--- /dev/null
+From 1818288820412123979cd0bcf16b202fb08449aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 May 2020 12:58:19 +0200
+Subject: ACPI: EC: PM: Avoid flushing EC work when EC GPE is inactive
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 607b9df63057a56f6172d560d5366cca6a030c76 ]
+
+Flushing the EC work while suspended to idle when the EC GPE status
+is not set causes some EC wakeup events (notably power button and
+lid ones) to be missed after a series of spurious wakeups on the Dell
+XPS13 9360 in my office.
+
+If that happens, the machine cannot be woken up from suspend-to-idle
+by the power button or lid status change and it needs to be woken up
+in some other way (eg. by a key press).
+
+Flushing the EC work only after successful dispatching the EC GPE,
+which means that its status has been set, avoids the issue, so change
+the code in question accordingly.
+
+Fixes: 7b301750f7f8 ("ACPI: EC: PM: Avoid premature returns from acpi_s2idle_wake()")
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Chris Chiu <chiu@endlessm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/ec.c | 6 +++++-
+ drivers/acpi/sleep.c | 15 ++++-----------
+ 2 files changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 5b53a66d403d..57eacdcbf820 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1984,9 +1984,13 @@ bool acpi_ec_dispatch_gpe(void)
+ * to allow the caller to process events properly after that.
+ */
+ ret = acpi_dispatch_gpe(NULL, first_ec->gpe);
+- if (ret == ACPI_INTERRUPT_HANDLED)
++ if (ret == ACPI_INTERRUPT_HANDLED) {
+ pm_pr_dbg("EC GPE dispatched\n");
+
++ /* Flush the event and query workqueues. */
++ acpi_ec_flush_work();
++ }
++
+ return false;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 85514c0f3aa5..d1b74179d217 100644
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -977,13 +977,6 @@ static int acpi_s2idle_prepare_late(void)
+ return 0;
+ }
+
+-static void acpi_s2idle_sync(void)
+-{
+- /* The EC driver uses special workqueues that need to be flushed. */
+- acpi_ec_flush_work();
+- acpi_os_wait_events_complete(); /* synchronize Notify handling */
+-}
+-
+ static bool acpi_s2idle_wake(void)
+ {
+ if (!acpi_sci_irq_valid())
+@@ -1015,7 +1008,7 @@ static bool acpi_s2idle_wake(void)
+ return true;
+
+ /*
+- * Cancel the wakeup and process all pending events in case
++ * Cancel the SCI wakeup and process all pending events in case
+ * there are any wakeup ones in there.
+ *
+ * Note that if any non-EC GPEs are active at this point, the
+@@ -1023,8 +1016,7 @@ static bool acpi_s2idle_wake(void)
+ * should be missed by canceling the wakeup here.
+ */
+ pm_system_cancel_wakeup();
+-
+- acpi_s2idle_sync();
++ acpi_os_wait_events_complete();
+
+ /*
+ * The SCI is in the "suspended" state now and it cannot produce
+@@ -1057,7 +1049,8 @@ static void acpi_s2idle_restore(void)
+ * of GPEs.
+ */
+ acpi_os_wait_events_complete(); /* synchronize GPE processing */
+- acpi_s2idle_sync();
++ acpi_ec_flush_work(); /* flush the EC driver's workqueues */
++ acpi_os_wait_events_complete(); /* synchronize Notify handling */
+
+ s2idle_wakeup = false;
+
+--
+2.25.1
+
--- /dev/null
+From 9d6cc05cb3c3e7e57324e54fd3b8277b4e178e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 May 2020 21:21:05 +0100
+Subject: afs: Don't unlock fetched data pages until the op completes
+ successfully
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 9d1be4f4dc5ff1c66c86acfd2c35765d9e3776b3 ]
+
+Don't call req->page_done() on each page as we finish filling it with
+the data coming from the network. Whilst this might speed up the
+application a bit, it's a problem if there's a network failure and the
+operation has to be reissued.
+
+If this happens, an oops occurs because afs_readpages_page_done() clears
+the pointer to each page it unlocks and when a retry happens, the
+pointers to the pages it wants to fill are now NULL (and the pages have
+been unlocked anyway).
+
+Instead, wait till the operation completes successfully and only then
+release all the pages after clearing any terminal gap (the server can
+give us less data than we requested as we're allowed to ask for more
+than is available).
+
+KASAN produces a bug like the following, and even without KASAN, it can
+oops and panic.
+
+ BUG: KASAN: wild-memory-access in _copy_to_iter+0x323/0x5f4
+ Write of size 1404 at addr 0005088000000000 by task md5sum/5235
+
+ CPU: 0 PID: 5235 Comm: md5sum Not tainted 5.7.0-rc3-fscache+ #250
+ Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
+ Call Trace:
+ memcpy+0x39/0x58
+ _copy_to_iter+0x323/0x5f4
+ __skb_datagram_iter+0x89/0x2a6
+ skb_copy_datagram_iter+0x129/0x135
+ rxrpc_recvmsg_data.isra.0+0x615/0xd42
+ rxrpc_kernel_recv_data+0x1e9/0x3ae
+ afs_extract_data+0x139/0x33a
+ yfs_deliver_fs_fetch_data64+0x47a/0x91b
+ afs_deliver_to_call+0x304/0x709
+ afs_wait_for_call_to_complete+0x1cc/0x4ad
+ yfs_fs_fetch_data+0x279/0x288
+ afs_fetch_data+0x1e1/0x38d
+ afs_readpages+0x593/0x72e
+ read_pages+0xf5/0x21e
+ __do_page_cache_readahead+0x128/0x23f
+ ondemand_readahead+0x36e/0x37f
+ generic_file_buffered_read+0x234/0x680
+ new_sync_read+0x109/0x17e
+ vfs_read+0xe6/0x138
+ ksys_read+0xd8/0x14d
+ do_syscall_64+0x6e/0x8a
+ entry_SYSCALL_64_after_hwframe+0x49/0xb3
+
+Fixes: 196ee9cd2d04 ("afs: Make afs_fs_fetch_data() take a list of pages")
+Fixes: 30062bd13e36 ("afs: Implement YFS support in the fs client")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/fsclient.c | 8 ++++----
+ fs/afs/yfsclient.c | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
+index 6805a469d13c..0a4fed9e706b 100644
+--- a/fs/afs/fsclient.c
++++ b/fs/afs/fsclient.c
+@@ -385,8 +385,6 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
+ ASSERTCMP(req->offset, <=, PAGE_SIZE);
+ if (req->offset == PAGE_SIZE) {
+ req->offset = 0;
+- if (req->page_done)
+- req->page_done(req);
+ req->index++;
+ if (req->remain > 0)
+ goto begin_page;
+@@ -440,11 +438,13 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call)
+ if (req->offset < PAGE_SIZE)
+ zero_user_segment(req->pages[req->index],
+ req->offset, PAGE_SIZE);
+- if (req->page_done)
+- req->page_done(req);
+ req->offset = 0;
+ }
+
++ if (req->page_done)
++ for (req->index = 0; req->index < req->nr_pages; req->index++)
++ req->page_done(req);
++
+ _leave(" = 0 [done]");
+ return 0;
+ }
+diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
+index 39230880f372..8af7f093305d 100644
+--- a/fs/afs/yfsclient.c
++++ b/fs/afs/yfsclient.c
+@@ -497,8 +497,6 @@ static int yfs_deliver_fs_fetch_data64(struct afs_call *call)
+ ASSERTCMP(req->offset, <=, PAGE_SIZE);
+ if (req->offset == PAGE_SIZE) {
+ req->offset = 0;
+- if (req->page_done)
+- req->page_done(req);
+ req->index++;
+ if (req->remain > 0)
+ goto begin_page;
+@@ -556,11 +554,13 @@ static int yfs_deliver_fs_fetch_data64(struct afs_call *call)
+ if (req->offset < PAGE_SIZE)
+ zero_user_segment(req->pages[req->index],
+ req->offset, PAGE_SIZE);
+- if (req->page_done)
+- req->page_done(req);
+ req->offset = 0;
+ }
+
++ if (req->page_done)
++ for (req->index = 0; req->index < req->nr_pages; req->index++)
++ req->page_done(req);
++
+ _leave(" = 0 [done]");
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From b2012d85b43fc92067926893109193288094c28d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2020 08:58:11 +0800
+Subject: aquantia: Fix the media type of AQC100 ethernet controller in the
+ driver
+
+From: Richard Clark <richard.xnu.clark@gmail.com>
+
+[ Upstream commit 6de556c31061e3b9c36546ffaaac5fdb679a2f14 ]
+
+The Aquantia AQC100 controller enables a SFP+ port, so the driver should
+configure the media type as '_TYPE_FIBRE' instead of '_TYPE_TP'.
+
+Signed-off-by: Richard Clark <richard.xnu.clark@gmail.com>
+Cc: Igor Russkikh <irusskikh@marvell.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Acked-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+index 74b9f3f1da81..0e8264c0b308 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+@@ -56,7 +56,7 @@ static const struct aq_board_revision_s hw_atl_boards[] = {
+ { AQ_DEVICE_ID_D108, AQ_HWREV_2, &hw_atl_ops_b0, &hw_atl_b0_caps_aqc108, },
+ { AQ_DEVICE_ID_D109, AQ_HWREV_2, &hw_atl_ops_b0, &hw_atl_b0_caps_aqc109, },
+
+- { AQ_DEVICE_ID_AQC100, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc107, },
++ { AQ_DEVICE_ID_AQC100, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc100, },
+ { AQ_DEVICE_ID_AQC107, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc107, },
+ { AQ_DEVICE_ID_AQC108, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc108, },
+ { AQ_DEVICE_ID_AQC109, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc109, },
+--
+2.25.1
+
--- /dev/null
+From 7e18b9fb36548ed221b330f445343ea2b0a66eb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Apr 2020 11:07:22 +0200
+Subject: ARM: futex: Address build warning
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 8101b5a1531f3390b3a69fa7934c70a8fd6566ad ]
+
+Stephen reported the following build warning on a ARM multi_v7_defconfig
+build with GCC 9.2.1:
+
+kernel/futex.c: In function 'do_futex':
+kernel/futex.c:1676:17: warning: 'oldval' may be used uninitialized in this function [-Wmaybe-uninitialized]
+ 1676 | return oldval == cmparg;
+ | ~~~~~~~^~~~~~~~~
+kernel/futex.c:1652:6: note: 'oldval' was declared here
+ 1652 | int oldval, ret;
+ | ^~~~~~
+
+introduced by commit a08971e9488d ("futex: arch_futex_atomic_op_inuser()
+calling conventions change").
+
+While that change should not make any difference it confuses GCC which
+fails to work out that oldval is not referenced when the return value is
+not zero.
+
+GCC fails to properly analyze arch_futex_atomic_op_inuser(). It's not the
+early return, the issue is with the assembly macros. GCC fails to detect
+that those either set 'ret' to 0 and set oldval or set 'ret' to -EFAULT
+which makes oldval uninteresting. The store to the callsite supplied oldval
+pointer is conditional on ret == 0.
+
+The straight forward way to solve this is to make the store unconditional.
+
+Aside of addressing the build warning this makes sense anyway because it
+removes the conditional from the fastpath. In the error case the stored
+value is uninteresting and the extra store does not matter at all.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/87pncao2ph.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/futex.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
+index 83c391b597d4..fdc4ae3e7378 100644
+--- a/arch/arm/include/asm/futex.h
++++ b/arch/arm/include/asm/futex.h
+@@ -164,8 +164,13 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
+ preempt_enable();
+ #endif
+
+- if (!ret)
+- *oval = oldval;
++ /*
++ * Store unconditionally. If ret != 0 the extra store is the least
++ * of the worries but GCC cannot figure out that __futex_atomic_op()
++ * is either setting ret to -EFAULT or storing the old value in
++ * oldval which results in a uninitialized warning at the call site.
++ */
++ *oval = oldval;
+
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 82c4f20e33168a7cb110d4b99fe8f612d852eaac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 14:12:49 +0800
+Subject: ceph: fix double unlock in handle_cap_export()
+
+From: Wu Bo <wubo40@huawei.com>
+
+[ Upstream commit 4d8e28ff3106b093d98bfd2eceb9b430c70a8758 ]
+
+If the ceph_mdsc_open_export_target_session() return fails, it will
+do a "goto retry", but the session mutex has already been unlocked.
+Re-lock the mutex in that case to ensure that we don't unlock it
+twice.
