--- /dev/null
+From 9397061f7f4ef8eadf4a49b2d732328df227070d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 12:28:49 -0400
+Subject: ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 326b509238171d37402dbe308e154cc234ed1960 ]
+
+If we don't find any pcm, pcm will point at address at an offset from
+the the list head and not a meaningful structure. Fix this by returning
+correct pcm if found and NULL if not. Found with coccinelle.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20200415162849.308-1-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hdmi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index 18c173e6a13b2..78d5b4d31bb69 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -150,14 +150,14 @@ static struct hdac_hdmi_pcm *
+ hdac_hdmi_get_pcm_from_cvt(struct hdac_hdmi_priv *hdmi,
+ struct hdac_hdmi_cvt *cvt)
+ {
+- struct hdac_hdmi_pcm *pcm = NULL;
++ struct hdac_hdmi_pcm *pcm;
+
+ list_for_each_entry(pcm, &hdmi->pcm_list, head) {
+ if (pcm->cvt == cvt)
+- break;
++ return pcm;
+ }
+
+- return pcm;
++ return NULL;
+ }
+
+ static void hdac_hdmi_jack_report(struct hdac_hdmi_pcm *pcm,
+--
+2.20.1
+
--- /dev/null
+From 16a7162c216d90860f544871ac284275e0d3d0af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Apr 2020 17:30:16 +0200
+Subject: ASoC: rsnd: Don't treat master SSI in multi SSI setup as parent
+
+From: Matthias Blankertz <matthias.blankertz@cetitec.com>
+
+[ Upstream commit 0c258657ddfe81b4fc0183378d800c97ba0b7cdd ]
+
+The master SSI of a multi-SSI setup was attached both to the
+RSND_MOD_SSI slot and the RSND_MOD_SSIP slot of the rsnd_dai_stream.
+This is not correct wrt. the meaning of being "parent" in the rest of
+the SSI code, where it seems to indicate an SSI that provides clock and
+word sync but is not transmitting/receiving audio data.
+
+Not treating the multi-SSI master as parent allows removal of various
+special cases to the rsnd_ssi_is_parent conditions introduced in commit
+a09fb3f28a60 ("ASoC: rsnd: Fix parent SSI start/stop in multi-SSI mode").
+It also fixes the issue that operations performed via rsnd_dai_call()
+were performed twice for the master SSI. This caused some "status check
+failed" spam when stopping a multi-SSI stream as the driver attempted to
+stop the master SSI twice.
+
+Signed-off-by: Matthias Blankertz <matthias.blankertz@cetitec.com>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/20200417153017.1744454-2-matthias.blankertz@cetitec.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/ssi.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index d51fb3a394486..9900a4f6f4e53 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -407,7 +407,7 @@ static void rsnd_ssi_config_init(struct rsnd_mod *mod,
+ * We shouldn't exchange SWSP after running.
+ * This means, parent needs to care it.
+ */
+- if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
++ if (rsnd_ssi_is_parent(mod, io))
+ goto init_end;
+
+ if (rsnd_io_is_play(io))
+@@ -559,7 +559,7 @@ static int rsnd_ssi_start(struct rsnd_mod *mod,
+ * EN is for data output.
+ * SSI parent EN is not needed.
+ */
+- if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
++ if (rsnd_ssi_is_parent(mod, io))
+ return 0;
+
+ ssi->cr_en = EN;
+@@ -582,7 +582,7 @@ static int rsnd_ssi_stop(struct rsnd_mod *mod,
+ if (!rsnd_ssi_is_run_mods(mod, io))
+ return 0;
+
+- if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
++ if (rsnd_ssi_is_parent(mod, io))
+ return 0;
+
+ cr = ssi->cr_own |
+@@ -620,7 +620,7 @@ static int rsnd_ssi_irq(struct rsnd_mod *mod,
+ if (rsnd_is_gen1(priv))
+ return 0;
+
+- if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
++ if (rsnd_ssi_is_parent(mod, io))
+ return 0;
+
+ if (!rsnd_ssi_is_run_mods(mod, io))
+@@ -737,6 +737,9 @@ static void rsnd_ssi_parent_attach(struct rsnd_mod *mod,
+ if (!rsnd_rdai_is_clk_master(rdai))
+ return;
+
++ if (rsnd_ssi_is_multi_slave(mod, io))
++ return;
++
+ switch (rsnd_mod_id(mod)) {
+ case 1:
+ case 2:
+--
+2.20.1
+
--- /dev/null
+From 3d96b826b3971921d3f1d301dcc815a6d225b8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 16:10:17 +0200
+Subject: ASoC: rsnd: Fix HDMI channel mapping for multi-SSI mode
+
+From: Matthias Blankertz <matthias.blankertz@cetitec.com>
+
+[ Upstream commit b94e164759b82d0c1c80d4b1c8f12c9bee83f11d ]
+
+The HDMI?_SEL register maps up to four stereo SSI data lanes onto the
+sdata[0..3] inputs of the HDMI output block. The upper half of the
+register contains four blocks of 4 bits, with the most significant
+controlling the sdata3 line and the least significant the sdata0 line.
+
+The shift calculation has an off-by-one error, causing the parent SSI to
+be mapped to sdata3, the first multi-SSI child to sdata0 and so forth.
+As the parent SSI transmits the stereo L/R channels, and the HDMI core
+expects it on the sdata0 line, this causes no audio to be output when
+playing stereo audio on a multichannel capable HDMI out, and
+multichannel audio has permutated channels.
+
+Fix the shift calculation to map the parent SSI to sdata0, the first
+child to sdata1 etc.
+
+Signed-off-by: Matthias Blankertz <matthias.blankertz@cetitec.com>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/20200415141017.384017-3-matthias.blankertz@cetitec.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/ssiu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
+index f35d882118874..9c7c3e7539c93 100644
+--- a/sound/soc/sh/rcar/ssiu.c
++++ b/sound/soc/sh/rcar/ssiu.c
+@@ -221,7 +221,7 @@ static int rsnd_ssiu_init_gen2(struct rsnd_mod *mod,
+ i;
+
+ for_each_rsnd_mod_array(i, pos, io, rsnd_ssi_array) {
+- shift = (i * 4) + 16;
++ shift = (i * 4) + 20;
+ val = (val & ~(0xF << shift)) |
+ rsnd_mod_id(pos) << shift;
+ }
+--
+2.20.1
+
--- /dev/null
+From 590218091a4040c1e3433de638df2122fc0535a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 16:10:16 +0200
+Subject: ASoC: rsnd: Fix parent SSI start/stop in multi-SSI mode
+
+From: Matthias Blankertz <matthias.blankertz@cetitec.com>
+
+[ Upstream commit a09fb3f28a60ba3e928a1fa94b0456780800299d ]
+
+The parent SSI of a multi-SSI setup must be fully setup, started and
+stopped since it is also part of the playback/capture setup. So only
+skip the SSI (as per commit 203cdf51f288 ("ASoC: rsnd: SSI parent cares
+SWSP bit") and commit 597b046f0d99 ("ASoC: rsnd: control SSICR::EN
+correctly")) if the SSI is parent outside of a multi-SSI setup.
+
+Signed-off-by: Matthias Blankertz <matthias.blankertz@cetitec.com>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/20200415141017.384017-2-matthias.blankertz@cetitec.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/ssi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index fc5d089868dfc..d51fb3a394486 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -407,7 +407,7 @@ static void rsnd_ssi_config_init(struct rsnd_mod *mod,
+ * We shouldn't exchange SWSP after running.
+ * This means, parent needs to care it.
+ */
+- if (rsnd_ssi_is_parent(mod, io))
++ if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
+ goto init_end;
+
+ if (rsnd_io_is_play(io))
+@@ -559,7 +559,7 @@ static int rsnd_ssi_start(struct rsnd_mod *mod,
+ * EN is for data output.
+ * SSI parent EN is not needed.
+ */
+- if (rsnd_ssi_is_parent(mod, io))
++ if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
+ return 0;
+
+ ssi->cr_en = EN;
+@@ -582,7 +582,7 @@ static int rsnd_ssi_stop(struct rsnd_mod *mod,
+ if (!rsnd_ssi_is_run_mods(mod, io))
+ return 0;
+
+- if (rsnd_ssi_is_parent(mod, io))
++ if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
+ return 0;
+
+ cr = ssi->cr_own |
+@@ -620,7 +620,7 @@ static int rsnd_ssi_irq(struct rsnd_mod *mod,
+ if (rsnd_is_gen1(priv))
+ return 0;
+
+- if (rsnd_ssi_is_parent(mod, io))
++ if (rsnd_ssi_is_parent(mod, io) && !rsnd_ssi_multi_slaves(io))
+ return 0;
+
+ if (!rsnd_ssi_is_run_mods(mod, io))
+--
+2.20.1
+
--- /dev/null
+From 160fea7951354fe7c9020ad94065166e1308aa0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Apr 2020 17:30:17 +0200
+Subject: ASoC: rsnd: Fix "status check failed" spam for multi-SSI
+
+From: Matthias Blankertz <matthias.blankertz@cetitec.com>
+
+[ Upstream commit 54cb6221688660670a2e430892d7f4e6370263b8 ]
+
+Fix the rsnd_ssi_stop function to skip disabling the individual SSIs of
+a multi-SSI setup, as the actual stop is performed by rsnd_ssiu_stop_gen2
+- the same logic as in rsnd_ssi_start. The attempt to disable these SSIs
+was harmless, but caused a "status check failed" message to be printed
+for every SSI in the multi-SSI setup.
