STATE_IPLING:
+ 	case SBE_STATE_ISTEP:
+ 	case SBE_STATE_MPIPL:
+-	case SBE_STATE_DMT:
+-		return -EBUSY;
+ 	case SBE_STATE_RUNTIME:
+ 	case SBE_STATE_DUMP: /* Not sure about that one */
+ 		break;
+-- 
+2.20.1
+
diff --git a/queue-4.19/genirq-debugfs-reinstate-full-of-path-for-domain-nam.patch b/queue-4.19/genirq-debugfs-reinstate-full-of-path-for-domain-nam.patch
new file mode 100644
index 00000000000..72d5c081763
--- /dev/null
+++ b/queue-4.19/genirq-debugfs-reinstate-full-of-path-for-domain-nam.patch
@@ -0,0 +1,47 @@
+From 6d6869b0148a22208029a4e39ad0410cb9438c74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 11:05:22 +0100
+Subject: genirq/debugfs: Reinstate full OF path for domain name
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit 94967b55ebf3b603f2fe750ecedd896042585a1c ]
+
+On a DT based system, we use the of_node full name to name the
+corresponding irq domain. We expect that name to be unique, so so that
+domains with the same base name won't clash (this happens on multi-node
+topologies, for example).
+
+Since a7e4cfb0a7ca ("of/fdt: only store the device node basename in
+full_name"), of_node_full_name() lies and only returns the basename. This
+breaks the above requirement, and we end-up with only a subset of the
+domains in /sys/kernel/debug/irq/domains.
+
+Let's reinstate the feature by using the fancy new %pOF format specifier,
+which happens to do the right thing.
+
+Fixes: a7e4cfb0a7ca ("of/fdt: only store the device node basename in full_name")
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20181001100522.180054-3-marc.zyngier@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irqdomain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 5d9fc01b60a61..0b90be3607249 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -183,7 +183,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
+ 		 * unhappy about. Replace them with ':', which does
+ 		 * the trick and is not as offensive as '\'...
+ 		 */
+-		name = kstrdup(of_node_full_name(of_node), GFP_KERNEL);
++		name = kasprintf(GFP_KERNEL, "%pOF", of_node);
+ 		if (!name) {
+ 			kfree(domain);
+ 			return NULL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/gpio-aspeed-fix-incorrect-number-of-banks.patch b/queue-4.19/gpio-aspeed-fix-incorrect-number-of-banks.patch
new file mode 100644
index 00000000000..2263f8984d9
--- /dev/null
+++ b/queue-4.19/gpio-aspeed-fix-incorrect-number-of-banks.patch
@@ -0,0 +1,41 @@
+From b980d11867ad7399f368cc47d763c9bfc87d8604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2019 16:26:22 +1000
+Subject: gpio/aspeed: Fix incorrect number of banks
+
+From: Rashmica Gupta <rashmica.g@gmail.com>
+
+[ Upstream commit 3c4710ae6f883f9c6e3df5e27e274702a1221c57 ]
+
+The current calculation for the number of GPIO banks is only correct if
+the number of GPIOs is a multiple of 32 (if there were 31 GPIOs we would
+currently say there are 0 banks, which is incorrect).
+
+Fixes: 361b79119a4b7 ('gpio: Add Aspeed driver')
+
+Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Link: https://lore.kernel.org/r/20190906062623.13354-1-rashmica.g@gmail.com
+Reviewed-by: Joel Stanley <joel@jms.d.au>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index b696ec35efb38..e627e0e9001ae 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -1199,7 +1199,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev)
+ 	gpio->chip.irq.need_valid_mask = true;
+ 
+ 	/* Allocate a cache of the output registers */
+-	banks = gpio->config->nr_gpios >> 5;
++	banks = DIV_ROUND_UP(gpio->config->nr_gpios, 32);
+ 	gpio->dcache = devm_kcalloc(&pdev->dev,
+ 				    banks, sizeof(u32), GFP_KERNEL);
+ 	if (!gpio->dcache)
+-- 
+2.20.1
+
diff --git a/queue-4.19/hv_netvsc-fix-offset-usage-in-netvsc_send_table.patch b/queue-4.19/hv_netvsc-fix-offset-usage-in-netvsc_send_table.patch
new file mode 100644
index 00000000000..04f42c26e98
--- /dev/null
+++ b/queue-4.19/hv_netvsc-fix-offset-usage-in-netvsc_send_table.patch
@@ -0,0 +1,116 @@
+From 787468de471481d453e0328d78575f8648ad78a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 13:33:40 -0800
+Subject: hv_netvsc: Fix offset usage in netvsc_send_table()
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit 71f21959dd5516031db4f011e15e9a9508b93a7d ]
+
+To reach the data region, the existing code adds offset in struct
+nvsp_5_send_indirect_table on the beginning of this struct. But the
+offset should be based on the beginning of its container,
+struct nvsp_message. This bug causes the first table entry missing,
+and adds an extra zero from the zero pad after the data region.
+This can put extra burden on the channel 0.
+
+So, correct the offset usage. Also add a boundary check to ensure
+not reading beyond data region.
+
+Fixes: 5b54dac856cb ("hyperv: Add support for virtual Receive Side Scaling (vRSS)")
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/hyperv_net.h |  3 ++-
+ drivers/net/hyperv/netvsc.c     | 26 ++++++++++++++++++--------
+ 2 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index 50709c76b6725..dfa801315da6b 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -616,7 +616,8 @@ struct nvsp_5_send_indirect_table {
+ 	/* The number of entries in the send indirection table */
+ 	u32 count;
+ 
+-	/* The offset of the send indirection table from top of this struct.
++	/* The offset of the send indirection table from the beginning of
++	 * struct nvsp_message.
+ 	 * The send indirection table tells which channel to put the send
+ 	 * traffic on. Each entry is a channel number.
+ 	 */
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 35413041dcf81..68c23a64e565f 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1182,20 +1182,28 @@ static int netvsc_receive(struct net_device *ndev,
+ }
+ 
+ static void netvsc_send_table(struct net_device *ndev,
+-			      const struct nvsp_message *nvmsg)
++			      const struct nvsp_message *nvmsg,
++			      u32 msglen)
+ {
+ 	struct net_device_context *net_device_ctx = netdev_priv(ndev);
+-	u32 count, *tab;
++	u32 count, offset, *tab;
+ 	int i;
+ 
+ 	count = nvmsg->msg.v5_msg.send_table.count;
++	offset = nvmsg->msg.v5_msg.send_table.offset;
++
+ 	if (count != VRSS_SEND_TAB_SIZE) {
+ 		netdev_err(ndev, "Received wrong send-table size:%u\n", count);
+ 		return;
+ 	}
+ 
+-	tab = (u32 *)((unsigned long)&nvmsg->msg.v5_msg.send_table +
+-		      nvmsg->msg.v5_msg.send_table.offset);
++	if (offset > msglen - count * sizeof(u32)) {
++		netdev_err(ndev, "Received send-table offset too big:%u\n",
++			   offset);
++		return;
++	}
++
++	tab = (void *)nvmsg + offset;
+ 
+ 	for (i = 0; i < count; i++)
+ 		net_device_ctx->tx_table[i] = tab[i];
+@@ -1213,12 +1221,13 @@ static void netvsc_send_vf(struct net_device *ndev,
+ 		    net_device_ctx->vf_alloc ? "added" : "removed");
+ }
+ 
+-static  void netvsc_receive_inband(struct net_device *ndev,
+-				   const struct nvsp_message *nvmsg)
++static void netvsc_receive_inband(struct net_device *ndev,
++				  const struct nvsp_message *nvmsg,
++				  u32 msglen)
+ {
+ 	switch (nvmsg->hdr.msg_type) {
+ 	case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
+-		netvsc_send_table(ndev, nvmsg);
++		netvsc_send_table(ndev, nvmsg, msglen);
+ 		break;
+ 
+ 	case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
+@@ -1235,6 +1244,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
+ 				  int budget)
+ {
+ 	const struct nvsp_message *nvmsg = hv_pkt_data(desc);
++	u32 msglen = hv_pkt_datalen(desc);
+ 
+ 	trace_nvsp_recv(ndev, channel, nvmsg);
+ 
+@@ -1250,7 +1260,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
+ 		break;
+ 
+ 	case VM_PKT_DATA_INBAND:
+-		netvsc_receive_inband(ndev, nvmsg);
++		netvsc_receive_inband(ndev, nvmsg, msglen);
+ 		break;
+ 
+ 	default:
+-- 
+2.20.1
+
diff --git a/queue-4.19/hv_netvsc-fix-send_table-offset-in-case-of-a-host-bu.patch b/queue-4.19/hv_netvsc-fix-send_table-offset-in-case-of-a-host-bu.patch
new file mode 100644
index 00000000000..773e99a4404
--- /dev/null
+++ b/queue-4.19/hv_netvsc-fix-send_table-offset-in-case-of-a-host-bu.patch
@@ -0,0 +1,83 @@
+From 3ef5621c66674b95f4166989a05130eb7a8fcb74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 13:33:41 -0800
+Subject: hv_netvsc: Fix send_table offset in case of a host bug
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit 171c1fd98df3d5948d9a9eb755274850fa5e59c6 ]
+
+If negotiated NVSP version <= NVSP_PROTOCOL_VERSION_6, the offset may
+be wrong (too small) due to a host bug. This can cause missing the
+end of the send indirection table, and add multiple zero entries from
+leading zeros before the data region. This bug adds extra burden on
+channel 0.
+
+So fix the offset by computing it from the data structure sizes. This
+will ensure netvsc driver runs normally on unfixed hosts, and future
+fixed hosts.
+
+Fixes: 5b54dac856cb ("hyperv: Add support for virtual Receive Side Scaling (vRSS)")
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 68c23a64e565f..dbfd3a0c97d3b 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1182,6 +1182,7 @@ static int netvsc_receive(struct net_device *ndev,
+ }
+ 
+ static void netvsc_send_table(struct net_device *ndev,
++			      struct netvsc_device *nvscdev,
+ 			      const struct nvsp_message *nvmsg,
+ 			      u32 msglen)
+ {
+@@ -1197,6 +1198,16 @@ static void netvsc_send_table(struct net_device *ndev,
+ 		return;
+ 	}
+ 
++	/* If negotiated version <= NVSP_PROTOCOL_VERSION_6, the offset may be
++	 * wrong due to a host bug. So fix the offset here.
++	 */
++	if (nvscdev->nvsp_version <= NVSP_PROTOCOL_VERSION_6 &&
++	    msglen >= sizeof(struct nvsp_message_header) +
++	    sizeof(union nvsp_6_message_uber) + count * sizeof(u32))
++		offset = sizeof(struct nvsp_message_header) +
++			 sizeof(union nvsp_6_message_uber);
++
++	/* Boundary check for all versions */
+ 	if (offset > msglen - count * sizeof(u32)) {
+ 		netdev_err(ndev, "Received send-table offset too big:%u\n",
+ 			   offset);
+@@ -1222,12 +1233,13 @@ static void netvsc_send_vf(struct net_device *ndev,
+ }
+ 
+ static void netvsc_receive_inband(struct net_device *ndev,
++				  struct netvsc_device *nvscdev,
+ 				  const struct nvsp_message *nvmsg,
+ 				  u32 msglen)
+ {
+ 	switch (nvmsg->hdr.msg_type) {
+ 	case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
+-		netvsc_send_table(ndev, nvmsg, msglen);
++		netvsc_send_table(ndev, nvscdev, nvmsg, msglen);
+ 		break;
+ 
+ 	case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
+@@ -1260,7 +1272,7 @@ static int netvsc_process_raw_pkt(struct hv_device *device,
+ 		break;
+ 
+ 	case VM_PKT_DATA_INBAND:
+-		netvsc_receive_inband(ndev, nvmsg, msglen);
++		netvsc_receive_inband(ndev, net_device, nvmsg, msglen);
+ 		break;
+ 
+ 	default:
+-- 
+2.20.1
+
diff --git a/queue-4.19/hv_netvsc-flag-software-created-hash-value.patch b/queue-4.19/hv_netvsc-flag-software-created-hash-value.patch
new file mode 100644
index 00000000000..588e6da513e
--- /dev/null
+++ b/queue-4.19/hv_netvsc-flag-software-created-hash-value.patch
@@ -0,0 +1,50 @@
+From a7cae98880da5cf873c3d4df04f53bfcfac4c645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 16:42:37 -0700
+Subject: hv_netvsc: flag software created hash value
+
+From: Stephen Hemminger <sthemmin@microsoft.com>
+
+[ Upstream commit df9f540ca74297a84bafacfa197e9347b20beea5 ]
+
+When the driver needs to create a hash value because it
+was not done at higher level, then the hash should be marked
+as a software not hardware hash.
+
+Fixes: f72860afa2e3 ("hv_netvsc: Exclude non-TCP port numbers from vRSS hashing")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 54670c9905c79..7ab576d8b6227 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -295,9 +295,9 @@ static inline u32 netvsc_get_hash(
+ 		else if (flow.basic.n_proto == htons(ETH_P_IPV6))
+ 			hash = jhash2((u32 *)&flow.addrs.v6addrs, 8, hashrnd);
+ 		else
+-			hash = 0;
++			return 0;
+ 
+-		skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
++		__skb_set_sw_hash(skb, hash, false);
+ 	}
+ 
+ 	return hash;
+@@ -804,8 +804,7 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ 	    skb->protocol == htons(ETH_P_IP))
+ 		netvsc_comp_ipcsum(skb);
+ 
+-	/* Do L4 checksum offload if enabled and present.
+-	 */
++	/* Do L4 checksum offload if enabled and present. */
+ 	if (csum_info && (net->features & NETIF_F_RXCSUM)) {
+ 		if (csum_info->receive.tcp_checksum_succeeded ||
+ 		    csum_info->receive.udp_checksum_succeeded)
+-- 
+2.20.1
+
diff --git a/queue-4.19/hwmon-lm75-fix-write-operations-for-negative-tempera.patch b/queue-4.19/hwmon-lm75-fix-write-operations-for-negative-tempera.patch
new file mode 100644
index 00000000000..0ce8786a1dd
--- /dev/null
+++ b/queue-4.19/hwmon-lm75-fix-write-operations-for-negative-tempera.patch
@@ -0,0 +1,40 @@
+From aa23aa6c45e234fb86ff2827a3363f43031d427e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 12:00:18 -0700
+Subject: hwmon: (lm75) Fix write operations for negative temperatures
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 7d82fcc9d9e81241778aaa22fda7be753e237d86 ]
+
+Writes into limit registers fail if the temperature written is negative.
+The regmap write operation checks the value range, regmap_write accepts
+an unsigned int as parameter, and the temperature value passed to
+regmap_write is kept in a variable declared as long. Negative values
+are converted large unsigned integers, which fails the range check.
+Fix by type casting the temperature to u16 when calling regmap_write().
+
+Cc: Iker Perez del Palomar Sustatxa <iker.perez@codethink.co.uk>
+Fixes: e65365fed87f ("hwmon: (lm75) Convert to use regmap")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm75.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
+index 49f4b33a5685a..7f28912c9abcf 100644
+--- a/drivers/hwmon/lm75.c
++++ b/drivers/hwmon/lm75.c
+@@ -165,7 +165,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type,
+ 	temp = DIV_ROUND_CLOSEST(temp  << (resolution - 8),
+ 				 1000) << (16 - resolution);
+ 
+-	return regmap_write(data->regmap, reg, temp);
++	return regmap_write(data->regmap, reg, (u16)temp);
+ }
+ 
+ static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type,
+-- 
+2.20.1
+
diff --git a/queue-4.19/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch b/queue-4.19/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch
new file mode 100644
index 00000000000..a37b7b165fc
--- /dev/null
+++ b/queue-4.19/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch
@@ -0,0 +1,48 @@
+From 78c90598ee8ebf604bd6e5d9751d3155755db153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 19:54:40 +0000
+Subject: hwmon: (pmbus/tps53679) Fix driver info initialization in probe
+ routine
+
+From: Vadim Pasternak <vadimp@mellanox.com>
+
+[ Upstream commit ff066653aeed8ee2d4dadb1e35774dd91ecbb19f ]
+
+Fix tps53679_probe() by using dynamically allocated "pmbus_driver_info"
+structure instead of static. Usage of static structures causes
+overwritten of the field "vrm_version", in case the system is equipped
+with several tps53679 devices with the different "vrm_version".
+In such case the last probed device overwrites this field for all
+others.
+
+Fixes: 610526527a13 ("hwmon: (pmbus) Add support for Texas Instruments tps53679 device")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 85b515cd9df0e..2bc352c5357f4 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -80,7 +80,14 @@ static struct pmbus_driver_info tps53679_info = {
+ static int tps53679_probe(struct i2c_client *client,
+ 			  const struct i2c_device_id *id)
+ {
+-	return pmbus_do_probe(client, id, &tps53679_info);
++	struct pmbus_driver_info *info;
++
++	info = devm_kmemdup(&client->dev, &tps53679_info, sizeof(*info),
++			    GFP_KERNEL);
++	if (!info)
++		return -ENOMEM;
++
++	return pmbus_do_probe(client, id, info);
+ }
+ 
+ static const struct i2c_device_id tps53679_id[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch b/queue-4.19/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
new file mode 100644
index 00000000000..7e99e0dbf5a
--- /dev/null
+++ b/queue-4.19/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
@@ -0,0 +1,39 @@
+From 12da6bf5a634e022d793ec7c3a7e3e8eaa4983ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 01:45:54 +0000
+Subject: hwmon: (shtc1) fix shtc1 and shtw1 id mask
+
+From: Dan Robertson <dan@dlrobertson.com>
+
+[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ]
+
+Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to
+retrieve the chip ID from the ID register. See section 5.7 of the shtw1
+or shtc1 datasheet for details.
+
+Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor")
+Signed-off-by: Dan Robertson <dan@dlrobertson.com>
+Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com
+[groeck: Reordered to be first in series and adjusted accordingly]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/shtc1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
+index decd7df995abf..2a18539591eaf 100644
+--- a/drivers/hwmon/shtc1.c
++++ b/drivers/hwmon/shtc1.c
+@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[]	       = { 0xef, 0xc8 };
+ 
+ /* constants for reading the ID register */
+ #define SHTC1_ID	  0x07
+-#define SHTC1_ID_REG_MASK 0x1f
++#define SHTC1_ID_REG_MASK 0x3f
+ 
+ /* delays for non-blocking i2c commands, both in us */
+ #define SHTC1_NONBLOCKING_WAIT_TIME_HPM  14400
+-- 
+2.20.1
+
diff --git a/queue-4.19/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch b/queue-4.19/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
new file mode 100644
index 00000000000..e75b151b0e7
--- /dev/null
+++ b/queue-4.19/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
@@ -0,0 +1,121 @@
+From 5f8b1391b4ed270468176a9225bfd18f3c17581e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Apr 2019 08:44:41 -0700
+Subject: hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 8ac89d0781ccc..a575e1cdb81a8 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
+ 	outb(ld,  sio->sioaddr + 1);
+ }
+ 
+-static inline void
++static inline int
+ superio_enter(struct w83627hf_sio_data *sio)
+ {
++	if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
++		return -EBUSY;
++
+ 	outb(0x87, sio->sioaddr);
+ 	outb(0x87, sio->sioaddr);
++
++	return 0;
+ }
+ 
+ static inline void
+ superio_exit(struct w83627hf_sio_data *sio)
+ {
+ 	outb(0xAA, sio->sioaddr);
++	release_region(sio->sioaddr, 2);
+ }
+ 
+ #define W627_DEVID 0x52
+@@ -1278,7 +1284,7 @@ static DEVICE_ATTR_RO(name);
+ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ 				struct w83627hf_sio_data *sio_data)
+ {
+-	int err = -ENODEV;
++	int err;
+ 	u16 val;
+ 
+ 	static __initconst char *const names[] = {
+@@ -1290,7 +1296,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ 	};
+ 
+ 	sio_data->sioaddr = sioaddr;
+-	superio_enter(sio_data);
++	err = superio_enter(sio_data);
++	if (err)
++		return err;
++
++	err = -ENODEV;
+ 	val = force_id ? force_id : superio_inb(sio_data, DEVID);
+ 	switch (val) {
+ 	case W627_DEVID:
+@@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
+ 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ 	int res = 0xff, sel;
+ 
+-	superio_enter(sio_data);
++	if (superio_enter(sio_data)) {
++		/*
++		 * Some other driver reserved the address space for itself.
++		 * We don't want to fail driver instantiation because of that,
++		 * so display a warning and keep going.
++		 */
++		dev_warn(&pdev->dev,
++			 "Can not read VID data: Failed to enable SuperIO access\n");
++		return res;
++	}
++
+ 	superio_select(sio_data, W83627HF_LD_GPIO5);
+ 
++	res = 0xff;
++
+ 	/* Make sure these GPIO pins are enabled */
+ 	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
+ 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
+@@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
+ 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ 	int res = 0xff;
+ 
+-	superio_enter(sio_data);
++	if (superio_enter(sio_data)) {
++		/*
++		 * Some other driver reserved the address space for itself.
++		 * We don't want to fail driver instantiation because of that,
++		 * so display a warning and keep going.
++		 */
++		dev_warn(&pdev->dev,
++			 "Can not read VID data: Failed to enable SuperIO access\n");
++		return res;
++	}
++
+ 	superio_select(sio_data, W83627HF_LD_HWM);
+ 
+ 	/* Make sure these GPIO pins are enabled */
+-- 
+2.20.1
+
diff --git a/queue-4.19/hwrng-bcm2835-fix-probe-as-platform-device.patch b/queue-4.19/hwrng-bcm2835-fix-probe-as-platform-device.patch
new file mode 100644
index 00000000000..08965239620
--- /dev/null
+++ b/queue-4.19/hwrng-bcm2835-fix-probe-as-platform-device.patch
@@ -0,0 +1,58 @@
+From 0e10fbb8f5650b6a94cdda00a318ee0c8d8658f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 13:16:08 +0100
+Subject: hwrng: bcm2835 - fix probe as platform device
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 984798de671a927ac73da31096a150df42e6aaf3 ]
+
+BCM63XX (MIPS) does not use device tree, so there cannot be any
+of_device_id, causing the driver to fail on probe:
+
+[    0.904564] bcm2835-rng: probe of bcm63xx-rng failed with error -22
+
+Fix this by checking for match data only if we are probing from device
+tree.
+
+Fixes: 8705f24f7b57 ("hwrng: bcm2835 - Enable BCM2835 RNG to work on BCM63xx platforms")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/bcm2835-rng.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
+index 6767d965c36c5..19bde680aee1d 100644
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -171,14 +171,16 @@ static int bcm2835_rng_probe(struct platform_device *pdev)
+ 	priv->rng.read = bcm2835_rng_read;
+ 	priv->rng.cleanup = bcm2835_rng_cleanup;
+ 
+-	rng_id = of_match_node(bcm2835_rng_of_match, np);
+-	if (!rng_id)
+-		return -EINVAL;
+-
+-	/* Check for rng init function, execute it */
+-	of_data = rng_id->data;
+-	if (of_data)
+-		priv->mask_interrupts = of_data->mask_interrupts;
++	if (dev_of_node(dev)) {
++		rng_id = of_match_node(bcm2835_rng_of_match, np);
++		if (!rng_id)
++			return -EINVAL;
++
++		/* Check for rng init function, execute it */
++		of_data = rng_id->data;
++		if (of_data)
++			priv->mask_interrupts = of_data->mask_interrupts;
++	}
+ 
+ 	/* register driver */
+ 	err = devm_hwrng_register(dev, &priv->rng);
+-- 
+2.20.1
+
diff --git a/queue-4.19/hwrng-omap3-rom-fix-missing-clock-by-probing-with-de.patch b/queue-4.19/hwrng-omap3-rom-fix-missing-clock-by-probing-with-de.patch
new file mode 100644
index 00000000000..e164a878403
--- /dev/null
+++ b/queue-4.19/hwrng-omap3-rom-fix-missing-clock-by-probing-with-de.patch
@@ -0,0 +1,187 @@
+From 2dfff35eec9b17a521243a77a0a09eceb1ac647d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2019 14:02:55 -0700
+Subject: hwrng: omap3-rom - Fix missing clock by probing with device tree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 0c0ef9ea6f3f0d5979dc7b094b0a184c1a94716b ]
+
+Commit 0ed266d7ae5e ("clk: ti: omap3: cleanup unnecessary clock aliases")
+removed old omap3 clock framework aliases but caused omap3-rom-rng to
+stop working with clock not found error.
+
+Based on discussions on the mailing list it was requested by Tero Kristo
+that it would be best to fix this issue by probing omap3-rom-rng using
+device tree to provide a proper clk property. The other option would be
+to add back the missing clock alias, but that does not help moving things
+forward with removing old legacy platform_data.
+
+Let's also add a proper device tree binding and keep it together with
+the fix.
+
+Cc: devicetree@vger.kernel.org
+Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: Adam Ford <aford173@gmail.com>
+Cc: Pali Rohár <pali.rohar@gmail.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Tero Kristo <t-kristo@ti.com>
+Fixes: 0ed266d7ae5e ("clk: ti: omap3: cleanup unnecessary clock aliases")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/rng/omap3_rom_rng.txt | 27 +++++++++++++++++++
+ arch/arm/boot/dts/omap3-n900.dts              |  6 +++++
+ arch/arm/mach-omap2/pdata-quirks.c            | 12 +--------
+ drivers/char/hw_random/omap3-rom-rng.c        | 17 ++++++++++--
+ 4 files changed, 49 insertions(+), 13 deletions(-)
+ create mode 100644 Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+
+diff --git a/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+new file mode 100644
+index 0000000000000..f315c9723bd2a
+--- /dev/null
++++ b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+@@ -0,0 +1,27 @@
++OMAP ROM RNG driver binding
++
++Secure SoCs may provide RNG via secure ROM calls like Nokia N900 does. The
++implementation can depend on the SoC secure ROM used.
++
++- compatible:
++	Usage: required
++	Value type: <string>
++	Definition: must be "nokia,n900-rom-rng"
++
++- clocks:
++	Usage: required
++	Value type: <prop-encoded-array>
++	Definition: reference to the the RNG interface clock
++
++- clock-names:
++	Usage: required
++	Value type: <stringlist>
++	Definition: must be "ick"
++
++Example:
++
++	rom_rng: rng {
++		compatible = "nokia,n900-rom-rng";
++		clocks = <&rng_ick>;
++		clock-names = "ick";
++	};
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 182a53991c901..37785e7d1238c 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -158,6 +158,12 @@
+ 		pwms = <&pwm9 0 26316 0>; /* 38000 Hz */
+ 	};
+ 
++	rom_rng: rng {
++		compatible = "nokia,n900-rom-rng";
++		clocks = <&rng_ick>;
++		clock-names = "ick";
++	};
++
+ 	/* controlled (enabled/disabled) directly by bcm2048 and wl1251 */
+ 	vctcxo: vctcxo {
+ 		compatible = "fixed-clock";
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index dae7262287704..b57faa2310a2e 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -263,14 +263,6 @@ static void __init am3517_evm_legacy_init(void)
+ 	am35xx_emac_reset();
+ }
+ 
+-static struct platform_device omap3_rom_rng_device = {
+-	.name		= "omap3-rom-rng",
+-	.id		= -1,
+-	.dev	= {
+-		.platform_data	= rx51_secure_rng_call,
+-	},
+-};
+-
+ static void __init nokia_n900_legacy_init(void)
+ {
+ 	hsmmc2_internal_input_clk();
+@@ -286,9 +278,6 @@ static void __init nokia_n900_legacy_init(void)
+ 			pr_warn("RX-51: Not enabling ARM errata 430973 workaround\n");
+ 			pr_warn("Thumb binaries may crash randomly without this workaround\n");
+ 		}
+-
+-		pr_info("RX-51: Registering OMAP3 HWRNG device\n");
+-		platform_device_register(&omap3_rom_rng_device);
+ 	}
+ }
+ 
+@@ -466,6 +455,7 @@ static struct of_dev_auxdata omap_auxdata_lookup[] = {
+ 	OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
+ 	OF_DEV_AUXDATA("ti,am3517-emac", 0x5c000000, "davinci_emac.0",
+ 		       &am35xx_emac_pdata),
++	OF_DEV_AUXDATA("nokia,n900-rom-rng", 0, NULL, rx51_secure_rng_call),
+ 	/* McBSP modules with sidetone core */
+ #if IS_ENABLED(CONFIG_SND_OMAP_SOC_MCBSP)
+ 	OF_DEV_AUXDATA("ti,omap3-mcbsp", 0x49022000, "49022000.mcbsp", &mcbsp_pdata),
+diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
+index 648e39ce6bd95..8df3cad7c97ae 100644
+--- a/drivers/char/hw_random/omap3-rom-rng.c
++++ b/drivers/char/hw_random/omap3-rom-rng.c
+@@ -20,6 +20,8 @@
+ #include <linux/workqueue.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ 
+ #define RNG_RESET			0x01
+@@ -86,14 +88,18 @@ static int omap3_rom_rng_read(struct hwrng *rng, void *data, size_t max, bool w)
+ 
+ static struct hwrng omap3_rom_rng_ops = {
+ 	.name		= "omap3-rom",
+-	.read		= omap3_rom_rng_read,
+ };
+ 
+ static int omap3_rom_rng_probe(struct platform_device *pdev)
+ {
+ 	int ret = 0;
+ 
+-	pr_info("initializing\n");
++	omap3_rom_rng_ops.read = of_device_get_match_data(&pdev->dev);
++	if (!omap3_rom_rng_ops.read) {
++		dev_err(&pdev->dev, "missing rom code handler\n");
++
++		return -ENODEV;
++	}
+ 
+ 	omap3_rom_rng_call = pdev->dev.platform_data;
+ 	if (!omap3_rom_rng_call) {
+@@ -126,9 +132,16 @@ static int omap3_rom_rng_remove(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static const struct of_device_id omap_rom_rng_match[] = {
++	{ .compatible = "nokia,n900-rom-rng", .data = omap3_rom_rng_read, },
++	{ /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, omap_rom_rng_match);
++
+ static struct platform_driver omap3_rom_rng_driver = {
+ 	.driver = {
+ 		.name		= "omap3-rom-rng",
++		.of_match_table = omap_rom_rng_match,
+ 	},
+ 	.probe		= omap3_rom_rng_probe,
+ 	.remove		= omap3_rom_rng_remove,
+-- 
+2.20.1
+
diff --git a/queue-4.19/i2c-stm32f7-report-dma-error-during-probe.patch b/queue-4.19/i2c-stm32f7-report-dma-error-during-probe.patch
new file mode 100644
index 00000000000..20160cdbd0a
--- /dev/null
+++ b/queue-4.19/i2c-stm32f7-report-dma-error-during-probe.patch
@@ -0,0 +1,91 @@
+From c2838af70510fea6c2c6ddfd0faeb79cc7abaa73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 14:52:00 +0200
+Subject: i2c: stm32f7: report dma error during probe
+
+From: Alain Volmat <alain.volmat@st.com>
+
+[ Upstream commit d77eceb2de99f5d7e0c645bad15511fe1af59e09 ]
+
+Distinguish between the case where dma information is not provided
+within the DT and the case of an error during the dma init.
+Exit the probe with error in case of an error during dma init.
+
+Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API")
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32.c   | 16 ++++++++--------
+ drivers/i2c/busses/i2c-stm32f7.c |  9 +++++++++
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32.c b/drivers/i2c/busses/i2c-stm32.c
+index d75fbcbf02ef3..667f8032f8ef6 100644
+--- a/drivers/i2c/busses/i2c-stm32.c
++++ b/drivers/i2c/busses/i2c-stm32.c
+@@ -21,13 +21,13 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
+ 
+ 	dma = devm_kzalloc(dev, sizeof(*dma), GFP_KERNEL);
+ 	if (!dma)
+-		return NULL;
++		return ERR_PTR(-ENOMEM);
+ 
+ 	/* Request and configure I2C TX dma channel */
+-	dma->chan_tx = dma_request_slave_channel(dev, "tx");
+-	if (!dma->chan_tx) {
++	dma->chan_tx = dma_request_chan(dev, "tx");
++	if (IS_ERR(dma->chan_tx)) {
+ 		dev_dbg(dev, "can't request DMA tx channel\n");
+-		ret = -EINVAL;
++		ret = PTR_ERR(dma->chan_tx);
+ 		goto fail_al;
+ 	}
+ 
+@@ -43,10 +43,10 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
+ 	}
+ 
+ 	/* Request and configure I2C RX dma channel */
+-	dma->chan_rx = dma_request_slave_channel(dev, "rx");
+-	if (!dma->chan_rx) {
++	dma->chan_rx = dma_request_chan(dev, "rx");
++	if (IS_ERR(dma->chan_rx)) {
+ 		dev_err(dev, "can't request DMA rx channel\n");
+-		ret = -EINVAL;
++		ret = PTR_ERR(dma->chan_rx);
+ 		goto fail_tx;
+ 	}
+ 
+@@ -76,7 +76,7 @@ fail_al:
+ 	devm_kfree(dev, dma);
+ 	dev_info(dev, "can't use DMA\n");
+ 
+-	return NULL;
++	return ERR_PTR(ret);
+ }
+ 
+ void stm32_i2c_dma_free(struct stm32_i2c_dma *dma)
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index e6bbb8ca70905..eb7e533b0dd47 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1914,6 +1914,15 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
+ 	i2c_dev->dma = stm32_i2c_dma_request(i2c_dev->dev, phy_addr,
+ 					     STM32F7_I2C_TXDR,
+ 					     STM32F7_I2C_RXDR);
++	if (PTR_ERR(i2c_dev->dma) == -ENODEV)
++		i2c_dev->dma = NULL;
++	else if (IS_ERR(i2c_dev->dma)) {
++		ret = PTR_ERR(i2c_dev->dma);
++		if (ret != -EPROBE_DEFER)
++			dev_err(&pdev->dev,
++				"Failed to request dma error %i\n", ret);
++		goto clk_free;
++	}
+ 
+ 	ret = i2c_add_adapter(adap);
+ 	if (ret)
+-- 
+2.20.1
+
diff --git a/queue-4.19/i40e-reduce-stack-usage-in-i40e_set_fc.patch b/queue-4.19/i40e-reduce-stack-usage-in-i40e_set_fc.patch
new file mode 100644
index 00000000000..e861fc544b9
--- /dev/null
+++ b/queue-4.19/i40e-reduce-stack-usage-in-i40e_set_fc.patch
@@ -0,0 +1,166 @@
+From e1a35b6e401f62b078f4a32534ce97b1cd24b2ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 14:35:07 +0200
+Subject: i40e: reduce stack usage in i40e_set_fc
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 33b165684ab70867d4545643f550a5d48d3ddc57 ]
+
+The functions i40e_aq_get_phy_abilities_resp() and i40e_set_fc() both
+have giant structure on the stack, which makes each one use stack frames
+larger than 500 bytes.
+
+As clang decides one function into the other, we get a warning for
+exceeding the frame size limit on 32-bit architectures:
+
+drivers/net/ethernet/intel/i40e/i40e_common.c:1654:23: error: stack frame size of 1116 bytes in function 'i40e_set_fc' [-Werror,-Wframe-larger-than=]
+
+When building with gcc, the inlining does not happen, but i40e_set_fc()
+calls i40e_aq_get_phy_abilities_resp() anyway, so they add up on the
+kernel stack just as much.
+
+The parts that actually use large stacks don't overlap, so make sure
+each one is a separate function, and mark them as noinline_for_stack to
+prevent the compilers from combining them again.
+
+Fixes: 0a862b43acc6 ("i40e/i40evf: Add module_types and update_link_info")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 91 +++++++++++--------
+ 1 file changed, 51 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 85f75b5978fca..eb0ae6ab01e26 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -1668,25 +1668,15 @@ enum i40e_status_code i40e_aq_set_phy_config(struct i40e_hw *hw,
+ 	return status;
+ }
+ 
+-/**
+- * i40e_set_fc
+- * @hw: pointer to the hw struct
+- * @aq_failures: buffer to return AdminQ failure information
+- * @atomic_restart: whether to enable atomic link restart
+- *
+- * Set the requested flow control mode using set_phy_config.
+- **/
+-enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+-				  bool atomic_restart)
++static noinline_for_stack enum i40e_status_code
++i40e_set_fc_status(struct i40e_hw *hw,
++		   struct i40e_aq_get_phy_abilities_resp *abilities,
++		   bool atomic_restart)
+ {
+-	enum i40e_fc_mode fc_mode = hw->fc.requested_mode;
+-	struct i40e_aq_get_phy_abilities_resp abilities;
+ 	struct i40e_aq_set_phy_config config;
+-	enum i40e_status_code status;
++	enum i40e_fc_mode fc_mode = hw->fc.requested_mode;
+ 	u8 pause_mask = 0x0;
+ 
+-	*aq_failures = 0x0;
+-
+ 	switch (fc_mode) {
+ 	case I40E_FC_FULL:
+ 		pause_mask |= I40E_AQ_PHY_FLAG_PAUSE_TX;
+@@ -1702,6 +1692,48 @@ enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+ 		break;
+ 	}
+ 
++	memset(&config, 0, sizeof(struct i40e_aq_set_phy_config));
++	/* clear the old pause settings */
++	config.abilities = abilities->abilities & ~(I40E_AQ_PHY_FLAG_PAUSE_TX) &
++			   ~(I40E_AQ_PHY_FLAG_PAUSE_RX);
++	/* set the new abilities */
++	config.abilities |= pause_mask;
++	/* If the abilities have changed, then set the new config */
++	if (config.abilities == abilities->abilities)
++		return 0;
++
++	/* Auto restart link so settings take effect */
++	if (atomic_restart)
++		config.abilities |= I40E_AQ_PHY_ENABLE_ATOMIC_LINK;
++	/* Copy over all the old settings */
++	config.phy_type = abilities->phy_type;
++	config.phy_type_ext = abilities->phy_type_ext;
++	config.link_speed = abilities->link_speed;
++	config.eee_capability = abilities->eee_capability;
++	config.eeer = abilities->eeer_val;
++	config.low_power_ctrl = abilities->d3_lpan;
++	config.fec_config = abilities->fec_cfg_curr_mod_ext_info &
++			    I40E_AQ_PHY_FEC_CONFIG_MASK;
++
++	return i40e_aq_set_phy_config(hw, &config, NULL);
++}
++
++/**
++ * i40e_set_fc
++ * @hw: pointer to the hw struct
++ * @aq_failures: buffer to return AdminQ failure information
++ * @atomic_restart: whether to enable atomic link restart
++ *
++ * Set the requested flow control mode using set_phy_config.
++ **/
++enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
++				  bool atomic_restart)
++{
++	struct i40e_aq_get_phy_abilities_resp abilities;
++	enum i40e_status_code status;
++
++	*aq_failures = 0x0;
++
+ 	/* Get the current phy config */
+ 	status = i40e_aq_get_phy_capabilities(hw, false, false, &abilities,
+ 					      NULL);
+@@ -1710,31 +1742,10 @@ enum i40e_status_code i40e_set_fc(struct i40e_hw *hw, u8 *aq_failures,
+ 		return status;
+ 	}
+ 
+-	memset(&config, 0, sizeof(struct i40e_aq_set_phy_config));
+-	/* clear the old pause settings */
+-	config.abilities = abilities.abilities & ~(I40E_AQ_PHY_FLAG_PAUSE_TX) &
+-			   ~(I40E_AQ_PHY_FLAG_PAUSE_RX);
+-	/* set the new abilities */
+-	config.abilities |= pause_mask;
+-	/* If the abilities have changed, then set the new config */
+-	if (config.abilities != abilities.abilities) {
+-		/* Auto restart link so settings take effect */
+-		if (atomic_restart)
+-			config.abilities |= I40E_AQ_PHY_ENABLE_ATOMIC_LINK;
+-		/* Copy over all the old settings */
+-		config.phy_type = abilities.phy_type;
+-		config.phy_type_ext = abilities.phy_type_ext;
+-		config.link_speed = abilities.link_speed;
+-		config.eee_capability = abilities.eee_capability;
+-		config.eeer = abilities.eeer_val;
+-		config.low_power_ctrl = abilities.d3_lpan;
+-		config.fec_config = abilities.fec_cfg_curr_mod_ext_info &
+-				    I40E_AQ_PHY_FEC_CONFIG_MASK;
+-		status = i40e_aq_set_phy_config(hw, &config, NULL);
++	status = i40e_set_fc_status(hw, &abilities, atomic_restart);
++	if (status)
++		*aq_failures |= I40E_SET_FC_AQ_FAIL_SET;
+ 
+-		if (status)
+-			*aq_failures |= I40E_SET_FC_AQ_FAIL_SET;
+-	}
+ 	/* Update the link info */
+ 	status = i40e_update_link_info(hw);
+ 	if (status) {
+@@ -2563,7 +2574,7 @@ i40e_status i40e_get_link_status(struct i40e_hw *hw, bool *link_up)
+  * i40e_updatelink_status - update status of the HW network link
+  * @hw: pointer to the hw struct
+  **/
+-i40e_status i40e_update_link_info(struct i40e_hw *hw)
++noinline_for_stack i40e_status i40e_update_link_info(struct i40e_hw *hw)
+ {
+ 	struct i40e_aq_get_phy_abilities_resp abilities;
+ 	i40e_status status = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-hfi1-add-mtu-check-for-operational-data-vls.patch b/queue-4.19/ib-hfi1-add-mtu-check-for-operational-data-vls.patch
new file mode 100644
index 00000000000..8ce06d847ef
--- /dev/null
+++ b/queue-4.19/ib-hfi1-add-mtu-check-for-operational-data-vls.patch
@@ -0,0 +1,74 @@
+From 8d3430cfaeda374b878f72ed4f1f73efc079662a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 10:56:03 -0700
+Subject: IB/hfi1: Add mtu check for operational data VLs
+
+From: Alex Estrin <alex.estrin@intel.com>
+
+[ Upstream commit eb50130964e8c1379f37c3d3bab33a411ec62e98 ]
+
+Since Virtual Lanes BCT credits and MTU are set through separate MADs, we
+have to ensure both are valid, and data VLs are ready for transmission
+before we allow port transition to Armed state.
+
+Fixes: 5e2d6764a729 ("IB/hfi1: Verify port data VLs credits on transition to Armed")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Alex Estrin <alex.estrin@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 6b89353611333..b09a4b1cf397b 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -10580,12 +10580,29 @@ void set_link_down_reason(struct hfi1_pportdata *ppd, u8 lcl_reason,
+ 	}
+ }
+ 
+-/*
+- * Verify if BCT for data VLs is non-zero.
++/**
++ * data_vls_operational() - Verify if data VL BCT credits and MTU
++ *			    are both set.
++ * @ppd: pointer to hfi1_pportdata structure
++ *
++ * Return: true - Ok, false -otherwise.
+  */
+ static inline bool data_vls_operational(struct hfi1_pportdata *ppd)
+ {
+-	return !!ppd->actual_vls_operational;
++	int i;
++	u64 reg;
++
++	if (!ppd->actual_vls_operational)
++		return false;
++
++	for (i = 0; i < ppd->vls_supported; i++) {
++		reg = read_csr(ppd->dd, SEND_CM_CREDIT_VL + (8 * i));
++		if ((reg && !ppd->dd->vld[i].mtu) ||
++		    (!reg && ppd->dd->vld[i].mtu))
++			return false;
++	}
++
++	return true;
+ }
+ 
+ /*
+@@ -10698,7 +10715,8 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ 
+ 		if (!data_vls_operational(ppd)) {
+ 			dd_dev_err(dd,
+-				   "%s: data VLs not operational\n", __func__);
++				   "%s: Invalid data VL credits or mtu\n",
++				   __func__);
+ 			ret = -EINVAL;
+ 			break;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-hfi1-correctly-process-fecn-and-becn-in-packets.patch b/queue-4.19/ib-hfi1-correctly-process-fecn-and-becn-in-packets.patch
new file mode 100644
index 00000000000..31a08a13073
--- /dev/null
+++ b/queue-4.19/ib-hfi1-correctly-process-fecn-and-becn-in-packets.patch
@@ -0,0 +1,474 @@
+From 74e92981f20bf4f023df130893743f4cc13e6d0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:19:15 -0800
+Subject: IB/hfi1: Correctly process FECN and BECN in packets
+
+From: Mitko Haralanov <mitko.haralanov@intel.com>
+
+[ Upstream commit fe4dd4239277486ca3a468e7bbeafd7ef3a5634e ]
+
+A CA is supposed to ignore FECN bits in multicast, ACK, and CNP
+packets. This patch corrects the behavior of the HFI1 driver in this
+regard by ignoring FECNs in those packet types.
+
+While fixing the above behavior, fix the extraction of the FECN and BECN
+bits from the packet headers for both 9B and 16B packets.
+
+Furthermore, this patch corrects the driver's response to a FECN in RDMA
+READ RESPONSE packets. Instead of sending an "empty" ACK, the driver now
+sends a CNP packet. While editing that code path, add the missing trace
+for CNP packets.
+
+Fixes: 88733e3b8450 ("IB/hfi1: Add 16B UD support")
+Fixes: f59fb9e05109 ("IB/hfi1: Fix handling of FECN marked multicast packet")
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Mitko Haralanov <mitko.haralanov@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/driver.c | 70 ++++++++++++++++++++---------
+ drivers/infiniband/hw/hfi1/hfi.h    | 35 ++++++++++-----
+ drivers/infiniband/hw/hfi1/rc.c     | 30 +++++--------
+ drivers/infiniband/hw/hfi1/uc.c     |  2 +-
+ drivers/infiniband/hw/hfi1/ud.c     | 33 ++++++++------
+ 5 files changed, 104 insertions(+), 66 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
+index a41f85558312e..d5277c23cba60 100644
+--- a/drivers/infiniband/hw/hfi1/driver.c
++++ b/drivers/infiniband/hw/hfi1/driver.c
+@@ -430,40 +430,60 @@ static const hfi1_handle_cnp hfi1_handle_cnp_tbl[2] = {
+ 	[HFI1_PKT_TYPE_16B] = &return_cnp_16B
+ };
+ 
+-void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+-			       bool do_cnp)
++/**
++ * hfi1_process_ecn_slowpath - Process FECN or BECN bits
++ * @qp: The packet's destination QP
++ * @pkt: The packet itself.
++ * @prescan: Is the caller the RXQ prescan
++ *
++ * Process the packet's FECN or BECN bits. By now, the packet
++ * has already been evaluated whether processing of those bit should
++ * be done.
++ * The significance of the @prescan argument is that if the caller
++ * is the RXQ prescan, a CNP will be send out instead of waiting for the
++ * normal packet processing to send an ACK with BECN set (or a CNP).
++ */
++bool hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
++			       bool prescan)
+ {
+ 	struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num);
+ 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ 	struct ib_other_headers *ohdr = pkt->ohdr;
+ 	struct ib_grh *grh = pkt->grh;
+-	u32 rqpn = 0, bth1;
++	u32 rqpn = 0;
+ 	u16 pkey;
+ 	u32 rlid, slid, dlid = 0;
+-	u8 hdr_type, sc, svc_type;
+-	bool is_mcast = false;
++	u8 hdr_type, sc, svc_type, opcode;
++	bool is_mcast = false, ignore_fecn = false, do_cnp = false,
++		fecn, becn;
+ 
+ 	/* can be called from prescan */
+ 	if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
+-		is_mcast = hfi1_is_16B_mcast(dlid);
+ 		pkey = hfi1_16B_get_pkey(pkt->hdr);
+ 		sc = hfi1_16B_get_sc(pkt->hdr);
+ 		dlid = hfi1_16B_get_dlid(pkt->hdr);
+ 		slid = hfi1_16B_get_slid(pkt->hdr);
++		is_mcast = hfi1_is_16B_mcast(dlid);
++		opcode = ib_bth_get_opcode(ohdr);
+ 		hdr_type = HFI1_PKT_TYPE_16B;
++		fecn = hfi1_16B_get_fecn(pkt->hdr);
++		becn = hfi1_16B_get_becn(pkt->hdr);
+ 	} else {
+-		is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
+-			   (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
+ 		pkey = ib_bth_get_pkey(ohdr);
+ 		sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf);
+-		dlid = ib_get_dlid(pkt->hdr);
++		dlid = qp->ibqp.qp_type != IB_QPT_UD ? ib_get_dlid(pkt->hdr) :
++			ppd->lid;
+ 		slid = ib_get_slid(pkt->hdr);
++		is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) &&
++			   (dlid != be16_to_cpu(IB_LID_PERMISSIVE));
++		opcode = ib_bth_get_opcode(ohdr);
+ 		hdr_type = HFI1_PKT_TYPE_9B;
++		fecn = ib_bth_get_fecn(ohdr);
++		becn = ib_bth_get_becn(ohdr);
+ 	}
+ 
+ 	switch (qp->ibqp.qp_type) {
+ 	case IB_QPT_UD:
+-		dlid = ppd->lid;
+ 		rlid = slid;
+ 		rqpn = ib_get_sqpn(pkt->ohdr);
+ 		svc_type = IB_CC_SVCTYPE_UD;
+@@ -485,22 +505,31 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+ 		svc_type = IB_CC_SVCTYPE_RC;
+ 		break;
+ 	default:
+-		return;
++		return false;
+ 	}
+ 
+-	bth1 = be32_to_cpu(ohdr->bth[1]);
++	ignore_fecn = is_mcast || (opcode == IB_OPCODE_CNP) ||
++		(opcode == IB_OPCODE_RC_ACKNOWLEDGE);
++	/*
++	 * ACKNOWLEDGE packets do not get a CNP but this will be
++	 * guarded by ignore_fecn above.
++	 */
++	do_cnp = prescan ||
++		(opcode >= IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST &&
++		 opcode <= IB_OPCODE_RC_ATOMIC_ACKNOWLEDGE);
++
+ 	/* Call appropriate CNP handler */
+-	if (do_cnp && (bth1 & IB_FECN_SMASK))
++	if (!ignore_fecn && do_cnp && fecn)
+ 		hfi1_handle_cnp_tbl[hdr_type](ibp, qp, rqpn, pkey,
+ 					      dlid, rlid, sc, grh);
+ 
+-	if (!is_mcast && (bth1 & IB_BECN_SMASK)) {
+-		u32 lqpn = bth1 & RVT_QPN_MASK;
++	if (becn) {
++		u32 lqpn = be32_to_cpu(ohdr->bth[1]) & RVT_QPN_MASK;
+ 		u8 sl = ibp->sc_to_sl[sc];
+ 
+ 		process_becn(ppd, sl, rlid, lqpn, rqpn, svc_type);
+ 	}
+-
++	return !ignore_fecn && fecn;
+ }
+ 
+ struct ps_mdata {
+@@ -599,7 +628,6 @@ static void __prescan_rxq(struct hfi1_packet *packet)
+ 		struct rvt_dev_info *rdi = &rcd->dd->verbs_dev.rdi;
+ 		u64 rhf = rhf_to_cpu(rhf_addr);
+ 		u32 etype = rhf_rcv_type(rhf), qpn, bth1;
+-		int is_ecn = 0;
+ 		u8 lnh;
+ 
+ 		if (ps_done(&mdata, rhf, rcd))
+@@ -625,12 +653,10 @@ static void __prescan_rxq(struct hfi1_packet *packet)
+ 			goto next; /* just in case */
+ 		}
+ 
+-		bth1 = be32_to_cpu(packet->ohdr->bth[1]);
+-		is_ecn = !!(bth1 & (IB_FECN_SMASK | IB_BECN_SMASK));
+-
+-		if (!is_ecn)
++		if (!hfi1_may_ecn(packet))
+ 			goto next;
+ 
++		bth1 = be32_to_cpu(packet->ohdr->bth[1]);
+ 		qpn = bth1 & RVT_QPN_MASK;
+ 		rcu_read_lock();
+ 		qp = rvt_lookup_qpn(rdi, &ibp->rvp, qpn);
+@@ -640,7 +666,7 @@ static void __prescan_rxq(struct hfi1_packet *packet)
+ 			goto next;
+ 		}
+ 
+-		process_ecn(qp, packet, true);
++		hfi1_process_ecn_slowpath(qp, packet, true);
+ 		rcu_read_unlock();
+ 
+ 		/* turn off BECN, FECN */
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 2ea42c04cfd25..232fc4b59a98c 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1797,13 +1797,20 @@ static inline struct hfi1_ibport *rcd_to_iport(struct hfi1_ctxtdata *rcd)
+ 	return &rcd->ppd->ibport_data;
+ }
+ 
+-void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
+-			       bool do_cnp);
+-static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt,
+-			       bool do_cnp)
++/**
++ * hfi1_may_ecn - Check whether FECN or BECN processing should be done
++ * @pkt: the packet to be evaluated
++ *
++ * Check whether the FECN or BECN bits in the packet's header are
++ * enabled, depending on packet type.
++ *
++ * This function only checks for FECN and BECN bits. Additional checks
++ * are done in the slowpath (hfi1_process_ecn_slowpath()) in order to
++ * ensure correct handling.
++ */
++static inline bool hfi1_may_ecn(struct hfi1_packet *pkt)
+ {
+-	bool becn;
+-	bool fecn;
++	bool fecn, becn;
+ 
+ 	if (pkt->etype == RHF_RCV_TYPE_BYPASS) {
+ 		fecn = hfi1_16B_get_fecn(pkt->hdr);
+@@ -1812,10 +1819,18 @@ static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt,
+ 		fecn = ib_bth_get_fecn(pkt->ohdr);
+ 		becn = ib_bth_get_becn(pkt->ohdr);
+ 	}
+-	if (unlikely(fecn || becn)) {
+-		hfi1_process_ecn_slowpath(qp, pkt, do_cnp);
+-		return fecn;
+-	}
++	return fecn || becn;
++}
++
++bool hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt,
++			       bool prescan);
++static inline bool process_ecn(struct rvt_qp *qp, struct hfi1_packet *pkt)
++{
++	bool do_work;
++
++	do_work = hfi1_may_ecn(pkt);
++	if (unlikely(do_work))
++		return hfi1_process_ecn_slowpath(qp, pkt, false);
+ 	return false;
+ }
+ 
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index 770c78c657306..980168a567071 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -2049,8 +2049,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ 	struct ib_reth *reth;
+ 	unsigned long flags;
+ 	int ret;
+-	bool is_fecn = false;
+-	bool copy_last = false;
++	bool copy_last = false, fecn;
+ 	u32 rkey;
+ 	u8 extra_bytes = pad + packet->extra_byte + (SIZE_OF_CRC << 2);
+ 
+@@ -2059,7 +2058,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ 	if (hfi1_ruc_check_hdr(ibp, packet))
+ 		return;
+ 
+-	is_fecn = process_ecn(qp, packet, false);
++	fecn = process_ecn(qp, packet);
+ 
+ 	/*
+ 	 * Process responses (ACKs) before anything else.  Note that the
+@@ -2070,8 +2069,6 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ 	if (opcode >= OP(RDMA_READ_RESPONSE_FIRST) &&
+ 	    opcode <= OP(ATOMIC_ACKNOWLEDGE)) {
+ 		rc_rcv_resp(packet);
+-		if (is_fecn)
+-			goto send_ack;
+ 		return;
+ 	}
+ 
+@@ -2347,11 +2344,11 @@ send_last:
+ 
+ 		/* Schedule the send engine. */
+ 		qp->s_flags |= RVT_S_RESP_PENDING;
++		if (fecn)
++			qp->s_flags |= RVT_S_ECN;
+ 		hfi1_schedule_send(qp);
+ 
+ 		spin_unlock_irqrestore(&qp->s_lock, flags);
+-		if (is_fecn)
+-			goto send_ack;
+ 		return;
+ 	}
+ 
+@@ -2413,11 +2410,11 @@ send_last:
+ 
+ 		/* Schedule the send engine. */
+ 		qp->s_flags |= RVT_S_RESP_PENDING;
++		if (fecn)
++			qp->s_flags |= RVT_S_ECN;
+ 		hfi1_schedule_send(qp);
+ 
+ 		spin_unlock_irqrestore(&qp->s_lock, flags);
+-		if (is_fecn)
+-			goto send_ack;
+ 		return;
+ 	}
+ 
+@@ -2430,16 +2427,9 @@ send_last:
+ 	qp->r_ack_psn = psn;
+ 	qp->r_nak_state = 0;
+ 	/* Send an ACK if requested or required. */
+-	if (psn & IB_BTH_REQ_ACK) {
+-		if (packet->numpkt == 0) {
+-			rc_cancel_ack(qp);
+-			goto send_ack;
+-		}
+-		if (qp->r_adefered >= HFI1_PSN_CREDIT) {
+-			rc_cancel_ack(qp);
+-			goto send_ack;
+-		}
+-		if (unlikely(is_fecn)) {
++	if (psn & IB_BTH_REQ_ACK || fecn) {
++		if (packet->numpkt == 0 || fecn ||
++		    qp->r_adefered >= HFI1_PSN_CREDIT) {
+ 			rc_cancel_ack(qp);
+ 			goto send_ack;
+ 		}
+@@ -2480,7 +2470,7 @@ nack_acc:
+ 	qp->r_nak_state = IB_NAK_REMOTE_ACCESS_ERROR;
+ 	qp->r_ack_psn = qp->r_psn;
+ send_ack:
+-	hfi1_send_rc_ack(packet, is_fecn);
++	hfi1_send_rc_ack(packet, fecn);
+ }
+ 
+ void hfi1_rc_hdrerr(
+diff --git a/drivers/infiniband/hw/hfi1/uc.c b/drivers/infiniband/hw/hfi1/uc.c
+index e254dcec6f647..4121d1a93b1bb 100644
+--- a/drivers/infiniband/hw/hfi1/uc.c
++++ b/drivers/infiniband/hw/hfi1/uc.c
+@@ -321,7 +321,7 @@ void hfi1_uc_rcv(struct hfi1_packet *packet)
+ 	if (hfi1_ruc_check_hdr(ibp, packet))
+ 		return;
+ 
+-	process_ecn(qp, packet, true);
++	process_ecn(qp, packet);
+ 
+ 	psn = ib_bth_get_psn(ohdr);
+ 	/* Compare the PSN verses the expected PSN. */
+diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
+index 54eb695642649..ef5b3ffd3888b 100644
+--- a/drivers/infiniband/hw/hfi1/ud.c
++++ b/drivers/infiniband/hw/hfi1/ud.c
+@@ -51,6 +51,7 @@
+ #include "hfi.h"
+ #include "mad.h"
+ #include "verbs_txreq.h"
++#include "trace_ibhdrs.h"
+ #include "qp.h"
+ 
+ /* We support only two types - 9B and 16B for now */
+@@ -656,18 +657,19 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ 	u32 bth0, plen, vl, hwords = 7;
+ 	u16 len;
+ 	u8 l4;
+-	struct hfi1_16b_header hdr;
++	struct hfi1_opa_header hdr;
+ 	struct ib_other_headers *ohdr;
+ 	struct pio_buf *pbuf;
+ 	struct send_context *ctxt = qp_to_send_context(qp, sc5);
+ 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ 	u32 nwords;
+ 
++	hdr.hdr_type = HFI1_PKT_TYPE_16B;
+ 	/* Populate length */
+ 	nwords = ((hfi1_get_16b_padding(hwords << 2, 0) +
+ 		   SIZE_OF_LT) >> 2) + SIZE_OF_CRC;
+ 	if (old_grh) {
+-		struct ib_grh *grh = &hdr.u.l.grh;
++		struct ib_grh *grh = &hdr.opah.u.l.grh;
+ 
+ 		grh->version_tclass_flow = old_grh->version_tclass_flow;
+ 		grh->paylen = cpu_to_be16(
+@@ -675,11 +677,11 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ 		grh->hop_limit = 0xff;
+ 		grh->sgid = old_grh->dgid;
+ 		grh->dgid = old_grh->sgid;
+-		ohdr = &hdr.u.l.oth;
++		ohdr = &hdr.opah.u.l.oth;
+ 		l4 = OPA_16B_L4_IB_GLOBAL;
+ 		hwords += sizeof(struct ib_grh) / sizeof(u32);
+ 	} else {
+-		ohdr = &hdr.u.oth;
++		ohdr = &hdr.opah.u.oth;
+ 		l4 = OPA_16B_L4_IB_LOCAL;
+ 	}
+ 
+@@ -693,7 +695,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ 
+ 	/* Convert dwords to flits */
+ 	len = (hwords + nwords) >> 1;
+-	hfi1_make_16b_hdr(&hdr, slid, dlid, len, pkey, 1, 0, l4, sc5);
++	hfi1_make_16b_hdr(&hdr.opah, slid, dlid, len, pkey, 1, 0, l4, sc5);
+ 
+ 	plen = 2 /* PBC */ + hwords + nwords;
+ 	pbc_flags |= PBC_PACKET_BYPASS | PBC_INSERT_BYPASS_ICRC;
+@@ -701,9 +703,11 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
+ 	if (ctxt) {
+ 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
+-		if (pbuf)
++		if (pbuf) {
++			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
+ 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
+ 						 &hdr, hwords);
++		}
+ 	}
+ }
+ 
+@@ -715,14 +719,15 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ 	u32 bth0, plen, vl, hwords = 5;
+ 	u16 lrh0;
+ 	u8 sl = ibp->sc_to_sl[sc5];
+-	struct ib_header hdr;
++	struct hfi1_opa_header hdr;
+ 	struct ib_other_headers *ohdr;
+ 	struct pio_buf *pbuf;
+ 	struct send_context *ctxt = qp_to_send_context(qp, sc5);
+ 	struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ 
++	hdr.hdr_type = HFI1_PKT_TYPE_9B;
+ 	if (old_grh) {
+-		struct ib_grh *grh = &hdr.u.l.grh;
++		struct ib_grh *grh = &hdr.ibh.u.l.grh;
+ 
+ 		grh->version_tclass_flow = old_grh->version_tclass_flow;
+ 		grh->paylen = cpu_to_be16(
+@@ -730,11 +735,11 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ 		grh->hop_limit = 0xff;
+ 		grh->sgid = old_grh->dgid;
+ 		grh->dgid = old_grh->sgid;
+-		ohdr = &hdr.u.l.oth;
++		ohdr = &hdr.ibh.u.l.oth;
+ 		lrh0 = HFI1_LRH_GRH;
+ 		hwords += sizeof(struct ib_grh) / sizeof(u32);
+ 	} else {
+-		ohdr = &hdr.u.oth;
++		ohdr = &hdr.ibh.u.oth;
+ 		lrh0 = HFI1_LRH_BTH;
+ 	}
+ 
+@@ -746,16 +751,18 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ 	ohdr->bth[1] = cpu_to_be32(remote_qpn | (1 << IB_BECN_SHIFT));
+ 	ohdr->bth[2] = 0; /* PSN 0 */
+ 
+-	hfi1_make_ib_hdr(&hdr, lrh0, hwords + SIZE_OF_CRC, dlid, slid);
++	hfi1_make_ib_hdr(&hdr.ibh, lrh0, hwords + SIZE_OF_CRC, dlid, slid);
+ 	plen = 2 /* PBC */ + hwords;
+ 	pbc_flags |= (ib_is_sc5(sc5) << PBC_DC_INFO_SHIFT);
+ 	vl = sc_to_vlt(ppd->dd, sc5);
+ 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
+ 	if (ctxt) {
+ 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
+-		if (pbuf)
++		if (pbuf) {
++			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
+ 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
+ 						 &hdr, hwords);
++		}
+ 	}
+ }
+ 
+@@ -912,7 +919,7 @@ void hfi1_ud_rcv(struct hfi1_packet *packet)
+ 		src_qp = hfi1_16B_get_src_qpn(packet->mgmt);
+ 	}
+ 
+-	process_ecn(qp, packet, (opcode != IB_OPCODE_CNP));
++	process_ecn(qp, packet);
+ 	/*
+ 	 * Get the number of bytes the message was padded by
+ 	 * and drop incomplete packets.
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-hfi1-handle-port-down-properly-in-pio.patch b/queue-4.19/ib-hfi1-handle-port-down-properly-in-pio.patch
new file mode 100644
index 00000000000..b514155e12a
--- /dev/null
+++ b/queue-4.19/ib-hfi1-handle-port-down-properly-in-pio.patch
@@ -0,0 +1,113 @@
+From 7fd4f1694350be6d5c8e573167cfa2c30fd700ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jun 2019 12:33:06 -0400
+Subject: IB/hfi1: Handle port down properly in pio
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 942a899335707fc9cfc97cb382a60734b2ff4e03 ]
+
+The call to sc_buffer_alloc currently returns NULL (no buffer) or
+a buffer descriptor.
+
+There is a third case when the port is down.  Currently that
+returns NULL and this prevents the caller from properly handling the
+sc_buffer_alloc() failure.  A verbs code link test after the call is
+racy so the indication needs to come from the state check inside the allocation
+routine to be valid.
+
+Fix by encoding the ECOMM failure like SDMA.   IS_ERR_OR_NULL() tests
+are added at all call sites.  For verbs send, this needs to treat any
+error by returning a completion without any MMIO copy.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/pio.c   | 5 +++--
+ drivers/infiniband/hw/hfi1/rc.c    | 2 +-
+ drivers/infiniband/hw/hfi1/ud.c    | 4 ++--
+ drivers/infiniband/hw/hfi1/verbs.c | 4 ++--
+ 4 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
+index 752057647f091..3fcbf56f8be23 100644
+--- a/drivers/infiniband/hw/hfi1/pio.c
++++ b/drivers/infiniband/hw/hfi1/pio.c
+@@ -1434,7 +1434,8 @@ void sc_stop(struct send_context *sc, int flag)
+  * @cb: optional callback to call when the buffer is finished sending
+  * @arg: argument for cb
+  *
+- * Return a pointer to a PIO buffer if successful, NULL if not enough room.
++ * Return a pointer to a PIO buffer, NULL if not enough room, -ECOMM
++ * when link is down.
+  */
+ struct pio_buf *sc_buffer_alloc(struct send_context *sc, u32 dw_len,
+ 				pio_release_cb cb, void *arg)
+@@ -1450,7 +1451,7 @@ struct pio_buf *sc_buffer_alloc(struct send_context *sc, u32 dw_len,
+ 	spin_lock_irqsave(&sc->alloc_lock, flags);
+ 	if (!(sc->flags & SCF_ENABLED)) {
+ 		spin_unlock_irqrestore(&sc->alloc_lock, flags);
+-		goto done;
++		return ERR_PTR(-ECOMM);
+ 	}
+ 
+ retry:
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index 980168a567071..7ed6fb407a689 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -914,7 +914,7 @@ void hfi1_send_rc_ack(struct hfi1_packet *packet, bool is_fecn)
+ 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps,
+ 			 sc_to_vlt(ppd->dd, sc5), plen);
+ 	pbuf = sc_buffer_alloc(rcd->sc, plen, NULL, NULL);
+-	if (!pbuf) {
++	if (IS_ERR_OR_NULL(pbuf)) {
+ 		/*
+ 		 * We have no room to send at the moment.  Pass
+ 		 * responsibility for sending the ACK to the send engine
+diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
+index ef5b3ffd3888b..839593641e3fd 100644
+--- a/drivers/infiniband/hw/hfi1/ud.c
++++ b/drivers/infiniband/hw/hfi1/ud.c
+@@ -703,7 +703,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp,
+ 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
+ 	if (ctxt) {
+ 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
+-		if (pbuf) {
++		if (!IS_ERR_OR_NULL(pbuf)) {
+ 			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
+ 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
+ 						 &hdr, hwords);
+@@ -758,7 +758,7 @@ void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn,
+ 	pbc = create_pbc(ppd, pbc_flags, qp->srate_mbps, vl, plen);
+ 	if (ctxt) {
+ 		pbuf = sc_buffer_alloc(ctxt, plen, NULL, NULL);
+-		if (pbuf) {
++		if (!IS_ERR_OR_NULL(pbuf)) {
+ 			trace_pio_output_ibhdr(ppd->dd, &hdr, sc5);
+ 			ppd->dd->pio_inline_send(ppd->dd, pbuf, pbc,
+ 						 &hdr, hwords);
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 4e7b3c027901b..90e12f9433a39 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1096,10 +1096,10 @@ int hfi1_verbs_send_pio(struct rvt_qp *qp, struct hfi1_pkt_state *ps,
+ 	if (cb)
+ 		iowait_pio_inc(&priv->s_iowait);
+ 	pbuf = sc_buffer_alloc(sc, plen, cb, qp);
+-	if (unlikely(!pbuf)) {
++	if (unlikely(IS_ERR_OR_NULL(pbuf))) {
+ 		if (cb)
+ 			verbs_pio_complete(qp, 0);
+-		if (ppd->host_link_state != HLS_UP_ACTIVE) {
++		if (IS_ERR(pbuf)) {
+ 			/*
+ 			 * If we have filled the PIO buffers to capacity and are
+ 			 * not in an active state this request is not going to
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-iser-fix-dma_nents-type-definition.patch b/queue-4.19/ib-iser-fix-dma_nents-type-definition.patch
new file mode 100644
index 00000000000..9c74951f568
--- /dev/null
+++ b/queue-4.19/ib-iser-fix-dma_nents-type-definition.patch
@@ -0,0 +1,41 @@
+From 95ed9eb900823cdaba3f65853ae67d62ce624870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 12:22:11 +0200
+Subject: IB/iser: Fix dma_nents type definition
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit c1545f1a200f4adc4ef8dd534bf33e2f1aa22c2f ]
+
+The retured value from ib_dma_map_sg saved in dma_nents variable. To avoid
+future mismatch between types, define dma_nents as an integer instead of
+unsigned.
+
+Fixes: 57b26497fabe ("IB/iser: Pass the correct number of entries for dma mapped SGL")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Israel Rukshin <israelr@mellanox.com>
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index 120b408295603..a7aeaa0c6fbc9 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -197,7 +197,7 @@ struct iser_data_buf {
+ 	struct scatterlist *sg;
+ 	int                size;
+ 	unsigned long      data_len;
+-	unsigned int       dma_nents;
++	int                dma_nents;
+ };
+ 
+ /* fwd declarations */
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch b/queue-4.19/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
new file mode 100644
index 00000000000..4adf51df811
--- /dev/null
+++ b/queue-4.19/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
@@ -0,0 +1,61 @@
+From a578456b834bde3c47007e67f562ebc098a2e8b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 15:45:45 +0000
+Subject: IB/iser: Pass the correct number of entries for dma mapped SGL
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ]
+
+ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may
+change the number of entries and the lengths of each entry.
+
+Code that touches dma_address is iterating over the 'dma mapped SGL' and
+must use dma_nents which returned from ib_dma_map_sg().
+
+ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use
+dma_nents.
+
+Fixes: 39405885005a ("IB/iser: Port to new fast registration API")
+Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 009be8889d71d..379bc0dfc3885 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
+ 	page_vec->npages = 0;
+ 	page_vec->fake_mr.page_size = SIZE_4K;
+ 	plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
+-			      mem->size, NULL, iser_set_page);
+-	if (unlikely(plen < mem->size)) {
++			      mem->dma_nents, NULL, iser_set_page);
++	if (unlikely(plen < mem->dma_nents)) {
+ 		iser_err("page vec too short to hold this SG\n");
+ 		iser_data_buf_dump(mem, device->ib_device);
+ 		iser_dump_page_vec(page_vec);
+@@ -451,10 +451,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+ 
+ 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+ 
+-	n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
+-	if (unlikely(n != mem->size)) {
++	n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
++	if (unlikely(n != mem->dma_nents)) {
+ 		iser_err("failed to map sg (%d/%d)\n",
+-			 n, mem->size);
++			 n, mem->dma_nents);
+ 		return n < 0 ? n : -EINVAL;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch b/queue-4.19/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
new file mode 100644
index 00000000000..cfec75f5140
--- /dev/null
+++ b/queue-4.19/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
@@ -0,0 +1,90 @@
+From 1959fe612eab95f54d393ec8981d389b34b6568e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 08:38:30 +0300
+Subject: IB/mlx5: Add missing XRC options to QP optional params mask
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]
+
+The QP transition optional parameters for the various transition for XRC
+QPs are identical to those for RC QPs.
+
+Many of the XRC QP transition optional parameter bits are missing from the
+QP optional mask table.  These omissions caused failures when doing XRC QP
+state transitions.
+
+For example, when trying to change the response timer of an XRC receive QP
+via the RTS2RTS transition, the new timer value was ignored because
+MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
+for XRC qps for the RTS2RTS transition.
+
+Fix this by adding the missing XRC optional parameters for all QP
+transitions to the opt_mask table.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index ef0f710587ad8..4c0f0ce02d2f7 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2598,6 +2598,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX	|
+ 					  MLX5_QP_OPTPAR_Q_KEY		|
+ 					  MLX5_QP_OPTPAR_PRI_PORT,
++			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
++					  MLX5_QP_OPTPAR_RAE		|
++					  MLX5_QP_OPTPAR_RWE		|
++					  MLX5_QP_OPTPAR_PKEY_INDEX	|
++					  MLX5_QP_OPTPAR_PRI_PORT,
+ 		},
+ 		[MLX5_QP_STATE_RTR] = {
+ 			[MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH  |
+@@ -2631,6 +2636,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 					  MLX5_QP_OPTPAR_RWE		|
+ 					  MLX5_QP_OPTPAR_PM_STATE,
+ 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
++			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH	|
++					  MLX5_QP_OPTPAR_RRE		|
++					  MLX5_QP_OPTPAR_RAE		|
++					  MLX5_QP_OPTPAR_RWE		|
++					  MLX5_QP_OPTPAR_PM_STATE	|
++					  MLX5_QP_OPTPAR_RNR_TIMEOUT,
+ 		},
+ 	},
+ 	[MLX5_QP_STATE_RTS] = {
+@@ -2647,6 +2658,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 			[MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY		|
+ 					  MLX5_QP_OPTPAR_SRQN		|
+ 					  MLX5_QP_OPTPAR_CQN_RCV,
++			[MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE		|
++					  MLX5_QP_OPTPAR_RAE		|
++					  MLX5_QP_OPTPAR_RWE		|
++					  MLX5_QP_OPTPAR_RNR_TIMEOUT	|
++					  MLX5_QP_OPTPAR_PM_STATE	|
++					  MLX5_QP_OPTPAR_ALT_ADDR_PATH,
+ 		},
+ 	},
+ 	[MLX5_QP_STATE_SQER] = {
+@@ -2658,6 +2675,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ 					   MLX5_QP_OPTPAR_RWE		|
+ 					   MLX5_QP_OPTPAR_RAE		|
+ 					   MLX5_QP_OPTPAR_RRE,
++			[MLX5_QP_ST_XRC]  = MLX5_QP_OPTPAR_RNR_TIMEOUT	|
++					   MLX5_QP_OPTPAR_RWE		|
++					   MLX5_QP_OPTPAR_RAE		|
++					   MLX5_QP_OPTPAR_RRE,
+ 		},
+ 	},
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-mlx5-don-t-override-existing-ip_protocol.patch b/queue-4.19/ib-mlx5-don-t-override-existing-ip_protocol.patch
new file mode 100644
index 00000000000..93799cc75c4
--- /dev/null
+++ b/queue-4.19/ib-mlx5-don-t-override-existing-ip_protocol.patch
@@ -0,0 +1,132 @@
+From 96caa1fffe3667d4be9ad0a7fb95b6d4888f4803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 20:08:15 +0200
+Subject: IB/mlx5: Don't override existing ip_protocol
+
+From: Maor Gottlieb <maorg@mellanox.com>
+
+[ Upstream commit 6113cc44015b41ca51c0a76fed82522b68108dac ]
+
+Two flow specifications can set the ip protocol field in
+the flow table entry:
+
+1) IB_FLOW_SPEC_TCP/UDP/GRE - set the ip protocol accordingly.
+2) IB_FLOW_SPEC_IPV4/6 - has ip_protocol field for users
+who want to receive specific L4 packets.
+
+We need to avoid overriding of the ip_protocol with zeros,
+in case that the user first put the L4 specification and
+only then the L3.
+
+Fixes: ca0d47538528b ('IB/mlx5: Add support in TOS and protocol to flow steering')
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 53 +++++++++++++++++++++----------
+ 1 file changed, 37 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index df5be462dd281..2db34f7b5ced1 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2390,10 +2390,29 @@ static u8 get_match_criteria_enable(u32 *match_criteria)
+ 	return match_criteria_enable;
+ }
+ 
+-static void set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
++static int set_proto(void *outer_c, void *outer_v, u8 mask, u8 val)
+ {
+-	MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_protocol, mask);
+-	MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
++	u8 entry_mask;
++	u8 entry_val;
++	int err = 0;
++
++	if (!mask)
++		goto out;
++
++	entry_mask = MLX5_GET(fte_match_set_lyr_2_4, outer_c,
++			      ip_protocol);
++	entry_val = MLX5_GET(fte_match_set_lyr_2_4, outer_v,
++			     ip_protocol);
++	if (!entry_mask) {
++		MLX5_SET(fte_match_set_lyr_2_4, outer_c, ip_protocol, mask);
++		MLX5_SET(fte_match_set_lyr_2_4, outer_v, ip_protocol, val);
++		goto out;
++	}
++	/* Don't override existing ip protocol */
++	if (mask != entry_mask || val != entry_val)
++		err = -EINVAL;
++out:
++	return err;
+ }
+ 
+ static void set_flow_label(void *misc_c, void *misc_v, u32 mask, u32 val,
+@@ -2597,8 +2616,10 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ 		set_tos(headers_c, headers_v,
+ 			ib_spec->ipv4.mask.tos, ib_spec->ipv4.val.tos);
+ 
+-		set_proto(headers_c, headers_v,
+-			  ib_spec->ipv4.mask.proto, ib_spec->ipv4.val.proto);
++		if (set_proto(headers_c, headers_v,
++			      ib_spec->ipv4.mask.proto,
++			      ib_spec->ipv4.val.proto))
++			return -EINVAL;
+ 		break;
+ 	case IB_FLOW_SPEC_IPV6:
+ 		if (FIELDS_NOT_SUPPORTED(ib_spec->ipv6.mask, LAST_IPV6_FIELD))
+@@ -2637,9 +2658,10 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ 			ib_spec->ipv6.mask.traffic_class,
+ 			ib_spec->ipv6.val.traffic_class);
+ 
+-		set_proto(headers_c, headers_v,
+-			  ib_spec->ipv6.mask.next_hdr,
+-			  ib_spec->ipv6.val.next_hdr);
++		if (set_proto(headers_c, headers_v,
++			      ib_spec->ipv6.mask.next_hdr,
++			      ib_spec->ipv6.val.next_hdr))
++			return -EINVAL;
+ 
+ 		set_flow_label(misc_params_c, misc_params_v,
+ 			       ntohl(ib_spec->ipv6.mask.flow_label),
+@@ -2660,10 +2682,8 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ 					 LAST_TCP_UDP_FIELD))
+ 			return -EOPNOTSUPP;
+ 
+-		MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
+-			 0xff);
+-		MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
+-			 IPPROTO_TCP);
++		if (set_proto(headers_c, headers_v, 0xff, IPPROTO_TCP))
++			return -EINVAL;
+ 
+ 		MLX5_SET(fte_match_set_lyr_2_4, headers_c, tcp_sport,
+ 			 ntohs(ib_spec->tcp_udp.mask.src_port));
+@@ -2680,10 +2700,8 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ 					 LAST_TCP_UDP_FIELD))
+ 			return -EOPNOTSUPP;
+ 
+-		MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
+-			 0xff);
+-		MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
+-			 IPPROTO_UDP);
++		if (set_proto(headers_c, headers_v, 0xff, IPPROTO_UDP))
++			return -EINVAL;
+ 
+ 		MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport,
+ 			 ntohs(ib_spec->tcp_udp.mask.src_port));
+@@ -2699,6 +2717,9 @@ static int parse_flow_attr(struct mlx5_core_dev *mdev, u32 *match_c,
+ 		if (ib_spec->gre.mask.c_ks_res0_ver)
+ 			return -EOPNOTSUPP;
+ 
++		if (set_proto(headers_c, headers_v, 0xff, IPPROTO_GRE))
++			return -EINVAL;
++
+ 		MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_protocol,
+ 			 0xff);
+ 		MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol,
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch b/queue-4.19/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch
new file mode 100644
index 00000000000..c9eabb23ecd
--- /dev/null
+++ b/queue-4.19/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch
@@ -0,0 +1,75 @@
+From dfb04286ae24c3c3c4cafbc667624bf039c4a2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Dec 2018 15:53:49 +0200
+Subject: IB/rxe: Fix incorrect cache cleanup in error flow
+
+From: Yuval Shaia <yuval.shaia@oracle.com>
+
+[ Upstream commit 6db21d8986e14e2e86573a3b055b05296188bd2c ]
+
+Array iterator stays at the same slot, fix it.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_pool.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
+index b4a8acc7bb7d6..0e2425f282335 100644
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_cache(struct rxe_pool *pool)
+ 	return rxe_type_info[pool->type].cache;
+ }
+ 
++static void rxe_cache_clean(size_t cnt)
++{
++	int i;
++	struct rxe_type_info *type;
++
++	for (i = 0; i < cnt; i++) {
++		type = &rxe_type_info[i];
++		kmem_cache_destroy(type->cache);
++		type->cache = NULL;
++	}
++}
++
+ int rxe_cache_init(void)
+ {
+ 	int err;
+@@ -136,24 +148,14 @@ int rxe_cache_init(void)
+ 	return 0;
+ 
+ err1:
+-	while (--i >= 0) {
+-		kmem_cache_destroy(type->cache);
+-		type->cache = NULL;
+-	}
++	rxe_cache_clean(i);
+ 
+ 	return err;
+ }
+ 
+ void rxe_cache_exit(void)
+ {
+-	int i;
+-	struct rxe_type_info *type;
+-
+-	for (i = 0; i < RXE_NUM_TYPES; i++) {
+-		type = &rxe_type_info[i];
+-		kmem_cache_destroy(type->cache);
+-		type->cache = NULL;
+-	}
++	rxe_cache_clean(RXE_NUM_TYPES);
+ }
+ 
+ static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min)
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-rxe-replace-kvfree-with-vfree.patch b/queue-4.19/ib-rxe-replace-kvfree-with-vfree.patch
new file mode 100644
index 00000000000..7b53e670746
--- /dev/null
+++ b/queue-4.19/ib-rxe-replace-kvfree-with-vfree.patch
@@ -0,0 +1,77 @@
+From f86a413ed8d4545111c99644e7e1dd8e141be5a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 01:57:42 -0400
+Subject: IB/rxe: replace kvfree with vfree
+
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+
+[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ]
+
+The buf is allocated by vmalloc_user in the function rxe_queue_init.
+So it is better to free it by vfree.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index 2ee4b08b00ea4..a57276f2cb849 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -30,7 +30,7 @@
+  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  * SOFTWARE.
+  */
+-
++#include <linux/vmalloc.h>
+ #include "rxe.h"
+ #include "rxe_loc.h"
+ #include "rxe_queue.h"
+@@ -97,7 +97,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ 	err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context,
+ 			   cq->queue->buf, cq->queue->buf_size, &cq->queue->ip);
+ 	if (err) {
+-		kvfree(cq->queue->buf);
++		vfree(cq->queue->buf);
+ 		kfree(cq->queue);
+ 		return err;
+ 	}
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index c58452daffc74..230697fa31fe3 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -34,6 +34,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/delay.h>
+ #include <linux/sched.h>
++#include <linux/vmalloc.h>
+ 
+ #include "rxe.h"
+ #include "rxe_loc.h"
+@@ -247,7 +248,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ 			   &qp->sq.queue->ip);
+ 
+ 	if (err) {
+-		kvfree(qp->sq.queue->buf);
++		vfree(qp->sq.queue->buf);
+ 		kfree(qp->sq.queue);
+ 		return err;
+ 	}
+@@ -300,7 +301,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ 				   qp->rq.queue->buf, qp->rq.queue->buf_size,
+ 				   &qp->rq.queue->ip);
+ 		if (err) {
+-			kvfree(qp->rq.queue->buf);
++			vfree(qp->rq.queue->buf);
+ 			kfree(qp->rq.queue);
+ 			return err;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch b/queue-4.19/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
new file mode 100644
index 00000000000..e5b182768f3
--- /dev/null
+++ b/queue-4.19/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
@@ -0,0 +1,37 @@
+From 7eb3e90a0e00e72c8c9f6f8a42f821bc4b1ef8d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:54 +0200
+Subject: IB/usnic: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index 3db232429630e..e611f133aa97b 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -447,7 +447,7 @@ struct net_device *usnic_get_netdev(struct ib_device *device, u8 port_num)
+ int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+ 				u16 *pkey)
+ {
+-	if (index > 1)
++	if (index > 0)
+ 		return -EINVAL;
+ 
+ 	*pkey = 0xffff;
+-- 
+2.20.1
+
diff --git a/queue-4.19/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch b/queue-4.19/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
new file mode 100644
index 00000000000..32f817558a0
--- /dev/null
+++ b/queue-4.19/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
@@ -0,0 +1,39 @@
+From 084af34c040e0e8efe1e60927bc2d7d6f8d889c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 12:58:46 +0100
+Subject: iio: dac: ad5380: fix incorrect assignment to val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ]
+
+Currently the pointer val is being incorrectly incremented
+instead of the value pointed to by val. Fix this by adding
+in the missing * indirection operator.
+
+Addresses-Coverity: ("Unused value")
+Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/ad5380.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
+index 873c2bf637c0c..617c9f7fe59a1 100644
+--- a/drivers/iio/dac/ad5380.c
++++ b/drivers/iio/dac/ad5380.c
+@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
+ 		if (ret)
+ 			return ret;
+ 		*val >>= chan->scan_type.shift;
+-		val -= (1 << chan->scan_type.realbits) / 2;
++		*val -= (1 << chan->scan_type.realbits) / 2;
+ 		return IIO_VAL_INT;
+ 	case IIO_CHAN_INFO_SCALE:
+ 		*val = 2 * st->vref;
+-- 
+2.20.1
+
diff --git a/queue-4.19/iio-fix-position-relative-kernel-version.patch b/queue-4.19/iio-fix-position-relative-kernel-version.patch
new file mode 100644
index 00000000000..b239eb7f0b7
--- /dev/null
+++ b/queue-4.19/iio-fix-position-relative-kernel-version.patch
@@ -0,0 +1,35 @@
+From e764b7e032a13d2ffdcb985c8ee05b11bad92d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 13:30:34 +0300
+Subject: iio: fix position relative kernel version
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 21eab7861688aa4c69fcb88440cc0c4a422bdcd6 ]
+
+Position relative channel type was added in 4.19 kernel version
+
+Fixes: "3055a6cfa04ba" ("iio: Add channel for Position Relative")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-bus-iio | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
+index a5b4f223641d9..8127a08e366d8 100644
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -199,7 +199,7 @@ Description:
+ 
+ What:		/sys/bus/iio/devices/iio:deviceX/in_positionrelative_x_raw
+ What:		/sys/bus/iio/devices/iio:deviceX/in_positionrelative_y_raw
+-KernelVersion:	4.18
++KernelVersion:	4.19
+ Contact:	linux-iio@vger.kernel.org
+ Description:
+ 		Relative position in direction x or y on a pad (may be
+-- 
+2.20.1
+
diff --git a/queue-4.19/iio-tsl2772-use-devm_add_action_or_reset-for-tsl2772.patch b/queue-4.19/iio-tsl2772-use-devm_add_action_or_reset-for-tsl2772.patch
new file mode 100644
index 00000000000..d510c064363
--- /dev/null
+++ b/queue-4.19/iio-tsl2772-use-devm_add_action_or_reset-for-tsl2772.patch
@@ -0,0 +1,74 @@
+From 288216e6b88399018825ac4a8bec6347f5adff4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 15:36:05 +0800
+Subject: iio: tsl2772: Use devm_add_action_or_reset for tsl2772_chip_off
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 338084135aeddb103624a6841972fb8588295cc6 ]
+
+Use devm_add_action_or_reset to call tsl2772_chip_off
+when the device is removed.
+This also fixes the issue that the chip is turned off
+before the device is unregistered.
+
+Not marked for stable as fairly hard to hit the bug and
+this is in the middle of a set making other cleanups
+to the driver.  Hence will probably need explicit backporting.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Fixes: c06c4d793584 ("staging: iio: tsl2x7x/tsl2772: move out of staging")
+Reviewed-by: Brian Masney <masneyb@onstation.org>
+Tested-by: Brian Masney <masneyb@onstation.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/tsl2772.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/light/tsl2772.c b/drivers/iio/light/tsl2772.c
+index df5b2a0da96c4..f2e308c6d6d7b 100644
+--- a/drivers/iio/light/tsl2772.c
++++ b/drivers/iio/light/tsl2772.c
+@@ -716,6 +716,13 @@ static int tsl2772_chip_off(struct iio_dev *indio_dev)
+ 	return tsl2772_write_control_reg(chip, 0x00);
+ }
+ 
++static void tsl2772_chip_off_action(void *data)
++{
++	struct iio_dev *indio_dev = data;
++
++	tsl2772_chip_off(indio_dev);
++}
++
+ /**
+  * tsl2772_invoke_change - power cycle the device to implement the user
+  *                         parameters
+@@ -1711,9 +1718,14 @@ static int tsl2772_probe(struct i2c_client *clientp,
+ 	if (ret < 0)
+ 		return ret;
+ 
++	ret = devm_add_action_or_reset(&clientp->dev,
++					tsl2772_chip_off_action,
++					indio_dev);
++	if (ret < 0)
++		return ret;
++
+ 	ret = iio_device_register(indio_dev);
+ 	if (ret) {
+-		tsl2772_chip_off(indio_dev);
+ 		dev_err(&clientp->dev,
+ 			"%s: iio registration failed\n", __func__);
+ 		return ret;
+@@ -1740,8 +1752,6 @@ static int tsl2772_remove(struct i2c_client *client)
+ {
+ 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
+ 
+-	tsl2772_chip_off(indio_dev);
+-
+ 	iio_device_unregister(indio_dev);
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/inet-frags-call-inet_frags_fini-after-unregister_per.patch b/queue-4.19/inet-frags-call-inet_frags_fini-after-unregister_per.patch
new file mode 100644
index 00000000000..84cee68d6e9
--- /dev/null
+++ b/queue-4.19/inet-frags-call-inet_frags_fini-after-unregister_per.patch
@@ -0,0 +1,56 @@
+From 6d383e12cd95ea8873b673725eed30642a553a43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 16:56:48 -0700
+Subject: inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]
+
+Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.
+
+inet_frags_fini() is dismantling a kmem_cache, that might be needed
+later when unregister_pernet_subsys() eventually has to remove
+frags queues from hash tables and free them.
+
+This fixes potential use-after-free, and is a prereq for the following patch.
+
+Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ieee802154/6lowpan/reassembly.c | 2 +-
+ net/ipv6/reassembly.c               | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
+index e7857a8ac86db..f3074249c6fc9 100644
+--- a/net/ieee802154/6lowpan/reassembly.c
++++ b/net/ieee802154/6lowpan/reassembly.c
+@@ -629,7 +629,7 @@ err_sysctl:
+ 
+ void lowpan_net_frag_exit(void)
+ {
+-	inet_frags_fini(&lowpan_frags);
+ 	lowpan_frags_sysctl_unregister();
+ 	unregister_pernet_subsys(&lowpan_frags_ops);
++	inet_frags_fini(&lowpan_frags);
+ }
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index 095825f964e28..c6132e39ab16b 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -593,8 +593,8 @@ err_protocol:
+ 
+ void ipv6_frag_exit(void)
+ {
+-	inet_frags_fini(&ip6_frags);
+ 	ip6_frags_sysctl_unregister();
+ 	unregister_pernet_subsys(&ip6_frags_ops);
+ 	inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
++	inet_frags_fini(&ip6_frags);
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch b/queue-4.19/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
new file mode 100644
index 00000000000..ef8383110e1
--- /dev/null
+++ b/queue-4.19/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
@@ -0,0 +1,35 @@
+From 4d74d67b65561d0db11d84b3020da00340944daa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:38:30 -0800
+Subject: Input: nomadik-ske-keypad - fix a loop timeout test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]
+
+The loop exits with "timeout" set to -1 not to 0.
+
+Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
+index 8567ee47761e1..ae3b045570740 100644
+--- a/drivers/input/keyboard/nomadik-ske-keypad.c
++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
+@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
+ 	while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
+ 		cpu_relax();
+ 
+-	if (!timeout)
++	if (timeout == -1)
+ 		return -EINVAL;
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-add-missing-new-line-for-dma-type.patch b/queue-4.19/iommu-add-missing-new-line-for-dma-type.patch
new file mode 100644
index 00000000000..747570321d5
--- /dev/null
+++ b/queue-4.19/iommu-add-missing-new-line-for-dma-type.patch
@@ -0,0 +1,35 @@
+From c450d2a43de626fc7ec07b411c1dacfd928758e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2019 14:30:56 +0800
+Subject: iommu: Add missing new line for dma type
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 24f307d8abf79486dd3c1b645037df7d91602aaa ]
+
+So that all types are printed in the same format.
+
+Fixes: c52c72d3dee81 ("iommu: Add sysfs attribyte for domain type")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index ee25ec22778ef..b82bec4224b91 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -317,7 +317,7 @@ static ssize_t iommu_group_show_type(struct iommu_group *group,
+ 			type = "unmanaged\n";
+ 			break;
+ 		case IOMMU_DOMAIN_DMA:
+-			type = "DMA";
++			type = "DMA\n";
+ 			break;
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-amd-make-iommu_disable-safer.patch b/queue-4.19/iommu-amd-make-iommu_disable-safer.patch
new file mode 100644
index 00000000000..bb97b581a07
--- /dev/null
+++ b/queue-4.19/iommu-amd-make-iommu_disable-safer.patch
@@ -0,0 +1,40 @@
+From 385df67e9aae24c7e716f444025dae6ffad5f7ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 14:52:03 -0700
+Subject: iommu/amd: Make iommu_disable safer
+
+From: Kevin Mitchell <kevmitch@arista.com>
+
+[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ]
+
+Make it safe to call iommu_disable during early init error conditions
+before mmio_base is set, but after the struct amd_iommu has been added
+to the amd_iommu_list. For example, this happens if firmware fails to
+fill in mmio_phys in the ACPI table leading to a NULL pointer
+dereference in iommu_feature_disable.
+
+Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 1e9a5da562f0d..465f28a7844c2 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -422,6 +422,9 @@ static void iommu_enable(struct amd_iommu *iommu)
+ 
+ static void iommu_disable(struct amd_iommu *iommu)
+ {
++	if (!iommu->mmio_base)
++		return;
++
+ 	/* Disable command buffer */
+ 	iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch b/queue-4.19/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
new file mode 100644
index 00000000000..605638adfef
--- /dev/null
+++ b/queue-4.19/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
@@ -0,0 +1,37 @@
+From 49a585729f01f19a1f4ed6ca2e252a55a63f5269 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 19:49:21 +0200
+Subject: iommu/amd: Wait for completion of IOTLB flush in attach_device
+
+From: Filippo Sironi <sironi@amazon.de>
+
+[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ]
+
+To make sure the domain tlb flush completes before the
+function returns, explicitly wait for its completion.
+
+Signed-off-by: Filippo Sironi <sironi@amazon.de>
+Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device")
+[joro: Added commit message and fixes tag]
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 9991386fb7000..bea19aa337587 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2153,6 +2153,8 @@ skip_ats_check:
+ 	 */
+ 	domain_flush_tlb_pde(domain);
+ 
++	domain_flush_complete(domain);
++
+ 	return ret;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-fix-iommu-debugfs-fallout.patch b/queue-4.19/iommu-fix-iommu-debugfs-fallout.patch
new file mode 100644
index 00000000000..1027b2125fd
--- /dev/null
+++ b/queue-4.19/iommu-fix-iommu-debugfs-fallout.patch
@@ -0,0 +1,74 @@
+From 739387da1c5fddb19601f57933ee102d533865e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 14:05:05 +0100
+Subject: iommu: Fix IOMMU debugfs fallout
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 18b3af4492a0aa6046b86d712f6ba4cbb66100fb ]
+
+A change made in the final version of IOMMU debugfs support replaced the
+public function iommu_debugfs_new_driver_dir() by the public dentry
+iommu_debugfs_dir in <linux/iommu.h>, but forgot to update both the
+implementation in iommu-debugfs.c, and the patch description.
+
+Fix this by exporting iommu_debugfs_dir, and removing the reference to
+and implementation of iommu_debugfs_new_driver_dir().
+
+Fixes: bad614b24293ae46 ("iommu: Enable debugfs exposure of IOMMU driver internals")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu-debugfs.c | 23 ++++-------------------
+ 1 file changed, 4 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/iommu/iommu-debugfs.c b/drivers/iommu/iommu-debugfs.c
+index 3b1bf88fd1b04..f035489420964 100644
+--- a/drivers/iommu/iommu-debugfs.c
++++ b/drivers/iommu/iommu-debugfs.c
+@@ -12,6 +12,7 @@
+ #include <linux/debugfs.h>
+ 
+ struct dentry *iommu_debugfs_dir;
++EXPORT_SYMBOL_GPL(iommu_debugfs_dir);
+ 
+ /**
+  * iommu_debugfs_setup - create the top-level iommu directory in debugfs
+@@ -23,9 +24,9 @@ struct dentry *iommu_debugfs_dir;
+  * Emit a strong warning at boot time to indicate that this feature is
+  * enabled.
+  *
+- * This function is called from iommu_init; drivers may then call
+- * iommu_debugfs_new_driver_dir() to instantiate a vendor-specific
+- * directory to be used to expose internal data.
++ * This function is called from iommu_init; drivers may then use
++ * iommu_debugfs_dir to instantiate a vendor-specific directory to be used
++ * to expose internal data.
+  */
+ void iommu_debugfs_setup(void)
+ {
+@@ -48,19 +49,3 @@ void iommu_debugfs_setup(void)
+ 		pr_warn("*************************************************************\n");
+ 	}
+ }
+-
+-/**
+- * iommu_debugfs_new_driver_dir - create a vendor directory under debugfs/iommu
+- * @vendor: name of the vendor-specific subdirectory to create
+- *
+- * This function is called by an IOMMU driver to create the top-level debugfs
+- * directory for that driver.
+- *
+- * Return: upon success, a pointer to the dentry for the new directory.
+- *         NULL in case of failure.
+- */
+-struct dentry *iommu_debugfs_new_driver_dir(const char *vendor)
+-{
+-	return debugfs_create_dir(vendor, iommu_debugfs_dir);
+-}
+-EXPORT_SYMBOL_GPL(iommu_debugfs_new_driver_dir);
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch b/queue-4.19/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch
new file mode 100644
index 00000000000..f773ad73cf8
--- /dev/null
+++ b/queue-4.19/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch
@@ -0,0 +1,96 @@
+From e89af5072aa4c422132d2a532038948fefd42718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Aug 2019 11:01:50 +0800
+Subject: iommu/mediatek: Fix iova_to_phys PA start for 4GB mode
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 76ce65464fcd2c21db84391572b7938b716aceb0 ]
+
+In M4U 4GB mode, the physical address is remapped as below:
+
+CPU Physical address:
+
+====================
+
+0      1G       2G     3G       4G     5G
+|---A---|---B---|---C---|---D---|---E---|
++--I/O--+------------Memory-------------+
+
+IOMMU output physical address:
+ =============================
+
+                                4G      5G     6G      7G      8G
+                                |---E---|---B---|---C---|---D---|
+                                +------------Memory-------------+
+
+The Region 'A'(I/O) can not be mapped by M4U; For Region 'B'/'C'/'D', the
+bit32 of the CPU physical address always is needed to set, and for Region
+'E', the CPU physical address keep as is. something looks like this:
+CPU PA         ->    M4U OUTPUT PA
+0x4000_0000          0x1_4000_0000 (Add bit32)
+0x8000_0000          0x1_8000_0000 ...
+0xc000_0000          0x1_c000_0000 ...
+0x1_0000_0000        0x1_0000_0000 (No change)
+
+Additionally, the iommu consumers always use the CPU phyiscal address.
+
+The PA in the iova_to_phys that is got from v7s always is u32, But
+from the CPU point of view, PA only need add BIT(32) when PA < 0x4000_0000.
+
+Fixes: 30e2fccf9512 ("iommu/mediatek: Enlarge the validate PA range
+for 4GB mode")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 154cf44439cb6..8e75f34ac8868 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -115,6 +115,30 @@ struct mtk_iommu_domain {
+ 
+ static struct iommu_ops mtk_iommu_ops;
+ 
++/*
++ * In M4U 4GB mode, the physical address is remapped as below:
++ *
++ * CPU Physical address:
++ * ====================
++ *
++ * 0      1G       2G     3G       4G     5G
++ * |---A---|---B---|---C---|---D---|---E---|
++ * +--I/O--+------------Memory-------------+
++ *
++ * IOMMU output physical address:
++ *  =============================
++ *
++ *                                 4G      5G     6G      7G      8G
++ *                                 |---E---|---B---|---C---|---D---|
++ *                                 +------------Memory-------------+
++ *
++ * The Region 'A'(I/O) can NOT be mapped by M4U; For Region 'B'/'C'/'D', the
++ * bit32 of the CPU physical address always is needed to set, and for Region
++ * 'E', the CPU physical address keep as is.
++ * Additionally, The iommu consumers always use the CPU phyiscal address.
++ */
++#define MTK_IOMMU_4GB_MODE_REMAP_BASE	 0x40000000
++
+ static LIST_HEAD(m4ulist);	/* List all the M4U HWs */
+ 
+ #define for_each_m4u(data)	list_for_each_entry(data, &m4ulist, list)
+@@ -409,7 +433,7 @@ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain,
+ 	pa = dom->iop->iova_to_phys(dom->iop, iova);
+ 	spin_unlock_irqrestore(&dom->pgtlock, flags);
+ 
+-	if (data->enable_4GB)
++	if (data->enable_4GB && pa < MTK_IOMMU_4GB_MODE_REMAP_BASE)
+ 		pa |= BIT_ULL(32);
+ 
+ 	return pa;
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-use-right-function-to-get-group-for-device.patch b/queue-4.19/iommu-use-right-function-to-get-group-for-device.patch
new file mode 100644
index 00000000000..c0dde01d536
--- /dev/null
+++ b/queue-4.19/iommu-use-right-function-to-get-group-for-device.patch
@@ -0,0 +1,42 @@
+From 4d1a6eb3f4eb7d58bd0d315d244adca0ed15b132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 15:27:35 +0800
+Subject: iommu: Use right function to get group for device
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ]
+
+The iommu_group_get_for_dev() will allocate a group for a
+device if it isn't in any group. This isn't the use case
+in iommu_request_dm_for_dev(). Let's use iommu_group_get()
+instead.
+
+Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index b82bec4224b91..00e1c908cd8e7 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -1900,9 +1900,9 @@ int iommu_request_dm_for_dev(struct device *dev)
+ 	int ret;
+ 
+ 	/* Device must already be in a group before calling this function */
+-	group = iommu_group_get_for_dev(dev);
+-	if (IS_ERR(group))
+-		return PTR_ERR(group);
++	group = iommu_group_get(dev);
++	if (!group)
++		return -EINVAL;
+ 
+ 	mutex_lock(&group->mutex);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch b/queue-4.19/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch
new file mode 100644
index 00000000000..1d149200a27
--- /dev/null
+++ b/queue-4.19/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch
@@ -0,0 +1,135 @@
+From ce037a303c145ea3a8d1aae4d071abb514e117ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2019 08:53:31 +0200
+Subject: iommu/vt-d: Duplicate iommu_resv_region objects per device list
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 5f64ce5411b467f1cfea6c63e2494c22b773582b ]
+
+intel_iommu_get_resv_regions() aims to return the list of
+reserved regions accessible by a given @device. However several
+devices can access the same reserved memory region and when
+building the list it is not safe to use a single iommu_resv_region
+object, whose container is the RMRR. This iommu_resv_region must
+be duplicated per device reserved region list.
+
+Let's remove the struct iommu_resv_region from the RMRR unit
+and allocate the iommu_resv_region directly in
+intel_iommu_get_resv_regions(). We hold the dmar_global_lock instead
+of the rcu-lock to allow sleeping.
+
+Fixes: 0659b8dc45a6 ("iommu/vt-d: Implement reserved region get/put callbacks")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index abbbc614c5225..9df3b84412274 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -387,7 +387,6 @@ struct dmar_rmrr_unit {
+ 	u64	end_address;		/* reserved end address */
+ 	struct dmar_dev_scope *devices;	/* target devices */
+ 	int	devices_cnt;		/* target device count */
+-	struct iommu_resv_region *resv; /* reserved region handle */
+ };
+ 
+ struct dmar_atsr_unit {
+@@ -4185,7 +4184,6 @@ static inline void init_iommu_pm_ops(void) {}
+ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ {
+ 	struct acpi_dmar_reserved_memory *rmrr;
+-	int prot = DMA_PTE_READ|DMA_PTE_WRITE;
+ 	struct dmar_rmrr_unit *rmrru;
+ 	size_t length;
+ 
+@@ -4199,22 +4197,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ 	rmrru->end_address = rmrr->end_address;
+ 
+ 	length = rmrr->end_address - rmrr->base_address + 1;
+-	rmrru->resv = iommu_alloc_resv_region(rmrr->base_address, length, prot,
+-					      IOMMU_RESV_DIRECT);
+-	if (!rmrru->resv)
+-		goto free_rmrru;
+ 
+ 	rmrru->devices = dmar_alloc_dev_scope((void *)(rmrr + 1),
+ 				((void *)rmrr) + rmrr->header.length,
+ 				&rmrru->devices_cnt);
+ 	if (rmrru->devices_cnt && rmrru->devices == NULL)
+-		goto free_all;
++		goto free_rmrru;
+ 
+ 	list_add(&rmrru->list, &dmar_rmrr_units);
+ 
+ 	return 0;
+-free_all:
+-	kfree(rmrru->resv);
+ free_rmrru:
+ 	kfree(rmrru);
+ out:
+@@ -4432,7 +4424,6 @@ static void intel_iommu_free_dmars(void)
+ 	list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
+ 		list_del(&rmrru->list);
+ 		dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
+-		kfree(rmrru->resv);
+ 		kfree(rmrru);
+ 	}
+ 
+@@ -5206,22 +5197,33 @@ static void intel_iommu_remove_device(struct device *dev)
+ static void intel_iommu_get_resv_regions(struct device *device,
+ 					 struct list_head *head)
+ {
++	int prot = DMA_PTE_READ | DMA_PTE_WRITE;
+ 	struct iommu_resv_region *reg;
+ 	struct dmar_rmrr_unit *rmrr;
+ 	struct device *i_dev;
+ 	int i;
+ 
+-	rcu_read_lock();
++	down_read(&dmar_global_lock);
+ 	for_each_rmrr_units(rmrr) {
+ 		for_each_active_dev_scope(rmrr->devices, rmrr->devices_cnt,
+ 					  i, i_dev) {
++			struct iommu_resv_region *resv;
++			size_t length;
++
+ 			if (i_dev != device)
+ 				continue;
+ 
+-			list_add_tail(&rmrr->resv->list, head);
++			length = rmrr->end_address - rmrr->base_address + 1;
++			resv = iommu_alloc_resv_region(rmrr->base_address,
++						       length, prot,
++						       IOMMU_RESV_DIRECT);
++			if (!resv)
++				break;
++
++			list_add_tail(&resv->list, head);
+ 		}
+ 	}
+-	rcu_read_unlock();
++	up_read(&dmar_global_lock);
+ 
+ 	reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
+ 				      IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
+@@ -5236,10 +5238,8 @@ static void intel_iommu_put_resv_regions(struct device *dev,
+ {
+ 	struct iommu_resv_region *entry, *next;
+ 
+-	list_for_each_entry_safe(entry, next, head, list) {
+-		if (entry->type == IOMMU_RESV_MSI)
+-			kfree(entry);
+-	}
++	list_for_each_entry_safe(entry, next, head, list)
++		kfree(entry);
+ }
+ 
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-vt-d-fix-null-pointer-reference-in-intel_svm_b.patch b/queue-4.19/iommu-vt-d-fix-null-pointer-reference-in-intel_svm_b.patch
new file mode 100644
index 00000000000..a0f416a9149
--- /dev/null
+++ b/queue-4.19/iommu-vt-d-fix-null-pointer-reference-in-intel_svm_b.patch
@@ -0,0 +1,43 @@
+From db3480bc01343d920128520b4f7f6baef51d82ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 11:23:12 +0800
+Subject: iommu/vt-d: Fix NULL pointer reference in intel_svm_bind_mm()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit c56cba5daf45d2d091ef1cfe2f1d6a930446687b ]
+
+Intel IOMMU could be turned off with intel_iommu=off. If Intel
+IOMMU is off,  the intel_iommu struct will not be initialized.
+When device drivers call intel_svm_bind_mm(), the NULL pointer
+reference will happen there.
+
+Add dmar_disabled check to avoid NULL pointer reference.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Fixes: 2f26e0a9c9860 ("iommu/vt-d: Add basic SVM PASID support")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index 188f4eaed6e59..fd8730b2cd46e 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -293,7 +293,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
+ 	int pasid_max;
+ 	int ret;
+ 
+-	if (!iommu)
++	if (!iommu || dmar_disabled)
+ 		return -EINVAL;
+ 
+ 	if (dev_is_pci(dev)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch b/queue-4.19/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
new file mode 100644
index 00000000000..a28d1ebb8d3
--- /dev/null
+++ b/queue-4.19/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
@@ -0,0 +1,49 @@
+From 40c05b4c466c1fd2caa4528eab616a33e155f0ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used.  This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b9af2419006f8..abbbc614c5225 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3387,9 +3387,12 @@ static int __init init_dmars(void)
+ 		iommu_identity_mapping |= IDENTMAP_ALL;
+ 
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+-	iommu_identity_mapping |= IDENTMAP_GFX;
++	dmar_map_gfx = 0;
+ #endif
+ 
++	if (!dmar_map_gfx)
++		iommu_identity_mapping |= IDENTMAP_GFX;
++
+ 	check_tylersburg_isoch();
+ 
+ 	if (iommu_identity_mapping) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/ip6_fib-don-t-discard-nodes-with-valid-routing-infor.patch b/queue-4.19/ip6_fib-don-t-discard-nodes-with-valid-routing-infor.patch
new file mode 100644
index 00000000000..667beb6dc64
--- /dev/null
+++ b/queue-4.19/ip6_fib-don-t-discard-nodes-with-valid-routing-infor.patch
@@ -0,0 +1,63 @@
+From dd151623ffaa49c252659a051d1f43442403ba7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 17:45:28 +0200
+Subject: ip6_fib: Don't discard nodes with valid routing information in
+ fib6_locate_1()
+
+From: Stefano Brivio <sbrivio@redhat.com>
+
+[ Upstream commit 40cb35d5dc04e7f89cbc7b1fc9b4b48d9f1e5343 ]
+
+When we perform an inexact match on FIB nodes via fib6_locate_1(), longer
+prefixes will be preferred to shorter ones. However, it might happen that
+a node, with higher fn_bit value than some other, has no valid routing
+information.
+
+In this case, we'll pick that node, but it will be discarded by the check
+on RTN_RTINFO in fib6_locate(), and we might miss nodes with valid routing
+information but with lower fn_bit value.
+
+This is apparent when a routing exception is created for a default route:
+ # ip -6 route list
+ fc00:1::/64 dev veth_A-R1 proto kernel metric 256 pref medium
+ fc00:2::/64 dev veth_A-R2 proto kernel metric 256 pref medium
+ fc00:4::1 via fc00:2::2 dev veth_A-R2 metric 1024 pref medium
+ fe80::/64 dev veth_A-R1 proto kernel metric 256 pref medium
+ fe80::/64 dev veth_A-R2 proto kernel metric 256 pref medium
+ default via fc00:1::2 dev veth_A-R1 metric 1024 pref medium
+ # ip -6 route list cache
+ fc00:4::1 via fc00:2::2 dev veth_A-R2 metric 1024 expires 593sec mtu 1500 pref medium
+ fc00:3::1 via fc00:1::2 dev veth_A-R1 metric 1024 expires 593sec mtu 1500 pref medium
+ # ip -6 route flush cache    # node for default route is discarded
+ Failed to send flush request: No such process
+ # ip -6 route list cache
+ fc00:3::1 via fc00:1::2 dev veth_A-R1 metric 1024 expires 586sec mtu 1500 pref medium
+
+Check right away if the node has a RTN_RTINFO flag, before replacing the
+'prev' pointer, that indicates the longest matching prefix found so far.
+
+Fixes: 38fbeeeeccdb ("ipv6: prepare fib6_locate() for exception table")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_fib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index bbb5ffb3397d8..7091568b9f630 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1529,7 +1529,8 @@ static struct fib6_node *fib6_locate_1(struct fib6_node *root,
+ 		if (plen == fn->fn_bit)
+ 			return fn;
+ 
+-		prev = fn;
++		if (fn->fn_flags & RTN_RTINFO)
++			prev = fn;
+ 
+ next:
+ 		/*
+-- 
+2.20.1
+
diff --git a/queue-4.19/ip6erspan-remove-the-incorrect-mtu-limit-for-ip6ersp.patch b/queue-4.19/ip6erspan-remove-the-incorrect-mtu-limit-for-ip6ersp.patch
new file mode 100644
index 00000000000..c7a9a272fc6
--- /dev/null
+++ b/queue-4.19/ip6erspan-remove-the-incorrect-mtu-limit-for-ip6ersp.patch
@@ -0,0 +1,41 @@
+From c4299788db797eca4391c549d0473905d6739e10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 17:56:03 +0800
+Subject: ip6erspan: remove the incorrect mtu limit for ip6erspan
+
+From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+
+[ Upstream commit 4123f637a5129470ff9d3cb00a5a4e213f2e15cc ]
+
+ip6erspan driver calls ether_setup(), after commit 61e84623ace3
+("net: centralize net_device min/max MTU checking"), the range
+of mtu is [min_mtu, max_mtu], which is [68, 1500] by default.
+
+It causes the dev mtu of the erspan device to not be greater
+than 1500, this limit value is not correct for ip6erspan tap
+device.
+
+Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking")
+Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+Acked-by: William Tu <u9012063@gmail.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_gre.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index b3515a4f13039..1f2d0022ba6fd 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2218,6 +2218,7 @@ static void ip6erspan_tap_setup(struct net_device *dev)
+ {
+ 	ether_setup(dev);
+ 
++	dev->max_mtu = 0;
+ 	dev->netdev_ops = &ip6erspan_netdev_ops;
+ 	dev->needs_free_netdev = true;
+ 	dev->priv_destructor = ip6gre_dev_free;
+-- 
+2.20.1
+
diff --git a/queue-4.19/ip_tunnel-fix-route-fl4-init-in-ip_md_tunnel_xmit.patch b/queue-4.19/ip_tunnel-fix-route-fl4-init-in-ip_md_tunnel_xmit.patch
new file mode 100644
index 00000000000..b6eaff7df4c
--- /dev/null
+++ b/queue-4.19/ip_tunnel-fix-route-fl4-init-in-ip_md_tunnel_xmit.patch
@@ -0,0 +1,40 @@
+From 7970c012ddb29576c10ef3e7d2d99bf3e95538a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 18:39:51 +0800
+Subject: ip_tunnel: Fix route fl4 init in ip_md_tunnel_xmit
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit 6e6b904ad4f9aed43ec320afbd5a52ed8461ab41 ]
+
+Init the gre_key from tuninfo->key.tun_id and init the mark
+from the skb->mark, set the oif to zero in the collect metadata
+mode.
+
+Fixes: cfc7381b3002 ("ip_tunnel: add collect_md mode to IPIP tunnel")
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 420e891ac59da..f03a1b68e70f0 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -574,8 +574,9 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto)
+ 		else if (skb->protocol == htons(ETH_P_IPV6))
+ 			tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
+ 	}
+-	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src, 0,
+-			    RT_TOS(tos), tunnel->parms.link, tunnel->fwmark);
++	ip_tunnel_init_flow(&fl4, proto, key->u.ipv4.dst, key->u.ipv4.src,
++			    tunnel_id_to_key32(key->tun_id), RT_TOS(tos),
++			    0, skb->mark);
+ 	if (tunnel->encap.type != TUNNEL_ENCAP_NONE)
+ 		goto tx_error;
+ 	rt = ip_route_output_key(tunnel->net, &fl4);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ipmi-kcs_bmc-handle-devm_kasprintf-failure-case.patch b/queue-4.19/ipmi-kcs_bmc-handle-devm_kasprintf-failure-case.patch
new file mode 100644
index 00000000000..3d25568a62f
--- /dev/null
+++ b/queue-4.19/ipmi-kcs_bmc-handle-devm_kasprintf-failure-case.patch
@@ -0,0 +1,45 @@
+From 4fad439d26d4a0ce962f8964fe678f68f0b1e2df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 16:08:25 +0100
+Subject: ipmi: kcs_bmc: handle devm_kasprintf() failure case
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 42c7c6ef1e6fa5fc0425120f06f045190b1dda2d ]
+
+devm_kasprintf() may return NULL if internal allocation failed so this
+assignment is not safe. Moved the error exit path and added the !NULL
+which then allows the devres manager to take care of cleanup.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: cd2315d471f4 ("ipmi: kcs_bmc: don't change device name")
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Reviewed-by: Haiyue Wang <haiyue.wang@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/kcs_bmc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/ipmi/kcs_bmc.c b/drivers/char/ipmi/kcs_bmc.c
+index e6124bd548df2..ed4dc3b1843e3 100644
+--- a/drivers/char/ipmi/kcs_bmc.c
++++ b/drivers/char/ipmi/kcs_bmc.c
+@@ -440,12 +440,13 @@ struct kcs_bmc *kcs_bmc_alloc(struct device *dev, int sizeof_priv, u32 channel)
+ 	kcs_bmc->data_in = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
+ 	kcs_bmc->data_out = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
+ 	kcs_bmc->kbuffer = devm_kmalloc(dev, KCS_MSG_BUFSIZ, GFP_KERNEL);
+-	if (!kcs_bmc->data_in || !kcs_bmc->data_out || !kcs_bmc->kbuffer)
+-		return NULL;
+ 
+ 	kcs_bmc->miscdev.minor = MISC_DYNAMIC_MINOR;
+ 	kcs_bmc->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "%s%u",
+ 					       DEVICE_NAME, channel);
++	if (!kcs_bmc->data_in || !kcs_bmc->data_out || !kcs_bmc->kbuffer ||
++	    !kcs_bmc->miscdev.name)
++		return NULL;
+ 	kcs_bmc->miscdev.fops = &kcs_bmc_fops;
+ 
+ 	return kcs_bmc;
+-- 
+2.20.1
+
diff --git a/queue-4.19/ipv6-add-missing-tx-timestamping-on-ipproto_raw.patch b/queue-4.19/ipv6-add-missing-tx-timestamping-on-ipproto_raw.patch
new file mode 100644
index 00000000000..569b38450ea
--- /dev/null
+++ b/queue-4.19/ipv6-add-missing-tx-timestamping-on-ipproto_raw.patch
@@ -0,0 +1,40 @@
+From 96c72110760561fd9c56d3ce58810512aaa10629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 12:23:59 -0500
+Subject: ipv6: add missing tx timestamping on IPPROTO_RAW
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit fbfb2321e950918b430e7225546296b2dcadf725 ]
+
+Raw sockets support tx timestamping, but one case is missing.