+
+Signed-off-by: Wu Bo <wubo40@huawei.com>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 703945cce0e5..2d602c2b0ff6 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3693,6 +3693,7 @@ retry:
+ WARN_ON(1);
+ tsession = NULL;
+ target = -1;
++ mutex_lock(&session->s_mutex);
+ }
+ goto retry;
+
+--
+2.25.1
+
--- /dev/null
+From 1fca3a5bd049a0a787e016b2b1260929a0c37474 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Apr 2020 13:02:41 -0600
+Subject: component: Silence bind error on -EPROBE_DEFER
+
+From: James Hilliard <james.hilliard1@gmail.com>
+
+[ Upstream commit 7706b0a76a9697021e2bf395f3f065c18f51043d ]
+
+If a component fails to bind due to -EPROBE_DEFER we should not log an
+error as this is not a real failure.
+
+Fixes messages like:
+vc4-drm soc:gpu: failed to bind 3f902000.hdmi (ops vc4_hdmi_ops): -517
+vc4-drm soc:gpu: master bind failed: -517
+
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Link: https://lore.kernel.org/r/20200411190241.89404-1-james.hilliard1@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/component.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index 1fdbd6ff2058..b9f20ada68b0 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -257,7 +257,8 @@ static int try_to_bring_up_master(struct master *master,
+ ret = master->ops->bind(master->dev);
+ if (ret < 0) {
+ devres_release_group(master->dev, NULL);
+- dev_info(master->dev, "master bind failed: %d\n", ret);
++ if (ret != -EPROBE_DEFER)
++ dev_info(master->dev, "master bind failed: %d\n", ret);
+ return ret;
+ }
+
+@@ -611,8 +612,9 @@ static int component_bind(struct component *component, struct master *master,
+ devres_release_group(component->dev, NULL);
+ devres_release_group(master->dev, NULL);
+
+- dev_err(master->dev, "failed to bind %s (ops %ps): %d\n",
+- dev_name(component->dev), component->ops, ret);
++ if (ret != -EPROBE_DEFER)
++ dev_err(master->dev, "failed to bind %s (ops %ps): %d\n",
++ dev_name(component->dev), component->ops, ret);
+ }
+
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From d6074479dd2fcc0114a025b438368aae38af0546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2020 20:52:26 +0800
+Subject: configfs: fix config_item refcnt leak in configfs_rmdir()
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+[ Upstream commit 8aebfffacfa379ba400da573a5bf9e49634e38cb ]
+
+configfs_rmdir() invokes configfs_get_config_item(), which returns a
+reference of the specified config_item object to "parent_item" with
+increased refcnt.
+
+When configfs_rmdir() returns, local variable "parent_item" becomes
+invalid, so the refcount should be decreased to keep refcount balanced.
+
+The reference counting issue happens in one exception handling path of
+configfs_rmdir(). When down_write_killable() fails, the function forgets
+to decrease the refcnt increased by configfs_get_config_item(), causing
+a refcnt leak.
+
+Fix this issue by calling config_item_put() when down_write_killable()
+fails.
+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/configfs/dir.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
+index cf7b7e1d5bd7..cb733652ecca 100644
+--- a/fs/configfs/dir.c
++++ b/fs/configfs/dir.c
+@@ -1519,6 +1519,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
+ spin_lock(&configfs_dirent_lock);
+ configfs_detach_rollback(dentry);
+ spin_unlock(&configfs_dirent_lock);
++ config_item_put(parent_item);
+ return -EINTR;
+ }
+ frag->frag_dead = true;
+--
+2.25.1
+
--- /dev/null
+From 33ab9afec6d8c8ea77101a304e82a8c321ae71d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 14:37:33 -0400
+Subject: drm/amd/display: Prevent dpcd reads with passive dongles
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit e6142dd511425cb827b5db869f489eb81f5f994d ]
+
+[why]
+During hotplug, a DP port may be connected to the sink through
+passive adapter which does not support DPCD reads. Issuing reads
+without checking for this condition will result in errors
+
+[how]
+Ensure the link is in aux_mode before initiating operation that result
+in a DPCD read.
+
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Reviewed-by: Harry Wentland <Harry.Wentland@amd.com>
+Acked-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 99906435dcf7..9f30343262f3 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1422,17 +1422,22 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
+ dc_sink_retain(aconnector->dc_sink);
+ if (sink->dc_edid.length == 0) {
+ aconnector->edid = NULL;
+- drm_dp_cec_unset_edid(&aconnector->dm_dp_aux.aux);
++ if (aconnector->dc_link->aux_mode) {
++ drm_dp_cec_unset_edid(
++ &aconnector->dm_dp_aux.aux);
++ }
+ } else {
+ aconnector->edid =
+- (struct edid *) sink->dc_edid.raw_edid;
+-
++ (struct edid *)sink->dc_edid.raw_edid;
+
+ drm_connector_update_edid_property(connector,
+- aconnector->edid);
+- drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux,
+- aconnector->edid);
++ aconnector->edid);
++
++ if (aconnector->dc_link->aux_mode)
++ drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux,
++ aconnector->edid);
+ }
++
+ amdgpu_dm_update_freesync_caps(connector, aconnector->edid);
+
+ } else {
+--
+2.25.1
+
--- /dev/null
+From 1debe34dc3be92153ded693b5fe5d22f3c02d0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 12:28:56 +0200
+Subject: evm: Check also if *tfm is an error pointer in init_desc()
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit 53de3b080d5eae31d0de219617155dcc34e7d698 ]
+
+This patch avoids a kernel panic due to accessing an error pointer set by
+crypto_alloc_shash(). It occurs especially when there are many files that
+require an unsupported algorithm, as it would increase the likelihood of
+the following race condition:
+
+Task A: *tfm = crypto_alloc_shash() <= error pointer
+Task B: if (*tfm == NULL) <= *tfm is not NULL, use it
+Task B: rc = crypto_shash_init(desc) <= panic
+Task A: *tfm = NULL
+
+This patch uses the IS_ERR_OR_NULL macro to determine whether or not a new
+crypto context must be created.
+
+Cc: stable@vger.kernel.org
+Fixes: d46eb3699502b ("evm: crypto hash replaced by shash")
+Co-developed-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
+Signed-off-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index d485f6fc908e..302adeb2d37b 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -93,7 +93,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ algo = hash_algo_name[hash_algo];
+ }
+
+- if (*tfm == NULL) {
++ if (IS_ERR_OR_NULL(*tfm)) {
+ mutex_lock(&mutex);
+ if (*tfm)
+ goto out;
+--
+2.25.1
+
--- /dev/null
+From c509576336384cb5bd5e12623dd37520a558378d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 May 2020 16:19:17 +0300
+Subject: evm: Fix a small race in init_desc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8433856947217ebb5697a8ff9c4c9cad4639a2cf ]
+
+The IS_ERR_OR_NULL() function has two conditions and if we got really
+unlucky we could hit a race where "ptr" started as an error pointer and
+then was set to NULL. Both conditions would be false even though the
+pointer at the end was NULL.
+
+This patch fixes the problem by ensuring that "*tfm" can only be NULL
+or valid. I have introduced a "tmp_tfm" variable to make that work. I
+also reversed a condition and pulled the code in one tab.
+
+Reported-by: Roberto Sassu <roberto.sassu@huawei.com>
+Fixes: 53de3b080d5e ("evm: Check also if *tfm is an error pointer in init_desc()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Roberto Sassu <roberto.sassu@huawei.com>
+Acked-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_crypto.c | 44 ++++++++++++++---------------
+ 1 file changed, 22 insertions(+), 22 deletions(-)
+
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index 302adeb2d37b..cc826c2767a3 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ {
+ long rc;
+ const char *algo;
+- struct crypto_shash **tfm;
++ struct crypto_shash **tfm, *tmp_tfm;
+ struct shash_desc *desc;
+
+ if (type == EVM_XATTR_HMAC) {
+@@ -93,31 +93,31 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ algo = hash_algo_name[hash_algo];
+ }
+
+- if (IS_ERR_OR_NULL(*tfm)) {
+- mutex_lock(&mutex);
+- if (*tfm)
+- goto out;
+- *tfm = crypto_alloc_shash(algo, 0, CRYPTO_NOLOAD);
+- if (IS_ERR(*tfm)) {
+- rc = PTR_ERR(*tfm);
+- pr_err("Can not allocate %s (reason: %ld)\n", algo, rc);
+- *tfm = NULL;
++ if (*tfm)
++ goto alloc;
++ mutex_lock(&mutex);
++ if (*tfm)
++ goto unlock;
++
++ tmp_tfm = crypto_alloc_shash(algo, 0, CRYPTO_NOLOAD);
++ if (IS_ERR(tmp_tfm)) {
++ pr_err("Can not allocate %s (reason: %ld)\n", algo,
++ PTR_ERR(tmp_tfm));
++ mutex_unlock(&mutex);
++ return ERR_CAST(tmp_tfm);
++ }
++ if (type == EVM_XATTR_HMAC) {
++ rc = crypto_shash_setkey(tmp_tfm, evmkey, evmkey_len);
++ if (rc) {
++ crypto_free_shash(tmp_tfm);
+ mutex_unlock(&mutex);
+ return ERR_PTR(rc);
+ }
+- if (type == EVM_XATTR_HMAC) {
+- rc = crypto_shash_setkey(*tfm, evmkey, evmkey_len);
+- if (rc) {
+- crypto_free_shash(*tfm);
+- *tfm = NULL;
+- mutex_unlock(&mutex);
+- return ERR_PTR(rc);
+- }
+- }
+-out:
+- mutex_unlock(&mutex);
+ }
+-
++ *tfm = tmp_tfm;
++unlock:
++ mutex_unlock(&mutex);
++alloc:
+ desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
+ GFP_KERNEL);
+ if (!desc)
+--
+2.25.1
+
--- /dev/null
+From 5b2b9965575ff54ff7d69d6ecb640a77f355ac07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 May 2020 17:48:52 -0400
+Subject: fix multiplication overflow in copy_fdtable()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ]
+
+cpy and set really should be size_t; we won't get an overflow on that,
+since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *),
+so nr that would've managed to overflow size_t on that multiplication
+won't get anywhere near copy_fdtable() - we'll fail with EMFILE
+before that.
+
+Cc: stable@kernel.org # v2.6.25+
+Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open)
+Reported-by: Thiago Macieira <thiago.macieira@intel.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/file.c b/fs/file.c
+index 3da91a112bab..e5d328335f88 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt,
+ */
+ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
+ {
+- unsigned int cpy, set;
++ size_t cpy, set;
+
+ BUG_ON(nfdt->max_fds < ofdt->max_fds);
+
+--
+2.25.1
+
--- /dev/null
+From ce14d72a506b4c8fed47264f4bb132708bd1aecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2020 09:33:30 +0000
+Subject: ftrace/selftest: make unresolved cases cause failure if
+ --fail-unresolved set
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit b730d668138cb3dd9ce78f8003986d1adae5523a ]
+
+Currently, ftracetest will return 1 (failure) if any unresolved cases
+are encountered. The unresolved status results from modules and
+programs not being available, and as such does not indicate any
+issues with ftrace itself. As such, change the behaviour of
+ftracetest in line with unsupported cases; if unsupported cases
+happen, ftracetest still returns 0 unless --fail-unsupported. Here
+--fail-unresolved is added and the default is to return 0 if
+unresolved results occur.
+
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ftrace/ftracetest | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest
+index 144308a757b7..19e9236dec5e 100755
+--- a/tools/testing/selftests/ftrace/ftracetest
++++ b/tools/testing/selftests/ftrace/ftracetest
+@@ -17,6 +17,7 @@ echo " -v|--verbose Increase verbosity of test messages"
+ echo " -vv Alias of -v -v (Show all results in stdout)"
+ echo " -vvv Alias of -v -v -v (Show all commands immediately)"
+ echo " --fail-unsupported Treat UNSUPPORTED as a failure"
++echo " --fail-unresolved Treat UNRESOLVED as a failure"
+ echo " -d|--debug Debug mode (trace all shell commands)"
+ echo " -l|--logdir <dir> Save logs on the <dir>"
+ echo " If <dir> is -, all logs output in console only"
+@@ -112,6 +113,10 @@ parse_opts() { # opts
+ UNSUPPORTED_RESULT=1
+ shift 1
+ ;;
++ --fail-unresolved)
++ UNRESOLVED_RESULT=1
++ shift 1
++ ;;
+ --logdir|-l)
+ LOG_DIR=$2
+ shift 2
+@@ -176,6 +181,7 @@ KEEP_LOG=0
+ DEBUG=0
+ VERBOSE=0
+ UNSUPPORTED_RESULT=0
++UNRESOLVED_RESULT=0
+ STOP_FAILURE=0
+ # Parse command-line options
+ parse_opts $*
+@@ -280,7 +286,7 @@ eval_result() { # sigval
+ $UNRESOLVED)
+ prlog " [${color_blue}UNRESOLVED${color_reset}]"
+ UNRESOLVED_CASES="$UNRESOLVED_CASES $CASENO"
+- return 1 # this is a kind of bug.. something happened.
