--- /dev/null
+From f1baca8896ae18e12c45552a4c4ae2086aa7e02c Mon Sep 17 00:00:00 2001
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Date: Mon, 23 Mar 2020 09:19:33 +0100
+Subject: ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+commit f1baca8896ae18e12c45552a4c4ae2086aa7e02c upstream.
+
+512a928affd5 ("ARM: imx: build v7_cpu_resume() unconditionally")
+introduced an unintended linker error for i.MX6 configurations that have
+ARM_CPU_SUSPEND=n which can happen if neither CONFIG_PM, CONFIG_CPU_IDLE,
+nor ARM_PSCI_FW are selected.
+
+Fix this by having v7_cpu_resume() compiled only when cpu_resume() it
+calls is available as well.
+
+The C declaration for the function remains unguarded to avoid future code
+inadvertently using a stub and introducing a regression to the bug the
+original commit fixed.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 512a928affd5 ("ARM: imx: build v7_cpu_resume() unconditionally")
+Reported-by: Clemens Gruber <clemens.gruber@pqgruber.com>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Tested-by: Roland Hieber <rhi@pengutronix.de>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/mach-imx/Makefile
++++ b/arch/arm/mach-imx/Makefile
+@@ -91,8 +91,10 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7
+ obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o
+ obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o
+ endif
++ifeq ($(CONFIG_ARM_CPU_SUSPEND),y)
+ AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a
+ obj-$(CONFIG_SOC_IMX6) += resume-imx6.o
++endif
+ obj-$(CONFIG_SOC_IMX6) += pm-imx6.o
+
+ obj-$(CONFIG_SOC_IMX1) += mach-imx1.o
--- /dev/null
+From 0afccd7601514c4b83d8cc58c740089cc447051d Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 15 Apr 2020 17:13:57 +0200
+Subject: cdc-acm: close race betrween suspend() and acm_softint
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 0afccd7601514c4b83d8cc58c740089cc447051d upstream.
+
+Suspend increments a counter, then kills the URBs,
+then kills the scheduled work. The scheduled work, however,
+may reschedule the URBs. Fix this by having the work
+check the counter.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Tested-by: Jonas Karlsson <jonas.karlsson@actia.se>
+Link: https://lore.kernel.org/r/20200415151358.32664-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -557,14 +557,14 @@ static void acm_softint(struct work_stru
+ struct acm *acm = container_of(work, struct acm, work);
+
+ if (test_bit(EVENT_RX_STALL, &acm->flags)) {
+- if (!(usb_autopm_get_interface(acm->data))) {
++ smp_mb(); /* against acm_suspend() */
++ if (!acm->susp_count) {
+ for (i = 0; i < acm->rx_buflimit; i++)
+ usb_kill_urb(acm->read_urbs[i]);
+ usb_clear_halt(acm->dev, acm->in);
+ acm_submit_read_urbs(acm, GFP_KERNEL);
+- usb_autopm_put_interface(acm->data);
++ clear_bit(EVENT_RX_STALL, &acm->flags);
+ }
+- clear_bit(EVENT_RX_STALL, &acm->flags);
+ }
+
+ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
--- /dev/null
+From a4e7279cd1d19f48f0af2a10ed020febaa9ac092 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 15 Apr 2020 17:13:58 +0200
+Subject: cdc-acm: introduce a cool down
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit a4e7279cd1d19f48f0af2a10ed020febaa9ac092 upstream.
+
+Immediate submission in case of a babbling device can lead
+to a busy loop. Introducing a delayed work.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Tested-by: Jonas Karlsson <jonas.karlsson@actia.se>
+Link: https://lore.kernel.org/r/20200415151358.32664-2-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 30 ++++++++++++++++++++++++++++--
+ drivers/usb/class/cdc-acm.h | 5 ++++-
+ 2 files changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -412,9 +412,12 @@ static void acm_ctrl_irq(struct urb *urb
+
+ exit:
+ retval = usb_submit_urb(urb, GFP_ATOMIC);
+- if (retval && retval != -EPERM)
++ if (retval && retval != -EPERM && retval != -ENODEV)
+ dev_err(&acm->control->dev,
+ "%s - usb_submit_urb failed: %d\n", __func__, retval);
++ else
++ dev_vdbg(&acm->control->dev,
++ "control resubmission terminated %d\n", retval);
+ }
+
+ static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags)
+@@ -430,6 +433,8 @@ static int acm_submit_read_urb(struct ac
+ dev_err(&acm->data->dev,
+ "urb %d failed submission with %d\n",
+ index, res);
++ } else {
++ dev_vdbg(&acm->data->dev, "intended failure %d\n", res);
+ }
+ set_bit(index, &acm->read_urbs_free);
+ return res;
+@@ -471,6 +476,7 @@ static void acm_read_bulk_callback(struc
+ int status = urb->status;
+ bool stopped = false;
+ bool stalled = false;
++ bool cooldown = false;
+
+ dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
+ rb->index, urb->actual_length, status);
+@@ -497,6 +503,14 @@ static void acm_read_bulk_callback(struc
+ __func__, status);
+ stopped = true;
+ break;
++ case -EOVERFLOW:
++ case -EPROTO:
++ dev_dbg(&acm->data->dev,
++ "%s - cooling babbling device\n", __func__);
++ usb_mark_last_busy(acm->dev);
++ set_bit(rb->index, &acm->urbs_in_error_delay);
++ cooldown = true;
++ break;
+ default:
+ dev_dbg(&acm->data->dev,
+ "%s - nonzero urb status received: %d\n",
+@@ -518,9 +532,11 @@ static void acm_read_bulk_callback(struc
+ */
+ smp_mb__after_atomic();
+
+- if (stopped || stalled) {
++ if (stopped || stalled || cooldown) {
+ if (stalled)
+ schedule_work(&acm->work);
++ else if (cooldown)
++ schedule_delayed_work(&acm->dwork, HZ / 2);
+ return;
+ }
+
+@@ -567,6 +583,12 @@ static void acm_softint(struct work_stru
+ }
+ }
+
++ if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) {
++ for (i = 0; i < ACM_NR; i++)
++ if (test_and_clear_bit(i, &acm->urbs_in_error_delay))
++ acm_submit_read_urb(acm, i, GFP_NOIO);
++ }
++
+ if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
+ tty_port_tty_wakeup(&acm->port);
+ }
+@@ -1333,6 +1355,7 @@ made_compressed_probe:
+ acm->readsize = readsize;
+ acm->rx_buflimit = num_rx_buf;
+ INIT_WORK(&acm->work, acm_softint);
++ INIT_DELAYED_WORK(&acm->dwork, acm_softint);
+ init_waitqueue_head(&acm->wioctl);
+ spin_lock_init(&acm->write_lock);
+ spin_lock_init(&acm->read_lock);
+@@ -1542,6 +1565,7 @@ static void acm_disconnect(struct usb_in
+
+ acm_kill_urbs(acm);
+ cancel_work_sync(&acm->work);
++ cancel_delayed_work_sync(&acm->dwork);
+
+ tty_unregister_device(acm_tty_driver, acm->minor);
+
+@@ -1584,6 +1608,8 @@ static int acm_suspend(struct usb_interf
+
+ acm_kill_urbs(acm);
+ cancel_work_sync(&acm->work);
++ cancel_delayed_work_sync(&acm->dwork);
++ acm->urbs_in_error_delay = 0;
+
+ return 0;
+ }
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -109,8 +109,11 @@ struct acm {
+ # define EVENT_TTY_WAKEUP 0
+ # define EVENT_RX_STALL 1
+ # define ACM_THROTTLED 2
++# define ACM_ERROR_DELAY 3
++ unsigned long urbs_in_error_delay; /* these need to be restarted after a delay */
+ struct usb_cdc_line_coding line; /* bits, stop, parity */
+- struct work_struct work; /* work queue entry for line discipline waking up */
++ struct work_struct work; /* work queue entry for various purposes*/
++ struct delayed_work dwork; /* for cool downs needed in error recovery */
+ unsigned int ctrlin; /* input control lines (DCD, DSR, RI, break, overruns) */
+ unsigned int ctrlout; /* output control lines (DTR, RTS) */
+ struct async_icount iocount; /* counters for control line changes */
--- /dev/null
+From 0fe0781f29dd8ab618999e6bda33c782ebbdb109 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@cjr.nz>
+Date: Mon, 20 Apr 2020 23:44:24 -0300
+Subject: cifs: fix uninitialised lease_key in open_shroot()
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+commit 0fe0781f29dd8ab618999e6bda33c782ebbdb109 upstream.
+
+SMB2_open_init() expects a pre-initialised lease_key when opening a
+file with a lease, so set pfid->lease_key prior to calling it in
+open_shroot().
+
+This issue was observed when performing some DFS failover tests and
+the lease key was never randomly generated.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -693,6 +693,11 @@ int open_shroot(unsigned int xid, struct
+ if (smb3_encryption_required(tcon))
+ flags |= CIFS_TRANSFORM_REQ;
+
++ if (!server->ops->new_lease_key)
++ return -EIO;
++
++ server->ops->new_lease_key(pfid);
++
+ memset(rqst, 0, sizeof(rqst));
+ resp_buftype[0] = resp_buftype[1] = CIFS_NO_BUFFER;
+ memset(rsp_iov, 0, sizeof(rsp_iov));
--- /dev/null
+From 3c2760b78f90db874401d97e3c17829e2e36f400 Mon Sep 17 00:00:00 2001
+From: Xu Yilun <yilun.xu@intel.com>
+Date: Tue, 25 Feb 2020 14:07:18 +0800
+Subject: fpga: dfl: pci: fix return value of cci_pci_sriov_configure
+
+From: Xu Yilun <yilun.xu@intel.com>
+
+commit 3c2760b78f90db874401d97e3c17829e2e36f400 upstream.
+
+pci_driver.sriov_configure should return negative value on error and
+number of enabled VFs on success. But now the driver returns 0 on
+success. The sriov configure still works but will cause a warning
+message:
+
+ XX VFs requested; only 0 enabled
+
+This patch changes the return value accordingly.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Wu Hao <hao.wu@intel.com>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/fpga/dfl-pci.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/fpga/dfl-pci.c
++++ b/drivers/fpga/dfl-pci.c
+@@ -248,11 +248,13 @@ static int cci_pci_sriov_configure(struc
+ return ret;
+
+ ret = pci_enable_sriov(pcidev, num_vfs);
+- if (ret)
++ if (ret) {
+ dfl_fpga_cdev_config_ports_pf(cdev);
++ return ret;
++ }
+ }
+
+- return ret;
++ return num_vfs;
+ }
+
+ static void cci_pci_remove(struct pci_dev *pcidev)
--- /dev/null
+From fec874a81b3ec280b91034d892a432fc71fd1522 Mon Sep 17 00:00:00 2001
+From: Benjamin Lee <ben@b1c1l1.com>
+Date: Fri, 17 Apr 2020 11:45:38 -0700
+Subject: mei: me: fix irq number stored in hw struct
+
+From: Benjamin Lee <ben@b1c1l1.com>
+
+commit fec874a81b3ec280b91034d892a432fc71fd1522 upstream.
