--- /dev/null
+From 3e2f6551abc472574889938969510e4a8384f863 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2019 17:16:51 +0200
+Subject: ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO
+ polarity
+
+From: Jarkko Nikula <jarkko.nikula@bitmer.com>
+
+[ Upstream commit 287897f9aaa2ad1c923d9875914f57c4dc9159c8 ]
+
+The MMC card detection GPIO polarity is active low on TAO3530, like in many
+other similar boards. Now the card is not detected and it is unable to
+mount rootfs from an SD card.
+
+Fix this by using the correct polarity.
+
+This incorrect polarity was defined already in the commit 30d95c6d7092
+("ARM: dts: omap3: Add Technexion TAO3530 SOM omap3-tao3530.dtsi") in v3.18
+kernel and later changed to use defined GPIO constants in v4.4 kernel by
+the commit 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags
+cell for OMAP2+ boards").
+
+While the latter commit did not introduce the issue I'm marking it with
+Fixes tag due the v4.4 kernels still being maintained.
+
+Fixes: 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags cell for OMAP2+ boards")
+Cc: linux-stable <stable@vger.kernel.org> # 4.4+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-tao3530.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-tao3530.dtsi b/arch/arm/boot/dts/omap3-tao3530.dtsi
+index ae5dbbd9d5692..4f10204c0994c 100644
+--- a/arch/arm/boot/dts/omap3-tao3530.dtsi
++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi
+@@ -225,7 +225,7 @@
+ pinctrl-0 = <&mmc1_pins>;
+ vmmc-supply = <&vmmc1>;
+ vmmc_aux-supply = <&vsim>;
+- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>;
+ bus-width = <8>;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From feddd286d41c42dfcd7d58822f7d7e486986d419 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 16:41:20 +0100
+Subject: Btrfs: fix negative subv_writers counter and data space leak after
+ buffered write
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a0e248bb502d5165b3314ac3819e888fdcdf7d9f ]
+
+When doing a buffered write it's possible to leave the subv_writers
+counter of the root, used for synchronization between buffered nocow
+writers and snapshotting. This happens in an exceptional case like the
+following:
+
+1) We fail to allocate data space for the write, since there's not
+ enough available data space nor enough unallocated space for allocating
+ a new data block group;
+
+2) Because of that failure, we try to go to NOCOW mode, which succeeds
+ and therefore we set the local variable 'only_release_metadata' to true
+ and set the root's sub_writers counter to 1 through the call to
+ btrfs_start_write_no_snapshotting() made by check_can_nocow();
+
+3) The call to btrfs_copy_from_user() returns zero, which is very unlikely
+ to happen but not impossible;
+
+4) No pages are copied because btrfs_copy_from_user() returned zero;
+
+5) We call btrfs_end_write_no_snapshotting() which decrements the root's
+ subv_writers counter to 0;
+
+6) We don't set 'only_release_metadata' back to 'false' because we do
+ it only if 'copied', the value returned by btrfs_copy_from_user(), is
+ greater than zero;
+
+7) On the next iteration of the while loop, which processes the same
+ page range, we are now able to allocate data space for the write (we
+ got enough data space released in the meanwhile);
+
+8) After this if we fail at btrfs_delalloc_reserve_metadata(), because
+ now there isn't enough free metadata space, or in some other place
+ further below (prepare_pages(), lock_and_cleanup_extent_if_need(),
+ btrfs_dirty_pages()), we break out of the while loop with
+ 'only_release_metadata' having a value of 'true';
+
+9) Because 'only_release_metadata' is 'true' we end up decrementing the
+ root's subv_writers counter to -1 (through a call to
+ btrfs_end_write_no_snapshotting()), and we also end up not releasing the
+ data space previously reserved through btrfs_check_data_free_space().
+ As a consequence the mechanism for synchronizing NOCOW buffered writes
+ with snapshotting gets broken.
