--- /dev/null
+From 37e97e6faeabda405d0c4319f8419dcc3da14b2b Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Fri, 24 Jan 2020 15:36:20 -0600
+Subject: ASoC: SOF: core: free trace on errors
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+commit 37e97e6faeabda405d0c4319f8419dcc3da14b2b upstream.
+
+free_trace() is not called on probe errors, fix
+
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200124213625.30186-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/sof/core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/sof/core.c
++++ b/sound/soc/sof/core.c
+@@ -394,7 +394,7 @@ static int sof_probe_continue(struct snd
+ if (ret < 0) {
+ dev_err(sdev->dev,
+ "error: failed to register DSP DAI driver %d\n", ret);
+- goto fw_run_err;
++ goto fw_trace_err;
+ }
+
+ drv_name = plat_data->machine->drv_name;
+@@ -408,7 +408,7 @@ static int sof_probe_continue(struct snd
+
+ if (IS_ERR(plat_data->pdev_mach)) {
+ ret = PTR_ERR(plat_data->pdev_mach);
+- goto fw_run_err;
++ goto fw_trace_err;
+ }
+
+ dev_dbg(sdev->dev, "created machine %s\n",
+@@ -420,6 +420,8 @@ static int sof_probe_continue(struct snd
+ return 0;
+
+ #if !IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE)
++fw_trace_err:
++ snd_sof_free_trace(sdev);
+ fw_run_err:
+ snd_sof_fw_unload(sdev);
+ fw_load_err:
+@@ -437,6 +439,7 @@ dbg_err:
+ * snd_sof_device_remove() when the PCI/ACPI device is removed
+ */
+
++fw_trace_err:
+ fw_run_err:
+ fw_load_err:
+ ipc_err:
--- /dev/null
+From 961b91a93ea27495022b2bdc3ca0f608f2c97b5f Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Fri, 31 Jan 2020 09:19:01 +0000
+Subject: ASoC: tegra: Revert 24 and 32 bit support
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+commit 961b91a93ea27495022b2bdc3ca0f608f2c97b5f upstream.
+
+Commit f3ee99087c8ca0ecfdd549ef5a94f557c42d5428 ("ASoC: tegra: Allow
+24bit and 32bit samples") added 24-bit and 32-bit support for to the
+Tegra30 I2S driver. However, there are two additional commits that are
+also needed to get 24-bit and 32-bit support to work correctly. These
+commits are not yet applied because there are still some review comments
+that need to be addressed. With only this change applied, 24-bit and
+32-bit support is advertised by the I2S driver, but it does not work and
+the audio is distorted. Therefore, revert this patch for now until the
+other changes are also ready.
+
+Furthermore, a clock issue with 24-bit support has been identified with
+this change and so if we revert this now, we can also fix that in the
+updated version.
+
+Reported-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20200131091901.13014-1-jonathanh@nvidia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/tegra/tegra30_i2s.c | 25 +++++--------------------
+ 1 file changed, 5 insertions(+), 20 deletions(-)
+
+--- a/sound/soc/tegra/tegra30_i2s.c
++++ b/sound/soc/tegra/tegra30_i2s.c
+@@ -127,7 +127,7 @@ static int tegra30_i2s_hw_params(struct
+ struct device *dev = dai->dev;
+ struct tegra30_i2s *i2s = snd_soc_dai_get_drvdata(dai);
+ unsigned int mask, val, reg;
+- int ret, sample_size, srate, i2sclock, bitcnt, audio_bits;
++ int ret, sample_size, srate, i2sclock, bitcnt;
+ struct tegra30_ahub_cif_conf cif_conf;
+
+ if (params_channels(params) != 2)
+@@ -137,19 +137,8 @@ static int tegra30_i2s_hw_params(struct
+ switch (params_format(params)) {
+ case SNDRV_PCM_FORMAT_S16_LE:
+ val = TEGRA30_I2S_CTRL_BIT_SIZE_16;
+- audio_bits = TEGRA30_AUDIOCIF_BITS_16;
+ sample_size = 16;
+ break;
+- case SNDRV_PCM_FORMAT_S24_LE:
+- val = TEGRA30_I2S_CTRL_BIT_SIZE_24;
+- audio_bits = TEGRA30_AUDIOCIF_BITS_24;
+- sample_size = 24;
+- break;
+- case SNDRV_PCM_FORMAT_S32_LE:
+- val = TEGRA30_I2S_CTRL_BIT_SIZE_32;
+- audio_bits = TEGRA30_AUDIOCIF_BITS_32;
+- sample_size = 32;
+- break;
+ default:
+ return -EINVAL;
+ }
+@@ -181,8 +170,8 @@ static int tegra30_i2s_hw_params(struct
+ cif_conf.threshold = 0;
+ cif_conf.audio_channels = 2;
+ cif_conf.client_channels = 2;
+- cif_conf.audio_bits = audio_bits;
+- cif_conf.client_bits = audio_bits;
++ cif_conf.audio_bits = TEGRA30_AUDIOCIF_BITS_16;
++ cif_conf.client_bits = TEGRA30_AUDIOCIF_BITS_16;
+ cif_conf.expand = 0;
+ cif_conf.stereo_conv = 0;
+ cif_conf.replicate = 0;
+@@ -317,18 +306,14 @@ static const struct snd_soc_dai_driver t
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_96000,
+- .formats = SNDRV_PCM_FMTBIT_S32_LE |
+- SNDRV_PCM_FMTBIT_S24_LE |
+- SNDRV_PCM_FMTBIT_S16_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ .capture = {
+ .stream_name = "Capture",
+ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_96000,
+- .formats = SNDRV_PCM_FMTBIT_S32_LE |
+- SNDRV_PCM_FMTBIT_S24_LE |
+- SNDRV_PCM_FMTBIT_S16_LE,
++ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ },
+ .ops = &tegra30_i2s_dai_ops,
+ .symmetric_rates = 1,
--- /dev/null
+From 8ce1cbd6ce0b1bda0c980c64fee4c1e1378355f1 Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 22 Jan 2020 20:07:52 +0100
+Subject: ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 8ce1cbd6ce0b1bda0c980c64fee4c1e1378355f1 upstream.
+
+The code which checks the return value for snd_soc_add_dai_link() call
+in soc_tplg_fe_link_create() moved the snd_soc_add_dai_link() call before
+link->dobj members initialization.
+
+While it does not affect the latest kernels, the old soc-core.c code
+in the stable kernels is affected. The snd_soc_add_dai_link() function uses
+the link->dobj.type member to check, if the link structure is valid.
+
+Reorder the link->dobj initialization to make things work again.
+It's harmless for the recent code (and the structure should be properly
+initialized before other calls anyway).
+
+The problem is in stable linux-5.4.y since version 5.4.11 when the
+upstream commit 76d270364932 was applied.
+
+Fixes: 76d270364932 ("ASoC: topology: Check return value for snd_soc_add_dai_link()")
+Cc: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20200122190752.3081016-1-perex@perex.cz
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-topology.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1906,6 +1906,10 @@ static int soc_tplg_fe_link_create(struc
+ link->num_codecs = 1;
+ link->num_platforms = 1;
+
++ link->dobj.index = tplg->index;
++ link->dobj.ops = tplg->ops;
++ link->dobj.type = SND_SOC_DOBJ_DAI_LINK;
++
+ if (strlen(pcm->pcm_name)) {
+ link->name = kstrdup(pcm->pcm_name, GFP_KERNEL);
+ link->stream_name = kstrdup(pcm->pcm_name, GFP_KERNEL);
+@@ -1942,9 +1946,6 @@ static int soc_tplg_fe_link_create(struc
+ goto err;
+ }
+
+- link->dobj.index = tplg->index;
+- link->dobj.ops = tplg->ops;
+- link->dobj.type = SND_SOC_DOBJ_DAI_LINK;
+ list_add(&link->dobj.list, &tplg->comp->dobj_list);
+
+ return 0;
--- /dev/null
+From 41ddb7e1f79693d904502ae9bea609837973eff8 Mon Sep 17 00:00:00 2001
+From: Thomas Renninger <trenn@suse.de>
+Date: Fri, 17 Jan 2020 08:55:54 +0100
+Subject: cpupower: Revert library ABI changes from commit ae2917093fb60bdc1ed3e
+
+From: Thomas Renninger <trenn@suse.de>
+
+commit 41ddb7e1f79693d904502ae9bea609837973eff8 upstream.
+
+Commit ae2917093fb6 ("tools/power/cpupower: Display boost frequency
+separately") modified the library function:
+
+struct cpufreq_available_frequencies
+*cpufreq_get_available_frequencies(unsigned int cpu)
+
+to
+struct cpufreq_frequencies
+*cpufreq_get_frequencies(const char *type, unsigned int cpu)
+
+This patch recovers the old API and implements the new functionality
+in a newly introduce method:
+struct cpufreq_boost_frequencies
+*cpufreq_get_available_frequencies(unsigned int cpu)
+
+This one should get merged into stable kernels back to 5.0 when
+the above had been introduced.