++ return $UNRESOLVED_RESULT # depends on use case
+ ;;
+ $UNTESTED)
+ prlog " [${color_blue}UNTESTED${color_reset}]"
+--
+2.25.1
+
--- /dev/null
+From 4f69663362d3458cce8271b8c852a86678ce90b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Apr 2020 13:32:59 +0200
+Subject: gcc-common.h: Update for GCC 10
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frédéric Pierret (fepitre) <frederic.pierret@qubes-os.org>
+
+[ Upstream commit c7527373fe28f97d8a196ab562db5589be0d34b9 ]
+
+Remove "params.h" include, which has been dropped in GCC 10.
+
+Remove is_a_helper() macro, which is now defined in gimple.h, as seen
+when running './scripts/gcc-plugin.sh g++ g++ gcc':
+
+In file included from <stdin>:1:
+./gcc-plugins/gcc-common.h:852:13: error: redefinition of ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’
+ 852 | inline bool is_a_helper<const ggoto *>::test(const_gimple gs)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~
+In file included from ./gcc-plugins/gcc-common.h:125,
+ from <stdin>:1:
+/usr/lib/gcc/x86_64-redhat-linux/10/plugin/include/gimple.h:1037:1: note: ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’ previously declared here
+ 1037 | is_a_helper <const ggoto *>::test (const gimple *gs)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Add -Wno-format-diag to scripts/gcc-plugins/Makefile to avoid
+meaningless warnings from error() formats used by plugins:
+
+scripts/gcc-plugins/structleak_plugin.c: In function ‘int plugin_init(plugin_name_args*, plugin_gcc_version*)’:
+scripts/gcc-plugins/structleak_plugin.c:253:12: warning: unquoted sequence of 2 consecutive punctuation characters ‘'-’ in format [-Wformat-diag]
+ 253 | error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Frédéric Pierret (fepitre) <frederic.pierret@qubes-os.org>
+Link: https://lore.kernel.org/r/20200407113259.270172-1-frederic.pierret@qubes-os.org
+[kees: include -Wno-format-diag for plugin builds]
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gcc-plugins/Makefile | 1 +
+ scripts/gcc-plugins/gcc-common.h | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
+index aa0d0ec6936d..9e95862f2788 100644
+--- a/scripts/gcc-plugins/Makefile
++++ b/scripts/gcc-plugins/Makefile
+@@ -11,6 +11,7 @@ else
+ HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti
+ HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb
+ HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable
++ HOST_EXTRACXXFLAGS += -Wno-format-diag
+ export HOST_EXTRACXXFLAGS
+ endif
+
+diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
+index 17f06079a712..9ad76b7f3f10 100644
+--- a/scripts/gcc-plugins/gcc-common.h
++++ b/scripts/gcc-plugins/gcc-common.h
+@@ -35,7 +35,9 @@
+ #include "ggc.h"
+ #include "timevar.h"
+
++#if BUILDING_GCC_VERSION < 10000
+ #include "params.h"
++#endif
+
+ #if BUILDING_GCC_VERSION <= 4009
+ #include "pointer-set.h"
+@@ -847,6 +849,7 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l
+ return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT);
+ }
+
++#if BUILDING_GCC_VERSION < 10000
+ template <>
+ template <>
+ inline bool is_a_helper<const ggoto *>::test(const_gimple gs)
+@@ -860,6 +863,7 @@ inline bool is_a_helper<const greturn *>::test(const_gimple gs)
+ {
+ return gs->code == GIMPLE_RETURN;
+ }
++#endif
+
+ static inline gasm *as_a_gasm(gimple stmt)
+ {
+--
+2.25.1
+
--- /dev/null
+From 679447ae1452b48883997961a636fe714c155966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 14:01:36 +0900
+Subject: gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()
+
+From: Yoshiyuki Kurauchi <ahochauwaaaaa@gmail.com>
+
+[ Upstream commit 846c68f7f1ac82c797a2f1db3344a2966c0fe2e1 ]
+
+In drivers/net/gtp.c, gtp_genl_dump_pdp() should set NLM_F_MULTI
+flag since it returns multipart message.
+This patch adds a new arg "flags" in gtp_genl_fill_info() so that
+flags can be set by the callers.
+
+Signed-off-by: Yoshiyuki Kurauchi <ahochauwaaaaa@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/gtp.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
+index 3a53d222bfcc..d89ec99abcd6 100644
+--- a/drivers/net/gtp.c
++++ b/drivers/net/gtp.c
+@@ -1172,11 +1172,11 @@ out_unlock:
+ static struct genl_family gtp_genl_family;
+
+ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq,
+- u32 type, struct pdp_ctx *pctx)
++ int flags, u32 type, struct pdp_ctx *pctx)
+ {
+ void *genlh;
+
+- genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, 0,
++ genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags,
+ type);
+ if (genlh == NULL)
+ goto nlmsg_failure;
+@@ -1230,8 +1230,8 @@ static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info)
+ goto err_unlock;
+ }
+
+- err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid,
+- info->snd_seq, info->nlhdr->nlmsg_type, pctx);
++ err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq,
++ 0, info->nlhdr->nlmsg_type, pctx);
+ if (err < 0)
+ goto err_unlock_free;
+
+@@ -1274,6 +1274,7 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,
+ gtp_genl_fill_info(skb,
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq,
++ NLM_F_MULTI,
+ cb->nlh->nlmsg_type, pctx)) {
+ cb->args[0] = i;
+ cb->args[1] = j;
+--
+2.25.1
+
--- /dev/null
+From 5855481df68c1efc1c49a7a45799f1a4ec622bef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 03:55:15 +0400
+Subject: HID: alps: Add AUI1657 device ID
+
+From: Artem Borisov <dedsa2002@gmail.com>
+
+[ Upstream commit 640e403b1fd24e7f31ac6f29f0b6a21d285ed729 ]
+
+This device is used on Lenovo V130-15IKB variants and uses
+the same registers as U1.
+
+Signed-off-by: Artem Borisov <dedsa2002@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-alps.c | 1 +
+ drivers/hid/hid-ids.h | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index fa704153cb00..c2a2bd528890 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -802,6 +802,7 @@ static int alps_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ break;
+ case HID_DEVICE_ID_ALPS_U1_DUAL:
+ case HID_DEVICE_ID_ALPS_U1:
++ case HID_DEVICE_ID_ALPS_1657:
+ data->dev_type = U1;
+ break;
+ default:
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ecb5ff8202ef..cc2b6f497f53 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -81,7 +81,7 @@
+ #define HID_DEVICE_ID_ALPS_U1 0x1215
+ #define HID_DEVICE_ID_ALPS_T4_BTNLESS 0x120C
+ #define HID_DEVICE_ID_ALPS_1222 0x1222
+-
++#define HID_DEVICE_ID_ALPS_1657 0x121E
+
+ #define USB_VENDOR_ID_AMI 0x046b
+ #define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10
+--
+2.25.1
+
--- /dev/null
+From 1d673f58b7ced555dc46a366afc9d7a2b9a7b96d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 14:51:42 +0200
+Subject: HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+[ Upstream commit 185af3e775b693f773d9a4b5a8c3cda69fc8ca0f ]
+
+HID_DEVICE_ID_ALPS_1657 PID is too specific, as there are many other
+ALPS hardware IDs using this particular touchpad.
+
+Rename the identifier to HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY in order
+to describe reality better.
+
+Fixes: 640e403b1fd24 ("HID: alps: Add AUI1657 device ID")
+Reported-by: Xiaojian Cao <xiaojian.cao@cn.alps.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-alps.c | 2 +-
+ drivers/hid/hid-ids.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index c2a2bd528890..b2ad319a74b9 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -802,7 +802,7 @@ static int alps_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ break;
+ case HID_DEVICE_ID_ALPS_U1_DUAL:
+ case HID_DEVICE_ID_ALPS_U1:
+- case HID_DEVICE_ID_ALPS_1657:
++ case HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY:
+ data->dev_type = U1;
+ break;
+ default:
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index cc2b6f497f53..48eba9c4f39a 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -79,9 +79,9 @@
+ #define HID_DEVICE_ID_ALPS_U1_DUAL_PTP 0x121F
+ #define HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP 0x1220
+ #define HID_DEVICE_ID_ALPS_U1 0x1215
++#define HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY 0x121E
+ #define HID_DEVICE_ID_ALPS_T4_BTNLESS 0x120C
+ #define HID_DEVICE_ID_ALPS_1222 0x1222
+-#define HID_DEVICE_ID_ALPS_1657 0x121E
+
+ #define USB_VENDOR_ID_AMI 0x046b
+ #define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10
+--
+2.25.1
+
--- /dev/null
+From 9e7e44e5d88f631b4b006b7758b479a14db13446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Apr 2020 20:58:17 +1000
+Subject: HID: i2c-hid: reset Synaptics SYNA2393 on resume
+
+From: Daniel Playfair Cal <daniel.playfair.cal@gmail.com>
+
+[ Upstream commit 538f67407e2c0e5ed2a46e7d7ffa52f2e30c7ef8 ]
+
+On the Dell XPS 9570, the Synaptics SYNA2393 touchpad generates spurious
+interrupts after resuming from suspend until it receives some input or
+is reset. Add it to the quirk I2C_HID_QUIRK_RESET_ON_RESUME so that it
+is reset when resuming from suspend.
+
+More information about the bug can be found in this mailing list
+discussion: https://www.spinics.net/lists/linux-input/msg59530.html
+
+Signed-off-by: Daniel Playfair Cal <daniel.playfair.cal@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 48eba9c4f39a..3341133df3a8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1089,6 +1089,9 @@
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200
+
++#define I2C_VENDOR_ID_SYNAPTICS 0x06cb
++#define I2C_PRODUCT_ID_SYNAPTICS_SYNA2393 0x7a13
++
+ #define USB_VENDOR_ID_SYNAPTICS 0x06cb
+ #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001
+ #define USB_DEVICE_ID_SYNAPTICS_INT_TP 0x0002
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 479934f7d241..b525b2715e07 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -179,6 +179,8 @@ static const struct i2c_hid_quirks {
+ I2C_HID_QUIRK_BOGUS_IRQ },
+ { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
+ I2C_HID_QUIRK_RESET_ON_RESUME },
++ { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393,
++ I2C_HID_QUIRK_RESET_ON_RESUME },
+ { USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720,
+ I2C_HID_QUIRK_BAD_INPUT_SIZE },
+ { 0, 0 }
+--
+2.25.1
+
--- /dev/null
+From 0b89adb1d04dc66aece7e0c24759ed30cc3561d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 18:02:37 +0200
+Subject: HID: multitouch: add eGalaxTouch P80H84 support
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit f9e82295eec141a0569649d400d249333d74aa91 ]
+
+Add support for P80H84 touchscreen from eGalaxy:
+
+ idVendor 0x0eef D-WAV Scientific Co., Ltd
+ idProduct 0xc002
+ iManufacturer 1 eGalax Inc.
+ iProduct 2 eGalaxTouch P80H84 2019 vDIVA_1204_T01 k4.02.146
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-multitouch.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 646b98809ed3..ecb5ff8202ef 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -385,6 +385,7 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002
+
+ #define USB_VENDOR_ID_ELAN 0x04f3
+ #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 362805ddf377..03c720b47306 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -1922,6 +1922,9 @@ static const struct hid_device_id mt_devices[] = {
+ { .driver_data = MT_CLS_EGALAX_SERIAL,
+ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
+ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) },
++ { .driver_data = MT_CLS_EGALAX,
++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV,
++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) },
+
+ /* Elitegroup panel */
+ { .driver_data = MT_CLS_SERIAL,
+--
+2.25.1
+
--- /dev/null
+From 779b7172a728b69906724ce5462d4dee792b847e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2020 20:18:42 +0200
+Subject: HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A
+ keyboard-dock
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1e189f267015a098bdcb82cc652d13fbf2203fa0 ]
+
+Add a HID_QUIRK_NO_INIT_REPORTS quirk for the Dell K12A keyboard-dock,
+which can be used with various Dell Venue 11 models.