+The disabling of interrupts is still performed, as they are enabled for
+all SSIs in rsnd_ssi_init, but care is taken to not accidentally set the
+EN bit for an SSI where it was not set by rsnd_ssi_start.
+
+Signed-off-by: Matthias Blankertz <matthias.blankertz@cetitec.com>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/20200417153017.1744454-3-matthias.blankertz@cetitec.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/ssi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 9900a4f6f4e53..4a7d3413917fc 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -594,10 +594,16 @@ static int rsnd_ssi_stop(struct rsnd_mod *mod,
+ * Capture: It might not receave data. Do nothing
+ */
+ if (rsnd_io_is_play(io)) {
+- rsnd_mod_write(mod, SSICR, cr | EN);
++ rsnd_mod_write(mod, SSICR, cr | ssi->cr_en);
+ rsnd_ssi_status_check(mod, DIRQ);
+ }
+
++ /* In multi-SSI mode, stop is performed by setting ssi0129 in
++ * SSI_CONTROL to 0 (in rsnd_ssio_stop_gen2). Do nothing here.
++ */
++ if (rsnd_ssi_multi_slaves_runtime(io))
++ return 0;
++
+ /*
+ * disable SSI,
+ * and, wait idle state
+--
+2.20.1
+
--- /dev/null
+From 310cc9b250836c4f1cb2e038d7c89462e901c65c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Apr 2020 20:11:40 +0200
+Subject: ASoC: sgtl5000: Fix VAG power-on handling
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit aa7812737f2877e192d57626cbe8825cc7cf6de9 ]
+
+As mentioned slightly out of patch context in the code, there
+is no reset routine for the chip. On boards where the chip is
+supplied by a fixed regulator, it might not even be resetted
+during (e.g. watchdog) reboot and can be in any state.
+
+If the device is probed with VAG enabled, the driver's probe
+routine will generate a loud pop sound when ANA_POWER is
+being programmed. Avoid this by properly disabling just the
+VAG bit and waiting the required power down time.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-by: Fabio Estevam <festivem@gmail.com>
+Link: https://lore.kernel.org/r/20200414181140.145825-1-sebastian.reichel@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 34 ++++++++++++++++++++++++++++++++++
+ sound/soc/codecs/sgtl5000.h | 1 +
+ 2 files changed, 35 insertions(+)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index e949b372ceada..f5b59305c957a 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1645,6 +1645,40 @@ static int sgtl5000_i2c_probe(struct i2c_client *client,
+ dev_err(&client->dev,
+ "Error %d initializing CHIP_CLK_CTRL\n", ret);
+
++ /* Mute everything to avoid pop from the following power-up */
++ ret = regmap_write(sgtl5000->regmap, SGTL5000_CHIP_ANA_CTRL,
++ SGTL5000_CHIP_ANA_CTRL_DEFAULT);
++ if (ret) {
++ dev_err(&client->dev,
++ "Error %d muting outputs via CHIP_ANA_CTRL\n", ret);
++ goto disable_clk;
++ }
++
++ /*
++ * If VAG is powered-on (e.g. from previous boot), it would be disabled
++ * by the write to ANA_POWER in later steps of the probe code. This
++ * may create a loud pop even with all outputs muted. The proper way
++ * to circumvent this is disabling the bit first and waiting the proper
++ * cool-down time.
++ */
++ ret = regmap_read(sgtl5000->regmap, SGTL5000_CHIP_ANA_POWER, &value);
++ if (ret) {
++ dev_err(&client->dev, "Failed to read ANA_POWER: %d\n", ret);
++ goto disable_clk;
++ }
++ if (value & SGTL5000_VAG_POWERUP) {
++ ret = regmap_update_bits(sgtl5000->regmap,
++ SGTL5000_CHIP_ANA_POWER,
++ SGTL5000_VAG_POWERUP,
++ 0);
++ if (ret) {
++ dev_err(&client->dev, "Error %d disabling VAG\n", ret);
++ goto disable_clk;
++ }
++
++ msleep(SGTL5000_VAG_POWERDOWN_DELAY);
++ }
++
+ /* Follow section 2.2.1.1 of AN3663 */
+ ana_pwr = SGTL5000_ANA_POWER_DEFAULT;
+ if (sgtl5000->num_supplies <= VDDD) {
+diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
+index a4bf4bca95bf7..56ec5863f2507 100644
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -233,6 +233,7 @@
+ /*
+ * SGTL5000_CHIP_ANA_CTRL
+ */
++#define SGTL5000_CHIP_ANA_CTRL_DEFAULT 0x0133
+ #define SGTL5000_LINE_OUT_MUTE 0x0100
+ #define SGTL5000_HP_SEL_MASK 0x0040
+ #define SGTL5000_HP_SEL_SHIFT 6
+--
+2.20.1
+
--- /dev/null
+From 7984acf07f4e0758897508645fa5d7abbe1c639d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 16:47:28 -0400
+Subject: ASoC: topology: Check return value of pcm_new_ver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit b3677fc3d68dd942c92de52f0bd9dd8b472a40e6 ]
+
+Function pcm_new_ver can fail, so we should check it's return value and
+handle possible error.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200327204729.397-6-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index e0b40d4d8784c..22960f5932c7f 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2092,7 +2092,9 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
+ _pcm = pcm;
+ } else {
+ abi_match = false;
+- pcm_new_ver(tplg, pcm, &_pcm);
++ ret = pcm_new_ver(tplg, pcm, &_pcm);
++ if (ret < 0)
++ return ret;
+ }
+
+ /* create the FE DAIs and DAI links */
+--
+2.20.1
+
--- /dev/null
+From b389eb12f12634a50bc281964af1554ee57f67ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 16:47:26 -0400
+Subject: ASoC: topology: Check return value of soc_tplg_*_create
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 2ae548f30d7f6973388fc3769bb3c2f6fd13652b ]
+
+Functions soc_tplg_denum_create, soc_tplg_dmixer_create,
+soc_tplg_dbytes_create can fail, so their return values should be
+checked and error should be propagated.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200327204729.397-4-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index c2901652a6d04..efe6ad3bfcd9b 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1123,6 +1123,7 @@ static int soc_tplg_kcontrol_elems_load(struct soc_tplg *tplg,
+ struct snd_soc_tplg_hdr *hdr)
+ {
+ struct snd_soc_tplg_ctl_hdr *control_hdr;
++ int ret;
+ int i;
+
+ if (tplg->pass != SOC_TPLG_PASS_MIXER) {
+@@ -1151,25 +1152,30 @@ static int soc_tplg_kcontrol_elems_load(struct soc_tplg *tplg,
+ case SND_SOC_TPLG_CTL_RANGE:
+ case SND_SOC_TPLG_DAPM_CTL_VOLSW:
+ case SND_SOC_TPLG_DAPM_CTL_PIN:
+- soc_tplg_dmixer_create(tplg, 1,
+- le32_to_cpu(hdr->payload_size));
++ ret = soc_tplg_dmixer_create(tplg, 1,
++ le32_to_cpu(hdr->payload_size));
+ break;
+ case SND_SOC_TPLG_CTL_ENUM:
+ case SND_SOC_TPLG_CTL_ENUM_VALUE:
+ case SND_SOC_TPLG_DAPM_CTL_ENUM_DOUBLE:
+ case SND_SOC_TPLG_DAPM_CTL_ENUM_VIRT:
+ case SND_SOC_TPLG_DAPM_CTL_ENUM_VALUE:
+- soc_tplg_denum_create(tplg, 1,
+- le32_to_cpu(hdr->payload_size));
++ ret = soc_tplg_denum_create(tplg, 1,
++ le32_to_cpu(hdr->payload_size));
+ break;
+ case SND_SOC_TPLG_CTL_BYTES:
+- soc_tplg_dbytes_create(tplg, 1,
+- le32_to_cpu(hdr->payload_size));
++ ret = soc_tplg_dbytes_create(tplg, 1,
++ le32_to_cpu(hdr->payload_size));
+ break;
+ default:
+ soc_bind_err(tplg, control_hdr, i);
+ return -EINVAL;
+ }
++ if (ret < 0) {
++ dev_err(tplg->dev, "ASoC: invalid control\n");
++ return ret;
++ }
++
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 6061103772a5455fce4d2250d64c28add4cc720d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 16:47:25 -0400
+Subject: ASoC: topology: Check return value of soc_tplg_create_tlv
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 482db55ae87f3749db05810a38b1d618dfd4407c ]
+
+Function soc_tplg_create_tlv can fail, so we should check if it succeded
+or not and proceed appropriately.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200327204729.397-3-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 17556a47f7274..c2901652a6d04 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -893,7 +893,13 @@ static int soc_tplg_dmixer_create(struct soc_tplg *tplg, unsigned int count,