+
+Commit 261b3e1f2a01 ("mei: me: store irq number in the hw struct.")
+stores the irq number in the hw struct before MSI is enabled. This
+caused a regression for mei_me_synchronize_irq() waiting for the wrong
+irq number. On my laptop this causes a hang on shutdown. Fix the issue
+by storing the irq number after enabling MSI.
+
+Fixes: 261b3e1f2a01 ("mei: me: store irq number in the hw struct.")
+Signed-off-by: Benjamin Lee <ben@b1c1l1.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200417184538.349550-1-ben@b1c1l1.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/pci-me.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -212,11 +212,12 @@ static int mei_me_probe(struct pci_dev *
+ }
+ hw = to_me_hw(dev);
+ hw->mem_addr = pcim_iomap_table(pdev)[0];
+- hw->irq = pdev->irq;
+ hw->read_fws = mei_me_read_fws;
+
+ pci_enable_msi(pdev);
+
++ hw->irq = pdev->irq;
++
+ /* request and enable interrupt */
+ irqflags = pci_dev_msi_enabled(pdev) ? IRQF_ONESHOT : IRQF_SHARED;
+
--- /dev/null
+From b61c38baa98056d4802ff5be5cfb979efc2d0f7a Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Mon, 20 Apr 2020 05:37:42 +0000
+Subject: powerpc/8xx: Fix STRICT_KERNEL_RWX startup test failure
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit b61c38baa98056d4802ff5be5cfb979efc2d0f7a upstream.
+
+WRITE_RO lkdtm test works.
+
+But when selecting CONFIG_DEBUG_RODATA_TEST, the kernel reports
+ rodata_test: test data was not read only
+
+This is because when rodata test runs, there are still old entries
+in TLB.
+
+Flush TLB after setting kernel pages RO or NX.
+
+Fixes: d5f17ee96447 ("powerpc/8xx: don't disable large TLBs with CONFIG_STRICT_KERNEL_RWX")
+Cc: stable@vger.kernel.org # v5.1+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/485caac75f195f18c11eb077b0031fdd2bb7fb9e.1587361039.git.christophe.leroy@c-s.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/nohash/8xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/powerpc/mm/nohash/8xx.c
++++ b/arch/powerpc/mm/nohash/8xx.c
+@@ -185,6 +185,7 @@ void mmu_mark_initmem_nx(void)
+ mmu_mapin_ram_chunk(etext8, einittext8, PAGE_KERNEL);
+ }
+ }
++ _tlbil_all();
+ }
+
+ #ifdef CONFIG_STRICT_KERNEL_RWX
+@@ -199,6 +200,8 @@ void mmu_mark_rodata_ro(void)
+ ~(LARGE_PAGE_SIZE_8M - 1)));
+ mmu_patch_addis(&patch__dtlbmiss_romem_top, -__pa(_sinittext));
+
++ _tlbil_all();
++
+ /* Update page tables for PTDUMP and BDI */
+ mmu_mapin_ram_chunk(0, sinittext, __pgprot(0));
+ mmu_mapin_ram_chunk(0, etext, PAGE_KERNEL_ROX);
--- /dev/null
+From 94c0b013c98583614e1ad911e8795ca36da34a85 Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Fri, 17 Apr 2020 10:19:08 +1200
+Subject: powerpc/setup_64: Set cache-line-size based on cache-block-size
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit 94c0b013c98583614e1ad911e8795ca36da34a85 upstream.
+
+If {i,d}-cache-block-size is set and {i,d}-cache-line-size is not, use
+the block-size value for both. Per the devicetree spec cache-line-size
+is only needed if it differs from the block size.
+
+Originally the code would fallback from block size to line size. An
+error message was printed if both properties were missing.
+
+Later the code was refactored to use clearer names and logic but it
+inadvertently made line size a required property, meaning on systems
+without a line size property we fall back to the default from the
+cputable.
+
+On powernv (OPAL) platforms, since the introduction of device tree CPU
+features (5a61ef74f269 ("powerpc/64s: Support new device tree binding
+for discovering CPU features")), that has led to the wrong value being
+used, as the fallback value is incorrect for Power8/Power9 CPUs.
+
+The incorrect values flow through to the VDSO and also to the sysconf
+values, SC_LEVEL1_ICACHE_LINESIZE etc.
+
+Fixes: bd067f83b084 ("powerpc/64: Fix naming of cache block vs. cache line")
+Cc: stable@vger.kernel.org # v4.11+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reported-by: Qian Cai <cai@lca.pw>
+[mpe: Add even more detail to change log]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200416221908.7886-1-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/setup_64.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -534,6 +534,8 @@ static bool __init parse_cache_info(stru
+ lsizep = of_get_property(np, propnames[3], NULL);
+ if (bsizep == NULL)
+ bsizep = lsizep;
++ if (lsizep == NULL)
++ lsizep = bsizep;
+ if (lsizep != NULL)
+ lsize = be32_to_cpu(*lsizep);
+ if (bsizep != NULL)
--- /dev/null
+From 72d68197281e2ad313960504d10b0c41ff87fd55 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:34 +0200
+Subject: Revert "serial: uartps: Change uart ID port allocation"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 72d68197281e2ad313960504d10b0c41ff87fd55 upstream.
+
+This reverts commit ae1cca3fa3478be92948dbbcd722390272032ade.
+
+With setting up NR_PORTS to 16 to be able to use serial2 and higher
+aliases and don't loose functionality which was intended by these changes.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/a94931b65ce0089f76fb1fe6b446a08731bff754.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 111 ++++---------------------------------
+ 1 file changed, 13 insertions(+), 98 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -27,6 +27,7 @@
+ #define CDNS_UART_TTY_NAME "ttyPS"
+ #define CDNS_UART_NAME "xuartps"
+ #define CDNS_UART_MAJOR 0 /* use dynamic node allocation */
++#define CDNS_UART_NR_PORTS 16
+ #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */
+ #define CDNS_UART_REGISTER_SPACE 0x1000
+ #define TX_TIMEOUT 500000
+@@ -1415,90 +1416,6 @@ static const struct of_device_id cdns_ua
+ };
+ MODULE_DEVICE_TABLE(of, cdns_uart_of_match);
+
+-/*
+- * Maximum number of instances without alias IDs but if there is alias
+- * which target "< MAX_UART_INSTANCES" range this ID can't be used.
+- */
+-#define MAX_UART_INSTANCES 32
+-
+-/* Stores static aliases list */
+-static DECLARE_BITMAP(alias_bitmap, MAX_UART_INSTANCES);
+-static int alias_bitmap_initialized;
+-
+-/* Stores actual bitmap of allocated IDs with alias IDs together */
+-static DECLARE_BITMAP(bitmap, MAX_UART_INSTANCES);
+-/* Protect bitmap operations to have unique IDs */
+-static DEFINE_MUTEX(bitmap_lock);
+-
+-static int cdns_get_id(struct platform_device *pdev)
+-{
+- int id, ret;
+-
+- mutex_lock(&bitmap_lock);
+-
+- /* Alias list is stable that's why get alias bitmap only once */
+- if (!alias_bitmap_initialized) {
+- ret = of_alias_get_alias_list(cdns_uart_of_match, "serial",
+- alias_bitmap, MAX_UART_INSTANCES);
+- if (ret && ret != -EOVERFLOW) {
+- mutex_unlock(&bitmap_lock);
+- return ret;
+- }
+-
+- alias_bitmap_initialized++;
+- }
+-
+- /* Make sure that alias ID is not taken by instance without alias */
+- bitmap_or(bitmap, bitmap, alias_bitmap, MAX_UART_INSTANCES);
+-
+- dev_dbg(&pdev->dev, "Alias bitmap: %*pb\n",
+- MAX_UART_INSTANCES, bitmap);
+-
+- /* Look for a serialN alias */
+- id = of_alias_get_id(pdev->dev.of_node, "serial");
+- if (id < 0) {
+- dev_warn(&pdev->dev,
+- "No serial alias passed. Using the first free id\n");
+-
+- /*
+- * Start with id 0 and check if there is no serial0 alias
+- * which points to device which is compatible with this driver.
+- * If alias exists then try next free position.
+- */
+- id = 0;
+-
+- for (;;) {
+- dev_info(&pdev->dev, "Checking id %d\n", id);
+- id = find_next_zero_bit(bitmap, MAX_UART_INSTANCES, id);
+-
+- /* No free empty instance */
+- if (id == MAX_UART_INSTANCES) {
+- dev_err(&pdev->dev, "No free ID\n");
+- mutex_unlock(&bitmap_lock);
+- return -EINVAL;
+- }
+-
+- dev_dbg(&pdev->dev, "The empty id is %d\n", id);
+- /* Check if ID is empty */
+- if (!test_and_set_bit(id, bitmap)) {
+- /* Break the loop if bit is taken */
+- dev_dbg(&pdev->dev,
+- "Selected ID %d allocation passed\n",
+- id);
+- break;
+- }
+- dev_dbg(&pdev->dev,
+- "Selected ID %d allocation failed\n", id);
+- /* if taking bit fails then try next one */
+- id++;
+- }
+- }
+-
+- mutex_unlock(&bitmap_lock);
+-
+- return id;
+-}
+-
+ /**
+ * cdns_uart_probe - Platform driver probe
+ * @pdev: Pointer to the platform device structure
+@@ -1532,17 +1449,21 @@ static int cdns_uart_probe(struct platfo
+ if (!cdns_uart_uart_driver)
+ return -ENOMEM;
+
+- cdns_uart_data->id = cdns_get_id(pdev);
++ /* Look for a serialN alias */
++ cdns_uart_data->id = of_alias_get_id(pdev->dev.of_node, "serial");
+ if (cdns_uart_data->id < 0)
+- return cdns_uart_data->id;
++ cdns_uart_data->id = 0;
++
++ if (cdns_uart_data->id >= CDNS_UART_NR_PORTS) {
++ dev_err(&pdev->dev, "Cannot get uart_port structure\n");
++ return -ENODEV;
++ }
+
+ /* There is a need to use unique driver name */
+ driver_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%d",
+ CDNS_UART_NAME, cdns_uart_data->id);
+- if (!driver_name) {
+- rc = -ENOMEM;
+- goto err_out_id;
+- }
++ if (!driver_name)
++ return -ENOMEM;
+
+ cdns_uart_uart_driver->owner = THIS_MODULE;
+ cdns_uart_uart_driver->driver_name = driver_name;
+@@ -1571,7 +1492,7 @@ static int cdns_uart_probe(struct platfo
+ rc = uart_register_driver(cdns_uart_uart_driver);
+ if (rc < 0) {
+ dev_err(&pdev->dev, "Failed to register driver\n");
+- goto err_out_id;
++ return rc;
+ }
+
+ cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;
+@@ -1722,10 +1643,7 @@ err_out_clk_dis_pclk:
+ clk_disable_unprepare(cdns_uart_data->pclk);
+ err_out_unregister_driver:
+ uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
+-err_out_id:
+- mutex_lock(&bitmap_lock);
+- clear_bit(cdns_uart_data->id, bitmap);
+- mutex_unlock(&bitmap_lock);
++
+ return rc;
+ }
+
+@@ -1748,9 +1666,6 @@ static int cdns_uart_remove(struct platf
+ #endif
+ rc = uart_remove_one_port(cdns_uart_data->cdns_uart_driver, port);
+ port->mapbase = 0;
+- mutex_lock(&bitmap_lock);
+- clear_bit(cdns_uart_data->id, bitmap);
+- mutex_unlock(&bitmap_lock);
+ clk_disable_unprepare(cdns_uart_data->uartclk);
+ clk_disable_unprepare(cdns_uart_data->pclk);
+ pm_runtime_disable(&pdev->dev);
--- /dev/null
+From 91c9dfa25c7f95b543c280e0edf1fd8de6e90985 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:33 +0200
+Subject: Revert "serial: uartps: Do not allow use aliases >= MAX_UART_INSTANCES"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 91c9dfa25c7f95b543c280e0edf1fd8de6e90985 upstream.