+
+IPPROTO_RAW takes a separate packet construction path. raw_send_hdrinc
+has an explicit call to sock_tx_timestamp, but rawv6_send_hdrinc does
+not. Add it.
+
+Fixes: 11878b40ed5c ("net-timestamp: SOCK_RAW and PING timestamping")
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 4856d9320b28e..a41156a00dd44 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -660,6 +660,8 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length,
+ 
+ 	skb->ip_summed = CHECKSUM_NONE;
+ 
++	sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags);
++
+ 	if (flags & MSG_CONFIRM)
+ 		skb_set_dst_pending_confirm(skb, 1);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch b/queue-4.19/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch
new file mode 100644
index 00000000000..efa883aa41e
--- /dev/null
+++ b/queue-4.19/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch
@@ -0,0 +1,81 @@
+From c0d72d3ea72c4b867f5727bf5855ebf1884fd8cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 22:01:03 +0800
+Subject: irqchip/gic-v3-its: fix some definitions of inner cacheability
+ attributes
+
+From: Hongbo Yao <yaohongbo@huawei.com>
+
+[ Upstream commit 0f29456d08042134aff6e562d07a6365c841c4ad ]
+
+Some definitions of Inner Cacheability attibutes need to be corrected.
+
+Fixes: 8c828a535e29f ("irqchip/gicv3-its: Restore all cacheability attributes")
+Signed-off-by: Hongbo Yao <yaohongbo@huawei.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/irqchip/arm-gic-v3.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 3188c0bef3e79..1d21e98d68549 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -165,7 +165,7 @@
+ #define GICR_PROPBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nCnB)
+ #define GICR_PROPBASER_nC 	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nC)
+ #define GICR_PROPBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
+-#define GICR_PROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
++#define GICR_PROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWb)
+ #define GICR_PROPBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWt)
+ #define GICR_PROPBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWb)
+ #define GICR_PROPBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWaWt)
+@@ -192,7 +192,7 @@
+ #define GICR_PENDBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nCnB)
+ #define GICR_PENDBASER_nC 	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nC)
+ #define GICR_PENDBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
+-#define GICR_PENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
++#define GICR_PENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWb)
+ #define GICR_PENDBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWt)
+ #define GICR_PENDBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWb)
+ #define GICR_PENDBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWaWt)
+@@ -251,7 +251,7 @@
+ #define GICR_VPROPBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nCnB)
+ #define GICR_VPROPBASER_nC 	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nC)
+ #define GICR_VPROPBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
+-#define GICR_VPROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
++#define GICR_VPROPBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWb)
+ #define GICR_VPROPBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWt)
+ #define GICR_VPROPBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWb)
+ #define GICR_VPROPBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWaWt)
+@@ -277,7 +277,7 @@
+ #define GICR_VPENDBASER_nCnB	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nCnB)
+ #define GICR_VPENDBASER_nC 	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nC)
+ #define GICR_VPENDBASER_RaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
+-#define GICR_VPENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
++#define GICR_VPENDBASER_RaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWb)
+ #define GICR_VPENDBASER_WaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWt)
+ #define GICR_VPENDBASER_WaWb	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWb)
+ #define GICR_VPENDBASER_RaWaWt	GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWaWt)
+@@ -351,7 +351,7 @@
+ #define GITS_CBASER_nCnB	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nCnB)
+ #define GITS_CBASER_nC		GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nC)
+ #define GITS_CBASER_RaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
+-#define GITS_CBASER_RaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
++#define GITS_CBASER_RaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWb)
+ #define GITS_CBASER_WaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWt)
+ #define GITS_CBASER_WaWb	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWb)
+ #define GITS_CBASER_RaWaWt	GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWaWt)
+@@ -375,7 +375,7 @@
+ #define GITS_BASER_nCnB		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nCnB)
+ #define GITS_BASER_nC		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nC)
+ #define GITS_BASER_RaWt		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
+-#define GITS_BASER_RaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
++#define GITS_BASER_RaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWb)
+ #define GITS_BASER_WaWt		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWt)
+ #define GITS_BASER_WaWb		GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWb)
+ #define GITS_BASER_RaWaWt	GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWaWt)
+-- 
+2.20.1
+
diff --git a/queue-4.19/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch b/queue-4.19/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch
new file mode 100644
index 00000000000..359e11e3ca7
--- /dev/null
+++ b/queue-4.19/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch
@@ -0,0 +1,61 @@
+From 33ab6b8e343102273f66e7268b2f9a25b24bcff8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2019 23:14:56 +0000
+Subject: irqdomain: Add the missing assignment of domain->fwnode for named
+ fwnode
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 711419e504ebd68c8f03656616829c8ad7829389 ]
+
+Recently device pass-through stops working for Linux VM running on Hyper-V.
+
+git-bisect shows the regression is caused by the recent commit
+467a3bb97432 ("PCI: hv: Allocate a named fwnode ..."), but the root cause
+is that the commit d59f6617eef0 forgets to set the domain->fwnode for
+IRQCHIP_FWNODE_NAMED*, and as a result:
+
+1. The domain->fwnode remains to be NULL.
+
+2. irq_find_matching_fwspec() returns NULL since "h->fwnode == fwnode" is
+false, and pci_set_bus_msi_domain() sets the Hyper-V PCI root bus's
+msi_domain to NULL.
+
+3. When the device is added onto the root bus, the device's dev->msi_domain
+is set to NULL in pci_set_msi_domain().
+
+4. When a device driver tries to enable MSI-X, pci_msi_setup_msi_irqs()
+calls arch_setup_msi_irqs(), which uses the native MSI chip (i.e.
+arch/x86/kernel/apic/msi.c: pci_msi_controller) to set up the irqs, but
+actually pci_msi_setup_msi_irqs() is supposed to call
+msi_domain_alloc_irqs() with the hbus->irq_domain, which is created in
+hv_pcie_init_irq_domain() and is associated with the Hyper-V chip
+hv_msi_irq_chip. Consequently, the irq line is not properly set up, and
+the device driver can not receive any interrupt.
+
+Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only")
+Fixes: 467a3bb97432 ("PCI: hv: Allocate a named fwnode instead of an address-based one")
+Reported-by: Lili Deng <v-lide@microsoft.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/PU1P153MB01694D9AF625AC335C600C5FBFBE0@PU1P153MB0169.APCP153.PROD.OUTLOOK.COM
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irqdomain.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 0b90be3607249..6e8520a81dd86 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -148,6 +148,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
+ 		switch (fwid->type) {
+ 		case IRQCHIP_FWNODE_NAMED:
+ 		case IRQCHIP_FWNODE_NAMED_ID:
++			domain->fwnode = fwnode;
+ 			domain->name = kstrdup(fwid->name, GFP_KERNEL);
+ 			if (!domain->name) {
+ 				kfree(domain);
+-- 
+2.20.1
+
diff --git a/queue-4.19/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch b/queue-4.19/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
new file mode 100644
index 00000000000..9f2d748bb44
--- /dev/null
+++ b/queue-4.19/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
@@ -0,0 +1,46 @@
+From 87ea8e004107963110d5bbdff792c85fbad9653a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 12:44:53 -0800
+Subject: iw_cxgb4: use tos when finding ipv6 routes
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ]
+
+When IPv6 support was added, the correct tos was not passed to
+cxgb_find_route6(). This potentially results in the wrong route entry.
+
+Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 3c8b7eae918c5..16145b0a14583 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2166,7 +2166,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
+ 					   laddr6->sin6_addr.s6_addr,
+ 					   raddr6->sin6_addr.s6_addr,
+ 					   laddr6->sin6_port,
+-					   raddr6->sin6_port, 0,
++					   raddr6->sin6_port,
++					   ep->com.cm_id->tos,
+ 					   raddr6->sin6_scope_id);
+ 		iptype = 6;
+ 		ra = (__u8 *)&raddr6->sin6_addr;
+@@ -3326,7 +3327,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ 					   laddr6->sin6_addr.s6_addr,
+ 					   raddr6->sin6_addr.s6_addr,
+ 					   laddr6->sin6_port,
+-					   raddr6->sin6_port, 0,
++					   raddr6->sin6_port, cm_id->tos,
+ 					   raddr6->sin6_scope_id);
+ 	}
+ 	if (!ep->dst) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/iw_cxgb4-use-tos-when-importing-the-endpoint.patch b/queue-4.19/iw_cxgb4-use-tos-when-importing-the-endpoint.patch
new file mode 100644
index 00000000000..fe15d5ca7cc
--- /dev/null
+++ b/queue-4.19/iw_cxgb4-use-tos-when-importing-the-endpoint.patch
@@ -0,0 +1,35 @@
+From d7a6d24e5036726c20014c46d1744731163afb50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 12:44:41 -0800
+Subject: iw_cxgb4: use tos when importing the endpoint
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ]
+
+import_ep() is passed the correct tos, but doesn't use it correctly.
+
+Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 1b3d014fa1d6e..3c8b7eae918c5 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2076,7 +2076,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
+ 	} else {
+ 		pdev = get_real_dev(n->dev);
+ 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
+-					n, pdev, 0);
++					n, pdev, rt_tos2priority(tos));
+ 		if (!ep->l2t)
+ 			goto out;
+ 		ep->mtu = dst_mtu(dst);
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-mvm-avoid-possible-access-out-of-array.patch b/queue-4.19/iwlwifi-mvm-avoid-possible-access-out-of-array.patch
new file mode 100644
index 00000000000..e9b1939da75
--- /dev/null
+++ b/queue-4.19/iwlwifi-mvm-avoid-possible-access-out-of-array.patch
@@ -0,0 +1,66 @@
+From 601f3e32a90aeb5eed0856f92b10e8560fdcfd8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Oct 2018 18:27:26 +0300
+Subject: iwlwifi: mvm: avoid possible access out of array.
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+[ Upstream commit b0d795a9ae558209656b18930c2b4def5f8fdfb8 ]
+
+The value in txq_id can be out of array scope,
+validate it before accessing the array.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index e850aa504b608..69057701641e0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -2462,7 +2462,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ 	struct iwl_mvm_tid_data *tid_data;
+ 	u16 normalized_ssn;
+-	int txq_id;
++	u16 txq_id;
+ 	int ret;
+ 
+ 	if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
+@@ -2506,17 +2506,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 	 */
+ 	txq_id = mvmsta->tid_data[tid].txq_id;
+ 	if (txq_id == IWL_MVM_INVALID_QUEUE) {
+-		txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
+-						 IWL_MVM_DQA_MIN_DATA_QUEUE,
+-						 IWL_MVM_DQA_MAX_DATA_QUEUE);
+-		if (txq_id < 0) {
+-			ret = txq_id;
++		ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
++					      IWL_MVM_DQA_MIN_DATA_QUEUE,
++					      IWL_MVM_DQA_MAX_DATA_QUEUE);
++		if (ret < 0) {
+ 			IWL_ERR(mvm, "Failed to allocate agg queue\n");
+ 			goto release_locks;
+ 		}
+ 
++		txq_id = ret;
++
+ 		/* TXQ hasn't yet been enabled, so mark it only as reserved */
+ 		mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
++	} else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
++		ret = -ENXIO;
++		IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
++			tid, IWL_MAX_HW_QUEUES - 1);
++		goto out;
++
+ 	} else if (unlikely(mvm->queue_info[txq_id].status ==
+ 			    IWL_MVM_QUEUE_SHARED)) {
+ 		ret = -ENXIO;
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch b/queue-4.19/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
new file mode 100644
index 00000000000..8521c19599a
--- /dev/null
+++ b/queue-4.19/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
@@ -0,0 +1,52 @@
+From a382d47aeab9a81d5158d6c4d9b62f0f9b9df1b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 09:51:56 +0100
+Subject: iwlwifi: mvm: fix A-MPDU reference assignment
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ]
+
+The current code assigns the reference, and then goes to increment
+it if the toggle bit has changed. That way, we get
+
+Toggle  0  0  0  0  1  1  1  1
+ID      1  1  1  1  1  2  2  2
+
+Fix that by assigning the post-toggle ID to get
+
+Toggle  0  0  0  0  1  1  1  1
+ID      1  1  1  1  2  2  2  2
+
+Reported-by: Danny Alexander <danny.alexander@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 036d1d82d93e7..77e3694536421 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -1077,7 +1077,6 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ 			he_phy_data = le64_to_cpu(desc->v1.he_phy_data);
+ 
+ 		rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
+-		rx_status->ampdu_reference = mvm->ampdu_ref;
+ 		/* toggle is switched whenever new aggregation starts */
+ 		if (toggle_bit != mvm->ampdu_toggle) {
+ 			mvm->ampdu_ref++;
+@@ -1092,6 +1091,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ 						RX_FLAG_AMPDU_EOF_BIT;
+ 			}
+ 		}
++		rx_status->ampdu_reference = mvm->ampdu_ref;
+ 	}
+ 
+ 	rcu_read_lock();
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-mvm-fix-rss-config-command.patch b/queue-4.19/iwlwifi-mvm-fix-rss-config-command.patch
new file mode 100644
index 00000000000..dc9278c2a60
--- /dev/null
+++ b/queue-4.19/iwlwifi-mvm-fix-rss-config-command.patch
@@ -0,0 +1,46 @@
+From 8330f7a54dbb3c9530c884f8f805b2143b117b6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 09:45:11 +0200
+Subject: iwlwifi: mvm: fix RSS config command
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ]
+
+The hash mask is a bitmap, so we should use BIT() on
+the enum values.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 9808d954dca29..c7e2b88cd5abb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -110,12 +110,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
+ 	int i;
+ 	struct iwl_rss_config_cmd cmd = {
+ 		.flags = cpu_to_le32(IWL_RSS_ENABLE),
+-		.hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
+-			     IWL_RSS_HASH_TYPE_IPV4_UDP |
+-			     IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
+-			     IWL_RSS_HASH_TYPE_IPV6_TCP |
+-			     IWL_RSS_HASH_TYPE_IPV6_UDP |
+-			     IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
++		.hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
++			     BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
+ 	};
+ 
+ 	if (mvm->trans->num_rx_queues == 1)
+-- 
+2.20.1
+
diff --git a/queue-4.19/iwlwifi-nvm-get-num-of-hw-addresses-from-firmware.patch b/queue-4.19/iwlwifi-nvm-get-num-of-hw-addresses-from-firmware.patch
new file mode 100644
index 00000000000..37fea558966
--- /dev/null
+++ b/queue-4.19/iwlwifi-nvm-get-num-of-hw-addresses-from-firmware.patch
@@ -0,0 +1,123 @@
+From f0a365b802d3f7008ab128c4d143e88e8df84f87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jun 2018 09:08:40 +0300
+Subject: iwlwifi: nvm: get num of hw addresses from firmware
+
+From: Naftali Goldstein <naftali.goldstein@intel.com>
+
+[ Upstream commit e7eeee08434873c2f781dc1afaa42b03a014b95d ]
+
+With NICs that don't read the NVM directly and instead rely on getting
+the relevant data from the firmware, the number of reserved MAC
+addresses was not added to the API. This caused the driver to assume
+there is only one address which results in all interfaces getting the
+same address. Update the API to fix this.
+
+While at it, fix-up the comments with firmware api names to actually
+match what we have in the firmware.
+
+Fixes: e9e1ba3dbf00 ("iwlwifi: mvm: support getting nvm data from firmware")
+Signed-off-by: Naftali Goldstein <naftali.goldstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/fw/api/nvm-reg.h    | 14 +++++++-------
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 10 +++++++++-
+ 2 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+index 6c53383647942..d22c1eefba6a2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+@@ -165,7 +165,7 @@ struct iwl_nvm_access_resp {
+  */
+ struct iwl_nvm_get_info {
+ 	__le32 reserved;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_S_VER_1 */
++} __packed; /* REGULATORY_NVM_GET_INFO_CMD_API_S_VER_1 */
+ 
+ /**
+  * enum iwl_nvm_info_general_flags - flags in NVM_GET_INFO resp
+@@ -180,14 +180,14 @@ enum iwl_nvm_info_general_flags {
+  * @flags: bit 0: 1 - empty, 0 - non-empty
+  * @nvm_version: nvm version
+  * @board_type: board type
+- * @reserved: reserved
++ * @n_hw_addrs: number of reserved MAC addresses
+  */
+ struct iwl_nvm_get_info_general {
+ 	__le32 flags;
+ 	__le16 nvm_version;
+ 	u8 board_type;
+-	u8 reserved;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_GENERAL_S_VER_1 */
++	u8 n_hw_addrs;
++} __packed; /* REGULATORY_NVM_GET_INFO_GENERAL_S_VER_2 */
+ 
+ /**
+  * enum iwl_nvm_mac_sku_flags - flags in &iwl_nvm_get_info_sku
+@@ -231,7 +231,7 @@ struct iwl_nvm_get_info_sku {
+ struct iwl_nvm_get_info_phy {
+ 	__le32 tx_chains;
+ 	__le32 rx_chains;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
++} __packed; /* REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
+ 
+ #define IWL_NUM_CHANNELS (51)
+ 
+@@ -245,7 +245,7 @@ struct iwl_nvm_get_info_regulatory {
+ 	__le32 lar_enabled;
+ 	__le16 channel_profile[IWL_NUM_CHANNELS];
+ 	__le16 reserved;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
++} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
+ 
+ /**
+  * struct iwl_nvm_get_info_rsp - response to get NVM data
+@@ -259,7 +259,7 @@ struct iwl_nvm_get_info_rsp {
+ 	struct iwl_nvm_get_info_sku mac_sku;
+ 	struct iwl_nvm_get_info_phy phy_sku;
+ 	struct iwl_nvm_get_info_regulatory regulatory;
+-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_RSP_S_VER_2 */
++} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */
+ 
+ /**
+  * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index 73969dbeb5c5f..b850cca9853c8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -1315,6 +1315,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+ 	bool lar_fw_supported = !iwlwifi_mod_params.lar_disable &&
+ 				fw_has_capa(&fw->ucode_capa,
+ 					    IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
++	bool empty_otp;
+ 	u32 mac_flags;
+ 	u32 sbands_flags = 0;
+ 
+@@ -1330,7 +1331,9 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+ 	}
+ 
+ 	rsp = (void *)hcmd.resp_pkt->data;
+-	if (le32_to_cpu(rsp->general.flags) & NVM_GENERAL_FLAGS_EMPTY_OTP)
++	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
++		       NVM_GENERAL_FLAGS_EMPTY_OTP);
++	if (empty_otp)
+ 		IWL_INFO(trans, "OTP is empty\n");
+ 
+ 	nvm = kzalloc(sizeof(*nvm) +
+@@ -1354,6 +1357,11 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+ 
+ 	/* Initialize general data */
+ 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
++	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
++	if (nvm->n_hw_addrs == 0)
++		IWL_WARN(trans,
++			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
++			 empty_otp);
+ 
+ 	/* Initialize MAC sku data */
+ 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ixgbe-don-t-clear-ipsec-sa-counters-on-hw-clearing.patch b/queue-4.19/ixgbe-don-t-clear-ipsec-sa-counters-on-hw-clearing.patch
new file mode 100644
index 00000000000..6f70c33bced
--- /dev/null
+++ b/queue-4.19/ixgbe-don-t-clear-ipsec-sa-counters-on-hw-clearing.patch
@@ -0,0 +1,47 @@
+From 01e7d86cadd1dd6c8b694e860464a6ea5eed5d94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 12:24:10 -0700
+Subject: ixgbe: don't clear IPsec sa counters on HW clearing
+
+From: Shannon Nelson <shannon.nelson@oracle.com>
+
+[ Upstream commit 9e3f2f5ecee69b0f70003fb3e07639151e91de73 ]
+
+The software SA record counters should not be cleared when clearing
+the hardware tables.  This causes the counters to be out of sync
+after a driver reset.
+
+Fixes: 63a67fe229ea ("ixgbe: add ipsec offload add and remove SA")
+Signed-off-by: Shannon Nelson <shannon.nelson@oracle.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index b27f7a968820d..49e6d66ccf802 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -114,7 +114,6 @@ static void ixgbe_ipsec_set_rx_ip(struct ixgbe_hw *hw, u16 idx, __be32 addr[])
+  **/
+ static void ixgbe_ipsec_clear_hw_tables(struct ixgbe_adapter *adapter)
+ {
+-	struct ixgbe_ipsec *ipsec = adapter->ipsec;
+ 	struct ixgbe_hw *hw = &adapter->hw;
+ 	u32 buf[4] = {0, 0, 0, 0};
+ 	u16 idx;
+@@ -133,9 +132,6 @@ static void ixgbe_ipsec_clear_hw_tables(struct ixgbe_adapter *adapter)
+ 		ixgbe_ipsec_set_tx_sa(hw, idx, buf, 0);
+ 		ixgbe_ipsec_set_rx_sa(hw, idx, 0, buf, 0, 0, 0);
+ 	}
+-
+-	ipsec->num_rx_sa = 0;
+-	ipsec->num_tx_sa = 0;
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/ixgbe-sync-the-first-fragment-unconditionally.patch b/queue-4.19/ixgbe-sync-the-first-fragment-unconditionally.patch
new file mode 100644
index 00000000000..8ba0a9dbb50
--- /dev/null
+++ b/queue-4.19/ixgbe-sync-the-first-fragment-unconditionally.patch
@@ -0,0 +1,78 @@
+From 2bad393c9dfba6ebf8330cd85d953f4c5e4adaa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 04:03:49 +0000
+Subject: ixgbe: sync the first fragment unconditionally
+
+From: Firo Yang <firo.yang@suse.com>
+
+[ Upstream commit e7ba676c6188d394a0133fc4b9bcd7ee50d54b7f ]
+
+In Xen environment, if Xen-swiotlb is enabled, ixgbe driver
+could possibly allocate a page, DMA memory buffer, for the first
+fragment which is not suitable for Xen-swiotlb to do DMA operations.
+Xen-swiotlb have to internally allocate another page for doing DMA
+operations. This mechanism requires syncing the data from the internal
+page to the page which ixgbe sends to upper network stack. However,
+since commit f3213d932173 ("ixgbe: Update driver to make use of DMA
+attributes in Rx path"), the unmap operation is performed with
+DMA_ATTR_SKIP_CPU_SYNC. As a result, the sync is not performed.
+Since the sync isn't performed, the upper network stack could receive
+a incomplete network packet. By incomplete, it means the linear data
+on the first fragment(between skb->head and skb->end) is invalid. So
+we have to copy the data from the internal xen-swiotlb page to the page
+which ixgbe sends to upper network stack through the sync operation.
+
+More details from Alexander Duyck:
+Specifically since we are mapping the frame with
+DMA_ATTR_SKIP_CPU_SYNC we have to unmap with that as well. As a result
+a sync is not performed on an unmap and must be done manually as we
+skipped it for the first frag. As such we need to always sync before
+possibly performing a page unmap operation.
+
+Fixes: f3213d932173 ("ixgbe: Update driver to make use of DMA attributes in Rx path")
+Signed-off-by: Firo Yang <firo.yang@suse.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index de65ca1e65580..51cd58fbab695 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1822,13 +1822,7 @@ static void ixgbe_pull_tail(struct ixgbe_ring *rx_ring,
+ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ 				struct sk_buff *skb)
+ {
+-	/* if the page was released unmap it, else just sync our portion */
+-	if (unlikely(IXGBE_CB(skb)->page_released)) {
+-		dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
+-				     ixgbe_rx_pg_size(rx_ring),
+-				     DMA_FROM_DEVICE,
+-				     IXGBE_RX_DMA_ATTR);
+-	} else if (ring_uses_build_skb(rx_ring)) {
++	if (ring_uses_build_skb(rx_ring)) {
+ 		unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK;
+ 
+ 		dma_sync_single_range_for_cpu(rx_ring->dev,
+@@ -1845,6 +1839,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ 					      skb_frag_size(frag),
+ 					      DMA_FROM_DEVICE);
+ 	}
++
++	/* If the page was released, just unmap it. */
++	if (unlikely(IXGBE_CB(skb)->page_released)) {
++		dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
++				     ixgbe_rx_pg_size(rx_ring),
++				     DMA_FROM_DEVICE,
++				     IXGBE_RX_DMA_ATTR);
++	}
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/jfs-fix-bogus-variable-self-initialization.patch b/queue-4.19/jfs-fix-bogus-variable-self-initialization.patch
new file mode 100644
index 00000000000..6cb8b12b435
--- /dev/null
+++ b/queue-4.19/jfs-fix-bogus-variable-self-initialization.patch
@@ -0,0 +1,45 @@
+From 7ffa8145ee69db12304dceaaa30252a6543ee805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:19:16 +0100
+Subject: jfs: fix bogus variable self-initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]
+
+A statement was originally added in 2006 to shut up a gcc warning,
+now but now clang warns about it:
+
+fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
+      [-Werror,-Wuninitialized]
+                pxd_t pxd = pxd;        /* truncated extent of xad */
+                      ~~~   ^~~
+
+Modern versions of gcc are fine without the silly assignment, so just
+drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.
+
+Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index a5663cb621d8d..78789c5ed36b0 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+ 	 * header ?
+ 	 */
+ 	if (tlck->type & tlckTRUNCATE) {
+-		/* This odd declaration suppresses a bogus gcc warning */
+-		pxd_t pxd = pxd;	/* truncated extent of xad */
++		pxd_t pxd;	/* truncated extent of xad */
+ 		int twm;
+ 
+ 		/*
+-- 
+2.20.1
+
diff --git a/queue-4.19/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch b/queue-4.19/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch
new file mode 100644
index 00000000000..d3fd47f7f32
--- /dev/null
+++ b/queue-4.19/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch
@@ -0,0 +1,72 @@
+From 5fc9c4b629897259b6d230560a9aea4405c1ea0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jan 2019 16:19:00 +0900
+Subject: kbuild: mark prepare0 as PHONY to fix external module build
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit e00d8880481497474792d28c14479a9fb6752046 ]
+
+Commit c3ff2a5193fa ("powerpc/32: add stack protector support")
+caused kernel panic on PowerPC when an external module is used with
+CONFIG_STACKPROTECTOR because the 'prepare' target was not executed
+for the external module build.
+
+Commit e07db28eea38 ("kbuild: fix single target build for external
+module") turned it into a build error because the 'prepare' target is
+now executed but the 'prepare0' target is missing for the external
+module build.
+
+External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is
+also broken in the same way.
+
+Move 'PHONY += prepare0' to the common place. GNU Make is fine with
+missing rule for phony targets. I also removed the comment which is
+wrong irrespective of this commit.
+
+I minimize the change so it can be easily backported to 4.20.x
+
+To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target
+build for external module"), and then this commit.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891
+Fixes: e07db28eea38 ("kbuild: fix single target build for external module")
+Fixes: c3ff2a5193fa ("powerpc/32: add stack protector support")
+Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
+Fixes: 0a1213fa7432 ("arm64: enable per-task stack canaries")
+Cc: linux-stable <stable@vger.kernel.org> # v4.20
+Reported-by: Samuel Holland <samuel@sholland.org>
+Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 48dbafb790ff1..9ceecb038356d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -964,6 +964,7 @@ ifdef CONFIG_STACK_VALIDATION
+   endif
+ endif
+ 
++PHONY += prepare0
+ 
+ ifeq ($(KBUILD_EXTMOD),)
+ core-y		+= kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
+@@ -1072,8 +1073,7 @@ scripts: scripts_basic asm-generic gcc-plugins $(autoksyms_h)
+ # archprepare is used in arch Makefiles and when processed asm symlink,
+ # version.h and scripts_basic is processed / created.
+ 
+-# Listed in dependency order
+-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
++PHONY += prepare archprepare prepare1 prepare2 prepare3
+ 
+ # prepare3 is used to check if we are building in a separate output directory,
+ # and if so do:
+-- 
+2.20.1
+
diff --git a/queue-4.19/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch b/queue-4.19/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
new file mode 100644
index 00000000000..9c50f45be2f
--- /dev/null
+++ b/queue-4.19/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
@@ -0,0 +1,38 @@
+From 7773a3fb76cb5e8135fc13b6e407f6dc73a55e7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 15:50:18 +0300
+Subject: kdb: do a sanity check on the cpu in kdb_per_cpu()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]
+
+The "whichcpu" comes from argv[3].  The cpu_online() macro looks up the
+cpu in a bitmap of online cpus, but if the value is too high then it
+could read beyond the end of the bitmap and possibly Oops.
+
+Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/debug/kdb/kdb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index f338d23b112b5..dc6bf35e78840 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2604,7 +2604,7 @@ static int kdb_per_cpu(int argc, const char **argv)
+ 		diag = kdbgetularg(argv[3], &whichcpu);
+ 		if (diag)
+ 			return diag;
+-		if (!cpu_online(whichcpu)) {
++		if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
+ 			kdb_printf("cpu %ld is not online\n", whichcpu);
+ 			return KDB_BADCPUNUM;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/keys-timestamp-new-keys.patch b/queue-4.19/keys-timestamp-new-keys.patch
new file mode 100644
index 00000000000..68a79c04db5
--- /dev/null
+++ b/queue-4.19/keys-timestamp-new-keys.patch
@@ -0,0 +1,34 @@
+From 0bffafd2484d8ae48315a3723ac62e21afaf1e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Feb 2019 16:20:37 +0000
+Subject: keys: Timestamp new keys
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ]
+
+Set the timestamp on new keys rather than leaving it unset.
+
+Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/key.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 249a6da4d2770..749a5cf27a192 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ 	key->gid = gid;
+ 	key->perm = perm;
+ 	key->restrict_link = restrict_link;
++	key->last_used_at = ktime_get_real_seconds();
+ 
+ 	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
+ 		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
+-- 
+2.20.1
+
diff --git a/queue-4.19/kvm-ppc-book3s-hv-fix-lockdep-warning-when-entering-.patch b/queue-4.19/kvm-ppc-book3s-hv-fix-lockdep-warning-when-entering-.patch
new file mode 100644
index 00000000000..517bcc12331
--- /dev/null
+++ b/queue-4.19/kvm-ppc-book3s-hv-fix-lockdep-warning-when-entering-.patch
@@ -0,0 +1,100 @@
+From c9ef1e6ef359ac1c451e84580aaf765defa46cbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2019 16:40:13 +1100
+Subject: KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 3309bec85e60d60d6394802cb8e183a4f4a72def ]
+
+The trace_hardirqs_on() sets current->hardirqs_enabled and from here
+the lockdep assumes interrupts are enabled although they are remain
+disabled until the context switches to the guest. Consequent
+srcu_read_lock() checks the flags in rcu_lock_acquire(), observes
+disabled interrupts and prints a warning (see below).
+
+This moves trace_hardirqs_on/off closer to __kvmppc_vcore_entry to
+prevent lockdep from being confused.
+
+DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
+WARNING: CPU: 16 PID: 8038 at kernel/locking/lockdep.c:4128 check_flags.part.25+0x224/0x280
+[...]
+NIP [c000000000185b84] check_flags.part.25+0x224/0x280
+LR [c000000000185b80] check_flags.part.25+0x220/0x280
+Call Trace:
+[c000003fec253710] [c000000000185b80] check_flags.part.25+0x220/0x280 (unreliable)
+[c000003fec253780] [c000000000187ea4] lock_acquire+0x94/0x260
+[c000003fec253840] [c00800001a1e9768] kvmppc_run_core+0xa60/0x1ab0 [kvm_hv]
+[c000003fec253a10] [c00800001a1ed944] kvmppc_vcpu_run_hv+0x73c/0xec0 [kvm_hv]
+[c000003fec253ae0] [c00800001a1095dc] kvmppc_vcpu_run+0x34/0x48 [kvm]
+[c000003fec253b00] [c00800001a1056bc] kvm_arch_vcpu_ioctl_run+0x2f4/0x400 [kvm]
+[c000003fec253b90] [c00800001a0f3618] kvm_vcpu_ioctl+0x460/0x850 [kvm]
+[c000003fec253d00] [c00000000041c4f4] do_vfs_ioctl+0xe4/0x930
+[c000003fec253db0] [c00000000041ce04] ksys_ioctl+0xc4/0x110
+[c000003fec253e00] [c00000000041ce78] sys_ioctl+0x28/0x80
+[c000003fec253e20] [c00000000000b5a4] system_call+0x5c/0x70
+Instruction dump:
+419e0034 3d220004 39291730 81290000 2f890000 409e0020 3c82ffc6 3c62ffc5
+3884be70 386329c0 4bf6ea71 60000000 <0fe00000> 3c62ffc6 3863be90 4801273d
+irq event stamp: 1025
+hardirqs last  enabled at (1025): [<c00800001a1e9728>] kvmppc_run_core+0xa20/0x1ab0 [kvm_hv]
+hardirqs last disabled at (1024): [<c00800001a1e9358>] kvmppc_run_core+0x650/0x1ab0 [kvm_hv]
+softirqs last  enabled at (0): [<c0000000000f1210>] copy_process.isra.4.part.5+0x5f0/0x1d00
+softirqs last disabled at (0): [<0000000000000000>]           (null)
+---[ end trace 31180adcc848993e ]---
+possible reason: unannotated irqs-off.
+irq event stamp: 1025
+hardirqs last  enabled at (1025): [<c00800001a1e9728>] kvmppc_run_core+0xa20/0x1ab0 [kvm_hv]
+hardirqs last disabled at (1024): [<c00800001a1e9358>] kvmppc_run_core+0x650/0x1ab0 [kvm_hv]
+softirqs last  enabled at (0): [<c0000000000f1210>] copy_process.isra.4.part.5+0x5f0/0x1d00
+softirqs last disabled at (0): [<0000000000000000>]           (null)
+
+Fixes: 8b24e69fc47e ("KVM: PPC: Book3S HV: Close race with testing for signals on guest entry", 2017-06-26)
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 3ae3e8d141e3e..dbfe32327212e 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -2993,25 +2993,26 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
+ 		}
+ 	}
+ 
+-	/*
+-	 * Interrupts will be enabled once we get into the guest,
+-	 * so tell lockdep that we're about to enable interrupts.
+-	 */
+-	trace_hardirqs_on();
+-
+ 	guest_enter_irqoff();
+ 
+ 	srcu_idx = srcu_read_lock(&vc->kvm->srcu);
+ 
+ 	this_cpu_disable_ftrace();
+ 
++	/*
++	 * Interrupts will be enabled once we get into the guest,
++	 * so tell lockdep that we're about to enable interrupts.
++	 */
++	trace_hardirqs_on();
++
+ 	trap = __kvmppc_vcore_entry();
+ 
++	trace_hardirqs_off();
++
+ 	this_cpu_enable_ftrace();
+ 
+ 	srcu_read_unlock(&vc->kvm->srcu, srcu_idx);
+ 
+-	trace_hardirqs_off();
+ 	set_irq_happened(trap);
+ 
+ 	spin_lock(&vc->lock);
+-- 
+2.20.1
+
diff --git a/queue-4.19/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch b/queue-4.19/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch
new file mode 100644
index 00000000000..c2be521e1ea
--- /dev/null
+++ b/queue-4.19/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch
@@ -0,0 +1,48 @@
+From 35458f36086c3a6a97c341c0e557d190081ed8a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 15:37:45 +1100
+Subject: KVM: PPC: Release all hardware TCE tables attached to a group
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit a67614cc05a5052b265ea48196dab2fce11f5f2e ]
+
+The SPAPR TCE KVM device references all hardware IOMMU tables assigned to
+some IOMMU group to ensure that in-kernel KVM acceleration of H_PUT_TCE
+can work. The tables are references when an IOMMU group gets registered
+with the VFIO KVM device by the KVM_DEV_VFIO_GROUP_ADD ioctl;
+KVM_DEV_VFIO_GROUP_DEL calls into the dereferencing code
+in kvm_spapr_tce_release_iommu_group() which walks through the list of
+LIOBNs, finds a matching IOMMU table and calls kref_put() when found.
+
+However that code stops after the very first successful derefencing
+leaving other tables referenced till the SPAPR TCE KVM device is destroyed
+which normally happens on guest reboot or termination so if we do hotplug
+and unplug in a loop, we are leaking IOMMU tables here.
+
+This removes a premature return to let kvm_spapr_tce_release_iommu_group()
+find and dereference all attached tables.
+
+Fixes: 121f80ba68f ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_64_vio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
+index 65486c3d029b5..26b03af71abd2 100644
+--- a/arch/powerpc/kvm/book3s_64_vio.c
++++ b/arch/powerpc/kvm/book3s_64_vio.c
+@@ -133,7 +133,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm,
+ 					continue;
+ 
+ 				kref_put(&stit->kref, kvm_spapr_tce_liobn_put);
+-				return;
+ 			}
+ 		}
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/l2tp-fix-possible-null-pointer-dereference.patch b/queue-4.19/l2tp-fix-possible-null-pointer-dereference.patch
new file mode 100644
index 00000000000..47a4402779d
--- /dev/null
+++ b/queue-4.19/l2tp-fix-possible-null-pointer-dereference.patch
@@ -0,0 +1,92 @@
+From e6136c70c4038e0cbbe357a333c5caf47a879aef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 22:44:04 +0800
+Subject: l2tp: Fix possible NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ]
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
+PGD 0 P4D 0
+Oops: 0000 [#1
+CPU: 0 PID: 5697 Comm: modprobe Tainted: G        W         5.1.0-rc7+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+RIP: 0010:__lock_acquire+0x53/0x10b0
+Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a
+RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002
+RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128
+RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
+R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000
+FS:  00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0
+Call Trace:
+ ? __lock_acquire+0x24e/0x10b0
+ lock_acquire+0xdf/0x230
+ ? flush_workqueue+0x71/0x530
+ flush_workqueue+0x97/0x530
+ ? flush_workqueue+0x71/0x530
+ l2tp_exit_net+0x170/0x2b0 [l2tp_core
+ ? l2tp_exit_net+0x93/0x2b0 [l2tp_core
+ ops_exit_list.isra.6+0x36/0x60
+ unregister_pernet_operations+0xb8/0x110
+ unregister_pernet_device+0x25/0x40
+ l2tp_init+0x55/0x1000 [l2tp_core
+ ? 0xffffffffa018d000
+ do_one_initcall+0x6c/0x3cc
+ ? do_init_module+0x22/0x1f1
+ ? rcu_read_lock_sched_held+0x97/0xb0
+ ? kmem_cache_alloc_trace+0x325/0x3b0
+ do_init_module+0x5b/0x1f1
+ load_module+0x1db1/0x2690
+ ? m_show+0x1d0/0x1d0
+ __do_sys_finit_module+0xc5/0xd0
+ __x64_sys_finit_module+0x15/0x20
+ do_syscall_64+0x6b/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x7fead031a839
+Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48
+RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839
+RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003
+RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80
+R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
+R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80
+Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core
+CR2: 0000000000000128
+---[ end trace 8322b2b8bf83f8e1
+
+If alloc_workqueue fails in l2tp_init, l2tp_net_ops
+is unregistered on failure path. Then l2tp_exit_net
+is called which will flush NULL workqueue, this patch
+add a NULL check to fix it.
+
+Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 52b5a2797c0c6..e4dec03a19fe9 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1735,7 +1735,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
+ 	}
+ 	rcu_read_unlock_bh();
+ 
+-	flush_workqueue(l2tp_wq);
++	if (l2tp_wq)
++		flush_workqueue(l2tp_wq);
+ 	rcu_barrier();
+ 
+ 	for (hash = 0; hash < L2TP_HASH_SIZE_2; hash++)
+-- 
+2.20.1
+
diff --git a/queue-4.19/led-triggers-fix-dereferencing-of-null-pointer.patch b/queue-4.19/led-triggers-fix-dereferencing-of-null-pointer.patch
new file mode 100644
index 00000000000..f78d2aa13c1
--- /dev/null
+++ b/queue-4.19/led-triggers-fix-dereferencing-of-null-pointer.patch
@@ -0,0 +1,45 @@
+From c4ee19caada06a46e515579a755b741ba77d3049 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 00:18:19 +0300
+Subject: led: triggers: Fix dereferencing of null pointer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Oleh Kravchenko <oleg@kaa.org.ua>
+
+[ Upstream commit 4016ba85880b252365d11bc7dc899450f2c73ad7 ]
+
+Error was detected by PVS-Studio:
+V522 Dereferencing of the null pointer 'led_cdev->trigger' might take place.
+
+Fixes: 2282e125a406 ("leds: triggers: let struct led_trigger::activate() return an error code")
+Signed-off-by: Oleh Kravchenko <oleg@kaa.org.ua>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-triggers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
+index e4cb3811e82a3..005b839f6eb9e 100644
+--- a/drivers/leds/led-triggers.c
++++ b/drivers/leds/led-triggers.c
+@@ -171,11 +171,11 @@ err_add_groups:
+ 		trig->deactivate(led_cdev);
+ err_activate:
+ 
+-	led_cdev->trigger = NULL;
+-	led_cdev->trigger_data = NULL;
+ 	write_lock_irqsave(&led_cdev->trigger->leddev_list_lock, flags);
+ 	list_del(&led_cdev->trig_list);
+ 	write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
++	led_cdev->trigger = NULL;
++	led_cdev->trigger_data = NULL;
+ 	led_set_brightness(led_cdev, LED_OFF);
+ 	kfree(event);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch b/queue-4.19/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
new file mode 100644
index 00000000000..20a2befa7bf
--- /dev/null
+++ b/queue-4.19/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
@@ -0,0 +1,38 @@
+From 7d680c31ad0be93ca229ebe053db58b64aa47962 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 22:42:18 +0800
+Subject: libertas_tf: Use correct channel range in lbtf_geo_init
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ]
+
+It seems we should use 'range' instead of 'priv->range'
+in lbtf_geo_init(), because 'range' is the corret one
+related to current regioncode.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas_tf/cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+index 909ac3685010f..2b193f1257a5a 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c
++++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
+ 			break;
+ 		}
+ 
+-	for (ch = priv->range.start; ch < priv->range.end; ch++)
++	for (ch = range->start; ch < range->end; ch++)
+ 		priv->channels[CHAN_TO_IDX(ch)].flags = 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch b/queue-4.19/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch
new file mode 100644
index 00000000000..60eeb01c6d5
--- /dev/null
+++ b/queue-4.19/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch
@@ -0,0 +1,43 @@
+From 869a8f675dcf2385ad2a83d2f5d627d98dd11200 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 May 2019 20:37:59 +0200
+Subject: lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Igor Konopko <igor.j.konopko@intel.com>
+
+[ Upstream commit 486b5aac85f6ec0b2df3e82a6a629d5eb7804db5 ]
+
+In pblk_rb_tear_down_check() the spinlock functions are not
+called in proper order.
+
+Fixes: a4bd217 ("lightnvm: physical block device (pblk) target")
+Signed-off-by: Igor Konopko <igor.j.konopko@intel.com>
+Reviewed-by: Javier González <javier@javigon.com>
+Reviewed-by: Hans Holmberg <hans.holmberg@cnexlabs.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/lightnvm/pblk-rb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c
+index f6eec0212dfcf..d22c13b556221 100644
+--- a/drivers/lightnvm/pblk-rb.c
++++ b/drivers/lightnvm/pblk-rb.c
+@@ -784,8 +784,8 @@ int pblk_rb_tear_down_check(struct pblk_rb *rb)
+ 	}
+ 
+ out:
+-	spin_unlock(&rb->w_lock);
+ 	spin_unlock_irq(&rb->s_lock);
++	spin_unlock(&rb->w_lock);
+ 
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch b/queue-4.19/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
new file mode 100644
index 00000000000..05f2443df9b
--- /dev/null
+++ b/queue-4.19/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
@@ -0,0 +1,196 @@
+From 37366f81119fcbcd856217eb23664ee47daf6479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:26 -0700
+Subject: llc: fix another potential sk_buff leak in llc_ui_sendmsg()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]
+
+All callers of llc_conn_state_process() except llc_build_and_send_pkt()
+(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
+consumes a reference to the skb.  Fix this caller to do the same.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/af_llc.c   | 34 ++++++++++++++++++++--------------
+ net/llc/llc_conn.c |  2 ++
+ net/llc/llc_if.c   | 12 ++++++++----
+ 3 files changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index b99e73a7e7e0f..ce841d59bc72a 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -113,22 +113,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+  *
+  *	Send data via reliable llc2 connection.
+  *	Returns 0 upon success, non-zero if action did not succeed.
++ *
++ *	This function always consumes a reference to the skb.
+  */
+ static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
+ {
+ 	struct llc_sock* llc = llc_sk(sk);
+-	int rc = 0;
+ 
+ 	if (unlikely(llc_data_accept_state(llc->state) ||
+ 		     llc->remote_busy_flag ||
+ 		     llc->p_flag)) {
+ 		long timeout = sock_sndtimeo(sk, noblock);
++		int rc;
+ 
+ 		rc = llc_ui_wait_for_busy_core(sk, timeout);
++		if (rc) {
++			kfree_skb(skb);
++			return rc;
++		}
+ 	}
+-	if (unlikely(!rc))
+-		rc = llc_build_and_send_pkt(sk, skb);
+-	return rc;
++	return llc_build_and_send_pkt(sk, skb);
+ }
+ 
+ static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
+@@ -900,7 +904,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
+ 	int flags = msg->msg_flags;
+ 	int noblock = flags & MSG_DONTWAIT;
+-	struct sk_buff *skb;
++	struct sk_buff *skb = NULL;
+ 	size_t size = 0;
+ 	int rc = -EINVAL, copied = 0, hdrlen;
+ 
+@@ -909,10 +913,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	lock_sock(sk);
+ 	if (addr) {
+ 		if (msg->msg_namelen < sizeof(*addr))
+-			goto release;
++			goto out;
+ 	} else {
+ 		if (llc_ui_addr_null(&llc->addr))
+-			goto release;
++			goto out;
+ 		addr = &llc->addr;
+ 	}
+ 	/* must bind connection to sap if user hasn't done it. */
+@@ -920,7 +924,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 		/* bind to sap with null dev, exclusive. */
+ 		rc = llc_ui_autobind(sock, addr);
+ 		if (rc)
+-			goto release;
++			goto out;
+ 	}
+ 	hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
+ 	size = hdrlen + len;
+@@ -929,12 +933,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	copied = size - hdrlen;
+ 	rc = -EINVAL;
+ 	if (copied < 0)
+-		goto release;
++		goto out;
+ 	release_sock(sk);
+ 	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
+ 	lock_sock(sk);
+ 	if (!skb)
+-		goto release;
++		goto out;
+ 	skb->dev      = llc->dev;
+ 	skb->protocol = llc_proto_type(addr->sllc_arphrd);
+ 	skb_reserve(skb, hdrlen);
+@@ -944,29 +948,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ 	if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
+ 		llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
+ 					  addr->sllc_sap);
++		skb = NULL;
+ 		goto out;
+ 	}
+ 	if (addr->sllc_test) {
+ 		llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
+ 					    addr->sllc_sap);
++		skb = NULL;
+ 		goto out;
+ 	}
+ 	if (addr->sllc_xid) {
+ 		llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
+ 					   addr->sllc_sap);
++		skb = NULL;
+ 		goto out;
+ 	}
+ 	rc = -ENOPROTOOPT;
+ 	if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
+ 		goto out;
+ 	rc = llc_ui_send_data(sk, skb, noblock);
++	skb = NULL;
+ out:
+-	if (rc) {
+-		kfree_skb(skb);
+-release:
++	kfree_skb(skb);
++	if (rc)
+ 		dprintk("%s: failed sending from %02X to %02X: %d\n",
+ 			__func__, llc->laddr.lsap, llc->daddr.lsap, rc);
+-	}
+ 	release_sock(sk);
+ 	return rc ? : copied;
+ }
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index ed2aca12460ca..0b0c6f12153b0 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
+  *	(executing it's actions and changing state), upper layer will be
+  *	indicated or confirmed, if needed. Returns 0 for success, 1 for
+  *	failure. The socket lock has to be held before calling this function.
++ *
++ *	This function always consumes a reference to the skb.
+  */
+ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ {
+diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
+index 8db03c2d5440b..ad6547736c219 100644
+--- a/net/llc/llc_if.c
++++ b/net/llc/llc_if.c
+@@ -38,6 +38,8 @@
+  *	closed and -EBUSY when sending data is not permitted in this state or
+  *	LLC has send an I pdu with p bit set to 1 and is waiting for it's
+  *	response.
++ *
++ *	This function always consumes a reference to the skb.
+  */
+ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ 	struct llc_sock *llc = llc_sk(sk);
+ 
+ 	if (unlikely(llc->state == LLC_CONN_STATE_ADM))
+-		goto out;
++		goto out_free;
+ 	rc = -EBUSY;
+ 	if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
+ 		     llc->p_flag)) {
+ 		llc->failed_data_req = 1;
+-		goto out;
++		goto out_free;
+ 	}
+ 	ev = llc_conn_ev(skb);
+ 	ev->type      = LLC_CONN_EV_TYPE_PRIM;
+ 	ev->prim      = LLC_DATA_PRIM;
+ 	ev->prim_type = LLC_PRIM_TYPE_REQ;
+ 	skb->dev      = llc->dev;
+-	rc = llc_conn_state_process(sk, skb);
+-out:
++	return llc_conn_state_process(sk, skb);
++
++out_free:
++	kfree_skb(skb);
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch b/queue-4.19/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
new file mode 100644
index 00000000000..97a8a285a29
--- /dev/null
+++ b/queue-4.19/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
@@ -0,0 +1,125 @@
+From faf5423ee6bbc45e19384bcffeec48edeb5b8b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:27 -0700
+Subject: llc: fix sk_buff refcounting in llc_conn_state_process()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ]
+
+If llc_conn_state_process() sees that llc_conn_service() put the skb on
+a list, it will drop one fewer references to it.  This is wrong because
+the current behavior is that llc_conn_service() never consumes a
+reference to the skb.
+
+The code also makes the number of skb references being dropped
+conditional on which of ind_prim and cfm_prim are nonzero, yet neither
+of these affects how many references are *acquired*.  So there is extra
+code that tries to fix this up by sometimes taking another reference.
+
+Remove the unnecessary/broken refcounting logic and instead just add an
+skb_get() before the only two places where an extra reference is
+actually consumed.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/llc_conn.c | 33 ++++++---------------------------
+ 1 file changed, 6 insertions(+), 27 deletions(-)
+
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 0b0c6f12153b0..a79b739eb2236 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 	struct llc_sock *llc = llc_sk(skb->sk);
+ 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+ 
+-	/*
+-	 * We have to hold the skb, because llc_conn_service will kfree it in
+-	 * the sending path and we need to look at the skb->cb, where we encode
+-	 * llc_conn_state_ev.
+-	 */
+-	skb_get(skb);
+ 	ev->ind_prim = ev->cfm_prim = 0;
+ 	/*
+ 	 * Send event to state machine
+@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 	rc = llc_conn_service(skb->sk, skb);
+ 	if (unlikely(rc != 0)) {
+ 		printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
+-		goto out_kfree_skb;
+-	}
+-
+-	if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
+-		/* indicate or confirm not required */
+-		if (!skb->next)
+-			goto out_kfree_skb;
+ 		goto out_skb_put;
+ 	}
+ 
+-	if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
+-		skb_get(skb);
+-
+ 	switch (ev->ind_prim) {
+ 	case LLC_DATA_PRIM:
++		skb_get(skb);
+ 		llc_save_primitive(sk, skb, LLC_DATA_PRIM);
+ 		if (unlikely(sock_queue_rcv_skb(sk, skb))) {
+ 			/*
+@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 		 * skb->sk pointing to the newly created struct sock in
+ 		 * llc_conn_handler. -acme
+ 		 */
++		skb_get(skb);
+ 		skb_queue_tail(&sk->sk_receive_queue, skb);
+ 		sk->sk_state_change(sk);
+ 		break;
+@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 				sk->sk_state_change(sk);
+ 			}
+ 		}
+-		kfree_skb(skb);
+ 		sock_put(sk);
+ 		break;
+ 	case LLC_RESET_PRIM:
+@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 		 * RESET is not being notified to upper layers for now
+ 		 */
+ 		printk(KERN_INFO "%s: received a reset ind!\n", __func__);
+-		kfree_skb(skb);
+ 		break;
+ 	default:
+-		if (ev->ind_prim) {
++		if (ev->ind_prim)
+ 			printk(KERN_INFO "%s: received unknown %d prim!\n",
+ 				__func__, ev->ind_prim);
+-			kfree_skb(skb);
+-		}
+ 		/* No indication */
+ 		break;
+ 	}
+@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ 		printk(KERN_INFO "%s: received a reset conf!\n", __func__);
+ 		break;
+ 	default:
+-		if (ev->cfm_prim) {
++		if (ev->cfm_prim)
+ 			printk(KERN_INFO "%s: received unknown %d prim!\n",
+ 					__func__, ev->cfm_prim);
+-			break;
+-		}
+-		goto out_skb_put; /* No confirmation */
++		/* No confirmation */
++		break;
+ 	}
+-out_kfree_skb:
+-	kfree_skb(skb);
+ out_skb_put:
+ 	kfree_skb(skb);
+ 	return rc;
+-- 
+2.20.1
+
diff --git a/queue-4.19/m68k-call-timer_interrupt-with-interrupts-disabled.patch b/queue-4.19/m68k-call-timer_interrupt-with-interrupts-disabled.patch
new file mode 100644
index 00000000000..4a08e83c0d5
--- /dev/null
+++ b/queue-4.19/m68k-call-timer_interrupt-with-interrupts-disabled.patch
@@ -0,0 +1,422 @@
+From d60fbe5b64c9eb07b017ca1dd28f68fe676b1858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: Call timer_interrupt() with interrupts disabled
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ]
+
+Some platforms execute their timer handler with the interrupt priority
+level set below 6. That means the handler could be interrupted by another
+driver and this could lead to re-entry of the timer core.
+
+Avoid this by use of local_irq_save/restore for timer interrupt dispatch.
+This provides mutual exclusion around the timer interrupt flag access
+which is needed later in this series for the clocksource conversion.
+
+Reported-by: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/amiga/cia.c       |  9 +++++++++
+ arch/m68k/atari/ataints.c   |  4 ++--
+ arch/m68k/atari/time.c      | 15 ++++++++++++++-
+ arch/m68k/bvme6000/config.c | 20 ++++++++++----------
+ arch/m68k/hp300/time.c      | 10 ++++++++--
+ arch/m68k/mac/via.c         | 17 +++++++++++++++++
+ arch/m68k/mvme147/config.c  | 18 ++++++++++--------
+ arch/m68k/mvme16x/config.c  | 21 +++++++++++----------
+ arch/m68k/q40/q40ints.c     | 19 +++++++++++--------
+ arch/m68k/sun3/sun3ints.c   |  3 +++
+ arch/m68k/sun3x/time.c      | 16 ++++++++++------
+ 11 files changed, 105 insertions(+), 47 deletions(-)
+
+diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
+index 2081b8cd5591c..b9aee983e6f4c 100644
+--- a/arch/m68k/amiga/cia.c
++++ b/arch/m68k/amiga/cia.c
+@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
+ 	struct ciabase *base = dev_id;
+ 	int mach_irq;
+ 	unsigned char ints;
++	unsigned long flags;
+ 
++	/* Interrupts get disabled while the timer irq flag is cleared and
++	 * the timer interrupt serviced.
++	 */
+ 	mach_irq = base->cia_irq;
++	local_irq_save(flags);
+ 	ints = cia_set_irq(base, CIA_ICR_ALL);
+ 	amiga_custom.intreq = base->int_mask;
++	if (ints & 1)
++		generic_handle_irq(mach_irq);
++	local_irq_restore(flags);
++	mach_irq++, ints >>= 1;
+ 	for (; ints; mach_irq++, ints >>= 1) {
+ 		if (ints & 1)
+ 			generic_handle_irq(mach_irq);
+diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
+index 3d2b63bedf058..56f02ea2c248d 100644
+--- a/arch/m68k/atari/ataints.c
++++ b/arch/m68k/atari/ataints.c
+@@ -142,7 +142,7 @@ struct mfptimerbase {
+ 	.name		= "MFP Timer D"
+ };
+ 
+-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
+ {
+ 	struct mfptimerbase *base = dev_id;
+ 	int mach_irq;
+@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
+ 	st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
+ 
+ 	/* request timer D dispatch handler */
+-	if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
++	if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
+ 			stmfp_base.name, &stmfp_base))
+ 		pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
+ 
+diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
+index 9cca64286464c..fafa20f75ab9a 100644
+--- a/arch/m68k/atari/time.c
++++ b/arch/m68k/atari/time.c
+@@ -24,6 +24,18 @@
+ DEFINE_SPINLOCK(rtc_lock);
+ EXPORT_SYMBOL_GPL(rtc_lock);
+ 
++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
++{
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
++	return IRQ_HANDLED;
++}
++
+ void __init
+ atari_sched_init(irq_handler_t timer_routine)
+ {
+@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
+     /* start timer C, div = 1:100 */
+     st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
+     /* install interrupt service routine for MFP Timer C */
+-    if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
++    if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
++                    timer_routine))
+ 	pr_err("Couldn't register timer interrupt\n");
+ }
+ 
+diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
+index 143ee9fa3893e..0e5efed4da865 100644
+--- a/arch/m68k/bvme6000/config.c
++++ b/arch/m68k/bvme6000/config.c
+@@ -44,11 +44,6 @@ extern int bvme6000_hwclk (int, struct rtc_time *);
+ extern void bvme6000_reset (void);
+ void bvme6000_set_vectors (void);
+ 
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+ 
+ int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -157,12 +152,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
+ 
+ static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
+ {
++    irq_handler_t timer_routine = dev_id;
++    unsigned long flags;
+     volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
+-    unsigned char msr = rtc->msr & 0xc0;
++    unsigned char msr;
+ 
++    local_irq_save(flags);
++    msr = rtc->msr & 0xc0;
+     rtc->msr = msr | 0x20;		/* Ack the interrupt */
++    timer_routine(0, NULL);
++    local_irq_restore(flags);
+ 
+-    return tick_handler(irq, dev_id);
++    return IRQ_HANDLED;
+ }
+ 
+ /*
+@@ -181,9 +182,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
+ 
+     rtc->msr = 0;	/* Ensure timer registers accessible */
+ 
+-    tick_handler = timer_routine;
+-    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
+-				"timer", bvme6000_timer_int))
++    if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
++                    timer_routine))
+ 	panic ("Couldn't register timer int");
+ 
+     rtc->t1cr_omr = 0x04;	/* Mode 2, ext clk */
+diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
+index 289d928a46cbe..d30b03ea93a27 100644
+--- a/arch/m68k/hp300/time.c
++++ b/arch/m68k/hp300/time.c
+@@ -38,13 +38,19 @@
+ 
+ static irqreturn_t hp300_tick(int irq, void *dev_id)
+ {
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
+ 	unsigned long tmp;
+-	irq_handler_t vector = dev_id;
++
++	local_irq_save(flags);
+ 	in_8(CLOCKBASE + CLKSR);
+ 	asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
+ 	/* Turn off the network and SCSI leds */
+ 	blinken_leds(0, 0xe0);
+-	return vector(irq, NULL);
++	return IRQ_HANDLED;
+ }
+ 
+ u32 hp300_gettimeoffset(void)
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index 288ec3aa5b575..038d5a1c4d484 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -387,6 +387,8 @@ void via_nubus_irq_shutdown(int irq)
+  * via6522.c :-), disable/pending masks added.
+  */
+ 
++#define VIA_TIMER_1_INT BIT(6)
++
+ void via1_irq(struct irq_desc *desc)
+ {
+ 	int irq_num;
+@@ -396,6 +398,21 @@ void via1_irq(struct irq_desc *desc)
+ 	if (!events)
+ 		return;
+ 
++	irq_num = IRQ_MAC_TIMER_1;
++	irq_bit = VIA_TIMER_1_INT;
++	if (events & irq_bit) {
++		unsigned long flags;
++
++		local_irq_save(flags);
++		via1[vIFR] = irq_bit;
++		generic_handle_irq(irq_num);
++		local_irq_restore(flags);
++
++		events &= ~irq_bit;
++		if (!events)
++			return;
++	}
++
+ 	irq_num = VIA1_SOURCE_BASE;
+ 	irq_bit = 1;
+ 	do {
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index adea549d240e9..93c68d2b8e0ea 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -45,11 +45,6 @@ extern void mvme147_reset (void);
+ 
+ static int bcd2int (unsigned char b);
+ 
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme147_process_int() */
+-
+-irq_handler_t tick_handler;
+-
+ 
+ int __init mvme147_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -104,16 +99,23 @@ void __init config_mvme147(void)
+ 
+ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ {
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
++
++	local_irq_save(flags);
+ 	m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+ 	m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
+-	return tick_handler(irq, dev_id);
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
++	return IRQ_HANDLED;
+ }
+ 
+ 
+ void mvme147_sched_init (irq_handler_t timer_routine)
+ {
+-	tick_handler = timer_routine;
+-	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
++	if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
++			timer_routine))
+ 		pr_err("Couldn't register timer interrupt\n");
+ 
+ 	/* Init the clock with a value */
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index 6ee36a5b528d8..5feb3ab484d08 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -50,11 +50,6 @@ extern void mvme16x_reset (void);
+ 
+ int bcd2int (unsigned char b);
+ 
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+ 
+ unsigned short mvme16x_config;
+ EXPORT_SYMBOL(mvme16x_config);
+@@ -352,8 +347,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
+ 
+ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ {
+-    *(volatile unsigned char *)0xfff4201b |= 8;
+-    return tick_handler(irq, dev_id);
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
++
++	local_irq_save(flags);
++	*(volatile unsigned char *)0xfff4201b |= 8;
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
++
++	return IRQ_HANDLED;
+ }
+ 
+ void mvme16x_sched_init (irq_handler_t timer_routine)
+@@ -361,14 +363,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
+     uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
+     int irq;
+ 
+-    tick_handler = timer_routine;
+     /* Using PCCchip2 or MC2 chip tick timer 1 */
+     *(volatile unsigned long *)0xfff42008 = 0;
+     *(volatile unsigned long *)0xfff42004 = 10000;	/* 10ms */
+     *(volatile unsigned char *)0xfff42017 |= 3;
+     *(volatile unsigned char *)0xfff4201b = 0x16;
+-    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
+-				"timer", mvme16x_timer_int))
++    if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
++                    timer_routine))
+ 	panic ("Couldn't register timer int");
+ 
+     if (brdno == 0x0162 || brdno == 0x172)
+diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
+index 3e7603202977e..1c696906c159f 100644
+--- a/arch/m68k/q40/q40ints.c
++++ b/arch/m68k/q40/q40ints.c
+@@ -127,10 +127,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
+ 	sound_ticks = ticks << 1;
+ }
+ 
+-static irq_handler_t q40_timer_routine;
+-
+-static irqreturn_t q40_timer_int (int irq, void * dev)
++static irqreturn_t q40_timer_int(int irq, void *dev_id)
+ {
++	irq_handler_t timer_routine = dev_id;
++
+ 	ql_ticks = ql_ticks ? 0 : 1;
+ 	if (sound_ticks) {
+ 		unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
+@@ -139,8 +139,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
+ 		*DAC_RIGHT=sval;
+ 	}
+ 
+-	if (!ql_ticks)
+-		q40_timer_routine(irq, dev);
++	if (!ql_ticks) {
++		unsigned long flags;
++
++		local_irq_save(flags);
++		timer_routine(0, NULL);
++		local_irq_restore(flags);
++	}
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -148,11 +153,9 @@ void q40_sched_init (irq_handler_t timer_routine)
+ {
+ 	int timer_irq;
+ 
+-	q40_timer_routine = timer_routine;
+ 	timer_irq = Q40_IRQ_FRAME;
+ 
+-	if (request_irq(timer_irq, q40_timer_int, 0,
+-				"timer", q40_timer_int))
++	if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
+ 		panic("Couldn't register timer int");
+ 
+ 	master_outb(-1, FRAME_CLEAR_REG);
+diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
+index 6bbca30c91884..a5824abb4a39c 100644
+--- a/arch/m68k/sun3/sun3ints.c
++++ b/arch/m68k/sun3/sun3ints.c
+@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
+ 
+ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ {
++	unsigned long flags;
+ 	unsigned int cnt;
+ 
++	local_irq_save(flags);
+ #ifdef CONFIG_SUN3
+ 	intersil_clear();
+ #endif
+@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ 	cnt = kstat_irqs_cpu(irq, 0);
+ 	if (!(cnt % 20))
+ 		sun3_leds(led_pattern[cnt % 160 / 20]);
++	local_irq_restore(flags);
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
+index 047e2bcee3d7a..3c8a86d085084 100644
+--- a/arch/m68k/sun3x/time.c
++++ b/arch/m68k/sun3x/time.c
+@@ -80,15 +80,19 @@ u32 sun3x_gettimeoffset(void)
+ }
+ 
+ #if 0
+-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
+ {
+-    void (*vector)(int, void *, struct pt_regs *) = dev_id;
++	irq_handler_t timer_routine = dev_id;
++	unsigned long flags;
+ 
+-    /* Clear the pending interrupt - pulse the enable line low */
+-    disable_irq(5);
+-    enable_irq(5);
++	local_irq_save(flags);
++	/* Clear the pending interrupt - pulse the enable line low */
++	disable_irq(5);
++	enable_irq(5);
++	timer_routine(0, NULL);
++	local_irq_restore(flags);
+ 
+-    vector(irq, NULL, regs);
++	return IRQ_HANDLED;
+ }
+ #endif
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/m68k-mac-fix-via-timer-counter-accesses.patch b/queue-4.19/m68k-mac-fix-via-timer-counter-accesses.patch
new file mode 100644
index 00000000000..2854914d8b6
--- /dev/null
+++ b/queue-4.19/m68k-mac-fix-via-timer-counter-accesses.patch
@@ -0,0 +1,156 @@
+From df5cfa73b032177545ea37a57417e4c6eee25a04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: mac: Fix VIA timer counter accesses
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]
+
+This resolves some bugs that affect VIA timer counter accesses.
+Avoid lost interrupts caused by reading the counter low byte register.
+Make allowance for the fact that the counter will be decremented to
+0xFFFF before being reloaded.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
+ 1 file changed, 53 insertions(+), 49 deletions(-)
+
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index acdabbeecfd2e..288ec3aa5b575 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -54,16 +54,6 @@ static __u8 rbv_clear;
+ 
+ static int gIER,gIFR,gBufA,gBufB;
+ 
+-/*
+- * Timer defs.
+- */
+-
+-#define TICK_SIZE		10000
+-#define MAC_CLOCK_TICK		(783300/HZ)		/* ticks per HZ */
+-#define MAC_CLOCK_LOW		(MAC_CLOCK_TICK&0xFF)
+-#define MAC_CLOCK_HIGH		(MAC_CLOCK_TICK>>8)
+-
+-
+ /*
+  * On Macs with a genuine VIA chip there is no way to mask an individual slot
+  * interrupt. This limitation also seems to apply to VIA clone logic cores in
+@@ -267,22 +257,6 @@ void __init via_init(void)
+ 	}
+ }
+ 
+-/*
+- * Start the 100 Hz clock
+- */
+-
+-void __init via_init_clock(irq_handler_t func)
+-{
+-	via1[vACR] |= 0x40;
+-	via1[vT1LL] = MAC_CLOCK_LOW;
+-	via1[vT1LH] = MAC_CLOCK_HIGH;
+-	via1[vT1CL] = MAC_CLOCK_LOW;
+-	via1[vT1CH] = MAC_CLOCK_HIGH;
+-
+-	if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
+-		pr_err("Couldn't register %s interrupt\n", "timer");
+-}
+-
+ /*
+  * Debugging dump, used in various places to see what's going on.
+  */
+@@ -310,29 +284,6 @@ void via_debug_dump(void)
+ 	}
+ }
+ 
+-/*
+- * This is always executed with interrupts disabled.
+- *
+- * TBI: get time offset between scheduling timer ticks
+- */
+-
+-u32 mac_gettimeoffset(void)
+-{
+-	unsigned long ticks, offset = 0;
+-
+-	/* read VIA1 timer 2 current value */
+-	ticks = via1[vT1CL] | (via1[vT1CH] << 8);
+-	/* The probability of underflow is less than 2% */
+-	if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
+-		/* Check for pending timer interrupt in VIA1 IFR */
+-		if (via1[vIFR] & 0x40) offset = TICK_SIZE;
+-
+-	ticks = MAC_CLOCK_TICK - ticks;
+-	ticks = ticks * 10000L / MAC_CLOCK_TICK;
+-
+-	return (ticks + offset) * 1000;
+-}
+-
+ /*
+  * Flush the L2 cache on Macs that have it by flipping
+  * the system into 24-bit mode for an instant.
+@@ -601,3 +552,56 @@ int via2_scsi_drq_pending(void)
+ 	return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
+ }
+ EXPORT_SYMBOL(via2_scsi_drq_pending);
++
++/* timer and clock source */
++
++#define VIA_CLOCK_FREQ     783360                /* VIA "phase 2" clock in Hz */
++#define VIA_TIMER_INTERVAL (1000000 / HZ)        /* microseconds per jiffy */
++#define VIA_TIMER_CYCLES   (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
++
++#define VIA_TC             (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
++#define VIA_TC_LOW         (VIA_TC & 0xFF)
++#define VIA_TC_HIGH        (VIA_TC >> 8)
++
++void __init via_init_clock(irq_handler_t timer_routine)
++{
++	if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
++		pr_err("Couldn't register %s interrupt\n", "timer");
++		return;
++	}
++
++	via1[vT1LL] = VIA_TC_LOW;
++	via1[vT1LH] = VIA_TC_HIGH;
++	via1[vT1CL] = VIA_TC_LOW;
++	via1[vT1CH] = VIA_TC_HIGH;
++	via1[vACR] |= 0x40;
++}
++
++u32 mac_gettimeoffset(void)
++{
++	unsigned long flags;
++	u8 count_high;
++	u16 count, offset = 0;
++
++	/*
++	 * Timer counter wrap-around is detected with the timer interrupt flag
++	 * but reading the counter low byte (vT1CL) would reset the flag.
++	 * Also, accessing both counter registers is essentially a data race.
++	 * These problems are avoided by ignoring the low byte. Clock accuracy
++	 * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
++	 * reduced by avoiding slow VIA register accesses.
++	 */
++
++	local_irq_save(flags);
++	count_high = via1[vT1CH];
++	if (count_high == 0xFF)
++		count_high = 0;
++	if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
++		offset = VIA_TIMER_CYCLES;
++	local_irq_restore(flags);
++
++	count = count_high << 8;
++	count = VIA_TIMER_CYCLES - count + offset;
++
++	return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
++}
+-- 
+2.20.1
+
diff --git a/queue-4.19/mac80211-accept-deauth-frames-in-ibss-mode.patch b/queue-4.19/mac80211-accept-deauth-frames-in-ibss-mode.patch
new file mode 100644
index 00000000000..1c7387ee194
--- /dev/null
+++ b/queue-4.19/mac80211-accept-deauth-frames-in-ibss-mode.patch
@@ -0,0 +1,49 @@
+From 29023b6bd86edf7803cfac489a0709ac84df535d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 15:37:05 +0300
+Subject: mac80211: accept deauth frames in IBSS mode
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ]
+
+We can process deauth frames and all, but we drop them very
+early in the RX path today - this could never have worked.
+
+Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index b12f23c996f4e..02d0b22d01141 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3391,9 +3391,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
+ 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+ 		/* process for all: mesh, mlme, ibss */
+ 		break;
++	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
++		if (is_multicast_ether_addr(mgmt->da) &&
++		    !is_broadcast_ether_addr(mgmt->da))
++			return RX_DROP_MONITOR;
++
++		/* process only for station/IBSS */
++		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
++			return RX_DROP_MONITOR;
++		break;
+ 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+-	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+ 	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+ 		if (is_multicast_ether_addr(mgmt->da) &&
+ 		    !is_broadcast_ether_addr(mgmt->da))
+-- 
+2.20.1
+
diff --git a/queue-4.19/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch b/queue-4.19/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
new file mode 100644
index 00000000000..7b77b5b7949
--- /dev/null
+++ b/queue-4.19/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
@@ -0,0 +1,38 @@
+From 5f0d97590d1e50201482d1a8377fbb3104e830f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 11:54:46 +0200
+Subject: mac80211: minstrel_ht: fix per-group max throughput rate
+ initialization
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ]
+
+The group number needs to be multiplied by the number of rates per group
+to get the full rate index
+
+Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rc80211_minstrel_ht.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 3d5520776655d..0b60e330c115b 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -529,7 +529,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+ 
+ 		/* (re)Initialize group rate indexes */
+ 		for(j = 0; j < MAX_THR_RATES; j++)
+-			tmp_group_tp_rate[j] = group;
++			tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
+ 
+ 		for (i = 0; i < MCS_GROUP_RATES; i++) {
+ 			if (!(mi->supported[group] & BIT(i)))
+-- 
+2.20.1
+
diff --git a/queue-4.19/mailbox-mediatek-add-check-for-possible-failure-of-k.patch b/queue-4.19/mailbox-mediatek-add-check-for-possible-failure-of-k.patch
new file mode 100644
index 00000000000..0c2f9b329c2
--- /dev/null
+++ b/queue-4.19/mailbox-mediatek-add-check-for-possible-failure-of-k.patch
@@ -0,0 +1,41 @@
+From 483fc55e1d0cee991feef68a9f1b83758e1c5ff4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 18:22:44 +0800
+Subject: mailbox: mediatek: Add check for possible failure of kzalloc
+
+From: Houlong Wei <houlong.wei@mediatek.com>
+
+[ Upstream commit 9f0a0a381c5db56e7922dbeea6831f27db58372f ]
+
+The patch 623a6143a845("mailbox: mediatek: Add Mediatek CMDQ driver")
+introduce the following static checker warning:
+  drivers/mailbox/mtk-cmdq-mailbox.c:366 cmdq_mbox_send_data()
+  error: potential null dereference 'task'.  (kzalloc returns null)
+
+Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Houlong Wei <houlong.wei@mediatek.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index aec46d5d35061..f7cc29c00302a 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -363,6 +363,9 @@ static int cmdq_mbox_send_data(struct mbox_chan *chan, void *data)
+ 	WARN_ON(cmdq->suspended);
+ 
+ 	task = kzalloc(sizeof(*task), GFP_ATOMIC);
++	if (!task)
++		return -ENOMEM;
++
+ 	task->cmdq = cmdq;
+ 	INIT_LIST_HEAD(&task->list_entry);
+ 	task->pa_base = pkt->pa_base;
+-- 
+2.20.1
+
diff --git a/queue-4.19/mailbox-qcom-apcs-fix-max_register-value.patch b/queue-4.19/mailbox-qcom-apcs-fix-max_register-value.patch
new file mode 100644
index 00000000000..cd8d0b060ed
--- /dev/null
+++ b/queue-4.19/mailbox-qcom-apcs-fix-max_register-value.patch
@@ -0,0 +1,36 @@
+From 6a1b2f04fea572357a2927f1ebe7ae562aad47c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 11:08:50 +0200
+Subject: mailbox: qcom-apcs: fix max_register value
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+
+[ Upstream commit 556a0964e28c4441dcdd50fb07596fd042246bd5 ]
+
+The mailbox length is 0x1000 hence the max_register value is 0xFFC.
+
+Fixes: c6a8b171ca8e ("mailbox: qcom: Convert APCS IPC driver to use
+regmap")
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/qcom-apcs-ipc-mailbox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+index 5255dcb551a78..d8b4f08f613b2 100644
+--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c
++++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+@@ -36,7 +36,7 @@ static const struct regmap_config apcs_regmap_config = {
+ 	.reg_bits = 32,
+ 	.reg_stride = 4,
+ 	.val_bits = 32,
+-	.max_register = 0x1000,
++	.max_register = 0xFFC,
+ 	.fast_io = true,
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mailbox-ti-msgmgr-off-by-one-in-ti_msgmgr_of_xlate.patch b/queue-4.19/mailbox-ti-msgmgr-off-by-one-in-ti_msgmgr_of_xlate.patch
new file mode 100644
index 00000000000..f627fd4aa3e
--- /dev/null
+++ b/queue-4.19/mailbox-ti-msgmgr-off-by-one-in-ti_msgmgr_of_xlate.patch
@@ -0,0 +1,40 @@
+From 79e1dae7e20c3a5fceab7692962c449b0c017ffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 17:50:11 +0300
+Subject: mailbox: ti-msgmgr: Off by one in ti_msgmgr_of_xlate()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 78f3ff524fca63e7d2a57149a34ade23d2c12798 ]
+
+The > comparison should be >= or we access one element beyond the end
+of the array.
+
+(The inst->qinsts[] array is allocated in the ti_msgmgr_probe() function
+and it has ->num_valid_queues elements.)
+
+Fixes: a2b79838b891 ("mailbox: ti-msgmgr: Add support for Secure Proxy")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/ti-msgmgr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c
+index 5bceafbf66993..01e9e462512b7 100644
+--- a/drivers/mailbox/ti-msgmgr.c
++++ b/drivers/mailbox/ti-msgmgr.c
+@@ -547,7 +547,7 @@ static struct mbox_chan *ti_msgmgr_of_xlate(struct mbox_controller *mbox,
+ 	}
+ 
+ 	if (d->is_sproxy) {
+-		if (req_pid > d->num_valid_queues)
++		if (req_pid >= d->num_valid_queues)
+ 			goto err;
+ 		qinst = &inst->qinsts[req_pid];
+ 		return qinst->chan;
+-- 
+2.20.1
+
diff --git a/queue-4.19/mdio_bus-fix-ptr_err-usage-after-initialization-to-c.patch b/queue-4.19/mdio_bus-fix-ptr_err-usage-after-initialization-to-c.patch
new file mode 100644
index 00000000000..3e3d82435ca
--- /dev/null
+++ b/queue-4.19/mdio_bus-fix-ptr_err-usage-after-initialization-to-c.patch
@@ -0,0 +1,49 @@
+From 45db43b5eb5a36769114c79e39a7dec3a1e1598e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Feb 2019 10:59:35 +0800
+Subject: mdio_bus: Fix PTR_ERR() usage after initialization to constant
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 780feae7eb69388c8d8b661cda6706b0dc0f642b ]
+
+Fix coccinelle warning:
+
+./drivers/net/phy/mdio_bus.c:51:5-12: ERROR: PTR_ERR applied after initialization to constant on line 44
+./drivers/net/phy/mdio_bus.c:52:5-12: ERROR: PTR_ERR applied after initialization to constant on line 44
+
+fix this by using IS_ERR before PTR_ERR
+
+Fixes: bafbdd527d56 ("phylib: Add device reset GPIO support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio_bus.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index c5588d4508f97..5c89a310359de 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -56,11 +56,12 @@ static int mdiobus_register_gpiod(struct mdio_device *mdiodev)
+ 		gpiod = fwnode_get_named_gpiod(&mdiodev->dev.of_node->fwnode,
+ 					       "reset-gpios", 0, GPIOD_OUT_LOW,
+ 					       "PHY reset");
+-	if (PTR_ERR(gpiod) == -ENOENT ||
+-	    PTR_ERR(gpiod) == -ENOSYS)
+-		gpiod = NULL;
+-	else if (IS_ERR(gpiod))
+-		return PTR_ERR(gpiod);
++	if (IS_ERR(gpiod)) {
++		if (PTR_ERR(gpiod) == -ENOENT || PTR_ERR(gpiod) == -ENOSYS)
++			gpiod = NULL;
++		else
++			return PTR_ERR(gpiod);
++	}
+ 
+ 	mdiodev->reset = gpiod;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch b/queue-4.19/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch
new file mode 100644
index 00000000000..cccd7b600e5
--- /dev/null
+++ b/queue-4.19/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch
@@ -0,0 +1,43 @@
+From e4b1278c8ee95f99759a64ba2d5b3a2aa076a8c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 08:37:45 -0300
+Subject: media: atmel: atmel-isi: fix timeout value for stop streaming
+
+From: Alexandre Kroupski <alexandre.kroupski@ingenico.com>
+
+[ Upstream commit 623fd246bb40234fe68dd4e7c1f1f081f9c45a3d ]
+
+In case of sensor malfunction, stop streaming timeout takes much longer
+than expected. This is due to conversion of time to jiffies: milliseconds
+multiplied with HZ (ticks/second) gives out a value of jiffies with 10^3
+greater. We need to also divide by 10^3 to obtain the right jiffies value.
+In other words FRAME_INTERVAL_MILLI_SEC must be in seconds in order to
+multiply by HZ and get the right jiffies value to add to the current
+jiffies for the timeout expire time.
+
+Fixes: 195ebc43bf76 ("[media] V4L: at91: add Atmel Image Sensor Interface (ISI) support")
+Signed-off-by: Alexandre Kroupski <alexandre.kroupski@ingenico.com>
+Reviewed-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/atmel/atmel-isi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
+index e8db4df1e7c41..1a0e5233ae28e 100644
+--- a/drivers/media/platform/atmel/atmel-isi.c
++++ b/drivers/media/platform/atmel/atmel-isi.c
+@@ -496,7 +496,7 @@ static void stop_streaming(struct vb2_queue *vq)
+ 	spin_unlock_irq(&isi->irqlock);
+ 
+ 	if (!isi->enable_preview_path) {
+-		timeout = jiffies + FRAME_INTERVAL_MILLI_SEC * HZ;
++		timeout = jiffies + (FRAME_INTERVAL_MILLI_SEC * HZ) / 1000;
+ 		/* Wait until the end of the current frame. */
+ 		while ((isi_readl(isi, ISI_STATUS) & ISI_CTRL_CDC) &&
+ 				time_before(jiffies, timeout))
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-cx18-update-pos-correctly-in-cx18_read_pos.patch b/queue-4.19/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
new file mode 100644
index 00000000000..0d3032b6c20
--- /dev/null
+++ b/queue-4.19/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
@@ -0,0 +1,37 @@
+From 88bc868beda5adcb3693344559e0fbf4e307e1d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: media: cx18: update *pos correctly in cx18_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]
+
+We should be updating *pos.  The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index a3f44e30f8219..88c2f3bea2b61 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+ 
+ 	CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ 	if (rc > 0)
+-		pos += rc;
++		*pos += rc;
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-cx23885-check-allocation-return.patch b/queue-4.19/media-cx23885-check-allocation-return.patch
new file mode 100644
index 00000000000..9d42395fe52
--- /dev/null
+++ b/queue-4.19/media-cx23885-check-allocation-return.patch
@@ -0,0 +1,43 @@
+From 4c7f5063690291c64a8c831796f75c4e79c187af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: media: cx23885: check allocation return
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here.  While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 7d52173073d6e..bafcb39822747 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1474,8 +1474,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ 		if (fe0->dvb.frontend != NULL) {
+ 			struct i2c_adapter *tun_i2c;
+ 
+-			fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+-			memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++			fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++			if (!fe0->dvb.frontend->sec_priv)
++				return -ENOMEM;
+ 			tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ 			if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ 				return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-davinci-isif-avoid-uninitialized-variable-use.patch b/queue-4.19/media-davinci-isif-avoid-uninitialized-variable-use.patch
new file mode 100644
index 00000000000..6c237e76d97
--- /dev/null
+++ b/queue-4.19/media-davinci-isif-avoid-uninitialized-variable-use.patch
@@ -0,0 +1,78 @@
+From 48348c1396477a1ab2a6b2236b3feb68fe0e796f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: media: davinci-isif: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+      [-Werror,-Wuninitialized]
+                dm365_vpss_set_pg_frame_size(frame_size);
+                                             ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+        struct vpss_pg_frame_size frame_size;
+        ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 340f8218f54d3..80fa60a4c4489 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -884,9 +884,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ 	struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+-	struct vpss_pg_frame_size frame_size;
+ 	u32 modeset = 0, ccdcfg = 0;
+-	struct vpss_sync_pol sync;
+ 
+ 	dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+ 
+@@ -974,13 +972,6 @@ static int isif_config_ycbcr(void)
+ 		/* two fields are interleaved in memory */
+ 		regw(0x00000249, SDOFST);
+ 
+-	/* Setup test pattern if enabled */
+-	if (isif_cfg.bayer.config_params.test_pat_gen) {
+-		sync.ccdpg_hdpol = params->hd_pol;
+-		sync.ccdpg_vdpol = params->vd_pol;
+-		dm365_vpss_set_sync_pol(sync);
+-		dm365_vpss_set_pg_frame_size(frame_size);
+-	}
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch b/queue-4.19/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
new file mode 100644
index 00000000000..fdf1dbd03f3
--- /dev/null
+++ b/queue-4.19/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
@@ -0,0 +1,54 @@
+From c681a989e0efccf079ef30d18a2635123d79d2bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:46:27 -0400
+Subject: media: davinci/vpbe: array underflow in vpbe_enum_outputs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]
+
+In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
+the problem is that "temp_index" can be negative.  This patch changes
+the types to unsigned to address this array underflow bug.
+
+Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe.c | 2 +-
+ include/media/davinci/vpbe.h          | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
+index df1ae6b5c8545..e45e062f44425 100644
+--- a/drivers/media/platform/davinci/vpbe.c
++++ b/drivers/media/platform/davinci/vpbe.c
+@@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
+ 			     struct v4l2_output *output)
+ {
+ 	struct vpbe_config *cfg = vpbe_dev->cfg;
+-	int temp_index = output->index;
++	unsigned int temp_index = output->index;
+ 
+ 	if (temp_index >= cfg->num_outputs)
+ 		return -EINVAL;
+diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
+index 79a566d7defd0..180a05e914979 100644
+--- a/include/media/davinci/vpbe.h
++++ b/include/media/davinci/vpbe.h
+@@ -92,7 +92,7 @@ struct vpbe_config {
+ 	struct encoder_config_info *ext_encoders;
+ 	/* amplifier information goes here */
+ 	struct amp_config_info *amp;
+-	int num_outputs;
++	unsigned int num_outputs;
+ 	/* Order is venc outputs followed by LCD and then external encoders */
+ 	struct vpbe_output *outputs;
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-dvb-earth-pt1-fix-wrong-initialization-for-dem.patch b/queue-4.19/media-dvb-earth-pt1-fix-wrong-initialization-for-dem.patch
new file mode 100644
index 00000000000..d3a5fab229f
--- /dev/null
+++ b/queue-4.19/media-dvb-earth-pt1-fix-wrong-initialization-for-dem.patch
@@ -0,0 +1,125 @@
+From cc04e63755a1963008ac974f1cc348f0958aba23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 04:56:23 -0500
+Subject: media: dvb/earth-pt1: fix wrong initialization for demod blocks
+
+From: Akihiro Tsukada <tskd08@gmail.com>
+
+[ Upstream commit 15d90a6ae98e6d2c68497b44a491cb9efbb98ab1 ]
+
+earth-pt1 driver was decomposed/restructured by the commit b732539efdba
+("media: dvb: earth-pt1: decompose pt1 driver into sub drivers"),
+but it introduced a problem regarding concurrent streaming:
+Opening a new terrestial stream stops the reception of an existing,
+already-opened satellite stream.
+
+The demod IC in earth-pt1 boards contains 2 pairs of terr. and sat. blocks,
+supporting 4 concurrent demodulations, and the above problem was because
+the config of a terr. block contained whole reset/init of the pair blocks,
+thus each open() of a terrestrial frontend wrongly cleared the config of
+its peer satellite block of the demod.
+This whole/pair reset should be executed earlier and not on each open().
+
+Fixes: b732539efdba ("media: dvb: earth-pt1: decompose pt1 driver into sub drivers")
+
+Signed-off-by: Akihiro Tsukada <tskd08@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/pt1/pt1.c | 54 ++++++++++++++++++++++++++++++++-----
+ 1 file changed, 48 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/media/pci/pt1/pt1.c b/drivers/media/pci/pt1/pt1.c
+index 7f878fc41b7e6..93fecffb36ee7 100644
+--- a/drivers/media/pci/pt1/pt1.c
++++ b/drivers/media/pci/pt1/pt1.c
+@@ -200,16 +200,10 @@ static const u8 va1j5jf8007t_25mhz_configs[][2] = {
+ static int config_demod(struct i2c_client *cl, enum pt1_fe_clk clk)
+ {
+ 	int ret;
+-	u8 buf[2] = {0x01, 0x80};
+ 	bool is_sat;
+ 	const u8 (*cfg_data)[2];
+ 	int i, len;
+ 
+-	ret = i2c_master_send(cl, buf, 2);
+-	if (ret < 0)
+-		return ret;
+-	usleep_range(30000, 50000);
+-
+ 	is_sat = !strncmp(cl->name, TC90522_I2C_DEV_SAT,
+ 			  strlen(TC90522_I2C_DEV_SAT));
+ 	if (is_sat) {
+@@ -260,6 +254,46 @@ static int config_demod(struct i2c_client *cl, enum pt1_fe_clk clk)
+ 	return 0;
+ }
+ 
++/*
++ * Init registers for (each pair of) terrestrial/satellite block in demod.
++ * Note that resetting terr. block also resets its peer sat. block as well.
++ * This function must be called before configuring any demod block
++ * (before pt1_wakeup(), fe->ops.init()).
++ */
++static int pt1_demod_block_init(struct pt1 *pt1)
++{
++	struct i2c_client *cl;
++	u8 buf[2] = {0x01, 0x80};
++	int ret;
++	int i;
++
++	/* reset all terr. & sat. pairs first */
++	for (i = 0; i < PT1_NR_ADAPS; i++) {
++		cl = pt1->adaps[i]->demod_i2c_client;
++		if (strncmp(cl->name, TC90522_I2C_DEV_TER,
++			    strlen(TC90522_I2C_DEV_TER)))
++			continue;
++
++		ret = i2c_master_send(cl, buf, 2);
++		if (ret < 0)
++			return ret;
++		usleep_range(30000, 50000);
++	}
++
++	for (i = 0; i < PT1_NR_ADAPS; i++) {
++		cl = pt1->adaps[i]->demod_i2c_client;
++		if (strncmp(cl->name, TC90522_I2C_DEV_SAT,
++			    strlen(TC90522_I2C_DEV_SAT)))
++			continue;
++
++		ret = i2c_master_send(cl, buf, 2);
++		if (ret < 0)
++			return ret;
++		usleep_range(30000, 50000);
++	}
++	return 0;
++}
++
+ static void pt1_write_reg(struct pt1 *pt1, int reg, u32 data)
+ {
+ 	writel(data, pt1->regs + reg * 4);
+@@ -987,6 +1021,10 @@ static int pt1_init_frontends(struct pt1 *pt1)
+ 			goto tuner_release;
+ 	}
+ 
++	ret = pt1_demod_block_init(pt1);
++	if (ret < 0)
++		goto fe_unregister;
++
+ 	return 0;
+ 
+ tuner_release:
+@@ -1245,6 +1283,10 @@ static int pt1_resume(struct device *dev)
+ 	pt1_update_power(pt1);
+ 	usleep_range(1000, 2000);
+ 
++	ret = pt1_demod_block_init(pt1);
++	if (ret < 0)
++		goto resume_err;
++
+ 	for (i = 0; i < PT1_NR_ADAPS; i++)
+ 		dvb_frontend_reinitialise(pt1->adaps[i]->fe);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-em28xx-fix-exception-handling-in-em28xx_alloc_.patch b/queue-4.19/media-em28xx-fix-exception-handling-in-em28xx_alloc_.patch
new file mode 100644
index 00000000000..3afe984e8f5
--- /dev/null
+++ b/queue-4.19/media-em28xx-fix-exception-handling-in-em28xx_alloc_.patch
@@ -0,0 +1,41 @@
+From e2a86bdcaf0ca67350329664b61e052e512f997e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2019 08:14:02 -0300
+Subject: media: em28xx: Fix exception handling in em28xx_alloc_urbs()
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit ecbce48f1ff2442371ebcd12ec0ecddb431fbd72 ]
+
+A null pointer would be passed to a call of the function "kfree" directly
+after a call of the function "kcalloc" failed at one place.
+Pass the data structure member "urb" instead for which memory
+was allocated before (so that this resource will be properly cleaned up).
+
+This issue was detected by using the Coccinelle software.
+
+Fixes: d571b592c6206d33731f41aa710fa0f69ac8611b ("media: em28xx: don't use coherent buffer for DMA transfers")
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index 5657f8710ca6b..69445c8e38e28 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -930,7 +930,7 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
+ 
+ 	usb_bufs->buf = kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
+ 	if (!usb_bufs->buf) {
+-		kfree(usb_bufs->buf);
++		kfree(usb_bufs->urb);
+ 		return -ENOMEM;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch b/queue-4.19/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
new file mode 100644
index 00000000000..b8fe8ca0b01
--- /dev/null
+++ b/queue-4.19/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
@@ -0,0 +1,37 @@
+From 273f68e991e35ae7767ebba543868e8d278f8a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: media: ivtv: update *pos correctly in ivtv_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 6196daae4b3e0..043ac0ae9ed07 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+ 
+ 	IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ 	if (rc > 0)
+-		pos += rc;
++		*pos += rc;
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch b/queue-4.19/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
new file mode 100644
index 00000000000..781bf72317e
--- /dev/null
+++ b/queue-4.19/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
@@ -0,0 +1,68 @@
+From fee6d9bf19ea0b77fcfd1660a095bd886c67f10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2019 05:01:57 -0400
+Subject: media: omap_vout: potential buffer overflow in vidioc_dqbuf()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]
+
+The "b->index" is a u32 the comes from the user in the ioctl.  It hasn't
+been checked.  We aren't supposed to use it but we're instead supposed
+to use the value that gets written to it when we call videobuf_dqbuf().
+
+The videobuf_dqbuf() first memsets it to zero and then re-initializes it
+inside the videobuf_status() function.  It's this final value which we
+want.
+
+Hans Verkuil pointed out that we need to check the return from
+videobuf_dqbuf().  I ended up doing a little cleanup related to that as
+well.
+
+Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
+index 5700b7818621d..45511d24d5705 100644
+--- a/drivers/media/platform/omap/omap_vout.c
++++ b/drivers/media/platform/omap/omap_vout.c
+@@ -1527,23 +1527,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
+ 	unsigned long size;
+ 	struct videobuf_buffer *vb;
+ 
+-	vb = q->bufs[b->index];
+-
+ 	if (!vout->streaming)
+ 		return -EINVAL;
+ 
+-	if (file->f_flags & O_NONBLOCK)
+-		/* Call videobuf_dqbuf for non blocking mode */
+-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
+-	else
+-		/* Call videobuf_dqbuf for  blocking mode */
+-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
++	ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
++	if (ret)
++		return ret;
++
++	vb = q->bufs[b->index];
+ 
+ 	addr = (unsigned long) vout->buf_phy_addr[vb->i];
+ 	size = (unsigned long) vb->size;
+ 	dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
+ 				size, DMA_TO_DEVICE);
+-	return ret;
++	return 0;
+ }
+ 
+ static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch b/queue-4.19/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
new file mode 100644
index 00000000000..a0a56b702f3
--- /dev/null
+++ b/queue-4.19/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
@@ -0,0 +1,39 @@
+From 888f52881f9e52114c2cff57bafb9470fa87ca6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: media: ov2659: fix unbalanced mutex_lock/unlock
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index 4b6be3b0fd528..5cdda9d6ca31e 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1136,7 +1136,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ 		mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ 		*mf = fmt->format;
+ #else
+-		return -ENOTTY;
++		ret = -ENOTTY;
+ #endif
+ 	} else {
+ 		s64 val;
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-rcar-vin-clean-up-correct-notifier-in-error-pa.patch b/queue-4.19/media-rcar-vin-clean-up-correct-notifier-in-error-pa.patch
new file mode 100644
index 00000000000..132c29f1fde
--- /dev/null
+++ b/queue-4.19/media-rcar-vin-clean-up-correct-notifier-in-error-pa.patch
@@ -0,0 +1,43 @@
+From eded9bb51f44c668fbced17d82dcb0a8f564e902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 13:42:58 -0400
+Subject: media: rcar-vin: Clean up correct notifier in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 0bd465765f8d1300040de627f0a0971a8849d654 ]
+
+The parallel input initialization error path cleans up the wrong
+async notifier, fix this by cleaning up the correct notifier.
+
+Fixes: 9863bc8695bc36e3 ("media: rcar-vin: Cleanup notifier in error path")
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar-vin/rcar-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
+index 485fa3fa8b49a..c389ba9ba74d2 100644
+--- a/drivers/media/platform/rcar-vin/rcar-core.c
++++ b/drivers/media/platform/rcar-vin/rcar-core.c
+@@ -631,7 +631,7 @@ static int rvin_parallel_init(struct rvin_dev *vin)
+ 	ret = v4l2_async_notifier_register(&vin->v4l2_dev, &vin->notifier);
+ 	if (ret < 0) {
+ 		vin_err(vin, "Notifier registration failed\n");
+-		v4l2_async_notifier_cleanup(&vin->group->notifier);
++		v4l2_async_notifier_cleanup(&vin->notifier);
+ 		return ret;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch b/queue-4.19/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
new file mode 100644
index 00000000000..01365b66624
--- /dev/null
+++ b/queue-4.19/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
@@ -0,0 +1,45 @@
+From 7b9a4aae049a6cd849b742c73b5dd3e1f93a0c2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jan 2019 13:00:41 -0500
+Subject: media: s5p-jpeg: Correct step and max values for
+ V4L2_CID_JPEG_RESTART_INTERVAL
+
+From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]
+
+This commit corrects max and step values for v4l2 control for
+V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
+It was found by using v4l2-compliance tool and checking result of
+VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
+Previously it was complaining that step was bigger than difference
+between max and min.
+
+Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")
+
+Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index 350afaa29a620..fa7c42cf4b4ef 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -2005,7 +2005,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
+ 
+ 		v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
+ 				  V4L2_CID_JPEG_RESTART_INTERVAL,
+-				  0, 3, 0xffff, 0);
++				  0, 0xffff, 1, 0);
+ 		if (ctx->jpeg->variant->version == SJPEG_S5P)
+ 			mask = ~0x06; /* 422, 420 */
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-sh-migor-include-missing-dma-mapping-header.patch b/queue-4.19/media-sh-migor-include-missing-dma-mapping-header.patch
new file mode 100644
index 00000000000..73c58f5d32e
--- /dev/null
+++ b/queue-4.19/media-sh-migor-include-missing-dma-mapping-header.patch
@@ -0,0 +1,40 @@
+From dd5d815d27731f27db2a6a1aaeb4465b6212c23a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 14:37:42 -0500
+Subject: media: sh: migor: Include missing dma-mapping header
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 5c88ee02932a964096cbbcc7c9f38b78d230bacb ]
+
+Since the removal of the stale soc_camera headers, Migo-R board fails to
+build due to missing dma-mapping include directive.
+
+Include missing dma-mapping.h header in Migo-R board file to fix the build
+error.
+
+Fixes: a50c7738e8ae ("media: sh: migor: Remove stale soc_camera include")
+
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/boards/mach-migor/setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
+index 254f2c6627036..6cd3cd468047c 100644
+--- a/arch/sh/boards/mach-migor/setup.c
++++ b/arch/sh/boards/mach-migor/setup.c
+@@ -5,6 +5,7 @@
+  * Copyright (C) 2008 Magnus Damm
+  */
+ #include <linux/clkdev.h>
++#include <linux/dma-mapping.h>
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+ #include <linux/interrupt.h>
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-staging-media-release-the-correct-resource-in-.patch b/queue-4.19/media-staging-media-release-the-correct-resource-in-.patch
new file mode 100644
index 00000000000..b74427112dd
--- /dev/null
+++ b/queue-4.19/media-staging-media-release-the-correct-resource-in-.patch
@@ -0,0 +1,58 @@
+From 383554093f567b3e07087aa37d6ea565af499acd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Aug 2017 12:49:01 -0400
+Subject: media: Staging: media: Release the correct resource in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3b6471c7becd06325eb5e701cc2602b2edbbc7b6 ]
+
+'res' is reassigned several times in the function and if we 'goto
+error_unmap', its value is not the returned value of 'request_mem_region()'
+anymore.
+
+Introduce a new 'struct resource *' variable (i.e. res2) to keep a pointer
+to the right resource, if needed in the error handling path.
+
+Fixes: 4b4eda001704 ("Staging: media: Unmap and release region obtained by ioremap_nocache")
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/davinci_vpfe/dm365_ipipe.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipe.c b/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
+index 95942768639cd..7bf2648affc0c 100644
+--- a/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
++++ b/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
+@@ -1777,7 +1777,7 @@ vpfe_ipipe_init(struct vpfe_ipipe_device *ipipe, struct platform_device *pdev)
+ 	struct media_pad *pads = &ipipe->pads[0];
+ 	struct v4l2_subdev *sd = &ipipe->subdev;
+ 	struct media_entity *me = &sd->entity;
+-	struct resource *res, *memres;
++	struct resource *res, *res2, *memres;
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 4);
+ 	if (!res)
+@@ -1791,11 +1791,11 @@ vpfe_ipipe_init(struct vpfe_ipipe_device *ipipe, struct platform_device *pdev)
+ 	if (!ipipe->base_addr)
+ 		goto error_release;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 6);
+-	if (!res)
++	res2 = platform_get_resource(pdev, IORESOURCE_MEM, 6);
++	if (!res2)
+ 		goto error_unmap;
+-	ipipe->isp5_base_addr = ioremap_nocache(res->start,
+-						resource_size(res));
++	ipipe->isp5_base_addr = ioremap_nocache(res2->start,
++						resource_size(res2));
+ 	if (!ipipe->isp5_base_addr)
+ 		goto error_unmap;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-tw5864-fix-possible-null-pointer-dereference-i.patch b/queue-4.19/media-tw5864-fix-possible-null-pointer-dereference-i.patch
new file mode 100644
index 00000000000..e9e112e978b
--- /dev/null
+++ b/queue-4.19/media-tw5864-fix-possible-null-pointer-dereference-i.patch
@@ -0,0 +1,47 @@
+From d525982918633b588632e1067ce048296600d6db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2019 22:01:24 -0400
+Subject: media: tw5864: Fix possible NULL pointer dereference in
+ tw5864_handle_frame
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]
+
+'vb' null check should be done before dereferencing it in
+tw5864_handle_frame, otherwise a NULL pointer dereference
+may occur.
+
+Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index ff2b7da90c088..6c40e60ac9939 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ 	input->vb = NULL;
+ 	spin_unlock_irqrestore(&input->slock, flags);
+ 
+-	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ 	if (!vb) { /* Gone because of disabling */
+ 		dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ 		return;
+ 	}
+ 
++	v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ 	/*
+ 	 * Check for space.
+ 	 * Mind the overhead of startcode emulation prevention.
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-tw9910-unregister-subdevice-with-v4l2-async.patch b/queue-4.19/media-tw9910-unregister-subdevice-with-v4l2-async.patch
new file mode 100644
index 00000000000..c70e1c57250
--- /dev/null
+++ b/queue-4.19/media-tw9910-unregister-subdevice-with-v4l2-async.patch
@@ -0,0 +1,39 @@
+From 8d66c5c83b55a818280d609a089f98bbde0ddd61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 12:33:04 -0200
+Subject: media: tw9910: Unregister subdevice with v4l2-async
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 341fe1d301f587c930509f6b9153436b957f649c ]
+
+As the tw9910 subdevice is registered through the v4l2-async framework,
+use the v4l2-async provided function to register it.
+
+Fixes: 7b20f325a566 ("media: i2c: tw9910: Remove soc_camera dependencies")
+
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tw9910.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tw9910.c b/drivers/media/i2c/tw9910.c
+index a54548cc42857..c7321a70e3ed0 100644
+--- a/drivers/media/i2c/tw9910.c
++++ b/drivers/media/i2c/tw9910.c
+@@ -1000,7 +1000,7 @@ static int tw9910_remove(struct i2c_client *client)
+ 	if (priv->pdn_gpio)
+ 		gpiod_put(priv->pdn_gpio);
+ 	clk_put(priv->clk);
+-	v4l2_device_unregister_subdev(&priv->subdev);
++	v4l2_async_unregister_subdev(&priv->subdev);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-vivid-fix-incorrect-assignment-operation-when-.patch b/queue-4.19/media-vivid-fix-incorrect-assignment-operation-when-.patch
new file mode 100644
index 00000000000..b837f716e22
--- /dev/null
+++ b/queue-4.19/media-vivid-fix-incorrect-assignment-operation-when-.patch
@@ -0,0 +1,42 @@
+From d3d276ad6240896bce217031853d8c8d14cf6a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 10:55:15 -0400
+Subject: media: vivid: fix incorrect assignment operation when setting video
+ mode
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ]
+
+The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
+bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
+otherwise the previous clearing of the FB_VMODE_MASK bits of
+var->vmode makes no sense and is redundant.
+
+Addresses-Coverity: ("Unused value")
+Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-osd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
+index bbbc1b6938a56..b24596697f579 100644
+--- a/drivers/media/platform/vivid/vivid-osd.c
++++ b/drivers/media/platform/vivid/vivid-osd.c
+@@ -155,7 +155,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
+ 	var->nonstd = 0;
+ 
+ 	var->vmode &= ~FB_VMODE_MASK;
+-	var->vmode = FB_VMODE_NONINTERLACED;
++	var->vmode |= FB_VMODE_NONINTERLACED;
+ 
+ 	/* Dummy values */
+ 	var->hsync_len = 24;
+-- 
+2.20.1
+
diff --git a/queue-4.19/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch b/queue-4.19/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
new file mode 100644
index 00000000000..240152d9bd5
--- /dev/null
+++ b/queue-4.19/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
@@ -0,0 +1,40 @@
+From c190983d24cbf82d23006b29b9216f14fb108fb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: media: wl128x: Fix an error code in fm_download_firmware()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 1cf4019689a56..cccf1a743f4e6 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1271,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+ 
+ 		switch (action->type) {
+ 		case ACTION_SEND_COMMAND:	/* Send */
+-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
+-						action->size, NULL, NULL))
++			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++					   action->size, NULL, NULL);
++			if (ret)
+ 				goto rel_fw;
+ 
+ 			cmd_cnt++;
+-- 
+2.20.1
+
diff --git a/queue-4.19/mei-replace-poll-with-epoll-for-write-queues.patch b/queue-4.19/mei-replace-poll-with-epoll-for-write-queues.patch
new file mode 100644
index 00000000000..fa7894ced01
--- /dev/null
+++ b/queue-4.19/mei-replace-poll-with-epoll-for-write-queues.patch
@@ -0,0 +1,47 @@
+From 61c146ef08279d31213c9e83312f9d0fe68726c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Sep 2018 23:27:48 +0300
+Subject: mei: replace POLL* with EPOLL* for write queues.
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+[ Upstream commit 03b2cbb6ea3c73e08fcf72d9ef8e286c4dcbd1fe ]
+
+Looks like during merging the bulk POLL* -> EPOLL* replacement
+missed the patch
+'commit af336cabe083 ("mei: limit the number of queued writes")'
+
+Fix sparse warning:
+drivers/misc/mei/main.c:602:13: warning: restricted __poll_t degrades to integer
+drivers/misc/mei/main.c:605:30: warning: invalid assignment: |=
+drivers/misc/mei/main.c:605:30:    left side has type restricted __poll_t
+drivers/misc/mei/main.c:605:30:    right side has type int
+
+Fixes: af336cabe083 ("mei: limit the number of queued writes")
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 4d77a6ae183a9..87281b3695e60 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -599,10 +599,10 @@ static __poll_t mei_poll(struct file *file, poll_table *wait)
+ 			mei_cl_read_start(cl, mei_cl_mtu(cl), file);
+ 	}
+ 
+-	if (req_events & (POLLOUT | POLLWRNORM)) {
++	if (req_events & (EPOLLOUT | EPOLLWRNORM)) {
+ 		poll_wait(file, &cl->tx_wait, wait);
+ 		if (cl->tx_cb_queued < dev->tx_queue_limit)
+-			mask |= POLLOUT | POLLWRNORM;
++			mask |= EPOLLOUT | EPOLLWRNORM;
+ 	}
+ 
+ out:
+-- 
+2.20.1
+
diff --git a/queue-4.19/memory-tegra-don-t-invoke-tegra30-specific-memory-ti.patch b/queue-4.19/memory-tegra-don-t-invoke-tegra30-specific-memory-ti.patch
new file mode 100644
index 00000000000..cc59e6caa47
--- /dev/null
+++ b/queue-4.19/memory-tegra-don-t-invoke-tegra30-specific-memory-ti.patch
@@ -0,0 +1,50 @@
+From c84a1d41b8268ccacc818f1d37b97b3332a7f7be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 23:38:51 +0300
+Subject: memory: tegra: Don't invoke Tegra30+ specific memory timing setup on
+ Tegra20
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit be4dbdec2bab8635c7a41573668624ee13d83022 ]
+
+This fixes irrelevant "tegra-mc 7000f000.memory-controller: no memory
+timings for RAM code 0 registered" warning message during of kernels
+boot-up on Tegra20.
+
+Fixes: a8d502fd3348 ("memory: tegra: Squash tegra20-mc into common tegra-mc driver")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/mc.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
+index c8f16666256cc..346d8eadb44b1 100644
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -664,12 +664,13 @@ static int tegra_mc_probe(struct platform_device *pdev)
+ 		}
+ 
+ 		isr = tegra_mc_irq;
+-	}
+ 
+-	err = tegra_mc_setup_timings(mc);
+-	if (err < 0) {
+-		dev_err(&pdev->dev, "failed to setup timings: %d\n", err);
+-		return err;
++		err = tegra_mc_setup_timings(mc);
++		if (err < 0) {
++			dev_err(&pdev->dev, "failed to setup timings: %d\n",
++				err);
++			return err;
++		}
+ 	}
+ 
+ 	mc->irq = platform_get_irq(pdev, 0);
+-- 
+2.20.1
+
diff --git a/queue-4.19/mfd-intel-lpss-release-ida-resources.patch b/queue-4.19/mfd-intel-lpss-release-ida-resources.patch
new file mode 100644
index 00000000000..e20601723f8
--- /dev/null
+++ b/queue-4.19/mfd-intel-lpss-release-ida-resources.patch
@@ -0,0 +1,36 @@
+From 8f9f9edaf9b79df666da22b80b7a6ae58a148a5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 15:56:31 +0300
+Subject: mfd: intel-lpss: Release IDA resources
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ]
+
+ida instances allocate some internal memory for ->free_bitmap
+in addition to the base 'struct ida'. Use ida_destroy() to release
+that memory at module_exit().
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index ff3fba16e7359..95e217e6b6d75 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -545,6 +545,7 @@ module_init(intel_lpss_init);
+ 
+ static void __exit intel_lpss_exit(void)
+ {
++	ida_destroy(&intel_lpss_devid_ida);
+ 	debugfs_remove(intel_lpss_debugfs);
+ }
+ module_exit(intel_lpss_exit);
+-- 
+2.20.1
+
diff --git a/queue-4.19/mic-avoid-statically-declaring-a-struct-device.patch b/queue-4.19/mic-avoid-statically-declaring-a-struct-device.patch
new file mode 100644
index 00000000000..f44ca482aaf
--- /dev/null
+++ b/queue-4.19/mic-avoid-statically-declaring-a-struct-device.patch
@@ -0,0 +1,118 @@
+From 691133f55b2e3fcaa1e870fafc27fd64d698bfa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 11:24:09 +0200
+Subject: mic: avoid statically declaring a 'struct device'.
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ]
+
+Generally, declaring a platform device as a static variable is
+a bad idea and can cause all kinds of problems, in particular
+with the DMA configuration and lifetime rules.
+
+A specific problem we hit here is from a bug in clang that warns
+about certain (otherwise valid) macros when used in static variables:
+
+drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow]
+static u64 mic_dma_mask = DMA_BIT_MASK(64);
+                          ^~~~~~~~~~~~~~~~
+include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK'
+ #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+                                                     ^ ~~~
+
+A slightly better way here is to create the platform device dynamically
+and set the dma mask in the probe function.
+This avoids the warning and some other problems, but is still not ideal
+because the device creation should really be separated from the driver,
+and the fact that the device has no parent means we have to force
+the dma mask rather than having it set up from the bus that the device
+is actually on.
+
+Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++----------------
+ 1 file changed, 12 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
+index b9f0710ffa6b0..4007adc666f37 100644
+--- a/drivers/misc/mic/card/mic_x100.c
++++ b/drivers/misc/mic/card/mic_x100.c
+@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
+ 	mdrv->dev = &pdev->dev;
+ 	snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
+ 
++	/* FIXME: use dma_set_mask_and_coherent() and check result */
++	dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++
+ 	mdev->mmio.pa = MIC_X100_MMIO_BASE;
+ 	mdev->mmio.len = MIC_X100_MMIO_LEN;
+ 	mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
+@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
+ 	mic_remove(pdev);
+ }
+ 
+-static u64 mic_dma_mask = DMA_BIT_MASK(64);
+-
+-static struct platform_device mic_platform_dev = {
+-	.name = mic_driver_name,
+-	.id   = 0,
+-	.num_resources = 0,
+-	.dev = {
+-		.dma_mask = &mic_dma_mask,
+-		.coherent_dma_mask = DMA_BIT_MASK(64),
+-	},
+-};
+-
+ static struct platform_driver __refdata mic_platform_driver = {
+ 	.probe = mic_probe,
+ 	.remove = mic_remove,
+@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
+ 	},
+ };
+ 
++static struct platform_device *mic_platform_dev;
++
+ static int __init mic_init(void)
+ {
+ 	int ret;
+@@ -328,9 +321,12 @@ static int __init mic_init(void)
+ 
+ 	request_module("mic_x100_dma");
+ 	mic_init_card_debugfs();
+-	ret = platform_device_register(&mic_platform_dev);
++
++	mic_platform_dev = platform_device_register_simple(mic_driver_name,
++							   0, NULL, 0);
++	ret = PTR_ERR_OR_ZERO(mic_platform_dev);
+ 	if (ret) {
+-		pr_err("platform_device_register ret %d\n", ret);
++		pr_err("platform_device_register_full ret %d\n", ret);
+ 		goto cleanup_debugfs;
+ 	}
+ 	ret = platform_driver_register(&mic_platform_driver);
+@@ -341,7 +337,7 @@ static int __init mic_init(void)
+ 	return ret;
+ 
+ device_unregister:
+-	platform_device_unregister(&mic_platform_dev);
++	platform_device_unregister(mic_platform_dev);
+ cleanup_debugfs:
+ 	mic_exit_card_debugfs();
+ done:
+@@ -351,7 +347,7 @@ done:
+ static void __exit mic_exit(void)
+ {
+ 	platform_driver_unregister(&mic_platform_driver);
+-	platform_device_unregister(&mic_platform_dev);
++	platform_device_unregister(mic_platform_dev);
+ 	mic_exit_card_debugfs();
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch b/queue-4.19/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
new file mode 100644
index 00000000000..0a28b596602
--- /dev/null
+++ b/queue-4.19/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
@@ -0,0 +1,103 @@
+From 73c331a84dc0498e44db6f5aee3cdcd081a82c45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 14:10:12 -0700
+Subject: mips: avoid explicit UB in assignment of mips_io_port_base
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ]
+
+The code in question is modifying a variable declared const through
+pointer manipulation.  Such code is explicitly undefined behavior, and
+is the lone issue preventing malta_defconfig from booting when built
+with Clang:
+
+If an attempt is made to modify an object defined with a const-qualified
+type through use of an lvalue with non-const-qualified type, the
+behavior is undefined.
+
+LLVM is removing such assignments. A simple fix is to not declare
+variables const that you plan on modifying.  Limiting the scope would be
+a better method of preventing unwanted writes to such a variable.
+
+Further, the code in question mentions "compiler bugs" without any links
+to bug reports, so it is difficult to know if the issue is resolved in
+GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or
+4.1.1. The minimal supported version of GCC in the Linux kernel is
+currently 4.6.
+
+For what its worth, there was UB before the commit in question, it just
+added a barrier and got lucky IRT codegen. I don't think there's any
+actual compiler bugs related, just runtime bugs due to UB.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/610
+Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for <asm/io.h>.")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Debugged-by: Nathan Chancellor <natechancellor@gmail.com>
+Suggested-by: Eli Friedman <efriedma@quicinc.com>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Hassan Naveed <hnaveed@wavecomp.com>
+Cc: Stephen Kitt <steve@sk2.org>
+Cc: Serge Semin <fancer.lancer@gmail.com>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/io.h | 14 ++------------
+ arch/mips/kernel/setup.c   |  2 +-
+ 2 files changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
+index 54c730aed3271..df1eaa3652794 100644
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -62,21 +62,11 @@
+  * instruction, so the lower 16 bits must be zero.  Should be true on
+  * on any sane architecture; generic code does not use this assumption.
+  */
+-extern const unsigned long mips_io_port_base;
++extern unsigned long mips_io_port_base;
+ 
+-/*
+- * Gcc will generate code to load the value of mips_io_port_base after each
+- * function call which may be fairly wasteful in some cases.  So we don't
+- * play quite by the book.  We tell gcc mips_io_port_base is a long variable
+- * which solves the code generation issue.  Now we need to violate the
+- * aliasing rules a little to make initialization possible and finally we
+- * will need the barrier() to fight side effects of the aliasing chat.
+- * This trickery will eventually collapse under gcc's optimizer.  Oh well.
+- */
+ static inline void set_io_port_base(unsigned long base)
+ {
+-	* (unsigned long *) &mips_io_port_base = base;
+-	barrier();
++	mips_io_port_base = base;
+ }
+ 
+ /*
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 8aaaa42f91ed6..e87c98b8a72c0 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -76,7 +76,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+  * mips_io_port_base is the begin of the address space to which x86 style
+  * I/O ports are mapped.
+  */
+-const unsigned long mips_io_port_base = -1;
++unsigned long mips_io_port_base = -1;
+ EXPORT_SYMBOL(mips_io_port_base);
+ 
+ static struct resource code_resource = { .name = "Kernel code", };
+-- 
+2.20.1
+
diff --git a/queue-4.19/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch b/queue-4.19/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch
new file mode 100644
index 00000000000..bb262ed2a1b
--- /dev/null
+++ b/queue-4.19/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch
@@ -0,0 +1,228 @@
+From a728582d5a18ca98bd15e5a5f06aad26673f1d15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Dec 2018 12:55:09 +0100
+Subject: MIPS: BCM63XX: drop unused and broken DSP platform device
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 682fee802843b332f9c51ffc8e062de5ff773f2e ]
+
+Trying to register the DSP platform device results in a null pointer
+access:
+
+[    0.124184] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804e305c, ra == 804e6f20
+[    0.135208] Oops[#1]:
+[    0.137514] CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.87
+...
+[    0.197117] epc   : 804e305c bcm63xx_dsp_register+0x80/0xa4
+[    0.202838] ra    : 804e6f20 board_register_devices+0x258/0x390
+...
+
+This happens because it tries to copy the passed platform data over the
+platform_device's unpopulated platform_data.
+
+Since this code has been broken since its submission, no driver was ever
+submitted for it, and apparently nobody was using it, just remove it
+instead of trying to fix it.