+ }
+
+ /* create any TLV data */
+- soc_tplg_create_tlv(tplg, &kc, &mc->hdr);
++ err = soc_tplg_create_tlv(tplg, &kc, &mc->hdr);
++ if (err < 0) {
++ dev_err(tplg->dev, "ASoC: failed to create TLV %s\n",
++ mc->hdr.name);
++ kfree(sm);
++ continue;
++ }
+
+ /* pass control to driver for optional further init */
+ err = soc_tplg_init_kcontrol(tplg, &kc,
+@@ -1354,7 +1360,13 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ }
+
+ /* create any TLV data */
+- soc_tplg_create_tlv(tplg, &kc[i], &mc->hdr);
++ err = soc_tplg_create_tlv(tplg, &kc[i], &mc->hdr);
++ if (err < 0) {
++ dev_err(tplg->dev, "ASoC: failed to create TLV %s\n",
++ mc->hdr.name);
++ kfree(sm);
++ continue;
++ }
+
+ /* pass control to driver for optional further init */
+ err = soc_tplg_init_kcontrol(tplg, &kc[i],
+--
+2.20.1
+
--- /dev/null
+From f36ac5221be109965d37312ac8fc2d1283e05c2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 16:47:29 -0400
+Subject: ASoC: topology: Check return value of soc_tplg_dai_config
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit dd8e871d4e560eeb8d22af82dde91457ad835a63 ]
+
+Function soc_tplg_dai_config can fail, check for and handle possible
+failure.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200327204729.397-7-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 22960f5932c7f..2d4a5a3058c41 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2431,7 +2431,7 @@ static int soc_tplg_dai_elems_load(struct soc_tplg *tplg,
+ {
+ struct snd_soc_tplg_dai *dai;
+ int count;
+- int i;
++ int i, ret;
+
+ count = le32_to_cpu(hdr->count);
+
+@@ -2446,7 +2446,12 @@ static int soc_tplg_dai_elems_load(struct soc_tplg *tplg,
+ return -EINVAL;
+ }
+
+- soc_tplg_dai_config(tplg, dai);
++ ret = soc_tplg_dai_config(tplg, dai);
++ if (ret < 0) {
++ dev_err(tplg->dev, "ASoC: failed to configure DAI\n");
++ return ret;
++ }
++
+ tplg->pos += (sizeof(*dai) + le32_to_cpu(dai->priv.size));
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ca7d900e43c194bcdb8f3748daec1ffc6252f4f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 16:47:27 -0400
+Subject: ASoC: topology: Check soc_tplg_add_route return value
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 6856e887eae3efc0fe56899cb3f969fe063171c5 ]
+
+Function soc_tplg_add_route can propagate error code from callback, we
+should check its return value and handle fail in correct way.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200327204729.397-5-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index efe6ad3bfcd9b..e0b40d4d8784c 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1283,7 +1283,9 @@ static int soc_tplg_dapm_graph_elems_load(struct soc_tplg *tplg,
+ routes[i]->dobj.index = tplg->index;
+ list_add(&routes[i]->dobj.list, &tplg->comp->dobj_list);
+
+- soc_tplg_add_route(tplg, routes[i]);
++ ret = soc_tplg_add_route(tplg, routes[i]);
++ if (ret < 0)
++ break;
+
+ /* add route, but keep going if some fail */
+ snd_soc_dapm_add_routes(dapm, routes[i], 1);
+--
+2.20.1
+
--- /dev/null
+From bc106744468ef745bbfe03f9244d2a83c5a8c830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 12:24:35 -0400
+Subject: ASoC: topology: Fix endianness issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 26d87881590fd55ccdd8f829498d7b3033f81990 ]
+
+As done in already existing cases, we should use le32_to_cpu macro while
+accessing hdr->magic. Found with sparse.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20200415162435.31859-2-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 2d4a5a3058c41..65c91abb9462f 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -2559,7 +2559,7 @@ static int soc_valid_header(struct soc_tplg *tplg,
+ }
+
+ /* big endian firmware objects not supported atm */
+- if (hdr->magic == SOC_TPLG_MAGIC_BIG_ENDIAN) {
++ if (le32_to_cpu(hdr->magic) == SOC_TPLG_MAGIC_BIG_ENDIAN) {
+ dev_err(tplg->dev,
+ "ASoC: pass %d big endian not supported header got %x at offset 0x%lx size 0x%zx.\n",
+ tplg->pass, hdr->magic,
+--
+2.20.1
+
--- /dev/null
+From 6cad9513e046e95009e7bcf287be13f0f427e138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Apr 2020 19:42:57 -0300
+Subject: cifs: do not share tcons with DFS
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+[ Upstream commit 65303de829dd6d291a4947c1a31de31896f8a060 ]
+
+This disables tcon re-use for DFS shares.
+
+tcon->dfs_path stores the path that the tcon should connect to when
+doing failing over.
+
+If that tcon is used multiple times e.g. 2 mounts using it with
+different prefixpath, each will need a different dfs_path but there is
+only one tcon. The other solution would be to split the tcon in 2
+tcons during failover but that is much harder.
+
+tcons could not be shared with DFS in cifs.ko because in a
+DFS namespace like:
+
+ //domain/dfsroot -> /serverA/dfsroot, /serverB/dfsroot
+
+ //serverA/dfsroot/link -> /serverA/target1/aa/bb
+
+ //serverA/dfsroot/link2 -> /serverA/target1/cc/dd
+
+you can see that link and link2 are two DFS links that both resolve to
+the same target share (/serverA/target1), so cifs.ko will only contain a
+single tcon for both link and link2.
+
+The problem with that is, if we (auto)mount "link" and "link2", cifs.ko
+will only contain a single tcon for both DFS links so we couldn't
+perform failover or refresh the DFS cache for both links because
+tcon->dfs_path was set to either "link" or "link2", but not both --
+which is wrong.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 52589ea4e3c05..721b2560caa74 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3362,6 +3362,10 @@ cifs_find_tcon(struct cifs_ses *ses, struct smb_vol *volume_info)
+ spin_lock(&cifs_tcp_ses_lock);
+ list_for_each(tmp, &ses->tcon_list) {
+ tcon = list_entry(tmp, struct cifs_tcon, tcon_list);
++#ifdef CONFIG_CIFS_DFS_UPCALL
++ if (tcon->dfs_path)
++ continue;
++#endif
+ if (!match_tcon(tcon, volume_info))
+ continue;
+ ++tcon->tc_count;
+--
+2.20.1
+
--- /dev/null
+From 6f4c3f9cdbdb0ac6570a4424532b0d1da8365b55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Apr 2020 12:37:39 +1000
+Subject: cifs: protect updating server->dstaddr with a spinlock
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+[ Upstream commit fada37f6f62995cc449b36ebba1220594bfe55fe ]
+
+We use a spinlock while we are reading and accessing the destination address for a server.
+We need to also use this spinlock to protect when we are modifying this address from
+reconn_set_ipaddr().
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index bcda48c038821..52589ea4e3c05 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -371,8 +371,10 @@ static int reconn_set_ipaddr(struct TCP_Server_Info *server)
+ return rc;
+ }
+
++ spin_lock(&cifs_tcp_ses_lock);
+ rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
+ strlen(ipaddr));
++ spin_unlock(&cifs_tcp_ses_lock);
+ kfree(ipaddr);
+
+ return !rc ? -1 : 0;
+--
+2.20.1
+
--- /dev/null
+From f12e61b5c594152d88868af703f1c4407fe6fbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Apr 2020 01:37:45 +0530
+Subject: drm/amdgpu: Correctly initialize thermal controller for GPUs with
+ Powerplay table v0 (e.g Hawaii)
+
+From: Sandeep Raghuraman <sandy.8925@gmail.com>
+
+[ Upstream commit bbc25dadc7ed19f9d6b2e30980f0eb4c741bb8bf ]
+
+Initialize thermal controller fields in the PowerPlay table for Hawaii
+GPUs, so that fan speeds are reported.