+
+This reverts commit 2088cfd882d0403609bdf426e9b24372fe1b8337.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/dac3898e3e32d963f357fb436ac9a7ac3cbcf933.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1724,8 +1724,7 @@ err_out_unregister_driver:
+ uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
+ err_out_id:
+ mutex_lock(&bitmap_lock);
+- if (cdns_uart_data->id < MAX_UART_INSTANCES)
+- clear_bit(cdns_uart_data->id, bitmap);
++ clear_bit(cdns_uart_data->id, bitmap);
+ mutex_unlock(&bitmap_lock);
+ return rc;
+ }
+@@ -1750,8 +1749,7 @@ static int cdns_uart_remove(struct platf
+ rc = uart_remove_one_port(cdns_uart_data->cdns_uart_driver, port);
+ port->mapbase = 0;
+ mutex_lock(&bitmap_lock);
+- if (cdns_uart_data->id < MAX_UART_INSTANCES)
+- clear_bit(cdns_uart_data->id, bitmap);
++ clear_bit(cdns_uart_data->id, bitmap);
+ mutex_unlock(&bitmap_lock);
+ clk_disable_unprepare(cdns_uart_data->uartclk);
+ clk_disable_unprepare(cdns_uart_data->pclk);
--- /dev/null
+From b6fd2dbbd649b89a3998528994665ded1e3fbf7f Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:32 +0200
+Subject: Revert "serial: uartps: Fix error path when alloc failed"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit b6fd2dbbd649b89a3998528994665ded1e3fbf7f upstream.
+
+This reverts commit 32cf21ac4edd6c0d5b9614368a83bcdc68acb031.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/46cd7f039db847c08baa6508edd7854f7c8ff80f.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1554,10 +1554,8 @@ static int cdns_uart_probe(struct platfo
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+ cdns_uart_console = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_console),
+ GFP_KERNEL);
+- if (!cdns_uart_console) {
+- rc = -ENOMEM;
+- goto err_out_id;
+- }
++ if (!cdns_uart_console)
++ return -ENOMEM;
+
+ strncpy(cdns_uart_console->name, CDNS_UART_TTY_NAME,
+ sizeof(cdns_uart_console->name));
--- /dev/null
+From 2e01911b7cf7aa07a304a809eca1b11a4bd35859 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:30 +0200
+Subject: Revert "serial: uartps: Fix uartps_major handling"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 2e01911b7cf7aa07a304a809eca1b11a4bd35859 upstream.
+
+This reverts commit 5e9bd2d70ae7c00a95a22994abf1eef728649e64.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/310999ab5342f788a7bc1b0e68294d4f052cad07.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1576,6 +1576,7 @@ static int cdns_uart_probe(struct platfo
+ goto err_out_id;
+ }
+
++ uartps_major = cdns_uart_uart_driver->tty_driver->major;
+ cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;
+
+ /*
+@@ -1706,7 +1707,6 @@ static int cdns_uart_probe(struct platfo
+ console_port = NULL;
+ #endif
+
+- uartps_major = cdns_uart_uart_driver->tty_driver->major;
+ cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node,
+ "cts-override");
+ return 0;
+@@ -1768,12 +1768,6 @@ static int cdns_uart_remove(struct platf
+ console_port = NULL;
+ #endif
+
+- /* If this is last instance major number should be initialized */
+- mutex_lock(&bitmap_lock);
+- if (bitmap_empty(bitmap, MAX_UART_INSTANCES))
+- uartps_major = 0;
+- mutex_unlock(&bitmap_lock);
+-
+ uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
+ return rc;
+ }
--- /dev/null
+From 492cc08bc16c44e2e587362ada3f6269dee2be22 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:35 +0200
+Subject: Revert "serial: uartps: Move Port ID to device data structure"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 492cc08bc16c44e2e587362ada3f6269dee2be22 upstream.
+
+This reverts commit bed25ac0e2b6ab8f9aed2d20bc9c3a2037311800.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/eb0ec98fecdca9b79c1a3ac0c30c668b6973b193.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -189,7 +189,6 @@ MODULE_PARM_DESC(rx_timeout, "Rx timeout
+ * @pclk: APB clock
+ * @cdns_uart_driver: Pointer to UART driver
+ * @baud: Current baud rate
+- * @id: Port ID
+ * @clk_rate_change_nb: Notifier block for clock changes
+ * @quirks: Flags for RXBS support.
+ */
+@@ -199,7 +198,6 @@ struct cdns_uart {
+ struct clk *pclk;
+ struct uart_driver *cdns_uart_driver;
+ unsigned int baud;
+- int id;
+ struct notifier_block clk_rate_change_nb;
+ u32 quirks;
+ bool cts_override;
+@@ -1424,7 +1422,7 @@ MODULE_DEVICE_TABLE(of, cdns_uart_of_mat
+ */
+ static int cdns_uart_probe(struct platform_device *pdev)
+ {
+- int rc, irq;
++ int rc, id, irq;
+ struct uart_port *port;
+ struct resource *res;
+ struct cdns_uart *cdns_uart_data;
+@@ -1450,18 +1448,18 @@ static int cdns_uart_probe(struct platfo
+ return -ENOMEM;
+
+ /* Look for a serialN alias */
+- cdns_uart_data->id = of_alias_get_id(pdev->dev.of_node, "serial");
+- if (cdns_uart_data->id < 0)
+- cdns_uart_data->id = 0;
++ id = of_alias_get_id(pdev->dev.of_node, "serial");
++ if (id < 0)
++ id = 0;
+
+- if (cdns_uart_data->id >= CDNS_UART_NR_PORTS) {
++ if (id >= CDNS_UART_NR_PORTS) {
+ dev_err(&pdev->dev, "Cannot get uart_port structure\n");
+ return -ENODEV;
+ }
+
+ /* There is a need to use unique driver name */
+ driver_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%d",
+- CDNS_UART_NAME, cdns_uart_data->id);
++ CDNS_UART_NAME, id);
+ if (!driver_name)
+ return -ENOMEM;
+
+@@ -1469,7 +1467,7 @@ static int cdns_uart_probe(struct platfo
+ cdns_uart_uart_driver->driver_name = driver_name;
+ cdns_uart_uart_driver->dev_name = CDNS_UART_TTY_NAME;
+ cdns_uart_uart_driver->major = CDNS_UART_MAJOR;
+- cdns_uart_uart_driver->minor = cdns_uart_data->id;
++ cdns_uart_uart_driver->minor = id;
+ cdns_uart_uart_driver->nr = 1;
+
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+@@ -1480,7 +1478,7 @@ static int cdns_uart_probe(struct platfo
+
+ strncpy(cdns_uart_console->name, CDNS_UART_TTY_NAME,
+ sizeof(cdns_uart_console->name));
+- cdns_uart_console->index = cdns_uart_data->id;
++ cdns_uart_console->index = id;
+ cdns_uart_console->write = cdns_uart_console_write;
+ cdns_uart_console->device = uart_console_device;
+ cdns_uart_console->setup = cdns_uart_console_setup;
+@@ -1502,7 +1500,7 @@ static int cdns_uart_probe(struct platfo
+ * registration because tty_driver structure is not filled.
+ * name_base is 0 by default.
+ */
+- cdns_uart_uart_driver->tty_driver->name_base = cdns_uart_data->id;
++ cdns_uart_uart_driver->tty_driver->name_base = id;
+
+ match = of_match_node(cdns_uart_of_match, pdev->dev.of_node);
+ if (match && match->data) {
--- /dev/null
+From 18cc7ac8a28e28cd005c2475f52576cfe10cabfb Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:36 +0200
+Subject: Revert "serial: uartps: Register own uart console and driver structures"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 18cc7ac8a28e28cd005c2475f52576cfe10cabfb upstream.