+
+Without this quirk the keyboard/touchpad combo works fine when connected
+at boot, but when hotplugged 9 out of 10 times it will not work properly.
+Adding the quirk fixes this.
+
+Cc: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 3341133df3a8..13b7222ef2c9 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1106,6 +1106,7 @@
+ #define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10
+ #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3
+ #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3
++#define USB_DEVICE_ID_SYNAPTICS_DELL_K12A 0x2819
+ #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012 0x2968
+ #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710
+ #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5 0x81a7
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index ae64a286a68f..90ec2390ef68 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -163,6 +163,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103), HID_QUIRK_NO_INIT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DELL_K12A), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882), HID_QUIRK_NOGET },
+--
+2.25.1
+
--- /dev/null
+From 2afe4dace06c75241282e200024e29fb899037c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 17:43:21 +0200
+Subject: i2c: fix missing pm_runtime_put_sync in i2c_device_probe
+
+From: Alain Volmat <alain.volmat@st.com>
+
+[ Upstream commit 3c3dd56f760da056e821ac177e3ad0de4209a435 ]
+
+In case of the I2C client exposes the flag I2C_CLIENT_HOST_NOTIFY,
+pm_runtime_get_sync is called in order to always keep active the
+adapter. However later on, pm_runtime_put_sync is never called
+within the function in case of an error. This commit add this
+error handling.
+
+Fixes: 72bfcee11cf8 ("i2c: Prevent runtime suspend of adapter when Host Notify is required")
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Reviewed-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index 810a942eaa8e..cc193f2ba5d3 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -338,8 +338,10 @@ static int i2c_device_probe(struct device *dev)
+ } else if (ACPI_COMPANION(dev)) {
+ irq = i2c_acpi_get_irq(client);
+ }
+- if (irq == -EPROBE_DEFER)
+- return irq;
++ if (irq == -EPROBE_DEFER) {
++ status = irq;
++ goto put_sync_adapter;
++ }
+
+ if (irq < 0)
+ irq = 0;
+@@ -353,15 +355,19 @@ static int i2c_device_probe(struct device *dev)
+ */
+ if (!driver->id_table &&
+ !i2c_acpi_match_device(dev->driver->acpi_match_table, client) &&
+- !i2c_of_match_device(dev->driver->of_match_table, client))
+- return -ENODEV;
++ !i2c_of_match_device(dev->driver->of_match_table, client)) {
++ status = -ENODEV;
++ goto put_sync_adapter;
++ }
+
+ if (client->flags & I2C_CLIENT_WAKE) {
+ int wakeirq;
+
+ wakeirq = of_irq_get_byname(dev->of_node, "wakeup");
+- if (wakeirq == -EPROBE_DEFER)
+- return wakeirq;
++ if (wakeirq == -EPROBE_DEFER) {
++ status = wakeirq;
++ goto put_sync_adapter;
++ }
+
+ device_init_wakeup(&client->dev, true);
+
+@@ -408,6 +414,10 @@ err_detach_pm_domain:
+ err_clear_wakeup_irq:
+ dev_pm_clear_wake_irq(&client->dev);
+ device_init_wakeup(&client->dev, false);
++put_sync_adapter:
++ if (client->flags & I2C_CLIENT_HOST_NOTIFY)
++ pm_runtime_put_sync(&client->adapter->dev);
++
+ return status;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From f1477ceac8ae9ce4273e1765ba681dcbb1646a3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 May 2020 21:21:00 +0200
+Subject: i2c: mux: demux-pinctrl: Fix an error handling path in
+ 'i2c_demux_pinctrl_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit e9d1a0a41d4486955e96552293c1fcf1fce61602 ]
+
+A call to 'i2c_demux_deactivate_master()' is missing in the error handling
+path, as already done in the remove function.
+
+Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+index 0e16490eb3a1..5365199a31f4 100644
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -272,6 +272,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
+ err_rollback_available:
+ device_remove_file(&pdev->dev, &dev_attr_available_masters);
+ err_rollback:
++ i2c_demux_deactivate_master(priv);
+ for (j = 0; j < i; j++) {
+ of_node_put(priv->chan[j].parent_np);
+ of_changeset_destroy(&priv->chan[j].chgset);
+--
+2.25.1
+
--- /dev/null
+From 8ddc31f90e66f1c1edb69d229bbc4a1211666075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 13:22:11 -0500
+Subject: ibmvnic: Skip fatal error reset after passive init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juliet Kim <julietk@linux.vnet.ibm.com>
+
+[ Upstream commit f9c6cea0b38518741c8dcf26ac056d26ee2fd61d ]
+
+During MTU change, the following events may happen.
+Client-driven CRQ initialization fails due to partner’s CRQ closed,
+causing client to enqueue a reset task for FATAL_ERROR. Then passive
+(server-driven) CRQ initialization succeeds, causing client to
+release CRQ and enqueue a reset task for failover. If the passive
+CRQ initialization occurs before the FATAL reset task is processed,
+the FATAL error reset task would try to access a CRQ message queue
+that was freed, causing an oops. The problem may be most likely to
+occur during DLPAR add vNIC with a non-default MTU, because the DLPAR
+process will automatically issue a change MTU request.
+
+Fix this by not processing fatal error reset if CRQ is passively
+initialized after client-driven CRQ initialization fails.
+
+Signed-off-by: Juliet Kim <julietk@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index e1ab2feeae53..aaa03ce5796f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2086,7 +2086,8 @@ static void __ibmvnic_reset(struct work_struct *work)
+ rc = do_hard_reset(adapter, rwi, reset_state);
+ rtnl_unlock();
+ }
+- } else {
++ } else if (!(rwi->reset_reason == VNIC_RESET_FATAL &&
++ adapter->from_passive_init)) {
+ rc = do_reset(adapter, rwi, reset_state);
+ }
+ kfree(rwi);
+--
+2.25.1
+
--- /dev/null
+From e70701db781132d0de4e9d7f473f5372a3bd9288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 12:31:28 +0200
+Subject: ima: Fix return value of ima_write_policy()
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit 2e3a34e9f409ebe83d1af7cd2f49fca7af97dfac ]
+
+This patch fixes the return value of ima_write_policy() when a new policy
+is directly passed to IMA and the current policy requires appraisal of the
+file containing the policy. Currently, if appraisal is not in ENFORCE mode,
+ima_write_policy() returns 0 and leads user space applications to an
+endless loop. Fix this issue by denying the operation regardless of the
+appraisal mode.
+
+Cc: stable@vger.kernel.org # 4.10.x
+Fixes: 19f8a84713edc ("ima: measure and appraise the IMA policy itself")
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Reviewed-by: Krzysztof Struczynski <krzysztof.struczynski@huawei.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_fs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index 2000e8df0301..68571c40d61f 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -340,8 +340,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf,
+ integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL,
+ "policy_update", "signed policy required",
+ 1, 0);
+- if (ima_appraise & IMA_APPRAISE_ENFORCE)
+- result = -EACCES;
++ result = -EACCES;
+ } else {
+ result = ima_parse_add_rule(data);
+ }
+--
+2.25.1
+
--- /dev/null
+From 7e521000563d53c49604a09c62b710c2436c3ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 12:28:55 +0200
+Subject: ima: Set file->f_mode instead of file->f_flags in
+ ima_calc_file_hash()
+
+From: Roberto Sassu <roberto.sassu@huawei.com>
+
+[ Upstream commit 0014cc04e8ec077dc482f00c87dfd949cfe2b98f ]
+
+Commit a408e4a86b36 ("ima: open a new file instance if no read
+permissions") tries to create a new file descriptor to calculate a file
+digest if the file has not been opened with O_RDONLY flag. However, if a
+new file descriptor cannot be obtained, it sets the FMODE_READ flag to
+file->f_flags instead of file->f_mode.
+
+This patch fixes this issue by replacing f_flags with f_mode as it was
+before that commit.
+
+Cc: stable@vger.kernel.org # 4.20.x
+Fixes: a408e4a86b36 ("ima: open a new file instance if no read permissions")
+Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
+Reviewed-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_crypto.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index 73044fc6a952..ad6cbbccc8d9 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -411,7 +411,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ loff_t i_size;
+ int rc;
+ struct file *f = file;
+- bool new_file_instance = false, modified_flags = false;
++ bool new_file_instance = false, modified_mode = false;
+
+ /*
+ * For consistency, fail file's opened with the O_DIRECT flag on
+@@ -431,13 +431,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ f = dentry_open(&file->f_path, flags, file->f_cred);
+ if (IS_ERR(f)) {
+ /*
+- * Cannot open the file again, lets modify f_flags
++ * Cannot open the file again, lets modify f_mode
+ * of original and continue
+ */
+ pr_info_ratelimited("Unable to reopen file for reading.\n");
+ f = file;
+- f->f_flags |= FMODE_READ;
+- modified_flags = true;
++ f->f_mode |= FMODE_READ;
++ modified_mode = true;
+ } else {
+ new_file_instance = true;
+ }
+@@ -455,8 +455,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash)
+ out:
+ if (new_file_instance)
+ fput(f);
+- else if (modified_flags)
+- f->f_flags &= ~FMODE_READ;
++ else if (modified_mode)
++ f->f_mode &= ~FMODE_READ;
+ return rc;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 144e83a3c3bef25477b61010dae2788c5b309a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 14:54:11 +0200
+Subject: iommu/amd: Call domain_flush_complete() in update_domain()
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit f44a4d7e4f1cdef73c90b1dc749c4d8a7372a8eb ]
+
+The update_domain() function is expected to also inform the hardware
+about domain changes. This needs a COMPLETION_WAIT command to be sent
+to all IOMMUs which use the domain.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Tested-by: Qian Cai <cai@lca.pw>
+Link: https://lore.kernel.org/r/20200504125413.16798-4-joro@8bytes.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index bc7771498342..32de8e7bb8b4 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2386,6 +2386,7 @@ static void update_domain(struct protection_domain *domain)
+
+ domain_flush_devices(domain);
+ domain_flush_tlb_pde(domain);
++ domain_flush_complete(domain);
+ }
+
+ static int dir2prot(enum dma_data_direction direction)
+--
+2.25.1
+
--- /dev/null
+From d7fc0ca9b4127aaa6222e12f3e48872ab61e1739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 May 2020 10:23:52 +0000
+Subject: iommu/amd: Fix over-read of ACPI UID from IVRS table
+
+From: Alexander Monakov <amonakov@ispras.ru>
+
+[ Upstream commit e461b8c991b9202b007ea2059d953e264240b0c9 ]
+
+IVRS parsing code always tries to read 255 bytes from memory when
+retrieving ACPI device path, and makes an assumption that firmware
+provides a zero-terminated string. Both of those are bugs: the entry
+is likely to be shorter than 255 bytes, and zero-termination is not
+guaranteed.
+
+With Acer SF314-42 firmware these issues manifest visibly in dmesg:
+
+AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR0\xf0\xa5, rdevid:160
+AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR1\xf0\xa5, rdevid:160
+AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR2\xf0\xa5, rdevid:160
+AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR3>\x83e\x8d\x9a\xd1...
+
+The first three lines show how the code over-reads adjacent table
+entries into the UID, and in the last line it even reads garbage data
+beyond the end of the IVRS table itself.
+
+Since each entry has the length of the UID (uidl member of ivhd_entry
+struct), use that for memcpy, and manually add a zero terminator.
+
+Avoid zero-filling hid and uid arrays up front, and instead ensure
+the uid array is always zero-terminated. No change needed for the hid
+array, as it was already properly zero-terminated.