+
+Fixes: ae2917093fb6 ("tools/power/cpupower: Display boost frequency separately")
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/power/cpupower/lib/cpufreq.c | 78 ++++++++++++++++++++++++++----
+ tools/power/cpupower/lib/cpufreq.h | 20 +++++--
+ tools/power/cpupower/utils/cpufreq-info.c | 12 ++--
+ 3 files changed, 87 insertions(+), 23 deletions(-)
+
+--- a/tools/power/cpupower/lib/cpufreq.c
++++ b/tools/power/cpupower/lib/cpufreq.c
+@@ -332,21 +332,74 @@ void cpufreq_put_available_governors(str
+ }
+
+
+-struct cpufreq_frequencies
+-*cpufreq_get_frequencies(const char *type, unsigned int cpu)
++struct cpufreq_available_frequencies
++*cpufreq_get_available_frequencies(unsigned int cpu)
+ {
+- struct cpufreq_frequencies *first = NULL;
+- struct cpufreq_frequencies *current = NULL;
++ struct cpufreq_available_frequencies *first = NULL;
++ struct cpufreq_available_frequencies *current = NULL;
+ char one_value[SYSFS_PATH_MAX];
+ char linebuf[MAX_LINE_LEN];
+- char fname[MAX_LINE_LEN];
+ unsigned int pos, i;
+ unsigned int len;
+
+- snprintf(fname, MAX_LINE_LEN, "scaling_%s_frequencies", type);
++ len = sysfs_cpufreq_read_file(cpu, "scaling_available_frequencies",
++ linebuf, sizeof(linebuf));
++ if (len == 0)
++ return NULL;
++
++ pos = 0;
++ for (i = 0; i < len; i++) {
++ if (linebuf[i] == ' ' || linebuf[i] == '\n') {
++ if (i - pos < 2)
++ continue;
++ if (i - pos >= SYSFS_PATH_MAX)
++ goto error_out;
++ if (current) {
++ current->next = malloc(sizeof(*current));
++ if (!current->next)
++ goto error_out;
++ current = current->next;
++ } else {
++ first = malloc(sizeof(*first));
++ if (!first)
++ goto error_out;
++ current = first;
++ }
++ current->first = first;
++ current->next = NULL;
++
++ memcpy(one_value, linebuf + pos, i - pos);
++ one_value[i - pos] = '\0';
++ if (sscanf(one_value, "%lu", ¤t->frequency) != 1)
++ goto error_out;
++
++ pos = i + 1;
++ }
++ }
++
++ return first;
++
++ error_out:
++ while (first) {
++ current = first->next;
++ free(first);
++ first = current;
++ }
++ return NULL;
++}
+
+- len = sysfs_cpufreq_read_file(cpu, fname,
+- linebuf, sizeof(linebuf));
++struct cpufreq_available_frequencies
++*cpufreq_get_boost_frequencies(unsigned int cpu)
++{
++ struct cpufreq_available_frequencies *first = NULL;
++ struct cpufreq_available_frequencies *current = NULL;
++ char one_value[SYSFS_PATH_MAX];
++ char linebuf[MAX_LINE_LEN];
++ unsigned int pos, i;
++ unsigned int len;
++
++ len = sysfs_cpufreq_read_file(cpu, "scaling_boost_frequencies",
++ linebuf, sizeof(linebuf));
+ if (len == 0)
+ return NULL;
+
+@@ -391,9 +444,9 @@ struct cpufreq_frequencies
+ return NULL;
+ }
+
+-void cpufreq_put_frequencies(struct cpufreq_frequencies *any)
++void cpufreq_put_available_frequencies(struct cpufreq_available_frequencies *any)
+ {
+- struct cpufreq_frequencies *tmp, *next;
++ struct cpufreq_available_frequencies *tmp, *next;
+
+ if (!any)
+ return;
+@@ -406,6 +459,11 @@ void cpufreq_put_frequencies(struct cpuf
+ }
+ }
+
++void cpufreq_put_boost_frequencies(struct cpufreq_available_frequencies *any)
++{
++ cpufreq_put_available_frequencies(any);
++}
++
+ static struct cpufreq_affected_cpus *sysfs_get_cpu_list(unsigned int cpu,
+ const char *file)
+ {
+--- a/tools/power/cpupower/lib/cpufreq.h
++++ b/tools/power/cpupower/lib/cpufreq.h
+@@ -20,10 +20,10 @@ struct cpufreq_available_governors {
+ struct cpufreq_available_governors *first;
+ };
+
+-struct cpufreq_frequencies {
++struct cpufreq_available_frequencies {
+ unsigned long frequency;
+- struct cpufreq_frequencies *next;
+- struct cpufreq_frequencies *first;
++ struct cpufreq_available_frequencies *next;
++ struct cpufreq_available_frequencies *first;
+ };
+
+
+@@ -124,11 +124,17 @@ void cpufreq_put_available_governors(
+ * cpufreq_put_frequencies after use.
+ */
+
+-struct cpufreq_frequencies
+-*cpufreq_get_frequencies(const char *type, unsigned int cpu);
++struct cpufreq_available_frequencies
++*cpufreq_get_available_frequencies(unsigned int cpu);
+
+-void cpufreq_put_frequencies(
+- struct cpufreq_frequencies *first);
++void cpufreq_put_available_frequencies(
++ struct cpufreq_available_frequencies *first);
++
++struct cpufreq_available_frequencies
++*cpufreq_get_boost_frequencies(unsigned int cpu);
++
++void cpufreq_put_boost_frequencies(
++ struct cpufreq_available_frequencies *first);
+
+
+ /* determine affected CPUs
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -244,14 +244,14 @@ static int get_boost_mode_x86(unsigned i
+
+ static int get_boost_mode(unsigned int cpu)
+ {
+- struct cpufreq_frequencies *freqs;
++ struct cpufreq_available_frequencies *freqs;
+
+ if (cpupower_cpu_info.vendor == X86_VENDOR_AMD ||
+ cpupower_cpu_info.vendor == X86_VENDOR_HYGON ||
+ cpupower_cpu_info.vendor == X86_VENDOR_INTEL)
+ return get_boost_mode_x86(cpu);
+
+- freqs = cpufreq_get_frequencies("boost", cpu);
++ freqs = cpufreq_get_boost_frequencies(cpu);
+ if (freqs) {
+ printf(_(" boost frequency steps: "));
+ while (freqs->next) {
+@@ -261,7 +261,7 @@ static int get_boost_mode(unsigned int c
+ }
+ print_speed(freqs->frequency);
+ printf("\n");
+- cpufreq_put_frequencies(freqs);
++ cpufreq_put_available_frequencies(freqs);
+ }
+
+ return 0;
+@@ -475,7 +475,7 @@ static int get_latency(unsigned int cpu,
+
+ static void debug_output_one(unsigned int cpu)
+ {
+- struct cpufreq_frequencies *freqs;
++ struct cpufreq_available_frequencies *freqs;
+
+ get_driver(cpu);
+ get_related_cpus(cpu);
+@@ -483,7 +483,7 @@ static void debug_output_one(unsigned in
+ get_latency(cpu, 1);
+ get_hardware_limits(cpu, 1);
+
+- freqs = cpufreq_get_frequencies("available", cpu);
++ freqs = cpufreq_get_available_frequencies(cpu);
+ if (freqs) {
+ printf(_(" available frequency steps: "));
+ while (freqs->next) {
+@@ -493,7 +493,7 @@ static void debug_output_one(unsigned in
+ }
+ print_speed(freqs->frequency);
+ printf("\n");
+- cpufreq_put_frequencies(freqs);
++ cpufreq_put_available_frequencies(freqs);
+ }
+
+ get_available_governors(cpu);
--- /dev/null
+From 7db3b61b6bba4310f454588c2ca6faf2958ad79f Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 6 Dec 2019 13:55:17 +0800
+Subject: crypto: api - Check spawn->alg under lock in crypto_drop_spawn
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit 7db3b61b6bba4310f454588c2ca6faf2958ad79f upstream.
+
+We need to check whether spawn->alg is NULL under lock as otherwise
+the algorithm could be removed from under us after we have checked
+it and found it to be non-NULL. This could cause us to remove the
+spawn from a non-existent list.
+
+Fixes: 7ede5a5ba55a ("crypto: api - Fix crypto_drop_spawn crash...")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/algapi.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -669,11 +669,9 @@ EXPORT_SYMBOL_GPL(crypto_grab_spawn);
+
+ void crypto_drop_spawn(struct crypto_spawn *spawn)
+ {
+- if (!spawn->alg)
+- return;
+-
+ down_write(&crypto_alg_sem);
+- list_del(&spawn->list);
++ if (spawn->alg)
++ list_del(&spawn->list);
+ up_write(&crypto_alg_sem);
+ }
+ EXPORT_SYMBOL_GPL(crypto_drop_spawn);
--- /dev/null
+From 2a6bc713f1cef32e39e3c4e6f2e1a9849da6379c Mon Sep 17 00:00:00 2001
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+Date: Thu, 16 Jan 2020 12:14:38 +0200
+Subject: crypto: ccree - fix AEAD decrypt auth fail
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+commit 2a6bc713f1cef32e39e3c4e6f2e1a9849da6379c upstream.