+
+This reverts commit 024ca329bfb9a948f76eaff3243e21b7e70182f2.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1ee35667e36a8efddee381df5fe495ad65f4d15c.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 95 +++++++++++++++----------------------
+ 1 file changed, 40 insertions(+), 55 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -27,6 +27,7 @@
+ #define CDNS_UART_TTY_NAME "ttyPS"
+ #define CDNS_UART_NAME "xuartps"
+ #define CDNS_UART_MAJOR 0 /* use dynamic node allocation */
++#define CDNS_UART_MINOR 0 /* works best with devtmpfs */
+ #define CDNS_UART_NR_PORTS 16
+ #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */
+ #define CDNS_UART_REGISTER_SPACE 0x1000
+@@ -1144,6 +1145,8 @@ static const struct uart_ops cdns_uart_o
+ #endif
+ };
+
++static struct uart_driver cdns_uart_uart_driver;
++
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+ /**
+ * cdns_uart_console_putchar - write the character to the FIFO buffer
+@@ -1283,6 +1286,16 @@ static int cdns_uart_console_setup(struc
+
+ return uart_set_options(port, co, baud, parity, bits, flow);
+ }
++
++static struct console cdns_uart_console = {
++ .name = CDNS_UART_TTY_NAME,
++ .write = cdns_uart_console_write,
++ .device = uart_console_device,
++ .setup = cdns_uart_console_setup,
++ .flags = CON_PRINTBUFFER,
++ .index = -1, /* Specified on the cmdline (e.g. console=ttyPS ) */
++ .data = &cdns_uart_uart_driver,
++};
+ #endif /* CONFIG_SERIAL_XILINX_PS_UART_CONSOLE */
+
+ #ifdef CONFIG_PM_SLEEP
+@@ -1414,6 +1427,9 @@ static const struct of_device_id cdns_ua
+ };
+ MODULE_DEVICE_TABLE(of, cdns_uart_of_match);
+
++/* Temporary variable for storing number of instances */
++static int instances;
++
+ /**
+ * cdns_uart_probe - Platform driver probe
+ * @pdev: Pointer to the platform device structure
+@@ -1427,11 +1443,6 @@ static int cdns_uart_probe(struct platfo
+ struct resource *res;
+ struct cdns_uart *cdns_uart_data;
+ const struct of_device_id *match;
+- struct uart_driver *cdns_uart_uart_driver;
+- char *driver_name;
+-#ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+- struct console *cdns_uart_console;
+-#endif
+
+ cdns_uart_data = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_data),
+ GFP_KERNEL);
+@@ -1441,12 +1452,6 @@ static int cdns_uart_probe(struct platfo
+ if (!port)
+ return -ENOMEM;
+
+- cdns_uart_uart_driver = devm_kzalloc(&pdev->dev,
+- sizeof(*cdns_uart_uart_driver),
+- GFP_KERNEL);
+- if (!cdns_uart_uart_driver)
+- return -ENOMEM;
+-
+ /* Look for a serialN alias */
+ id = of_alias_get_id(pdev->dev.of_node, "serial");
+ if (id < 0)
+@@ -1457,50 +1462,25 @@ static int cdns_uart_probe(struct platfo
+ return -ENODEV;
+ }
+
+- /* There is a need to use unique driver name */
+- driver_name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s%d",
+- CDNS_UART_NAME, id);
+- if (!driver_name)
+- return -ENOMEM;
+-
+- cdns_uart_uart_driver->owner = THIS_MODULE;
+- cdns_uart_uart_driver->driver_name = driver_name;
+- cdns_uart_uart_driver->dev_name = CDNS_UART_TTY_NAME;
+- cdns_uart_uart_driver->major = CDNS_UART_MAJOR;
+- cdns_uart_uart_driver->minor = id;
+- cdns_uart_uart_driver->nr = 1;
+-
++ if (!cdns_uart_uart_driver.state) {
++ cdns_uart_uart_driver.owner = THIS_MODULE;
++ cdns_uart_uart_driver.driver_name = CDNS_UART_NAME;
++ cdns_uart_uart_driver.dev_name = CDNS_UART_TTY_NAME;
++ cdns_uart_uart_driver.major = CDNS_UART_MAJOR;
++ cdns_uart_uart_driver.minor = CDNS_UART_MINOR;
++ cdns_uart_uart_driver.nr = CDNS_UART_NR_PORTS;
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+- cdns_uart_console = devm_kzalloc(&pdev->dev, sizeof(*cdns_uart_console),
+- GFP_KERNEL);
+- if (!cdns_uart_console)
+- return -ENOMEM;
+-
+- strncpy(cdns_uart_console->name, CDNS_UART_TTY_NAME,
+- sizeof(cdns_uart_console->name));
+- cdns_uart_console->index = id;
+- cdns_uart_console->write = cdns_uart_console_write;
+- cdns_uart_console->device = uart_console_device;
+- cdns_uart_console->setup = cdns_uart_console_setup;
+- cdns_uart_console->flags = CON_PRINTBUFFER;
+- cdns_uart_console->data = cdns_uart_uart_driver;
+- cdns_uart_uart_driver->cons = cdns_uart_console;
++ cdns_uart_uart_driver.cons = &cdns_uart_console;
+ #endif
+
+- rc = uart_register_driver(cdns_uart_uart_driver);
+- if (rc < 0) {
+- dev_err(&pdev->dev, "Failed to register driver\n");
+- return rc;
++ rc = uart_register_driver(&cdns_uart_uart_driver);
++ if (rc < 0) {
++ dev_err(&pdev->dev, "Failed to register driver\n");
++ return rc;
++ }
+ }
+
+- cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;
+-
+- /*
+- * Setting up proper name_base needs to be done after uart
+- * registration because tty_driver structure is not filled.
+- * name_base is 0 by default.
+- */
+- cdns_uart_uart_driver->tty_driver->name_base = id;
++ cdns_uart_data->cdns_uart_driver = &cdns_uart_uart_driver;
+
+ match = of_match_node(cdns_uart_of_match, pdev->dev.of_node);
+ if (match && match->data) {
+@@ -1578,6 +1558,7 @@ static int cdns_uart_probe(struct platfo
+ port->ops = &cdns_uart_ops;
+ port->fifosize = CDNS_UART_FIFO_SIZE;
+ port->has_sysrq = IS_ENABLED(CONFIG_SERIAL_XILINX_PS_UART_CONSOLE);
++ port->line = id;
+
+ /*
+ * Register the port.
+@@ -1609,7 +1590,7 @@ static int cdns_uart_probe(struct platfo
+ console_port = port;
+ #endif
+
+- rc = uart_add_one_port(cdns_uart_uart_driver, port);
++ rc = uart_add_one_port(&cdns_uart_uart_driver, port);
+ if (rc) {
+ dev_err(&pdev->dev,
+ "uart_add_one_port() failed; err=%i\n", rc);
+@@ -1619,12 +1600,15 @@ static int cdns_uart_probe(struct platfo
+ #ifdef CONFIG_SERIAL_XILINX_PS_UART_CONSOLE
+ /* This is not port which is used for console that's why clean it up */
+ if (console_port == port &&
+- !(cdns_uart_uart_driver->cons->flags & CON_ENABLED))
++ !(cdns_uart_uart_driver.cons->flags & CON_ENABLED))
+ console_port = NULL;
+ #endif
+
+ cdns_uart_data->cts_override = of_property_read_bool(pdev->dev.of_node,
+ "cts-override");
++
++ instances++;
++
+ return 0;
+
+ err_out_pm_disable:
+@@ -1640,8 +1624,8 @@ err_out_clk_disable:
+ err_out_clk_dis_pclk:
+ clk_disable_unprepare(cdns_uart_data->pclk);
+ err_out_unregister_driver:
+- uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
+-
++ if (!instances)
++ uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
+ return rc;
+ }
+
+@@ -1676,7 +1660,8 @@ static int cdns_uart_remove(struct platf
+ console_port = NULL;
+ #endif
+
+- uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
++ if (!--instances)
++ uart_unregister_driver(cdns_uart_data->cdns_uart_driver);
+ return rc;
+ }
+
--- /dev/null
+From 8da1a3940da4b0e82848ec29b835486890bc9232 Mon Sep 17 00:00:00 2001
+From: Michal Simek <michal.simek@xilinx.com>
+Date: Fri, 3 Apr 2020 11:24:31 +0200
+Subject: Revert "serial: uartps: Use the same dynamic major number for all ports"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+commit 8da1a3940da4b0e82848ec29b835486890bc9232 upstream.
+
+This reverts commit ab262666018de6f4e206b021386b93ed0c164316.
+
+As Johan says, this driver needs a lot more work and these changes are
+only going in the wrong direction:
+ https://lkml.kernel.org/r/20190523091839.GC568@localhost
+
+Reported-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/14a565fc1e14a5ec6cc6a6710deb878ae8305f22.1585905873.git.michal.simek@xilinx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -26,13 +26,13 @@
+
+ #define CDNS_UART_TTY_NAME "ttyPS"
+ #define CDNS_UART_NAME "xuartps"
++#define CDNS_UART_MAJOR 0 /* use dynamic node allocation */
+ #define CDNS_UART_FIFO_SIZE 64 /* FIFO size */
+ #define CDNS_UART_REGISTER_SPACE 0x1000
+ #define TX_TIMEOUT 500000
+
+ /* Rx Trigger level */
+ static int rx_trigger_level = 56;
+-static int uartps_major;
+ module_param(rx_trigger_level, uint, 0444);
+ MODULE_PARM_DESC(rx_trigger_level, "Rx trigger level, 1-63 bytes");
+
+@@ -1547,7 +1547,7 @@ static int cdns_uart_probe(struct platfo
+ cdns_uart_uart_driver->owner = THIS_MODULE;
+ cdns_uart_uart_driver->driver_name = driver_name;
+ cdns_uart_uart_driver->dev_name = CDNS_UART_TTY_NAME;
+- cdns_uart_uart_driver->major = uartps_major;
++ cdns_uart_uart_driver->major = CDNS_UART_MAJOR;
+ cdns_uart_uart_driver->minor = cdns_uart_data->id;
+ cdns_uart_uart_driver->nr = 1;
+
+@@ -1576,7 +1576,6 @@ static int cdns_uart_probe(struct platfo
+ goto err_out_id;
+ }
+
+- uartps_major = cdns_uart_uart_driver->tty_driver->major;
+ cdns_uart_data->cdns_uart_driver = cdns_uart_uart_driver;
+
+ /*
--- /dev/null
+From 3dc4db3662366306e54ddcbda4804acb1258e4ba Mon Sep 17 00:00:00 2001
+From: Kazuhiro Fujita <kazuhiro.fujita.jg@renesas.com>
+Date: Fri, 27 Mar 2020 18:17:28 +0000
+Subject: serial: sh-sci: Make sure status register SCxSR is read in correct sequence
+
+From: Kazuhiro Fujita <kazuhiro.fujita.jg@renesas.com>
+
+commit 3dc4db3662366306e54ddcbda4804acb1258e4ba upstream.
+
+For SCIF and HSCIF interfaces the SCxSR register holds the status of
+data that is to be read next from SCxRDR register, But where as for
+SCIFA and SCIFB interfaces SCxSR register holds status of data that is
+previously read from SCxRDR register.