+
+Fixes: 2a0cb4e2d423c ("iommu/amd: Add new map for storing IVHD dev entry type HID")
+
+Signed-off-by: Alexander Monakov <amonakov@ispras.ru>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: iommu@lists.linux-foundation.org
+Link: https://lore.kernel.org/r/20200511102352.1831-1-amonakov@ispras.ru
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index ef14b00fa94b..135ae5222cf3 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1331,8 +1331,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ }
+ case IVHD_DEV_ACPI_HID: {
+ u16 devid;
+- u8 hid[ACPIHID_HID_LEN] = {0};
+- u8 uid[ACPIHID_UID_LEN] = {0};
++ u8 hid[ACPIHID_HID_LEN];
++ u8 uid[ACPIHID_UID_LEN];
+ int ret;
+
+ if (h->type != 0x40) {
+@@ -1349,6 +1349,7 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ break;
+ }
+
++ uid[0] = '\0';
+ switch (e->uidf) {
+ case UID_NOT_PRESENT:
+
+@@ -1363,8 +1364,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ break;
+ case UID_IS_CHARACTER:
+
+- memcpy(uid, (u8 *)(&e->uid), ACPIHID_UID_LEN - 1);
+- uid[ACPIHID_UID_LEN - 1] = '\0';
++ memcpy(uid, &e->uid, e->uidl);
++ uid[e->uidl] = '\0';
+
+ break;
+ default:
+--
+2.25.1
+
--- /dev/null
+From 155a4410f486cdf37695c90db30412b16c4320d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Mar 2020 12:20:36 +0900
+Subject: kbuild: avoid concurrency issue in parallel building dtbs and
+ dtbs_check
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit b5154bf63e5577faaaca1d942df274f7de91dd2a ]
+
+'make dtbs_check' checks the shecma in addition to building *.dtb files,
+in other words, 'make dtbs_check' is a super-set of 'make dtbs'.
+So, you do not have to do 'make dtbs dtbs_check', but I want to keep
+the build system as robust as possible in any use.
+
+Currently, 'dtbs' and 'dtbs_check' are independent of each other.
+In parallel building, two threads descend into arch/*/boot/dts/,
+one for dtbs and the other for dtbs_check, then end up with building
+the same DTB simultaneously.
+
+This commit fixes the concurrency issue. Otherwise, I see build errors
+like follows:
+
+$ make ARCH=arm64 defconfig
+$ make -j16 ARCH=arm64 DT_SCHEMA_FILES=Documentation/devicetree/bindings/arm/psci.yaml dtbs dtbs_check
+ <snip>
+ DTC arch/arm64/boot/dts/qcom/sdm845-cheza-r2.dtb
+ DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtb
+ DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb
+ DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb
+ DTC arch/arm64/boot/dts/freescale/imx8mn-evk.dtb
+ DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb
+ DTC arch/arm64/boot/dts/zte/zx296718-pcbox.dtb
+ DTC arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dt.yaml
+ DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dtb
+ DTC arch/arm64/boot/dts/xilinx/zynqmp-zc1254-revA.dtb
+ DTC arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dtb
+ DTC arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-inx.dtb
+ DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb
+ CHECK arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dt.yaml
+fixdep: error opening file: arch/arm64/boot/dts/allwinner/.sun50i-h6-orangepi-lite2.dtb.d: No such file or directory
+make[2]: *** [scripts/Makefile.lib:296: arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb] Error 2
+make[2]: *** Deleting file 'arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb'
+make[2]: *** Waiting for unfinished jobs....
+ DTC arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-kd.dtb
+ DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p231.dtb
+ DTC arch/arm64/boot/dts/xilinx/zynqmp-zc1275-revA.dtb
+ DTC arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dtb
+fixdep: parse error; no targets found
+make[2]: *** [scripts/Makefile.lib:296: arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb] Error 1
+make[2]: *** Deleting file 'arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb'
+make[1]: *** [scripts/Makefile.build:505: arch/arm64/boot/dts/allwinner] Error 2
+make[1]: *** Waiting for unfinished jobs....
+ DTC arch/arm64/boot/dts/renesas/r8a77951-salvator-xs.dtb
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 1bd1b17cd207..ba154f92b203 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1246,11 +1246,15 @@ ifneq ($(dtstree),)
+ $(Q)$(MAKE) $(build)=$(dtstree) $(dtstree)/$@
+
+ PHONY += dtbs dtbs_install dtbs_check
+-dtbs dtbs_check: include/config/kernel.release scripts_dtc
++dtbs: include/config/kernel.release scripts_dtc
+ $(Q)$(MAKE) $(build)=$(dtstree)
+
++ifneq ($(filter dtbs_check, $(MAKECMDGOALS)),)
++dtbs: dt_binding_check
++endif
++
+ dtbs_check: export CHECK_DTBS=1
+-dtbs_check: dt_binding_check
++dtbs_check: dtbs
+
+ dtbs_install:
+ $(Q)$(MAKE) $(dtbinst)=$(dtstree)
+--
+2.25.1
+
--- /dev/null
+From 7b61b1662a9c2bd6e1f4922ff855bd7048153323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 18:06:07 -0400
+Subject: KVM: selftests: Fix build for evmcs.h
+
+From: Peter Xu <peterx@redhat.com>
+
+[ Upstream commit 8ffdaf9155ebe517cdec5edbcca19ba6e7ee9c3c ]
+
+I got this error when building kvm selftests:
+
+/usr/bin/ld: /home/xz/git/linux/tools/testing/selftests/kvm/libkvm.a(vmx.o):/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:222: multiple definition of `current_evmcs'; /tmp/cco1G48P.o:/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:222: first defined here
+/usr/bin/ld: /home/xz/git/linux/tools/testing/selftests/kvm/libkvm.a(vmx.o):/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:223: multiple definition of `current_vp_assist'; /tmp/cco1G48P.o:/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:223: first defined here
+
+I think it's because evmcs.h is included both in a test file and a lib file so
+the structs have multiple declarations when linking. After all it's not a good
+habit to declare structs in the header files.
+
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Message-Id: <20200504220607.99627-1-peterx@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/include/evmcs.h | 4 ++--
+ tools/testing/selftests/kvm/lib/x86_64/vmx.c | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/kvm/include/evmcs.h b/tools/testing/selftests/kvm/include/evmcs.h
+index 4912d23844bc..e31ac9c5ead0 100644
+--- a/tools/testing/selftests/kvm/include/evmcs.h
++++ b/tools/testing/selftests/kvm/include/evmcs.h
+@@ -217,8 +217,8 @@ struct hv_enlightened_vmcs {
+ #define HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_MASK \
+ (~((1ull << HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_SHIFT) - 1))
+
+-struct hv_enlightened_vmcs *current_evmcs;
+-struct hv_vp_assist_page *current_vp_assist;
++extern struct hv_enlightened_vmcs *current_evmcs;
++extern struct hv_vp_assist_page *current_vp_assist;
+
+ int vcpu_enable_evmcs(struct kvm_vm *vm, int vcpu_id);
+
+diff --git a/tools/testing/selftests/kvm/lib/x86_64/vmx.c b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
+index f6ec97b7eaef..8cc4a59ff369 100644
+--- a/tools/testing/selftests/kvm/lib/x86_64/vmx.c
++++ b/tools/testing/selftests/kvm/lib/x86_64/vmx.c
+@@ -17,6 +17,9 @@
+
+ bool enable_evmcs;
+
++struct hv_enlightened_vmcs *current_evmcs;
++struct hv_vp_assist_page *current_vp_assist;
++
+ struct eptPageTableEntry {
+ uint64_t readable:1;
+ uint64_t writable:1;
+--
+2.25.1
+
--- /dev/null
+From 6c98298763132a58df4f939e0c24d6123a90bcbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 15:17:21 +0200
+Subject: mtd: Fix mtd not registered due to nvmem name collision
+
+From: Ricardo Ribalda Delgado <ribalda@kernel.org>
+
+[ Upstream commit 7b01b7239d0dc9832e0d0d23605c1ff047422a2c ]
+
+When the nvmem framework is enabled, a nvmem device is created per mtd
+device/partition.
+
+It is not uncommon that a device can have multiple mtd devices with
+partitions that have the same name. Eg, when there DT overlay is allowed
+and the same device with mtd is attached twice.
+
+Under that circumstances, the mtd fails to register due to a name
+duplication on the nvmem framework.
+
+With this patch we use the mtdX name instead of the partition name,
+which is unique.
+
+[ 8.948991] sysfs: cannot create duplicate filename '/bus/nvmem/devices/Production Data'
+[ 8.948992] CPU: 7 PID: 246 Comm: systemd-udevd Not tainted 5.5.0-qtec-standard #13
+[ 8.948993] Hardware name: AMD Dibbler/Dibbler, BIOS 05.22.04.0019 10/26/2019
+[ 8.948994] Call Trace:
+[ 8.948996] dump_stack+0x50/0x70
+[ 8.948998] sysfs_warn_dup.cold+0x17/0x2d
+[ 8.949000] sysfs_do_create_link_sd.isra.0+0xc2/0xd0
+[ 8.949002] bus_add_device+0x74/0x140
+[ 8.949004] device_add+0x34b/0x850
+[ 8.949006] nvmem_register.part.0+0x1bf/0x640
+...
+[ 8.948926] mtd mtd8: Failed to register NVMEM device
+
+Fixes: c4dfa25ab307 ("mtd: add support for reading MTD devices via the nvmem API")
+Signed-off-by: Ricardo Ribalda Delgado <ribalda@kernel.org>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
+index 6cc7ecb0c788..036b9452b19f 100644
+--- a/drivers/mtd/mtdcore.c
++++ b/drivers/mtd/mtdcore.c
+@@ -563,7 +563,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd)
+
+ config.id = -1;
+ config.dev = &mtd->dev;
+- config.name = mtd->name;
++ config.name = dev_name(&mtd->dev);
+ config.owner = THIS_MODULE;
+ config.reg_read = mtd_nvmem_reg_read;
+ config.size = mtd->size;
+--
+2.25.1
+
--- /dev/null
+From f75ec21b65607ba4d4ff69a2126b04fea33efec5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 May 2020 15:10:29 +0200
+Subject: mtd: spinand: Propagate ECC information to the MTD structure
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 3507273d5a4d3c2e46f9d3f9ed9449805f5dff07 ]
+
+This is done by default in the raw NAND core (nand_base.c) but was
+missing in the SPI-NAND core. Without these two lines the ecc_strength
+and ecc_step_size values are not exported to the user through sysfs.
+
+Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/spi/core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
+index 8dda51bbdd11..0d21c68bfe24 100644
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1049,6 +1049,10 @@ static int spinand_init(struct spinand_device *spinand)
+
+ mtd->oobavail = ret;
+
++ /* Propagate ECC information to mtd_info */
++ mtd->ecc_strength = nand->eccreq.strength;
++ mtd->ecc_step_size = nand->eccreq.step_size;
++
+ return 0;
+
+ err_cleanup_nanddev:
+--
+2.25.1
+
--- /dev/null
+From d6163516c22a25e396a5a387033717227d4f81f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2020 15:29:25 +0900
+Subject: net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report()
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 1cd9b3abf5332102d4d967555e7ed861a75094bf ]
+
+In net/Kconfig, NET_DEVLINK implies NET_DROP_MONITOR.
+
+The original behavior of the 'imply' keyword prevents NET_DROP_MONITOR
+from being 'm' when NET_DEVLINK=y.
+
+With the planned Kconfig change that relaxes the 'imply', the
+combination of NET_DEVLINK=y and NET_DROP_MONITOR=m would be allowed.
+
+Use IS_REACHABLE() to avoid the vmlinux link error for this case.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/drop_monitor.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/drop_monitor.h b/include/net/drop_monitor.h
+index 2ab668461463..f68bc373544a 100644
+--- a/include/net/drop_monitor.h
++++ b/include/net/drop_monitor.h
+@@ -19,7 +19,7 @@ struct net_dm_hw_metadata {
+ struct net_device *input_dev;
+ };
+
+-#if IS_ENABLED(CONFIG_NET_DROP_MONITOR)
++#if IS_REACHABLE(CONFIG_NET_DROP_MONITOR)
+ void net_dm_hw_report(struct sk_buff *skb,
+ const struct net_dm_hw_metadata *hw_metadata);
+ #else
+--
+2.25.1
+
--- /dev/null
+From eadc42c2f16671bd0529339fc687ab68f4731046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2020 14:49:45 +1000
+Subject: net/ena: Fix build warning in ena_xdp_set()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Gavin Shan <gshan@redhat.com>
+
+[ Upstream commit caec66198d137c26f0d234abc498866a58c64150 ]
+
+This fixes the following build warning in ena_xdp_set(), which is
+observed on aarch64 with 64KB page size.