+
+On AEAD decryption authentication failure we are suppose to
+zero out the output plaintext buffer. However, we've missed
+skipping the optional associated data that may prefix the
+ciphertext. This commit fixes this issue.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Fixes: e88b27c8eaa8 ("crypto: ccree - use std api sg_zero_buffer")
+Cc: stable@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/ccree/cc_aead.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/ccree/cc_aead.c
++++ b/drivers/crypto/ccree/cc_aead.c
+@@ -237,7 +237,7 @@ static void cc_aead_complete(struct devi
+ * revealed the decrypted message --> zero its memory.
+ */
+ sg_zero_buffer(areq->dst, sg_nents(areq->dst),
+- areq->cryptlen, 0);
++ areq->cryptlen, areq->assoclen);
+ err = -EBADMSG;
+ }
+ /*ENCRYPT*/
--- /dev/null
+From 4df2ef25b3b3618fd708ab484fe6239abd130fec Mon Sep 17 00:00:00 2001
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+Date: Wed, 27 Nov 2019 10:49:08 +0200
+Subject: crypto: ccree - fix backlog memory leak
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+commit 4df2ef25b3b3618fd708ab484fe6239abd130fec upstream.
+
+Fix brown paper bag bug of not releasing backlog list item buffer
+when backlog was consumed causing a memory leak when backlog is
+used.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/ccree/cc_request_mgr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/crypto/ccree/cc_request_mgr.c
++++ b/drivers/crypto/ccree/cc_request_mgr.c
+@@ -404,6 +404,7 @@ static void cc_proc_backlog(struct cc_dr
+ spin_lock(&mgr->bl_lock);
+ list_del(&bli->list);
+ --mgr->bl_len;
++ kfree(bli);
+ }
+
+ spin_unlock(&mgr->bl_lock);
--- /dev/null
+From 5c83e8ec4d51ac4cc58482ed04297e6882b32a09 Mon Sep 17 00:00:00 2001
+From: Ofir Drang <ofir.drang@arm.com>
+Date: Thu, 16 Jan 2020 12:14:42 +0200
+Subject: crypto: ccree - fix FDE descriptor sequence
+
+From: Ofir Drang <ofir.drang@arm.com>
+
+commit 5c83e8ec4d51ac4cc58482ed04297e6882b32a09 upstream.
+
+In FDE mode (xts, essiv and bitlocker) the cryptocell hardware requires
+that the the XEX key will be loaded after Key1.
+
+Signed-off-by: Ofir Drang <ofir.drang@arm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/ccree/cc_cipher.c | 48 ++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 45 insertions(+), 3 deletions(-)
+
+--- a/drivers/crypto/ccree/cc_cipher.c
++++ b/drivers/crypto/ccree/cc_cipher.c
+@@ -523,6 +523,7 @@ static void cc_setup_readiv_desc(struct
+ }
+ }
+
++
+ static void cc_setup_state_desc(struct crypto_tfm *tfm,
+ struct cipher_req_ctx *req_ctx,
+ unsigned int ivsize, unsigned int nbytes,
+@@ -534,8 +535,6 @@ static void cc_setup_state_desc(struct c
+ int cipher_mode = ctx_p->cipher_mode;
+ int flow_mode = ctx_p->flow_mode;
+ int direction = req_ctx->gen_ctx.op_type;
+- dma_addr_t key_dma_addr = ctx_p->user.key_dma_addr;
+- unsigned int key_len = ctx_p->keylen;
+ dma_addr_t iv_dma_addr = req_ctx->gen_ctx.iv_dma_addr;
+ unsigned int du_size = nbytes;
+
+@@ -571,6 +570,47 @@ static void cc_setup_state_desc(struct c
+ case DRV_CIPHER_XTS:
+ case DRV_CIPHER_ESSIV:
+ case DRV_CIPHER_BITLOCKER:
++ break;
++ default:
++ dev_err(dev, "Unsupported cipher mode (%d)\n", cipher_mode);
++ }
++}
++
++
++static void cc_setup_xex_state_desc(struct crypto_tfm *tfm,
++ struct cipher_req_ctx *req_ctx,
++ unsigned int ivsize, unsigned int nbytes,
++ struct cc_hw_desc desc[],
++ unsigned int *seq_size)
++{
++ struct cc_cipher_ctx *ctx_p = crypto_tfm_ctx(tfm);
++ struct device *dev = drvdata_to_dev(ctx_p->drvdata);
++ int cipher_mode = ctx_p->cipher_mode;
++ int flow_mode = ctx_p->flow_mode;
++ int direction = req_ctx->gen_ctx.op_type;
++ dma_addr_t key_dma_addr = ctx_p->user.key_dma_addr;
++ unsigned int key_len = ctx_p->keylen;
++ dma_addr_t iv_dma_addr = req_ctx->gen_ctx.iv_dma_addr;
++ unsigned int du_size = nbytes;
++
++ struct cc_crypto_alg *cc_alg =
++ container_of(tfm->__crt_alg, struct cc_crypto_alg,
++ skcipher_alg.base);
++
++ if (cc_alg->data_unit)
++ du_size = cc_alg->data_unit;
++
++ switch (cipher_mode) {
++ case DRV_CIPHER_ECB:
++ break;
++ case DRV_CIPHER_CBC:
++ case DRV_CIPHER_CBC_CTS:
++ case DRV_CIPHER_CTR:
++ case DRV_CIPHER_OFB:
++ break;
++ case DRV_CIPHER_XTS:
++ case DRV_CIPHER_ESSIV:
++ case DRV_CIPHER_BITLOCKER:
+ /* load XEX key */
+ hw_desc_init(&desc[*seq_size]);
+ set_cipher_mode(&desc[*seq_size], cipher_mode);
+@@ -881,12 +921,14 @@ static int cc_cipher_process(struct skci
+
+ /* STAT_PHASE_2: Create sequence */
+
+- /* Setup IV and XEX key used */
++ /* Setup state (IV) */
+ cc_setup_state_desc(tfm, req_ctx, ivsize, nbytes, desc, &seq_len);
+ /* Setup MLLI line, if needed */
+ cc_setup_mlli_desc(tfm, req_ctx, dst, src, nbytes, req, desc, &seq_len);
+ /* Setup key */
+ cc_setup_key_desc(tfm, req_ctx, nbytes, desc, &seq_len);
++ /* Setup state (IV and XEX key) */
++ cc_setup_xex_state_desc(tfm, req_ctx, ivsize, nbytes, desc, &seq_len);
+ /* Data processing */
+ cc_setup_flow_desc(tfm, req_ctx, dst, src, nbytes, desc, &seq_len);
+ /* Read next IV */
--- /dev/null
+From 15fd2566bf54ee4d4781d8f170acfc9472a1541f Mon Sep 17 00:00:00 2001
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+Date: Thu, 16 Jan 2020 12:14:43 +0200
+Subject: crypto: ccree - fix PM race condition
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+commit 15fd2566bf54ee4d4781d8f170acfc9472a1541f upstream.