+
+This patch makes sure the status register is read depending on the port
+types so that errors are caught accordingly.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Kazuhiro Fujita <kazuhiro.fujita.jg@renesas.com>
+Signed-off-by: Hao Bui <hao.bui.yg@renesas.com>
+Signed-off-by: KAZUMI HARADA <kazumi.harada.rh@renesas.com>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/1585333048-31828-1-git-send-email-kazuhiro.fujita.jg@renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sh-sci.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -870,9 +870,16 @@ static void sci_receive_chars(struct uar
+ tty_insert_flip_char(tport, c, TTY_NORMAL);
+ } else {
+ for (i = 0; i < count; i++) {
+- char c = serial_port_in(port, SCxRDR);
++ char c;
+
+- status = serial_port_in(port, SCxSR);
++ if (port->type == PORT_SCIF ||
++ port->type == PORT_HSCIF) {
++ status = serial_port_in(port, SCxSR);
++ c = serial_port_in(port, SCxRDR);
++ } else {
++ c = serial_port_in(port, SCxRDR);
++ status = serial_port_in(port, SCxSR);
++ }
+ if (uart_handle_sysrq_char(port, c)) {
+ count--; i--;
+ continue;
iwlwifi-mvm-do-not-declare-support-for-ack-enabled-aggregation.patch
iwlwifi-mvm-fix-inactive-tid-removal-return-value-usage.patch
iwlwifi-fix-wgds-check-when-wrds-is-disabled.patch
+cifs-fix-uninitialised-lease_key-in-open_shroot.patch
+arm-imx-provide-v7_cpu_resume-only-on-arm_cpu_suspend-y.patch
+powerpc-8xx-fix-strict_kernel_rwx-startup-test-failure.patch
+powerpc-setup_64-set-cache-line-size-based-on-cache-block-size.patch
+staging-comedi-dt2815-fix-writing-hi-byte-of-analog-output.patch
+staging-comedi-fix-comedi_device-refcnt-leak-in-comedi_open.patch
+vt-don-t-hardcode-the-mem-allocation-upper-bound.patch
+vt-don-t-use-kmalloc-for-the-unicode-screen-buffer.patch
+staging-vt6656-don-t-set-rcr_multicast-or-rcr_broadcast-by-default.patch
+staging-vt6656-fix-calling-conditions-of-vnt_set_bss_mode.patch
+staging-vt6656-fix-drivers-tbtt-timing-counter.patch
+staging-vt6656-fix-pairwise-key-entry-save.patch
+staging-vt6656-power-save-stop-wake_up_count-wrap-around.patch
+mei-me-fix-irq-number-stored-in-hw-struct.patch
+cdc-acm-close-race-betrween-suspend-and-acm_softint.patch
+cdc-acm-introduce-a-cool-down.patch
+uas-no-use-logging-any-details-in-case-of-enodev.patch
+uas-fix-deadlock-in-error-handling-and-pm-flushing-work.patch
+fpga-dfl-pci-fix-return-value-of-cci_pci_sriov_configure.patch
+usb-dwc3-gadget-fix-request-completion-check.patch
+usb-f_fs-clear-os-extended-descriptor-counts-to-zero-in-ffs_data_reset.patch
+usb-typec-tcpm-ignore-cc-and-vbus-changes-in-port_reset-change.patch
+usb-typec-altmode-fix-typec_altmode_get_partner-sometimes-returning-an-invalid-pointer.patch
+xhci-fix-handling-halted-endpoint-even-if-endpoint-ring-appears-empty.patch
+xhci-prevent-bus-suspend-if-a-roothub-port-detected-a-over-current-condition.patch
+xhci-don-t-clear-hub-tt-buffer-on-ep0-protocol-stall.patch
+serial-sh-sci-make-sure-status-register-scxsr-is-read-in-correct-sequence.patch
+revert-serial-uartps-fix-uartps_major-handling.patch
+revert-serial-uartps-use-the-same-dynamic-major-number-for-all-ports.patch
+revert-serial-uartps-fix-error-path-when-alloc-failed.patch
+revert-serial-uartps-do-not-allow-use-aliases-max_uart_instances.patch
+revert-serial-uartps-change-uart-id-port-allocation.patch
+revert-serial-uartps-move-port-id-to-device-data-structure.patch
+revert-serial-uartps-register-own-uart-console-and-driver-structures.patch
--- /dev/null
+From ed87d33ddbcd9a1c3b5ae87995da34e6f51a862c Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 6 Apr 2020 15:20:15 +0100
+Subject: staging: comedi: dt2815: fix writing hi byte of analog output
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit ed87d33ddbcd9a1c3b5ae87995da34e6f51a862c upstream.
+
+The DT2815 analog output command is 16 bits wide, consisting of the
+12-bit sample value in bits 15 to 4, the channel number in bits 3 to 1,
+and a voltage or current selector in bit 0. Both bytes of the 16-bit
+command need to be written in turn to a single 8-bit data register.
+However, the driver currently only writes the low 8-bits. It is broken
+and appears to have always been broken.
+
+Electronic copies of the DT2815 User's Manual seem impossible to find
+online, but looking at the source code, a best guess for the sequence
+the driver intended to use to write the analog output command is as
+follows:
+
+1. Wait for the status register to read 0x00.
+2. Write the low byte of the command to the data register.
+3. Wait for the status register to read 0x80.
+4. Write the high byte of the command to the data register.
+
+Step 4 is missing from the driver. Add step 4 to (hopefully) fix the
+driver.
+
+Also add a "FIXME" comment about setting bit 0 of the low byte of the
+command. Supposedly, it is used to choose between voltage output and
+current output, but the current driver always sets it to 1.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200406142015.126982-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/dt2815.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/comedi/drivers/dt2815.c
++++ b/drivers/staging/comedi/drivers/dt2815.c
+@@ -92,6 +92,7 @@ static int dt2815_ao_insn(struct comedi_
+ int ret;
+
+ for (i = 0; i < insn->n; i++) {
++ /* FIXME: lo bit 0 chooses voltage output or current output */
+ lo = ((data[i] & 0x0f) << 4) | (chan << 1) | 0x01;
+ hi = (data[i] & 0xff0) >> 4;
+
+@@ -105,6 +106,8 @@ static int dt2815_ao_insn(struct comedi_
+ if (ret)
+ return ret;
+
++ outb(hi, dev->iobase + DT2815_DATA);
++
+ devpriv->ao_readback[chan] = data[i];
+ }
+ return i;
--- /dev/null
+From 332e0e17ad49e084b7db670ef43b5eb59abd9e34 Mon Sep 17 00:00:00 2001
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Date: Mon, 20 Apr 2020 13:44:16 +0800
+Subject: staging: comedi: Fix comedi_device refcnt leak in comedi_open
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+commit 332e0e17ad49e084b7db670ef43b5eb59abd9e34 upstream.
+
+comedi_open() invokes comedi_dev_get_from_minor(), which returns a
+reference of the COMEDI device to "dev" with increased refcount.
+
+When comedi_open() returns, "dev" becomes invalid, so the refcount
+should be decreased to keep refcount balanced.
+
+The reference counting issue happens in one exception handling path of
+comedi_open(). When "cfp" allocation is failed, the refcnt increased by
+comedi_dev_get_from_minor() is not decreased, causing a refcnt leak.
+
+Fix this issue by calling comedi_dev_put() on this error path when "cfp"
+allocation is failed.
+
+Fixes: 20f083c07565 ("staging: comedi: prepare support for per-file read and write subdevices")
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/1587361459-83622-1-git-send-email-xiyuyang19@fudan.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_fops.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -2725,8 +2725,10 @@ static int comedi_open(struct inode *ino
+ }
+
+ cfp = kzalloc(sizeof(*cfp), GFP_KERNEL);
+- if (!cfp)
++ if (!cfp) {
++ comedi_dev_put(dev);
+ return -ENOMEM;
++ }
+
+ cfp->dev = dev;
+
--- /dev/null
+From 0f8240bfc070033a4823b19883efd3d38c7735cc Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 18 Apr 2020 17:24:50 +0100
+Subject: staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 0f8240bfc070033a4823b19883efd3d38c7735cc upstream.
+
+mac80211/users control whether multicast is on or off don't enable it by default.
+
+Fixes an issue when multicast/broadcast is always on allowing other beacons through
+in power save.
+
+Fixes: db8f37fa3355 ("staging: vt6656: mac80211 conversion: main_usb add functions...")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/2c24c33d-68c4-f343-bd62-105422418eac@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/main_usb.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -817,15 +817,11 @@ static void vnt_configure(struct ieee802
+ {
+ struct vnt_private *priv = hw->priv;
+ u8 rx_mode = 0;
+- int rc;
+
+ *total_flags &= FIF_ALLMULTI | FIF_OTHER_BSS | FIF_BCN_PRBRESP_PROMISC;
+
+- rc = vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR,
+- MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode);
+-
+- if (!rc)
+- rx_mode = RCR_MULTICAST | RCR_BROADCAST;
++ vnt_control_in(priv, MESSAGE_TYPE_READ, MAC_REG_RCR,
++ MESSAGE_REQUEST_MACREG, sizeof(u8), &rx_mode);
+
+ dev_dbg(&priv->usb->dev, "rx mode in = %x\n", rx_mode);
+
--- /dev/null
+From 664ba5180234593b4b8517530e8198bf2f7359e2 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 18 Apr 2020 18:37:18 +0100
+Subject: staging: vt6656: Fix calling conditions of vnt_set_bss_mode
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 664ba5180234593b4b8517530e8198bf2f7359e2 upstream.
+
+vnt_set_bss_mode needs to be called on all changes to BSS_CHANGED_BASIC_RATES,
+BSS_CHANGED_ERP_PREAMBLE and BSS_CHANGED_ERP_SLOT
+
+Remove all other calls and vnt_update_ifs which is called in vnt_set_bss_mode.
+
+Fixes an issue that preamble mode is not being updated correctly.
+
+Fixes: c12603576e06 ("staging: vt6656: Only call vnt_set_bss_mode on basic rates change.")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/44110801-6234-50d8-c583-9388f04b486c@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/main_usb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -632,8 +632,6 @@ static int vnt_add_interface(struct ieee
+
+ priv->op_mode = vif->type;
+
+- vnt_set_bss_mode(priv);
+-
+ /* LED blink on TX */
+ vnt_mac_set_led(priv, LEDSTS_STS, LEDSTS_INTER);
+
+@@ -720,7 +718,6 @@ static void vnt_bss_info_changed(struct
+ priv->basic_rates = conf->basic_rates;
+
+ vnt_update_top_rates(priv);
+- vnt_set_bss_mode(priv);
+
+ dev_dbg(&priv->usb->dev, "basic rates %x\n", conf->basic_rates);
+ }
+@@ -749,11 +746,14 @@ static void vnt_bss_info_changed(struct
+ priv->short_slot_time = false;
+
+ vnt_set_short_slot_time(priv);
+- vnt_update_ifs(priv);
+ vnt_set_vga_gain_offset(priv, priv->bb_vga[0]);
+ vnt_update_pre_ed_threshold(priv, false);
+ }
+
++ if (changed & (BSS_CHANGED_BASIC_RATES | BSS_CHANGED_ERP_PREAMBLE |
++ BSS_CHANGED_ERP_SLOT))
++ vnt_set_bss_mode(priv);
++
+ if (changed & BSS_CHANGED_TXPOWER)
+ vnt_rf_setpower(priv, priv->current_rate,
+ conf->chandef.chan->hw_value);
--- /dev/null
+From 09057742af98a39ebffa27fac4f889dc873132de Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 18 Apr 2020 17:43:24 +0100
+Subject: staging: vt6656: Fix drivers TBTT timing counter.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 09057742af98a39ebffa27fac4f889dc873132de upstream.