+
+Signed-off-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/powerplay/hwmgr/processpptables.c | 26 +++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c
+index 77c14671866c0..719597c5d27d9 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/processpptables.c
+@@ -984,6 +984,32 @@ static int init_thermal_controller(
+ struct pp_hwmgr *hwmgr,
+ const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
+ {
++ hwmgr->thermal_controller.ucType =
++ powerplay_table->sThermalController.ucType;
++ hwmgr->thermal_controller.ucI2cLine =
++ powerplay_table->sThermalController.ucI2cLine;
++ hwmgr->thermal_controller.ucI2cAddress =
++ powerplay_table->sThermalController.ucI2cAddress;
++
++ hwmgr->thermal_controller.fanInfo.bNoFan =
++ (0 != (powerplay_table->sThermalController.ucFanParameters &
++ ATOM_PP_FANPARAMETERS_NOFAN));
++
++ hwmgr->thermal_controller.fanInfo.ucTachometerPulsesPerRevolution =
++ powerplay_table->sThermalController.ucFanParameters &
++ ATOM_PP_FANPARAMETERS_TACHOMETER_PULSES_PER_REVOLUTION_MASK;
++
++ hwmgr->thermal_controller.fanInfo.ulMinRPM
++ = powerplay_table->sThermalController.ucFanMinRPM * 100UL;
++ hwmgr->thermal_controller.fanInfo.ulMaxRPM
++ = powerplay_table->sThermalController.ucFanMaxRPM * 100UL;
++
++ set_hw_cap(hwmgr,
++ ATOM_PP_THERMALCONTROLLER_NONE != hwmgr->thermal_controller.ucType,
++ PHM_PlatformCaps_ThermalController);
++
++ hwmgr->thermal_controller.use_hw_fan_control = 1;
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e14c7e02444814795200e3bd50429798b7a5cf60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2020 11:34:27 +0100
+Subject: drm/bridge: analogix_dp: Split bind() into probe() and real bind()
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 83a196773b8bc6702f49df1eddc848180e350340 ]
+
+Analogix_dp driver acquires all its resources in the ->bind() callback,
+what is a bit against the component driver based approach, where the
+driver initialization is split into a probe(), where all resources are
+gathered, and a bind(), where all objects are created and a compound
+driver is initialized.
+
+Extract all the resource related operations to analogix_dp_probe() and
+analogix_dp_remove(), then call them before/after registration of the
+device components from the main Exynos DP and Rockchip DP drivers. Also
+move the plat_data initialization to the probe() to make it available for
+the analogix_dp_probe() function.
+
+This fixes the multiple calls to the bind() of the DRM compound driver
+when the DP PHY driver is not yet loaded/probed:
+
+[drm] Exynos DRM: using 14400000.fimd device for DMA mapping operations
+exynos-drm exynos-drm: bound 14400000.fimd (ops fimd_component_ops [exynosdrm])
+exynos-drm exynos-drm: bound 14450000.mixer (ops mixer_component_ops [exynosdrm])
+exynos-dp 145b0000.dp-controller: no DP phy configured
+exynos-drm exynos-drm: failed to bind 145b0000.dp-controller (ops exynos_dp_ops [exynosdrm]): -517
+exynos-drm exynos-drm: master bind failed: -517
+...
+[drm] Exynos DRM: using 14400000.fimd device for DMA mapping operations
+exynos-drm exynos-drm: bound 14400000.fimd (ops hdmi_enable [exynosdrm])
+exynos-drm exynos-drm: bound 14450000.mixer (ops hdmi_enable [exynosdrm])
+exynos-drm exynos-drm: bound 145b0000.dp-controller (ops hdmi_enable [exynosdrm])
+exynos-drm exynos-drm: bound 14530000.hdmi (ops hdmi_enable [exynosdrm])
+[drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
+Console: switching to colour frame buffer device 170x48
+exynos-drm exynos-drm: fb0: exynosdrmfb frame buffer device
+[drm] Initialized exynos 1.1.0 20180330 for exynos-drm on minor 1
+...
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Andy Yan <andy.yan@rock-chips.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200310103427.26048-1-m.szyprowski@samsung.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/bridge/analogix/analogix_dp_core.c | 33 +++++++++++------
+ drivers/gpu/drm/exynos/exynos_dp.c | 29 ++++++++-------
+ .../gpu/drm/rockchip/analogix_dp-rockchip.c | 36 ++++++++++---------
+ include/drm/bridge/analogix_dp.h | 5 +--
+ 4 files changed, 61 insertions(+), 42 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index 22885dceaa177..1f26890a8da6e 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -1635,8 +1635,7 @@ static ssize_t analogix_dpaux_transfer(struct drm_dp_aux *aux,
+ }
+
+ struct analogix_dp_device *
+-analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
+- struct analogix_dp_plat_data *plat_data)
++analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct analogix_dp_device *dp;
+@@ -1739,22 +1738,30 @@ analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
+ irq_flags, "analogix-dp", dp);
+ if (ret) {
+ dev_err(&pdev->dev, "failed to request irq\n");
+- goto err_disable_pm_runtime;
++ return ERR_PTR(ret);
+ }
+ disable_irq(dp->irq);
+
++ return dp;
++}
++EXPORT_SYMBOL_GPL(analogix_dp_probe);
++
++int analogix_dp_bind(struct analogix_dp_device *dp, struct drm_device *drm_dev)
++{
++ int ret;
++
+ dp->drm_dev = drm_dev;
+ dp->encoder = dp->plat_data->encoder;
+
+ dp->aux.name = "DP-AUX";
+ dp->aux.transfer = analogix_dpaux_transfer;
+- dp->aux.dev = &pdev->dev;
++ dp->aux.dev = dp->dev;
+
+ ret = drm_dp_aux_register(&dp->aux);
+ if (ret)
+- return ERR_PTR(ret);
++ return ret;
+
+- pm_runtime_enable(dev);
++ pm_runtime_enable(dp->dev);
+
+ ret = analogix_dp_create_bridge(drm_dev, dp);
+ if (ret) {
+@@ -1762,13 +1769,12 @@ analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
+ goto err_disable_pm_runtime;
+ }
+
+- return dp;
++ return 0;
+
+ err_disable_pm_runtime:
++ pm_runtime_disable(dp->dev);
+
+- pm_runtime_disable(dev);
+-
+- return ERR_PTR(ret);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(analogix_dp_bind);
+
+@@ -1785,10 +1791,15 @@ void analogix_dp_unbind(struct analogix_dp_device *dp)
+
+ drm_dp_aux_unregister(&dp->aux);
+ pm_runtime_disable(dp->dev);
+- clk_disable_unprepare(dp->clock);
+ }
+ EXPORT_SYMBOL_GPL(analogix_dp_unbind);
+
++void analogix_dp_remove(struct analogix_dp_device *dp)
++{
++ clk_disable_unprepare(dp->clock);
++}
++EXPORT_SYMBOL_GPL(analogix_dp_remove);
++
+ #ifdef CONFIG_PM
+ int analogix_dp_suspend(struct analogix_dp_device *dp)
+ {
+diff --git a/drivers/gpu/drm/exynos/exynos_dp.c b/drivers/gpu/drm/exynos/exynos_dp.c
+index 3a0f0ba8c63a0..e0cfae744afc9 100644
+--- a/drivers/gpu/drm/exynos/exynos_dp.c
++++ b/drivers/gpu/drm/exynos/exynos_dp.c
+@@ -158,15 +158,8 @@ static int exynos_dp_bind(struct device *dev, struct device *master, void *data)
+ struct drm_device *drm_dev = data;
+ int ret;
+
+- dp->dev = dev;
+ dp->drm_dev = drm_dev;
+
+- dp->plat_data.dev_type = EXYNOS_DP;
+- dp->plat_data.power_on_start = exynos_dp_poweron;
+- dp->plat_data.power_off = exynos_dp_poweroff;
+- dp->plat_data.attach = exynos_dp_bridge_attach;
+- dp->plat_data.get_modes = exynos_dp_get_modes;
+-
+ if (!dp->plat_data.panel && !dp->ptn_bridge) {
+ ret = exynos_dp_dt_parse_panel(dp);
+ if (ret)
+@@ -184,13 +177,11 @@ static int exynos_dp_bind(struct device *dev, struct device *master, void *data)
+
+ dp->plat_data.encoder = encoder;
+
+- dp->adp = analogix_dp_bind(dev, dp->drm_dev, &dp->plat_data);
+- if (IS_ERR(dp->adp)) {
++ ret = analogix_dp_bind(dp->adp, dp->drm_dev);
++ if (ret)
+ dp->encoder.funcs->destroy(&dp->encoder);
+- return PTR_ERR(dp->adp);
+- }
+
+- return 0;
++ return ret;
+ }
+
+ static void exynos_dp_unbind(struct device *dev, struct device *master,
+@@ -221,6 +212,7 @@ static int exynos_dp_probe(struct platform_device *pdev)
+ if (!dp)
+ return -ENOMEM;
+
++ dp->dev = dev;
+ /*
+ * We just use the drvdata until driver run into component
+ * add function, and then we would set drvdata to null, so
+@@ -246,16 +238,29 @@ static int exynos_dp_probe(struct platform_device *pdev)