+
+The PM code was racy, possibly causing the driver to submit
+requests to a powered down device. Fix the race and while
+at it simplify the PM code.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Fixes: 1358c13a48c4 ("crypto: ccree - fix resume race condition on init")
+Cc: stable@kernel.org # v4.20
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/ccree/cc_driver.h | 1
+ drivers/crypto/ccree/cc_pm.c | 28 ++++---------------
+ drivers/crypto/ccree/cc_request_mgr.c | 50 ----------------------------------
+ drivers/crypto/ccree/cc_request_mgr.h | 8 -----
+ 4 files changed, 7 insertions(+), 80 deletions(-)
+
+--- a/drivers/crypto/ccree/cc_driver.h
++++ b/drivers/crypto/ccree/cc_driver.h
+@@ -161,6 +161,7 @@ struct cc_drvdata {
+ int std_bodies;
+ bool sec_disabled;
+ u32 comp_mask;
++ bool pm_on;
+ };
+
+ struct cc_crypto_alg {
+--- a/drivers/crypto/ccree/cc_pm.c
++++ b/drivers/crypto/ccree/cc_pm.c
+@@ -22,14 +22,8 @@ const struct dev_pm_ops ccree_pm = {
+ int cc_pm_suspend(struct device *dev)
+ {
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+- int rc;
+
+ dev_dbg(dev, "set HOST_POWER_DOWN_EN\n");
+- rc = cc_suspend_req_queue(drvdata);
+- if (rc) {
+- dev_err(dev, "cc_suspend_req_queue (%x)\n", rc);
+- return rc;
+- }
+ fini_cc_regs(drvdata);
+ cc_iowrite(drvdata, CC_REG(HOST_POWER_DOWN_EN), POWER_DOWN_ENABLE);
+ cc_clk_off(drvdata);
+@@ -63,13 +57,6 @@ int cc_pm_resume(struct device *dev)
+ /* check if tee fips error occurred during power down */
+ cc_tee_handle_fips_error(drvdata);
+
+- rc = cc_resume_req_queue(drvdata);
+- if (rc) {
+- dev_err(dev, "cc_resume_req_queue (%x)\n", rc);
+- return rc;
+- }
+-
+- /* must be after the queue resuming as it uses the HW queue*/
+ cc_init_hash_sram(drvdata);
+
+ return 0;
+@@ -80,10 +67,8 @@ int cc_pm_get(struct device *dev)
+ int rc = 0;
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (cc_req_queue_suspended(drvdata))
++ if (drvdata->pm_on)
+ rc = pm_runtime_get_sync(dev);
+- else
+- pm_runtime_get_noresume(dev);
+
+ return (rc == 1 ? 0 : rc);
+ }
+@@ -93,14 +78,11 @@ int cc_pm_put_suspend(struct device *dev
+ int rc = 0;
+ struct cc_drvdata *drvdata = dev_get_drvdata(dev);
+
+- if (!cc_req_queue_suspended(drvdata)) {
++ if (drvdata->pm_on) {
+ pm_runtime_mark_last_busy(dev);
+ rc = pm_runtime_put_autosuspend(dev);
+- } else {
+- /* Something wrong happens*/
+- dev_err(dev, "request to suspend already suspended queue");
+- rc = -EBUSY;
+ }
++
+ return rc;
+ }
+
+@@ -117,7 +99,7 @@ int cc_pm_init(struct cc_drvdata *drvdat
+ /* must be before the enabling to avoid resdundent suspending */
+ pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
+ pm_runtime_use_autosuspend(dev);
+- /* activate the PM module */
++ /* set us as active - note we won't do PM ops until cc_pm_go()! */
+ return pm_runtime_set_active(dev);
+ }
+
+@@ -125,9 +107,11 @@ int cc_pm_init(struct cc_drvdata *drvdat
+ void cc_pm_go(struct cc_drvdata *drvdata)
+ {
+ pm_runtime_enable(drvdata_to_dev(drvdata));
++ drvdata->pm_on = true;
+ }
+
+ void cc_pm_fini(struct cc_drvdata *drvdata)
+ {
+ pm_runtime_disable(drvdata_to_dev(drvdata));
++ drvdata->pm_on = false;
+ }
+--- a/drivers/crypto/ccree/cc_request_mgr.c
++++ b/drivers/crypto/ccree/cc_request_mgr.c
+@@ -41,7 +41,6 @@ struct cc_req_mgr_handle {
+ #else
+ struct tasklet_struct comptask;
+ #endif
+- bool is_runtime_suspended;
+ };
+
+ struct cc_bl_item {
+@@ -678,52 +677,3 @@ static void comp_handler(unsigned long d
+ cc_proc_backlog(drvdata);
+ dev_dbg(dev, "Comp. handler done.\n");
+ }
+-
+-/*
+- * resume the queue configuration - no need to take the lock as this happens
+- * inside the spin lock protection
+- */
+-#if defined(CONFIG_PM)
+-int cc_resume_req_queue(struct cc_drvdata *drvdata)
+-{
+- struct cc_req_mgr_handle *request_mgr_handle =
+- drvdata->request_mgr_handle;
+-
+- spin_lock_bh(&request_mgr_handle->hw_lock);
+- request_mgr_handle->is_runtime_suspended = false;
+- spin_unlock_bh(&request_mgr_handle->hw_lock);
+-
+- return 0;
+-}
+-
+-/*
+- * suspend the queue configuration. Since it is used for the runtime suspend
+- * only verify that the queue can be suspended.
+- */
+-int cc_suspend_req_queue(struct cc_drvdata *drvdata)
+-{
+- struct cc_req_mgr_handle *request_mgr_handle =
+- drvdata->request_mgr_handle;
+-
+- /* lock the send_request */
+- spin_lock_bh(&request_mgr_handle->hw_lock);
+- if (request_mgr_handle->req_queue_head !=
+- request_mgr_handle->req_queue_tail) {
+- spin_unlock_bh(&request_mgr_handle->hw_lock);
+- return -EBUSY;
+- }
+- request_mgr_handle->is_runtime_suspended = true;
+- spin_unlock_bh(&request_mgr_handle->hw_lock);
+-
+- return 0;
+-}
+-
+-bool cc_req_queue_suspended(struct cc_drvdata *drvdata)
+-{
+- struct cc_req_mgr_handle *request_mgr_handle =
+- drvdata->request_mgr_handle;
+-
+- return request_mgr_handle->is_runtime_suspended;
+-}
+-
+-#endif
+--- a/drivers/crypto/ccree/cc_request_mgr.h
++++ b/drivers/crypto/ccree/cc_request_mgr.h
+@@ -40,12 +40,4 @@ void complete_request(struct cc_drvdata
+
+ void cc_req_mgr_fini(struct cc_drvdata *drvdata);
+
+-#if defined(CONFIG_PM)
+-int cc_resume_req_queue(struct cc_drvdata *drvdata);
+-
+-int cc_suspend_req_queue(struct cc_drvdata *drvdata);
+-
+-bool cc_req_queue_suspended(struct cc_drvdata *drvdata);
+-#endif
+-
+ #endif /*__REQUEST_MGR_H__*/
--- /dev/null
+From cedca59fae5834af8445b403c66c9953754375d7 Mon Sep 17 00:00:00 2001
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+Date: Thu, 16 Jan 2020 12:14:40 +0200
+Subject: crypto: ccree - fix pm wrongful error reporting
+
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+
+commit cedca59fae5834af8445b403c66c9953754375d7 upstream.
+
+pm_runtime_get_sync() can return 1 as a valid (none error) return
+code. Treat it as such.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/ccree/cc_pm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/ccree/cc_pm.c
++++ b/drivers/crypto/ccree/cc_pm.c
+@@ -85,7 +85,7 @@ int cc_pm_get(struct device *dev)
+ else
+ pm_runtime_get_noresume(dev);
+
+- return rc;
++ return (rc == 1 ? 0 : rc);
+ }
+
+ int cc_pm_put_suspend(struct device *dev)
--- /dev/null
+From 4d2024370d877f9ac8b98694bcff666da6a5d333 Mon Sep 17 00:00:00 2001
+From: Gao Xiang <xiang@kernel.org>
+Date: Tue, 7 Jan 2020 10:25:46 +0800
+Subject: erofs: fix out-of-bound read for shifted uncompressed block
+
+From: Gao Xiang <gaoxiang25@huawei.com>
+
+commit 4d2024370d877f9ac8b98694bcff666da6a5d333 upstream.
+
+rq->out[1] should be valid before accessing. Otherwise,
+in very rare cases, out-of-bound dirty onstack rq->out[1]
+can equal to *in and lead to unintended memmove behavior.
+
+Link: https://lore.kernel.org/r/20200107022546.19432-1-gaoxiang25@huawei.com
+Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend")
+Cc: <stable@vger.kernel.org> # 5.3+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/erofs/decompressor.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/fs/erofs/decompressor.c
++++ b/fs/erofs/decompressor.c
+@@ -306,24 +306,22 @@ static int z_erofs_shifted_transform(con
+ }
+
+ src = kmap_atomic(*rq->in);
+- if (!rq->out[0]) {
+- dst = NULL;
+- } else {
++ if (rq->out[0]) {
+ dst = kmap_atomic(rq->out[0]);
+ memcpy(dst + rq->pageofs_out, src, righthalf);
++ kunmap_atomic(dst);
+ }
+
+- if (rq->out[1] == *rq->in) {
+- memmove(src, src + righthalf, rq->pageofs_out);
+- } else if (nrpages_out == 2) {
+- if (dst)
+- kunmap_atomic(dst);
++ if (nrpages_out == 2) {
+ DBG_BUGON(!rq->out[1]);
+- dst = kmap_atomic(rq->out[1]);
+- memcpy(dst, src + righthalf, rq->pageofs_out);
++ if (rq->out[1] == *rq->in) {
++ memmove(src, src + righthalf, rq->pageofs_out);
++ } else {
++ dst = kmap_atomic(rq->out[1]);
++ memcpy(dst, src + righthalf, rq->pageofs_out);
++ kunmap_atomic(dst);
++ }
+ }
+- if (dst)
+- kunmap_atomic(dst);
+ kunmap_atomic(src);
+ return 0;
+ }
--- /dev/null
+From a5e6ea18e3d132be4716eb5fdd520c2c234e3003 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 16 Dec 2019 18:26:55 +0000
+Subject: fs: allow deduplication of eof block into the end of the destination file
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit a5e6ea18e3d132be4716eb5fdd520c2c234e3003 upstream.
+
+We always round down, to a multiple of the filesystem's block size, the
+length to deduplicate at generic_remap_check_len(). However this is only
+needed if an attempt to deduplicate the last block into the middle of the
+destination file is requested, since that leads into a corruption if the
+length of the source file is not block size aligned. When an attempt to
+deduplicate the last block into the end of the destination file is
+requested, we should allow it because it is safe to do it - there's no
+stale data exposure and we are prepared to compare the data ranges for
+a length not aligned to the block (or page) size - in fact we even do
+the data compare before adjusting the deduplication length.