+
+The drivers TBTT counter is not synchronized with mac80211 timestamp.
+
+Reorder the functions and use vnt_update_next_tbtt to do the final
+synchronize.
+
+Fixes: c15158797df6 ("staging: vt6656: implement TSF counter")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/375d0b25-e8bc-c8f7-9b10-6cc705d486ee@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/main_usb.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -777,12 +777,15 @@ static void vnt_bss_info_changed(struct
+ vnt_mac_reg_bits_on(priv, MAC_REG_TFTCTL,
+ TFTCTL_TSFCNTREN);
+
+- vnt_adjust_tsf(priv, conf->beacon_rate->hw_value,
+- conf->sync_tsf, priv->current_tsf);
+-
+ vnt_mac_set_beacon_interval(priv, conf->beacon_int);
+
+ vnt_reset_next_tbtt(priv, conf->beacon_int);
++
++ vnt_adjust_tsf(priv, conf->beacon_rate->hw_value,
++ conf->sync_tsf, priv->current_tsf);
++
++ vnt_update_next_tbtt(priv,
++ conf->sync_tsf, conf->beacon_int);
+ } else {
+ vnt_clear_current_tsf(priv);
+
--- /dev/null
+From 0b59f10b1d8fe8d50944f21f5d403df9303095a8 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sat, 18 Apr 2020 22:01:49 +0100
+Subject: staging: vt6656: Fix pairwise key entry save.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 0b59f10b1d8fe8d50944f21f5d403df9303095a8 upstream.
+
+The problem is that the group key was saved as VNT_KEY_DEFAULTKEY
+was over written by the VNT_KEY_GROUP_ADDRESS index.
+
+mac80211 could not clear the mac_addr in the default key.
+
+The VNT_KEY_DEFAULTKEY is not necesscary so remove it and set as
+VNT_KEY_GROUP_ADDRESS.
+
+mac80211 can clear any key using vnt_mac_disable_keyentry.
+
+Fixes: f9ef05ce13e4 ("staging: vt6656: Fix pairwise key for non station modes")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/da2f7e7f-1658-1320-6eee-0f55770ca391@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/key.c | 14 +++-----------
+ drivers/staging/vt6656/main_usb.c | 6 +++++-
+ 2 files changed, 8 insertions(+), 12 deletions(-)
+
+--- a/drivers/staging/vt6656/key.c
++++ b/drivers/staging/vt6656/key.c
+@@ -83,9 +83,6 @@ static int vnt_set_keymode(struct ieee80
+ case VNT_KEY_PAIRWISE:
+ key_mode |= mode;
+ key_inx = 4;
+- /* Don't save entry for pairwise key for station mode */
+- if (priv->op_mode == NL80211_IFTYPE_STATION)
+- clear_bit(entry, &priv->key_entry_inuse);
+ break;
+ default:
+ return -EINVAL;
+@@ -109,7 +106,6 @@ static int vnt_set_keymode(struct ieee80
+ int vnt_set_keys(struct ieee80211_hw *hw, struct ieee80211_sta *sta,
+ struct ieee80211_vif *vif, struct ieee80211_key_conf *key)
+ {
+- struct ieee80211_bss_conf *conf = &vif->bss_conf;
+ struct vnt_private *priv = hw->priv;
+ u8 *mac_addr = NULL;
+ u8 key_dec_mode = 0;
+@@ -151,16 +147,12 @@ int vnt_set_keys(struct ieee80211_hw *hw
+ key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ }
+
+- if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
++ if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+ vnt_set_keymode(hw, mac_addr, key, VNT_KEY_PAIRWISE,
+ key_dec_mode, true);
+- } else {
+- vnt_set_keymode(hw, mac_addr, key, VNT_KEY_DEFAULTKEY,
++ else
++ vnt_set_keymode(hw, mac_addr, key, VNT_KEY_GROUP_ADDRESS,
+ key_dec_mode, true);
+
+- vnt_set_keymode(hw, (u8 *)conf->bssid, key,
+- VNT_KEY_GROUP_ADDRESS, key_dec_mode, true);
+- }
+-
+ return 0;
+ }
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -865,8 +865,12 @@ static int vnt_set_key(struct ieee80211_
+ return -EOPNOTSUPP;
+ break;
+ case DISABLE_KEY:
+- if (test_bit(key->hw_key_idx, &priv->key_entry_inuse))
++ if (test_bit(key->hw_key_idx, &priv->key_entry_inuse)) {
+ clear_bit(key->hw_key_idx, &priv->key_entry_inuse);
++
++ vnt_mac_disable_keyentry(priv, key->hw_key_idx);
++ }
++
+ default:
+ break;
+ }
--- /dev/null
+From ea81c3486442f4643fc9825a2bb1b430b829bccd Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 14 Apr 2020 11:39:23 +0100
+Subject: staging: vt6656: Power save stop wake_up_count wrap around.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit ea81c3486442f4643fc9825a2bb1b430b829bccd upstream.
+
+conf.listen_interval can sometimes be zero causing wake_up_count
+to wrap around up to many beacons too late causing
+CTRL-EVENT-BEACON-LOSS as in.
+
+wpa_supplicant[795]: message repeated 45 times: [..CTRL-EVENT-BEACON-LOSS ]
+
+Fixes: 43c93d9bf5e2 ("staging: vt6656: implement power saving code.")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/fce47bb5-7ca6-7671-5094-5c6107302f2b@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/int.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/int.c
++++ b/drivers/staging/vt6656/int.c
+@@ -145,7 +145,8 @@ void vnt_int_process_data(struct vnt_pri
+ priv->wake_up_count =
+ priv->hw->conf.listen_interval;
+
+- --priv->wake_up_count;
++ if (priv->wake_up_count)
++ --priv->wake_up_count;
+
+ /* Turn on wake up to listen next beacon */
+ if (priv->wake_up_count == 1)
--- /dev/null
+From f6cc6093a729ede1ff5658b493237c42b82ba107 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 15 Apr 2020 16:17:50 +0200
+Subject: UAS: fix deadlock in error handling and PM flushing work
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit f6cc6093a729ede1ff5658b493237c42b82ba107 upstream.
+
+A SCSI error handler and block runtime PM must not allocate
+memory with GFP_KERNEL. Furthermore they must not wait for
+tasks allocating memory with GFP_KERNEL.
+That means that they cannot share a workqueue with arbitrary tasks.
+
+Fix this for UAS using a private workqueue.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: f9dc024a2da1f ("uas: pre_reset and suspend: Fix a few races")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200415141750.811-2-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/uas.c | 43 ++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 40 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -81,6 +81,19 @@ static void uas_free_streams(struct uas_
+ static void uas_log_cmd_state(struct scsi_cmnd *cmnd, const char *prefix,
+ int status);
+
++/*
++ * This driver needs its own workqueue, as we need to control memory allocation.
++ *
++ * In the course of error handling and power management uas_wait_for_pending_cmnds()
++ * needs to flush pending work items. In these contexts we cannot allocate memory
++ * by doing block IO as we would deadlock. For the same reason we cannot wait
++ * for anything allocating memory not heeding these constraints.
++ *
++ * So we have to control all work items that can be on the workqueue we flush.
++ * Hence we cannot share a queue and need our own.
++ */
++static struct workqueue_struct *workqueue;
++
+ static void uas_do_work(struct work_struct *work)
+ {
+ struct uas_dev_info *devinfo =
+@@ -109,7 +122,7 @@ static void uas_do_work(struct work_stru
+ if (!err)
+ cmdinfo->state &= ~IS_IN_WORK_LIST;
+ else
+- schedule_work(&devinfo->work);
++ queue_work(workqueue, &devinfo->work);
+ }
+ out:
+ spin_unlock_irqrestore(&devinfo->lock, flags);
+@@ -134,7 +147,7 @@ static void uas_add_work(struct uas_cmd_
+
+ lockdep_assert_held(&devinfo->lock);
+ cmdinfo->state |= IS_IN_WORK_LIST;
+- schedule_work(&devinfo->work);
++ queue_work(workqueue, &devinfo->work);
+ }
+
+ static void uas_zap_pending(struct uas_dev_info *devinfo, int result)
+@@ -1229,7 +1242,31 @@ static struct usb_driver uas_driver = {
+ .id_table = uas_usb_ids,
+ };
+
+-module_usb_driver(uas_driver);
++static int __init uas_init(void)
++{
++ int rv;
++
++ workqueue = alloc_workqueue("uas", WQ_MEM_RECLAIM, 0);
++ if (!workqueue)
++ return -ENOMEM;
++
++ rv = usb_register(&uas_driver);
++ if (rv) {
++ destroy_workqueue(workqueue);
++ return -ENOMEM;
++ }
++
++ return 0;
++}
++
++static void __exit uas_exit(void)
++{
++ usb_deregister(&uas_driver);
++ destroy_workqueue(workqueue);
++}
++
++module_init(uas_init);
++module_exit(uas_exit);
+
+ MODULE_LICENSE("GPL");
+ MODULE_IMPORT_NS(USB_STORAGE);
--- /dev/null
+From 5963dec98dc52d52476390485f07a29c30c6a582 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 15 Apr 2020 16:17:49 +0200
+Subject: UAS: no use logging any details in case of ENODEV
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 5963dec98dc52d52476390485f07a29c30c6a582 upstream.
+
+Once a device is gone, the internal state does not matter anymore.
+There is no need to spam the logs.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Fixes: 326349f824619 ("uas: add dead request list")
+Link: https://lore.kernel.org/r/20200415141750.811-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/uas.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -190,6 +190,9 @@ static void uas_log_cmd_state(struct scs
+ struct uas_cmd_info *ci = (void *)&cmnd->SCp;
+ struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp;
+
++ if (status == -ENODEV) /* too late */
++ return;
++
+ scmd_printk(KERN_INFO, cmnd,
+ "%s %d uas-tag %d inflight:%s%s%s%s%s%s%s%s%s%s%s%s ",
+ prefix, status, cmdinfo->uas_tag,
--- /dev/null
+From 49e0590e3a60e75b493e5df879e216e5073c7663 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Tue, 31 Mar 2020 01:40:35 -0700
+Subject: usb: dwc3: gadget: Fix request completion check
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 49e0590e3a60e75b493e5df879e216e5073c7663 upstream.
+
+A request may not be completed because not all the TRBs are prepared for
+it. This happens when we run out of available TRBs. When some TRBs are
+completed, the driver needs to prepare the rest of the TRBs for the
+request. The check dwc3_gadget_ep_request_completed() shouldn't be
+checking the amount of data received but rather the number of pending
+TRBs. Revise this request completion check.