+
+ In file included from ./include/net/inet_sock.h:19,
+ from ./include/net/ip.h:27,
+ from drivers/net/ethernet/amazon/ena/ena_netdev.c:46:
+ drivers/net/ethernet/amazon/ena/ena_netdev.c: In function \
+ ‘ena_xdp_set’: \
+ drivers/net/ethernet/amazon/ena/ena_netdev.c:557:6: warning: \
+ format ‘%lu’ \
+ expects argument of type ‘long unsigned int’, but argument 4 \
+ has type ‘int’ \
+ [-Wformat=] "Failed to set xdp program, the current MTU (%d) is \
+ larger than the maximum allowed MTU (%lu) while xdp is on",
+
+Signed-off-by: Gavin Shan <gshan@redhat.com>
+Acked-by: Shay Agroskin <shayagr@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+index dc02950a96b8..28412f11a9ca 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -68,7 +68,7 @@
+ * 16kB.
+ */
+ #if PAGE_SIZE > SZ_16K
+-#define ENA_PAGE_SIZE SZ_16K
++#define ENA_PAGE_SIZE (_AC(SZ_16K, UL))
+ #else
+ #define ENA_PAGE_SIZE PAGE_SIZE
+ #endif
+--
+2.25.1
+
--- /dev/null
+From 01cce1761626cc8b693cd68a2e682b7a560e8be2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Apr 2020 00:05:59 +0200
+Subject: platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 3bd12da7f50b8bc191fcb3bab1f55c582234df59 ]
+
+asus-nb-wmi does not add any extra functionality on these Asus
+Transformer books. They have detachable keyboards, so the hotkeys are
+send through a HID device (and handled by the hid-asus driver) and also
+the rfkill functionality is not used on these devices.
+
+Besides not adding any extra functionality, initializing the WMI interface
+on these devices actually has a negative side-effect. For some reason
+the \_SB.ATKD.INIT() function which asus_wmi_platform_init() calls drives
+GPO2 (INT33FC:02) pin 8, which is connected to the front facing webcam LED,
+high and there is no (WMI or other) interface to drive this low again
+causing the LED to be permanently on, even during suspend.
+
+This commit adds a blacklist of DMI system_ids on which not to load the
+asus-nb-wmi and adds these Transformer books to this list. This fixes
+the webcam LED being permanently on under Linux.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index b361c73636a4..0d42477946f3 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -514,9 +514,33 @@ static struct asus_wmi_driver asus_nb_wmi_driver = {
+ .detect_quirks = asus_nb_wmi_quirks,
+ };
+
++static const struct dmi_system_id asus_nb_wmi_blacklist[] __initconst = {
++ {
++ /*
++ * asus-nb-wm adds no functionality. The T100TA has a detachable
++ * USB kbd, so no hotkeys and it has no WMI rfkill; and loading
++ * asus-nb-wm causes the camera LED to turn and _stay_ on.
++ */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"),
++ },
++ },
++ {
++ /* The Asus T200TA has the same issue as the T100TA */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T200TA"),
++ },
++ },
++ {} /* Terminating entry */
++};
+
+ static int __init asus_nb_wmi_init(void)
+ {
++ if (dmi_check_system(asus_nb_wmi_blacklist))
++ return -ENODEV;
++
+ return asus_wmi_register_driver(&asus_nb_wmi_driver);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 329c2245d65a03797c4395646bdf00190c501801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 May 2020 18:36:03 -0700
+Subject: scripts/gdb: repair rb_first() and rb_last()
+
+From: Aymeric Agon-Rambosson <aymeric.agon@yandex.com>
+
+[ Upstream commit 50e36be1fb9572b2e4f2753340bdce3116bf2ce7 ]
+
+The current implementations of the rb_first() and rb_last() gdb
+functions have a variable that references itself in its instanciation,
+which causes the function to throw an error if a specific condition on
+the argument is met. The original author rather intended to reference
+the argument and made a typo. Referring the argument instead makes the
+function work as intended.
+
+Signed-off-by: Aymeric Agon-Rambosson <aymeric.agon@yandex.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Nikolay Borisov <n.borisov.lkml@gmail.com>
+Cc: Jackie Liu <liuyun01@kylinos.cn>
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Link: http://lkml.kernel.org/r/20200427051029.354840-1-aymeric.agon@yandex.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/rbtree.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/gdb/linux/rbtree.py b/scripts/gdb/linux/rbtree.py
+index 39db889b874c..c4b991607917 100644
+--- a/scripts/gdb/linux/rbtree.py
++++ b/scripts/gdb/linux/rbtree.py
+@@ -12,7 +12,7 @@ rb_node_type = utils.CachedType("struct rb_node")
+
+ def rb_first(root):
+ if root.type == rb_root_type.get_type():
+- node = node.address.cast(rb_root_type.get_type().pointer())
++ node = root.address.cast(rb_root_type.get_type().pointer())
+ elif root.type != rb_root_type.get_type().pointer():
+ raise gdb.GdbError("Must be struct rb_root not {}".format(root.type))
+
+@@ -28,7 +28,7 @@ def rb_first(root):
+
+ def rb_last(root):
+ if root.type == rb_root_type.get_type():
+- node = node.address.cast(rb_root_type.get_type().pointer())
++ node = root.address.cast(rb_root_type.get_type().pointer())
+ elif root.type != rb_root_type.get_type().pointer():
+ raise gdb.GdbError("Must be struct rb_root not {}".format(root.type))
+
+--
+2.25.1
+
--- /dev/null
+From 23fa930715c7791bf1131ba40cdca3c48a80be1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 15:49:53 -0700
+Subject: scsi: ibmvscsi: Fix WARN_ON during event pool release
+
+From: Tyrel Datwyler <tyreld@linux.ibm.com>
+
+[ Upstream commit b36522150e5b85045f868768d46fbaaa034174b2 ]
+
+While removing an ibmvscsi client adapter a WARN_ON like the following is
+seen in the kernel log:
+
+drmgr: drmgr: -r -c slot -s U9080.M9S.783AEC8-V11-C11 -w 5 -d 1
+WARNING: CPU: 9 PID: 24062 at ../kernel/dma/mapping.c:311 dma_free_attrs+0x78/0x110
+Supported: No, Unreleased kernel
+CPU: 9 PID: 24062 Comm: drmgr Kdump: loaded Tainted: G X 5.3.18-12-default
+NIP: c0000000001fa758 LR: c0000000001fa744 CTR: c0000000001fa6e0
+REGS: c0000002173375d0 TRAP: 0700 Tainted: G X (5.3.18-12-default)
+MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28088282 XER: 20000000
+CFAR: c0000000001fbf0c IRQMASK: 1
+GPR00: c0000000001fa744 c000000217337860 c00000000161ab00 0000000000000000
+GPR04: 0000000000000000 c000011e12250000 0000000018010000 0000000000000000
+GPR08: 0000000000000000 0000000000000001 0000000000000001 c0080000190f4fa8
+GPR12: c0000000001fa6e0 c000000007fc2a00 0000000000000000 0000000000000000
+GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+GPR24: 000000011420e310 0000000000000000 0000000000000000 0000000018010000
+GPR28: c00000000159de50 c000011e12250000 0000000000006600 c000011e5c994848
+NIP [c0000000001fa758] dma_free_attrs+0x78/0x110
+LR [c0000000001fa744] dma_free_attrs+0x64/0x110
+Call Trace:
+[c000000217337860] [000000011420e310] 0x11420e310 (unreliable)
+[c0000002173378b0] [c0080000190f0280] release_event_pool+0xd8/0x120 [ibmvscsi]
+[c000000217337930] [c0080000190f3f74] ibmvscsi_remove+0x6c/0x160 [ibmvscsi]
+[c000000217337960] [c0000000000f3cac] vio_bus_remove+0x5c/0x100
+[c0000002173379a0] [c00000000087a0a4] device_release_driver_internal+0x154/0x280
+[c0000002173379e0] [c0000000008777cc] bus_remove_device+0x11c/0x220
+[c000000217337a60] [c000000000870fc4] device_del+0x1c4/0x470
+[c000000217337b10] [c0000000008712a0] device_unregister+0x30/0xa0
+[c000000217337b80] [c0000000000f39ec] vio_unregister_device+0x2c/0x60
+[c000000217337bb0] [c00800001a1d0964] dlpar_remove_slot+0x14c/0x250 [rpadlpar_io]
+[c000000217337c50] [c00800001a1d0bcc] remove_slot_store+0xa4/0x110 [rpadlpar_io]
+[c000000217337cd0] [c000000000c091a0] kobj_attr_store+0x30/0x50
+[c000000217337cf0] [c00000000057c934] sysfs_kf_write+0x64/0x90
+[c000000217337d10] [c00000000057be10] kernfs_fop_write+0x1b0/0x290
+[c000000217337d60] [c000000000488c4c] __vfs_write+0x3c/0x70
+[c000000217337d80] [c00000000048c648] vfs_write+0xd8/0x260
+[c000000217337dd0] [c00000000048ca8c] ksys_write+0xdc/0x130
+[c000000217337e20] [c00000000000b488] system_call+0x5c/0x70
+Instruction dump:
+7c840074 f8010010 f821ffb1 20840040 eb830218 7c8407b4 48002019 60000000
+2fa30000 409e003c 892d0988 792907e0 <0b090000> 2fbd0000 419e0028 2fbc0000
+---[ end trace 5955b3c0cc079942 ]---
+rpadlpar_io: slot U9080.M9S.783AEC8-V11-C11 removed
+
+This is tripped as a result of irqs being disabled during the call to
+dma_free_coherent() by release_event_pool(). At this point in the code path
+we have quiesced the adapter and it is overly paranoid to be holding the
+host lock.
+
+[mkp: fixed build warning reported by sfr]
+
+Link: https://lore.kernel.org/r/1588027793-17952-1-git-send-email-tyreld@linux.ibm.com
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ibmvscsi/ibmvscsi.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index 7f66a7783209..59f0f1030c54 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -2320,16 +2320,12 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id)
+ static int ibmvscsi_remove(struct vio_dev *vdev)
+ {
+ struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev);
+- unsigned long flags;
+
+ srp_remove_host(hostdata->host);
+ scsi_remove_host(hostdata->host);
+
+ purge_requests(hostdata, DID_ERROR);
+-
+- spin_lock_irqsave(hostdata->host->host_lock, flags);
+ release_event_pool(&hostdata->pool, hostdata);
+- spin_unlock_irqrestore(hostdata->host->host_lock, flags);
+
+ ibmvscsi_release_crq_queue(&hostdata->queue, hostdata,
+ max_events);
+--
+2.25.1
+
--- /dev/null
+From fe474df3df053ef72779b35769fbdcf6b5e2308a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2020 03:40:15 -0700
+Subject: scsi: qla2xxx: Delete all sessions before unregister local nvme port
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit c48f849d3f7a4ec1025105f446e29d395c4dcc2f ]
+
+Delete all sessions before unregistering local nvme port. This allows nvme
+layer to decrement all active rport count down to zero. Once the count is
+down to zero, nvme would call qla to continue with the npiv port deletion.
+
+PID: 27448 TASK: ffff9e34b777c1c0 CPU: 0 COMMAND: "qaucli"
+ 0 [ffff9e25e84abbd8] __schedule at ffffffff977858ca
+ 1 [ffff9e25e84abc68] schedule at ffffffff97785d79
+ 2 [ffff9e25e84abc78] schedule_timeout at ffffffff97783881
+ 3 [ffff9e25e84abd28] wait_for_completion at ffffffff9778612d
+ 4 [ffff9e25e84abd88] qla_nvme_delete at ffffffffc0e3024e [qla2xxx]
+ 5 [ffff9e25e84abda8] qla24xx_vport_delete at ffffffffc0e024b9 [qla2xxx]
+ 6 [ffff9e25e84abdf0] fc_vport_terminate at ffffffffc011c247 [scsi_transport_fc]
+ 7 [ffff9e25e84abe28] store_fc_host_vport_delete at ffffffffc011cd94 [scsi_transport_fc]
+ 8 [ffff9e25e84abe70] dev_attr_store at ffffffff974b376b
+ 9 [ffff9e25e84abe80] sysfs_kf_write at ffffffff972d9a92
+10 [ffff9e25e84abe90] kernfs_fop_write at ffffffff972d907b
+11 [ffff9e25e84abec8] vfs_write at ffffffff9724c790
+12 [ffff9e25e84abf08] sys_write at ffffffff9724d55f
+13 [ffff9e25e84abf50] system_call_fastpath at ffffffff97792ed2
+ RIP: 00007fc0bd81a6fd RSP: 00007ffff78d9648 RFLAGS: 00010202
+ RAX: 0000000000000001 RBX: 0000000000000022 RCX: 00007ffff78d96e0
+ RDX: 0000000000000022 RSI: 00007ffff78d94e0 RDI: 0000000000000008
+ RBP: 00007ffff78d9440 R8: 0000000000000000 R9: 00007fc0bd48b2cd
+ R10: 0000000000000017 R11: 0000000000000293 R12: 0000000000000000
+ R13: 00005624e4dac840 R14: 00005624e4da9a10 R15: 0000000000000000
+ ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b
+
+Link: https://lore.kernel.org/r/20200331104015.24868-4-njavali@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_attr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 1fbc5c6c6c14..3aa343633250 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -2926,11 +2926,11 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
+ test_bit(FCPORT_UPDATE_NEEDED, &vha->dpc_flags))
+ msleep(1000);
+
+- qla_nvme_delete(vha);
+
+ qla24xx_disable_vp(vha);
+ qla2x00_wait_for_sess_deletion(vha);
+
++ qla_nvme_delete(vha);
+ vha->flags.delete_progress = 1;
+
+ qlt_remove_target(ha, vha);
+--
+2.25.1
+
--- /dev/null
+From adc2c1f62b2a25bbcf1fe5cb5b0a9cf3d0bbe9e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2020 03:40:14 -0700
+Subject: scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV
+
+From: Arun Easi <aeasi@marvell.com>
+
+[ Upstream commit 45a76264c26fd8cfd0c9746196892d9b7e2657ee ]
+
+In NPIV environment, a NPIV host may use a queue pair created by base host
+or other NPIVs, so the check for a queue pair created by this NPIV is not
+correct, and can cause an abort to fail, which in turn means the NVME
+command not returned. This leads to hang in nvme_fc layer in
+nvme_fc_delete_association() which waits for all I/Os to be returned, which
+is seen as hang in the application.
