--- /dev/null
+From 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 Mon Sep 17 00:00:00 2001
+From: Qiushi Wu <wu000273@umn.edu>
+Date: Wed, 27 May 2020 17:35:51 -0500
+Subject: ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe()
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+commit 4d8be4bc94f74bb7d096e1c2e44457b530d5a170 upstream.
+
+kobject_init_and_add() takes reference even when it fails.
+If this function returns an error, kobject_put() must be called to
+properly clean up the memory associated with the object. Previous
+commit "b8eb718348b8" fixed a similar problem.
+
+Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered performance")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Cc: 4.10+ <stable@vger.kernel.org> # 4.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/cppc_acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -846,6 +846,7 @@ int acpi_cppc_processor_probe(struct acp
+ "acpi_cppc");
+ if (ret) {
+ per_cpu(cpc_desc_ptr, pr->id) = NULL;
++ kobject_put(&cpc_ptr->kobj);
+ goto out_free;
+ }
+
--- /dev/null
+From ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Fri, 15 May 2020 11:36:13 +0200
+Subject: ACPI: GED: add support for _Exx / _Lxx handler methods
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit ea6f3af4c5e63f6981c0b0ab8ebec438e2d5ef40 upstream.
+
+Per the ACPI spec, interrupts in the range [0, 255] may be handled
+in AML using individual methods whose naming is based on the format
+_Exx or _Lxx, where xx is the hex representation of the interrupt
+index.
+
+Add support for this missing feature to our ACPI GED driver.
+
+Cc: v4.9+ <stable@vger.kernel.org> # v4.9+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/evged.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/evged.c
++++ b/drivers/acpi/evged.c
+@@ -79,6 +79,8 @@ static acpi_status acpi_ged_request_inte
+ struct resource r;
+ struct acpi_resource_irq *p = &ares->data.irq;
+ struct acpi_resource_extended_irq *pext = &ares->data.extended_irq;
++ char ev_name[5];
++ u8 trigger;
+
+ if (ares->type == ACPI_RESOURCE_TYPE_END_TAG)
+ return AE_OK;
+@@ -87,14 +89,28 @@ static acpi_status acpi_ged_request_inte
+ dev_err(dev, "unable to parse IRQ resource\n");
+ return AE_ERROR;
+ }
+- if (ares->type == ACPI_RESOURCE_TYPE_IRQ)
++ if (ares->type == ACPI_RESOURCE_TYPE_IRQ) {
+ gsi = p->interrupts[0];
+- else
++ trigger = p->triggering;
++ } else {
+ gsi = pext->interrupts[0];
++ trigger = p->triggering;
++ }
+
+ irq = r.start;
+
+- if (ACPI_FAILURE(acpi_get_handle(handle, "_EVT", &evt_handle))) {
++ switch (gsi) {
++ case 0 ... 255:
++ sprintf(ev_name, "_%c%02hhX",
++ trigger == ACPI_EDGE_SENSITIVE ? 'E' : 'L', gsi);
++
++ if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
++ break;
++ /* fall through */
++ default:
++ if (ACPI_SUCCESS(acpi_get_handle(handle, "_EVT", &evt_handle)))
++ break;
++
+ dev_err(dev, "cannot locate _EVT method\n");
+ return AE_ERROR;
+ }
--- /dev/null
+From 956ad9d98b73f59e442cc119c98ba1e04e94fe6d Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 4 Jun 2020 19:22:26 +0200
+Subject: ACPI: PM: Avoid using power resources if there are none for D0
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 956ad9d98b73f59e442cc119c98ba1e04e94fe6d upstream.
+
+As recently reported, some platforms provide a list of power
+resources for device power state D3hot, through the _PR3 object,
+but they do not provide a list of power resources for device power
+state D0.
+
+Among other things, this causes acpi_device_get_power() to return
+D3hot as the current state of the device in question if all of the
+D3hot power resources are "on", because it sees the power_resources
+flag set and calls acpi_power_get_inferred_state() which finds that
+D3hot is the shallowest power state with all of the associated power
+resources turned "on", so that's what it returns. Moreover, that
+value takes precedence over the acpi_dev_pm_explicit_get() return
+value, because it means a deeper power state. The device may very
+well be in D0 physically at that point, however.
+
+Moreover, the presence of _PR3 without _PR0 for a given device
+means that only one D3-level power state can be supported by it.