+
+Cc: stable@vger.kernel.org
+Fixes: e0c42ce590fe ("usb: dwc3: gadget: simplify IOC handling")
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2484,14 +2484,7 @@ static int dwc3_gadget_ep_reclaim_trb_li
+
+ static bool dwc3_gadget_ep_request_completed(struct dwc3_request *req)
+ {
+- /*
+- * For OUT direction, host may send less than the setup
+- * length. Return true for all OUT requests.
+- */
+- if (!req->direction)
+- return true;
+-
+- return req->request.actual == req->request.length;
++ return req->num_pending_sgs == 0;
+ }
+
+ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep,
+@@ -2515,8 +2508,7 @@ static int dwc3_gadget_ep_cleanup_comple
+
+ req->request.actual = req->request.length - req->remaining;
+
+- if (!dwc3_gadget_ep_request_completed(req) ||
+- req->num_pending_sgs) {
++ if (!dwc3_gadget_ep_request_completed(req)) {
+ __dwc3_gadget_kick_transfer(dep);
+ goto out;
+ }
--- /dev/null
+From 1c2e54fbf1da5e5445a0ab132c862b02ccd8d230 Mon Sep 17 00:00:00 2001
+From: Udipto Goswami <ugoswami@codeaurora.org>
+Date: Thu, 2 Apr 2020 10:15:21 +0530
+Subject: usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
+
+From: Udipto Goswami <ugoswami@codeaurora.org>
+
+commit 1c2e54fbf1da5e5445a0ab132c862b02ccd8d230 upstream.
+
+For userspace functions using OS Descriptors, if a function also supplies
+Extended Property descriptors currently the counts and lengths stored in
+the ms_os_descs_ext_prop_{count,name_len,data_len} variables are not
+getting reset to 0 during an unbind or when the epfiles are closed. If
+the same function is re-bound and the descriptors are re-written, this
+results in those count/length variables to monotonically increase
+causing the VLA allocation in _ffs_func_bind() to grow larger and larger
+at each bind/unbind cycle and eventually fail to allocate.
+
+Fix this by clearing the ms_os_descs_ext_prop count & lengths to 0 in
+ffs_data_reset().
+
+Fixes: f0175ab51993 ("usb: gadget: f_fs: OS descriptors support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Udipto Goswami <ugoswami@codeaurora.org>
+Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
+Reviewed-by: Manu Gautam <mgautam@codeaurora.org>
+Link: https://lore.kernel.org/r/20200402044521.9312-1-sallenki@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1813,6 +1813,10 @@ static void ffs_data_reset(struct ffs_da
+ ffs->state = FFS_READ_DESCRIPTORS;
+ ffs->setup_state = FFS_NO_SETUP;
+ ffs->flags = 0;
++
++ ffs->ms_os_descs_ext_prop_count = 0;
++ ffs->ms_os_descs_ext_prop_name_len = 0;
++ ffs->ms_os_descs_ext_prop_data_len = 0;
+ }
+
+
--- /dev/null
+From 0df9433fcae02215c8fd79690c134d535c7bb905 Mon Sep 17 00:00:00 2001
+From: Naoki Kiryu <naonaokiryu2@gmail.com>
+Date: Wed, 22 Apr 2020 16:43:45 +0200
+Subject: usb: typec: altmode: Fix typec_altmode_get_partner sometimes returning an invalid pointer
+
+From: Naoki Kiryu <naonaokiryu2@gmail.com>
+
+commit 0df9433fcae02215c8fd79690c134d535c7bb905 upstream.
+
+Before this commit, typec_altmode_get_partner would return a
+const struct typec_altmode * pointing to address 0x08 when
+to_altmode(adev)->partner was NULL.
+
+Add a check for to_altmode(adev)->partner being NULL to fix this.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=206365
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1785972
+Fixes: 5f54a85db5df ("usb: typec: Make sure an alt mode exist before getting its partner")
+Cc: stable@vger.kernel.org
+Signed-off-by: Naoki Kiryu <naonaokiryu2@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20200422144345.43262-1-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/bus.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/typec/bus.c
++++ b/drivers/usb/typec/bus.c
+@@ -208,7 +208,10 @@ EXPORT_SYMBOL_GPL(typec_altmode_vdm);
+ const struct typec_altmode *
+ typec_altmode_get_partner(struct typec_altmode *adev)
+ {
+- return adev ? &to_altmode(adev)->partner->adev : NULL;
++ if (!adev || !to_altmode(adev)->partner)
++ return NULL;
++
++ return &to_altmode(adev)->partner->adev;
+ }
+ EXPORT_SYMBOL_GPL(typec_altmode_get_partner);
+
--- /dev/null
+From 901789745a053286e0ced37960d44fa60267b940 Mon Sep 17 00:00:00 2001
+From: Badhri Jagan Sridharan <badhri@google.com>
+Date: Thu, 2 Apr 2020 14:59:47 -0700
+Subject: usb: typec: tcpm: Ignore CC and vbus changes in PORT_RESET change
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+commit 901789745a053286e0ced37960d44fa60267b940 upstream.
+
+After PORT_RESET, the port is set to the appropriate
+default_state. Ignore processing CC changes here as this
+could cause the port to be switched into sink states
+by default.
+
+echo source > /sys/class/typec/port0/port_type
+
+Before:
+[ 154.528547] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms
+[ 154.528560] CC1: 0 -> 0, CC2: 3 -> 0 [state PORT_RESET, polarity 0, disconnected]
+[ 154.528564] state change PORT_RESET -> SNK_UNATTACHED
+
+After:
+[ 151.068814] pending state change PORT_RESET -> PORT_RESET_WAIT_OFF @ 100 ms [rev3 NONE_AMS]
+[ 151.072440] CC1: 3 -> 0, CC2: 0 -> 0 [state PORT_RESET, polarity 0, disconnected]
+[ 151.172117] state change PORT_RESET -> PORT_RESET_WAIT_OFF [delayed 100 ms]
+[ 151.172136] pending state change PORT_RESET_WAIT_OFF -> SRC_UNATTACHED @ 870 ms [rev3 NONE_AMS]
+[ 152.060106] state change PORT_RESET_WAIT_OFF -> SRC_UNATTACHED [delayed 870 ms]
+[ 152.060118] Start toggling
+
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20200402215947.176577-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/tcpm/tcpm.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -3759,6 +3759,14 @@ static void _tcpm_cc_change(struct tcpm_
+ */
+ break;
+
++ case PORT_RESET:
++ case PORT_RESET_WAIT_OFF:
++ /*
++ * State set back to default mode once the timer completes.
++ * Ignore CC changes here.
++ */
++ break;
++
+ default:
+ if (tcpm_port_is_disconnected(port))
+ tcpm_set_state(port, unattached_state(port), 0);
+@@ -3820,6 +3828,15 @@ static void _tcpm_pd_vbus_on(struct tcpm
+ case SRC_TRY_DEBOUNCE:
+ /* Do nothing, waiting for sink detection */
+ break;
++
++ case PORT_RESET:
++ case PORT_RESET_WAIT_OFF:
++ /*
++ * State set back to default mode once the timer completes.
++ * Ignore vbus changes here.
++ */
++ break;
++
+ default:
+ break;
+ }
+@@ -3873,10 +3890,19 @@ static void _tcpm_pd_vbus_off(struct tcp
+ case PORT_RESET_WAIT_OFF:
+ tcpm_set_state(port, tcpm_default_state(port), 0);
+ break;
++
+ case SRC_TRY_WAIT:
+ case SRC_TRY_DEBOUNCE:
+ /* Do nothing, waiting for sink detection */
+ break;
++
++ case PORT_RESET:
++ /*
++ * State set back to default mode once the timer completes.
++ * Ignore vbus changes here.
++ */
++ break;
++
+ default:
+ if (port->pwr_role == TYPEC_SINK &&
+ port->attached)
--- /dev/null
+From 2717769e204e83e65b8819c5e2ef3e5b6639b270 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nico@fluxnic.net>
+Date: Sat, 28 Mar 2020 17:32:42 -0400
+Subject: vt: don't hardcode the mem allocation upper bound
+
+From: Nicolas Pitre <nico@fluxnic.net>
+
+commit 2717769e204e83e65b8819c5e2ef3e5b6639b270 upstream.
+
+The code in vc_do_resize() bounds the memory allocation size to avoid
+exceeding MAX_ORDER down the kzalloc() call chain and generating a
+runtime warning triggerable from user space. However, not only is it
+unwise to use a literal value here, but MAX_ORDER may also be
+configurable based on CONFIG_FORCE_MAX_ZONEORDER.
+Let's use KMALLOC_MAX_SIZE instead.
+
+Note that prior commit bb1107f7c605 ("mm, slab: make sure that
+KMALLOC_MAX_SIZE will fit into MAX_ORDER") the KMALLOC_MAX_SIZE value
+could not be relied upon.
+
+Signed-off-by: Nicolas Pitre <nico@fluxnic.net>
+Cc: <stable@vger.kernel.org> # v4.10+
+Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2003281702410.2671@knanqh.ubzr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1206,7 +1206,7 @@ static int vc_do_resize(struct tty_struc
+ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
+ return 0;
+
+- if (new_screen_size > (4 << 20))
++ if (new_screen_size > KMALLOC_MAX_SIZE)
+ return -EINVAL;
+ newscreen = kzalloc(new_screen_size, GFP_USER);
+ if (!newscreen)
--- /dev/null
+From 9a98e7a80f95378c9ee0c644705e3b5aa54745f1 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nico@fluxnic.net>
+Date: Sat, 28 Mar 2020 22:25:11 -0400
+Subject: vt: don't use kmalloc() for the unicode screen buffer
+
+From: Nicolas Pitre <nico@fluxnic.net>
+
+commit 9a98e7a80f95378c9ee0c644705e3b5aa54745f1 upstream.
+
+Even if the actual screen size is bounded in vc_do_resize(), the unicode
+buffer is still a little more than twice the size of the glyph buffer
+and may exceed MAX_ORDER down the kmalloc() path. This can be triggered
+from user space.
+
+Since there is no point having a physically contiguous buffer here,
+let's avoid the above issue as well as reducing pressure on high order
+allocations by using vmalloc() instead.
