--- /dev/null
+From 3570ba5cc53d2a71555b2f14f6ef6ce9e3114ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:39 +0000
+Subject: ACPI / APEI: Switch estatus pool to use vmalloc memory
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 0ac234be1a9497498e57d958f4251f5257b116b4 ]
+
+The ghes code is careful to parse and round firmware's advertised
+memory requirements for CPER records, up to a maximum of 64K.
+However when ghes_estatus_pool_expand() does its work, it splits
+the requested size into PAGE_SIZE granules.
+
+This means if firmware generates 5K of CPER records, and correctly
+describes this in the table, __process_error() will silently fail as it
+is unable to allocate more than PAGE_SIZE.
+
+Switch the estatus pool to vmalloc() memory. On x86 vmalloc() memory
+may fault and be fixed up by vmalloc_fault(). To prevent this call
+vmalloc_sync_all() before an NMI handler could discover the memory.
+
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 0375c60240621..a6e3c8dc2be4e 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -203,40 +203,40 @@ static int ghes_estatus_pool_init(void)
+ return 0;
+ }
+
+-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool,
++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool,
+ struct gen_pool_chunk *chunk,
+ void *data)
+ {
+- free_page(chunk->start_addr);
++ vfree((void *)chunk->start_addr);
+ }
+
+ static void ghes_estatus_pool_exit(void)
+ {
+ gen_pool_for_each_chunk(ghes_estatus_pool,
+- ghes_estatus_pool_free_chunk_page, NULL);
++ ghes_estatus_pool_free_chunk, NULL);
+ gen_pool_destroy(ghes_estatus_pool);
+ }
+
+ static int ghes_estatus_pool_expand(unsigned long len)
+ {
+- unsigned long i, pages, size, addr;
+- int ret;
++ unsigned long size, addr;
+
+ ghes_estatus_pool_size_request += PAGE_ALIGN(len);
+ size = gen_pool_size(ghes_estatus_pool);
+ if (size >= ghes_estatus_pool_size_request)
+ return 0;
+- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE;
+- for (i = 0; i < pages; i++) {
+- addr = __get_free_page(GFP_KERNEL);
+- if (!addr)
+- return -ENOMEM;
+- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1);
+- if (ret)
+- return ret;
+- }
+
+- return 0;
++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
++ if (!addr)
++ return -ENOMEM;
++
++ /*
++ * New allocation must be visible in all pgd before it can be found by
++ * an NMI allocating from the pool.
++ */
++ vmalloc_sync_all();
++
++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+
+ static struct ghes *ghes_new(struct acpi_hest_generic *generic)
+--
+2.20.1
+
--- /dev/null
+From d6eb6c51c444e35b24ab128373f5ffded2dd4a3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 13:59:24 +0100
+Subject: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1a2fa02f7489dc4d746f2a15fb77b3ce1affade8 ]
+
+Ignore acpi_device_fix_up_power() return value. If we return an error
+we end up with acpi_default_enumeration() still creating a platform-
+device for the device and we end up with the device still being used
+but without the special LPSS related handling which is not useful.
+
+Specicifically ignoring the error fixes the touchscreen no longer
+working after a suspend/resume on a Prowise PT301 tablet.
+
+This tablet has a broken _PS0 method on the touchscreen's I2C controller,
+causing acpi_device_fix_up_power() to fail, causing fallback to standard
+platform-dev handling and specifically causing acpi_lpss_save/restore_ctx
+to not run.
+
+The I2C controllers _PS0 method does actually turn on the device, but then
+does some more nonsense which fails when run during early boot trying to
+use I2C opregion handling on another not-yet registered I2C controller.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 8e38249311bdf..a9158858f54cd 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -448,12 +448,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ * have _PS0 and _PS3 without _PSC (and no power resources), so
+ * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+ */
+- ret = acpi_device_fix_up_power(adev);
+- if (ret) {
+- /* Skip the device, but continue the namespace scan. */
+- ret = 0;
+- goto err_out;
+- }
++ acpi_device_fix_up_power(adev);
+
+ adev->driver_data = pdata;
+ pdev = acpi_create_platform_device(adev, dev_desc->properties);
+--
+2.20.1
+
--- /dev/null
+From c2360240d98a7cb74dfb5e77668043e1cdd42e22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:04:16 +0100
+Subject: ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 7c41ea57beb2aee96fa63091a457b1a2826f3c42 ]
+
+If debugging on i.MX is enabled DEBUG_IMX_UART_PORT defines which UART
+is used for the debug output. If however debugging is off don't only
+hide the then unused config item but drop it completely by using a
+dependency instead of a conditional prompt.
+
+This fixes DEBUG_IMX_UART_PORT being present in the kernel config even
+if DEBUG_LL is disabled.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index d83f7c369e514..a5625430bef64 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1340,21 +1340,21 @@ config DEBUG_OMAP2PLUS_UART
+ depends on ARCH_OMAP2PLUS
+
+ config DEBUG_IMX_UART_PORT
+- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
+- DEBUG_IMX25_UART || \
+- DEBUG_IMX21_IMX27_UART || \
+- DEBUG_IMX31_UART || \
+- DEBUG_IMX35_UART || \
+- DEBUG_IMX50_UART || \
+- DEBUG_IMX51_UART || \
+- DEBUG_IMX53_UART || \
+- DEBUG_IMX6Q_UART || \
+- DEBUG_IMX6SL_UART || \
+- DEBUG_IMX6SX_UART || \
+- DEBUG_IMX6UL_UART || \
+- DEBUG_IMX7D_UART
++ int "i.MX Debug UART Port Selection"
++ depends on DEBUG_IMX1_UART || \
++ DEBUG_IMX25_UART || \
++ DEBUG_IMX21_IMX27_UART || \
++ DEBUG_IMX31_UART || \
++ DEBUG_IMX35_UART || \
++ DEBUG_IMX50_UART || \
++ DEBUG_IMX51_UART || \
++ DEBUG_IMX53_UART || \
++ DEBUG_IMX6Q_UART || \
++ DEBUG_IMX6SL_UART || \
++ DEBUG_IMX6SX_UART || \
++ DEBUG_IMX6UL_UART || \
++ DEBUG_IMX7D_UART
+ default 1
+- depends on ARCH_MXC
+ help
+ Choose UART port on which kernel low-level debug messages
+ should be output.
+--
+2.20.1
+
--- /dev/null
+From 4586dda4c8492dddda102434aee85da13454fd23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 16:10:01 -0200
+Subject: ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 998a84c27a7f3f9133d32af64e19c05cec161a1a ]
+
+imx53-voipac-dmm-668 has two memory nodes, but the correct representation
+would be to use a single one with two reg entries - one for each RAM chip
+select, so fix it accordingly.
+
+Reported-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+index ba689fbd0e413..301cf8d45947f 100644
+--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+@@ -17,12 +17,8 @@
+
+ memory@70000000 {
+ device_type = "memory";
+- reg = <0x70000000 0x20000000>;
+- };
+-
+- memory@b0000000 {
+- device_type = "memory";
+- reg = <0xb0000000 0x20000000>;
++ reg = <0x70000000 0x20000000>,
++ <0xb0000000 0x20000000>;
+ };
+
+ regulators {
+--
+2.20.1
+
--- /dev/null
+From 6d563b9d8e1817efbb6a2b72a62f5bd6f3c8fea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 22:58:38 +0100
+Subject: ARM: ks8695: fix section mismatch warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4aa64677330beeeed721b4b122884dabad845d66 ]
+
+WARNING: vmlinux.o(.text+0x13250): Section mismatch in reference from the function acs5k_i2c_init() to the (unknown reference) .init.data:(unknown)
+The function acs5k_i2c_init() references
+the (unknown reference) __initdata (unknown).
+This is often because acs5k_i2c_init lacks a __initdata
+annotation or the annotation of (unknown) is wrong.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ks8695/board-acs5k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c
+index e4d709c8ed32f..76d3083f1f634 100644
+--- a/arch/arm/mach-ks8695/board-acs5k.c
++++ b/arch/arm/mach-ks8695/board-acs5k.c
+@@ -92,7 +92,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = {
+ },
+ };
+
+-static void acs5k_i2c_init(void)
++static void __init acs5k_i2c_init(void)
+ {
+ /* The gpio interface */
+ platform_device_register(&acs5k_i2c_device);
+--
+2.20.1
+
--- /dev/null
+From a08985150151cf783128099f33694a179c1d8b88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 22:50:40 +0000
+Subject: arm64: mm: Prevent mismatched 52-bit VA support
+
+From: Steve Capper <steve.capper@arm.com>
+
+[ Upstream commit a96a33b1ca57dbea4285893dedf290aeb8eb090b ]
+
+For cases where there is a mismatch in ARMv8.2-LVA support between CPUs
+we have to be careful in allowing secondary CPUs to boot if 52-bit
+virtual addresses have already been enabled on the boot CPU.
+
+This patch adds code to the secondary startup path. If the boot CPU has
+enabled 52-bit VAs then ID_AA64MMFR2_EL1 is checked to see if the
+secondary can also enable 52-bit support. If not, the secondary is
+prevented from booting and an error message is displayed indicating why.
+
+Technically this patch could be implemented using the cpufeature code
+when considering 52-bit userspace support. However, we employ low level
+checks here as the cpufeature code won't be able to run if we have
+mismatched 52-bit kernel va support.
+
+Signed-off-by: Steve Capper <steve.capper@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 26 ++++++++++++++++++++++++++
+ arch/arm64/kernel/smp.c | 5 +++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index db6ff1944c412..3b10b93959607 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -686,6 +686,7 @@ secondary_startup:
+ /*
+ * Common entry point for secondary CPUs.
+ */
++ bl __cpu_secondary_check52bitva
+ bl __cpu_setup // initialise processor
+ bl __enable_mmu
+ ldr x8, =__secondary_switched
+@@ -759,6 +760,31 @@ ENTRY(__enable_mmu)
+ ret
+ ENDPROC(__enable_mmu)
+
++ENTRY(__cpu_secondary_check52bitva)
++#ifdef CONFIG_ARM64_52BIT_VA
++ ldr_l x0, vabits_user
++ cmp x0, #52
++ b.ne 2f
++
++ mrs_s x0, SYS_ID_AA64MMFR2_EL1
++ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT)
++ cbnz x0, 2f
++
++ adr_l x0, va52mismatch
++ mov w1, #1
++ strb w1, [x0]
++ dmb sy
++ dc ivac, x0 // Invalidate potentially stale cache line
++
++ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1
++1: wfe
++ wfi
++ b 1b
++
++#endif
++2: ret
++ENDPROC(__cpu_secondary_check52bitva)
++
+ __no_granule_support:
+ /* Indicate that this CPU can't boot and is stuck in the kernel */
+ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index cfd33f18f4378..f0c41524b052f 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -136,6 +136,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle)
+ }
+
+ static DECLARE_COMPLETION(cpu_running);
++bool va52mismatch __ro_after_init;
+
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+@@ -164,6 +165,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+
+ if (!cpu_online(cpu)) {
+ pr_crit("CPU%u: failed to come online\n", cpu);
++
++ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch)
++ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu);
++
+ ret = -EIO;
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From c35293d54b544af87c541538966fd7335725db24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 18:07:33 +0000
+Subject: arm64: smp: Handle errors reported by the firmware
+
+From: Suzuki K Poulose <Suzuki.Poulose@arm.com>
+
+[ Upstream commit f357b3a7e17af7736d67d8267edc1ed3d1dd9391 ]
+
+The __cpu_up() routine ignores the errors reported by the firmware
+for a CPU bringup operation and looks for the error status set by the
+booting CPU. If the CPU never entered the kernel, we could end up
+in assuming stale error status, which otherwise would have been
+set/cleared appropriately by the booting CPU.
+
+Reported-by: Steve Capper <steve.capper@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index f0c41524b052f..b2d6de9f6f4fb 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -173,6 +173,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ }
+ } else {
+ pr_err("CPU%u: failed to boot: %d\n", cpu, ret);
++ return ret;
+ }
+
+ secondary_data.stack = NULL;
+--
+2.20.1
+
--- /dev/null
+From 8d7210b296595bd4e011656f7e95aed1bfbd7cc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:54:32 +0100
+Subject: ASoC: compress: fix unsigned integer overflow check
+
+From: Xiaojun Sang <xsang@codeaurora.org>
+
+[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]
+
+Parameter fragments and fragment_size are type of u32. U32_MAX is
+the correct check.
+
+Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 2e2d184684911..7ae8e24dc1e61 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ params->buffer.fragments == 0)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 1db8f214d77c5d9b1b989feab44ad9ed9e5f7d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:44 +0100
+Subject: ASoC: kirkwood: fix external clock probe defer
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]
+
+When our call to get the external clock fails, we forget to clean up
+the enabled internal clock correctly. Enable the clock after we have
+obtained all our resources.
+
+Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 3a36d60e17850..0a5d9fb6fc84b 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -570,10 +570,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->clk);
+ }
+
+- err = clk_prepare_enable(priv->clk);
+- if (err < 0)
+- return err;
+-
+ priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ if (IS_ERR(priv->extclk)) {
+ if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -589,6 +585,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ }
+ }
+
++ err = clk_prepare_enable(priv->clk);
++ if (err < 0)
++ return err;
++
+ /* Some sensible defaults - this reflects the powerup values */
+ priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+--
+2.20.1
+
--- /dev/null
+From 95fee23a0b402e387d66ae470c77cd0147763ccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:13 +0200
+Subject: ath6kl: Fix off by one error in scan completion
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b ]
+
+When ath6kl was reworked to share code between regular and scheduled scans
+in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"),
+probed SSID entry changed from 1-index to 0-indexed. However,
+ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its
+indexing so that we correctly clear out the probed SSID list.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 0cce5a2bca161..650d2f6446a6c 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -1088,7 +1088,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted)
+ if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) {
+ for (i = 0; i < vif->scan_req->n_ssids; i++) {
+ ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
+- i + 1, DISABLE_SSID_FLAG,
++ i, DISABLE_SSID_FLAG,
+ 0, NULL);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 5c02778ce9d9a37b254789fc2527180138fb53a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:11 +0200
+Subject: ath6kl: Only use match sets when firmware supports it
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 ]
+
+Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+merged the probed and matched SSID lists before sending them to the
+firmware. In the process, it assumed match set support is always available
+in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check
+that the firmware supports matching SSIDs in scheduled scans before setting
+MATCH_SSID_FLAG.
+
+Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index b7fe0af4cb240..0cce5a2bca161 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -934,7 +934,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ else
+ ssid_list[i].flag = ANY_SSID_FLAG;
+
+- if (n_match_ssid == 0)
++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ ssid_list[i].flag |= MATCH_SSID_FLAG;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 48df5eccd9628aec7fa4e2001c627653d8575c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:23:19 -0600
+Subject: atl1e: checking the status of atl1e_write_phy_reg
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef ]
+
+atl1e_write_phy_reg() could fail. The fix issues an error message when
+it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 974713b19ab64..5e1f03590aaf2 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -478,7 +478,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
+ {
+ struct atl1e_adapter *adapter = netdev_priv(netdev);
+
+- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val);
++ if (atl1e_write_phy_reg(&adapter->hw,
++ reg_num & MDIO_REG_ADDR_MASK, val))
++ netdev_err(netdev, "write phy register failed\n");
+ }
+
+ static int atl1e_mii_ioctl(struct net_device *netdev,
+--
+2.20.1
+
--- /dev/null
+From 278e59d42664b507a118ae0dfbee2d5cbf1cd857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 10:48:47 +0300
+Subject: block: drbd: remove a stray unlock in __drbd_send_protocol()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]
+
+There are two callers of this function and they both unlock the mutex so
+this ends up being a double unlock.
+
+Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 83482721bc012..f5c24459fc5c1 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -793,7 +793,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+
+ if (nc->tentative && connection->agreed_pro_version < 92) {
+ rcu_read_unlock();
+- mutex_unlock(&sock->mutex);
+ drbd_err(connection, "--dry-run is not supported by peer");
+ return -EOPNOTSUPP;
+ }
+--
+2.20.1
+
--- /dev/null
+From f65bd4b3f07ba2d5240c18851cb7409edbc3f6ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 10:20:32 -0500
+Subject: btrfs: only track ref_heads in delayed_ref_updates
+
+From: Josef Bacik <jbacik@fb.com>
+
+[ Upstream commit 158ffa364bf723fa1ef128060646d23dc3942994 ]
+
+We use this number to figure out how many delayed refs to run, but
+__btrfs_run_delayed_refs really only checks every time we need a new
+delayed ref head, so we always run at least one ref head completely no
+matter what the number of items on it. Fix the accounting to only be
+adjusted when we add/remove a ref head.
+
+In addition to using this number to limit the number of delayed refs
+run, a future patch is also going to use it to calculate the amount of
+space required for delayed refs space reservation.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-ref.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 8d93854a4b4f3..74c17db752014 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -193,8 +193,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ ref->in_tree = 0;
+ btrfs_put_delayed_ref(ref);
+ atomic_dec(&delayed_refs->num_entries);
+- if (trans->delayed_ref_updates)
+- trans->delayed_ref_updates--;
+ }
+
+ static bool merge_ref(struct btrfs_trans_handle *trans,
+@@ -445,7 +443,6 @@ add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+ add_tail:
+ list_add_tail(&ref->list, &href->ref_list);
+ atomic_inc(&root->num_entries);
+- trans->delayed_ref_updates++;
+ spin_unlock(&href->lock);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From fd199758052ef76ae2fc3cead803489a17cc2e21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:01:20 +0000
+Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on
+ open
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]
+
+When the CAN interface is closed it the hardwre is put in power down
+mode, but does not reset the error counters / state. Reset the D_CAN on
+open, so the reported state and the actual state match.