+
+Fix this by always setting 'only_release_metadata' to false at the start
+of each iteration.
+
+Fixes: 8257b2dc3c1a ("Btrfs: introduce btrfs_{start, end}_nocow_write() for each subvolume")
+Fixes: 7ee9e4405f26 ("Btrfs: check if we can nocow if we don't have data space")
+CC: stable@vger.kernel.org # 4.4+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index d056060529f81..73b547f88bfca 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1525,6 +1525,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
+ }
+
+ reserve_bytes = num_pages << PAGE_CACHE_SHIFT;
++ only_release_metadata = false;
+
+ if ((BTRFS_I(inode)->flags & (BTRFS_INODE_NODATACOW |
+ BTRFS_INODE_PREALLOC)) &&
+@@ -1659,7 +1660,6 @@ again:
+ set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart,
+ lockend, EXTENT_NORESERVE, NULL,
+ NULL, GFP_NOFS);
+- only_release_metadata = false;
+ }
+
+ btrfs_drop_pages(pages, num_pages);
+--
+2.20.1
+
--- /dev/null
+From 86637e5e52ac37053196791a5e3a5bf89dec57ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 20:48:19 +0800
+Subject: e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit cd0d465bb697a9c7bf66a9fe940f7981232f1676 ]
+
+Fix a static code checker warning:
+drivers/net/ethernet/intel/e100.c:1349
+ e100_load_ucode_wait() warn: passing zero to 'PTR_ERR'
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e100.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
+index 068789e694c9b..93c29094ceff9 100644
+--- a/drivers/net/ethernet/intel/e100.c
++++ b/drivers/net/ethernet/intel/e100.c
+@@ -1370,8 +1370,8 @@ static inline int e100_load_ucode_wait(struct nic *nic)
+
+ fw = e100_request_firmware(nic);
+ /* If it's NULL, then no ucode is required */
+- if (!fw || IS_ERR(fw))
+- return PTR_ERR(fw);
++ if (IS_ERR_OR_NULL(fw))
++ return PTR_ERR_OR_ZERO(fw);
+
+ if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode)))
+ netif_err(nic, probe, nic->netdev,
+--
+2.20.1
+
--- /dev/null
+From 7cd6a80fc6b5728d8f80fb3b1ca450481729555c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 17:33:49 +0100
+Subject: iio: adis16480: Add debugfs_reg_access entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+[ Upstream commit 4c35b7a51e2f291471f7221d112c6a45c63e83bc ]
+
+The driver is defining debugfs entries by calling
+`adis16480_debugfs_init()`. However, those entries are attached to the
+iio_dev debugfs entry which won't exist if no debugfs_reg_access
+callback is provided.
+
+Fixes: 2f3abe6cbb6c ("iio:imu: Add support for the ADIS16480 and similar IMUs")
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/adis16480.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index 778a46247f8de..eeed374ebc6c5 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -724,6 +724,7 @@ static const struct iio_info adis16480_info = {
+ .write_raw = &adis16480_write_raw,
+ .update_scan_mode = adis_update_scan_mode,
+ .driver_module = THIS_MODULE,
++ .debugfs_reg_access = adis_debugfs_reg_access,
+ };
+
+ static int adis16480_stop_device(struct iio_dev *indio_dev)
+--
+2.20.1
+
--- /dev/null
+From 9a2bd4ede5a53a11d32069fb297df0ff8a061796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2019 18:27:09 +0200
+Subject: pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup
+ controller init
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 7f028caadf6c37580d0f59c6c094ed09afc04062 ]
+
+In s3c64xx_eint_eint0_init() the for_each_child_of_node() loop is used
+with a break to find a matching child node. Although each iteration of
+for_each_child_of_node puts the previous node, but early exit from loop
+misses it. This leads to leak of device node.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 61dd72613177 ("pinctrl: Add pinctrl-s3c64xx driver")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/samsung/pinctrl-s3c64xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+index 43407ab248f51..0cd9f3a7bb11a 100644
+--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+@@ -713,6 +713,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d)