+
+Signed-off-by: Nicolas Pitre <nico@fluxnic.net>
+Cc: <stable@vger.kernel.org>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2003282214210.2671@knanqh.ubzr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/vt/vt.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -81,6 +81,7 @@
+ #include <linux/errno.h>
+ #include <linux/kd.h>
+ #include <linux/slab.h>
++#include <linux/vmalloc.h>
+ #include <linux/major.h>
+ #include <linux/mm.h>
+ #include <linux/console.h>
+@@ -350,7 +351,7 @@ static struct uni_screen *vc_uniscr_allo
+ /* allocate everything in one go */
+ memsize = cols * rows * sizeof(char32_t);
+ memsize += rows * sizeof(char32_t *);
+- p = kmalloc(memsize, GFP_KERNEL);
++ p = vmalloc(memsize);
+ if (!p)
+ return NULL;
+
+@@ -366,7 +367,7 @@ static struct uni_screen *vc_uniscr_allo
+
+ static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr)
+ {
+- kfree(vc->vc_uni_screen);
++ vfree(vc->vc_uni_screen);
+ vc->vc_uni_screen = new_uniscr;
+ }
+
--- /dev/null
+From 8f97250c21f0cf36434bf5b7ddf4377406534cd1 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 21 Apr 2020 17:08:22 +0300
+Subject: xhci: Don't clear hub TT buffer on ep0 protocol stall
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 8f97250c21f0cf36434bf5b7ddf4377406534cd1 upstream.
+
+The default control endpoint ep0 can return a STALL indicating the
+device does not support the control transfer requests. This is called
+a protocol stall and does not halt the endpoint.
+
+xHC behaves a bit different. Its internal endpoint state will always
+be halted on any stall, even if the device side of the endpiont is not
+halted. So we do need to issue the reset endpoint command to clear the
+xHC host intenal endpoint halt state, but should not request the HS hub
+to clear the TT buffer unless device side of endpoint is halted.
+
+Clearing the hub TT buffer at protocol stall caused ep0 to become
+unresponsive for some FS/LS devices behind HS hubs, and class drivers
+failed to set the interface due to timeout:
+
+usb 1-2.1: 1:1: usb_set_interface failed (-110)
+
+Fixes: ef513be0a905 ("usb: xhci: Add Clear_TT_Buffer")
+Cc: <stable@vger.kernel.org> # v5.3
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200421140822.28233-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1872,7 +1872,6 @@ static void xhci_cleanup_halted_endpoint
+ ep->ep_state |= EP_HARD_CLEAR_TOGGLE;
+ xhci_cleanup_stalled_ring(xhci, slot_id, ep_index, stream_id,
+ td);
+- xhci_clear_hub_tt_buffer(xhci, td, ep);
+ }
+ xhci_ring_cmd_db(xhci);
+ }
+@@ -1993,11 +1992,18 @@ static int finish_td(struct xhci_hcd *xh
+ if (trb_comp_code == COMP_STALL_ERROR ||
+ xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
+ trb_comp_code)) {
+- /* Issue a reset endpoint command to clear the host side
+- * halt, followed by a set dequeue command to move the
+- * dequeue pointer past the TD.
+- * The class driver clears the device side halt later.
++ /*
++ * xhci internal endpoint state will go to a "halt" state for
++ * any stall, including default control pipe protocol stall.
++ * To clear the host side halt we need to issue a reset endpoint
++ * command, followed by a set dequeue command to move past the
++ * TD.
++ * Class drivers clear the device side halt from a functional
++ * stall later. Hub TT buffer should only be cleared for FS/LS
++ * devices behind HS hubs for functional stalls.
+ */
++ if ((ep_index != 0) || (trb_comp_code != COMP_STALL_ERROR))
++ xhci_clear_hub_tt_buffer(xhci, td, ep);
+ xhci_cleanup_halted_endpoint(xhci, slot_id, ep_index,
+ ep_ring->stream_id, td, EP_HARD_RESET);
+ } else {
--- /dev/null
+From 93ceaa808e8defc67ebca1396e2f42f812a2efc0 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 21 Apr 2020 17:08:20 +0300
+Subject: xhci: Fix handling halted endpoint even if endpoint ring appears empty
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 93ceaa808e8defc67ebca1396e2f42f812a2efc0 upstream.
+
+If a class driver cancels its only URB then the endpoint ring buffer will
+appear empty to the xhci driver. xHC hardware may still process cached
+TRBs, and complete with a STALL, halting the endpoint.
+
+This halted endpoint was not handled correctly by xhci driver as events on
+empty rings were all assumed to be spurious events.
+xhci driver refused to restart the ring with EP_HALTED flag set, so class
+driver was never informed the endpoint halted even if it queued new URBs.
+
+The host side of the endpoint needs to be reset, and dequeue pointer should
+be moved in order to clear the cached TRBs and resetart the endpoint.
+
+Small adjustments in finding the new dequeue pointer are needed to support
+the case of stall on an empty ring and unknown current TD.
+
+Cc: <stable@vger.kernel.org>
+cc: Jeremy Compostella <jeremy.compostella@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200421140822.28233-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 30 +++++++++++++++++++++++++++++-
+ drivers/usb/host/xhci.c | 14 +++++++-------
+ drivers/usb/host/xhci.h | 5 +++--
+ 3 files changed, 39 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -547,6 +547,23 @@ void xhci_find_new_dequeue_state(struct
+ stream_id);
+ return;
+ }
++ /*
++ * A cancelled TD can complete with a stall if HW cached the trb.
++ * In this case driver can't find cur_td, but if the ring is empty we
++ * can move the dequeue pointer to the current enqueue position.
++ */
++ if (!cur_td) {
++ if (list_empty(&ep_ring->td_list)) {
++ state->new_deq_seg = ep_ring->enq_seg;
++ state->new_deq_ptr = ep_ring->enqueue;
++ state->new_cycle_state = ep_ring->cycle_state;
++ goto done;
++ } else {
++ xhci_warn(xhci, "Can't find new dequeue state, missing cur_td\n");
++ return;
++ }
++ }
++
+ /* Dig out the cycle state saved by the xHC during the stop ep cmd */
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "Finding endpoint context");
+@@ -592,6 +609,7 @@ void xhci_find_new_dequeue_state(struct
+ state->new_deq_seg = new_seg;
+ state->new_deq_ptr = new_deq;
+
++done:
+ /* Don't update the ring cycle state for the producer (us). */
+ xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
+ "Cycle state = 0x%x", state->new_cycle_state);
+@@ -1852,7 +1870,8 @@ static void xhci_cleanup_halted_endpoint
+
+ if (reset_type == EP_HARD_RESET) {
+ ep->ep_state |= EP_HARD_CLEAR_TOGGLE;
+- xhci_cleanup_stalled_ring(xhci, ep_index, stream_id, td);
++ xhci_cleanup_stalled_ring(xhci, slot_id, ep_index, stream_id,
++ td);
+ xhci_clear_hub_tt_buffer(xhci, td, ep);
+ }
+ xhci_ring_cmd_db(xhci);
+@@ -2531,6 +2550,15 @@ static int handle_tx_event(struct xhci_h
+ xhci_dbg(xhci, "td_list is empty while skip flag set. Clear skip flag for slot %u ep %u.\n",
+ slot_id, ep_index);
+ }
++ if (trb_comp_code == COMP_STALL_ERROR ||
++ xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
++ trb_comp_code)) {
++ xhci_cleanup_halted_endpoint(xhci, slot_id,
++ ep_index,
++ ep_ring->stream_id,
++ NULL,
++ EP_HARD_RESET);
++ }
+ goto cleanup;
+ }
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3031,19 +3031,19 @@ static void xhci_setup_input_ctx_for_qui
+ added_ctxs, added_ctxs);
+ }
+
+-void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index,
+- unsigned int stream_id, struct xhci_td *td)
++void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int slot_id,
++ unsigned int ep_index, unsigned int stream_id,
++ struct xhci_td *td)
+ {
+ struct xhci_dequeue_state deq_state;
+- struct usb_device *udev = td->urb->dev;
+
+ xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
+ "Cleaning up stalled endpoint ring");
+ /* We need to move the HW's dequeue pointer past this TD,
+ * or it will attempt to resend it on the next doorbell ring.
+ */
+- xhci_find_new_dequeue_state(xhci, udev->slot_id,
+- ep_index, stream_id, td, &deq_state);
++ xhci_find_new_dequeue_state(xhci, slot_id, ep_index, stream_id, td,
++ &deq_state);
+
+ if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)
+ return;
+@@ -3054,7 +3054,7 @@ void xhci_cleanup_stalled_ring(struct xh
+ if (!(xhci->quirks & XHCI_RESET_EP_QUIRK)) {
+ xhci_dbg_trace(xhci, trace_xhci_dbg_reset_ep,
+ "Queueing new dequeue state");
+- xhci_queue_new_dequeue_state(xhci, udev->slot_id,
++ xhci_queue_new_dequeue_state(xhci, slot_id,
+ ep_index, &deq_state);
+ } else {
+ /* Better hope no one uses the input context between now and the
+@@ -3065,7 +3065,7 @@ void xhci_cleanup_stalled_ring(struct xh
+ xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+ "Setting up input context for "
+ "configure endpoint command");
+- xhci_setup_input_ctx_for_quirk(xhci, udev->slot_id,
++ xhci_setup_input_ctx_for_quirk(xhci, slot_id,
+ ep_index, &deq_state);
+ }
+ }
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -2116,8 +2116,9 @@ void xhci_find_new_dequeue_state(struct
+ void xhci_queue_new_dequeue_state(struct xhci_hcd *xhci,
+ unsigned int slot_id, unsigned int ep_index,
+ struct xhci_dequeue_state *deq_state);
+-void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int ep_index,
+- unsigned int stream_id, struct xhci_td *td);
++void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci, unsigned int slot_id,
++ unsigned int ep_index, unsigned int stream_id,
++ struct xhci_td *td);
+ void xhci_stop_endpoint_command_watchdog(struct timer_list *t);
+ void xhci_handle_command_timeout(struct work_struct *work);
+
--- /dev/null
+From e9fb08d617bfae5471d902112667d0eeb9dee3c4 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 21 Apr 2020 17:08:21 +0300
+Subject: xhci: prevent bus suspend if a roothub port detected a over-current condition
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit e9fb08d617bfae5471d902112667d0eeb9dee3c4 upstream.
+
+Suspending the bus and host controller while a port is in a over-current
+condition may halt the host.
+Also keep the roothub running if over-current is active.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200421140822.28233-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-hub.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1569,6 +1569,8 @@ int xhci_hub_status_data(struct usb_hcd
+ }
+ if ((temp & PORT_RC))
+ reset_change = true;
++ if (temp & PORT_OC)
++ status = 1;
+ }
+ if (!status && !reset_change) {
+ xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+@@ -1634,6 +1636,13 @@ retry:
+ port_index);
+ goto retry;
+ }
++ /* bail out if port detected a over-current condition */
++ if (t1 & PORT_OC) {
++ bus_state->bus_suspended = 0;
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_dbg(xhci, "Bus suspend bailout, port over-current detected\n");
++ return -EBUSY;
++ }
+ /* suspend ports in U0, or bail out for new connect changes */
+ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
+ if ((t1 & PORT_CSC) && wake_enabled) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