+
+According to [1], the C_CAN module doesn't have the software reset.
+
+[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 7d35f6737499c..4ead5a18b7940 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR BIT(8)
+
+ /* control register */
++#define CONTROL_SWR BIT(15)
+ #define CONTROL_TEST BIT(7)
+ #define CONTROL_CCE BIT(6)
+ #define CONTROL_DISABLE_AR BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ IF_MCONT_RCV_EOB);
+ }
+
++static int c_can_software_reset(struct net_device *dev)
++{
++ struct c_can_priv *priv = netdev_priv(dev);
++ int retry = 0;
++
++ if (priv->type != BOSCH_D_CAN)
++ return 0;
++
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++ msleep(20);
++ if (retry++ > 100) {
++ netdev_err(dev, "CCTRL: software reset failed\n");
++ return -EIO;
++ }
++ }
++
++ return 0;
++}
++
+ /*
+ * Configure C_CAN chip:
+ * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
++ int err;
++
++ err = c_can_software_reset(dev);
++ if (err)
++ return err;
+
+ /* enable automatic retransmission */
+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+--
+2.20.1
+
--- /dev/null
+From 47a07b83d1cb3638b39589cf8f85d8868a26b609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 08:58:45 +0000
+Subject: can: peak_usb: report bus recovery as well
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]
+
+While the state changes are reported when the error counters increase
+and decrease, there is no event when the bus recovers and the error
+counters decrease again. So add those as well.
+
+Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
+ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Cc: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index e626c2afbbb11..0e1fc6c4360e7 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -441,8 +441,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+ if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ new_state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ }
+ break;
+
+@@ -465,9 +465,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+
+ if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+- /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ /* no error (back to warning state) */
++ new_state = CAN_STATE_ERROR_WARNING;
++ break;
+ }
+ break;
+
+@@ -506,6 +506,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ mc->pdev->dev.can.can_stats.error_warning++;
+ break;
+
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ break;
++
+ default:
+ /* CAN_STATE_MAX (trick to handle other errors) */
+ cf->can_id |= CAN_ERR_CRTL;
+--
+2.20.1
+
--- /dev/null
+From dfea0a34b5e53e9d859df6e01f2b055d28fee9f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 17:39:06 +0200
+Subject: clk: at91: avoid sleeping early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ]
+
+It is not allowed to sleep to early in the boot process and this may lead
+to kernel issues if the bootloader didn't prepare the slow clock and main
+clock.
+
+This results in the following error and dump stack on the AriettaG25:
+ bad: scheduling from the idle thread!
+
+Ensure it is possible to sleep, else simply have a delay.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
+Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
+Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-main.c | 5 ++++-
+ drivers/clk/at91/sckc.c | 20 ++++++++++++++++----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 2f97a843d6d6b..fb5c14af8cc8d 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
+ regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
+ if (mcfr & AT91_PMC_MAINRDY)
+ return 0;
+- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(MAINF_LOOP_MIN_WAIT);
++ else
++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ } while (time_before(prep_time, timeout));
+
+ return -ETIMEDOUT;
+diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
+index ab6ecefc49ad8..43ba2a8b03faf 100644
+--- a/drivers/clk/at91/sckc.c
++++ b/drivers/clk/at91/sckc.c
+@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
+
+ writel(tmp | AT91_SCKC_OSC32EN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
+
+ writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
+
+ writel(tmp, sckcr);
+
+- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(SLOWCK_SW_TIME_USEC);
++ else
++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+
+ return 0;
+ }
+@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
+ return 0;
+ }
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ osc->prepared = true;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 4238a8379cf556a3e015f5fdc624609e1db258cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:02:01 +0200
+Subject: clk: samsung: exynos5420: Preserve PLL configuration during
+ suspend/resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]
+
+Properly save and restore all top PLL related configuration registers
+during suspend/resume cycle. So far driver only handled EPLL and RPLL
+clocks, all other were reset to default values after suspend/resume cycle.
+This caused for example lower G3D (MALI Panfrost) performance after system
+resume, even if performance governor has been selected.
+
+Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 13c09a740840b..2bb88d1251136 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -170,12 +170,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ CPLL_CON0,
++ DPLL_CON0,
+ EPLL_CON0,
+ EPLL_CON1,
+ EPLL_CON2,
+ RPLL_CON0,
+ RPLL_CON1,
+ RPLL_CON2,
++ IPLL_CON0,
++ SPLL_CON0,
++ VPLL_CON0,
++ MPLL_CON0,
+ SRC_TOP0,
+ SRC_TOP1,
+ SRC_TOP2,
+--
+2.20.1
+
--- /dev/null
+From 827ed1957a2e61e59a26b1ec4bc6837f29507704 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 07:52:32 -0200
+Subject: crypto: mxc-scc - fix build warnings on ARM64
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 2326828ee40357b3d2b1359b8ca7526af201495b ]
+
+The following build warnings are seen when building for ARM64 allmodconfig:
+
+drivers/crypto/mxc-scc.c:181:20: warning: format '%d' expects argument of type 'int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:186:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:277:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:339:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+drivers/crypto/mxc-scc.c:340:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+
+Fix them by using the %zu specifier to print a size_t variable and using
+a plain %x to print the result of a readl().
+
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxc-scc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c
+index ee4be1b0d30ba..0a57b3db2d67e 100644
+--- a/drivers/crypto/mxc-scc.c
++++ b/drivers/crypto/mxc-scc.c
+@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx,
+ else
+ from = scc->black_memory;
+
+- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from,
++ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from,
+ ctx->dst_nents * 8);
+ len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents,
+ from, ctx->size, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len);
++ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len);
+ return -EINVAL;
+ }
+
+@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx,
+ len = sg_pcopy_to_buffer(req->src, ctx->src_nents,
+ to, len, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len);
++ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len);
+ return -EINVAL;
+ }
+
+@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx,
+ return;
+ }
+
+- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n",
+- (void *)readl(scc->base + SCC_SCM_RED_START),
+- (void *)readl(scc->base + SCC_SCM_BLACK_START));
++ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n",
++ readl(scc->base + SCC_SCM_RED_START),
++ readl(scc->base + SCC_SCM_BLACK_START));
+
+ /* clear interrupt control registers */
+ writel(SCC_SCM_INTR_CTRL_CLR_INTR,
+--
+2.20.1
+
--- /dev/null
+From c865f435fc1ea255d474917bde757a2953c6df9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 15:55:41 -0800
+Subject: crypto: user - support incremental algorithm dumps
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0ac6b8fb23c724b015d9ca70a89126e8d1563166 ]
+
+CRYPTO_MSG_GETALG in NLM_F_DUMP mode sometimes doesn't return all
+registered crypto algorithms, because it doesn't support incremental
+dumps. crypto_dump_report() only permits itself to be called once, yet
+the netlink subsystem allocates at most ~64 KiB for the skb being dumped
+to. Thus only the first recvmsg() returns data, and it may only include
+a subset of the crypto algorithms even if the user buffer passed to
+recvmsg() is large enough to hold all of them.
+
+Fix this by using one of the arguments in the netlink_callback structure
+to keep track of the current position in the algorithm list. Then
+userspace can do multiple recvmsg() on the socket after sending the dump
+request. This is the way netlink dumps work elsewhere in the kernel;
+it's unclear why this was different (probably just an oversight).
+
+Also fix an integer overflow when calculating the dump buffer size hint.
+
+Fixes: a38f7907b926 ("crypto: Add userspace configuration API")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/crypto_user.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index c90a1727cd2c6..60cf7d163731b 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -277,30 +277,33 @@ drop_alg:
+
+ static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+- struct crypto_alg *alg;
++ const size_t start_pos = cb->args[0];
++ size_t pos = 0;
+ struct crypto_dump_info info;
+- int err;
+-
+- if (cb->args[0])
+- goto out;
+-
+- cb->args[0] = 1;
++ struct crypto_alg *alg;
++ int res;
+
+ info.in_skb = cb->skb;
+ info.out_skb = skb;
+ info.nlmsg_seq = cb->nlh->nlmsg_seq;
+ info.nlmsg_flags = NLM_F_MULTI;
+
++ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list) {
+- err = crypto_report_alg(alg, &info);
+- if (err)
+- goto out_err;
++ if (pos >= start_pos) {
++ res = crypto_report_alg(alg, &info);
++ if (res == -EMSGSIZE)
++ break;
++ if (res)
++ goto out;
++ }
++ pos++;
+ }
+-
++ cb->args[0] = pos;
++ res = skb->len;
+ out:
+- return skb->len;
+-out_err:
+- return err;
++ up_read(&crypto_alg_sem);
++ return res;
+ }
+
+ static int crypto_dump_report_done(struct netlink_callback *cb)
+@@ -483,7 +486,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
+ (nlh->nlmsg_flags & NLM_F_DUMP))) {
+ struct crypto_alg *alg;
+- u16 dump_alloc = 0;
++ unsigned long dump_alloc = 0;
+
+ if (link->dump == NULL)
+ return -EINVAL;
+@@ -491,16 +494,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ dump_alloc += CRYPTO_REPORT_MAXSIZE;
++ up_read(&crypto_alg_sem);
+
+ {
+ struct netlink_dump_control c = {
+ .dump = link->dump,
+ .done = link->done,
+- .min_dump_alloc = dump_alloc,
++ .min_dump_alloc = min(dump_alloc, 65535UL),
+ };
+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ }
+- up_read(&crypto_alg_sem);
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 946768928b8c53055d5d1e938fe64ef758624814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 21:12:19 +0100
+Subject: decnet: fix DN_IFREQ_SIZE
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 50c2936634bcb1db78a8ca63249236810c11a80f ]
+
+Digging through the ioctls with Al because of the previous
+patches, we found that on 64-bit decnet's dn_dev_ioctl()
+is wrong, because struct ifreq::ifr_ifru is actually 24
+bytes (not 16 as expected from struct sockaddr) due to the
+ifru_map and ifru_settings members.
+
+Clearly, decnet expects the ioctl to be called with a struct
+like
+ struct ifreq_dn {
+ char ifr_name[IFNAMSIZ];
+ struct sockaddr_dn ifr_addr;
+ };
+
+since it does
+ struct ifreq *ifr = ...;
+ struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
+
+This means that DN_IFREQ_SIZE is too big for what it wants on
+64-bit, as it is
+ sizeof(struct ifreq) - sizeof(struct sockaddr) +
+ sizeof(struct sockaddr_dn)
+
+This assumes that sizeof(struct sockaddr) is the size of ifr_ifru
+but that isn't true.
+
+Fix this to use offsetof(struct ifreq, ifr_ifru).
+
+This indeed doesn't really matter much - the result is that we
+copy in/out 8 bytes more than we should on 64-bit platforms. In
+case the "struct ifreq_dn" lands just on the end of a page though
+it might lead to faults.
+
+As far as I can tell, it has been like this forever, so it seems
+very likely that nobody cares.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/decnet/dn_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index b2c26b081134a..80554e7e9a0f6 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -55,7 +55,7 @@
+ #include <net/dn_neigh.h>
+ #include <net/dn_fib.h>
+
+-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+
+ static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+ static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00};
+--
+2.20.1
+
--- /dev/null
+From 5a4e92acd11cdb117458c69cc8d1c565399a1c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 08:04:24 -0500
+Subject: dm flakey: Properly corrupt multi-page bios.
+
+From: Sweet Tea <sweettea@redhat.com>
+
+[ Upstream commit a00f5276e26636cbf72f24f79831026d2e2868e7 ]
+
+The flakey target is documented to be able to corrupt the Nth byte in
+a bio, but does not corrupt byte indices after the first biovec in the
+bio. Change the corrupting function to actually corrupt the Nth byte
+no matter in which biovec that index falls.
+
+A test device generating two-page bios, atop a flakey device configured
+to corrupt a byte index on the second page, verified both the failure
+to corrupt before this patch and the expected corruption after this
+change.
+
+Signed-off-by: John Dorminy <jdorminy@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-flakey.c | 33 ++++++++++++++++++++++-----------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 3643cba713518..742c1fa870dae 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -258,20 +258,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio)
+
+ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc)
+ {
+- unsigned bio_bytes = bio_cur_bytes(bio);
+- char *data = bio_data(bio);
++ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1;
++
++ struct bvec_iter iter;
++ struct bio_vec bvec;
++
++ if (!bio_has_data(bio))
++ return;
+
+ /*
+- * Overwrite the Nth byte of the data returned.
++ * Overwrite the Nth byte of the bio's data, on whichever page
++ * it falls.
+ */
+- if (data && bio_bytes >= fc->corrupt_bio_byte) {
+- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value;
+-
+- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
+- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n",
+- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
+- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
+- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes);
++ bio_for_each_segment(bvec, bio, iter) {
++ if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
++ char *segment = (page_address(bio_iter_page(bio, iter))
++ + bio_iter_offset(bio, iter));
++ segment[corrupt_bio_byte] = fc->corrupt_bio_value;
++ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
++ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
++ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
++ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
++ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size);
++ break;
++ }
++ corrupt_bio_byte -= bio_iter_len(bio, iter);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6b339f60d67810c3899a4b6a89c16f015de4743c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:37 +0100
+Subject: drbd: do not block when adjusting "disk-options" while IO is frozen
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit f708bd08ecbdc23d03aaedf5b3311ebe44cfdb50 ]
+
+"suspending" IO is overloaded.
+It can mean "do not allow new requests" (obviously),
+but it also may mean "must not complete pending IO",
+for example while the fencing handlers do their arbitration.
+
+When adjusting disk options, we suspend io (disallow new requests), then
+wait for the activity-log to become unused (drain all IO completions),
+and possibly replace it with a new activity log of different size.
+
+If the other "suspend IO" aspect is active, pending IO completions won't
+happen, and we would block forever (unkillable drbdsetup process).
+
+Fix this by skipping the activity log adjustment if the "al-extents"
+setting did not change. Also, in case it did change, fail early without
+blocking if it looks like we would block forever.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 37 ++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index ff26f676f24d1..b809f325c2bea 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1508,6 +1508,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis
+ }
+ }
+
++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc)
++{
++ int err = -EBUSY;
++
++ if (device->act_log &&
++ device->act_log->nr_elements == dc->al_extents)
++ return 0;
++
++ drbd_suspend_io(device);
++ /* If IO completion is currently blocked, we would likely wait
++ * "forever" for the activity log to become unused. So we don't. */
++ if (atomic_read(&device->ap_bio_cnt))
++ goto out;
++
++ wait_event(device->al_wait, lc_try_lock(device->act_log));
++ drbd_al_shrink(device);
++ err = drbd_check_al_size(device, dc);
++ lc_unlock(device->act_log);
++ wake_up(&device->al_wait);
++out:
++ drbd_resume_io(device);
++ return err;
++}
++
+ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ {
+ struct drbd_config_context adm_ctx;
+@@ -1570,15 +1594,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- drbd_suspend_io(device);
+- wait_event(device->al_wait, lc_try_lock(device->act_log));
+- drbd_al_shrink(device);
+- err = drbd_check_al_size(device, new_disk_conf);
+- lc_unlock(device->act_log);
+- wake_up(&device->al_wait);
+- drbd_resume_io(device);
+-
++ err = disk_opts_check_al_size(device, new_disk_conf);
+ if (err) {
++ /* Could be just "busy". Ignore?
++ * Introduce dedicated error code? */
++ drbd_msg_put_info(adm_ctx.reply_skb,
++ "Try again without changing current al-extents setting");
+ retcode = ERR_NOMEM;
+ goto fail_unlock;
+ }
+--
+2.20.1
+
--- /dev/null
+From 330911eb3f8aa4d9c9b5e8fb7515eaa390931f29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:39 +0100
+Subject: drbd: fix print_st_err()'s prototype to match the definition
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 2c38f035117331eb78d0504843c79ea7c7fabf37 ]
+
+print_st_err() is defined with its 4th argument taking an
+'enum drbd_state_rv' but its prototype use an int for it.
+
+Fix this by using 'enum drbd_state_rv' in the prototype too.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_state.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index 6c9d5d4a8a753..110f64d9e91c1 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -126,7 +126,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state
+ enum chg_state_flags,
+ struct completion *done);
+ extern void print_st_err(struct drbd_device *, union drbd_state,
+- union drbd_state, int);
++ union drbd_state, enum drbd_state_rv);
+
+ enum drbd_state_rv
+ _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val,
+--
+2.20.1
+
--- /dev/null
+From 25fbc696fd7dd64ee0ea6c80cc0f4fa0c86e1bd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:31 +0100
+Subject: drbd: ignore "all zero" peer volume sizes in handshake
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit 94c43a13b8d6e3e0dd77b3536b5e04a84936b762 ]
+
+During handshake, if we are diskless ourselves, we used to accept any size
+presented by the peer.
+
+Which could be zero if that peer was just brought up and connected
+to us without having a disk attached first, in which case both
+peers would just "flip" their volume sizes.
+
+Now, even a diskless node will ignore "zero" sizes
+presented by a diskless peer.
+
+Also a currently Diskless Primary will refuse to shrink during handshake:
+it may be frozen, and waiting for a "suitable" local disk or peer to
+re-appear (on-no-data-accessible suspend-io). If the peer is smaller
+than what we used to be, it is not suitable.