+
+Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm63xx/Makefile                    |  6 +-
+ arch/mips/bcm63xx/boards/board_bcm963xx.c     | 20 -------
+ arch/mips/bcm63xx/dev-dsp.c                   | 56 -------------------
+ .../asm/mach-bcm63xx/bcm63xx_dev_dsp.h        | 14 -----
+ .../include/asm/mach-bcm63xx/board_bcm963xx.h |  5 --
+ 5 files changed, 3 insertions(+), 98 deletions(-)
+ delete mode 100644 arch/mips/bcm63xx/dev-dsp.c
+ delete mode 100644 arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+
+diff --git a/arch/mips/bcm63xx/Makefile b/arch/mips/bcm63xx/Makefile
+index c69f297fc1df3..d89651e538f64 100644
+--- a/arch/mips/bcm63xx/Makefile
++++ b/arch/mips/bcm63xx/Makefile
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
+-		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+-		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+-		   dev-wdt.o dev-usb-usbd.o
++		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
++		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
++		   dev-usb-usbd.o
+ obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ 
+ obj-y		+= boards/
+diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
+index b2097c0d2ed78..36ec3dc2c999a 100644
+--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
++++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
+@@ -23,7 +23,6 @@
+ #include <bcm63xx_nvram.h>
+ #include <bcm63xx_dev_pci.h>
+ #include <bcm63xx_dev_enet.h>
+-#include <bcm63xx_dev_dsp.h>
+ #include <bcm63xx_dev_flash.h>
+ #include <bcm63xx_dev_hsspi.h>
+ #include <bcm63xx_dev_pcmcia.h>
+@@ -289,14 +288,6 @@ static struct board_info __initdata board_96348gw_10 = {
+ 	.has_pccard			= 1,
+ 	.has_ehci0			= 1,
+ 
+-	.has_dsp			= 1,
+-	.dsp = {
+-		.gpio_rst		= 6,
+-		.gpio_int		= 34,
+-		.cs			= 2,
+-		.ext_irq		= 2,
+-	},
+-
+ 	.leds = {
+ 		{
+ 			.name		= "adsl-fail",
+@@ -401,14 +392,6 @@ static struct board_info __initdata board_96348gw = {
+ 
+ 	.has_ohci0 = 1,
+ 
+-	.has_dsp			= 1,
+-	.dsp = {
+-		.gpio_rst		= 6,
+-		.gpio_int		= 34,
+-		.ext_irq		= 2,
+-		.cs			= 2,
+-	},
+-
+ 	.leds = {
+ 		{
+ 			.name		= "adsl-fail",
+@@ -898,9 +881,6 @@ int __init board_register_devices(void)
+ 	if (board.has_usbd)
+ 		bcm63xx_usbd_register(&board.usbd);
+ 
+-	if (board.has_dsp)
+-		bcm63xx_dsp_register(&board.dsp);
+-
+ 	/* Generate MAC address for WLAN and register our SPROM,
+ 	 * do this after registering enet devices
+ 	 */
+diff --git a/arch/mips/bcm63xx/dev-dsp.c b/arch/mips/bcm63xx/dev-dsp.c
+deleted file mode 100644
+index 5bb5b154c9bd3..0000000000000
+--- a/arch/mips/bcm63xx/dev-dsp.c
++++ /dev/null
+@@ -1,56 +0,0 @@
+-/*
+- * Broadcom BCM63xx VoIP DSP registration
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License.  See the file "COPYING" in the main directory of this archive
+- * for more details.
+- *
+- * Copyright (C) 2009 Florian Fainelli <florian@openwrt.org>
+- */
+-
+-#include <linux/init.h>
+-#include <linux/kernel.h>
+-#include <linux/platform_device.h>
+-
+-#include <bcm63xx_cpu.h>
+-#include <bcm63xx_dev_dsp.h>
+-#include <bcm63xx_regs.h>
+-#include <bcm63xx_io.h>
+-
+-static struct resource voip_dsp_resources[] = {
+-	{
+-		.start		= -1, /* filled at runtime */
+-		.end		= -1, /* filled at runtime */
+-		.flags		= IORESOURCE_MEM,
+-	},
+-	{
+-		.start		= -1, /* filled at runtime */
+-		.flags		= IORESOURCE_IRQ,
+-	},
+-};
+-
+-static struct platform_device bcm63xx_voip_dsp_device = {
+-	.name		= "bcm63xx-voip-dsp",
+-	.id		= -1,
+-	.num_resources	= ARRAY_SIZE(voip_dsp_resources),
+-	.resource	= voip_dsp_resources,
+-};
+-
+-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd)
+-{
+-	struct bcm63xx_dsp_platform_data *dpd;
+-	u32 val;
+-
+-	/* Get the memory window */
+-	val = bcm_mpi_readl(MPI_CSBASE_REG(pd->cs - 1));
+-	val &= MPI_CSBASE_BASE_MASK;
+-	voip_dsp_resources[0].start = val;
+-	voip_dsp_resources[0].end = val + 0xFFFFFFF;
+-	voip_dsp_resources[1].start = pd->ext_irq;
+-
+-	/* copy given platform data */
+-	dpd = bcm63xx_voip_dsp_device.dev.platform_data;
+-	memcpy(dpd, pd, sizeof (*pd));
+-
+-	return platform_device_register(&bcm63xx_voip_dsp_device);
+-}
+diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+deleted file mode 100644
+index 4e4970787371a..0000000000000
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
++++ /dev/null
+@@ -1,14 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __BCM63XX_DSP_H
+-#define __BCM63XX_DSP_H
+-
+-struct bcm63xx_dsp_platform_data {
+-	unsigned gpio_rst;
+-	unsigned gpio_int;
+-	unsigned cs;
+-	unsigned ext_irq;
+-};
+-
+-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd);
+-
+-#endif /* __BCM63XX_DSP_H */
+diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+index 5e5b1bc4a3247..830f53f28e3f7 100644
+--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
++++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+@@ -7,7 +7,6 @@
+ #include <linux/leds.h>
+ #include <bcm63xx_dev_enet.h>
+ #include <bcm63xx_dev_usb_usbd.h>
+-#include <bcm63xx_dev_dsp.h>
+ 
+ /*
+  * flash mapping
+@@ -31,7 +30,6 @@ struct board_info {
+ 	unsigned int	has_ohci0:1;
+ 	unsigned int	has_ehci0:1;
+ 	unsigned int	has_usbd:1;
+-	unsigned int	has_dsp:1;
+ 	unsigned int	has_uart0:1;
+ 	unsigned int	has_uart1:1;
+ 
+@@ -43,9 +41,6 @@ struct board_info {
+ 	/* USB config */
+ 	struct bcm63xx_usbd_platform_data usbd;
+ 
+-	/* DSP config */
+-	struct bcm63xx_dsp_platform_data dsp;
+-
+ 	/* GPIO LEDs */
+ 	struct gpio_led leds[5];
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch b/queue-4.19/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
new file mode 100644
index 00000000000..ebbd070def9
--- /dev/null
+++ b/queue-4.19/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
@@ -0,0 +1,42 @@
+From 7d195818ec21becd06e25c529a6ef586c32637df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:33:50 +0800
+Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ]
+
+When call function hwmon_device_register failed, use the actual
+return value instead of always -ENOMEM.
+
+Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mips/cpu_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
+index f66521c7f8462..98128374d710a 100644
+--- a/drivers/platform/mips/cpu_hwmon.c
++++ b/drivers/platform/mips/cpu_hwmon.c
+@@ -159,7 +159,7 @@ static int __init loongson_hwmon_init(void)
+ 
+ 	cpu_hwmon_dev = hwmon_device_register(NULL);
+ 	if (IS_ERR(cpu_hwmon_dev)) {
+-		ret = -ENOMEM;
++		ret = PTR_ERR(cpu_hwmon_dev);
+ 		pr_err("hwmon_device_register fail!\n");
+ 		goto fail_hwmon_device_register;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch b/queue-4.19/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
new file mode 100644
index 00000000000..a3006a9403e
--- /dev/null
+++ b/queue-4.19/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
@@ -0,0 +1,70 @@
+From 4cee23f64f648b91909991b2ab78bcb7ea65cd4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2019 09:15:17 -0700
+Subject: misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]
+
+Clang warns:
+
+drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is
+uninitialized when used within its own initialization [-Wuninitialized]
+        void *buf = buf;
+              ~~~   ^~~
+1 warning generated.
+
+Arnd's explanation during review:
+
+  /*
+   * Returns the physical address of the partition's reserved page through
+   * an iterative number of calls.
+   *
+   * On first call, 'cookie' and 'len' should be set to 0, and 'addr'
+   * set to the nasid of the partition whose reserved page's address is
+   * being sought.
+   * On subsequent calls, pass the values, that were passed back on the
+   * previous call.
+   *
+   * While the return status equals SALRET_MORE_PASSES, keep calling
+   * this function after first copying 'len' bytes starting at 'addr'
+   * into 'buf'. Once the return status equals SALRET_OK, 'addr' will
+   * be the physical address of the partition's reserved page. If the
+   * return status equals neither of these, an error as occurred.
+   */
+  static inline s64
+  sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len)
+
+  so *len is set to zero on the first call and tells the bios how many
+  bytes are accessible at 'buf', and it does get updated by the BIOS to
+  tell us how many bytes it needs, and then we allocate that and try again.
+
+Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page")
+Link: https://github.com/ClangBuiltLinux/linux/issues/466
+Suggested-by: Stephen Hines <srhines@google.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/sgi-xp/xpc_partition.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
+index 0c3ef6f1df546..519826ba13786 100644
+--- a/drivers/misc/sgi-xp/xpc_partition.c
++++ b/drivers/misc/sgi-xp/xpc_partition.c
+@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
+ 	unsigned long rp_pa = nasid;	/* seed with nasid */
+ 	size_t len = 0;
+ 	size_t buf_len = 0;
+-	void *buf = buf;
++	void *buf = NULL;
+ 	void *buf_base = NULL;
+ 	enum xp_retval (*get_partition_rsvd_page_pa)
+ 		(void *, u64 *, unsigned long *, size_t *) =
+-- 
+2.20.1
+
diff --git a/queue-4.19/mlxsw-reg-qeec-add-minimum-shaper-fields.patch b/queue-4.19/mlxsw-reg-qeec-add-minimum-shaper-fields.patch
new file mode 100644
index 00000000000..84d893fc755
--- /dev/null
+++ b/queue-4.19/mlxsw-reg-qeec-add-minimum-shaper-fields.patch
@@ -0,0 +1,77 @@
+From c50e10bb591117fb30076f9c239d5e0b4a3863d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 09:56:42 +0000
+Subject: mlxsw: reg: QEEC: Add minimum shaper fields
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ]
+
+Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable
+configuration of minimum shaper.
+
+Increase the QEEC length to 0x20 as well: that's the length that the
+register has had for a long time now, but with the configurations that
+mlxsw typically exercises, the firmware tolerated 0x1C-sized packets.
+With mise=true however, FW rejects packets unless they have the full
+required length.
+
+Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+index aee58b3892f20..c9895876a2317 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -3215,7 +3215,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
+  * Configures the ETS elements.
+  */
+ #define MLXSW_REG_QEEC_ID 0x400D
+-#define MLXSW_REG_QEEC_LEN 0x1C
++#define MLXSW_REG_QEEC_LEN 0x20
+ 
+ MLXSW_REG_DEFINE(qeec, MLXSW_REG_QEEC_ID, MLXSW_REG_QEEC_LEN);
+ 
+@@ -3257,6 +3257,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
+  */
+ MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
+ 
++/* reg_qeec_mise
++ * Min shaper configuration enable. Enables configuration of the min
++ * shaper on this ETS element
++ * 0 - Disable
++ * 1 - Enable
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
++
+ enum {
+ 	MLXSW_REG_QEEC_BYTES_MODE,
+ 	MLXSW_REG_QEEC_PACKETS_MODE,
+@@ -3273,6 +3282,17 @@ enum {
+  */
+ MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
+ 
++/* The smallest permitted min shaper rate. */
++#define MLXSW_REG_QEEC_MIS_MIN	200000		/* Kbps */
++
++/* reg_qeec_min_shaper_rate
++ * Min shaper information rate.
++ * For CPU port, can only be configured for port hierarchy.
++ * When in bytes mode, value is specified in units of 1000bps.
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
++
+ /* reg_qeec_mase
+  * Max shaper configuration enable. Enables configuration of the max
+  * shaper on this ETS element.
+-- 
+2.20.1
+
diff --git a/queue-4.19/mlxsw-spectrum-set-minimum-shaper-on-mc-tcs.patch b/queue-4.19/mlxsw-spectrum-set-minimum-shaper-on-mc-tcs.patch
new file mode 100644
index 00000000000..fd0964d9c6e
--- /dev/null
+++ b/queue-4.19/mlxsw-spectrum-set-minimum-shaper-on-mc-tcs.patch
@@ -0,0 +1,83 @@
+From 36abd1ec0eafa0b6eff150451c9f04703a485fe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 09:56:44 +0000
+Subject: mlxsw: spectrum: Set minimum shaper on MC TCs
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 0fe64023162aef123de2f1993ba13a35a786e1de ]
+
+An MC-aware mode was introduced in commit 7b8195306694 ("mlxsw:
+spectrum: Configure MC-aware mode on mlxsw ports"). In MC-aware mode,
+BUM traffic gets a special treatment by being assigned to a separate set
+of traffic classes 8..15. Pairs of TCs 0 and 8, 1 and 9, etc., are then
+configured to strictly prioritize the lower-numbered ones. The intention
+is to prevent BUM traffic from flooding the switch and push out all UC
+traffic, which would otherwise happen, and instead give UC traffic
+precedence.
+
+However strictly prioritizing UC traffic has the effect that UC overload
+pushes out all BUM traffic, such as legitimate ARP queries. These
+packets are kept in queues for a while, but under sustained UC overload,
+their lifetime eventually expires and these packets are dropped. That is
+detrimental to network performance as well.
+
+Therefore configure the MC TCs (8..15) with minimum shaper of 200Mbps (a
+minimum permitted value) to allow a trickle of necessary control traffic
+to get through.
+
+Fixes: 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum.c    | 25 +++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index 30ef318b3d68d..5df9b25cab27d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2753,6 +2753,21 @@ int mlxsw_sp_port_ets_maxrate_set(struct mlxsw_sp_port *mlxsw_sp_port,
+ 	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(qeec), qeec_pl);
+ }
+ 
++static int mlxsw_sp_port_min_bw_set(struct mlxsw_sp_port *mlxsw_sp_port,
++				    enum mlxsw_reg_qeec_hr hr, u8 index,
++				    u8 next_index, u32 minrate)
++{
++	struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
++	char qeec_pl[MLXSW_REG_QEEC_LEN];
++
++	mlxsw_reg_qeec_pack(qeec_pl, mlxsw_sp_port->local_port, hr, index,
++			    next_index);
++	mlxsw_reg_qeec_mise_set(qeec_pl, true);
++	mlxsw_reg_qeec_min_shaper_rate_set(qeec_pl, minrate);
++
++	return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(qeec), qeec_pl);
++}
++
+ int mlxsw_sp_port_prio_tc_set(struct mlxsw_sp_port *mlxsw_sp_port,
+ 			      u8 switch_prio, u8 tclass)
+ {
+@@ -2830,6 +2845,16 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ 			return err;
+ 	}
+ 
++	/* Configure the min shaper for multicast TCs. */
++	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
++		err = mlxsw_sp_port_min_bw_set(mlxsw_sp_port,
++					       MLXSW_REG_QEEC_HIERARCY_TC,
++					       i + 8, i,
++					       MLXSW_REG_QEEC_MIS_MIN);
++		if (err)
++			return err;
++	}
++
+ 	/* Map all priorities to traffic class 0. */
+ 	for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+ 		err = mlxsw_sp_port_prio_tc_set(mlxsw_sp_port, i, 0);
+-- 
+2.20.1
+
diff --git a/queue-4.19/mmc-core-fix-possible-use-after-free-of-host.patch b/queue-4.19/mmc-core-fix-possible-use-after-free-of-host.patch
new file mode 100644
index 00000000000..4cb39611f6a
--- /dev/null
+++ b/queue-4.19/mmc-core-fix-possible-use-after-free-of-host.patch
@@ -0,0 +1,40 @@
+From a6d21a3a4cb03d8e809020d0d430df566d736598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 16:28:37 +0800
+Subject: mmc: core: fix possible use after free of host
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 8e1943af2986db42bee2b8dddf49a36cdb2e9219 ]
+
+In the function mmc_alloc_host, the function put_device is called to
+release allocated resources when mmc_gpio_alloc fails. Finally, the
+function pointed by host->class_dev.class->dev_release (i.e.,
+mmc_host_classdev_release) is used to release resources including the
+host structure. However, after put_device, host is used and released
+again. Resulting in a use-after-free bug.
+
+Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/host.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index f57f5de542064..dd1c14d8f6863 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -385,8 +385,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+ 
+ 	if (mmc_gpio_alloc(host)) {
+ 		put_device(&host->class_dev);
+-		ida_simple_remove(&mmc_host_ida, host->index);
+-		kfree(host);
+ 		return NULL;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mmc-core-fix-wl1251-sdio-quirks.patch b/queue-4.19/mmc-core-fix-wl1251-sdio-quirks.patch
new file mode 100644
index 00000000000..4112ef49e12
--- /dev/null
+++ b/queue-4.19/mmc-core-fix-wl1251-sdio-quirks.patch
@@ -0,0 +1,43 @@
+From ae1fd41822c8dd6b035ede07887704dbc47225e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:43 +0100
+Subject: mmc: core: fix wl1251 sdio quirks
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 16568b4a4f0c34bd35cfadac63303c7af7812764 ]
+
+wl1251 and wl1271 have different vendor id and device id.
+So we need to handle both with sdio quirks.
+
+Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/quirks.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index dd2f73af8f2c0..d5bbe8e544de7 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -119,7 +119,14 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
+ 	END_FIXUP
+ };
+ 
++
+ static const struct mmc_fixup sdio_fixup_methods[] = {
++	SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++		   add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
++
++	SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++		   add_quirk, MMC_QUIRK_DISABLE_CD),
++
+ 	SDIO_FIXUP(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271,
+ 		   add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch b/queue-4.19/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
new file mode 100644
index 00000000000..98080ba3da7
--- /dev/null
+++ b/queue-4.19/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
@@ -0,0 +1,38 @@
+From 7e6930e7c3305e0eb468aceac0c81509dbcfebba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 21:59:18 +0100
+Subject: mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ]
+
+We need to handle mmc_of_parse() errors during probe otherwise the
+MMC driver could start without proper initialization (e.g. power sequence).
+
+Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
+index 552bddc5096ce..1cd10356fc14f 100644
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -55,7 +55,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	sdhci_get_of_property(pdev);
+-	mmc_of_parse(host->mmc);
++	res = mmc_of_parse(host->mmc);
++	if (res)
++		goto err;
+ 
+ 	/*
+ 	 * Supply the existing CAPS, but clear the UHS modes. This
+-- 
+2.20.1
+
diff --git a/queue-4.19/mmc-sdio-fix-wl1251-vendor-id.patch b/queue-4.19/mmc-sdio-fix-wl1251-vendor-id.patch
new file mode 100644
index 00000000000..ee9b6d44530
--- /dev/null
+++ b/queue-4.19/mmc-sdio-fix-wl1251-vendor-id.patch
@@ -0,0 +1,44 @@
+From 6c0e2fe04bc128712afe00ee1042f4235f3030f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:42 +0100
+Subject: mmc: sdio: fix wl1251 vendor id
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit e5db673e7fe2f971ec82039a28dc0811c2100e87 ]
+
+v4.11-rc1 did introduce a patch series that rearranged the
+sdio quirks into a header file. Unfortunately this did forget
+to handle SDIO_VENDOR_ID_TI differently between wl1251 and
+wl1271 with the result that although the wl1251 was found on
+the sdio bus, the firmware did not load any more and there was
+no interface registration.
+
+This patch defines separate constants to be used by sdio quirks
+and drivers.
+
+Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mmc/sdio_ids.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
+index 4224902a8e22a..358d6be357eda 100644
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -68,6 +68,8 @@
+ 
+ #define SDIO_VENDOR_ID_TI			0x0097
+ #define SDIO_DEVICE_ID_TI_WL1271		0x4076
++#define SDIO_VENDOR_ID_TI_WL1251		0x104c
++#define SDIO_DEVICE_ID_TI_WL1251		0x9066
+ 
+ #define SDIO_VENDOR_ID_STE			0x0020
+ #define SDIO_DEVICE_ID_STE_CW1200		0x2280
+-- 
+2.20.1
+
diff --git a/queue-4.19/mpls-fix-warning-with-multi-label-encap.patch b/queue-4.19/mpls-fix-warning-with-multi-label-encap.patch
new file mode 100644
index 00000000000..079646eddfa
--- /dev/null
+++ b/queue-4.19/mpls-fix-warning-with-multi-label-encap.patch
@@ -0,0 +1,45 @@
+From fdff2d3c9ed15fdf9e9fd498e58d07baf5663a67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2019 11:49:41 +0100
+Subject: mpls: fix warning with multi-label encap
+
+From: George Wilkie <gwilkie@vyatta.att-mail.com>
+
+[ Upstream commit 2f3f7d1fa0d1039b24a55d127ed190f196fc3e79 ]
+
+If you configure a route with multiple labels, e.g.
+  ip route add 10.10.3.0/24 encap mpls 16/100 via 10.10.2.2 dev ens4
+A warning is logged:
+  kernel: [  130.561819] netlink: 'ip': attribute type 1 has an invalid
+  length.
+
+This happens because mpls_iptunnel_policy has set the type of
+MPLS_IPTUNNEL_DST to fixed size NLA_U32.
+Change it to a minimum size.
+nla_get_labels() does the remaining validation.
+
+Fixes: e3e4712ec096 ("mpls: ip tunnel support")
+Signed-off-by: George Wilkie <gwilkie@vyatta.att-mail.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mpls/mpls_iptunnel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
+index 94f53a9b7d1ae..faf6ef1b6a454 100644
+--- a/net/mpls/mpls_iptunnel.c
++++ b/net/mpls/mpls_iptunnel.c
+@@ -28,7 +28,7 @@
+ #include "internal.h"
+ 
+ static const struct nla_policy mpls_iptunnel_policy[MPLS_IPTUNNEL_MAX + 1] = {
+-	[MPLS_IPTUNNEL_DST]	= { .type = NLA_U32 },
++	[MPLS_IPTUNNEL_DST]	= { .len = sizeof(u32) },
+ 	[MPLS_IPTUNNEL_TTL]	= { .type = NLA_U8 },
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/mt76-usb-fix-possible-memory-leak-in-mt76u_buf_free.patch b/queue-4.19/mt76-usb-fix-possible-memory-leak-in-mt76u_buf_free.patch
new file mode 100644
index 00000000000..60a2a409945
--- /dev/null
+++ b/queue-4.19/mt76-usb-fix-possible-memory-leak-in-mt76u_buf_free.patch
@@ -0,0 +1,65 @@
+From 1e523e3361a55b09aa0e1f36ad10cfc6cf29efe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Feb 2019 22:49:14 +0100
+Subject: mt76: usb: fix possible memory leak in mt76u_buf_free
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit cb83585e1121bd6d6c039cf09fa32380bf8b6258 ]
+
+Move q->ndesc initialization before the for loop in mt76u_alloc_rx
+since otherwise allocated urbs will not be freed in mt76u_buf_free
+Double-check scatterlist pointer in mt76u_buf_free
+
+Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/usb.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
+index 8d40e92fb6f27..dcf927de65f39 100644
+--- a/drivers/net/wireless/mediatek/mt76/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/usb.c
+@@ -273,10 +273,16 @@ EXPORT_SYMBOL_GPL(mt76u_buf_alloc);
+ void mt76u_buf_free(struct mt76u_buf *buf)
+ {
+ 	struct urb *urb = buf->urb;
++	struct scatterlist *sg;
+ 	int i;
+ 
+-	for (i = 0; i < urb->num_sgs; i++)
+-		skb_free_frag(sg_virt(&urb->sg[i]));
++	for (i = 0; i < urb->num_sgs; i++) {
++		sg = &urb->sg[i];
++		if (!sg)
++			continue;
++
++		skb_free_frag(sg_virt(sg));
++	}
+ 	usb_free_urb(buf->urb);
+ }
+ EXPORT_SYMBOL_GPL(mt76u_buf_free);
+@@ -478,7 +484,8 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
+ 		nsgs = 1;
+ 	}
+ 
+-	for (i = 0; i < MT_NUM_RX_ENTRIES; i++) {
++	q->ndesc = MT_NUM_RX_ENTRIES;
++	for (i = 0; i < q->ndesc; i++) {
+ 		err = mt76u_buf_alloc(dev, &q->entry[i].ubuf,
+ 				      nsgs, q->buf_size,
+ 				      SKB_WITH_OVERHEAD(q->buf_size),
+@@ -486,7 +493,6 @@ static int mt76u_alloc_rx(struct mt76_dev *dev)
+ 		if (err < 0)
+ 			return err;
+ 	}
+-	q->ndesc = MT_NUM_RX_ENTRIES;
+ 
+ 	return mt76u_submit_rx_buffers(dev);
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-add-read-write-_once-annotations-on-rskq_accept_.patch b/queue-4.19/net-add-read-write-_once-annotations-on-rskq_accept_.patch
new file mode 100644
index 00000000000..bdbd4ffbb19
--- /dev/null
+++ b/queue-4.19/net-add-read-write-_once-annotations-on-rskq_accept_.patch
@@ -0,0 +1,76 @@
+From 85bc0259b573bb3d1c078d4a66faacc9c5f8e00a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 14:51:20 -0700
+Subject: net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 60b173ca3d1cd1782bd0096dc17298ec242f6fb1 ]
+
+reqsk_queue_empty() is called from inet_csk_listen_poll() while
+other cpus might write ->rskq_accept_head value.
+
+Use {READ|WRITE}_ONCE() to avoid compiler tricks
+and potential KCSAN splats.
+
+Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c      | 2 +-
+ include/net/request_sock.h      | 4 ++--
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index d4ea33581ac26..b3fbfed28682f 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -784,7 +784,7 @@ static int pvcalls_back_poll(struct xenbus_device *dev,
+ 	mappass->reqcopy = *req;
+ 	icsk = inet_csk(mappass->sock->sk);
+ 	queue = &icsk->icsk_accept_queue;
+-	data = queue->rskq_accept_head != NULL;
++	data = READ_ONCE(queue->rskq_accept_head) != NULL;
+ 	if (data) {
+ 		mappass->reqcopy.cmd = 0;
+ 		ret = 0;
+diff --git a/include/net/request_sock.h b/include/net/request_sock.h
+index 347015515a7de..1653435f18f5c 100644
+--- a/include/net/request_sock.h
++++ b/include/net/request_sock.h
+@@ -183,7 +183,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
+ 
+ static inline bool reqsk_queue_empty(const struct request_sock_queue *queue)
+ {
+-	return queue->rskq_accept_head == NULL;
++	return READ_ONCE(queue->rskq_accept_head) == NULL;
+ }
+ 
+ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue *queue,
+@@ -195,7 +195,7 @@ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue
+ 	req = queue->rskq_accept_head;
+ 	if (req) {
+ 		sk_acceptq_removed(parent);
+-		queue->rskq_accept_head = req->dl_next;
++		WRITE_ONCE(queue->rskq_accept_head, req->dl_next);
+ 		if (queue->rskq_accept_head == NULL)
+ 			queue->rskq_accept_tail = NULL;
+ 	}
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 636a11c56cf5a..79320858e7196 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -937,7 +937,7 @@ struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
+ 		req->sk = child;
+ 		req->dl_next = NULL;
+ 		if (queue->rskq_accept_head == NULL)
+-			queue->rskq_accept_head = req;
++			WRITE_ONCE(queue->rskq_accept_head, req);
+ 		else
+ 			queue->rskq_accept_tail->dl_next = req;
+ 		queue->rskq_accept_tail = req;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-af_iucv-always-register-net_device-notifier.patch b/queue-4.19/net-af_iucv-always-register-net_device-notifier.patch
new file mode 100644
index 00000000000..d45aa07ab2a
--- /dev/null
+++ b/queue-4.19/net-af_iucv-always-register-net_device-notifier.patch
@@ -0,0 +1,84 @@
+From a5c93c829f451534402048685a665333e2263ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 20:43:01 +0200
+Subject: net/af_iucv: always register net_device notifier
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ]
+
+Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still
+open HiperTransport-based connections. For robust operation these
+connections require the af_iucv_netdev_notifier, so register it
+unconditionally.
+
+Also handle any error that register_netdevice_notifier() returns.
+
+Fixes: 9fbd87d41392 ("af_iucv: handle netdev events")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/iucv/af_iucv.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index e07daee1227c3..23a1002ed86dd 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -2465,6 +2465,13 @@ out:
+ 	return err;
+ }
+ 
++static void afiucv_iucv_exit(void)
++{
++	device_unregister(af_iucv_dev);
++	driver_unregister(&af_iucv_driver);
++	pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++}
++
+ static int __init afiucv_init(void)
+ {
+ 	int err;
+@@ -2498,11 +2505,18 @@ static int __init afiucv_init(void)
+ 		err = afiucv_iucv_init();
+ 		if (err)
+ 			goto out_sock;
+-	} else
+-		register_netdevice_notifier(&afiucv_netdev_notifier);
++	}
++
++	err = register_netdevice_notifier(&afiucv_netdev_notifier);
++	if (err)
++		goto out_notifier;
++
+ 	dev_add_pack(&iucv_packet_type);
+ 	return 0;
+ 
++out_notifier:
++	if (pr_iucv)
++		afiucv_iucv_exit();
+ out_sock:
+ 	sock_unregister(PF_IUCV);
+ out_proto:
+@@ -2516,12 +2530,11 @@ out:
+ static void __exit afiucv_exit(void)
+ {
+ 	if (pr_iucv) {
+-		device_unregister(af_iucv_dev);
+-		driver_unregister(&af_iucv_driver);
+-		pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++		afiucv_iucv_exit();
+ 		symbol_put(iucv_if);
+-	} else
+-		unregister_netdevice_notifier(&afiucv_netdev_notifier);
++	}
++
++	unregister_netdevice_notifier(&afiucv_netdev_notifier);
+ 	dev_remove_pack(&iucv_packet_type);
+ 	sock_unregister(PF_IUCV);
+ 	proto_unregister(&iucv_proto);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-af_iucv-build-proper-skbs-for-hipertransport.patch b/queue-4.19/net-af_iucv-build-proper-skbs-for-hipertransport.patch
new file mode 100644
index 00000000000..07466482d68
--- /dev/null
+++ b/queue-4.19/net-af_iucv-build-proper-skbs-for-hipertransport.patch
@@ -0,0 +1,88 @@
+From f7cec1c1e91c90cfe68ae9d2fe621cd0cdfeddfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 20:43:00 +0200
+Subject: net/af_iucv: build proper skbs for HiperTransport
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 238965b71b968dc5b3c0fe430e946f488322c4b5 ]
+
+The HiperSockets-based transport path in af_iucv is still too closely
+entangled with qeth.
+With commit a647a02512ca ("s390/qeth: speed-up L3 IQD xmit"), the
+relevant xmit code in qeth has begun to use skb_cow_head(). So to avoid
+unnecessary skb head expansions, af_iucv must learn to
+1) respect dev->needed_headroom when allocating skbs, and
+2) drop the header reference before cloning the skb.
+
+While at it, also stop hard-coding the LL-header creation stage and just
+use the appropriate helper.
+
+Fixes: a647a02512ca ("s390/qeth: speed-up L3 IQD xmit")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/iucv/af_iucv.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index f024914da1b2d..e07daee1227c3 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -13,6 +13,7 @@
+ #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+ 
+ #include <linux/module.h>
++#include <linux/netdevice.h>
+ #include <linux/types.h>
+ #include <linux/list.h>
+ #include <linux/errno.h>
+@@ -355,6 +356,9 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
+ 		err = -ENODEV;
+ 		goto err_free;
+ 	}
++
++	dev_hard_header(skb, skb->dev, ETH_P_AF_IUCV, NULL, NULL, skb->len);
++
+ 	if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev)) {
+ 		err = -ENETDOWN;
+ 		goto err_free;
+@@ -367,6 +371,8 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
+ 		skb_trim(skb, skb->dev->mtu);
+ 	}
+ 	skb->protocol = cpu_to_be16(ETH_P_AF_IUCV);
++
++	__skb_header_release(skb);
+ 	nskb = skb_clone(skb, GFP_ATOMIC);
+ 	if (!nskb) {
+ 		err = -ENOMEM;
+@@ -466,12 +472,14 @@ static void iucv_sever_path(struct sock *sk, int with_user_data)
+ /* Send controlling flags through an IUCV socket for HIPER transport */
+ static int iucv_send_ctrl(struct sock *sk, u8 flags)
+ {
++	struct iucv_sock *iucv = iucv_sk(sk);
+ 	int err = 0;
+ 	int blen;
+ 	struct sk_buff *skb;
+ 	u8 shutdown = 0;
+ 
+-	blen = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
++	blen = sizeof(struct af_iucv_trans_hdr) +
++	       LL_RESERVED_SPACE(iucv->hs_dev);
+ 	if (sk->sk_shutdown & SEND_SHUTDOWN) {
+ 		/* controlling flags should be sent anyway */
+ 		shutdown = sk->sk_shutdown;
+@@ -1131,7 +1139,8 @@ static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg,
+ 	 * segmented records using the MSG_EOR flag), but
+ 	 * for SOCK_STREAM we might want to improve it in future */
+ 	if (iucv->transport == AF_IUCV_TRANS_HIPER) {
+-		headroom = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
++		headroom = sizeof(struct af_iucv_trans_hdr) +
++			   LL_RESERVED_SPACE(iucv->hs_dev);
+ 		linear = len;
+ 	} else {
+ 		if (len < PAGE_SIZE) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-always-initialize-pagedlen.patch b/queue-4.19/net-always-initialize-pagedlen.patch
new file mode 100644
index 00000000000..c393a29759f
--- /dev/null
+++ b/queue-4.19/net-always-initialize-pagedlen.patch
@@ -0,0 +1,72 @@
+From de00156d8ef7b49ec7f67cbda21773da50704925 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Nov 2018 14:21:16 -0500
+Subject: net: always initialize pagedlen
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit aba36930a35e7f1fe1319b203f25c05d6c119936 ]
+
+In ip packet generation, pagedlen is initialized for each skb at the
+start of the loop in __ip(6)_append_data, before label alloc_new_skb.
+
+Depending on compiler options, code can be generated that jumps to
+this label, triggering use of an an uninitialized variable.
+
+In practice, at -O2, the generated code moves the initialization below
+the label. But the code should not rely on that for correctness.
+
+Fixes: 15e36f5b8e98 ("udp: paged allocation with gso")
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_output.c  | 3 ++-
+ net/ipv6/ip6_output.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index d63091812342f..fbf30122e8bf2 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -940,7 +940,7 @@ static int __ip_append_data(struct sock *sk,
+ 			unsigned int fraglen;
+ 			unsigned int fraggap;
+ 			unsigned int alloclen;
+-			unsigned int pagedlen = 0;
++			unsigned int pagedlen;
+ 			struct sk_buff *skb_prev;
+ alloc_new_skb:
+ 			skb_prev = skb;
+@@ -957,6 +957,7 @@ alloc_new_skb:
+ 			if (datalen > mtu - fragheaderlen)
+ 				datalen = maxfraglen - fragheaderlen;
+ 			fraglen = datalen + fragheaderlen;
++			pagedlen = 0;
+ 
+ 			if ((flags & MSG_MORE) &&
+ 			    !(rt->dst.dev->features&NETIF_F_SG))
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index eed9231c90ad5..9886a84c25117 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1357,7 +1357,7 @@ emsgsize:
+ 			unsigned int fraglen;
+ 			unsigned int fraggap;
+ 			unsigned int alloclen;
+-			unsigned int pagedlen = 0;
++			unsigned int pagedlen;
+ alloc_new_skb:
+ 			/* There's no room in the current skb */
+ 			if (skb)
+@@ -1381,6 +1381,7 @@ alloc_new_skb:
+ 			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+ 				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
+ 			fraglen = datalen + fragheaderlen;
++			pagedlen = 0;
+ 
+ 			if ((flags & MSG_MORE) &&
+ 			    !(rt->dst.dev->features&NETIF_F_SG))
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch b/queue-4.19/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch
new file mode 100644
index 00000000000..f9eeea39f9b
--- /dev/null
+++ b/queue-4.19/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch
@@ -0,0 +1,67 @@
+From d6ce6d66076a69a7dd01cf8f87c571d7fb9b7b83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:54:30 +0300
+Subject: net: aquantia: Fix aq_vec_isr_legacy() return value
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 31aefe14bc9f56566041303d733fda511d3a1c3e ]
+
+The irqreturn_t type is an enum or an unsigned int in GCC.  That
+creates to problems because it can't detect if the
+self->aq_hw_ops->hw_irq_read() call fails and at the end the function
+always returns IRQ_HANDLED.
+
+drivers/net/ethernet/aquantia/atlantic/aq_vec.c:316 aq_vec_isr_legacy() warn: unsigned 'err' is never less than zero.
+drivers/net/ethernet/aquantia/atlantic/aq_vec.c:329 aq_vec_isr_legacy() warn: always true condition '(err >= 0) => (0-u32max >= 0)'
+
+Fixes: 970a2e9864b0 ("net: ethernet: aquantia: Vector operations")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+index 82582fa54d5d2..72aa2a4c4d666 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+@@ -309,15 +309,13 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
+ {
+ 	struct aq_vec_s *self = private;
+ 	u64 irq_mask = 0U;
+-	irqreturn_t err = 0;
++	int err;
+ 
+-	if (!self) {
+-		err = -EINVAL;
+-		goto err_exit;
+-	}
++	if (!self)
++		return IRQ_NONE;
+ 	err = self->aq_hw_ops->hw_irq_read(self->aq_hw, &irq_mask);
+ 	if (err < 0)
+-		goto err_exit;
++		return IRQ_NONE;
+ 
+ 	if (irq_mask) {
+ 		self->aq_hw_ops->hw_irq_disable(self->aq_hw,
+@@ -325,11 +323,10 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
+ 		napi_schedule(&self->napi);
+ 	} else {
+ 		self->aq_hw_ops->hw_irq_enable(self->aq_hw, 1U);
+-		err = IRQ_NONE;
++		return IRQ_NONE;
+ 	}
+ 
+-err_exit:
+-	return err >= 0 ? IRQ_HANDLED : IRQ_NONE;
++	return IRQ_HANDLED;
+ }
+ 
+ cpumask_t *aq_vec_get_affinity_mask(struct aq_vec_s *self)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-aquantia-fixed-instack-structure-overflow.patch b/queue-4.19/net-aquantia-fixed-instack-structure-overflow.patch
new file mode 100644
index 00000000000..cdb5aa1f770
--- /dev/null
+++ b/queue-4.19/net-aquantia-fixed-instack-structure-overflow.patch
@@ -0,0 +1,58 @@
+From 5e382e11aa47bd95c579b7f1074944340ad9025d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 12:10:09 +0000
+Subject: net: aquantia: fixed instack structure overflow
+
+From: Igor Russkikh <Igor.Russkikh@aquantia.com>
+
+[ Upstream commit 8006e3730b6e900319411e35cee85b4513d298df ]
+
+This is a real stack undercorruption found by kasan build.
+
+The issue did no harm normally because it only overflowed
+2 bytes after `bitary` array which on most architectures
+were mapped into `err` local.
+
+Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.")
+Signed-off-by: Nikita Danilov <nikita.danilov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 4 ++--
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+index 97addfa6f8956..dab5891b97145 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -207,8 +207,8 @@ static int hw_atl_a0_hw_rss_set(struct aq_hw_s *self,
+ 	u32 i = 0U;
+ 	u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ 	int err = 0;
+-	u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX *
+-					HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
++	u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX *
++		   HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
+ 
+ 	memset(bitary, 0, sizeof(bitary));
+ 
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 51cd1f98bcf07..c4f914a29c385 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -192,8 +192,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self,
+ 	u32 i = 0U;
+ 	u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ 	int err = 0;
+-	u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX *
+-					HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
++	u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX *
++		   HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
+ 
+ 	memset(bitary, 0, sizeof(bitary));
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch b/queue-4.19/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch
new file mode 100644
index 00000000000..f941c23c81d
--- /dev/null
+++ b/queue-4.19/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch
@@ -0,0 +1,48 @@
+From ac9d5efa9d10995a3b4d80ab17fa5a5b8f741073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 12:55:53 -0700
+Subject: net: avoid possible false sharing in sk_leave_memory_pressure()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 503978aca46124cd714703e180b9c8292ba50ba7 ]
+
+As mentioned in https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance
+a C compiler can legally transform :
+
+if (memory_pressure && *memory_pressure)
+        *memory_pressure = 0;
+
+to :
+
+if (memory_pressure)
+        *memory_pressure = 0;
+
+Fixes: 0604475119de ("tcp: add TCPMemoryPressuresChrono counter")
+Fixes: 180d8cd942ce ("foundations of per-cgroup memory pressure controlling.")
+Fixes: 3ab224be6d69 ("[NET] CORE: Introducing new memory accounting interface.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index bbde5f6a7dc91..b9ec14f2c729a 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2179,8 +2179,8 @@ static void sk_leave_memory_pressure(struct sock *sk)
+ 	} else {
+ 		unsigned long *memory_pressure = sk->sk_prot->memory_pressure;
+ 
+-		if (memory_pressure && *memory_pressure)
+-			*memory_pressure = 0;
++		if (memory_pressure && READ_ONCE(*memory_pressure))
++			WRITE_ONCE(*memory_pressure, 0);
+ 	}
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-axienet-fix-a-signedness-bug-in-probe.patch b/queue-4.19/net-axienet-fix-a-signedness-bug-in-probe.patch
new file mode 100644
index 00000000000..ce89305b58d
--- /dev/null
+++ b/queue-4.19/net-axienet-fix-a-signedness-bug-in-probe.patch
@@ -0,0 +1,37 @@
+From f6ef937e294936645387553222223a0209bc44e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:59:11 +0300
+Subject: net: axienet: fix a signedness bug in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 73e211e11be86715d66bd3c9d38b3c34b05fca9a ]
+
+The "lp->phy_mode" is an enum but in this context GCC treats it as an
+unsigned int so the error handling is never triggered.
+
+Fixes: ee06b1728b95 ("net: axienet: add support for standard phy-mode binding")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 28764268a44f8..b093f14eeec39 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1573,7 +1573,7 @@ static int axienet_probe(struct platform_device *pdev)
+ 		}
+ 	} else {
+ 		lp->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+-		if (lp->phy_mode < 0) {
++		if ((int)lp->phy_mode < 0) {
+ 			ret = -EINVAL;
+ 			goto free_netdev;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch b/queue-4.19/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
new file mode 100644
index 00000000000..89297038f14
--- /dev/null
+++ b/queue-4.19/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
@@ -0,0 +1,38 @@
+From bda0f6ce93b71e1e8ce9afc22c1fd743d8e6ea9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:56:04 +0300
+Subject: net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ]
+
+The "priv->phy_interface" variable is an enum and in this context GCC
+will treat it as unsigned so the error handling will never be
+triggered.
+
+Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 0bdbc72605e1f..49aa3b5ea57cc 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2470,7 +2470,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+ 
+ 	priv->phy_interface = of_get_phy_mode(dn);
+ 	/* Default to GMII interface mode */
+-	if (priv->phy_interface < 0)
++	if ((int)priv->phy_interface < 0)
+ 		priv->phy_interface = PHY_INTERFACE_MODE_GMII;
+ 
+ 	/* In the case of a fixed PHY, the DT node associated
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-core-support-xdp-generic-on-stacked-devices.patch b/queue-4.19/net-core-support-xdp-generic-on-stacked-devices.patch
new file mode 100644
index 00000000000..b4a9c29ec23
--- /dev/null
+++ b/queue-4.19/net-core-support-xdp-generic-on-stacked-devices.patch
@@ -0,0 +1,123 @@
+From ab11e6f32c7a8fa61446968c7a97c17732f44892 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 May 2019 11:47:31 -0700
+Subject: net: core: support XDP generic on stacked devices.
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 458bf2f224f04a513b0be972f8708e78ee2c986e ]
+
+When a device is stacked like (team, bonding, failsafe or netvsc) the
+XDP generic program for the parent device was not called.
+
+Move the call to XDP generic inside __netif_receive_skb_core where
+it can be done multiple times for stacked case.
+
+Fixes: d445516966dc ("net: xdp: support xdp generic on virtual devices")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 58 +++++++++++---------------------------------------
+ 1 file changed, 12 insertions(+), 46 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index a26d87073f714..935fe158cfaff 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4465,23 +4465,6 @@ static int netif_rx_internal(struct sk_buff *skb)
+ 
+ 	trace_netif_rx(skb);
+ 
+-	if (static_branch_unlikely(&generic_xdp_needed_key)) {
+-		int ret;
+-
+-		preempt_disable();
+-		rcu_read_lock();
+-		ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+-		rcu_read_unlock();
+-		preempt_enable();
+-
+-		/* Consider XDP consuming the packet a success from
+-		 * the netdev point of view we do not want to count
+-		 * this as an error.
+-		 */
+-		if (ret != XDP_PASS)
+-			return NET_RX_SUCCESS;
+-	}
+-
+ #ifdef CONFIG_RPS
+ 	if (static_key_false(&rps_needed)) {
+ 		struct rps_dev_flow voidflow, *rflow = &voidflow;
+@@ -4815,6 +4798,18 @@ another_round:
+ 
+ 	__this_cpu_inc(softnet_data.processed);
+ 
++	if (static_branch_unlikely(&generic_xdp_needed_key)) {
++		int ret2;
++
++		preempt_disable();
++		ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
++		preempt_enable();
++
++		if (ret2 != XDP_PASS)
++			return NET_RX_DROP;
++		skb_reset_mac_len(skb);
++	}
++
+ 	if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
+ 	    skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
+ 		skb = skb_vlan_untag(skb);
+@@ -5133,19 +5128,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
+ 	if (skb_defer_rx_timestamp(skb))
+ 		return NET_RX_SUCCESS;
+ 
+-	if (static_branch_unlikely(&generic_xdp_needed_key)) {
+-		int ret;
+-
+-		preempt_disable();
+-		rcu_read_lock();
+-		ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+-		rcu_read_unlock();
+-		preempt_enable();
+-
+-		if (ret != XDP_PASS)
+-			return NET_RX_DROP;
+-	}
+-
+ 	rcu_read_lock();
+ #ifdef CONFIG_RPS
+ 	if (static_key_false(&rps_needed)) {
+@@ -5166,7 +5148,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb)
+ 
+ static void netif_receive_skb_list_internal(struct list_head *head)
+ {
+-	struct bpf_prog *xdp_prog = NULL;
+ 	struct sk_buff *skb, *next;
+ 	struct list_head sublist;
+ 
+@@ -5179,21 +5160,6 @@ static void netif_receive_skb_list_internal(struct list_head *head)
+ 	}
+ 	list_splice_init(&sublist, head);
+ 
+-	if (static_branch_unlikely(&generic_xdp_needed_key)) {
+-		preempt_disable();
+-		rcu_read_lock();
+-		list_for_each_entry_safe(skb, next, head, list) {
+-			xdp_prog = rcu_dereference(skb->dev->xdp_prog);
+-			skb_list_del_init(skb);
+-			if (do_xdp_generic(xdp_prog, skb) == XDP_PASS)
+-				list_add_tail(&skb->list, &sublist);
+-		}
+-		rcu_read_unlock();
+-		preempt_enable();
+-		/* Put passed packets back on main list */
+-		list_splice_init(&sublist, head);
+-	}
+-
+ 	rcu_read_lock();
+ #ifdef CONFIG_RPS
+ 	if (static_key_false(&rps_needed)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch b/queue-4.19/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch
new file mode 100644
index 00000000000..144d3916998
--- /dev/null
+++ b/queue-4.19/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch
@@ -0,0 +1,85 @@
+From 9c3ff9a1f5f62f9f0d10022843a0c2385f94196e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 May 2019 16:33:23 -0700
+Subject: net: don't clear sock->sk early to avoid trouble in strparser
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 2b81f8161dfeda4017cef4f2498ccb64b13f0d61 ]
+
+af_inet sets sock->sk to NULL which trips strparser over:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000012
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP PTI
+CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.2.0-rc1-00139-g14629453a6d3 #21
+RIP: 0010:tcp_peek_len+0x10/0x60
+RSP: 0018:ffffc02e41c54b98 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: ffff9cf924c4e030 RCX: 0000000000000051
+RDX: 0000000000000000 RSI: 000000000000000c RDI: ffff9cf97128f480
+RBP: ffff9cf9365e0300 R08: ffff9cf94fe7d2c0 R09: 0000000000000000
+R10: 000000000000036b R11: ffff9cf939735e00 R12: ffff9cf91ad9ae40
+R13: ffff9cf924c4e000 R14: ffff9cf9a8fcbaae R15: 0000000000000020
+FS: 0000000000000000(0000) GS:ffff9cf9af7c0000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000012 CR3: 000000013920a003 CR4: 00000000003606e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <IRQ>
+ strp_data_ready+0x48/0x90
+ tls_data_ready+0x22/0xd0 [tls]
+ tcp_rcv_established+0x569/0x620
+ tcp_v4_do_rcv+0x127/0x1e0
+ tcp_v4_rcv+0xad7/0xbf0
+ ip_protocol_deliver_rcu+0x2c/0x1c0
+ ip_local_deliver_finish+0x41/0x50
+ ip_local_deliver+0x6b/0xe0
+ ? ip_protocol_deliver_rcu+0x1c0/0x1c0
+ ip_rcv+0x52/0xd0
+ ? ip_rcv_finish_core.isra.20+0x380/0x380
+ __netif_receive_skb_one_core+0x7e/0x90
+ netif_receive_skb_internal+0x42/0xf0
+ napi_gro_receive+0xed/0x150
+ nfp_net_poll+0x7a2/0xd30 [nfp]
+ ? kmem_cache_free_bulk+0x286/0x310
+ net_rx_action+0x149/0x3b0
+ __do_softirq+0xe3/0x30a
+ ? handle_irq_event_percpu+0x6a/0x80
+ irq_exit+0xe8/0xf0
+ do_IRQ+0x85/0xd0
+ common_interrupt+0xf/0xf
+ </IRQ>
+RIP: 0010:cpuidle_enter_state+0xbc/0x450
+
+To avoid this issue set sock->sk after sk_prot->close.
+My grepping and testing did not discover any code which
+would depend on the current behaviour.
+
+Fixes: c46234ebb4d1 ("tls: RX path for ktls")
+Reported-by: David Beckett <david.beckett@netronome.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/af_inet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 1fbe2f815474c..bbf3b3daa9994 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -424,8 +424,8 @@ int inet_release(struct socket *sock)
+ 		if (sock_flag(sk, SOCK_LINGER) &&
+ 		    !(current->flags & PF_EXITING))
+ 			timeout = sk->sk_lingertime;
+-		sock->sk = NULL;
+ 		sk->sk_prot->close(sk, timeout);
++		sock->sk = NULL;
+ 	}
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-avoid-null-pointer-when-failing-to-connect-t.patch b/queue-4.19/net-dsa-avoid-null-pointer-when-failing-to-connect-t.patch
new file mode 100644
index 00000000000..5098e4acc92
--- /dev/null
+++ b/queue-4.19/net-dsa-avoid-null-pointer-when-failing-to-connect-t.patch
@@ -0,0 +1,55 @@
+From 68aa9c6dcc5b8d13a54105fa398d7c9e960252d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Mar 2019 01:24:07 +0200
+Subject: net: dsa: Avoid null pointer when failing to connect to PHY
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit 6146dd453e235c487d85ae4dc6cc08978a1c890f ]
+
+When phylink_of_phy_connect fails, dsa_slave_phy_setup tries to save the
+day by connecting to an alternative PHY, none other than a PHY on the
+switch's internal MDIO bus, at an address equal to the port's index.
+
+However this does not take into consideration the scenario when the
+switch that failed to probe an external PHY does not have an internal
+MDIO bus at all.
+
+Fixes: aab9c4067d23 ("net: dsa: Plug in PHYLINK support")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/slave.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index b39720d0995d3..8ee28b6016d82 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1219,9 +1219,9 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
+ 		phy_flags = ds->ops->get_phy_flags(ds, dp->index);
+ 
+ 	ret = phylink_of_phy_connect(dp->pl, port_dn, phy_flags);
+-	if (ret == -ENODEV) {
+-		/* We could not connect to a designated PHY or SFP, so use the
+-		 * switch internal MDIO bus instead
++	if (ret == -ENODEV && ds->slave_mii_bus) {
++		/* We could not connect to a designated PHY or SFP, so try to
++		 * use the switch internal MDIO bus instead
+ 		 */
+ 		ret = dsa_slave_phy_connect(slave_dev, dp->index);
+ 		if (ret) {
+@@ -1233,7 +1233,7 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
+ 		}
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static struct lock_class_key dsa_slave_netdev_xmit_lock_key;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-b53-do-not-program-cpu-port-s-pvid.patch b/queue-4.19/net-dsa-b53-do-not-program-cpu-port-s-pvid.patch
new file mode 100644
index 00000000000..d4aa2bc668a
--- /dev/null
+++ b/queue-4.19/net-dsa-b53-do-not-program-cpu-port-s-pvid.patch
@@ -0,0 +1,37 @@
+From 8da974b480cc5691d62a667e6fd39fe16adf73cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 12:16:53 -0800
+Subject: net: dsa: b53: Do not program CPU port's PVID
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 10163aaee9671b01b2f4737922e1a4f43581047a ]
+
+The CPU port is special and does not need to obey VLAN restrictions as
+far as untagged traffic goes, also, having the CPU port be part of a
+particular PVID is against the idea of keeping it tagged in all VLANs.
+
+Fixes: ca8931948344 ("net: dsa: b53: Keep CPU port as tagged in all VLANs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 426ec1c05799a..9f21e710fc38b 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1175,7 +1175,7 @@ void b53_vlan_add(struct dsa_switch *ds, int port,
+ 		b53_fast_age_vlan(dev, vid);
+ 	}
+ 
+-	if (pvid) {
++	if (pvid && !dsa_is_cpu_port(ds, port)) {
+ 		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
+ 			    vlan->vid_end);
+ 		b53_fast_age_vlan(dev, vid);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-b53-fix-default-vlan-id.patch b/queue-4.19/net-dsa-b53-fix-default-vlan-id.patch
new file mode 100644
index 00000000000..c7ba98d7dcb
--- /dev/null
+++ b/queue-4.19/net-dsa-b53-fix-default-vlan-id.patch
@@ -0,0 +1,96 @@
+From 6610b3fde3b8f021c154f073556ce174731ce343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 12:16:49 -0800
+Subject: net: dsa: b53: Fix default VLAN ID
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit fea83353177a55540c71c140887737c282137aa2 ]
+
+We were not consistent in how the default VID of a given port was
+defined, b53_br_leave() would make sure the VLAN ID would be either 0/1
+depending on the switch generation, but b53_configure_vlan(), which is
+the default configuration would unconditionally set it to 1. The correct
+value is 1 for 5325/5365 series and 0 otherwise. To avoid repeating that
+mistake ever again, introduce a helper function: b53_default_pvid() to
+factor that out.
+
+Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 2d3a2cb026d26..bceda1e884426 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -622,15 +622,25 @@ static void b53_enable_mib(struct b53_device *dev)
+ 	b53_write8(dev, B53_MGMT_PAGE, B53_GLOBAL_CONFIG, gc);
+ }
+ 
++static u16 b53_default_pvid(struct b53_device *dev)
++{
++	if (is5325(dev) || is5365(dev))
++		return 1;
++	else
++		return 0;
++}
++
+ int b53_configure_vlan(struct dsa_switch *ds)
+ {
+ 	struct b53_device *dev = ds->priv;
+ 	struct b53_vlan vl = { 0 };
+-	int i;
++	int i, def_vid;
++
++	def_vid = b53_default_pvid(dev);
+ 
+ 	/* clear all vlan entries */
+ 	if (is5325(dev) || is5365(dev)) {
+-		for (i = 1; i < dev->num_vlans; i++)
++		for (i = def_vid; i < dev->num_vlans; i++)
+ 			b53_set_vlan_entry(dev, i, &vl);
+ 	} else {
+ 		b53_do_vlan_op(dev, VTA_CMD_CLEAR);
+@@ -640,7 +650,7 @@ int b53_configure_vlan(struct dsa_switch *ds)
+ 
+ 	b53_for_each_port(dev, i)
+ 		b53_write16(dev, B53_VLAN_PAGE,
+-			    B53_VLAN_PORT_DEF_TAG(i), 1);
++			    B53_VLAN_PORT_DEF_TAG(i), def_vid);
+ 
+ 	if (!is5325(dev) && !is5365(dev))
+ 		b53_set_jumbo(dev, dev->enable_jumbo, false);
+@@ -1142,12 +1152,8 @@ int b53_vlan_del(struct dsa_switch *ds, int port,
+ 
+ 		vl->members &= ~BIT(port);
+ 
+-		if (pvid == vid) {
+-			if (is5325(dev) || is5365(dev))
+-				pvid = 1;
+-			else
+-				pvid = 0;
+-		}
++		if (pvid == vid)
++			pvid = b53_default_pvid(dev);
+ 
+ 		if (untagged && !dsa_is_cpu_port(ds, port))
+ 			vl->untag &= ~(BIT(port));
+@@ -1460,10 +1466,7 @@ void b53_br_leave(struct dsa_switch *ds, int port, struct net_device *br)
+ 	b53_write16(dev, B53_PVLAN_PAGE, B53_PVLAN_PORT_MASK(port), pvlan);
+ 	dev->ports[port].vlan_ctl_mask = pvlan;
+ 
+-	if (is5325(dev) || is5365(dev))
+-		pvid = 1;
+-	else
+-		pvid = 0;
++	pvid = b53_default_pvid(dev);
+ 
+ 	/* Make this port join all VLANs without VLAN entries */
+ 	if (is58xx(dev)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-b53-properly-account-for-vlan-filtering.patch b/queue-4.19/net-dsa-b53-properly-account-for-vlan-filtering.patch
new file mode 100644
index 00000000000..a45a479bb4f
--- /dev/null
+++ b/queue-4.19/net-dsa-b53-properly-account-for-vlan-filtering.patch
@@ -0,0 +1,152 @@
+From 7e39a6a82dec7bfeebcda287325ebd03b661566f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 12:16:50 -0800
+Subject: net: dsa: b53: Properly account for VLAN filtering
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit dad8d7c6452b5b9f9828c9e2c7ca143205fd40c7 ]
+
+VLAN filtering can be built into the kernel, and also dynamically turned
+on/off through the bridge master device. Allow re-configuring the switch
+appropriately to account for that by deciding whether VLAN table
+(v_table) misses should lead to a drop or forward.
+
+Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 59 +++++++++++++++++++++++++++++---
+ drivers/net/dsa/b53/b53_priv.h   |  3 ++
+ 2 files changed, 57 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index bceda1e884426..426ec1c05799a 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -343,7 +343,8 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
+ 	b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_CTRL, mgmt);
+ }
+ 
+-static void b53_enable_vlan(struct b53_device *dev, bool enable)
++static void b53_enable_vlan(struct b53_device *dev, bool enable,
++			    bool enable_filtering)
+ {
+ 	u8 mgmt, vc0, vc1, vc4 = 0, vc5;
+ 
+@@ -368,8 +369,13 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
+ 		vc0 |= VC0_VLAN_EN | VC0_VID_CHK_EN | VC0_VID_HASH_VID;
+ 		vc1 |= VC1_RX_MCST_UNTAG_EN | VC1_RX_MCST_FWD_EN;
+ 		vc4 &= ~VC4_ING_VID_CHECK_MASK;
+-		vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
+-		vc5 |= VC5_DROP_VTABLE_MISS;
++		if (enable_filtering) {
++			vc4 |= VC4_ING_VID_VIO_DROP << VC4_ING_VID_CHECK_S;
++			vc5 |= VC5_DROP_VTABLE_MISS;
++		} else {
++			vc4 |= VC4_ING_VID_VIO_FWD << VC4_ING_VID_CHECK_S;
++			vc5 &= ~VC5_DROP_VTABLE_MISS;
++		}
+ 
+ 		if (is5325(dev))
+ 			vc0 &= ~VC0_RESERVED_1;
+@@ -419,6 +425,9 @@ static void b53_enable_vlan(struct b53_device *dev, bool enable)
+ 	}
+ 
+ 	b53_write8(dev, B53_CTRL_PAGE, B53_SWITCH_MODE, mgmt);
++
++	dev->vlan_enabled = enable;
++	dev->vlan_filtering_enabled = enable_filtering;
+ }
+ 
+ static int b53_set_jumbo(struct b53_device *dev, bool enable, bool allow_10_100)
+@@ -646,7 +655,7 @@ int b53_configure_vlan(struct dsa_switch *ds)
+ 		b53_do_vlan_op(dev, VTA_CMD_CLEAR);
+ 	}
+ 
+-	b53_enable_vlan(dev, false);
++	b53_enable_vlan(dev, false, dev->vlan_filtering_enabled);
+ 
+ 	b53_for_each_port(dev, i)
+ 		b53_write16(dev, B53_VLAN_PAGE,
+@@ -1081,6 +1090,46 @@ static void b53_adjust_link(struct dsa_switch *ds, int port,
+ 
+ int b53_vlan_filtering(struct dsa_switch *ds, int port, bool vlan_filtering)
+ {
++	struct b53_device *dev = ds->priv;
++	struct net_device *bridge_dev;
++	unsigned int i;
++	u16 pvid, new_pvid;
++
++	/* Handle the case were multiple bridges span the same switch device
++	 * and one of them has a different setting than what is being requested
++	 * which would be breaking filtering semantics for any of the other
++	 * bridge devices.
++	 */
++	b53_for_each_port(dev, i) {
++		bridge_dev = dsa_to_port(ds, i)->bridge_dev;
++		if (bridge_dev &&
++		    bridge_dev != dsa_to_port(ds, port)->bridge_dev &&
++		    br_vlan_enabled(bridge_dev) != vlan_filtering) {
++			netdev_err(bridge_dev,
++				   "VLAN filtering is global to the switch!\n");
++			return -EINVAL;
++		}
++	}
++
++	b53_read16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port), &pvid);
++	new_pvid = pvid;
++	if (dev->vlan_filtering_enabled && !vlan_filtering) {
++		/* Filtering is currently enabled, use the default PVID since
++		 * the bridge does not expect tagging anymore
++		 */
++		dev->ports[port].pvid = pvid;
++		new_pvid = b53_default_pvid(dev);
++	} else if (!dev->vlan_filtering_enabled && vlan_filtering) {
++		/* Filtering is currently disabled, restore the previous PVID */
++		new_pvid = dev->ports[port].pvid;
++	}
++
++	if (pvid != new_pvid)
++		b53_write16(dev, B53_VLAN_PAGE, B53_VLAN_PORT_DEF_TAG(port),
++			    new_pvid);
++
++	b53_enable_vlan(dev, dev->vlan_enabled, vlan_filtering);
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(b53_vlan_filtering);
+@@ -1096,7 +1145,7 @@ int b53_vlan_prepare(struct dsa_switch *ds, int port,
+ 	if (vlan->vid_end > dev->num_vlans)
+ 		return -ERANGE;
+ 
+-	b53_enable_vlan(dev, true);
++	b53_enable_vlan(dev, true, dev->vlan_filtering_enabled);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
+index df149756c2820..e87af5db0d6d8 100644
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -73,6 +73,7 @@ enum {
+ struct b53_port {
+ 	u16		vlan_ctl_mask;
+ 	struct ethtool_eee eee;
++	u16		pvid;
+ };
+ 
+ struct b53_vlan {
+@@ -118,6 +119,8 @@ struct b53_device {
+ 
+ 	unsigned int num_vlans;
+ 	struct b53_vlan *vlans;
++	bool vlan_enabled;
++	bool vlan_filtering_enabled;
+ 	unsigned int num_ports;
+ 	struct b53_port *ports;
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-fix-unintended-change-of-bridge-interface-st.patch b/queue-4.19/net-dsa-fix-unintended-change-of-bridge-interface-st.patch
new file mode 100644
index 00000000000..def88e6b54e
--- /dev/null
+++ b/queue-4.19/net-dsa-fix-unintended-change-of-bridge-interface-st.patch
@@ -0,0 +1,72 @@
+From cf04d277df0ecae3538b79de6b3f1177ff41dbcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 10:32:52 +0000
+Subject: net: dsa: fix unintended change of bridge interface STP state
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 9c2054a5cf415a9dc32c91ffde78399955deb571 ]
+
+When a DSA port is added to a bridge and brought up, the resulting STP
+state programmed into the hardware depends on the order that these
+operations are performed.  However, the Linux bridge code believes that
+the port is in disabled mode.
+
+If the DSA port is first added to a bridge and then brought up, it will
+be in blocking mode.  If it is brought up and then added to the bridge,
+it will be in disabled mode.
+
+This difference is caused by DSA always setting the STP mode in
+dsa_port_enable() whether or not this port is part of a bridge.  Since
+bridge always sets the STP state when the port is added, brought up or
+taken down, it is unnecessary for us to manipulate the STP state.
+
+Apparently, this code was copied from Rocker, and the very next day a
+similar fix for Rocker was merged but was not propagated to DSA.  See
+e47172ab7e41 ("rocker: put port in FORWADING state after leaving bridge")
+
+Fixes: b73adef67765 ("net: dsa: integrate with SWITCHDEV for HW bridging")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/port.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/dsa/port.c b/net/dsa/port.c
+index ed0595459df13..ea7efc86b9d7c 100644
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -69,7 +69,6 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
+ 
+ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
+ {
+-	u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING;
+ 	struct dsa_switch *ds = dp->ds;
+ 	int port = dp->index;
+ 	int err;
+@@ -80,7 +79,8 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
+ 			return err;
+ 	}
+ 
+-	dsa_port_set_state_now(dp, stp_state);
++	if (!dp->bridge_dev)
++		dsa_port_set_state_now(dp, BR_STATE_FORWARDING);
+ 
+ 	return 0;
+ }
+@@ -90,7 +90,8 @@ void dsa_port_disable(struct dsa_port *dp, struct phy_device *phy)
+ 	struct dsa_switch *ds = dp->ds;
+ 	int port = dp->index;
+ 
+-	dsa_port_set_state_now(dp, BR_STATE_DISABLED);
++	if (!dp->bridge_dev)
++		dsa_port_set_state_now(dp, BR_STATE_DISABLED);
+ 
+ 	if (ds->ops->port_disable)
+ 		ds->ops->port_disable(ds, port, phy);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch b/queue-4.19/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
new file mode 100644
index 00000000000..86e86506c4d
--- /dev/null
+++ b/queue-4.19/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
@@ -0,0 +1,64 @@
+From 1e8b8326b4300fbc7503fe43b63fd42abb420001 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 12:29:43 +0530
+Subject: net: dsa: qca8k: Enable delay for RGMII_ID mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ]
+
+RGMII_ID specifies that we should have internal delay, so resurrect the
+delay addition routine but under the RGMII_ID mode.
+
+Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode")
+Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca8k.c | 12 ++++++++++++
+ drivers/net/dsa/qca8k.h |  1 +
+ 2 files changed, 13 insertions(+)
+
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index 33232cc9fb04d..6c04f32e96418 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -451,6 +451,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
+ 		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+ 			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+ 		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		/* RGMII_ID needs internal delay. This is enabled through
++		 * PORT5_PAD_CTRL for all ports, rather than individual port
++		 * registers
++		 */
++		qca8k_write(priv, reg,
++			    QCA8K_PORT_PAD_RGMII_EN |
++			    QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
++			    QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
++		qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
++			    QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
++		break;
+ 	case PHY_INTERFACE_MODE_SGMII:
+ 		qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
+ 		break;
+diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
+index 613fe5c50236c..d146e54c8a6c6 100644
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -40,6 +40,7 @@
+ 						((0x8 + (x & 0x3)) << 22)
+ #define   QCA8K_PORT_PAD_RGMII_RX_DELAY(x)		\
+ 						((0x10 + (x & 0x3)) << 20)
++#define   QCA8K_MAX_DELAY				3
+ #define   QCA8K_PORT_PAD_RGMII_RX_DELAY_EN		BIT(24)
+ #define   QCA8K_PORT_PAD_SGMII_EN			BIT(7)
+ #define QCA8K_REG_MODULE_EN				0x030
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ena-fix-ena_com_fill_hash_function-implementatio.patch b/queue-4.19/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
new file mode 100644
index 00000000000..ac55a7d68a0
--- /dev/null
+++ b/queue-4.19/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
@@ -0,0 +1,35 @@
+From 3402373f0ea42567fe33510d09d3a1093e29311a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:09 +0300
+Subject: net: ena: fix ena_com_fill_hash_function() implementation
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ]
+
+ena_com_fill_hash_function() didn't configure the rss->hash_func.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 005882c402625..92261c946e2a3 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2093,6 +2093,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
+ 		return -EINVAL;
+ 	}
+ 
++	rss->hash_func = func;
+ 	rc = ena_com_set_hash_function(ena_dev);
+ 
+ 	/* Restore the old function */
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ena-fix-free-napi-resources-when-ena_up-fails.patch b/queue-4.19/net-ena-fix-free-napi-resources-when-ena_up-fails.patch
new file mode 100644
index 00000000000..1c00c1c118e
--- /dev/null
+++ b/queue-4.19/net-ena-fix-free-napi-resources-when-ena_up-fails.patch
@@ -0,0 +1,38 @@
+From 27503c41be7b65bd011952d855cf06f52ab57472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:05 +0300
+Subject: net: ena: fix: Free napi resources when ena_up() fails
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ]
+
+ena_up() calls ena_init_napi() but does not call ena_del_napi() in
+case of failure. This causes a segmentation fault upon rmmod when
+netif_napi_del() is called. Fix this bug by calling ena_del_napi()
+before returning error from ena_up().
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index e26c195fec83b..9afb19ebba580 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1800,6 +1800,7 @@ err_setup_rx:
+ err_setup_tx:
+ 	ena_free_io_irq(adapter);
+ err_req_irq:
++	ena_del_napi(adapter);
+ 
+ 	return rc;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ena-fix-incorrect-test-of-supported-hash-functio.patch b/queue-4.19/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
new file mode 100644
index 00000000000..cbac60d63de
--- /dev/null
+++ b/queue-4.19/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
@@ -0,0 +1,40 @@
+From 3aad333f1ab36d572bc3454efdee2202c4b9d492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:06 +0300
+Subject: net: ena: fix incorrect test of supported hash function
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ]
+
+ena_com_set_hash_function() tests if a hash function is supported
+by the device before setting it.
+The test returns the opposite result than needed.
+Reverse the condition to return the correct value.
+Also use the BIT macro instead of inline shift.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 7635c38e77dd0..005882c402625 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2008,7 +2008,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
+ 	if (unlikely(ret))
+ 		return ret;
+ 
+-	if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
++	if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
+ 		pr_err("Func hash %d isn't supported by device, abort\n",
+ 		       rss->hash_func);
+ 		return -EOPNOTSUPP;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch b/queue-4.19/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
new file mode 100644
index 00000000000..17314070d3b
--- /dev/null
+++ b/queue-4.19/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
@@ -0,0 +1,39 @@
+From 10cd6b6a556cac5dc3efe0afba45c695e4b5f713 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:03 +0300
+Subject: net: ena: fix swapped parameters when calling
+ ena_com_indirect_table_fill_entry
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ]
+
+second parameter should be the index of the table rather than the value.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Saeed Bshara <saeedb@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 521607bc43937..eb9e07fa427ee 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -695,8 +695,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
+ 	if (indir) {
+ 		for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
+ 			rc = ena_com_indirect_table_fill_entry(ena_dev,
+-							       ENA_IO_RXQ_IDX(indir[i]),
+-							       i);
++							       i,
++							       ENA_IO_RXQ_IDX(indir[i]));
+ 			if (unlikely(rc)) {
+ 				netif_err(adapter, drv, netdev,
+ 					  "Cannot fill indirect table (index is too large)\n");
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch b/queue-4.19/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
new file mode 100644
index 00000000000..21894cebf0c
--- /dev/null
+++ b/queue-4.19/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
@@ -0,0 +1,37 @@
+From d1dfc7e416a291bccd35384aa9b1a3b98d5bff31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:05:54 +0300
+Subject: net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ]
+
+The "gmac->phy_mode" variable is an enum and in this context GCC will
+treat it as an unsigned int so the error handling will never be
+triggered.
+
+Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 2c6d7c69c8f74..0d21082ceb93d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -191,7 +191,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
+ 	struct device *dev = &gmac->pdev->dev;
+ 
+ 	gmac->phy_mode = of_get_phy_mode(dev->of_node);
+-	if (gmac->phy_mode < 0) {
++	if ((int)gmac->phy_mode < 0) {
+ 		dev_err(dev, "missing phy mode property\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-fix-bpf_xdp_adjust_head-regression-for-generic-x.patch b/queue-4.19/net-fix-bpf_xdp_adjust_head-regression-for-generic-x.patch
new file mode 100644
index 00000000000..90927e395c6
--- /dev/null
+++ b/queue-4.19/net-fix-bpf_xdp_adjust_head-regression-for-generic-x.patch
@@ -0,0 +1,57 @@
+From d2da94f19977d5a08b6b2f9cde56d54caeba49e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 20:00:31 +0200
+Subject: net: fix bpf_xdp_adjust_head regression for generic-XDP
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 065af355470519bd184019a93ac579f22b036045 ]
+
+When generic-XDP was moved to a later processing step by commit
+458bf2f224f0 ("net: core: support XDP generic on stacked devices.")
+a regression was introduced when using bpf_xdp_adjust_head.
+
+The issue is that after this commit the skb->network_header is now
+changed prior to calling generic XDP and not after. Thus, if the header
+is changed by XDP (via bpf_xdp_adjust_head), then skb->network_header
+also need to be updated again.  Fix by calling skb_reset_network_header().
+
+Fixes: 458bf2f224f0 ("net: core: support XDP generic on stacked devices.")
+Reported-by: Brandon Cazander <brandon.cazander@multapplied.net>
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 935fe158cfaff..73ebacabfde8d 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4349,12 +4349,17 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
+ 
+ 	act = bpf_prog_run_xdp(xdp_prog, xdp);
+ 
++	/* check if bpf_xdp_adjust_head was used */
+ 	off = xdp->data - orig_data;
+-	if (off > 0)
+-		__skb_pull(skb, off);
+-	else if (off < 0)
+-		__skb_push(skb, -off);
+-	skb->mac_header += off;
++	if (off) {
++		if (off > 0)
++			__skb_pull(skb, off);
++		else if (off < 0)
++			__skb_push(skb, -off);
++
++		skb->mac_header += off;
++		skb_reset_network_header(skb);
++	}
+ 
+ 	/* check if bpf_xdp_adjust_tail was used. it can only "shrink"
+ 	 * pckt.
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch b/queue-4.19/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
new file mode 100644
index 00000000000..971b5c2e31e
--- /dev/null
+++ b/queue-4.19/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
@@ -0,0 +1,36 @@
+From f6c02fe7396973c11ba48e9fa07197584edb6c7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:55:32 +0300
+Subject: net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ]
+
+The "priv->phy_mode" variable is an enum and in this context GCC will
+treat it as unsigned to the error handling will never trigger.
+
+Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index 471805ea363b6..b63871ef8a403 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -1201,7 +1201,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
+ 		goto err_free_mdio;
+ 
+ 	priv->phy_mode = of_get_phy_mode(node);
+-	if (priv->phy_mode < 0) {
++	if ((int)priv->phy_mode < 0) {
+ 		netdev_err(ndev, "not find phy-mode\n");
+ 		ret = -EINVAL;
+ 		goto err_mdiobus;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-add-error-handler-for-hns3_nic_init_vector_.patch b/queue-4.19/net-hns3-add-error-handler-for-hns3_nic_init_vector_.patch
new file mode 100644
index 00000000000..0241a14fede
--- /dev/null
+++ b/queue-4.19/net-hns3-add-error-handler-for-hns3_nic_init_vector_.patch
@@ -0,0 +1,58 @@
+From 602ab149cb80d21f4cafc64319aa998d2933150c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 21:50:43 +0800
+Subject: net: hns3: add error handler for hns3_nic_init_vector_data()
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit ece4bf46e98c9f3775a488f3932a531508d3b1a2 ]
+
+When hns3_nic_init_vector_data() fails to map ring to vector,
+it should cancel the netif_napi_add() that has been successfully
+done and then exits.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 1aaf6e2a3b39d..9df807ec8c840 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2642,7 +2642,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ 	struct hnae3_handle *h = priv->ae_handle;
+ 	struct hns3_enet_tqp_vector *tqp_vector;
+ 	int ret = 0;
+-	u16 i;
++	int i;
+ 
+ 	for (i = 0; i < priv->vector_num; i++) {
+ 		tqp_vector = &priv->tqp_vector[i];
+@@ -2687,13 +2687,19 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ 		hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain);
+ 
+ 		if (ret)
+-			return ret;
++			goto map_ring_fail;
+ 
+ 		netif_napi_add(priv->netdev, &tqp_vector->napi,
+ 			       hns3_nic_common_poll, NAPI_POLL_WEIGHT);
+ 	}
+ 
+ 	return 0;
++
++map_ring_fail:
++	while (i--)
++		netif_napi_del(&priv->tqp_vector[i].napi);
++
++	return ret;
+ }
+ 
+ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-a-memory-leak-issue-for-hclge_map_unmap.patch b/queue-4.19/net-hns3-fix-a-memory-leak-issue-for-hclge_map_unmap.patch
new file mode 100644
index 00000000000..168828adb4f
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-a-memory-leak-issue-for-hclge_map_unmap.patch
@@ -0,0 +1,48 @@
+From a662dda21f62500cf9bc3c1e92e1183e8e903449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 May 2019 17:03:02 +0800
+Subject: net: hns3: fix a memory leak issue for
+ hclge_map_unmap_ring_to_vf_vector
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 49f971bd308571fe466687227130a7082b662d0e ]
+
+When hclge_bind_ring_with_vector() fails,
+hclge_map_unmap_ring_to_vf_vector() returns the error
+directly, so nobody will free the memory allocated by
+hclge_get_ring_chain_from_mbx().
+
+So hclge_free_vector_ring_chain() should be called no matter
+hclge_bind_ring_with_vector() fails or not.
+
+Fixes: 84e095d64ed9 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+index e08e82020402a..997ca79ed892b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+@@ -181,12 +181,10 @@ static int hclge_map_unmap_ring_to_vf_vector(struct hclge_vport *vport, bool en,
+ 		return ret;
+ 
+ 	ret = hclge_bind_ring_with_vector(vport, vector_id, en, &ring_chain);
+-	if (ret)
+-		return ret;
+ 
+ 	hclge_free_vector_ring_chain(&ring_chain);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int hclge_set_vf_promisc_mode(struct hclge_vport *vport,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-bug-of-ethtool_ops.get_channels-for-vf.patch b/queue-4.19/net-hns3-fix-bug-of-ethtool_ops.get_channels-for-vf.patch
new file mode 100644
index 00000000000..b8815fc4a5e
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-bug-of-ethtool_ops.get_channels-for-vf.patch
@@ -0,0 +1,51 @@
+From 10a3a6823c1116b2501ad5cab5eb56e2237379b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 07:39:32 +0800
+Subject: net: hns3: fix bug of ethtool_ops.get_channels for VF
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 8be7362186bd5ccb5f6f72be49751ad2778e2636 ]
+
+The current code returns the number of all queues that can be used and
+the number of queues that have been allocated, which is incorrect.
+What should be returned is the number of queues allocated for each enabled
+TC and the number of queues that can be allocated.
+
+This patch fixes it.
+
+Fixes: 849e46077689 ("net: hns3: add ethtool_ops.get_channels support for VF")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 67db19709deaa..fd5375b5991bb 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1957,7 +1957,8 @@ static u32 hclgevf_get_max_channels(struct hclgevf_dev *hdev)
+ 	struct hnae3_handle *nic = &hdev->nic;
+ 	struct hnae3_knic_private_info *kinfo = &nic->kinfo;
+ 
+-	return min_t(u32, hdev->rss_size_max * kinfo->num_tc, hdev->num_tqps);
++	return min_t(u32, hdev->rss_size_max,
++		     hdev->num_tqps / kinfo->num_tc);
+ }
+ 
+ /**
+@@ -1978,7 +1979,7 @@ static void hclgevf_get_channels(struct hnae3_handle *handle,
+ 	ch->max_combined = hclgevf_get_max_channels(hdev);
+ 	ch->other_count = 0;
+ 	ch->max_other = 0;
+-	ch->combined_count = hdev->num_tqps;
++	ch->combined_count = handle->kinfo.rss_size;
+ }
+ 
+ static void hclgevf_get_tqps_and_rss_info(struct hnae3_handle *handle,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch b/queue-4.19/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch
new file mode 100644
index 00000000000..66079b02fe3
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch
@@ -0,0 +1,55 @@
+From f5ccc4f0f305b6dad8bd1dd27e9b33d223629996 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 19:37:48 +0800
+Subject: net: hns3: fix error handling int the hns3_get_vector_ring_chain
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit cda69d244585bc4497d3bb878c22fe2b6ad647c1 ]
+
+When hns3_get_vector_ring_chain() failed in the
+hns3_nic_init_vector_data(), it should do the error handling instead
+of return directly.
+
+Also, cur_chain should be freed instead of chain and head->next should
+be set to NULL in error handling of hns3_get_vector_ring_chain.
+
+This patch fixes them.
+
+Fixes: 73b907a083b8 ("net: hns3: bugfix for buffer not free problem during resetting")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 9df807ec8c840..10fa7f5df57e7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2605,9 +2605,10 @@ err_free_chain:
+ 	cur_chain = head->next;
+ 	while (cur_chain) {
+ 		chain = cur_chain->next;
+-		devm_kfree(&pdev->dev, chain);
++		devm_kfree(&pdev->dev, cur_chain);
+ 		cur_chain = chain;
+ 	}
++	head->next = NULL;
+ 
+ 	return -ENOMEM;
+ }
+@@ -2679,7 +2680,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ 		ret = hns3_get_vector_ring_chain(tqp_vector,
+ 						 &vector_ring_chain);
+ 		if (ret)
+-			return ret;
++			goto map_ring_fail;
+ 
+ 		ret = h->ae_algo->ops->map_ring_to_vector(h,
+ 			tqp_vector->vector_irq, &vector_ring_chain);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-error-vf-index-when-setting-vlan-offloa.patch b/queue-4.19/net-hns3-fix-error-vf-index-when-setting-vlan-offloa.patch
new file mode 100644
index 00000000000..5b66efc08fb
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-error-vf-index-when-setting-vlan-offloa.patch
@@ -0,0 +1,76 @@
+From d778ffd83711c91914d3f2ed8a8676d0b131924a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 21:31:36 +0800
+Subject: net: hns3: fix error VF index when setting VLAN offload
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit d9c0f2756a33833b2653f7a3612814fa5f52a568 ]
+
+In original codes, the VF index used incorrectly in function
+hclge_set_vlan_rx_offload_cfg() and hclge_set_vlan_rx_offload_cfg().
+When VF id is greater than 8, for example 9, it will set the
+same bit with VF id 1.
+
+This patch fixes it by using  vport->vport_id % HCLGE_VF_NUM_PER_CMD /
+HCLGE_VF_NUM_PER_BYTE as the array index, instead of vport->vport_id /
+HCLGE_VF_NUM_PER_CMD.
+
+Fixes: 052ece6dc19c ("net: hns3: add ethtool related offload command")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 4b9f898a1620c..d575dd9a329d9 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4833,6 +4833,7 @@ static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
+ 	struct hclge_vport_vtag_tx_cfg_cmd *req;
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_desc desc;
++	u16 bmap_index;
+ 	int status;
+ 
+ 	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_TX_CFG, false);
+@@ -4855,8 +4856,10 @@ static int hclge_set_vlan_tx_offload_cfg(struct hclge_vport *vport)
+ 	hnae3_set_bit(req->vport_vlan_cfg, HCLGE_CFG_NIC_ROCE_SEL_B, 0);
+ 
+ 	req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD;
+-	req->vf_bitmap[req->vf_offset] =
+-		1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
++	bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD /
++			HCLGE_VF_NUM_PER_BYTE;
++	req->vf_bitmap[bmap_index] =
++		1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
+ 
+ 	status = hclge_cmd_send(&hdev->hw, &desc, 1);
+ 	if (status)
+@@ -4873,6 +4876,7 @@ static int hclge_set_vlan_rx_offload_cfg(struct hclge_vport *vport)
+ 	struct hclge_vport_vtag_rx_cfg_cmd *req;
+ 	struct hclge_dev *hdev = vport->back;
+ 	struct hclge_desc desc;
++	u16 bmap_index;
+ 	int status;
+ 
+ 	hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_VLAN_PORT_RX_CFG, false);
+@@ -4888,8 +4892,10 @@ static int hclge_set_vlan_rx_offload_cfg(struct hclge_vport *vport)
+ 		      vcfg->vlan2_vlan_prionly ? 1 : 0);
+ 
+ 	req->vf_offset = vport->vport_id / HCLGE_VF_NUM_PER_CMD;
+-	req->vf_bitmap[req->vf_offset] =
+-		1 << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
++	bmap_index = vport->vport_id % HCLGE_VF_NUM_PER_CMD /
++			HCLGE_VF_NUM_PER_BYTE;
++	req->vf_bitmap[bmap_index] =
++		1U << (vport->vport_id % HCLGE_VF_NUM_PER_BYTE);
+ 
+ 	status = hclge_cmd_send(&hdev->hw, &desc, 1);
+ 	if (status)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch b/queue-4.19/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch
new file mode 100644
index 00000000000..7e82cc355cf
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch
@@ -0,0 +1,41 @@
+From 7c8466576e949fcb2a2a9c74155a325782975dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2019 21:48:39 +0800
+Subject: net: hns3: fix for vport->bw_limit overflow problem
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 2566f10676ba996b745e138f54f3e2f974311692 ]
+
+When setting vport->bw_limit to hdev->tm_info.pg_info[0].bw_limit
+in hclge_tm_vport_tc_info_update, vport->bw_limit can be as big as
+HCLGE_ETHER_MAX_RATE (100000), which can not fit into u16 (65535).
+
+So this patch fixes it by using u32 for vport->bw_limit.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 260b1e7796908..d14b7018fdf34 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -600,7 +600,7 @@ struct hclge_vport {
+ 	u16 alloc_rss_size;
+ 
+ 	u16 qs_offset;
+-	u16 bw_limit;		/* VSI BW Limit (0 = disabled) */
++	u32 bw_limit;		/* VSI BW Limit (0 = disabled) */
+ 	u8  dwrr;
+ 
+ 	struct hclge_tx_vtag_cfg  txvlan_cfg;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-loop-condition-of-hns3_get_tx_timeo_que.patch b/queue-4.19/net-hns3-fix-loop-condition-of-hns3_get_tx_timeo_que.patch
new file mode 100644
index 00000000000..cc32f53dd90
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-loop-condition-of-hns3_get_tx_timeo_que.patch
@@ -0,0 +1,39 @@
+From f159e89608f0b81327835e6c68d443f08b568ec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Apr 2019 11:05:41 +0800
+Subject: net: hns3: fix loop condition of hns3_get_tx_timeo_queue_info()
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit fa6c4084b98b82c98cada0f0d5c9f8577579f962 ]
+
+In function hns3_get_tx_timeo_queue_info(), it should use
+netdev->num_tx_queues, instead of netdve->real_num_tx_queues
+as the loop limitation.
+
+Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 10fa7f5df57e7..3eb8b85f6afb6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1464,7 +1464,7 @@ static bool hns3_get_tx_timeo_queue_info(struct net_device *ndev)
+ 	int i;
+ 
+ 	/* Find the stopped queue the same way the stack does */
+-	for (i = 0; i < ndev->real_num_tx_queues; i++) {
++	for (i = 0; i < ndev->num_tx_queues; i++) {
+ 		struct netdev_queue *q;
+ 		unsigned long trans_start;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-hns3-fix-wrong-combined-count-returned-by-ethtoo.patch b/queue-4.19/net-hns3-fix-wrong-combined-count-returned-by-ethtoo.patch
new file mode 100644
index 00000000000..07e185a79b8
--- /dev/null
+++ b/queue-4.19/net-hns3-fix-wrong-combined-count-returned-by-ethtoo.patch
@@ -0,0 +1,55 @@
+From 40ad2f030d6785b607bdaf4196fd76d39202fb55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jan 2019 16:13:12 +0800
+Subject: net: hns3: fix wrong combined count returned by ethtool -l
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit c3b9c50d1567aa12be4448fe85b09626eba2499c ]
+
+The current code returns the number of all queues that can be used and
+the number of queues that have been allocated, which is incorrect.
+What should be returned is the number of queues allocated for each enabled
+TC and the number of queues that can be allocated.
+
+This patch fixes it.
+
+Fixes: 482d2e9c1cc7 ("net: hns3: add support to query tqps number")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index f8cc8d1f0b209..4b9f898a1620c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -5922,18 +5922,17 @@ static u32 hclge_get_max_channels(struct hnae3_handle *handle)
+ 	struct hclge_vport *vport = hclge_get_vport(handle);
+ 	struct hclge_dev *hdev = vport->back;
+ 
+-	return min_t(u32, hdev->rss_size_max * kinfo->num_tc, hdev->num_tqps);
++	return min_t(u32, hdev->rss_size_max,
++		     vport->alloc_tqps / kinfo->num_tc);
+ }
+ 
+ static void hclge_get_channels(struct hnae3_handle *handle,
+ 			       struct ethtool_channels *ch)
+ {
+-	struct hclge_vport *vport = hclge_get_vport(handle);
+-
+ 	ch->max_combined = hclge_get_max_channels(handle);
+ 	ch->other_count = 1;
+ 	ch->max_other = 1;
+-	ch->combined_count = vport->alloc_tqps;
++	ch->combined_count = handle->kinfo.rss_size;
+ }
+ 
+ static void hclge_get_tqps_and_rss_info(struct hnae3_handle *handle,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mlx5-delete-unused-fpga-qpn-variable.patch b/queue-4.19/net-mlx5-delete-unused-fpga-qpn-variable.patch
new file mode 100644
index 00000000000..b077b8543c2
--- /dev/null
+++ b/queue-4.19/net-mlx5-delete-unused-fpga-qpn-variable.patch
@@ -0,0 +1,49 @@
+From d047726482d54125a3f40d3e4a494cd619c66eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Feb 2019 15:21:28 +0200
+Subject: net/mlx5: Delete unused FPGA QPN variable
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 566428375a53619196e31803130dd1a7010c4d7f ]
+
+fpga_qpn was assigned but never used and compilation with W=1
+produced the following warning:
+
+drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c: In function _mlx5_fpga_event_:
+drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c:320:6: warning:
+variable _fpga_qpn_ set but not used [-Wunused-but-set-variable]
+  u32 fpga_qpn;
+      ^~~~~~~~
+
+Fixes: 98db16bab59f ("net/mlx5: FPGA, Handle QP error event")
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+index 436a8136f26ff..310f9e7d83200 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c
+@@ -289,7 +289,6 @@ void mlx5_fpga_event(struct mlx5_core_dev *mdev, u8 event, void *data)
+ 	const char *event_name;
+ 	bool teardown = false;
+ 	unsigned long flags;
+-	u32 fpga_qpn;
+ 	u8 syndrome;
+ 
+ 	switch (event) {
+@@ -300,7 +299,6 @@ void mlx5_fpga_event(struct mlx5_core_dev *mdev, u8 event, void *data)
+ 	case MLX5_EVENT_TYPE_FPGA_QP_ERROR:
+ 		syndrome = MLX5_GET(fpga_qp_error_event, data, syndrome);
+ 		event_name = mlx5_fpga_qp_syndrome_to_string(syndrome);
+-		fpga_qpn = MLX5_GET(fpga_qp_error_event, data, fpga_qpn);
+ 		break;
+ 	default:
+ 		mlx5_fpga_warn_ratelimited(fdev, "Unexpected event %u\n",
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch b/queue-4.19/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
new file mode 100644
index 00000000000..c39ef947adb
--- /dev/null
+++ b/queue-4.19/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
@@ -0,0 +1,36 @@
+From e22c5d1dd7329be229f39b79f4cb0313f61ebc5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 14:40:13 +0300
+Subject: net/mlx5: Fix mlx5_ifc_query_lag_out_bits
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit ea77388b02270b0af8dc57f668f311235ea068f0 ]
+
+Remove the "reserved_at_40" field to match the device specification.
+
+Fixes: 84df61ebc69b ("net/mlx5: Add HW interfaces used by LAG")
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 177f11c96187b..76b76b6aa83d0 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -9053,8 +9053,6 @@ struct mlx5_ifc_query_lag_out_bits {
+ 
+ 	u8         syndrome[0x20];
+ 
+-	u8         reserved_at_40[0x40];
+-
+ 	struct mlx5_ifc_lagc_bits ctx;
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mlx5-fix-multiple-updates-of-steering-rules-in-p.patch b/queue-4.19/net-mlx5-fix-multiple-updates-of-steering-rules-in-p.patch
new file mode 100644
index 00000000000..86d6b475c5a
--- /dev/null
+++ b/queue-4.19/net-mlx5-fix-multiple-updates-of-steering-rules-in-p.patch
@@ -0,0 +1,49 @@
+From e89ff1d54f058122b13f9cc652526413f4bdd35f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jan 2019 14:56:01 +0200
+Subject: net/mlx5: Fix multiple updates of steering rules in parallel
+
+From: Eli Britstein <elibr@mellanox.com>
+
+[ Upstream commit 6237634d8fcc65c9e3348382910e7cdb15084c68 ]
+
+There might be a condition where the fte found is not active yet. In
+this case we should not use it, but continue to search for another, or
+allocate a new one.
+
+Fixes: bd71b08ec2ee ("net/mlx5: Support multiple updates of steering rules in parallel")
+Signed-off-by: Eli Britstein <elibr@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 82a53317285d0..b16e0f45d28c5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -469,6 +469,7 @@ static void del_hw_fte(struct fs_node *node)
+ 			mlx5_core_warn(dev,
+ 				       "flow steering can't delete fte in index %d of flow group id %d\n",
+ 				       fte->index, fg->id);
++		node->active = 0;
+ 	}
+ }
+ 
+@@ -1597,6 +1598,11 @@ lookup_fte_locked(struct mlx5_flow_group *g,
+ 		fte_tmp = NULL;
+ 		goto out;
+ 	}
++	if (!fte_tmp->node.active) {
++		tree_put_node(&fte_tmp->node);
++		fte_tmp = NULL;
++		goto out;
++	}
+ 
+ 	nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD);
+ out:
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch b/queue-4.19/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch
new file mode 100644
index 00000000000..238d55c25b8
--- /dev/null
+++ b/queue-4.19/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch
@@ -0,0 +1,82 @@
+From a9b88f6dfd95f1dd3abe1dd27dbab3e87bcbdd44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 19:21:21 +0200
+Subject: net/mlx5: Take lock with IRQs disabled to avoid deadlock
+
+From: Moni Shoua <monis@mellanox.com>
+
+[ Upstream commit 33814e5d127e21f53b52e17b0722c1b57d4f4d29 ]
+
+The lock in qp_table might be taken from process context or from
+interrupt context. This may lead to a deadlock unless it is taken with
+IRQs disabled.
+
+Discovered by lockdep
+
+================================
+WARNING: inconsistent lock state
+4.20.0-rc6
+--------------------------------
+inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W}
+
+python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes:
+00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core]
+{HARDIRQ-ON-W} state was registered at:
+  _raw_spin_lock+0x33/0x70
+  mlx5_get_rsc+0x1a/0x50 [mlx5_core]
+  mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib]
+  process_one_work+0x90c/0x1820
+  worker_thread+0x87/0xbb0
+  kthread+0x320/0x3e0
+  ret_from_fork+0x24/0x30
+irq event stamp: 103928
+hardirqs last  enabled at (103927): [] nk+0x1a/0x1c
+hardirqs last disabled at (103928): [] unk+0x1a/0x1c
+softirqs last  enabled at (103924): [] tcp_sendmsg+0x31/0x40
+softirqs last disabled at (103922): [] 80
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+       CPU0
+       ----
+  lock(&(&table->lock)->rlock#2);
+
+    lock(&(&table->lock)->rlock#2);
+
+ *** DEADLOCK ***
+
+Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/qp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+index f33707ce8b6b0..479ac21cdbc69 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *mlx5_get_rsc(struct mlx5_core_dev *dev,
+ {
+ 	struct mlx5_qp_table *table = &dev->priv.qp_table;
+ 	struct mlx5_core_rsc_common *common;
++	unsigned long flags;
+ 
+-	spin_lock(&table->lock);
++	spin_lock_irqsave(&table->lock, flags);
+ 
+ 	common = radix_tree_lookup(&table->tree, rsn);
+ 	if (common)
+ 		atomic_inc(&common->refcount);
+ 
+-	spin_unlock(&table->lock);
++	spin_unlock_irqrestore(&table->lock, flags);
+ 
+ 	if (!common) {
+ 		mlx5_core_warn(dev, "Async event for bogus resource 0x%x\n",
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-mlx5e-ipoib-fix-rx-checksum-statistics-update.patch b/queue-4.19/net-mlx5e-ipoib-fix-rx-checksum-statistics-update.patch
new file mode 100644
index 00000000000..2511f6eb9cb
--- /dev/null
+++ b/queue-4.19/net-mlx5e-ipoib-fix-rx-checksum-statistics-update.patch
@@ -0,0 +1,51 @@
+From d72a6aab98747483a44193bf11bbef5da80b06e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 17:34:28 +0200
+Subject: net/mlx5e: IPoIB, Fix RX checksum statistics update
+
+From: Feras Daoud <ferasda@mellanox.com>
+
+[ Upstream commit 3d6f3cdf9bfe92c430674308db0f1c8655f2c11d ]
+
+Update the RX checksum only if the feature is enabled.
+
+Fixes: 9d6bd752c63c ("net/mlx5e: IPoIB, RX handler")
+Signed-off-by: Feras Daoud <ferasda@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index 9cbc4173973e9..044687a1f27cc 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1364,8 +1364,14 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+ 
+ 	skb->protocol = *((__be16 *)(skb->data));
+ 
+-	skb->ip_summed = CHECKSUM_COMPLETE;
+-	skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++	if (netdev->features & NETIF_F_RXCSUM) {
++		skb->ip_summed = CHECKSUM_COMPLETE;
++		skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++		stats->csum_complete++;
++	} else {
++		skb->ip_summed = CHECKSUM_NONE;
++		stats->csum_none++;
++	}
+ 
+ 	if (unlikely(mlx5e_rx_hw_stamp(tstamp)))
+ 		skb_hwtstamps(skb)->hwtstamp =
+@@ -1384,7 +1390,6 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
+ 
+ 	skb->dev = netdev;
+ 
+-	stats->csum_complete++;
+ 	stats->packets++;
+ 	stats->bytes += cqe_bcnt;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-neigh-use-long-type-to-store-jiffies-delta.patch b/queue-4.19/net-neigh-use-long-type-to-store-jiffies-delta.patch
new file mode 100644
index 00000000000..33b6f620bb9
--- /dev/null
+++ b/queue-4.19/net-neigh-use-long-type-to-store-jiffies-delta.patch
@@ -0,0 +1,37 @@
+From d4c41b9ea8ff100ecd14df78349326b5cf4cbb64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:11:49 -0800
+Subject: net: neigh: use long type to store jiffies delta
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]
+
+A difference of two unsigned long needs long storage.
+
+Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index e260d44ebdca0..bf738ec68cb53 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1885,8 +1885,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
+ 		goto nla_put_failure;
+ 	{
+ 		unsigned long now = jiffies;
+-		unsigned int flush_delta = now - tbl->last_flush;
+-		unsigned int rand_delta = now - tbl->last_rand;
++		long flush_delta = now - tbl->last_flush;
++		long rand_delta = now - tbl->last_rand;
+ 		struct neigh_hash_table *nht;
+ 		struct ndt_config ndc = {
+ 			.ndtc_key_len		= tbl->key_len,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-netem-correct-the-parent-s-backlog-when-corrupte.patch b/queue-4.19/net-netem-correct-the-parent-s-backlog-when-corrupte.patch
new file mode 100644
index 00000000000..c6b950d95d5
--- /dev/null
+++ b/queue-4.19/net-netem-correct-the-parent-s-backlog-when-corrupte.patch
@@ -0,0 +1,40 @@
+From 2fe03e6f32ecea52acab7aa4fb12576e6fecd781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:16:58 -0700
+Subject: net: netem: correct the parent's backlog when corrupted packet was
+ dropped
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit e0ad032e144731a5928f2d75e91c2064ba1a764c ]
+
+If packet corruption failed we jump to finish_segs and return
+NET_XMIT_SUCCESS. Seeing success will make the parent qdisc
+increment its backlog, that's incorrect - we need to return
+NET_XMIT_DROP.
+
+Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 7660aa5b80da8..014a28d8dd4fa 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -607,6 +607,8 @@ finish_segs:
+ 		}
+ 		/* Parent qdiscs accounted for 1 skb of size @prev_len */
+ 		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
++	} else if (!skb) {
++		return NET_XMIT_DROP;
+ 	}
+ 	return NET_XMIT_SUCCESS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch b/queue-4.19/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
new file mode 100644
index 00000000000..0ec423a51ca
--- /dev/null
+++ b/queue-4.19/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
@@ -0,0 +1,84 @@
+From 6c03ec276b475a0838b7f0f9de49b44595db564d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2019 11:11:10 -0700
+Subject: net: netem: fix backlog accounting for corrupted GSO frames
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 177b8007463c4f36c9a2c7ce7aa9875a4cad9bd5 ]
+
+When GSO frame has to be corrupted netem uses skb_gso_segment()
+to produce the list of frames, and re-enqueues the segments one
+by one.  The backlog length has to be adjusted to account for
+new frames.
+
+The current calculation is incorrect, leading to wrong backlog
+lengths in the parent qdisc (both bytes and packets), and
+incorrect packet backlog count in netem itself.
+
+Parent backlog goes negative, netem's packet backlog counts
+all non-first segments twice (thus remaining non-zero even
+after qdisc is emptied).
+
+Move the variables used to count the adjustment into local
+scope to make 100% sure they aren't used at any stage in
+backports.
+
+Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 15f8f24c190d4..1cd7266140e6a 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -436,8 +436,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 	struct netem_skb_cb *cb;
+ 	struct sk_buff *skb2;
+ 	struct sk_buff *segs = NULL;
+-	unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
+-	int nb = 0;
++	unsigned int prev_len = qdisc_pkt_len(skb);
+ 	int count = 1;
+ 	int rc = NET_XMIT_SUCCESS;
+ 	int rc_drop = NET_XMIT_DROP;
+@@ -494,6 +493,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 			segs = netem_segment(skb, sch, to_free);
+ 			if (!segs)
+ 				return rc_drop;
++			qdisc_skb_cb(segs)->pkt_len = segs->len;
+ 		} else {
+ 			segs = skb;
+ 		}
+@@ -583,6 +583,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 
+ finish_segs:
+ 	if (segs) {
++		unsigned int len, last_len;
++		int nb = 0;
++
++		len = skb->len;
++
+ 		while (segs) {
+ 			skb2 = segs->next;
+ 			segs->next = NULL;
+@@ -598,9 +603,7 @@ finish_segs:
+ 			}
+ 			segs = skb2;
+ 		}
+-		sch->q.qlen += nb;
+-		if (nb > 1)
+-			qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
++		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
+ 	}
+ 	return NET_XMIT_SUCCESS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-netem-fix-error-path-for-corrupted-gso-frames.patch b/queue-4.19/net-netem-fix-error-path-for-corrupted-gso-frames.patch
new file mode 100644
index 00000000000..e2a4c72bcbd
--- /dev/null
+++ b/queue-4.19/net-netem-fix-error-path-for-corrupted-gso-frames.patch
@@ -0,0 +1,74 @@
+From b54061bc50700b6de94ea0502703a429db18d5f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:16:57 -0700
+Subject: net: netem: fix error path for corrupted GSO frames
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit a7fa12d15855904aff1716e1fc723c03ba38c5cc ]
+
+To corrupt a GSO frame we first perform segmentation.  We then
+proceed using the first segment instead of the full GSO skb and
+requeue the rest of the segments as separate packets.
+
+If there are any issues with processing the first segment we
+still want to process the rest, therefore we jump to the
+finish_segs label.
+
+Commit 177b8007463c ("net: netem: fix backlog accounting for
+corrupted GSO frames") started using the pointer to the first
+segment in the "rest of segments processing", but as mentioned
+above the first segment may had already been freed at this point.
+
+Backlog corrections for parent qdiscs have to be adjusted.
+
+Fixes: 177b8007463c ("net: netem: fix backlog accounting for corrupted GSO frames")
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 1cd7266140e6a..7660aa5b80da8 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -509,6 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ 		if (skb->ip_summed == CHECKSUM_PARTIAL &&
+ 		    skb_checksum_help(skb)) {
+ 			qdisc_drop(skb, sch, to_free);
++			skb = NULL;
+ 			goto finish_segs;
+ 		}
+ 
+@@ -584,9 +585,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ finish_segs:
+ 	if (segs) {
+ 		unsigned int len, last_len;
+-		int nb = 0;
++		int nb;
+ 
+-		len = skb->len;
++		len = skb ? skb->len : 0;
++		nb = skb ? 1 : 0;
+ 
+ 		while (segs) {
+ 			skb2 = segs->next;
+@@ -603,7 +605,8 @@ finish_segs:
+ 			}
+ 			segs = skb2;
+ 		}
+-		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
++		/* Parent qdiscs accounted for 1 skb of size @prev_len */
++		qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
+ 	}
+ 	return NET_XMIT_SUCCESS;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-netsec-fix-signedness-bug-in-netsec_probe.patch b/queue-4.19/net-netsec-fix-signedness-bug-in-netsec_probe.patch
new file mode 100644
index 00000000000..7d0ae13445c
--- /dev/null
+++ b/queue-4.19/net-netsec-fix-signedness-bug-in-netsec_probe.patch
@@ -0,0 +1,37 @@
+From d1ee5f01deddefa9d972622fb43ce0634e608444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:56:38 +0300
+Subject: net: netsec: Fix signedness bug in netsec_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit bd55f8ddbc437c225391ca8f487e7ec10243c4cc ]
+
+The "priv->phy_interface" variable is an enum and in this context GCC
+will treat it as an unsigned int so the error handling is never
+triggered.
+
+Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/netsec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index d9d0d03e4ce79..027367b9cc480 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -1604,7 +1604,7 @@ static int netsec_probe(struct platform_device *pdev)
+ 			   NETIF_MSG_LINK | NETIF_MSG_PROBE;
+ 
+ 	priv->phy_interface = device_get_phy_mode(&pdev->dev);
+-	if (priv->phy_interface < 0) {
++	if ((int)priv->phy_interface < 0) {
+ 		dev_err(&pdev->dev, "missing required property 'phy-mode'\n");
+ 		ret = -ENODEV;
+ 		goto free_ndev;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-nixge-fix-a-signedness-bug-in-nixge_probe.patch b/queue-4.19/net-nixge-fix-a-signedness-bug-in-nixge_probe.patch
new file mode 100644
index 00000000000..d49209d1aa0
--- /dev/null
+++ b/queue-4.19/net-nixge-fix-a-signedness-bug-in-nixge_probe.patch
@@ -0,0 +1,36 @@
+From cc744f40e387b371dd1f795e63d5feafae464b67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:05:24 +0300
+Subject: net: nixge: Fix a signedness bug in nixge_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 1a4b62a0b8a3b81eca24366f63e214a7144b9f02 ]
+
+The "priv->phy_mode" is an enum and in this context GCC will treat it
+as an unsigned int so it can never be less than zero.
+
+Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ni/nixge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
+index 76efed058f334..a791d7932b0ef 100644
+--- a/drivers/net/ethernet/ni/nixge.c
++++ b/drivers/net/ethernet/ni/nixge.c
+@@ -1233,7 +1233,7 @@ static int nixge_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	priv->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+-	if (priv->phy_mode < 0) {
++	if ((int)priv->phy_mode < 0) {
+ 		netdev_err(ndev, "not find \"phy-mode\" property\n");
+ 		err = -EINVAL;
+ 		goto unregister_mdio;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch b/queue-4.19/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
new file mode 100644
index 00000000000..2fbca9b9914
--- /dev/null
+++ b/queue-4.19/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
@@ -0,0 +1,49 @@
+From beaefa1d586f33b1a6e24dcb1836b77c666a0de7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jul 2019 12:23:41 +0800
+Subject: net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]
+
+The phy_dn variable is still being used in of_phy_connect() after the
+of_node_put() call, which may result in use-after-free.
+
+Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 8a31a02c9f47f..65f69e562618a 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ 
+ 	dn = pci_device_to_OF_node(mac->pdev);
+ 	phy_dn = of_parse_phandle(dn, "phy-handle", 0);
+-	of_node_put(phy_dn);
+ 
+ 	mac->link = 0;
+ 	mac->speed = 0;
+@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ 	phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
+ 				PHY_INTERFACE_MODE_SGMII);
+ 
++	of_node_put(phy_dn);
+ 	if (!phydev) {
+ 		printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
+ 		return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch b/queue-4.19/net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch
new file mode 100644
index 00000000000..4706487d759
--- /dev/null
+++ b/queue-4.19/net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch
@@ -0,0 +1,46 @@
+From b6265c6763aaad27a8844351ad1f538a078fa5d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 20:00:20 +0100
+Subject: net: phy: don't clear BMCR in genphy_soft_reset
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit d29f5aa0bc0c321e1b9e4658a2a7e08e885da52a ]
+
+So far we effectively clear the BMCR register. Some PHY's can deal
+with this (e.g. because they reset BMCR to a default as part of a
+soft-reset) whilst on others this causes issues because e.g. the
+autoneg bit is cleared. Marvell is an example, see also thread [0].
+So let's be a little bit more gentle and leave all bits we're not
+interested in as-is. This change is needed for PHY drivers to
+properly deal with the original patch.
+
+[0] https://marc.info/?t=155264050700001&r=1&w=2
+
+Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+Tested-by: Phil Reid <preid@electromag.com.au>
+Tested-by: liweihang <liweihang@hisilicon.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 9c7e51443f6b6..ae40d8137fd20 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1657,7 +1657,7 @@ int genphy_soft_reset(struct phy_device *phydev)
+ {
+ 	int ret;
+ 
+-	ret = phy_write(phydev, MII_BMCR, BMCR_RESET);
++	ret = phy_set_bits(phydev, MII_BMCR, BMCR_RESET);
+ 	if (ret < 0)
+ 		return ret;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch b/queue-4.19/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
new file mode 100644
index 00000000000..c1a5326d617
--- /dev/null
+++ b/queue-4.19/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
@@ -0,0 +1,68 @@
+From 3ae3e780ec1770c562989aa3b60c760e853e7717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 09:02:41 +0000
+Subject: net: phy: Fix not to call phy_resume() if PHY is not attached
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ]
+
+This patch fixes an issue that mdio_bus_phy_resume() doesn't call
+phy_resume() if the PHY is not attached.
+
+Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 43c4f358eeb8a..9c7e51443f6b6 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);
+ static DEFINE_MUTEX(phy_fixup_lock);
+ 
+ #ifdef CONFIG_PM
+-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
+ {
+ 	struct device_driver *drv = phydev->mdio.dev.driver;
+ 	struct phy_driver *phydrv = to_phy_driver(drv);
+@@ -88,10 +88,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ 	/* PHY not attached? May suspend if the PHY has not already been
+ 	 * suspended as part of a prior call to phy_disconnect() ->
+ 	 * phy_detach() -> phy_suspend() because the parent netdev might be the
+-	 * MDIO bus driver and clock gated at this point.
++	 * MDIO bus driver and clock gated at this point. Also may resume if
++	 * PHY is not attached.
+ 	 */
+ 	if (!netdev)
+-		return !phydev->suspended;
++		return suspend ? !phydev->suspended : phydev->suspended;
+ 
+ 	if (netdev->wol_enabled)
+ 		return false;
+@@ -126,7 +127,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
+ 	if (phydev->attached_dev && phydev->adjust_link)
+ 		phy_stop_machine(phydev);
+ 
+-	if (!mdio_bus_phy_may_suspend(phydev))
++	if (!mdio_bus_phy_may_suspend(phydev, true))
+ 		return 0;
+ 
+ 	return phy_suspend(phydev);
+@@ -137,7 +138,7 @@ static int mdio_bus_phy_resume(struct device *dev)
+ 	struct phy_device *phydev = to_phy_device(dev);
+ 	int ret;
+ 
+-	if (!mdio_bus_phy_may_suspend(phydev))
++	if (!mdio_bus_phy_may_suspend(phydev, false))
+ 		goto no_resume;
+ 
+ 	ret = phy_resume(phydev);
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch b/queue-4.19/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
new file mode 100644
index 00000000000..688bbe19695
--- /dev/null
+++ b/queue-4.19/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
@@ -0,0 +1,46 @@
+From c36bf7c0e828e17e97c588af2d037f0abccfd0fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 21:45:29 -0800
+Subject: net: phy: fixed_phy: Fix fixed_phy not checking GPIO
+
+From: Moritz Fischer <mdf@kernel.org>
+
+[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ]
+
+Fix fixed_phy not checking GPIO if no link_update callback
+is registered.
+
+In the original version all users registered a link_update
+callback so the issue was masked.
+
+Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/fixed_phy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index 67b260877f305..59820164502eb 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
+ 			do {
+ 				s = read_seqcount_begin(&fp->seqcount);
+ 				/* Issue callback if user registered it. */
+-				if (fp->link_update) {
++				if (fp->link_update)
+ 					fp->link_update(fp->phydev->attached_dev,
+ 							&fp->status);
+-					fixed_phy_update(fp);
+-				}
++				/* Check the GPIO for change in status */
++				fixed_phy_update(fp);
+ 				state = fp->status;
+ 			} while (read_seqcount_retry(&fp->seqcount, s));
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch b/queue-4.19/net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch
new file mode 100644
index 00000000000..f1bb00654ca
--- /dev/null
+++ b/queue-4.19/net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch
@@ -0,0 +1,42 @@
+From 3bbac14883de50ec0a2412ce9044fc14d205a511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 20:22:26 +0100
+Subject: net: phy: micrel: set soft_reset callback to genphy_soft_reset for
+ KSZ9031
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 1d16073a326891c2a964e4cb95bc18fbcafb5f74 ]
+
+So far genphy_soft_reset was used automatically if the PHY driver
+didn't implement the soft_reset callback. This changed with the
+mentioned commit and broke KSZ9031. To fix this configure the
+KSZ9031 PHY driver to use genphy_soft_reset.
+
+Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+Reported-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Sekhar Nori <nsekhar@ti.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/micrel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 05a6ae32ff652..b4c67c3a928b5 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -977,6 +977,7 @@ static struct phy_driver ksphy_driver[] = {
+ 	.driver_data	= &ksz9021_type,
+ 	.probe		= kszphy_probe,
+ 	.config_init	= ksz9031_config_init,
++	.soft_reset	= genphy_soft_reset,
+ 	.read_status	= ksz9031_read_status,
+ 	.ack_interrupt	= kszphy_ack_interrupt,
+ 	.config_intr	= kszphy_config_intr,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-qca_spi-move-reset_count-to-struct-qcaspi.patch b/queue-4.19/net-qca_spi-move-reset_count-to-struct-qcaspi.patch
new file mode 100644
index 00000000000..bd580998c58
--- /dev/null
+++ b/queue-4.19/net-qca_spi-move-reset_count-to-struct-qcaspi.patch
@@ -0,0 +1,68 @@
+From b23b8f8cd7ec054f0cda28338d43c315069b4988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 18:29:13 +0100
+Subject: net: qca_spi: Move reset_count to struct qcaspi
+
+From: Stefan Wahren <stefan.wahren@in-tech.com>
+
+[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ]
+
+The reset counter is specific for every QCA700x chip. So move this
+into the private driver struct. Otherwise we get unpredictable reset
+behavior in setups with multiple QCA700x chips.
+
+Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
+Signed-off-by: Stefan Wahren <stefan.wahren@in-tech.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++-----
+ drivers/net/ethernet/qualcomm/qca_spi.h | 1 +
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 66b775d462fd8..9d188931bc09e 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -475,7 +475,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ 	u16 signature = 0;
+ 	u16 spi_config;
+ 	u16 wrbuf_space = 0;
+-	static u16 reset_count;
+ 
+ 	if (event == QCASPI_EVENT_CPUON) {
+ 		/* Read signature twice, if not valid
+@@ -528,13 +527,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ 
+ 		qca->sync = QCASPI_SYNC_RESET;
+ 		qca->stats.trig_reset++;
+-		reset_count = 0;
++		qca->reset_count = 0;
+ 		break;
+ 	case QCASPI_SYNC_RESET:
+-		reset_count++;
++		qca->reset_count++;
+ 		netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
+-			   reset_count);
+-		if (reset_count >= QCASPI_RESET_TIMEOUT) {
++			   qca->reset_count);
++		if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
+ 			/* reset did not seem to take place, try again */
+ 			qca->sync = QCASPI_SYNC_UNKNOWN;
+ 			qca->stats.reset_timeout++;
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
+index fc0e98726b361..719c41227f221 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.h
++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
+@@ -92,6 +92,7 @@ struct qcaspi {
+ 
+ 	unsigned int intr_req;
+ 	unsigned int intr_svc;
++	u16 reset_count;
+ 
+ #ifdef CONFIG_DEBUG_FS
+ 	struct dentry *device_root;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-rds-add-a-few-missing-rds_stat_names-entries.patch b/queue-4.19/net-rds-add-a-few-missing-rds_stat_names-entries.patch
new file mode 100644
index 00000000000..6e0a0ba1526
--- /dev/null
+++ b/queue-4.19/net-rds-add-a-few-missing-rds_stat_names-entries.patch
@@ -0,0 +1,44 @@
+From b9a1ced119f90ca617639fbec1ff0e38f73078ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2019 12:15:50 -0700
+Subject: net/rds: Add a few missing rds_stat_names entries
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit 55c70ca00c982fbc0df4c4d3e31747fb73f4ddb5 ]
+
+In a previous commit, fields were added to "struct rds_statistics"
+but array "rds_stat_names" was not updated accordingly.
+
+Please note the inconsistent naming of the string representations
+that is done in the name of compatibility
+with the Oracle internal code-base.