+
+After btrfs was updated to use the generic helpers from VFS (by commit
+34a28e3d77535e ("Btrfs: use generic_remap_file_range_prep() for cloning
+and deduplication")) we started to have user reports of deduplication
+not reflinking the last block anymore, and whence users getting lower
+deduplication scores. The main use case is deduplication of entire
+files that have a size not aligned to the block size of the filesystem.
+
+We already allow cloning the last block to the end (and beyond) of the
+destination file, so allow for deduplication as well.
+
+Link: https://lore.kernel.org/linux-btrfs/2019-1576167349.500456@svIo.N5dq.dFFD/
+CC: stable@vger.kernel.org # 5.1+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/read_write.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1777,10 +1777,9 @@ static int remap_verify_area(struct file
+ * else. Assume that the offsets have already been checked for block
+ * alignment.
+ *
+- * For deduplication we always scale down to the previous block because we
+- * can't meaningfully compare post-EOF contents.
+- *
+- * For clone we only link a partial EOF block above the destination file's EOF.
++ * For clone we only link a partial EOF block above or at the destination file's
++ * EOF. For deduplication we accept a partial EOF block only if it ends at the
++ * destination file's EOF (can not link it into the middle of a file).
+ *
+ * Shorten the request if possible.
+ */
+@@ -1796,8 +1795,7 @@ static int generic_remap_check_len(struc
+ if ((*len & blkmask) == 0)
+ return 0;
+
+- if ((remap_flags & REMAP_FILE_DEDUP) ||
+- pos_out + *len < i_size_read(inode_out))
++ if (pos_out + *len < i_size_read(inode_out))
+ new_len &= ~blkmask;
+
+ if (new_len == *len)
--- /dev/null
+From d33c240d47dab4fd15123d9e73fc8810cbc6ed6a Mon Sep 17 00:00:00 2001
+From: Tianyu Lan <Tianyu.Lan@microsoft.com>
+Date: Sat, 25 Jan 2020 16:50:47 -0500
+Subject: hv_balloon: Balloon up according to request page number
+
+From: Tianyu Lan <Tianyu.Lan@microsoft.com>
+
+commit d33c240d47dab4fd15123d9e73fc8810cbc6ed6a upstream.
+
+Current code has assumption that balloon request memory size aligns
+with 2MB. But actually Hyper-V doesn't guarantee such alignment. When
+balloon driver receives non-aligned balloon request, it produces warning
+and balloon up more memory than requested in order to keep 2MB alignment.
+Remove the warning and balloon up memory according to actual requested
+memory size.
+
+Fixes: f6712238471a ("hv: hv_balloon: avoid memory leak on alloc_error of 2MB memory block")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Tianyu Lan <Tianyu.Lan@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv_balloon.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -1217,10 +1217,7 @@ static unsigned int alloc_balloon_pages(
+ unsigned int i, j;
+ struct page *pg;
+
+- if (num_pages < alloc_unit)
+- return 0;
+-
+- for (i = 0; (i * alloc_unit) < num_pages; i++) {
++ for (i = 0; i < num_pages / alloc_unit; i++) {
+ if (bl_resp->hdr.size + sizeof(union dm_mem_page_range) >
+ HV_HYP_PAGE_SIZE)
+ return i * alloc_unit;
+@@ -1258,7 +1255,7 @@ static unsigned int alloc_balloon_pages(
+
+ }
+
+- return num_pages;
++ return i * alloc_unit;
+ }
+
+ static void balloon_up(struct work_struct *dummy)
+@@ -1273,9 +1270,6 @@ static void balloon_up(struct work_struc
+ long avail_pages;
+ unsigned long floor;
+
+- /* The host balloons pages in 2M granularity. */
+- WARN_ON_ONCE(num_pages % PAGES_IN_2M != 0);
+-
+ /*
+ * We will attempt 2M allocations. However, if we fail to
+ * allocate 2M chunks, we will go back to PAGE_SIZE allocations.
+@@ -1285,14 +1279,13 @@ static void balloon_up(struct work_struc
+ avail_pages = si_mem_available();
+ floor = compute_balloon_floor();
+
+- /* Refuse to balloon below the floor, keep the 2M granularity. */
++ /* Refuse to balloon below the floor. */
+ if (avail_pages < num_pages || avail_pages - num_pages < floor) {
+ pr_warn("Balloon request will be partially fulfilled. %s\n",
+ avail_pages < num_pages ? "Not enough memory." :
+ "Balloon floor reached.");
+
+ num_pages = avail_pages > floor ? (avail_pages - floor) : 0;
+- num_pages -= num_pages % PAGES_IN_2M;
+ }
+
+ while (!done) {
--- /dev/null
+From dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Sat, 4 Jan 2020 19:24:08 -0600
+Subject: mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
+
+From: Samuel Holland <samuel@sholland.org>
+
+commit dc91c3b6fe66a13ac76f6cb3b2100c0779cd3350 upstream.
+
+On AXP288 and newer PMICs, bit 7 of AXP20X_VBUS_IPSOUT_MGMT can be set
+to prevent using the VBUS input. However, when the VBUS unplugged and
+plugged back in, the bit automatically resets to zero.
+
+We need to set the register as volatile to prevent regmap from caching
+that bit. Otherwise, regcache will think the bit is already set and not
+write the register.
+
+Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges")
+Cc: stable@vger.kernel.org
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/axp20x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -126,7 +126,7 @@ static const struct regmap_range axp288_
+ static const struct regmap_range axp288_volatile_ranges[] = {
+ regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON),
+ regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL),
+- regmap_reg_range(AXP288_BC_DET_STAT, AXP288_BC_DET_STAT),
++ regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT),
+ regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL),
+ regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L),
+ regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL),
--- /dev/null
+From 16bb7abc4a6b9defffa294e4dc28383e62a1dbcf Mon Sep 17 00:00:00 2001
+From: Bitan Biswas <bbiswas@nvidia.com>
+Date: Thu, 9 Jan 2020 10:40:17 +0000
+Subject: nvmem: core: fix memory abort in cleanup path
+
+From: Bitan Biswas <bbiswas@nvidia.com>
+
+commit 16bb7abc4a6b9defffa294e4dc28383e62a1dbcf upstream.
+
+nvmem_cell_info_to_nvmem_cell implementation has static
+allocation of name. nvmem_add_cells_from_of() call may
+return error and kfree name results in memory abort. Use
+kstrdup_const() and kfree_const calls for name alloc and free.
+
+Unable to handle kernel paging request at virtual address ffffffffffe44888
+Mem abort info:
+ ESR = 0x96000006
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000006
+ CM = 0, WnR = 0
+swapper pgtable: 64k pages, 48-bit VAs, pgdp=00000000815d0000
+[ffffffffffe44888] pgd=0000000081d30803, pud=0000000081d30803,
+pmd=0000000000000000
+Internal error: Oops: 96000006 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 2 PID: 43 Comm: kworker/2:1 Tainted
+Hardware name: quill (DT)
+Workqueue: events deferred_probe_work_func
+pstate: a0000005 (NzCv daif -PAN -UAO)
+pc : kfree+0x38/0x278
+lr : nvmem_cell_drop+0x68/0x80
+sp : ffff80001284f9d0
+x29: ffff80001284f9d0 x28: ffff0001f677e830
+x27: ffff800011b0b000 x26: ffff0001c36e1008
+x25: ffff8000112ad000 x24: ffff8000112c9000
+x23: ffffffffffffffea x22: ffff800010adc7f0
+x21: ffffffffffe44880 x20: ffff800011b0b068
+x19: ffff80001122d380 x18: ffffffffffffffff
+x17: 00000000d5cb4756 x16: 0000000070b193b8
+x15: ffff8000119538c8 x14: 0720072007200720
+x13: 07200720076e0772 x12: 07750762072d0765
+x11: 0773077507660765 x10: 072f073007300730
+x9 : 0730073207380733 x8 : 0000000000000151
+x7 : 07660765072f0720 x6 : ffff0001c00e0f00
+x5 : 0000000000000000 x4 : ffff0001c0b43800
+x3 : ffff800011b0b068 x2 : 0000000000000000
+x1 : 0000000000000000 x0 : ffffffdfffe00000
+Call trace:
+ kfree+0x38/0x278
+ nvmem_cell_drop+0x68/0x80
+ nvmem_device_remove_all_cells+0x2c/0x50
+ nvmem_register.part.9+0x520/0x628
+ devm_nvmem_register+0x48/0xa0
+ tegra_fuse_probe+0x140/0x1f0
+ platform_drv_probe+0x50/0xa0
+ really_probe+0x108/0x348
+ driver_probe_device+0x58/0x100
+ __device_attach_driver+0x90/0xb0
+ bus_for_each_drv+0x64/0xc8
+ __device_attach+0xd8/0x138
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ deferred_probe_work_func+0x74/0xb0
+ process_one_work+0x1e0/0x358
+ worker_thread+0x208/0x488
+ kthread+0x118/0x120
+ ret_from_fork+0x10/0x18
+Code: d350feb5 f2dffbe0 aa1e03f6 8b151815 (f94006a0)
+---[ end trace 49b1303c6b83198e ]---
+
+Fixes: badcdff107cbf ("nvmem: Convert to using %pOFn instead of device_node.name")
+Signed-off-by: Bitan Biswas <bbiswas@nvidia.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20200109104017.6249-5-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvmem/core.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -83,7 +83,7 @@ static void nvmem_cell_drop(struct nvmem
+ list_del(&cell->node);
+ mutex_unlock(&nvmem_mutex);
+ of_node_put(cell->np);
+- kfree(cell->name);
++ kfree_const(cell->name);
+ kfree(cell);
+ }
+
+@@ -110,7 +110,9 @@ static int nvmem_cell_info_to_nvmem_cell
+ cell->nvmem = nvmem;
+ cell->offset = info->offset;
+ cell->bytes = info->bytes;
+- cell->name = info->name;
++ cell->name = kstrdup_const(info->name, GFP_KERNEL);
++ if (!cell->name)
++ return -ENOMEM;
+
+ cell->bit_offset = info->bit_offset;
+ cell->nbits = info->nbits;
+@@ -300,7 +302,7 @@ static int nvmem_add_cells_from_of(struc
+ dev_err(dev, "cell %s unaligned to nvmem stride %d\n",
+ cell->name, nvmem->stride);
+ /* Cells already added will be freed later. */
+- kfree(cell->name);
++ kfree_const(cell->name);
+ kfree(cell);
+ return -EINVAL;
+ }
--- /dev/null
+From 40bb95dbb8acca35f8d52a833393ddbb01cfa2db Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Thu, 9 Jan 2020 10:40:14 +0000
+Subject: nvmem: imx: scu: fix write SIP
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit 40bb95dbb8acca35f8d52a833393ddbb01cfa2db upstream.