+
+The logic for a diskless node during handshake is now supposed to be:
+believe the peer, if
+ - I don't have a current size myself
+ - we agree on the size anyways
+ - I do have a current size, am Secondary, and he has the only disk
+ - I do have a current size, am Primary, and he has the only disk,
+ which is larger than my current size
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 33 +++++++++++++++++++++++++++---
+ 1 file changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 8e8e4ccb128f3..bbd50d7dce43d 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -4037,6 +4037,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL;
+ enum determine_dev_size dd = DS_UNCHANGED;
+ sector_t p_size, p_usize, p_csize, my_usize;
++ sector_t new_size, cur_size;
+ int ldsc = 0; /* local disk size changed */
+ enum dds_flags ddsf;
+
+@@ -4044,6 +4045,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ if (!peer_device)
+ return config_unknown_volume(connection, pi);
+ device = peer_device->device;
++ cur_size = drbd_get_capacity(device->this_bdev);
+
+ p_size = be64_to_cpu(p->d_size);
+ p_usize = be64_to_cpu(p->u_size);
+@@ -4054,7 +4056,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ device->p_size = p_size;
+
+ if (get_ldev(device)) {
+- sector_t new_size, cur_size;
+ rcu_read_lock();
+ my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size;
+ rcu_read_unlock();
+@@ -4072,7 +4073,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ /* Never shrink a device with usable data during connect.
+ But allow online shrinking if we are connected. */
+ new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0);
+- cur_size = drbd_get_capacity(device->this_bdev);
+ if (new_size < cur_size &&
+ device->state.disk >= D_OUTDATED &&
+ device->state.conn < C_CONNECTED) {
+@@ -4137,9 +4137,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ *
+ * However, if he sends a zero current size,
+ * take his (user-capped or) backing disk size anyways.
++ *
++ * Unless of course he does not have a disk himself.
++ * In which case we ignore this completely.
+ */
++ sector_t new_size = p_csize ?: p_usize ?: p_size;
+ drbd_reconsider_queue_parameters(device, NULL, o);
+- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size);
++ if (new_size == 0) {
++ /* Ignore, peer does not know nothing. */
++ } else if (new_size == cur_size) {
++ /* nothing to do */
++ } else if (cur_size != 0 && p_size == 0) {
++ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ } else if (new_size < cur_size && device->state.role == R_PRIMARY) {
++ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD);
++ return -EIO;
++ } else {
++ /* I believe the peer, if
++ * - I don't have a current size myself
++ * - we agree on the size anyways
++ * - I do have a current size, am Secondary,
++ * and he has the only disk
++ * - I do have a current size, am Primary,
++ * and he has the only disk,
++ * which is larger than my current size
++ */
++ drbd_set_my_capacity(device, new_size);
++ }
+ }
+
+ if (get_ldev(device)) {
+--
+2.20.1
+
--- /dev/null
+From 8b1ae929fffd674c6780cb12fb79f6bebaafd4c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:35 +0100
+Subject: drbd: reject attach of unsuitable uuids even if connected
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit fe43ed97bba3b11521abd934b83ed93143470e4f ]
+
+Multiple failure scenario:
+a) all good
+ Connected Primary/Secondary UpToDate/UpToDate
+b) lose disk on Primary,
+ Connected Primary/Secondary Diskless/UpToDate
+c) continue to write to the device,
+ changes only make it to the Secondary storage.
+d) lose disk on Secondary,
+ Connected Primary/Secondary Diskless/Diskless
+e) now try to re-attach on Primary
+
+This would have succeeded before, even though that is clearly the
+wrong data set to attach to (missing the modifications from c).
+Because we only compared our "effective" and the "to-be-attached"
+data generation uuid tags if (device->state.conn < C_CONNECTED).
+
+Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE)
+compare the uuids, and reject the attach.
+
+This patch also tries to improve the reverse scenario:
+first lose Secondary, then Primary disk,
+then try to attach the disk on Secondary.
+
+Before this patch, the attach on the Secondary succeeds, but since commit
+drbd: disconnect, if the wrong UUIDs are attached on a connected peer
+the Primary will notice unsuitable data, and drop the connection hard.
+
+Though unfortunately at a point in time during the handshake where
+we cannot easily abort the attach on the peer without more
+refactoring of the handshake.
+
+We now reject any attach to "unsuitable" uuids,
+as long as we can see a Primary role,
+unless we already have access to "good" data.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 6 +++---
+ drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index abee91940a36d..ff26f676f24d1 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1927,9 +1927,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- if (device->state.conn < C_CONNECTED &&
+- device->state.role == R_PRIMARY && device->ed_uuid &&
+- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid &&
++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) &&
++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
+ drbd_err(device, "Can only attach to data with current UUID=%016llX\n",
+ (unsigned long long)device->ed_uuid);
+ retcode = ERR_DATA_NOT_CURRENT;
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index bbd50d7dce43d..a10ff6e8c20b7 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -4452,6 +4452,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info
+ if (peer_state.conn == C_AHEAD)
+ ns.conn = C_BEHIND;
+
++ /* TODO:
++ * if (primary and diskless and peer uuid != effective uuid)
++ * abort attach on peer;
++ *
++ * If this node does not have good data, was already connected, but
++ * the peer did a late attach only now, trying to "negotiate" with me,
++ * AND I am currently Primary, possibly frozen, with some specific
++ * "effective" uuid, this should never be reached, really, because
++ * we first send the uuids, then the current state.
++ *
++ * In this scenario, we already dropped the connection hard
++ * when we received the unsuitable uuids (receive_uuids().
++ *
++ * Should we want to change this, that is: not drop the connection in
++ * receive_uuids() already, then we would need to add a branch here
++ * that aborts the attach of "unsuitable uuids" on the peer in case
++ * this node is currently Diskless Primary.
++ */
++
+ if (device->p_uuid && peer_state.disk >= D_NEGOTIATING &&
+ get_ldev_if_state(device, D_NEGOTIATING)) {
+ int cr; /* consider resync */
+--
+2.20.1
+
--- /dev/null
+From 4ed6260eb66b5bbe0899d3314e22042a2ecacc27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:29:05 -0800
+Subject: drivers/base/platform.c: kmemleak ignore a known leak
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 967d3010df8b6f6f9aa95c198edc5fe3646ebf36 ]
+
+unreferenced object 0xffff808ec6dc5a80 (size 128):
+ comm "swapper/0", pid 1, jiffies 4294938063 (age 2560.530s)
+ hex dump (first 32 bytes):
+ ff ff ff ff 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
+ 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ backtrace:
+ [<00000000476dcf8c>] kmem_cache_alloc_trace+0x430/0x500
+ [<000000004f708d37>] platform_device_register_full+0xbc/0x1e8
+ [<000000006c2a7ec7>] acpi_create_platform_device+0x370/0x450
+ [<00000000ef135642>] acpi_default_enumeration+0x34/0x78
+ [<000000003bd9a052>] acpi_bus_attach+0x2dc/0x3e0
+ [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+ [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+ [<000000002968643e>] acpi_bus_scan+0xb0/0x110
+ [<0000000010dd0bd7>] acpi_scan_init+0x1a8/0x410
+ [<00000000965b3c5a>] acpi_init+0x408/0x49c
+ [<00000000ed4b9fe2>] do_one_initcall+0x178/0x7f4
+ [<00000000a5ac5a74>] kernel_init_freeable+0x9d4/0xa9c
+ [<0000000070ea6c15>] kernel_init+0x18/0x138
+ [<00000000fb8fff06>] ret_from_fork+0x10/0x1c
+ [<0000000041273a0d>] 0xffffffffffffffff
+
+Then, faddr2line pointed out this line,
+
+/*
+ * This memory isn't freed when the device is put,
+ * I don't have a nice idea for that though. Conceptually
+ * dma_mask in struct device should not be a pointer.
+ * See http://thread.gmane.org/gmane.linux.kernel.pci/9081
+ */
+pdev->dev.dma_mask =
+ kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
+
+Since this leak has existed for more than 8 years and it does not
+reference other parts of the memory, let kmemleak ignore it, so users
+don't need to waste time reporting this in the future.
+
+Link: http://lkml.kernel.org/r/20181206160751.36211-1-cai@gmx.us
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J . Wysocki" <rafael.j.wysocki@intel.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 14ff40371f013..f90b1b9bbad0d 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -27,6 +27,7 @@
+ #include <linux/clk/clk-conf.h>
+ #include <linux/limits.h>
+ #include <linux/property.h>
++#include <linux/kmemleak.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -516,6 +517,8 @@ struct platform_device *platform_device_register_full(
+ if (!pdev->dev.dma_mask)
+ goto err;
+
++ kmemleak_ignore(pdev->dev.dma_mask);
++
+ *pdev->dev.dma_mask = pdevinfo->dma_mask;
+ pdev->dev.coherent_dma_mask = pdevinfo->dma_mask;
+ }
+--
+2.20.1
+
--- /dev/null
+From b20373929c2cfdb75ff65f9539423c6cc954975b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 23:04:13 -0600
+Subject: drivers/regulator: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad ]
+
+If palmas_smps_read() fails, we should not use the read data in "reg"
+which may contain random value. The fix inserts a check for the return
+value of palmas_smps_read(): If it fails, we return the error code
+upstream and stop using "reg".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/palmas-regulator.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index f11d41dad9c13..1eb605b6f0492 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -435,13 +435,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg,
+ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
+ {
+ int id = rdev_get_id(dev);
++ int ret;
+ struct palmas_pmic *pmic = rdev_get_drvdata(dev);
+ struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata;
+ struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id];
+ unsigned int reg;
+ bool rail_enable = true;
+
+- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ if (ret)
++ return ret;
+
+ reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+--
+2.20.1
+
--- /dev/null
+From b8bc6400be4f315bfaef65ffadcd5f27ee10571d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 08:29:32 -0600
+Subject: gfs2: take jdata unstuff into account in do_grow
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit bc0205612bbd4dd4026d4ba6287f5643c37366ec ]
+
+Before this patch, function do_grow would not reserve enough journal
+blocks in the transaction to unstuff jdata files while growing them.
+This patch adds the logic to add one more block if the file to grow
+is jdata.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/bmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 39af17b407f00..d83e99fa98b3a 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1236,6 +1236,8 @@ static int do_grow(struct inode *inode, u64 size)
+ }
+
+ error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT +
++ (unstuff &&
++ gfs2_is_jdata(ip) ? RES_JDATA : 0) +
+ (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ?
+ 0 : RES_QUOTA), 0);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From 2ae76f7f77e4483d5f2063d22b60b7fa5fd9f66a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 10:45:49 +0100
+Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c5510b8dafce5f3f5a039c9b262ebcae0092c462 ]
+
+If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return
+the same type of error as regular version: NULL. All the callers
+compare the return value of gpio_to_desc() against NULL, so returned
+ERR_PTR would be treated as non-error case leading to dereferencing of
+error value.
+
+Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index fb0fde686cb1f..4a9838feb0866 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -398,7 +398,7 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
+
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+- return ERR_PTR(-EINVAL);
++ return NULL;
+ }
+
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+--
+2.20.1
+
--- /dev/null
+From 574dca8f9b180b3bb2b48c977793ba68bd3340e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:28:51 +1000
+Subject: HID: doc: fix wrong data structure reference for UHID_OUTPUT
+
+From: Peter Hutterer <peter.hutterer@who-t.net>
+
+[ Upstream commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 ]
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hid/uhid.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
+index c8656dd029a91..958fff9453044 100644
+--- a/Documentation/hid/uhid.txt
++++ b/Documentation/hid/uhid.txt
+@@ -160,7 +160,7 @@ them but you should handle them according to your needs.
+ UHID_OUTPUT:
+ This is sent if the HID device driver wants to send raw data to the I/O
+ device on the interrupt channel. You should read the payload and forward it to
+- the device. The payload is of type "struct uhid_data_req".
++ the device. The payload is of type "struct uhid_output_req".
+ This may be received even though you haven't received UHID_OPEN, yet.
+
+ UHID_GET_REPORT:
+--
+2.20.1
+
--- /dev/null
+From 0f0ff6a030328fbda67f8b0dde67d23408684162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:52:33 +0800
+Subject: HID: intel-ish-hid: fixes incorrect error handling
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 6e0856d317440a950b17c00a9283114f025e5699 ]
+
+The memory chunk allocated by hid_allocate_device() should be released
+by hid_destroy_device(), not kfree().
+
+Fixes: 0b28cb4bcb1("HID: intel-ish-hid: ISH HID client driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ishtp-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c
+index 277983aa1d90a..d0b902285fc3a 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.c
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c
+@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,
+ err_hid_device:
+ kfree(hid_data);
+ err_hid_data:
+- kfree(hid);
++ hid_destroy_device(hid);
+ return rv;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 32858b832a94acf5ab05d2878dba40f5184e89c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 10:05:36 +0300
+Subject: IB/qib: Fix an error code in qib_sdma_verbs_send()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 ]
+
+We accidentally return success on this error path.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
+index 891873b38a1e6..5f3f197678b78 100644
+--- a/drivers/infiniband/hw/qib/qib_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_sdma.c
+@@ -600,8 +600,10 @@ retry:
+ dw = (len + 3) >> 2;
+ addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
+ dw << 2, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
++ ret = -ENOMEM;
+ goto unmap;
++ }
+ sdmadesc[0] = 0;
+ make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
+ /* SDmaUseLargeBuf has to be set in every descriptor */
+--
+2.20.1
+
--- /dev/null
+From 127a7266388515bf6c58e6b8170e0b5def6d69f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2019 21:53:24 +0800
+Subject: iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit bb6bccba390c7d743c1e4427de4ef284c8cc6869 ]
+
+Add a non-NULL check to fix potential NULL pointer dereference
+Cleanup code to call function once.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Fixes: 2bf9a0a12749b ('iommu/amd: Add iommu support for ACPI HID devices')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index e81acb2b6ee7d..c898c70472bb2 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -176,10 +176,14 @@ static struct lock_class_key reserved_rbtree_key;
+ static inline int match_hid_uid(struct device *dev,
+ struct acpihid_map_entry *entry)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(dev);
+ const char *hid, *uid;
+
+- hid = acpi_device_hid(ACPI_COMPANION(dev));
+- uid = acpi_device_uid(ACPI_COMPANION(dev));
++ if (!adev)
++ return -ENODEV;
++
++ hid = acpi_device_hid(adev);
++ uid = acpi_device_uid(adev);
+
+ if (!hid || !(*hid))
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 1e0e5156dce84205919e6e1215deb7c697ac1ceb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 13:11:25 +0800
+Subject: ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit d71b57532d70c03f4671dd04e84157ac6bf021b0 ]
+
+ip l add dev tun type gretap key 1000
+ip a a dev tun 10.0.0.1/24
+
+Packets with tun-id 1000 can be recived by tun dev. But packet can't
+be sent through dev tun for non-tunnel-dst
+
+With this patch: tunnel-dst can be get through lwtunnel like beflow:
+ip r a 10.0.0.7 encap ip dst 172.168.0.11 dev tun
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index e6ee6acac80c4..a4db2d79b9134 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -653,13 +653,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ dst = tnl_params->daddr;
+ if (dst == 0) {
+ /* NBMA tunnel */
++ struct ip_tunnel_info *tun_info;
+
+ if (!skb_dst(skb)) {
+ dev->stats.tx_fifo_errors++;
+ goto tx_error;
+ }
+
+- if (skb->protocol == htons(ETH_P_IP)) {
++ tun_info = skb_tunnel_info(skb);
++ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
++ ip_tunnel_info_af(tun_info) == AF_INET &&
++ tun_info->key.u.ipv4.dst)
++ dst = tun_info->key.u.ipv4.dst;
++ else if (skb->protocol == htons(ETH_P_IP)) {
+ rt = skb_rtable(skb);
+ dst = rt_nexthop(rt, inner_iph->daddr);
+ }
+--
+2.20.1
+
--- /dev/null
+From 0a45fd71150e172336e9ebc1386bb084300f962c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 15:32:06 +0100
+Subject: KVM: s390: unregister debug feature on failing arch init
+
+From: Michael Mueller <mimu@linux.ibm.com>
+
+[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
+
+Make sure the debug feature and its allocated resources get
+released upon unsuccessful architecture initialization.
+
+A related indication of the issue will be reported as kernel
+message.
+
+Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 37c254677ccda..d8fd2eadcda7f 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -319,19 +319,30 @@ static void kvm_s390_cpu_feat_init(void)
+
+ int kvm_arch_init(void *opaque)
+ {
++ int rc;
++
+ kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
+ if (!kvm_s390_dbf)
+ return -ENOMEM;
+
+ if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
+- debug_unregister(kvm_s390_dbf);
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto out_debug_unreg;
+ }
+
+ kvm_s390_cpu_feat_init();
+
+ /* Register floating interrupt controller interface. */
+- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ if (rc) {
++ pr_err("Failed to register FLIC rc=%d\n", rc);
++ goto out_debug_unreg;
++ }
++ return 0;
++
++out_debug_unreg:
++ debug_unregister(kvm_s390_dbf);
++ return rc;
+ }
+
+ void kvm_arch_exit(void)
+--
+2.20.1
+
--- /dev/null
+From 73fbedb2b7f6fc9806a57a94ea02e341a9f108ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:44 -0800
+Subject: lib/genalloc.c: fix allocation of aligned buffer from non-aligned
+ chunk
+
+From: Alexey Skidanov <alexey.skidanov@intel.com>
+
+[ Upstream commit 52fbf1134d479234d7e64ba9dcbaea23405f229e ]
+
+gen_pool_alloc_algo() uses different allocation functions implementing
+different allocation algorithms. With gen_pool_first_fit_align()
+allocation function, the returned address should be aligned on the
+requested boundary.
+
+If chunk start address isn't aligned on the requested boundary, the
+returned address isn't aligned too. The only way to get properly
+aligned address is to initialize the pool with chunks aligned on the
+requested boundary. If want to have an ability to allocate buffers
+aligned on different boundaries (for example, 4K, 1MB, ...), the chunk
+start address should be aligned on the max possible alignment.