+
+s_recv_bytes_added_to_socket     -> "recv_bytes_added_to_sock"
+s_recv_bytes_removed_from_socket -> "recv_bytes_freed_fromsock"
+
+Fixes: 192a798f5299 ("RDS: add stat for socket recv memory usage")
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/stats.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/stats.c b/net/rds/stats.c
+index 73be187d389ed..6bbab4d74c4fe 100644
+--- a/net/rds/stats.c
++++ b/net/rds/stats.c
+@@ -76,6 +76,8 @@ static const char *const rds_stat_names[] = {
+ 	"cong_update_received",
+ 	"cong_send_error",
+ 	"cong_send_blocked",
++	"recv_bytes_added_to_sock",
++	"recv_bytes_freed_fromsock",
+ };
+ 
+ void rds_stats_info_copy(struct rds_info_iterator *iter,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch b/queue-4.19/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
new file mode 100644
index 00000000000..93f1520ee99
--- /dev/null
+++ b/queue-4.19/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
@@ -0,0 +1,40 @@
+From 06245c41249b012b55c27fca085278141ed693b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 13:49:41 -0700
+Subject: net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ]
+
+All entries in 'rds_ib_stat_names' are stringified versions
+of the corresponding "struct rds_ib_statistics" element
+without the "s_"-prefix.
+
+Fix entry 'ib_evt_handler_call' to do the same.
+
+Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance")
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/ib_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
+index 9252ad1263359..ac46d8961b61a 100644
+--- a/net/rds/ib_stats.c
++++ b/net/rds/ib_stats.c
+@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
+ static const char *const rds_ib_stat_names[] = {
+ 	"ib_connect_raced",
+ 	"ib_listen_closed_stale",
+-	"s_ib_evt_handler_call",
++	"ib_evt_handler_call",
+ 	"ib_tasklet_call",
+ 	"ib_tx_cq_event",
+ 	"ib_tx_ring_full",
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sched-act_csum-fix-csum-calc-for-tagged-packets.patch b/queue-4.19/net-sched-act_csum-fix-csum-calc-for-tagged-packets.patch
new file mode 100644
index 00000000000..46f97d821a7
--- /dev/null
+++ b/queue-4.19/net-sched-act_csum-fix-csum-calc-for-tagged-packets.patch
@@ -0,0 +1,91 @@
+From 3f0a41acd9e18145ff67ea5df2d33b288212d5ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 09:57:34 +0000
+Subject: net: sched: act_csum: Fix csum calc for tagged packets
+
+From: Eli Britstein <elibr@mellanox.com>
+
+[ Upstream commit 2ecba2d1e45b24620a7c3df9531895cf68d5dec6 ]
+
+The csum calculation is different for IPv4/6. For VLAN packets,
+tc_skb_protocol returns the VLAN protocol rather than the packet's one
+(e.g. IPv4/6), so csum is not calculated. Furthermore, VLAN may not be
+stripped so csum is not calculated in this case too. Calculate the
+csum for those cases.
+
+Fixes: d8b9605d2697 ("net: sched: fix skb->protocol use in case of accelerated vlan path")
+Signed-off-by: Eli Britstein <elibr@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_csum.c | 31 +++++++++++++++++++++++++++++--
+ 1 file changed, 29 insertions(+), 2 deletions(-)
+
+diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
+index 1e269441065a6..9ecbf8edcf390 100644
+--- a/net/sched/act_csum.c
++++ b/net/sched/act_csum.c
+@@ -560,8 +560,11 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ 			struct tcf_result *res)
+ {
+ 	struct tcf_csum *p = to_tcf_csum(a);
++	bool orig_vlan_tag_present = false;
++	unsigned int vlan_hdr_count = 0;
+ 	struct tcf_csum_params *params;
+ 	u32 update_flags;
++	__be16 protocol;
+ 	int action;
+ 
+ 	params = rcu_dereference_bh(p->params);
+@@ -574,7 +577,9 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ 		goto drop;
+ 
+ 	update_flags = params->update_flags;
+-	switch (tc_skb_protocol(skb)) {
++	protocol = tc_skb_protocol(skb);
++again:
++	switch (protocol) {
+ 	case cpu_to_be16(ETH_P_IP):
+ 		if (!tcf_csum_ipv4(skb, update_flags))
+ 			goto drop;
+@@ -583,13 +588,35 @@ static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a,
+ 		if (!tcf_csum_ipv6(skb, update_flags))
+ 			goto drop;
+ 		break;
++	case cpu_to_be16(ETH_P_8021AD): /* fall through */
++	case cpu_to_be16(ETH_P_8021Q):
++		if (skb_vlan_tag_present(skb) && !orig_vlan_tag_present) {
++			protocol = skb->protocol;
++			orig_vlan_tag_present = true;
++		} else {
++			struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data;
++
++			protocol = vlan->h_vlan_encapsulated_proto;
++			skb_pull(skb, VLAN_HLEN);
++			skb_reset_network_header(skb);
++			vlan_hdr_count++;
++		}
++		goto again;
++	}
++
++out:
++	/* Restore the skb for the pulled VLAN tags */
++	while (vlan_hdr_count--) {
++		skb_push(skb, VLAN_HLEN);
++		skb_reset_network_header(skb);
+ 	}
+ 
+ 	return action;
+ 
+ drop:
+ 	qstats_drop_inc(this_cpu_ptr(p->common.cpu_qstats));
+-	return TC_ACT_SHOT;
++	action = TC_ACT_SHOT;
++	goto out;
+ }
+ 
+ static int tcf_csum_dump(struct sk_buff *skb, struct tc_action *a, int bind,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sched-cbs-avoid-division-by-zero-when-calculatin.patch b/queue-4.19/net-sched-cbs-avoid-division-by-zero-when-calculatin.patch
new file mode 100644
index 00000000000..2e2ee23b74b
--- /dev/null
+++ b/queue-4.19/net-sched-cbs-avoid-division-by-zero-when-calculatin.patch
@@ -0,0 +1,40 @@
+From 5040cdd42ee72e9da0c08543a9e2bc973d368073 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 02:39:48 +0300
+Subject: net: sched: cbs: Avoid division by zero when calculating the port
+ rate
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit 83c8c3cf45163f0c823db37be6ab04dfcf8ac751 ]
+
+As explained in the "net: sched: taprio: Avoid division by zero on
+invalid link speed" commit, it is legal for the ethtool API to return
+zero as a link speed. So guard against it to ensure we don't perform a
+division by zero in kernel.
+
+Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index 289f66b9238d3..940e72d6db185 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
+ 	if (err < 0)
+ 		goto skip;
+ 
+-	if (ecmd.base.speed != SPEED_UNKNOWN)
++	if (ecmd.base.speed && ecmd.base.speed != SPEED_UNKNOWN)
+ 		speed = ecmd.base.speed;
+ 
+ skip:
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sched-cbs-fix-error-path-of-cbs_module_init.patch b/queue-4.19/net-sched-cbs-fix-error-path-of-cbs_module_init.patch
new file mode 100644
index 00000000000..6ffd1f167e6
--- /dev/null
+++ b/queue-4.19/net-sched-cbs-fix-error-path-of-cbs_module_init.patch
@@ -0,0 +1,48 @@
+From 07f6e8b5f8e0f3caac43911632885418bf3642d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 21:44:37 +0800
+Subject: net/sched: cbs: Fix error path of cbs_module_init
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 45d5cb137c3638b3a310f41b31d8e79daf647f14 ]
+
+If register_qdisc fails, we should unregister
+netdevice notifier.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cbs.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index 81f84cb5dd23b..b3c8d04929df2 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -552,12 +552,17 @@ static struct notifier_block cbs_device_notifier = {
+ 
+ static int __init cbs_module_init(void)
+ {
+-	int err = register_netdevice_notifier(&cbs_device_notifier);
++	int err;
+ 
++	err = register_netdevice_notifier(&cbs_device_notifier);
+ 	if (err)
+ 		return err;
+ 
+-	return register_qdisc(&cbs_qdisc_ops);
++	err = register_qdisc(&cbs_qdisc_ops);
++	if (err)
++		unregister_netdevice_notifier(&cbs_device_notifier);
++
++	return err;
+ }
+ 
+ static void __exit cbs_module_exit(void)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sched-cbs-fix-port_rate-miscalculation.patch b/queue-4.19/net-sched-cbs-fix-port_rate-miscalculation.patch
new file mode 100644
index 00000000000..ba0157a6cf5
--- /dev/null
+++ b/queue-4.19/net-sched-cbs-fix-port_rate-miscalculation.patch
@@ -0,0 +1,227 @@
+From df795f71c6998ece2d87fd41d8251104b2479d4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 10:12:18 -0700
+Subject: net/sched: cbs: fix port_rate miscalculation
+
+From: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
+
+[ Upstream commit e0a7683d30e91e30ee6cf96314ae58a0314a095e ]
+
+The Credit Based Shaper heavily depends on link speed to calculate
+the scheduling credits, we can't properly calculate the credits if the
+device has failed to report the link speed.
+
+In that case we can't dequeue packets assuming a wrong port rate that will
+result into an inconsistent credit distribution.
+
+This patch makes sure we fail to dequeue case:
+
+1) __ethtool_get_link_ksettings() reports error or 2) the ethernet driver
+failed to set the ksettings' speed value (setting link speed to
+SPEED_UNKNOWN).
+
+Additionally we properly re calculate the port rate whenever the link speed
+is changed.
+
+Fixes: 3d0bd028ffb4a ("net/sched: Add support for HW offloading for CBS")
+Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
+Reviewed-by: Vedang Patel <vedang.patel@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cbs.c | 98 ++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 84 insertions(+), 14 deletions(-)
+
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index e26a24017faa6..81f84cb5dd23b 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -61,16 +61,20 @@
+ #include <linux/string.h>
+ #include <linux/errno.h>
+ #include <linux/skbuff.h>
++#include <net/netevent.h>
+ #include <net/netlink.h>
+ #include <net/sch_generic.h>
+ #include <net/pkt_sched.h>
+ 
++static LIST_HEAD(cbs_list);
++static DEFINE_SPINLOCK(cbs_list_lock);
++
+ #define BYTES_PER_KBIT (1000LL / 8)
+ 
+ struct cbs_sched_data {
+ 	bool offload;
+ 	int queue;
+-	s64 port_rate; /* in bytes/s */
++	atomic64_t port_rate; /* in bytes/s */
+ 	s64 last; /* timestamp in ns */
+ 	s64 credits; /* in bytes */
+ 	s32 locredit; /* in bytes */
+@@ -82,6 +86,7 @@ struct cbs_sched_data {
+ 		       struct sk_buff **to_free);
+ 	struct sk_buff *(*dequeue)(struct Qdisc *sch);
+ 	struct Qdisc *qdisc;
++	struct list_head cbs_list;
+ };
+ 
+ static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+@@ -180,6 +185,11 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ 	s64 credits;
+ 	int len;
+ 
++	if (atomic64_read(&q->port_rate) == -1) {
++		WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
++		return NULL;
++	}
++
+ 	if (q->credits < 0) {
+ 		credits = timediff_to_credits(now - q->last, q->idleslope);
+ 
+@@ -206,7 +216,8 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ 	/* As sendslope is a negative number, this will decrease the
+ 	 * amount of q->credits.
+ 	 */
+-	credits = credits_from_len(len, q->sendslope, q->port_rate);
++	credits = credits_from_len(len, q->sendslope,
++				   atomic64_read(&q->port_rate));
+ 	credits += q->credits;
+ 
+ 	q->credits = max_t(s64, credits, q->locredit);
+@@ -293,6 +304,50 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
+ 	return 0;
+ }
+ 
++static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
++{
++	struct ethtool_link_ksettings ecmd;
++	int port_rate = -1;
++
++	if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
++	    ecmd.base.speed != SPEED_UNKNOWN)
++		port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
++
++	atomic64_set(&q->port_rate, port_rate);
++	netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
++		   dev->name, (long long)atomic64_read(&q->port_rate),
++		   ecmd.base.speed);
++}
++
++static int cbs_dev_notifier(struct notifier_block *nb, unsigned long event,
++			    void *ptr)
++{
++	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++	struct cbs_sched_data *q;
++	struct net_device *qdev;
++	bool found = false;
++
++	ASSERT_RTNL();
++
++	if (event != NETDEV_UP && event != NETDEV_CHANGE)
++		return NOTIFY_DONE;
++
++	spin_lock(&cbs_list_lock);
++	list_for_each_entry(q, &cbs_list, cbs_list) {
++		qdev = qdisc_dev(q->qdisc);
++		if (qdev == dev) {
++			found = true;
++			break;
++		}
++	}
++	spin_unlock(&cbs_list_lock);
++
++	if (found)
++		cbs_set_port_rate(dev, q);
++
++	return NOTIFY_DONE;
++}
++
+ static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
+ 		      struct netlink_ext_ack *extack)
+ {
+@@ -314,16 +369,7 @@ static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
+ 	qopt = nla_data(tb[TCA_CBS_PARMS]);
+ 
+ 	if (!qopt->offload) {
+-		struct ethtool_link_ksettings ecmd;
+-		s64 link_speed;
+-
+-		if (!__ethtool_get_link_ksettings(dev, &ecmd))
+-			link_speed = ecmd.base.speed;
+-		else
+-			link_speed = SPEED_1000;
+-
+-		q->port_rate = link_speed * 1000 * BYTES_PER_KBIT;
+-
++		cbs_set_port_rate(dev, q);
+ 		cbs_disable_offload(dev, q);
+ 	} else {
+ 		err = cbs_enable_offload(dev, q, qopt, extack);
+@@ -346,6 +392,7 @@ static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
+ {
+ 	struct cbs_sched_data *q = qdisc_priv(sch);
+ 	struct net_device *dev = qdisc_dev(sch);
++	int err;
+ 
+ 	if (!opt) {
+ 		NL_SET_ERR_MSG(extack, "Missing CBS qdisc options  which are mandatory");
+@@ -366,7 +413,17 @@ static int cbs_init(struct Qdisc *sch, struct nlattr *opt,
+ 
+ 	qdisc_watchdog_init(&q->watchdog, sch);
+ 
+-	return cbs_change(sch, opt, extack);
++	err = cbs_change(sch, opt, extack);
++	if (err)
++		return err;
++
++	if (!q->offload) {
++		spin_lock(&cbs_list_lock);
++		list_add(&q->cbs_list, &cbs_list);
++		spin_unlock(&cbs_list_lock);
++	}
++
++	return 0;
+ }
+ 
+ static void cbs_destroy(struct Qdisc *sch)
+@@ -374,8 +431,11 @@ static void cbs_destroy(struct Qdisc *sch)
+ 	struct cbs_sched_data *q = qdisc_priv(sch);
+ 	struct net_device *dev = qdisc_dev(sch);
+ 
+-	qdisc_watchdog_cancel(&q->watchdog);
++	spin_lock(&cbs_list_lock);
++	list_del(&q->cbs_list);
++	spin_unlock(&cbs_list_lock);
+ 
++	qdisc_watchdog_cancel(&q->watchdog);
+ 	cbs_disable_offload(dev, q);
+ 
+ 	if (q->qdisc)
+@@ -486,14 +546,24 @@ static struct Qdisc_ops cbs_qdisc_ops __read_mostly = {
+ 	.owner		=	THIS_MODULE,
+ };
+ 
++static struct notifier_block cbs_device_notifier = {
++	.notifier_call = cbs_dev_notifier,
++};
++
+ static int __init cbs_module_init(void)
+ {
++	int err = register_netdevice_notifier(&cbs_device_notifier);
++
++	if (err)
++		return err;
++
+ 	return register_qdisc(&cbs_qdisc_ops);
+ }
+ 
+ static void __exit cbs_module_exit(void)
+ {
+ 	unregister_qdisc(&cbs_qdisc_ops);
++	unregister_netdevice_notifier(&cbs_device_notifier);
+ }
+ module_init(cbs_module_init)
+ module_exit(cbs_module_exit)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sched-cbs-set-default-link-speed-to-10-mbps-in-c.patch b/queue-4.19/net-sched-cbs-set-default-link-speed-to-10-mbps-in-c.patch
new file mode 100644
index 00000000000..d6ccdd19e69
--- /dev/null
+++ b/queue-4.19/net-sched-cbs-set-default-link-speed-to-10-mbps-in-c.patch
@@ -0,0 +1,66 @@
+From 09216d2be9334a6a519d227e32e3731b9199db05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 04:07:23 +0300
+Subject: net/sched: cbs: Set default link speed to 10 Mbps in
+ cbs_set_port_rate
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit 1c6c09a0ae62fa3ea8f8ead2ac3920e6fff2de64 ]
+
+The discussion to be made is absolutely the same as in the case of
+previous patch ("taprio: Set default link speed to 10 Mbps in
+taprio_set_picos_per_byte"). Nothing is lost when setting a default.
+
+Cc: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
+Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
+Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cbs.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
+index b3c8d04929df2..289f66b9238d3 100644
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -185,11 +185,6 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
+ 	s64 credits;
+ 	int len;
+ 
+-	if (atomic64_read(&q->port_rate) == -1) {
+-		WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
+-		return NULL;
+-	}
+-
+ 	if (q->credits < 0) {
+ 		credits = timediff_to_credits(now - q->last, q->idleslope);
+ 
+@@ -307,11 +302,19 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
+ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
+ {
+ 	struct ethtool_link_ksettings ecmd;
++	int speed = SPEED_10;
+ 	int port_rate = -1;
++	int err;
++
++	err = __ethtool_get_link_ksettings(dev, &ecmd);
++	if (err < 0)
++		goto skip;
++
++	if (ecmd.base.speed != SPEED_UNKNOWN)
++		speed = ecmd.base.speed;
+ 
+-	if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
+-	    ecmd.base.speed != SPEED_UNKNOWN)
+-		port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
++skip:
++	port_rate = speed * 1000 * BYTES_PER_KBIT;
+ 
+ 	atomic64_set(&q->port_rate, port_rate);
+ 	netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch b/queue-4.19/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
new file mode 100644
index 00000000000..b1ddc3c4995
--- /dev/null
+++ b/queue-4.19/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
@@ -0,0 +1,49 @@
+From bbb39e863ab3b31302862761bc29ad1ec52fdf14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2019 02:43:18 -0500
+Subject: net: sh_eth: fix a missing check of of_get_phy_mode
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]
+
+of_get_phy_mode may fail and return a negative error code;
+the fix checks the return value of of_get_phy_mode and
+returns NULL of it fails.
+
+Fixes: b356e978e92f ("sh_eth: add device tree support")
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 6068e96f5ac1e..441643670ac0e 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3133,12 +3133,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
+ 	struct device_node *np = dev->of_node;
+ 	struct sh_eth_plat_data *pdata;
+ 	const char *mac_addr;
++	int ret;
+ 
+ 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
+ 	if (!pdata)
+ 		return NULL;
+ 
+-	pdata->phy_interface = of_get_phy_mode(np);
++	ret = of_get_phy_mode(np);
++	if (ret < 0)
++		return NULL;
++	pdata->phy_interface = ret;
+ 
+ 	mac_addr = of_get_mac_address(np);
+ 	if (mac_addr)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-original-socket-family-in-inet_sock_diag.patch b/queue-4.19/net-smc-original-socket-family-in-inet_sock_diag.patch
new file mode 100644
index 00000000000..133ee88ab07
--- /dev/null
+++ b/queue-4.19/net-smc-original-socket-family-in-inet_sock_diag.patch
@@ -0,0 +1,56 @@
+From c8de39ba2b6d65bc51293fcc84019528018b51cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 15:56:20 +0100
+Subject: net/smc: original socket family in inet_sock_diag
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 232dc8ef647658a5352da807d9e994e0e03b43cd ]
+
+Commit ed75986f4aae ("net/smc: ipv6 support for smc_diag.c") changed the
+value of the diag_family field. The idea was to indicate the family of
+the IP address in the inet_diag_sockid field. But the change makes it
+impossible to distinguish an inet_sock_diag response message from SMC
+sock_diag response. This patch restores the original behaviour and sends
+AF_SMC as value of the diag_family field.
+
+Fixes: ed75986f4aae ("net/smc: ipv6 support for smc_diag.c")
+Reported-by: Eugene Syromiatnikov <esyr@redhat.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_diag.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c
+index dbf64a93d68ad..371b4cf31fcd2 100644
+--- a/net/smc/smc_diag.c
++++ b/net/smc/smc_diag.c
+@@ -38,6 +38,7 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
+ {
+ 	struct smc_sock *smc = smc_sk(sk);
+ 
++	r->diag_family = sk->sk_family;
+ 	if (!smc->clcsock)
+ 		return;
+ 	r->id.idiag_sport = htons(smc->clcsock->sk->sk_num);
+@@ -45,14 +46,12 @@ static void smc_diag_msg_common_fill(struct smc_diag_msg *r, struct sock *sk)
+ 	r->id.idiag_if = smc->clcsock->sk->sk_bound_dev_if;
+ 	sock_diag_save_cookie(sk, r->id.idiag_cookie);
+ 	if (sk->sk_protocol == SMCPROTO_SMC) {
+-		r->diag_family = PF_INET;
+ 		memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+ 		memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+ 		r->id.idiag_src[0] = smc->clcsock->sk->sk_rcv_saddr;
+ 		r->id.idiag_dst[0] = smc->clcsock->sk->sk_daddr;
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	} else if (sk->sk_protocol == SMCPROTO_SMC6) {
+-		r->diag_family = PF_INET6;
+ 		memcpy(&r->id.idiag_src, &smc->clcsock->sk->sk_v6_rcv_saddr,
+ 		       sizeof(smc->clcsock->sk->sk_v6_rcv_saddr));
+ 		memcpy(&r->id.idiag_dst, &smc->clcsock->sk->sk_v6_daddr,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-receive-pending-data-after-rcv_shutdown.patch b/queue-4.19/net-smc-receive-pending-data-after-rcv_shutdown.patch
new file mode 100644
index 00000000000..7f1a460ed1d
--- /dev/null
+++ b/queue-4.19/net-smc-receive-pending-data-after-rcv_shutdown.patch
@@ -0,0 +1,77 @@
+From da929773c7317c1fd70efa34bf754d1fb3ee3de4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2019 10:16:11 +0200
+Subject: net/smc: receive pending data after RCV_SHUTDOWN
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 107529e31a87acd475ff6a0f82745821b8f70fec ]
+
+smc_rx_recvmsg() first checks if data is available, and then if
+RCV_SHUTDOWN is set. There is a race when smc_cdc_msg_recv_action() runs
+in between these 2 checks, receives data and sets RCV_SHUTDOWN.
+In that case smc_rx_recvmsg() would return from receive without to
+process the available data.
+Fix that with a final check for data available if RCV_SHUTDOWN is set.
+Move the check for data into a function and call it twice.
+And use the existing helper smc_rx_data_available().
+
+Fixes: 952310ccf2d8 ("smc: receive data from RMBE")
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_rx.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
+index 1ee5fdbf8284e..36340912df48a 100644
+--- a/net/smc/smc_rx.c
++++ b/net/smc/smc_rx.c
+@@ -262,6 +262,18 @@ static int smc_rx_recv_urg(struct smc_sock *smc, struct msghdr *msg, int len,
+ 	return -EAGAIN;
+ }
+ 
++static bool smc_rx_recvmsg_data_available(struct smc_sock *smc)
++{
++	struct smc_connection *conn = &smc->conn;
++
++	if (smc_rx_data_available(conn))
++		return true;
++	else if (conn->urg_state == SMC_URG_VALID)
++		/* we received a single urgent Byte - skip */
++		smc_rx_update_cons(smc, 0);
++	return false;
++}
++
+ /* smc_rx_recvmsg - receive data from RMBE
+  * @msg:	copy data to receive buffer
+  * @pipe:	copy data to pipe if set - indicates splice() call
+@@ -303,15 +315,18 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ 		if (read_done >= target || (pipe && read_done))
+ 			break;
+ 
+-		if (atomic_read(&conn->bytes_to_rcv))
++		if (smc_rx_recvmsg_data_available(smc))
+ 			goto copy;
+-		else if (conn->urg_state == SMC_URG_VALID)
+-			/* we received a single urgent Byte - skip */
+-			smc_rx_update_cons(smc, 0);
+ 
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN ||
+-		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)
++		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort) {
++			/* smc_cdc_msg_recv_action() could have run after
++			 * above smc_rx_recvmsg_data_available()
++			 */
++			if (smc_rx_recvmsg_data_available(smc))
++				goto copy;
+ 			break;
++		}
+ 
+ 		if (read_done) {
+ 			if (sk->sk_err ||
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-smc-receive-returns-without-data.patch b/queue-4.19/net-smc-receive-returns-without-data.patch
new file mode 100644
index 00000000000..a09da60c576
--- /dev/null
+++ b/queue-4.19/net-smc-receive-returns-without-data.patch
@@ -0,0 +1,52 @@
+From 47ffcf1c681466eedc68b2edbef012b3887f0eb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2019 10:16:10 +0200
+Subject: net/smc: receive returns without data
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 882dcfe5a1785c20f45820cbe6fec4b8b647c946 ]
+
+smc_cdc_rxed_any_close_or_senddone() is used as an end condition for the
+receive loop. This conflicts with smc_cdc_msg_recv_action() which could
+run in parallel and set the bits checked by
+smc_cdc_rxed_any_close_or_senddone() before the receive is processed.
+In that case we could return from receive with no data, although data is
+available. The same applies to smc_rx_wait().
+Fix this by checking for RCV_SHUTDOWN only, which is set in
+smc_cdc_msg_recv_action() after the receive was actually processed.
+
+Fixes: 952310ccf2d8 ("smc: receive data from RMBE")
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_rx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/smc/smc_rx.c b/net/smc/smc_rx.c
+index bbcf0fe4ae10f..1ee5fdbf8284e 100644
+--- a/net/smc/smc_rx.c
++++ b/net/smc/smc_rx.c
+@@ -212,8 +212,7 @@ int smc_rx_wait(struct smc_sock *smc, long *timeo,
+ 	rc = sk_wait_event(sk, timeo,
+ 			   sk->sk_err ||
+ 			   sk->sk_shutdown & RCV_SHUTDOWN ||
+-			   fcrit(conn) ||
+-			   smc_cdc_rxed_any_close_or_senddone(conn),
++			   fcrit(conn),
+ 			   &wait);
+ 	remove_wait_queue(sk_sleep(sk), &wait);
+ 	sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+@@ -311,7 +310,6 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg,
+ 			smc_rx_update_cons(smc, 0);
+ 
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN ||
+-		    smc_cdc_rxed_any_close_or_senddone(conn) ||
+ 		    conn->local_tx_ctrl.conn_state_flags.peer_conn_abort)
+ 			break;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-socionext-add-dummy-phy-register-read-in-phy_wri.patch b/queue-4.19/net-socionext-add-dummy-phy-register-read-in-phy_wri.patch
new file mode 100644
index 00000000000..5f0acbfa0e9
--- /dev/null
+++ b/queue-4.19/net-socionext-add-dummy-phy-register-read-in-phy_wri.patch
@@ -0,0 +1,77 @@
+From c571b569e823a1371464d323479656a388651fad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Oct 2018 20:24:27 +0900
+Subject: net: socionext: Add dummy PHY register read in phy_write()
+
+From: Masahisa Kojima <masahisa.kojima@linaro.org>
+
+[ Upstream commit a3241a91de6429051a211b5ce04d6946157caec7 ]
+
+There is a compatibility issue between RTL8211E implemented
+in Developerbox and netsec ethernet controller IP.
+
+Our MDIO controller stops MDC clock right after the write
+access, but RTL8211E expects MDC clock must be kept toggling
+for several clock cycle with MDIO high before entering
+the IDLE state. Without keeping clock after write access,
+write access is not correctly handled and register is not
+updated.
+
+To meet this requirement, netsec driver needs to issue dummy
+read(e.g. read PHYID1(offset 0x2) register) right after write
+access, to keep MDC clock.
+
+We think this compatibility issue is a problem specific to
+our MDIO controller and RTL8211E.
+
+Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
+Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
+Signed-off-by: Yoshitoyo Osaki <osaki.yoshitoyo@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/netsec.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index 28d582c18afb9..d9d0d03e4ce79 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -432,9 +432,12 @@ static int netsec_mac_update_to_phy_state(struct netsec_priv *priv)
+ 	return 0;
+ }
+ 
++static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr);
++
+ static int netsec_phy_write(struct mii_bus *bus,
+ 			    int phy_addr, int reg, u16 val)
+ {
++	int status;
+ 	struct netsec_priv *priv = bus->priv;
+ 
+ 	if (netsec_mac_write(priv, GMAC_REG_GDR, val))
+@@ -447,8 +450,19 @@ static int netsec_phy_write(struct mii_bus *bus,
+ 			      GMAC_REG_SHIFT_CR_GAR)))
+ 		return -ETIMEDOUT;
+ 
+-	return netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
+-					  NETSEC_GMAC_GAR_REG_GB);
++	status = netsec_mac_wait_while_busy(priv, GMAC_REG_GAR,
++					    NETSEC_GMAC_GAR_REG_GB);
++
++	/* Developerbox implements RTL8211E PHY and there is
++	 * a compatibility problem with F_GMAC4.
++	 * RTL8211E expects MDC clock must be kept toggling for several
++	 * clock cycle with MDIO high before entering the IDLE state.
++	 * To meet this requirement, netsec driver needs to issue dummy
++	 * read(e.g. read PHYID1(offset 0x2) register) right after write.
++	 */
++	netsec_phy_read(bus, phy_addr, MII_PHYSID1);
++
++	return status;
+ }
+ 
+ static int netsec_phy_read(struct mii_bus *bus, int phy_addr, int reg_addr)
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-socionext-fix-a-signedness-bug-in-ave_probe.patch b/queue-4.19/net-socionext-fix-a-signedness-bug-in-ave_probe.patch
new file mode 100644
index 00000000000..f4e8da6d10f
--- /dev/null
+++ b/queue-4.19/net-socionext-fix-a-signedness-bug-in-ave_probe.patch
@@ -0,0 +1,37 @@
+From 8797249fa6be17cffb269ce5b9f78f1f39eeb5b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:57:50 +0300
+Subject: net: socionext: Fix a signedness bug in ave_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7f9e88e6ef8c971f2c638b5ff7044c59b5d0f58d ]
+
+The "phy_mode" variable is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: 4c270b55a5af ("net: ethernet: socionext: add AVE ethernet driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/sni_ave.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index 09d25b87cf7c0..c309accc6797e 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -1575,7 +1575,7 @@ static int ave_probe(struct platform_device *pdev)
+ 
+ 	np = dev->of_node;
+ 	phy_mode = of_get_phy_mode(np);
+-	if (phy_mode < 0) {
++	if ((int)phy_mode < 0) {
+ 		dev_err(dev, "phy-mode not found\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch b/queue-4.19/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
new file mode 100644
index 00000000000..efc5651b6f7
--- /dev/null
+++ b/queue-4.19/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
@@ -0,0 +1,37 @@
+From 71866a7bac47c37d07f2db26741791595e493182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 09:36:23 +0800
+Subject: net: sonic: replace dev_kfree_skb in sonic_send_packet
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ]
+
+sonic_send_packet will be processed in irq or non-irq
+context, so it would better use dev_kfree_skb_any
+instead of dev_kfree_skb.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index be36f7117d484..5f1875fe47cdf 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -232,7 +232,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ 	if (!laddr) {
+ 		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+-		dev_kfree_skb(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch b/queue-4.19/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
new file mode 100644
index 00000000000..e0ad6626ad2
--- /dev/null
+++ b/queue-4.19/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
@@ -0,0 +1,42 @@
+From 87b88c7417cf2731aeabd80ee20b40d04cbe570d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 09:57:12 +0800
+Subject: net: sonic: return NETDEV_TX_OK if failed to map buffer
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ]
+
+NETDEV_TX_BUSY really should only be used by drivers that call
+netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
+failed to map tx DMA buffer, it might trigger an infinite loop.
+This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
+printk to pr_err_ratelimited.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index c805dcbebd027..be36f7117d484 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -231,9 +231,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ 
+ 	laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ 	if (!laddr) {
+-		printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
++		pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+ 		dev_kfree_skb(skb);
+-		return NETDEV_TX_BUSY;
++		return NETDEV_TX_OK;
+ 	}
+ 
+ 	sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0);       /* clear status */
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch b/queue-4.19/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
new file mode 100644
index 00000000000..dcab0ec2b63
--- /dev/null
+++ b/queue-4.19/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
@@ -0,0 +1,37 @@
+From 0e524971c62f4c059e5c5ab0eb809a8eb5abf8aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:58:22 +0300
+Subject: net: stmmac: dwmac-meson8b: Fix signedness bug in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f10210517a2f37feea2edf85eb34c98977265c16 ]
+
+The "dwmac->phy_mode" is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: 566e82516253 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index 94b46258e8ff8..0a17535f13ae4 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -355,7 +355,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
+ 
+ 	dwmac->dev = &pdev->dev;
+ 	dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+-	if (dwmac->phy_mode < 0) {
++	if ((int)dwmac->phy_mode < 0) {
+ 		dev_err(&pdev->dev, "missing phy-mode property\n");
+ 		ret = -EINVAL;
+ 		goto err_remove_config_dt;
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-stmmac-fix-disabling-flexible-pps-output.patch b/queue-4.19/net-stmmac-fix-disabling-flexible-pps-output.patch
new file mode 100644
index 00000000000..351a1529de0
--- /dev/null
+++ b/queue-4.19/net-stmmac-fix-disabling-flexible-pps-output.patch
@@ -0,0 +1,47 @@
+From 95dc840c08dafac7d8952235dbcdffca575580a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 17:43:05 +0200
+Subject: net: stmmac: fix disabling flexible PPS output
+
+From: Antonio Borneo <antonio.borneo@st.com>
+
+[ Upstream commit 520cf6002147281d1e7b522bb338416b623dcb93 ]
+
+Accordingly to Synopsys documentation [1] and [2], when bit PPSEN0
+in register MAC_PPS_CONTROL is set it selects the functionality
+command in the same register, otherwise selects the functionality
+control.
+Command functionality is required to either enable (command 0x2)
+and disable (command 0x5) the flexible PPS output, but the bit
+PPSEN0 is currently set only for enabling.
+
+Set the bit PPSEN0 to properly disable flexible PPS output.
+
+Tested on STM32MP15x, based on dwmac 4.10a.
+
+[1] DWC Ethernet QoS Databook 4.10a October 2014
+[2] DWC Ethernet QoS Databook 5.00a September 2017
+
+Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
+Fixes: 9a8a02c9d46d ("net: stmmac: Add Flexible PPS support")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+index 3f4f3132e16b3..e436fa160c7d6 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac5.c
+@@ -515,6 +515,7 @@ int dwmac5_flex_pps_config(void __iomem *ioaddr, int index,
+ 
+ 	if (!enable) {
+ 		val |= PPSCMDx(index, 0x5);
++		val |= PPSEN0;
+ 		writel(val, ioaddr + MAC_PPS_CONTROL);
+ 		return 0;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch b/queue-4.19/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
new file mode 100644
index 00000000000..03d07468564
--- /dev/null
+++ b/queue-4.19/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
@@ -0,0 +1,51 @@
+From bd6b302a04bc2cd853c00b596ed4413fc0824cc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 17:43:04 +0200
+Subject: net: stmmac: fix length of PTP clock's name string
+
+From: Antonio Borneo <antonio.borneo@st.com>
+
+[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ]
+
+The field "name" in struct ptp_clock_info has a fixed size of 16
+chars and is used as zero terminated string by clock_name_show()
+in drivers/ptp/ptp_sysfs.c
+The current initialization value requires 17 chars to fit also the
+null termination, and this causes overflow to the next bytes in
+the struct when the string is read as null terminated:
+	hexdump -C /sys/class/ptp/ptp0/clock_name
+	00000000  73 74 6d 6d 61 63 5f 70  74 70 5f 63 6c 6f 63 6b  |stmmac_ptp_clock|
+	00000010  a0 ac b9 03 0a                                    |.....|
+where the extra 4 bytes (excluding the newline) after the string
+represent the integer 0x03b9aca0 = 62500000 assigned to the field
+"max_adj" that follows "name" in the same struct.
+
+There is no strict requirement for the "name" content and in the
+comment in ptp_clock_kernel.h it's reported it should just be 'A
+short "friendly name" to identify the clock'.
+Replace it with "stmmac ptp".
+
+Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
+Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index cc60b3fb08927..8f8b8f381ffd4 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -174,7 +174,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
+ /* structure describing a PTP hardware clock */
+ static struct ptp_clock_info stmmac_ptp_clock_ops = {
+ 	.owner = THIS_MODULE,
+-	.name = "stmmac_ptp_clock",
++	.name = "stmmac ptp",
+ 	.max_adj = 62500000,
+ 	.n_alarm = 0,
+ 	.n_ext_ts = 0,
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch b/queue-4.19/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
new file mode 100644
index 00000000000..b1daebfde6a
--- /dev/null
+++ b/queue-4.19/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
@@ -0,0 +1,36 @@
+From a1fd1f85be0c303349fa6f152e7b7735e04ff1ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 13:08:56 +0200
+Subject: net: stmmac: gmac4+: Not all Unicast addresses may be available
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 25683bab09a70542b9f8e3e28f79b3369e56701f ]
+
+Some setups may not have all Unicast addresses filters available. Check
+the number of available filters before trying to setup it.
+
+Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 48cf5e2b24417..bc8871e7351f2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -443,7 +443,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ 	}
+ 
+ 	/* Handle multiple unicast addresses */
+-	if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
++	if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
+ 		/* Switch to promiscuous mode if more than 128 addrs
+ 		 * are required
+ 		 */
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch b/queue-4.19/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
new file mode 100644
index 00000000000..59ebd9ddcd1
--- /dev/null
+++ b/queue-4.19/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
@@ -0,0 +1,40 @@
+From cd16d15762617215c430105e458ee822421b0bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2019 19:53:18 -0700
+Subject: net/tls: fix socket wmem accounting on fallback with netem
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 5c4b4608fe100838c62591877101128467e56c00 ]
+
+netem runs skb_orphan_partial() which "disconnects" the skb
+from normal TCP write memory accounting.  We should not adjust
+sk->sk_wmem_alloc on the fallback path for such skbs.
+
+Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tls/tls_device_fallback.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/tls/tls_device_fallback.c b/net/tls/tls_device_fallback.c
+index 426dd97725e4a..6cf832891b53e 100644
+--- a/net/tls/tls_device_fallback.c
++++ b/net/tls/tls_device_fallback.c
+@@ -208,6 +208,10 @@ static void complete_skb(struct sk_buff *nskb, struct sk_buff *skb, int headln)
+ 
+ 	update_chksum(nskb, headln);
+ 
++	/* sock_efree means skb must gone through skb_orphan_partial() */
++	if (nskb->destructor == sock_efree)
++		return;
++
+ 	delta = nskb->truesize - skb->truesize;
+ 	if (likely(delta < 0))
+ 		WARN_ON_ONCE(refcount_sub_and_test(-delta, &sk->sk_wmem_alloc));
+-- 
+2.20.1
+
diff --git a/queue-4.19/net-udp_gso-allow-tx-timestamp-with-udp-gso.patch b/queue-4.19/net-udp_gso-allow-tx-timestamp-with-udp-gso.patch
new file mode 100644
index 00000000000..ba7498063fa
--- /dev/null
+++ b/queue-4.19/net-udp_gso-allow-tx-timestamp-with-udp-gso.patch
@@ -0,0 +1,80 @@
+From aa1c9fbdc2daa0887926afa359045113e9530ddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2019 12:05:07 -0700
+Subject: net/udp_gso: Allow TX timestamp with UDP GSO
+
+From: Fred Klassen <fklassen@appneta.com>
+
+[ Upstream commit 76e21533a48bb42d1fa894f93f6233bf4554f45e ]
+
+Fixes an issue where TX Timestamps are not arriving on the error queue
+when UDP_SEGMENT CMSG type is combined with CMSG type SO_TIMESTAMPING.
+This can be illustrated with an updated updgso_bench_tx program which
+includes the '-T' option to test for this condition. It also introduces
+the '-P' option which will call poll() before reading the error queue.
+
+    ./udpgso_bench_tx -4ucTPv -S 1472 -l2 -D 172.16.120.18
+    poll timeout
+    udp tx:      0 MB/s        1 calls/s      1 msg/s
+
+The "poll timeout" message above indicates that TX timestamp never
+arrived.
+
+This patch preserves tx_flags for the first UDP GSO segment. Only the
+first segment is timestamped, even though in some cases there may be
+benefital in timestamping both the first and last segment.
+
+Factors in deciding on first segment timestamp only:
+
+- Timestamping both first and last segmented is not feasible. Hardware
+can only have one outstanding TS request at a time.
+
+- Timestamping last segment may under report network latency of the
+previous segments. Even though the doorbell is suppressed, the ring
+producer counter has been incremented.
+
+- Timestamping the first segment has the upside in that it reports
+timestamps from the application's view, e.g. RTT.
+
+- Timestamping the first segment has the downside that it may
+underreport tx host network latency. It appears that we have to pick
+one or the other. And possibly follow-up with a config flag to choose
+behavior.
+
+v2: Remove tests as noted by Willem de Bruijn <willemb@google.com>
+    Moving tests from net to net-next
+
+v3: Update only relevant tx_flag bits as per
+    Willem de Bruijn <willemb@google.com>
+
+v4: Update comments and commit message as per
+    Willem de Bruijn <willemb@google.com>
+
+Fixes: ee80d1ebe5ba ("udp: add udp gso")
+Signed-off-by: Fred Klassen <fklassen@appneta.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_offload.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
+index 0c0522b79b43f..aa343654abfc0 100644
+--- a/net/ipv4/udp_offload.c
++++ b/net/ipv4/udp_offload.c
+@@ -227,6 +227,11 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
+ 	seg = segs;
+ 	uh = udp_hdr(seg);
+ 
++	/* preserve TX timestamp flags and TS key for first segment */
++	skb_shinfo(seg)->tskey = skb_shinfo(gso_skb)->tskey;
++	skb_shinfo(seg)->tx_flags |=
++			(skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP);
++
+ 	/* compute checksum adjustment based on old length versus new */
+ 	newlen = htons(sizeof(*uh) + mss);
+ 	check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-ctnetlink-honor-ips_offload-flag.patch b/queue-4.19/netfilter-ctnetlink-honor-ips_offload-flag.patch
new file mode 100644
index 00000000000..916a8b8e96e
--- /dev/null
+++ b/queue-4.19/netfilter-ctnetlink-honor-ips_offload-flag.patch
@@ -0,0 +1,48 @@
+From d8692f8556786af124e3d40149cb528feed37040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2019 19:37:42 +0200
+Subject: netfilter: ctnetlink: honor IPS_OFFLOAD flag
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit b067fa009c884401d23846251031c1f14d8a9c77 ]
+
+If this flag is set, timeout and state are irrelevant to userspace.
+
+Fixes: 90964016e5d3 ("netfilter: nf_conntrack: add IPS_OFFLOAD status bit")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 7ba9ea55816a6..31fa94064a620 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -555,10 +555,8 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ 		goto nla_put_failure;
+ 
+ 	if (ctnetlink_dump_status(skb, ct) < 0 ||
+-	    ctnetlink_dump_timeout(skb, ct) < 0 ||
+ 	    ctnetlink_dump_acct(skb, ct, type) < 0 ||
+ 	    ctnetlink_dump_timestamp(skb, ct) < 0 ||
+-	    ctnetlink_dump_protoinfo(skb, ct) < 0 ||
+ 	    ctnetlink_dump_helpinfo(skb, ct) < 0 ||
+ 	    ctnetlink_dump_mark(skb, ct) < 0 ||
+ 	    ctnetlink_dump_secctx(skb, ct) < 0 ||
+@@ -570,6 +568,11 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ 	    ctnetlink_dump_ct_synproxy(skb, ct) < 0)
+ 		goto nla_put_failure;
+ 
++	if (!test_bit(IPS_OFFLOAD_BIT, &ct->status) &&
++	    (ctnetlink_dump_timeout(skb, ct) < 0 ||
++	     ctnetlink_dump_protoinfo(skb, ct) < 0))
++		goto nla_put_failure;
++
+ 	nlmsg_end(skb, nlh);
+ 	return skb->len;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-ebtables-config_compat-reject-trailing-dat.patch b/queue-4.19/netfilter-ebtables-config_compat-reject-trailing-dat.patch
new file mode 100644
index 00000000000..667ed35d0e8
--- /dev/null
+++ b/queue-4.19/netfilter-ebtables-config_compat-reject-trailing-dat.patch
@@ -0,0 +1,44 @@
+From 9ea39f251b453aa5e8c2cad1505ac0b38e2c409a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2019 18:47:33 +0200
+Subject: netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last
+ rule
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]
+
+If userspace provides a rule blob with trailing data after last target,
+we trigger a splat, then convert ruleset to 64bit format (with trailing
+data), then pass that to do_replace_finish() which then returns -EINVAL.
+
+Erroring out right away avoids the splat plus unneeded translation and
+error unwind.
+
+Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebtables.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 785e19afd6aaa..f59230e4fc295 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2165,7 +2165,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	WARN_ON(size_remaining);
++	if (size_remaining)
++		return -EINVAL;
++
+ 	return state->buf_kern_offset;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nf_flow_table-do-not-remove-offload-when-o.patch b/queue-4.19/netfilter-nf_flow_table-do-not-remove-offload-when-o.patch
new file mode 100644
index 00000000000..87078e50372
--- /dev/null
+++ b/queue-4.19/netfilter-nf_flow_table-do-not-remove-offload-when-o.patch
@@ -0,0 +1,54 @@
+From 3edfff84c95261b096be25ef9244332350e82177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 03:46:29 +0900
+Subject: netfilter: nf_flow_table: do not remove offload when other netns's
+ interface is down
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit a3fb3698cadf27dc142b24394c401625e14d80d0 ]
+
+When interface is down, offload cleanup function(nf_flow_table_do_cleanup)
+is called and that checks whether interface index of offload and
+index of link down interface is same. but only interface index checking
+is not enough because flowtable is not pernet list.
+So that, if other netns's interface that has index is same with offload
+is down, that offload will be removed.
+This patch adds netns checking code to the offload cleanup routine.
+
+Fixes: 59c466dd68e7 ("netfilter: nf_flow_table: add a new flow state for tearing down offloading")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_flow_table_core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index 70bd730ca0597..890799c16aa41 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -491,14 +491,17 @@ EXPORT_SYMBOL_GPL(nf_flow_table_init);
+ static void nf_flow_table_do_cleanup(struct flow_offload *flow, void *data)
+ {
+ 	struct net_device *dev = data;
++	struct flow_offload_entry *e;
++
++	e = container_of(flow, struct flow_offload_entry, flow);
+ 
+ 	if (!dev) {
+ 		flow_offload_teardown(flow);
+ 		return;
+ 	}
+-
+-	if (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
+-	    flow->tuplehash[1].tuple.iifidx == dev->ifindex)
++	if (net_eq(nf_ct_net(e->ct), dev_net(dev)) &&
++	    (flow->tuplehash[0].tuple.iifidx == dev->ifindex ||
++	     flow->tuplehash[1].tuple.iifidx == dev->ifindex))
+ 		flow_offload_dead(flow);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nf_tables-correct-nft_loglevel_max-value.patch b/queue-4.19/netfilter-nf_tables-correct-nft_loglevel_max-value.patch
new file mode 100644
index 00000000000..3067efbfe0f
--- /dev/null
+++ b/queue-4.19/netfilter-nf_tables-correct-nft_loglevel_max-value.patch
@@ -0,0 +1,35 @@
+From 7e66c02052b7d6a7e32bff4c93da49b01dacf9b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 May 2019 20:42:37 +0200
+Subject: netfilter: nf_tables: correct NFT_LOGLEVEL_MAX value
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 92285a079eedfe104a773a7c4293f77a01f456fb ]
+
+should be same as NFT_LOGLEVEL_AUDIT, so use -, not +.
+
+Fixes: 7eced5ab5a73 ("netfilter: nf_tables: add NFT_LOGLEVEL_* enumeration and use it")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter/nf_tables.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index 325ec6ef0a764..5eac62e1b68d5 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -1128,7 +1128,7 @@ enum nft_log_level {
+ 	NFT_LOGLEVEL_AUDIT,
+ 	__NFT_LOGLEVEL_MAX
+ };
+-#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX + 1)
++#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
+ 
+ /**
+  * enum nft_queue_attributes - nf_tables queue expression netlink attributes
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nft_flow_offload-add-entry-to-flowtable-af.patch b/queue-4.19/netfilter-nft_flow_offload-add-entry-to-flowtable-af.patch
new file mode 100644
index 00000000000..0260a43d235
--- /dev/null
+++ b/queue-4.19/netfilter-nft_flow_offload-add-entry-to-flowtable-af.patch
@@ -0,0 +1,45 @@
+From f640e222cba1c812ca933980f3ec26a6c12dc449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:54:56 +0200
+Subject: netfilter: nft_flow_offload: add entry to flowtable after
+ confirmation
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 270a8a297f42ecff82060aaa53118361f09c1f7d ]
+
+This is fixing flow offload for UDP traffic where packets only follow
+one single direction.
+
+The flow_offload_fixup_tcp() mechanism works fine in case that the
+offloaded entry remains in SYN_RECV state, given sequence tracking is
+reset and that conntrack handles syn+ack packets as a retransmission, ie.
+
+	sES + synack => sIG
+
+for reply traffic.
+
+Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 1ef8cb789c41a..166edea0e4527 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -103,8 +103,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ 	    ct->status & IPS_SEQ_ADJUST)
+ 		goto out;
+ 
+-	if (ctinfo == IP_CT_NEW ||
+-	    ctinfo == IP_CT_RELATED)
++	if (!nf_ct_is_confirmed(ct))
+ 		goto out;
+ 
+ 	if (test_and_set_bit(IPS_OFFLOAD_BIT, &ct->status))
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nft_osf-usage-from-output-path-is-not-vali.patch b/queue-4.19/netfilter-nft_osf-usage-from-output-path-is-not-vali.patch
new file mode 100644
index 00000000000..78f3ce45cac
--- /dev/null
+++ b/queue-4.19/netfilter-nft_osf-usage-from-output-path-is-not-vali.patch
@@ -0,0 +1,51 @@
+From 7c9f62f94815c12204e024905416e7715c30c34d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 09:56:09 +0200
+Subject: netfilter: nft_osf: usage from output path is not valid
+
+From: Fernando Fernandez Mancera <ffmancera@riseup.net>
+
+[ Upstream commit 4a3e71b7b7dbaf3562be9d508260935aa13cb48b ]
+
+The nft_osf extension, like xt_osf, is not supported from the output
+path.
+
+Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
+Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_osf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
+index a35fb59ace732..df4e3e0412ed3 100644
+--- a/net/netfilter/nft_osf.c
++++ b/net/netfilter/nft_osf.c
+@@ -69,6 +69,15 @@ nla_put_failure:
+ 	return -1;
+ }
+ 
++static int nft_osf_validate(const struct nft_ctx *ctx,
++			    const struct nft_expr *expr,
++			    const struct nft_data **data)
++{
++	return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) |
++						    (1 << NF_INET_PRE_ROUTING) |
++						    (1 << NF_INET_FORWARD));
++}
++
+ static struct nft_expr_type nft_osf_type;
+ static const struct nft_expr_ops nft_osf_op = {
+ 	.eval		= nft_osf_eval,
+@@ -76,6 +85,7 @@ static const struct nft_expr_ops nft_osf_op = {
+ 	.init		= nft_osf_init,
+ 	.dump		= nft_osf_dump,
+ 	.type		= &nft_osf_type,
++	.validate	= nft_osf_validate,
+ };
+ 
+ static struct nft_expr_type nft_osf_type __read_mostly = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nft_set_hash-bogus-element-self-comparison.patch b/queue-4.19/netfilter-nft_set_hash-bogus-element-self-comparison.patch
new file mode 100644
index 00000000000..c85b50a64bd
--- /dev/null
+++ b/queue-4.19/netfilter-nft_set_hash-bogus-element-self-comparison.patch
@@ -0,0 +1,38 @@
+From 1b9eb284f5195b6e58360d510ecc2c4ee103c335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Feb 2019 14:13:42 +0100
+Subject: netfilter: nft_set_hash: bogus element self comparison from
+ deactivation path
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit a01cbae57ec29b161d42ee1caa4ffffda5d519c2 ]
+
+Use the element from the loop iteration, not the same element we want to
+deactivate otherwise this branch always evaluates true.
+
+Fixes: 6c03ae210ce3 ("netfilter: nft_set_hash: add non-resizable hashtable implementation")
+Reported-by: Florian Westphal <fw@strlen.de>
+Tested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index 8dde4bfe8b8a4..05118e03c3e48 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -555,7 +555,7 @@ static void *nft_hash_deactivate(const struct net *net,
+ 
+ 	hash = nft_jhash(set, priv, &this->ext);
+ 	hlist_for_each_entry(he, &priv->table[hash], node) {
+-		if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
++		if (!memcmp(nft_set_ext_key(&he->ext), &elem->key.val,
+ 			    set->klen) &&
+ 		    nft_set_elem_active(&he->ext, genmask)) {
+ 			nft_set_elem_change_active(net, set, &he->ext);
+-- 
+2.20.1
+
diff --git a/queue-4.19/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch b/queue-4.19/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch
new file mode 100644
index 00000000000..6ae68dfc8e2
--- /dev/null
+++ b/queue-4.19/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch
@@ -0,0 +1,73 @@
+From d0710654e7584b3fb91fe9467d8600c946193a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Feb 2019 14:13:41 +0100
+Subject: netfilter: nft_set_hash: fix lookups with fixed size hash on big
+ endian
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 3b02b0adc242a72b5e46019b6a9e4f84823592f6 ]
+
+Call jhash_1word() for the 4-bytes key case from the insertion and
+deactivation path, otherwise big endian arch set lookups fail.
+
+Fixes: 446a8268b7f5 ("netfilter: nft_set_hash: add lookup variant for fixed size hashtable")
+Reported-by: Florian Westphal <fw@strlen.de>
+Tested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_hash.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index 015124e649cbd..8dde4bfe8b8a4 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -488,6 +488,23 @@ static bool nft_hash_lookup_fast(const struct net *net,
+ 	return false;
+ }
+ 
++static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv,
++		     const struct nft_set_ext *ext)
++{
++	const struct nft_data *key = nft_set_ext_key(ext);
++	u32 hash, k1;
++
++	if (set->klen == 4) {
++		k1 = *(u32 *)key;
++		hash = jhash_1word(k1, priv->seed);
++	} else {
++		hash = jhash(key, set->klen, priv->seed);
++	}
++	hash = reciprocal_scale(hash, priv->buckets);
++
++	return hash;
++}
++
+ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
+ 			   const struct nft_set_elem *elem,
+ 			   struct nft_set_ext **ext)
+@@ -497,8 +514,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
+ 	u8 genmask = nft_genmask_next(net);
+ 	u32 hash;
+ 
+-	hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
+-	hash = reciprocal_scale(hash, priv->buckets);
++	hash = nft_jhash(set, priv, &this->ext);
+ 	hlist_for_each_entry(he, &priv->table[hash], node) {
+ 		if (!memcmp(nft_set_ext_key(&this->ext),
+ 			    nft_set_ext_key(&he->ext), set->klen) &&
+@@ -537,8 +553,7 @@ static void *nft_hash_deactivate(const struct net *net,
+ 	u8 genmask = nft_genmask_next(net);
+ 	u32 hash;
+ 
+-	hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
+-	hash = reciprocal_scale(hash, priv->buckets);
++	hash = nft_jhash(set, priv, &this->ext);
+ 	hlist_for_each_entry(he, &priv->table[hash], node) {
+ 		if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
+ 			    set->klen) &&
+-- 
+2.20.1
+
diff --git a/queue-4.19/netvsc-unshare-skb-in-vf-rx-handler.patch b/queue-4.19/netvsc-unshare-skb-in-vf-rx-handler.patch
new file mode 100644
index 00000000000..eabf6d8249f
--- /dev/null
+++ b/queue-4.19/netvsc-unshare-skb-in-vf-rx-handler.patch
@@ -0,0 +1,45 @@
+From f5ab5cc511f81848f16a1b890f8bdd64c23ee1ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 May 2019 11:47:30 -0700
+Subject: netvsc: unshare skb in VF rx handler
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 996ed04741467f6d1552440c92988b132a9487ec ]
+
+The netvsc VF skb handler should make sure that skb is not
+shared. Similar logic already exists in bonding and team device
+drivers.
+
+This is not an issue in practice because the VF devicex
+does not send up shared skb's. But the netvsc driver
+should do the right thing if it did.
+
+Fixes: 0c195567a8f6 ("netvsc: transparent VF management")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 1f9f7fcdb0eb3..54670c9905c79 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -2004,6 +2004,12 @@ static rx_handler_result_t netvsc_vf_handle_frame(struct sk_buff **pskb)
+ 	struct netvsc_vf_pcpu_stats *pcpu_stats
+ 		 = this_cpu_ptr(ndev_ctx->vf_stats);
+ 
++	skb = skb_share_check(skb, GFP_ATOMIC);
++	if (unlikely(!skb))
++		return RX_HANDLER_CONSUMED;
++
++	*pskb = skb;
++
+ 	skb->dev = ndev;
+ 
+ 	u64_stats_update_begin(&pcpu_stats->syncp);
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfp-bpf-fix-static-check-error-through-tightening-sh.patch b/queue-4.19/nfp-bpf-fix-static-check-error-through-tightening-sh.patch
new file mode 100644
index 00000000000..5a0dd98bf3f
--- /dev/null
+++ b/queue-4.19/nfp-bpf-fix-static-check-error-through-tightening-sh.patch
@@ -0,0 +1,66 @@
+From 885f3f093a0b4c9b23e8cec8bc2b902e58edf531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 May 2019 17:41:30 +0100
+Subject: nfp: bpf: fix static check error through tightening shift amount
+ adjustment
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiong Wang <jiong.wang@netronome.com>
+
+[ Upstream commit 69e168ebdcfcb87ce7252d4857d570f99996fa27 ]
+
+NFP shift instruction has something special. If shift direction is left
+then shift amount of 1 to 31 is specified as 32 minus the amount to shift.
+
+But no need to do this for indirect shift which has shift amount be 0. Even
+after we do this subtraction, shift amount 0 will be turned into 32 which
+will eventually be encoded the same as 0 because only low 5 bits are
+encoded, but shift amount be 32 will fail the FIELD_PREP check done later
+on shift mask (0x1f), due to 32 is out of mask range. Such error has been
+observed when compiling nfp/bpf/jit.c using gcc 8.3 + O3.
+
+This issue has started when indirect shift support added after which the
+incoming shift amount to __emit_shf could be 0, therefore it is at that
+time shift amount adjustment inside __emit_shf should have been tightened.
+
+Fixes: 991f5b3651f6 ("nfp: bpf: support logic indirect shifts (BPF_[L|R]SH | BPF_X)")
+Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Reported-by: Pablo Cascón <pablo.cascon@netronome.com
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/bpf/jit.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/bpf/jit.c b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+index 4e18d95e548f1..c3ce0fb47a0f0 100644
+--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+@@ -326,7 +326,18 @@ __emit_shf(struct nfp_prog *nfp_prog, u16 dst, enum alu_dst_ab dst_ab,
+ 		return;
+ 	}
+ 
+-	if (sc == SHF_SC_L_SHF)
++	/* NFP shift instruction has something special. If shift direction is
++	 * left then shift amount of 1 to 31 is specified as 32 minus the amount
++	 * to shift.
++	 *
++	 * But no need to do this for indirect shift which has shift amount be
++	 * 0. Even after we do this subtraction, shift amount 0 will be turned
++	 * into 32 which will eventually be encoded the same as 0 because only
++	 * low 5 bits are encoded, but shift amount be 32 will fail the
++	 * FIELD_PREP check done later on shift mask (0x1f), due to 32 is out of
++	 * mask range.
++	 */
++	if (sc == SHF_SC_L_SHF && shift)
+ 		shift = 32 - shift;
+ 
+ 	insn = OP_SHF_BASE |
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfp-fix-simple-vnic-mailbox-length.patch b/queue-4.19/nfp-fix-simple-vnic-mailbox-length.patch
new file mode 100644
index 00000000000..5cd739f5f4d
--- /dev/null
+++ b/queue-4.19/nfp-fix-simple-vnic-mailbox-length.patch
@@ -0,0 +1,41 @@
+From c5e426ab25cd30d043c8579b2ab9bdd7478fa87f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 10:52:13 -0800
+Subject: nfp: fix simple vNIC mailbox length
+
+From: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+
+[ Upstream commit eaab2d2d0fe4393b040dbf3922e18cd2ab7d6b85 ]
+
+The simple vNIC mailbox length should be 12 decimal and not 0x12.
+Using a decimal also makes it clear this is a length value and not
+another field within the simple mailbox defines.
+
+Found by code inspection, there are no known firmware configurations
+where this would cause issues.
+
+Fixes: 527d7d1b9949 ("nfp: read mailbox address from TLV caps")
+Signed-off-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+index 44d3ea75d043a..ab602a79b084d 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+@@ -423,7 +423,7 @@
+ #define NFP_NET_CFG_MBOX_SIMPLE_CMD	0x0
+ #define NFP_NET_CFG_MBOX_SIMPLE_RET	0x4
+ #define NFP_NET_CFG_MBOX_SIMPLE_VAL	0x8
+-#define NFP_NET_CFG_MBOX_SIMPLE_LEN	0x12
++#define NFP_NET_CFG_MBOX_SIMPLE_LEN	12
+ 
+ #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1
+ #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfs-add-missing-encode-decode-sequence_maxsz-to-v4.2.patch b/queue-4.19/nfs-add-missing-encode-decode-sequence_maxsz-to-v4.2.patch
new file mode 100644
index 00000000000..d63f9afad3a
--- /dev/null
+++ b/queue-4.19/nfs-add-missing-encode-decode-sequence_maxsz-to-v4.2.patch
@@ -0,0 +1,88 @@
+From a65588f9b68a9bb749973265cb0e835fcf869ca5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 16:09:56 -0500
+Subject: NFS: Add missing encode / decode sequence_maxsz to v4.2 operations
+
+From: Anna Schumaker <Anna.Schumaker@Netapp.com>
+
+[ Upstream commit 1a3466aed3a17eed41cd9411f89eb637f58349b0 ]
+
+These really should have been there from the beginning, but we never
+noticed because there was enough slack in the RPC request for the extra
+bytes. Chuck's recent patch to use au_cslack and au_rslack to compute
+buffer size shrunk the buffer enough that this was now a problem for
+SEEK operations on my test client.
+
+Fixes: f4ac1674f5da4 ("nfs: Add ALLOCATE support")
+Fixes: 2e72448b07dc3 ("NFS: Add COPY nfs operation")
+Fixes: cb95deea0b4aa ("NFS OFFLOAD_CANCEL xdr")
+Fixes: 624bd5b7b683c ("nfs: Add DEALLOCATE support")
+Fixes: 1c6dcbe5ceff8 ("NFS: Implement SEEK")
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42xdr.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
+index 69f72ed2bf879..ec9803088f6b8 100644
+--- a/fs/nfs/nfs42xdr.c
++++ b/fs/nfs/nfs42xdr.c
+@@ -59,43 +59,53 @@
+ #define decode_clone_maxsz		(op_decode_hdr_maxsz)
+ 
+ #define NFS4_enc_allocate_sz		(compound_encode_hdr_maxsz + \
++					 encode_sequence_maxsz + \
+ 					 encode_putfh_maxsz + \
+ 					 encode_allocate_maxsz + \
+ 					 encode_getattr_maxsz)
+ #define NFS4_dec_allocate_sz		(compound_decode_hdr_maxsz + \
++					 decode_sequence_maxsz + \
+ 					 decode_putfh_maxsz + \
+ 					 decode_allocate_maxsz + \
+ 					 decode_getattr_maxsz)
+ #define NFS4_enc_copy_sz		(compound_encode_hdr_maxsz + \
++					 encode_sequence_maxsz + \
+ 					 encode_putfh_maxsz + \
+ 					 encode_savefh_maxsz + \
+ 					 encode_putfh_maxsz + \
+ 					 encode_copy_maxsz + \
+ 					 encode_commit_maxsz)
+ #define NFS4_dec_copy_sz		(compound_decode_hdr_maxsz + \
++					 decode_sequence_maxsz + \
+ 					 decode_putfh_maxsz + \
+ 					 decode_savefh_maxsz + \
+ 					 decode_putfh_maxsz + \
+ 					 decode_copy_maxsz + \
+ 					 decode_commit_maxsz)
+ #define NFS4_enc_offload_cancel_sz	(compound_encode_hdr_maxsz + \
++					 encode_sequence_maxsz + \
+ 					 encode_putfh_maxsz + \
+ 					 encode_offload_cancel_maxsz)
+ #define NFS4_dec_offload_cancel_sz	(compound_decode_hdr_maxsz + \
++					 decode_sequence_maxsz + \
+ 					 decode_putfh_maxsz + \
+ 					 decode_offload_cancel_maxsz)
+ #define NFS4_enc_deallocate_sz		(compound_encode_hdr_maxsz + \
++					 encode_sequence_maxsz + \
+ 					 encode_putfh_maxsz + \
+ 					 encode_deallocate_maxsz + \
+ 					 encode_getattr_maxsz)
+ #define NFS4_dec_deallocate_sz		(compound_decode_hdr_maxsz + \
++					 decode_sequence_maxsz + \
+ 					 decode_putfh_maxsz + \
+ 					 decode_deallocate_maxsz + \
+ 					 decode_getattr_maxsz)
+ #define NFS4_enc_seek_sz		(compound_encode_hdr_maxsz + \
++					 encode_sequence_maxsz + \
+ 					 encode_putfh_maxsz + \
+ 					 encode_seek_maxsz)
+ #define NFS4_dec_seek_sz		(compound_decode_hdr_maxsz + \
++					 decode_sequence_maxsz + \
+ 					 decode_putfh_maxsz + \
+ 					 decode_seek_maxsz)
+ #define NFS4_enc_layoutstats_sz		(compound_encode_hdr_maxsz + \
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch b/queue-4.19/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch
new file mode 100644
index 00000000000..9a097813d23
--- /dev/null
+++ b/queue-4.19/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch
@@ -0,0 +1,37 @@
+From 39f81c65c1bdc95b850d24d5a096ae2916b8eef2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Apr 2019 13:59:02 -0400
+Subject: NFS: Don't interrupt file writeout due to fatal errors
+
+From: Trond Myklebust <trondmy@gmail.com>
+
+[ Upstream commit 14bebe3c90b326d2a0df78aed5e9de090c71d878 ]
+
+When flushing out dirty pages, the fact that we may hit fatal errors
+is not a reason to stop writeback. Those errors are reported through
+fsync(), not through the flush mechanism.
+
+Fixes: a6598813a4c5b ("NFS: Don't write back further requests if there...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 117ffd90419e2..e27637fa0f790 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -646,7 +646,7 @@ out:
+ 	return ret;
+ out_launder:
+ 	nfs_write_error_remove_page(req);
+-	return ret;
++	return 0;
+ }
+ 
+ static int nfs_do_writepage(struct page *page, struct writeback_control *wbc,
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch b/queue-4.19/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
new file mode 100644
index 00000000000..2394e8ddc3f
--- /dev/null
+++ b/queue-4.19/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
@@ -0,0 +1,83 @@
+From aec9ba3bde0ad867bd4bb09169ea46332e24e8ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Feb 2019 14:51:25 -0500
+Subject: NFS: Fix a soft lockup in the delegation recovery code
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ]
+
+Fix a soft lockup when NFS client delegation recovery is attempted
+but the inode is in the process of being freed. When the
+igrab(inode) call fails, and we have to restart the recovery process,
+we need to ensure that we won't attempt to recover the same delegation
+again.
+
+Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 20 ++++++++++++--------
+ fs/nfs/delegation.h |  1 +
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 74ff459b75efa..b0c0c2fc2fbac 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -240,6 +240,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
+ 	spin_lock(&delegation->lock);
+ 	if (delegation->inode != NULL)
+ 		inode = igrab(delegation->inode);
++	if (!inode)
++		set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
+ 	spin_unlock(&delegation->lock);
+ 	return inode;
+ }
+@@ -955,10 +957,11 @@ restart:
+ 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ 		list_for_each_entry_rcu(delegation, &server->delegations,
+ 								super_list) {
+-			if (test_bit(NFS_DELEGATION_RETURNING,
+-						&delegation->flags))
+-				continue;
+-			if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
++			if (test_bit(NFS_DELEGATION_INODE_FREEING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_RETURNING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_NEED_RECLAIM,
+ 						&delegation->flags) == 0)
+ 				continue;
+ 			if (!nfs_sb_active(server->super))
+@@ -1064,10 +1067,11 @@ restart:
+ 	list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ 		list_for_each_entry_rcu(delegation, &server->delegations,
+ 								super_list) {
+-			if (test_bit(NFS_DELEGATION_RETURNING,
+-						&delegation->flags))
+-				continue;
+-			if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
++			if (test_bit(NFS_DELEGATION_INODE_FREEING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_RETURNING,
++						&delegation->flags) ||
++			    test_bit(NFS_DELEGATION_TEST_EXPIRED,
+ 						&delegation->flags) == 0)
+ 				continue;
+ 			if (!nfs_sb_active(server->super))
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index dd0f3eed3890d..f09b153ac82ff 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -34,6 +34,7 @@ enum {
+ 	NFS_DELEGATION_RETURNING,
+ 	NFS_DELEGATION_REVOKED,
+ 	NFS_DELEGATION_TEST_EXPIRED,
++	NFS_DELEGATION_INODE_FREEING,
+ };
+ 
+ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred,
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch b/queue-4.19/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch
new file mode 100644
index 00000000000..84c6642d65d
--- /dev/null
+++ b/queue-4.19/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch
@@ -0,0 +1,94 @@
+From e0892756282109b44da5860e5ca30b6376738131 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 14:20:27 -0500
+Subject: NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 5085607d209102b37b169bc94d0aa39566a9842a ]
+
+If a bulk layout recall or a metadata server reboot coincides with a
+umount, then holding a reference to an inode is unsafe unless we
+also hold a reference to the super block.
+
+Fixes: fd9a8d7160937 ("NFSv4.1: Fix bulk recall and destroy of layouts")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
+ fs/nfs/pnfs.h |  1 +
+ 2 files changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index c818f9886f618..66f699e18755c 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -758,22 +758,35 @@ static int
+ pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp,
+ 		struct nfs_server *server,
+ 		struct list_head *layout_list)
++	__must_hold(&clp->cl_lock)
++	__must_hold(RCU)
+ {
+ 	struct pnfs_layout_hdr *lo, *next;
+ 	struct inode *inode;
+ 
+ 	list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) {
+-		if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags))
++		if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
++		    test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) ||
++		    !list_empty(&lo->plh_bulk_destroy))
+ 			continue;
++		/* If the sb is being destroyed, just bail */
++		if (!nfs_sb_active(server->super))
++			break;
+ 		inode = igrab(lo->plh_inode);
+-		if (inode == NULL)
+-			continue;
+-		list_del_init(&lo->plh_layouts);
+-		if (pnfs_layout_add_bulk_destroy_list(inode, layout_list))
+-			continue;
+-		rcu_read_unlock();
+-		spin_unlock(&clp->cl_lock);
+-		iput(inode);
++		if (inode != NULL) {
++			list_del_init(&lo->plh_layouts);
++			if (pnfs_layout_add_bulk_destroy_list(inode,
++						layout_list))
++				continue;
++			rcu_read_unlock();
++			spin_unlock(&clp->cl_lock);
++			iput(inode);
++		} else {
++			rcu_read_unlock();
++			spin_unlock(&clp->cl_lock);
++			set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags);
++		}
++		nfs_sb_deactive(server->super);
+ 		spin_lock(&clp->cl_lock);
+ 		rcu_read_lock();
+ 		return -EAGAIN;
+@@ -811,7 +824,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list,
+ 		/* Free all lsegs that are attached to commit buckets */
+ 		nfs_commit_inode(inode, 0);
+ 		pnfs_put_layout_hdr(lo);
+-		iput(inode);
++		nfs_iput_and_deactive(inode);
+ 	}
+ 	return ret;
+ }
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index ece367ebde692..3ba44819a88ae 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -104,6 +104,7 @@ enum {
+ 	NFS_LAYOUT_RETURN_REQUESTED,	/* Return this layout ASAP */
+ 	NFS_LAYOUT_INVALID_STID,	/* layout stateid id is invalid */
+ 	NFS_LAYOUT_FIRST_LAYOUTGET,	/* Serialize first layoutget */
++	NFS_LAYOUT_INODE_FREEING,	/* The inode is being freed */
+ };
+ 
+ enum layoutdriver_policy_flags {
+-- 
+2.20.1
+
diff --git a/queue-4.19/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch b/queue-4.19/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch
new file mode 100644
index 00000000000..786917e8019
--- /dev/null
+++ b/queue-4.19/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch
@@ -0,0 +1,73 @@
+From 3482dd431e301c8b43c1df82ab5669a0b1f00180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 11:19:46 -0500
+Subject: NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 108bb4afd351d65826648a47f11fa3104e250d9b ]
+
+If the attempt to instantiate the mirror's layout DS pointer failed,
+then that pointer may hold a value of type ERR_PTR(), so we need
+to check that before we dereference it.
+
+Fixes: 65990d1afbd2d ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.h | 32 +++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
+index de50a342d5a50..2ac99124474cb 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.h
++++ b/fs/nfs/flexfilelayout/flexfilelayout.h
+@@ -132,16 +132,6 @@ FF_LAYOUT_LSEG(struct pnfs_layout_segment *lseg)
+ 			    generic_hdr);
+ }
+ 
+-static inline struct nfs4_deviceid_node *
+-FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
+-{
+-	if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt ||
+-	    FF_LAYOUT_LSEG(lseg)->mirror_array[idx] == NULL ||
+-	    FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds == NULL)
+-		return NULL;
+-	return &FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds->id_node;
+-}
+-
+ static inline struct nfs4_ff_layout_ds *
+ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
+ {
+@@ -151,9 +141,25 @@ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
+ static inline struct nfs4_ff_layout_mirror *
+ FF_LAYOUT_COMP(struct pnfs_layout_segment *lseg, u32 idx)
+ {
+-	if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt)
+-		return NULL;
+-	return FF_LAYOUT_LSEG(lseg)->mirror_array[idx];
++	struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
++
++	if (idx < fls->mirror_array_cnt)
++		return fls->mirror_array[idx];
++	return NULL;
++}
++
++static inline struct nfs4_deviceid_node *
++FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
++{
++	struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, idx);
++
++	if (mirror != NULL) {
++		struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds;
++
++		if (!IS_ERR_OR_NULL(mirror_ds))
++			return &mirror_ds->id_node;
++	}
++	return NULL;
+ }
+ 
+ static inline u32
+-- 
+2.20.1
+
diff --git a/queue-4.19/nios2-ksyms-add-missing-symbol-exports.patch b/queue-4.19/nios2-ksyms-add-missing-symbol-exports.patch
new file mode 100644
index 00000000000..c7a9b0611e0
--- /dev/null
+++ b/queue-4.19/nios2-ksyms-add-missing-symbol-exports.patch
@@ -0,0 +1,67 @@
+From d32ecc70681ad85a62c90d4df1b5378a3bb50234 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:36:10 +0800
+Subject: nios2: ksyms: Add missing symbol exports
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]
+
+Building nios2:allmodconfig fails as follows (each symbol is only listed
+once).
+
+ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
+ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
+ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
+ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
+ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
+ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!
+
+The problem is seen with gcc 7.3.0.
+
+Export the missing symbols.
+
+Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
+index bf2f55d10a4d8..4e704046a150c 100644
+--- a/arch/nios2/kernel/nios2_ksyms.c
++++ b/arch/nios2/kernel/nios2_ksyms.c
+@@ -9,12 +9,20 @@
+ #include <linux/export.h>
+ #include <linux/string.h>
+ 
++#include <asm/cacheflush.h>
++#include <asm/pgtable.h>
++
+ /* string functions */
+ 
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memmove);
+ 
++/* memory management */
++
++EXPORT_SYMBOL(empty_zero_page);
++EXPORT_SYMBOL(flush_icache_range);
++
+ /*
+  * libgcc functions - functions that are used internally by the
+  * compiler...  (prototypes are not correct though, but that
+@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
+ DECLARE_EXPORT(__umoddi3);
+ DECLARE_EXPORT(__umodsi3);
+ DECLARE_EXPORT(__muldi3);
++DECLARE_EXPORT(__ucmpdi2);
++DECLARE_EXPORT(__lshrdi3);
++DECLARE_EXPORT(__ashldi3);
++DECLARE_EXPORT(__ashrdi3);
+-- 
+2.20.1
+
diff --git a/queue-4.19/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch b/queue-4.19/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch
new file mode 100644
index 00000000000..734fbf244a2
--- /dev/null
+++ b/queue-4.19/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch
@@ -0,0 +1,54 @@
+From afb3c7a8691f449838d91489fcff680647933439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 17:13:06 -0500
+Subject: NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 1b7619828d0c341612f58683e73f279c37e70bbc ]
+
+Both devm_kcalloc() and devm_kzalloc() return NULL on error. They
+never return error pointers.
+
+The use of IS_ERR_OR_NULL is currently applied to the wrong
+context.
+
+Fix this by replacing IS_ERR_OR_NULL with regular NULL checks.
+
+Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/idt/ntb_hw_idt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
+index dbe72f116017a..a67ef23e81bca 100644
+--- a/drivers/ntb/hw/idt/ntb_hw_idt.c
++++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
+@@ -1105,9 +1105,9 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port,
+ 	}
+ 
+ 	/* Allocate memory for memory window descriptors */
+-	ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt,
+-				sizeof(*ret_mws), GFP_KERNEL);
+-	if (IS_ERR_OR_NULL(ret_mws))
++	ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws),
++			       GFP_KERNEL);
++	if (!ret_mws)
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	/* Copy the info of detected memory windows */
+@@ -2390,7 +2390,7 @@ static struct idt_ntb_dev *idt_create_dev(struct pci_dev *pdev,
+ 
+ 	/* Allocate memory for the IDT PCIe-device descriptor */
+ 	ndev = devm_kzalloc(&pdev->dev, sizeof(*ndev), GFP_KERNEL);
+-	if (IS_ERR_OR_NULL(ndev)) {
++	if (!ndev) {
+ 		dev_err(&pdev->dev, "Memory allocation failed for descriptor");
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/ntb_hw_switchtec-debug-print-64bit-aligned-crosslink.patch b/queue-4.19/ntb_hw_switchtec-debug-print-64bit-aligned-crosslink.patch
new file mode 100644
index 00000000000..a82a9d042ae
--- /dev/null
+++ b/queue-4.19/ntb_hw_switchtec-debug-print-64bit-aligned-crosslink.patch
@@ -0,0 +1,39 @@
+From 19817725d7c5de98cadc5327298950f0bb07200a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 21:30:50 +0800
+Subject: ntb_hw_switchtec: debug print 64bit aligned crosslink BAR Numbers
+
+From: Paul Selles <paul.selles@microchip.com>
+
+[ Upstream commit cce8e04cf79e47809455215744685e8eb56f94bb ]
+
+Switchtec NTB crosslink BARs are 64bit addressed but they are printed as
+32bit addressed BARs. Fix debug log to increment the BAR numbers by 2 to
+reflect the 64bit address alignment.
+
+Fixes: 017525018202 ("ntb_hw_switchtec: Add initialization code for crosslink")
+Signed-off-by: Paul Selles <paul.selles@microchip.com>
+Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 5ee5f40b4dfc3..9916bc5b6759a 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -1120,7 +1120,7 @@ static int crosslink_enum_partition(struct switchtec_ntb *sndev,
+ 
+ 		dev_dbg(&sndev->stdev->dev,
+ 			"Crosslink BAR%d addr: %llx\n",
+-			i, bar_addr);
++			i*2, bar_addr);
+ 
+ 		if (bar_addr != bar_space * i)
+ 			continue;
+-- 
+2.20.1
+
diff --git a/queue-4.19/ntb_hw_switchtec-nt-req-id-mapping-table-register-en.patch b/queue-4.19/ntb_hw_switchtec-nt-req-id-mapping-table-register-en.patch
new file mode 100644
index 00000000000..c74f62c67b7
--- /dev/null
+++ b/queue-4.19/ntb_hw_switchtec-nt-req-id-mapping-table-register-en.patch
@@ -0,0 +1,42 @@
+From 4efa2b4ea7161dca7994ca1eb284fda808608cd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 21:30:51 +0800
+Subject: ntb_hw_switchtec: NT req id mapping table register entry number
+ should be 512
+
+From: Wesley Sheng <wesley.sheng@microchip.com>
+
+[ Upstream commit d123fab71f63aae129aebe052664fda73131921a ]
+
+The number of available NT req id mapping table entries per NTB control
+register is 512. The driver mistakenly limits the number to 256.
+
+Fix the array size of NT req id mapping table.
+
+Fixes: c082b04c9d40 ("NTB: switchtec: Add NTB hardware register definitions")
+Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/switchtec.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/switchtec.h b/include/linux/switchtec.h
+index ab400af6f0ce3..623719c917061 100644
+--- a/include/linux/switchtec.h
++++ b/include/linux/switchtec.h
+@@ -244,8 +244,8 @@ struct ntb_ctrl_regs {
+ 		u64 xlate_addr;
+ 	} bar_entry[6];
+ 	u32 reserved2[216];
+-	u32 req_id_table[256];
+-	u32 reserved3[512];
++	u32 req_id_table[512];
++	u32 reserved3[256];
+ 	u64 lut_entry[512];
+ } __packed;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/ntb_hw_switchtec-potential-shift-wrapping-bug-in-swi.patch b/queue-4.19/ntb_hw_switchtec-potential-shift-wrapping-bug-in-swi.patch
new file mode 100644
index 00000000000..0c396abc620
--- /dev/null
+++ b/queue-4.19/ntb_hw_switchtec-potential-shift-wrapping-bug-in-swi.patch
@@ -0,0 +1,43 @@
+From 7db758a5e4563bb8dbe8a4444cb178caf80df7bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 12:17:26 +0300
+Subject: ntb_hw_switchtec: potential shift wrapping bug in
+ switchtec_ntb_init_sndev()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ff148d8ac53e59802645bd3200c811620317eb9f ]
+
+This code triggers a Smatch warning:
+
+    drivers/ntb/hw/mscc/ntb_hw_switchtec.c:884 switchtec_ntb_init_sndev()
+    warn: should '(1 << sndev->peer_partition)' be a 64 bit type?
+
+The "part_map" and "tpart_vec" variables are u64 type so this seems like
+a valid warning.
+
+Fixes: 3df54c870f52 ("ntb_hw_switchtec: Allow using Switchtec NTB in multi-partition setups")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+index 9916bc5b6759a..313f6258c4249 100644
+--- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
++++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c
+@@ -899,7 +899,7 @@ static int switchtec_ntb_init_sndev(struct switchtec_ntb *sndev)
+ 		}
+ 
+ 		sndev->peer_partition = ffs(tpart_vec) - 1;
+-		if (!(part_map & (1 << sndev->peer_partition))) {
++		if (!(part_map & (1ULL << sndev->peer_partition))) {
+ 			dev_err(&sndev->stdev->dev,
+ 				"ntb target partition is not NT partition\n");
+ 			return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.19/nvme-retain-split-access-workaround-for-capability-r.patch b/queue-4.19/nvme-retain-split-access-workaround-for-capability-r.patch
new file mode 100644
index 00000000000..0483aea64c2
--- /dev/null
+++ b/queue-4.19/nvme-retain-split-access-workaround-for-capability-r.patch
@@ -0,0 +1,57 @@
+From 3d00db1b02397370b9844f1281be0bca5f793c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 13:57:29 +0200
+Subject: nvme: retain split access workaround for capability reads
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 3a8ecc935efabdad106b5e06d07b150c394b4465 ]
+
+Commit 7fd8930f26be4
+
+  "nvme: add a common helper to read Identify Controller data"
+
+has re-introduced an issue that we have attempted to work around in the
+past, in commit a310acd7a7ea ("NVMe: use split lo_hi_{read,write}q").
+
+The problem is that some PCIe NVMe controllers do not implement 64-bit
+outbound accesses correctly, which is why the commit above switched
+to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in
+the code.
+
+In the mean time, the NVMe subsystem has been refactored, and now calls
+into the PCIe support layer for NVMe via a .reg_read64() method, which
+fails to use lo_hi_readq(), and thus reintroduces the problem that the
+workaround above aimed to address.
+
+Given that, at the moment, .reg_read64() is only used to read the
+capability register [which is known to tolerate split reads], let's
+switch .reg_read64() to lo_hi_readq() as well.
+
+This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys
+DesignWare PCIe host controller.
+
+Fixes: 7fd8930f26be4 ("nvme: add a common helper to read Identify Controller data")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 124f41157173e..3c68a5b35ec1b 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2396,7 +2396,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val)
+ 
+ static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
+ {
+-	*val = readq(to_nvme_dev(ctrl)->bar + off);
++	*val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/nvmem-imx-ocotp-change-timing-calculation-to-u-boot-.patch b/queue-4.19/nvmem-imx-ocotp-change-timing-calculation-to-u-boot-.patch
new file mode 100644
index 00000000000..30fba5cd926
--- /dev/null
+++ b/queue-4.19/nvmem-imx-ocotp-change-timing-calculation-to-u-boot-.patch
@@ -0,0 +1,99 @@
+From b839e7860a51a7f0c09f685181839be78953abc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 11:27:30 +0100
+Subject: nvmem: imx-ocotp: Change TIMING calculation to u-boot algorithm
+
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+
+[ Upstream commit 159dbaf57b2f4f67ecb59b2c87d071e45ed41d7e ]
+
+The RELAX field of the OCOTP block is turning out as a zero on i.MX8MM.
+This messes up the subsequent re-load of the fuse shadow registers.
+
+After some discussion with people @ NXP its clear we have missed a trick
+here in Linux.
+
+The OCOTP fuse programming time has a physical minimum 'burn time' that is
+not related to the ipg_clk.
+
+We need to define the RELAX, STROBE_READ and STROBE_PROG fields in terms of
+desired timings to allow for the burn-in to safely complete. Right now only
+the RELAX field is calculated in terms of an absolute time and we are
+ending up with a value of zero.
+
+This patch inherits the u-boot timings for the OCOTP_TIMING calculation on
+the i.MX6 and i.MX8. Those timings are known to work and critically specify
+values such as STROBE_PROG as a minimum timing.
+
+Fixes: 0642bac7da42 ("nvmem: imx-ocotp: add write support")
+
+Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Suggested-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/imx-ocotp.c | 36 ++++++++++++++++++++++++++++++++----
+ 1 file changed, 32 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index 04421a73f74aa..09281aca86c29 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -50,7 +50,9 @@
+ #define IMX_OCOTP_BM_CTRL_ERROR		0x00000200
+ #define IMX_OCOTP_BM_CTRL_REL_SHADOWS	0x00000400
+ 
+-#define DEF_RELAX			20	/* > 16.5ns */
++#define TIMING_STROBE_PROG_US		10	/* Min time to blow a fuse */
++#define TIMING_STROBE_READ_NS		37	/* Min time before read */
++#define TIMING_RELAX_NS			17
+ #define DEF_FSOURCE			1001	/* > 1000 ns */
+ #define DEF_STROBE_PROG			10000	/* IPG clocks */
+ #define IMX_OCOTP_WR_UNLOCK		0x3E770000
+@@ -182,12 +184,38 @@ static void imx_ocotp_set_imx6_timing(struct ocotp_priv *priv)
+ 	 * fields with timing values to match the current frequency of the
+ 	 * ipg_clk. OTP writes will work at maximum bus frequencies as long
+ 	 * as the HW_OCOTP_TIMING parameters are set correctly.
++	 *
++	 * Note: there are minimum timings required to ensure an OTP fuse burns
++	 * correctly that are independent of the ipg_clk. Those values are not
++	 * formally documented anywhere however, working from the minimum
++	 * timings given in u-boot we can say:
++	 *
++	 * - Minimum STROBE_PROG time is 10 microseconds. Intuitively 10
++	 *   microseconds feels about right as representative of a minimum time
++	 *   to physically burn out a fuse.
++	 *
++	 * - Minimum STROBE_READ i.e. the time to wait post OTP fuse burn before
++	 *   performing another read is 37 nanoseconds
++	 *
++	 * - Minimum RELAX timing is 17 nanoseconds. This final RELAX minimum
++	 *   timing is not entirely clear the documentation says "This
++	 *   count value specifies the time to add to all default timing
++	 *   parameters other than the Tpgm and Trd. It is given in number
++	 *   of ipg_clk periods." where Tpgm and Trd refer to STROBE_PROG
++	 *   and STROBE_READ respectively. What the other timing parameters
++	 *   are though, is not specified. Experience shows a zero RELAX
++	 *   value will mess up a re-load of the shadow registers post OTP
++	 *   burn.
+ 	 */
+ 	clk_rate = clk_get_rate(priv->clk);
+ 
+-	relax = clk_rate / (1000000000 / DEF_RELAX) - 1;
+-	strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1;
+-	strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1;
++	relax = DIV_ROUND_UP(clk_rate * TIMING_RELAX_NS, 1000000000) - 1;
++	strobe_read = DIV_ROUND_UP(clk_rate * TIMING_STROBE_READ_NS,
++				   1000000000);
++	strobe_read += 2 * (relax + 1) - 1;
++	strobe_prog = DIV_ROUND_CLOSEST(clk_rate * TIMING_STROBE_PROG_US,
++					1000000);
++	strobe_prog += 2 * (relax + 1) - 1;
+ 
+ 	timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000;
+ 	timing |= strobe_prog & 0x00000FFF;
+-- 
+2.20.1
+
diff --git a/queue-4.19/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch b/queue-4.19/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch
new file mode 100644
index 00000000000..86e1404b77f
--- /dev/null
+++ b/queue-4.19/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch
@@ -0,0 +1,47 @@
+From d6683eb48c3322935c513cfc714b9624dc1508d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 11:27:29 +0100
+Subject: nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing
+
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+
+[ Upstream commit 0493c4792b4eb260441e57f52cc11a9ded48b5a7 ]
+
+The i.MX6 and i.MX8 both have a bit-field spanning bits 27:22 called the
+WAIT field.
+
+The WAIT field according to the documentation for both parts "specifies
+time interval between auto read and write access in one time program. It is
+given in number of ipg_clk periods."
+
+This patch ensures that the relevant field is read and written back to the
+timing register.
+
+Fixes: 0642bac7da42 ("nvmem: imx-ocotp: add write support")
+
+Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/imx-ocotp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index 926d9cc080cf4..04421a73f74aa 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -189,7 +189,8 @@ static void imx_ocotp_set_imx6_timing(struct ocotp_priv *priv)
+ 	strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1;
+ 	strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1;
+ 
+-	timing = strobe_prog & 0x00000FFF;
++	timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000;
++	timing |= strobe_prog & 0x00000FFF;
+ 	timing |= (relax       << 12) & 0x0000F000;
+ 	timing |= (strobe_read << 16) & 0x003F0000;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/of-fix-property-name-in-of_node_get_device_type.patch b/queue-4.19/of-fix-property-name-in-of_node_get_device_type.patch
new file mode 100644
index 00000000000..9b7f5d38606
--- /dev/null
+++ b/queue-4.19/of-fix-property-name-in-of_node_get_device_type.patch
@@ -0,0 +1,38 @@
+From 3eeaa6a6e1fd71b23c41cb809d2d7ef9f5120f4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 10:54:51 -0500
+Subject: of: Fix property name in of_node_get_device_type
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 5d5a0ab1a7918fce5ca5c0fb1871a3e2000f85de ]
+
+Commit 0413bedabc88 ("of: Add device_type access helper functions")
+added a new helper not yet used in preparation for some treewide clean
+up of accesses to 'device_type' properties. Unfortunately, there's an
+error and 'type' was used for the property name. Fix this.
+
+Fixes: 0413bedabc88 ("of: Add device_type access helper functions")
+Cc: Frank Rowand <frowand.list@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/of.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/of.h b/include/linux/of.h
+index d5a863c1ee390..dac0201eacef7 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1001,7 +1001,7 @@ static inline struct device_node *of_find_matching_node(
+ 
+ static inline const char *of_node_get_device_type(const struct device_node *np)
+ {
+-	return of_get_property(np, "type", NULL);
++	return of_get_property(np, "device_type", NULL);
+ }
+ 
+ static inline bool of_node_is_type(const struct device_node *np, const char *type)
+-- 
+2.20.1
+
diff --git a/queue-4.19/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch b/queue-4.19/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
new file mode 100644
index 00000000000..64f9b6baf79
--- /dev/null
+++ b/queue-4.19/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
@@ -0,0 +1,36 @@
+From 51b56fa0df3f2e518a0da5d9b93c5e001ad152a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:01:00 +0300
+Subject: of: mdio: Fix a signedness bug in of_phy_get_and_connect()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d7eb651212fdbafa82d485d8e76095ac3b14c193 ]
+
+The "iface" variable is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: b78624125304 ("of_mdio: Abstract a general interface for phy connect")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_mdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 5ad1342f56825..7d2bc22680d90 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -370,7 +370,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev,
+ 	int ret;
+ 
+ 	iface = of_get_phy_mode(np);
+-	if (iface < 0)
++	if ((int)iface < 0)
+ 		return NULL;
+ 	if (of_phy_is_fixed_link(np)) {
+ 		ret = of_phy_register_fixed_link(np);
+-- 
+2.20.1
+
diff --git a/queue-4.19/of-use-correct-function-prototype-for-of_overlay_fdt.patch b/queue-4.19/of-use-correct-function-prototype-for-of_overlay_fdt.patch
new file mode 100644
index 00000000000..c88d3a5f010
--- /dev/null
+++ b/queue-4.19/of-use-correct-function-prototype-for-of_overlay_fdt.patch
@@ -0,0 +1,40 @@
+From da548cd67d8f04c60d1499d49c241be74f61ddf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 13:23:41 +1300
+Subject: of: use correct function prototype for of_overlay_fdt_apply()
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit ecb0abc1d8528015957fbd034be8bfe760363b3b ]
+
+When CONFIG_OF_OVERLAY is not enabled the fallback stub for
+of_overlay_fdt_apply() does not match the prototype for the case when
+CONFIG_OF_OVERLAY is enabled. Update the stub to use the correct
+function prototype.
+
+Fixes: 39a751a4cb7e ("of: change overlay apply input data from unflattened to FDT")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/of.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/of.h b/include/linux/of.h
+index dac0201eacef7..d4f14b0302b63 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -1425,7 +1425,8 @@ int of_overlay_notifier_unregister(struct notifier_block *nb);
+ 
+ #else
+ 
+-static inline int of_overlay_fdt_apply(void *overlay_fdt, int *ovcs_id)
++static inline int of_overlay_fdt_apply(void *overlay_fdt, u32 overlay_fdt_size,
++				       int *ovcs_id)
+ {
+ 	return -ENOTSUPP;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/opp-fix-missing-debugfs-supply-directory-for-opps.patch b/queue-4.19/opp-fix-missing-debugfs-supply-directory-for-opps.patch
new file mode 100644
index 00000000000..4dfaeb4a4f6
--- /dev/null
+++ b/queue-4.19/opp-fix-missing-debugfs-supply-directory-for-opps.patch
@@ -0,0 +1,162 @@
+From 7dd6809ebb1181f7e245cd9a0a30afd4001cb084 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 16:39:36 +0530
+Subject: OPP: Fix missing debugfs supply directory for OPPs
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 46f48aca2e5aef3f430e95d1a5fb68227ec8ec85 ]
+
+There is one case where we may end up with no "supply" directory for the
+OPPs in debugfs. That happens when the OPP core isn't managing the
+regulators for the device and the device's OPP do have microvolt
+property. It happens because the opp_table->regulator_count remains set
+to 0 and the debugfs routines don't add any supply directory in such a
+case.
+
+This commit fixes that by setting opp_table->regulator_count to 1 in
+that particular case. But to make everything work nicely and not break
+other parts of the core, regulator_count is defined as "int" now instead
+of "unsigned int" and it can have different special values now. It is
+set to -1 initially to mark it "uninitialized" and later only we set it
+to 0 or positive values after checking how many supplies are there.
+
+This also helps in finding the bugs where only few of the OPPs have the
+"opp-microvolt" property set and not all.
+
+Fixes: 1fae788ed640 ("PM / OPP: Don't create debugfs "supply-0" directory unnecessarily")
+Reported-by: Quentin Perret <quentin.perret@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 12 +++++++++---
+ drivers/opp/of.c   | 20 ++++++++++++++++----
+ drivers/opp/opp.h  |  6 ++++--
+ 3 files changed, 29 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 1e80f9ec1aa6a..34515f4323755 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -793,6 +793,9 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+ 
+ 	INIT_LIST_HEAD(&opp_table->dev_list);
+ 
++	/* Mark regulator count uninitialized */
++	opp_table->regulator_count = -1;
++
+ 	opp_dev = _add_opp_dev(dev, opp_table);
+ 	if (!opp_dev) {
+ 		kfree(opp_table);
+@@ -955,7 +958,7 @@ struct dev_pm_opp *_opp_allocate(struct opp_table *table)
+ 	int count, supply_size;
+ 
+ 	/* Allocate space for at least one supply */
+-	count = table->regulator_count ? table->regulator_count : 1;
++	count = table->regulator_count > 0 ? table->regulator_count : 1;
+ 	supply_size = sizeof(*opp->supplies) * count;
+ 
+ 	/* allocate new OPP node and supplies structures */
+@@ -1363,7 +1366,7 @@ free_regulators:
+ 
+ 	kfree(opp_table->regulators);
+ 	opp_table->regulators = NULL;
+-	opp_table->regulator_count = 0;
++	opp_table->regulator_count = -1;
+ err:
+ 	dev_pm_opp_put_opp_table(opp_table);
+ 
+@@ -1392,7 +1395,7 @@ void dev_pm_opp_put_regulators(struct opp_table *opp_table)
+ 
+ 	kfree(opp_table->regulators);
+ 	opp_table->regulators = NULL;
+-	opp_table->regulator_count = 0;
++	opp_table->regulator_count = -1;
+ 
+ put_opp_table:
+ 	dev_pm_opp_put_opp_table(opp_table);
+@@ -1545,6 +1548,9 @@ int dev_pm_opp_add(struct device *dev, unsigned long freq, unsigned long u_volt)
+ 	if (!opp_table)
+ 		return -ENOMEM;
+ 
++	/* Fix regulator count for dynamic OPPs */
++	opp_table->regulator_count = 1;
++
+ 	ret = _opp_add_v1(opp_table, dev, freq, u_volt, true);
+ 
+ 	dev_pm_opp_put_opp_table(opp_table);
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 20988c4266501..d64a13d7881b9 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -113,12 +113,10 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+ 			      struct opp_table *opp_table)
+ {
+ 	u32 *microvolt, *microamp = NULL;
+-	int supplies, vcount, icount, ret, i, j;
++	int supplies = opp_table->regulator_count, vcount, icount, ret, i, j;
+ 	struct property *prop = NULL;
+ 	char name[NAME_MAX];
+ 
+-	supplies = opp_table->regulator_count ? opp_table->regulator_count : 1;
+-
+ 	/* Search for "opp-microvolt-<name>" */
+ 	if (opp_table->prop_name) {
+ 		snprintf(name, sizeof(name), "opp-microvolt-%s",
+@@ -133,7 +131,13 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+ 
+ 		/* Missing property isn't a problem, but an invalid entry is */
+ 		if (!prop) {
+-			if (!opp_table->regulator_count)
++			if (unlikely(supplies == -1)) {
++				/* Initialize regulator_count */
++				opp_table->regulator_count = 0;
++				return 0;
++			}
++
++			if (!supplies)
+ 				return 0;
+ 
+ 			dev_err(dev, "%s: opp-microvolt missing although OPP managing regulators\n",
+@@ -142,6 +146,14 @@ static int opp_parse_supplies(struct dev_pm_opp *opp, struct device *dev,
+ 		}
+ 	}
+ 
++	if (unlikely(supplies == -1)) {
++		/* Initialize regulator_count */
++		supplies = opp_table->regulator_count = 1;
++	} else if (unlikely(!supplies)) {
++		dev_err(dev, "%s: opp-microvolt wasn't expected\n", __func__);
++		return -EINVAL;
++	}
++
+ 	vcount = of_property_count_u32_elems(opp->np, name);
+ 	if (vcount < 0) {
+ 		dev_err(dev, "%s: Invalid %s property (%d)\n",
+diff --git a/drivers/opp/opp.h b/drivers/opp/opp.h
+index 7c540fd063b2d..c9e65964ed848 100644
+--- a/drivers/opp/opp.h
++++ b/drivers/opp/opp.h
+@@ -136,7 +136,9 @@ enum opp_table_access {
+  * @prop_name: A name to postfix to many DT properties, while parsing them.
+  * @clk: Device's clock handle
+  * @regulators: Supply regulators
+- * @regulator_count: Number of power supply regulators
++ * @regulator_count: Number of power supply regulators. Its value can be -1
++ * (uninitialized), 0 (no opp-microvolt property) or > 0 (has opp-microvolt
++ * property).
+  * @genpd_performance_state: Device's power domain support performance state.
+  * @set_opp: Platform specific set_opp callback
+  * @set_opp_data: Data to be passed to set_opp callback
+@@ -172,7 +174,7 @@ struct opp_table {
+ 	const char *prop_name;
+ 	struct clk *clk;
+ 	struct regulator **regulators;
+-	unsigned int regulator_count;
++	int regulator_count;
+ 	bool genpd_performance_state;
+ 
+ 	int (*set_opp)(struct dev_pm_set_opp_data *data);
+-- 
+2.20.1
+
diff --git a/queue-4.19/packet-fix-data-race-in-fanout_flow_is_huge.patch b/queue-4.19/packet-fix-data-race-in-fanout_flow_is_huge.patch
new file mode 100644
index 00000000000..3b9737410bc
--- /dev/null
+++ b/queue-4.19/packet-fix-data-race-in-fanout_flow_is_huge.patch
@@ -0,0 +1,134 @@
+From e024872e1577c458d2803678aecb235baa258c73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 05:07:46 -0800
+Subject: packet: fix data-race in fanout_flow_is_huge()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]
+
+KCSAN reported the following data-race [1]
+
+Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.
+
+Since the report hinted about multiple cpus using the history
+concurrently, I added a test avoiding writing on it if the
+victim slot already contains the desired value.
+
+[1]
+
+BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover
+
+read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
+ fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
+ fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
+ fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
+ fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 60ba18a4bb0ff..ddf90e6fac514 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1297,15 +1297,21 @@ static void packet_sock_destruct(struct sock *sk)
+ 
+ static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
+ {
+-	u32 rxhash;
++	u32 *history = po->rollover->history;
++	u32 victim, rxhash;
+ 	int i, count = 0;
+ 
+ 	rxhash = skb_get_hash(skb);
+ 	for (i = 0; i < ROLLOVER_HLEN; i++)
+-		if (po->rollover->history[i] == rxhash)
++		if (READ_ONCE(history[i]) == rxhash)
+ 			count++;
+ 
+-	po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
++	victim = prandom_u32() % ROLLOVER_HLEN;
++
++	/* Avoid dirtying the cache line if possible */
++	if (READ_ONCE(history[victim]) != rxhash)
++		WRITE_ONCE(history[victim], rxhash);
++
+ 	return count > (ROLLOVER_HLEN >> 1);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch b/queue-4.19/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
new file mode 100644
index 00000000000..4549ce83d21
--- /dev/null
+++ b/queue-4.19/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
@@ -0,0 +1,69 @@
+From e506b6b1e76cc289efe33a2644054d92a857559f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:46:55 -0400
+Subject: packet: in recvmsg msg_name return at least sizeof sockaddr_ll
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]
+
+Packet send checks that msg_name is at least sizeof sockaddr_ll.
+Packet recv must return at least this length, so that its output
+can be passed unmodified to packet send.
+
+This ceased to be true since adding support for lladdr longer than
+sll_addr. Since, the return value uses true address length.
+
+Always return at least sizeof sockaddr_ll, even if address length
+is shorter. Zero the padding bytes.
+
+Change v1->v2: do not overwrite zeroed padding again. use copy_len.
+
+Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
+Suggested-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index ac65e66d1d727..60ba18a4bb0ff 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3371,20 +3371,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	sock_recv_ts_and_drops(msg, sk, skb);
+ 
+ 	if (msg->msg_name) {
++		int copy_len;
++
+ 		/* If the address length field is there to be filled
+ 		 * in, we fill it in now.
+ 		 */
+ 		if (sock->type == SOCK_PACKET) {
+ 			__sockaddr_check_size(sizeof(struct sockaddr_pkt));
+ 			msg->msg_namelen = sizeof(struct sockaddr_pkt);
++			copy_len = msg->msg_namelen;
+ 		} else {
+ 			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+ 
+ 			msg->msg_namelen = sll->sll_halen +
+ 				offsetof(struct sockaddr_ll, sll_addr);
++			copy_len = msg->msg_namelen;
++			if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
++				memset(msg->msg_name +
++				       offsetof(struct sockaddr_ll, sll_addr),
++				       0, sizeof(sll->sll_addr));
++				msg->msg_namelen = sizeof(struct sockaddr_ll);
++			}
+ 		}
+-		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
+-		       msg->msg_namelen);
++		memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ 	}
+ 
+ 	if (pkt_sk(sk)->auxdata) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch b/queue-4.19/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
new file mode 100644
index 00000000000..5674631567e
--- /dev/null
+++ b/queue-4.19/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
@@ -0,0 +1,62 @@
+From c4d39e3f642e54648716aa3dd8fe24eb8ccd6a14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 18:47:15 -0700
+Subject: Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ]
+
+Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made
+the kfifo code round the number of elements up.  That was good for
+__kfifo_alloc(), but it's actually wrong for __kfifo_init().
+
+The difference? __kfifo_alloc() will allocate the rounded-up number of
+elements, but __kfifo_init() uses an allocation done by the caller.  We
+can't just say "use more elements than the caller allocated", and have
+to round down.
+
+The good news? All the normal cases will be using power-of-two arrays
+anyway, and most users of kfifo's don't use kfifo_init() at all, but one
+of the helper macros to declare a KFIFO that enforce the proper
+power-of-two behavior.  But it looks like at least ibmvscsis might be
+affected.
+
+The bad news? Will Deacon refers to an old thread and points points out
+that the memory ordering in kfifo's is questionable.  See
+
+  https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/
+
+for more.
+
+Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()")
+Reported-by: laokz <laokz@foxmail.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg KH <greg@kroah.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kfifo.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kfifo.c b/lib/kfifo.c
+index 015656aa8182d..6320ab91e3431 100644
+--- a/lib/kfifo.c
++++ b/lib/kfifo.c
+@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
+ {
+ 	size /= esize;
+ 
+-	size = roundup_pow_of_two(size);
++	if (!is_power_of_2(size))
++		size = rounddown_pow_of_two(size);
+ 
+ 	fifo->in = 0;
+ 	fifo->out = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-dwc-fix-dw_pcie_ep_find_capability-to-return-cor.patch b/queue-4.19/pci-dwc-fix-dw_pcie_ep_find_capability-to-return-cor.patch
new file mode 100644
index 00000000000..2c72346cf18
--- /dev/null
+++ b/queue-4.19/pci-dwc-fix-dw_pcie_ep_find_capability-to-return-cor.patch
@@ -0,0 +1,67 @@
+From 5b83cf0371ca42fec0e58c8cd303395d129580c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 15:09:41 +0530
+Subject: PCI: dwc: Fix dw_pcie_ep_find_capability() to return correct
+ capability offset
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 421db1ab287eebe80fd203eb009ae92836c586ad ]
+
+commit beb4641a787d ("PCI: dwc: Add MSI-X callbacks handler") while
+adding MSI-X callback handler, introduced dw_pcie_ep_find_capability()
+and __dw_pcie_ep_find_next_cap() for finding the MSI and MSIX capability.
+
+However if MSI or MSIX capability is the last capability (i.e there are
+no additional items in the capabilities list and the Next Capability
+Pointer is set to '0'), __dw_pcie_ep_find_next_cap will return '0'
+even though MSI or MSIX capability may be present because of
+incorrect ordering of the "next_cap_ptr" check. Fix it.
+
+Fixes: beb4641a787d ("PCI: dwc: Add MSI-X callbacks handler")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware-ep.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c
+index 739d97080d3bd..a3d07d9c598bf 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
+@@ -46,16 +46,19 @@ static u8 __dw_pcie_ep_find_next_cap(struct dw_pcie *pci, u8 cap_ptr,
+ 	u8 cap_id, next_cap_ptr;
+ 	u16 reg;
+ 
++	if (!cap_ptr)
++		return 0;
++
+ 	reg = dw_pcie_readw_dbi(pci, cap_ptr);
+-	next_cap_ptr = (reg & 0xff00) >> 8;
+ 	cap_id = (reg & 0x00ff);
+ 
+-	if (!next_cap_ptr || cap_id > PCI_CAP_ID_MAX)
++	if (cap_id > PCI_CAP_ID_MAX)
+ 		return 0;
+ 
+ 	if (cap_id == cap)
+ 		return cap_ptr;
+ 
++	next_cap_ptr = (reg & 0xff00) >> 8;
+ 	return __dw_pcie_ep_find_next_cap(pci, next_cap_ptr, cap);
+ }
+ 
+@@ -67,9 +70,6 @@ static u8 dw_pcie_ep_find_capability(struct dw_pcie *pci, u8 cap)
+ 	reg = dw_pcie_readw_dbi(pci, PCI_CAPABILITY_LIST);
+ 	next_cap_ptr = (reg & 0x00ff);
+ 
+-	if (!next_cap_ptr)
+-		return 0;
+-
+ 	return __dw_pcie_ep_find_next_cap(pci, next_cap_ptr, cap);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch b/queue-4.19/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch
new file mode 100644
index 00000000000..5d8df33fa59
--- /dev/null
+++ b/queue-4.19/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch
@@ -0,0 +1,58 @@
+From 4f0ae050d734929c17f474cf898e9c132ffa0297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 17:04:00 +0800
+Subject: PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit 726dabfde6aa35a4f1508e235ae37edbbf9fbc65 ]
+
+Functions copying from/to IO addresses should use the
+memcpy_fromio()/memcpy_toio() API rather than plain memcpy().
+
+Fix the issue detected through the sparse tool.
+
+Fixes: 349e7a85b25f ("PCI: endpoint: functions: Add an EP function to test PCI")
+Suggested-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+[lorenzo.pieralisi@arm.com: updated log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+CC: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+CC: Bjorn Helgaas <bhelgaas@google.com>
+CC: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+CC: Niklas Cassel <niklas.cassel@axis.com>
+CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+CC: Cyrille Pitchen <cyrille.pitchen@free-electrons.com>
+CC: linux-pci@vger.kernel.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 3e86fa3c7da32..4bbd26e8a9e2f 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -175,7 +175,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
+ 		goto err_map_addr;
+ 	}
+ 
+-	memcpy(buf, src_addr, reg->size);
++	memcpy_fromio(buf, src_addr, reg->size);
+ 
+ 	crc32 = crc32_le(~0, buf, reg->size);
+ 	if (crc32 != reg->checksum)
+@@ -230,7 +230,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
+ 	get_random_bytes(buf, reg->size);
+ 	reg->checksum = crc32_le(~0, buf, reg->size);
+ 
+-	memcpy(dst_addr, buf, reg->size);
++	memcpy_toio(dst_addr, buf, reg->size);
+ 
+ 	/*
+ 	 * wait 1ms inorder for the write to complete. Without this delay L3
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-fix-try-semantics-of-bus-and-slot-reset.patch b/queue-4.19/pci-fix-try-semantics-of-bus-and-slot-reset.patch
new file mode 100644
index 00000000000..19e9dd49a93
--- /dev/null
+++ b/queue-4.19/pci-fix-try-semantics-of-bus-and-slot-reset.patch
@@ -0,0 +1,163 @@
+From a9619fb965c82cdee75c68dcfc1f1bd534a1a5fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 12:46:46 -0700
+Subject: PCI: Fix "try" semantics of bus and slot reset
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit ddefc033eecf23f1e8b81d0663c5db965adf5516 ]
+
+The commit referenced below introduced device locking around save and
+restore of state for each device during a PCI bus "try" reset, making it
+decidely non-"try" and prone to deadlock in the event that a device is
+already locked.  Restore __pci_reset_bus() and __pci_reset_slot() to their
+advertised locking semantics by pushing the save and restore functions into
+the branch where the entire tree is already locked.  Extend the helper
+function names with "_locked" and update the comment to reflect this
+calling requirement.
+
+Fixes: b014e96d1abb ("PCI: Protect pci_error_handlers->reset_notify() usage with device_lock()")
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 54 +++++++++++++++++++++++------------------------
+ 1 file changed, 26 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index c9f51fc24563c..57a87a001b4f4 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5039,39 +5039,42 @@ unlock:
+ 	return 0;
+ }
+ 
+-/* Save and disable devices from the top of the tree down */
+-static void pci_bus_save_and_disable(struct pci_bus *bus)
++/*
++ * Save and disable devices from the top of the tree down while holding
++ * the @dev mutex lock for the entire tree.
++ */
++static void pci_bus_save_and_disable_locked(struct pci_bus *bus)
+ {
+ 	struct pci_dev *dev;
+ 
+ 	list_for_each_entry(dev, &bus->devices, bus_list) {
+-		pci_dev_lock(dev);
+ 		pci_dev_save_and_disable(dev);
+-		pci_dev_unlock(dev);
+ 		if (dev->subordinate)
+-			pci_bus_save_and_disable(dev->subordinate);
++			pci_bus_save_and_disable_locked(dev->subordinate);
+ 	}
+ }
+ 
+ /*
+- * Restore devices from top of the tree down - parent bridges need to be
+- * restored before we can get to subordinate devices.
++ * Restore devices from top of the tree down while holding @dev mutex lock
++ * for the entire tree.  Parent bridges need to be restored before we can
++ * get to subordinate devices.
+  */
+-static void pci_bus_restore(struct pci_bus *bus)
++static void pci_bus_restore_locked(struct pci_bus *bus)
+ {
+ 	struct pci_dev *dev;
+ 
+ 	list_for_each_entry(dev, &bus->devices, bus_list) {
+-		pci_dev_lock(dev);
+ 		pci_dev_restore(dev);
+-		pci_dev_unlock(dev);
+ 		if (dev->subordinate)
+-			pci_bus_restore(dev->subordinate);
++			pci_bus_restore_locked(dev->subordinate);
+ 	}
+ }
+ 
+-/* Save and disable devices from the top of the tree down */
+-static void pci_slot_save_and_disable(struct pci_slot *slot)
++/*
++ * Save and disable devices from the top of the tree down while holding
++ * the @dev mutex lock for the entire tree.
++ */
++static void pci_slot_save_and_disable_locked(struct pci_slot *slot)
+ {
+ 	struct pci_dev *dev;
+ 
+@@ -5080,26 +5083,25 @@ static void pci_slot_save_and_disable(struct pci_slot *slot)
+ 			continue;
+ 		pci_dev_save_and_disable(dev);
+ 		if (dev->subordinate)
+-			pci_bus_save_and_disable(dev->subordinate);
++			pci_bus_save_and_disable_locked(dev->subordinate);
+ 	}
+ }
+ 
+ /*
+- * Restore devices from top of the tree down - parent bridges need to be
+- * restored before we can get to subordinate devices.
++ * Restore devices from top of the tree down while holding @dev mutex lock
++ * for the entire tree.  Parent bridges need to be restored before we can
++ * get to subordinate devices.
+  */
+-static void pci_slot_restore(struct pci_slot *slot)
++static void pci_slot_restore_locked(struct pci_slot *slot)
+ {
+ 	struct pci_dev *dev;
+ 
+ 	list_for_each_entry(dev, &slot->bus->devices, bus_list) {
+ 		if (!dev->slot || dev->slot != slot)
+ 			continue;
+-		pci_dev_lock(dev);
+ 		pci_dev_restore(dev);
+-		pci_dev_unlock(dev);
+ 		if (dev->subordinate)
+-			pci_bus_restore(dev->subordinate);
++			pci_bus_restore_locked(dev->subordinate);
+ 	}
+ }
+ 
+@@ -5158,17 +5160,15 @@ static int __pci_reset_slot(struct pci_slot *slot)
+ 	if (rc)
+ 		return rc;
+ 
+-	pci_slot_save_and_disable(slot);
+-
+ 	if (pci_slot_trylock(slot)) {
++		pci_slot_save_and_disable_locked(slot);
+ 		might_sleep();
+ 		rc = pci_reset_hotplug_slot(slot->hotplug, 0);
++		pci_slot_restore_locked(slot);
+ 		pci_slot_unlock(slot);
+ 	} else
+ 		rc = -EAGAIN;
+ 
+-	pci_slot_restore(slot);
+-
+ 	return rc;
+ }
+ 
+@@ -5254,17 +5254,15 @@ static int __pci_reset_bus(struct pci_bus *bus)
+ 	if (rc)
+ 		return rc;
+ 
+-	pci_bus_save_and_disable(bus);
+-
+ 	if (pci_bus_trylock(bus)) {
++		pci_bus_save_and_disable_locked(bus);
+ 		might_sleep();
+ 		rc = pci_bridge_secondary_bus_reset(bus->self);
++		pci_bus_restore_locked(bus);
+ 		pci_bus_unlock(bus);
+ 	} else
+ 		rc = -EAGAIN;
+ 
+-	pci_bus_restore(bus);
+-
+ 	return rc;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-iproc-enable-iproc-config-read-for-paxbv2.patch b/queue-4.19/pci-iproc-enable-iproc-config-read-for-paxbv2.patch
new file mode 100644
index 00000000000..32f35a640f9
--- /dev/null
+++ b/queue-4.19/pci-iproc-enable-iproc-config-read-for-paxbv2.patch
@@ -0,0 +1,43 @@
+From 6d25f7145a471e1f40224980d6db688583802111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2019 14:50:04 +0530
+Subject: PCI: iproc: Enable iProc config read for PAXBv2
+
+From: Srinath Mannam <srinath.mannam@broadcom.com>
+
+[ Upstream commit 8cff995405eb0b563e7a0d2c49838611ea3f2692 ]
+
+iProc config read flag has to be enabled for PAXBv2 instead of PAXB.
+
+Fixes: f78e60a29d4f ("PCI: iproc: Reject unconfigured physical functions from PAXC")
+Signed-off-by: Srinath Mannam <srinath.mannam@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index c20fd6bd68fd8..9d5cbc75d5ae0 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -1347,7 +1347,6 @@ static int iproc_pcie_rev_init(struct iproc_pcie *pcie)
+ 		break;
+ 	case IPROC_PCIE_PAXB:
+ 		regs = iproc_pcie_reg_paxb;
+-		pcie->iproc_cfg_read = true;
+ 		pcie->has_apb_err_disable = true;
+ 		if (pcie->need_ob_cfg) {
+ 			pcie->ob_map = paxb_ob_map;
+@@ -1356,6 +1355,7 @@ static int iproc_pcie_rev_init(struct iproc_pcie *pcie)
+ 		break;
+ 	case IPROC_PCIE_PAXB_V2:
+ 		regs = iproc_pcie_reg_paxb_v2;
++		pcie->iproc_cfg_read = true;
+ 		pcie->has_apb_err_disable = true;
+ 		if (pcie->need_ob_cfg) {
+ 			pcie->ob_map = paxb_v2_ob_map;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch b/queue-4.19/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch
new file mode 100644
index 00000000000..1a3bc91ec68
--- /dev/null
+++ b/queue-4.19/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch
@@ -0,0 +1,45 @@
+From 6e6a611ea03b2866673727d7c3f2208b732506c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:22:58 -0700
+Subject: PCI: iproc: Remove PAXC slot check to allow VF support
+
+From: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+
+[ Upstream commit 4da6b4480766e5bc9c4d7bc14bf1d0939a1a5fa7 ]
+
+Fix previous incorrect logic that limits PAXC slot number to zero only.