+
+Link: https://lore.kernel.org/r/20200331104015.24868-3-njavali@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 1ef8907314e5..62a16463f025 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3117,7 +3117,7 @@ qla24xx_abort_command(srb_t *sp)
+ ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x108c,
+ "Entered %s.\n", __func__);
+
+- if (vha->flags.qpairs_available && sp->qpair)
++ if (sp->qpair)
+ req = sp->qpair->req;
+ else
+ return QLA_FUNCTION_FAILED;
+--
+2.25.1
+
i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch
kvm-svm-fix-potential-memory-leak-in-svm_cpu_init.patch
+ima-set-file-f_mode-instead-of-file-f_flags-in-ima_c.patch
+evm-check-also-if-tfm-is-an-error-pointer-in-init_de.patch
+ima-fix-return-value-of-ima_write_policy.patch
+ubifs-fix-wrong-use-of-crypto_shash_descsize.patch
+acpi-ec-pm-avoid-flushing-ec-work-when-ec-gpe-is-ina.patch
+mtd-spinand-propagate-ecc-information-to-the-mtd-str.patch
+fix-multiplication-overflow-in-copy_fdtable.patch
+ubifs-remove-broken-lazytime-support.patch
+i2c-fix-missing-pm_runtime_put_sync-in-i2c_device_pr.patch
+iommu-amd-fix-over-read-of-acpi-uid-from-ivrs-table.patch
+evm-fix-a-small-race-in-init_desc.patch
+i2c-mux-demux-pinctrl-fix-an-error-handling-path-in-.patch
+ubi-fix-seq_file-usage-in-detailed_erase_block_info-.patch
+afs-don-t-unlock-fetched-data-pages-until-the-op-com.patch
+mtd-fix-mtd-not-registered-due-to-nvmem-name-collisi.patch
+kbuild-avoid-concurrency-issue-in-parallel-building-.patch
+net-drop_monitor-use-is_reachable-to-guard-net_dm_hw.patch
+gcc-common.h-update-for-gcc-10.patch
+hid-multitouch-add-egalaxtouch-p80h84-support.patch
+hid-alps-add-aui1657-device-id.patch
+hid-alps-alps_1657-is-too-specific-use-u1_unicorn_le.patch
+scsi-qla2xxx-fix-hang-when-issuing-nvme-disconnect-a.patch
+scsi-qla2xxx-delete-all-sessions-before-unregister-l.patch
+configfs-fix-config_item-refcnt-leak-in-configfs_rmd.patch
+vhost-vsock-fix-packet-delivery-order-to-monitoring-.patch
+aquantia-fix-the-media-type-of-aqc100-ethernet-contr.patch
+component-silence-bind-error-on-eprobe_defer.patch
+net-ena-fix-build-warning-in-ena_xdp_set.patch
+scsi-ibmvscsi-fix-warn_on-during-event-pool-release.patch
+hid-i2c-hid-reset-synaptics-syna2393-on-resume.patch
+x86-mm-cpa-flush-direct-map-alias-during-cpa.patch
+ibmvnic-skip-fatal-error-reset-after-passive-init.patch
+ftrace-selftest-make-unresolved-cases-cause-failure-.patch
+x86-apic-move-tsc-deadline-timer-debug-printk.patch
+gtp-set-nlm_f_multi-flag-in-gtp_genl_dump_pdp.patch
+hid-quirks-add-hid_quirk_no_init_reports-quirk-for-d.patch
+ceph-fix-double-unlock-in-handle_cap_export.patch
+stmmac-fix-pointer-check-after-utilization-in-stmmac.patch
+usb-core-fix-misleading-driver-bug-report.patch
+platform-x86-asus-nb-wmi-do-not-load-on-asus-t100ta-.patch
+iommu-amd-call-domain_flush_complete-in-update_domai.patch
+drm-amd-display-prevent-dpcd-reads-with-passive-dong.patch
+kvm-selftests-fix-build-for-evmcs.h.patch
+arm-futex-address-build-warning.patch
+scripts-gdb-repair-rb_first-and-rb_last.patch
--- /dev/null
+From c2d490370f5976234fc58041dbeeb8584213a2e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 09:26:43 +0300
+Subject: stmmac: fix pointer check after utilization in stmmac_interrupt
+
+From: Maxim Petrov <mmrmaximuzz@gmail.com>
+
+[ Upstream commit f42234ffd531ca6b13d9da02faa60b72eccf8334 ]
+
+The paranoidal pointer check in IRQ handler looks very strange - it
+really protects us only against bogus drivers which request IRQ line
+with null pointer dev_id. However, the code fragment is incorrect
+because the dev pointer is used before the actual check which leads
+to undefined behavior. Remove the check to avoid confusing people
+with incorrect code.
+
+Signed-off-by: Maxim Petrov <mmrmaximuzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 89a6ae2b17e3..1623516efb17 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3832,7 +3832,7 @@ static int stmmac_set_features(struct net_device *netdev,
+ /**
+ * stmmac_interrupt - main ISR
+ * @irq: interrupt number.
+- * @dev_id: to pass the net device pointer.
++ * @dev_id: to pass the net device pointer (must be valid).
+ * Description: this is the main driver interrupt service routine.
+ * It can call:
+ * o DMA service routine (to manage incoming frame reception and transmission
+@@ -3856,11 +3856,6 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id)
+ if (priv->irq_wake)
+ pm_wakeup_event(priv->device, 0);
+
+- if (unlikely(!dev)) {
+- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__);
+- return IRQ_NONE;
+- }
+-
+ /* Check if adapter is up */
+ if (test_bit(STMMAC_DOWN, &priv->state))
+ return IRQ_HANDLED;
+--
+2.25.1
+
--- /dev/null
+From d7cd76ccbc49fe1ed97d42cdf09ca0050f513f12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2020 14:48:02 +0200
+Subject: ubi: Fix seq_file usage in detailed_erase_block_info debugfs file
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 0e7572cffe442290c347e779bf8bd4306bb0aa7c ]
+
+3bfa7e141b0b ("fs/seq_file.c: seq_read(): add info message about buggy .next functions")
+showed that we don't use seq_file correctly.
+So make sure that our ->next function always updates the position.
+
+Fixes: 7bccd12d27b7 ("ubi: Add debugfs file for tracking PEB state")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/debug.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
+index a1dff92ceedf..8a83072401a7 100644
+--- a/drivers/mtd/ubi/debug.c
++++ b/drivers/mtd/ubi/debug.c
+@@ -392,9 +392,6 @@ static void *eraseblk_count_seq_start(struct seq_file *s, loff_t *pos)
+ {
+ struct ubi_device *ubi = s->private;
+
+- if (*pos == 0)
+- return SEQ_START_TOKEN;
+-
+ if (*pos < ubi->peb_count)
+ return pos;
+
+@@ -408,8 +405,6 @@ static void *eraseblk_count_seq_next(struct seq_file *s, void *v, loff_t *pos)
+ {
+ struct ubi_device *ubi = s->private;
+
+- if (v == SEQ_START_TOKEN)
+- return pos;
+ (*pos)++;
+
+ if (*pos < ubi->peb_count)
+@@ -431,11 +426,8 @@ static int eraseblk_count_seq_show(struct seq_file *s, void *iter)
+ int err;
+
+ /* If this is the start, print a header */
+- if (iter == SEQ_START_TOKEN) {
+- seq_puts(s,
+- "physical_block_number\terase_count\tblock_status\tread_status\n");
+- return 0;
+- }
++ if (*block_number == 0)
++ seq_puts(s, "physical_block_number\terase_count\n");
+
+ err = ubi_io_is_bad(ubi, *block_number);
+ if (err)
+--
+2.25.1
+
--- /dev/null
+From 105020f6a063c08d37135033732ce53421312cf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 May 2020 22:59:45 -0700
+Subject: ubifs: fix wrong use of crypto_shash_descsize()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 3c3c32f85b6cc05e5db78693457deff03ac0f434 ]
+
+crypto_shash_descsize() returns the size of the shash_desc context
+needed to compute the hash, not the size of the hash itself.
+
+crypto_shash_digestsize() would be correct, or alternatively using
+c->hash_len and c->hmac_desc_len which already store the correct values.
+But actually it's simpler to just use stack arrays, so do that instead.
+
+Fixes: 49525e5eecca ("ubifs: Add helper functions for authentication support")
+Fixes: da8ef65f9573 ("ubifs: Authenticate replayed journal")
+Cc: <stable@vger.kernel.org> # v4.20+
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/auth.c | 17 ++++-------------
+ fs/ubifs/replay.c | 13 ++-----------
+ 2 files changed, 6 insertions(+), 24 deletions(-)
+
+diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
+index 8cdbd53d780c..f985a3fbbb36 100644
+--- a/fs/ubifs/auth.c
++++ b/fs/ubifs/auth.c
+@@ -79,13 +79,9 @@ int ubifs_prepare_auth_node(struct ubifs_info *c, void *node,
+ struct shash_desc *inhash)
+ {
+ struct ubifs_auth_node *auth = node;
+- u8 *hash;
++ u8 hash[UBIFS_HASH_ARR_SZ];
+ int err;
+
+- hash = kmalloc(crypto_shash_descsize(c->hash_tfm), GFP_NOFS);
+- if (!hash)
+- return -ENOMEM;
+-
+ {
+ SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm);
+
+@@ -94,21 +90,16 @@ int ubifs_prepare_auth_node(struct ubifs_info *c, void *node,
+
+ err = crypto_shash_final(hash_desc, hash);
+ if (err)
+- goto out;
++ return err;
+ }
+
+ err = ubifs_hash_calc_hmac(c, hash, auth->hmac);
+ if (err)
+- goto out;
++ return err;
+
+ auth->ch.node_type = UBIFS_AUTH_NODE;
+ ubifs_prepare_node(c, auth, ubifs_auth_node_sz(c), 0);
+-
+- err = 0;
+-out:
+- kfree(hash);
+-
+- return err;
++ return 0;
+ }
+
+ static struct shash_desc *ubifs_get_desc(const struct ubifs_info *c,
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index b28ac4dfb407..01fcf7975047 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -601,18 +601,12 @@ static int authenticate_sleb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ struct ubifs_scan_node *snod;
+ int n_nodes = 0;
+ int err;
+- u8 *hash, *hmac;
++ u8 hash[UBIFS_HASH_ARR_SZ];
++ u8 hmac[UBIFS_HMAC_ARR_SZ];
+
+ if (!ubifs_authenticated(c))
+ return sleb->nodes_cnt;
+
+- hash = kmalloc(crypto_shash_descsize(c->hash_tfm), GFP_NOFS);
+- hmac = kmalloc(c->hmac_desc_len, GFP_NOFS);
+- if (!hash || !hmac) {
+- err = -ENOMEM;
+- goto out;
+- }
+-
+ list_for_each_entry(snod, &sleb->nodes, list) {
+
+ n_nodes++;
+@@ -662,9 +656,6 @@ static int authenticate_sleb(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
+ err = 0;
+ }
+ out:
+- kfree(hash);
+- kfree(hmac);
+-
+ return err ? err : n_nodes - n_not_auth;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a3ac2f764e0fda73b9317aeac90023dc07ff93f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Apr 2020 13:33:05 +0200
+Subject: ubifs: remove broken lazytime support
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit ecf84096a526f2632ee85c32a3d05de3fa60ce80 ]
+
+When "ubifs: introduce UBIFS_ATIME_SUPPORT to ubifs" introduced atime
+support to ubifs, it also added lazytime support. As far as I can tell
+the lazytime support is terminally broken, as it causes
+mark_inode_dirty_sync to be called from __writeback_single_inode, which
+will then trigger the locking assert in ubifs_dirty_inode. Just remove
+the broken lazytime support for now, it can be added back later,
+especially as some infrastructure changes should make that easier soon.