+
+This happens because gen_pool_first_fit_align() looks for properly
+aligned memory block without taking into account the chunk start address
+alignment.
+
+To fix this, we provide chunk start address to
+gen_pool_first_fit_align() and change its implementation such that it
+starts looking for properly aligned block with appropriate offset
+(exactly as is done in CMA).
+
+Link: https://lkml.kernel.org/lkml/a170cf65-6884-3592-1de9-4c235888cc8a@intel.com
+Link: http://lkml.kernel.org/r/1541690953-4623-1-git-send-email-alexey.skidanov@intel.com
+Signed-off-by: Alexey Skidanov <alexey.skidanov@intel.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Logan Gunthorpe <logang@deltatee.com>
+Cc: Daniel Mentz <danielmentz@google.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/genalloc.h | 13 +++++++------
+ lib/genalloc.c | 20 ++++++++++++--------
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
+index 206fe3bcccccd..575f2dee8cf71 100644
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -50,7 +50,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map,
+ unsigned long size,
+ unsigned long start,
+ unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool,
++ unsigned long start_addr);
+
+ /*
+ * General purpose special memory pool descriptor.
+@@ -130,24 +131,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo,
+
+ extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_fixed_alloc(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_first_fit_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern struct gen_pool *devm_gen_pool_create(struct device *dev,
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index ca06adc4f4451..5deb25c40a5a1 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -311,7 +311,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ end_bit = chunk_size(chunk) >> order;
+ retry:
+ start_bit = algo(chunk->bits, end_bit, start_bit,
+- nbits, data, pool);
++ nbits, data, pool, chunk->start_addr);
+ if (start_bit >= end_bit)
+ continue;
+ remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
+@@ -525,7 +525,7 @@ EXPORT_SYMBOL(gen_pool_set_algo);
+ */
+ unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ return bitmap_find_next_zero_area(map, size, start, nr, 0);
+ }
+@@ -543,16 +543,19 @@ EXPORT_SYMBOL(gen_pool_first_fit);
+ */
+ unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_align *alignment;
+- unsigned long align_mask;
++ unsigned long align_mask, align_off;
+ int order;
+
+ alignment = data;
+ order = pool->min_alloc_order;
+ align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+- return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
++ align_off = (start_addr & (alignment->align - 1)) >> order;
++
++ return bitmap_find_next_zero_area_off(map, size, start, nr,
++ align_mask, align_off);
+ }
+ EXPORT_SYMBOL(gen_pool_first_fit_align);
+
+@@ -567,7 +570,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align);
+ */
+ unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_fixed *fixed_data;
+ int order;
+@@ -601,7 +604,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc);
+ */
+ unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start,
+- unsigned int nr, void *data, struct gen_pool *pool)
++ unsigned int nr, void *data, struct gen_pool *pool,
++ unsigned long start_addr)
+ {
+ unsigned long align_mask = roundup_pow_of_two(nr) - 1;
+
+@@ -624,7 +628,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
+ */
+ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ unsigned long start_bit = size;
+ unsigned long len = size + 1;
+--
+2.20.1
+
--- /dev/null
+From b6b8c5308a13948fa1b1e62902104ae19c10ca27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 13:21:18 -0800
+Subject: lib/genalloc.c: include vmalloc.h
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit 35004f2e55807a1a1491db24ab512dd2f770a130 ]
+
+Fixes build break on most ARM/ARM64 defconfigs:
+
+ lib/genalloc.c: In function 'gen_pool_add_virt':
+ lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'?
+ lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ lib/genalloc.c: In function 'gen_pool_destroy':
+ lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'?
+
+Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap')
+Cc: Huang Shijie <sjhuang@iluvatar.ai>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index f365d71cdc774..7e85d1e37a6ea 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -35,6 +35,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/genalloc.h>
+ #include <linux/of_device.h>
++#include <linux/vmalloc.h>
+
+ static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
+ {
+--
+2.20.1
+
--- /dev/null
+From e0f751f37cd247227753641d1d749d4e59521ae2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:51 -0800
+Subject: lib/genalloc.c: use vzalloc_node() to allocate the bitmap
+
+From: Huang Shijie <sjhuang@iluvatar.ai>
+
+[ Upstream commit 6862d2fc81859f88c1f3f660886427893f2b4f3f ]
+
+Some devices may have big memory on chip, such as over 1G. In some
+cases, the nbytes maybe bigger then 4M which is the bounday of the
+memory buddy system (4K default).
+
+So use vzalloc_node() to allocate the bitmap. Also use vfree to free
+it.
+
+Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai
+Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 5deb25c40a5a1..f365d71cdc774 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -187,7 +187,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ int nbytes = sizeof(struct gen_pool_chunk) +
+ BITS_TO_LONGS(nbits) * sizeof(long);
+
+- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid);
++ chunk = vzalloc_node(nbytes, nid);
+ if (unlikely(chunk == NULL))
+ return -ENOMEM;
+
+@@ -251,7 +251,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ bit = find_next_bit(chunk->bits, end_bit, 0);
+ BUG_ON(bit < end_bit);
+
+- kfree(chunk);
++ vfree(chunk);
+ }
+ kfree_const(pool->name);
+ kfree(pool);
+--
+2.20.1
+
--- /dev/null
+From fda354ec5ca0b7de44666930262765bf5342d63b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 06:12:43 -0600
+Subject: mac80211: fix station inactive_time shortly after boot
+
+From: Ahmed Zaki <anzaki@gmail.com>
+
+[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ]
+
+In the first 5 minutes after boot (time of INITIAL_JIFFIES),
+ieee80211_sta_last_active() returns zero if last_ack is zero. This
+leads to "inactive time" showing jiffies_to_msecs(jiffies).
+
+ # iw wlan0 station get fc:ec:da:64:a6:dd
+ Station fc:ec:da:64:a6:dd (on wlan0)
+ inactive time: 4294894049 ms
+ .
+ .
+ connected time: 70 seconds
+
+Fix by returning last_rx if last_ack == 0.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 892c392ff8fcc..8e8a185dbb9b1 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2305,7 +2305,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+ struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
+
+- if (time_after(stats->last_rx, sta->status_stats.last_ack))
++ if (!sta->status_stats.last_ack ||
++ time_after(stats->last_rx, sta->status_stats.last_ack))
+ return stats->last_rx;
+ return sta->status_stats.last_ack;
+ }
+--
+2.20.1
+
--- /dev/null
+From 524e9174ecba6815ec57aba17e9828c60e3c6929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:52 +0900
+Subject: microblaze: adjust the help to the real behavior
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit bafcc61d998c1ca18f556d92a0e95335ac68c7da ]
+
+"make ARCH=microblaze help" mentions simpleImage.<dt>.unstrip,
+but it is not a real Make target. It does not work because Makefile
+assumes "system.unstrip" is the name of DT.
+
+$ make ARCH=microblaze CROSS_COMPILE=microblaze-linux- simpleImage.system.unstrip
+ [ snip ]
+make[1]: *** No rule to make target 'arch/microblaze/boot/dts/system.unstrip.dtb', needed by 'arch/microblaze/boot/dts/system.dtb'. Stop.
+make: *** [Makefile;1060: arch/microblaze/boot/dts] Error 2
+make: *** Waiting for unfinished jobs....
+
+simpleImage.<dt> works like a phony target that generates multiple
+images. Reflect the real behavior. I removed the DT directory path
+information because it is already explained a few lines below.
+
+While I am here, I deleted the redundant *_defconfig explanation.
+
+The top-level Makefile caters to list available defconfig files:
+
+ mmu_defconfig - Build for mmu
+ nommu_defconfig - Build for nommu
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 740f2b82a182a..5e1e18540a571 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -83,11 +83,11 @@ define archhelp
+ echo '* linux.bin - Create raw binary'
+ echo ' linux.bin.gz - Create compressed raw binary'
+ echo ' linux.bin.ub - Create U-Boot wrapped raw binary'
+- echo ' simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
+- echo ' - stripped elf with fdt blob'
+- echo ' simpleImage.<dt>.unstrip - full ELF image with fdt blob'
+- echo ' *_defconfig - Select default config from arch/microblaze/configs'
+- echo ''
++ echo ' simpleImage.<dt> - Create the following images with <dt>.dtb linked in'
++ echo ' simpleImage.<dt> : raw image'
++ echo ' simpleImage.<dt>.ub : raw image with U-Boot header'
++ echo ' simpleImage.<dt>.unstrip: ELF (identical to vmlinux)'
++ echo ' simpleImage.<dt>.strip : stripped ELF'
+ echo ' Targets with <dt> embed a device tree blob inside the image'
+ echo ' These targets support board with firmware that does not'
+ echo ' support passing a device tree directly. Replace <dt> with the'
+--
+2.20.1
+
--- /dev/null
+From b206c6371534ac1fa7274f2b30825418fa4b053e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:53 +0900
+Subject: microblaze: move "... is ready" messages to arch/microblaze/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 2e14f94cf4bc2f15ca5362e81ca3a987c79e3062 ]
+
+To prepare for more fixes, move this to arch/microblaze/Makefile.
+Otherwise, the same "... is ready" would be printed multiple times.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 2 ++
+ arch/microblaze/boot/Makefile | 4 ----
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 5e1e18540a571..491676a6cde57 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -75,9 +75,11 @@ archclean:
+
+ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ simpleImage.%: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ define archhelp
+ echo '* linux.bin - Create raw binary'
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 0f3fe6a151dce..22bed08ec7f28 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -8,15 +8,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+
+ $(obj)/linux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(call if_changed,uimage)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ $(call if_changed,gzip)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ quiet_cmd_cp = CP $< $@$2
+ cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+@@ -34,6 +31,5 @@ $(obj)/simpleImage.%: vmlinux FORCE
+ $(call if_changed,objcopy)
+ $(call if_changed,uimage)
+ $(call if_changed,strip,.strip)
+- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+
+ clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb
+--
+2.20.1
+
--- /dev/null
+From e03ce269c9f0b3e6b29cc19c0b3ae8834c46fbd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jan 2019 15:36:54 +0100
+Subject: mtd: Check add_mtd_device() ret code
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit 2b6f0090a3335b7bdd03ca520c35591159463041 ]
+
+add_mtd_device() can fail. We should always check its return value
+and gracefully handle the failure case. Fix the call sites where this
+not done (in mtdpart.c) and add a __must_check attribute to the
+prototype to avoid this kind of mistakes.
+
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.h | 2 +-
+ drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++-----
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
+index 55fdb8e1fd2a8..488b652ba9e63 100644
+--- a/drivers/mtd/mtdcore.h
++++ b/drivers/mtd/mtdcore.h
+@@ -6,7 +6,7 @@
+ extern struct mutex mtd_table_mutex;
+
+ struct mtd_info *__mtd_next_device(int i);
+-int add_mtd_device(struct mtd_info *mtd);
++int __must_check add_mtd_device(struct mtd_info *mtd);
+ int del_mtd_device(struct mtd_info *mtd);
+ int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
+ int del_mtd_partitions(struct mtd_info *);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index fccdd49bb9640..70e476c1c474d 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -648,10 +648,22 @@ int mtd_add_partition(struct mtd_info *master, const char *name,
+ list_add(&new->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&new->mtd);
++ ret = add_mtd_device(&new->mtd);
++ if (ret)
++ goto err_remove_part;
+
+ mtd_add_partition_attrs(new);
+
++ return 0;
++
++err_remove_part:
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&new->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(new);
++ pr_info("%s:%i\n", __func__, __LINE__);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(mtd_add_partition);
+@@ -696,28 +708,42 @@ int add_mtd_partitions(struct mtd_info *master,
+ {
+ struct mtd_part *slave;
+ uint64_t cur_offset = 0;
+- int i;
++ int i, ret;
+
+ printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+
+ for (i = 0; i < nbparts; i++) {
+ slave = allocate_partition(master, parts + i, i, cur_offset);
+ if (IS_ERR(slave)) {
+- del_mtd_partitions(master);
+- return PTR_ERR(slave);
++ ret = PTR_ERR(slave);
++ goto err_del_partitions;
+ }
+
+ mutex_lock(&mtd_partitions_mutex);
+ list_add(&slave->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&slave->mtd);
++ ret = add_mtd_device(&slave->mtd);
++ if (ret) {
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&slave->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(slave);
++ goto err_del_partitions;
++ }
++
+ mtd_add_partition_attrs(slave);
+
+ cur_offset = slave->offset + slave->mtd.size;
+ }
+
+ return 0;
++
++err_del_partitions:
++ del_mtd_partitions(master);
++
++ return ret;
+ }
+
+ static DEFINE_SPINLOCK(part_parser_lock);
+--
+2.20.1
+
--- /dev/null
+From e7c4d78ccfcd60819013b1cc093098455375b840 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 09:34:17 +0100
+Subject: mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET
+
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+
+[ Upstream commit 732774437ae01d9882e60314e303898e63c7f038 ]
+
+The opcodes used by the controller when doing batched page prog should
+be written in NFC_REG_WCMD_SET not FC_REG_RCMD_SET. Luckily, the
+default NFC_REG_WCMD_SET value matches the one we set in the driver
+which explains why we didn't notice the problem.
+
+Fixes: 614049a8d904 ("mtd: nand: sunxi: add support for DMA assisted operations")
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/sunxi_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
+index e26c4f880df66..886355bfa7617 100644
+--- a/drivers/mtd/nand/sunxi_nand.c
++++ b/drivers/mtd/nand/sunxi_nand.c
+@@ -1420,7 +1420,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd,
+ sunxi_nfc_randomizer_enable(mtd);
+
+ writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
+- nfc->regs + NFC_REG_RCMD_SET);
++ nfc->regs + NFC_REG_WCMD_SET);
+
+ dma_async_issue_pending(nfc->dmac);
+
+--
+2.20.1
+
--- /dev/null
+From b407e138a038fce637f1b483656d2a35ad744dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 09:47:00 +0100
+Subject: mtd: Remove a debug trace in mtdpart.c
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit bda2ab56356b9acdfab150f31c4bac9846253092 ]
+
+Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained
+a leftover of the debug session that led to this bug fix. Remove this
+pr_info().
+
+Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code")
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 70e476c1c474d..5e2d1aa5e81e1 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -662,7 +662,6 @@ err_remove_part:
+ mutex_unlock(&mtd_partitions_mutex);
+
+ free_partition(new);
+- pr_info("%s:%i\n", __func__, __LINE__);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 39a6d9cf3334433cf60e72ee8e9800dfbb9895e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 14:26:55 -0800
+Subject: mwifiex: debugfs: correct histogram spacing, formatting
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 4cb777c64e030778c569f605398d7604d8aabc0f ]
+
+Currently, snippets of this file look like:
+
+rx rates (in Mbps): 0=1M 1=2M2=5.5M 3=11M 4=6M 5=9M 6=12M
+7=18M 8=24M 9=36M 10=48M 11=54M12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)
+44-53=MCS0-9(VHT:BW20)54-63=MCS0-9(VHT:BW40)64-73=MCS0-9(VHT:BW80)
+...
+noise_flr[--96dBm] = 22
+noise_flr[--95dBm] = 149
+noise_flr[--94dBm] = 9
+noise_flr[--93dBm] = 2
+
+We're missing some spaces, and we're adding a minus sign ('-') on values
+that are already negative signed integers.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index ae2b69db59940..6eacea28d7ac8 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -296,15 +296,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ "total samples = %d\n",
+ atomic_read(&phist_data->num_samples));
+
+- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M");
+- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n");
+- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M");
+- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
++ p += sprintf(p,
++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n"
++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+ if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
++ p += sprintf(p,
++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n");
+ } else {
+ p += sprintf(p, "\n");
+ }
+@@ -333,7 +331,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+ value = atomic_read(&phist_data->noise_flr[i]);
+ if (value)
+- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n",
+ (int)(i-128), value);
+ }
+ for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+--
+2.20.1
+
--- /dev/null
+From 23a84f63058b8fd78c4b2200089ffd835a64295f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:25:19 +0800
+Subject: mwifiex: fix potential NULL dereference and use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]
+
+There are two defects: (1) passing a NULL bss to
+mwifiex_save_hidden_ssid_channels will result in NULL dereference,
+(2) using bss after dropping the reference to it via cfg80211_put_bss.
+To fix them, the patch moves the buggy code to the branch that bss is
+not NULL and puts it before cfg80211_put_bss.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/scan.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index 7e96b6a37946a..828c6f5eb83c8 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1890,15 +1890,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ ETH_ALEN))
+ mwifiex_update_curr_bss_params(priv,
+ bss);
+- cfg80211_put_bss(priv->wdev.wiphy, bss);
+- }
+
+- if ((chan->flags & IEEE80211_CHAN_RADAR) ||
+- (chan->flags & IEEE80211_CHAN_NO_IR)) {
+- mwifiex_dbg(adapter, INFO,
+- "radar or passive channel %d\n",
+- channel);
+- mwifiex_save_hidden_ssid_channels(priv, bss);
++ if ((chan->flags & IEEE80211_CHAN_RADAR) ||
++ (chan->flags & IEEE80211_CHAN_NO_IR)) {
++ mwifiex_dbg(adapter, INFO,
++ "radar or passive channel %d\n",
++ channel);
++ mwifiex_save_hidden_ssid_channels(priv,
++ bss);
++ }
++
++ cfg80211_put_bss(priv->wdev.wiphy, bss);
+ }
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From f1af6ac180c58d7f5b641935ba11dcc2e2b56454 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:38:43 +0300
+Subject: net/core/neighbour: fix kmemleak minimal reference count for hash
+ tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 01b833ab44c9e484060aad72267fc7e71beb559b ]
+
+This should be 1 for normal allocations, 0 disables leak reporting.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
+Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 1e2b0c258aa88..44a29be7bfff3 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -332,7 +332,7 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
+- kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+ }
+ if (!buckets) {
+ kfree(ret);
+--
+2.20.1
+
--- /dev/null
+From 1dbff65b8e27e961c453c24250ce77b336f25be5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jan 2019 12:30:00 +0300
+Subject: net/core/neighbour: tell kmemleak about hash tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 ]
+
+This fixes false-positive kmemleak reports about leaked neighbour entries:
+
+unreferenced object 0xffff8885c6e4d0a8 (size 1024):
+ comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff ........ ,......