+In order for SRIOV/VF to work, we need to allow the slot number to be
+greater than zero.
+
+Fixes: 46560388c476c ("PCI: iproc: Allow multiple devices except on PAXC")
+Signed-off-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 3160e9342a2fb..c20fd6bd68fd8 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -630,14 +630,6 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct iproc_pcie *pcie,
+ 			return (pcie->base + offset);
+ 	}
+ 
+-	/*
+-	 * PAXC is connected to an internally emulated EP within the SoC.  It
+-	 * allows only one device.
+-	 */
+-	if (pcie->ep_is_internal)
+-		if (slot > 0)
+-			return NULL;
+-
+ 	return iproc_pcie_map_ep_cfg_reg(pcie, busno, slot, fn, where);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-mobiveil-fix-devfn-check-in-mobiveil_pcie_valid_.patch b/queue-4.19/pci-mobiveil-fix-devfn-check-in-mobiveil_pcie_valid_.patch
new file mode 100644
index 00000000000..b9b8c580c59
--- /dev/null
+++ b/queue-4.19/pci-mobiveil-fix-devfn-check-in-mobiveil_pcie_valid_.patch
@@ -0,0 +1,41 @@
+From f4528f264c492f27be2df3ffc310a46e32d97e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jul 2019 17:56:39 +0800
+Subject: PCI: mobiveil: Fix devfn check in mobiveil_pcie_valid_device()
+
+From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+
+[ Upstream commit cbd50b3ca3964c79dac65fda277637577e029e8c ]
+
+Current check for devfn number in mobiveil_pci_valid_device() is
+wrong in that it flags as invalid functions present in PCI device 0
+in the root bus while it is perfectly valid to access all functions
+in PCI device 0 in the root bus.
+
+Update the check in mobiveil_pci_valid_device() to fix the issue.
+
+Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver")
+Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mobiveil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
+index dc228eb500edd..476be4f3c7f6e 100644
+--- a/drivers/pci/controller/pcie-mobiveil.c
++++ b/drivers/pci/controller/pcie-mobiveil.c
+@@ -174,7 +174,7 @@ static bool mobiveil_pcie_valid_device(struct pci_bus *bus, unsigned int devfn)
+ 	 * Do not read more than one device on the bus directly
+ 	 * attached to RC
+ 	 */
+-	if ((bus->primary == pcie->root_bus_nr) && (devfn > 0))
++	if ((bus->primary == pcie->root_bus_nr) && (PCI_SLOT(devfn) > 0))
+ 		return false;
+ 
+ 	return true;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-mobiveil-fix-the-valid-check-for-inbound-and-out.patch b/queue-4.19/pci-mobiveil-fix-the-valid-check-for-inbound-and-out.patch
new file mode 100644
index 00000000000..2b8985cdf63
--- /dev/null
+++ b/queue-4.19/pci-mobiveil-fix-the-valid-check-for-inbound-and-out.patch
@@ -0,0 +1,48 @@
+From e25c89eb77b00b1750e9c6aad27feaa89adf61d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jul 2019 17:56:47 +0800
+Subject: PCI: mobiveil: Fix the valid check for inbound and outbound windows
+
+From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+
+[ Upstream commit ccd34dac2ed596b1f26079912bdf638e002a3979 ]
+
+In program_ib/ob_windows() check the window index from the function
+parameter instead of the total number of initialized windows to
+determine if the specified window is valid.
+
+Fixes: 9af6bcb11e12 ("PCI: mobiveil: Add Mobiveil PCIe Host Bridge IP driver")
+Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
+Reviewed-by: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mobiveil.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
+index 476be4f3c7f6e..14f816591e844 100644
+--- a/drivers/pci/controller/pcie-mobiveil.c
++++ b/drivers/pci/controller/pcie-mobiveil.c
+@@ -395,7 +395,7 @@ static void program_ib_windows(struct mobiveil_pcie *pcie, int win_num,
+ 	int amap_ctrl_dw;
+ 	u64 size64 = ~(size - 1);
+ 
+-	if ((pcie->ib_wins_configured + 1) > pcie->ppio_wins) {
++	if (win_num >= pcie->ppio_wins) {
+ 		dev_err(&pcie->pdev->dev,
+ 			"ERROR: max inbound windows reached !\n");
+ 		return;
+@@ -429,7 +429,7 @@ static void program_ob_windows(struct mobiveil_pcie *pcie, int win_num,
+ 	u32 value, type;
+ 	u64 size64 = ~(size - 1);
+ 
+-	if ((pcie->ob_wins_configured + 1) > pcie->apio_wins) {
++	if (win_num >= pcie->apio_wins) {
+ 		dev_err(&pcie->pdev->dev,
+ 			"ERROR: max outbound windows reached !\n");
+ 		return;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-mobiveil-remove-the-flag-msi_flag_multi_pci_msi.patch b/queue-4.19/pci-mobiveil-remove-the-flag-msi_flag_multi_pci_msi.patch
new file mode 100644
index 00000000000..047baa53b4c
--- /dev/null
+++ b/queue-4.19/pci-mobiveil-remove-the-flag-msi_flag_multi_pci_msi.patch
@@ -0,0 +1,45 @@
+From 7b88dfadec3bb7a2c536631624a136e19caa6340 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jul 2019 17:56:30 +0800
+Subject: PCI: mobiveil: Remove the flag MSI_FLAG_MULTI_PCI_MSI
+
+From: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+
+[ Upstream commit a131fb6364c1be0924dcb969ecf6b988c556a5d5 ]
+
+The Mobiveil internal MSI controller requires separate target addresses,
+one per MSI vector; this is clearly incompatible with the Multiple MSI
+feature, which requires the same target address for all vectors
+requested by an endpoint (ie the Message Address field in the MSI
+Capability structure), so the multi MSI feature is clearly not
+supported by the host controller driver.
+
+Remove the flag MSI_FLAG_MULTI_PCI_MSI and with it multi MSI support,
+fixing the misconfiguration.
+
+Fixes: 1e913e58335f ("PCI: mobiveil: Add MSI support")
+Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+[lorenzo.pieralisi@arm.com: commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Minghuan Lian <Minghuan.Lian@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mobiveil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
+index a2d1e89d48674..dc228eb500edd 100644
+--- a/drivers/pci/controller/pcie-mobiveil.c
++++ b/drivers/pci/controller/pcie-mobiveil.c
+@@ -643,7 +643,7 @@ static struct irq_chip mobiveil_msi_irq_chip = {
+ 
+ static struct msi_domain_info mobiveil_msi_domain_info = {
+ 	.flags	= (MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
+-		MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX),
++		   MSI_FLAG_PCI_MSIX),
+ 	.chip	= &mobiveil_msi_irq_chip,
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-pm-avoid-possible-suspend-to-idle-issue.patch b/queue-4.19/pci-pm-avoid-possible-suspend-to-idle-issue.patch
new file mode 100644
index 00000000000..b585fba80b6
--- /dev/null
+++ b/queue-4.19/pci-pm-avoid-possible-suspend-to-idle-issue.patch
@@ -0,0 +1,89 @@
+From e614522dbdc622afcfbb24432f5b2836675196aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2019 11:08:50 +0200
+Subject: PCI: PM: Avoid possible suspend-to-idle issue
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit d491f2b75237ef37d8867830ab7fad8d9659e853 ]
+
+If a PCI driver leaves the device handled by it in D0 and calls
+pci_save_state() on the device in its ->suspend() or ->suspend_late()
+callback, it can expect the device to stay in D0 over the whole
+s2idle cycle.  However, that may not be the case if there is a
+spurious wakeup while the system is suspended, because in that case
+pci_pm_suspend_noirq() will run again after pci_pm_resume_noirq()
+which calls pci_restore_state(), via pci_pm_default_resume_early(),
+so state_saved is cleared and the second iteration of
+pci_pm_suspend_noirq() will invoke pci_prepare_to_sleep() which
+may change the power state of the device.
+
+To avoid that, add a new internal flag, skip_bus_pm, that will be set
+by pci_pm_suspend_noirq() when it runs for the first time during the
+given system suspend-resume cycle if the state of the device has
+been saved already and the device is still in D0.  Setting that flag
+will cause the next iterations of pci_pm_suspend_noirq() to set
+state_saved for pci_pm_resume_noirq(), so that it always restores the
+device state from the originally saved data, and avoid calling
+pci_prepare_to_sleep() for the device.
+
+Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 17 ++++++++++++++++-
+ include/linux/pci.h      |  1 +
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index bc1ff41ce3d35..5c9873fcbd08b 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -736,6 +736,8 @@ static int pci_pm_suspend(struct device *dev)
+ 	struct pci_dev *pci_dev = to_pci_dev(dev);
+ 	const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+ 
++	pci_dev->skip_bus_pm = false;
++
+ 	if (pci_has_legacy_pm_support(pci_dev))
+ 		return pci_legacy_suspend(dev, PMSG_SUSPEND);
+ 
+@@ -829,7 +831,20 @@ static int pci_pm_suspend_noirq(struct device *dev)
+ 		}
+ 	}
+ 
+-	if (!pci_dev->state_saved) {
++	if (pci_dev->skip_bus_pm) {
++		/*
++		 * The function is running for the second time in a row without
++		 * going through full resume, which is possible only during
++		 * suspend-to-idle in a spurious wakeup case.  Moreover, the
++		 * device was originally left in D0, so its power state should
++		 * not be changed here and the device register values saved
++		 * originally should be restored on resume again.
++		 */
++		pci_dev->state_saved = true;
++	} else if (pci_dev->state_saved) {
++		if (pci_dev->current_state == PCI_D0)
++			pci_dev->skip_bus_pm = true;
++	} else {
+ 		pci_save_state(pci_dev);
+ 		if (pci_power_manageable(pci_dev))
+ 			pci_prepare_to_sleep(pci_dev);
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index b1f297f4b7b0b..94853094b6ef4 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -342,6 +342,7 @@ struct pci_dev {
+ 						   D3cold, not set for devices
+ 						   powered on/off by the
+ 						   corresponding bridge */
++	unsigned int	skip_bus_pm:1;	/* Internal: Skip bus-level PM */
+ 	unsigned int	ignore_hotplug:1;	/* Ignore hotplug events */
+ 	unsigned int	hotplug_user_indicators:1; /* SlotCtl indicators
+ 						      controlled exclusively by
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-pm-skip-devices-in-d0-for-suspend-to-idle.patch b/queue-4.19/pci-pm-skip-devices-in-d0-for-suspend-to-idle.patch
new file mode 100644
index 00000000000..2eec2f416e4
--- /dev/null
+++ b/queue-4.19/pci-pm-skip-devices-in-d0-for-suspend-to-idle.patch
@@ -0,0 +1,126 @@
+From 917fbb79016d9e16438b608e3d18d1512bae5ac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 23:59:45 +0200
+Subject: PCI: PM: Skip devices in D0 for suspend-to-idle
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 3e26c5feed2add218046ecf91bab3cfa9bf762a6 ]
+
+Commit d491f2b75237 ("PCI: PM: Avoid possible suspend-to-idle issue")
+attempted to avoid a problem with devices whose drivers want them to
+stay in D0 over suspend-to-idle and resume, but it did not go as far
+as it should with that.
+
+Namely, first of all, the power state of a PCI bridge with a
+downstream device in D0 must be D0 (based on the PCI PM spec r1.2,
+sec 6, table 6-1, if the bridge is not in D0, there can be no PCI
+transactions on its secondary bus), but that is not actively enforced
+during system-wide PM transitions, so use the skip_bus_pm flag
+introduced by commit d491f2b75237 for that.
+
+Second, the configuration of devices left in D0 (whatever the reason)
+during suspend-to-idle need not be changed and attempting to put them
+into D0 again by force is pointless, so explicitly avoid doing that.
+
+Fixes: d491f2b75237 ("PCI: PM: Avoid possible suspend-to-idle issue")
+Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 47 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 35 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 5c9873fcbd08b..e69af9b8361dc 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -526,7 +526,6 @@ static void pci_pm_default_resume_early(struct pci_dev *pci_dev)
+ 	pci_power_up(pci_dev);
+ 	pci_restore_state(pci_dev);
+ 	pci_pme_restore(pci_dev);
+-	pci_fixup_device(pci_fixup_resume_early, pci_dev);
+ }
+ 
+ /*
+@@ -833,18 +832,16 @@ static int pci_pm_suspend_noirq(struct device *dev)
+ 
+ 	if (pci_dev->skip_bus_pm) {
+ 		/*
+-		 * The function is running for the second time in a row without
++		 * Either the device is a bridge with a child in D0 below it, or
++		 * the function is running for the second time in a row without
+ 		 * going through full resume, which is possible only during
+-		 * suspend-to-idle in a spurious wakeup case.  Moreover, the
+-		 * device was originally left in D0, so its power state should
+-		 * not be changed here and the device register values saved
+-		 * originally should be restored on resume again.
++		 * suspend-to-idle in a spurious wakeup case.  The device should
++		 * be in D0 at this point, but if it is a bridge, it may be
++		 * necessary to save its state.
+ 		 */
+-		pci_dev->state_saved = true;
+-	} else if (pci_dev->state_saved) {
+-		if (pci_dev->current_state == PCI_D0)
+-			pci_dev->skip_bus_pm = true;
+-	} else {
++		if (!pci_dev->state_saved)
++			pci_save_state(pci_dev);
++	} else if (!pci_dev->state_saved) {
+ 		pci_save_state(pci_dev);
+ 		if (pci_power_manageable(pci_dev))
+ 			pci_prepare_to_sleep(pci_dev);
+@@ -853,6 +850,22 @@ static int pci_pm_suspend_noirq(struct device *dev)
+ 	dev_dbg(dev, "PCI PM: Suspend power state: %s\n",
+ 		pci_power_name(pci_dev->current_state));
+ 
++	if (pci_dev->current_state == PCI_D0) {
++		pci_dev->skip_bus_pm = true;
++		/*
++		 * Per PCI PM r1.2, table 6-1, a bridge must be in D0 if any
++		 * downstream device is in D0, so avoid changing the power state
++		 * of the parent bridge by setting the skip_bus_pm flag for it.
++		 */
++		if (pci_dev->bus->self)
++			pci_dev->bus->self->skip_bus_pm = true;
++	}
++
++	if (pci_dev->skip_bus_pm && !pm_suspend_via_firmware()) {
++		dev_dbg(dev, "PCI PM: Skipped\n");
++		goto Fixup;
++	}
++
+ 	pci_pm_set_unknown_state(pci_dev);
+ 
+ 	/*
+@@ -900,7 +913,16 @@ static int pci_pm_resume_noirq(struct device *dev)
+ 	if (dev_pm_smart_suspend_and_suspended(dev))
+ 		pm_runtime_set_active(dev);
+ 
+-	pci_pm_default_resume_early(pci_dev);
++	/*
++	 * In the suspend-to-idle case, devices left in D0 during suspend will
++	 * stay in D0, so it is not necessary to restore or update their
++	 * configuration here and attempting to put them into D0 again may
++	 * confuse some firmware, so avoid doing that.
++	 */
++	if (!pci_dev->skip_bus_pm || pm_suspend_via_firmware())
++		pci_pm_default_resume_early(pci_dev);
++
++	pci_fixup_device(pci_fixup_resume_early, pci_dev);
+ 
+ 	if (pci_has_legacy_pm_support(pci_dev))
+ 		return pci_legacy_resume_early(dev);
+@@ -1201,6 +1223,7 @@ static int pci_pm_restore_noirq(struct device *dev)
+ 	}
+ 
+ 	pci_pm_default_resume_early(pci_dev);
++	pci_fixup_device(pci_fixup_resume_early, pci_dev);
+ 
+ 	if (pci_has_legacy_pm_support(pci_dev))
+ 		return pci_legacy_resume_early(dev);
+-- 
+2.20.1
+
diff --git a/queue-4.19/pci-rockchip-fix-rockchip_pcie_ep_assert_intx-bitwis.patch b/queue-4.19/pci-rockchip-fix-rockchip_pcie_ep_assert_intx-bitwis.patch
new file mode 100644
index 00000000000..1ca1d6a977e
--- /dev/null
+++ b/queue-4.19/pci-rockchip-fix-rockchip_pcie_ep_assert_intx-bitwis.patch
@@ -0,0 +1,42 @@
+From 7ff6274935758981a61abfef9a4b3a3700b75b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 15:09:10 +0000
+Subject: PCI: rockchip: Fix rockchip_pcie_ep_assert_intx() bitwise operations
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c577f4a5a08bb9677e12ddafb62e2f3a901de87f ]
+
+Currently the bitwise operations on the u16 variable 'status' with
+the setting ROCKCHIP_PCIE_EP_CMD_STATUS_IS are incorrect because
+ROCKCHIP_PCIE_EP_CMD_STATUS_IS is 1UL<<19 which is wider than the
+u16 variable.
+
+Fix this by making status a u32.
+
+Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rockchip-ep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-rockchip-ep.c b/drivers/pci/controller/pcie-rockchip-ep.c
+index b8163c56a142d..caf34661d38d4 100644
+--- a/drivers/pci/controller/pcie-rockchip-ep.c
++++ b/drivers/pci/controller/pcie-rockchip-ep.c
+@@ -350,7 +350,7 @@ static void rockchip_pcie_ep_assert_intx(struct rockchip_pcie_ep *ep, u8 fn,
+ 	struct rockchip_pcie *rockchip = &ep->rockchip;
+ 	u32 r = ep->max_regions - 1;
+ 	u32 offset;
+-	u16 status;
++	u32 status;
+ 	u8 msg_code;
+ 
+ 	if (unlikely(ep->irq_pci_addr != ROCKCHIP_PCIE_EP_PCI_LEGACY_IRQ_ADDR ||
+-- 
+2.20.1
+
diff --git a/queue-4.19/pcrypt-use-format-specifier-in-kobject_add.patch b/queue-4.19/pcrypt-use-format-specifier-in-kobject_add.patch
new file mode 100644
index 00000000000..9e564df224f
--- /dev/null
+++ b/queue-4.19/pcrypt-use-format-specifier-in-kobject_add.patch
@@ -0,0 +1,43 @@
+From 358c4b5366a1d8628927d3c5fa6c6f39e78fcd08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Oct 2018 15:49:26 +0100
+Subject: pcrypt: use format specifier in kobject_add
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]
+
+Passing string 'name' as the format specifier is potentially hazardous
+because name could (although very unlikely to) have a format specifier
+embedded in it causing issues when parsing the non-existent arguments
+to these.  Follow best practice by using the "%s" format string for
+the string 'name'.
+
+Cleans up clang warning:
+crypto/pcrypt.c:397:40: warning: format string is not a string literal
+(potentially insecure) [-Wformat-security]
+
+Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/pcrypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index f8ec3d4ba4a80..a5718c0a3dc4e 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
+ 	int ret;
+ 
+ 	pinst->kobj.kset = pcrypt_kset;
+-	ret = kobject_add(&pinst->kobj, NULL, name);
++	ret = kobject_add(&pinst->kobj, NULL, "%s", name);
+ 	if (!ret)
+ 		kobject_uevent(&pinst->kobj, KOBJ_ADD);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/perf-copy-parent-s-address-filter-offsets-on-clone.patch b/queue-4.19/perf-copy-parent-s-address-filter-offsets-on-clone.patch
new file mode 100644
index 00000000000..5e43911b6a6
--- /dev/null
+++ b/queue-4.19/perf-copy-parent-s-address-filter-offsets-on-clone.patch
@@ -0,0 +1,63 @@
+From 9177a227a91ab947f066c0042db0f5681288eeae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 13:56:54 +0200
+Subject: perf: Copy parent's address filter offsets on clone
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit 18736eef12137c59f60cc9f56dc5bea05c92e0eb ]
+
+When a child event is allocated in the inherit_event() path, the VMA
+based filter offsets are not copied from the parent, even though the
+address space mapping of the new task remains the same, which leads to
+no trace for the new task until exec.
+
+Reported-by: Mansour Alharthi <malharthi9@gatech.edu>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Tested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Fixes: 375637bc5249 ("perf/core: Introduce address range filtering")
+Link: http://lkml.kernel.org/r/20190215115655.63469-2-alexander.shishkin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 460d5fd3ec4e4..9a5559f5938a5 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1254,6 +1254,7 @@ static void put_ctx(struct perf_event_context *ctx)
+  *	      perf_event_context::lock
+  *	    perf_event::mmap_mutex
+  *	    mmap_sem
++ *	      perf_addr_filters_head::lock
+  *
+  *    cpu_hotplug_lock
+  *      pmus_lock
+@@ -10136,6 +10137,20 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ 			goto err_per_task;
+ 		}
+ 
++		/*
++		 * Clone the parent's vma offsets: they are valid until exec()
++		 * even if the mm is not shared with the parent.
++		 */
++		if (event->parent) {
++			struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
++
++			raw_spin_lock_irq(&ifh->lock);
++			memcpy(event->addr_filters_offs,
++			       event->parent->addr_filters_offs,
++			       pmu->nr_addr_filters * sizeof(unsigned long));
++			raw_spin_unlock_irq(&ifh->lock);
++		}
++
+ 		/* force hw sync on the address filters */
+ 		event->addr_filters_gen = 1;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/perf-core-fix-the-address-filtering-fix.patch b/queue-4.19/perf-core-fix-the-address-filtering-fix.patch
new file mode 100644
index 00000000000..3710ae16bd0
--- /dev/null
+++ b/queue-4.19/perf-core-fix-the-address-filtering-fix.patch
@@ -0,0 +1,106 @@
+From 61f7029ba226247e07d96a48295211c63fa55ead Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2019 11:12:12 +0200
+Subject: perf/core: Fix the address filtering fix
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit 52a44f83fc2d64a5e74d5d685fad2fecc7b7a321 ]
+
+The following recent commit:
+
+  c60f83b813e5 ("perf, pt, coresight: Fix address filters for vmas with non-zero offset")
+
+changes the address filtering logic to communicate filter ranges to the PMU driver
+via a single address range object, instead of having the driver do the final bit of
+math.
+
+That change forgets to take into account kernel filters, which are not calculated
+the same way as DSO based filters.
+
+Fix that by passing the kernel filters the same way as file-based filters.
+This doesn't require any additional changes in the drivers.
+
+Reported-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Fixes: c60f83b813e5 ("perf, pt, coresight: Fix address filters for vmas with non-zero offset")
+Link: https://lkml.kernel.org/r/20190329091212.29870-1-alexander.shishkin@linux.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 37 +++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 4eef2d42d05c4..751888cbed5c0 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -8861,26 +8861,29 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
+ 	if (task == TASK_TOMBSTONE)
+ 		return;
+ 
+-	if (!ifh->nr_file_filters)
+-		return;
+-
+-	mm = get_task_mm(event->ctx->task);
+-	if (!mm)
+-		goto restart;
++	if (ifh->nr_file_filters) {
++		mm = get_task_mm(event->ctx->task);
++		if (!mm)
++			goto restart;
+ 
+-	down_read(&mm->mmap_sem);
++		down_read(&mm->mmap_sem);
++	}
+ 
+ 	raw_spin_lock_irqsave(&ifh->lock, flags);
+ 	list_for_each_entry(filter, &ifh->list, entry) {
+-		event->addr_filter_ranges[count].start = 0;
+-		event->addr_filter_ranges[count].size = 0;
++		if (filter->path.dentry) {
++			/*
++			 * Adjust base offset if the filter is associated to a
++			 * binary that needs to be mapped:
++			 */
++			event->addr_filter_ranges[count].start = 0;
++			event->addr_filter_ranges[count].size = 0;
+ 
+-		/*
+-		 * Adjust base offset if the filter is associated to a binary
+-		 * that needs to be mapped:
+-		 */
+-		if (filter->path.dentry)
+ 			perf_addr_filter_apply(filter, mm, &event->addr_filter_ranges[count]);
++		} else {
++			event->addr_filter_ranges[count].start = filter->offset;
++			event->addr_filter_ranges[count].size  = filter->size;
++		}
+ 
+ 		count++;
+ 	}
+@@ -8888,9 +8891,11 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
+ 	event->addr_filters_gen++;
+ 	raw_spin_unlock_irqrestore(&ifh->lock, flags);
+ 
+-	up_read(&mm->mmap_sem);
++	if (ifh->nr_file_filters) {
++		up_read(&mm->mmap_sem);
+ 
+-	mmput(mm);
++		mmput(mm);
++	}
+ 
+ restart:
+ 	perf_event_stop(event, 1);
+-- 
+2.20.1
+
diff --git a/queue-4.19/perf-ioctl-add-check-for-the-sample_period-value.patch b/queue-4.19/perf-ioctl-add-check-for-the-sample_period-value.patch
new file mode 100644
index 00000000000..462e6399b7e
--- /dev/null
+++ b/queue-4.19/perf-ioctl-add-check-for-the-sample_period-value.patch
@@ -0,0 +1,57 @@
+From 7e755667fef9698164e30e1b80847939e9cc11e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 09:59:53 +0530
+Subject: perf/ioctl: Add check for the sample_period value
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ]
+
+perf_event_open() limits the sample_period to 63 bits. See:
+
+  0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
+
+Make ioctl() consistent with it.
+
+Also on PowerPC, negative sample_period could cause a recursive
+PMIs leading to a hang (reported when running perf-fuzzer).
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: acme@kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: maddy@linux.vnet.ibm.com
+Cc: mpe@ellerman.id.au
+Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
+Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 751888cbed5c0..16af86ab24c42 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5012,6 +5012,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ 	if (perf_event_check_period(event, value))
+ 		return -EINVAL;
+ 
++	if (!event->attr.freq && (value & (1ULL << 63)))
++		return -EINVAL;
++
+ 	event_function_call(event, __perf_event_period, &value);
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/perf-pt-coresight-fix-address-filters-for-vmas-with-.patch b/queue-4.19/perf-pt-coresight-fix-address-filters-for-vmas-with-.patch
new file mode 100644
index 00000000000..ebb9c6eb87c
--- /dev/null
+++ b/queue-4.19/perf-pt-coresight-fix-address-filters-for-vmas-with-.patch
@@ -0,0 +1,298 @@
+From 5b65b84cfb398c621e12ec27d3fb26022589b68a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 13:56:55 +0200
+Subject: perf, pt, coresight: Fix address filters for vmas with non-zero
+ offset
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit c60f83b813e5b25ccd5de7e8c8925c31b3aebcc1 ]
+
+Currently, the address range calculation for file-based filters works as
+long as the vma that maps the matching part of the object file starts
+from offset zero into the file (vm_pgoff==0). Otherwise, the resulting
+filter range would be off by vm_pgoff pages. Another related problem is
+that in case of a partially matching vma, that is, a vma that matches
+part of a filter region, the filter range size wouldn't be adjusted.
+
+Fix the arithmetics around address filter range calculations, taking
+into account vma offset, so that the entire calculation is done before
+the filter configuration is passed to the PMU drivers instead of having
+those drivers do the final bit of arithmetics.
+
+Based on the patch by Adrian Hunter <adrian.hunter.intel.com>.
+
+Reported-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Tested-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Fixes: 375637bc5249 ("perf/core: Introduce address range filtering")
+Link: http://lkml.kernel.org/r/20190215115655.63469-3-alexander.shishkin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/pt.c                    |  9 ++-
+ .../hwtracing/coresight/coresight-etm-perf.c  |  7 +-
+ include/linux/perf_event.h                    |  7 +-
+ kernel/events/core.c                          | 81 +++++++++++--------
+ 4 files changed, 62 insertions(+), 42 deletions(-)
+
+diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
+index 8f4c98fdd03c5..f03100bc5fd12 100644
+--- a/arch/x86/events/intel/pt.c
++++ b/arch/x86/events/intel/pt.c
+@@ -1213,7 +1213,8 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
+ static void pt_event_addr_filters_sync(struct perf_event *event)
+ {
+ 	struct perf_addr_filters_head *head = perf_event_addr_filters(event);
+-	unsigned long msr_a, msr_b, *offs = event->addr_filters_offs;
++	unsigned long msr_a, msr_b;
++	struct perf_addr_filter_range *fr = event->addr_filter_ranges;
+ 	struct pt_filters *filters = event->hw.addr_filters;
+ 	struct perf_addr_filter *filter;
+ 	int range = 0;
+@@ -1222,12 +1223,12 @@ static void pt_event_addr_filters_sync(struct perf_event *event)
+ 		return;
+ 
+ 	list_for_each_entry(filter, &head->list, entry) {
+-		if (filter->path.dentry && !offs[range]) {
++		if (filter->path.dentry && !fr[range].start) {
+ 			msr_a = msr_b = 0;
+ 		} else {
+ 			/* apply the offset */
+-			msr_a = filter->offset + offs[range];
+-			msr_b = filter->size + msr_a - 1;
++			msr_a = fr[range].start;
++			msr_b = msr_a + fr[range].size - 1;
+ 		}
+ 
+ 		filters->filter[range].msr_a  = msr_a;
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index c3c6452015142..567f46ca25998 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -437,15 +437,16 @@ static int etm_addr_filters_validate(struct list_head *filters)
+ static void etm_addr_filters_sync(struct perf_event *event)
+ {
+ 	struct perf_addr_filters_head *head = perf_event_addr_filters(event);
+-	unsigned long start, stop, *offs = event->addr_filters_offs;
++	unsigned long start, stop;
++	struct perf_addr_filter_range *fr = event->addr_filter_ranges;
+ 	struct etm_filters *filters = event->hw.addr_filters;
+ 	struct etm_filter *etm_filter;
+ 	struct perf_addr_filter *filter;
+ 	int i = 0;
+ 
+ 	list_for_each_entry(filter, &head->list, entry) {
+-		start = filter->offset + offs[i];
+-		stop = start + filter->size;
++		start = fr[i].start;
++		stop = start + fr[i].size;
+ 		etm_filter = &filters->etm_filter[i];
+ 
+ 		switch (filter->action) {
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index b22bc81f3669a..d8b4d31acd18e 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -494,6 +494,11 @@ struct perf_addr_filters_head {
+ 	unsigned int		nr_file_filters;
+ };
+ 
++struct perf_addr_filter_range {
++	unsigned long		start;
++	unsigned long		size;
++};
++
+ /**
+  * enum perf_event_state - the states of an event:
+  */
+@@ -670,7 +675,7 @@ struct perf_event {
+ 	/* address range filters */
+ 	struct perf_addr_filters_head	addr_filters;
+ 	/* vma address array for file-based filders */
+-	unsigned long			*addr_filters_offs;
++	struct perf_addr_filter_range	*addr_filter_ranges;
+ 	unsigned long			addr_filters_gen;
+ 
+ 	void (*destroy)(struct perf_event *);
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 9a5559f5938a5..4eef2d42d05c4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2804,7 +2804,7 @@ static int perf_event_stop(struct perf_event *event, int restart)
+  *
+  * (p1) when userspace mappings change as a result of (1) or (2) or (3) below,
+  *      we update the addresses of corresponding vmas in
+- *	event::addr_filters_offs array and bump the event::addr_filters_gen;
++ *	event::addr_filter_ranges array and bump the event::addr_filters_gen;
+  * (p2) when an event is scheduled in (pmu::add), it calls
+  *      perf_event_addr_filters_sync() which calls pmu::addr_filters_sync()
+  *      if the generation has changed since the previous call.
+@@ -4448,7 +4448,7 @@ static void _free_event(struct perf_event *event)
+ 
+ 	perf_event_free_bpf_prog(event);
+ 	perf_addr_filters_splice(event, NULL);
+-	kfree(event->addr_filters_offs);
++	kfree(event->addr_filter_ranges);
+ 
+ 	if (event->destroy)
+ 		event->destroy(event);
+@@ -6743,7 +6743,8 @@ static void perf_event_addr_filters_exec(struct perf_event *event, void *data)
+ 	raw_spin_lock_irqsave(&ifh->lock, flags);
+ 	list_for_each_entry(filter, &ifh->list, entry) {
+ 		if (filter->path.dentry) {
+-			event->addr_filters_offs[count] = 0;
++			event->addr_filter_ranges[count].start = 0;
++			event->addr_filter_ranges[count].size = 0;
+ 			restart++;
+ 		}
+ 
+@@ -7425,28 +7426,47 @@ static bool perf_addr_filter_match(struct perf_addr_filter *filter,
+ 	return true;
+ }
+ 
++static bool perf_addr_filter_vma_adjust(struct perf_addr_filter *filter,
++					struct vm_area_struct *vma,
++					struct perf_addr_filter_range *fr)
++{
++	unsigned long vma_size = vma->vm_end - vma->vm_start;
++	unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
++	struct file *file = vma->vm_file;
++
++	if (!perf_addr_filter_match(filter, file, off, vma_size))
++		return false;
++
++	if (filter->offset < off) {
++		fr->start = vma->vm_start;
++		fr->size = min(vma_size, filter->size - (off - filter->offset));
++	} else {
++		fr->start = vma->vm_start + filter->offset - off;
++		fr->size = min(vma->vm_end - fr->start, filter->size);
++	}
++
++	return true;
++}
++
+ static void __perf_addr_filters_adjust(struct perf_event *event, void *data)
+ {
+ 	struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
+ 	struct vm_area_struct *vma = data;
+-	unsigned long off = vma->vm_pgoff << PAGE_SHIFT, flags;
+-	struct file *file = vma->vm_file;
+ 	struct perf_addr_filter *filter;
+ 	unsigned int restart = 0, count = 0;
++	unsigned long flags;
+ 
+ 	if (!has_addr_filter(event))
+ 		return;
+ 
+-	if (!file)
++	if (!vma->vm_file)
+ 		return;
+ 
+ 	raw_spin_lock_irqsave(&ifh->lock, flags);
+ 	list_for_each_entry(filter, &ifh->list, entry) {
+-		if (perf_addr_filter_match(filter, file, off,
+-					     vma->vm_end - vma->vm_start)) {
+-			event->addr_filters_offs[count] = vma->vm_start;
++		if (perf_addr_filter_vma_adjust(filter, vma,
++						&event->addr_filter_ranges[count]))
+ 			restart++;
+-		}
+ 
+ 		count++;
+ 	}
+@@ -8806,26 +8826,19 @@ static void perf_addr_filters_splice(struct perf_event *event,
+  * @filter; if so, adjust filter's address range.
+  * Called with mm::mmap_sem down for reading.
+  */
+-static unsigned long perf_addr_filter_apply(struct perf_addr_filter *filter,
+-					    struct mm_struct *mm)
++static void perf_addr_filter_apply(struct perf_addr_filter *filter,
++				   struct mm_struct *mm,
++				   struct perf_addr_filter_range *fr)
+ {
+ 	struct vm_area_struct *vma;
+ 
+ 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
+-		struct file *file = vma->vm_file;
+-		unsigned long off = vma->vm_pgoff << PAGE_SHIFT;
+-		unsigned long vma_size = vma->vm_end - vma->vm_start;
+-
+-		if (!file)
++		if (!vma->vm_file)
+ 			continue;
+ 
+-		if (!perf_addr_filter_match(filter, file, off, vma_size))
+-			continue;
+-
+-		return vma->vm_start;
++		if (perf_addr_filter_vma_adjust(filter, vma, fr))
++			return;
+ 	}
+-
+-	return 0;
+ }
+ 
+ /*
+@@ -8859,15 +8872,15 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
+ 
+ 	raw_spin_lock_irqsave(&ifh->lock, flags);
+ 	list_for_each_entry(filter, &ifh->list, entry) {
+-		event->addr_filters_offs[count] = 0;
++		event->addr_filter_ranges[count].start = 0;
++		event->addr_filter_ranges[count].size = 0;
+ 
+ 		/*
+ 		 * Adjust base offset if the filter is associated to a binary
+ 		 * that needs to be mapped:
+ 		 */
+ 		if (filter->path.dentry)
+-			event->addr_filters_offs[count] =
+-				perf_addr_filter_apply(filter, mm);
++			perf_addr_filter_apply(filter, mm, &event->addr_filter_ranges[count]);
+ 
+ 		count++;
+ 	}
+@@ -10129,10 +10142,10 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ 		goto err_pmu;
+ 
+ 	if (has_addr_filter(event)) {
+-		event->addr_filters_offs = kcalloc(pmu->nr_addr_filters,
+-						   sizeof(unsigned long),
+-						   GFP_KERNEL);
+-		if (!event->addr_filters_offs) {
++		event->addr_filter_ranges = kcalloc(pmu->nr_addr_filters,
++						    sizeof(struct perf_addr_filter_range),
++						    GFP_KERNEL);
++		if (!event->addr_filter_ranges) {
+ 			err = -ENOMEM;
+ 			goto err_per_task;
+ 		}
+@@ -10145,9 +10158,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ 			struct perf_addr_filters_head *ifh = perf_event_addr_filters(event);
+ 
+ 			raw_spin_lock_irq(&ifh->lock);
+-			memcpy(event->addr_filters_offs,
+-			       event->parent->addr_filters_offs,
+-			       pmu->nr_addr_filters * sizeof(unsigned long));
++			memcpy(event->addr_filter_ranges,
++			       event->parent->addr_filter_ranges,
++			       pmu->nr_addr_filters * sizeof(struct perf_addr_filter_range));
+ 			raw_spin_unlock_irq(&ifh->lock);
+ 		}
+ 
+@@ -10169,7 +10182,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ 	return event;
+ 
+ err_addr_filters:
+-	kfree(event->addr_filters_offs);
++	kfree(event->addr_filter_ranges);
+ 
+ err_per_task:
+ 	exclusive_event_destroy(event);
+-- 
+2.20.1
+
diff --git a/queue-4.19/phy-qcom-qusb2-fix-missing-assignment-of-ret-when-ca.patch b/queue-4.19/phy-qcom-qusb2-fix-missing-assignment-of-ret-when-ca.patch
new file mode 100644
index 00000000000..251174d7b48
--- /dev/null
+++ b/queue-4.19/phy-qcom-qusb2-fix-missing-assignment-of-ret-when-ca.patch
@@ -0,0 +1,39 @@
+From cd47ddd3af80180a5e2e7f915603abe03bc4bb13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 May 2019 13:05:59 +0100
+Subject: phy: qcom-qusb2: fix missing assignment of ret when calling
+ clk_prepare_enable
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d98010817a26eba8d4d1e8a639e0b7d7f042308a ]
+
+The error return from the call to clk_prepare_enable is not being assigned
+to variable ret even though ret is being used to check if the call failed.
+Fix this by adding in the missing assignment.
+
+Addresses-Coverity: ("Logically dead code")
+Fixes: 891a96f65ac3 ("phy: qcom-qusb2: Add support for runtime PM")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qusb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+index 69c92843eb3b2..9b7ae93e9df1e 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
++++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
+@@ -526,7 +526,7 @@ static int __maybe_unused qusb2_phy_runtime_resume(struct device *dev)
+ 	}
+ 
+ 	if (!qphy->has_se_clk_scheme) {
+-		clk_prepare_enable(qphy->ref_clk);
++		ret = clk_prepare_enable(qphy->ref_clk);
+ 		if (ret) {
+ 			dev_err(dev, "failed to enable ref clk, %d\n", ret);
+ 			goto disable_ahb_clk;
+-- 
+2.20.1
+
diff --git a/queue-4.19/phy-usb-phy-brcm-usb-remove-sysfs-attributes-upon-dr.patch b/queue-4.19/phy-usb-phy-brcm-usb-remove-sysfs-attributes-upon-dr.patch
new file mode 100644
index 00000000000..4e4aee0396c
--- /dev/null
+++ b/queue-4.19/phy-usb-phy-brcm-usb-remove-sysfs-attributes-upon-dr.patch
@@ -0,0 +1,52 @@
+From 132d2975cecd6205295caa0f2974a533b862a451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:35:25 -0700
+Subject: phy: usb: phy-brcm-usb: Remove sysfs attributes upon driver removal
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d9e100829fca6cbd270d7e005b0c0bb2d14924b8 ]
+
+We are not destroying the sysfs attribute groupe we registered during
+the probe function which will make subsequent probe calls to that
+driver fail. Correct that with adding a remove function which only
+removes those attributes since the reference counting on clocks did its
+job already.
+
+Fixes: 415060b21f31 ("phy: usb: phy-brcm-usb: Add ability to force DRD mode to host or device")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/broadcom/phy-brcm-usb.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/phy/broadcom/phy-brcm-usb.c b/drivers/phy/broadcom/phy-brcm-usb.c
+index d1dab36fa5b7b..e2455ffb85979 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb.c
++++ b/drivers/phy/broadcom/phy-brcm-usb.c
+@@ -378,6 +378,13 @@ static int brcm_usb_phy_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
++static int brcm_usb_phy_remove(struct platform_device *pdev)
++{
++	sysfs_remove_group(&pdev->dev.kobj, &brcm_usb_phy_group);
++
++	return 0;
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static int brcm_usb_phy_suspend(struct device *dev)
+ {
+@@ -443,6 +450,7 @@ MODULE_DEVICE_TABLE(of, brcm_usb_dt_ids);
+ 
+ static struct platform_driver brcm_usb_driver = {
+ 	.probe		= brcm_usb_phy_probe,
++	.remove		= brcm_usb_phy_remove,
+ 	.driver		= {
+ 		.name	= "brcmstb-usb-phy",
+ 		.owner	= THIS_MODULE,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch b/queue-4.19/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch
new file mode 100644
index 00000000000..2775d5b617e
--- /dev/null
+++ b/queue-4.19/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch
@@ -0,0 +1,227 @@
+From bf3da88d5deee1b8c1f2cbf5ecb8e83c54f6d72c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 10:22:27 +0530
+Subject: pinctrl: iproc-gpio: Fix incorrect pinconf configurations
+
+From: Li Jin <li.jin@broadcom.com>
+
+[ Upstream commit 398a1f50e3c731586182fd52b834103b0aa2f826 ]
+
+Fix drive strength for AON/CRMU controller; fix pull-up/down setting
+for CCM/CDRU controller.
+
+Fixes: 616043d58a89 ("pinctrl: Rename gpio driver from cygnus to iproc")
+Signed-off-by: Li Jin <li.jin@broadcom.com>
+Link: https://lore.kernel.org/r/1567054348-19685-2-git-send-email-srinath.mannam@broadcom.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 96 +++++++++++++++++++-----
+ 1 file changed, 77 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+index b70058caee504..20b9864adce06 100644
+--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
++++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+@@ -54,8 +54,12 @@
+ /* drive strength control for ASIU GPIO */
+ #define IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET 0x58
+ 
+-/* drive strength control for CCM/CRMU (AON) GPIO */
+-#define IPROC_GPIO_DRV0_CTRL_OFFSET  0x00
++/* pinconf for CCM GPIO */
++#define IPROC_GPIO_PULL_DN_OFFSET   0x10
++#define IPROC_GPIO_PULL_UP_OFFSET   0x14
++
++/* pinconf for CRMU(aon) GPIO and CCM GPIO*/
++#define IPROC_GPIO_DRV_CTRL_OFFSET  0x00
+ 
+ #define GPIO_BANK_SIZE 0x200
+ #define NGPIOS_PER_BANK 32
+@@ -76,6 +80,12 @@ enum iproc_pinconf_param {
+ 	IPROC_PINCON_MAX,
+ };
+ 
++enum iproc_pinconf_ctrl_type {
++	IOCTRL_TYPE_AON = 1,
++	IOCTRL_TYPE_CDRU,
++	IOCTRL_TYPE_INVALID,
++};
++
+ /*
+  * Iproc GPIO core
+  *
+@@ -100,6 +110,7 @@ struct iproc_gpio {
+ 
+ 	void __iomem *base;
+ 	void __iomem *io_ctrl;
++	enum iproc_pinconf_ctrl_type io_ctrl_type;
+ 
+ 	raw_spinlock_t lock;
+ 
+@@ -461,20 +472,44 @@ static const struct pinctrl_ops iproc_pctrl_ops = {
+ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
+ 				bool disable, bool pull_up)
+ {
++	void __iomem *base;
+ 	unsigned long flags;
++	unsigned int shift;
++	u32 val_1, val_2;
+ 
+ 	raw_spin_lock_irqsave(&chip->lock, flags);
+-
+-	if (disable) {
+-		iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, false);
++	if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
++		base = chip->io_ctrl;
++		shift = IPROC_GPIO_SHIFT(gpio);
++
++		val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET);
++		val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET);
++		if (disable) {
++			/* no pull-up or pull-down */
++			val_1 &= ~BIT(shift);
++			val_2 &= ~BIT(shift);
++		} else if (pull_up) {
++			val_1 |= BIT(shift);
++			val_2 &= ~BIT(shift);
++		} else {
++			val_1 &= ~BIT(shift);
++			val_2 |= BIT(shift);
++		}
++		writel(val_1, base + IPROC_GPIO_PULL_UP_OFFSET);
++		writel(val_2, base + IPROC_GPIO_PULL_DN_OFFSET);
+ 	} else {
+-		iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
+-			       pull_up);
+-		iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, true);
++		if (disable) {
++			iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
++				      false);
++		} else {
++			iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
++				      pull_up);
++			iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
++				      true);
++		}
+ 	}
+ 
+ 	raw_spin_unlock_irqrestore(&chip->lock, flags);
+-
+ 	dev_dbg(chip->dev, "gpio:%u set pullup:%d\n", gpio, pull_up);
+ 
+ 	return 0;
+@@ -483,14 +518,35 @@ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
+ static void iproc_gpio_get_pull(struct iproc_gpio *chip, unsigned gpio,
+ 				 bool *disable, bool *pull_up)
+ {
++	void __iomem *base;
+ 	unsigned long flags;
++	unsigned int shift;
++	u32 val_1, val_2;
+ 
+ 	raw_spin_lock_irqsave(&chip->lock, flags);
+-	*disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
+-	*pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
++	if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
++		base = chip->io_ctrl;
++		shift = IPROC_GPIO_SHIFT(gpio);
++
++		val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET) & BIT(shift);
++		val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET) & BIT(shift);
++
++		*pull_up = val_1 ? true : false;
++		*disable = (val_1 | val_2) ? false : true;
++
++	} else {
++		*disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
++		*pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
++	}
+ 	raw_spin_unlock_irqrestore(&chip->lock, flags);
+ }
+ 
++#define DRV_STRENGTH_OFFSET(gpio, bit, type)  ((type) == IOCTRL_TYPE_AON ? \
++	((2 - (bit)) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
++	((type) == IOCTRL_TYPE_CDRU) ? \
++	((bit) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
++	((bit) * 4 + IPROC_GPIO_REG(gpio, IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET)))
++
+ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ 				    unsigned strength)
+ {
+@@ -505,11 +561,8 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ 
+ 	if (chip->io_ctrl) {
+ 		base = chip->io_ctrl;
+-		offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
+ 	} else {
+ 		base = chip->base;
+-		offset = IPROC_GPIO_REG(gpio,
+-					 IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
+ 	}
+ 
+ 	shift = IPROC_GPIO_SHIFT(gpio);
+@@ -520,11 +573,11 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ 	raw_spin_lock_irqsave(&chip->lock, flags);
+ 	strength = (strength / 2) - 1;
+ 	for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
++		offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
+ 		val = readl(base + offset);
+ 		val &= ~BIT(shift);
+ 		val |= ((strength >> i) & 0x1) << shift;
+ 		writel(val, base + offset);
+-		offset += 4;
+ 	}
+ 	raw_spin_unlock_irqrestore(&chip->lock, flags);
+ 
+@@ -541,11 +594,8 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
+ 
+ 	if (chip->io_ctrl) {
+ 		base = chip->io_ctrl;
+-		offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
+ 	} else {
+ 		base = chip->base;
+-		offset = IPROC_GPIO_REG(gpio,
+-					 IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
+ 	}
+ 
+ 	shift = IPROC_GPIO_SHIFT(gpio);
+@@ -553,10 +603,10 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
+ 	raw_spin_lock_irqsave(&chip->lock, flags);
+ 	*strength = 0;
+ 	for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
++		offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
+ 		val = readl(base + offset) & BIT(shift);
+ 		val >>= shift;
+ 		*strength += (val << i);
+-		offset += 4;
+ 	}
+ 
+ 	/* convert to mA */
+@@ -734,6 +784,7 @@ static int iproc_gpio_probe(struct platform_device *pdev)
+ 	u32 ngpios, pinconf_disable_mask = 0;
+ 	int irq, ret;
+ 	bool no_pinconf = false;
++	enum iproc_pinconf_ctrl_type io_ctrl_type = IOCTRL_TYPE_INVALID;
+ 
+ 	/* NSP does not support drive strength config */
+ 	if (of_device_is_compatible(dev->of_node, "brcm,iproc-nsp-gpio"))
+@@ -764,8 +815,15 @@ static int iproc_gpio_probe(struct platform_device *pdev)
+ 			dev_err(dev, "unable to map I/O memory\n");
+ 			return PTR_ERR(chip->io_ctrl);
+ 		}
++		if (of_device_is_compatible(dev->of_node,
++					    "brcm,cygnus-ccm-gpio"))
++			io_ctrl_type = IOCTRL_TYPE_CDRU;
++		else
++			io_ctrl_type = IOCTRL_TYPE_AON;
+ 	}
+ 
++	chip->io_ctrl_type = io_ctrl_type;
++
+ 	if (of_property_read_u32(dev->of_node, "ngpios", &ngpios)) {
+ 		dev_err(&pdev->dev, "missing ngpios DT property\n");
+ 		return -ENODEV;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-meson-gxl-remove-invalid-gpiox-tsin_a-pins.patch b/queue-4.19/pinctrl-meson-gxl-remove-invalid-gpiox-tsin_a-pins.patch
new file mode 100644
index 00000000000..c0952e06d00
--- /dev/null
+++ b/queue-4.19/pinctrl-meson-gxl-remove-invalid-gpiox-tsin_a-pins.patch
@@ -0,0 +1,64 @@
+From 573bab99076d7a702051e98abaa957a9b79c4ab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:42:38 +0100
+Subject: pinctrl: meson-gxl: remove invalid GPIOX tsin_a pins
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit d801064cb871806e6843738ecad38993646f53f7 ]
+
+The GPIOX tsin_a pins wrongly uses the SDCard pinctrl bits, this
+patch completely removes these pins entries until we find out what
+are the correct bits and registers to be used instead.
+
+Fixes: 5a6ae9b80139 ("pinctrl: meson-gxl: add tsin_a pins")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 158f618f16957..0c0a5018102b0 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -239,13 +239,9 @@ static const unsigned int eth_link_led_pins[]	= { GPIOZ_14 };
+ static const unsigned int eth_act_led_pins[]	= { GPIOZ_15 };
+ 
+ static const unsigned int tsin_a_d0_pins[]	= { GPIODV_0 };
+-static const unsigned int tsin_a_d0_x_pins[]	= { GPIOX_10 };
+ static const unsigned int tsin_a_clk_pins[]	= { GPIODV_8 };
+-static const unsigned int tsin_a_clk_x_pins[]	= { GPIOX_11 };
+ static const unsigned int tsin_a_sop_pins[]	= { GPIODV_9 };
+-static const unsigned int tsin_a_sop_x_pins[]	= { GPIOX_8 };
+ static const unsigned int tsin_a_d_valid_pins[] = { GPIODV_10 };
+-static const unsigned int tsin_a_d_valid_x_pins[] = { GPIOX_9 };
+ static const unsigned int tsin_a_fail_pins[]	= { GPIODV_11 };
+ static const unsigned int tsin_a_dp_pins[] = {
+ 	GPIODV_1, GPIODV_2, GPIODV_3, GPIODV_4, GPIODV_5, GPIODV_6, GPIODV_7,
+@@ -432,10 +428,6 @@ static struct meson_pmx_group meson_gxl_periphs_groups[] = {
+ 	GROUP(spi_miso,		5,	2),
+ 	GROUP(spi_ss0,		5,	1),
+ 	GROUP(spi_sclk,		5,	0),
+-	GROUP(tsin_a_sop_x,	6,	3),
+-	GROUP(tsin_a_d_valid_x,	6,	2),
+-	GROUP(tsin_a_d0_x,	6,	1),
+-	GROUP(tsin_a_clk_x,	6,	0),
+ 
+ 	/* Bank Z */
+ 	GROUP(eth_mdio,		4,	23),
+@@ -698,8 +690,8 @@ static const char * const eth_led_groups[] = {
+ };
+ 
+ static const char * const tsin_a_groups[] = {
+-	"tsin_a_clk", "tsin_a_clk_x", "tsin_a_sop", "tsin_a_sop_x",
+-	"tsin_a_d_valid", "tsin_a_d_valid_x", "tsin_a_d0", "tsin_a_d0_x",
++	"tsin_a_clk", "tsin_a_sop",
++	"tsin_a_d_valid", "tsin_a_d0",
+ 	"tsin_a_dp", "tsin_a_fail",
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch b/queue-4.19/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
new file mode 100644
index 00000000000..06038e425a9
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
@@ -0,0 +1,82 @@
+From 4bcf60c8513fe9cbf53a10f1df519658e1f117eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jan 2019 13:04:52 +0100
+Subject: pinctrl: sh-pfc: emev2: Add missing pinmux functions
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]
+
+The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
+but no pinmux functions refer to them, hence they can not be selected.
+
+Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+index 1cbbe04d7df65..eafd8edbcbe95 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
+ 	"dtv_b",
+ };
+ 
++static const char * const err_rst_reqb_groups[] = {
++	"err_rst_reqb",
++};
++
++static const char * const ext_clki_groups[] = {
++	"ext_clki",
++};
++
+ static const char * const iic0_groups[] = {
+ 	"iic0",
+ };
+@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
+ 	"yuv3",
+ };
+ 
++static const char * const lowpwr_groups[] = {
++	"lowpwr",
++};
++
+ static const char * const ntsc_groups[] = {
+ 	"ntsc_clk",
+ 	"ntsc_data",
+@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
+ 	"pwm1",
+ };
+ 
++static const char * const ref_clko_groups[] = {
++	"ref_clko",
++};
++
+ static const char * const sd_groups[] = {
+ 	"sd_cki",
+ };
+@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
+ 	SH_PFC_FUNCTION(cam),
+ 	SH_PFC_FUNCTION(cf),
+ 	SH_PFC_FUNCTION(dtv),
++	SH_PFC_FUNCTION(err_rst_reqb),
++	SH_PFC_FUNCTION(ext_clki),
+ 	SH_PFC_FUNCTION(iic0),
+ 	SH_PFC_FUNCTION(iic1),
+ 	SH_PFC_FUNCTION(jtag),
+ 	SH_PFC_FUNCTION(lcd),
++	SH_PFC_FUNCTION(lowpwr),
+ 	SH_PFC_FUNCTION(ntsc),
+ 	SH_PFC_FUNCTION(pwm0),
+ 	SH_PFC_FUNCTION(pwm1),
++	SH_PFC_FUNCTION(ref_clko),
+ 	SH_PFC_FUNCTION(sd),
+ 	SH_PFC_FUNCTION(sdi0),
+ 	SH_PFC_FUNCTION(sdi1),
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch b/queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
new file mode 100644
index 00000000000..6dd53bf0154
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
@@ -0,0 +1,36 @@
+From 9d1d476bf60ee1083fbd71c362fd917349738c7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:00:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]
+
+The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
+but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.
+
+Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index d8077065636e3..e9739dbcb356e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
+ 	LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
+ 	LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
+ 	LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
++	LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
+ 	LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
+ 	LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
+ 	LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch b/queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
new file mode 100644
index 00000000000..1a8356a69ee
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
@@ -0,0 +1,37 @@
+From a0b3e7f449086c33b12704169d5f0ac6c4e3eca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 10:57:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]
+
+The gether_gmii_mux[] array contains the REF125CK pin mark, but the
+gether_gmii_pins[] array lacks the corresponding pin number.
+
+Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index 35f436bcb8491..d8077065636e3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
+ 	 */
+ 	185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
+ 	171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
+-	205, 163, 206, 207,
++	205, 163, 206, 207, 158,
+ };
+ static const unsigned int gether_gmii_mux[] = {
+ 	ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch b/queue-4.19/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
new file mode 100644
index 00000000000..03ca1366dbc
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
@@ -0,0 +1,36 @@
+From eee8facae87002692f73c07797ad365f9111543f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:07:43 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]
+
+The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
+typo, thus the group cannot be selected.
+
+Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 6236ac55c65d3..9eb860c8f9174 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -5239,7 +5239,7 @@ static const char * const scifb2_groups[] = {
+ 	"scifb2_data_b",
+ 	"scifb2_clk_b",
+ 	"scifb2_ctrl_b",
+-	"scifb0_data_c",
++	"scifb2_data_c",
+ 	"scifb2_clk_c",
+ 	"scifb2_data_d",
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch b/queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
new file mode 100644
index 00000000000..e2e1abf3fc8
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
@@ -0,0 +1,40 @@
+From c21bdbbcaf57bc66f1527e2517634b3442fba7cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:05:57 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]
+
+The qspi_data4_b_mux[] array contains pin marks for the clock and chip
+select pins.  The qspi_data4_b_pins[] array rightfully does not contain
+the corresponding pin numbers, as the control pins are provided by a
+separate group (qspi_ctrl_b).
+
+Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 5811784d88cb9..f5b4255570b28 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -3220,8 +3220,7 @@ static const unsigned int qspi_data4_b_pins[] = {
+ 	RCAR_GP_PIN(6, 4),
+ };
+ static const unsigned int qspi_data4_b_mux[] = {
+-	SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
+-	IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
++	MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
+ };
+ /* - SCIF0 ------------------------------------------------------------------ */
+ static const unsigned int scif0_data_pins[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch b/queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
new file mode 100644
index 00000000000..64fcf77a244
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
@@ -0,0 +1,47 @@
+From 3dce6e36106222e3deb7256d58a85efce3bf1a1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:12:20 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]
+
+The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
+the color components.  The vin1_b_data18_pins[] array rightfully does
+not include the corresponding pin numbers, as RGB18 is subset of RGB24,
+containing only the 6 MSB bits of each component.
+
+Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index f5b4255570b28..6236ac55c65d3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -4374,17 +4374,14 @@ static const unsigned int vin1_b_data18_pins[] = {
+ };
+ static const unsigned int vin1_b_data18_mux[] = {
+ 	/* B */
+-	VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
+ 	VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
+ 	VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
+ 	VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
+ 	/* G */
+-	VI1_G0_B_MARK, VI1_G1_B_MARK,
+ 	VI1_G2_B_MARK, VI1_G3_B_MARK,
+ 	VI1_G4_B_MARK, VI1_G5_B_MARK,
+ 	VI1_G6_B_MARK, VI1_G7_B_MARK,
+ 	/* R */
+-	VI1_R0_B_MARK, VI1_R1_B_MARK,
+ 	VI1_R2_B_MARK, VI1_R3_B_MARK,
+ 	VI1_R4_B_MARK, VI1_R5_B_MARK,
+ 	VI1_R6_B_MARK, VI1_R7_B_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch b/queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
new file mode 100644
index 00000000000..063022bc291
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
@@ -0,0 +1,35 @@
+From 17e6b49da00c473ec75c0766cf4985e1b2e50da8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:14:07 +0100
+Subject: pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ]
+
+The vin1_data18_b pin group itself is present, but it is not listed in
+the VIN1 pin group array, and thus cannot be selected.
+
+Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+index cc3597f66605a..46c41ca6ea38b 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+@@ -1916,6 +1916,7 @@ static const char * const vin1_groups[] = {
+ 	"vin1_data8",
+ 	"vin1_data24_b",
+ 	"vin1_data20_b",
++	"vin1_data18_b",
+ 	"vin1_data16_b",
+ 	"vin1_sync",
+ 	"vin1_field",
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch b/queue-4.19/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
new file mode 100644
index 00000000000..560cf8aecb4
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
@@ -0,0 +1,36 @@
+From 5a7c477e2417aa918e69675fa56b60c1565aef4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:21:16 +0100
+Subject: pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]
+
+The Peripheral Function Select Register 9 contains 12 fields, but the
+variable field descriptor contains a 13th bogus field of 3 bits.
+
+Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+index 1640024375946..24b9bb1ee1fe5 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+@@ -5215,7 +5215,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
+ 	},
+ 	{ PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
+-			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
++			     1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
+ 		/* IP9_31 [1] */
+ 		0, 0,
+ 		/* IP9_30_28 [3] */
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a77970-add-missing-mod_sel0-field.patch b/queue-4.19/pinctrl-sh-pfc-r8a77970-add-missing-mod_sel0-field.patch
new file mode 100644
index 00000000000..03aa88aa47c
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a77970-add-missing-mod_sel0-field.patch
@@ -0,0 +1,37 @@
+From 502760a32cf72d02c986ab821415e53aabb56bbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:29:02 +0100
+Subject: pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 67d7745bc78e16ec6b3af02bc1da6c8c868cbd89 ]
+
+The Module Select Register 0 contains 20 (= 5 x 4) reserved bits, and 12
+single-bit fields, but the variable field descriptor lacks a field of 4
+reserved bits.
+
+Fixes: b92ac66a1819602b ("pinctrl: sh-pfc: Add R8A77970 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77970.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+index eeb58b3bbc9a0..53fae9fd682b8 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77970.c
+@@ -2354,7 +2354,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ #define F_(x, y)	x,
+ #define FM(x)		FN_##x,
+ 	{ PINMUX_CFG_REG_VAR("MOD_SEL0", 0xe6060500, 32,
+-			     4, 4, 4, 4,
++			     4, 4, 4, 4, 4,
+ 			     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) {
+ 		/* RESERVED 31, 30, 29, 28 */
+ 		0, 0, 0, 0, 0, 0, 0, 0,	0, 0, 0, 0, 0, 0, 0, 0,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a77980-add-missing-mod_sel0-field.patch b/queue-4.19/pinctrl-sh-pfc-r8a77980-add-missing-mod_sel0-field.patch
new file mode 100644
index 00000000000..9dc8e14dafb
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a77980-add-missing-mod_sel0-field.patch
@@ -0,0 +1,37 @@
+From c567b1a9d53da31e3062b44581f93f6a1ea366e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:36:54 +0100
+Subject: pinctrl: sh-pfc: r8a77980: Add missing MOD_SEL0 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b0f77269f6bba385f1f4dce44e7756cf8fbc0176 ]
+
+The Module Select Register 0 contains 20 (= 5 x 4) reserved bits, and 12
+single-bit fields, but the variable field descriptor lacks a field of 4
+reserved bits.
+
+Fixes: f59125248a691dfe ("pinctrl: sh-pfc: Add R8A77980 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77980.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77980.c b/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
+index 3f6967331f646..81a710bb8555e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77980.c
+@@ -2751,7 +2751,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ #define F_(x, y)	x,
+ #define FM(x)		FN_##x,
+ 	{ PINMUX_CFG_REG_VAR("MOD_SEL0", 0xe6060500, 32,
+-			     4, 4, 4, 4,
++			     4, 4, 4, 4, 4,
+ 			     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) {
+ 		/* RESERVED 31, 30, 29, 28 */
+ 		0, 0, 0, 0, 0, 0, 0, 0,	0, 0, 0, 0, 0, 0, 0, 0,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch b/queue-4.19/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch
new file mode 100644
index 00000000000..027444ae801
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch
@@ -0,0 +1,45 @@
+From 6ce96a3a2e7048b5fb832ca839df037fc561e8cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 13:59:42 +0100
+Subject: pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit e28dc3f09c9d2555a9bd982f0847988591052226 ]
+
+While the SEL_PWM[0-3] fields in the Module Select Register 0 support 4
+possible configurations per PWM pin, only the first 3 are valid.
+
+Replace the invalid and unused configurations for SEL_PWM[0-3]_3 by
+dummies.
+
+Fixes: 794a6711764658a1 ("pinctrl: sh-pfc: Initial R8A77995 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77995.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+index adade5b7ffbc2..337c80bde8f93 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+@@ -391,10 +391,10 @@ FM(IP12_31_28)	IP12_31_28 \
+ #define MOD_SEL0_27		FM(SEL_MSIOF3_0)	FM(SEL_MSIOF3_1)
+ #define MOD_SEL0_26		FM(SEL_HSCIF3_0)	FM(SEL_HSCIF3_1)
+ #define MOD_SEL0_25		FM(SEL_SCIF4_0)		FM(SEL_SCIF4_1)
+-#define MOD_SEL0_24_23		FM(SEL_PWM0_0)		FM(SEL_PWM0_1)		FM(SEL_PWM0_2)		FM(SEL_PWM0_3)
+-#define MOD_SEL0_22_21		FM(SEL_PWM1_0)		FM(SEL_PWM1_1)		FM(SEL_PWM1_2)		FM(SEL_PWM1_3)
+-#define MOD_SEL0_20_19		FM(SEL_PWM2_0)		FM(SEL_PWM2_1)		FM(SEL_PWM2_2)		FM(SEL_PWM2_3)
+-#define MOD_SEL0_18_17		FM(SEL_PWM3_0)		FM(SEL_PWM3_1)		FM(SEL_PWM3_2)		FM(SEL_PWM3_3)
++#define MOD_SEL0_24_23		FM(SEL_PWM0_0)		FM(SEL_PWM0_1)		FM(SEL_PWM0_2)		F_(0, 0)
++#define MOD_SEL0_22_21		FM(SEL_PWM1_0)		FM(SEL_PWM1_1)		FM(SEL_PWM1_2)		F_(0, 0)
++#define MOD_SEL0_20_19		FM(SEL_PWM2_0)		FM(SEL_PWM2_1)		FM(SEL_PWM2_2)		F_(0, 0)
++#define MOD_SEL0_18_17		FM(SEL_PWM3_0)		FM(SEL_PWM3_1)		FM(SEL_PWM3_2)		F_(0, 0)
+ #define MOD_SEL0_15		FM(SEL_IRQ_0_0)		FM(SEL_IRQ_0_1)
+ #define MOD_SEL0_14		FM(SEL_IRQ_1_0)		FM(SEL_IRQ_1_1)
+ #define MOD_SEL0_13		FM(SEL_IRQ_2_0)		FM(SEL_IRQ_2_1)
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch b/queue-4.19/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
new file mode 100644
index 00000000000..d4be20e8a75
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
@@ -0,0 +1,39 @@
+From 7ef9e5773fcec5d066e3d9b749d984f28eb68e42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:27:56 +0100
+Subject: pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]
+
+The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
+contains only dummy configuration values for 6 reserved bits, thus
+breaking the configuration of all subsequent fields in the register.
+
+Fix this by adding the two missing configuration values.
+
+Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index a50d22bef1f44..cfdb4fc177c3e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 	},
+ 
+ 	{ PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
+-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ 		PC8_IN, PC8_OUT,
+ 		PC7_IN, PC7_OUT,
+ 		PC6_IN, PC6_OUT,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch b/queue-4.19/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
new file mode 100644
index 00000000000..73f0e8693d0
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
@@ -0,0 +1,37 @@
+From 35d1168593509e7635d6e629266506bc3bdfa2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:20:14 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]
+
+The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
+tpu4_to3_pins[] array lacks the corresponding pin number.
+
+Add the missing pin number, for non-GPIO pin F26.
+
+Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index d25e6f674d0ab..f8fbedb46585d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
+ };
+ static const unsigned int tpu4_to3_pins[] = {
+ 	/* TO */
++	PIN_NUMBER(6, 26),
+ };
+ static const unsigned int tpu4_to3_mux[] = {
+ 	TPU4TO3_MARK,
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch b/queue-4.19/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
new file mode 100644
index 00000000000..63c71d8ae50
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
@@ -0,0 +1,37 @@
+From 3e2b654510c09640dcda6eb23f442415da5d9c91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 16:51:21 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]
+
+There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
+group array lists only one, and it refers to a nonexistent group.
+
+Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index f8fbedb46585d..6dca760f9f280 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = {
+ 	"fsic_sclk_out",
+ 	"fsic_data_in",
+ 	"fsic_data_out",
+-	"fsic_spdif",
++	"fsic_spdif_0",
++	"fsic_spdif_1",
+ };
+ 
+ static const char * const fsid_groups[] = {
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch b/queue-4.19/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
new file mode 100644
index 00000000000..fde82af68ab
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
@@ -0,0 +1,37 @@
+From 9cc83bda15ebe5b000b2027db80fbccb640e9a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:42:16 +0100
+Subject: pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]
+
+The Peripheral Function Select Register 11 contains 3 reserved bits and
+15 variable-width fields, but the variable field descriptor does not
+contain the 3-bit field IP11[25:23].
+
+Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 3eccc9b3ca84a..05ccb27f77818 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		FN_LCD_DATA15_B, 0, 0, 0 }
+ 	},
+ 	{ PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
+-			3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
++			3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+ 	    /* IP11_31_29 [3] */
+ 	    0, 0, 0, 0, 0, 0, 0, 0,
+ 	    /* IP11_28 [1] */
+-- 
+2.20.1
+
diff --git a/queue-4.19/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch b/queue-4.19/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
new file mode 100644
index 00000000000..03829a8b8cc
--- /dev/null
+++ b/queue-4.19/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
@@ -0,0 +1,42 @@
+From 68c1c190a10673e685c53be9d16157492e68aad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:32:34 +0100
+Subject: pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]
+
+The IP10[5:3] field in Peripheral Function Select Register 10 has a
+width of 3 bits, i.e. it allows programming one out of 8 different
+configurations.
+However, 9 values are provided instead of 8, overflowing into the
+subsequent field in the register, and thus breaking the configuration of
+the latter.
+
+Fix this by dropping a bogus zero value.
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 05ccb27f77818..c691e5e9d9dea 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		FN_LCD_CL1_B, 0, 0,
+ 	    /* IP10_5_3 [3] */
+ 		FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+-		FN_LCD_DON_B, 0, 0, 0,
++		FN_LCD_DON_B, 0, 0,
+ 	    /* IP10_2_0 [3] */
+ 		FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
+ 		FN_LCD_DATA15_B, 0, 0, 0 }
+-- 
+2.20.1
+
diff --git a/queue-4.19/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch b/queue-4.19/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch
new file mode 100644
index 00000000000..7a45e2ae017
--- /dev/null
+++ b/queue-4.19/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch
@@ -0,0 +1,65 @@
+From d1866fdabea5e937f659fee5ac022148bec79117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 00:17:12 +0000
+Subject: platform/x86: alienware-wmi: fix kfree on potentially uninitialized
+ pointer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ]
+
+Currently the kfree of output.pointer can be potentially freeing
+an uninitalized pointer in the case where out_data is NULL. Fix this
+by reworking the case where out_data is not-null to perform the
+ACPI status check and also the kfree of outpoint.pointer in one block
+and hence ensuring the pointer is only freed when it has been used.
+
+Also replace the if (ptr != NULL) idiom with just if (ptr).
+
+Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/alienware-wmi.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index f10af5c383c55..c0d1555735cdd 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -522,23 +522,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
+ 
+ 	input.length = (acpi_size) sizeof(*in_args);
+ 	input.pointer = in_args;
+-	if (out_data != NULL) {
++	if (out_data) {
+ 		output.length = ACPI_ALLOCATE_BUFFER;
+ 		output.pointer = NULL;
+ 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
+ 					     command, &input, &output);
+-	} else
++		if (ACPI_SUCCESS(status)) {
++			obj = (union acpi_object *)output.pointer;
++			if (obj && obj->type == ACPI_TYPE_INTEGER)
++				*out_data = (u32)obj->integer.value;
++		}
++		kfree(output.pointer);
++	} else {
+ 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
+ 					     command, &input, NULL);
+-
+-	if (ACPI_SUCCESS(status) && out_data != NULL) {
+-		obj = (union acpi_object *)output.pointer;
+-		if (obj && obj->type == ACPI_TYPE_INTEGER)
+-			*out_data = (u32) obj->integer.value;
+ 	}
+-	kfree(output.pointer);
+ 	return status;
+-
+ }
+ 
+ /*
+-- 
+2.20.1
+
diff --git a/queue-4.19/platform-x86-alienware-wmi-printing-the-wrong-error-.patch b/queue-4.19/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
new file mode 100644
index 00000000000..39adc49eded
--- /dev/null
+++ b/queue-4.19/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
@@ -0,0 +1,38 @@
+From fce75a55ab4b3e8cbf07e37e08db1934efb8fc6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: platform/x86: alienware-wmi: printing the wrong error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]
+
+The "out_data" variable is uninitialized at the point.  Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index c0d1555735cdd..83fd7677af24c 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -587,7 +587,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ 			return scnprintf(buf, PAGE_SIZE,
+ 					 "input [gpu] unknown\n");
+ 	}
+-	pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++	pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ 	return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/platform-x86-wmi-fix-potential-null-pointer-derefere.patch b/queue-4.19/platform-x86-wmi-fix-potential-null-pointer-derefere.patch
new file mode 100644
index 00000000000..06413db7ee7
--- /dev/null
+++ b/queue-4.19/platform-x86-wmi-fix-potential-null-pointer-derefere.patch
@@ -0,0 +1,42 @@
+From 32682da0778d56f66ac92417df7010c624a22132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 16:14:24 +0100
+Subject: platform/x86: wmi: fix potential null pointer dereference
+
+From: Mattias Jacobsson <2pi@mok.nu>
+
+[ Upstream commit c355ec651a8941864549f2586f969d0eb7bf499a ]
+
+In the function wmi_dev_match() the variable id is dereferenced without
+first performing a NULL check. The variable can for example be NULL if
+a WMI driver is registered without specifying the id_table field in
+struct wmi_driver.
+
+Add a NULL check and return that the driver can't handle the device if
+the variable is NULL.
+
+Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
+Signed-off-by: Mattias Jacobsson <2pi@mok.nu>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/wmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 04791ea5d97b6..35cdc3998eb59 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -768,6 +768,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
+ 	struct wmi_block *wblock = dev_to_wblock(dev);
+ 	const struct wmi_device_id *id = wmi_driver->id_table;
+ 
++	if (id == NULL)
++		return 0;
++
+ 	while (id->guid_string) {
+ 		uuid_le driver_guid;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/pm-acpi-pci-resume-all-devices-during-hibernation.patch b/queue-4.19/pm-acpi-pci-resume-all-devices-during-hibernation.patch
new file mode 100644
index 00000000000..1808fa9de29
--- /dev/null
+++ b/queue-4.19/pm-acpi-pci-resume-all-devices-during-hibernation.patch
@@ -0,0 +1,89 @@
+From cd0e0cb09a7b43e1b4b203f6fe998fc3bdbb4a11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2019 12:44:25 +0200
+Subject: PM: ACPI/PCI: Resume all devices during hibernation
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 501debd4aa5edc755037c39ea5a8fba23b41e580 ]
+
+Both the PCI bus type and the ACPI PM domain avoid resuming
+runtime-suspended devices with DPM_FLAG_SMART_SUSPEND set during
+hibernation (before creating the snapshot image of system memory),
+but that turns out to be a mistake.  It leads to functional issues
+and adds complexity that's hard to justify.
+
+For this reason, resume all runtime-suspended PCI devices and all
+devices in the ACPI PM domains before creating a snapshot image of
+system memory during hibernation.
+
+Fixes: 05087360fd7a (ACPI / PM: Take SMART_SUSPEND driver flag into account)
+Fixes: c4b65157aeef (PCI / PM: Take SMART_SUSPEND driver flag into account)
+Link: https://lore.kernel.org/linux-acpi/917d4399-2e22-67b1-9d54-808561f9083f@uwyo.edu/T/#maf065fe6e4974f2a9d79f332ab99dfaba635f64c
+Reported-by: Robert R. Howell <RHowell@uwyo.edu>
+Tested-by: Robert R. Howell <RHowell@uwyo.edu>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_pm.c | 13 +++++++------
+ drivers/pci/pci-driver.c | 16 ++++++++--------
+ 2 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index e0927c5fd2821..11b7a1632e5aa 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1116,13 +1116,14 @@ EXPORT_SYMBOL_GPL(acpi_subsys_resume_early);
+ int acpi_subsys_freeze(struct device *dev)
+ {
+ 	/*
+-	 * This used to be done in acpi_subsys_prepare() for all devices and
+-	 * some drivers may depend on it, so do it here.  Ideally, however,
+-	 * runtime-suspended devices should not be touched during freeze/thaw
+-	 * transitions.
++	 * Resume all runtime-suspended devices before creating a snapshot
++	 * image of system memory, because the restore kernel generally cannot
++	 * be expected to always handle them consistently and they need to be
++	 * put into the runtime-active metastate during system resume anyway,
++	 * so it is better to ensure that the state saved in the image will be
++	 * always consistent with that.
+ 	 */
+-	if (!dev_pm_test_driver_flags(dev, DPM_FLAG_SMART_SUSPEND))
+-		pm_runtime_resume(dev);
++	pm_runtime_resume(dev);
+ 
+ 	return pm_generic_freeze(dev);
+ }
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index e69af9b8361dc..5def4b74d54a0 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -996,15 +996,15 @@ static int pci_pm_freeze(struct device *dev)
+ 	}
+ 
+ 	/*
+-	 * This used to be done in pci_pm_prepare() for all devices and some
+-	 * drivers may depend on it, so do it here.  Ideally, runtime-suspended
+-	 * devices should not be touched during freeze/thaw transitions,
+-	 * however.
++	 * Resume all runtime-suspended devices before creating a snapshot
++	 * image of system memory, because the restore kernel generally cannot
++	 * be expected to always handle them consistently and they need to be
++	 * put into the runtime-active metastate during system resume anyway,
++	 * so it is better to ensure that the state saved in the image will be
++	 * always consistent with that.
+ 	 */
+-	if (!dev_pm_smart_suspend_and_suspended(dev)) {
+-		pm_runtime_resume(dev);
+-		pci_dev->state_saved = false;
+-	}
++	pm_runtime_resume(dev);
++	pci_dev->state_saved = false;
+ 
+ 	if (pm->freeze) {
+ 		int error;
+-- 
+2.20.1
+
diff --git a/queue-4.19/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch b/queue-4.19/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch
new file mode 100644
index 00000000000..f4a2120e714
--- /dev/null
+++ b/queue-4.19/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch
@@ -0,0 +1,38 @@
+From 2b125d4be7bcdd428dede9515997cfb2b5a624f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 13:03:48 +0200
+Subject: PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2933954b71f10d392764f95eec0f0aa2d103054b ]
+
+It is not actually guaranteed that pm_abort_suspend will be
+nonzero when pm_system_cancel_wakeup() is called which may lead to
+subtle issues, so make it use atomic_dec_if_positive() instead of
+atomic_dec() for the safety sake.
+
+Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/wakeup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
+index 7c84f64c74f77..2dfa2e0487451 100644
+--- a/drivers/base/power/wakeup.c
++++ b/drivers/base/power/wakeup.c
+@@ -875,7 +875,7 @@ EXPORT_SYMBOL_GPL(pm_system_wakeup);
+ 
+ void pm_system_cancel_wakeup(void)
+ {
+-	atomic_dec(&pm_abort_suspend);
++	atomic_dec_if_positive(&pm_abort_suspend);
+ }
+ 
+ void pm_wakeup_clear(bool reset)
+-- 
+2.20.1
+
diff --git a/queue-4.19/power-supply-init-device-wakeup-after-device_add.patch b/queue-4.19/power-supply-init-device-wakeup-after-device_add.patch
new file mode 100644
index 00000000000..f6cafd84eed
--- /dev/null
+++ b/queue-4.19/power-supply-init-device-wakeup-after-device_add.patch
@@ -0,0 +1,69 @@
+From 716407a3f967337adc87acc3ac8c6d92f7ee077a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 14:33:30 -0700
+Subject: power: supply: Init device wakeup after device_add()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ]
+
+We may want to use the device pointer in device_init_wakeup() with
+functions that expect the device to already be added with device_add().
+For example, if we were to link the device initializing wakeup to
+something in sysfs such as a class for wakeups we'll run into an error.
+It looks like this code was written with the assumption that the device
+would be added before initializing wakeup due to the order of operations
+in power_supply_unregister().
+
+Let's change the order of operations so we don't run into problems here.
+
+Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed")
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Tri Vo <trong@android.com>
+Cc: Kalesh Singh <kaleshsingh@google.com>
+Cc: Ravi Chandra Sadineni <ravisadineni@chromium.org>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/power_supply_core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index e85361878450c..e43a7b3b570c4 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -902,14 +902,14 @@ __power_supply_register(struct device *parent,
+ 	}
+ 
+ 	spin_lock_init(&psy->changed_lock);
+-	rc = device_init_wakeup(dev, ws);
+-	if (rc)
+-		goto wakeup_init_failed;
+-
+ 	rc = device_add(dev);
+ 	if (rc)
+ 		goto device_add_failed;
+ 
++	rc = device_init_wakeup(dev, ws);
++	if (rc)
++		goto wakeup_init_failed;
++
+ 	rc = psy_register_thermal(psy);
+ 	if (rc)
+ 		goto register_thermal_failed;
+@@ -946,8 +946,8 @@ register_cooler_failed:
+ 	psy_unregister_thermal(psy);
+ register_thermal_failed:
+ 	device_del(dev);
+-device_add_failed:
+ wakeup_init_failed:
++device_add_failed:
+ check_supplies_failed:
+ dev_set_name_failed:
+ 	put_device(dev);
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch b/queue-4.19/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch
new file mode 100644
index 00000000000..4b6278d0c01
--- /dev/null
+++ b/queue-4.19/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch
@@ -0,0 +1,83 @@
+From 212e6c2462eaca2f0f7138ae6ad68cfbc07514d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 11:20:01 +1100
+Subject: powerpc/64s: Fix logic when handling unknown CPU features
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 8cfaf106918a8c13abb24c641556172afbb9545c ]
+
+In cpufeatures_process_feature(), if a provided CPU feature is unknown and
+enable_unknown is false, we erroneously print that the feature is being
+enabled and return true, even though no feature has been enabled, and
+may also set feature bits based on the last entry in the match table.
+
+Fix this so that we only set feature bits from the match table if we have
+actually enabled a feature from that table, and when failing to enable an
+unknown feature, always print the "not enabling" message and return false.
+
+Coincidentally, some older gccs (<GCC 7), when invoked with
+-fsanitize-coverage=trace-pc, cause a spurious uninitialised variable
+warning in this function:
+
+  arch/powerpc/kernel/dt_cpu_ftrs.c: In function ‘cpufeatures_process_feature’:
+  arch/powerpc/kernel/dt_cpu_ftrs.c:686:7: warning: ‘m’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+    if (m->cpu_ftr_bit_mask)
+
+An upcoming patch will enable support for kcov, which requires this option.
+This patch avoids the warning.
+
+Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
+Reported-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+[ajd: add commit message]
+Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/dt_cpu_ftrs.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index c6f41907f0d71..a4b31e17492d3 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -666,8 +666,10 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ 		m = &dt_cpu_feature_match_table[i];
+ 		if (!strcmp(f->name, m->name)) {
+ 			known = true;
+-			if (m->enable(f))
++			if (m->enable(f)) {
++				cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
+ 				break;
++			}
+ 
+ 			pr_info("not enabling: %s (disabled or unsupported by kernel)\n",
+ 				f->name);
+@@ -675,17 +677,12 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ 		}
+ 	}
+ 
+-	if (!known && enable_unknown) {
+-		if (!feat_try_enable_unknown(f)) {
+-			pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
+-				f->name);
+-			return false;
+-		}
++	if (!known && (!enable_unknown || !feat_try_enable_unknown(f))) {
++		pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
++			f->name);
++		return false;
+ 	}
+ 
+-	if (m->cpu_ftr_bit_mask)
+-		cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
+-
+ 	if (known)
+ 		pr_debug("enabling: %s\n", f->name);
+ 	else
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-64s-radix-fix-memory-hot-unplug-page-table-s.patch b/queue-4.19/powerpc-64s-radix-fix-memory-hot-unplug-page-table-s.patch
new file mode 100644
index 00000000000..17cfd9992da
--- /dev/null
+++ b/queue-4.19/powerpc-64s-radix-fix-memory-hot-unplug-page-table-s.patch
@@ -0,0 +1,41 @@
+From c9625759128b96fa077facd0df281d267ad8dca6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 18:46:35 +1000
+Subject: powerpc/64s/radix: Fix memory hot-unplug page table split
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 31f210cf42d4b308eacef89b6cb0b1459338b8de ]
+
+create_physical_mapping expects physical addresses, but splitting
+these mapping on hot unplug is supplying virtual (effective)
+addresses.
+
+Fixes: 4dd5f8a99e791 ("powerpc/mm/radix: Split linear mapping on hot-unplug")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190724084638.24982-2-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/pgtable-radix.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index 69caeb5bccb21..5404a631d5834 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -717,8 +717,8 @@ static int __meminit stop_machine_change_mapping(void *data)
+ 
+ 	spin_unlock(&init_mm.page_table_lock);
+ 	pte_clear(&init_mm, params->aligned_start, params->pte);
+-	create_physical_mapping(params->aligned_start, params->start, -1);
+-	create_physical_mapping(params->end, params->aligned_end, -1);
++	create_physical_mapping(__pa(params->aligned_start), __pa(params->start), -1);
++	create_physical_mapping(__pa(params->end), __pa(params->aligned_end), -1);
+ 	spin_lock(&init_mm.page_table_lock);
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch b/queue-4.19/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
new file mode 100644
index 00000000000..63c5fd0d854
--- /dev/null
+++ b/queue-4.19/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
@@ -0,0 +1,71 @@
+From c83e596aec491be3012f675cfc21aad4d3d8edcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 23:45:04 -0500
+Subject: powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ]
+
+Allow external callers to force the cacheinfo code to release all its
+references to cache nodes, e.g. before processing device tree updates
+post-migration, and to rebuild the hierarchy afterward.
+
+CPU online/offline must be blocked by callers; enforce this.
+
+Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++
+ arch/powerpc/kernel/cacheinfo.h |  4 ++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index a8f20e5928e13..9edb454301336 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -865,4 +865,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
+ 	if (cache)
+ 		cache_cpu_clear(cache, cpu_id);
+ }
++
++void cacheinfo_teardown(void)
++{
++	unsigned int cpu;
++
++	lockdep_assert_cpus_held();
++
++	for_each_online_cpu(cpu)
++		cacheinfo_cpu_offline(cpu);
++}
++
++void cacheinfo_rebuild(void)
++{
++	unsigned int cpu;
++
++	lockdep_assert_cpus_held();
++
++	for_each_online_cpu(cpu)
++		cacheinfo_cpu_online(cpu);
++}
++
+ #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
+diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
+index 955f5e999f1b8..52bd3fc6642da 100644
+--- a/arch/powerpc/kernel/cacheinfo.h
++++ b/arch/powerpc/kernel/cacheinfo.h
+@@ -6,4 +6,8 @@
+ extern void cacheinfo_cpu_online(unsigned int cpu_id);
+ extern void cacheinfo_cpu_offline(unsigned int cpu_id);
+ 
++/* Allow migration/suspend to tear down and rebuild the hierarchy. */
++extern void cacheinfo_teardown(void);
++extern void cacheinfo_rebuild(void);
++
+ #endif /* _PPC_CACHEINFO_H */
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch b/queue-4.19/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch
new file mode 100644
index 00000000000..0a536f98c90
--- /dev/null
+++ b/queue-4.19/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch
@@ -0,0 +1,136 @@
+From 4df969ec8045cb48a4501a608f9050e9e3751af7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 09:26:03 +0000
+Subject: powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit fb978ca207743badfe7efd9eebe68bcbb4969f79 ]
+
+Generic implementation fails to remove breakpoints after init
+when CONFIG_STRICT_KERNEL_RWX is selected:
+
+[   13.251285] KGDB: BP remove failed: c001c338
+[   13.259587] kgdbts: ERROR PUT: end of test buffer on 'do_fork_test' line 8 expected OK got $E14#aa
+[   13.268969] KGDB: re-enter exception: ALL breakpoints killed
+[   13.275099] CPU: 0 PID: 1 Comm: init Not tainted 4.18.0-g82bbb913ffd8 #860
+[   13.282836] Call Trace:
+[   13.285313] [c60e1ba0] [c0080ef0] kgdb_handle_exception+0x6f4/0x720 (unreliable)
+[   13.292618] [c60e1c30] [c000e97c] kgdb_handle_breakpoint+0x3c/0x98
+[   13.298709] [c60e1c40] [c000af54] program_check_exception+0x104/0x700
+[   13.305083] [c60e1c60] [c000e45c] ret_from_except_full+0x0/0x4
+[   13.310845] [c60e1d20] [c02a22ac] run_simple_test+0x2b4/0x2d4
+[   13.316532] [c60e1d30] [c0081698] put_packet+0xb8/0x158
+[   13.321694] [c60e1d60] [c00820b4] gdb_serial_stub+0x230/0xc4c
+[   13.327374] [c60e1dc0] [c0080af8] kgdb_handle_exception+0x2fc/0x720
+[   13.333573] [c60e1e50] [c000e928] kgdb_singlestep+0xb4/0xcc
+[   13.339068] [c60e1e70] [c000ae1c] single_step_exception+0x90/0xac
+[   13.345100] [c60e1e80] [c000e45c] ret_from_except_full+0x0/0x4
+[   13.350865] [c60e1f40] [c000e11c] ret_from_syscall+0x0/0x38
+[   13.356346] Kernel panic - not syncing: Recursive entry to debugger
+
+This patch creates powerpc specific version of
+kgdb_arch_set_breakpoint() and kgdb_arch_remove_breakpoint()
+using patch_instruction()
+
+Fixes: 1e0fc9d1eb2b ("powerpc/Kconfig: Enable STRICT_KERNEL_RWX for some configs")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/kgdb.h |  5 +++-
+ arch/powerpc/kernel/kgdb.c      | 43 +++++++++++++++++++++++++++------
+ 2 files changed, 39 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/kgdb.h b/arch/powerpc/include/asm/kgdb.h
+index 9db24e77b9f4b..a9e098a3b881f 100644
+--- a/arch/powerpc/include/asm/kgdb.h
++++ b/arch/powerpc/include/asm/kgdb.h
+@@ -26,9 +26,12 @@
+ #define BREAK_INSTR_SIZE	4
+ #define BUFMAX			((NUMREGBYTES * 2) + 512)
+ #define OUTBUFMAX		((NUMREGBYTES * 2) + 512)
++
++#define BREAK_INSTR		0x7d821008	/* twge r2, r2 */
++
+ static inline void arch_kgdb_breakpoint(void)
+ {
+-	asm(".long 0x7d821008"); /* twge r2, r2 */
++	asm(stringify_in_c(.long BREAK_INSTR));
+ }
+ #define CACHE_FLUSH_IS_SAFE	1
+ #define DBG_MAX_REG_NUM     70
+diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
+index 35e240a0a4087..59c578f865aa6 100644
+--- a/arch/powerpc/kernel/kgdb.c
++++ b/arch/powerpc/kernel/kgdb.c
+@@ -24,6 +24,7 @@
+ #include <asm/processor.h>
+ #include <asm/machdep.h>
+ #include <asm/debug.h>
++#include <asm/code-patching.h>
+ #include <linux/slab.h>
+ 
+ /*
+@@ -144,7 +145,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
+ 	if (kgdb_handle_exception(1, SIGTRAP, 0, regs) != 0)
+ 		return 0;
+ 
+-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
++	if (*(u32 *)regs->nip == BREAK_INSTR)
+ 		regs->nip += BREAK_INSTR_SIZE;
+ 
+ 	return 1;
+@@ -441,16 +442,42 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
+ 	return -1;
+ }
+ 
++int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
++{
++	int err;
++	unsigned int instr;
++	unsigned int *addr = (unsigned int *)bpt->bpt_addr;
++
++	err = probe_kernel_address(addr, instr);
++	if (err)
++		return err;
++
++	err = patch_instruction(addr, BREAK_INSTR);
++	if (err)
++		return -EFAULT;
++
++	*(unsigned int *)bpt->saved_instr = instr;
++
++	return 0;
++}
++
++int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
++{
++	int err;
++	unsigned int instr = *(unsigned int *)bpt->saved_instr;
++	unsigned int *addr = (unsigned int *)bpt->bpt_addr;
++
++	err = patch_instruction(addr, instr);
++	if (err)
++		return -EFAULT;
++
++	return 0;
++}
++
+ /*
+  * Global data
+  */
+-struct kgdb_arch arch_kgdb_ops = {
+-#ifdef __LITTLE_ENDIAN__
+-	.gdb_bpt_instr = {0x08, 0x10, 0x82, 0x7d},
+-#else
+-	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
+-#endif
+-};
++struct kgdb_arch arch_kgdb_ops;
+ 
+ static int kgdb_not_implemented(struct pt_regs *regs)
+ {
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-mm-check-secondary-hash-page-table.patch b/queue-4.19/powerpc-mm-check-secondary-hash-page-table.patch
new file mode 100644
index 00000000000..7bbbaaf6173
--- /dev/null
+++ b/queue-4.19/powerpc-mm-check-secondary-hash-page-table.patch
@@ -0,0 +1,38 @@
+From 2b235fccc28003c159399dac05ed47542676561c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Feb 2019 10:29:49 +1100
+Subject: powerpc/mm: Check secondary hash page table
+
+From: Rashmica Gupta <rashmica.g@gmail.com>
+
+[ Upstream commit 790845e2f12709d273d08ea7a2af7c2593689519 ]
+
+We were always calling base_hpte_find() with primary = true,
+even when we wanted to check the secondary table.
+
+mpe: I broke this when refactoring Rashmica's original patch.
+
+Fixes: 1515ab932156 ("powerpc/mm: Dump hash table")
+Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/dump_hashpagetable.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c
+index 8692946950485..b430e4e08af69 100644
+--- a/arch/powerpc/mm/dump_hashpagetable.c
++++ b/arch/powerpc/mm/dump_hashpagetable.c
+@@ -342,7 +342,7 @@ static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
+ 
+ 	/* Look in secondary table */
+ 	if (slot == -1)
+-		slot = base_hpte_find(ea, psize, true, &v, &r);
++		slot = base_hpte_find(ea, psize, false, &v, &r);
+ 
+ 	/* No entry found */
+ 	if (slot == -1)
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-mm-mce-keep-irqs-disabled-during-lockless-pa.patch b/queue-4.19/powerpc-mm-mce-keep-irqs-disabled-during-lockless-pa.patch
new file mode 100644
index 00000000000..5e4e5301230
--- /dev/null
+++ b/queue-4.19/powerpc-mm-mce-keep-irqs-disabled-during-lockless-pa.patch
@@ -0,0 +1,73 @@
+From 6fdf2787c8f560a4a10b9d13e694af091d60ce2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 20:23:28 +0530
+Subject: powerpc/mm/mce: Keep irqs disabled during lockless page table walk
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit d9101bfa6adc831bda8836c4d774820553c14942 ]
+
+__find_linux_mm_pte() returns a page table entry pointer after walking
+the page table without holding locks. To make it safe against a THP
+split and/or collapse, we disable interrupts around the lockless page
+table walk. However we need to keep interrupts disabled as long as we
+use the page table entry pointer that is returned.
+
+Fix addr_to_pfn() to do that.
+
+Fixes: ba41e1e1ccb9 ("powerpc/mce: Hookup derror (load/store) UE errors")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+[mpe: Rearrange code slightly and tweak change log wording]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190918145328.28602-1-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/mce_power.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index 37a110b8e7e17..ecb3750406378 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -40,7 +40,7 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
+ {
+ 	pte_t *ptep;
+ 	unsigned int shift;
+-	unsigned long flags;
++	unsigned long pfn, flags;
+ 	struct mm_struct *mm;
+ 
+ 	if (user_mode(regs))
+@@ -50,18 +50,22 @@ static unsigned long addr_to_pfn(struct pt_regs *regs, unsigned long addr)
+ 
+ 	local_irq_save(flags);
+ 	ptep = __find_linux_pte(mm->pgd, addr, NULL, &shift);
+-	local_irq_restore(flags);
+ 
+-	if (!ptep || pte_special(*ptep))
+-		return ULONG_MAX;
++	if (!ptep || pte_special(*ptep)) {
++		pfn = ULONG_MAX;
++		goto out;
++	}
+ 
+-	if (shift > PAGE_SHIFT) {
++	if (shift <= PAGE_SHIFT)
++		pfn = pte_pfn(*ptep);
++	else {
+ 		unsigned long rpnmask = (1ul << shift) - PAGE_SIZE;
+-
+-		return pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
++		pfn = pte_pfn(__pte(pte_val(*ptep) | (addr & rpnmask)));
+ 	}
+ 
+-	return pte_pfn(*ptep);
++out:
++	local_irq_restore(flags);
++	return pfn;
+ }
+ 
+ /* flush SLBs and reload */
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-pseries-memory-hotplug-fix-return-value-type.patch b/queue-4.19/powerpc-pseries-memory-hotplug-fix-return-value-type.patch
new file mode 100644
index 00000000000..01e26ec82aa
--- /dev/null
+++ b/queue-4.19/powerpc-pseries-memory-hotplug-fix-return-value-type.patch
@@ -0,0 +1,139 @@
+From 0bfc9c8a70aee32b5d014439813293ff36991906 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Oct 2018 21:59:13 +0800
+Subject: powerpc/pseries/memory-hotplug: Fix return value type of
+ find_aa_index
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit b45e9d761ba2d60044b610297e3ef9f947ac157f ]
+
+The variable 'aa_index' is defined as an unsigned value in
+update_lmb_associativity_index(), but find_aa_index() may return -1
+when dlpar_clone_property() fails. So change find_aa_index() to return
+a bool, which indicates whether 'aa_index' was found or not.
+
+Fixes: c05a5a40969e ("powerpc/pseries: Dynamic add entires to associativity lookup array")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Nathan Fontenot nfont@linux.vnet.ibm.com>
+[mpe: Tweak changelog, rename is_found to just found]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platforms/pseries/hotplug-memory.c        | 61 +++++++++----------
+ 1 file changed, 28 insertions(+), 33 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 7f86bc3eaadec..62d3c72cd9316 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -101,11 +101,12 @@ static struct property *dlpar_clone_property(struct property *prop,
+ 	return new_prop;
+ }
+ 
+-static u32 find_aa_index(struct device_node *dr_node,
+-			 struct property *ala_prop, const u32 *lmb_assoc)
++static bool find_aa_index(struct device_node *dr_node,
++			 struct property *ala_prop,
++			 const u32 *lmb_assoc, u32 *aa_index)
+ {
+-	u32 *assoc_arrays;
+-	u32 aa_index;
++	u32 *assoc_arrays, new_prop_size;
++	struct property *new_prop;
+ 	int aa_arrays, aa_array_entries, aa_array_sz;
+ 	int i, index;
+ 
+@@ -121,46 +122,39 @@ static u32 find_aa_index(struct device_node *dr_node,
+ 	aa_array_entries = be32_to_cpu(assoc_arrays[1]);
+ 	aa_array_sz = aa_array_entries * sizeof(u32);
+ 
+-	aa_index = -1;
+ 	for (i = 0; i < aa_arrays; i++) {
+ 		index = (i * aa_array_entries) + 2;
+ 
+ 		if (memcmp(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz))
+ 			continue;
+ 
+-		aa_index = i;
+-		break;
++		*aa_index = i;
++		return true;
+ 	}
+ 
+-	if (aa_index == -1) {
+-		struct property *new_prop;
+-		u32 new_prop_size;
+-
+-		new_prop_size = ala_prop->length + aa_array_sz;
+-		new_prop = dlpar_clone_property(ala_prop, new_prop_size);
+-		if (!new_prop)
+-			return -1;
+-
+-		assoc_arrays = new_prop->value;
++	new_prop_size = ala_prop->length + aa_array_sz;
++	new_prop = dlpar_clone_property(ala_prop, new_prop_size);
++	if (!new_prop)
++		return false;
+ 
+-		/* increment the number of entries in the lookup array */
+-		assoc_arrays[0] = cpu_to_be32(aa_arrays + 1);
++	assoc_arrays = new_prop->value;
+ 
+-		/* copy the new associativity into the lookup array */
+-		index = aa_arrays * aa_array_entries + 2;
+-		memcpy(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz);
++	/* increment the number of entries in the lookup array */
++	assoc_arrays[0] = cpu_to_be32(aa_arrays + 1);
+ 
+-		of_update_property(dr_node, new_prop);
++	/* copy the new associativity into the lookup array */
++	index = aa_arrays * aa_array_entries + 2;
++	memcpy(&assoc_arrays[index], &lmb_assoc[1], aa_array_sz);
+ 
+-		/*
+-		 * The associativity lookup array index for this lmb is
+-		 * number of entries - 1 since we added its associativity
+-		 * to the end of the lookup array.
+-		 */
+-		aa_index = be32_to_cpu(assoc_arrays[0]) - 1;
+-	}
++	of_update_property(dr_node, new_prop);
+ 
+-	return aa_index;
++	/*
++	 * The associativity lookup array index for this lmb is
++	 * number of entries - 1 since we added its associativity
++	 * to the end of the lookup array.
++	 */
++	*aa_index = be32_to_cpu(assoc_arrays[0]) - 1;
++	return true;
+ }
+ 
+ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+@@ -169,6 +163,7 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ 	struct property *ala_prop;
+ 	const u32 *lmb_assoc;
+ 	u32 aa_index;
++	bool found;
+ 
+ 	parent = of_find_node_by_path("/");
+ 	if (!parent)
+@@ -200,12 +195,12 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+ 		return -ENODEV;
+ 	}
+ 
+-	aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
++	found = find_aa_index(dr_node, ala_prop, lmb_assoc, &aa_index);
+ 
+ 	of_node_put(dr_node);
+ 	dlpar_free_cc_nodes(lmb_node);
+ 
+-	if (aa_index < 0) {
++	if (!found) {
+ 		pr_err("Could not find LMB associativity\n");
+ 		return -1;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch b/queue-4.19/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
new file mode 100644
index 00000000000..2021c01eed9
--- /dev/null
+++ b/queue-4.19/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
@@ -0,0 +1,81 @@
+From 2342a2965839ace8cf2ad350828169e496df51b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 23:45:06 -0500
+Subject: powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit e610a466d16a086e321f0bd421e2fc75cff28605 ]
+
+It's common for the platform to replace the cache device nodes after a
+migration. Since the cacheinfo code is never informed about this, it
+never drops its references to the source system's cache nodes, causing
+it to wind up in an inconsistent state resulting in warnings and oopses
+as soon as CPU online/offline occurs after the migration, e.g.
+
+  cache for /cpus/l3-cache@3113(Unified) refers to cache for /cpus/l2-cache@200d(Unified)
+  WARNING: CPU: 15 PID: 86 at arch/powerpc/kernel/cacheinfo.c:176 release_cache+0x1bc/0x1d0
+  [...]
+  NIP release_cache+0x1bc/0x1d0
+  LR  release_cache+0x1b8/0x1d0
+  Call Trace:
+    release_cache+0x1b8/0x1d0 (unreliable)
+    cacheinfo_cpu_offline+0x1c4/0x2c0
+    unregister_cpu_online+0x1b8/0x260
+    cpuhp_invoke_callback+0x114/0xf40
+    cpuhp_thread_fun+0x270/0x310
+    smpboot_thread_fn+0x2c8/0x390
+    kthread+0x1b8/0x1c0
+    ret_from_kernel_thread+0x5c/0x68
+
+Using device tree notifiers won't work since we want to rebuild the
+hierarchy only after all the removals and additions have occurred and
+the device tree is in a consistent state. Call cacheinfo_teardown()
+before processing device tree updates, and rebuild the hierarchy
+afterward.
+
+Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/mobility.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index e4ea713833832..70744b4fbd9ed 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -24,6 +24,7 @@
+ #include <asm/machdep.h>
+ #include <asm/rtas.h>
+ #include "pseries.h"
++#include "../../kernel/cacheinfo.h"
+ 
+ static struct kobject *mobility_kobj;
+ 
+@@ -360,11 +361,20 @@ void post_mobility_fixup(void)
+ 	 */
+ 	cpus_read_lock();
+ 
++	/*
++	 * It's common for the destination firmware to replace cache
++	 * nodes.  Release all of the cacheinfo hierarchy's references
++	 * before updating the device tree.
++	 */
++	cacheinfo_teardown();
++
+ 	rc = pseries_devicetree_update(MIGRATION_SCOPE);
+ 	if (rc)
+ 		printk(KERN_ERR "Post-mobility device tree update "
+ 			"failed: %d\n", rc);
+ 
++	cacheinfo_rebuild();
++
+ 	cpus_read_unlock();
+ 
+ 	/* Possibly switch to a new RFI flush type */
+-- 
+2.20.1
+
diff --git a/queue-4.19/powerpc-vdso-make-vdso32-installation-conditional-in.patch b/queue-4.19/powerpc-vdso-make-vdso32-installation-conditional-in.patch
new file mode 100644
index 00000000000..92c30ecfd6c
--- /dev/null
+++ b/queue-4.19/powerpc-vdso-make-vdso32-installation-conditional-in.patch
@@ -0,0 +1,39 @@
+From 81213746bf0d4abf5cb4e2435d0d6ba523ee11a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 04:24:37 +0000
+Subject: powerpc: vdso: Make vdso32 installation conditional in vdso_install
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]
+
+The 32-bit vDSO is not needed and not normally built for 64-bit
+little-endian configurations.  However, the vdso_install target still
+builds and installs it.  Add the same config condition as is normally
+used for the build.
+
+Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index e43321f46a3be..8954108df4570 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -412,7 +412,9 @@ vdso_install:
+ ifdef CONFIG_PPC64
+ 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
+ endif
++ifdef CONFIG_VDSO32
+ 	$(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
++endif
+ 
+ archclean:
+ 	$(Q)$(MAKE) $(clean)=$(boot)
+-- 
+2.20.1
+
diff --git a/queue-4.19/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch b/queue-4.19/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
new file mode 100644
index 00000000000..b9e01c2f262
--- /dev/null
+++ b/queue-4.19/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
@@ -0,0 +1,45 @@
+From dc7ea488521d7812f2edcff063f4d0914b29db2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 12:12:28 +0200
+Subject: pwm: lpss: Release runtime-pm reference from the driver's remove
+ callback
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ]
+
+For each pwm output which gets enabled through pwm_lpss_apply(), we do a
+pm_runtime_get_sync().
+
+This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance
+these when the driver gets removed with some of the outputs still enabled.
+
+Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM")
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lpss.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 1e69c1c9ec096..7a4a6406cf69a 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -216,6 +216,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
+ 
+ int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
+ {
++	int i;
++
++	for (i = 0; i < lpwm->info->npwm; i++) {
++		if (pwm_is_enabled(&lpwm->chip.pwms[i]))
++			pm_runtime_put(lpwm->chip.dev);
++	}
+ 	return pwmchip_remove(&lpwm->chip);
+ }
+ EXPORT_SYMBOL_GPL(pwm_lpss_remove);
+-- 
+2.20.1
+
diff --git a/queue-4.19/pwm-meson-consider-128-a-valid-pre-divider.patch b/queue-4.19/pwm-meson-consider-128-a-valid-pre-divider.patch
new file mode 100644
index 00000000000..397665d0422
--- /dev/null
+++ b/queue-4.19/pwm-meson-consider-128-a-valid-pre-divider.patch
@@ -0,0 +1,54 @@
+From db9e441932be9c1174ab85fdf17d2d90933869cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 20:18:16 +0200
+Subject: pwm: meson: Consider 128 a valid pre-divider
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 51496e4446875726d50a5617a6e0e0dabbc2e6da ]
+
+The pre-divider allows configuring longer PWM periods compared to using
+the input clock directly. The pre-divider is 7 bit wide, meaning it's
+maximum value is 128 (the register value is off-by-one: 0x7f or 127).
+
+Change the loop to also allow for the maximum possible value to be
+considered valid.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-meson.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index f6e738ad7bd92..4b708c1fcb1d2 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -188,7 +188,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ 	do_div(fin_ps, fin_freq);
+ 
+ 	/* Calc pre_div with the period */
+-	for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
++	for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
+ 		cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
+ 					    fin_ps * (pre_div + 1));
+ 		dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
+@@ -197,7 +197,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ 			break;
+ 	}
+ 
+-	if (pre_div == MISC_CLK_DIV_MASK) {
++	if (pre_div > MISC_CLK_DIV_MASK) {
+ 		dev_err(meson->chip.dev, "unable to get period pre_div\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch b/queue-4.19/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
new file mode 100644
index 00000000000..eefaf277c6c
--- /dev/null
+++ b/queue-4.19/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
@@ -0,0 +1,43 @@
+From 9400c3622bea96ce155e6876f6e894098fd1f068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 20:18:17 +0200
+Subject: pwm: meson: Don't disable PWM when setting duty repeatedly
+
+From: Bichao Zheng <bichao.zheng@amlogic.com>
+
+[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ]
+
+There is an abnormally low about 20ms,when setting duty repeatedly.
+Because setting the duty will disable PWM and then enable. Delete
+this operation now.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
+[ Dropped code instead of hiding it behind a comment ]
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-meson.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 4b708c1fcb1d2..e247ab632530b 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -325,11 +325,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	if (state->period != channel->state.period ||
+ 	    state->duty_cycle != channel->state.duty_cycle ||
+ 	    state->polarity != channel->state.polarity) {
+-		if (channel->state.enabled) {
+-			meson_pwm_disable(meson, pwm->hwpwm);
+-			channel->state.enabled = false;
+-		}
+-
+ 		if (state->polarity != channel->state.polarity) {
+ 			if (state->polarity == PWM_POLARITY_NORMAL)
+ 				meson->inverter_mask |= BIT(pwm->hwpwm);
+-- 
+2.20.1
+
diff --git a/queue-4.19/qed-iwarp-fix-uninitialized-callback.patch b/queue-4.19/qed-iwarp-fix-uninitialized-callback.patch
new file mode 100644
index 00000000000..acbaf2e4586
--- /dev/null
+++ b/queue-4.19/qed-iwarp-fix-uninitialized-callback.patch
@@ -0,0 +1,35 @@
+From 6b05a6954dfc679c2eef24b71c16838cfe3fb058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 11:29:41 +0300
+Subject: qed: iWARP - fix uninitialized callback
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit 43cf40d93fadbb0d3edf0942a4612f8ff67478a1 ]
+
+Fix uninitialized variable warning by static checker.
+
+Fixes: ae3488ff37dc ("qed: Add ll2 connection for processing unaligned MPA packets")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index c77babd0ef952..39787bb885c86 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -2641,6 +2641,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+ 	cbs.rx_release_cb = qed_iwarp_ll2_rel_rx_pkt;
+ 	cbs.tx_comp_cb = qed_iwarp_ll2_comp_tx_pkt;
+ 	cbs.tx_release_cb = qed_iwarp_ll2_rel_tx_pkt;
++	cbs.slowpath_cb = NULL;
+ 	cbs.cookie = p_hwfn;
+ 
+ 	memset(&data, 0, sizeof(data));
+-- 
+2.20.1
+
diff --git a/queue-4.19/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch b/queue-4.19/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch
new file mode 100644
index 00000000000..7db86023a47
--- /dev/null
+++ b/queue-4.19/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch
@@ -0,0 +1,80 @@
+From 25c2887c27f9baf2828488fec754cc4b4c962ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 11:29:40 +0300
+Subject: qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit 6117561e1bb30b2fe7f51e1961f34dbedd0bec8a ]
+
+Destroy QP waits for it's ep object state to be set to CLOSED
+before proceeding. ep->state can be updated from a different
+context. Add smp_store_release/READ_ONCE to synchronize.
+
+Fixes: fc4c6065e661 ("qed: iWARP implement disconnect flows")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index 7002a660b6b4c..c77babd0ef952 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -532,7 +532,8 @@ int qed_iwarp_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
+ 
+ 	/* Make sure ep is closed before returning and freeing memory. */
+ 	if (ep) {
+-		while (ep->state != QED_IWARP_EP_CLOSED && wait_count++ < 200)
++		while (READ_ONCE(ep->state) != QED_IWARP_EP_CLOSED &&
++		       wait_count++ < 200)
+ 			msleep(100);
+ 
+ 		if (ep->state != QED_IWARP_EP_CLOSED)
+@@ -1023,8 +1024,6 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
+ 
+ 	params.ep_context = ep;
+ 
+-	ep->state = QED_IWARP_EP_CLOSED;
+-
+ 	switch (fw_return_code) {
+ 	case RDMA_RETURN_OK:
+ 		ep->qp->max_rd_atomic_req = ep->cm_info.ord;
+@@ -1084,6 +1083,10 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
+ 		break;
+ 	}
+ 
++	if (fw_return_code != RDMA_RETURN_OK)
++		/* paired with READ_ONCE in destroy_qp */
++		smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ 	ep->event_cb(ep->cb_context, &params);
+ 
+ 	/* on passive side, if there is no associated QP (REJECT) we need to
+@@ -2828,7 +2831,9 @@ static void qed_iwarp_qp_in_error(struct qed_hwfn *p_hwfn,
+ 	params.status = (fw_return_code == IWARP_QP_IN_ERROR_GOOD_CLOSE) ?
+ 			 0 : -ECONNRESET;
+ 
+-	ep->state = QED_IWARP_EP_CLOSED;
++	/* paired with READ_ONCE in destroy_qp */
++	smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ 	spin_lock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+ 	list_del(&ep->list_entry);
+ 	spin_unlock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+@@ -2917,7 +2922,8 @@ qed_iwarp_tcp_connect_unsuccessful(struct qed_hwfn *p_hwfn,
+ 	params.event = QED_IWARP_EVENT_ACTIVE_COMPLETE;
+ 	params.ep_context = ep;
+ 	params.cm_info = &ep->cm_info;
+-	ep->state = QED_IWARP_EP_CLOSED;
++	/* paired with READ_ONCE in destroy_qp */
++	smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
+ 
+ 	switch (fw_return_code) {
+ 	case IWARP_CONN_ERROR_TCP_CONNECT_INVALID_PACKET:
+-- 
+2.20.1
+
diff --git a/queue-4.19/qed-reduce-maximum-stack-frame-size.patch b/queue-4.19/qed-reduce-maximum-stack-frame-size.patch
new file mode 100644
index 00000000000..2336fa978e8
--- /dev/null
+++ b/queue-4.19/qed-reduce-maximum-stack-frame-size.patch
@@ -0,0 +1,103 @@
+From b46cd0741fb0059210b9f0126a913e1a178a1872 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 17:01:23 +0200
+Subject: qed: reduce maximum stack frame size
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7c116e02a4a7575c8c62bfd2106e3e3ec8fb99dc ]
+
+clang warns about an overly large stack frame in one function
+when it decides to inline all __qed_get_vport_*() functions into
+__qed_get_vport_stats():
+
+drivers/net/ethernet/qlogic/qed/qed_l2.c:1889:13: error: stack frame size of 1128 bytes in function '_qed_get_vport_stats' [-Werror,-Wframe-larger-than=]
+
+Use a noinline_for_stack annotation to prevent clang from inlining
+these, which keeps the maximum stack usage at around half of that
+in the worst case, similar to what we get with gcc.
+
+Fixes: 86622ee75312 ("qed: Move statistics to L2 code")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 34 +++++++++++-------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 64ac95ca4df21..d921b991dbdb5 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -1631,10 +1631,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn,
+ 	}
+ }
+ 
+-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++		       struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct eth_pstorm_per_queue_stat pstats;
+ 	u32 pstats_addr = 0, pstats_len = 0;
+@@ -1661,10 +1660,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+ 	    HILO_64_REGPAIR(pstats.error_drop_pkts);
+ }
+ 
+-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++		       struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct tstorm_per_port_stat tstats;
+ 	u32 tstats_addr, tstats_len;
+@@ -1709,10 +1707,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn,
+ 	}
+ }
+ 
+-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack
++void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++			    struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct eth_ustorm_per_queue_stat ustats;
+ 	u32 ustats_addr = 0, ustats_len = 0;
+@@ -1751,10 +1748,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn,
+ 	}
+ }
+ 
+-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+-				   struct qed_ptt *p_ptt,
+-				   struct qed_eth_stats *p_stats,
+-				   u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++		       struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ 	struct eth_mstorm_per_queue_stat mstats;
+ 	u32 mstats_addr = 0, mstats_len = 0;
+@@ -1780,9 +1776,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+ 	    HILO_64_REGPAIR(mstats.tpa_coalesced_bytes);
+ }
+ 
+-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn,
+-				       struct qed_ptt *p_ptt,
+-				       struct qed_eth_stats *p_stats)
++static noinline_for_stack void
++__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++			   struct qed_eth_stats *p_stats)
+ {
+ 	struct qed_eth_stats_common *p_common = &p_stats->common;
+ 	struct port_stats port_stats;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rbd-clear-xferred-on-error-from-rbd_obj_issue_copyup.patch b/queue-4.19/rbd-clear-xferred-on-error-from-rbd_obj_issue_copyup.patch
new file mode 100644
index 00000000000..b20600c7742
--- /dev/null
+++ b/queue-4.19/rbd-clear-xferred-on-error-from-rbd_obj_issue_copyup.patch
@@ -0,0 +1,33 @@
+From 05ffca7bcba3d19cfe6cc8171725e38e6d4cc37d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 12:06:24 +0100
+Subject: rbd: clear ->xferred on error from rbd_obj_issue_copyup()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+[ Upstream commit 356889c49d84f11f446ec235bd52ca1a7d581aa0 ]
+
+Otherwise the assert in rbd_obj_end_request() is triggered.
+
+Fixes: 3da691bf4366 ("rbd: new request handling code")
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rbd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 585378bc988cd..b942f4c8cea8c 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2506,6 +2506,7 @@ again:
+ 		ret = rbd_obj_issue_copyup(obj_req, obj_req->xferred);
+ 		if (ret) {
+ 			obj_req->result = ret;
++			obj_req->xferred = 0;
+ 			return true;
+ 		}
+ 		return false;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-bnxt_re-add-missing-spin-lock-initialization.patch b/queue-4.19/rdma-bnxt_re-add-missing-spin-lock-initialization.patch
new file mode 100644
index 00000000000..5383869854e
--- /dev/null
+++ b/queue-4.19/rdma-bnxt_re-add-missing-spin-lock-initialization.patch
@@ -0,0 +1,47 @@
+From 76111d4e42257f97320a45fdaf060cb86fd6d9a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 03:27:52 -0700
+Subject: RDMA/bnxt_re: Add missing spin lock initialization
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit 5a23e0b1dd51fe0efae666b03fdb15e1301f437a ]
+
+Add the missing initalization of the cq_lock and qplib.flush_lock.