+ data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+ if (!data) {
+ dev_err(dev, "could not allocate memory for wkup eint data\n");
++ of_node_put(eint0_np);
+ return -ENOMEM;
+ }
+ data->drvdata = d;
+@@ -723,6 +724,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d)
+ irq = irq_of_parse_and_map(eint0_np, i);
+ if (!irq) {
+ dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i);
++ of_node_put(eint0_np);
+ return -ENXIO;
+ }
+
+@@ -730,6 +732,7 @@ static int s3c64xx_eint_eint0_init(struct samsung_pinctrl_drv_data *d)
+ s3c64xx_eint0_handlers[i],
+ data);
+ }
++ of_node_put(eint0_np);
+
+ bank = d->pin_banks;
+ for (i = 0; i < d->nr_banks; ++i, ++bank) {
+--
+2.20.1
+
--- /dev/null
+From 69255c84e39f55a47ea78004a739c17b487cb3f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:33 -0800
+Subject: scsi: lpfc: Cap NPIV vports to 256
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 8b47ae69e049ae0b3373859d901f0334322f9fe9 ]
+
+Depending on the chipset, the number of NPIV vports may vary and be in
+excess of what most switches support (256). To avoid confusion with the
+users, limit the reported NPIV vports to 256.
+
+Additionally correct the 16G adapter which is reporting a bogus NPIV vport
+number if the link is down.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc.h | 3 ++-
+ drivers/scsi/lpfc/lpfc_attr.c | 12 ++++++++++--
+ drivers/scsi/lpfc/lpfc_init.c | 3 +++
+ 3 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index ceee9a3fd9e52..a1a9cb952414c 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -867,7 +867,8 @@ struct lpfc_hba {
+ struct list_head port_list;
+ struct lpfc_vport *pport; /* physical lpfc_vport pointer */
+ uint16_t max_vpi; /* Maximum virtual nports */
+-#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */
++#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */
++#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */
+ uint16_t max_vports; /*
+ * For IOV HBAs max_vpi can change
+ * after a reset. max_vports is max
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index f096766150bc9..93092dfba2937 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1213,6 +1213,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
+ max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ?
+ (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0;
+
++ /* Limit the max we support */
++ if (max_vpi > LPFC_MAX_VPI)
++ max_vpi = LPFC_MAX_VPI;
+ if (mvpi)
+ *mvpi = max_vpi;
+ if (avpi)
+@@ -1228,8 +1231,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
+ *axri = pmb->un.varRdConfig.avail_xri;
+ if (mvpi)
+ *mvpi = pmb->un.varRdConfig.max_vpi;
+- if (avpi)
+- *avpi = pmb->un.varRdConfig.avail_vpi;
++ if (avpi) {
++ /* avail_vpi is only valid if link is up and ready */
++ if (phba->link_state == LPFC_HBA_READY)
++ *avpi = pmb->un.varRdConfig.avail_vpi;
++ else
++ *avpi = pmb->un.varRdConfig.max_vpi;
++ }
+ }
+
+ mempool_free(pmboxq, phba->mbox_mem_pool);
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 7e06fd6127ccb..1a7ac17534d6b 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -6890,6 +6890,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba)
+ bf_get(lpfc_mbx_rd_conf_xri_base, rd_config);
+ phba->sli4_hba.max_cfg_param.max_vpi =
+ bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config);
++ /* Limit the max we support */
++ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS)
++ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS;
+ phba->sli4_hba.max_cfg_param.vpi_base =
+ bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config);
+ phba->sli4_hba.max_cfg_param.max_rpi =
+--
+2.20.1
+
--- /dev/null
+From 385c681bcc752eaab98a5b4ee146b26610282470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 20:01:52 -0700
+Subject: scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return
+ value
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit e6803efae5acd109fad9f2f07dab674563441a53 ]