+ 08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00 ..._......}.....
+ backtrace:
+ [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40
+ [<0000000036d7a0d8>] ip6_output+0x1ba/0x600
+ [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0
+ [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0
+ [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0
+ [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0
+ [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0
+ [<000000008698009d>] __sys_sendmsg+0xde/0x170
+ [<00000000889dacf1>] do_syscall_64+0x9b/0x400
+ [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<000000005767ed39>] 0xffffffffffffffff
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 6e964fec45cf8..1e2b0c258aa88 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -18,6 +18,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/slab.h>
++#include <linux/kmemleak.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -325,12 +326,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
+ if (!ret)
+ return NULL;
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ buckets = kzalloc(size, GFP_ATOMIC);
+- else
++ } else {
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
++ kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ }
+ if (!buckets) {
+ kfree(ret);
+ return NULL;
+@@ -350,10 +353,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
+ size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
+ struct neighbour __rcu **buckets = nht->hash_buckets;
+
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ kfree(buckets);
+- else
++ } else {
++ kmemleak_free(buckets);
+ free_pages((unsigned long)buckets, get_order(size));
++ }
+ kfree(nht);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a991f8d3fe717f30d217e51c9146e054a4b99cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 13:37:26 +0300
+Subject: net: dev: Use unsigned integer as an argument to left-shift
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f4d7b3e23d259c44f1f1c39645450680fcd935d6 ]
+
+1 << 31 is Undefined Behaviour according to the C standard.
+Use U type modifier to avoid theoretical overflow.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 2ecf0f32444e0..29ed5977ac041 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3565,7 +3565,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ if (debug_value == 0) /* no output */
+ return 0;
+ /* set low N bits */
+- return (1 << debug_value) - 1;
++ return (1U << debug_value) - 1;
+ }
+
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+--
+2.20.1
+
--- /dev/null
+From 9336d3e72101492c49cc0c01807635722d8013bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:08:18 -0600
+Subject: net: dsa: bcm_sf2: Propagate error value from mdio_write
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit e49505f7255be8ced695919c08a29bf2c3d79616 ]
+
+Both bcm_sf2_sw_indir_rw and mdiobus_write_nested could fail, so let's
+return their error codes upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index c2cd540e9c9ec..a3a8d7b62f3fb 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -405,11 +405,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum,
+ * send them to our master MDIO bus controller
+ */
+ if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr))
+- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
++ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
+ else
+- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val);
+-
+- return 0;
++ return mdiobus_write_nested(priv->master_mii_bus, addr,
++ regnum, val);
+ }
+
+ static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id)
+--
+2.20.1
+
--- /dev/null
+From c16d1cecb18d8fe380d5b13c78cf40ab69bfeca4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 23:50:00 +0800
+Subject: net: fec: add missed clk_disable_unprepare in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ]
+
+This driver forgets to disable and unprepare clks when remove.
+Add calls to clk_disable_unprepare to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 92ea760c48226..f50ebabd8cc63 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3539,6 +3539,8 @@ fec_drv_remove(struct platform_device *pdev)
+ regulator_disable(fep->reg_phy);
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ clk_disable_unprepare(fep->clk_ahb);
++ clk_disable_unprepare(fep->clk_ipg);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+--
+2.20.1
+
--- /dev/null
+From ed7cc020649afaddfee918c03f4116318c6fa173 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 12:26:27 -0800
+Subject: net: fix possible overflow in __sk_mem_raise_allocated()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5bf325a53202b8728cf7013b72688c46071e212e ]
+
+With many active TCP sockets, fat TCP sockets could fool
+__sk_mem_raise_allocated() thanks to an overflow.
+
+They would increase their share of the memory, instead
+of decreasing it.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ net/core/sock.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index d8d14ae8892a7..aed436567d70b 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1201,7 +1201,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
+ percpu_counter_inc(sk->sk_prot->sockets_allocated);
+ }
+
+-static inline int
++static inline u64
+ sk_sockets_allocated_read_positive(struct sock *sk)
+ {
+ return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index d224933514074..41794a698da66 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2156,7 +2156,7 @@ int __sk_mem_schedule(struct sock *sk, int size, int kind)
+ }
+
+ if (sk_has_memory_pressure(sk)) {
+- int alloc;
++ u64 alloc;
+
+ if (!sk_under_memory_pressure(sk))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From b1074614abc19c6aa5aff1dbc006bd2ce53b6205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 13:15:11 +0200
+Subject: net/mlx5: Continue driver initialization despite debugfs failure
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 199fa087dc6b503baad06712716fac645a983e8a ]
+
+The failure to create debugfs entry is unpleasant event, but not enough
+to abort drier initialization. Align the mlx5_core code to debugfs design
+and continue execution whenever debugfs_create_dir() successes or not.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index d676088512cf8..c9fb589690ee9 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -786,11 +786,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+
+ priv->numa_node = dev_to_node(&dev->pdev->dev);
+
+- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+- if (!priv->dbg_root) {
+- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+- return -ENOMEM;
+- }
++ if (mlx5_debugfs_root)
++ priv->dbg_root =
++ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root);
+
+ err = mlx5_pci_enable_device(dev);
+ if (err) {
+--
+2.20.1
+
--- /dev/null
+From 43b6f9171d24e86d0e6c4930eb2e6890544e9155 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 19:42:38 -0600
+Subject: net/net_namespace: Check the return value of register_pernet_subsys()
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c ]
+
+In net_ns_init(), register_pernet_subsys() could fail while registering
+network namespace subsystems. The fix checks the return value and
+sends a panic() on failure.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/net_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 4509dec7bd1cd..7630fa80db92a 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -802,7 +802,8 @@ static int __init net_ns_init(void)
+
+ mutex_unlock(&net_mutex);
+
+- register_pernet_subsys(&net_ns_ops);
++ if (register_pernet_subsys(&net_ns_ops))
++ panic("Could not register network namespace subsystems");
+
+ rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL, NULL);
+ rtnl_register(PF_UNSPEC, RTM_GETNSID, rtnl_net_getid, rtnl_net_dumpid,
+--
+2.20.1
+
--- /dev/null
+From fd5a41b2a06798ad1d45457a7ace5be5847bc3f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:57:14 -0600
+Subject: net: stmicro: fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit f86a3b83833e7cfe558ca4d70b64ebc48903efec ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index d07520fb969e6..62ccbd47c1db2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ gmac->clk_enabled = 1;
+ } else {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+- clk_prepare(gmac->tx_clk);
++ ret = clk_prepare(gmac->tx_clk);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 67463d02de685909d56c04f424e1f2417b04a70d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 16:28:30 +0800
+Subject: net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit 40752b3eae29f8ca2378e978a02bd6dbeeb06d16 ]
+
+This patch fixes potential double frees if register_hdlc_device() fails.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Peng Hao <peng.hao2@zte.com.cn>
+CC: Zhao Qiang <qiang.zhao@nxp.com>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: netdev@vger.kernel.org
+CC: linuxppc-dev@lists.ozlabs.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 7a62316c570d2..b2c1e872d5ed5 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -1117,7 +1117,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ if (register_hdlc_device(dev)) {
+ ret = -ENOBUFS;
+ pr_err("ucc_hdlc: unable to register hdlc device\n");
+- free_netdev(dev);
+ goto free_dev;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9c9b97a4c238cc58e2cba6750da42b1f02dcd9b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:32:53 -0800
+Subject: ocfs2: clear journal dirty flag after shutdown journal
+
+From: Junxiao Bi <junxiao.bi@oracle.com>
+
+[ Upstream commit d85400af790dba2aa294f0a77e712f166681f977 ]
+
+Dirty flag of the journal should be cleared at the last stage of umount,
+if do it before jbd2_journal_destroy(), then some metadata in uncommitted
+transaction could be lost due to io error, but as dirty flag of journal
+was already cleared, we can't find that until run a full fsck. This may
+cause system panic or other corruption.
+
+Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index a30f63623db70..13cf69aa4cae8 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ mlog_errno(status);
+ }
+
+- if (status == 0) {
++ /* Shutdown the kernel journal system */
++ if (!jbd2_journal_destroy(journal->j_journal) && !status) {
+ /*
+ * Do not toggle if flush was unsuccessful otherwise
+ * will leave dirty metadata in a "clean" journal
+@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ if (status < 0)
+ mlog_errno(status);
+ }
+-
+- /* Shutdown the kernel journal system */
+- jbd2_journal_destroy(journal->j_journal);
+ journal->j_journal = NULL;
+
+ OCFS2_I(inode)->ip_open_count--;
+--
+2.20.1
+
--- /dev/null
+From b6a81e5051e6cb302609ddbd62ad7b6b6487b909 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:20:47 +0100
+Subject: openrisc: Fix broken paths to arch/or32
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff ]
+
+OpenRISC was mainlined as "openrisc", not "or32".
+vmlinux.lds is generated from vmlinux.lds.S.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 2 +-
+ arch/openrisc/kernel/head.S | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index fec8bf97d8064..c17e8451d9978 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -179,7 +179,7 @@ handler: ;\
+ * occured. in fact they never do. if you need them use
+ * values saved on stack (for SPR_EPC, SPR_ESR) or content
+ * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
+- * in 'arch/or32/kernel/head.S'
++ * in 'arch/openrisc/kernel/head.S'
+ */
+
+ /* =====================================================[ exceptions] === */
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index f14793306b03f..98dd6860bc0b9 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -1596,7 +1596,7 @@ _string_esr_irq_bug:
+
+ /*
+ * .data section should be page aligned
+- * (look into arch/or32/kernel/vmlinux.lds)
++ * (look into arch/openrisc/kernel/vmlinux.lds.S)
+ */
+ .section .data,"aw"
+ .align 8192
+--
+2.20.1
+
--- /dev/null
+From f56b475fe70427f4d8329cfbfdc44d0448198b3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:06:34 +0100
+Subject: parisc: Fix HP SDC hpa address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit c4bff35ca1bfba886da6223c9fed76a2b1382b8e ]
+
+Show the hpa address of the HP SDC instead of a hashed value, e.g.:
+HP SDC: HP SDC at 0xf0201000, IRQ 23 (NMI IRQ 24)
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/hp_sdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
+index 852858e5d8d08..92f541db98a09 100644
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -887,8 +887,8 @@ static int __init hp_sdc_init(void)
+ "HP SDC NMI", &hp_sdc))
+ goto err2;
+
+- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n",
+- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n",
++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
+
+ hp_sdc_status_in8();
+ hp_sdc_data_in8();
+--
+2.20.1
+
--- /dev/null
+From a54549c076ec9edc4bc6b69d9b37d64cd36d4c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:09:59 +0100
+Subject: parisc: Fix serio address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 785145171d17af2554128becd6a7c8f89e101141 ]
+
+We want the hpa addresses printed in the serio modules, not some
+virtual ioremap()ed address, e.g.:
+
+ serio: gsc-ps2-keyboard port at 0xf0108000 irq 22 @ 2:0:11
+ serio: gsc-ps2-mouse port at 0xf0108100 irq 22 @ 2:0:12
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/gscps2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index ecba666afadb7..cca26e6f38b36 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -382,9 +382,9 @@ static int gscps2_probe(struct parisc_device *dev)
+ goto fail;
+ #endif
+
+- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n",
++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n",
+ ps2port->port->name,
+- ps2port->addr,
++ hpa,
+ ps2port->padev->irq,
+ ps2port->port->phys);
+
+--
+2.20.1
+
--- /dev/null
+From 3f0ffef739d538feed24b58556aeb1a0a5e51989 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:09:56 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d ]
+
+The Port F Control Register 3 (PFCR3) contains only a single field.
+However, counting from left to right, it is the fourth field, not the
+first field.
+Insert the missing dummy configuration values (3 fields of 16 values) to
+fix this.
+
+The descriptor for the Port F Control Register 0 (PFCR0) lacks the
+description for the 4th field (PF0 Mode, PF0MD[2:0]).
+Add the missing configuration values to fix this.
+
+Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 8070765311dbf..e1c34e19222ee 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PF12MD_000, PF12MD_001, 0, PF12MD_011,
+ PF12MD_100, PF12MD_101, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0 }
+@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
+ PF1MD_100, PF1MD_101, 0, 0,
+- 0, 0, 0, 0, 0, 0, 0, 0
+- }
++ 0, 0, 0, 0, 0, 0, 0, 0,
++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
++ PF0MD_100, PF0MD_101, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0 }
+ },
+
+ { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
+--
+2.20.1
+
--- /dev/null
+From ba87c31c6abbbe591133316bef5faa96566f604e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:41:11 +0100
+Subject: pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 054f2400f706327f96770219c3065b5131f8f154 ]
+
+Some values in the Peripheral Function Select Register 10 descriptor are
+shifted by one position, which may cause a peripheral function to be
+programmed incorrectly.
+
+Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was
+already the case for the HSCK0 pin in field IP10[5:3].
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 6502e676d3686..33232041ee86d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ /* IP10_22 [1] */
+ FN_CAN_CLK_A, FN_RX4_D,
+ /* IP10_21_19 [3] */
+- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
+- FN_LCD_M_DISP_B, 0, 0, 0,
++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
++ FN_LCD_M_DISP_B, 0, 0,
+ /* IP10_18_16 [3] */
+- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
+- FN_LCD_VEPWC_B, 0, 0, 0,
++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
++ FN_LCD_VEPWC_B, 0, 0,
+ /* IP10_15 [1] */
+ FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
+ /* IP10_14_12 [3] */
+ FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
+ FN_LCD_FLM_B, 0, 0, 0,
+ /* IP10_11_9 [3] */
+- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
+- FN_LCD_CL2_B, 0, 0, 0,
++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
++ FN_LCD_CL2_B, 0, 0,
+ /* IP10_8_6 [3] */
+- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
+- FN_LCD_CL1_B, 0, 0, 0,
++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
++ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+ FN_LCD_DON_B, 0, 0, 0,
+--
+2.20.1
+
--- /dev/null
+From bec11f0b5d3ed5ec2745ab88c24a4454a28db716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 08:48:25 +0100
+Subject: pinctrl: xway: fix gpio-hog related boot issues
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 9b4924da4711674e62d97d4f5360446cc78337af ]
+
+This patch is based on commit a86caa9ba5d7 ("pinctrl: msm: fix gpio-hog
+related boot issues").
+
+It fixes the issue that the gpio ranges needs to be defined before
+gpiochip_add().
+
+Therefore, we also have to swap the order of registering the pinctrl
+driver and registering the gpio chip.
+
+You also have to add the "gpio-ranges" property to the pinctrl device
+node to get it finally working.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Acked-by: John Crispin <john@phrozen.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-xway.c | 39 +++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index dd85ad1807f52..8ea1c6e2a6b2b 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -1748,14 +1748,6 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ }
+ xway_pctrl_desc.pins = xway_info.pads;
+
+- /* register the gpio chip */
+- xway_chip.parent = &pdev->dev;
+- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to register gpio chip\n");
+- return ret;
+- }
+-
+ /* setup the data needed by pinctrl */
+ xway_pctrl_desc.name = dev_name(&pdev->dev);
+ xway_pctrl_desc.npins = xway_chip.ngpio;
+@@ -1777,10 +1769,33 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /* finish with registering the gpio range in pinctrl */
+- xway_gpio_range.npins = xway_chip.ngpio;
+- xway_gpio_range.base = xway_chip.base;
+- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ /* register the gpio chip */
++ xway_chip.parent = &pdev->dev;
++ xway_chip.owner = THIS_MODULE;
++ xway_chip.of_node = pdev->dev.of_node;
++ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to register gpio chip\n");
++ return ret;
++ }
++
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) {
++ /* finish with registering the gpio range in pinctrl */
++ xway_gpio_range.npins = xway_chip.ngpio;
++ xway_gpio_range.base = xway_chip.base;
++ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ }
++
+ dev_info(&pdev->dev, "Init done\n");
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1932de467189246e2a831a450b9eae536fb42e7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 21:52:11 +0100
+Subject: PM / AVS: SmartReflex: NULL check before some freeing functions is
+ not needed
+
+From: Thomas Meyer <thomas@m3y3r.de>
+
+[ Upstream commit 14d338a857f05f894ba3badd9e6d3039c68b8180 ]
+
+NULL check before some freeing functions is not needed.
+
+Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/avs/smartreflex.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index fa0f19b975a6a..bb7b817cca599 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -994,8 +994,7 @@ static int omap_sr_remove(struct platform_device *pdev)
+
+ if (sr_info->autocomp_active)
+ sr_stop_vddautocomp(sr_info);
+- if (sr_info->dbg_dir)
+- debugfs_remove_recursive(sr_info->dbg_dir);
++ debugfs_remove_recursive(sr_info->dbg_dir);
+
+ pm_runtime_disable(&pdev->dev);
+ list_del(&sr_info->node);
+--
+2.20.1
+
--- /dev/null
+From ba5f3d39ae2e4b9a2c5570476142f26441e2658b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:27:33 +1100
+Subject: powerpc/44x/bamboo: Fix PCI range
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 ]
+
+The bamboo dts has a bug: it uses a non-naturally aligned range
+for PCI memory space. This isnt' supported by the code, thus
+causing PCI to break on this system.