+
+Fixes: 942c9b6ca8de ("RDMA/bnxt_re: Avoid Hard lockup during error CQE processing")
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index a69632f1fab0b..c9af2d139f5cb 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -2664,6 +2664,7 @@ struct ib_cq *bnxt_re_create_cq(struct ib_device *ibdev,
+ 	nq->budget++;
+ 
+ 	atomic_inc(&rdev->cq_count);
++	spin_lock_init(&cq->cq_lock);
+ 
+ 	if (context) {
+ 		struct bnxt_re_cq_resp resp;
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index c15335dc8f614..60f2fb7e7dbfe 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -1970,6 +1970,7 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
+ 	INIT_LIST_HEAD(&cq->sqf_head);
+ 	INIT_LIST_HEAD(&cq->rqf_head);
+ 	spin_lock_init(&cq->compl_lock);
++	spin_lock_init(&cq->flush_lock);
+ 
+ 	bnxt_qplib_arm_cq_enable(cq);
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-cma-fix-false-error-message.patch b/queue-4.19/rdma-cma-fix-false-error-message.patch
new file mode 100644
index 00000000000..5dda39d2068
--- /dev/null
+++ b/queue-4.19/rdma-cma-fix-false-error-message.patch
@@ -0,0 +1,44 @@
+From a97eb770ff1f65429b07ab4a4bcf236eec5405cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2019 11:27:31 +0200
+Subject: RDMA/cma: Fix false error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit a6e4d254c19b541a58caced322111084b27a7788 ]
+
+In addr_handler(), assuming status == 0 and the device already has been
+acquired (id_priv->cma_dev != NULL), we get the following incorrect
+"error" message:
+
+RDMA CM: ADDR_ERROR: failed to resolve IP. status 0
+
+Fixes: 498683c6a7ee ("IB/cma: Add debug messages to error flows")
+Link: https://lore.kernel.org/r/20190902092731.1055757-1-haakon.bugge@oracle.com
+Signed-off-by: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 319bfef00a4a8..e16872e0724ff 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2889,7 +2889,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,
+ 		if (status)
+ 			pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n",
+ 					     status);
+-	} else {
++	} else if (status) {
+ 		pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status);
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch b/queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch
new file mode 100644
index 00000000000..ccd67a30d3e
--- /dev/null
+++ b/queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch
@@ -0,0 +1,126 @@
+From 7f63876332dddd3c60f4bfc21151534e727bd1a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 17:41:03 +0800
+Subject: RDMA/hns: bugfix for slab-out-of-bounds when loading hip08 driver
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit bf8c02f961c89e5ccae5987b7ab28f5592a35101 ]
+
+kasan will report a BUG when run command 'insmod hns_roce_hw_v2.ko', the
+calltrace is as follows:
+
+==================================================================
+BUG: KASAN: slab-out-of-bounds in hns_roce_v2_init_eq_table+0x1324/0x1948
+[hns_roce_hw_v2]
+Read of size 8 at addr ffff8020e7a10608 by task insmod/256
+
+CPU: 0 PID: 256 Comm: insmod Tainted: G           O      5.2.0-rc4 #1
+Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0
+Call trace:
+dump_backtrace+0x0/0x1e8
+show_stack+0x14/0x20
+dump_stack+0xc4/0xfc
+print_address_description+0x60/0x270
+__kasan_report+0x164/0x1b8
+kasan_report+0xc/0x18
+__asan_load8+0x84/0xa8
+hns_roce_v2_init_eq_table+0x1324/0x1948 [hns_roce_hw_v2]
+hns_roce_init+0xf8/0xfe0 [hns_roce]
+__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
+hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
+hclge_init_roce_client_instance+0x180/0x310 [hclge]
+hclge_init_client_instance+0xcc/0x508 [hclge]
+hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
+hnae3_register_client+0x134/0x1a8 [hnae3]
+hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2]
+do_one_initcall+0x9c/0x3e0
+do_init_module+0xd4/0x2d8
+load_module+0x3284/0x3690
+__se_sys_init_module+0x274/0x308
+__arm64_sys_init_module+0x40/0x50
+el0_svc_handler+0xbc/0x210
+el0_svc+0x8/0xc
+
+Allocated by task 256:
+__kasan_kmalloc.isra.0+0xd0/0x180
+kasan_kmalloc+0xc/0x18
+__kmalloc+0x16c/0x328
+hns_roce_v2_init_eq_table+0x764/0x1948 [hns_roce_hw_v2]
+hns_roce_init+0xf8/0xfe0 [hns_roce]
+__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
+hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
+hclge_init_roce_client_instance+0x180/0x310 [hclge]
+hclge_init_client_instance+0xcc/0x508 [hclge]
+hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
+hnae3_register_client+0x134/0x1a8 [hnae3]
+hns_roce_hw_v2_init+0x14/0x10000 [hns_roce_hw_v2]
+do_one_initcall+0x9c/0x3e0
+do_init_module+0xd4/0x2d8
+load_module+0x3284/0x3690
+__se_sys_init_module+0x274/0x308
+__arm64_sys_init_module+0x40/0x50
+el0_svc_handler+0xbc/0x210
+el0_svc+0x8/0xc
+
+Freed by task 0:
+(stack is not available)
+
+The buggy address belongs to the object at ffff8020e7a10600
+which belongs to the cache kmalloc-128 of size 128
+The buggy address is located 8 bytes inside of
+128-byte region [ffff8020e7a10600, ffff8020e7a10680)
+The buggy address belongs to the page:
+page:ffff7fe00839e840 refcount:1 mapcount:0 mapping:ffff802340020200 index:0x0
+flags: 0x5fffe00000000200(slab)
+raw: 5fffe00000000200 dead000000000100 dead000000000200 ffff802340020200
+raw: 0000000000000000 0000000081000100 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ffff8020e7a10500: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
+ffff8020e7a10580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+>ffff8020e7a10600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+^
+ffff8020e7a10680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ffff8020e7a10700: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+==================================================================
+Disabling lock debugging due to kernel taint
+
+Fixes: a5073d6054f7 ("RDMA/hns: Add eq support of hip08")
+
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Link: https://lore.kernel.org/r/1565343666-73193-7-git-send-email-oulijun@huawei.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 7021444f18b46..417de7ac0d5e2 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4833,7 +4833,8 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
+ 				break;
+ 		}
+ 		eq->cur_eqe_ba = eq->buf_dma[0];
+-		eq->nxt_eqe_ba = eq->buf_dma[1];
++		if (ba_num > 1)
++			eq->nxt_eqe_ba = eq->buf_dma[1];
+ 
+ 	} else if (mhop_num == 2) {
+ 		/* alloc L1 BT and buf */
+@@ -4875,7 +4876,8 @@ static int hns_roce_mhop_alloc_eq(struct hns_roce_dev *hr_dev,
+ 				break;
+ 		}
+ 		eq->cur_eqe_ba = eq->buf_dma[0];
+-		eq->nxt_eqe_ba = eq->buf_dma[1];
++		if (ba_num > 1)
++			eq->nxt_eqe_ba = eq->buf_dma[1];
+ 	}
+ 
+ 	eq->l0_last_num = i + 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-unloadin.patch b/queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-unloadin.patch
new file mode 100644
index 00000000000..84145fdd782
--- /dev/null
+++ b/queue-4.19/rdma-hns-bugfix-for-slab-out-of-bounds-when-unloadin.patch
@@ -0,0 +1,159 @@
+From 9703efba1b2dbe508b37b045c5cecf4a1de3b859 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 17:41:02 +0800
+Subject: RDMA/hns: Bugfix for slab-out-of-bounds when unloading hip08 driver
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 9bba3f0cbfc8abf2e1549ea03c0128186081d7a8 ]
+
+kasan will report a BUG when run command 'rmmod hns_roce_hw_v2', the calltrace
+is as follows:
+
+==================================================================
+BUG: KASAN: slab-out-of-bounds in hns_roce_table_mhop_put+0x584/0x828
+[hns_roce]
+Read of size 8 at addr ffff802185e08300 by task rmmod/270
+
+Call trace:
+dump_backtrace+0x0/0x1e8
+show_stack+0x14/0x20
+dump_stack+0xc4/0xfc
+print_address_description+0x60/0x270
+__kasan_report+0x164/0x1b8
+kasan_report+0xc/0x18
+__asan_load8+0x84/0xa8
+hns_roce_table_mhop_put+0x584/0x828 [hns_roce]
+hns_roce_table_put+0x174/0x1a0 [hns_roce]
+hns_roce_mr_free+0x124/0x210 [hns_roce]
+hns_roce_dereg_mr+0x90/0xb8 [hns_roce]
+ib_dealloc_pd_user+0x60/0xf0
+ib_mad_port_close+0x128/0x1d8
+ib_mad_remove_device+0x94/0x118
+remove_client_context+0xa0/0xe0
+disable_device+0xfc/0x1c0
+__ib_unregister_device+0x60/0xe0
+ib_unregister_device+0x24/0x38
+hns_roce_exit+0x3c/0x138 [hns_roce]
+__hns_roce_hw_v2_uninit_instance.isra.30+0x28/0x50 [hns_roce_hw_v2]
+hns_roce_hw_v2_uninit_instance+0x44/0x60 [hns_roce_hw_v2]
+hclge_uninit_client_instance+0x15c/0x238 [hclge]
+hnae3_uninit_client_instance+0x84/0xa8 [hnae3]
+hnae3_unregister_client+0x84/0x158 [hnae3]
+hns_roce_hw_v2_exit+0x14/0x20 [hns_roce_hw_v2]
+__arm64_sys_delete_module+0x20c/0x308
+el0_svc_handler+0xbc/0x210
+el0_svc+0x8/0xc
+
+Allocated by task 255:
+__kasan_kmalloc.isra.0+0xd0/0x180
+kasan_kmalloc+0xc/0x18
+__kmalloc+0x16c/0x328
+hns_roce_init_hem_table+0x20c/0x428 [hns_roce]
+hns_roce_init+0x214/0xfe0 [hns_roce]
+__hns_roce_hw_v2_init_instance+0x284/0x330 [hns_roce_hw_v2]
+hns_roce_hw_v2_init_instance+0xd0/0x1b8 [hns_roce_hw_v2]
+hclge_init_roce_client_instance+0x180/0x310 [hclge]
+hclge_init_client_instance+0xcc/0x508 [hclge]
+hnae3_init_client_instance.part.3+0x3c/0x80 [hnae3]
+hnae3_register_client+0x134/0x1a8 [hnae3]
+0xffff200009c00014
+do_one_initcall+0x9c/0x3e0
+do_init_module+0xd4/0x2d8
+load_module+0x3284/0x3690
+__se_sys_init_module+0x274/0x308
+__arm64_sys_init_module+0x40/0x50
+el0_svc_handler+0xbc/0x210
+el0_svc+0x8/0xc
+
+Freed by task 0:
+(stack is not available)
+
+The buggy address belongs to the object at ffff802185e06300
+which belongs to the cache kmalloc-8k of size 8192
+The buggy address is located 0 bytes to the right of
+8192-byte region [ffff802185e06300, ffff802185e08300)
+The buggy address belongs to the page:
+page:ffff7fe008617800 refcount:1 mapcount:0 mapping:ffff802340020e00 index:0x0
+compound_mapcount: 0
+flags: 0x5fffe00000010200(slab|head)
+raw: 5fffe00000010200 dead000000000100 dead000000000200 ffff802340020e00
+raw: 0000000000000000 00000000803e003e 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ffff802185e08200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ffff802185e08280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>ffff802185e08300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+^
+ffff802185e08380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ffff802185e08400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+==================================================================
+Disabling lock debugging due to kernel taint
+
+Fixes: a25d13cbe816 ("RDMA/hns: Add the interfaces to support multi hop addressing for the contexts in hip08")
+
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Link: https://lore.kernel.org/r/1565343666-73193-6-git-send-email-oulijun@huawei.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index a73d388b70930..31b9b99f81cb7 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -54,12 +54,13 @@ bool hns_roce_check_whether_mhop(struct hns_roce_dev *hr_dev, u32 type)
+ EXPORT_SYMBOL_GPL(hns_roce_check_whether_mhop);
+ 
+ static bool hns_roce_check_hem_null(struct hns_roce_hem **hem, u64 start_idx,
+-			    u32 bt_chunk_num)
++			    u32 bt_chunk_num, u64 hem_max_num)
+ {
+-	int i;
++	u64 check_max_num = start_idx + bt_chunk_num;
++	u64 i;
+ 
+-	for (i = 0; i < bt_chunk_num; i++)
+-		if (hem[start_idx + i])
++	for (i = start_idx; (i < check_max_num) && (i < hem_max_num); i++)
++		if (hem[i])
+ 			return false;
+ 
+ 	return true;
+@@ -413,6 +414,12 @@ static int hns_roce_table_mhop_get(struct hns_roce_dev *hr_dev,
+ 		return -EINVAL;
+ 	}
+ 
++	if (unlikely(hem_idx >= table->num_hem)) {
++		dev_err(dev, "Table %d exceed hem limt idx = %llu,max = %lu!\n",
++			     table->type, hem_idx, table->num_hem);
++		return -EINVAL;
++	}
++
+ 	mutex_lock(&table->mutex);
+ 
+ 	if (table->hem[hem_idx]) {
+@@ -649,7 +656,7 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
+ 	if (check_whether_bt_num_2(table->type, hop_num)) {
+ 		start_idx = mhop.l0_idx * chunk_ba_num;
+ 		if (hns_roce_check_hem_null(table->hem, start_idx,
+-					    chunk_ba_num)) {
++					    chunk_ba_num, table->num_hem)) {
+ 			if (table->type < HEM_TYPE_MTT &&
+ 			    hr_dev->hw->clear_hem(hr_dev, table, obj, 0))
+ 				dev_warn(dev, "Clear HEM base address failed.\n");
+@@ -663,7 +670,7 @@ static void hns_roce_table_mhop_put(struct hns_roce_dev *hr_dev,
+ 		start_idx = mhop.l0_idx * chunk_ba_num * chunk_ba_num +
+ 			    mhop.l1_idx * chunk_ba_num;
+ 		if (hns_roce_check_hem_null(table->hem, start_idx,
+-					    chunk_ba_num)) {
++					    chunk_ba_num, table->num_hem)) {
+ 			if (hr_dev->hw->clear_hem(hr_dev, table, obj, 1))
+ 				dev_warn(dev, "Clear HEM base address failed.\n");
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch b/queue-4.19/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
new file mode 100644
index 00000000000..3de9c4bd050
--- /dev/null
+++ b/queue-4.19/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
@@ -0,0 +1,48 @@
+From 342e6a5bb284fc3e98cd0b58cf81ec6ed380c5f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 19:47:51 +0800
+Subject: RDMA/hns: Fixs hw access invalid dma memory error
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 ]
+
+When smmu is enable, if execute the perftest command and then use 'kill
+-9' to exit, follow this operation repeatedly, the kernel will have a high
+probability to print the following smmu event:
+
+  arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received:
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00007d0000000010
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x0000020900000080
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000
+  arm-smmu-v3 arm-smmu-v3.1.auto:  0x00000000f47cf000
+
+This is because the hw will periodically refresh the qpc cache until the
+next reset.
+
+This patch fixed it by removing the action that release qpc memory in the
+'hns_roce_qp_free' function.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index af24698ff2262..3012d7eb4ccb4 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -262,7 +262,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
+ 			hns_roce_table_put(hr_dev, &qp_table->trrl_table,
+ 					   hr_qp->qpn);
+ 		hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn);
+-		hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(hns_roce_qp_free);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch b/queue-4.19/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch
new file mode 100644
index 00000000000..d5c9632ccec
--- /dev/null
+++ b/queue-4.19/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch
@@ -0,0 +1,57 @@
+From 430398871703c049a75775c85f36b4f757bd09b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jan 2019 20:27:18 +0530
+Subject: RDMA/iw_cxgb4: Fix the unchecked ep dereference
+
+From: Raju Rangoju <rajur@chelsio.com>
+
+[ Upstream commit 3352976c892301fd576a2e9ff0ac7337b2e2ca48 ]
+
+The patch 944661dd97f4: "RDMA/iw_cxgb4: atomically lookup ep and get a
+reference" from May 6, 2016, leads to the following Smatch complaint:
+
+    drivers/infiniband/hw/cxgb4/cm.c:2953 terminate()
+    error: we previously assumed 'ep' could be null (see line 2945)
+
+Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Raju Rangoju <rajur@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 4dcc92d116097..1b3d014fa1d6e 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2947,15 +2947,18 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
+ 
+ 	ep = get_ep_from_tid(dev, tid);
+ 
+-	if (ep && ep->com.qp) {
+-		pr_warn("TERM received tid %u qpid %u\n",
+-			tid, ep->com.qp->wq.sq.qid);
+-		attrs.next_state = C4IW_QP_STATE_TERMINATE;
+-		c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+-			       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
++	if (ep) {
++		if (ep->com.qp) {
++			pr_warn("TERM received tid %u qpid %u\n", tid,
++				ep->com.qp->wq.sq.qid);
++			attrs.next_state = C4IW_QP_STATE_TERMINATE;
++			c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
++				       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
++		}
++
++		c4iw_put_ep(&ep->com);
+ 	} else
+ 		pr_warn("TERM received tid %u no ep/qp\n", tid);
+-	c4iw_put_ep(&ep->com);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-mlx5-fix-memory-leak-in-case-we-fail-to-add-an-.patch b/queue-4.19/rdma-mlx5-fix-memory-leak-in-case-we-fail-to-add-an-.patch
new file mode 100644
index 00000000000..ace918ac633
--- /dev/null
+++ b/queue-4.19/rdma-mlx5-fix-memory-leak-in-case-we-fail-to-add-an-.patch
@@ -0,0 +1,44 @@
+From d8a3e5d76ceb9da00fe853ece27095037e41c1d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 17:40:54 +0200
+Subject: RDMA/mlx5: Fix memory leak in case we fail to add an IB device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Bloch <markb@mellanox.com>
+
+[ Upstream commit fc9e4477f924e84d7798f7a1d41401d699de1219 ]
+
+Make sure the IB device is freed on failure.
+
+Fixes: b5ca15ad7e61 ("IB/mlx5: Add proper representors support")
+Signed-off-by: Mark Bloch <markb@mellanox.com>
+Reviewed-by: Bodong Wang <bodong@mellanox.com>
+Reviewed-by: HÃ¥kon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/ib_rep.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c
+index 35a0e04c38f28..b841589c27c9c 100644
+--- a/drivers/infiniband/hw/mlx5/ib_rep.c
++++ b/drivers/infiniband/hw/mlx5/ib_rep.c
+@@ -69,8 +69,10 @@ mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep)
+ 	ibdev->mdev = dev;
+ 	ibdev->num_ports = max(MLX5_CAP_GEN(dev, num_ports),
+ 			       MLX5_CAP_GEN(dev, num_vhca_ports));
+-	if (!__mlx5_ib_add(ibdev, &rep_profile))
++	if (!__mlx5_ib_add(ibdev, &rep_profile)) {
++		ib_dealloc_device(&ibdev->ib_dev);
+ 		return -EINVAL;
++	}
+ 
+ 	rep->rep_if[REP_IB].priv = ibdev;
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch b/queue-4.19/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
new file mode 100644
index 00000000000..70c29b908cc
--- /dev/null
+++ b/queue-4.19/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
@@ -0,0 +1,36 @@
+From 6cb9382636529eb4a8b2ac5ca99454d9435ecfc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:55 +0200
+Subject: RDMA/ocrdma: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index c158ca9fde6dc..08271fce0b9e4 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -55,7 +55,7 @@
+ 
+ int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+-	if (index > 1)
++	if (index > 0)
+ 		return -EINVAL;
+ 
+ 	*pkey = 0xffff;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-qedr-fix-incorrect-device-rate.patch b/queue-4.19/rdma-qedr-fix-incorrect-device-rate.patch
new file mode 100644
index 00000000000..cfdddec34ed
--- /dev/null
+++ b/queue-4.19/rdma-qedr-fix-incorrect-device-rate.patch
@@ -0,0 +1,95 @@
+From ca349c531524b01f2e4368fbda6fd49b6f9e8caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2019 12:33:20 +0300
+Subject: RDMA/qedr: Fix incorrect device rate.
+
+From: Sagiv Ozeri <sagiv.ozeri@marvell.com>
+
+[ Upstream commit 69054666df0a9b4e8331319f98b6b9a88bc3fcc4 ]
+
+Use the correct enum value introduced in commit 12113a35ada6 ("IB/core:
+Add HDR speed enum") Prior to this change a 50Gbps port would show 40Gbps.
+
+This patch also cleaned up the redundant redefiniton of ib speeds for
+qedr.
+
+Fixes: 12113a35ada6 ("IB/core: Add HDR speed enum")
+Signed-off-by: Sagiv Ozeri <sagiv.ozeri@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 8fd8b97348bfe..38fe2f7413757 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -158,54 +158,47 @@ int qedr_query_device(struct ib_device *ibdev,
+ 	return 0;
+ }
+ 
+-#define QEDR_SPEED_SDR		(1)
+-#define QEDR_SPEED_DDR		(2)
+-#define QEDR_SPEED_QDR		(4)
+-#define QEDR_SPEED_FDR10	(8)
+-#define QEDR_SPEED_FDR		(16)
+-#define QEDR_SPEED_EDR		(32)
+-
+ static inline void get_link_speed_and_width(int speed, u8 *ib_speed,
+ 					    u8 *ib_width)
+ {
+ 	switch (speed) {
+ 	case 1000:
+-		*ib_speed = QEDR_SPEED_SDR;
++		*ib_speed = IB_SPEED_SDR;
+ 		*ib_width = IB_WIDTH_1X;
+ 		break;
+ 	case 10000:
+-		*ib_speed = QEDR_SPEED_QDR;
++		*ib_speed = IB_SPEED_QDR;
+ 		*ib_width = IB_WIDTH_1X;
+ 		break;
+ 
+ 	case 20000:
+-		*ib_speed = QEDR_SPEED_DDR;
++		*ib_speed = IB_SPEED_DDR;
+ 		*ib_width = IB_WIDTH_4X;
+ 		break;
+ 
+ 	case 25000:
+-		*ib_speed = QEDR_SPEED_EDR;
++		*ib_speed = IB_SPEED_EDR;
+ 		*ib_width = IB_WIDTH_1X;
+ 		break;
+ 
+ 	case 40000:
+-		*ib_speed = QEDR_SPEED_QDR;
++		*ib_speed = IB_SPEED_QDR;
+ 		*ib_width = IB_WIDTH_4X;
+ 		break;
+ 
+ 	case 50000:
+-		*ib_speed = QEDR_SPEED_QDR;
+-		*ib_width = IB_WIDTH_4X;
++		*ib_speed = IB_SPEED_HDR;
++		*ib_width = IB_WIDTH_1X;
+ 		break;
+ 
+ 	case 100000:
+-		*ib_speed = QEDR_SPEED_EDR;
++		*ib_speed = IB_SPEED_EDR;
+ 		*ib_width = IB_WIDTH_4X;
+ 		break;
+ 
+ 	default:
+ 		/* Unsupported */
+-		*ib_speed = QEDR_SPEED_SDR;
++		*ib_speed = IB_SPEED_SDR;
+ 		*ib_width = IB_WIDTH_1X;
+ 	}
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch b/queue-4.19/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
new file mode 100644
index 00000000000..011a75d636a
--- /dev/null
+++ b/queue-4.19/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
@@ -0,0 +1,37 @@
+From 9d7f61dc3c48b2bf70b5a98c338c0a75a07099c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:56 +0200
+Subject: RDMA/qedr: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ]
+
+The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested
+for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN.
+
+Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 9167a1c40bcf5..8fd8b97348bfe 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -67,7 +67,7 @@ static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src,
+ 
+ int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+-	if (index > QEDR_ROCE_PKEY_TABLE_LEN)
++	if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
+ 		return -EINVAL;
+ 
+ 	*pkey = QEDR_ROCE_PKEY_DEFAULT;
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-rxe-consider-skb-reserve-space-based-on-netdev-.patch b/queue-4.19/rdma-rxe-consider-skb-reserve-space-based-on-netdev-.patch
new file mode 100644
index 00000000000..323402b9741
--- /dev/null
+++ b/queue-4.19/rdma-rxe-consider-skb-reserve-space-based-on-netdev-.patch
@@ -0,0 +1,39 @@
+From 6ca5c48707b384d6ee8dd32188c34464f8d22822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 10:48:01 +0300
+Subject: RDMA/rxe: Consider skb reserve space based on netdev of GID
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 3bf3e2b881c1412d0329ce9376dfe1518489b8fc ]
+
+Always consider the skb reserve space based on netdevice of the GID
+attribute, regardless of vlan or non vlan netdevice.
+
+Fixes: 43c9fc509fa5 ("rdma_rxe: make rxe work over 802.1q VLAN devices")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_net.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 8094cbaa54a9e..54add70c22b5c 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -533,8 +533,9 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
+ 	if (unlikely(!skb))
+ 		goto out;
+ 
+-	skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(rxe->ndev));
++	skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev));
+ 
++	/* FIXME: hold reference to this netdev until life of this skb. */
+ 	skb->dev	= ndev;
+ 	if (av->network_type == RDMA_NETWORK_IPV4)
+ 		skb->protocol = htons(ETH_P_IP);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rdma-uverbs-check-for-allocation-failure-in-uapi_add.patch b/queue-4.19/rdma-uverbs-check-for-allocation-failure-in-uapi_add.patch
new file mode 100644
index 00000000000..56929feb537
--- /dev/null
+++ b/queue-4.19/rdma-uverbs-check-for-allocation-failure-in-uapi_add.patch
@@ -0,0 +1,39 @@
+From 4e1aec35496c7c84f0b591b69f3ea27bfcea4c0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 May 2019 11:20:24 +0300
+Subject: RDMA/uverbs: check for allocation failure in uapi_add_elm()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit cac2a301c02a9b178842e22df34217da7854e588 ]
+
+If the kzalloc() fails then we should return ERR_PTR(-ENOMEM).  In the
+current code it's possible that the kzalloc() fails and the
+radix_tree_insert() inserts the NULL pointer successfully and we return
+the NULL "elm" pointer to the caller.  That results in a NULL pointer
+dereference.
+
+Fixes: 9ed3e5f44772 ("IB/uverbs: Build the specs into a radix tree at runtime")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_uapi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c
+index be854628a7c63..959a3418a192d 100644
+--- a/drivers/infiniband/core/uverbs_uapi.c
++++ b/drivers/infiniband/core/uverbs_uapi.c
+@@ -17,6 +17,8 @@ static void *uapi_add_elm(struct uverbs_api *uapi, u32 key, size_t alloc_size)
+ 		return ERR_PTR(-EOVERFLOW);
+ 
+ 	elm = kzalloc(alloc_size, GFP_KERNEL);
++	if (!elm)
++		return ERR_PTR(-ENOMEM);
+ 	rc = radix_tree_insert(&uapi->radix, key, elm);
+ 	if (rc) {
+ 		kfree(elm);
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-fixed-default-enable-high-on-dt-regulators.patch b/queue-4.19/regulator-fixed-default-enable-high-on-dt-regulators.patch
new file mode 100644
index 00000000000..a3ed5c5fe62
--- /dev/null
+++ b/queue-4.19/regulator-fixed-default-enable-high-on-dt-regulators.patch
@@ -0,0 +1,67 @@
+From fd6de905dc3a2ed5994c2d53e319678d88672019 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 22:43:46 +0200
+Subject: regulator: fixed: Default enable high on DT regulators
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ]
+
+commit efdfeb079cc3
+("regulator: fixed: Convert to use GPIO descriptor only")
+switched to use gpiod_get() to look up the regulator from the
+gpiolib core whether that is device tree or boardfile.
+
+This meant that we activate the code in
+a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags")
+which means the descriptors coming from the device tree already
+have the right inversion and open drain semantics set up from
+the gpiolib core.
+
+As the fixed regulator was inspected again we got the
+inverted inversion and things broke.
+
+Fix it by ignoring the config in the device tree for now: the
+later patches in the series will push all inversion handling
+over to the gpiolib core and set it up properly in the
+boardfiles for legacy devices, but I did not finish that
+for this kernel cycle.
+
+Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only")
+Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reported-by: Fabio Estevam <festevam@gmail.com>
+Reported-by: John Stultz <john.stultz@linaro.org>
+Reported-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/fixed.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
+index 988a7472c2ab5..d68ff65a5adc9 100644
+--- a/drivers/regulator/fixed.c
++++ b/drivers/regulator/fixed.c
+@@ -84,9 +84,14 @@ of_get_fixed_voltage_config(struct device *dev,
+ 
+ 	of_property_read_u32(np, "startup-delay-us", &config->startup_delay);
+ 
+-	config->enable_high = of_property_read_bool(np, "enable-active-high");
+-	config->gpio_is_open_drain = of_property_read_bool(np,
+-							   "gpio-open-drain");
++	/*
++	 * FIXME: we pulled active low/high and open drain handling into
++	 * gpiolib so it will be handled there. Delete this in the second
++	 * step when we also remove the custom inversion handling for all
++	 * legacy boardfiles.
++	 */
++	config->enable_high = 1;
++	config->gpio_is_open_drain = 0;
+ 
+ 	if (of_find_property(np, "vin-supply", NULL))
+ 		config->input_supply = "vin";
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-lp87565-fix-missing-register-for-lp87565_b.patch b/queue-4.19/regulator-lp87565-fix-missing-register-for-lp87565_b.patch
new file mode 100644
index 00000000000..d65bd905f84
--- /dev/null
+++ b/queue-4.19/regulator-lp87565-fix-missing-register-for-lp87565_b.patch
@@ -0,0 +1,36 @@
+From 95a7828ea0b8b2cd2da1a1d709f6e71e72e3f628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 14:16:40 +0800
+Subject: regulator: lp87565: Fix missing register for LP87565_BUCK_0
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit d1a6cbdf1e597917cb642c655512d91b71a35d22 ]
+
+LP87565_BUCK_0 is missed, fix it.
+
+Fixes: f0168a9bf ("regulator: lp87565: Add support for lp87565 PMIC regulators")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/lp87565-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c
+index c192357d1dea0..7cd6862406b70 100644
+--- a/drivers/regulator/lp87565-regulator.c
++++ b/drivers/regulator/lp87565-regulator.c
+@@ -193,7 +193,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
+ 	struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent);
+ 	struct regulator_config config = { };
+ 	struct regulator_dev *rdev;
+-	int i, min_idx = LP87565_BUCK_1, max_idx = LP87565_BUCK_3;
++	int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3;
+ 
+ 	platform_set_drvdata(pdev, lp87565);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-pv88060-fix-array-out-of-bounds-access.patch b/queue-4.19/regulator-pv88060-fix-array-out-of-bounds-access.patch
new file mode 100644
index 00000000000..c38ff8dc7a4
--- /dev/null
+++ b/queue-4.19/regulator-pv88060-fix-array-out-of-bounds-access.patch
@@ -0,0 +1,36 @@
+From dcd527142b6e4c0cea12de1bf5ca46896eabf9f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:00 +0800
+Subject: regulator: pv88060: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88060-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
+index a9446056435f9..1f2d8180506bc 100644
+--- a/drivers/regulator/pv88060-regulator.c
++++ b/drivers/regulator/pv88060-regulator.c
+@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
+ 	int i;
+ 
+ 	/* search for closest to maximum */
+-	for (i = info->n_current_limits; i >= 0; i--) {
++	for (i = info->n_current_limits - 1; i >= 0; i--) {
+ 		if (min <= info->current_limits[i]
+ 			&& max >= info->current_limits[i]) {
+ 			return regmap_update_bits(rdev->regmap,
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-pv88080-fix-array-out-of-bounds-access.patch b/queue-4.19/regulator-pv88080-fix-array-out-of-bounds-access.patch
new file mode 100644
index 00000000000..04ad8c8f4f0
--- /dev/null
+++ b/queue-4.19/regulator-pv88080-fix-array-out-of-bounds-access.patch
@@ -0,0 +1,36 @@
+From 56c0f098b8ad0fed774c74e7f499496e055e1c63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:01 +0800
+Subject: regulator: pv88080: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88080-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
+index 9a08cb2de501e..6770e4de20978 100644
+--- a/drivers/regulator/pv88080-regulator.c
++++ b/drivers/regulator/pv88080-regulator.c
+@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
+ 	int i;
+ 
+ 	/* search for closest to maximum */
+-	for (i = info->n_current_limits; i >= 0; i--) {
++	for (i = info->n_current_limits - 1; i >= 0; i--) {
+ 		if (min <= info->current_limits[i]
+ 			&& max >= info->current_limits[i]) {
+ 				return regmap_update_bits(rdev->regmap,
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-pv88090-fix-array-out-of-bounds-access.patch b/queue-4.19/regulator-pv88090-fix-array-out-of-bounds-access.patch
new file mode 100644
index 00000000000..a1a77348931
--- /dev/null
+++ b/queue-4.19/regulator-pv88090-fix-array-out-of-bounds-access.patch
@@ -0,0 +1,36 @@
+From ff235c8533876c4b11d844c0549d9936a3bca47f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:02 +0800
+Subject: regulator: pv88090: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88090-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
+index 7a0c15957bd0b..2302b0df7630f 100644
+--- a/drivers/regulator/pv88090-regulator.c
++++ b/drivers/regulator/pv88090-regulator.c
+@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
+ 	int i;
+ 
+ 	/* search for closest to maximum */
+-	for (i = info->n_current_limits; i >= 0; i--) {
++	for (i = info->n_current_limits - 1; i >= 0; i--) {
+ 		if (min <= info->current_limits[i]
+ 			&& max >= info->current_limits[i]) {
+ 			return regmap_update_bits(rdev->regmap,
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch b/queue-4.19/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
new file mode 100644
index 00000000000..b42e7db6061
--- /dev/null
+++ b/queue-4.19/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
@@ -0,0 +1,45 @@
+From 38769057d4a7359741074423d6cdb20922c320c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 16:57:52 +0800
+Subject: regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ]
+
+selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix.
+
+Table 5-4. LDOA1 Output Voltage Options
+VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT
+0000     1.35 0100     1.8  1000     2.3  1100     2.85
+0001     1.5  0101     1.9  1001     2.4  1101     3.0
+0010     1.6  0110     2.0  1010     2.5  1110     3.3
+0011     1.7  0111     2.1  1011     2.6  1111     Not Used
+
+Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65086-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
+index 45e96e1546900..5a5e9b5bf4bea 100644
+--- a/drivers/regulator/tps65086-regulator.c
++++ b/drivers/regulator/tps65086-regulator.c
+@@ -90,8 +90,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
+ static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
+ 	REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
+ 	REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
+-	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
+-	REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
++	REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
++	REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
+ 	REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch b/queue-4.19/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
new file mode 100644
index 00000000000..c905598f4ee
--- /dev/null
+++ b/queue-4.19/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
@@ -0,0 +1,40 @@
+From 7a5a52a40ebf3dd50c2a9b7aca127712751a828c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Feb 2019 21:16:51 +0800
+Subject: regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]
+
+The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
+with min_uA and max_uA.
+While at it also make the array const and change to use unsigned int.
+
+Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/wm831x-dcdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
+index 5a5bc4bb08d26..df591435d12a3 100644
+--- a/drivers/regulator/wm831x-dcdc.c
++++ b/drivers/regulator/wm831x-dcdc.c
+@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
+ }
+ 
+ /* Current limit options */
+-static u16 wm831x_dcdc_ilim[] = {
+-	125, 250, 375, 500, 625, 750, 875, 1000
++static const unsigned int wm831x_dcdc_ilim[] = {
++	125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
+ };
+ 
+ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
+-- 
+2.20.1
+
diff --git a/queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-clocks-for-msm8.patch b/queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-clocks-for-msm8.patch
new file mode 100644
index 00000000000..950b50e306b
--- /dev/null
+++ b/queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-clocks-for-msm8.patch
@@ -0,0 +1,47 @@
+From cdd3f07376783e81935e9a425cebc0736a25fad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Dec 2018 00:23:03 +0530
+Subject: remoteproc: qcom: q6v5-mss: Add missing clocks for MSM8996
+
+From: Sibi Sankar <sibis@codeaurora.org>
+
+[ Upstream commit 80ec419c3404106c563aaf56aa6b516a59c4cdfb ]
+
+Proxy vote for QDSS clock and remove vote on handover interrupt
+to provide MSS PBL with access to STM hardware registers during
+boot. Add "snoc_axi" and "mnoc_axi" to the active clock list.
+Rename "gpll0_mss_clk" to "gpll0_mss" for consistency across SoCs.
+
+Fixes: 9f058fa2efb1 ("remoteproc: qcom: Add support for mss remoteproc on msm8996")
+Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pil.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index 6a84b6372897d..073747ba80002 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -1271,13 +1271,16 @@ static const struct rproc_hexagon_res msm8996_mss = {
+ 	.proxy_clk_names = (char*[]){
+ 			"xo",
+ 			"pnoc",
++			"qdss",
+ 			NULL
+ 	},
+ 	.active_clk_names = (char*[]){
+ 			"iface",
+ 			"bus",
+ 			"mem",
+-			"gpll0_mss_clk",
++			"gpll0_mss",
++			"snoc_axi",
++			"mnoc_axi",
+ 			NULL
+ 	},
+ 	.need_mem_protection = true,
+-- 
+2.20.1
+
diff --git a/queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-regulator-for-m.patch b/queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-regulator-for-m.patch
new file mode 100644
index 00000000000..b585dbcc8f2
--- /dev/null
+++ b/queue-4.19/remoteproc-qcom-q6v5-mss-add-missing-regulator-for-m.patch
@@ -0,0 +1,40 @@
+From fa8cdfc2af55fdb5b3e7cc5248b4c47a5c269c02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Dec 2018 00:23:05 +0530
+Subject: remoteproc: qcom: q6v5-mss: Add missing regulator for MSM8996
+
+From: Sibi Sankar <sibis@codeaurora.org>
+
+[ Upstream commit 47b874748d500020026ee43b386b5598e20f3a68 ]
+
+Add proxy vote for pll supply on MSM8996 SoC.
+
+Fixes: 9f058fa2efb1 ("remoteproc: qcom: Add support for mss remoteproc on msm8996")
+Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pil.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index 073747ba80002..cc475dcbf27f3 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -1268,6 +1268,13 @@ static const struct rproc_hexagon_res sdm845_mss = {
+ 
+ static const struct rproc_hexagon_res msm8996_mss = {
+ 	.hexagon_mba_image = "mba.mbn",
++	.proxy_supply = (struct qcom_mss_reg_res[]) {
++		{
++			.supply = "pll",
++			.uA = 100000,
++		},
++		{}
++	},
+ 	.proxy_clk_names = (char*[]){
+ 			"xo",
+ 			"pnoc",
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-88pm80x-fix-unintended-sign-extension.patch b/queue-4.19/rtc-88pm80x-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..90912105cff
--- /dev/null
+++ b/queue-4.19/rtc-88pm80x-fix-unintended-sign-extension.patch
@@ -0,0 +1,93 @@
+From aaa653480aaa3a49feba072243f284d9f4382dcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:08:11 +0000
+Subject: rtc: 88pm80x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")
+
+Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
+index cab293cb2bf0b..1fc48ebd3cd05 100644
+--- a/drivers/rtc/rtc-88pm80x.c
++++ b/drivers/rtc/rtc-88pm80x.c
+@@ -114,12 +114,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	unsigned char buf[4];
+ 	unsigned long ticks, base, data;
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+ 
+ 	/* load 32-bit read-only counter */
+ 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -137,7 +139,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ 
+ 	/* load 32-bit read-only counter */
+ 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	base = ticks - data;
+ 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -158,11 +161,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	int ret;
+ 
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+ 
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -185,12 +190,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
+ 
+ 	regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+-	base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+ 
+ 	/* load 32-bit read-only counter */
+ 	regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-88pm860x-fix-unintended-sign-extension.patch b/queue-4.19/rtc-88pm860x-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..e64d670bff3
--- /dev/null
+++ b/queue-4.19/rtc-88pm860x-fix-unintended-sign-extension.patch
@@ -0,0 +1,90 @@
+From f945612c7bd06037bcce7963a9d448768cf164a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 09:50:53 +0000
+Subject: rtc: 88pm860x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")
+
+Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index fbcf13bbbd8d1..73697e4b18a9d 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++		(buf[5] << 8) | buf[7];
+ 
+ 	/* load 32-bit read-only counter */
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ 
+ 	/* load 32-bit read-only counter */
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	base = ticks - data;
+ 	dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++		(buf[5] << 8) | buf[7];
+ 
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ 	pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ 	dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ 		buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+-	base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++	base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++		(buf[5] << 8) | buf[7];
+ 
+ 	/* load 32-bit read-only counter */
+ 	pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+-	data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++		(buf[1] << 8) | buf[0];
+ 	ticks = base + data;
+ 	dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ 		base, data, ticks);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-cmos-ignore-bogus-century-byte.patch b/queue-4.19/rtc-cmos-ignore-bogus-century-byte.patch
new file mode 100644
index 00000000000..4a02cd08470
--- /dev/null
+++ b/queue-4.19/rtc-cmos-ignore-bogus-century-byte.patch
@@ -0,0 +1,45 @@
+From 6040ccea3f181e2f4b4f00bce9a8f80be8ebba98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jan 2019 08:21:03 +0000
+Subject: rtc: cmos: ignore bogus century byte
+
+From: Eric Wong <e@80x24.org>
+
+[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]
+
+Older versions of Libreboot and Coreboot had an invalid value
+(`3' in my case) in the century byte affecting the GM45 in
+the Thinkpad X200.  Not everybody's updated their firmwares,
+and Linux <= 4.2 was able to read the RTC without problems,
+so workaround this by ignoring invalid values.
+
+Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")
+
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
+Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
+Cc: linux-rtc@vger.kernel.org
+Signed-off-by: Eric Wong <e@80x24.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-mc146818-lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
+index 2f1772a358ca5..18a6f15e313d8 100644
+--- a/drivers/rtc/rtc-mc146818-lib.c
++++ b/drivers/rtc/rtc-mc146818-lib.c
+@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
+ 	time->tm_year += real_year - 72;
+ #endif
+ 
+-	if (century)
++	if (century > 20)
+ 		time->tm_year += (century - 19) * 100;
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-ds1307-rx8130-fix-alarm-handling.patch b/queue-4.19/rtc-ds1307-rx8130-fix-alarm-handling.patch
new file mode 100644
index 00000000000..e040d45af55
--- /dev/null
+++ b/queue-4.19/rtc-ds1307-rx8130-fix-alarm-handling.patch
@@ -0,0 +1,57 @@
+From b01537f9e1a2b89e194a0e19dbd1d1f267b0d784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 15:35:58 +0100
+Subject: rtc: ds1307: rx8130: Fix alarm handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 3f929cad943380370b6db31fcb7a38d898d91089 ]
+
+When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of
+week days, not a day of month. As Linux only handles a single alarm
+without repetition using day of month is more flexible, so clear this
+bit. (Otherwise a value depending on time.tm_wday would have to be
+written to register 0x19.)
+
+Also optimize setting the AIE bit to use a single register write instead
+of a bulk write of three registers.
+
+Fixes: ee0981be7704 ("rtc: ds1307: Add support for Epson RX8130CE")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1307.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index 71396b62dc52b..ebd59e86a567b 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -749,8 +749,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
+-	ctl[1] |= RX8130_REG_FLAG_AF;
++	ctl[0] &= RX8130_REG_EXTENSION_WADA;
++	ctl[1] &= ~RX8130_REG_FLAG_AF;
+ 	ctl[2] &= ~RX8130_REG_CONTROL0_AIE;
+ 
+ 	ret = regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
+@@ -773,8 +773,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ 
+ 	ctl[2] |= RX8130_REG_CONTROL0_AIE;
+ 
+-	return regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
+-				 sizeof(ctl));
++	return regmap_write(ds1307->regmap, RX8130_REG_CONTROL0, ctl[2]);
+ }
+ 
+ static int rx8130_alarm_irq_enable(struct device *dev, unsigned int enabled)
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-ds1672-fix-unintended-sign-extension.patch b/queue-4.19/rtc-ds1672-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..13e37c66d1a
--- /dev/null
+++ b/queue-4.19/rtc-ds1672-fix-unintended-sign-extension.patch
@@ -0,0 +1,43 @@
+From ef44f014699a058c2f3c88775934ddcd833c7a8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 18:04:49 +0000
+Subject: rtc: ds1672: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#138801 ("Unintended sign extension")
+
+Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1672.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
+index 9caaccccaa575..b1ebca099b0df 100644
+--- a/drivers/rtc/rtc-ds1672.c
++++ b/drivers/rtc/rtc-ds1672.c
+@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ 		"%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
+ 		__func__, buf[0], buf[1], buf[2], buf[3]);
+ 
+-	time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++	time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++	       (buf[1] << 8) | buf[0];
+ 
+ 	rtc_time_to_tm(time, tm);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-fix-timestamp-value-for-rtc_timestamp_begin_1900.patch b/queue-4.19/rtc-fix-timestamp-value-for-rtc_timestamp_begin_1900.patch
new file mode 100644
index 00000000000..7ee14c2f6b0
--- /dev/null
+++ b/queue-4.19/rtc-fix-timestamp-value-for-rtc_timestamp_begin_1900.patch
@@ -0,0 +1,35 @@
+From 1deb9113724125b0eecff7581ffe16d5a7496036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 08:26:12 +0100
+Subject: rtc: Fix timestamp value for RTC_TIMESTAMP_BEGIN_1900
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit d3062d1d7415cb5a37777220357aca51a491c3d7 ]
+
+Printing "mktime64(1900, 1, 1, 0, 0, 0)" gives -2208988800.
+
+Fixes: 83bbc5ac63326433 ("rtc: Add useful timestamp definitions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rtc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/rtc.h b/include/linux/rtc.h
+index 6aedc30003e73..5a34f59941fb7 100644
+--- a/include/linux/rtc.h
++++ b/include/linux/rtc.h
+@@ -163,7 +163,7 @@ struct rtc_device {
+ #define to_rtc_device(d) container_of(d, struct rtc_device, dev)
+ 
+ /* useful timestamps */
+-#define RTC_TIMESTAMP_BEGIN_1900	-2208989361LL /* 1900-01-01 00:00:00 */
++#define RTC_TIMESTAMP_BEGIN_1900	-2208988800LL /* 1900-01-01 00:00:00 */
+ #define RTC_TIMESTAMP_BEGIN_2000	946684800LL /* 2000-01-01 00:00:00 */
+ #define RTC_TIMESTAMP_END_2099		4102444799LL /* 2099-12-31 23:59:59 */
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-mt6397-don-t-call-irq_dispose_mapping.patch b/queue-4.19/rtc-mt6397-don-t-call-irq_dispose_mapping.patch
new file mode 100644
index 00000000000..aad56003553
--- /dev/null
+++ b/queue-4.19/rtc-mt6397-don-t-call-irq_dispose_mapping.patch
@@ -0,0 +1,61 @@
+From c0e1f351e8f32d949fe0b2e17c7281b2535c3f04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2019 15:55:40 +0800
+Subject: rtc: mt6397: Don't call irq_dispose_mapping.
+
+From: Pi-Hsun Shih <pihsun@chromium.org>
+
+[ Upstream commit 24db953e942bd7a983e97892bdaddf69d00b1199 ]
+
+The IRQ mapping was changed to not being created in the rtc-mt6397
+driver, so the irq_dispose_mapping is no longer needed.
+Also the dev_id passed to free_irq should be the same as the last
+argument passed to request_threaded_irq.
+This prevents a "Trying to free already-free IRQ 274" warning when
+unbinding the driver.
+
+Fixes: e695d3a0b3b3 ("mfd: mt6397: Create irq mappings in mfd core driver")
+Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-mt6397.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index f85f1fc29e32e..964ed91416e1b 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -362,7 +362,7 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Failed to request alarm IRQ: %d: %d\n",
+ 			rtc->irq, ret);
+-		goto out_dispose_irq;
++		return ret;
+ 	}
+ 
+ 	device_init_wakeup(&pdev->dev, 1);
+@@ -378,9 +378,7 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ out_free_irq:
+-	free_irq(rtc->irq, rtc->rtc_dev);
+-out_dispose_irq:
+-	irq_dispose_mapping(rtc->irq);
++	free_irq(rtc->irq, rtc);
+ 	return ret;
+ }
+ 
+@@ -388,8 +386,7 @@ static int mtk_rtc_remove(struct platform_device *pdev)
+ {
+ 	struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
+ 
+-	free_irq(rtc->irq, rtc->rtc_dev);
+-	irq_dispose_mapping(rtc->irq);
++	free_irq(rtc->irq, rtc);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch b/queue-4.19/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch
new file mode 100644
index 00000000000..9395fe48e68
--- /dev/null
+++ b/queue-4.19/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch
@@ -0,0 +1,91 @@
+From 56a77c8a225e530672fc11110a000999882aa756 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 15:19:34 +0200
+Subject: rtc: pcf2127: bugfix: read rtc disables watchdog
+
+From: Bruno Thomsen <bruno.thomsen@gmail.com>
+
+[ Upstream commit 7f43020e3bdb63d65661ed377682702f8b34d3ea ]
+
+The previous fix listed bulk read of registers as root cause of
+accendential disabling of watchdog, since the watchdog counter
+register (WD_VAL) was zeroed.
+
+Fixes: 3769a375ab83 rtc: pcf2127: bulk read only date and time registers.
+
+Tested with the same PCF2127 chip as Sean reveled root cause
+of WD_VAL register value zeroing was caused by reading CTRL2
+register which is one of the watchdog feature control registers.
+
+So the solution is to not read the first two control registers
+(CTRL1 and CTRL2) in pcf2127_rtc_read_time as they are not
+needed anyway. Size of local buf variable is kept to allow
+easy usage of register defines to improve readability of code.
+
+Debug trace line was updated after CTRL1 and CTRL2 are no longer
+read from the chip. Also replaced magic numbers in buf access
+with register defines.
+
+Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20190822131936.18772-3-bruno.thomsen@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 32 ++++++++++++--------------------
+ 1 file changed, 12 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 7cb786d76e3c1..8c62406f92dd1 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -57,20 +57,14 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	struct pcf2127 *pcf2127 = dev_get_drvdata(dev);
+ 	unsigned char buf[10];
+ 	int ret;
+-	int i;
+ 
+-	for (i = 0; i <= PCF2127_REG_CTRL3; i++) {
+-		ret = regmap_read(pcf2127->regmap, PCF2127_REG_CTRL1 + i,
+-				  (unsigned int *)(buf + i));
+-		if (ret) {
+-			dev_err(dev, "%s: read error\n", __func__);
+-			return ret;
+-		}
+-	}
+-
+-	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_SC,
+-			       (buf + PCF2127_REG_SC),
+-			       ARRAY_SIZE(buf) - PCF2127_REG_SC);
++	/*
++	 * Avoid reading CTRL2 register as it causes WD_VAL register
++	 * value to reset to 0 which means watchdog is stopped.
++	 */
++	ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_CTRL3,
++			       (buf + PCF2127_REG_CTRL3),
++			       ARRAY_SIZE(buf) - PCF2127_REG_CTRL3);
+ 	if (ret) {
+ 		dev_err(dev, "%s: read error\n", __func__);
+ 		return ret;
+@@ -91,14 +85,12 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 	}
+ 
+ 	dev_dbg(dev,
+-		"%s: raw data is cr1=%02x, cr2=%02x, cr3=%02x, "
+-		"sec=%02x, min=%02x, hr=%02x, "
++		"%s: raw data is cr3=%02x, sec=%02x, min=%02x, hr=%02x, "
+ 		"mday=%02x, wday=%02x, mon=%02x, year=%02x\n",
+-		__func__,
+-		buf[0], buf[1], buf[2],
+-		buf[3], buf[4], buf[5],
+-		buf[6], buf[7], buf[8], buf[9]);
+-
++		__func__, buf[PCF2127_REG_CTRL3], buf[PCF2127_REG_SC],
++		buf[PCF2127_REG_MN], buf[PCF2127_REG_HR],
++		buf[PCF2127_REG_DM], buf[PCF2127_REG_DW],
++		buf[PCF2127_REG_MO], buf[PCF2127_REG_YR]);
+ 
+ 	tm->tm_sec = bcd2bin(buf[PCF2127_REG_SC] & 0x7F);
+ 	tm->tm_min = bcd2bin(buf[PCF2127_REG_MN] & 0x7F);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch b/queue-4.19/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
new file mode 100644
index 00000000000..29f0c9708fb
--- /dev/null
+++ b/queue-4.19/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
@@ -0,0 +1,61 @@
+From b9772d5c5b8a6e3c87ac28d78e0c20ef6240a246 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:36 +0800
+Subject: rtc: pcf8563: Clear event flags and disable interrupts before
+ requesting irq
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ]
+
+Besides the alarm, the PCF8563 also has a timer triggered interrupt.
+In cases where the previous system left the timer and interrupts on,
+or somehow the bits got enabled, the interrupt would keep triggering
+as the kernel doesn't know about it.
+
+Clear both the alarm and timer event flags, and disable the interrupts,
+before requesting the interrupt line.
+
+Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
+Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf8563.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index e358313466f19..d8adf69b66978 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client,
+ 	struct pcf8563 *pcf8563;
+ 	int err;
+ 	unsigned char buf;
+-	unsigned char alm_pending;
+ 
+ 	dev_dbg(&client->dev, "%s\n", __func__);
+ 
+@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client,
+ 		return err;
+ 	}
+ 
+-	err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
+-	if (err) {
+-		dev_err(&client->dev, "%s: read error\n", __func__);
++	/* Clear flags and disable interrupts */
++	buf = 0;
++	err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
++	if (err < 0) {
++		dev_err(&client->dev, "%s: write error\n", __func__);
+ 		return err;
+ 	}
+-	if (alm_pending)
+-		pcf8563_set_alarm_mode(client, 0);
+ 
+ 	pcf8563->rtc = devm_rtc_device_register(&client->dev,
+ 				pcf8563_driver.driver.name,
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-pcf8563-fix-interrupt-trigger-method.patch b/queue-4.19/rtc-pcf8563-fix-interrupt-trigger-method.patch
new file mode 100644
index 00000000000..f7fd30ffd6c
--- /dev/null
+++ b/queue-4.19/rtc-pcf8563-fix-interrupt-trigger-method.patch
@@ -0,0 +1,38 @@
+From 6592a2945ec1f1f22fd312634da67f38272d6cbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:35 +0800
+Subject: rtc: pcf8563: Fix interrupt trigger method
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 65f662cbf829834fa4d94190eb7691e5a9cb92d8 ]
+
+The PCF8563 datasheet says the interrupt line is active low and stays
+active until the events are cleared, i.e. a level trigger interrupt.
+
+Fix the flags used to request the interrupt.
+
+Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf8563.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index 3efc86c25d27a..e358313466f19 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -605,7 +605,7 @@ static int pcf8563_probe(struct i2c_client *client,
+ 	if (client->irq > 0) {
+ 		err = devm_request_threaded_irq(&client->dev, client->irq,
+ 				NULL, pcf8563_irq,
+-				IRQF_SHARED|IRQF_ONESHOT|IRQF_TRIGGER_FALLING,
++				IRQF_SHARED | IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+ 				pcf8563_driver.driver.name, client);
+ 		if (err) {
+ 			dev_err(&client->dev, "unable to request IRQ %d\n",
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-pm8xxx-fix-unintended-sign-extension.patch b/queue-4.19/rtc-pm8xxx-fix-unintended-sign-extension.patch
new file mode 100644
index 00000000000..4bb328d083a
--- /dev/null
+++ b/queue-4.19/rtc-pm8xxx-fix-unintended-sign-extension.patch
@@ -0,0 +1,53 @@
+From b6ba4205fe39ee3942d68799c2947d72d9497ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:31:02 +0000
+Subject: rtc: pm8xxx: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#1309693 ("Unintended sign extension")
+
+Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pm8xxx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index 29358a0459258..e03104b734fc9 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -213,7 +213,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ 		}
+ 	}
+ 
+-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++	       ((unsigned long)value[3] << 24);
+ 
+ 	rtc_time_to_tm(secs, tm);
+ 
+@@ -288,7 +289,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ 		return rc;
+ 	}
+ 
+-	secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++	secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++	       ((unsigned long)value[3] << 24);
+ 
+ 	rtc_time_to_tm(secs, &alarm->time);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtc-rv3029-revert-error-handling-patch-to-rv3029_eep.patch b/queue-4.19/rtc-rv3029-revert-error-handling-patch-to-rv3029_eep.patch
new file mode 100644
index 00000000000..9918b22bf33
--- /dev/null
+++ b/queue-4.19/rtc-rv3029-revert-error-handling-patch-to-rv3029_eep.patch
@@ -0,0 +1,66 @@
+From 67b120a6237eb42f13ade68f80808081d01d2870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Aug 2019 09:56:04 +0300
+Subject: rtc: rv3029: revert error handling patch to rv3029_eeprom_write()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a6f26606ddd03c5eab8b2132f1bfaa768c06158f ]
+
+My error handling "cleanup" was totally wrong.  Both the "err" and "ret"
+variables are required.  The "err" variable holds the error codes for
+rv3029_eeprom_enter/exit() and the "ret" variable holds the error codes
+for if actual write fails.  In my patch if the write failed, the
+function probably still returned success.
+
+Reported-by: Tom Evans <tom.evans@motec.com.au>
+Fixes: 97f5b0379c38 ("rtc: rv3029: Clean up error handling in rv3029_eeprom_write()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20190817065604.GB29951@mwanda
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-rv3029c2.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/rtc/rtc-rv3029c2.c b/drivers/rtc/rtc-rv3029c2.c
+index 3d6174eb32f6a..cfe3aece51d17 100644
+--- a/drivers/rtc/rtc-rv3029c2.c
++++ b/drivers/rtc/rtc-rv3029c2.c
+@@ -282,13 +282,13 @@ static int rv3029_eeprom_read(struct device *dev, u8 reg,
+ static int rv3029_eeprom_write(struct device *dev, u8 reg,
+ 			       u8 const buf[], size_t len)
+ {
+-	int ret;
++	int ret, err;
+ 	size_t i;
+ 	u8 tmp;
+ 
+-	ret = rv3029_eeprom_enter(dev);
+-	if (ret < 0)
+-		return ret;
++	err = rv3029_eeprom_enter(dev);
++	if (err < 0)
++		return err;
+ 
+ 	for (i = 0; i < len; i++, reg++) {
+ 		ret = rv3029_read_regs(dev, reg, &tmp, 1);
+@@ -304,11 +304,11 @@ static int rv3029_eeprom_write(struct device *dev, u8 reg,
+ 			break;
+ 	}
+ 
+-	ret = rv3029_eeprom_exit(dev);
+-	if (ret < 0)
+-		return ret;
++	err = rv3029_eeprom_exit(dev);
++	if (err < 0)
++		return err;
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static int rv3029_eeprom_update_bits(struct device *dev,
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtlwifi-fix-file-release-memory-leak.patch b/queue-4.19/rtlwifi-fix-file-release-memory-leak.patch
new file mode 100644
index 00000000000..00390396994
--- /dev/null
+++ b/queue-4.19/rtlwifi-fix-file-release-memory-leak.patch
@@ -0,0 +1,38 @@
+From d77b1cdfe00a9d8058138671545991e06db65550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 14:16:11 +0000
+Subject: rtlwifi: Fix file release memory leak
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 4c3e48794dec7cb568974ba3bf2ab62b9c45ca3e ]
+
+When using single_open() for opening, single_release() should be
+used instead of seq_release(), otherwise there is a memory leak.
+
+This is detected by Coccinelle semantic patch.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index d70385be99762..498994041bbcb 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -109,7 +109,7 @@ static const struct file_operations file_ops_common = {
+ 	.open = dl_debug_open_common,
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+-	.release = seq_release,
++	.release = single_release,
+ };
+ 
+ static int rtl_debug_get_mac_page(struct seq_file *m, void *v)
+-- 
+2.20.1
+
diff --git a/queue-4.19/rtlwifi-rtl8821ae-replace-_rtl8821ae_mrate_idx_to_ar.patch b/queue-4.19/rtlwifi-rtl8821ae-replace-_rtl8821ae_mrate_idx_to_ar.patch
new file mode 100644
index 00000000000..8d879c77504
--- /dev/null
+++ b/queue-4.19/rtlwifi-rtl8821ae-replace-_rtl8821ae_mrate_idx_to_ar.patch
@@ -0,0 +1,121 @@
+From 53623082898b52260395478200c57b922993f384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 09:50:28 +0100
+Subject: rtlwifi: rtl8821ae: replace _rtl8821ae_mrate_idx_to_arfr_id with
+ generic version
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c894696188d5c2af1e636e458190e80c53fb893d ]
+
+Function _rtl8821ae_mrate_idx_to_arfr_id is functionally identical to
+the generic version rtl_mrate_idx_to_arfr_id, so remove
+_rtl8821ae_mrate_idx_to_arfr_id and use the generic one instead.
+
+This also fixes a missing break statement found by CoverityScan in
+_rtl8821ae_mrate_idx_to_arfr_id, namely: CID#1167237 ("Missing break
+in switch")
+
+Thanks to Joe Perches for spotting this when I submitted an earlier patch.
+
+Fixes: 3c05bedb5fef ("Staging: rtl8812ae: Add Realtek 8821 PCI WIFI driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/realtek/rtlwifi/rtl8821ae/hw.c   | 71 +------------------
+ 1 file changed, 1 insertion(+), 70 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+index 317c1b3101dad..ba258318ee9f3 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+@@ -3404,75 +3404,6 @@ static void rtl8821ae_update_hal_rate_table(struct ieee80211_hw *hw,
+ 		 "%x\n", rtl_read_dword(rtlpriv, REG_ARFR0));
+ }
+ 
+-static u8 _rtl8821ae_mrate_idx_to_arfr_id(
+-	struct ieee80211_hw *hw, u8 rate_index,
+-	enum wireless_mode wirelessmode)
+-{
+-	struct rtl_priv *rtlpriv = rtl_priv(hw);
+-	struct rtl_phy *rtlphy = &rtlpriv->phy;
+-	u8 ret = 0;
+-	switch (rate_index) {
+-	case RATR_INX_WIRELESS_NGB:
+-		if (rtlphy->rf_type == RF_1T1R)
+-			ret = 1;
+-		else
+-			ret = 0;
+-		; break;
+-	case RATR_INX_WIRELESS_N:
+-	case RATR_INX_WIRELESS_NG:
+-		if (rtlphy->rf_type == RF_1T1R)
+-			ret = 5;
+-		else
+-			ret = 4;
+-		; break;
+-	case RATR_INX_WIRELESS_NB:
+-		if (rtlphy->rf_type == RF_1T1R)
+-			ret = 3;
+-		else
+-			ret = 2;
+-		; break;
+-	case RATR_INX_WIRELESS_GB:
+-		ret = 6;
+-		break;
+-	case RATR_INX_WIRELESS_G:
+-		ret = 7;
+-		break;
+-	case RATR_INX_WIRELESS_B:
+-		ret = 8;
+-		break;
+-	case RATR_INX_WIRELESS_MC:
+-		if ((wirelessmode == WIRELESS_MODE_B)
+-			|| (wirelessmode == WIRELESS_MODE_G)
+-			|| (wirelessmode == WIRELESS_MODE_N_24G)
+-			|| (wirelessmode == WIRELESS_MODE_AC_24G))
+-			ret = 6;
+-		else
+-			ret = 7;
+-	case RATR_INX_WIRELESS_AC_5N:
+-		if (rtlphy->rf_type == RF_1T1R)
+-			ret = 10;
+-		else
+-			ret = 9;
+-		break;
+-	case RATR_INX_WIRELESS_AC_24N:
+-		if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_80) {
+-			if (rtlphy->rf_type == RF_1T1R)
+-				ret = 10;
+-			else
+-				ret = 9;
+-		} else {
+-			if (rtlphy->rf_type == RF_1T1R)
+-				ret = 11;
+-			else
+-				ret = 12;
+-		}
+-		break;
+-	default:
+-		ret = 0; break;
+-	}
+-	return ret;
+-}
+-
+ static u32 _rtl8821ae_rate_to_bitmap_2ssvht(__le16 vht_rate)
+ {
+ 	u8 i, j, tmp_rate;
+@@ -3761,7 +3692,7 @@ static void rtl8821ae_update_hal_rate_mask(struct ieee80211_hw *hw,
+ 		break;
+ 	}
+ 
+-	ratr_index = _rtl8821ae_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
++	ratr_index = rtl_mrate_idx_to_arfr_id(hw, ratr_index, wirelessmode);
+ 	sta_entry->ratr_index = ratr_index;
+ 	ratr_bitmap = _rtl8821ae_set_ra_vht_ratr_bitmap(hw, wirelessmode,
+ 							ratr_bitmap);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rxrpc-fix-detection-of-out-of-order-acks.patch b/queue-4.19/rxrpc-fix-detection-of-out-of-order-acks.patch
new file mode 100644
index 00000000000..687e9e7e4db
--- /dev/null
+++ b/queue-4.19/rxrpc-fix-detection-of-out-of-order-acks.patch
@@ -0,0 +1,114 @@
+From 99e82ebef5b3c356b1aa8fc8e0d9346de98f8fb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2019 16:34:16 +0100
+Subject: rxrpc: Fix detection of out of order acks
+
+From: Jeffrey Altman <jaltman@auristor.com>
+
+[ Upstream commit 1a2391c30c0b9d041bc340f68df81d49c53546cc ]
+
+The rxrpc packet serial number cannot be safely used to compute out of
+order ack packets for several reasons:
+
+ 1. The allocation of serial numbers cannot be assumed to imply the order
+    by which acks are populated and transmitted.  In some rxrpc
+    implementations, delayed acks and ping acks are transmitted
+    asynchronously to the receipt of data packets and so may be transmitted
+    out of order.  As a result, they can race with idle acks.
+
+ 2. Serial numbers are allocated by the rxrpc connection and not the call
+    and as such may wrap independently if multiple channels are in use.
+
+In any case, what matters is whether the ack packet provides new
+information relating to the bounds of the window (the firstPacket and
+previousPacket in the ACK data).
+
+Fix this by discarding packets that appear to wind back the window bounds
+rather than on serial number procession.
+
+Fixes: 298bc15b2079 ("rxrpc: Only take the rwind and mtu values from latest ACK")
+Signed-off-by: Jeffrey Altman <jaltman@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/ar-internal.h |  1 +
+ net/rxrpc/input.c       | 18 ++++++++++++------
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index dfd9eab77cc8a..37e4c1801a41f 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -644,6 +644,7 @@ struct rxrpc_call {
+ 	u8			ackr_reason;	/* reason to ACK */
+ 	u16			ackr_skew;	/* skew on packet being ACK'd */
+ 	rxrpc_serial_t		ackr_serial;	/* serial of packet being ACK'd */
++	rxrpc_serial_t		ackr_first_seq;	/* first sequence number received */
+ 	rxrpc_seq_t		ackr_prev_seq;	/* previous sequence number received */
+ 	rxrpc_seq_t		ackr_consumed;	/* Highest packet shown consumed */
+ 	rxrpc_seq_t		ackr_seen;	/* Highest packet shown seen */
+diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
+index 7965600ee5dec..2f91ab909191b 100644
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -837,7 +837,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ 		u8 acks[RXRPC_MAXACKS];
+ 	} buf;
+ 	rxrpc_serial_t acked_serial;
+-	rxrpc_seq_t first_soft_ack, hard_ack;
++	rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
+ 	int nr_acks, offset, ioffset;
+ 
+ 	_enter("");
+@@ -851,13 +851,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ 
+ 	acked_serial = ntohl(buf.ack.serial);
+ 	first_soft_ack = ntohl(buf.ack.firstPacket);
++	prev_pkt = ntohl(buf.ack.previousPacket);
+ 	hard_ack = first_soft_ack - 1;
+ 	nr_acks = buf.ack.nAcks;
+ 	summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
+ 			      buf.ack.reason : RXRPC_ACK__INVALID);
+ 
+ 	trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
+-			   first_soft_ack, ntohl(buf.ack.previousPacket),
++			   first_soft_ack, prev_pkt,
+ 			   summary.ack_reason, nr_acks);
+ 
+ 	if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
+@@ -878,8 +879,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ 				  rxrpc_propose_ack_respond_to_ack);
+ 	}
+ 
+-	/* Discard any out-of-order or duplicate ACKs. */
+-	if (before_eq(sp->hdr.serial, call->acks_latest))
++	/* Discard any out-of-order or duplicate ACKs (outside lock). */
++	if (before(first_soft_ack, call->ackr_first_seq) ||
++	    before(prev_pkt, call->ackr_prev_seq))
+ 		return;
+ 
+ 	buf.info.rxMTU = 0;
+@@ -890,12 +892,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+ 
+ 	spin_lock(&call->input_lock);
+ 
+-	/* Discard any out-of-order or duplicate ACKs. */
+-	if (before_eq(sp->hdr.serial, call->acks_latest))
++	/* Discard any out-of-order or duplicate ACKs (inside lock). */
++	if (before(first_soft_ack, call->ackr_first_seq) ||
++	    before(prev_pkt, call->ackr_prev_seq))
+ 		goto out;
+ 	call->acks_latest_ts = skb->tstamp;
+ 	call->acks_latest = sp->hdr.serial;
+ 
++	call->ackr_first_seq = first_soft_ack;
++	call->ackr_prev_seq = prev_pkt;
++
+ 	/* Parse rwind and mtu sizes if provided. */
+ 	if (buf.info.rxMTU)
+ 		rxrpc_input_ackinfo(call, skb, &buf.info);
+-- 
+2.20.1
+
diff --git a/queue-4.19/rxrpc-fix-lack-of-conn-cleanup-when-local-endpoint-i.patch b/queue-4.19/rxrpc-fix-lack-of-conn-cleanup-when-local-endpoint-i.patch
new file mode 100644
index 00000000000..68640c4ef84
--- /dev/null
+++ b/queue-4.19/rxrpc-fix-lack-of-conn-cleanup-when-local-endpoint-i.patch
@@ -0,0 +1,179 @@
+From cf642396b50dc7e7ce34ba39d7afe826785cc1ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 14:12:11 +0100
+Subject: rxrpc: Fix lack of conn cleanup when local endpoint is cleaned up
+ [ver #2]
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit d12040b6933f684a26773afad46dbba9778608d7 ]
+
+When a local endpoint is ceases to be in use, such as when the kafs module
+is unloaded, the kernel will emit an assertion failure if there are any
+outstanding client connections:
+
+	rxrpc: Assertion failed
+	------------[ cut here ]------------
+	kernel BUG at net/rxrpc/local_object.c:433!
+
+and even beyond that, will evince other oopses if there are service
+connections still present.
+
+Fix this by:
+
+ (1) Removing the triggering of connection reaping when an rxrpc socket is
+     released.  These don't actually clean up the connections anyway - and
+     further, the local endpoint may still be in use through another
+     socket.
+
+ (2) Mark the local endpoint as dead when we start the process of tearing
+     it down.
+
+ (3) When destroying a local endpoint, strip all of its client connections
+     from the idle list and discard the ref on each that the list was
+     holding.
+
+ (4) When destroying a local endpoint, call the service connection reaper
+     directly (rather than through a workqueue) to immediately kill off all
+     outstanding service connections.
+
+ (5) Make the service connection reaper reap connections for which the
+     local endpoint is marked dead.
+
+Only after destroying the connections can we close the socket lest we get
+an oops in a workqueue that's looking at a connection or a peer.
+
+Fixes: 3d18cbb7fd0c ("rxrpc: Fix conn expiry timers")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/af_rxrpc.c     |  3 ---
+ net/rxrpc/ar-internal.h  |  1 +
+ net/rxrpc/conn_client.c  | 44 ++++++++++++++++++++++++++++++++++++++++
+ net/rxrpc/conn_object.c  |  2 +-
+ net/rxrpc/local_object.c |  5 ++++-
+ 5 files changed, 50 insertions(+), 5 deletions(-)
+
+diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
+index 7319d3ca30e94..a74edb10cbfc6 100644
+--- a/net/rxrpc/af_rxrpc.c
++++ b/net/rxrpc/af_rxrpc.c
+@@ -869,7 +869,6 @@ static void rxrpc_sock_destructor(struct sock *sk)
+ static int rxrpc_release_sock(struct sock *sk)
+ {
+ 	struct rxrpc_sock *rx = rxrpc_sk(sk);
+-	struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
+ 
+ 	_enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
+ 
+@@ -905,8 +904,6 @@ static int rxrpc_release_sock(struct sock *sk)
+ 	rxrpc_release_calls_on_socket(rx);
+ 	flush_workqueue(rxrpc_workqueue);
+ 	rxrpc_purge_queue(&sk->sk_receive_queue);
+-	rxrpc_queue_work(&rxnet->service_conn_reaper);
+-	rxrpc_queue_work(&rxnet->client_conn_reaper);
+ 
+ 	rxrpc_unuse_local(rx->local);
+ 	rx->local = NULL;
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 37e4c1801a41f..ccef6e40e0020 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -903,6 +903,7 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *);
+ void rxrpc_put_client_conn(struct rxrpc_connection *);
+ void rxrpc_discard_expired_client_conns(struct work_struct *);
+ void rxrpc_destroy_all_client_connections(struct rxrpc_net *);
++void rxrpc_clean_up_local_conns(struct rxrpc_local *);
+ 
+ /*
+  * conn_event.c
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index c979a56faaef0..3dbb126e60608 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -1166,3 +1166,47 @@ void rxrpc_destroy_all_client_connections(struct rxrpc_net *rxnet)
+ 
+ 	_leave("");
+ }
++
++/*
++ * Clean up the client connections on a local endpoint.
++ */
++void rxrpc_clean_up_local_conns(struct rxrpc_local *local)
++{
++	struct rxrpc_connection *conn, *tmp;
++	struct rxrpc_net *rxnet = local->rxnet;
++	unsigned int nr_active;
++	LIST_HEAD(graveyard);
++
++	_enter("");
++
++	spin_lock(&rxnet->client_conn_cache_lock);
++	nr_active = rxnet->nr_active_client_conns;
++
++	list_for_each_entry_safe(conn, tmp, &rxnet->idle_client_conns,
++				 cache_link) {
++		if (conn->params.local == local) {
++			ASSERTCMP(conn->cache_state, ==, RXRPC_CONN_CLIENT_IDLE);
++
++			trace_rxrpc_client(conn, -1, rxrpc_client_discard);
++			if (!test_and_clear_bit(RXRPC_CONN_EXPOSED, &conn->flags))
++				BUG();
++			conn->cache_state = RXRPC_CONN_CLIENT_INACTIVE;
++			list_move(&conn->cache_link, &graveyard);
++			nr_active--;
++		}
++	}
++
++	rxnet->nr_active_client_conns = nr_active;
++	spin_unlock(&rxnet->client_conn_cache_lock);
++	ASSERTCMP(nr_active, >=, 0);
++
++	while (!list_empty(&graveyard)) {
++		conn = list_entry(graveyard.next,
++				  struct rxrpc_connection, cache_link);
++		list_del_init(&conn->cache_link);
++
++		rxrpc_put_connection(conn);
++	}
++
++	_leave(" [culled]");
++}
+diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
+index 885dae829f4a1..004a6eb529bc1 100644
+--- a/net/rxrpc/conn_object.c
++++ b/net/rxrpc/conn_object.c
+@@ -401,7 +401,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
+ 		if (conn->state == RXRPC_CONN_SERVICE_PREALLOC)
+ 			continue;
+ 
+-		if (rxnet->live) {
++		if (rxnet->live && !conn->params.local->dead) {
+ 			idle_timestamp = READ_ONCE(conn->idle_timestamp);
+ 			expire_at = idle_timestamp + rxrpc_connection_expiry * HZ;
+ 			if (conn->params.local->service_closed)
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index c752ad4870678..04f0976841a43 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -430,11 +430,14 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
+ 
+ 	_enter("%d", local->debug_id);
+ 
++	local->dead = true;
++
+ 	mutex_lock(&rxnet->local_mutex);
+ 	list_del_init(&local->link);
+ 	mutex_unlock(&rxnet->local_mutex);
+ 
+-	ASSERT(RB_EMPTY_ROOT(&local->client_conns));
++	rxrpc_clean_up_local_conns(local);
++	rxrpc_service_connection_reaper(&rxnet->service_conn_reaper);
+ 	ASSERT(!local->service);
+ 
+ 	if (socket) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/rxrpc-fix-trace-after-put-looking-at-the-put-connect.patch b/queue-4.19/rxrpc-fix-trace-after-put-looking-at-the-put-connect.patch
new file mode 100644
index 00000000000..8c9dd1c308a
--- /dev/null
+++ b/queue-4.19/rxrpc-fix-trace-after-put-looking-at-the-put-connect.patch
@@ -0,0 +1,174 @@
+From 1ec2e7acd756afb5e2ab0ef0466bd204198c5267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 10:58:29 +0100
+Subject: rxrpc: Fix trace-after-put looking at the put connection record
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 4c1295dccc0afe0905b6ca4c62ade7f2406f2cfb ]
+
+rxrpc_put_*conn() calls trace_rxrpc_conn() after they have done the
+decrement of the refcount - which looks at the debug_id in the connection
+record.  But unless the refcount was reduced to zero, we no longer have the
+right to look in the record and, indeed, it may be deleted by some other
+thread.
+
+Fix this by getting the debug_id out before decrementing the refcount and
+then passing that into the tracepoint.
+
+Fixes: 363deeab6d0f ("rxrpc: Add connection tracepoint and client conn state tracepoint")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/rxrpc.h |  6 +++---
+ net/rxrpc/call_accept.c      |  2 +-
+ net/rxrpc/conn_client.c      |  6 ++++--
+ net/rxrpc/conn_object.c      | 13 +++++++------
+ net/rxrpc/conn_service.c     |  2 +-
+ 5 files changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
+index a08916eb76152..0924119bcfa40 100644
+--- a/include/trace/events/rxrpc.h
++++ b/include/trace/events/rxrpc.h
+@@ -554,10 +554,10 @@ TRACE_EVENT(rxrpc_peer,
+ 	    );
+ 
+ TRACE_EVENT(rxrpc_conn,
+-	    TP_PROTO(struct rxrpc_connection *conn, enum rxrpc_conn_trace op,
++	    TP_PROTO(unsigned int conn_debug_id, enum rxrpc_conn_trace op,
+ 		     int usage, const void *where),
+ 
+-	    TP_ARGS(conn, op, usage, where),
++	    TP_ARGS(conn_debug_id, op, usage, where),
+ 
+ 	    TP_STRUCT__entry(
+ 		    __field(unsigned int,	conn		)
+@@ -567,7 +567,7 @@ TRACE_EVENT(rxrpc_conn,
+ 			     ),
+ 
+ 	    TP_fast_assign(
+-		    __entry->conn = conn->debug_id;
++		    __entry->conn = conn_debug_id;
+ 		    __entry->op = op;
+ 		    __entry->usage = usage;
+ 		    __entry->where = where;
+diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
+index 8079aacaecace..c5566bc4aaca3 100644
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -88,7 +88,7 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
+ 		smp_store_release(&b->conn_backlog_head,
+ 				  (head + 1) & (size - 1));
+ 
+-		trace_rxrpc_conn(conn, rxrpc_conn_new_service,
++		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service,
+ 				 atomic_read(&conn->usage), here);
+ 	}
+ 
+diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
+index 3dbb126e60608..38d5485320242 100644
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -217,7 +217,8 @@ rxrpc_alloc_client_connection(struct rxrpc_conn_parameters *cp, gfp_t gfp)
+ 	rxrpc_get_local(conn->params.local);
+ 	key_get(conn->params.key);
+ 
+-	trace_rxrpc_conn(conn, rxrpc_conn_new_client, atomic_read(&conn->usage),
++	trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_client,
++			 atomic_read(&conn->usage),
+ 			 __builtin_return_address(0));
+ 	trace_rxrpc_client(conn, -1, rxrpc_client_alloc);
+ 	_leave(" = %p", conn);
+@@ -989,11 +990,12 @@ rxrpc_put_one_client_conn(struct rxrpc_connection *conn)
+ void rxrpc_put_client_conn(struct rxrpc_connection *conn)
+ {
+ 	const void *here = __builtin_return_address(0);
++	unsigned int debug_id = conn->debug_id;
+ 	int n;
+ 
+ 	do {
+ 		n = atomic_dec_return(&conn->usage);
+-		trace_rxrpc_conn(conn, rxrpc_conn_put_client, n, here);
++		trace_rxrpc_conn(debug_id, rxrpc_conn_put_client, n, here);
+ 		if (n > 0)
+ 			return;
+ 		ASSERTCMP(n, >=, 0);
+diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
+index 004a6eb529bc1..f338efd2880aa 100644
+--- a/net/rxrpc/conn_object.c
++++ b/net/rxrpc/conn_object.c
+@@ -272,7 +272,7 @@ bool rxrpc_queue_conn(struct rxrpc_connection *conn)
+ 	if (n == 0)
+ 		return false;
+ 	if (rxrpc_queue_work(&conn->processor))
+-		trace_rxrpc_conn(conn, rxrpc_conn_queued, n + 1, here);
++		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_queued, n + 1, here);
+ 	else
+ 		rxrpc_put_connection(conn);
+ 	return true;
+@@ -287,7 +287,7 @@ void rxrpc_see_connection(struct rxrpc_connection *conn)
+ 	if (conn) {
+ 		int n = atomic_read(&conn->usage);
+ 
+-		trace_rxrpc_conn(conn, rxrpc_conn_seen, n, here);
++		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_seen, n, here);
+ 	}
+ }
+ 
+@@ -299,7 +299,7 @@ void rxrpc_get_connection(struct rxrpc_connection *conn)
+ 	const void *here = __builtin_return_address(0);
+ 	int n = atomic_inc_return(&conn->usage);
+ 
+-	trace_rxrpc_conn(conn, rxrpc_conn_got, n, here);
++	trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n, here);
+ }
+ 
+ /*
+@@ -313,7 +313,7 @@ rxrpc_get_connection_maybe(struct rxrpc_connection *conn)
+ 	if (conn) {
+ 		int n = atomic_fetch_add_unless(&conn->usage, 1, 0);
+ 		if (n > 0)
+-			trace_rxrpc_conn(conn, rxrpc_conn_got, n + 1, here);
++			trace_rxrpc_conn(conn->debug_id, rxrpc_conn_got, n + 1, here);
+ 		else
+ 			conn = NULL;
+ 	}
+@@ -336,10 +336,11 @@ static void rxrpc_set_service_reap_timer(struct rxrpc_net *rxnet,
+ void rxrpc_put_service_conn(struct rxrpc_connection *conn)
+ {
+ 	const void *here = __builtin_return_address(0);
++	unsigned int debug_id = conn->debug_id;
+ 	int n;
+ 
+ 	n = atomic_dec_return(&conn->usage);
+-	trace_rxrpc_conn(conn, rxrpc_conn_put_service, n, here);
++	trace_rxrpc_conn(debug_id, rxrpc_conn_put_service, n, here);
+ 	ASSERTCMP(n, >=, 0);
+ 	if (n == 1)
+ 		rxrpc_set_service_reap_timer(conn->params.local->rxnet,
+@@ -423,7 +424,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
+ 		 */
+ 		if (atomic_cmpxchg(&conn->usage, 1, 0) != 1)
+ 			continue;
+-		trace_rxrpc_conn(conn, rxrpc_conn_reap_service, 0, NULL);
++		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_reap_service, 0, NULL);
+ 
+ 		if (rxrpc_conn_is_client(conn))
+ 			BUG();
+diff --git a/net/rxrpc/conn_service.c b/net/rxrpc/conn_service.c
+index 80773a50c7551..6da7c4bf15e88 100644
+--- a/net/rxrpc/conn_service.c
++++ b/net/rxrpc/conn_service.c
+@@ -138,7 +138,7 @@ struct rxrpc_connection *rxrpc_prealloc_service_connection(struct rxrpc_net *rxn
+ 		list_add_tail(&conn->proc_link, &rxnet->conn_proc_list);
+ 		write_unlock(&rxnet->conn_lock);
+ 
+-		trace_rxrpc_conn(conn, rxrpc_conn_new_service,
++		trace_rxrpc_conn(conn->debug_id, rxrpc_conn_new_service,
+ 				 atomic_read(&conn->usage),
+ 				 __builtin_return_address(0));
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch b/queue-4.19/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
new file mode 100644
index 00000000000..b3786580e9c
--- /dev/null
+++ b/queue-4.19/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
@@ -0,0 +1,52 @@
+From 276a6f48bf68eb3ace86d61229e24ed83d768ebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 15:55:28 +0100
+Subject: rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3427beb6375d04e9627c67343872e79341a684ea ]
+
+With gcc 4.1:
+
+    net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’:
+    net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function
+
+Indeed, if the first jump to the send_fragmentable label is made, and
+the address family is not handled in the switch() statement, ret will be
+used uninitialized.
+
+Fix this by BUG()'ing as is done in other places in rxrpc where internal
+support for future address families will need adding.  It should not be
+possible to reach this normally as the address families are checked
+up-front.
+
+Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/output.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index 345dc1c5fe72f..31e47cfb3e68a 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -524,6 +524,9 @@ send_fragmentable:
+ 		}
+ 		break;
+ #endif
++
++	default:
++		BUG();
+ 	}
+ 
+ 	if (ret < 0)
+-- 
+2.20.1
+
diff --git a/queue-4.19/s390-kexec_file-fix-potential-segment-overlap-in-elf.patch b/queue-4.19/s390-kexec_file-fix-potential-segment-overlap-in-elf.patch
new file mode 100644
index 00000000000..f8db19d9e92
--- /dev/null
+++ b/queue-4.19/s390-kexec_file-fix-potential-segment-overlap-in-elf.patch
@@ -0,0 +1,37 @@
+From 68922fa14ba55e6ce3b7454d130448ddd777cf98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 12:13:42 +0200
+Subject: s390/kexec_file: Fix potential segment overlap in ELF loader
+
+From: Philipp Rudo <prudo@linux.ibm.com>
+
+[ Upstream commit 6339a3889ad4d0dd930ed7a1e873fb81d3e690f7 ]
+
+When loading an ELF image via kexec_file the segment alignment is ignored
+in the calculation for the load address of the next segment. When there are
+multiple segments this can lead to segment overlap and thus load failure.
+
+Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
+Fixes: 8be018827154 ("s390/kexec_file: Add ELF loader")
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/kexec_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/kexec_elf.c b/arch/s390/kernel/kexec_elf.c
+index 602e7cc26d118..5cf340b778f18 100644
+--- a/arch/s390/kernel/kexec_elf.c
++++ b/arch/s390/kernel/kexec_elf.c
+@@ -58,7 +58,7 @@ static int kexec_file_add_elf_kernel(struct kimage *image,
+ 		if (ret)
+ 			return ret;
+ 
+-		data->memsz += buf.memsz;
++		data->memsz = ALIGN(data->memsz, phdr->p_align) + buf.memsz;
+ 	}
+ 
+ 	return 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/s390-qeth-fix-error-handling-during-vnicc-initializa.patch b/queue-4.19/s390-qeth-fix-error-handling-during-vnicc-initializa.patch
new file mode 100644
index 00000000000..b8b0f3b7ada
--- /dev/null
+++ b/queue-4.19/s390-qeth-fix-error-handling-during-vnicc-initializa.patch
@@ -0,0 +1,63 @@
+From 918123b1fdc9c89f9fa9ef42857545da719f7eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 18:21:06 +0200
+Subject: s390/qeth: Fix error handling during VNICC initialization
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+[ Upstream commit b528965bcc827dad32a8d21745feaacfc76c9703 ]
+
+Smatch discovered the use of uninitialized variable sup_cmds
+in error paths.
+
+Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index c238b190b3c93..b9be2c08e8dfa 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2330,10 +2330,10 @@ static bool qeth_l2_vnicc_recover_char(struct qeth_card *card, u32 vnicc,
+ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ {
+ 	u32 *timeout = &card->options.vnicc.learning_timeout;
++	bool enable, error = false;
+ 	unsigned int chars_len, i;
+ 	unsigned long chars_tmp;
+ 	u32 sup_cmds, vnicc;
+-	bool enable, error;
+ 
+ 	QETH_CARD_TEXT(card, 2, "vniccini");
+ 	/* reset rx_bcast */
+@@ -2354,7 +2354,10 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ 	chars_len = sizeof(card->options.vnicc.sup_chars) * BITS_PER_BYTE;
+ 	for_each_set_bit(i, &chars_tmp, chars_len) {
+ 		vnicc = BIT(i);
+-		qeth_l2_vnicc_query_cmds(card, vnicc, &sup_cmds);
++		if (qeth_l2_vnicc_query_cmds(card, vnicc, &sup_cmds)) {
++			sup_cmds = 0;
++			error = true;
++		}
+ 		if (!(sup_cmds & IPA_VNICC_SET_TIMEOUT) ||
+ 		    !(sup_cmds & IPA_VNICC_GET_TIMEOUT))
+ 			card->options.vnicc.getset_timeout_sup &= ~vnicc;
+@@ -2363,8 +2366,8 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ 			card->options.vnicc.set_char_sup &= ~vnicc;
+ 	}
+ 	/* enforce assumed default values and recover settings, if changed  */
+-	error = qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
+-					      timeout);
++	error |= qeth_l2_vnicc_recover_timeout(card, QETH_VNICC_LEARNING,
++					       timeout);
+ 	chars_tmp = card->options.vnicc.wanted_chars ^ QETH_VNICC_DEFAULT;
+ 	chars_len = sizeof(card->options.vnicc.wanted_chars) * BITS_PER_BYTE;
+ 	for_each_set_bit(i, &chars_tmp, chars_len) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/s390-qeth-fix-initialization-of-vnicc-cmd-masks-duri.patch b/queue-4.19/s390-qeth-fix-initialization-of-vnicc-cmd-masks-duri.patch
new file mode 100644
index 00000000000..733e254fd0c
--- /dev/null
+++ b/queue-4.19/s390-qeth-fix-initialization-of-vnicc-cmd-masks-duri.patch
@@ -0,0 +1,51 @@
+From 576895aad2b3fe09e515f0d118889bd72e306a8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 18:21:07 +0200
+Subject: s390/qeth: Fix initialization of vnicc cmd masks during set online
+
+From: Alexandra Winter <wintera@linux.ibm.com>
+
+[ Upstream commit be40a86c319706f90caca144343c64743c32b953 ]
+
+Without this patch, a command bit in the supported commands mask is only
+ever set to unsupported during set online. If a command is ever marked as
+unsupported (e.g. because of error during qeth_l2_vnicc_query_cmds),
+subsequent successful initialization (offline/online) would not bring it
+back.
+
+Fixes: caa1f0b10d18 ("s390/qeth: add VNICC enable/disable support")
+Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index b9be2c08e8dfa..aa90004f49e28 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -2358,11 +2358,15 @@ static void qeth_l2_vnicc_init(struct qeth_card *card)
+ 			sup_cmds = 0;
+ 			error = true;
+ 		}
+-		if (!(sup_cmds & IPA_VNICC_SET_TIMEOUT) ||
+-		    !(sup_cmds & IPA_VNICC_GET_TIMEOUT))
++		if ((sup_cmds & IPA_VNICC_SET_TIMEOUT) &&
++		    (sup_cmds & IPA_VNICC_GET_TIMEOUT))
++			card->options.vnicc.getset_timeout_sup |= vnicc;
++		else
+ 			card->options.vnicc.getset_timeout_sup &= ~vnicc;
+-		if (!(sup_cmds & IPA_VNICC_ENABLE) ||
+-		    !(sup_cmds & IPA_VNICC_DISABLE))
++		if ((sup_cmds & IPA_VNICC_ENABLE) &&
++		    (sup_cmds & IPA_VNICC_DISABLE))
++			card->options.vnicc.set_char_sup |= vnicc;
++		else
+ 			card->options.vnicc.set_char_sup &= ~vnicc;
+ 	}
+ 	/* enforce assumed default values and recover settings, if changed  */
+-- 
+2.20.1
+
diff --git a/queue-4.19/samples-bpf-fix-broken-xdp_rxq_info-due-to-map-order.patch b/queue-4.19/samples-bpf-fix-broken-xdp_rxq_info-due-to-map-order.patch
new file mode 100644
index 00000000000..44e73828eaa
--- /dev/null
+++ b/queue-4.19/samples-bpf-fix-broken-xdp_rxq_info-due-to-map-order.patch
@@ -0,0 +1,66 @@
+From 8d4f4afdc0ff7a60780632eab445069cf43f55ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 13:37:31 +0100
+Subject: samples/bpf: Fix broken xdp_rxq_info due to map order assumptions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit edbca120a8cdfa5a5793707e33497aa5185875ca ]
+
+In the days of using bpf_load.c the order in which the 'maps' sections
+were defines in BPF side (*_kern.c) file, were used by userspace side
+to identify the map via using the map order as an index. In effect the
+order-index is created based on the order the maps sections are stored
+in the ELF-object file, by the LLVM compiler.
+
+This have also carried over in libbpf via API bpf_map__next(NULL, obj)
+to extract maps in the order libbpf parsed the ELF-object file.
+
+When BTF based maps were introduced a new section type ".maps" were
+created. I found that the LLVM compiler doesn't create the ".maps"
+sections in the order they are defined in the C-file. The order in the
+ELF file is based on the order the map pointer is referenced in the code.
+
+This combination of changes lead to xdp_rxq_info mixing up the map
+file-descriptors in userspace, resulting in very broken behaviour, but
+without warning the user.
+
+This patch fix issue by instead using bpf_object__find_map_by_name()
+to find maps via their names. (Note, this is the ELF name, which can
+be longer than the name the kernel retains).
+
+Fixes: be5bca44aa6b ("samples: bpf: convert some XDP samples from bpf_load to libbpf")
+Fixes: 451d1dc886b5 ("samples: bpf: update map definition to new syntax BTF-defined map")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/157529025128.29832.5953245340679936909.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/xdp_rxq_info_user.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/samples/bpf/xdp_rxq_info_user.c b/samples/bpf/xdp_rxq_info_user.c
+index ef26f882f92f4..a55c81301c1a9 100644
+--- a/samples/bpf/xdp_rxq_info_user.c
++++ b/samples/bpf/xdp_rxq_info_user.c
+@@ -472,9 +472,9 @@ int main(int argc, char **argv)
+ 	if (bpf_prog_load_xattr(&prog_load_attr, &obj, &prog_fd))
+ 		return EXIT_FAIL;
+ 
+-	map = bpf_map__next(NULL, obj);
+-	stats_global_map = bpf_map__next(map, obj);
+-	rx_queue_index_map = bpf_map__next(stats_global_map, obj);
++	map =  bpf_object__find_map_by_name(obj, "config_map");
++	stats_global_map = bpf_object__find_map_by_name(obj, "stats_global_map");
++	rx_queue_index_map = bpf_object__find_map_by_name(obj, "rx_queue_index_map");
+ 	if (!map || !stats_global_map || !rx_queue_index_map) {
+ 		printf("finding a map in obj file failed\n");
+ 		return EXIT_FAIL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-fnic-fix-msix-interrupt-allocation.patch b/queue-4.19/scsi-fnic-fix-msix-interrupt-allocation.patch
new file mode 100644
index 00000000000..5be0de35b8f
--- /dev/null
+++ b/queue-4.19/scsi-fnic-fix-msix-interrupt-allocation.patch
@@ -0,0 +1,47 @@
+From 08d191c6abf08053e5b2fe48aeb9fe011cbb38a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 14:13:40 -0700
+Subject: scsi: fnic: fix msix interrupt allocation
+
+From: Govindarajulu Varadarajan <gvaradar@cisco.com>
+
+[ Upstream commit 3ec24fb4c035e9cbb2f02a48640a09aa913442a2 ]
+
+pci_alloc_irq_vectors() returns number of vectors allocated.  Fix the check
+for error condition.
+
+Fixes: cca678dfbad49 ("scsi: fnic: switch to pci_alloc_irq_vectors")
+Link: https://lore.kernel.org/r/20190827211340.1095-1-gvaradar@cisco.com
+Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
+Acked-by: Satish Kharat <satishkh@cisco.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_isr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c
+index 4e3a50202e8c5..d28088218c364 100644
+--- a/drivers/scsi/fnic/fnic_isr.c
++++ b/drivers/scsi/fnic/fnic_isr.c
+@@ -254,7 +254,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
+ 		int vecs = n + m + o + 1;
+ 
+ 		if (pci_alloc_irq_vectors(fnic->pdev, vecs, vecs,
+-				PCI_IRQ_MSIX) < 0) {
++				PCI_IRQ_MSIX) == vecs) {
+ 			fnic->rq_count = n;
+ 			fnic->raw_wq_count = m;
+ 			fnic->wq_copy_count = o;
+@@ -280,7 +280,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
+ 	    fnic->wq_copy_count >= 1 &&
+ 	    fnic->cq_count >= 3 &&
+ 	    fnic->intr_count >= 1 &&
+-	    pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) < 0) {
++	    pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) == 1) {
+ 		fnic->rq_count = 1;
+ 		fnic->raw_wq_count = 1;
+ 		fnic->wq_copy_count = 1;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch b/queue-4.19/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
new file mode 100644
index 00000000000..759336e4a38
--- /dev/null
+++ b/queue-4.19/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
@@ -0,0 +1,39 @@
+From 034c96676ca0de6e7d693a4de25ae12334f02738 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 10:18:35 +0100
+Subject: scsi: libfc: fix null pointer dereference on a null lport
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ]
+
+Currently if lport is null then the null lport pointer is dereference when
+printing out debug via the FC_LPORT_DB macro. Fix this by using the more
+generic FC_LIBFC_DBG debug macro instead that does not use lport.
+
+Addresses-Coverity: ("Dereference after null check")
+Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_exch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 42bcf7f3a0f90..6ba257cbc6d94 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -2603,7 +2603,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
+ 
+ 	/* lport lock ? */
+ 	if (!lport || lport->state == LPORT_ST_DISABLED) {
+-		FC_LPORT_DBG(lport, "Receiving frames for an lport that "
++		FC_LIBFC_DBG("Receiving frames for an lport that "
+ 			     "has not been initialized correctly\n");
+ 		fc_frame_free(fp);
+ 		return;
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-megaraid_sas-reduce-module-load-time.patch b/queue-4.19/scsi-megaraid_sas-reduce-module-load-time.patch
new file mode 100644
index 00000000000..7cbe7b55c49
--- /dev/null
+++ b/queue-4.19/scsi-megaraid_sas-reduce-module-load-time.patch
@@ -0,0 +1,67 @@
+From 7d754e2c8f0e1fe6afc489fa15da0c0f77860303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 06:46:28 -0800
+Subject: scsi: megaraid_sas: reduce module load time
+
+From: Steve Sistare <steven.sistare@oracle.com>
+
+[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]
+
+megaraid_sas takes 1+ seconds to load while waiting for firmware:
+
+[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+This is due to the following loop in megasas_transition_to_ready(), which
+waits a minimum of 1 second, even though the FW becomes ready in tens of
+millisecs:
+
+        /*
+         * The cur_state should not last for more than max_wait secs
+         */
+        for (i = 0; i < max_wait; i++) {
+                ...
+                msleep(1000);
+        ...
+        dev_info(&instance->pdev->dev, "FW now in Ready state\n");
+
+This is a regression, caused by a change of the msleep granularity from 1
+to 1000 due to concern about waiting too long on systems with coarse
+jiffies.
+
+To fix, increase iterations and use msleep(20), which results in:
+
+[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
+Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 2f31d266339f8..99469f9057eea 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3894,12 +3894,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ 		/*
+ 		 * The cur_state should not last for more than max_wait secs
+ 		 */
+-		for (i = 0; i < max_wait; i++) {
++		for (i = 0; i < max_wait * 50; i++) {
+ 			curr_abs_state = instance->instancet->
+ 				read_fw_status_reg(instance->reg_set);
+ 
+ 			if (abs_state == curr_abs_state) {
+-				msleep(1000);
++				msleep(20);
+ 			} else
+ 				break;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch b/queue-4.19/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch
new file mode 100644
index 00000000000..d58b477fd92
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch
@@ -0,0 +1,55 @@
+From 9ec51f40f4b34dcaf92bfb6ff0209ddfced01f04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 14:44:42 -0700
+Subject: scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit a861b49273578e255426a499842cf7f465456351 ]
+
+The "(&ctio->u.status1.sense_data)[i]" where i >= 0 expressions in
+qlt_send_resp_ctio() are probably typos and should have been
+"(&ctio->u.status1.sense_data[4 * i])" instead. Instead of only fixing
+these typos, modify the code for storing sense data such that it becomes
+easy to read. This patch fixes a Coverity complaint about accessing an
+array outside its bounds.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <gmalavali@marvell.com>
+Fixes: be25152c0d9e ("qla2xxx: Improve T10-DIF/PI handling in driver.") # v4.11.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index c925ca7875374..95206e227730c 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -2233,14 +2233,14 @@ void qlt_send_resp_ctio(struct qla_qpair *qpair, struct qla_tgt_cmd *cmd,
+ 		ctio->u.status1.scsi_status |=
+ 		    cpu_to_le16(SS_RESIDUAL_UNDER);
+ 
+-	/* Response code and sense key */
+-	put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
+-	    (&ctio->u.status1.sense_data)[0]);
++	/* Fixed format sense data. */
++	ctio->u.status1.sense_data[0] = 0x70;
++	ctio->u.status1.sense_data[2] = sense_key;
+ 	/* Additional sense length */
+-	put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
++	ctio->u.status1.sense_data[7] = 0xa;
+ 	/* ASC and ASCQ */
+-	put_unaligned_le32(((asc << 24) | (ascq << 16)),
+-	    (&ctio->u.status1.sense_data)[3]);
++	ctio->u.status1.sense_data[12] = asc;
++	ctio->u.status1.sense_data[13] = ascq;
+ 
+ 	/* Memory Barrier */
+ 	wmb();
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-fix-a-format-specifier.patch b/queue-4.19/scsi-qla2xxx-fix-a-format-specifier.patch
new file mode 100644
index 00000000000..0f0ae2b6125
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-fix-a-format-specifier.patch
@@ -0,0 +1,39 @@
+From ccb915fc6658a3296b4fc9aff90f3cb1856c4ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 14:44:11 -0700
+Subject: scsi: qla2xxx: Fix a format specifier
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 19ce192cd718e02f880197c0983404ca48236807 ]
+
+Since mcmd->sess->port_name is eight bytes long, use %8phC to format that
+port name instead of %phC.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <gmalavali@marvell.com>
+Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") # v4.11.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index e9545411ec5a9..bbbe1996620bf 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -2290,7 +2290,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
+ 		    mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode ==
+ 		    ELS_TPRLO) {
+ 			ql_dbg(ql_dbg_disc, vha, 0x2106,
+-			    "TM response logo %phC status %#x state %#x",
++			    "TM response logo %8phC status %#x state %#x",
+ 			    mcmd->sess->port_name, mcmd->fc_tm_rsp,
+ 			    mcmd->flags);
+ 			qlt_schedule_sess_for_deletion(mcmd->sess);
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-fix-error-handling-in-qlt_alloc_qfull_c.patch b/queue-4.19/scsi-qla2xxx-fix-error-handling-in-qlt_alloc_qfull_c.patch
new file mode 100644
index 00000000000..39b3d136d3e
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-fix-error-handling-in-qlt_alloc_qfull_c.patch
@@ -0,0 +1,52 @@
+From 68bfed510ecb0d202f52bc756b71769b751fcc1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 14:44:27 -0700
+Subject: scsi: qla2xxx: Fix error handling in qlt_alloc_qfull_cmd()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c04466c17142d5eb566984372b9a5003d1900fe3 ]
+
+The test "if (!cmd)" is not useful because it is guaranteed that cmd !=
+NULL.  Instead of testing the cmd pointer, rely on the tag to decide
+whether or not command allocation failed.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <gmalavali@marvell.com>
+Fixes: 33e799775593 ("qla2xxx: Add support for QFull throttling and Term Exchange retry") # v3.18.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index bbbe1996620bf..c925ca7875374 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -5334,11 +5334,7 @@ qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ 	se_sess = sess->se_sess;
+ 
+ 	tag = sbitmap_queue_get(&se_sess->sess_tag_pool, &cpu);
+-	if (tag < 0)
+-		return;
+-
+-	cmd = &((struct qla_tgt_cmd *)se_sess->sess_cmd_map)[tag];
+-	if (!cmd) {
++	if (tag < 0) {
+ 		ql_dbg(ql_dbg_io, vha, 0x3009,
+ 			"qla_target(%d): %s: Allocation of cmd failed\n",
+ 			vha->vp_idx, __func__);
+@@ -5353,6 +5349,7 @@ qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ 		return;
+ 	}
+ 
++	cmd = &((struct qla_tgt_cmd *)se_sess->sess_cmd_map)[tag];
+ 	memset(cmd, 0, sizeof(struct qla_tgt_cmd));
+ 
+ 	qlt_incr_num_pend_cmds(vha);
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch b/queue-4.19/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
new file mode 100644
index 00000000000..d59dcfb0d7e
--- /dev/null
+++ b/queue-4.19/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
@@ -0,0 +1,100 @@
+From 7641f55c5622de5bb12209d5362875ed6fa8c8a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2019 12:44:46 -0700
+Subject: scsi: qla2xxx: Unregister chrdev if module initialization fails
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]
+
+If module initialization fails after the character device has been
+registered, unregister the character device. Additionally, avoid
+duplicating error path code.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
+Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
+ 1 file changed, 21 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index bb20a4a228cfe..fff20a3707677 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6967,8 +6967,7 @@ qla2x00_module_init(void)
+ 	/* Initialize target kmem_cache and mem_pools */
+ 	ret = qlt_init();
+ 	if (ret < 0) {
+-		kmem_cache_destroy(srb_cachep);
+-		return ret;
++		goto destroy_cache;
+ 	} else if (ret > 0) {
+ 		/*
+ 		 * If initiator mode is explictly disabled by qlt_init(),
+@@ -6989,11 +6988,10 @@ qla2x00_module_init(void)
+ 	qla2xxx_transport_template =
+ 	    fc_attach_transport(&qla2xxx_transport_functions);
+ 	if (!qla2xxx_transport_template) {
+-		kmem_cache_destroy(srb_cachep);
+ 		ql_log(ql_log_fatal, NULL, 0x0002,
+ 		    "fc_attach_transport failed...Failing load!.\n");
+-		qlt_exit();
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto qlt_exit;
+ 	}
+ 
+ 	apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
+@@ -7005,27 +7003,37 @@ qla2x00_module_init(void)
+ 	qla2xxx_transport_vport_template =
+ 	    fc_attach_transport(&qla2xxx_transport_vport_functions);
+ 	if (!qla2xxx_transport_vport_template) {
+-		kmem_cache_destroy(srb_cachep);
+-		qlt_exit();
+-		fc_release_transport(qla2xxx_transport_template);
+ 		ql_log(ql_log_fatal, NULL, 0x0004,
+ 		    "fc_attach_transport vport failed...Failing load!.\n");
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto unreg_chrdev;
+ 	}
+ 	ql_log(ql_log_info, NULL, 0x0005,
+ 	    "QLogic Fibre Channel HBA Driver: %s.\n",
+ 	    qla2x00_version_str);
+ 	ret = pci_register_driver(&qla2xxx_pci_driver);
+ 	if (ret) {
+-		kmem_cache_destroy(srb_cachep);
+-		qlt_exit();
+-		fc_release_transport(qla2xxx_transport_template);
+-		fc_release_transport(qla2xxx_transport_vport_template);
+ 		ql_log(ql_log_fatal, NULL, 0x0006,
+ 		    "pci_register_driver failed...ret=%d Failing load!.\n",
+ 		    ret);
++		goto release_vport_transport;
+ 	}
+ 	return ret;
++
++release_vport_transport:
++	fc_release_transport(qla2xxx_transport_vport_template);
++
++unreg_chrdev:
++	if (apidev_major >= 0)
++		unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
++	fc_release_transport(qla2xxx_transport_template);
++
++qlt_exit:
++	qlt_exit();
++
++destroy_cache:
++	kmem_cache_destroy(srb_cachep);
++	return ret;
+ }
+ 
+ /**
+-- 
+2.20.1
+
diff --git a/queue-4.19/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch b/queue-4.19/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch
new file mode 100644
index 00000000000..17c8b431c02
--- /dev/null
+++ b/queue-4.19/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch
@@ -0,0 +1,52 @@
+From ea7a30f9c62d9ab36b7c5bb7699c8a890a9b9423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2019 12:58:05 -0700
+Subject: scsi: target/core: Fix a race condition in the LUN lookup code
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 63f7479439c95bcd49b7dd4af809862c316c71a3 ]
+
+The rcu_dereference(deve->se_lun) expression occurs twice in the LUN lookup
+functions. Since these expressions are not serialized against deve->se_lun
+assignments each of these expressions may yield a different result. Avoid
+that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only
+once.
+
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index e9ff2a7c0c0e6..22e97a93728db 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ 			goto out_unlock;
+ 		}
+ 
+-		se_cmd->se_lun = rcu_dereference(deve->se_lun);
++		se_cmd->se_lun = se_lun;
+ 		se_cmd->pr_res_key = deve->pr_res_key;
+ 		se_cmd->orig_fe_lun = unpacked_lun;
+ 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+@@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ 			goto out_unlock;
+ 		}
+ 
+-		se_cmd->se_lun = rcu_dereference(deve->se_lun);
++		se_cmd->se_lun = se_lun;
+ 		se_cmd->pr_res_key = deve->pr_res_key;
+ 		se_cmd->orig_fe_lun = unpacked_lun;
+ 		se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+-- 
+2.20.1
+
diff --git a/queue-4.19/sctp-add-chunks-to-sk_backlog-when-the-newsk-sk_sock.patch b/queue-4.19/sctp-add-chunks-to-sk_backlog-when-the-newsk-sk_sock.patch
new file mode 100644
index 00000000000..1d1537173ad
--- /dev/null
+++ b/queue-4.19/sctp-add-chunks-to-sk_backlog-when-the-newsk-sk_sock.patch
@@ -0,0 +1,129 @@
+From 7596511ee4a6a5718d6d0d7b7f144f27786fa226 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Oct 2019 19:09:23 +0800
+Subject: sctp: add chunks to sk_backlog when the newsk sk_socket is not set
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 819be8108fded0b9e710bbbf81193e52f7bab2f7 ]
+
+This patch is to fix a NULL-ptr deref in selinux_socket_connect_helper:
+
+  [...] kasan: GPF could be caused by NULL-ptr deref or user memory access
+  [...] RIP: 0010:selinux_socket_connect_helper+0x94/0x460
+  [...] Call Trace:
+  [...]  selinux_sctp_bind_connect+0x16a/0x1d0
+  [...]  security_sctp_bind_connect+0x58/0x90
+  [...]  sctp_process_asconf+0xa52/0xfd0 [sctp]
+  [...]  sctp_sf_do_asconf+0x785/0x980 [sctp]
+  [...]  sctp_do_sm+0x175/0x5a0 [sctp]
+  [...]  sctp_assoc_bh_rcv+0x285/0x5b0 [sctp]
+  [...]  sctp_backlog_rcv+0x482/0x910 [sctp]
+  [...]  __release_sock+0x11e/0x310
+  [...]  release_sock+0x4f/0x180
+  [...]  sctp_accept+0x3f9/0x5a0 [sctp]
+  [...]  inet_accept+0xe7/0x720
+
+It was caused by that the 'newsk' sk_socket was not set before going to
+security sctp hook when processing asconf chunk with SCTP_PARAM_ADD_IP
+or SCTP_PARAM_SET_PRIMARY:
+
+  inet_accept()->
+    sctp_accept():
+      lock_sock():
+          lock listening 'sk'
+                                          do_softirq():
+                                            sctp_rcv():  <-- [1]
+                                                asconf chunk arrives and
+                                                enqueued in 'sk' backlog
+      sctp_sock_migrate():
+          set asoc's sk to 'newsk'
+      release_sock():
+          sctp_backlog_rcv():
+            lock 'newsk'
+            sctp_process_asconf()  <-- [2]
+            unlock 'newsk'
+    sock_graft():
+        set sk_socket  <-- [3]
+
+As it shows, at [1] the asconf chunk would be put into the listening 'sk'
+backlog, as accept() was holding its sock lock. Then at [2] asconf would
+get processed with 'newsk' as asoc's sk had been set to 'newsk'. However,
+'newsk' sk_socket is not set until [3], while selinux_sctp_bind_connect()
+would deref it, then kernel crashed.
+
+Here to fix it by adding the chunk to sk_backlog until newsk sk_socket is
+set when .accept() is done.
+
+Note that sk->sk_socket can be NULL when the sock is closed, so SOCK_DEAD
+flag is also needed to check in sctp_newsk_ready().
+
+Thanks to Ondrej for reviewing the code.
+
+Fixes: d452930fd3b9 ("selinux: Add SCTP support")
+Reported-by: Ying Xu <yinxu@redhat.com>
+Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sctp/sctp.h |  5 +++++
+ net/sctp/input.c        | 12 +++++++++---
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 2abbc15824af9..2c6570e6fcfec 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -625,4 +625,9 @@ static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
+ 	return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
+ }
+ 
++static inline bool sctp_newsk_ready(const struct sock *sk)
++{
++	return sock_flag(sk, SOCK_DEAD) || sk->sk_socket;
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/net/sctp/input.c b/net/sctp/input.c
+index bfe29158afccb..f64d882c86985 100644
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -255,7 +255,7 @@ int sctp_rcv(struct sk_buff *skb)
+ 		bh_lock_sock(sk);
+ 	}
+ 
+-	if (sock_owned_by_user(sk)) {
++	if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
+ 		if (sctp_add_backlog(sk, skb)) {
+ 			bh_unlock_sock(sk);
+ 			sctp_chunk_free(chunk);
+@@ -333,7 +333,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ 		local_bh_disable();
+ 		bh_lock_sock(sk);
+ 
+-		if (sock_owned_by_user(sk)) {
++		if (sock_owned_by_user(sk) || !sctp_newsk_ready(sk)) {
+ 			if (sk_add_backlog(sk, skb, sk->sk_rcvbuf))
+ 				sctp_chunk_free(chunk);
+ 			else
+@@ -348,7 +348,13 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ 		if (backloged)
+ 			return 0;
+ 	} else {
+-		sctp_inq_push(inqueue, chunk);
++		if (!sctp_newsk_ready(sk)) {
++			if (!sk_add_backlog(sk, skb, sk->sk_rcvbuf))
++				return 0;
++			sctp_chunk_free(chunk);
++		} else {
++			sctp_inq_push(inqueue, chunk);
++		}
+ 	}
+ 
+ done:
+-- 
+2.20.1
+
diff --git a/queue-4.19/selftests-ipc-fix-msgque-compiler-warnings.patch b/queue-4.19/selftests-ipc-fix-msgque-compiler-warnings.patch
new file mode 100644
index 00000000000..f888cd109a7
--- /dev/null
+++ b/queue-4.19/selftests-ipc-fix-msgque-compiler-warnings.patch
@@ -0,0 +1,76 @@
+From 3086dcee1afb4f54c632ac80fc554c1b2d9454e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 10:13:44 -0700
+Subject: selftests/ipc: Fix msgque compiler warnings
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit a147faa96f832f76e772b1e448e94ea84c774081 ]
+
+This fixes the various compiler warnings when building the msgque
+selftest. The primary change is using sys/msg.h instead of linux/msg.h
+directly to gain the API declarations.
+
+Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ipc/msgque.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
+index dac927e823363..4c156aeab6b80 100644
+--- a/tools/testing/selftests/ipc/msgque.c
++++ b/tools/testing/selftests/ipc/msgque.c
+@@ -1,9 +1,10 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <errno.h>
+-#include <linux/msg.h>
++#include <sys/msg.h>
+ #include <fcntl.h>
+ 
+ #include "../kselftest.h"
+@@ -73,7 +74,7 @@ int restore_queue(struct msgque_data *msgque)
+ 	return 0;
+ 
+ destroy:
+-	if (msgctl(id, IPC_RMID, 0))
++	if (msgctl(id, IPC_RMID, NULL))
+ 		printf("Failed to destroy queue: %d\n", -errno);
+ 	return ret;
+ }
+@@ -120,7 +121,7 @@ int check_and_destroy_queue(struct msgque_data *msgque)
+ 
+ 	ret = 0;
+ err:
+-	if (msgctl(msgque->msq_id, IPC_RMID, 0)) {
++	if (msgctl(msgque->msq_id, IPC_RMID, NULL)) {
+ 		printf("Failed to destroy queue: %d\n", -errno);
+ 		return -errno;
+ 	}
+@@ -129,7 +130,7 @@ err:
+ 
+ int dump_queue(struct msgque_data *msgque)
+ {
+-	struct msqid64_ds ds;
++	struct msqid_ds ds;
+ 	int kern_id;
+ 	int i, ret;
+ 
+@@ -245,7 +246,7 @@ int main(int argc, char **argv)
+ 	return ksft_exit_pass();
+ 
+ err_destroy:
+-	if (msgctl(msgque.msq_id, IPC_RMID, 0)) {
++	if (msgctl(msgque.msq_id, IPC_RMID, NULL)) {
+ 		printf("Failed to destroy queue: %d\n", -errno);
+ 		return ksft_exit_fail();
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-add-support-of-tc-bit-status-check.patch b/queue-4.19/serial-stm32-add-support-of-tc-bit-status-check.patch
new file mode 100644
index 00000000000..e9f119429d2
--- /dev/null
+++ b/queue-4.19/serial-stm32-add-support-of-tc-bit-status-check.patch
@@ -0,0 +1,97 @@
+From 452c6967dd8db1042239fed07ac493c31b16a596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:45 +0200
+Subject: serial: stm32: Add support of TC bit status check
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 64c32eab660386f9904bb295a104c9c425e9f8b2 ]
+
+Adds a check on the Transmission Complete bit status before closing the
+com port. Prevents the port closure before the end of the transmission.
+TC poll loop is moved from stm32_tx_dma_complete to stm32_shutdown
+routine, in order to check TC before shutdown in both dma and
+PIO tx modes.