+
+This patch fixes several Coverity complaints about not always checking
+the qla2x00_wait_for_hba_online() return value.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_attr.c | 3 ++-
+ drivers/scsi/qla2xxx/qla_target.c | 7 +++++--
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 31c29a5d1f389..b8765c55906c9 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -760,7 +760,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
+ break;
+ } else {
+ /* Make sure FC side is not in reset */
+- qla2x00_wait_for_hba_online(vha);
++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) !=
++ QLA_SUCCESS);
+
+ /* Issue MPI reset */
+ scsi_block_requests(vha->host);
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 6c4f54aa60df6..1d9f19e5e0f81 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -6026,7 +6026,8 @@ qlt_enable_vha(struct scsi_qla_host *vha)
+ } else {
+ set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
+ qla2xxx_wake_dpc(base_vha);
+- qla2x00_wait_for_hba_online(base_vha);
++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) !=
++ QLA_SUCCESS);
+ }
+ }
+ EXPORT_SYMBOL(qlt_enable_vha);
+@@ -6056,7 +6057,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha)
+
+ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+ qla2xxx_wake_dpc(vha);
+- qla2x00_wait_for_hba_online(vha);
++ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS)
++ ql_dbg(ql_dbg_tgt, vha, 0xe081,
++ "qla2x00_wait_for_hba_online() failed\n");
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From c072399065077d381742b0fc26bfe22cb934272a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2019 09:07:26 -0700
+Subject: scsi: qla2xxx: Fix DMA unmap leak
+
+From: Himanshu Madhani <hmadhani@marvell.com>
+
+[ Upstream commit 5d328de64d89400dcf9911125844d8adc0db697f ]
+
+With debug kernel we see following wanings indicating memory leak.
+
+[28809.523959] WARNING: CPU: 3 PID: 6790 at lib/dma-debug.c:978
+dma_debug_device_change+0x166/0x1d0
+[28809.523964] pci 0000:0c:00.6: DMA-API: device driver has pending DMA
+allocations while released from device [count=5]
+[28809.523964] One of leaked entries details: [device
+address=0x00000002aefe4000] [size=8208 bytes] [mapped with DMA_BIDIRECTIONAL]
+[mapped as coherent]
+
+Fix this by unmapping DMA memory.
+
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index 2d5375d677367..df856a2895ae1 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -336,6 +336,8 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job)
+ dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list,
+ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE);
+ if (!req_sg_cnt) {
++ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list,
++ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE);
+ rval = -ENOMEM;
+ goto done_free_fcport;
+ }
+@@ -343,6 +345,8 @@ qla2x00_process_els(struct fc_bsg_job *bsg_job)
+ rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list,
+ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+ if (!rsp_sg_cnt) {
++ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list,
++ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+ rval = -ENOMEM;
+ goto done_free_fcport;
+ }
+--
+2.20.1
+
--- /dev/null
+From b40e1cbacfdc79ca5e9885a257f4d68fa16b0732 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 16:20:02 +0200
+Subject: scsi: qla2xxx: Fix message indicating vectors used by driver
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 16561db45eec03368cbfcf96ab11faf59fca58a9 ]
+
+[ Upstream commit da48b82425b8bf999fb9f7c220e967c4d661b5f8 ]
+
+This patch updates log message which indicates number of vectors used by
+the driver instead of displaying failure to get maximum requested
+vectors. Driver will always request maximum vectors during
+initialization. In the event driver is not able to get maximum requested
+vectors, it will adjust the allocated vectors. This is normal and does not
+imply failure in driver.