+
+SIP number 0xC200000A is for reading, 0xC200000B is for writing.
+And the following two args for write are word index, data to write.
+
+Fixes: 885ce72a09d0 ("nvmem: imx: scu: support write")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200109104017.6249-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvmem/imx-ocotp-scu.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvmem/imx-ocotp-scu.c
++++ b/drivers/nvmem/imx-ocotp-scu.c
+@@ -15,8 +15,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+
+-#define IMX_SIP_OTP 0xC200000A
+-#define IMX_SIP_OTP_WRITE 0x2
++#define IMX_SIP_OTP_WRITE 0xc200000B
+
+ enum ocotp_devtype {
+ IMX8QXP,
+@@ -212,8 +211,7 @@ static int imx_scu_ocotp_write(void *con
+
+ mutex_lock(&scu_ocotp_mutex);
+
+- arm_smccc_smc(IMX_SIP_OTP, IMX_SIP_OTP_WRITE, index, *buf,
+- 0, 0, 0, 0, &res);
++ arm_smccc_smc(IMX_SIP_OTP_WRITE, index, *buf, 0, 0, 0, 0, 0, &res);
+
+ mutex_unlock(&scu_ocotp_mutex);
+
--- /dev/null
+From 07928d9bfc81640bab36f5190e8725894d93b659 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Tue, 19 Nov 2019 13:17:31 +0800
+Subject: padata: Remove broken queue flushing
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit 07928d9bfc81640bab36f5190e8725894d93b659 upstream.
+
+The function padata_flush_queues is fundamentally broken because
+it cannot force padata users to complete the request that is
+underway. IOW padata has to passively wait for the completion
+of any outstanding work.
+
+As it stands flushing is used in two places. Its use in padata_stop
+is simply unnecessary because nothing depends on the queues to
+be flushed afterwards.
+
+The other use in padata_replace is more substantial as we depend
+on it to free the old pd structure. This patch instead uses the
+pd->refcnt to dynamically free the pd structure once all requests
+are complete.
+
+Fixes: 2b73b07ab8a4 ("padata: Flush the padata queues actively")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/padata.c | 43 ++++++++++++-------------------------------
+ 1 file changed, 12 insertions(+), 31 deletions(-)
+
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -35,6 +35,8 @@
+
+ #define MAX_OBJ_NUM 1000
+
++static void padata_free_pd(struct parallel_data *pd);
++
+ static int padata_index_to_cpu(struct parallel_data *pd, int cpu_index)
+ {
+ int cpu, target_cpu;
+@@ -283,6 +285,7 @@ static void padata_serial_worker(struct
+ struct padata_serial_queue *squeue;
+ struct parallel_data *pd;
+ LIST_HEAD(local_list);
++ int cnt;
+
+ local_bh_disable();
+ squeue = container_of(serial_work, struct padata_serial_queue, work);
+@@ -292,6 +295,8 @@ static void padata_serial_worker(struct
+ list_replace_init(&squeue->serial.list, &local_list);
+ spin_unlock(&squeue->serial.lock);
+
++ cnt = 0;
++
+ while (!list_empty(&local_list)) {
+ struct padata_priv *padata;
+
+@@ -301,9 +306,12 @@ static void padata_serial_worker(struct
+ list_del_init(&padata->list);
+
+ padata->serial(padata);
+- atomic_dec(&pd->refcnt);
++ cnt++;
+ }
+ local_bh_enable();
++
++ if (atomic_sub_and_test(cnt, &pd->refcnt))
++ padata_free_pd(pd);
+ }
+
+ /**
+@@ -440,7 +448,7 @@ static struct parallel_data *padata_allo
+ padata_init_squeues(pd);
+ atomic_set(&pd->seq_nr, -1);
+ atomic_set(&pd->reorder_objects, 0);
+- atomic_set(&pd->refcnt, 0);
++ atomic_set(&pd->refcnt, 1);
+ spin_lock_init(&pd->lock);
+ pd->cpu = cpumask_first(pd->cpumask.pcpu);
+ INIT_WORK(&pd->reorder_work, invoke_padata_reorder);
+@@ -466,29 +474,6 @@ static void padata_free_pd(struct parall
+ kfree(pd);
+ }
+
+-/* Flush all objects out of the padata queues. */
+-static void padata_flush_queues(struct parallel_data *pd)
+-{
+- int cpu;
+- struct padata_parallel_queue *pqueue;
+- struct padata_serial_queue *squeue;
+-
+- for_each_cpu(cpu, pd->cpumask.pcpu) {
+- pqueue = per_cpu_ptr(pd->pqueue, cpu);
+- flush_work(&pqueue->work);
+- }
+-
+- if (atomic_read(&pd->reorder_objects))
+- padata_reorder(pd);
+-
+- for_each_cpu(cpu, pd->cpumask.cbcpu) {
+- squeue = per_cpu_ptr(pd->squeue, cpu);
+- flush_work(&squeue->work);
+- }
+-
+- BUG_ON(atomic_read(&pd->refcnt) != 0);
+-}
+-
+ static void __padata_start(struct padata_instance *pinst)
+ {
+ pinst->flags |= PADATA_INIT;
+@@ -502,10 +487,6 @@ static void __padata_stop(struct padata_
+ pinst->flags &= ~PADATA_INIT;
+
+ synchronize_rcu();
+-
+- get_online_cpus();
+- padata_flush_queues(pinst->pd);
+- put_online_cpus();
+ }
+
+ /* Replace the internal control structure with a new one. */
+@@ -526,8 +507,8 @@ static void padata_replace(struct padata
+ if (!cpumask_equal(pd_old->cpumask.cbcpu, pd_new->cpumask.cbcpu))
+ notification_mask |= PADATA_CPU_SERIAL;
+
+- padata_flush_queues(pd_old);
+- padata_free_pd(pd_old);
++ if (atomic_dec_and_test(&pd_old->refcnt))
++ padata_free_pd(pd_old);
+
+ if (notification_mask)
+ blocking_notifier_call_chain(&pinst->cpumask_change_notifier,
--- /dev/null
+From 1c51aad8475d670ad58ae60adc9d32342381df8d Mon Sep 17 00:00:00 2001
+From: Samuel Holland <samuel@sholland.org>
+Date: Sun, 12 Jan 2020 21:53:03 -0600
+Subject: power: supply: axp20x_ac_power: Fix reporting online status
+
+From: Samuel Holland <samuel@sholland.org>
+
+commit 1c51aad8475d670ad58ae60adc9d32342381df8d upstream.
+
+AXP803/AXP813 have a flag that enables/disables the AC power supply
+input. This flag does not affect the status bits in PWR_INPUT_STATUS.
+Its effect can be verified by checking the battery charge/discharge
+state (bit 2 of PWR_INPUT_STATUS), or by examining the current draw on
+the AC input.
+
+Take this flag into account when getting the ONLINE property of the AC
+input, on PMICs where this flag is present.