+
+ /* The remote port can be either a panel or a bridge */
+ dp->plat_data.panel = panel;
++ dp->plat_data.dev_type = EXYNOS_DP;
++ dp->plat_data.power_on_start = exynos_dp_poweron;
++ dp->plat_data.power_off = exynos_dp_poweroff;
++ dp->plat_data.attach = exynos_dp_bridge_attach;
++ dp->plat_data.get_modes = exynos_dp_get_modes;
+ dp->plat_data.skip_connector = !!bridge;
++
+ dp->ptn_bridge = bridge;
+
+ out:
++ dp->adp = analogix_dp_probe(dev, &dp->plat_data);
++ if (IS_ERR(dp->adp))
++ return PTR_ERR(dp->adp);
++
+ return component_add(&pdev->dev, &exynos_dp_ops);
+ }
+
+ static int exynos_dp_remove(struct platform_device *pdev)
+ {
++ struct exynos_dp_device *dp = platform_get_drvdata(pdev);
++
+ component_del(&pdev->dev, &exynos_dp_ops);
++ analogix_dp_remove(dp->adp);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+index f38f5e113c6b3..ce98c08aa8b44 100644
+--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+@@ -325,15 +325,9 @@ static int rockchip_dp_bind(struct device *dev, struct device *master,
+ void *data)
+ {
+ struct rockchip_dp_device *dp = dev_get_drvdata(dev);
+- const struct rockchip_dp_chip_data *dp_data;
+ struct drm_device *drm_dev = data;
+ int ret;
+
+- dp_data = of_device_get_match_data(dev);
+- if (!dp_data)
+- return -ENODEV;
+-
+- dp->data = dp_data;
+ dp->drm_dev = drm_dev;
+
+ ret = rockchip_dp_drm_create_encoder(dp);
+@@ -344,16 +338,9 @@ static int rockchip_dp_bind(struct device *dev, struct device *master,
+
+ dp->plat_data.encoder = &dp->encoder;
+
+- dp->plat_data.dev_type = dp->data->chip_type;
+- dp->plat_data.power_on_start = rockchip_dp_poweron_start;
+- dp->plat_data.power_off = rockchip_dp_powerdown;
+- dp->plat_data.get_modes = rockchip_dp_get_modes;
+-
+- dp->adp = analogix_dp_bind(dev, dp->drm_dev, &dp->plat_data);
+- if (IS_ERR(dp->adp)) {
+- ret = PTR_ERR(dp->adp);
++ ret = analogix_dp_bind(dp->adp, drm_dev);
++ if (ret)
+ goto err_cleanup_encoder;
+- }
+
+ return 0;
+ err_cleanup_encoder:
+@@ -368,8 +355,6 @@ static void rockchip_dp_unbind(struct device *dev, struct device *master,
+
+ analogix_dp_unbind(dp->adp);
+ dp->encoder.funcs->destroy(&dp->encoder);
+-
+- dp->adp = ERR_PTR(-ENODEV);
+ }
+
+ static const struct component_ops rockchip_dp_component_ops = {
+@@ -380,10 +365,15 @@ static const struct component_ops rockchip_dp_component_ops = {
+ static int rockchip_dp_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
++ const struct rockchip_dp_chip_data *dp_data;
+ struct drm_panel *panel = NULL;
+ struct rockchip_dp_device *dp;
+ int ret;
+
++ dp_data = of_device_get_match_data(dev);
++ if (!dp_data)
++ return -ENODEV;
++
+ ret = drm_of_find_panel_or_bridge(dev->of_node, 1, 0, &panel, NULL);
+ if (ret < 0)
+ return ret;
+@@ -394,7 +384,12 @@ static int rockchip_dp_probe(struct platform_device *pdev)
+
+ dp->dev = dev;
+ dp->adp = ERR_PTR(-ENODEV);
++ dp->data = dp_data;
+ dp->plat_data.panel = panel;
++ dp->plat_data.dev_type = dp->data->chip_type;
++ dp->plat_data.power_on_start = rockchip_dp_poweron_start;
++ dp->plat_data.power_off = rockchip_dp_powerdown;
++ dp->plat_data.get_modes = rockchip_dp_get_modes;
+
+ ret = rockchip_dp_of_probe(dp);
+ if (ret < 0)
+@@ -402,12 +397,19 @@ static int rockchip_dp_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, dp);
+
++ dp->adp = analogix_dp_probe(dev, &dp->plat_data);
++ if (IS_ERR(dp->adp))
++ return PTR_ERR(dp->adp);
++
+ return component_add(dev, &rockchip_dp_component_ops);
+ }
+
+ static int rockchip_dp_remove(struct platform_device *pdev)
+ {
++ struct rockchip_dp_device *dp = platform_get_drvdata(pdev);
++
+ component_del(&pdev->dev, &rockchip_dp_component_ops);
++ analogix_dp_remove(dp->adp);
+
+ return 0;
+ }
+diff --git a/include/drm/bridge/analogix_dp.h b/include/drm/bridge/analogix_dp.h
+index 7aa2f93da49ca..b0dcc07334a1e 100644
+--- a/include/drm/bridge/analogix_dp.h
++++ b/include/drm/bridge/analogix_dp.h
+@@ -42,9 +42,10 @@ int analogix_dp_resume(struct analogix_dp_device *dp);
+ int analogix_dp_suspend(struct analogix_dp_device *dp);
+
+ struct analogix_dp_device *
+-analogix_dp_bind(struct device *dev, struct drm_device *drm_dev,
+- struct analogix_dp_plat_data *plat_data);
++analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data);
++int analogix_dp_bind(struct analogix_dp_device *dp, struct drm_device *drm_dev);
+ void analogix_dp_unbind(struct analogix_dp_device *dp);
++void analogix_dp_remove(struct analogix_dp_device *dp);
+
+ int analogix_dp_start_crc(struct drm_connector *connector);
+ int analogix_dp_stop_crc(struct drm_connector *connector);
+--
+2.20.1
+
--- /dev/null
+From ec32d0484b467e8eaf17dd93edb6a3b2a6a9644c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 12:50:42 -0700
+Subject: lib/mpi: Fix building for powerpc with clang
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 5990cdee689c6885b27c6d969a3d58b09002b0bc ]
+
+0day reports over and over on an powerpc randconfig with clang:
+
+lib/mpi/generic_mpih-mul1.c:37:13: error: invalid use of a cast in a
+inline asm context requiring an l-value: remove the cast or build with
+-fheinous-gnu-extensions
+
+Remove the superfluous casts, which have been done previously for x86
+and arm32 in commit dea632cadd12 ("lib/mpi: fix build with clang") and
+commit 7b7c1df2883d ("lib/mpi/longlong.h: fix building with 32-bit
+x86").
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/991
+Link: https://lore.kernel.org/r/20200413195041.24064-1-natechancellor@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/mpi/longlong.h | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index 2dceaca27489c..891e1c3549c46 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -722,22 +722,22 @@ do { \
+ do { \
+ if (__builtin_constant_p(bh) && (bh) == 0) \
+ __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "%r" ((USItype)(ah)), \
+ "%r" ((USItype)(al)), \
+ "rI" ((USItype)(bl))); \
+ else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
+ __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "%r" ((USItype)(ah)), \
+ "%r" ((USItype)(al)), \
+ "rI" ((USItype)(bl))); \
+ else \
+ __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "%r" ((USItype)(ah)), \
+ "r" ((USItype)(bh)), \
+ "%r" ((USItype)(al)), \
+@@ -747,36 +747,36 @@ do { \
+ do { \
+ if (__builtin_constant_p(ah) && (ah) == 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(bh)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else if (__builtin_constant_p(ah) && (ah) == ~(USItype) 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(bh)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else if (__builtin_constant_p(bh) && (bh) == 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(ah)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
+ __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(ah)), \
+ "rI" ((USItype)(al)), \
+ "r" ((USItype)(bl))); \
+ else \
+ __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
++ : "=r" (sh), \
++ "=&r" (sl) \
+ : "r" ((USItype)(ah)), \
+ "r" ((USItype)(bh)), \
+ "rI" ((USItype)(al)), \
+@@ -787,7 +787,7 @@ do { \
+ do { \
+ USItype __m0 = (m0), __m1 = (m1); \
+ __asm__ ("mulhwu %0,%1,%2" \
+- : "=r" ((USItype) ph) \
++ : "=r" (ph) \
+ : "%r" (__m0), \
+ "r" (__m1)); \
+ (pl) = __m0 * __m1; \
+--
+2.20.1
+
--- /dev/null
+From 3d7c2a8c5aec33a9be935a4510e9e53c7ab60bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Apr 2020 13:59:06 +0530
+Subject: mac80211: sta_info: Add lockdep condition for RCU list usage
+
+From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+
+[ Upstream commit 8ca47eb9f9e4e10e7e7fa695731a88941732c38d ]
+
+The function sta_info_get_by_idx() uses RCU list primitive.
+It is called with local->sta_mtx held from mac80211/cfg.c.
+Add lockdep expression to avoid any false positive RCU list warnings.