+
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Link: https://lore.kernel.org/r/20190830222402.23688-2-hmadhani@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mem.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 0ec809a35a3f0..c851918a50fe5 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1928,10 +1928,14 @@ no_bw:
+ kfree(xhci->port_array);
+ kfree(xhci->rh_bw);
+ kfree(xhci->ext_caps);
++ kfree(xhci->usb2_rhub.psi);
++ kfree(xhci->usb3_rhub.psi);
+
+ xhci->usb2_ports = NULL;
+ xhci->usb3_ports = NULL;
+ xhci->port_array = NULL;
++ xhci->usb2_rhub.psi = NULL;
++ xhci->usb3_rhub.psi = NULL;
+ xhci->rh_bw = NULL;
+ xhci->ext_caps = NULL;
+
+--
+2.20.1
+
--- /dev/null
+From 2d821ba07d6bd62b14c5a734243d1688fc5bd872 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 20:01:48 -0700
+Subject: scsi: qla2xxx: Fix qla24xx_process_bidir_cmd()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c29282c65d1cf54daeea63be46243d7f69d72f4d ]
+
+Set the r??_data_len variables before using these instead of after.
+
+This patch fixes the following Coverity complaint:
+
+const: At condition req_data_len != rsp_data_len, the value of req_data_len
+must be equal to 0.
+const: At condition req_data_len != rsp_data_len, the value of rsp_data_len
+must be equal to 0.
+dead_error_condition: The condition req_data_len != rsp_data_len cannot be
+true.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Fixes: a9b6f722f62d ("[SCSI] qla2xxx: Implementation of bidirectional.") # v3.7.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index df856a2895ae1..68ec6695b48c7 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -1743,8 +1743,8 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job)
+ uint16_t nextlid = 0;
+ uint32_t tot_dsds;
+ srb_t *sp = NULL;
+- uint32_t req_data_len = 0;
+- uint32_t rsp_data_len = 0;
++ uint32_t req_data_len;
++ uint32_t rsp_data_len;
+
+ /* Check the type of the adapter */
+ if (!IS_BIDI_CAPABLE(ha)) {
+@@ -1849,6 +1849,9 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job)
+ goto done_unmap_sg;
+ }
+
++ req_data_len = bsg_job->request_payload.payload_len;
++ rsp_data_len = bsg_job->reply_payload.payload_len;
++
+ if (req_data_len != rsp_data_len) {
+ rval = EXT_STATUS_BUSY;
+ ql_log(ql_log_warn, vha, 0x70aa,
+@@ -1856,10 +1859,6 @@ qla24xx_process_bidir_cmd(struct fc_bsg_job *bsg_job)
+ goto done_unmap_sg;
+ }
+
+- req_data_len = bsg_job->request_payload.payload_len;
+- rsp_data_len = bsg_job->reply_payload.payload_len;
+-
+-
+ /* Alloc SRB structure */
+ sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL);
+ if (!sp) {
+--
+2.20.1
+
--- /dev/null
+From a6dc14b0fa2f8efcad734fb576a60d8b0c36172d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 18:12:53 +0200
+Subject: scsi: zfcp: trace channel log even for FCP command responses
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+[ Upstream commit 100843f176109af94600e500da0428e21030ca7f ]
+
+While v2.6.26 commit b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug
+trace") is right that we don't want to flood the (payload) trace ring
+buffer, we don't trace successful FCP command responses by default. So we
+can include the channel log for problem determination with failed responses
+of any FSF request type.