+
+Fixes: 7693b5643fd2 ("power: supply: add AC power supply driver for AXP813")
+Cc: stable@vger.kernel.org
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/axp20x_ac_power.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+--- a/drivers/power/supply/axp20x_ac_power.c
++++ b/drivers/power/supply/axp20x_ac_power.c
+@@ -23,6 +23,8 @@
+ #define AXP20X_PWR_STATUS_ACIN_PRESENT BIT(7)
+ #define AXP20X_PWR_STATUS_ACIN_AVAIL BIT(6)
+
++#define AXP813_ACIN_PATH_SEL BIT(7)
++
+ #define AXP813_VHOLD_MASK GENMASK(5, 3)
+ #define AXP813_VHOLD_UV_TO_BIT(x) ((((x) / 100000) - 40) << 3)
+ #define AXP813_VHOLD_REG_TO_UV(x) \
+@@ -40,6 +42,7 @@ struct axp20x_ac_power {
+ struct power_supply *supply;
+ struct iio_channel *acin_v;
+ struct iio_channel *acin_i;
++ bool has_acin_path_sel;
+ };
+
+ static irqreturn_t axp20x_ac_power_irq(int irq, void *devid)
+@@ -86,6 +89,17 @@ static int axp20x_ac_power_get_property(
+ return ret;
+
+ val->intval = !!(reg & AXP20X_PWR_STATUS_ACIN_AVAIL);
++
++ /* ACIN_PATH_SEL disables ACIN even if ACIN_AVAIL is set. */
++ if (val->intval && power->has_acin_path_sel) {
++ ret = regmap_read(power->regmap, AXP813_ACIN_PATH_CTRL,
++ ®);
++ if (ret)
++ return ret;
++
++ val->intval = !!(reg & AXP813_ACIN_PATH_SEL);
++ }
++
+ return 0;
+
+ case POWER_SUPPLY_PROP_VOLTAGE_NOW:
+@@ -224,21 +238,25 @@ static const struct power_supply_desc ax
+ struct axp_data {
+ const struct power_supply_desc *power_desc;
+ bool acin_adc;
++ bool acin_path_sel;
+ };
+
+ static const struct axp_data axp20x_data = {
+- .power_desc = &axp20x_ac_power_desc,
+- .acin_adc = true,
++ .power_desc = &axp20x_ac_power_desc,
++ .acin_adc = true,
++ .acin_path_sel = false,
+ };
+
+ static const struct axp_data axp22x_data = {
+- .power_desc = &axp22x_ac_power_desc,
+- .acin_adc = false,
++ .power_desc = &axp22x_ac_power_desc,
++ .acin_adc = false,
++ .acin_path_sel = false,
+ };
+
+ static const struct axp_data axp813_data = {
+- .power_desc = &axp813_ac_power_desc,
+- .acin_adc = false,
++ .power_desc = &axp813_ac_power_desc,
++ .acin_adc = false,
++ .acin_path_sel = true,
+ };
+
+ static int axp20x_ac_power_probe(struct platform_device *pdev)
+@@ -282,6 +300,7 @@ static int axp20x_ac_power_probe(struct
+ }
+
+ power->regmap = dev_get_regmap(pdev->dev.parent, NULL);
++ power->has_acin_path_sel = axp_data->acin_path_sel;
+
+ platform_set_drvdata(pdev, power);
+
--- /dev/null
+From a60ec78d306c6548d4adbc7918b587a723c555cc Mon Sep 17 00:00:00 2001
+From: Sven Van Asbroeck <thesven73@gmail.com>
+Date: Thu, 19 Sep 2019 11:11:37 -0400
+Subject: power: supply: ltc2941-battery-gauge: fix use-after-free
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+commit a60ec78d306c6548d4adbc7918b587a723c555cc upstream.
+
+This driver's remove path calls cancel_delayed_work().
+However, that function does not wait until the work function
+finishes. This could mean that the work function is still
+running after the driver's remove function has finished,
+which would result in a use-after-free.
+
+Fix by calling cancel_delayed_work_sync(), which ensures that
+that the work is properly cancelled, no longer running, and
+unable to re-schedule itself.
+
+This issue was detected with the help of Coccinelle.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/ltc2941-battery-gauge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/supply/ltc2941-battery-gauge.c
++++ b/drivers/power/supply/ltc2941-battery-gauge.c
+@@ -449,7 +449,7 @@ static int ltc294x_i2c_remove(struct i2c
+ {
+ struct ltc294x_info *info = i2c_get_clientdata(client);
+
+- cancel_delayed_work(&info->work);
++ cancel_delayed_work_sync(&info->work);
+ power_supply_unregister(info->supply);
+ return 0;
+ }
--- /dev/null
+From 1630146db2111412e7524d05d812ff8f2c75977e Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 27 Jan 2020 10:31:07 +0100
+Subject: scripts/find-unused-docs: Fix massive false positives
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 1630146db2111412e7524d05d812ff8f2c75977e upstream.
+
+scripts/find-unused-docs.sh invokes scripts/kernel-doc to find out if a
+source file contains kerneldoc or not.
+
+However, as it passes the no longer supported "-text" option to
+scripts/kernel-doc, the latter prints out its help text, causing all
+files to be considered containing kerneldoc.
+
+Get rid of these false positives by removing the no longer supported
+"-text" option from the scripts/kernel-doc invocation.
+
+Cc: stable@vger.kernel.org # 4.16+
+Fixes: b05142675310d2ac ("scripts: kernel-doc: get rid of unused output formats")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20200127093107.26401-1-geert+renesas@glider.be
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/find-unused-docs.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/find-unused-docs.sh
++++ b/scripts/find-unused-docs.sh
+@@ -54,7 +54,7 @@ for file in `find $1 -name '*.c'`; do
+ if [[ ${FILES_INCLUDED[$file]+_} ]]; then
+ continue;
+ fi
+- str=$(scripts/kernel-doc -text -export "$file" 2>/dev/null)
++ str=$(scripts/kernel-doc -export "$file" 2>/dev/null)
+ if [[ -n "$str" ]]; then
+ echo "$file"
+ fi
--- /dev/null
+From 6d7537270e3283b92f9b327da9d58a4de40fe8d0 Mon Sep 17 00:00:00 2001
+From: Anand Lodnoor <anand.lodnoor@broadcom.com>
+Date: Tue, 14 Jan 2020 16:51:19 +0530
+Subject: scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state
+
+From: Anand Lodnoor <anand.lodnoor@broadcom.com>
+
+commit 6d7537270e3283b92f9b327da9d58a4de40fe8d0 upstream.
+
+Driver initiates OCR if a DCMD command times out. But there is a deadlock
+if the driver attempts to invoke another OCR before the mutex lock
+(reset_mutex) is released from the previous session of OCR.
+
+This patch takes care of the above scenario using new flag
+MEGASAS_FUSION_OCR_NOT_POSSIBLE to indicate if OCR is possible.
+
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1579000882-20246-9-git-send-email-anand.lodnoor@broadcom.com
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Anand Lodnoor <anand.lodnoor@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 3 ++-
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 ++-
+ drivers/scsi/megaraid/megaraid_sas_fusion.h | 1 +
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -4392,7 +4392,8 @@ dcmd_timeout_ocr_possible(struct megasas
+ if (instance->adapter_type == MFI_SERIES)
+ return KILL_ADAPTER;
+ else if (instance->unload ||
+- test_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags))
++ test_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE,
++ &instance->reset_flags))
+ return IGNORE_TIMEOUT;
+ else
+ return INITIATE_OCR;
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -4847,6 +4847,7 @@ int megasas_reset_fusion(struct Scsi_Hos
+ if (instance->requestorId && !instance->skip_heartbeat_timer_del)
+ del_timer_sync(&instance->sriov_heartbeat_timer);
+ set_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags);
++ set_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, &instance->reset_flags);
+ atomic_set(&instance->adprecovery, MEGASAS_ADPRESET_SM_POLLING);
+ instance->instancet->disable_intr(instance);
+ megasas_sync_irqs((unsigned long)instance);
+@@ -5046,7 +5047,7 @@ kill_hba:
+ instance->skip_heartbeat_timer_del = 1;
+ retval = FAILED;
+ out:
+- clear_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags);
++ clear_bit(MEGASAS_FUSION_OCR_NOT_POSSIBLE, &instance->reset_flags);
+ mutex_unlock(&instance->reset_mutex);
+ return retval;
+ }
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
+@@ -89,6 +89,7 @@ enum MR_RAID_FLAGS_IO_SUB_TYPE {
+
+ #define MEGASAS_FP_CMD_LEN 16
+ #define MEGASAS_FUSION_IN_RESET 0
++#define MEGASAS_FUSION_OCR_NOT_POSSIBLE 1
+ #define RAID_1_PEER_CMDS 2
+ #define JBOD_MAPS_COUNT 2
+ #define MEGASAS_REDUCE_QD_COUNT 64
--- /dev/null
+From 641e0efddcbde52461e017136acd3ce7f2ef0c14 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <qutran@marvell.com>
+Date: Tue, 17 Dec 2019 14:06:16 -0800
+Subject: scsi: qla2xxx: Fix mtcp dump collection failure
+
+From: Quinn Tran <qutran@marvell.com>
+
+commit 641e0efddcbde52461e017136acd3ce7f2ef0c14 upstream.