+
+Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+Link: https://lore.kernel.org/r/20200409082906.27427-1-madhuparnabhowmik10@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 21b1422b1b1c3..b1669f0244706 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -217,7 +217,8 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
+ struct sta_info *sta;
+ int i = 0;
+
+- list_for_each_entry_rcu(sta, &local->sta_list, list) {
++ list_for_each_entry_rcu(sta, &local->sta_list, list,
++ lockdep_is_held(&local->sta_mtx)) {
+ if (sdata != sta->sdata)
+ continue;
+ if (i < idx) {
+--
+2.20.1
+
--- /dev/null
+From 6fc83654516b5f22cedf30f232fafdf0f20859ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Apr 2020 16:02:11 -0700
+Subject: net: bcmgenet: suppress warnings on failed Rx SKB allocations
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit ecaeceb8a8a145d93c7e136f170238229165348f ]
+
+The driver is designed to drop Rx packets and reclaim the buffers
+when an allocation fails, and the network interface needs to safely
+handle this packet loss. Therefore, an allocation failure of Rx
+SKBs is relatively benign.
+
+However, the output of the warning message occurs with a high
+scheduling priority that can cause excessive jitter/latency for
+other high priority processing.
+
+This commit suppresses the warning messages to prevent scheduling
+problems while retaining the failure count in the statistics of
+the network interface.
+
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index ff09ee777b2bf..6f01f4e03cef1 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1697,7 +1697,8 @@ static struct sk_buff *bcmgenet_rx_refill(struct bcmgenet_priv *priv,
+ dma_addr_t mapping;
+
+ /* Allocate a new Rx skb */
+- skb = netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT);
++ skb = __netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (!skb) {
+ priv->mib.alloc_rx_buff_failed++;
+ netif_err(priv, rx_err, priv->dev,
+--
+2.20.1
+
--- /dev/null
+From 7dfd1a759ad9e36743a9bc6161dfd6b38316890f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 14:24:31 +0200
+Subject: net: stmmac: fix enabling socfpga's ptp_ref_clock
+
+From: Julien Beraud <julien.beraud@orolia.com>
+
+[ Upstream commit 15ce30609d1e88d42fb1cd948f453e6d5f188249 ]
+
+There are 2 registers to write to enable a ptp ref clock coming from the
+fpga.
+One that enables the usage of the clock from the fpga for emac0 and emac1
+as a ptp ref clock, and the other to allow signals from the fpga to reach
+emac0 and emac1.
+Currently, if the dwmac-socfpga has phymode set to PHY_INTERFACE_MODE_MII,
+PHY_INTERFACE_MODE_GMII, or PHY_INTERFACE_MODE_SGMII, both registers will
+be written and the ptp ref clock will be set as coming from the fpga.
+Separate the 2 register writes to only enable signals from the fpga to
+reach emac0 or emac1 when ptp ref clock is not coming from the fpga.
+
+Signed-off-by: Julien Beraud <julien.beraud@orolia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index fa32cd5b418ef..70d41783329dd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -291,16 +291,19 @@ static int socfpga_gen5_set_phy_mode(struct socfpga_dwmac *dwmac)
+ phymode == PHY_INTERFACE_MODE_MII ||
+ phymode == PHY_INTERFACE_MODE_GMII ||
+ phymode == PHY_INTERFACE_MODE_SGMII) {
+- ctrl |= SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2);
+ regmap_read(sys_mgr_base_addr, SYSMGR_FPGAGRP_MODULE_REG,
+ &module);
+ module |= (SYSMGR_FPGAGRP_MODULE_EMAC << (reg_shift / 2));
+ regmap_write(sys_mgr_base_addr, SYSMGR_FPGAGRP_MODULE_REG,
+ module);
+- } else {
+- ctrl &= ~(SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2));
+ }
+
++ if (dwmac->f2h_ptp_ref_clk)
++ ctrl |= SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK << (reg_shift / 2);
++ else
++ ctrl &= ~(SYSMGR_EMACGRP_CTRL_PTP_REF_CLK_MASK <<
++ (reg_shift / 2));
++
+ regmap_write(sys_mgr_base_addr, reg_offset, ctrl);
+
+ /* Deassert reset for the phy configuration to be sampled by
+--
+2.20.1
+
--- /dev/null
+From aaf9669468dd4d513bd153c370cda9d67e1097d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 14:24:32 +0200
+Subject: net: stmmac: Fix sub-second increment
+
+From: Julien Beraud <julien.beraud@orolia.com>
+
+[ Upstream commit 91a2559c1dc5b0f7e1256d42b1508935e8eabfbf ]
+
+In fine adjustement mode, which is the current default, the sub-second
+ increment register is the number of nanoseconds that will be added to
+ the clock when the accumulator overflows. At each clock cycle, the
+ value of the addend register is added to the accumulator.
+ Currently, we use 20ns = 1e09ns / 50MHz as this value whatever the
+ frequency of the ptp clock actually is.
+ The adjustment is then done on the addend register, only incrementing
+ every X clock cycles X being the ratio between 50MHz and ptp_clock_rate
+ (addend = 2^32 * 50MHz/ptp_clock_rate).
+ This causes the following issues :
+ - In case the frequency of the ptp clock is inferior or equal to 50MHz,
+ the addend value calculation will overflow and the default
+ addend value will be set to 0, causing the clock to not work at
+ all. (For instance, for ptp_clock_rate = 50MHz, addend = 2^32).
+ - The resolution of the timestamping clock is limited to 20ns while it
+ is not needed, thus limiting the accuracy of the timestamping to
+ 20ns.
+
+ Fix this by setting sub-second increment to 2e09ns / ptp_clock_rate.
+ It will allow to reach the minimum possible frequency for
+ ptp_clk_ref, which is 5MHz for GMII 1000Mps Full-Duplex by setting the
+ sub-second-increment to a higher value. For instance, for 25MHz, it
+ gives ssinc = 80ns and default_addend = 2^31.
+ It will also allow to use a lower value for sub-second-increment, thus
+ improving the timestamping accuracy with frequencies higher than
+ 100MHz, for instance, for 200MHz, ssinc = 10ns and default_addend =
+ 2^31.
+
+v1->v2:
+ - Remove modifications to the calculation of default addend, which broke
+ compatibility with clock frequencies for which 2000000000 / ptp_clk_freq
+ is not an integer.
+ - Modify description according to discussions.
+
+Signed-off-by: Julien Beraud <julien.beraud@orolia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+index 0201596225592..e5d9007c8090b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -26,12 +26,16 @@ static void config_sub_second_increment(void __iomem *ioaddr,
+ unsigned long data;
+ u32 reg_value;
+
+- /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
+- * formula = (1/ptp_clock) * 1000000000
+- * where ptp_clock is 50MHz if fine method is used to update system
++ /* For GMAC3.x, 4.x versions, in "fine adjustement mode" set sub-second
++ * increment to twice the number of nanoseconds of a clock cycle.
++ * The calculation of the default_addend value by the caller will set it
++ * to mid-range = 2^31 when the remainder of this division is zero,
++ * which will make the accumulator overflow once every 2 ptp_clock
++ * cycles, adding twice the number of nanoseconds of a clock cycle :
++ * 2000000000ULL / ptp_clock.
+ */
+ if (value & PTP_TCR_TSCFUPDT)
+- data = (1000000000ULL / 50000000);
++ data = (2000000000ULL / ptp_clock);
+ else
+ data = (1000000000ULL / ptp_clock);
+
+--
+2.20.1
+
--- /dev/null
+From 2c375f6d4424608a26dc7e1d444328154b48186b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Apr 2020 16:13:30 -0700
+Subject: net: systemport: suppress warnings on failed Rx SKB allocations
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 3554e54a46125030c534820c297ed7f6c3907e24 ]
+
+The driver is designed to drop Rx packets and reclaim the buffers
+when an allocation fails, and the network interface needs to safely
+handle this packet loss. Therefore, an allocation failure of Rx
+SKBs is relatively benign.
+
+However, the output of the warning message occurs with a high
+scheduling priority that can cause excessive jitter/latency for
+other high priority processing.
+
+This commit suppresses the warning messages to prevent scheduling
+problems while retaining the failure count in the statistics of
+the network interface.
+
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index ad86a186ddc5f..4dfdb5a58025b 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -666,7 +666,8 @@ static struct sk_buff *bcm_sysport_rx_refill(struct bcm_sysport_priv *priv,
+ dma_addr_t mapping;
+
+ /* Allocate a new SKB for a new packet */
+- skb = netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH);
++ skb = __netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (!skb) {
+ priv->mib.alloc_rx_buff_failed++;
+ netif_err(priv, rx_err, ndev, "SKB alloc failed\n");
+--
+2.20.1
+
--- /dev/null
+From e2d21ceb617da665e8f09d2c15481845ca1aeb39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Apr 2020 12:50:04 -0500
+Subject: remoteproc: qcom_q6v5_mss: fix a bug in q6v5_probe()
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 13c060b50a341dd60303e5264d12108b5747f200 ]
+
+If looking up the DT "firmware-name" property fails in q6v6_probe(),
+the function returns without freeing the remoteproc structure
+that has been allocated. Fix this by jumping to the free_rproc
+label, which takes care of this.