+
+Fixes: 8c1c5f263833 ("ubifs: introduce UBIFS_ATIME_SUPPORT to ubifs")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/file.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
+index a771273fba7e..8dada89bbe4d 100644
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -1375,7 +1375,6 @@ int ubifs_update_time(struct inode *inode, struct timespec64 *time,
+ struct ubifs_info *c = inode->i_sb->s_fs_info;
+ struct ubifs_budget_req req = { .dirtied_ino = 1,
+ .dirtied_ino_d = ALIGN(ui->data_len, 8) };
+- int iflags = I_DIRTY_TIME;
+ int err, release;
+
+ if (!IS_ENABLED(CONFIG_UBIFS_ATIME_SUPPORT))
+@@ -1393,11 +1392,8 @@ int ubifs_update_time(struct inode *inode, struct timespec64 *time,
+ if (flags & S_MTIME)
+ inode->i_mtime = *time;
+
+- if (!(inode->i_sb->s_flags & SB_LAZYTIME))
+- iflags |= I_DIRTY_SYNC;
+-
+ release = ui->dirty;
+- __mark_inode_dirty(inode, iflags);
++ __mark_inode_dirty(inode, I_DIRTY_SYNC);
+ mutex_unlock(&ui->ui_mutex);
+ if (release)
+ ubifs_release_budget(c, &req);
+--
+2.25.1
+
--- /dev/null
+From c7a7788b29690467350c047f6c788537c4b29995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 May 2020 16:07:28 -0400
+Subject: USB: core: Fix misleading driver bug report
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+[ Upstream commit ac854131d9844f79e2fdcef67a7707227538d78a ]
+
+The syzbot fuzzer found a race between URB submission to endpoint 0
+and device reset. Namely, during the reset we call usb_ep0_reinit()
+because the characteristics of ep0 may have changed (if the reset
+follows a firmware update, for example). While usb_ep0_reinit() is
+running there is a brief period during which the pointers stored in
+udev->ep_in[0] and udev->ep_out[0] are set to NULL, and if an URB is
+submitted to ep0 during that period, usb_urb_ep_type_check() will
+report it as a driver bug. In the absence of those pointers, the
+routine thinks that the endpoint doesn't exist. The log message looks
+like this:
+
+------------[ cut here ]------------
+usb 2-1: BOGUS urb xfer, pipe 2 != type 2
+WARNING: CPU: 0 PID: 9241 at drivers/usb/core/urb.c:478
+usb_submit_urb+0x1188/0x1460 drivers/usb/core/urb.c:478
+
+Now, although submitting an URB while the device is being reset is a
+questionable thing to do, it shouldn't count as a driver bug as severe
+as submitting an URB for an endpoint that doesn't exist. Indeed,
+endpoint 0 always exists, even while the device is in its unconfigured
+state.
+
+To prevent these misleading driver bug reports, this patch updates
+usb_disable_endpoint() to avoid clearing the ep_in[] and ep_out[]
+pointers when the endpoint being disabled is ep0. There's no danger
+of leaving a stale pointer in place, because the usb_host_endpoint
+structure being pointed to is stored permanently in udev->ep0; it
+doesn't get deallocated until the entire usb_device structure does.
+
+Reported-and-tested-by: syzbot+db339689b2101f6f6071@syzkaller.appspotmail.com
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+
+Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2005011558590.903-100000@netrider.rowland.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/message.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index 02eaac7e1e34..a1ac2f0723b0 100644
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1143,11 +1143,11 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr,
+
+ if (usb_endpoint_out(epaddr)) {
+ ep = dev->ep_out[epnum];
+- if (reset_hardware)
++ if (reset_hardware && epnum != 0)
+ dev->ep_out[epnum] = NULL;
+ } else {
+ ep = dev->ep_in[epnum];
+- if (reset_hardware)
++ if (reset_hardware && epnum != 0)
+ dev->ep_in[epnum] = NULL;
+ }
+ if (ep) {
+--
+2.25.1
+
--- /dev/null
+From aba793a1962d81c472a878cc7f869eb933511ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Apr 2020 17:08:29 +0200
+Subject: vhost/vsock: fix packet delivery order to monitoring devices
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit 107bc0766b9feb5113074c753735a3f115c2141f ]
+
+We want to deliver packets to monitoring devices before it is
+put in the virtqueue, to avoid that replies can appear in the
+packet capture before the transmitted packet.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vsock.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 6c089f655707..ca68a27b98ed 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -181,14 +181,14 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock,
+ break;
+ }
+
+- vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len);
+- added = true;
+-
+- /* Deliver to monitoring devices all correctly transmitted
+- * packets.
++ /* Deliver to monitoring devices all packets that we
++ * will transmit.
+ */
+ virtio_transport_deliver_tap_pkt(pkt);
+
++ vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len);
++ added = true;
++
+ pkt->off += payload_len;
+ total_len += payload_len;
+
+--
+2.25.1
+
--- /dev/null
+From 8f9ba2534561c024f77f40e815ee85c976f608d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 16:55:57 +0200
+Subject: x86/apic: Move TSC deadline timer debug printk
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit c84cb3735fd53c91101ccdb191f2e3331a9262cb ]
+
+Leon reported that the printk_once() in __setup_APIC_LVTT() triggers a
+lockdep splat due to a lock order violation between hrtimer_base::lock and
+console_sem, when the 'once' condition is reset via
+/sys/kernel/debug/clear_warn_once after boot.
+
+The initial printk cannot trigger this because that happens during boot
+when the local APIC timer is set up on the boot CPU.
+
+Prevent it by moving the printk to a place which is guaranteed to be only
+called once during boot.
+
+Mark the deadline timer check related functions and data __init while at
+it.
+
+Reported-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/87y2qhoshi.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 27 ++++++++++++++-------------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index df891f874614..25b8c45467fc 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -352,8 +352,6 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen)
+ * According to Intel, MFENCE can do the serialization here.
+ */
+ asm volatile("mfence" : : : "memory");
+-
+- printk_once(KERN_DEBUG "TSC deadline timer enabled\n");
+ return;
+ }
+
+@@ -552,7 +550,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events);
+ #define DEADLINE_MODEL_MATCH_REV(model, rev) \
+ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)rev }
+
+-static u32 hsx_deadline_rev(void)
++static __init u32 hsx_deadline_rev(void)
+ {
+ switch (boot_cpu_data.x86_stepping) {
+ case 0x02: return 0x3a; /* EP */
+@@ -562,7 +560,7 @@ static u32 hsx_deadline_rev(void)
+ return ~0U;
+ }
+
+-static u32 bdx_deadline_rev(void)
++static __init u32 bdx_deadline_rev(void)
+ {
+ switch (boot_cpu_data.x86_stepping) {
+ case 0x02: return 0x00000011;
+@@ -574,7 +572,7 @@ static u32 bdx_deadline_rev(void)
+ return ~0U;
+ }
+
+-static u32 skx_deadline_rev(void)
++static __init u32 skx_deadline_rev(void)
+ {
+ switch (boot_cpu_data.x86_stepping) {
+ case 0x03: return 0x01000136;
+@@ -587,7 +585,7 @@ static u32 skx_deadline_rev(void)
+ return ~0U;
+ }
+
+-static const struct x86_cpu_id deadline_match[] = {
++static const struct x86_cpu_id deadline_match[] __initconst = {
+ DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_HASWELL_X, hsx_deadline_rev),
+ DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_BROADWELL_X, 0x0b000020),
+ DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_BROADWELL_D, bdx_deadline_rev),
+@@ -609,18 +607,19 @@ static const struct x86_cpu_id deadline_match[] = {
+ {},
+ };
+
+-static void apic_check_deadline_errata(void)
++static __init bool apic_validate_deadline_timer(void)
+ {
+ const struct x86_cpu_id *m;
+ u32 rev;
+
+- if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER) ||
+- boot_cpu_has(X86_FEATURE_HYPERVISOR))
+- return;
++ if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER))
++ return false;
++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
++ return true;
+
+ m = x86_match_cpu(deadline_match);
+ if (!m)
+- return;
++ return true;
+
+ /*
+ * Function pointers will have the MSB set due to address layout,
+@@ -632,11 +631,12 @@ static void apic_check_deadline_errata(void)
+ rev = (u32)m->driver_data;
+
+ if (boot_cpu_data.microcode >= rev)
+- return;
++ return true;
+
+ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
+ pr_err(FW_BUG "TSC_DEADLINE disabled due to Errata; "
+ "please update microcode to version: 0x%x (or later)\n", rev);
++ return false;
+ }
+
+ /*
+@@ -2098,7 +2098,8 @@ void __init init_apic_mappings(void)
+ {
+ unsigned int new_apicid;
+
+- apic_check_deadline_errata();
++ if (apic_validate_deadline_timer())
++ pr_debug("TSC deadline timer available\n");
+
+ if (x2apic_mode) {
+ boot_cpu_physical_apicid = read_apic_id();
+--
+2.25.1
+
--- /dev/null
+From aefa8d9718cfadd5dbaa955ec9e7fe5212cda8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 20:13:55 -0700
+Subject: x86/mm/cpa: Flush direct map alias during cpa
+
+From: Rick Edgecombe <rick.p.edgecombe@intel.com>
+
+[ Upstream commit ab5130186d7476dcee0d4e787d19a521ca552ce9 ]
+
+As an optimization, cpa_flush() was changed to optionally only flush
+the range in @cpa if it was small enough. However, this range does
+not include any direct map aliases changed in cpa_process_alias(). So
+small set_memory_() calls that touch that alias don't get the direct
+map changes flushed. This situation can happen when the virtual
+address taking variants are passed an address in vmalloc or modules
+space.
+
+In these cases, force a full TLB flush.
+
+Note this issue does not extend to cases where the set_memory_() calls are
+passed a direct map address, or page array, etc, as the primary target. In
+those cases the direct map would be flushed.
+
+Fixes: 935f5839827e ("x86/mm/cpa: Optimize cpa_flush_array() TLB invalidation")
+Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20200424105343.GA20730@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pageattr.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index a19a71b4d185..281e584cfe39 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -42,7 +42,8 @@ struct cpa_data {
+ unsigned long pfn;
+ unsigned int flags;
+ unsigned int force_split : 1,
+- force_static_prot : 1;
++ force_static_prot : 1,
++ force_flush_all : 1;
+ struct page **pages;
+ };
+
+@@ -352,10 +353,10 @@ static void cpa_flush(struct cpa_data *data, int cache)
+ return;
+ }
+
+- if (cpa->numpages <= tlb_single_page_flush_ceiling)
+- on_each_cpu(__cpa_flush_tlb, cpa, 1);
+- else
++ if (cpa->force_flush_all || cpa->numpages > tlb_single_page_flush_ceiling)
+ flush_tlb_all();
++ else
++ on_each_cpu(__cpa_flush_tlb, cpa, 1);
+
+ if (!cache)
+ return;
+@@ -1584,6 +1585,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
+ alias_cpa.flags &= ~(CPA_PAGES_ARRAY | CPA_ARRAY);
+ alias_cpa.curpage = 0;
+
++ cpa->force_flush_all = 1;
++
+ ret = __change_page_attr_set_clr(&alias_cpa, 0);
+ if (ret)
+ return ret;
+@@ -1604,6 +1607,7 @@ static int cpa_process_alias(struct cpa_data *cpa)
+ alias_cpa.flags &= ~(CPA_PAGES_ARRAY | CPA_ARRAY);
+ alias_cpa.curpage = 0;
+
++ cpa->force_flush_all = 1;
+ /*
+ * The high mapping range is imprecise, so ignore the
+ * return value.
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