+
+This is due to the fact that while the chip memory map has 1G
+reserved for PCI memory, it's only 512M aligned. The code doesn't
+know how to split that into 2 different PMMs and fails, so limit
+the region to 512M.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/bamboo.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts
+index aa68911f6560a..084b82ba74933 100644
+--- a/arch/powerpc/boot/dts/bamboo.dts
++++ b/arch/powerpc/boot/dts/bamboo.dts
+@@ -268,8 +268,10 @@
+ /* Outbound ranges, one memory and one IO,
+ * later cannot be changed. Chip supports a second
+ * IO range but we don't use it for now
++ * The chip also supports a larger memory range but
++ * it's not naturally aligned, so our code will break
+ */
+- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000
++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000
+ 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000
+ 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>;
+
+--
+2.20.1
+
--- /dev/null
+From dd496e47a5ad08cc26e8d4bfaeb3db59b1d1b033 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:41:29 +0000
+Subject: powerpc/83xx: handle machine check caused by watchdog timer
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 0deae39cec6dab3a66794f3e9e83ca4dc30080f1 ]
+
+When the watchdog timer is set in interrupt mode, it causes a
+machine check when it times out. The purpose of this mode is to
+ease debugging, not to crash the kernel and reboot the machine.
+
+This patch implements a special handling for that, in order to not
+crash the kernel if the watchdog times out while in interrupt or
+within the idle task.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[scottwood: added missing #include]
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/cputable.h | 1 +
+ arch/powerpc/include/asm/reg.h | 2 ++
+ arch/powerpc/kernel/cputable.c | 10 ++++++----
+ arch/powerpc/platforms/83xx/misc.c | 17 +++++++++++++++++
+ 4 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 4e54282c29b44..cf51aea47510c 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -44,6 +44,7 @@ extern int machine_check_e500(struct pt_regs *regs);
+ extern int machine_check_e200(struct pt_regs *regs);
+ extern int machine_check_47x(struct pt_regs *regs);
+ int machine_check_8xx(struct pt_regs *regs);
++int machine_check_83xx(struct pt_regs *regs);
+
+ extern void cpu_down_flush_e500v2(void);
+ extern void cpu_down_flush_e500mc(void);
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index ceb168cd3b814..26aeeaad32678 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -663,6 +663,8 @@
+ #define SRR1_PROGTRAP 0x00020000 /* Trap */
+ #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */
+
++#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */
++
+ #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */
+ #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */
+ #define HSRR1_DENORM 0x00100000 /* Denorm exception */
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index 6a82ef039c509..7471ed48f41fa 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -1162,6 +1162,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .machine_check = machine_check_generic,
+ .platform = "ppc603",
+ },
++#ifdef CONFIG_PPC_83xx
+ { /* e300c1 (a 603e core, plus some) on 83xx */
+ .pvr_mask = 0x7fff0000,
+ .pvr_value = 0x00830000,
+@@ -1172,7 +1173,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */
+@@ -1186,7 +1187,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */
+@@ -1200,7 +1201,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+@@ -1217,12 +1218,13 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+ .platform = "ppc603",
+ },
++#endif
+ { /* default match, we assume split I/D cache & TB (non-601)... */
+ .pvr_mask = 0x00000000,
+ .pvr_value = 0x00000000,
+diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c
+index d75c9816a5c92..2b6589fe812dd 100644
+--- a/arch/powerpc/platforms/83xx/misc.c
++++ b/arch/powerpc/platforms/83xx/misc.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/pci.h>
+
++#include <asm/debug.h>
+ #include <asm/io.h>
+ #include <asm/hw_irq.h>
+ #include <asm/ipic.h>
+@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void)
+
+ mpc83xx_setup_pci();
+ }
++
++int machine_check_83xx(struct pt_regs *regs)
++{
++ u32 mask = 1 << (31 - IPIC_MCP_WDT);
++
++ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask))
++ return machine_check_generic(regs);
++ ipic_clear_mcp_status(mask);
++
++ if (debugger_fault_handler(regs))
++ return 1;
++
++ die("Watchdog NMI Reset", regs, 0);
++
++ return 1;
++}
+--
+2.20.1
+
--- /dev/null
+From 4b993ffa37d51a54dd5eec2769f5d1053df6cbcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:27:42 +0000
+Subject: powerpc/book3s/32: fix number of bats in p/v_block_mapped()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e93ba1b7eb5b188c749052df7af1c90821c5f320 ]
+
+This patch fixes the loop in p_block_mapped() and v_block_mapped()
+to scan the entire bat_addrs[] array.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/ppc_mmu_32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c
+index 2a049fb8523d5..96c52271e9c2d 100644
+--- a/arch/powerpc/mm/ppc_mmu_32.c
++++ b/arch/powerpc/mm/ppc_mmu_32.c
+@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */
+ phys_addr_t v_block_mapped(unsigned long va)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (va >= bat_addrs[b].start && va < bat_addrs[b].limit)
+ return bat_addrs[b].phys + (va - bat_addrs[b].start);
+ return 0;
+@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va)
+ unsigned long p_block_mapped(phys_addr_t pa)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (pa >= bat_addrs[b].phys
+ && pa < (bat_addrs[b].limit-bat_addrs[b].start)
+ +bat_addrs[b].phys)
+--
+2.20.1
+
--- /dev/null
+From e8930ace3d31c2d9e25f555f11baab03e0c2e5f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 15:23:33 +0000
+Subject: powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb ]
+
+As several other arches including x86, this patch makes it explicit
+that a bad page fault is a NULL pointer dereference when the fault
+address is lower than PAGE_SIZE
+
+In the mean time, this page makes all bad_page_fault() messages
+shorter so that they remain on one single line. And it prefixes them
+by "BUG: " so that they get easily grepped.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Avoid pr_cont()]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 9376e8e53bfae..2791f568bdb25 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -521,21 +521,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+ switch (regs->trap) {
+ case 0x300:
+ case 0x380:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "data at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: %s at 0x%08lx\n",
++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
++ "Unable to handle kernel data access", regs->dar);
+ break;
+ case 0x400:
+ case 0x480:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "instruction fetch\n");
++ pr_alert("BUG: Unable to handle kernel instruction fetch%s",
++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n");
+ break;
+ case 0x600:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unaligned access at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n",
++ regs->dar);
+ break;
+ default:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unknown fault\n");
++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n",
++ regs->dar);
+ break;
+ }
+ printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
+--
+2.20.1
+
--- /dev/null
+From 81078fa2247c1874e2ece594f46cbd047d0ae847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 15:25:17 +1100
+Subject: powerpc/powernv/eeh/npu: Fix uninitialized variables in
+ opal_pci_eeh_freeze_status
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit c20577014f85f36d4e137d3d52a1f61225b4a3d2 ]
+
+The current implementation of the OPAL_PCI_EEH_FREEZE_STATUS call in
+skiboot's NPU driver does not touch the pci_error_type parameter so
+it might have garbage but the powernv code analyzes it nevertheless.
+
+This initializes pcierr and fstate to zero in all call sites.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/eeh-powernv.c | 8 ++++----
+ arch/powerpc/platforms/powernv/pci-ioda.c | 4 ++--
+ arch/powerpc/platforms/powernv/pci.c | 4 ++--
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 2354ea51e8714..6189c4cf56c3f 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -546,8 +546,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe)
+ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result = 0;
+
+@@ -585,8 +585,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ static int pnv_eeh_get_pe_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result;
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 8015e40bc7ee4..3ec673b4ca6ce 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -599,8 +599,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt)
+ static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no)
+ {
+ struct pnv_ioda_pe *slave, *pe;
+- u8 fstate, state;
+- __be16 pcierr;
++ u8 fstate = 0, state;
++ __be16 pcierr = 0;
+ s64 rc;
+
+ /* Sanity check on PE number */
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index db7b8020f68ef..98cc8ba07c233 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -482,8 +482,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
+ static void pnv_pci_config_check_eeh(struct pci_dn *pdn)
+ {
+ struct pnv_phb *phb = pdn->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ unsigned int pe_no;
+ s64 rc;
+
+--
+2.20.1
+
--- /dev/null
+From 57cd801875de1975a99eb71afb5137e9d2ff564d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 10:27:47 +0000
+Subject: powerpc/prom: fix early DEBUG messages
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 ]
+
+This patch fixes early DEBUG messages in prom.c:
+- Use %px instead of %p to see the addresses
+- Cast memblock_phys_mem_size() with (unsigned long long) to
+avoid build failure when phys_addr_t is not 64 bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index b0245bed6f548..b868f07c4246c 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -128,7 +128,7 @@ static void __init move_device_tree(void)
+ p = __va(memblock_alloc(size, PAGE_SIZE));
+ memcpy(p, initial_boot_params, size);
+ initial_boot_params = p;
+- DBG("Moved device tree to 0x%p\n", p);
++ DBG("Moved device tree to 0x%px\n", p);
+ }
+
+ DBG("<- move_device_tree\n");
+@@ -651,7 +651,7 @@ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+
+- DBG(" -> early_init_devtree(%p)\n", params);
++ DBG(" -> early_init_devtree(%px)\n", params);
+
+ /* Too early to BUG_ON(), do it by hand */
+ if (!early_init_dt_verify(params))
+@@ -711,7 +711,7 @@ void __init early_init_devtree(void *params)
+ memblock_allow_resize();
+ memblock_dump_all();
+
+- DBG("Phys. mem: %llx\n", memblock_phys_mem_size());
++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size());
+
+ /* We may need to relocate the flat tree, do it now.
+ * FIXME .. and the initrd too? */
+--
+2.20.1
+
--- /dev/null
+From a947831b74393bc17a3cf8f9e7be18140e2fff88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2019 10:42:40 +0800
+Subject: powerpc/pseries/dlpar: Fix a missing check in
+ dlpar_parse_cc_property()
+
+From: Gen Zhang <blackgod016574@gmail.com>
+
+[ Upstream commit efa9ace68e487ddd29c2b4d6dd23242158f1f607 ]
+
+In dlpar_parse_cc_property(), 'prop->name' is allocated by kstrdup().
+kstrdup() may return NULL, so it should be checked and handle error.
+And prop should be freed if 'prop->name' is NULL.
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 999b04819d699..5abb8e2239a54 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
+
+ name = (char *)ccwa + be32_to_cpu(ccwa->name_offset);
+ prop->name = kstrdup(name, GFP_KERNEL);
++ if (!prop->name) {
++ dlpar_free_cc_property(prop);
++ return NULL;
++ }
+
+ prop->length = be32_to_cpu(ccwa->prop_length);
+ value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset);
+--
+2.20.1
+
--- /dev/null
+From 3dd4558e19b2938b04285dc52cd6bb3431d8afff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 19:16:44 +1100
+Subject: powerpc/pseries: Fix node leak in update_lmb_associativity_index()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 47918bc68b7427e961035949cc1501a864578a69 ]
+
+In update_lmb_associativity_index() we lookup dr_node using
+of_find_node_by_path() which takes a reference for us. In the
+non-error case we forget to drop the reference. Note that
+find_aa_index() does modify properties of the node, but doesn't need
+an extra reference held once it's returned.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-memory.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 656bbbd731d03..6c12b02f4a61d 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -294,6 +294,7 @@ static u32 lookup_lmb_associativity_index(struct of_drconf_cell *lmb)
+
+ aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+
++ of_node_put(dr_node);
+ dlpar_free_cc_nodes(lmb_node);
+ return aa_index;
+ }
+--
+2.20.1
+
--- /dev/null
+From c202a98b667a0e02b31ab2c3b3f8e0b03e6a1f47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:31:08 +0000
+Subject: powerpc/xmon: fix dump_segments()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 32c8c4c621897199e690760c2d57054f8b84b6e6 ]
+
+mfsrin() takes segment num from bits 31-28 (IBM bits 0-3).
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Clarify bit numbering]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 687e8b8bf5c67..899288b71145e 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -3043,7 +3043,7 @@ void dump_segments(void)
+
+ printf("sr0-15 =");
+ for (i = 0; i < 16; ++i)
+- printf(" %x", mfsrin(i));
++ printf(" %x", mfsrin(i << 28));
+ printf("\n");
+ }
+ #endif
+--
+2.20.1
+
--- /dev/null
+From c752f6303178b67b0afd8f5927c09f1957262bd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 21:22:18 +0200
+Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ]
+
+The owner member of struct pwm_ops must be set to THIS_MODULE to
+increase the reference count of the module such that the module cannot
+be removed while its code is in use.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index d961a8207b1cb..31b01035d0ab3 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ static const struct pwm_ops iproc_pwm_ops = {
+ .apply = iproc_pwmc_apply,
+ .get_state = iproc_pwmc_get_state,
++ .owner = THIS_MODULE,
+ };
+
+ static int iproc_pwmc_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 538cf37fbfc4523e2f3ca0633c9a054ae237ed42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 13:39:24 +0300
+Subject: pwm: clps711x: Fix period calculation
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit b0f17570b8203c22f139459c86cfbaa0311313ed ]
+
+Commit e39c0df1be5a ("pwm: Introduce the pwm_args concept") has
+changed the variable for the period for clps711x-pwm driver, so now
+pwm_get/set_period() works with pwm->state.period variable instead
+of pwm->args.period.
+This patch changes the period variable in other places where it is used.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-clps711x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c
+index 26ec24e457b12..7e16b7def0dcb 100644
+--- a/drivers/pwm/pwm-clps711x.c
++++ b/drivers/pwm/pwm-clps711x.c
+@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v)
+ static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v)
+ {
+ /* Duty cycle 0..15 max */
+- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm));
++ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period);
+ }
+
+ static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ struct clps711x_chip *priv = to_clps711x_chip(chip);
+ unsigned int duty;
+
+- if (period_ns != pwm_get_period(pwm))
++ if (period_ns != pwm->args.period)
+ return -EINVAL;
+
+ duty = clps711x_get_duty(pwm, duty_ns);
+--
+2.20.1
+
--- /dev/null
+From 14d59f4f9e93931848fee086e534dbe0f9a7bd8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 13:20:36 -0800
+Subject: RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 ]
+
+This patch avoids that the SCSI mid-layer keeps retrying forever if
+ib_post_send() fails. This was discovered while testing immediate
+data support and passing a too large num_sge value to ib_post_send().
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 74de1ae48d4f7..af68be201c299 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2180,6 +2180,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+
+ if (srp_post_send(ch, iu, len)) {
+ shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
++ scmnd->result = DID_ERROR << 16;
+ goto err_unmap;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 171d9a70f6297dd2ca31268bccfa925b5f7bc5bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:29:19 -0600
+Subject: regulator: tps65910: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a ]
+
+tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so,
+returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65910-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 696116ebdf50a..9cde7b0757011 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, pmic);
+
+ /* Give control of all register to control port */
+- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
+ DEVCTRL_SR_CTL_I2C_SEL_MASK);
++ if (err < 0)
++ return err;
+
+ switch (tps65910_chip_id(tps65910)) {
+ case TPS65910:
+--
+2.20.1
+
--- /dev/null
+From 99da2d76f637050ea1ce60da42a6f06d27040b85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:57:06 -0700
+Subject: reset: fix reset_control_ops kerneldoc comment
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]
+
+Add a missing short description to the reset_control_ops documentation.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[p.zabel@pengutronix.de: rebased and updated commit message]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset-controller.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index db1fe6772ad50..b5542aff192cd 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -6,7 +6,7 @@
+ struct reset_controller_dev;
+
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+ *
+ * @reset: for self-deasserting resets, does all necessary
+ * things to reset the device
+--
+2.20.1
+
--- /dev/null
+From 19f9672402a2a3458a65db30d94eac159e2854bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:48:10 +0800
+Subject: rtl818x: fix potential use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit afbb1947db94eacc5a13302eee88a9772fb78935 ]
+
+entry is released via usb_put_urb just after calling usb_submit_urb.
+However, entry is used if the submission fails, resulting in a use after
+free bug. The patch fixes this.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+index 6113624ccec39..17e3d5e830626 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -446,12 +446,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
+ skb_queue_tail(&priv->rx_queue, skb);
+ usb_anchor_urb(entry, &priv->anchored);
+ ret = usb_submit_urb(entry, GFP_KERNEL);
+- usb_put_urb(entry);
+ if (ret) {
+ skb_unlink(skb, &priv->rx_queue);
+ usb_unanchor_urb(entry);
++ usb_put_urb(entry);
+ goto err;
+ }
++ usb_put_urb(entry);
+ }
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 0be8c451dbb18104f7f0c4dce52bf9fad001d08c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:17:06 -0800
+Subject: scripts/gdb: fix debugging modules compiled with hot/cold
+ partitioning
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]
+
+gcc's -freorder-blocks-and-partition option makes it group frequently
+and infrequently used code in .text.hot and .text.unlikely sections
+respectively. At least when building modules on s390, this option is
+used by default.
+
+gdb assumes that all code is located in .text section, and that .text
+section is located at module load address. With such modules this is no
+longer the case: there is code in .text.hot and .text.unlikely, and
+either of them might precede .text.
+
+Fix by explicitly telling gdb the addresses of code sections.
+
+It might be tempting to do this for all sections, not only the ones in
+the white list. Unfortunately, gdb appears to have an issue, when
+telling it about e.g. loadable .note.gnu.build-id section causes it to
+think that non-loadable .note.Linux section is loaded at address 0,
+which in turn causes NULL pointers to be resolved to bogus symbols. So
+keep using the white list approach for the time being.