+TC clear is added in stm32_transmit_char routine, in order to be cleared
+before transmitting in both dma and PIO tx modes.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++-----------------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 2e7757d5e5d83..d603be9669a96 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -290,21 +290,6 @@ static void stm32_tx_dma_complete(void *arg)
+ 	struct uart_port *port = arg;
+ 	struct stm32_port *stm32port = to_stm32_port(port);
+ 	struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
+-	unsigned int isr;
+-	int ret;
+-
+-	ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
+-						isr,
+-						(isr & USART_SR_TC),
+-						10, 100000);
+-
+-	if (ret)
+-		dev_err(port->dev, "terminal count not set\n");
+-
+-	if (ofs->icr == UNDEF_REG)
+-		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+-	else
+-		stm32_set_bits(port, ofs->icr, USART_CR_TC);
+ 
+ 	stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
+ 	stm32port->tx_dma_busy = false;
+@@ -396,7 +381,6 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
+ 	/* Issue pending DMA TX requests */
+ 	dma_async_issue_pending(stm32port->tx_ch);
+ 
+-	stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+ 	stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT);
+ 
+ 	xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
+@@ -425,6 +409,11 @@ static void stm32_transmit_chars(struct uart_port *port)
+ 		return;
+ 	}
+ 
++	if (ofs->icr == UNDEF_REG)
++		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
++	else
++		stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
++
+ 	if (stm32_port->tx_ch)
+ 		stm32_transmit_chars_dma(port);
+ 	else
+@@ -601,12 +590,21 @@ static void stm32_shutdown(struct uart_port *port)
+ 	struct stm32_port *stm32_port = to_stm32_port(port);
+ 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+-	u32 val;
++	u32 val, isr;
++	int ret;
+ 
+ 	val = USART_CR1_TXEIE | USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
+ 	val |= BIT(cfg->uart_enable_bit);
+ 	if (stm32_port->fifoen)
+ 		val |= USART_CR1_FIFOEN;
++
++	ret = readl_relaxed_poll_timeout(port->membase + ofs->isr,
++					 isr, (isr & USART_SR_TC),
++					 10, 100000);
++
++	if (ret)
++		dev_err(port->dev, "transmission complete not set\n");
++
+ 	stm32_clr_bits(port, ofs->cr1, val);
+ 
+ 	dev_pm_clear_wake_irq(port->dev);
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-a-recursive-locking-in-stm32_config.patch b/queue-4.19/serial-stm32-fix-a-recursive-locking-in-stm32_config.patch
new file mode 100644
index 00000000000..13ea9b22e8f
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-a-recursive-locking-in-stm32_config.patch
@@ -0,0 +1,45 @@
+From 10c19d0c86f3fc4cd655b685a94d799d7c841ade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2019 12:53:06 +0200
+Subject: serial: stm32: fix a recursive locking in stm32_config_rs485
+
+From: Borut Seljak <borut.seljak@t-2.net>
+
+[ Upstream commit 707aeea13a9c85520262e11899d86df3c4b48262 ]
+
+Remove spin_lock_irqsave in stm32_config_rs485, it cause recursive locking.
+Already locked in uart_set_rs485_config.
+
+Fixes: 1bcda09d291081 ("serial: stm32: add support for RS485 hardware control mode")
+Signed-off-by: Borut Seljak <borut.seljak@t-2.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 1334e42939776..d096e552176cc 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -105,9 +105,7 @@ static int stm32_config_rs485(struct uart_port *port,
+ 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ 	u32 usartdiv, baud, cr1, cr3;
+ 	bool over8;
+-	unsigned long flags;
+ 
+-	spin_lock_irqsave(&port->lock, flags);
+ 	stm32_clr_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+ 
+ 	port->rs485 = *rs485conf;
+@@ -147,7 +145,6 @@ static int stm32_config_rs485(struct uart_port *port,
+ 	}
+ 
+ 	stm32_set_bits(port, ofs->cr1, BIT(cfg->uart_enable_bit));
+-	spin_unlock_irqrestore(&port->lock, flags);
+ 
+ 	return 0;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-clearing-interrupt-error-flags.patch b/queue-4.19/serial-stm32-fix-clearing-interrupt-error-flags.patch
new file mode 100644
index 00000000000..ef53a66fbcd
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-clearing-interrupt-error-flags.patch
@@ -0,0 +1,52 @@
+From 78a7b0ef236db48a606598e377407768a10a62fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 09:10:49 +0100
+Subject: serial: stm32: fix clearing interrupt error flags
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 1250ed7114a977cdc2a67a0c09d6cdda63970eb9 ]
+
+The interrupt clear flag register is a "write 1 to clear" register.
+So, only writing ones allows to clear flags:
+- Replace buggy stm32_clr_bits() by a simple write to clear error flags
+- Replace useless read/modify/write stm32_set_bits() routine by a
+  simple write to clear TC (transfer complete) flag.
+
+Fixes: 4f01d833fdcd ("serial: stm32: fix rx error handling")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1574323849-1909-1-git-send-email-fabrice.gasnier@st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index d096e552176cc..bce4ac1787add 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -239,8 +239,8 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+ 		 * cleared by the sequence [read SR - read DR].
+ 		 */
+ 		if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
+-			stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
+-				       USART_ICR_PECF | USART_ICR_FECF);
++			writel_relaxed(sr & USART_SR_ERR_MASK,
++				       port->membase + ofs->icr);
+ 
+ 		c = stm32_get_char(port, &sr, &stm32_port->last_res);
+ 		port->icount.rx++;
+@@ -409,7 +409,7 @@ static void stm32_transmit_chars(struct uart_port *port)
+ 	if (ofs->icr == UNDEF_REG)
+ 		stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+ 	else
+-		stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
++		writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr);
+ 
+ 	if (stm32_port->tx_ch)
+ 		stm32_transmit_chars_dma(port);
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-rx-data-length-when-parity-enabled.patch b/queue-4.19/serial-stm32-fix-rx-data-length-when-parity-enabled.patch
new file mode 100644
index 00000000000..4a95f522b29
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-rx-data-length-when-parity-enabled.patch
@@ -0,0 +1,76 @@
+From 7033830f94d09245deb1191da9fddc185af9a7a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:43 +0200
+Subject: serial: stm32: fix rx data length when parity enabled
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 6c5962f30bce147b1c83869085f3ddde3b34c9e3 ]
+
+- Fixes a rx data error when data length < 8 bits and parity is enabled.
+RDR register MSB is used for parity bit reception.
+- Adds a mask to ignore MSB when data is get from RDR.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 12 ++++++++----
+ drivers/tty/serial/stm32-usart.h |  1 +
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index f6b739351ddec..0a7953e5ce47a 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -194,8 +194,8 @@ static int stm32_pending_rx(struct uart_port *port, u32 *sr, int *last_res,
+ 	return 0;
+ }
+ 
+-static unsigned long
+-stm32_get_char(struct uart_port *port, u32 *sr, int *last_res)
++static unsigned long stm32_get_char(struct uart_port *port, u32 *sr,
++				    int *last_res)
+ {
+ 	struct stm32_port *stm32_port = to_stm32_port(port);
+ 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+@@ -205,10 +205,13 @@ stm32_get_char(struct uart_port *port, u32 *sr, int *last_res)
+ 		c = stm32_port->rx_buf[RX_BUF_L - (*last_res)--];
+ 		if ((*last_res) == 0)
+ 			*last_res = RX_BUF_L;
+-		return c;
+ 	} else {
+-		return readl_relaxed(port->membase + ofs->rdr);
++		c = readl_relaxed(port->membase + ofs->rdr);
++		/* apply RDR data mask */
++		c &= stm32_port->rdr_mask;
+ 	}
++
++	return c;
+ }
+ 
+ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+@@ -679,6 +682,7 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ 		cr2 |= USART_CR2_STOP_2B;
+ 
+ 	bits = stm32_get_databits(termios);
++	stm32_port->rdr_mask = (BIT(bits) - 1);
+ 
+ 	if (cflag & PARENB) {
+ 		bits++;
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index 8d34802e572ed..30d2433e27c3c 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -254,6 +254,7 @@ struct stm32_port {
+ 	bool hw_flow_control;
+ 	bool fifoen;
+ 	int wakeirq;
++	int rdr_mask;		/* receive data register mask */
+ };
+ 
+ static struct stm32_port stm32_ports[STM32_MAX_PORTS];
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-rx-error-handling.patch b/queue-4.19/serial-stm32-fix-rx-error-handling.patch
new file mode 100644
index 00000000000..a00c90bef19
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-rx-error-handling.patch
@@ -0,0 +1,164 @@
+From 10c9ce757a0b792b2eb7fcb9ebc1ca05467faa0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:42 +0200
+Subject: serial: stm32: fix rx error handling
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 4f01d833fdcdd6f9b85d9e5d5d7568eb683626a7 ]
+
+- Fixes parity and framing error bit by clearing parity and framing error
+  flag. The current implementation doesn't clear the error bits when an
+  error is detected.
+- Fixes the incorrect name of framing error clearing flag in header file.
+- Fixes misalignement between data frame and errors status. The status
+  read for "n" frame was the status of "n+1" frame".
+- Fixes break detection was not triggered by the expected register.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 54 +++++++++++++++++++++-----------
+ drivers/tty/serial/stm32-usart.h | 10 ++----
+ 2 files changed, 37 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index e8321850938af..f6b739351ddec 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -225,35 +225,51 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+ 
+ 	while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) {
+ 		sr |= USART_SR_DUMMY_RX;
+-		c = stm32_get_char(port, &sr, &stm32_port->last_res);
+ 		flag = TTY_NORMAL;
+-		port->icount.rx++;
+ 
++		/*
++		 * Status bits has to be cleared before reading the RDR:
++		 * In FIFO mode, reading the RDR will pop the next data
++		 * (if any) along with its status bits into the SR.
++		 * Not doing so leads to misalignement between RDR and SR,
++		 * and clear status bits of the next rx data.
++		 *
++		 * Clear errors flags for stm32f7 and stm32h7 compatible
++		 * devices. On stm32f4 compatible devices, the error bit is
++		 * cleared by the sequence [read SR - read DR].
++		 */
++		if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
++			stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
++				       USART_ICR_PECF | USART_ICR_FECF);
++
++		c = stm32_get_char(port, &sr, &stm32_port->last_res);
++		port->icount.rx++;
+ 		if (sr & USART_SR_ERR_MASK) {
+-			if (sr & USART_SR_LBD) {
+-				port->icount.brk++;
+-				if (uart_handle_break(port))
+-					continue;
+-			} else if (sr & USART_SR_ORE) {
+-				if (ofs->icr != UNDEF_REG)
+-					writel_relaxed(USART_ICR_ORECF,
+-						       port->membase +
+-						       ofs->icr);
++			if (sr & USART_SR_ORE) {
+ 				port->icount.overrun++;
+ 			} else if (sr & USART_SR_PE) {
+ 				port->icount.parity++;
+ 			} else if (sr & USART_SR_FE) {
+-				port->icount.frame++;
++				/* Break detection if character is null */
++				if (!c) {
++					port->icount.brk++;
++					if (uart_handle_break(port))
++						continue;
++				} else {
++					port->icount.frame++;
++				}
+ 			}
+ 
+ 			sr &= port->read_status_mask;
+ 
+-			if (sr & USART_SR_LBD)
+-				flag = TTY_BREAK;
+-			else if (sr & USART_SR_PE)
++			if (sr & USART_SR_PE) {
+ 				flag = TTY_PARITY;
+-			else if (sr & USART_SR_FE)
+-				flag = TTY_FRAME;
++			} else if (sr & USART_SR_FE) {
++				if (!c)
++					flag = TTY_BREAK;
++				else
++					flag = TTY_FRAME;
++			}
+ 		}
+ 
+ 		if (uart_handle_sysrq_char(port, c))
+@@ -721,14 +737,14 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	if (termios->c_iflag & INPCK)
+ 		port->read_status_mask |= USART_SR_PE | USART_SR_FE;
+ 	if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
+-		port->read_status_mask |= USART_SR_LBD;
++		port->read_status_mask |= USART_SR_FE;
+ 
+ 	/* Characters to ignore */
+ 	port->ignore_status_mask = 0;
+ 	if (termios->c_iflag & IGNPAR)
+ 		port->ignore_status_mask = USART_SR_PE | USART_SR_FE;
+ 	if (termios->c_iflag & IGNBRK) {
+-		port->ignore_status_mask |= USART_SR_LBD;
++		port->ignore_status_mask |= USART_SR_FE;
+ 		/*
+ 		 * If we're ignoring parity and break indicators,
+ 		 * ignore overruns too (for real raw support).
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index a70aa5006ab97..8d34802e572ed 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -108,7 +108,6 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_SR_RXNE		BIT(5)
+ #define USART_SR_TC		BIT(6)
+ #define USART_SR_TXE		BIT(7)
+-#define USART_SR_LBD		BIT(8)
+ #define USART_SR_CTSIF		BIT(9)
+ #define USART_SR_CTS		BIT(10)		/* F7 */
+ #define USART_SR_RTOF		BIT(11)		/* F7 */
+@@ -120,8 +119,7 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_SR_SBKF		BIT(18)		/* F7 */
+ #define USART_SR_WUF		BIT(20)		/* H7 */
+ #define USART_SR_TEACK		BIT(21)		/* F7 */
+-#define USART_SR_ERR_MASK	(USART_SR_LBD | USART_SR_ORE | \
+-				 USART_SR_FE | USART_SR_PE)
++#define USART_SR_ERR_MASK	(USART_SR_ORE | USART_SR_FE | USART_SR_PE)
+ /* Dummy bits */
+ #define USART_SR_DUMMY_RX	BIT(16)
+ 
+@@ -168,8 +166,6 @@ struct stm32_usart_info stm32h7_info = {
+ /* USART_CR2 */
+ #define USART_CR2_ADD_MASK	GENMASK(3, 0)	/* F4 */
+ #define USART_CR2_ADDM7		BIT(4)		/* F7 */
+-#define USART_CR2_LBDL		BIT(5)
+-#define USART_CR2_LBDIE		BIT(6)
+ #define USART_CR2_LBCL		BIT(8)
+ #define USART_CR2_CPHA		BIT(9)
+ #define USART_CR2_CPOL		BIT(10)
+@@ -226,12 +222,10 @@ struct stm32_usart_info stm32h7_info = {
+ 
+ /* USART_ICR */
+ #define USART_ICR_PECF		BIT(0)		/* F7 */
+-#define USART_ICR_FFECF		BIT(1)		/* F7 */
+-#define USART_ICR_NCF		BIT(2)		/* F7 */
++#define USART_ICR_FECF		BIT(1)		/* F7 */
+ #define USART_ICR_ORECF		BIT(3)		/* F7 */
+ #define USART_ICR_IDLECF	BIT(4)		/* F7 */
+ #define USART_ICR_TCCF		BIT(6)		/* F7 */
+-#define USART_ICR_LBDCF		BIT(8)		/* F7 */
+ #define USART_ICR_CTSCF		BIT(9)		/* F7 */
+ #define USART_ICR_RTOCF		BIT(11)		/* F7 */
+ #define USART_ICR_EOBCF		BIT(12)		/* F7 */
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch b/queue-4.19/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
new file mode 100644
index 00000000000..32c90857db1
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
@@ -0,0 +1,52 @@
+From b5dd8c2df94ec6a34b4f7be5958f89fb311093c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:44 +0200
+Subject: serial: stm32: fix transmit_chars when tx is stopped
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ]
+
+Disables the tx irq  when the transmission is ended and updates stop_tx
+conditions for code cleanup.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 0a7953e5ce47a..2e7757d5e5d83 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -420,13 +420,8 @@ static void stm32_transmit_chars(struct uart_port *port)
+ 		return;
+ 	}
+ 
+-	if (uart_tx_stopped(port)) {
+-		stm32_stop_tx(port);
+-		return;
+-	}
+-
+-	if (uart_circ_empty(xmit)) {
+-		stm32_stop_tx(port);
++	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
++		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ 		return;
+ 	}
+ 
+@@ -439,7 +434,7 @@ static void stm32_transmit_chars(struct uart_port *port)
+ 		uart_write_wakeup(port);
+ 
+ 	if (uart_circ_empty(xmit))
+-		stm32_stop_tx(port);
++		stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ }
+ 
+ static irqreturn_t stm32_interrupt(int irq, void *ptr)
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-wakeup-source-initialization.patch b/queue-4.19/serial-stm32-fix-wakeup-source-initialization.patch
new file mode 100644
index 00000000000..b78b4c8488e
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-wakeup-source-initialization.patch
@@ -0,0 +1,102 @@
+From 13bd7c3889340017f07fad9d78a11adc862c6277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:46 +0200
+Subject: serial: stm32: fix wakeup source initialization
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 5297f274e8b61ceb9676cba6649d3de9d03387ad ]
+
+Fixes dedicated_irq_wakeup issue and deactivated uart as wakeup source by
+default.
+
+Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index d603be9669a96..1334e42939776 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -557,7 +557,6 @@ static int stm32_startup(struct uart_port *port)
+ {
+ 	struct stm32_port *stm32_port = to_stm32_port(port);
+ 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+-	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ 	const char *name = to_platform_device(port->dev)->name;
+ 	u32 val;
+ 	int ret;
+@@ -568,15 +567,6 @@ static int stm32_startup(struct uart_port *port)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
+-		ret = dev_pm_set_dedicated_wake_irq(port->dev,
+-						    stm32_port->wakeirq);
+-		if (ret) {
+-			free_irq(port->irq, port);
+-			return ret;
+-		}
+-	}
+-
+ 	val = USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
+ 	if (stm32_port->fifoen)
+ 		val |= USART_CR1_FIFOEN;
+@@ -607,7 +597,6 @@ static void stm32_shutdown(struct uart_port *port)
+ 
+ 	stm32_clr_bits(port, ofs->cr1, val);
+ 
+-	dev_pm_clear_wake_irq(port->dev);
+ 	free_irq(port->irq, port);
+ }
+ 
+@@ -1079,11 +1068,18 @@ static int stm32_serial_probe(struct platform_device *pdev)
+ 		ret = device_init_wakeup(&pdev->dev, true);
+ 		if (ret)
+ 			goto err_uninit;
++
++		ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
++						    stm32port->wakeirq);
++		if (ret)
++			goto err_nowup;
++
++		device_set_wakeup_enable(&pdev->dev, false);
+ 	}
+ 
+ 	ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
+ 	if (ret)
+-		goto err_nowup;
++		goto err_wirq;
+ 
+ 	ret = stm32_of_dma_rx_probe(stm32port, pdev);
+ 	if (ret)
+@@ -1097,6 +1093,10 @@ static int stm32_serial_probe(struct platform_device *pdev)
+ 
+ 	return 0;
+ 
++err_wirq:
++	if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
++		dev_pm_clear_wake_irq(&pdev->dev);
++
+ err_nowup:
+ 	if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
+ 		device_init_wakeup(&pdev->dev, false);
+@@ -1134,8 +1134,10 @@ static int stm32_serial_remove(struct platform_device *pdev)
+ 				  TX_BUF_L, stm32_port->tx_buf,
+ 				  stm32_port->tx_dma_buf);
+ 
+-	if (cfg->has_wakeup && stm32_port->wakeirq >= 0)
++	if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
++		dev_pm_clear_wake_irq(&pdev->dev);
+ 		device_init_wakeup(&pdev->dev, false);
++	}
+ 
+ 	clk_disable_unprepare(stm32_port->clk);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/serial-stm32-fix-word-length-configuration.patch b/queue-4.19/serial-stm32-fix-word-length-configuration.patch
new file mode 100644
index 00000000000..4176134dbfc
--- /dev/null
+++ b/queue-4.19/serial-stm32-fix-word-length-configuration.patch
@@ -0,0 +1,135 @@
+From fe31cbe4d5f5ae2f84d3211100d3eed579a5f33a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:41 +0200
+Subject: serial: stm32: fix word length configuration
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit c8a9d043947b4acb19a65f7fac2bd0893e581cd5 ]
+
+STM32 supports either:
+- 8 and 9 bits word length (including parity bit) for stm32f4 compatible
+  devices
+- 7, 8 and 9 bits word length (including parity bit) for stm32f7 and
+  stm32h7 compatible devices.
+
+As a consequence STM32 supports the following termios configurations:
+- CS7 with parity bit, and CS8 (with or without parity bit) for stm32f4
+  compatible devices.
+- CS6 with parity bit, CS7 and CS8 (with or without parity bit) for
+  stm32f7 and stm32h7 compatible devices.
+
+This patch is fixing word length by configuring correctly the SoC with
+supported configurations.
+
+Fixes: ada8618ff3bf ("serial: stm32: adding support for stm32f7")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 56 ++++++++++++++++++++++++++++----
+ drivers/tty/serial/stm32-usart.h |  3 +-
+ 2 files changed, 50 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index e8d7a7bb4339e..e8321850938af 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -599,6 +599,36 @@ static void stm32_shutdown(struct uart_port *port)
+ 	free_irq(port->irq, port);
+ }
+ 
++unsigned int stm32_get_databits(struct ktermios *termios)
++{
++	unsigned int bits;
++
++	tcflag_t cflag = termios->c_cflag;
++
++	switch (cflag & CSIZE) {
++	/*
++	 * CSIZE settings are not necessarily supported in hardware.
++	 * CSIZE unsupported configurations are handled here to set word length
++	 * to 8 bits word as default configuration and to print debug message.
++	 */
++	case CS5:
++		bits = 5;
++		break;
++	case CS6:
++		bits = 6;
++		break;
++	case CS7:
++		bits = 7;
++		break;
++	/* default including CS8 */
++	default:
++		bits = 8;
++		break;
++	}
++
++	return bits;
++}
++
+ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ 			    struct ktermios *old)
+ {
+@@ -606,7 +636,7 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ 	struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ 	struct serial_rs485 *rs485conf = &port->rs485;
+-	unsigned int baud;
++	unsigned int baud, bits;
+ 	u32 usartdiv, mantissa, fraction, oversampling;
+ 	tcflag_t cflag = termios->c_cflag;
+ 	u32 cr1, cr2, cr3;
+@@ -632,16 +662,28 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	if (cflag & CSTOPB)
+ 		cr2 |= USART_CR2_STOP_2B;
+ 
++	bits = stm32_get_databits(termios);
++
+ 	if (cflag & PARENB) {
++		bits++;
+ 		cr1 |= USART_CR1_PCE;
+-		if ((cflag & CSIZE) == CS8) {
+-			if (cfg->has_7bits_data)
+-				cr1 |= USART_CR1_M0;
+-			else
+-				cr1 |= USART_CR1_M;
+-		}
+ 	}
+ 
++	/*
++	 * Word length configuration:
++	 * CS8 + parity, 9 bits word aka [M1:M0] = 0b01
++	 * CS7 or (CS6 + parity), 7 bits word aka [M1:M0] = 0b10
++	 * CS8 or (CS7 + parity), 8 bits word aka [M1:M0] = 0b00
++	 * M0 and M1 already cleared by cr1 initialization.
++	 */
++	if (bits == 9)
++		cr1 |= USART_CR1_M0;
++	else if ((bits == 7) && cfg->has_7bits_data)
++		cr1 |= USART_CR1_M1;
++	else if (bits != 8)
++		dev_dbg(port->dev, "Unsupported data bits config: %u bits\n"
++			, bits);
++
+ 	if (cflag & PARODD)
+ 		cr1 |= USART_CR1_PS;
+ 
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index 6f294e280ea30..a70aa5006ab97 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -151,8 +151,7 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_CR1_PS		BIT(9)
+ #define USART_CR1_PCE		BIT(10)
+ #define USART_CR1_WAKE		BIT(11)
+-#define USART_CR1_M		BIT(12)
+-#define USART_CR1_M0		BIT(12)		/* F7 */
++#define USART_CR1_M0		BIT(12)		/* F7 (CR1_M for F4) */
+ #define USART_CR1_MME		BIT(13)		/* F7 */
+ #define USART_CR1_CMIE		BIT(14)		/* F7 */
+ #define USART_CR1_OVER8		BIT(15)
+-- 
+2.20.1
+
diff --git a/queue-4.19/series b/queue-4.19/series
index 9703c5f543e..7d645a45cf8 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -15,3 +15,625 @@ leds-tlc591xx-update-the-maximum-brightness.patch
 soc-aspeed-fix-snoop_file_poll-s-return-type.patch
 watchdog-sprd-fix-the-incorrect-pointer-getting-from-driver-data.patch
 ipmi-fix-memory-leak-in-__ipmi_bmc_register.patch
+drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
+arm-dts-at91-nattis-set-the-prlud-and-hipow-signals-.patch
+arm-dts-at91-nattis-make-the-sd-card-slot-work.patch
+ixgbe-don-t-clear-ipsec-sa-counters-on-hw-clearing.patch
+drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
+iio-fix-position-relative-kernel-version.patch
+apparmor-fix-network-performance-issue-in-aa_label_s.patch
+alsa-hda-fix-unused-variable-warning.patch
+apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch
+arm-qcom_defconfig-enable-mailbox.patch
+firmware-coreboot-let-of-core-populate-platform-devi.patch
+pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch
+bridge-br_arp_nd_proxy-set-icmp6_router-if-neigh-has.patch
+drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch
+signal-ia64-use-the-generic-force_sigsegv-in-setup_f.patch
+signal-ia64-use-the-force_sig-sigsegv-.-in-ia64_rt_s.patch
+asoc-wm9712-fix-unused-variable-warning.patch
+mailbox-mediatek-add-check-for-possible-failure-of-k.patch
+ib-rxe-replace-kvfree-with-vfree.patch
+ib-hfi1-add-mtu-check-for-operational-data-vls.patch
+genirq-debugfs-reinstate-full-of-path-for-domain-nam.patch
+usb-dwc3-add-extcon-dependency-for-qcom.patch
+usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
+cfg80211-regulatory-make-initialization-more-robust.patch
+regulator-fixed-default-enable-high-on-dt-regulators.patch
+mei-replace-poll-with-epoll-for-write-queues.patch
+drm-msm-fix-unsigned-comparison-with-less-than-zero.patch
+of-fix-property-name-in-of_node_get_device_type.patch
+alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
+iwlwifi-nvm-get-num-of-hw-addresses-from-firmware.patch
+staging-comedi-ni_mio_common-protect-register-write-.patch
+netfilter-nft_osf-usage-from-output-path-is-not-vali.patch
+pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
+powerpc-pseries-memory-hotplug-fix-return-value-type.patch
+rtlwifi-rtl8821ae-replace-_rtl8821ae_mrate_idx_to_ar.patch
+rdma-bnxt_re-add-missing-spin-lock-initialization.patch
+netfilter-nf_flow_table-do-not-remove-offload-when-o.patch
+powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch
+tipc-eliminate-message-disordering-during-binding-ta.patch
+net-socionext-add-dummy-phy-register-read-in-phy_wri.patch
+drm-sun4i-hdmi-fix-double-flag-assignation.patch
+net-hns3-add-error-handler-for-hns3_nic_init_vector_.patch
+mlxsw-reg-qeec-add-minimum-shaper-fields.patch
+mlxsw-spectrum-set-minimum-shaper-on-mc-tcs.patch
+ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch
+asoc-wm97xx-fix-uninitialized-regmap-pointer-problem.patch
+arm-dts-bcm283x-correct-mailbox-register-sizes.patch
+pcrypt-use-format-specifier-in-kobject_add.patch
+asoc-sun8i-codec-add-missing-route-for-adc.patch
+pinctrl-meson-gxl-remove-invalid-gpiox-tsin_a-pins.patch
+bus-ti-sysc-add-mcasp-optional-clocks-flag.patch
+exportfs-fix-passing-zero-to-err_ptr-warning.patch
+drm-rcar-du-fix-the-return-value-in-case-of-error-in.patch
+drm-rcar-du-fix-vblank-initialization.patch
+net-always-initialize-pagedlen.patch
+drm-dp_mst-skip-validating-ports-during-destruction-.patch
+arm64-dts-meson-gx-add-hdmi_5v-regulator-as-hdmi-tx-.patch
+arm64-dts-renesas-r8a7795-es1-add-missing-power-doma.patch
+net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
+ib-hfi1-correctly-process-fecn-and-becn-in-packets.patch
+opp-fix-missing-debugfs-supply-directory-for-opps.patch
+ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch
+mailbox-ti-msgmgr-off-by-one-in-ti_msgmgr_of_xlate.patch
+staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch
+staging-bcm2835-camera-fix-module-autoloading.patch
+switchtec-remove-immediate-status-check-after-submit.patch
+ipv6-add-missing-tx-timestamping-on-ipproto_raw.patch
+pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
+pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
+pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
+pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
+pinctrl-sh-pfc-r8a77970-add-missing-mod_sel0-field.patch
+pinctrl-sh-pfc-r8a77980-add-missing-mod_sel0-field.patch
+pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
+pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch
+pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
+pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
+net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch
+vxlan-changelink-fix-handling-of-default-remotes.patch
+input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
+fork-memcg-fix-crash-in-free_thread_stack-on-memcg-c.patch
+clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
+clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
+clk-ti-fix-refcount-leak-in-ti_dt_clocks_register.patch
+clk-socfpga-fix-refcount-leak.patch
+clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
+clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
+clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
+clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
+clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
+clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
+clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
+clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
+clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch
+clk-dove-fix-refcount-leak-in-dove_clk_init.patch
+mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch
+arm64-defconfig-re-enable-bcm2835-thermal-driver.patch
+remoteproc-qcom-q6v5-mss-add-missing-clocks-for-msm8.patch
+remoteproc-qcom-q6v5-mss-add-missing-regulator-for-m.patch
+drm-fix-error-handling-in-drm_legacy_addctx.patch
+arm-dts-r8a7743-remove-generic-compatible-string-fro.patch
+drm-etnaviv-fix-some-off-by-one-bugs.patch
+drm-fb-helper-generic-fix-setup-error-path.patch
+fork-memcg-fix-cached_stacks-case.patch
+ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
+rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
+rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
+drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch
+arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
+spi-cadence-correct-initialisation-of-runtime-pm.patch
+rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch
+net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch
+memory-tegra-don-t-invoke-tegra30-specific-memory-ti.patch
+drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
+media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
+kbuild-mark-prepare0-as-phony-to-fix-external-module.patch
+crypto-brcm-fix-some-set-but-not-used-warning.patch
+crypto-tgr192-fix-unaligned-memory-access.patch
+asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
+ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
+net-hns3-fix-wrong-combined-count-returned-by-ethtoo.patch
+media-tw9910-unregister-subdevice-with-v4l2-async.patch
+ib-mlx5-don-t-override-existing-ip_protocol.patch
+rtc-cmos-ignore-bogus-century-byte.patch
+spi-topcliff_pch-fix-potential-null-dereference-on-a.patch
+net-hns3-fix-bug-of-ethtool_ops.get_channels-for-vf.patch
+arm-dts-sun8i-a23-a33-move-nand-controller-device-no.patch
+clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
+iwlwifi-mvm-avoid-possible-access-out-of-array.patch
+net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch
+ip_tunnel-fix-route-fl4-init-in-ip_md_tunnel_xmit.patch
+arm64-dts-allwinner-h6-move-gic-device-node-fix-base.patch
+iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
+bus-ti-sysc-fix-timer-handling-with-drop-pm_runtime_.patch
+tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
+driver-uio-fix-possible-memory-leak-in-__uio_registe.patch
+driver-uio-fix-possible-use-after-free-in-__uio_regi.patch
+crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
+driver-core-fix-dl_flag_autoremove_supplier-device-l.patch
+driver-core-avoid-careless-re-use-of-existing-device.patch
+driver-core-do-not-resume-suppliers-under-device_lin.patch
+driver-core-fix-handling-of-runtime-pm-flags-in-devi.patch
+driver-core-do-not-call-rpm_put_suppliers-in-pm_runt.patch
+arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
+arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
+arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
+arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
+arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
+drm-xen-front-fix-mmap-attributes-for-display-buffer.patch
+iwlwifi-mvm-fix-rss-config-command.patch
+staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
+clk-ingenic-jz4740-fix-gating-of-udc-clock.patch
+rtc-ds1672-fix-unintended-sign-extension.patch
+thermal-mediatek-fix-register-index-error.patch
+arm64-dts-msm8916-remove-bogus-argument-to-the-cpu-c.patch
+ath10k-fix-dma-unmap-direction-for-management-frames.patch
+net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
+rtc-ds1307-rx8130-fix-alarm-handling.patch
+net-smc-original-socket-family-in-inet_sock_diag.patch
+rtc-88pm860x-fix-unintended-sign-extension.patch
+rtc-88pm80x-fix-unintended-sign-extension.patch
+rtc-pm8xxx-fix-unintended-sign-extension.patch
+fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
+iw_cxgb4-use-tos-when-importing-the-endpoint.patch
+iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
+ipmi-kcs_bmc-handle-devm_kasprintf-failure-case.patch
+xsk-add-missing-smp_rmb-in-xsk_mmap.patch
+drm-etnaviv-potential-null-dereference.patch
+ntb_hw_switchtec-debug-print-64bit-aligned-crosslink.patch
+ntb_hw_switchtec-nt-req-id-mapping-table-register-en.patch
+pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
+pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
+pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
+pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
+rdma-mlx5-fix-memory-leak-in-case-we-fail-to-add-an-.patch
+driver-core-fix-possible-supplier-pm-usage-counter-i.patch
+pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch
+usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
+block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
+keys-timestamp-new-keys.patch
+net-dsa-b53-fix-default-vlan-id.patch
+net-dsa-b53-properly-account-for-vlan-filtering.patch
+net-dsa-b53-do-not-program-cpu-port-s-pvid.patch
+mt76-usb-fix-possible-memory-leak-in-mt76u_buf_free.patch
+media-sh-migor-include-missing-dma-mapping-header.patch
+vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
+hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch
+mdio_bus-fix-ptr_err-usage-after-initialization-to-c.patch
+kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch
+staging-r8822be-check-kzalloc-return-or-bail.patch
+dmaengine-mv_xor-use-correct-device-for-dma-api.patch
+cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
+brcmfmac-create-debugfs-files-for-bus-specific-layer.patch
+regulator-pv88060-fix-array-out-of-bounds-access.patch
+regulator-pv88080-fix-array-out-of-bounds-access.patch
+regulator-pv88090-fix-array-out-of-bounds-access.patch
+net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
+net-mlx5-delete-unused-fpga-qpn-variable.patch
+drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
+drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
+drm-nouveau-fix-missing-break-in-switch-statement.patch
+driver-core-fix-pm-runtime-for-links-added-during-co.patch
+asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
+net-dsa-fix-unintended-change-of-bridge-interface-st.patch
+fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
+staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch
+powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch
+nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
+perf-copy-parent-s-address-filter-offsets-on-clone.patch
+perf-pt-coresight-fix-address-filters-for-vmas-with-.patch
+clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
+clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
+platform-x86-wmi-fix-potential-null-pointer-derefere.patch
+nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch
+mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
+iommu-fix-iommu-debugfs-fallout.patch
+arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
+arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
+arm-8849-1-nommu-fix-encodings-for-pmsav8-s-prbar4-p.patch
+regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
+ath10k-fix-length-of-wmi-tlv-command-for-protected-m.patch
+netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch
+netfilter-nft_set_hash-bogus-element-self-comparison.patch
+net-sched-act_csum-fix-csum-calc-for-tagged-packets.patch
+hwrng-bcm2835-fix-probe-as-platform-device.patch
+iommu-vt-d-fix-null-pointer-reference-in-intel_svm_b.patch
+nfs-add-missing-encode-decode-sequence_maxsz-to-v4.2.patch
+nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch
+net-aquantia-fixed-instack-structure-overflow.patch
+powerpc-mm-check-secondary-hash-page-table.patch
+media-dvb-earth-pt1-fix-wrong-initialization-for-dem.patch
+rbd-clear-xferred-on-error-from-rbd_obj_issue_copyup.patch
+pci-fix-try-semantics-of-bus-and-slot-reset.patch
+nios2-ksyms-add-missing-symbol-exports.patch
+x86-mm-remove-unused-variable-cpu.patch
+scsi-megaraid_sas-reduce-module-load-time.patch
+nfp-fix-simple-vnic-mailbox-length.patch
+drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
+xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
+net-mlx5-fix-multiple-updates-of-steering-rules-in-p.patch
+net-mlx5e-ipoib-fix-rx-checksum-statistics-update.patch
+net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
+regulator-lp87565-fix-missing-register-for-lp87565_b.patch
+soc-amlogic-gx-socinfo-add-mask-for-each-soc-package.patch
+media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
+media-cx18-update-pos-correctly-in-cx18_read_pos.patch
+media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
+media-cx23885-check-allocation-return.patch
+regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
+crypto-ccree-reduce-kernel-stack-usage-with-clang.patch
+jfs-fix-bogus-variable-self-initialization.patch
+tipc-tipc-clang-warning.patch
+m68k-mac-fix-via-timer-counter-accesses.patch
+arm-dts-sun8i-a33-reintroduce-default-pinctrl-muxing.patch
+arm64-dts-allwinner-a64-add-missing-pio-clocks.patch
+arm-dts-sun9i-optimus-fix-fixed-regulators.patch
+net-phy-don-t-clear-bmcr-in-genphy_soft_reset.patch
+arm-omap2-fix-potentially-uninitialized-return-value.patch
+net-dsa-avoid-null-pointer-when-failing-to-connect-t.patch
+soc-qcom-cmd-db-fix-an-error-code-in-cmd_db_dev_prob.patch
+media-davinci-isif-avoid-uninitialized-variable-use.patch
+media-tw5864-fix-possible-null-pointer-dereference-i.patch
+spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
+spi-tegra114-fix-for-unpacked-mode-transfers.patch
+spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch
+spi-tegra114-flush-fifos.patch
+spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch
+bus-ti-sysc-fix-sysc_unprepare-when-no-clocks-have-b.patch
+soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
+spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
+drm-fb-helper-generic-call-drm_client_add-after-setu.patch
+arm64-vdso-don-t-leak-kernel-addresses.patch
+rtc-fix-timestamp-value-for-rtc_timestamp_begin_1900.patch
+rtc-mt6397-don-t-call-irq_dispose_mapping.patch
+ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
+bpf-add-missed-newline-in-verifier-verbose-log.patch
+drm-vmwgfx-remove-set-but-not-used-variable-restart.patch
+scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
+of-use-correct-function-prototype-for-of_overlay_fdt.patch
+net-sched-cbs-fix-port_rate-miscalculation.patch
+clk-qcom-skip-halt-checks-on-gcc_pcie_0_pipe_clk-for.patch
+acpi-button-reinitialize-button-state-upon-resume.patch
+firmware-arm_scmi-fix-of_node-leak-in-scmi_mailbox_c.patch
+rxrpc-fix-detection-of-out-of-order-acks.patch
+scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch
+brcmfmac-fix-leak-of-mypkt-on-error-return-path.patch
+arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
+pci-rockchip-fix-rockchip_pcie_ep_assert_intx-bitwis.patch
+net-hns3-fix-for-vport-bw_limit-overflow-problem.patch
+hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
+perf-core-fix-the-address-filtering-fix.patch
+staging-android-vsoc-fix-copy_from_user-overrun.patch
+pci-dwc-fix-dw_pcie_ep_find_capability-to-return-cor.patch
+soc-amlogic-meson-gx-pwrc-vpu-fix-power-on-off-regis.patch
+platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch
+tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
+usb-typec-tcpm-notify-the-tcpc-to-start-connection-d.patch
+selftests-ipc-fix-msgque-compiler-warnings.patch
+net-hns3-fix-loop-condition-of-hns3_get_tx_timeo_que.patch
+powerpc-vdso-make-vdso32-installation-conditional-in.patch
+arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
+media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
+6lowpan-off-by-one-handling-nexthdr.patch
+dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
+alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
+afs-fix-afs-file-locking-to-allow-fine-grained-locks.patch
+afs-further-fix-file-locking.patch
+nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch
+coresight-catu-fix-clang-build-warning.patch
+s390-kexec_file-fix-potential-segment-overlap-in-elf.patch
+irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch
+scsi-qla2xxx-fix-a-format-specifier.patch
+scsi-qla2xxx-fix-error-handling-in-qlt_alloc_qfull_c.patch
+scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch
+kvm-ppc-book3s-hv-fix-lockdep-warning-when-entering-.patch
+netfilter-nft_flow_offload-add-entry-to-flowtable-af.patch
+pci-iproc-enable-iproc-config-read-for-paxbv2.patch
+arm-dts-logicpd-som-lv-fix-mmc1-card-detect.patch
+packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
+asoc-fix-valid-stream-condition.patch
+usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
+dwc2-gadget-fix-completed-transfer-size-calculation-.patch
+ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
+rdma-rxe-consider-skb-reserve-space-based-on-netdev-.patch
+iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
+net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
+net-ena-fix-free-napi-resources-when-ena_up-fails.patch
+net-ena-fix-incorrect-test-of-supported-hash-functio.patch
+net-ena-fix-ena_com_fill_hash_function-implementatio.patch
+dmaengine-tegra210-adma-restore-channel-status.patch
+watchdog-rtd119x_wdt-fix-remove-function.patch
+mmc-core-fix-possible-use-after-free-of-host.patch
+lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch
+ath10k-fix-encoding-for-protected-management-frames.patch
+afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch
+vfio-mdev-avoid-release-parent-reference-during-erro.patch
+vfio-mdev-follow-correct-remove-sequence.patch
+vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch
+l2tp-fix-possible-null-pointer-dereference.patch
+alsa-aica-fix-a-long-time-build-breakage.patch
+media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
+media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
+platform-x86-alienware-wmi-printing-the-wrong-error-.patch
+crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch
+netfilter-ebtables-config_compat-reject-trailing-dat.patch
+pwm-meson-consider-128-a-valid-pre-divider.patch
+pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
+arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
+nfp-bpf-fix-static-check-error-through-tightening-sh.patch
+kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
+netfilter-nf_tables-correct-nft_loglevel_max-value.patch
+backlight-lm3630a-return-0-on-success-in-update_stat.patch
+thermal-rcar_gen3_thermal-fix-interrupt-type.patch
+thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
+edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch
+afs-fix-key-leak-in-afs_release-and-afs_evict_inode.patch
+afs-don-t-invalidate-callback-if-afs_vnode_dir_valid.patch
+afs-fix-lock-wait-callback-break-double-locking.patch
+afs-fix-double-inc-of-vnode-cb_break.patch
+arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch
+clk-meson-gxbb-no-spread-spectrum-on-mpll0.patch
+clk-meson-axg-spread-spectrum-is-on-mpll2.patch
+dmaengine-tegra210-adma-fix-crash-during-probe.patch
+arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch
+rdma-qedr-fix-incorrect-device-rate.patch
+spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
+crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
+crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch
+serial-stm32-fix-word-length-configuration.patch
+serial-stm32-fix-rx-error-handling.patch
+serial-stm32-fix-rx-data-length-when-parity-enabled.patch
+serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
+serial-stm32-add-support-of-tc-bit-status-check.patch
+serial-stm32-fix-wakeup-source-initialization.patch
+misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
+pci-pm-avoid-possible-suspend-to-idle-issue.patch
+iommu-add-missing-new-line-for-dma-type.patch
+iommu-use-right-function-to-get-group-for-device.patch
+signal-bpfilter-fix-bpfilter_kernl-to-use-send_sig-n.patch
+signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
+inet-frags-call-inet_frags_fini-after-unregister_per.patch
+net-hns3-fix-a-memory-leak-issue-for-hclge_map_unmap.patch
+media-staging-media-release-the-correct-resource-in-.patch
+crypto-talitos-fix-aead-processing.patch
+netvsc-unshare-skb-in-vf-rx-handler.patch
+net-core-support-xdp-generic-on-stacked-devices.patch
+rdma-uverbs-check-for-allocation-failure-in-uapi_add.patch
+net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch
+phy-qcom-qusb2-fix-missing-assignment-of-ret-when-ca.patch
+cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch
+cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch
+clk-sunxi-ng-sun50i-h6-r-fix-incorrect-w1-clock-gate.patch
+media-vivid-fix-incorrect-assignment-operation-when-.patch
+crypto-inside-secure-fix-zeroing-of-the-request-in-a.patch
+crypto-inside-secure-fix-queued-len-computation.patch
+arm64-dts-renesas-ebisu-remove-renesas-no-ether-link.patch
+mpls-fix-warning-with-multi-label-encap.patch
+serial-stm32-fix-a-recursive-locking-in-stm32_config.patch
+arm64-dts-meson-gxm-khadas-vim2-fix-gpio-keys-polled.patch
+arm64-dts-meson-gxm-khadas-vim2-fix-bluetooth-suppor.patch
+iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch
+phy-usb-phy-brcm-usb-remove-sysfs-attributes-upon-dr.patch
+firmware-arm_scmi-fix-bitfield-definitions-for-senso.patch
+firmware-arm_scmi-update-rate_discrete-in-clock_desc.patch
+ntb_hw_switchtec-potential-shift-wrapping-bug-in-swi.patch
+asoc-meson-axg-tdmin-right_j-is-not-supported.patch
+asoc-meson-axg-tdmout-right_j-is-not-supported.patch
+pci-pm-skip-devices-in-d0-for-suspend-to-idle.patch
+qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch
+qed-iwarp-fix-uninitialized-callback.patch
+powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
+powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
+bpf-fix-the-check-that-forwarding-is-enabled-in-bpf_.patch
+ib-hfi1-handle-port-down-properly-in-pio.patch
+drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
+net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
+net-udp_gso-allow-tx-timestamp-with-udp-gso.patch
+net-af_iucv-build-proper-skbs-for-hipertransport.patch
+net-af_iucv-always-register-net_device-notifier.patch
+asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
+rtc-pcf8563-fix-interrupt-trigger-method.patch
+rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
+arm-dts-iwg20d-q7-common-fix-sdhi1-vccq-regularor.patch
+net-sched-cbs-fix-error-path-of-cbs_module_init.patch
+arm64-dts-allwinner-h6-pine-h64-add-interrupt-line-f.patch
+drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
+ip6_fib-don-t-discard-nodes-with-valid-routing-infor.patch
+perf-ioctl-add-check-for-the-sample_period-value.patch
+dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
+clk-qcom-fix-wunused-const-variable.patch
+nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch
+nvmem-imx-ocotp-change-timing-calculation-to-u-boot-.patch
+tools-bpftool-use-correct-argument-in-cgroup-errors.patch
+backlight-pwm_bl-fix-heuristic-to-determine-number-o.patch
+fork-memcg-alloc_thread_stack_node-needs-to-set-tsk-.patch
+bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch
+bnxt_en-suppress-error-messages-when-querying-dscp-d.patch
+iommu-amd-make-iommu_disable-safer.patch
+mfd-intel-lpss-release-ida-resources.patch
+rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
+xprtrdma-fix-use-after-free-in-rpcrdma_post_recvs.patch
+um-fix-irq-controller-regression-on-console-read.patch
+pm-acpi-pci-resume-all-devices-during-hibernation.patch
+acpi-pm-simplify-and-fix-pm-domain-hibernation-callb.patch
+acpi-pm-introduce-poweroff-callbacks-for-acpi-pm-dom.patch
+fsi-core-fix-error-paths-on-cfam-init.patch
+devres-allow-const-resource-arguments.patch
+fsi-sbefifo-don-t-fail-operations-when-in-sbe-ipl-st.patch
+rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
+pci-mobiveil-remove-the-flag-msi_flag_multi_pci_msi.patch
+pci-mobiveil-fix-devfn-check-in-mobiveil_pcie_valid_.patch
+pci-mobiveil-fix-the-valid-check-for-inbound-and-out.patch
+ceph-fix-ceph.dir.rctime-vxattr-value.patch
+net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
+net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
+x86-pgtable-32-fix-lowmem_pages-constant.patch
+xdp-fix-possible-cq-entry-leak.patch
+arm-stm32-use-depends-on-instead-of-if-after-prompt.patch
+scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
+xfrm-interface-ifname-may-be-wrong-in-logs.patch
+drm-panel-make-drm_panel.h-self-contained.patch
+clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch
+pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch
+libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
+qed-reduce-maximum-stack-frame-size.patch
+usb-host-xhci-hub-fix-extra-endianness-conversion.patch
+media-rcar-vin-clean-up-correct-notifier-in-error-pa.patch
+mic-avoid-statically-declaring-a-struct-device.patch
+x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
+crypto-ccp-reduce-maximum-stack-usage.patch
+alsa-aoa-onyx-always-initialize-register-read-value.patch
+arm64-dts-renesas-r8a77995-fix-register-range-of-dis.patch
+tipc-reduce-risk-of-wakeup-queue-starvation.patch
+arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch
+net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
+cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
+iio-tsl2772-use-devm_add_action_or_reset-for-tsl2772.patch
+net-fix-bpf_xdp_adjust_head-regression-for-generic-x.patch
+spi-bcm-qspi-fix-bspi-quad-and-dual-mode-support-whe.patch
+cxgb4-smt-add-lock-for-atomic_dec_and_test.patch
+crypto-caam-free-resources-in-case-caam_rng-registra.patch
+ext4-set-error-return-correctly-when-ext4_htree_stor.patch
+rdma-hns-bugfix-for-slab-out-of-bounds-when-unloadin.patch
+rdma-hns-bugfix-for-slab-out-of-bounds-when-loading-.patch
+asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
+asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
+asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
+net-rds-add-a-few-missing-rds_stat_names-entries.patch
+tools-bpftool-fix-arguments-for-p_err-in-do_event_pi.patch
+tools-bpftool-fix-format-strings-and-arguments-for-j.patch
+drm-rcar-du-lvds-fix-bridge_to_rcar_lvds.patch
+bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch
+signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
+powerpc-64s-radix-fix-memory-hot-unplug-page-table-s.patch
+asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
+dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
+rtc-rv3029-revert-error-handling-patch-to-rv3029_eep.patch
+mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
+i40e-reduce-stack-usage-in-i40e_set_fc.patch
+media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch
+arm-8896-1-vdso-don-t-leak-kernel-addresses.patch
+rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch
+mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
+media-em28xx-fix-exception-handling-in-em28xx_alloc_.patch
+iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch
+ahci-do-not-export-local-variable-ahci_em_messages.patch
+rxrpc-fix-lack-of-conn-cleanup-when-local-endpoint-i.patch
+partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
+hwmon-lm75-fix-write-operations-for-negative-tempera.patch
+net-sched-cbs-set-default-link-speed-to-10-mbps-in-c.patch
+power-supply-init-device-wakeup-after-device_add.patch
+x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
+staging-greybus-light-fix-a-couple-double-frees.patch
+irqdomain-add-the-missing-assignment-of-domain-fwnod.patch
+bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
+usb-typec-tps6598x-fix-build-error-without-config_re.patch
+bcache-fix-an-error-code-in-bch_dump_read.patch
+iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
+netfilter-ctnetlink-honor-ips_offload-flag.patch
+ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
+wcn36xx-use-dynamic-allocation-for-large-variables.patch
+tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch
+arm-dts-aspeed-g5-fixe-gpio-ranges-upper-limit.patch
+xsk-avoid-store-tearing-when-assigning-queues.patch
+xsk-avoid-store-tearing-when-assigning-umem.patch
+led-triggers-fix-dereferencing-of-null-pointer.patch
+net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
+net-hns3-fix-error-vf-index-when-setting-vlan-offloa.patch
+rtlwifi-fix-file-release-memory-leak.patch
+arm-dts-logicpd-som-lv-fix-i2c2-and-i2c3-pin-mux.patch
+f2fs-fix-wrong-error-injection-path-in-inc_valid_blo.patch
+f2fs-fix-error-path-of-f2fs_convert_inline_page.patch
+scsi-fnic-fix-msix-interrupt-allocation.patch
+btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
+btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch
+btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch
+btrfs-use-correct-count-in-btrfs_file_write_iter.patch
+ixgbe-sync-the-first-fragment-unconditionally.patch
+hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
+net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
+pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch
+gpio-aspeed-fix-incorrect-number-of-banks.patch
+ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch
+rdma-cma-fix-false-error-message.patch
+net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
+um-fix-off-by-one-error-in-irq-enumeration.patch
+bnxt_en-increase-timeout-for-hwrm_dbg_coredump_xx-co.patch
+f2fs-fix-to-avoid-accessing-uninitialized-field-of-i.patch
+mailbox-qcom-apcs-fix-max_register-value.patch
+clk-actions-fix-factor-clk-struct-member-access.patch
+powerpc-mm-mce-keep-irqs-disabled-during-lockless-pa.patch
+bpf-fix-btf-limits.patch
+crypto-hisilicon-matching-the-dma-address-for-dma_po.patch
+iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
+net-aquantia-fix-aq_vec_isr_legacy-return-value.patch
+cxgb4-signedness-bug-in-init_one.patch
+net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
+net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
+net-netsec-fix-signedness-bug-in-netsec_probe.patch
+net-socionext-fix-a-signedness-bug-in-ave_probe.patch
+net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
+net-axienet-fix-a-signedness-bug-in-probe.patch
+of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
+net-nixge-fix-a-signedness-bug-in-nixge_probe.patch
+net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
+net-sched-cbs-avoid-division-by-zero-when-calculatin.patch
+nvme-retain-split-access-workaround-for-capability-r.patch
+net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
+rxrpc-fix-trace-after-put-looking-at-the-put-connect.patch
+mac80211-accept-deauth-frames-in-ibss-mode.patch
+llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
+llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
+ip6erspan-remove-the-incorrect-mtu-limit-for-ip6ersp.patch
+net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
+net-stmmac-fix-disabling-flexible-pps-output.patch
+sctp-add-chunks-to-sk_backlog-when-the-newsk-sk_sock.patch
+s390-qeth-fix-error-handling-during-vnicc-initializa.patch
+s390-qeth-fix-initialization-of-vnicc-cmd-masks-duri.patch
+act_mirred-fix-mirred_init_module-error-handling.patch
+net-avoid-possible-false-sharing-in-sk_leave_memory_.patch
+net-add-read-write-_once-annotations-on-rskq_accept_.patch
+tcp-annotate-lockless-access-to-tcp_memory_pressure.patch
+net-smc-receive-returns-without-data.patch
+net-smc-receive-pending-data-after-rcv_shutdown.patch
+drm-msm-dsi-implement-reset-correctly.patch
+vhost-test-stop-device-before-reset.patch
+dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
+firmware-dmi-fix-unlikely-out-of-bounds-read-in-save.patch
+arm64-hibernate-check-pgd-table-allocation.patch
+net-netem-fix-error-path-for-corrupted-gso-frames.patch
+net-netem-correct-the-parent-s-backlog-when-corrupte.patch
+xsk-fix-registration-of-rx-only-sockets.patch
+bpf-offload-unlock-on-error-in-bpf_offload_dev_creat.patch
+afs-fix-missing-timeout-reset.patch
+net-qca_spi-move-reset_count-to-struct-qcaspi.patch
+hv_netvsc-fix-offset-usage-in-netvsc_send_table.patch
+hv_netvsc-fix-send_table-offset-in-case-of-a-host-bu.patch
+afs-fix-large-file-support.patch
+drm-panel-lvds-potential-oops-in-probe-error-handlin.patch
+hwrng-omap3-rom-fix-missing-clock-by-probing-with-de.patch
+dpaa_eth-perform-dma-unmapping-before-read.patch
+dpaa_eth-avoid-timestamp-read-on-error-paths.patch
+mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
+hv_netvsc-flag-software-created-hash-value.patch
+net-neigh-use-long-type-to-store-jiffies-delta.patch
+packet-fix-data-race-in-fanout_flow_is_huge.patch
+i2c-stm32f7-report-dma-error-during-probe.patch
+mmc-sdio-fix-wl1251-vendor-id.patch
+mmc-core-fix-wl1251-sdio-quirks.patch
+affs-fix-a-memory-leak-in-affs_remount.patch
+afs-remove-set-but-not-used-variables-before-after.patch
+dmaengine-ti-edma-fix-missed-failure-handling.patch
+drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
+arm64-dts-juno-fix-uart-frequency.patch
+samples-bpf-fix-broken-xdp_rxq_info-due-to-map-order.patch
+usb-dwc3-allow-building-usb_dwc3_qcom-without-extcon.patch
+ib-iser-fix-dma_nents-type-definition.patch
+serial-stm32-fix-clearing-interrupt-error-flags.patch
+arm64-dts-meson-gxm-khadas-vim2-fix-uart_a-bluetooth.patch
+m68k-call-timer_interrupt-with-interrupts-disabled.patch
diff --git a/queue-4.19/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch b/queue-4.19/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
new file mode 100644
index 00000000000..fb933e4761c
--- /dev/null
+++ b/queue-4.19/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
@@ -0,0 +1,136 @@
+From 49c822cf3fd3331fbabab36886f033ed7e05faea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 12:33:54 -0500
+Subject: signal: Allow cifs and drbd to receive their terminating signals
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
+
+My recent to change to only use force_sig for a synchronous events
+wound up breaking signal reception cifs and drbd.  I had overlooked
+the fact that by default kthreads start out with all signals set to
+SIG_IGN.  So a change I thought was safe turned out to have made it
+impossible for those kernel thread to catch their signals.
+
+Reverting the work on force_sig is a bad idea because what the code
+was doing was very much a misuse of force_sig.  As the way force_sig
+ultimately allowed the signal to happen was to change the signal
+handler to SIG_DFL.  Which after the first signal will allow userspace
+to send signals to these kernel threads.  At least for
+wake_ack_receiver in drbd that does not appear actively wrong.
+
+So correct this problem by adding allow_kernel_signal that will allow
+signals whose siginfo reports they were sent by the kernel through,
+but will not allow userspace generated signals, and update cifs and
+drbd to call allow_kernel_signal in an appropriate place so that their
+thread can receive this signal.
+
+Fixing things this way ensures that userspace won't be able to send
+signals and cause problems, that it is clear which signals the
+threads are expecting to receive, and it guarantees that nothing
+else in the system will be affected.
+
+This change was partly inspired by similar cifs and drbd patches that
+added allow_signal.
+
+Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
+Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
+Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c |  2 ++
+ fs/cifs/connect.c              |  2 +-
+ include/linux/signal.h         | 15 ++++++++++++++-
+ kernel/signal.c                |  5 +++++
+ 4 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index a49a8d91a5990..5e3885f5729b0 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -334,6 +334,8 @@ static int drbd_thread_setup(void *arg)
+ 		 thi->name[0],
+ 		 resource->name);
+ 
++	allow_kernel_signal(DRBD_SIGKILL);
++	allow_kernel_signal(SIGXCPU);
+ restart:
+ 	retval = thi->function(thi);
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index a8790bf04e95d..576cf71576da1 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -970,7 +970,7 @@ cifs_demultiplex_thread(void *p)
+ 		mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+ 
+ 	set_freezable();
+-	allow_signal(SIGKILL);
++	allow_kernel_signal(SIGKILL);
+ 	while (server->tcpStatus != CifsExiting) {
+ 		if (try_to_freeze())
+ 			continue;
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index e4d01469ed60c..0be5ce2375cb9 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -272,6 +272,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
+ extern void exit_signals(struct task_struct *tsk);
+ extern void kernel_sigaction(int, __sighandler_t);
+ 
++#define SIG_KTHREAD ((__force __sighandler_t)2)
++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
++
+ static inline void allow_signal(int sig)
+ {
+ 	/*
+@@ -279,7 +282,17 @@ static inline void allow_signal(int sig)
+ 	 * know it'll be handled, so that they don't get converted to
+ 	 * SIGKILL or just silently dropped.
+ 	 */
+-	kernel_sigaction(sig, (__force __sighandler_t)2);
++	kernel_sigaction(sig, SIG_KTHREAD);
++}
++
++static inline void allow_kernel_signal(int sig)
++{
++	/*
++	 * Kernel threads handle their own signals. Let the signal code
++	 * know signals sent by the kernel will be handled, so that they
++	 * don't get silently dropped.
++	 */
++	kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
+ }
+ 
+ static inline void disallow_signal(int sig)
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 7278302e34850..08911bb6fe9ab 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -86,6 +86,11 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force)
+ 	    handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ 		return true;
+ 
++	/* Only allow kernel generated signals to this kthread */
++	if (unlikely((t->flags & PF_KTHREAD) &&
++		     (handler == SIG_KTHREAD_KERNEL) && !force))
++		return true;
++
+ 	return sig_handler_ignored(handler, sig);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/signal-bpfilter-fix-bpfilter_kernl-to-use-send_sig-n.patch b/queue-4.19/signal-bpfilter-fix-bpfilter_kernl-to-use-send_sig-n.patch
new file mode 100644
index 00000000000..bcce7e9208b
--- /dev/null
+++ b/queue-4.19/signal-bpfilter-fix-bpfilter_kernl-to-use-send_sig-n.patch
@@ -0,0 +1,49 @@
+From fef870bd684c8fbdf2858c0274fe20b6f509d781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 12:23:03 -0500
+Subject: signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 1dfd1711de2952fd1bfeea7152bd1687a4eea771 ]
+
+The locking in force_sig_info is not prepared to deal with
+a task that exits or execs (as sighand may change).  As force_sig
+is only built to handle synchronous exceptions.
+
+Further the function force_sig_info changes the signal state if the
+signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
+delivery of the signal.  The signal SIGKILL can not be ignored and can
+not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
+delivered.
+
+So using force_sig rather than send_sig for SIGKILL is pointless.
+
+Because it won't impact the sending of the signal and and because
+using force_sig is wrong, replace force_sig with send_sig.
+
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: David S. Miller <davem@davemloft.net>
+Fixes: d2ba09c17a06 ("net: add skeleton of bpfilter kernel module")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bpfilter/bpfilter_kern.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
+index 94e88f510c5b8..450b257afa84d 100644
+--- a/net/bpfilter/bpfilter_kern.c
++++ b/net/bpfilter/bpfilter_kern.c
+@@ -25,7 +25,7 @@ static void shutdown_umh(struct umh_info *info)
+ 		return;
+ 	tsk = get_pid_task(find_vpid(info->pid), PIDTYPE_PID);
+ 	if (tsk) {
+-		force_sig(SIGKILL, tsk);
++		send_sig(SIGKILL, tsk, 1);
+ 		put_task_struct(tsk);
+ 	}
+ 	fput(info->pipe_to_umh);
+-- 
+2.20.1
+
diff --git a/queue-4.19/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch b/queue-4.19/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
new file mode 100644
index 00000000000..6155424b514
--- /dev/null
+++ b/queue-4.19/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
@@ -0,0 +1,54 @@
+From 4aa954e903ff1e4e311a35abe2f49349c3df896f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 12:33:50 -0500
+Subject: signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of
+ force_sig
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ]
+
+The locking in force_sig_info is not prepared to deal with a task that
+exits or execs (as sighand may change).  The is not a locking problem
+in force_sig as force_sig is only built to handle synchronous
+exceptions.
+
+Further the function force_sig_info changes the signal state if the
+signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
+delivery of the signal.  The signal SIGKILL can not be ignored and can
+not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
+delivered.
+
+So using force_sig rather than send_sig for SIGKILL is confusing
+and pointless.
+
+Because it won't impact the sending of the signal and and because
+using force_sig is wrong, replace force_sig with send_sig.
+
+Cc: Namjae Jeon <namjae.jeon@samsung.com>
+Cc: Jeff Layton <jlayton@primarydata.com>
+Cc: Steve French <smfrench@gmail.com>
+Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
+Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 7e85070d010f4..a59dcda075343 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2454,7 +2454,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+ 
+ 	task = xchg(&server->tsk, NULL);
+ 	if (task)
+-		force_sig(SIGKILL, task);
++		send_sig(SIGKILL, task, 1);
+ }
+ 
+ static struct TCP_Server_Info *
+-- 
+2.20.1
+
diff --git a/queue-4.19/signal-ia64-use-the-force_sig-sigsegv-.-in-ia64_rt_s.patch b/queue-4.19/signal-ia64-use-the-force_sig-sigsegv-.-in-ia64_rt_s.patch
new file mode 100644
index 00000000000..c4d12e9b60d
--- /dev/null
+++ b/queue-4.19/signal-ia64-use-the-force_sig-sigsegv-.-in-ia64_rt_s.patch
@@ -0,0 +1,64 @@
+From 30a4ce5af5cac2706bee3d518f0366f9cd740e35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Apr 2018 13:55:53 -0500
+Subject: signal/ia64: Use the force_sig(SIGSEGV,...) in ia64_rt_sigreturn
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit b92adb74adde62d9a9780ff2977d63dcb21aeaa6 ]
+
+The ia64 handling of failure to return from a signal frame has been trying
+to set overlapping fields in struct siginfo since 2.3.43.  The si_code
+corresponds to the fields that were stomped (not the field that is
+actually written), so I can not imagine a piece of userspace code
+making sense of the signal frame if it looks closely.
+
+In practice failure to return from a signal frame is a rare event that
+almost never happens.  Someone using an alternate signal stack to
+recover and looking in detail is even more rare.  So I presume no one
+has ever noticed and reported this ia64 nonsense.
+
+Sort this out by causing ia64 to use force_sig(SIGSEGV) like other architectures.
+
+Fixes: 2.3.43
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: linux-ia64@vger.kernel.org
+Acked-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/signal.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
+index 01fc133b2e4c8..9a960829a01d9 100644
+--- a/arch/ia64/kernel/signal.c
++++ b/arch/ia64/kernel/signal.c
+@@ -110,7 +110,6 @@ ia64_rt_sigreturn (struct sigscratch *scr)
+ {
+ 	extern char ia64_strace_leave_kernel, ia64_leave_kernel;
+ 	struct sigcontext __user *sc;
+-	struct siginfo si;
+ 	sigset_t set;
+ 	long retval;
+ 
+@@ -153,14 +152,7 @@ ia64_rt_sigreturn (struct sigscratch *scr)
+ 	return retval;
+ 
+   give_sigsegv:
+-	clear_siginfo(&si);
+-	si.si_signo = SIGSEGV;
+-	si.si_errno = 0;
+-	si.si_code = SI_KERNEL;
+-	si.si_pid = task_pid_vnr(current);
+-	si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
+-	si.si_addr = sc;
+-	force_sig_info(SIGSEGV, &si, current);
++	force_sig(SIGSEGV, current);
+ 	return retval;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/signal-ia64-use-the-generic-force_sigsegv-in-setup_f.patch b/queue-4.19/signal-ia64-use-the-generic-force_sigsegv-in-setup_f.patch
new file mode 100644
index 00000000000..81ca89a887d
--- /dev/null
+++ b/queue-4.19/signal-ia64-use-the-generic-force_sigsegv-in-setup_f.patch
@@ -0,0 +1,122 @@
+From 386f1bacd3b01aef85333d68c7f5d768324160f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Apr 2018 13:55:06 -0500
+Subject: signal/ia64: Use the generic force_sigsegv in setup_frame
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 8b9c6b28312cc51a87055e292b11c5aa28f0c935 ]
+
+The ia64 handling of failure to setup a signal frame has been trying
+to set overlapping fields in struct siginfo since 2.3.43.  The si_pid
+and si_uid fields are stomped when the si_addr field is set.  The
+si_code of SI_KERNEL indicates that si_pid and si_uid should be valid,
+and that si_addr does not exist.
+
+Being at odds with the definition of SI_KERNEL and with nothing to
+indicate that this was a signal frame setup failure there is no way
+for userspace to know that si_addr was filled out instead.
+
+In practice failure to setup a signal frame is rare, and si_pid and
+si_uid are always set to 0 when si_code is SI_KERNEL so I expect no
+one has looked closely enough before to see this weirdness.  Further
+the only difference between force_sigsegv_info and the generic
+force_sigsegv other than the return code is that force_sigsegv_info
+stomps the si_uid and si_pid fields.
+
+Remove the bug and simplify the code by using force_sigsegv in this
+case just like other architectures.
+
+Fixes: 2.3.43
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: linux-ia64@vger.kernel.org
+Acked-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/signal.c | 50 ++++++++++-----------------------------
+ 1 file changed, 12 insertions(+), 38 deletions(-)
+
+diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
+index d1234a5ba4c55..01fc133b2e4c8 100644
+--- a/arch/ia64/kernel/signal.c
++++ b/arch/ia64/kernel/signal.c
+@@ -231,37 +231,6 @@ rbs_on_sig_stack (unsigned long bsp)
+ 	return (bsp - current->sas_ss_sp < current->sas_ss_size);
+ }
+ 
+-static long
+-force_sigsegv_info (int sig, void __user *addr)
+-{
+-	unsigned long flags;
+-	struct siginfo si;
+-
+-	clear_siginfo(&si);
+-	if (sig == SIGSEGV) {
+-		/*
+-		 * Acquiring siglock around the sa_handler-update is almost
+-		 * certainly overkill, but this isn't a
+-		 * performance-critical path and I'd rather play it safe
+-		 * here than having to debug a nasty race if and when
+-		 * something changes in kernel/signal.c that would make it
+-		 * no longer safe to modify sa_handler without holding the
+-		 * lock.
+-		 */
+-		spin_lock_irqsave(&current->sighand->siglock, flags);
+-		current->sighand->action[sig - 1].sa.sa_handler = SIG_DFL;
+-		spin_unlock_irqrestore(&current->sighand->siglock, flags);
+-	}
+-	si.si_signo = SIGSEGV;
+-	si.si_errno = 0;
+-	si.si_code = SI_KERNEL;
+-	si.si_pid = task_pid_vnr(current);
+-	si.si_uid = from_kuid_munged(current_user_ns(), current_uid());
+-	si.si_addr = addr;
+-	force_sig_info(SIGSEGV, &si, current);
+-	return 1;
+-}
+-
+ static long
+ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
+ {
+@@ -295,15 +264,18 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
+ 			 * instead so we will die with SIGSEGV.
+ 			 */
+ 			check_sp = (new_sp - sizeof(*frame)) & -STACK_ALIGN;
+-			if (!likely(on_sig_stack(check_sp)))
+-				return force_sigsegv_info(ksig->sig, (void __user *)
+-							  check_sp);
++			if (!likely(on_sig_stack(check_sp))) {
++				force_sigsegv(ksig->sig, current);
++				return 1;
++			}
+ 		}
+ 	}
+ 	frame = (void __user *) ((new_sp - sizeof(*frame)) & -STACK_ALIGN);
+ 
+-	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
+-		return force_sigsegv_info(ksig->sig, frame);
++	if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame))) {
++		force_sigsegv(ksig->sig, current);
++		return 1;
++	}
+ 
+ 	err  = __put_user(ksig->sig, &frame->arg0);
+ 	err |= __put_user(&frame->info, &frame->arg1);
+@@ -317,8 +289,10 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct sigscratch *scr)
+ 	err |= __save_altstack(&frame->sc.sc_stack, scr->pt.r12);
+ 	err |= setup_sigcontext(&frame->sc, set, scr);
+ 
+-	if (unlikely(err))
+-		return force_sigsegv_info(ksig->sig, frame);
++	if (unlikely(err)) {
++		force_sigsegv(ksig->sig, current);
++		return 1;
++	}
+ 
+ 	scr->pt.r12 = (unsigned long) frame - 16;	/* new stack pointer */
+ 	scr->pt.ar_fpsr = FPSR_DEFAULT;			/* reset fpsr for signal handler */
+-- 
+2.20.1
+
diff --git a/queue-4.19/soc-amlogic-gx-socinfo-add-mask-for-each-soc-package.patch b/queue-4.19/soc-amlogic-gx-socinfo-add-mask-for-each-soc-package.patch
new file mode 100644
index 00000000000..6252a842829
--- /dev/null
+++ b/queue-4.19/soc-amlogic-gx-socinfo-add-mask-for-each-soc-package.patch
@@ -0,0 +1,95 @@
+From ed8a6c1d423eda40122a2759e1d8ab075aca2ab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 15:01:45 +0100
+Subject: soc: amlogic: gx-socinfo: Add mask for each SoC packages
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit dce47aed20c7de3ee2011b7a63e67f08e9dcfb5e ]
+
+When updated IDs on f842c41adc04 ("amlogic: meson-gx-socinfo: Update soc ids")
+we introduced packages ids using the full 8bit value, but in the function
+socinfo_to_package_id() the id was filtered with the 0xf0 mask.
+
+While the 0xf0 mask is valid for most board, it filters out the lower
+4 bits which encodes some characteristics of the chip.
+
+This patch moves the mask into the meson_gx_package_id table to be applied
+on each package name independently and add the correct mask for some
+specific entries.
+
+An example is the S905, in the vendor code the S905 is package_id
+different from 0x20, and S905M is exactly 0x20.
+
+Another example are the The Wetek Hub & Play2 boards using a S905-H
+variant, which is the S905 SoC with some licence bits enabled.
+These licence bits are encoded in the lower 4bits, so to detect
+the -H variant, we must detect the id == 0x3 with the 0xf mask.
+
+Fixes: f842c41adc04 ("amlogic: meson-gx-socinfo: Update soc ids")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/amlogic/meson-gx-socinfo.c | 32 ++++++++++++++------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/soc/amlogic/meson-gx-socinfo.c b/drivers/soc/amlogic/meson-gx-socinfo.c
+index 37ea0a1c24c82..1ae339f5eadbd 100644
+--- a/drivers/soc/amlogic/meson-gx-socinfo.c
++++ b/drivers/soc/amlogic/meson-gx-socinfo.c
+@@ -43,20 +43,21 @@ static const struct meson_gx_package_id {
+ 	const char *name;
+ 	unsigned int major_id;
+ 	unsigned int pack_id;
++	unsigned int pack_mask;
+ } soc_packages[] = {
+-	{ "S905", 0x1f, 0 },
+-	{ "S905H", 0x1f, 0x13 },
+-	{ "S905M", 0x1f, 0x20 },
+-	{ "S905D", 0x21, 0 },
+-	{ "S905X", 0x21, 0x80 },
+-	{ "S905W", 0x21, 0xa0 },
+-	{ "S905L", 0x21, 0xc0 },
+-	{ "S905M2", 0x21, 0xe0 },
+-	{ "S912", 0x22, 0 },
+-	{ "962X", 0x24, 0x10 },
+-	{ "962E", 0x24, 0x20 },
+-	{ "A113X", 0x25, 0x37 },
+-	{ "A113D", 0x25, 0x22 },
++	{ "S905", 0x1f, 0, 0x20 }, /* pack_id != 0x20 */
++	{ "S905H", 0x1f, 0x3, 0xf }, /* pack_id & 0xf == 0x3 */
++	{ "S905M", 0x1f, 0x20, 0xf0 }, /* pack_id == 0x20 */
++	{ "S905D", 0x21, 0, 0xf0 },
++	{ "S905X", 0x21, 0x80, 0xf0 },
++	{ "S905W", 0x21, 0xa0, 0xf0 },
++	{ "S905L", 0x21, 0xc0, 0xf0 },
++	{ "S905M2", 0x21, 0xe0, 0xf0 },
++	{ "S912", 0x22, 0, 0x0 }, /* Only S912 is known for GXM */
++	{ "962X", 0x24, 0x10, 0xf0 },
++	{ "962E", 0x24, 0x20, 0xf0 },
++	{ "A113X", 0x25, 0x37, 0xff },
++	{ "A113D", 0x25, 0x22, 0xff },
+ };
+ 
+ static inline unsigned int socinfo_to_major(u32 socinfo)
+@@ -81,13 +82,14 @@ static inline unsigned int socinfo_to_misc(u32 socinfo)
+ 
+ static const char *socinfo_to_package_id(u32 socinfo)
+ {
+-	unsigned int pack = socinfo_to_pack(socinfo) & 0xf0;
++	unsigned int pack = socinfo_to_pack(socinfo);
+ 	unsigned int major = socinfo_to_major(socinfo);
+ 	int i;
+ 
+ 	for (i = 0 ; i < ARRAY_SIZE(soc_packages) ; ++i) {
+ 		if (soc_packages[i].major_id == major &&
+-		    soc_packages[i].pack_id == pack)
++		    soc_packages[i].pack_id ==
++				(pack & soc_packages[i].pack_mask))
+ 			return soc_packages[i].name;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/soc-amlogic-meson-gx-pwrc-vpu-fix-power-on-off-regis.patch b/queue-4.19/soc-amlogic-meson-gx-pwrc-vpu-fix-power-on-off-regis.patch
new file mode 100644
index 00000000000..7e108a571b2
--- /dev/null
+++ b/queue-4.19/soc-amlogic-meson-gx-pwrc-vpu-fix-power-on-off-regis.patch
@@ -0,0 +1,59 @@
+From 804bc5973aa307836f985f313515b2f63bfbd806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 09:48:01 +0200
+Subject: soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 2fe3b4bbc93ec30a173ebae7d2b8c530416df3af ]
+
+The register bitmask to power on/off the VPU memories was incorectly set
+to 0x2 instead of 0x3. While still working, let's use the recommended
+vendor value instead.
+
+Fixes: 75fcb5ca4b46 ("soc: amlogic: add Meson GX VPU Domains driver")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/amlogic/meson-gx-pwrc-vpu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soc/amlogic/meson-gx-pwrc-vpu.c b/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
+index 6289965c42e98..05421d029dff9 100644
+--- a/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
++++ b/drivers/soc/amlogic/meson-gx-pwrc-vpu.c
+@@ -54,12 +54,12 @@ static int meson_gx_pwrc_vpu_power_off(struct generic_pm_domain *genpd)
+ 	/* Power Down Memories */
+ 	for (i = 0; i < 32; i += 2) {
+ 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG0,
+-				   0x2 << i, 0x3 << i);
++				   0x3 << i, 0x3 << i);
+ 		udelay(5);
+ 	}
+ 	for (i = 0; i < 32; i += 2) {
+ 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG1,
+-				   0x2 << i, 0x3 << i);
++				   0x3 << i, 0x3 << i);
+ 		udelay(5);
+ 	}
+ 	for (i = 8; i < 16; i++) {
+@@ -108,13 +108,13 @@ static int meson_gx_pwrc_vpu_power_on(struct generic_pm_domain *genpd)
+ 	/* Power Up Memories */
+ 	for (i = 0; i < 32; i += 2) {
+ 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG0,
+-				   0x2 << i, 0);
++				   0x3 << i, 0);
+ 		udelay(5);
+ 	}
+ 
+ 	for (i = 0; i < 32; i += 2) {
+ 		regmap_update_bits(pd->regmap_hhi, HHI_VPU_MEM_PD_REG1,
+-				   0x2 << i, 0);
++				   0x3 << i, 0);
+ 		udelay(5);
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch b/queue-4.19/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
new file mode 100644
index 00000000000..43e286f0f4c
--- /dev/null
+++ b/queue-4.19/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
@@ -0,0 +1,38 @@
+From 1f586fe90e8e350584bafd7bddff3b9a96d56444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2019 17:18:41 +0300
+Subject: soc/fsl/qe: Fix an error code in qe_pin_request()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]
+
+We forgot to set "err" on this error path.
+
+Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
+index 819bed0f56679..51b3a47b5a559 100644
+--- a/drivers/soc/fsl/qe/gpio.c
++++ b/drivers/soc/fsl/qe/gpio.c
+@@ -179,8 +179,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
+ 	if (err < 0)
+ 		goto err0;
+ 	gc = gpio_to_chip(err);
+-	if (WARN_ON(!gc))
++	if (WARN_ON(!gc)) {
++		err = -ENODEV;
+ 		goto err0;
++	}
+ 
+ 	if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
+ 		pr_debug("%s: tried to get a non-qe pin\n", __func__);
+-- 
+2.20.1
+
diff --git a/queue-4.19/soc-qcom-cmd-db-fix-an-error-code-in-cmd_db_dev_prob.patch b/queue-4.19/soc-qcom-cmd-db-fix-an-error-code-in-cmd_db_dev_prob.patch
new file mode 100644
index 00000000000..df813772be7
--- /dev/null
+++ b/queue-4.19/soc-qcom-cmd-db-fix-an-error-code-in-cmd_db_dev_prob.patch
@@ -0,0 +1,40 @@
+From 096f99fa89b94670afb064dd747c109df1c2b933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 08:48:49 +0300
+Subject: soc: qcom: cmd-db: Fix an error code in cmd_db_dev_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 93b260528020792032e50725383f27a27897bb0f ]
+
+The memremap() function doesn't return error pointers, it returns NULL.
+This code is returning "ret = PTR_ERR(NULL);" which is success, but it
+should return -ENOMEM.
+
+Fixes: 312416d9171a ("drivers: qcom: add command DB driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/cmd-db.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c
+index a6f646295f067..78d73ec587e11 100644
+--- a/drivers/soc/qcom/cmd-db.c
++++ b/drivers/soc/qcom/cmd-db.c
+@@ -283,8 +283,8 @@ static int cmd_db_dev_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	cmd_db_header = memremap(rmem->base, rmem->size, MEMREMAP_WB);
+-	if (IS_ERR_OR_NULL(cmd_db_header)) {
+-		ret = PTR_ERR(cmd_db_header);
++	if (!cmd_db_header) {
++		ret = -ENOMEM;
+ 		cmd_db_header = NULL;
+ 		return ret;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-bcm-qspi-fix-bspi-quad-and-dual-mode-support-whe.patch b/queue-4.19/spi-bcm-qspi-fix-bspi-quad-and-dual-mode-support-whe.patch
new file mode 100644
index 00000000000..0e8b16c88d1
--- /dev/null
+++ b/queue-4.19/spi-bcm-qspi-fix-bspi-quad-and-dual-mode-support-whe.patch
@@ -0,0 +1,49 @@
+From 95293e5807b7cf9557d07e9029a88dcd087d15ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2019 15:37:50 +0530
+Subject: spi: bcm-qspi: Fix BSPI QUAD and DUAL mode support when using flex
+ mode
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 79629d0f7ce5b38515c1716911a0181f01b91102 ]
+
+Fix data transfer width settings based on DT field 'spi-rx-bus-width'
+to configure BSPI in single, dual or quad mode by using data width
+and not the command width.
+
+Fixes: 5f195ee7d830c ("spi: bcm-qspi: Implement the spi_mem interface")
+
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Link: https://lore.kernel.org/r/1565086070-28451-1-git-send-email-rayagonda.kokatanur@broadcom.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm-qspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 584bcb018a62d..285a6f463013b 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -354,7 +354,7 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi,
+ {
+ 	int bpc = 0, bpp = 0;
+ 	u8 command = op->cmd.opcode;
+-	int width  = op->cmd.buswidth ? op->cmd.buswidth : SPI_NBITS_SINGLE;
++	int width = op->data.buswidth ? op->data.buswidth : SPI_NBITS_SINGLE;
+ 	int addrlen = op->addr.nbytes;
+ 	int flex_mode = 1;
+ 
+@@ -992,7 +992,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem,
+ 	if (mspi_read)
+ 		return bcm_qspi_mspi_exec_mem_op(spi, op);
+ 
+-	ret = bcm_qspi_bspi_set_mode(qspi, op, -1);
++	ret = bcm_qspi_bspi_set_mode(qspi, op, 0);
+ 
+ 	if (!ret)
+ 		ret = bcm_qspi_bspi_exec_mem_op(spi, op);
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch b/queue-4.19/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
new file mode 100644
index 00000000000..e1c77c5cbfd
--- /dev/null
+++ b/queue-4.19/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
@@ -0,0 +1,61 @@
+From f65a096b0be958fa754b90db049973002d159ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 09:31:02 +0000
+Subject: spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
+
+From: Martin Sperl <kernel@martin.sperl.org>
+
+[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]
+
+The original driver by default defines num_chipselects as -1.
+This actually allicates an array of 65535 entries in
+of_spi_register_master.
+
+There is a side-effect for buggy device trees that (contrary to
+dt-binding documentation) have no cs-gpio defined.
+
+This mode was never supported by the driver due to limitations
+of native cs and additional code complexity and is explicitly
+not stated to be implemented.
+
+To keep backwards compatibility with such buggy DTs we limit
+the number of chip_selects to 1, as for all practical purposes
+it is only ever realistic to use a single chip select in
+native cs mode without negative side-effects.
+
+Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index 12c1fa5b06c5b..c63ed402cf860 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, master);
+ 	master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
+ 	master->bits_per_word_mask = SPI_BPW_MASK(8);
+-	master->num_chipselect = -1;
++	/* even though the driver never officially supported native CS
++	 * allow a single native CS for legacy DT support purposes when
++	 * no cs-gpio is configured.
++	 * Known limitations for native cs are:
++	 * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
++	 *     whenever there is a transfer -  this even includes SPI_NO_CS
++	 * * SPI_CS_HIGH: is ignores - cs are always asserted low
++	 * * cs_change: cs is deasserted after each spi_transfer
++	 * * cs_delay_usec: cs is always deasserted one SCK cycle after
++	 *     a spi_transfer
++	 */
++	master->num_chipselect = 1;
+ 	master->transfer_one = bcm2835aux_spi_transfer_one;
+ 	master->handle_err = bcm2835aux_spi_handle_err;
+ 	master->prepare_message = bcm2835aux_spi_prepare_message;
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-cadence-correct-initialisation-of-runtime-pm.patch b/queue-4.19/spi-cadence-correct-initialisation-of-runtime-pm.patch
new file mode 100644
index 00000000000..99ed947426e
--- /dev/null
+++ b/queue-4.19/spi-cadence-correct-initialisation-of-runtime-pm.patch
@@ -0,0 +1,63 @@
+From 1270995e6efb5dd1a0afd3b59028827dac72caad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jan 2019 18:08:09 +0000
+Subject: spi: cadence: Correct initialisation of runtime PM
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 734882a8bf984c2ac8a57d8ac3ee53230bd0bed8 ]
+
+Currently the driver calls pm_runtime_put_autosuspend but without ever
+having done a pm_runtime_get, this causes the reference count in the pm
+runtime core to become -1. The bad reference count causes the core to
+sometimes suspend whilst an active SPI transfer is in progress.
+
+arizona spi0.1: SPI transfer timed out
+spi_master spi0: failed to transfer one message from queue
+
+The correct proceedure is to do all the initialisation that requires the
+hardware to be powered up before enabling the PM runtime, then enable
+the PM runtime having called pm_runtime_set_active to inform it that the
+hardware is currently powered up. The core will then power it down at
+it's leisure and no explicit pm_runtime_put is required.
+
+Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index 7c88f74f7f470..94cc0a152449f 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -584,11 +584,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ 		goto clk_dis_apb;
+ 	}
+ 
+-	pm_runtime_use_autosuspend(&pdev->dev);
+-	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+-	pm_runtime_set_active(&pdev->dev);
+-	pm_runtime_enable(&pdev->dev);
+-
+ 	ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+ 	if (ret < 0)
+ 		master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
+@@ -603,8 +598,10 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ 	/* SPI controller initializations */
+ 	cdns_spi_init_hw(xspi);
+ 
+-	pm_runtime_mark_last_busy(&pdev->dev);
+-	pm_runtime_put_autosuspend(&pdev->dev);
++	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_enable(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
++	pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+ 	if (irq <= 0) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch b/queue-4.19/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
new file mode 100644
index 00000000000..6e9d69a2f61
--- /dev/null
+++ b/queue-4.19/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
@@ -0,0 +1,44 @@
+From 42d52637610d4f3db788e700f4df8be5534e5854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:00:36 +0000
+Subject: spi: spi-fsl-spi: call spi_finalize_current_message() at the end
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]
+
+spi_finalize_current_message() shall be called once all
+actions are finished, otherwise the last actions might
+step over a newly started transfer.
+
+Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 8b79e36fab21c..cd784552de7f1 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -407,7 +407,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ 	}
+ 
+ 	m->status = status;
+-	spi_finalize_current_message(master);
+ 
+ 	if (status || !cs_change) {
+ 		ndelay(nsecs);
+@@ -415,6 +414,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ 	}
+ 
+ 	fsl_spi_setup_transfer(spi, NULL);
++	spi_finalize_current_message(master);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch b/queue-4.19/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
new file mode 100644
index 00000000000..309932b8d00
--- /dev/null
+++ b/queue-4.19/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
@@ -0,0 +1,38 @@
+From c23523b6dd0ccfe506f750b60e8ecda16bc5f4a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:23 -0700
+Subject: spi: tegra114: clear packed bit for unpacked mode
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]
+
+Fixes: Clear packed bit when not using packed mode.
+
+Packed bit is not cleared when not using packed mode. This results
+in transfer timeouts for the unpacked mode transfers followed by the
+packed mode transfers.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index a1888dc6a938a..fd039cab768a0 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+ 
+ 	if (tspi->is_packed)
+ 		command1 |= SPI_PACKED;
++	else
++		command1 &= ~SPI_PACKED;
+ 
+ 	command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
+ 	tspi->cur_direction = 0;
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch b/queue-4.19/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch
new file mode 100644
index 00000000000..6ec0b6a2a7b
--- /dev/null
+++ b/queue-4.19/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch
@@ -0,0 +1,135 @@
+From e07a2aae6aa1fbbb03ddc33b43f722d37c6d1ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:29 -0700
+Subject: spi: tegra114: configure dma burst size to fifo trig level
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit f4ce428c41fb22e3ed55496dded94df44cb920fa ]
+
+Fixes: Configure DMA burst size to be same as SPI TX/RX trigger levels
+to avoid mismatch.
+
+SPI FIFO trigger levels are calculated based on the transfer length.
+So this patch moves DMA slave configuration to happen before start
+of DMAs.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 52 ++++++++++++++++++++++----------------
+ 1 file changed, 30 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 5114b80084722..09cfae3abce2d 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -529,6 +529,8 @@ static int tegra_spi_start_dma_based_transfer(
+ 	u32 val;
+ 	unsigned int len;
+ 	int ret = 0;
++	u8 dma_burst;
++	struct dma_slave_config dma_sconfig = {0};
+ 
+ 	val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
+ 	tegra_spi_writel(tspi, val, SPI_DMA_BLK);
+@@ -540,12 +542,16 @@ static int tegra_spi_start_dma_based_transfer(
+ 		len = tspi->curr_dma_words * 4;
+ 
+ 	/* Set attention level based on length of transfer */
+-	if (len & 0xF)
++	if (len & 0xF) {
+ 		val |= SPI_TX_TRIG_1 | SPI_RX_TRIG_1;
+-	else if (((len) >> 4) & 0x1)
++		dma_burst = 1;
++	} else if (((len) >> 4) & 0x1) {
+ 		val |= SPI_TX_TRIG_4 | SPI_RX_TRIG_4;
+-	else
++		dma_burst = 4;
++	} else {
+ 		val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8;
++		dma_burst = 8;
++	}
+ 
+ 	if (tspi->cur_direction & DATA_DIR_TX)
+ 		val |= SPI_IE_TX;
+@@ -556,7 +562,18 @@ static int tegra_spi_start_dma_based_transfer(
+ 	tegra_spi_writel(tspi, val, SPI_DMA_CTL);
+ 	tspi->dma_control_reg = val;
+ 
++	dma_sconfig.device_fc = true;
+ 	if (tspi->cur_direction & DATA_DIR_TX) {
++		dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
++		dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++		dma_sconfig.dst_maxburst = dma_burst;
++		ret = dmaengine_slave_config(tspi->tx_dma_chan, &dma_sconfig);
++		if (ret < 0) {
++			dev_err(tspi->dev,
++				"DMA slave config failed: %d\n", ret);
++			return ret;
++		}
++
+ 		tegra_spi_copy_client_txbuf_to_spi_txbuf(tspi, t);
+ 		ret = tegra_spi_start_tx_dma(tspi, len);
+ 		if (ret < 0) {
+@@ -567,6 +584,16 @@ static int tegra_spi_start_dma_based_transfer(
+ 	}
+ 
+ 	if (tspi->cur_direction & DATA_DIR_RX) {
++		dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
++		dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++		dma_sconfig.src_maxburst = dma_burst;
++		ret = dmaengine_slave_config(tspi->rx_dma_chan, &dma_sconfig);
++		if (ret < 0) {
++			dev_err(tspi->dev,
++				"DMA slave config failed: %d\n", ret);
++			return ret;
++		}
++
+ 		/* Make the dma buffer to read by dma */
+ 		dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+ 				tspi->dma_buf_size, DMA_FROM_DEVICE);
+@@ -626,7 +653,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ 	u32 *dma_buf;
+ 	dma_addr_t dma_phys;
+ 	int ret;
+-	struct dma_slave_config dma_sconfig;
+ 
+ 	dma_chan = dma_request_slave_channel_reason(tspi->dev,
+ 					dma_to_memory ? "rx" : "tx");
+@@ -646,19 +672,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ 		return -ENOMEM;
+ 	}
+ 
+-	if (dma_to_memory) {
+-		dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
+-		dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+-		dma_sconfig.src_maxburst = 0;
+-	} else {
+-		dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
+-		dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+-		dma_sconfig.dst_maxburst = 0;
+-	}
+-
+-	ret = dmaengine_slave_config(dma_chan, &dma_sconfig);
+-	if (ret)
+-		goto scrub;
+ 	if (dma_to_memory) {
+ 		tspi->rx_dma_chan = dma_chan;
+ 		tspi->rx_dma_buf = dma_buf;
+@@ -669,11 +682,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ 		tspi->tx_dma_phys = dma_phys;
+ 	}
+ 	return 0;
+-
+-scrub:
+-	dma_free_coherent(tspi->dev, tspi->dma_buf_size, dma_buf, dma_phys);
+-	dma_release_channel(dma_chan);
+-	return ret;
+ }
+ 
+ static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi,
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-tegra114-fix-for-unpacked-mode-transfers.patch b/queue-4.19/spi-tegra114-fix-for-unpacked-mode-transfers.patch
new file mode 100644
index 00000000000..e5c5e77a6b9
--- /dev/null
+++ b/queue-4.19/spi-tegra114-fix-for-unpacked-mode-transfers.patch
@@ -0,0 +1,164 @@
+From df26a48d47018aecdc0fcb1df1609f6ce6bf1d49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:24 -0700
+Subject: spi: tegra114: fix for unpacked mode transfers
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]
+
+Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
+mode when transfer length is not a multiple of requested bits per word.
+
+unpacked mode transfers fails when the transfer includes partial bytes in
+the last word.
+
+Total words to be written/read to/from FIFO is computed based on transfer
+length and bits per word. Unpacked mode includes 0 padding bytes for partial
+words to align with bits per word and these extra bytes are also accounted
+for calculating bytes left to transfer in the current driver.
+
+This causes extra bytes access of tx/rx buffers along with buffer index
+position crossing actual length where remain_len becomes negative and due to
+unsigned type, negative value is a 32 bit representation of signed value
+and transferred bytes never meets the actual transfer length resulting in
+transfer timeout and a hang.
+
+This patch fixes this with proper computation of the actual bytes to fill in
+FIFO during transmit and the actual bytes to read from FIFO during receive
+ignoring 0 padded bytes.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index fd039cab768a0..17c2c78318f71 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ 		}
++
++		tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+ 	} else {
++		unsigned int write_bytes;
+ 		max_n_32bit = min(tspi->curr_dma_words,  tx_empty_count);
+ 		written_words = max_n_32bit;
+ 		nbytes = written_words * tspi->bytes_per_word;
++		if (nbytes > t->len - tspi->cur_pos)
++			nbytes = t->len - tspi->cur_pos;
++		write_bytes = nbytes;
+ 		for (count = 0; count < max_n_32bit; count++) {
+ 			u32 x = 0;
+ 
+@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ 		}
++
++		tspi->cur_tx_pos += write_bytes;
+ 	}
+-	tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
++
+ 	return written_words;
+ }
+ 
+@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
+ 			for (i = 0; len && (i < 4); i++, len--)
+ 				*rx_buf++ = (x >> i*8) & 0xFF;
+ 		}
+-		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 		read_words += tspi->curr_dma_words;
++		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 	} else {
+ 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++		u8 bytes_per_word = tspi->bytes_per_word;
++		unsigned int read_bytes;
+ 
++		len = rx_full_count * bytes_per_word;
++		if (len > t->len - tspi->cur_pos)
++			len = t->len - tspi->cur_pos;
++		read_bytes = len;
+ 		for (count = 0; count < rx_full_count; count++) {
+ 			u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
+ 
+-			for (i = 0; (i < tspi->bytes_per_word); i++)
++			for (i = 0; len && (i < bytes_per_word); i++, len--)
+ 				*rx_buf++ = (x >> (i*8)) & 0xFF;
+ 		}
+-		tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
+ 		read_words += rx_full_count;
++		tspi->cur_rx_pos += read_bytes;
+ 	}
++
+ 	return read_words;
+ }
+ 
+@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 		memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
++		tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 	} else {
+ 		unsigned int i;
+ 		unsigned int count;
+ 		u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
+ 		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++		unsigned int write_bytes;
+ 
++		if (consume > t->len - tspi->cur_pos)
++			consume = t->len - tspi->cur_pos;
++		write_bytes = consume;
+ 		for (count = 0; count < tspi->curr_dma_words; count++) {
+ 			u32 x = 0;
+ 
+@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ 				x |= (u32)(*tx_buf++) << (i * 8);
+ 			tspi->tx_dma_buf[count] = x;
+ 		}
++
++		tspi->cur_tx_pos += write_bytes;
+ 	}
+-	tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 	/* Make the dma buffer to read by dma */
+ 	dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
+@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
+ 		unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 		memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
++		tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 	} else {
+ 		unsigned int i;
+ 		unsigned int count;
+ 		unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
+ 		u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++		unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++		unsigned int read_bytes;
+ 
++		if (consume > t->len - tspi->cur_pos)
++			consume = t->len - tspi->cur_pos;
++		read_bytes = consume;
+ 		for (count = 0; count < tspi->curr_dma_words; count++) {
+ 			u32 x = tspi->rx_dma_buf[count] & rx_mask;
+ 
+-			for (i = 0; (i < tspi->bytes_per_word); i++)
++			for (i = 0; consume && (i < tspi->bytes_per_word);
++							i++, consume--)
+ 				*rx_buf++ = (x >> (i*8)) & 0xFF;
+ 		}
++
++		tspi->cur_rx_pos += read_bytes;
+ 	}
+-	tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ 
+ 	/* Make the dma buffer to read by dma */
+ 	dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-tegra114-flush-fifos.patch b/queue-4.19/spi-tegra114-flush-fifos.patch
new file mode 100644
index 00000000000..adfdc2d997b
--- /dev/null
+++ b/queue-4.19/spi-tegra114-flush-fifos.patch
@@ -0,0 +1,107 @@
+From aba2481f8012508c0f8eee58deb7e025ecd4e351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:28 -0700
+Subject: spi: tegra114: flush fifos
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit c4fc9e5b28ff787e35137c2cc13316bb11d7657b ]
+
+Fixes: Flush TX and RX FIFOs before start of new transfer and on FIFO
+overflow or underrun errors.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 39 +++++++++++++++++++++++++++++---------
+ 1 file changed, 30 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index b1b726673f850..5114b80084722 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -499,22 +499,37 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len)
+ 	return 0;
+ }
+ 
+-static int tegra_spi_start_dma_based_transfer(
+-		struct tegra_spi_data *tspi, struct spi_transfer *t)
++static int tegra_spi_flush_fifos(struct tegra_spi_data *tspi)
+ {
+-	u32 val;
+-	unsigned int len;
+-	int ret = 0;
++	unsigned long timeout = jiffies + HZ;
+ 	u32 status;
+ 
+-	/* Make sure that Rx and Tx fifo are empty */
+ 	status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
+ 	if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
+-		dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08x\n",
+-			(unsigned)status);
+-		return -EIO;
++		status |= SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH;
++		tegra_spi_writel(tspi, status, SPI_FIFO_STATUS);
++		while ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
++			status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
++			if (time_after(jiffies, timeout)) {
++				dev_err(tspi->dev,
++					"timeout waiting for fifo flush\n");
++				return -EIO;
++			}
++
++			udelay(1);
++		}
+ 	}
+ 
++	return 0;
++}
++
++static int tegra_spi_start_dma_based_transfer(
++		struct tegra_spi_data *tspi, struct spi_transfer *t)
++{
++	u32 val;
++	unsigned int len;
++	int ret = 0;
++
+ 	val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
+ 	tegra_spi_writel(tspi, val, SPI_DMA_BLK);
+ 
+@@ -779,6 +794,9 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+ 	dev_dbg(tspi->dev, "The def 0x%x and written 0x%x\n",
+ 		tspi->def_command1_reg, (unsigned)command1);
+ 
++	ret = tegra_spi_flush_fifos(tspi);
++	if (ret < 0)
++		return ret;
+ 	if (total_fifo_words > SPI_FIFO_DEPTH)
+ 		ret = tegra_spi_start_dma_based_transfer(tspi, t);
+ 	else
+@@ -876,6 +894,7 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
+ 			    (tspi->cur_direction & DATA_DIR_RX))
+ 				dmaengine_terminate_all(tspi->rx_dma_chan);
+ 			ret = -EIO;
++			tegra_spi_flush_fifos(tspi);
+ 			reset_control_assert(tspi->rst);
+ 			udelay(2);
+ 			reset_control_deassert(tspi->rst);
+@@ -929,6 +948,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_spi_data *tspi)
+ 			tspi->status_reg);
+ 		dev_err(tspi->dev, "CpuXfer 0x%08x:0x%08x\n",
+ 			tspi->command1_reg, tspi->dma_control_reg);
++		tegra_spi_flush_fifos(tspi);
+ 		reset_control_assert(tspi->rst);
+ 		udelay(2);
+ 		reset_control_deassert(tspi->rst);
+@@ -1001,6 +1021,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_spi_data *tspi)
+ 			tspi->status_reg);
+ 		dev_err(tspi->dev, "DmaXfer 0x%08x:0x%08x\n",
+ 			tspi->command1_reg, tspi->dma_control_reg);
++		tegra_spi_flush_fifos(tspi);
+ 		reset_control_assert(tspi->rst);
+ 		udelay(2);
+ 		reset_control_deassert(tspi->rst);
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch b/queue-4.19/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch
new file mode 100644
index 00000000000..575f570a0dd
--- /dev/null
+++ b/queue-4.19/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch
@@ -0,0 +1,43 @@
+From 37eff86c2ade05d4e5421d048d218e8aec781186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:27 -0700
+Subject: spi: tegra114: terminate dma and reset on transfer timeout
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 32bd1a9551cae34e6889afa235c7afdfede9aeac ]
+
+Fixes: terminate DMA and perform controller reset on transfer timeout
+to clear the FIFO's and errors.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 17c2c78318f71..b1b726673f850 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -869,7 +869,16 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
+ 		if (WARN_ON(ret == 0)) {
+ 			dev_err(tspi->dev,
+ 				"spi transfer timeout, err %d\n", ret);
++			if (tspi->is_curr_dma_xfer &&
++			    (tspi->cur_direction & DATA_DIR_TX))
++				dmaengine_terminate_all(tspi->tx_dma_chan);
++			if (tspi->is_curr_dma_xfer &&
++			    (tspi->cur_direction & DATA_DIR_RX))
++				dmaengine_terminate_all(tspi->rx_dma_chan);
+ 			ret = -EIO;
++			reset_control_assert(tspi->rst);
++			udelay(2);
++			reset_control_deassert(tspi->rst);
+ 			goto complete_xfer;
+ 		}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch b/queue-4.19/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch
new file mode 100644
index 00000000000..76577ea0cbb
--- /dev/null
+++ b/queue-4.19/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch
@@ -0,0 +1,47 @@
+From e46036422fa812d7e72a7e4ecb7fd34ff663d3a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 20:00:22 +0800
+Subject: spi/topcliff_pch: Fix potential NULL dereference on allocation error
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit e902cdcb5112b89ee445588147964723fd69ffb4 ]
+
+In pch_spi_handle_dma, it doesn't check for NULL returns of kcalloc
+so it would result in an Oops.
+
+Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-topcliff-pch.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 4389ab80c23e6..fa730a871d252 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 
+ 	/* RX */
+ 	dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC);
++	if (!dma->sg_rx_p)
++		return;
++
+ 	sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */
+ 	/* offset, length setting */
+ 	sg = dma->sg_rx_p;
+@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ 	}
+ 
+ 	dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC);
++	if (!dma->sg_tx_p)
++		return;
++
+ 	sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
+ 	/* offset, length setting */
+ 	sg = dma->sg_tx_p;
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-android-vsoc-fix-copy_from_user-overrun.patch b/queue-4.19/staging-android-vsoc-fix-copy_from_user-overrun.patch
new file mode 100644
index 00000000000..26321c428c9
--- /dev/null
+++ b/queue-4.19/staging-android-vsoc-fix-copy_from_user-overrun.patch
@@ -0,0 +1,43 @@
+From eedb3293a11015d3232ebd0cf50276e557225f68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Apr 2019 17:37:26 +0200
+Subject: staging: android: vsoc: fix copy_from_user overrun
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit 060ea4271a82270be6d44e8e9aefe8f155fb5626 ]
+
+The `np->permission' structure is smaller than the `np' structure but
+sizeof(*np) worth of data is copied in there. Fix the size passed to
+copy_from_user() to avoid overrun.
+
+Fixes: 3d2ec9dcd553 ("staging: Android: Add 'vsoc' driver for cuttlefish.")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/android/vsoc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/android/vsoc.c b/drivers/staging/android/vsoc.c
+index 22571abcaa4e8..034d86869772e 100644
+--- a/drivers/staging/android/vsoc.c
++++ b/drivers/staging/android/vsoc.c
+@@ -260,7 +260,8 @@ do_create_fd_scoped_permission(struct vsoc_device_region *region_p,
+ 	atomic_t *owner_ptr = NULL;
+ 	struct vsoc_device_region *managed_region_p;
+ 
+-	if (copy_from_user(&np->permission, &arg->perm, sizeof(*np)) ||
++	if (copy_from_user(&np->permission,
++			   &arg->perm, sizeof(np->permission)) ||
+ 	    copy_from_user(&managed_fd,
+ 			   &arg->managed_region_fd, sizeof(managed_fd))) {
+ 		return -EFAULT;
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch b/queue-4.19/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch
new file mode 100644
index 00000000000..eef9451faa9
--- /dev/null
+++ b/queue-4.19/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch
@@ -0,0 +1,53 @@
+From b54128512fe6e700c5be496b1b9331ece0904954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 19:28:51 +0100
+Subject: staging: bcm2835-camera: Abort probe if there is no camera
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 7566f39dfdc11f8a97d5810c6e6295a88f97ef91 ]
+
+Abort the probing of the camera driver in case there isn't a camera
+actually connected to the Raspberry Pi. This solution also avoids a
+NULL ptr dereference of mmal instance on driver unload.
+
+Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../vc04_services/bcm2835-camera/bcm2835-camera.c        | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+index 455082867246d..068e5b9ab2323 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1854,6 +1854,12 @@ static int bcm2835_mmal_probe(struct platform_device *pdev)
+ 	num_cameras = get_num_cameras(instance,
+ 				      resolutions,
+ 				      MAX_BCM2835_CAMERAS);
++
++	if (num_cameras < 1) {
++		ret = -ENODEV;
++		goto cleanup_mmal;
++	}
++
+ 	if (num_cameras > MAX_BCM2835_CAMERAS)
+ 		num_cameras = MAX_BCM2835_CAMERAS;
+ 
+@@ -1953,6 +1959,9 @@ cleanup_gdev:
+ 	pr_info("%s: error %d while loading driver\n",
+ 		BM2835_MMAL_MODULE_NAME, ret);
+ 
++cleanup_mmal:
++	vchiq_mmal_finalise(instance);
++
+ 	return ret;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-bcm2835-camera-fix-module-autoloading.patch b/queue-4.19/staging-bcm2835-camera-fix-module-autoloading.patch
new file mode 100644
index 00000000000..20639350826
--- /dev/null
+++ b/queue-4.19/staging-bcm2835-camera-fix-module-autoloading.patch
@@ -0,0 +1,37 @@
+From 21edb95f7ab14ce5e548f2e35dd3bf8e778a4579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 19:28:52 +0100
+Subject: staging: bcm2835-camera: fix module autoloading
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 3a2c20024a2b47adbf514e7f3ab79342739c3926 ]
+
+In order to make the module bcm2835-camera load automatically, we need to
+add a module alias.
+
+Fixes: 4bebb0312ea9 ("staging/bcm2835-camera: Set ourselves up as a platform driver.")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+index 068e5b9ab2323..edf25922b12d6 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -47,6 +47,7 @@ MODULE_DESCRIPTION("Broadcom 2835 MMAL video capture");
+ MODULE_AUTHOR("Vincent Sanders");
+ MODULE_LICENSE("GPL");
+ MODULE_VERSION(BM2835_MMAL_VERSION);
++MODULE_ALIAS("platform:bcm2835-camera");
+ 
+ int bcm2835_v4l2_debug;
+ module_param_named(debug, bcm2835_v4l2_debug, int, 0644);
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-comedi-ni_mio_common-protect-register-write-.patch b/queue-4.19/staging-comedi-ni_mio_common-protect-register-write-.patch
new file mode 100644
index 00000000000..ac741caf6f3
--- /dev/null
+++ b/queue-4.19/staging-comedi-ni_mio_common-protect-register-write-.patch
@@ -0,0 +1,90 @@
+From cb8c19c1b9da7291fa36637d2b1cd7eba3ecff13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:54:16 -0600
+Subject: staging: comedi: ni_mio_common: protect register write overflow
+
+From: Spencer E. Olson <olsonse@umich.edu>
+
+[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]
+
+Fixes two problems introduced as early as
+commit 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code"):
+(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
+    not unduly overwritten on e-series devices.  On e-series devices, the
+    first three of the last four bits are reserved.  The last bit defines
+    the output selection of the RGOUT0 pin, otherwise known as
+    RTSI_Sub_Selection.  For m-series devices, these last four bits are
+    indeed used as the output selection of the RTSI7 pin (and the
+    RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
+    RTSI_Trig_Direction register.
+(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
+    lines.
+
+This patch also cleans up the ni_get_rtsi_routing command for readability.
+
+Fixes: 03aef4b6dc12  ("Staging: comedi: add ni_mio_common code")
+Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/comedi/drivers/ni_mio_common.c    | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index d799b1b55de39..747518c295427 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4984,7 +4984,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ 	case NI_RTSI_OUTPUT_G_SRC0:
+ 	case NI_RTSI_OUTPUT_G_GATE0:
+ 	case NI_RTSI_OUTPUT_RGOUT0:
+-	case NI_RTSI_OUTPUT_RTSI_BRD_0:
++	case NI_RTSI_OUTPUT_RTSI_BRD(0):
++	case NI_RTSI_OUTPUT_RTSI_BRD(1):
++	case NI_RTSI_OUTPUT_RTSI_BRD(2):
++	case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ 		return 1;
+ 	case NI_RTSI_OUTPUT_RTSI_OSC:
+ 		return (devpriv->is_m_series) ? 1 : 0;
+@@ -5005,11 +5008,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ 		devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ 		ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ 			      NISTC_RTSI_TRIGA_OUT_REG);
+-	} else if (chan < 8) {
++	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ 		devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ 		devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ 		ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ 			      NISTC_RTSI_TRIGB_OUT_REG);
++	} else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++		/* probably should never reach this, since the
++		 * ni_valid_rtsi_output_source above errors out if chan is too
++		 * high
++		 */
++		dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++		return -EINVAL;
+ 	}
+ 	return 2;
+ }
+@@ -5025,12 +5035,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
+ 	} else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ 		return NISTC_RTSI_TRIG_TO_SRC(chan,
+ 					      devpriv->rtsi_trig_b_output_reg);
+-	} else {
+-		if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+-			return NI_RTSI_OUTPUT_RTSI_OSC;
+-		dev_err(dev->class_dev, "bug! should never get here?\n");
+-		return 0;
++	} else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++		return NI_RTSI_OUTPUT_RTSI_OSC;
+ 	}
++
++	dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++	return -EINVAL;
+ }
+ 
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-greybus-light-fix-a-couple-double-frees.patch b/queue-4.19/staging-greybus-light-fix-a-couple-double-frees.patch
new file mode 100644
index 00000000000..c3a3762161b
--- /dev/null
+++ b/queue-4.19/staging-greybus-light-fix-a-couple-double-frees.patch
@@ -0,0 +1,69 @@
+From 7f239b8edfa4da8ff258f2a1302cbdeeaadabaa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 15:28:39 +0300
+Subject: staging: greybus: light: fix a couple double frees
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]
+
+The problem is in gb_lights_request_handler().  If we get a request to
+change the config then we release the light with gb_lights_light_release()
+and re-allocated it.  However, if the allocation fails part way through
+then we call gb_lights_light_release() again.  This can lead to a couple
+different double frees where we haven't cleared out the original values:
+
+	gb_lights_light_v4l2_unregister(light);
+	...
+	kfree(light->channels);
+	kfree(light->name);
+
+I also made a small change to how we set "light->channels_count = 0;".
+The original code handled this part fine and did not cause a use after
+free but it was sort of complicated to read.
+
+Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/light.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
+index 010ae1e9c7fbf..40680eaf3974f 100644
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -1098,21 +1098,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
+ static void gb_lights_light_release(struct gb_light *light)
+ {
+ 	int i;
+-	int count;
+ 
+ 	light->ready = false;
+ 
+-	count = light->channels_count;
+-
+ 	if (light->has_flash)
+ 		gb_lights_light_v4l2_unregister(light);
++	light->has_flash = false;
+ 
+-	for (i = 0; i < count; i++) {
++	for (i = 0; i < light->channels_count; i++)
+ 		gb_lights_channel_release(&light->channels[i]);
+-		light->channels_count--;
+-	}
++	light->channels_count = 0;
++
+ 	kfree(light->channels);
++	light->channels = NULL;
+ 	kfree(light->name);
++	light->name = NULL;
+ }
+ 
+ static void gb_lights_release(struct gb_lights *glights)
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch b/queue-4.19/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
new file mode 100644
index 00000000000..f2a567a5b29
--- /dev/null
+++ b/queue-4.19/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
@@ -0,0 +1,49 @@
+From 2784a81c98498355cbf02e1f61cd436ad477cc9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Feb 2019 22:34:49 +0000
+Subject: staging: most: cdev: add missing check for cdev_add failure
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]
+
+Currently the call to cdev_add is missing a check for failure. Fix this by
+checking for failure and exiting via a new error path that ensures the
+allocated comp_channel struct is kfree'd.
+
+Detected by CoverityScan, CID#1462359 ("Unchecked return value")
+
+Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/most/cdev/cdev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/most/cdev/cdev.c b/drivers/staging/most/cdev/cdev.c
+index 0b48677fa958a..27d58b55b8108 100644
+--- a/drivers/staging/most/cdev/cdev.c
++++ b/drivers/staging/most/cdev/cdev.c
+@@ -453,7 +453,9 @@ static int comp_probe(struct most_interface *iface, int channel_id,
+ 	c->devno = MKDEV(comp.major, current_minor);
+ 	cdev_init(&c->cdev, &channel_fops);
+ 	c->cdev.owner = THIS_MODULE;
+-	cdev_add(&c->cdev, c->devno, 1);
++	retval = cdev_add(&c->cdev, c->devno, 1);
++	if (retval < 0)
++		goto err_free_c;
+ 	c->iface = iface;
+ 	c->cfg = cfg;
+ 	c->channel_id = channel_id;
+@@ -485,6 +487,7 @@ error_create_device:
+ 	list_del(&c->list);
+ error_alloc_kfifo:
+ 	cdev_del(&c->cdev);
++err_free_c:
+ 	kfree(c);
+ error_alloc_channel:
+ 	ida_simple_remove(&comp.minor_id, current_minor);
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-r8822be-check-kzalloc-return-or-bail.patch b/queue-4.19/staging-r8822be-check-kzalloc-return-or-bail.patch
new file mode 100644
index 00000000000..25a71ac8ec2
--- /dev/null
+++ b/queue-4.19/staging-r8822be-check-kzalloc-return-or-bail.patch
@@ -0,0 +1,41 @@
+From 6a5121b695be589663f584467abea8672ba5ccc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 10:24:22 +0100
+Subject: staging: r8822be: check kzalloc return or bail
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit e4b08e16b7d9d030b6475ef48f94d734a39f3c81 ]
+
+The kzalloc() in halmac_parse_psd_data_88xx() can fail and return NULL
+so check the psd_set->data after allocation and if allocation failed
+return HALMAC_CMD_PROCESS_ERROR.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 938a0447f094 ("staging: r8822be: Add code for halmac sub-drive")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c    | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+index 53f55f129a760..ec742da030dba 100644
+--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+@@ -2466,8 +2466,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
+ 	segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf);
+ 	psd_set->data_size = total_size;
+ 
+-	if (!psd_set->data)
++	if (!psd_set->data) {
+ 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
++		if (!psd_set->data)
++			return HALMAC_CMD_PROCESS_ERROR;
++	}
+ 
+ 	if (segment_id == 0)
+ 		psd_set->segment_size = segment_size;
+-- 
+2.20.1
+
diff --git a/queue-4.19/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch b/queue-4.19/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch
new file mode 100644
index 00000000000..6a7b6c9fa32
--- /dev/null
+++ b/queue-4.19/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch
@@ -0,0 +1,49 @@
+From e31327f3bd9a98a5d0f69b0dc1503f016c2b99ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 22:25:24 -0700
+Subject: staging: rtlwifi: Use proper enum for return in
+ halmac_parse_psd_data_88xx
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit e8edc32d70a4e09160835792eb5d1af71a0eec14 ]
+
+Clang warns:
+
+drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c:2472:11:
+warning: implicit conversion from enumeration type 'enum
+halmac_cmd_process_status' to different enumeration type 'enum
+halmac_ret_status' [-Wenum-conversion]
+                        return HALMAC_CMD_PROCESS_ERROR;
+                        ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~
+1 warning generated.
+
+Fix this by using the proper enum for allocation failures,
+HALMAC_RET_MALLOC_FAIL, which is used in the rest of this file.
+
+Fixes: e4b08e16b7d9 ("staging: r8822be: check kzalloc return or bail")
+Link: https://github.com/ClangBuiltLinux/linux/issues/375
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+index ec742da030dba..ddbeff8224ab6 100644
+--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+@@ -2469,7 +2469,7 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
+ 	if (!psd_set->data) {
+ 		psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
+ 		if (!psd_set->data)
+-			return HALMAC_CMD_PROCESS_ERROR;
++			return HALMAC_RET_MALLOC_FAIL;
+ 	}
+ 
+ 	if (segment_id == 0)
+-- 
+2.20.1
+
diff --git a/queue-4.19/switchtec-remove-immediate-status-check-after-submit.patch b/queue-4.19/switchtec-remove-immediate-status-check-after-submit.patch
new file mode 100644
index 00000000000..138261897c3
--- /dev/null
+++ b/queue-4.19/switchtec-remove-immediate-status-check-after-submit.patch
@@ -0,0 +1,53 @@
+From e254bd79d07ef46dad50ded59c68de20676f6dc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:12:20 +0800
+Subject: switchtec: Remove immediate status check after submitting MRPC
+ command
+
+From: Kelvin Cao <kelvin.cao@microchip.com>
+
+[ Upstream commit 526180408b815aa7b96fd48bd23cdd33ef04e38e ]
+
+After submitting a Firmware Download MRPC command, Switchtec firmware will
+delay Management EP BAR MemRd TLP responses by more than 10ms.  This is a
+firmware limitation.  Delayed MemRd completions are a problem for systems
+with a low Completion Timeout (CTO).
+
+The current driver checks the MRPC status immediately after submitting an
+MRPC command, which results in a delayed MemRd completion that may cause a
+Completion Timeout.
+
+Remove the immediate status check and rely on the check after receiving an
+interrupt or timing out.
+
+This is only a software workaround to the READ issue and a proper fix of
+this should be done in firmware.