+
+Fixes: b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug trace")
+Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
+Cc: <stable@vger.kernel.org> #2.6.38+
+Link: https://lore.kernel.org/r/e37597b5c4ae123aaa85fd86c23a9f71e994e4a9.1572018132.git.bblock@linux.ibm.com
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_dbf.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
+index b6caad0fee24c..c53ea0ac5f460 100644
+--- a/drivers/s390/scsi/zfcp_dbf.c
++++ b/drivers/s390/scsi/zfcp_dbf.c
+@@ -93,11 +93,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req)
+ memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual,
+ FSF_STATUS_QUALIFIER_SIZE);
+
+- if (req->fsf_command != FSF_QTCB_FCP_CMND) {
+- rec->pl_len = q_head->log_length;
+- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start,
+- rec->pl_len, "fsf_res", req->req_id);
+- }
++ rec->pl_len = q_head->log_length;
++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start,
++ rec->pl_len, "fsf_res", req->req_id);
+
+ debug_event(dbf->hba, level, rec, sizeof(*rec));
+ spin_unlock_irqrestore(&dbf->hba_lock, flags);
+--
+2.20.1
+
video-hdmi-fix-avi-bar-unpack.patch
quota-check-that-quota-is-not-dirty-before-release.patch
quota-fix-livelock-in-dquot_writeback_dquots.patch
+scsi-zfcp-trace-channel-log-even-for-fcp-command-res.patch
+usb-xhci-only-set-d3hot-for-pci-device.patch
+scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch
+xhci-make-sure-interrupts-are-restored-to-correct-st.patch
+iio-adis16480-add-debugfs_reg_access-entry.patch
+btrfs-fix-negative-subv_writers-counter-and-data-spa.patch
+scsi-lpfc-cap-npiv-vports-to-256.patch
+e100-fix-passing-zero-to-ptr_err-warning-in-e100_loa.patch
+x86-mce-amd-turn-off-mc4_misc-thresholding-on-all-fa.patch
+arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detecti.patch
+pinctrl-samsung-fix-device-node-refcount-leaks-in-s3.patch
+scsi-qla2xxx-fix-dma-unmap-leak.patch
+scsi-qla2xxx-fix-qla24xx_process_bidir_cmd.patch
+scsi-qla2xxx-always-check-the-qla2x00_wait_for_hba_o.patch
--- /dev/null
+From 73b0dddb184eb24fd039ae19e76e4dc7c8bfc8bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 16:20:04 +0200
+Subject: usb: xhci: only set D3hot for pci device
+
+From: Henry Lin <henryl@nvidia.com>
+
+[ Upstream commit f2c710f7dca8457e88b4ac9de2060f011254f9dd ]
+
+Xhci driver cannot call pci_set_power_state() on non-pci xhci host
+controllers. For example, NVIDIA Tegra XHCI host controller which acts
+as platform device with XHCI_SPURIOUS_WAKEUP quirk set in some platform
+hits this issue during shutdown.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell")
+Signed-off-by: Henry Lin <henryl@nvidia.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20191211142007.8847-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 13 +++++++++++++
+ drivers/usb/host/xhci.c | 5 +----
+ drivers/usb/host/xhci.h | 1 +
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index d6e2199bcfe57..bda176fa6e488 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -446,6 +446,18 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ }
+ #endif /* CONFIG_PM */
+
++static void xhci_pci_shutdown(struct usb_hcd *hcd)
++{
++ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct pci_dev *pdev = to_pci_dev(hcd->self.controller);
++
++ xhci_shutdown(hcd);
++
++ /* Yet another workaround for spurious wakeups at shutdown with HSW */
++ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
++ pci_set_power_state(pdev, PCI_D3hot);
++}
++
+ /*-------------------------------------------------------------------------*/
+
+ /* PCI driver selection metadata; PCI hotplugging uses this */
+@@ -481,6 +493,7 @@ static int __init xhci_pci_init(void)
+ #ifdef CONFIG_PM
+ xhci_pci_hc_driver.pci_suspend = xhci_pci_suspend;
+ xhci_pci_hc_driver.pci_resume = xhci_pci_resume;
++ xhci_pci_hc_driver.shutdown = xhci_pci_shutdown;
+ #endif
+ return pci_register_driver(&xhci_pci_driver);
+ }
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 7a0db7fb731ee..af4e68152776e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -754,11 +754,8 @@ void xhci_shutdown(struct usb_hcd *hcd)
+ xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+ "xhci_shutdown completed - status = %x",
+ readl(&xhci->op_regs->status));
+-
+- /* Yet another workaround for spurious wakeups at shutdown with HSW */
+- if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+- pci_set_power_state(to_pci_dev(hcd->self.controller), PCI_D3hot);
+ }
++EXPORT_SYMBOL_GPL(xhci_shutdown);
+
+ #ifdef CONFIG_PM
+ static void xhci_save_registers(struct xhci_hcd *xhci)
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index b57bee70cdef2..e23e3a381672d 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1833,6 +1833,7 @@ int xhci_run(struct usb_hcd *hcd);
+ void xhci_stop(struct usb_hcd *hcd);
+ void xhci_shutdown(struct usb_hcd *hcd);
+ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
++void xhci_shutdown(struct usb_hcd *hcd);
+ void xhci_init_driver(struct hc_driver *drv,
+ const struct xhci_driver_overrides *over);
+
+--
+2.20.1
+
--- /dev/null
+From 68281791a6312d441860559abfe4aaaef23063b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 07:54:40 +0000
+Subject: x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models
+
+From: Shirish S <Shirish.S@amd.com>
+
+[ Upstream commit c95b323dcd3598dd7ef5005d6723c1ba3b801093 ]
+
+MC4_MISC thresholding is not supported on all family 0x15 processors,
+hence skip the x86_model check when applying the quirk.