+
+Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 004b0ac7fa72d..4644f1a83b578 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+ attrs[n]['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++ ".text", ".text.hot", ".text.unlikely"]:
+ address = section_name_to_address.get(section_name)
+ if address:
+ args.append(" -s {name} {addr}".format(
+--
+2.20.1
+
--- /dev/null
+From 2d6766331a4c007ec4f0d21fc688a8d0cbcf7b4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:42:50 +0530
+Subject: scsi: csiostor: fix incorrect dma device in case of vport
+
+From: Varun Prakash <varun@chelsio.com>
+
+[ Upstream commit 9934613edcb40b92a216122876cd3b7e76d08390 ]
+
+In case of ->vport_create() call scsi_add_host_with_dma() instead of
+scsi_add_host() to pass correct dma device.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index dbe416ff46c27..776b992786881 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -648,7 +648,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev,
+ if (csio_lnode_init(ln, hw, pln))
+ goto err_shost_put;
+
+- if (scsi_add_host(shost, dev))
++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev))
+ goto err_lnode_exit;
+
+ return ln;
+--
+2.20.1
+
--- /dev/null
+From 21f4fd0a88184c0b78c89100df1ba084f9d8465d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:27 +0800
+Subject: scsi: libsas: Check SMP PHY control function result
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 01929a65dfa13e18d89264ab1378854a91857e59 ]
+
+Currently the SMP PHY control execution result is checked, however the
+function result for the command is not.
+
+As such, we may be missing all potential errors, like SMP FUNCTION FAILED,
+INVALID REQUEST FRAME LENGTH, etc., meaning the PHY control request has
+failed.
+
+In some scenarios we need to ensure the function result is accepted, so add
+a check for this.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index b7e4493d3dc16..7e8274938a3ee 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -603,7 +603,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ }
+
+ res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE);
+-
++ if (res) {
++ pr_err("ex %016llx phy%02d PHY control failed: %d\n",
++ SAS_ADDR(dev->sas_addr), phy_id, res);
++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) {
++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n",
++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]);
++ res = pc_resp[2];
++ }
+ kfree(pc_resp);
+ kfree(pc_req);
+ return res;
+--
+2.20.1
+
--- /dev/null
+From 2bed452be8a847609d8834f9b6a2fe07ece2de71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:28 +0800
+Subject: scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+ discovery
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit cec9771d2e954650095aa37a6a97722c8194e7d2 ]
+
+ +----------+ +----------+
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ |initiator | | |
+ | device |--- 3.0 G ---| Expander |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ | | | |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ +----------+ +----------+
+
+According to Serial Attached SCSI - 1.1 (SAS-1.1):
+If an expander PHY attached to a SATA PHY is using a physical link rate
+greater than the maximum connection rate supported by the pathway from an
+STP initiator port, a management application client should use the SMP PHY
+CONTROL function (see 10.4.3.10) to set the PROGRAMMED MAXIMUM PHYSICAL
+LINK RATE field of the expander PHY to the maximum connection rate
+supported by the pathway from that STP initiator port.
+
+Currently libsas does not support checking if this condition occurs, nor
+rectifying when it does.
+
+Such a condition is not at all common, however it has been seen on some
+pre-silicon environments where the initiator PHY only supports a 1.5 Gbit
+maximum linkrate, mated with 12G expander PHYs and 3/6G SATA phy.
+
+This patch adds support for checking and rectifying this condition during
+initial device discovery only.
+
+We do support checking min pathway connection rate during revalidation phase,
+when new devices can be detected in the topology. However we do not
+support in the case of the the user reprogramming PHY linkrates, such that
+min pathway condition is not met/maintained.
+
+A note on root port PHY rates:
+The libsas root port PHY rates calculation is broken. Libsas sets the
+rates (min, max, and current linkrate) of a root port to the same linkrate
+of the first PHY member of that same port. In doing so, it assumes that
+all other PHYs which subsequently join the port to have the same
+negotiated linkrate, when they could actually be different.
+
+In practice this doesn't happen, as initiator and expander PHYs are
+normally initialised with consistent min/max linkrates.
+
+This has not caused an issue so far, so leave alone for now.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index d44f18f773c0f..b7e4493d3dc16 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -806,6 +806,26 @@ static struct domain_device *sas_ex_discover_end_dev(
+
+ #ifdef CONFIG_SCSI_SAS_ATA
+ if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) {
++ if (child->linkrate > parent->min_linkrate) {
++ struct sas_phy_linkrates rates = {
++ .maximum_linkrate = parent->min_linkrate,
++ .minimum_linkrate = parent->min_linkrate,
++ };
++ int ret;
++
++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ ret = sas_smp_phy_control(parent, phy_id,
++ PHY_FUNC_LINK_RESET, &rates);
++ if (ret) {
++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n",
++ SAS_ADDR(child->sas_addr), phy_id, ret);
++ goto out_free;
++ }
++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ child->linkrate = child->min_linkrate;
++ }
+ res = sas_get_ata_info(child, phy);
+ if (res)
+ goto out_free;
+--
+2.20.1
+
--- /dev/null
+From 5a23d33ab911c8368826483333f747e4b76d226c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:40 -0800
+Subject: scsi: lpfc: Fix dif and first burst use in write commands
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 7c4042a4d0b7532cfbc90478fd3084b2dab5849e ]
+
+When dif and first burst is used in a write command wqe, the driver was not
+properly setting fields in the io command request. This resulted in no dif
+bytes being sent and invalid xfer_rdy's, resulting in the io being aborted
+by the hardware.
+
+Correct the wqe initializaton when both dif and first burst are used.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index d197aa176dee3..d489cc1018b5c 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -2707,6 +2707,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd
+@@ -2812,6 +2813,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ return 0;
+ err:
+ if (lpfc_cmd->seg_cnt)
+@@ -3364,6 +3373,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd
+@@ -3479,6 +3489,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ /*
+ * If the OAS driver feature is enabled and the lun is enabled for
+ * OAS, set the oas iocb related flags.
+--
+2.20.1
+
--- /dev/null
+From 437ff0e110cd67f0701bfe2693d068250c731b65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:48:45 -0700
+Subject: scsi: qla2xxx: deadlock by configfs_depend_item
+
+From: Anatoliy Glagolev <glagolig@gmail.com>
+
+[ Upstream commit 17b18eaa6f59044a5172db7d07149e31ede0f920 ]
+
+The intent of invoking configfs_depend_item in commit 7474f52a82d51
+("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg")
+was to prevent a physical Fibre Channel port removal when
+virtual (NPIV) ports announced through that physical port are active.
+The change does not work as expected: it makes enabled physical port
+dependent on target configfs subsystem (the port's parent), something
+the configfs guarantees anyway.
+
+Besides, scheduling work in a worker thread and waiting for the work's
+completion is not really a valid workaround for the requirement not to call
+configfs_depend_item from a configfs callback: the call occasionally
+deadlocks.
+
+Thus, removing configfs_depend_item calls does not break anything and fixes
+the deadlock problem.
+
+Signed-off-by: Anatoliy Glagolev <glagolig@gmail.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++-------------------------
+ drivers/scsi/qla2xxx/tcm_qla2xxx.h | 3 --
+ 2 files changed, 8 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 0ad8ecef1e302..abdd6f93c8fe5 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -821,38 +821,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item,
+ atomic_read(&tpg->lport_tpg_enabled));
+ }
+
+-static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 1);
+- qlt_enable_vha(base_vha);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 0);
+- target_undepend_item(&se_tpg->tpg_group.cg_item);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ const char *page, size_t count)
+ {
+ struct se_portal_group *se_tpg = to_tpg(item);
++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
++ struct tcm_qla2xxx_lport, lport_wwn);
++ struct scsi_qla_host *vha = lport->qla_vha;
+ struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+ struct tcm_qla2xxx_tpg, se_tpg);
+ unsigned long op;
+@@ -871,24 +847,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ if (atomic_read(&tpg->lport_tpg_enabled))
+ return -EEXIST;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 1);
++ qlt_enable_vha(vha);
+ } else {
+ if (!atomic_read(&tpg->lport_tpg_enabled))
+ return count;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 0);
++ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+ }
+- init_completion(&tpg->tpg_base_comp);
+- schedule_work(&tpg->tpg_base_work);
+- wait_for_completion(&tpg->tpg_base_comp);
+
+- if (op) {
+- if (!atomic_read(&tpg->lport_tpg_enabled))
+- return -ENODEV;
+- } else {
+- if (atomic_read(&tpg->lport_tpg_enabled))
+- return -EPERM;
+- }
+ return count;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+index 37e026a4823d6..8b70fa3105bd7 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg {
+ struct tcm_qla2xxx_tpg_attrib tpg_attrib;
+ /* Returned by tcm_qla2xxx_make_tpg() */
+ struct se_portal_group se_tpg;
+- /* Items for dealing with configfs_depend_item */
+- struct completion tpg_base_comp;
+- struct work_struct tpg_base_work;
+ };
+
+ struct tcm_qla2xxx_fc_loopid {
+--
+2.20.1
+
--- /dev/null
+From 494fc4b62b915286e8ca1af0c6ab25a2e645b179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 09:45:26 +0100
+Subject: sctp: don't compare hb_timer expire date before starting it
+
+From: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+
+[ Upstream commit d1f20c03f48102e52eb98b8651d129b83134cae4 ]
+
+hb_timer might not start at all for a particular transport because its
+start is conditional. In a result a node is not sending heartbeats.
+
+Function sctp_transport_reset_hb_timer has two roles:
+ - initial start of hb_timer for a given transport,
+ - update expire date of hb_timer for a given transport.
+The function is optimized to update timer's expire only if it is before
+a new calculated one but this comparison is invalid for a timer which
+has not yet started. Such a timer has expire == 0 and if a new expire
+value is bigger than (MAX_JIFFIES / 2 + 2) then "time_before" macro will
+fail and timer will not start resulting in no heartbeat packets send by
+the node.
+
+This was found when association was initialized within first 5 mins
+after system boot due to jiffies init value which is near to MAX_JIFFIES.
+
+Test kernel version: 4.9.154 (ARCH=arm)
+hb_timer.expire = 0; //initialized, not started timer
+new_expire = MAX_JIFFIES / 2 + 2; //or more
+time_before(hb_timer.expire, new_expire) == false
+
+Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often")
+Reported-by: Marcin Stojek <marcin.stojek@nokia.com>
+Tested-by: Marcin Stojek <marcin.stojek@nokia.com>
+Signed-off-by: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/transport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 03d71cd97ec08..5c78942550e97 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -205,7 +205,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+
+ /* When a data chunk is sent, reset the heartbeat interval. */
+ expires = jiffies + sctp_transport_timeout(transport);
+- if (time_before(transport->hb_timer.expires, expires) &&
++ if ((time_before(transport->hb_timer.expires, expires) ||
++ !timer_pending(&transport->hb_timer)) &&
+ !mod_timer(&transport->hb_timer,
+ expires + prandom_u32_max(transport->rto)))
+ sctp_transport_hold(transport);
+--
+2.20.1
+
--- /dev/null
+From dd113313012f24ce28055529a719897bf7a49a79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 14:19:20 +0300
+Subject: serial: max310x: Fix tx_empty() callback
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit a8da3c7873ea57acb8f9cea58c0af477522965aa ]
+
+Function max310x_tx_empty() accesses the IRQSTS register, which is
+cleared by IC when reading, so if there is an interrupt status, we
+will lose it. This patch implement the transmitter check only by
+the current FIFO level.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index bacc7e284c0c1..80ab672d61cc4 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -769,12 +769,9 @@ static void max310x_start_tx(struct uart_port *port)
+
+ static unsigned int max310x_tx_empty(struct uart_port *port)
+ {
+- unsigned int lvl, sts;
++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+
+- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+- sts = max310x_port_read(port, MAX310X_IRQSTS_REG);
+-
+- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0;
++ return lvl ? 0 : TIOCSER_TEMT;
+ }
+
+ static unsigned int max310x_get_mctrl(struct uart_port *port)
+--
+2.20.1
+
--- /dev/null
+asoc-compress-fix-unsigned-integer-overflow-check.patch
+asoc-kirkwood-fix-external-clock-probe-defer.patch
+clk-samsung-exynos5420-preserve-pll-configuration-du.patch
+reset-fix-reset_control_ops-kerneldoc-comment.patch
+clk-at91-avoid-sleeping-early.patch
+net-fec-add-missed-clk_disable_unprepare-in-remove.patch
+can-peak_usb-report-bus-recovery-as-well.patch
+can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
+watchdog-meson-fix-the-wrong-value-of-left-time.patch
+scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
+mac80211-fix-station-inactive_time-shortly-after-boo.patch
+block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
+pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
+scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
+arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
+arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
+parisc-fix-serio-address-output.patch
+parisc-fix-hp-sdc-hpa-address-output.patch
+arm64-mm-prevent-mismatched-52-bit-va-support.patch
+arm64-smp-handle-errors-reported-by-the-firmware.patch
+pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
+arm-ks8695-fix-section-mismatch-warning.patch
+acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
+crypto-user-support-incremental-algorithm-dumps.patch
+mwifiex-fix-potential-null-dereference-and-use-after.patch
+mwifiex-debugfs-correct-histogram-spacing-formatting.patch
+rtl818x-fix-potential-use-after-free.patch
+xfs-require-both-realtime-inodes-to-mount.patch
+ubi-put-mtd-device-after-it-is-not-used.patch
+ubi-do-not-drop-ubi-device-reference-before-using.patch
+microblaze-adjust-the-help-to-the-real-behavior.patch
+microblaze-move-.-is-ready-messages-to-arch-microbla.patch
+gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
+vsock-bind-to-random-port-for-vmaddr_port_any.patch
+mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
+btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
+hid-intel-ish-hid-fixes-incorrect-error-handling.patch
+xen-pciback-check-dev_data-before-using-it.patch
+pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
+net-mlx5-continue-driver-initialization-despite-debu.patch
+kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
+pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
+pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
+hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
+dm-flakey-properly-corrupt-multi-page-bios.patch
+gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
+xfs-align-compat-attrlist_by_handle-with-native-impl.patch
+xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
+ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
+powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
+powerpc-xmon-fix-dump_segments.patch
+drivers-regulator-fix-a-missing-check-of-return-valu.patch
+serial-max310x-fix-tx_empty-callback.patch
+openrisc-fix-broken-paths-to-arch-or32.patch
+rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
+scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
+scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
+ath6kl-only-use-match-sets-when-firmware-supports-it.patch
+ath6kl-fix-off-by-one-error-in-scan-completion.patch
+powerpc-prom-fix-early-debug-messages.patch
+powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
+powerpc-44x-bamboo-fix-pci-range.patch
+vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
+powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
+drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
+drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
+drbd-do-not-block-when-adjusting-disk-options-while-.patch
+drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
+regulator-tps65910-fix-a-missing-check-of-return-val.patch
+powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
+powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
+crypto-mxc-scc-fix-build-warnings-on-arm64.patch
+pwm-clps711x-fix-period-calculation.patch
+net-net_namespace-check-the-return-value-of-register.patch
+um-make-gcov-depend-on-kcov.patch
+net-stmicro-fix-a-missing-check-of-clk_prepare.patch
+net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
+atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
+tipc-fix-a-missing-check-of-genlmsg_put.patch
+net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
+ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
+vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
+lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
+lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
+drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
+lib-genalloc.c-include-vmalloc.h.patch
+mtd-check-add_mtd_device-ret-code.patch
+tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
+net-core-neighbour-tell-kmemleak-about-hash-tables.patch
+net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
+sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
+ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
+decnet-fix-dn_ifreq_size.patch
+tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
+sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
+net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
+sctp-don-t-compare-hb_timer-expire-date-before-start.patch
+net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
+iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
+scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
+acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
+scsi-libsas-check-smp-phy-control-function-result.patch
+powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
+mtd-remove-a-debug-trace-in-mtdpart.c.patch
--- /dev/null
+From 4ffe4d51edd126b20274dfebdad25bf7066fd1f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 13:10:00 +0000
+Subject: sfc: initialise found bitmap in efx_ef10_mtd_probe
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit c65285428b6e7797f1bb063f33b0ae7e93397b7b ]
+
+The bitmap of found partitions in efx_ef10_mtd_probe was not
+initialised, causing partitions to be suppressed based off whatever
+value was in the bitmap at the start.
+
+Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 34e2256c93f46..22bc3dc44298c 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -5159,7 +5159,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+- DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+--
+2.20.1
+
--- /dev/null
+From 065337f0f2b3a6be2a1da1188917250238747ef8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 19:02:17 +0000
+Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
+
+From: Edward Cree <ecree@solarflare.com>
+
+[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ]
+
+Use a bitmap to keep track of which partition types we've already seen;
+ for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and
+ thus skip adding that partition.
+Duplicate partitions occur because of the A/B backup scheme used by newer
+ sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because
+ they have the same name, causing us not to expose any MTDs at all.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 3d5d5d54c1033..34e2256c93f46 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -5093,22 +5093,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" },
+ { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types)
+
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ struct efx_mcdi_mtd_partition *part,
+- unsigned int type)
++ unsigned int type,
++ unsigned long *found)
+ {
+ MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ const struct efx_ef10_nvram_type_info *info;
+ size_t size, erase_size, outlen;
++ int type_idx = 0;
+ bool protected;
+ int rc;
+
+- for (info = efx_ef10_nvram_types; ; info++) {
+- if (info ==
+- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++ for (type_idx = 0; ; type_idx++) {
++ if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ return -ENODEV;
++ info = efx_ef10_nvram_types + type_idx;
+ if ((type & ~info->type_mask) == info->type)
+ break;
+ }
+@@ -5121,6 +5124,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ if (protected)
+ return -ENODEV; /* hide it */
+
++ /* If we've already exposed a partition of this type, hide this
++ * duplicate. All operations on MTDs are keyed by the type anyway,
++ * so we can't act on the duplicate.