+
+Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
+Signed-off-by: Kelvin Cao <kelvin.cao@microchip.com>
+Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/switch/switchtec.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 5aaa4ce04ec3d..ceb7ab3ba3d09 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -134,10 +134,6 @@ static void mrpc_cmd_submit(struct switchtec_dev *stdev)
+ 		    stuser->data, stuser->data_len);
+ 	iowrite32(stuser->cmd, &stdev->mmio_mrpc->cmd);
+ 
+-	stuser->status = ioread32(&stdev->mmio_mrpc->status);
+-	if (stuser->status != SWITCHTEC_MRPC_STATUS_INPROGRESS)
+-		mrpc_complete_cmd(stdev);
+-
+ 	schedule_delayed_work(&stdev->mrpc_timeout,
+ 			      msecs_to_jiffies(500));
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch b/queue-4.19/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch
new file mode 100644
index 00000000000..9340a406585
--- /dev/null
+++ b/queue-4.19/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch
@@ -0,0 +1,63 @@
+From aab3d6f3f2f4801902b4d59f63dfaf4c950e7fad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:10:15 -0700
+Subject: tcp: annotate lockless access to tcp_memory_pressure
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 1f142c17d19a5618d5a633195a46f2c8be9bf232 ]
+
+tcp_memory_pressure is read without holding any lock,
+and its value could be changed on other cpus.
+
+Use READ_ONCE() to annotate these lockless reads.
+
+The write side is already using atomic ops.
+
+Fixes: b8da51ebb1aa ("tcp: introduce tcp_under_memory_pressure()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 2 +-
+ net/ipv4/tcp.c    | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index ac4ffe8013d8a..918bfd0d7d1f9 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -261,7 +261,7 @@ static inline bool tcp_under_memory_pressure(const struct sock *sk)
+ 	    mem_cgroup_under_socket_pressure(sk->sk_memcg))
+ 		return true;
+ 
+-	return tcp_memory_pressure;
++	return READ_ONCE(tcp_memory_pressure);
+ }
+ /*
+  * The next routines deal with comparing 32 bit unsigned ints
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index cd8a92e7a39eb..af9361eba64a6 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -325,7 +325,7 @@ void tcp_enter_memory_pressure(struct sock *sk)
+ {
+ 	unsigned long val;
+ 
+-	if (tcp_memory_pressure)
++	if (READ_ONCE(tcp_memory_pressure))
+ 		return;
+ 	val = jiffies;
+ 
+@@ -340,7 +340,7 @@ void tcp_leave_memory_pressure(struct sock *sk)
+ {
+ 	unsigned long val;
+ 
+-	if (!tcp_memory_pressure)
++	if (!READ_ONCE(tcp_memory_pressure))
+ 		return;
+ 	val = xchg(&tcp_memory_pressure, 0);
+ 	if (val)
+-- 
+2.20.1
+
diff --git a/queue-4.19/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch b/queue-4.19/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
new file mode 100644
index 00000000000..3c2c67855c2
--- /dev/null
+++ b/queue-4.19/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
@@ -0,0 +1,59 @@
+From 0b67e9a7c2936c4f05f70b98e1e9cd050a0ca80f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 11:32:38 -0700
+Subject: thermal: cpu_cooling: Actually trace CPU load in
+ thermal_power_cpu_get_power
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]
+
+The CPU load values passed to the thermal_power_cpu_get_power
+tracepoint are zero for all CPUs, unless, unless the
+thermal_power_cpu_limit tracepoint is enabled too:
+
+  irq/41-rockchip-98    [000] ....   290.972410: thermal_power_cpu_get_power:
+  cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815
+
+vs
+
+  irq/41-rockchip-96    [000] ....    95.773585: thermal_power_cpu_get_power:
+  cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
+  irq/41-rockchip-96    [000] ....    95.773596: thermal_power_cpu_limit:
+  cpus=0000000f freq=408000 cdev_state=10 power=416
+
+There seems to be no good reason for omitting the CPU load information
+depending on another tracepoint. My guess is that the intention was to
+check whether thermal_power_cpu_get_power is (still) enabled, however
+'load_cpu != NULL' already indicates that it was at least enabled when
+cpufreq_get_requested_power() was entered, there seems little gain
+from omitting the assignment if the tracepoint was just disabled, so
+just remove the check.
+
+Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Javi Merino <javi.merino@kernel.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/cpu_cooling.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
+index dfd23245f778a..9df6b72604667 100644
+--- a/drivers/thermal/cpu_cooling.c
++++ b/drivers/thermal/cpu_cooling.c
+@@ -458,7 +458,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
+ 			load = 0;
+ 
+ 		total_load += load;
+-		if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
++		if (load_cpu)
+ 			load_cpu[i] = load;
+ 
+ 		i++;
+-- 
+2.20.1
+
diff --git a/queue-4.19/thermal-mediatek-fix-register-index-error.patch b/queue-4.19/thermal-mediatek-fix-register-index-error.patch
new file mode 100644
index 00000000000..78aef4afd60
--- /dev/null
+++ b/queue-4.19/thermal-mediatek-fix-register-index-error.patch
@@ -0,0 +1,47 @@
+From a1f59ea9f6eb24f9cf92ab9cd44432915b3c5479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 15:38:07 +0800
+Subject: thermal: mediatek: fix register index error
+
+From: Michael Kao <michael.kao@mediatek.com>
+
+[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ]
+
+The index of msr and adcpnp should match the sensor
+which belongs to the selected bank in the for loop.
+
+Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
+Signed-off-by: Michael Kao <michael.kao@mediatek.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mtk_thermal.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 0691f260f6eab..f64643629d8b5 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -431,7 +431,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
+ 	u32 raw;
+ 
+ 	for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+-		raw = readl(mt->thermal_base + conf->msr[i]);
++		raw = readl(mt->thermal_base +
++			    conf->msr[conf->bank_data[bank->id].sensors[i]]);
+ 
+ 		temp = raw_to_mcelsius(mt,
+ 				       conf->bank_data[bank->id].sensors[i],
+@@ -568,7 +569,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
+ 
+ 	for (i = 0; i < conf->bank_data[num].num_sensors; i++)
+ 		writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
+-		       mt->thermal_base + conf->adcpnp[i]);
++		       mt->thermal_base +
++		       conf->adcpnp[conf->bank_data[num].sensors[i]]);
+ 
+ 	writel((1 << conf->bank_data[num].num_sensors) - 1,
+ 	       mt->thermal_base + TEMP_MONCTL0);
+-- 
+2.20.1
+
diff --git a/queue-4.19/thermal-rcar_gen3_thermal-fix-interrupt-type.patch b/queue-4.19/thermal-rcar_gen3_thermal-fix-interrupt-type.patch
new file mode 100644
index 00000000000..15389fd8e9a
--- /dev/null
+++ b/queue-4.19/thermal-rcar_gen3_thermal-fix-interrupt-type.patch
@@ -0,0 +1,119 @@
+From f6c0d91218c8f250d7af1b6545d839caa0fa9739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 14:11:44 +0900
+Subject: thermal: rcar_gen3_thermal: fix interrupt type
+
+From: Jiada Wang <jiada_wang@mentor.com>
+
+[ Upstream commit 2c0928c9e004589dc9e7672c40a38d6c4ca12701 ]
+
+Currently IRQF_SHARED type interrupt line is allocated, but it
+is not appropriate, as the interrupt line isn't shared between
+different devices, instead IRQF_ONESHOT is the proper type.
+
+By changing interrupt type to IRQF_ONESHOT, now irq handler is
+no longer needed, as clear of interrupt status can be done in
+threaded interrupt context.
+
+Because IRQF_ONESHOT type interrupt line is kept disabled until
+the threaded handler has been run, so there is no need to protect
+read/write of REG_GEN3_IRQSTR with lock.
+
+Fixes: 7d4b269776ec6 ("enable hardware interrupts for trip points")
+Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Tested-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/rcar_gen3_thermal.c | 38 +++++------------------------
+ 1 file changed, 6 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c
+index 704c8ad045bb5..8f553453dd7fc 100644
+--- a/drivers/thermal/rcar_gen3_thermal.c
++++ b/drivers/thermal/rcar_gen3_thermal.c
+@@ -14,7 +14,6 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+-#include <linux/spinlock.h>
+ #include <linux/sys_soc.h>
+ #include <linux/thermal.h>
+ 
+@@ -81,7 +80,6 @@ struct rcar_gen3_thermal_tsc {
+ struct rcar_gen3_thermal_priv {
+ 	struct rcar_gen3_thermal_tsc *tscs[TSC_MAX_NUM];
+ 	unsigned int num_tscs;
+-	spinlock_t lock; /* Protect interrupts on and off */
+ 	void (*thermal_init)(struct rcar_gen3_thermal_tsc *tsc);
+ };
+ 
+@@ -231,38 +229,16 @@ static irqreturn_t rcar_gen3_thermal_irq(int irq, void *data)
+ {
+ 	struct rcar_gen3_thermal_priv *priv = data;
+ 	u32 status;
+-	int i, ret = IRQ_HANDLED;
++	int i;
+ 
+-	spin_lock(&priv->lock);
+ 	for (i = 0; i < priv->num_tscs; i++) {
+ 		status = rcar_gen3_thermal_read(priv->tscs[i], REG_GEN3_IRQSTR);
+ 		rcar_gen3_thermal_write(priv->tscs[i], REG_GEN3_IRQSTR, 0);
+ 		if (status)
+-			ret = IRQ_WAKE_THREAD;
++			thermal_zone_device_update(priv->tscs[i]->zone,
++						   THERMAL_EVENT_UNSPECIFIED);
+ 	}
+ 
+-	if (ret == IRQ_WAKE_THREAD)
+-		rcar_thermal_irq_set(priv, false);
+-
+-	spin_unlock(&priv->lock);
+-
+-	return ret;
+-}
+-
+-static irqreturn_t rcar_gen3_thermal_irq_thread(int irq, void *data)
+-{
+-	struct rcar_gen3_thermal_priv *priv = data;
+-	unsigned long flags;
+-	int i;
+-
+-	for (i = 0; i < priv->num_tscs; i++)
+-		thermal_zone_device_update(priv->tscs[i]->zone,
+-					   THERMAL_EVENT_UNSPECIFIED);
+-
+-	spin_lock_irqsave(&priv->lock, flags);
+-	rcar_thermal_irq_set(priv, true);
+-	spin_unlock_irqrestore(&priv->lock, flags);
+-
+ 	return IRQ_HANDLED;
+ }
+ 
+@@ -364,8 +340,6 @@ static int rcar_gen3_thermal_probe(struct platform_device *pdev)
+ 	if (soc_device_match(r8a7795es1))
+ 		priv->thermal_init = rcar_gen3_thermal_init_r8a7795es1;
+ 
+-	spin_lock_init(&priv->lock);
+-
+ 	platform_set_drvdata(pdev, priv);
+ 
+ 	/*
+@@ -383,9 +357,9 @@ static int rcar_gen3_thermal_probe(struct platform_device *pdev)
+ 		if (!irqname)
+ 			return -ENOMEM;
+ 
+-		ret = devm_request_threaded_irq(dev, irq, rcar_gen3_thermal_irq,
+-						rcar_gen3_thermal_irq_thread,
+-						IRQF_SHARED, irqname, priv);
++		ret = devm_request_threaded_irq(dev, irq, NULL,
++						rcar_gen3_thermal_irq,
++						IRQF_ONESHOT, irqname, priv);
+ 		if (ret)
+ 			return ret;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-eliminate-message-disordering-during-binding-ta.patch b/queue-4.19/tipc-eliminate-message-disordering-during-binding-ta.patch
new file mode 100644
index 00000000000..b30d9441fe6
--- /dev/null
+++ b/queue-4.19/tipc-eliminate-message-disordering-during-binding-ta.patch
@@ -0,0 +1,129 @@
+From 2903846062918e0a99414761bc03b8903de7a520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 19:55:40 +0200
+Subject: tipc: eliminate message disordering during binding table update
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 988f3f1603d4650409db5334355cbf7b13ef50c3 ]
+
+We have seen the following race scenario:
+1) named_distribute() builds a "bulk" message, containing a PUBLISH
+   item for a certain publication. This is based on the contents of
+   the binding tables's 'cluster_scope' list.
+2) tipc_named_withdraw() removes the same publication from the list,
+   bulds a WITHDRAW message and distributes it to all cluster nodes.
+3) tipc_named_node_up(), which was calling named_distribute(), sends
+   out the bulk message built under 1)
+4) The WITHDRAW message arrives at the just detected node, finds
+   no corresponding publication, and is dropped.
+5) The PUBLISH item arrives at the same node, is added to its binding
+   table, and remains there forever.
+
+This arrival disordering was earlier taken care of by the backlog queue,
+originally added for a different purpose, which was removed in the
+commit referred to below, but we now need a different solution.
+In this commit, we replace the rcu lock protecting the 'cluster_scope'
+list with a regular RW lock which comprises even the sending of the
+bulk message. This both guarantees both the list integrity and the
+message sending order. We will later add a commit which cleans up
+this code further.
+
+Note that this commit needs recently added commit d3092b2efca1 ("tipc:
+fix unsafe rcu locking when accessing publication list") to apply
+cleanly.
+
+Fixes: 37922ea4a310 ("tipc: permit overlapping service ranges in name table")
+Reported-by: Tuong Lien Tong <tuong.t.lien@dektech.com.au>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/name_distr.c | 18 ++++++++++--------
+ net/tipc/name_table.c |  1 +
+ net/tipc/name_table.h |  1 +
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
+index e0a3dd424d8c2..836e629e8f4ab 100644
+--- a/net/tipc/name_distr.c
++++ b/net/tipc/name_distr.c
+@@ -94,8 +94,9 @@ struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ)
+ 		list_add_tail_rcu(&publ->binding_node, &nt->node_scope);
+ 		return NULL;
+ 	}
+-	list_add_tail_rcu(&publ->binding_node, &nt->cluster_scope);
+-
++	write_lock_bh(&nt->cluster_scope_lock);
++	list_add_tail(&publ->binding_node, &nt->cluster_scope);
++	write_unlock_bh(&nt->cluster_scope_lock);
+ 	skb = named_prepare_buf(net, PUBLICATION, ITEM_SIZE, 0);
+ 	if (!skb) {
+ 		pr_warn("Publication distribution failure\n");
+@@ -112,11 +113,13 @@ struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ)
+  */
+ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ)
+ {
++	struct name_table *nt = tipc_name_table(net);
+ 	struct sk_buff *buf;
+ 	struct distr_item *item;
+ 
+-	list_del_rcu(&publ->binding_node);
+-
++	write_lock_bh(&nt->cluster_scope_lock);
++	list_del(&publ->binding_node);
++	write_unlock_bh(&nt->cluster_scope_lock);
+ 	if (publ->scope == TIPC_NODE_SCOPE)
+ 		return NULL;
+ 
+@@ -147,7 +150,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
+ 			ITEM_SIZE) * ITEM_SIZE;
+ 	u32 msg_rem = msg_dsz;
+ 
+-	list_for_each_entry_rcu(publ, pls, binding_node) {
++	list_for_each_entry(publ, pls, binding_node) {
+ 		/* Prepare next buffer: */
+ 		if (!skb) {
+ 			skb = named_prepare_buf(net, PUBLICATION, msg_rem,
+@@ -189,11 +192,10 @@ void tipc_named_node_up(struct net *net, u32 dnode)
+ 
+ 	__skb_queue_head_init(&head);
+ 
+-	rcu_read_lock();
++	read_lock_bh(&nt->cluster_scope_lock);
+ 	named_distribute(net, &head, dnode, &nt->cluster_scope);
+-	rcu_read_unlock();
+-
+ 	tipc_node_xmit(net, &head, dnode, 0);
++	read_unlock_bh(&nt->cluster_scope_lock);
+ }
+ 
+ /**
+diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
+index d72985ca1d555..89993afe0fbd3 100644
+--- a/net/tipc/name_table.c
++++ b/net/tipc/name_table.c
+@@ -744,6 +744,7 @@ int tipc_nametbl_init(struct net *net)
+ 
+ 	INIT_LIST_HEAD(&nt->node_scope);
+ 	INIT_LIST_HEAD(&nt->cluster_scope);
++	rwlock_init(&nt->cluster_scope_lock);
+ 	tn->nametbl = nt;
+ 	spin_lock_init(&tn->nametbl_lock);
+ 	return 0;
+diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
+index 892bd750b85fa..f79066334cc8f 100644
+--- a/net/tipc/name_table.h
++++ b/net/tipc/name_table.h
+@@ -100,6 +100,7 @@ struct name_table {
+ 	struct hlist_head services[TIPC_NAMETBL_SIZE];
+ 	struct list_head node_scope;
+ 	struct list_head cluster_scope;
++	rwlock_t cluster_scope_lock;
+ 	u32 local_publ_count;
+ };
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-reduce-risk-of-wakeup-queue-starvation.patch b/queue-4.19/tipc-reduce-risk-of-wakeup-queue-starvation.patch
new file mode 100644
index 00000000000..03026a9655f
--- /dev/null
+++ b/queue-4.19/tipc-reduce-risk-of-wakeup-queue-starvation.patch
@@ -0,0 +1,86 @@
+From da1a810dd1af71cf21cc3bbb06636172b1f388ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2019 16:23:18 +0200
+Subject: tipc: reduce risk of wakeup queue starvation
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 7c5b42055964f587e55bd87ef334c3a27e95d144 ]
+
+In commit 365ad353c256 ("tipc: reduce risk of user starvation during
+link congestion") we allowed senders to add exactly one list of extra
+buffers to the link backlog queues during link congestion (aka
+"oversubscription"). However, the criteria for when to stop adding
+wakeup messages to the input queue when the overload abates is
+inaccurate, and may cause starvation problems during very high load.
+
+Currently, we stop adding wakeup messages after 10 total failed attempts
+where we find that there is no space left in the backlog queue for a
+certain importance level. The counter for this is accumulated across all
+levels, which may lead the algorithm to leave the loop prematurely,
+although there may still be plenty of space available at some levels.
+The result is sometimes that messages near the wakeup queue tail are not
+added to the input queue as they should be.
+
+We now introduce a more exact algorithm, where we keep adding wakeup
+messages to a level as long as the backlog queue has free slots for
+the corresponding level, and stop at the moment there are no more such
+slots or when there are no more wakeup messages to dequeue.
+
+Fixes: 365ad35 ("tipc: reduce risk of user starvation during link congestion")
+Reported-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 0fbf8ea18ce04..cc9a0485536b3 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -830,18 +830,31 @@ static int link_schedule_user(struct tipc_link *l, struct tipc_msg *hdr)
+  */
+ static void link_prepare_wakeup(struct tipc_link *l)
+ {
++	struct sk_buff_head *wakeupq = &l->wakeupq;
++	struct sk_buff_head *inputq = l->inputq;
+ 	struct sk_buff *skb, *tmp;
+-	int imp, i = 0;
++	struct sk_buff_head tmpq;
++	int avail[5] = {0,};
++	int imp = 0;
++
++	__skb_queue_head_init(&tmpq);
+ 
+-	skb_queue_walk_safe(&l->wakeupq, skb, tmp) {
++	for (; imp <= TIPC_SYSTEM_IMPORTANCE; imp++)
++		avail[imp] = l->backlog[imp].limit - l->backlog[imp].len;
++
++	skb_queue_walk_safe(wakeupq, skb, tmp) {
+ 		imp = TIPC_SKB_CB(skb)->chain_imp;
+-		if (l->backlog[imp].len < l->backlog[imp].limit) {
+-			skb_unlink(skb, &l->wakeupq);
+-			skb_queue_tail(l->inputq, skb);
+-		} else if (i++ > 10) {
+-			break;
+-		}
++		if (avail[imp] <= 0)
++			continue;
++		avail[imp]--;
++		__skb_unlink(skb, wakeupq);
++		__skb_queue_tail(&tmpq, skb);
+ 	}
++
++	spin_lock_bh(&inputq->lock);
++	skb_queue_splice_tail(&tmpq, inputq);
++	spin_unlock_bh(&inputq->lock);
++
+ }
+ 
+ void tipc_link_reset(struct tipc_link *l)
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch b/queue-4.19/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
new file mode 100644
index 00000000000..00414f2b580
--- /dev/null
+++ b/queue-4.19/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
@@ -0,0 +1,60 @@
+From c054ef6a13c1ad797b685520b35c0296ef785a20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 13:10:09 +0800
+Subject: tipc: set sysctl_tipc_rmem and named_timeout right range
+
+From: Jie Liu <liujie165@huawei.com>
+
+[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]
+
+We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
+setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
+And named_timeout as a timeout setting should be not less than zero.
+
+Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
+Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
+Signed-off-by: Jie Liu <liujie165@huawei.com>
+Reported-by: Qiang Ning <ningqiang1@huawei.com>
+Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/sysctl.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
+index 1a779b1e85100..40f6d82083d7b 100644
+--- a/net/tipc/sysctl.c
++++ b/net/tipc/sysctl.c
+@@ -37,6 +37,8 @@
+ 
+ #include <linux/sysctl.h>
+ 
++static int zero;
++static int one = 1;
+ static struct ctl_table_header *tipc_ctl_hdr;
+ 
+ static struct ctl_table tipc_table[] = {
+@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
+ 		.data		= &sysctl_tipc_rmem,
+ 		.maxlen		= sizeof(sysctl_tipc_rmem),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1         = &one,
+ 	},
+ 	{
+ 		.procname	= "named_timeout",
+ 		.data		= &sysctl_tipc_named_timeout,
+ 		.maxlen		= sizeof(sysctl_tipc_named_timeout),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1         = &zero,
+ 	},
+ 	{}
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.19/tipc-tipc-clang-warning.patch b/queue-4.19/tipc-tipc-clang-warning.patch
new file mode 100644
index 00000000000..5a35cf59673
--- /dev/null
+++ b/queue-4.19/tipc-tipc-clang-warning.patch
@@ -0,0 +1,69 @@
+From f04043de5069926f3e8f21518c80d4b5649a8f76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:03:51 +0100
+Subject: tipc: tipc clang warning
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ]
+
+When checking the code with clang -Wsometimes-uninitialized we get the
+following warning:
+
+if (!tipc_link_is_establishing(l)) {
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/node.c:847:46: note: uninitialized use occurs here
+      tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+
+net/tipc/node.c:831:2: note: remove the 'if' if its condition is always
+true
+if (!tipc_link_is_establishing(l)) {
+    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence
+this warning
+struct tipc_media_addr *maddr;
+
+We fix this by initializing 'maddr' to NULL. For the matter of clarity,
+we also test if 'xmitq' is non-empty before we use it and 'maddr'
+further down in the  function. It will never happen that 'xmitq' is non-
+empty at the same time as 'maddr' is NULL, so this is a sufficient test.
+
+Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/node.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 32556f480a606..e67ffd1949272 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -810,10 +810,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
+ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ {
+ 	struct tipc_link_entry *le = &n->links[bearer_id];
++	struct tipc_media_addr *maddr = NULL;
+ 	struct tipc_link *l = le->link;
+-	struct tipc_media_addr *maddr;
+-	struct sk_buff_head xmitq;
+ 	int old_bearer_id = bearer_id;
++	struct sk_buff_head xmitq;
+ 
+ 	if (!l)
+ 		return;
+@@ -835,7 +835,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ 	tipc_node_write_unlock(n);
+ 	if (delete)
+ 		tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
+-	tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
++	if (!skb_queue_empty(&xmitq))
++		tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+ 	tipc_sk_rcv(n->net, &le->inputq);
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/tools-bpftool-fix-arguments-for-p_err-in-do_event_pi.patch b/queue-4.19/tools-bpftool-fix-arguments-for-p_err-in-do_event_pi.patch
new file mode 100644
index 00000000000..1f5590c137b
--- /dev/null
+++ b/queue-4.19/tools-bpftool-fix-arguments-for-p_err-in-do_event_pi.patch
@@ -0,0 +1,48 @@
+From 73832e49d2a92d6f55abfadecfde7ad73848dfc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 15:32:15 +0100
+Subject: tools: bpftool: fix arguments for p_err() in do_event_pipe()
+
+From: Quentin Monnet <quentin.monnet@netronome.com>
+
+[ Upstream commit 9def249dc8409ffc1f5a1d7195f1c462f2b49c07 ]
+
+The last argument passed to some calls to the p_err() functions is not
+correct, it should be "*argv" instead of "**argv". This may lead to a
+segmentation fault error if CPU IDs or indices from the command line
+cannot be parsed correctly. Let's fix this.
+
+Fixes: f412eed9dfde ("tools: bpftool: add simple perf event output reader")
+Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/map_perf_ring.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/bpf/bpftool/map_perf_ring.c b/tools/bpf/bpftool/map_perf_ring.c
+index 6d41323be291b..8ec0148d7426d 100644
+--- a/tools/bpf/bpftool/map_perf_ring.c
++++ b/tools/bpf/bpftool/map_perf_ring.c
+@@ -205,7 +205,7 @@ int do_event_pipe(int argc, char **argv)
+ 			NEXT_ARG();
+ 			cpu = strtoul(*argv, &endptr, 0);
+ 			if (*endptr) {
+-				p_err("can't parse %s as CPU ID", **argv);
++				p_err("can't parse %s as CPU ID", *argv);
+ 				goto err_close_map;
+ 			}
+ 
+@@ -216,7 +216,7 @@ int do_event_pipe(int argc, char **argv)
+ 			NEXT_ARG();
+ 			index = strtoul(*argv, &endptr, 0);
+ 			if (*endptr) {
+-				p_err("can't parse %s as index", **argv);
++				p_err("can't parse %s as index", *argv);
+ 				goto err_close_map;
+ 			}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/tools-bpftool-fix-format-strings-and-arguments-for-j.patch b/queue-4.19/tools-bpftool-fix-format-strings-and-arguments-for-j.patch
new file mode 100644
index 00000000000..0a8922ecc3c
--- /dev/null
+++ b/queue-4.19/tools-bpftool-fix-format-strings-and-arguments-for-j.patch
@@ -0,0 +1,60 @@
+From e8837091df6849c3eb5914fde2f79271c97e81c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 15:32:16 +0100
+Subject: tools: bpftool: fix format strings and arguments for jsonw_printf()
+
+From: Quentin Monnet <quentin.monnet@netronome.com>
+
+[ Upstream commit 22c349e8db89df86804d3ba23cef037ccd44a8bf ]
+
+There are some mismatches between format strings and arguments passed to
+jsonw_printf() in the BTF dumper for bpftool, which seems harmless but
+may result in warnings if the "__printf()" attribute is used correctly
+for jsonw_printf(). Let's fix relevant format strings and type cast.
+
+Fixes: b12d6ec09730 ("bpf: btf: add btf print functionality")
+Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index e4e6e2b3fd847..ff0cc3c171411 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -26,9 +26,9 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
+ 			   bool is_plain_text)
+ {
+ 	if (is_plain_text)
+-		jsonw_printf(jw, "%p", *(unsigned long *)data);
++		jsonw_printf(jw, "%p", data);
+ 	else
+-		jsonw_printf(jw, "%u", *(unsigned long *)data);
++		jsonw_printf(jw, "%lu", *(unsigned long *)data);
+ }
+ 
+ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
+@@ -129,7 +129,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
+ 	switch (BTF_INT_ENCODING(*int_type)) {
+ 	case 0:
+ 		if (BTF_INT_BITS(*int_type) == 64)
+-			jsonw_printf(jw, "%lu", *(__u64 *)data);
++			jsonw_printf(jw, "%llu", *(__u64 *)data);
+ 		else if (BTF_INT_BITS(*int_type) == 32)
+ 			jsonw_printf(jw, "%u", *(__u32 *)data);
+ 		else if (BTF_INT_BITS(*int_type) == 16)
+@@ -142,7 +142,7 @@ static int btf_dumper_int(const struct btf_type *t, __u8 bit_offset,
+ 		break;
+ 	case BTF_INT_SIGNED:
+ 		if (BTF_INT_BITS(*int_type) == 64)
+-			jsonw_printf(jw, "%ld", *(long long *)data);
++			jsonw_printf(jw, "%lld", *(long long *)data);
+ 		else if (BTF_INT_BITS(*int_type) == 32)
+ 			jsonw_printf(jw, "%d", *(int *)data);
+ 		else if (BTF_INT_BITS(*int_type) == 16)
+-- 
+2.20.1
+
diff --git a/queue-4.19/tools-bpftool-use-correct-argument-in-cgroup-errors.patch b/queue-4.19/tools-bpftool-use-correct-argument-in-cgroup-errors.patch
new file mode 100644
index 00000000000..ea45ad44aab
--- /dev/null
+++ b/queue-4.19/tools-bpftool-use-correct-argument-in-cgroup-errors.patch
@@ -0,0 +1,56 @@
+From 20b042183be2cb0f624b474725fea30138e582c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jun 2019 09:56:31 -0700
+Subject: tools: bpftool: use correct argument in cgroup errors
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 6c6874f401e5a0caab3b6a0663169e1fb5e930bb ]
+
+cgroup code tries to use argv[0] as the cgroup path,
+but if it fails uses argv[1] to report errors.
+
+Fixes: 5ccda64d38cc ("bpftool: implement cgroup bpf operations")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/cgroup.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
+index ee7a9765c6b32..adbcd84818f74 100644
+--- a/tools/bpf/bpftool/cgroup.c
++++ b/tools/bpf/bpftool/cgroup.c
+@@ -164,7 +164,7 @@ static int do_show(int argc, char **argv)
+ 
+ 	cgroup_fd = open(argv[0], O_RDONLY);
+ 	if (cgroup_fd < 0) {
+-		p_err("can't open cgroup %s", argv[1]);
++		p_err("can't open cgroup %s", argv[0]);
+ 		goto exit;
+ 	}
+ 
+@@ -345,7 +345,7 @@ static int do_attach(int argc, char **argv)
+ 
+ 	cgroup_fd = open(argv[0], O_RDONLY);
+ 	if (cgroup_fd < 0) {
+-		p_err("can't open cgroup %s", argv[1]);
++		p_err("can't open cgroup %s", argv[0]);
+ 		goto exit;
+ 	}
+ 
+@@ -403,7 +403,7 @@ static int do_detach(int argc, char **argv)
+ 
+ 	cgroup_fd = open(argv[0], O_RDONLY);
+ 	if (cgroup_fd < 0) {
+-		p_err("can't open cgroup %s", argv[1]);
++		p_err("can't open cgroup %s", argv[0]);
+ 		goto exit;
+ 	}
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch b/queue-4.19/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
new file mode 100644
index 00000000000..71690daeadd
--- /dev/null
+++ b/queue-4.19/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
@@ -0,0 +1,36 @@
+From 5cda188c3c3b263622a495ea2af0519e0c16a6de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:30:51 +0800
+Subject: tty: ipwireless: Fix potential NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]
+
+There is a potential NULL pointer dereference in case
+alloc_ctrl_packet() fails and returns NULL.
+
+Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/ipwireless/hardware.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
+index b0baa4ce10f98..6bbf35682d531 100644
+--- a/drivers/tty/ipwireless/hardware.c
++++ b/drivers/tty/ipwireless/hardware.c
+@@ -1516,6 +1516,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
+ 			sizeof(struct ipw_setup_get_version_query_packet),
+ 			ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
+ 			TL_SETUP_SIGNO_GET_VERSION_QRY);
++	if (!ver_packet)
++		return;
+ 	ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
+ 
+ 	/*
+-- 
+2.20.1
+
diff --git a/queue-4.19/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch b/queue-4.19/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch
new file mode 100644
index 00000000000..dea134a9f3e
--- /dev/null
+++ b/queue-4.19/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch
@@ -0,0 +1,100 @@
+From 8540b4c858c3f0b4188a772c53a753d49b814bee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 12:52:15 -0700
+Subject: tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit 1da17d7cf8e2c4b60163d54300f72c02f510327c ]
+
+When dealing with 32-bit variant of LPUART IP block appropriate I/O
+helpers have to be used to properly deal with endianness
+differences. Change all of the offending code to do that.
+
+Fixes: a5fa2660d787 ("tty/serial/fsl_lpuart: Add CONSOLE_POLL support
+for lpuart32.")
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Stefan Agner <stefan@agner.ch>
+Cc: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
+Cc: Chris Healy <cphealy@gmail.com>
+Cc: Cory Tusar <cory.tusar@zii.aero>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: linux-imx@nxp.com
+Cc: linux-serial@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20190729195226.8862-14-andrew.smirnov@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index ee8a5cb61a5f1..2daccb10ae2f3 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -528,26 +528,26 @@ static int lpuart32_poll_init(struct uart_port *port)
+ 	spin_lock_irqsave(&sport->port.lock, flags);
+ 
+ 	/* Disable Rx & Tx */
+-	writel(0, sport->port.membase + UARTCTRL);
++	lpuart32_write(&sport->port, UARTCTRL, 0);
+ 
+-	temp = readl(sport->port.membase + UARTFIFO);
++	temp = lpuart32_read(&sport->port, UARTFIFO);
+ 
+ 	/* Enable Rx and Tx FIFO */
+-	writel(temp | UARTFIFO_RXFE | UARTFIFO_TXFE,
+-		   sport->port.membase + UARTFIFO);
++	lpuart32_write(&sport->port, UARTFIFO,
++		       temp | UARTFIFO_RXFE | UARTFIFO_TXFE);
+ 
+ 	/* flush Tx and Rx FIFO */
+-	writel(UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH,
+-			sport->port.membase + UARTFIFO);
++	lpuart32_write(&sport->port, UARTFIFO,
++		       UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH);
+ 
+ 	/* explicitly clear RDRF */
+-	if (readl(sport->port.membase + UARTSTAT) & UARTSTAT_RDRF) {
+-		readl(sport->port.membase + UARTDATA);
+-		writel(UARTFIFO_RXUF, sport->port.membase + UARTFIFO);
++	if (lpuart32_read(&sport->port, UARTSTAT) & UARTSTAT_RDRF) {
++		lpuart32_read(&sport->port, UARTDATA);
++		lpuart32_write(&sport->port, UARTFIFO, UARTFIFO_RXUF);
+ 	}
+ 
+ 	/* Enable Rx and Tx */
+-	writel(UARTCTRL_RE | UARTCTRL_TE, sport->port.membase + UARTCTRL);
++	lpuart32_write(&sport->port, UARTCTRL, UARTCTRL_RE | UARTCTRL_TE);
+ 	spin_unlock_irqrestore(&sport->port.lock, flags);
+ 
+ 	return 0;
+@@ -555,18 +555,18 @@ static int lpuart32_poll_init(struct uart_port *port)
+ 
+ static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c)
+ {
+-	while (!(readl(port->membase + UARTSTAT) & UARTSTAT_TDRE))
++	while (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_TDRE))
+ 		barrier();
+ 
+-	writel(c, port->membase + UARTDATA);
++	lpuart32_write(port, UARTDATA, c);
+ }
+ 
+ static int lpuart32_poll_get_char(struct uart_port *port)
+ {
+-	if (!(readl(port->membase + UARTSTAT) & UARTSTAT_RDRF))
++	if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF))
+ 		return NO_POLL_CHAR;
+ 
+-	return readl(port->membase + UARTDATA);
++	return lpuart32_read(port, UARTDATA);
+ }
+ #endif
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/um-fix-irq-controller-regression-on-console-read.patch b/queue-4.19/um-fix-irq-controller-regression-on-console-read.patch
new file mode 100644
index 00000000000..a0aac09bd82
--- /dev/null
+++ b/queue-4.19/um-fix-irq-controller-regression-on-console-read.patch
@@ -0,0 +1,121 @@
+From 7c0bd45f750502139461483b2f74354f27d15b00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 14:39:35 +0200
+Subject: um: Fix IRQ controller regression on console read
+
+From: Jouni Malinen <j@w1.fi>
+
+[ Upstream commit bebe4681d0e7e1be2608282dc86645728bc7f623 ]
+
+The conversion of UML to use epoll based IRQ controller claimed that
+clone_one_chan() can safely call um_free_irq() while starting to ignore
+the delay_free_irq parameter that explicitly noted that the IRQ cannot
+be freed because this is being called from chan_interrupt(). This
+resulted in free_irq() getting called in interrupt context ("Trying to
+free IRQ 6 from IRQ context!").
+
+Fix this by restoring previously used delay_free_irq processing.
+
+Fixes: ff6a17989c08 ("Epoll based IRQ controller")
+Signed-off-by: Jouni Malinen <j@w1.fi>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/chan_kern.c | 52 +++++++++++++++++++++++++++++++------
+ arch/um/kernel/irq.c        |  4 +++
+ 2 files changed, 48 insertions(+), 8 deletions(-)
+
+diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
+index 05588f9466c7f..13ba195f9c9c8 100644
+--- a/arch/um/drivers/chan_kern.c
++++ b/arch/um/drivers/chan_kern.c
+@@ -171,19 +171,55 @@ int enable_chan(struct line *line)
+ 	return err;
+ }
+ 
++/* Items are added in IRQ context, when free_irq can't be called, and
++ * removed in process context, when it can.
++ * This handles interrupt sources which disappear, and which need to
++ * be permanently disabled.  This is discovered in IRQ context, but
++ * the freeing of the IRQ must be done later.
++ */
++static DEFINE_SPINLOCK(irqs_to_free_lock);
++static LIST_HEAD(irqs_to_free);
++
++void free_irqs(void)
++{
++	struct chan *chan;
++	LIST_HEAD(list);
++	struct list_head *ele;
++	unsigned long flags;
++
++	spin_lock_irqsave(&irqs_to_free_lock, flags);
++	list_splice_init(&irqs_to_free, &list);
++	spin_unlock_irqrestore(&irqs_to_free_lock, flags);
++
++	list_for_each(ele, &list) {
++		chan = list_entry(ele, struct chan, free_list);
++
++		if (chan->input && chan->enabled)
++			um_free_irq(chan->line->driver->read_irq, chan);
++		if (chan->output && chan->enabled)
++			um_free_irq(chan->line->driver->write_irq, chan);
++		chan->enabled = 0;
++	}
++}
++
+ static void close_one_chan(struct chan *chan, int delay_free_irq)
+ {
++	unsigned long flags;
++
+ 	if (!chan->opened)
+ 		return;
+ 
+-    /* we can safely call free now - it will be marked
+-     *  as free and freed once the IRQ stopped processing
+-     */
+-	if (chan->input && chan->enabled)
+-		um_free_irq(chan->line->driver->read_irq, chan);
+-	if (chan->output && chan->enabled)
+-		um_free_irq(chan->line->driver->write_irq, chan);
+-	chan->enabled = 0;
++	if (delay_free_irq) {
++		spin_lock_irqsave(&irqs_to_free_lock, flags);
++		list_add(&chan->free_list, &irqs_to_free);
++		spin_unlock_irqrestore(&irqs_to_free_lock, flags);
++	} else {
++		if (chan->input && chan->enabled)
++			um_free_irq(chan->line->driver->read_irq, chan);
++		if (chan->output && chan->enabled)
++			um_free_irq(chan->line->driver->write_irq, chan);
++		chan->enabled = 0;
++	}
+ 	if (chan->ops->close != NULL)
+ 		(*chan->ops->close)(chan->fd, chan->data);
+ 
+diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
+index 6b7f3827d6e4a..2753718d31b9d 100644
+--- a/arch/um/kernel/irq.c
++++ b/arch/um/kernel/irq.c
+@@ -21,6 +21,8 @@
+ #include <irq_user.h>
+ 
+ 
++extern void free_irqs(void);
++
+ /* When epoll triggers we do not know why it did so
+  * we can also have different IRQs for read and write.
+  * This is why we keep a small irq_fd array for each fd -
+@@ -100,6 +102,8 @@ void sigio_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs)
+ 			}
+ 		}
+ 	}
++
++	free_irqs();
+ }
+ 
+ static int assign_epoll_events_to_irq(struct irq_entry *irq_entry)
+-- 
+2.20.1
+
diff --git a/queue-4.19/um-fix-off-by-one-error-in-irq-enumeration.patch b/queue-4.19/um-fix-off-by-one-error-in-irq-enumeration.patch
new file mode 100644
index 00000000000..5932b0445d2
--- /dev/null
+++ b/queue-4.19/um-fix-off-by-one-error-in-irq-enumeration.patch
@@ -0,0 +1,36 @@
+From b65b1eeae1fc79b85536a2bfadaba9e80042797c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 12:51:27 +0100
+Subject: um: Fix off by one error in IRQ enumeration
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 09ccf0364ca3e94aba4093707ef433ea8014e2a4 ]
+
+Fix an off-by-one in IRQ enumeration
+
+Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
+Reported by: Dana Johnson <djohns042@gmail.com>
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/include/asm/irq.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/um/include/asm/irq.h b/arch/um/include/asm/irq.h
+index 49ed3e35b35ad..ce7a78c3bcf21 100644
+--- a/arch/um/include/asm/irq.h
++++ b/arch/um/include/asm/irq.h
+@@ -23,7 +23,7 @@
+ #define VECTOR_BASE_IRQ		15
+ #define VECTOR_IRQ_SPACE	8
+ 
+-#define LAST_IRQ (VECTOR_IRQ_SPACE + VECTOR_BASE_IRQ)
++#define LAST_IRQ (VECTOR_IRQ_SPACE + VECTOR_BASE_IRQ - 1)
+ 
+ #else
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-dwc3-add-extcon-dependency-for-qcom.patch b/queue-4.19/usb-dwc3-add-extcon-dependency-for-qcom.patch
new file mode 100644
index 00000000000..7a88dd8d1f7
--- /dev/null
+++ b/queue-4.19/usb-dwc3-add-extcon-dependency-for-qcom.patch
@@ -0,0 +1,44 @@
+From b72478d08a138d55f5545e12a00f5d30c95a3247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 11:37:31 +0200
+Subject: usb: dwc3: add EXTCON dependency for qcom
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 3def4031b3e3fbb524cbd01555b057a6cef0d5e6 ]
+
+Like the omap back-end, we get a link error with CONFIG_EXTCON=m
+when building the qcom back-end into the kernel:
+
+drivers/usb/dwc3/dwc3-qcom.o: In function `dwc3_qcom_probe':
+dwc3-qcom.c:(.text+0x13dc): undefined reference to `extcon_get_edev_by_phandle'
+dwc3-qcom.c:(.text+0x1b18): undefined reference to `devm_extcon_register_notifier'
+dwc3-qcom.c:(.text+0x1b9c): undefined reference to `extcon_get_state'
+
+Do the same thing as OMAP and add an explicit dependency on
+EXTCON.
+
+Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
+index 518ead12458d0..1a0404fda596b 100644
+--- a/drivers/usb/dwc3/Kconfig
++++ b/drivers/usb/dwc3/Kconfig
+@@ -113,7 +113,7 @@ config USB_DWC3_ST
+ 
+ config USB_DWC3_QCOM
+ 	tristate "Qualcomm Platform"
+-	depends on ARCH_QCOM || COMPILE_TEST
++	depends on EXTCON && (ARCH_QCOM || COMPILE_TEST)
+ 	depends on OF
+ 	default USB_DWC3
+ 	help
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-dwc3-allow-building-usb_dwc3_qcom-without-extcon.patch b/queue-4.19/usb-dwc3-allow-building-usb_dwc3_qcom-without-extcon.patch
new file mode 100644
index 00000000000..1860e52dc5c
--- /dev/null
+++ b/queue-4.19/usb-dwc3-allow-building-usb_dwc3_qcom-without-extcon.patch
@@ -0,0 +1,49 @@
+From d186e8238a9dcea19333b2528729591d8f5fd6d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 17:00:57 +0200
+Subject: usb: dwc3: Allow building USB_DWC3_QCOM without EXTCON
+
+From: Marc Gonzalez <marc.w.gonzalez@free.fr>
+
+[ Upstream commit 77a4946516fe488b6a33390de6d749f934a243ba ]
+
+Keep EXTCON support optional, as some platforms do not need it.
+
+Do the same for USB_DWC3_OMAP while we're at it.
+
+Fixes: 3def4031b3e3f ("usb: dwc3: add EXTCON dependency for qcom")
+Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/Kconfig | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/Kconfig b/drivers/usb/dwc3/Kconfig
+index 1a0404fda596b..5d22f4bf2a9fa 100644
+--- a/drivers/usb/dwc3/Kconfig
++++ b/drivers/usb/dwc3/Kconfig
+@@ -52,7 +52,8 @@ comment "Platform Glue Driver Support"
+ 
+ config USB_DWC3_OMAP
+ 	tristate "Texas Instruments OMAP5 and similar Platforms"
+-	depends on EXTCON && (ARCH_OMAP2PLUS || COMPILE_TEST)
++	depends on ARCH_OMAP2PLUS || COMPILE_TEST
++	depends on EXTCON || !EXTCON
+ 	depends on OF
+ 	default USB_DWC3
+ 	help
+@@ -113,7 +114,8 @@ config USB_DWC3_ST
+ 
+ config USB_DWC3_QCOM
+ 	tristate "Qualcomm Platform"
+-	depends on EXTCON && (ARCH_QCOM || COMPILE_TEST)
++	depends on ARCH_QCOM || COMPILE_TEST
++	depends on EXTCON || !EXTCON
+ 	depends on OF
+ 	default USB_DWC3
+ 	help
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch b/queue-4.19/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
new file mode 100644
index 00000000000..a919ad7b2bc
--- /dev/null
+++ b/queue-4.19/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
@@ -0,0 +1,41 @@
+From a97e750e3e27d08149de8cfe9f95756034bfd0b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 14:25:32 +0200
+Subject: usb: gadget: fsl: fix link error against usb-gadget module
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]
+
+The dependency to ensure this driver links correctly fails since
+it can not be a loadable module:
+
+drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
+phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'
+
+Make the option 'tristate' so it can work correctly.
+
+Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
+index 91ea3083e7ad9..affb5393c4c6d 100644
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -20,7 +20,7 @@ config AB8500_USB
+ 	  in host mode, low speed.
+ 
+ config FSL_USB2_OTG
+-	bool "Freescale USB OTG Transceiver Driver"
++	tristate "Freescale USB OTG Transceiver Driver"
+ 	depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
+ 	depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
+ 	select USB_PHY
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch b/queue-4.19/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
new file mode 100644
index 00000000000..09b8a547217
--- /dev/null
+++ b/queue-4.19/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
@@ -0,0 +1,95 @@
+From 8b878f3692d25d021c5bc86787b26eb67c3baaea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 12:16:58 +0200
+Subject: usb: gadget: fsl_udc_core: check allocation return value and cleanup
+ on failure
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit 4ab2b48c98f2ec9712452d520a381917f91ac3d2 ]
+
+The allocation with fsl_alloc_request() and kmalloc() were unchecked
+fixed this up with a NULL check and appropriate cleanup.
+
+Additionally udc->ep_qh_size was reset to 0 on failure of allocation.
+Similar udc->phy_mode is initially 0 (as udc_controller was
+allocated with kzalloc in fsl_udc_probe()) so reset it to 0 as well
+so that this function is side-effect free on failure. Not clear if
+this is necessary or sensible as fsl_udc_release() probably can not
+be called if fsl_udc_probe() failed - but it should not hurt.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: b504882da5 ("USB: add Freescale high-speed USB SOC device controller driver")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c | 30 +++++++++++++++++++++++----
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
+index d44b26d5b2a2c..367697144cda2 100644
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2247,8 +2247,10 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ 	udc->phy_mode = pdata->phy_mode;
+ 
+ 	udc->eps = kcalloc(udc->max_ep, sizeof(struct fsl_ep), GFP_KERNEL);
+-	if (!udc->eps)
+-		return -1;
++	if (!udc->eps) {
++		ERR("kmalloc udc endpoint status failed\n");
++		goto eps_alloc_failed;
++	}
+ 
+ 	/* initialized QHs, take care of alignment */
+ 	size = udc->max_ep * sizeof(struct ep_queue_head);
+@@ -2262,8 +2264,7 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ 					&udc->ep_qh_dma, GFP_KERNEL);
+ 	if (!udc->ep_qh) {
+ 		ERR("malloc QHs for udc failed\n");
+-		kfree(udc->eps);
+-		return -1;
++		goto ep_queue_alloc_failed;
+ 	}
+ 
+ 	udc->ep_qh_size = size;
+@@ -2272,8 +2273,17 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ 	/* FIXME: fsl_alloc_request() ignores ep argument */
+ 	udc->status_req = container_of(fsl_alloc_request(NULL, GFP_KERNEL),
+ 			struct fsl_req, req);
++	if (!udc->status_req) {
++		ERR("kzalloc for udc status request failed\n");
++		goto udc_status_alloc_failed;
++	}
++
+ 	/* allocate a small amount of memory to get valid address */
+ 	udc->status_req->req.buf = kmalloc(8, GFP_KERNEL);
++	if (!udc->status_req->req.buf) {
++		ERR("kzalloc for udc request buffer failed\n");
++		goto udc_req_buf_alloc_failed;
++	}
+ 
+ 	udc->resume_state = USB_STATE_NOTATTACHED;
+ 	udc->usb_state = USB_STATE_POWERED;
+@@ -2281,6 +2291,18 @@ static int struct_udc_setup(struct fsl_udc *udc,
+ 	udc->remote_wakeup = 0;	/* default to 0 on reset */
+ 
+ 	return 0;
++
++udc_req_buf_alloc_failed:
++	kfree(udc->status_req);
++udc_status_alloc_failed:
++	kfree(udc->ep_qh);
++	udc->ep_qh_size = 0;
++ep_queue_alloc_failed:
++	kfree(udc->eps);
++eps_alloc_failed:
++	udc->phy_mode = 0;
++	return -1;
++
+ }
+ 
+ /*----------------------------------------------------------------
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-host-xhci-hub-fix-extra-endianness-conversion.patch b/queue-4.19/usb-host-xhci-hub-fix-extra-endianness-conversion.patch
new file mode 100644
index 00000000000..80dc95a7eec
--- /dev/null
+++ b/queue-4.19/usb-host-xhci-hub-fix-extra-endianness-conversion.patch
@@ -0,0 +1,44 @@
+From fc3906bc4104254a234b1f048f162d4a18c8cc1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jul 2019 15:17:19 +0300
+Subject: usb: host: xhci-hub: fix extra endianness conversion
+
+From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+
+[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]
+
+Don't do extra cpu_to_le32 conversion for
+put_unaligned_le32 because it is already implemented
+in this function.
+
+Fixes sparse error:
+xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
+xhci-hub.c:1152:44:    expected unsigned int [usertype] val
+xhci-hub.c:1152:44:    got restricted __le32 [usertype]
+
+Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
+Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 8f180bf7561a2..9772c0de59b7d 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1104,7 +1104,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ 			}
+ 			port_li = readl(ports[wIndex]->addr + PORTLI);
+ 			status = xhci_get_ext_port_status(temp, port_li);
+-			put_unaligned_le32(cpu_to_le32(status), &buf[4]);
++			put_unaligned_le32(status, &buf[4]);
+ 		}
+ 		break;
+ 	case SetPortFeature:
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch b/queue-4.19/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
new file mode 100644
index 00000000000..27d4b61d0fa
--- /dev/null
+++ b/queue-4.19/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
@@ -0,0 +1,41 @@
+From a15f7acf8a000ca703e66fb2fc2c4a5e843012e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 10:04:26 -0500
+Subject: usb: phy: twl6030-usb: fix possible use-after-free on remove
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]
+
+In remove(), use cancel_delayed_work_sync() to cancel the
+delayed work. Otherwise there's a chance that this work
+will continue to run until after the device has been removed.
+
+This issue was detected with the help of Coccinelle.
+
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: Bin Liu <b-liu@ti.com>
+Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
+Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 183550b63faad..dade34d704198 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -400,7 +400,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
+ {
+ 	struct twl6030_usb *twl = platform_get_drvdata(pdev);
+ 
+-	cancel_delayed_work(&twl->get_status_work);
++	cancel_delayed_work_sync(&twl->get_status_work);
+ 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+ 		REG_INT_MSK_LINE_C);
+ 	twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-typec-tcpm-notify-the-tcpc-to-start-connection-d.patch b/queue-4.19/usb-typec-tcpm-notify-the-tcpc-to-start-connection-d.patch
new file mode 100644
index 00000000000..968cd07c5f6
--- /dev/null
+++ b/queue-4.19/usb-typec-tcpm-notify-the-tcpc-to-start-connection-d.patch
@@ -0,0 +1,269 @@
+From c34c93422412dd7106162ca752105b0abb802d8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 22:07:52 +0200
+Subject: usb: typec: tcpm: Notify the tcpc to start connection-detection for
+ SRPs
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7893f9e1c26d1f9ea02622902ee671de45ad377b ]
+
+Some tcpc device-drivers need to explicitly be told to watch for connection
+events, otherwise the tcpc will not generate any TCPM_CC_EVENTs and devices
+being plugged into the Type-C port will not be noticed.
+
+For dual-role ports tcpm_start_drp_toggling() is used to tell the tcpc to
+watch for connection events. Sofar we lack a similar callback to the tcpc
+for single-role ports. With some tcpc-s such as the fusb302 this means
+no TCPM_CC_EVENTs will be generated when the port is configured as a
+single-role port.
+
+This commit renames start_drp_toggling to start_toggling and since the
+device-properties are parsed by the tcpm-core, adds a port_type parameter
+to the start_toggling callback so that the tcpc_dev driver knows the
+port-type and can act accordingly when it starts toggling.
+
+The new start_toggling callback now always gets called if defined, instead
+of only being called for DRP ports.
+
+To avoid this causing undesirable functional changes all existing
+start_drp_toggling implementations are not only renamed to start_toggling,
+but also get a port_type check added and return -EOPNOTSUPP when port_type
+is not DRP.
+
+Fixes: ea3b4d5523bc("usb: typec: fusb302: Resolve fixed power role ...")
+Cc: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Tested-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/fusb302/fusb302.c | 10 ++++++---
+ drivers/usb/typec/tcpci.c           | 10 ++++++---
+ drivers/usb/typec/tcpm.c            | 32 +++++++++++++----------------
+ drivers/usb/typec/typec_wcove.c     | 10 ++++++---
+ include/linux/usb/tcpm.h            | 13 ++++++------
+ 5 files changed, 42 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/fusb302/fusb302.c
+index 62a0060d39d8d..c749ce486ec85 100644
+--- a/drivers/usb/typec/fusb302/fusb302.c
++++ b/drivers/usb/typec/fusb302/fusb302.c
+@@ -990,13 +990,17 @@ done:
+ 	return ret;
+ }
+ 
+-static int tcpm_start_drp_toggling(struct tcpc_dev *dev,
+-				   enum typec_cc_status cc)
++static int tcpm_start_toggling(struct tcpc_dev *dev,
++			       enum typec_port_type port_type,
++			       enum typec_cc_status cc)
+ {
+ 	struct fusb302_chip *chip = container_of(dev, struct fusb302_chip,
+ 						 tcpc_dev);
+ 	int ret = 0;
+ 
++	if (port_type != TYPEC_PORT_DRP)
++		return -EOPNOTSUPP;
++
+ 	mutex_lock(&chip->lock);
+ 	ret = fusb302_set_src_current(chip, cc_src_current[cc]);
+ 	if (ret < 0) {
+@@ -1206,7 +1210,7 @@ static void init_tcpc_dev(struct tcpc_dev *fusb302_tcpc_dev)
+ 	fusb302_tcpc_dev->set_vbus = tcpm_set_vbus;
+ 	fusb302_tcpc_dev->set_pd_rx = tcpm_set_pd_rx;
+ 	fusb302_tcpc_dev->set_roles = tcpm_set_roles;
+-	fusb302_tcpc_dev->start_drp_toggling = tcpm_start_drp_toggling;
++	fusb302_tcpc_dev->start_toggling = tcpm_start_toggling;
+ 	fusb302_tcpc_dev->pd_transmit = tcpm_pd_transmit;
+ }
+ 
+diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpci.c
+index ac6b418b15f1f..c1f7073a56de7 100644
+--- a/drivers/usb/typec/tcpci.c
++++ b/drivers/usb/typec/tcpci.c
+@@ -100,13 +100,17 @@ static int tcpci_set_cc(struct tcpc_dev *tcpc, enum typec_cc_status cc)
+ 	return 0;
+ }
+ 
+-static int tcpci_start_drp_toggling(struct tcpc_dev *tcpc,
+-				    enum typec_cc_status cc)
++static int tcpci_start_toggling(struct tcpc_dev *tcpc,
++				enum typec_port_type port_type,
++				enum typec_cc_status cc)
+ {
+ 	int ret;
+ 	struct tcpci *tcpci = tcpc_to_tcpci(tcpc);
+ 	unsigned int reg = TCPC_ROLE_CTRL_DRP;
+ 
++	if (port_type != TYPEC_PORT_DRP)
++		return -EOPNOTSUPP;
++
+ 	/* Handle vendor drp toggling */
+ 	if (tcpci->data->start_drp_toggling) {
+ 		ret = tcpci->data->start_drp_toggling(tcpci, tcpci->data, cc);
+@@ -511,7 +515,7 @@ struct tcpci *tcpci_register_port(struct device *dev, struct tcpci_data *data)
+ 	tcpci->tcpc.get_cc = tcpci_get_cc;
+ 	tcpci->tcpc.set_polarity = tcpci_set_polarity;
+ 	tcpci->tcpc.set_vconn = tcpci_set_vconn;
+-	tcpci->tcpc.start_drp_toggling = tcpci_start_drp_toggling;
++	tcpci->tcpc.start_toggling = tcpci_start_toggling;
+ 
+ 	tcpci->tcpc.set_pd_rx = tcpci_set_pd_rx;
+ 	tcpci->tcpc.set_roles = tcpci_set_roles;
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index 39cf190012393..29d72e9b0f017 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -31,7 +31,7 @@
+ 
+ #define FOREACH_STATE(S)			\
+ 	S(INVALID_STATE),			\
+-	S(DRP_TOGGLING),			\
++	S(TOGGLING),			\
+ 	S(SRC_UNATTACHED),			\
+ 	S(SRC_ATTACH_WAIT),			\
+ 	S(SRC_ATTACHED),			\
+@@ -473,7 +473,7 @@ static void tcpm_log(struct tcpm_port *port, const char *fmt, ...)
+ 	/* Do not log while disconnected and unattached */
+ 	if (tcpm_port_is_disconnected(port) &&
+ 	    (port->state == SRC_UNATTACHED || port->state == SNK_UNATTACHED ||
+-	     port->state == DRP_TOGGLING))
++	     port->state == TOGGLING))
+ 		return;
+ 
+ 	va_start(args, fmt);
+@@ -2561,20 +2561,16 @@ static int tcpm_set_charge(struct tcpm_port *port, bool charge)
+ 	return 0;
+ }
+ 
+-static bool tcpm_start_drp_toggling(struct tcpm_port *port,
+-				    enum typec_cc_status cc)
++static bool tcpm_start_toggling(struct tcpm_port *port, enum typec_cc_status cc)
+ {
+ 	int ret;
+ 
+-	if (port->tcpc->start_drp_toggling &&
+-	    port->port_type == TYPEC_PORT_DRP) {
+-		tcpm_log_force(port, "Start DRP toggling");
+-		ret = port->tcpc->start_drp_toggling(port->tcpc, cc);
+-		if (!ret)
+-			return true;
+-	}
++	if (!port->tcpc->start_toggling)
++		return false;
+ 
+-	return false;
++	tcpm_log_force(port, "Start toggling");
++	ret = port->tcpc->start_toggling(port->tcpc, port->port_type, cc);
++	return ret == 0;
+ }
+ 
+ static void tcpm_set_cc(struct tcpm_port *port, enum typec_cc_status cc)
+@@ -2868,15 +2864,15 @@ static void run_state_machine(struct tcpm_port *port)
+ 
+ 	port->enter_state = port->state;
+ 	switch (port->state) {
+-	case DRP_TOGGLING:
++	case TOGGLING:
+ 		break;
+ 	/* SRC states */
+ 	case SRC_UNATTACHED:
+ 		if (!port->non_pd_role_swap)
+ 			tcpm_swap_complete(port, -ENOTCONN);
+ 		tcpm_src_detach(port);
+-		if (tcpm_start_drp_toggling(port, tcpm_rp_cc(port))) {
+-			tcpm_set_state(port, DRP_TOGGLING, 0);
++		if (tcpm_start_toggling(port, tcpm_rp_cc(port))) {
++			tcpm_set_state(port, TOGGLING, 0);
+ 			break;
+ 		}
+ 		tcpm_set_cc(port, tcpm_rp_cc(port));
+@@ -3074,8 +3070,8 @@ static void run_state_machine(struct tcpm_port *port)
+ 			tcpm_swap_complete(port, -ENOTCONN);
+ 		tcpm_pps_complete(port, -ENOTCONN);
+ 		tcpm_snk_detach(port);
+-		if (tcpm_start_drp_toggling(port, TYPEC_CC_RD)) {
+-			tcpm_set_state(port, DRP_TOGGLING, 0);
++		if (tcpm_start_toggling(port, TYPEC_CC_RD)) {
++			tcpm_set_state(port, TOGGLING, 0);
+ 			break;
+ 		}
+ 		tcpm_set_cc(port, TYPEC_CC_RD);
+@@ -3642,7 +3638,7 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
+ 						       : "connected");
+ 
+ 	switch (port->state) {
+-	case DRP_TOGGLING:
++	case TOGGLING:
+ 		if (tcpm_port_is_debug(port) || tcpm_port_is_audio(port) ||
+ 		    tcpm_port_is_source(port))
+ 			tcpm_set_state(port, SRC_ATTACH_WAIT, 0);
+diff --git a/drivers/usb/typec/typec_wcove.c b/drivers/usb/typec/typec_wcove.c
+index 6770afd407654..f1f8f45e2f3dc 100644
+--- a/drivers/usb/typec/typec_wcove.c
++++ b/drivers/usb/typec/typec_wcove.c
+@@ -416,12 +416,16 @@ static int wcove_pd_transmit(struct tcpc_dev *tcpc,
+ 	return regmap_write(wcove->regmap, USBC_TXCMD, cmd | USBC_TXCMD_START);
+ }
+ 
+-static int wcove_start_drp_toggling(struct tcpc_dev *tcpc,
+-				    enum typec_cc_status cc)
++static int wcove_start_toggling(struct tcpc_dev *tcpc,
++				enum typec_port_type port_type,
++				enum typec_cc_status cc)
+ {
+ 	struct wcove_typec *wcove = tcpc_to_wcove(tcpc);
+ 	unsigned int usbc_ctrl;
+ 
++	if (port_type != TYPEC_PORT_DRP)
++		return -EOPNOTSUPP;
++
+ 	usbc_ctrl = USBC_CONTROL1_MODE_DRP | USBC_CONTROL1_DRPTOGGLE_RANDOM;
+ 
+ 	switch (cc) {
+@@ -642,7 +646,7 @@ static int wcove_typec_probe(struct platform_device *pdev)
+ 	wcove->tcpc.set_polarity = wcove_set_polarity;
+ 	wcove->tcpc.set_vconn = wcove_set_vconn;
+ 	wcove->tcpc.set_current_limit = wcove_set_current_limit;
+-	wcove->tcpc.start_drp_toggling = wcove_start_drp_toggling;
++	wcove->tcpc.start_toggling = wcove_start_toggling;
+ 
+ 	wcove->tcpc.set_pd_rx = wcove_set_pd_rx;
+ 	wcove->tcpc.set_roles = wcove_set_roles;
+diff --git a/include/linux/usb/tcpm.h b/include/linux/usb/tcpm.h
+index 50c74a77db55c..8cb93aff69f1e 100644
+--- a/include/linux/usb/tcpm.h
++++ b/include/linux/usb/tcpm.h
+@@ -121,10 +121,10 @@ struct tcpc_config {
+  *		with partner.
+  * @set_pd_rx:	Called to enable or disable reception of PD messages
+  * @set_roles:	Called to set power and data roles
+- * @start_drp_toggling:
+- *		Optional; if supported by hardware, called to start DRP
+- *		toggling. DRP toggling is stopped automatically if
+- *		a connection is established.
++ * @start_toggling:
++ *		Optional; if supported by hardware, called to start dual-role
++ *		toggling or single-role connection detection. Toggling stops
++ *		automatically if a connection is established.
+  * @try_role:	Optional; called to set a preferred role
+  * @pd_transmit:Called to transmit PD message
+  * @mux:	Pointer to multiplexer data
+@@ -147,8 +147,9 @@ struct tcpc_dev {
+ 	int (*set_pd_rx)(struct tcpc_dev *dev, bool on);
+ 	int (*set_roles)(struct tcpc_dev *dev, bool attached,
+ 			 enum typec_role role, enum typec_data_role data);
+-	int (*start_drp_toggling)(struct tcpc_dev *dev,
+-				  enum typec_cc_status cc);
++	int (*start_toggling)(struct tcpc_dev *dev,
++			      enum typec_port_type port_type,
++			      enum typec_cc_status cc);
+ 	int (*try_role)(struct tcpc_dev *dev, int role);
+ 	int (*pd_transmit)(struct tcpc_dev *dev, enum tcpm_transmit_type type,
+ 			   const struct pd_message *msg);
+-- 
+2.20.1
+
diff --git a/queue-4.19/usb-typec-tps6598x-fix-build-error-without-config_re.patch b/queue-4.19/usb-typec-tps6598x-fix-build-error-without-config_re.patch
new file mode 100644
index 00000000000..279b5cbade6
--- /dev/null
+++ b/queue-4.19/usb-typec-tps6598x-fix-build-error-without-config_re.patch
@@ -0,0 +1,42 @@
+From 90822f88a5f1d065a81c12ddc4ee6358beb99c66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 20:10:26 +0800
+Subject: usb: typec: tps6598x: Fix build error without CONFIG_REGMAP_I2C
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 35af2445dc306403254a181507b390ec9eb725d5 ]
+
+If CONFIG_REGMAP_I2C is not set, building fails:
+
+drivers/usb/typec/tps6598x.o: In function `tps6598x_probe':
+tps6598x.c:(.text+0x5f0): undefined reference to `__devm_regmap_init_i2c'
+
+Select REGMAP_I2C to fix this.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20190903121026.22148-1-yuehaibing@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig
+index 00878c386dd09..8445890accdfe 100644
+--- a/drivers/usb/typec/Kconfig
++++ b/drivers/usb/typec/Kconfig
+@@ -95,6 +95,7 @@ source "drivers/usb/typec/ucsi/Kconfig"
+ config TYPEC_TPS6598X
+ 	tristate "TI TPS6598x USB Power Delivery controller driver"
+ 	depends on I2C
++	select REGMAP_I2C
+ 	help
+ 	  Say Y or M here if your system has TI TPS65982 or TPS65983 USB Power
+ 	  Delivery controller.
+-- 
+2.20.1
+
diff --git a/queue-4.19/vfio-mdev-avoid-release-parent-reference-during-erro.patch b/queue-4.19/vfio-mdev-avoid-release-parent-reference-during-erro.patch
new file mode 100644
index 00000000000..cf00927a028
--- /dev/null
+++ b/queue-4.19/vfio-mdev-avoid-release-parent-reference-during-erro.patch
@@ -0,0 +1,40 @@
+From 377be66d8539065f3c97d185d35195760c5ea5ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2019 17:49:28 -0500
+Subject: vfio/mdev: Avoid release parent reference during error path
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 60e7f2c3fe9919cee9534b422865eed49f4efb15 ]
+
+During mdev parent registration in mdev_register_device(),
+if parent device is duplicate, it releases the reference of existing
+parent device.
+This is incorrect. Existing parent device should not be touched.
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 0212f0ee8aea7..8cfa712308773 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -182,6 +182,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
+ 	/* Check for duplicate */
+ 	parent = __find_parent_device(dev);
+ 	if (parent) {
++		parent = NULL;
+ 		ret = -EEXIST;
+ 		goto add_dev_err;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch b/queue-4.19/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch
new file mode 100644
index 00000000000..91185d73075
--- /dev/null
+++ b/queue-4.19/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch
@@ -0,0 +1,77 @@
+From 1cb64db2ba80d4b6483b2736fde66c52888abef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2019 17:49:33 -0500
+Subject: vfio/mdev: Fix aborting mdev child device removal if one fails
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 6093e348a5e2475c5bb2e571346460f939998670 ]
+
+device_for_each_child() stops executing callback function for remaining
+child devices, if callback hits an error.
+Each child mdev device is independent of each other.
+While unregistering parent device, mdev core must remove all child mdev
+devices.
+Therefore, mdev_device_remove_cb() always returns success so that
+device_for_each_child doesn't abort if one child removal hits error.
+
+While at it, improve remove and unregister functions for below simplicity.
+
+There isn't need to pass forced flag pointer during mdev parent
+removal which invokes mdev_device_remove(). So simplify the flow.
+
+mdev_device_remove() is called from two paths.
+1. mdev_unregister_driver()
+     mdev_device_remove_cb()
+       mdev_device_remove()
+2. remove_store()
+     mdev_device_remove()
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_core.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 8cfa712308773..e052f62fdea7e 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -150,10 +150,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
+ 
+ static int mdev_device_remove_cb(struct device *dev, void *data)
+ {
+-	if (!dev_is_mdev(dev))
+-		return 0;
++	if (dev_is_mdev(dev))
++		mdev_device_remove(dev, true);
+ 
+-	return mdev_device_remove(dev, data ? *(bool *)data : true);
++	return 0;
+ }
+ 
+ /*
+@@ -241,7 +241,6 @@ EXPORT_SYMBOL(mdev_register_device);
+ void mdev_unregister_device(struct device *dev)
+ {
+ 	struct mdev_parent *parent;
+-	bool force_remove = true;
+ 
+ 	mutex_lock(&parent_list_lock);
+ 	parent = __find_parent_device(dev);
+@@ -255,8 +254,7 @@ void mdev_unregister_device(struct device *dev)
+ 	list_del(&parent->next);
+ 	class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
+ 
+-	device_for_each_child(dev, (void *)&force_remove,
+-			      mdev_device_remove_cb);
++	device_for_each_child(dev, NULL, mdev_device_remove_cb);
+ 
+ 	parent_remove_sysfs_files(parent);
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/vfio-mdev-follow-correct-remove-sequence.patch b/queue-4.19/vfio-mdev-follow-correct-remove-sequence.patch
new file mode 100644
index 00000000000..6302ac45784
--- /dev/null
+++ b/queue-4.19/vfio-mdev-follow-correct-remove-sequence.patch
@@ -0,0 +1,39 @@
+From f3e31cd834047df8996b36a918d2eea6191cc328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2019 17:49:32 -0500
+Subject: vfio/mdev: Follow correct remove sequence
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit a6d6f4f160f76d840e59affe664b8d3159e23056 ]
+
+mdev_remove_sysfs_files() should follow exact mirror sequence of a
+create, similar to what is followed in error unwinding path of
+mdev_create_sysfs_files().
+
+Fixes: 6a62c1dfb5c7 ("vfio/mdev: Re-order sysfs attribute creation")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
+index 249472f055097..e7770b511d033 100644
+--- a/drivers/vfio/mdev/mdev_sysfs.c
++++ b/drivers/vfio/mdev/mdev_sysfs.c
+@@ -280,7 +280,7 @@ type_link_failed:
+ 
+ void mdev_remove_sysfs_files(struct device *dev, struct mdev_type *type)
+ {
++	sysfs_remove_files(&dev->kobj, mdev_device_attrs);
+ 	sysfs_remove_link(&dev->kobj, "mdev_type");
+ 	sysfs_remove_link(type->devices_kobj, dev_name(dev));
+-	sysfs_remove_files(&dev->kobj, mdev_device_attrs);
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch b/queue-4.19/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
new file mode 100644
index 00000000000..62e4fb4de35
--- /dev/null
+++ b/queue-4.19/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
@@ -0,0 +1,69 @@
+From 92a8097a34e8238388317cd941991675a1c056db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 17:16:06 +0100
+Subject: vfio_pci: Enable memory accesses before calling pci_map_rom
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]
+
+pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
+In case the Memory Space accesses were disabled, readw() is likely
+to trigger a synchronous external abort on some platforms.
+
+In case memory accesses were disabled, re-enable them before the
+call and disable them back again just after.
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 0a6eb53e79fbf..66783a37f450c 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -696,6 +696,7 @@ static long vfio_pci_ioctl(void *device_data,
+ 		{
+ 			void __iomem *io;
+ 			size_t size;
++			u16 orig_cmd;
+ 
+ 			info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ 			info.flags = 0;
+@@ -711,15 +712,23 @@ static long vfio_pci_ioctl(void *device_data,
+ 					break;
+ 			}
+ 
+-			/* Is it really there? */
++			/*
++			 * Is it really there?  Enable memory decode for
++			 * implicit access in pci_map_rom().
++			 */
++			pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++			pci_write_config_word(pdev, PCI_COMMAND,
++					      orig_cmd | PCI_COMMAND_MEMORY);
++
+ 			io = pci_map_rom(pdev, &size);
+-			if (!io || !size) {
++			if (io) {
++				info.flags = VFIO_REGION_INFO_FLAG_READ;
++				pci_unmap_rom(pdev, io);
++			} else {
+ 				info.size = 0;
+-				break;
+ 			}
+-			pci_unmap_rom(pdev, io);
+ 
+-			info.flags = VFIO_REGION_INFO_FLAG_READ;
++			pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ 			break;
+ 		}
+ 		case VFIO_PCI_VGA_REGION_INDEX:
+-- 
+2.20.1
+
diff --git a/queue-4.19/vhost-test-stop-device-before-reset.patch b/queue-4.19/vhost-test-stop-device-before-reset.patch
new file mode 100644
index 00000000000..6c6e6e5188f
--- /dev/null
+++ b/queue-4.19/vhost-test-stop-device-before-reset.patch
@@ -0,0 +1,43 @@
+From 72357995fc48d78be019ca9eb799c05a75d50617 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 13:56:59 -0400
+Subject: vhost/test: stop device before reset
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 245cdd9fbd396483d501db83047116e2530f245f ]
+
+When device stop was moved out of reset, test device wasn't updated to
+stop before reset, this resulted in a use after free.  Fix by invoking
+stop appropriately.
+
+Fixes: b211616d7125 ("vhost: move -net specific code out")
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
+index a9be2d8e98df7..55090d9f9de0d 100644
+--- a/drivers/vhost/test.c
++++ b/drivers/vhost/test.c
+@@ -162,6 +162,7 @@ static int vhost_test_release(struct inode *inode, struct file *f)
+ 
+ 	vhost_test_stop(n, &private);
+ 	vhost_test_flush(n);
++	vhost_dev_stop(&n->dev);
+ 	vhost_dev_cleanup(&n->dev);
+ 	/* We do an extra flush before freeing memory,
+ 	 * since jobs can re-queue themselves. */
+@@ -238,6 +239,7 @@ static long vhost_test_reset_owner(struct vhost_test *n)
+ 	}
+ 	vhost_test_stop(n, &priv);
+ 	vhost_test_flush(n);
++	vhost_dev_stop(&n->dev);
+ 	vhost_dev_reset_owner(&n->dev, umem);
+ done:
+ 	mutex_unlock(&n->dev.mutex);
+-- 
+2.20.1
+
diff --git a/queue-4.19/vxlan-changelink-fix-handling-of-default-remotes.patch b/queue-4.19/vxlan-changelink-fix-handling-of-default-remotes.patch
new file mode 100644
index 00000000000..acb296f3cb6
--- /dev/null
+++ b/queue-4.19/vxlan-changelink-fix-handling-of-default-remotes.patch
@@ -0,0 +1,94 @@
+From be674afb08fbc3de1ab2bf290bfd1ee81aeea010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 13:16:02 +0000
+Subject: vxlan: changelink: Fix handling of default remotes
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit ce5e098f7a10b4bf8e948c12fa350320c5c3afad ]
+
+Default remotes are stored as FDB entries with an Ethernet address of
+00:00:00:00:00:00. When a request is made to change a remote address of
+a VXLAN device, vxlan_changelink() first deletes the existing default
+remote, and then creates a new FDB entry.
+
+This works well as long as the list of default remotes matches exactly
+the configuration of a VXLAN remote address. Thus when the VXLAN device
+has a remote of X, there should be exactly one default remote FDB entry
+X. If the VXLAN device has no remote address, there should be no such
+entry.
+
+Besides using "ip link set", it is possible to manipulate the list of
+default remotes by using the "bridge fdb". It is therefore easy to break
+the above condition. Under such circumstances, the __vxlan_fdb_delete()
+call doesn't delete the FDB entry itself, but just one remote. The
+following vxlan_fdb_create() then creates a new FDB entry, leading to a
+situation where two entries exist for the address 00:00:00:00:00:00,
+each with a different subset of default remotes.
+
+An even more obvious breakage rooted in the same cause can be observed
+when a remote address is configured for a VXLAN device that did not have
+one before. In that case vxlan_changelink() doesn't remove any remote,
+and just creates a new FDB entry for the new address:
+
+$ ip link add name vx up type vxlan id 2000 dstport 4789
+$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.20 self permanent
+$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.30 self permanent
+$ ip link set dev vx type vxlan remote 192.0.2.30
+$ bridge fdb sh dev vx | grep 00:00:00:00:00:00
+00:00:00:00:00:00 dst 192.0.2.30 self permanent <- new entry, 1 rdst
+00:00:00:00:00:00 dst 192.0.2.20 self permanent <- orig. entry, 2 rdsts
+00:00:00:00:00:00 dst 192.0.2.30 self permanent
+
+To fix this, instead of calling vxlan_fdb_create() directly, defer to
+vxlan_fdb_update(). That has logic to handle the duplicates properly.
+Additionally, it also handles notifications, so drop that call from
+changelink as well.
+
+Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 613f366818536..df88981e796a4 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3496,7 +3496,6 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ 	struct vxlan_rdst *dst = &vxlan->default_dst;
+ 	struct vxlan_rdst old_dst;
+ 	struct vxlan_config conf;
+-	struct vxlan_fdb *f = NULL;
+ 	int err;
+ 
+ 	err = vxlan_nl2conf(tb, data,
+@@ -3522,19 +3521,19 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ 					   old_dst.remote_ifindex, 0);
+ 
+ 		if (!vxlan_addr_any(&dst->remote_ip)) {
+-			err = vxlan_fdb_create(vxlan, all_zeros_mac,
++			err = vxlan_fdb_update(vxlan, all_zeros_mac,
+ 					       &dst->remote_ip,
+ 					       NUD_REACHABLE | NUD_PERMANENT,
++					       NLM_F_APPEND | NLM_F_CREATE,
+ 					       vxlan->cfg.dst_port,
+ 					       dst->remote_vni,
+ 					       dst->remote_vni,
+ 					       dst->remote_ifindex,
+-					       NTF_SELF, &f);
++					       NTF_SELF);
+ 			if (err) {
+ 				spin_unlock_bh(&vxlan->hash_lock);
+ 				return err;
+ 			}
+-			vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
+ 		}
+ 		spin_unlock_bh(&vxlan->hash_lock);
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/watchdog-rtd119x_wdt-fix-remove-function.patch b/queue-4.19/watchdog-rtd119x_wdt-fix-remove-function.patch
new file mode 100644
index 00000000000..5ccbbc87962
--- /dev/null
+++ b/queue-4.19/watchdog-rtd119x_wdt-fix-remove-function.patch
@@ -0,0 +1,43 @@
+From 129adb65e2713636cb363a09ecbd0f5a702de175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Apr 2019 08:29:35 -0700
+Subject: watchdog: rtd119x_wdt: Fix remove function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 8dd29f19512cc75ee470d7bb8ec86af199de23a8 ]
+
+The driver registers the watchdog with devm_watchdog_register_device() but
+still calls watchdog_unregister_device() on remove. Since clocks have to
+be stopped when removing the driver, after the watchdog device has been
+unregistered, we can not drop the call to watchdog_unregister_device().
+Use watchdog_register_device() to register the watchdog.
+
+Fixes: 2bdf6acbfead7 ("watchdog: Add Realtek RTD1295")
+Cc: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/rtd119x_wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/rtd119x_wdt.c b/drivers/watchdog/rtd119x_wdt.c
+index d001c17ddfdee..99caec6882d2f 100644
+--- a/drivers/watchdog/rtd119x_wdt.c
++++ b/drivers/watchdog/rtd119x_wdt.c
+@@ -135,7 +135,7 @@ static int rtd119x_wdt_probe(struct platform_device *pdev)
+ 	rtd119x_wdt_set_timeout(&data->wdt_dev, data->wdt_dev.timeout);
+ 	rtd119x_wdt_stop(&data->wdt_dev);
+ 
+-	ret = devm_watchdog_register_device(&pdev->dev, &data->wdt_dev);
++	ret = watchdog_register_device(&data->wdt_dev);
+ 	if (ret) {
+ 		clk_disable_unprepare(data->clk);
+ 		clk_put(data->clk);
+-- 
+2.20.1
+
diff --git a/queue-4.19/wcn36xx-use-dynamic-allocation-for-large-variables.patch b/queue-4.19/wcn36xx-use-dynamic-allocation-for-large-variables.patch
new file mode 100644
index 00000000000..8badfc5c2c7
--- /dev/null
+++ b/queue-4.19/wcn36xx-use-dynamic-allocation-for-large-variables.patch
@@ -0,0 +1,345 @@
+From 79109b03f073b707cae3c7cf7418d73e52efe76a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 16:59:01 +0200
+Subject: wcn36xx: use dynamic allocation for large variables
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 355cf31912014e6ff1bb1019ae4858cad12c68cf ]
+
+clang triggers a warning about oversized stack frames that gcc does not
+notice because of slightly different inlining decisions:
+
+ath/wcn36xx/smd.c:1409:5: error: stack frame size of 1040 bytes in function 'wcn36xx_smd_config_bss' [-Werror,-Wframe-larger-than=]
+ath/wcn36xx/smd.c:640:5: error: stack frame size of 1032 bytes in function 'wcn36xx_smd_start_hw_scan' [-Werror,-Wframe-larger-than=]
+
+Basically the wcn36xx_hal_start_scan_offload_req_msg,
+wcn36xx_hal_config_bss_req_msg_v1, and wcn36xx_hal_config_bss_req_msg
+structures are too large to be put on the kernel stack, but small
+enough that gcc does not warn about them.
+
+Use kzalloc() to allocate them all. There are similar structures in other
+parts of this driver, but they are all smaller, with the next largest
+stack frame at 480 bytes for wcn36xx_smd_send_beacon.
+
+Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wcn36xx/smd.c | 186 ++++++++++++++-----------
+ 1 file changed, 105 insertions(+), 81 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
+index 00098f24116de..6cd113b3b3e49 100644
+--- a/drivers/net/wireless/ath/wcn36xx/smd.c
++++ b/drivers/net/wireless/ath/wcn36xx/smd.c
+@@ -641,52 +641,58 @@ int wcn36xx_smd_start_hw_scan(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ 			      struct cfg80211_scan_request *req)
+ {
+ 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
+-	struct wcn36xx_hal_start_scan_offload_req_msg msg_body;
++	struct wcn36xx_hal_start_scan_offload_req_msg *msg_body;
+ 	int ret, i;
+ 
+ 	if (req->ie_len > WCN36XX_MAX_SCAN_IE_LEN)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&wcn->hal_mutex);
+-	INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
++	msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
++	if (!msg_body) {
++		ret = -ENOMEM;
++		goto out;
++	}
+ 
+-	msg_body.scan_type = WCN36XX_HAL_SCAN_TYPE_ACTIVE;
+-	msg_body.min_ch_time = 30;
+-	msg_body.max_ch_time = 100;
+-	msg_body.scan_hidden = 1;
+-	memcpy(msg_body.mac, vif->addr, ETH_ALEN);
+-	msg_body.bss_type = vif_priv->bss_type;
+-	msg_body.p2p_search = vif->p2p;
++	INIT_HAL_MSG((*msg_body), WCN36XX_HAL_START_SCAN_OFFLOAD_REQ);
+ 
+-	msg_body.num_ssid = min_t(u8, req->n_ssids, ARRAY_SIZE(msg_body.ssids));
+-	for (i = 0; i < msg_body.num_ssid; i++) {
+-		msg_body.ssids[i].length = min_t(u8, req->ssids[i].ssid_len,
+-						sizeof(msg_body.ssids[i].ssid));
+-		memcpy(msg_body.ssids[i].ssid, req->ssids[i].ssid,
+-		       msg_body.ssids[i].length);
++	msg_body->scan_type = WCN36XX_HAL_SCAN_TYPE_ACTIVE;
++	msg_body->min_ch_time = 30;
++	msg_body->max_ch_time = 100;
++	msg_body->scan_hidden = 1;
++	memcpy(msg_body->mac, vif->addr, ETH_ALEN);
++	msg_body->bss_type = vif_priv->bss_type;
++	msg_body->p2p_search = vif->p2p;
++
++	msg_body->num_ssid = min_t(u8, req->n_ssids, ARRAY_SIZE(msg_body->ssids));
++	for (i = 0; i < msg_body->num_ssid; i++) {
++		msg_body->ssids[i].length = min_t(u8, req->ssids[i].ssid_len,
++						sizeof(msg_body->ssids[i].ssid));
++		memcpy(msg_body->ssids[i].ssid, req->ssids[i].ssid,
++		       msg_body->ssids[i].length);
+ 	}
+ 
+-	msg_body.num_channel = min_t(u8, req->n_channels,
+-				     sizeof(msg_body.channels));
+-	for (i = 0; i < msg_body.num_channel; i++)
+-		msg_body.channels[i] = req->channels[i]->hw_value;
++	msg_body->num_channel = min_t(u8, req->n_channels,
++				     sizeof(msg_body->channels));
++	for (i = 0; i < msg_body->num_channel; i++)
++		msg_body->channels[i] = req->channels[i]->hw_value;
+ 
+-	msg_body.header.len -= WCN36XX_MAX_SCAN_IE_LEN;
++	msg_body->header.len -= WCN36XX_MAX_SCAN_IE_LEN;
+ 
+ 	if (req->ie_len > 0) {
+-		msg_body.ie_len = req->ie_len;
+-		msg_body.header.len += req->ie_len;
+-		memcpy(msg_body.ie, req->ie, req->ie_len);
++		msg_body->ie_len = req->ie_len;
++		msg_body->header.len += req->ie_len;
++		memcpy(msg_body->ie, req->ie, req->ie_len);
+ 	}
+ 
+-	PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
++	PREPARE_HAL_BUF(wcn->hal_buf, (*msg_body));
+ 
+ 	wcn36xx_dbg(WCN36XX_DBG_HAL,
+ 		    "hal start hw-scan (channels: %u; ssids: %u; p2p: %s)\n",
+-		    msg_body.num_channel, msg_body.num_ssid,
+-		    msg_body.p2p_search ? "yes" : "no");
++		    msg_body->num_channel, msg_body->num_ssid,
++		    msg_body->p2p_search ? "yes" : "no");
+ 
+-	ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
++	ret = wcn36xx_smd_send_and_wait(wcn, msg_body->header.len);
+ 	if (ret) {
+ 		wcn36xx_err("Sending hal_start_scan_offload failed\n");
+ 		goto out;
+@@ -698,6 +704,7 @@ int wcn36xx_smd_start_hw_scan(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ 		goto out;
+ 	}
+ out:
++	kfree(msg_body);
+ 	mutex_unlock(&wcn->hal_mutex);
+ 	return ret;
+ }
+@@ -1257,96 +1264,104 @@ out:
+ static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+ 			const struct wcn36xx_hal_config_bss_req_msg *orig)
+ {
+-	struct wcn36xx_hal_config_bss_req_msg_v1 msg_body;
+-	struct wcn36xx_hal_config_bss_params_v1 *bss = &msg_body.bss_params;
+-	struct wcn36xx_hal_config_sta_params_v1 *sta = &bss->sta;
++	struct wcn36xx_hal_config_bss_req_msg_v1 *msg_body;
++	struct wcn36xx_hal_config_bss_params_v1 *bss;
++	struct wcn36xx_hal_config_sta_params_v1 *sta;
++	int ret;
++
++	msg_body = kzalloc(sizeof(*msg_body), GFP_KERNEL);
++	if (!msg_body)
++		return -ENOMEM;
++
++	INIT_HAL_MSG((*msg_body), WCN36XX_HAL_CONFIG_BSS_REQ);
+ 
+-	INIT_HAL_MSG(msg_body, WCN36XX_HAL_CONFIG_BSS_REQ);
++	bss = &msg_body->bss_params;
++	sta = &bss->sta;
+ 
+ 	/* convert orig to v1 */
+-	memcpy(&msg_body.bss_params.bssid,
++	memcpy(&msg_body->bss_params.bssid,
+ 	       &orig->bss_params.bssid, ETH_ALEN);
+-	memcpy(&msg_body.bss_params.self_mac_addr,
++	memcpy(&msg_body->bss_params.self_mac_addr,
+ 	       &orig->bss_params.self_mac_addr, ETH_ALEN);
+ 
+-	msg_body.bss_params.bss_type = orig->bss_params.bss_type;
+-	msg_body.bss_params.oper_mode = orig->bss_params.oper_mode;
+-	msg_body.bss_params.nw_type = orig->bss_params.nw_type;
++	msg_body->bss_params.bss_type = orig->bss_params.bss_type;
++	msg_body->bss_params.oper_mode = orig->bss_params.oper_mode;
++	msg_body->bss_params.nw_type = orig->bss_params.nw_type;
+ 
+-	msg_body.bss_params.short_slot_time_supported =
++	msg_body->bss_params.short_slot_time_supported =
+ 		orig->bss_params.short_slot_time_supported;
+-	msg_body.bss_params.lla_coexist = orig->bss_params.lla_coexist;
+-	msg_body.bss_params.llb_coexist = orig->bss_params.llb_coexist;
+-	msg_body.bss_params.llg_coexist = orig->bss_params.llg_coexist;
+-	msg_body.bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
+-	msg_body.bss_params.lln_non_gf_coexist =
++	msg_body->bss_params.lla_coexist = orig->bss_params.lla_coexist;
++	msg_body->bss_params.llb_coexist = orig->bss_params.llb_coexist;
++	msg_body->bss_params.llg_coexist = orig->bss_params.llg_coexist;
++	msg_body->bss_params.ht20_coexist = orig->bss_params.ht20_coexist;
++	msg_body->bss_params.lln_non_gf_coexist =
+ 		orig->bss_params.lln_non_gf_coexist;
+ 
+-	msg_body.bss_params.lsig_tx_op_protection_full_support =
++	msg_body->bss_params.lsig_tx_op_protection_full_support =
+ 		orig->bss_params.lsig_tx_op_protection_full_support;
+-	msg_body.bss_params.rifs_mode = orig->bss_params.rifs_mode;
+-	msg_body.bss_params.beacon_interval = orig->bss_params.beacon_interval;
+-	msg_body.bss_params.dtim_period = orig->bss_params.dtim_period;
+-	msg_body.bss_params.tx_channel_width_set =
++	msg_body->bss_params.rifs_mode = orig->bss_params.rifs_mode;
++	msg_body->bss_params.beacon_interval = orig->bss_params.beacon_interval;
++	msg_body->bss_params.dtim_period = orig->bss_params.dtim_period;
++	msg_body->bss_params.tx_channel_width_set =
+ 		orig->bss_params.tx_channel_width_set;
+-	msg_body.bss_params.oper_channel = orig->bss_params.oper_channel;
+-	msg_body.bss_params.ext_channel = orig->bss_params.ext_channel;
++	msg_body->bss_params.oper_channel = orig->bss_params.oper_channel;
++	msg_body->bss_params.ext_channel = orig->bss_params.ext_channel;
+ 
+-	msg_body.bss_params.reserved = orig->bss_params.reserved;
++	msg_body->bss_params.reserved = orig->bss_params.reserved;
+ 
+-	memcpy(&msg_body.bss_params.ssid,
++	memcpy(&msg_body->bss_params.ssid,
+ 	       &orig->bss_params.ssid,
+ 	       sizeof(orig->bss_params.ssid));
+ 
+-	msg_body.bss_params.action = orig->bss_params.action;
+-	msg_body.bss_params.rateset = orig->bss_params.rateset;
+-	msg_body.bss_params.ht = orig->bss_params.ht;
+-	msg_body.bss_params.obss_prot_enabled =
++	msg_body->bss_params.action = orig->bss_params.action;
++	msg_body->bss_params.rateset = orig->bss_params.rateset;
++	msg_body->bss_params.ht = orig->bss_params.ht;
++	msg_body->bss_params.obss_prot_enabled =
+ 		orig->bss_params.obss_prot_enabled;
+-	msg_body.bss_params.rmf = orig->bss_params.rmf;
+-	msg_body.bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
+-	msg_body.bss_params.dual_cts_protection =
++	msg_body->bss_params.rmf = orig->bss_params.rmf;
++	msg_body->bss_params.ht_oper_mode = orig->bss_params.ht_oper_mode;
++	msg_body->bss_params.dual_cts_protection =
+ 		orig->bss_params.dual_cts_protection;
+ 
+-	msg_body.bss_params.max_probe_resp_retry_limit =
++	msg_body->bss_params.max_probe_resp_retry_limit =
+ 		orig->bss_params.max_probe_resp_retry_limit;
+-	msg_body.bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
+-	msg_body.bss_params.proxy_probe_resp =
++	msg_body->bss_params.hidden_ssid = orig->bss_params.hidden_ssid;
++	msg_body->bss_params.proxy_probe_resp =
+ 		orig->bss_params.proxy_probe_resp;
+-	msg_body.bss_params.edca_params_valid =
++	msg_body->bss_params.edca_params_valid =
+ 		orig->bss_params.edca_params_valid;
+ 
+-	memcpy(&msg_body.bss_params.acbe,
++	memcpy(&msg_body->bss_params.acbe,
+ 	       &orig->bss_params.acbe,
+ 	       sizeof(orig->bss_params.acbe));
+-	memcpy(&msg_body.bss_params.acbk,
++	memcpy(&msg_body->bss_params.acbk,
+ 	       &orig->bss_params.acbk,
+ 	       sizeof(orig->bss_params.acbk));
+-	memcpy(&msg_body.bss_params.acvi,
++	memcpy(&msg_body->bss_params.acvi,
+ 	       &orig->bss_params.acvi,
+ 	       sizeof(orig->bss_params.acvi));
+-	memcpy(&msg_body.bss_params.acvo,
++	memcpy(&msg_body->bss_params.acvo,
+ 	       &orig->bss_params.acvo,
+ 	       sizeof(orig->bss_params.acvo));
+ 
+-	msg_body.bss_params.ext_set_sta_key_param_valid =
++	msg_body->bss_params.ext_set_sta_key_param_valid =
+ 		orig->bss_params.ext_set_sta_key_param_valid;
+ 
+-	memcpy(&msg_body.bss_params.ext_set_sta_key_param,
++	memcpy(&msg_body->bss_params.ext_set_sta_key_param,
+ 	       &orig->bss_params.ext_set_sta_key_param,
+ 	       sizeof(orig->bss_params.acvo));
+ 
+-	msg_body.bss_params.wcn36xx_hal_persona =
++	msg_body->bss_params.wcn36xx_hal_persona =
+ 		orig->bss_params.wcn36xx_hal_persona;
+-	msg_body.bss_params.spectrum_mgt_enable =
++	msg_body->bss_params.spectrum_mgt_enable =
+ 		orig->bss_params.spectrum_mgt_enable;
+-	msg_body.bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
+-	msg_body.bss_params.max_tx_power = orig->bss_params.max_tx_power;
++	msg_body->bss_params.tx_mgmt_power = orig->bss_params.tx_mgmt_power;
++	msg_body->bss_params.max_tx_power = orig->bss_params.max_tx_power;
+ 
+ 	wcn36xx_smd_convert_sta_to_v1(wcn, &orig->bss_params.sta,
+-				      &msg_body.bss_params.sta);
++				      &msg_body->bss_params.sta);
+ 
+-	PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
++	PREPARE_HAL_BUF(wcn->hal_buf, (*msg_body));
+ 
+ 	wcn36xx_dbg(WCN36XX_DBG_HAL,
+ 		    "hal config bss v1 bssid %pM self_mac_addr %pM bss_type %d oper_mode %d nw_type %d\n",
+@@ -1358,7 +1373,10 @@ static int wcn36xx_smd_config_bss_v1(struct wcn36xx *wcn,
+ 		    sta->bssid, sta->action, sta->sta_index,
+ 		    sta->bssid_index, sta->aid, sta->type, sta->mac);
+ 
+-	return wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
++	ret = wcn36xx_smd_send_and_wait(wcn, msg_body->header.len);
++	kfree(msg_body);
++
++	return ret;
+ }
+ 
+ 
+@@ -1410,16 +1428,21 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ 			   struct ieee80211_sta *sta, const u8 *bssid,
+ 			   bool update)
+ {
+-	struct wcn36xx_hal_config_bss_req_msg msg;
++	struct wcn36xx_hal_config_bss_req_msg *msg;
+ 	struct wcn36xx_hal_config_bss_params *bss;
+ 	struct wcn36xx_hal_config_sta_params *sta_params;
+ 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
+ 	int ret;
+ 
+ 	mutex_lock(&wcn->hal_mutex);
+-	INIT_HAL_MSG(msg, WCN36XX_HAL_CONFIG_BSS_REQ);
++	msg = kzalloc(sizeof(*msg), GFP_KERNEL);
++	if (!msg) {
++		ret = -ENOMEM;
++		goto out;
++	}
++	INIT_HAL_MSG((*msg), WCN36XX_HAL_CONFIG_BSS_REQ);
+ 
+-	bss = &msg.bss_params;
++	bss = &msg->bss_params;
+ 	sta_params = &bss->sta;
+ 
+ 	WARN_ON(is_zero_ether_addr(bssid));
+@@ -1514,11 +1537,11 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ 		    sta_params->mac);
+ 
+ 	if (!wcn36xx_is_fw_version(wcn, 1, 2, 2, 24)) {
+-		ret = wcn36xx_smd_config_bss_v1(wcn, &msg);
++		ret = wcn36xx_smd_config_bss_v1(wcn, msg);
+ 	} else {
+-		PREPARE_HAL_BUF(wcn->hal_buf, msg);
++		PREPARE_HAL_BUF(wcn->hal_buf, (*msg));
+ 
+-		ret = wcn36xx_smd_send_and_wait(wcn, msg.header.len);
++		ret = wcn36xx_smd_send_and_wait(wcn, msg->header.len);
+ 	}
+ 	if (ret) {
+ 		wcn36xx_err("Sending hal_config_bss failed\n");
+@@ -1534,6 +1557,7 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
+ 		goto out;
+ 	}
+ out:
++	kfree(msg);
+ 	mutex_unlock(&wcn->hal_mutex);
+ 	return ret;
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.19/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch b/queue-4.19/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
new file mode 100644
index 00000000000..81fcb59d5be
--- /dev/null
+++ b/queue-4.19/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
@@ -0,0 +1,41 @@
+From b03ca5683e181ce94ee65a5069ad15b3b7e91b30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:47:06 +0200
+Subject: x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ]
+
+apic->send_IPI_allbutself() takes a vector number as argument.
+
+APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is
+outside the vector space.
+
+Use NMI_VECTOR instead as that's what it is intended to be.
+
+Fixes: 82da3ff89dc2 ("x86: kgdb support")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kgdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
+index 8e36f249646e2..904e18bb38c52 100644
+--- a/arch/x86/kernel/kgdb.c
++++ b/arch/x86/kernel/kgdb.c
+@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
+  */
+ void kgdb_roundup_cpus(unsigned long flags)
+ {
+-	apic->send_IPI_allbutself(APIC_DM_NMI);
++	apic->send_IPI_allbutself(NMI_VECTOR);
+ }
+ #endif
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/x86-mm-remove-unused-variable-cpu.patch b/queue-4.19/x86-mm-remove-unused-variable-cpu.patch
new file mode 100644
index 00000000000..c9d8255dbc6
--- /dev/null
+++ b/queue-4.19/x86-mm-remove-unused-variable-cpu.patch
@@ -0,0 +1,50 @@
+From 49bb060bd152aa217cac896bd95c8bd754b1a6b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 17:01:55 -0500
+Subject: x86/mm: Remove unused variable 'cpu'
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 3609e31bc8dc03b701390f79c74fc7fe92b95039 ]
+
+The commit a2055abe9c67 ("x86/mm: Pass flush_tlb_info to
+flush_tlb_others() etc") removed the unnecessary cpu parameter from
+uv_flush_tlb_others() but left an unused variable.
+
+arch/x86/mm/tlb.c: In function 'native_flush_tlb_others':
+arch/x86/mm/tlb.c:688:16: warning: variable 'cpu' set but not used
+[-Wunused-but-set-variable]
+   unsigned int cpu;
+                ^~~
+
+Fixes: a2055abe9c67 ("x86/mm: Pass flush_tlb_info to flush_tlb_others() etc")
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Andyt Lutomirski <luto@kernel.org>
+Cc: dave.hansen@linux.intel.com
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Link: https://lkml.kernel.org/r/20190228220155.88124-1-cai@lca.pw
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/tlb.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index a6836ab0fcc73..b72296bd04a29 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -664,9 +664,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
+ 		 * that UV should be updated so that smp_call_function_many(),
+ 		 * etc, are optimal on UV.
+ 		 */
+-		unsigned int cpu;
+-
+-		cpu = smp_processor_id();
+ 		cpumask = uv_flush_tlb_others(cpumask, info);
+ 		if (cpumask)
+ 			smp_call_function_many(cpumask, flush_tlb_func_remote,
+-- 
+2.20.1
+
diff --git a/queue-4.19/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch b/queue-4.19/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
new file mode 100644
index 00000000000..ad37d091b8a
--- /dev/null
+++ b/queue-4.19/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
@@ -0,0 +1,40 @@
+From d1db3e2085432d292c451a75f132dfb4c24f03de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2019 12:03:08 +0900
+Subject: x86, perf: Fix the dependency of the x86 insn decoder selftest
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ]
+
+Since x86 instruction decoder is not only for kprobes,
+it should be tested when the insn.c is compiled.
+(e.g. perf is enabled but kprobes is disabled)
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index 7d68f0c7cfb1e..687cd1a213d50 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -181,7 +181,7 @@ config HAVE_MMIOTRACE_SUPPORT
+ 
+ config X86_DECODER_SELFTEST
+ 	bool "x86 instruction decoder selftest"
+-	depends on DEBUG_KERNEL && KPROBES
++	depends on DEBUG_KERNEL && INSTRUCTION_DECODER
+ 	depends on !COMPILE_TEST
+ 	---help---
+ 	 Perform x86 instruction decoder selftests at build time.
+-- 
+2.20.1
+
diff --git a/queue-4.19/x86-pgtable-32-fix-lowmem_pages-constant.patch b/queue-4.19/x86-pgtable-32-fix-lowmem_pages-constant.patch
new file mode 100644
index 00000000000..d570be27b5a
--- /dev/null
+++ b/queue-4.19/x86-pgtable-32-fix-lowmem_pages-constant.patch
@@ -0,0 +1,47 @@
+From 8bc60c30f2211230623bf0dad78a6289a214d2a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2019 15:04:55 +0200
+Subject: x86/pgtable/32: Fix LOWMEM_PAGES constant
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 26515699863d68058e290e18e83f444925920be5 ]
+
+clang points out that the computation of LOWMEM_PAGES causes a signed
+integer overflow on 32-bit x86:
+
+arch/x86/kernel/head32.c:83:20: error: signed shift result (0x100000000) requires 34 bits to represent, but 'int' only has 32 bits [-Werror,-Wshift-overflow]
+                (PAGE_TABLE_SIZE(LOWMEM_PAGES) << PAGE_SHIFT);
+                                 ^~~~~~~~~~~~
+arch/x86/include/asm/pgtable_32.h:109:27: note: expanded from macro 'LOWMEM_PAGES'
+ #define LOWMEM_PAGES ((((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
+                         ~^ ~~
+arch/x86/include/asm/pgtable_32.h:98:34: note: expanded from macro 'PAGE_TABLE_SIZE'
+ #define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
+
+Use the _ULL() macro to make it a 64-bit constant.
+
+Fixes: 1e620f9b23e5 ("x86/boot/32: Convert the 32-bit pgtable setup code from assembly to C")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20190710130522.1802800-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/pgtable_32.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
+index b3ec519e39827..71e1df8601765 100644
+--- a/arch/x86/include/asm/pgtable_32.h
++++ b/arch/x86/include/asm/pgtable_32.h
+@@ -106,6 +106,6 @@ do {						\
+  * with only a host target support using a 32-bit type for internal
+  * representation.
+  */
+-#define LOWMEM_PAGES ((((2<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
++#define LOWMEM_PAGES ((((_ULL(2)<<31) - __PAGE_OFFSET) >> PAGE_SHIFT))
+ 
+ #endif /* _ASM_X86_PGTABLE_32_H */
+-- 
+2.20.1
+
diff --git a/queue-4.19/xdp-fix-possible-cq-entry-leak.patch b/queue-4.19/xdp-fix-possible-cq-entry-leak.patch
new file mode 100644
index 00000000000..86ef2ddc949
--- /dev/null
+++ b/queue-4.19/xdp-fix-possible-cq-entry-leak.patch
@@ -0,0 +1,69 @@
+From a28d269f1aba9f76425077c99c2b321642d37d27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 17:25:03 +0300
+Subject: xdp: fix possible cq entry leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilya Maximets <i.maximets@samsung.com>
+
+[ Upstream commit 675716400da6f15b9d3db04ef74ee74ca9a00af3 ]
+
+Completion queue address reservation could not be undone.
+In case of bad 'queue_id' or skb allocation failure, reserved entry
+will be leaked reducing the total capacity of completion queue.
+
+Fix that by moving reservation to the point where failure is not
+possible. Additionally, 'queue_id' checking moved out from the loop
+since there is no point to check it there.
+
+Fixes: 35fcde7f8deb ("xsk: support for Tx")
+Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: William Tu <u9012063@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 547fc4554b22c..c90854bc3048e 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -218,6 +218,9 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+ 
+ 	mutex_lock(&xs->mutex);
+ 
++	if (xs->queue_id >= xs->dev->real_num_tx_queues)
++		goto out;
++
+ 	while (xskq_peek_desc(xs->tx, &desc)) {
+ 		char *buffer;
+ 		u64 addr;
+@@ -228,12 +231,6 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+ 			goto out;
+ 		}
+ 
+-		if (xskq_reserve_addr(xs->umem->cq))
+-			goto out;
+-
+-		if (xs->queue_id >= xs->dev->real_num_tx_queues)
+-			goto out;
+-
+ 		len = desc.len;
+ 		skb = sock_alloc_send_skb(sk, len, 1, &err);
+ 		if (unlikely(!skb)) {
+@@ -245,7 +242,7 @@ static int xsk_generic_xmit(struct sock *sk, struct msghdr *m,
+ 		addr = desc.addr;
+ 		buffer = xdp_umem_get_data(xs->umem, addr);
+ 		err = skb_store_bits(skb, 0, buffer, len);
+-		if (unlikely(err)) {
++		if (unlikely(err) || xskq_reserve_addr(xs->umem->cq)) {
+ 			kfree_skb(skb);
+ 			goto out;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch b/queue-4.19/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
new file mode 100644
index 00000000000..7db93227a3b
--- /dev/null
+++ b/queue-4.19/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
@@ -0,0 +1,38 @@
+From 3098dae6bb5c8d2d1dc45c4e169d390f4b641fd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 08:41:22 +0300
+Subject: xen, cpu_hotplug: Prevent an out of bounds access
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]
+
+The "cpu" variable comes from the sscanf() so Smatch marks it as
+untrusted data.  We can't pass a higher value than "nr_cpu_ids" to
+cpu_possible() or it results in an out of bounds access.
+
+Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/cpu_hotplug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
+index b1357aa4bc552..f192b6f42da9f 100644
+--- a/drivers/xen/cpu_hotplug.c
++++ b/drivers/xen/cpu_hotplug.c
+@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu)
+ }
+ static void vcpu_hotplug(unsigned int cpu)
+ {
+-	if (!cpu_possible(cpu))
++	if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
+ 		return;
+ 
+ 	switch (vcpu_online(cpu)) {
+-- 
+2.20.1
+
diff --git a/queue-4.19/xfrm-interface-ifname-may-be-wrong-in-logs.patch b/queue-4.19/xfrm-interface-ifname-may-be-wrong-in-logs.patch
new file mode 100644
index 00000000000..df1b9f5be86
--- /dev/null
+++ b/queue-4.19/xfrm-interface-ifname-may-be-wrong-in-logs.patch
@@ -0,0 +1,72 @@
+From 655cb61d248214f0bd18747934da3ec31c58a590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 12:00:21 +0200
+Subject: xfrm interface: ifname may be wrong in logs
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit e0aaa332e6a97dae57ad59cdb19e21f83c3d081c ]
+
+The ifname is copied when the interface is created, but is never updated
+later. In fact, this property is used only in one error message, where the
+netdevice pointer is available, thus let's use it.
+
+Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/xfrm.h        |  1 -
+ net/xfrm/xfrm_interface.c | 10 +---------
+ 2 files changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index fb9b19a3b7496..48dc1ce2170d8 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1054,7 +1054,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
+ void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
+ 
+ struct xfrm_if_parms {
+-	char name[IFNAMSIZ];	/* name of XFRM device */
+ 	int link;		/* ifindex of underlying L2 interface */
+ 	u32 if_id;		/* interface identifyer */
+ };
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index d6a3cdf7885c3..4ee512622e93d 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -145,8 +145,6 @@ static int xfrmi_create(struct net_device *dev)
+ 	if (err < 0)
+ 		goto out;
+ 
+-	strcpy(xi->p.name, dev->name);
+-
+ 	dev_hold(dev);
+ 	xfrmi_link(xfrmn, xi);
+ 
+@@ -293,7 +291,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ 	if (tdev == dev) {
+ 		stats->collisions++;
+ 		net_warn_ratelimited("%s: Local routing loop detected!\n",
+-				     xi->p.name);
++				     dev->name);
+ 		goto tx_err_dst_release;
+ 	}
+ 
+@@ -648,12 +646,6 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
+ 	int err;
+ 
+ 	xfrmi_netlink_parms(data, &p);
+-
+-	if (!tb[IFLA_IFNAME])
+-		return -EINVAL;
+-
+-	nla_strlcpy(p.name, tb[IFLA_IFNAME], IFNAMSIZ);
+-
+ 	xi = xfrmi_locate(net, &p);
+ 	if (xi)
+ 		return -EEXIST;
+-- 
+2.20.1
+
diff --git a/queue-4.19/xprtrdma-fix-use-after-free-in-rpcrdma_post_recvs.patch b/queue-4.19/xprtrdma-fix-use-after-free-in-rpcrdma_post_recvs.patch
new file mode 100644
index 00000000000..da0cfebba16
--- /dev/null
+++ b/queue-4.19/xprtrdma-fix-use-after-free-in-rpcrdma_post_recvs.patch
@@ -0,0 +1,42 @@
+From 0e9b4174d8ddb00bcd58abd4a42c43dbf2adf207 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2019 10:32:38 -0400
+Subject: xprtrdma: Fix use-after-free in rpcrdma_post_recvs
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 2d0abe36cf13fb7b577949fd1539326adddcc9bc ]
+
+Dereference wr->next /before/ the memory backing wr has been
+released. This issue was found by code inspection. It is not
+expected to be a significant problem because it is in an error
+path that is almost never executed.
+
+Fixes: 7c8d9e7c8863 ("xprtrdma: Move Receive posting to ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/verbs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 90ec322dbbc0f..ef1f3d076af96 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -1558,10 +1558,11 @@ rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
+ 	rc = ib_post_recv(r_xprt->rx_ia.ri_id->qp, wr,
+ 			  (const struct ib_recv_wr **)&bad_wr);
+ 	if (rc) {
+-		for (wr = bad_wr; wr; wr = wr->next) {
++		for (wr = bad_wr; wr;) {
+ 			struct rpcrdma_rep *rep;
+ 
+ 			rep = container_of(wr, struct rpcrdma_rep, rr_recv_wr);
++			wr = wr->next;
+ 			rpcrdma_recv_buffer_put(rep);
+ 			--count;
+ 		}
+-- 
+2.20.1
+
diff --git a/queue-4.19/xsk-add-missing-smp_rmb-in-xsk_mmap.patch b/queue-4.19/xsk-add-missing-smp_rmb-in-xsk_mmap.patch
new file mode 100644
index 00000000000..59427eb8fdd
--- /dev/null
+++ b/queue-4.19/xsk-add-missing-smp_rmb-in-xsk_mmap.patch
@@ -0,0 +1,52 @@
+From 9231d0cf23240ec3fd7adba171cb0d484a96cf56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Feb 2019 14:13:50 +0100
+Subject: xsk: add missing smp_rmb() in xsk_mmap
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit e6762c8bcf982821935a2b1cb33cf8335d0eefae ]
+
+All the setup code in AF_XDP is protected by a mutex with the
+exception of the mmap code that cannot use it. To make sure that a
+process banging on the mmap call at the same time as another process
+is setting up the socket, smp_wmb() calls were added in the umem
+registration code and the queue creation code, so that the published
+structures that xsk_mmap needs would be consistent. However, the
+corresponding smp_rmb() calls were not added to the xsk_mmap
+code. This patch adds these calls.
+
+Fixes: 37b076933a8e3 ("xsk: add missing write- and data-dependency barrier")
+Fixes: c0c77d8fb787c ("xsk: add user memory registration support sockopt")
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index ff15207036dc5..547fc4554b22c 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -661,6 +661,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
+ 		if (!umem)
+ 			return -EINVAL;
+ 
++		/* Matches the smp_wmb() in XDP_UMEM_REG */
++		smp_rmb();
+ 		if (offset == XDP_UMEM_PGOFF_FILL_RING)
+ 			q = READ_ONCE(umem->fq);
+ 		else if (offset == XDP_UMEM_PGOFF_COMPLETION_RING)
+@@ -670,6 +672,8 @@ static int xsk_mmap(struct file *file, struct socket *sock,
+ 	if (!q)
+ 		return -EINVAL;
+ 
++	/* Matches the smp_wmb() in xsk_init_queue */
++	smp_rmb();
+ 	qpg = virt_to_head_page(q->ring);
+ 	if (size > (PAGE_SIZE << compound_order(qpg)))
+ 		return -EINVAL;
+-- 
+2.20.1
+
diff --git a/queue-4.19/xsk-avoid-store-tearing-when-assigning-queues.patch b/queue-4.19/xsk-avoid-store-tearing-when-assigning-queues.patch
new file mode 100644
index 00000000000..f4a8d2b96e8
--- /dev/null
+++ b/queue-4.19/xsk-avoid-store-tearing-when-assigning-queues.patch
@@ -0,0 +1,41 @@
+From 0d536c4e7b6fe532088c9f314f6e6865a7c88ea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 13:49:10 +0200
+Subject: xsk: avoid store-tearing when assigning queues
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 94a997637c5b562fa0ca44fca1d2cd02ec08236f ]
+
+Use WRITE_ONCE when doing the store of tx, rx, fq, and cq, to avoid
+potential store-tearing. These members are read outside of the control
+mutex in the mmap implementation.
+
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Fixes: 37b076933a8e ("xsk: add missing write- and data-dependency barrier")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index c90854bc3048e..b580078f04d15 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -320,7 +320,7 @@ static int xsk_init_queue(u32 entries, struct xsk_queue **queue,
+ 
+ 	/* Make sure queue is ready before it can be seen by others */
+ 	smp_wmb();
+-	*queue = q;
++	WRITE_ONCE(*queue, q);
+ 	return 0;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/queue-4.19/xsk-avoid-store-tearing-when-assigning-umem.patch b/queue-4.19/xsk-avoid-store-tearing-when-assigning-umem.patch
new file mode 100644
index 00000000000..1b24fa34326
--- /dev/null
+++ b/queue-4.19/xsk-avoid-store-tearing-when-assigning-umem.patch
@@ -0,0 +1,50 @@
+From f3df525fccc34b0ca5d2a7774bfc222583b70e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 13:49:11 +0200
+Subject: xsk: avoid store-tearing when assigning umem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 9764f4b301c3e7eb3b75eec85b73cad449cdbb0d ]
+
+The umem member of struct xdp_sock is read outside of the control
+mutex, in the mmap implementation, and needs a WRITE_ONCE to avoid
+potential store-tearing.
+
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Fixes: 423f38329d26 ("xsk: add umem fill queue support and mmap")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xsk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index b580078f04d15..72caa4fb13f47 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -454,7 +454,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+ 		}
+ 
+ 		xdp_get_umem(umem_xs->umem);
+-		xs->umem = umem_xs->umem;
++		WRITE_ONCE(xs->umem, umem_xs->umem);
+ 		sockfd_put(sock);
+ 	} else if (!xs->umem || !xdp_umem_validate_queues(xs->umem)) {
+ 		err = -EINVAL;
+@@ -534,7 +534,7 @@ static int xsk_setsockopt(struct socket *sock, int level, int optname,
+ 
+ 		/* Make sure umem is ready before it can be seen by others */
+ 		smp_wmb();
+-		xs->umem = umem;
++		WRITE_ONCE(xs->umem, umem);
+ 		mutex_unlock(&xs->mutex);
+ 		return 0;
+ 	}
+-- 
+2.20.1
+
diff --git a/queue-4.19/xsk-fix-registration-of-rx-only-sockets.patch b/queue-4.19/xsk-fix-registration-of-rx-only-sockets.patch
new file mode 100644
index 00000000000..bce6e810e61
--- /dev/null
+++ b/queue-4.19/xsk-fix-registration-of-rx-only-sockets.patch
@@ -0,0 +1,60 @@
+From c0391289e2ca0f814890cdfb37bd831207a836fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:16:58 +0200
+Subject: xsk: Fix registration of Rx-only sockets
+
+From: Magnus Karlsson <magnus.karlsson@intel.com>
+
+[ Upstream commit 2afd23f78f39da84937006ecd24aa664a4ab052b ]
+
+Having Rx-only AF_XDP sockets can potentially lead to a crash in the
+system by a NULL pointer dereference in xsk_umem_consume_tx(). This
+function iterates through a list of all sockets tied to a umem and
+checks if there are any packets to send on the Tx ring. Rx-only
+sockets do not have a Tx ring, so this will cause a NULL pointer
+dereference. This will happen if you have registered one or more
+Rx-only sockets to a umem and the driver is checking the Tx ring even
+on Rx, or if the XDP_SHARED_UMEM mode is used and there is a mix of
+Rx-only and other sockets tied to the same umem.
+
+Fixed by only putting sockets with a Tx component on the list that
+xsk_umem_consume_tx() iterates over.
+
+Fixes: ac98d8aab61b ("xsk: wire upp Tx zero-copy functions")
+Reported-by: Kal Cutter Conley <kal.conley@dectris.com>
+Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Link: https://lore.kernel.org/bpf/1571645818-16244-1-git-send-email-magnus.karlsson@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xdp/xdp_umem.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
+index d9117ab035f7c..556a649512b60 100644
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -23,6 +23,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
+ {
+ 	unsigned long flags;
+ 
++	if (!xs->tx)
++		return;
++
+ 	spin_lock_irqsave(&umem->xsk_list_lock, flags);
+ 	list_add_rcu(&xs->list, &umem->xsk_list);
+ 	spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
+@@ -32,6 +35,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
+ {
+ 	unsigned long flags;
+ 
++	if (!xs->tx)
++		return;
++
+ 	spin_lock_irqsave(&umem->xsk_list_lock, flags);
+ 	list_del_rcu(&xs->list);
+ 	spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
+-- 
+2.20.1
+
-- 
2.47.3