+
+ [ bp: massage commit message. ]
+
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1547106849-3476-2-git-send-email-shirish.s@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 4b9cfdcc3aaa3..605395bbf0d82 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1536,11 +1536,10 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
+ mce_flags.overflow_recov = 1;
+
+ /*
+- * Turn off MC4_MISC thresholding banks on those models since
++ * Turn off MC4_MISC thresholding banks on all models since
+ * they're not supported there.
+ */
+- if (c->x86 == 0x15 &&
+- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) {
++ if (c->x86 == 0x15) {
+ int i;
+ u64 hwcr;
+ bool need_toggle;
+--
+2.20.1
+
--- /dev/null
+From 60fea87df58eca5b5f9c25482fc878ae4fb16d8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 16:20:07 +0200
+Subject: xhci: make sure interrupts are restored to correct state
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit bd82873f23c9a6ad834348f8b83f3b6a5bca2c65 ]
+
+spin_unlock_irqrestore() might be called with stale flags after
+reading port status, possibly restoring interrupts to a incorrect
+state.
+
+If a usb2 port just finished resuming while the port status is read
+the spin lock will be temporary released and re-acquired in a separate
+function. The flags parameter is passed as value instead of a pointer,
+not updating flags properly before the final spin_unlock_irqrestore()
+is called.
+
+Cc: <stable@vger.kernel.org> # v3.12+
+Fixes: 8b3d45705e54 ("usb: Fix xHCI host issues on remote wakeup.")
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20191211142007.8847-7-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 421825b44202b..bd31b016c51db 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -704,7 +704,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ struct xhci_bus_state *bus_state,
+ __le32 __iomem **port_array,
+ u16 wIndex, u32 raw_port_status,
+- unsigned long flags)
++ unsigned long *flags)
+ __releases(&xhci->lock)
+ __acquires(&xhci->lock)
+ {
+@@ -786,12 +786,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ xhci_set_link_state(xhci, port_array, wIndex,
+ XDEV_U0);
+
+- spin_unlock_irqrestore(&xhci->lock, flags);
++ spin_unlock_irqrestore(&xhci->lock, *flags);
+ time_left = wait_for_completion_timeout(
+ &bus_state->rexit_done[wIndex],
+ msecs_to_jiffies(
+ XHCI_MAX_REXIT_TIMEOUT_MS));
+- spin_lock_irqsave(&xhci->lock, flags);
++ spin_lock_irqsave(&xhci->lock, *flags);
+
+ if (time_left) {
+ slot_id = xhci_find_slot_id_by_port(hcd,
+@@ -937,7 +937,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ break;
+ }
+ status = xhci_get_port_status(hcd, bus_state, port_array,
+- wIndex, temp, flags);
++ wIndex, temp, &flags);
+ if (status == 0xffffffff)
+ goto error;
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