++ */
++ if (__test_and_set_bit(type_idx, found))
++ return -EEXIST;
++
+ part->nvram_type = type;
+
+ MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -5149,6 +5159,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+@@ -5177,11 +5188,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ for (i = 0; i < n_parts_total; i++) {
+ type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ i);
+- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+- if (rc == 0)
+- n_parts++;
+- else if (rc != -ENODEV)
++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++ found);
++ if (rc == -EEXIST || rc == -ENODEV)
++ continue;
++ if (rc)
+ goto fail;
++ n_parts++;
+ }
+
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+--
+2.20.1
+
--- /dev/null
+From c414eb4fca7b1df69b41f4aac8b61e29ee6af541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:09:04 -0600
+Subject: tipc: fix a missing check of genlmsg_put
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 ]
+
+genlmsg_put could fail. The fix inserts a check of its return value, and
+if it fails, returns -EMSGSIZE.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 63a913b238735..454ed8ea194c8 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -974,6 +974,8 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
++ if (!hdr)
++ return -EMSGSIZE;
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From ae4451f9c9490ab41186fd6bf5bc4e1a2ac63f9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 10:52:23 -0600
+Subject: tipc: fix memory leak in tipc_nl_compat_publ_dump
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit f87d8ad9233f115db92c6c087d58403b0009ed36 ]
+
+There is a memory leak in case genlmsg_put fails.
+
+Fix this by freeing *args* before return.
+
+Addresses-Coverity-ID: 1476406 ("Resource leak")
+Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 454ed8ea194c8..e3fc959e496d4 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -974,8 +974,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
+- if (!hdr)
++ if (!hdr) {
++ kfree_skb(args);
+ return -EMSGSIZE;
++ }
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From bb3d0b6110304c454ac20170b3258d7b1a6baadd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 09:18:28 +0700
+Subject: tipc: fix skb may be leaky in tipc_link_input
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ]
+
+When we free skb at tipc_data_input, we return a 'false' boolean.
+Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,
+
+<snip>
+1303 int tipc_link_rcv:
+...
+1354 if (!tipc_data_input(l, skb, l->inputq))
+1355 rc |= tipc_link_input(l, skb, l->inputq);
+</snip>
+
+Fix it by simple changing to a 'true' boolean when skb is being free-ed.
+Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
+condition.
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <maloy@donjonn.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 4e8647aef01c1..c7406c1fdc14b 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1063,7 +1063,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
+ default:
+ pr_warn("Dropping received illegal msg type\n");
+ kfree_skb(skb);
+- return false;
++ return true;
+ };
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 97246712c200a4ba588e8a6ffd6d15de8c9ce317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 11:20:03 +0800
+Subject: ubi: Do not drop UBI device reference before using
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e542087701f09418702673631a908429feb3eae0 ]
+
+The UBI device reference is dropped but then the device is used as a
+parameter of ubi_err. The bug is introduced in changing ubi_err's
+behavior. The old ubi_err does not require a UBI device as its first
+parameter, but the new one does.
+
+Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/kapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index 88b1897aeb40f..7826f7c4ec2fb 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -227,9 +227,9 @@ out_unlock:
+ out_free:
+ kfree(desc);
+ out_put_ubi:
+- ubi_put_device(ubi);
+ ubi_err(ubi, "cannot open device %d, volume %d, error %d",
+ ubi_num, vol_id, err);
++ ubi_put_device(ubi);
+ return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(ubi_open_volume);
+--
+2.20.1
+
--- /dev/null
+From 8a655e09fdbfed9f3c4b59a2b3a0d5d588a67108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:57:33 +0800
+Subject: ubi: Put MTD device after it is not used
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit b95f83ab762dd6211351b9140f99f43644076ca8 ]
+
+The MTD device reference is dropped via put_mtd_device, however its
+field ->index is read and passed to ubi_msg. To fix this, the patch
+moves the reference dropping after calling ubi_msg.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index ad2b57c6b13fd..211ee13d36ed4 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1146,10 +1146,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+- put_mtd_device(ubi->mtd);
+ vfree(ubi->peb_buf);
+ vfree(ubi->fm_buf);
+ ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
++ put_mtd_device(ubi->mtd);
+ put_device(&ubi->dev);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 17272dc1ffc2baaf46f42648b4b7c1dac54b9546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:12 +0100
+Subject: um: Make GCOV depend on !KCOV
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 550ed0e2036663b35cec12374b835444f9c60454 ]
+
+Both do more or less the same thing and are mutually exclusive.
+If both are enabled the build will fail.
+Sooner or later we can kill UML's GCOV.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug
+index 68205fd3b08c8..6ae7f0f434a9c 100644
+--- a/arch/um/Kconfig.debug
++++ b/arch/um/Kconfig.debug
+@@ -18,6 +18,7 @@ config GPROF
+ config GCOV
+ bool "Enable gcov support"
+ depends on DEBUG_INFO
++ depends on !KCOV
+ help
+ This option allows developers to retrieve coverage data from a UML
+ session.
+--
+2.20.1
+
--- /dev/null
+From 081bae249b480386639a0817c61ddad0918c0b9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Oct 2018 13:22:31 +1000
+Subject: vfio/spapr_tce: Get rid of possible infinite loop
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 517ad4ae8aa93dccdb9a88c27257ecb421c9e848 ]
+
+As a part of cleanup, the SPAPR TCE IOMMU subdriver releases preregistered
+memory. If there is a bug in memory release, the loop in
+tce_iommu_release() becomes infinite; this actually happened to me.
+
+This makes the loop finite and prints a warning on every failure to make
+the code more bug prone.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index 70c748a5fbcc2..a8e25f9409fa5 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -406,6 +406,7 @@ static void tce_iommu_release(void *iommu_data)
+ {
+ struct tce_container *container = iommu_data;
+ struct tce_iommu_group *tcegrp;
++ struct tce_iommu_prereg *tcemem, *tmtmp;
+ long i;
+
+ while (tce_groups_attached(container)) {
+@@ -428,13 +429,8 @@ static void tce_iommu_release(void *iommu_data)
+ tce_iommu_free_table(container, tbl);
+ }
+
+- while (!list_empty(&container->prereg_list)) {
+- struct tce_iommu_prereg *tcemem;
+-
+- tcemem = list_first_entry(&container->prereg_list,
+- struct tce_iommu_prereg, next);
+- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem));
+- }
++ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next)
++ WARN_ON(tce_iommu_prereg_free(container, tcemem));
+
+ tce_iommu_disable(container);
+ if (container->mm)
+--
+2.20.1
+
--- /dev/null
+From 5a40582c1d48cea04d325e261ffcd4fbd9f68b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:34:36 -0800
+Subject: vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA
+ is n
+
+From: Wei Yang <richard.weiyang@gmail.com>
+
+[ Upstream commit 8b09549c2bfd9f3f8f4cdad74107ef4f4ff9cdd7 ]
+
+Commit fa5e084e43eb ("vmscan: do not unconditionally treat zones that
+fail zone_reclaim() as full") changed the return value of
+node_reclaim(). The original return value 0 means NODE_RECLAIM_SOME
+after this commit.
+
+While the return value of node_reclaim() when CONFIG_NUMA is n is not
+changed. This will leads to call zone_watermark_ok() again.
+
+This patch fixes the return value by adjusting to NODE_RECLAIM_NOSCAN.
+Since node_reclaim() is only called in page_alloc.c, move it to
+mm/internal.h.
+
+Link: http://lkml.kernel.org/r/20181113080436.22078-1-richard.weiyang@gmail.com
+Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swap.h | 6 ------
+ mm/internal.h | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 2228907d08ffd..d13617c7bcc4f 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -335,14 +335,8 @@ extern unsigned long vm_total_pages;
+ extern int node_reclaim_mode;
+ extern int sysctl_min_unmapped_ratio;
+ extern int sysctl_min_slab_ratio;
+-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
+ #else
+ #define node_reclaim_mode 0
+-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
+- unsigned int order)
+-{
+- return 0;
+-}
+ #endif
+
+ extern int page_evictable(struct page *page);
+diff --git a/mm/internal.h b/mm/internal.h
+index 3e2d016947479..f6df7cb8cbc0a 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -442,6 +442,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn,
+ #define NODE_RECLAIM_SOME 0
+ #define NODE_RECLAIM_SUCCESS 1
+
++#ifdef CONFIG_NUMA
++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
++#else
++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
++ unsigned int order)
++{
++ return NODE_RECLAIM_NOSCAN;
++}
++#endif
++
+ extern int hwpoison_filter(struct page *p);
+
+ extern u32 hwpoison_filter_dev_major;
+--
+2.20.1
+
--- /dev/null
+From f73b6cf4e83f2be42bf545a83c66a761450e0721 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 11:12:55 -0800
+Subject: VSOCK: bind to random port for VMADDR_PORT_ANY
+
+From: Lepton Wu <ytht.net@gmail.com>
+
+[ Upstream commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b ]
+
+The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes
+when VMM crashed, there is still orphaned vsock which is waiting for
+close timer, then it could cause connection time out for new started VM
+if they are trying to connect to same port with same guest cid since the
+new packets could hit that orphaned vsock. We could also fix this by doing
+more in vhost_vsock_reset_orphans, but any way, it should be better to start
+from a random local port instead of a fixed one.
+
+Signed-off-by: Lepton Wu <ytht.net@gmail.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 7566395e526d2..18f377306884b 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -97,6 +97,7 @@
+ #include <linux/mutex.h>
+ #include <linux/net.h>
+ #include <linux/poll.h>
++#include <linux/random.h>
+ #include <linux/skbuff.h>
+ #include <linux/smp.h>
+ #include <linux/socket.h>
+@@ -501,9 +502,13 @@ out:
+ static int __vsock_bind_stream(struct vsock_sock *vsk,
+ struct sockaddr_vm *addr)
+ {
+- static u32 port = LAST_RESERVED_PORT + 1;
++ static u32 port = 0;
+ struct sockaddr_vm new_addr;
+
++ if (!port)
++ port = LAST_RESERVED_PORT + 1 +
++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
++
+ vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+
+ if (addr->svm_port == VMADDR_PORT_ANY) {
+--
+2.20.1
+
--- /dev/null
+From c731ef22ae826a161ac9ca20e3ca42e721aa90b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 18:53:49 +0800
+Subject: watchdog: meson: Fix the wrong value of left time
+
+From: Xingyu Chen <xingyu.chen@amlogic.com>
+
+[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ]
+
+The left time value is wrong when we get it by sysfs. The left time value
+should be equal to preset timeout value minus elapsed time value. According
+to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value
+is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved
+to BIT[16-31] of the WATCHDOG_TCNT.
+
+[0]: http://linux-meson.com
+
+Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver")
+Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/meson_gxbb_wdt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
+index 44d180a2c5e57..58e06f059e673 100644
+--- a/drivers/watchdog/meson_gxbb_wdt.c
++++ b/drivers/watchdog/meson_gxbb_wdt.c
+@@ -137,8 +137,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+
+ reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
+
+- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
+ }
+
+ static const struct watchdog_ops meson_gxbb_wdt_ops = {
+--
+2.20.1
+
--- /dev/null
+From 20a76eafe501a0b3a802cfb4c9ebf7f8919a9e20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:55:45 +0000
+Subject: xen/pciback: Check dev_data before using it
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit 1669907e3d1abfa3f7586e2d55dbbc117b5adba2 ]
+
+If pcistub_init_device fails, the release function will be called with
+dev_data set to NULL. Check it before using it to avoid a NULL pointer
+dereference.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/pci_stub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 6331a95691a44..ee5ce9286d613 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref)
+ * is called from "unbind" which takes a device_lock mutex.
+ */
+ __pci_reset_function_locked(dev);
+- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
++ if (dev_data &&
++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+ dev_info(&dev->dev, "Could not reload PCI state\n");
+ else
+ pci_restore_state(dev);
+--
+2.20.1
+
--- /dev/null
+From 85d70c2d151246ef55279c240ab1cb0d7f19a156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Align compat attrlist_by_handle with native implementation.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ]
+
+While inspecting the ioctl implementations, I noticed that the compat
+implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the
+same thing as the native implementation. Specifically, the "cursor"
+does not appear to be written out to userspace on the compat path,
+like it is on the native path.
+
+This adjusts the compat implementation to copy out the cursor just
+like the native implementation does. The attrlist cursor does not
+require any special compat handling. This fixes xfstests xfs/269
+on both IA-32 and x32 userspace, when running on an amd64 kernel.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace")
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index 321f57721b922..8f18756ee405e 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -346,6 +346,7 @@ xfs_compat_attrlist_by_handle(
+ {
+ int error;
+ attrlist_cursor_kern_t *cursor;
++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg;
+ compat_xfs_fsop_attrlist_handlereq_t al_hreq;
+ struct dentry *dentry;
+ char *kbuf;
+@@ -380,6 +381,11 @@ xfs_compat_attrlist_by_handle(
+ if (error)
+ goto out_kfree;
+
++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
++ error = -EFAULT;
++ goto out_kfree;
++ }
++
+ if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen))
+ error = -EFAULT;
+
+--
+2.20.1
+
--- /dev/null
+From 13d5354208acd27d7f1d7b06b9049b06ea19d5ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Fix bulkstat compat ioctls on x32 userspace.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit 7ca860e3c1a74ad6bd8949364073ef1044cad758 ]
+
+The bulkstat family of ioctls are problematic on x32, because there is
+a mixup of native 32-bit and 64-bit conventions. The xfs_fsop_bulkreq
+struct contains pointers and 32-bit integers so that matches the native
+32-bit layout, and that means the ioctl implementation goes into the
+regular compat path on x32.
+
+However, the 'ubuffer' member of that struct in turn refers to either
+struct xfs_inogrp or xfs_bstat (or an array of these). On x32, those
+structures match the native 64-bit layout. The compat implementation
+writes out the 32-bit version of these structures. This is not the
+expected format for x32 userspace, causing problems.
+
+Fortunately the functions which actually output these xfs_inogrp and
+xfs_bstat structures have an easy way to select which output format
+is required, so we just need a little tweak to select the right format
+on x32.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index 8f18756ee405e..6b7ed221726db 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -251,6 +251,32 @@ xfs_compat_ioc_bulkstat(
+ int done;
+ int error;
+
++ /*
++ * Output structure handling functions. Depending on the command,
++ * either the xfs_bstat and xfs_inogrp structures are written out
++ * to userpace memory via bulkreq.ubuffer. Normally the compat
++ * functions and structure size are the correct ones to use ...
++ */
++ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat;
++ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat;
++ size_t bs_one_size = sizeof(struct compat_xfs_bstat);
++
++#ifdef CONFIG_X86_X32
++ if (in_x32_syscall()) {
++ /*
++ * ... but on x32 the input xfs_fsop_bulkreq has pointers
++ * which must be handled in the "compat" (32-bit) way, while
++ * the xfs_bstat and xfs_inogrp structures follow native 64-
++ * bit layout convention. So adjust accordingly, otherwise
++ * the data written out in compat layout will not match what
++ * x32 userspace expects.
++ */
++ inumbers_func = xfs_inumbers_fmt;
++ bs_one_func = xfs_bulkstat_one;
++ bs_one_size = sizeof(struct xfs_bstat);
++ }
++#endif
++
+ /* done = 1 if there are more stats to get and if bulkstat */
+ /* should be called again (unused here, but used in dmapi) */
+
+@@ -282,15 +308,15 @@ xfs_compat_ioc_bulkstat(
+
+ if (cmd == XFS_IOC_FSINUMBERS_32) {
+ error = xfs_inumbers(mp, &inlast, &count,
+- bulkreq.ubuffer, xfs_inumbers_fmt_compat);
++ bulkreq.ubuffer, inumbers_func);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) {
+ int res;
+
+- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
+- sizeof(compat_xfs_bstat_t), NULL, &res);
++ error = bs_one_func(mp, inlast, bulkreq.ubuffer,
++ bs_one_size, NULL, &res);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
+ error = xfs_bulkstat(mp, &inlast, &count,
+- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
++ bs_one_func, bs_one_size,
+ bulkreq.ubuffer, &done);
+ } else
+ error = -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 8afde10d9b8990195934777086e4fb50359fbedf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 15:18:52 -0800
+Subject: xfs: require both realtime inodes to mount
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ]
+
+Since mkfs always formats the filesystem with the realtime bitmap and
+summary inodes immediately after the root directory, we should expect
+that both of them are present and loadable, even if there isn't a
+realtime volume attached. There's no reason to skip this if rbmino ==
+NULLFSINO; in fact, this causes an immediate crash if the there /is/ a
+realtime volume and someone writes to it.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Bill O'Donnell <billodo@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_rtalloc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 802bcc326d9fb..0d93d3c10fcc4 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -1222,13 +1222,11 @@ xfs_rtmount_inodes(
+ xfs_sb_t *sbp;
+
+ sbp = &mp->m_sb;
+- if (sbp->sb_rbmino == NULLFSINO)
+- return 0;
+ error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
+ if (error)
+ return error;
+ ASSERT(mp->m_rbmip != NULL);
+- ASSERT(sbp->sb_rsumino != NULLFSINO);
++
+ error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
+ if (error) {
+ IRELE(mp->m_rbmip);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