+
+MTCP dump failed due to MB Reg 10 was picking garbage data from stack
+memory.
+
+Fixes: 81178772b636a ("[SCSI] qla2xxx: Implemetation of mctp.")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20191217220617.28084-14-hmadhani@marvell.com
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -6152,9 +6152,8 @@ qla2x00_dump_mctp_data(scsi_qla_host_t *
+ mcp->mb[7] = LSW(MSD(req_dma));
+ mcp->mb[8] = MSW(addr);
+ /* Setting RAM ID to valid */
+- mcp->mb[10] |= BIT_7;
+ /* For MCTP RAM ID is 0x40 */
+- mcp->mb[10] |= 0x40;
++ mcp->mb[10] = BIT_7 | 0x40;
+
+ mcp->out_mb |= MBX_10|MBX_8|MBX_7|MBX_6|MBX_5|MBX_4|MBX_3|MBX_2|MBX_1|
+ MBX_0;
--- /dev/null
+From 8aaac2d7da873aebeba92c666f82c00bbd74aaf9 Mon Sep 17 00:00:00 2001
+From: Quinn Tran <qutran@marvell.com>
+Date: Tue, 17 Dec 2019 14:06:11 -0800
+Subject: scsi: qla2xxx: Fix stuck login session using prli_pend_timer
+
+From: Quinn Tran <qutran@marvell.com>
+
+commit 8aaac2d7da873aebeba92c666f82c00bbd74aaf9 upstream.
+
+Session is stuck if driver sees FW has received a PRLI. Driver allows FW to
+finish with processing of PRLI by checking back with FW at a later time to
+see if the PRLI has finished. Instead, driver failed to push forward after
+re-checking PRLI completion.
+
+Fixes: ce0ba496dccf ("scsi: qla2xxx: Fix stuck login session")
+Cc: stable@vger.kernel.org # 5.3
+Link: https://lore.kernel.org/r/20191217220617.28084-9-hmadhani@marvell.com
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_def.h | 5 +++++
+ drivers/scsi/qla2xxx/qla_init.c | 34 ++++++++++++++++++++++++++--------
+ drivers/scsi/qla2xxx/qla_target.c | 1 +
+ 3 files changed, 32 insertions(+), 8 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2402,6 +2402,7 @@ typedef struct fc_port {
+ unsigned int scan_needed:1;
+ unsigned int n2n_flag:1;
+ unsigned int explicit_logout:1;
++ unsigned int prli_pend_timer:1;
+
+ struct completion nvme_del_done;
+ uint32_t nvme_prli_service_param;
+@@ -2428,6 +2429,7 @@ typedef struct fc_port {
+ struct work_struct free_work;
+ struct work_struct reg_work;
+ uint64_t jiffies_at_registration;
++ unsigned long prli_expired;
+ struct qlt_plogi_ack_t *plogi_link[QLT_PLOGI_LINK_MAX];
+
+ uint16_t tgt_id;
+@@ -4845,6 +4847,9 @@ struct sff_8247_a0 {
+ (ha->fc4_type_priority == FC4_PRIORITY_NVME)) || \
+ NVME_ONLY_TARGET(fcport)) \
+
++#define PRLI_PHASE(_cls) \
++ ((_cls == DSC_LS_PRLI_PEND) || (_cls == DSC_LS_PRLI_COMP))
++
+ #include "qla_target.h"
+ #include "qla_gbl.h"
+ #include "qla_dbg.h"
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -685,7 +685,7 @@ static void qla24xx_handle_gnl_done_even
+ port_id_t id;
+ u64 wwn;
+ u16 data[2];
+- u8 current_login_state;
++ u8 current_login_state, nvme_cls;
+
+ fcport = ea->fcport;
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+@@ -744,10 +744,17 @@ static void qla24xx_handle_gnl_done_even
+
+ loop_id = le16_to_cpu(e->nport_handle);
+ loop_id = (loop_id & 0x7fff);
+- if (NVME_TARGET(vha->hw, fcport))
+- current_login_state = e->current_login_state >> 4;
+- else
+- current_login_state = e->current_login_state & 0xf;
++ nvme_cls = e->current_login_state >> 4;
++ current_login_state = e->current_login_state & 0xf;
++
++ if (PRLI_PHASE(nvme_cls)) {
++ current_login_state = nvme_cls;
++ fcport->fc4_type &= ~FS_FC4TYPE_FCP;
++ fcport->fc4_type |= FS_FC4TYPE_NVME;
++ } else if (PRLI_PHASE(current_login_state)) {
++ fcport->fc4_type |= FS_FC4TYPE_FCP;
++ fcport->fc4_type &= ~FS_FC4TYPE_NVME;
++ }
+
+ ql_dbg(ql_dbg_disc, vha, 0x20e2,
+ "%s found %8phC CLS [%x|%x] fc4_type %d ID[%06x|%06x] lid[%d|%d]\n",
+@@ -1216,12 +1223,19 @@ qla24xx_async_prli(struct scsi_qla_host
+ struct srb_iocb *lio;
+ int rval = QLA_FUNCTION_FAILED;
+
+- if (!vha->flags.online)
++ if (!vha->flags.online) {
++ ql_dbg(ql_dbg_disc, vha, 0xffff, "%s %d %8phC exit\n",
++ __func__, __LINE__, fcport->port_name);
+ return rval;
++ }
+
+- if (fcport->fw_login_state == DSC_LS_PLOGI_PEND ||
+- fcport->fw_login_state == DSC_LS_PRLI_PEND)
++ if ((fcport->fw_login_state == DSC_LS_PLOGI_PEND ||
++ fcport->fw_login_state == DSC_LS_PRLI_PEND) &&
++ qla_dual_mode_enabled(vha)) {
++ ql_dbg(ql_dbg_disc, vha, 0xffff, "%s %d %8phC exit\n",
++ __func__, __LINE__, fcport->port_name);
+ return rval;
++ }
+
+ sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL);
+ if (!sp)
+@@ -1600,6 +1614,10 @@ int qla24xx_fcport_handle_login(struct s
+ break;
+ default:
+ if (fcport->login_pause) {
++ ql_dbg(ql_dbg_disc, vha, 0x20d8,
++ "%s %d %8phC exit\n",
++ __func__, __LINE__,
++ fcport->port_name);
+ fcport->last_rscn_gen = fcport->rscn_gen;
+ fcport->last_login_gen = fcport->login_gen;
+ set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1257,6 +1257,7 @@ void qlt_schedule_sess_for_deletion(stru
+ sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
+ spin_unlock_irqrestore(&sess->vha->work_lock, flags);
+
++ sess->prli_pend_timer = 0;
+ sess->disc_state = DSC_DELETE_PEND;
+
+ qla24xx_chk_fcp_state(sess);
ubifs-fix-fs_ioc_setflags-unexpectedly-clearing-encrypt-flag.patch
ubifs-fix-deadlock-in-concurrent-bulk-read-and-writepage.patch
mmc-sdhci-of-at91-fix-memleak-on-clk_get-failure.patch
+asoc-tegra-revert-24-and-32-bit-support.patch
+asoc-topology-fix-soc_tplg_fe_link_create-link-dobj-initialization-order.patch
+asoc-sof-core-free-trace-on-errors.patch
+hv_balloon-balloon-up-according-to-request-page-number.patch
+mfd-axp20x-mark-axp20x_vbus_ipsout_mgmt-as-volatile.patch
+nvmem-imx-scu-fix-write-sip.patch
+nvmem-core-fix-memory-abort-in-cleanup-path.patch
+crypto-api-check-spawn-alg-under-lock-in-crypto_drop_spawn.patch
+crypto-ccree-fix-backlog-memory-leak.patch
+crypto-ccree-fix-aead-decrypt-auth-fail.patch
+crypto-ccree-fix-pm-wrongful-error-reporting.patch
+crypto-ccree-fix-fde-descriptor-sequence.patch
+crypto-ccree-fix-pm-race-condition.patch
+padata-remove-broken-queue-flushing.patch
+fs-allow-deduplication-of-eof-block-into-the-end-of-the-destination-file.patch
+scripts-find-unused-docs-fix-massive-false-positives.patch
+erofs-fix-out-of-bound-read-for-shifted-uncompressed-block.patch
+scsi-megaraid_sas-do-not-initiate-ocr-if-controller-is-not-in-ready-state.patch
+scsi-qla2xxx-fix-stuck-login-session-using-prli_pend_timer.patch
+scsi-qla2xxx-fix-mtcp-dump-collection-failure.patch
+cpupower-revert-library-abi-changes-from-commit-ae2917093fb60bdc1ed3e.patch
+power-supply-axp20x_ac_power-fix-reporting-online-status.patch
+power-supply-ltc2941-battery-gauge-fix-use-after-free.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