+
+Signed-off-by: Alex Elder <elder@linaro.org>
+Link: https://lore.kernel.org/r/20200403175005.17130-3-elder@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_mss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
+index 783d00131a2a9..6ba065d5c4d95 100644
+--- a/drivers/remoteproc/qcom_q6v5_mss.c
++++ b/drivers/remoteproc/qcom_q6v5_mss.c
+@@ -1440,7 +1440,7 @@ static int q6v5_probe(struct platform_device *pdev)
+ ret = of_property_read_string_index(pdev->dev.of_node, "firmware-name",
+ 1, &qproc->hexagon_mdt_image);
+ if (ret < 0 && ret != -EINVAL)
+- return ret;
++ goto free_rproc;
+
+ platform_set_drvdata(pdev, qproc);
+
+--
+2.20.1
+
--- /dev/null
+From 4854c3a52b83bb71b5a0181b22337d38ec763f08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Apr 2020 18:57:40 +0200
+Subject: scripts/config: allow colons in option strings for sed
+
+From: Jeremie Francois (on alpha) <jeremie.francois@gmail.com>
+
+[ Upstream commit e461bc9f9ab105637b86065d24b0b83f182d477c ]
+
+Sed broke on some strings as it used colon as a separator.
+I made it more robust by using \001, which is legit POSIX AFAIK.
+
+E.g. ./config --set-str CONFIG_USBNET_DEVADDR "de:ad:be:ef:00:01"
+failed with: sed: -e expression #1, char 55: unknown option to `s'
+
+Signed-off-by: Jeremie Francois (on alpha) <jeremie.francois@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/config | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/config b/scripts/config
+index e0e39826dae90..eee5b7f3a092a 100755
+--- a/scripts/config
++++ b/scripts/config
+@@ -7,6 +7,9 @@ myname=${0##*/}
+ # If no prefix forced, use the default CONFIG_
+ CONFIG_="${CONFIG_-CONFIG_}"
+
++# We use an uncommon delimiter for sed substitutions
++SED_DELIM=$(echo -en "\001")
++
+ usage() {
+ cat >&2 <<EOL
+ Manipulate options in a .config file from the command line.
+@@ -83,7 +86,7 @@ txt_subst() {
+ local infile="$3"
+ local tmpfile="$infile.swp"
+
+- sed -e "s:$before:$after:" "$infile" >"$tmpfile"
++ sed -e "s$SED_DELIM$before$SED_DELIM$after$SED_DELIM" "$infile" >"$tmpfile"
+ # replace original file with the edited one
+ mv "$tmpfile" "$infile"
+ }
+--
+2.20.1
+
--- /dev/null
+From 1915a1086e7296013fd4186e8ab970d206a0ef84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 15:21:45 -0500
+Subject: selftests/ipc: Fix test failure seen after initial test run
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit b87080eab4c1377706c113fc9c0157f19ea8fed1 ]
+
+After successfully running the IPC msgque test once, subsequent runs
+result in a test failure:
+
+ $ sudo ./run_kselftest.sh
+ TAP version 13
+ 1..1
+ # selftests: ipc: msgque
+ # Failed to get stats for IPC queue with id 0
+ # Failed to dump queue: -22
+ # Bail out!
+ # # Pass 0 Fail 0 Xfail 0 Xpass 0 Skip 0 Error 0
+ not ok 1 selftests: ipc: msgque # exit=1
+
+The dump_queue() function loops through the possible message queue index
+values using calls to msgctl(kern_id, MSG_STAT, ...) where kern_id
+represents the index value. The first time the test is ran, the initial
+index value of 0 is valid and the test is able to complete. The index
+value of 0 is not valid in subsequent test runs and the loop attempts to
+try index values of 1, 2, 3, and so on until a valid index value is
+found that corresponds to the message queue created earlier in the test.
+
+The msgctl() syscall returns -1 and sets errno to EINVAL when invalid
+index values are used. The test failure is caused by incorrectly
+comparing errno to -EINVAL when cycling through possible index values.
+
+Fix invalid test failures on subsequent runs of the msgque test by
+correctly comparing errno values to a non-negated EINVAL.
+
+Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ipc/msgque.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
+index 4c156aeab6b80..5ec4d9e18806c 100644
+--- a/tools/testing/selftests/ipc/msgque.c
++++ b/tools/testing/selftests/ipc/msgque.c
+@@ -137,7 +137,7 @@ int dump_queue(struct msgque_data *msgque)
+ for (kern_id = 0; kern_id < 256; kern_id++) {
+ ret = msgctl(kern_id, MSG_STAT, &ds);
+ if (ret < 0) {
+- if (errno == -EINVAL)
++ if (errno == EINVAL)
+ continue;
+ printf("Failed to get stats for IPC queue with id %d\n",
+ kern_id);
+--
+2.20.1
+
vhost-vsock-kick-send_pkt-worker-once-device-is-started.patch
+drm-bridge-analogix_dp-split-bind-into-probe-and-rea.patch
+asoc-topology-check-return-value-of-soc_tplg_create_.patch
+asoc-topology-check-return-value-of-soc_tplg_-_creat.patch
+asoc-topology-check-soc_tplg_add_route-return-value.patch
+asoc-topology-check-return-value-of-pcm_new_ver.patch
+asoc-topology-check-return-value-of-soc_tplg_dai_con.patch
+selftests-ipc-fix-test-failure-seen-after-initial-te.patch
+asoc-sgtl5000-fix-vag-power-on-handling.patch
+asoc-topology-fix-endianness-issue.patch
+usb-dwc3-gadget-properly-set-maxpacket-limit.patch
+asoc-rsnd-fix-parent-ssi-start-stop-in-multi-ssi-mod.patch
+asoc-rsnd-fix-hdmi-channel-mapping-for-multi-ssi-mod.patch
+asoc-codecs-hdac_hdmi-fix-incorrect-use-of-list_for_.patch
+remoteproc-qcom_q6v5_mss-fix-a-bug-in-q6v5_probe.patch
+drm-amdgpu-correctly-initialize-thermal-controller-f.patch
+wimax-i2400m-fix-potential-urb-refcnt-leak.patch
+net-stmmac-fix-enabling-socfpga-s-ptp_ref_clock.patch
+net-stmmac-fix-sub-second-increment.patch
+asoc-rsnd-don-t-treat-master-ssi-in-multi-ssi-setup-.patch
+asoc-rsnd-fix-status-check-failed-spam-for-multi-ssi.patch
+cifs-protect-updating-server-dstaddr-with-a-spinlock.patch
+scripts-config-allow-colons-in-option-strings-for-se.patch
+cifs-do-not-share-tcons-with-dfs.patch
+tracing-fix-memory-leaks-in-trace_events_hist.c.patch
+lib-mpi-fix-building-for-powerpc-with-clang.patch
+mac80211-sta_info-add-lockdep-condition-for-rcu-list.patch
+net-bcmgenet-suppress-warnings-on-failed-rx-skb-allo.patch
+net-systemport-suppress-warnings-on-failed-rx-skb-al.patch
--- /dev/null
+From d7e74b9f85f5ebc2b8fbfbcee9a57f2f7d161693 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 11:45:06 +0530
+Subject: tracing: Fix memory leaks in trace_events_hist.c
+
+From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+
+[ Upstream commit 9da73974eb9c965dd9989befb593b8c8da9e4bdc ]
+
+kmemleak report 1:
+ [<9092c50b>] kmem_cache_alloc_trace+0x138/0x270
+ [<05a2c9ed>] create_field_var+0xcf/0x180
+ [<528a2d68>] action_create+0xe2/0xc80
+ [<63f50b61>] event_hist_trigger_func+0x15b5/0x1920
+ [<28ea5d3d>] trigger_process_regex+0x7b/0xc0
+ [<3138e86f>] event_trigger_write+0x4d/0xb0
+ [<ffd66c19>] __vfs_write+0x30/0x200
+ [<4f424a0d>] vfs_write+0x96/0x1b0
+ [<da59a290>] ksys_write+0x53/0xc0
+ [<3717101a>] __ia32_sys_write+0x15/0x20
+ [<c5f23497>] do_fast_syscall_32+0x70/0x250
+ [<46e2629c>] entry_SYSENTER_32+0xaf/0x102
+
+This is because save_vars[] of struct hist_trigger_data are
+not destroyed
+
+kmemleak report 2:
+ [<9092c50b>] kmem_cache_alloc_trace+0x138/0x270
+ [<6e5e97c5>] create_var+0x3c/0x110
+ [<de82f1b9>] create_field_var+0xaf/0x180
+ [<528a2d68>] action_create+0xe2/0xc80
+ [<63f50b61>] event_hist_trigger_func+0x15b5/0x1920
+ [<28ea5d3d>] trigger_process_regex+0x7b/0xc0
+ [<3138e86f>] event_trigger_write+0x4d/0xb0
+ [<ffd66c19>] __vfs_write+0x30/0x200
+ [<4f424a0d>] vfs_write+0x96/0x1b0
+ [<da59a290>] ksys_write+0x53/0xc0
+ [<3717101a>] __ia32_sys_write+0x15/0x20
+ [<c5f23497>] do_fast_syscall_32+0x70/0x250
+ [<46e2629c>] entry_SYSENTER_32+0xaf/0x102
+
+struct hist_field allocated through create_var() do not initialize
+"ref" field to 1. The code in __destroy_hist_field() does not destroy
+object if "ref" is initialized to zero, the condition
+if (--hist_field->ref > 1) always passes since unsigned int wraps.
+
+kmemleak report 3:
+ [<f8666fcc>] __kmalloc_track_caller+0x139/0x2b0
+ [<bb7f80a5>] kstrdup+0x27/0x50
+ [<39d70006>] init_var_ref+0x58/0xd0
+ [<8ca76370>] create_var_ref+0x89/0xe0
+ [<f045fc39>] action_create+0x38f/0xc80
+ [<7c146821>] event_hist_trigger_func+0x15b5/0x1920
+ [<07de3f61>] trigger_process_regex+0x7b/0xc0
+ [<e87daf8f>] event_trigger_write+0x4d/0xb0
+ [<19bf1512>] __vfs_write+0x30/0x200
+ [<64ce4d27>] vfs_write+0x96/0x1b0
+ [<a6f34170>] ksys_write+0x53/0xc0
+ [<7d4230cd>] __ia32_sys_write+0x15/0x20
+ [<8eadca00>] do_fast_syscall_32+0x70/0x250
+ [<235cf985>] entry_SYSENTER_32+0xaf/0x102
+
+hist_fields (system & event_name) are not freed
+
+Link: http://lkml.kernel.org/r/20200422061503.GA5151@cosmos
+
+Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_hist.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 6495800fb92a1..8107574e8af9d 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2466,6 +2466,9 @@ static void __destroy_hist_field(struct hist_field *hist_field)
+ kfree(hist_field->name);
+ kfree(hist_field->type);
+
++ kfree(hist_field->system);
++ kfree(hist_field->event_name);
++
+ kfree(hist_field);
+ }
+
+@@ -3528,6 +3531,7 @@ static struct hist_field *create_var(struct hist_trigger_data *hist_data,
+ goto out;
+ }
+
++ var->ref = 1;
+ var->flags = HIST_FIELD_FL_VAR;
+ var->var.idx = idx;
+ var->var.hist_data = var->hist_data = hist_data;
+@@ -4157,6 +4161,9 @@ static void destroy_field_vars(struct hist_trigger_data *hist_data)
+
+ for (i = 0; i < hist_data->n_field_vars; i++)
+ destroy_field_var(hist_data->field_vars[i]);
++
++ for (i = 0; i < hist_data->n_save_vars; i++)
++ destroy_field_var(hist_data->save_vars[i]);
+ }
+
+ static void save_field_var(struct hist_trigger_data *hist_data,
+--
+2.20.1
+
--- /dev/null
+From 184e328224a0e1691024a83273b662f23458cd03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2020 16:59:27 -0800
+Subject: usb: dwc3: gadget: Properly set maxpacket limit
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit d94ea5319813658ad5861d161ae16a194c2abf88 ]
+
+Currently the calculation of max packet size limit for IN endpoints is
+too restrictive. This prevents a matching of a capable hardware endpoint
+during configuration. Below is the minimum recommended HW configuration
+to support a particular endpoint setup from the databook:
+
+For OUT endpoints, the databook recommended the minimum RxFIFO size to
+be at least 3x MaxPacketSize + 3x setup packets size (8 bytes each) +
+clock crossing margin (16 bytes).
+
+For IN endpoints, the databook recommended the minimum TxFIFO size to be
+at least 3x MaxPacketSize for endpoints that support burst. If the
+endpoint doesn't support burst or when the device is operating in USB
+2.0 mode, a minimum TxFIFO size of 2x MaxPacketSize is recommended.
+
+Base on these recommendations, we can calculate the MaxPacketSize limit
+of each endpoint. This patch revises the IN endpoint MaxPacketSize limit
+and also sets the MaxPacketSize limit for OUT endpoints.
+
+Reference: Databook 3.30a section 3.2.2 and 3.2.3
+
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.h | 4 +++
+ drivers/usb/dwc3/gadget.c | 52 ++++++++++++++++++++++++++++++---------
+ 2 files changed, 45 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 3ecc69c5b150f..ce4acbf7fef90 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -310,6 +310,10 @@
+ #define DWC3_GTXFIFOSIZ_TXFDEF(n) ((n) & 0xffff)
+ #define DWC3_GTXFIFOSIZ_TXFSTADDR(n) ((n) & 0xffff0000)
+
++/* Global RX Fifo Size Register */
++#define DWC31_GRXFIFOSIZ_RXFDEP(n) ((n) & 0x7fff) /* DWC_usb31 only */
++#define DWC3_GRXFIFOSIZ_RXFDEP(n) ((n) & 0xffff)
++
+ /* Global Event Size Registers */
+ #define DWC3_GEVNTSIZ_INTMASK BIT(31)
+ #define DWC3_GEVNTSIZ_SIZE(n) ((n) & 0xffff)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 379f978db13d5..3d30dec42c81a 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2220,7 +2220,6 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ {
+ struct dwc3 *dwc = dep->dwc;
+ int mdwidth;
+- int kbytes;
+ int size;
+
+ mdwidth = DWC3_MDWIDTH(dwc->hwparams.hwparams0);
+@@ -2236,17 +2235,17 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ /* FIFO Depth is in MDWDITH bytes. Multiply */
+ size *= mdwidth;
+
+- kbytes = size / 1024;
+- if (kbytes == 0)
+- kbytes = 1;
+-
+ /*
+- * FIFO sizes account an extra MDWIDTH * (kbytes + 1) bytes for
+- * internal overhead. We don't really know how these are used,
+- * but documentation say it exists.
++ * To meet performance requirement, a minimum TxFIFO size of 3x
++ * MaxPacketSize is recommended for endpoints that support burst and a
++ * minimum TxFIFO size of 2x MaxPacketSize for endpoints that don't
++ * support burst. Use those numbers and we can calculate the max packet
++ * limit as below.
+ */
+- size -= mdwidth * (kbytes + 1);
+- size /= kbytes;
++ if (dwc->maximum_speed >= USB_SPEED_SUPER)
++ size /= 3;
++ else
++ size /= 2;
+
+ usb_ep_set_maxpacket_limit(&dep->endpoint, size);
+
+@@ -2264,8 +2263,39 @@ static int dwc3_gadget_init_in_endpoint(struct dwc3_ep *dep)
+ static int dwc3_gadget_init_out_endpoint(struct dwc3_ep *dep)
+ {
+ struct dwc3 *dwc = dep->dwc;
++ int mdwidth;
++ int size;
++
++ mdwidth = DWC3_MDWIDTH(dwc->hwparams.hwparams0);
++
++ /* MDWIDTH is represented in bits, convert to bytes */
++ mdwidth /= 8;
+
+- usb_ep_set_maxpacket_limit(&dep->endpoint, 1024);
++ /* All OUT endpoints share a single RxFIFO space */
++ size = dwc3_readl(dwc->regs, DWC3_GRXFIFOSIZ(0));
++ if (dwc3_is_usb31(dwc))
++ size = DWC31_GRXFIFOSIZ_RXFDEP(size);
++ else
++ size = DWC3_GRXFIFOSIZ_RXFDEP(size);
++
++ /* FIFO depth is in MDWDITH bytes */
++ size *= mdwidth;
++
++ /*
++ * To meet performance requirement, a minimum recommended RxFIFO size
++ * is defined as follow:
++ * RxFIFO size >= (3 x MaxPacketSize) +
++ * (3 x 8 bytes setup packets size) + (16 bytes clock crossing margin)
++ *
++ * Then calculate the max packet limit as below.
++ */
++ size -= (3 * 8) + 16;
++ if (size < 0)
++ size = 0;
++ else
++ size /= 3;
++
++ usb_ep_set_maxpacket_limit(&dep->endpoint, size);
+ dep->endpoint.max_streams = 15;
+ dep->endpoint.ops = &dwc3_gadget_ep_ops;
+ list_add_tail(&dep->endpoint.ep_list,
+--
+2.20.1
+
--- /dev/null
+From 55d9964cea0fcb8ce0777d91b8c36d8583aeb6a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 16:41:20 +0800
+Subject: wimax/i2400m: Fix potential urb refcnt leak
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+[ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]
+
+i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
+refcount of the "notif_urb".
+
+When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
+becomes invalid, so the refcount should be decreased to keep refcount
+balanced.
+
+The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
+forget to decrease the refcnt increased by usb_get_urb(), causing a
+refcnt leak.
+
+Fix this issue by calling usb_put_urb() before the
+i2400mu_bus_bm_wait_for_ack() returns.
+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wimax/i2400m/usb-fw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
+index 529ebca1e9e13..1f7709d24f352 100644
+--- a/drivers/net/wimax/i2400m/usb-fw.c
++++ b/drivers/net/wimax/i2400m/usb-fw.c
+@@ -354,6 +354,7 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
+ usb_autopm_put_interface(i2400mu->usb_iface);
+ d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
+ i2400m, ack, ack_size, (long) result);
++ usb_put_urb(¬if_urb);
+ return result;
+
+ error_exceeded:
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