+Namely, because there are no power resources to turn "off" when
+transitioning the device from D0 into D3cold (which should be
+supported since _PR3 is present), the evaluation of _PS3 should
+be sufficient to put it straight into D3cold, but this means that
+the effect of turning "on" the _PR3 power resources is unclear,
+so it is better to avoid doing that altogether. Consequently,
+there is no practical way do distinguish D3cold from D3hot for
+the device in question and the power states of it can be labeled
+so that D3hot is the deepest supported one (and Linux assumes
+that putting a device into D3hot via ACPI may cause power to be
+removed from it anyway, for legacy reasons).
+
+To work around the problem described above modify the ACPI
+enumeration of devices so that power resources are only used
+for device power management if the list of D0 power resources
+is not empty and make it mart D3cold as supported only if that
+is the case and the D3hot list of power resources is not empty
+too.
+
+Fixes: ef85bdbec444 ("ACPI / scan: Consolidate extraction of power resources lists")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=205057
+Link: https://lore.kernel.org/linux-acpi/20200603194659.185757-1-hdegoede@redhat.com/
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: youling257@gmail.com
+Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/device_pm.c | 2 +-
+ drivers/acpi/scan.c | 28 +++++++++++++++++++---------
+ 2 files changed, 20 insertions(+), 10 deletions(-)
+
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -186,7 +186,7 @@ int acpi_device_set_power(struct acpi_de
+ * possibly drop references to the power resources in use.
+ */
+ state = ACPI_STATE_D3_HOT;
+- /* If _PR3 is not available, use D3hot as the target state. */
++ /* If D3cold is not supported, use D3hot as the target state. */
+ if (!device->power.states[ACPI_STATE_D3_COLD].flags.valid)
+ target_state = state;
+ } else if (!device->power.states[state].flags.valid) {
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -919,12 +919,9 @@ static void acpi_bus_init_power_state(st
+
+ if (buffer.length && package
+ && package->type == ACPI_TYPE_PACKAGE
+- && package->package.count) {
+- int err = acpi_extract_power_resources(package, 0,
+- &ps->resources);
+- if (!err)
+- device->power.flags.power_resources = 1;
+- }
++ && package->package.count)
++ acpi_extract_power_resources(package, 0, &ps->resources);
++
+ ACPI_FREE(buffer.pointer);
+ }
+
+@@ -971,14 +968,27 @@ static void acpi_bus_get_power_flags(str
+ acpi_bus_init_power_state(device, i);
+
+ INIT_LIST_HEAD(&device->power.states[ACPI_STATE_D3_COLD].resources);
+- if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources))
+- device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1;
+
+- /* Set defaults for D0 and D3hot states (always valid) */
++ /* Set the defaults for D0 and D3hot (always supported). */
+ device->power.states[ACPI_STATE_D0].flags.valid = 1;
+ device->power.states[ACPI_STATE_D0].power = 100;
+ device->power.states[ACPI_STATE_D3_HOT].flags.valid = 1;
+
++ /*
++ * Use power resources only if the D0 list of them is populated, because
++ * some platforms may provide _PR3 only to indicate D3cold support and
++ * in those cases the power resources list returned by it may be bogus.
++ */
++ if (!list_empty(&device->power.states[ACPI_STATE_D0].resources)) {
++ device->power.flags.power_resources = 1;
++ /*
++ * D3cold is supported if the D3hot list of power resources is
++ * not empty.
++ */
++ if (!list_empty(&device->power.states[ACPI_STATE_D3_HOT].resources))
++ device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1;
++ }
++
+ if (acpi_bus_init_power(device))
+ device->flags.power_manageable = 0;
+ }
--- /dev/null
+From 6e6c25283dff866308c87b49434c7dbad4774cc0 Mon Sep 17 00:00:00 2001
+From: Qiushi Wu <wu000273@umn.edu>
+Date: Wed, 27 May 2020 16:17:17 -0500
+Subject: ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile()
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+commit 6e6c25283dff866308c87b49434c7dbad4774cc0 upstream.
+
+kobject_init_and_add() takes reference even when it fails.
+Thus, when kobject_init_and_add() returns an error,
+kobject_put() must be called to properly clean up the kobject.
+
+Fixes: 3f8055c35836 ("ACPI / hotplug: Introduce user space interface for hotplug profiles")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sysfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -993,8 +993,10 @@ void acpi_sysfs_add_hotplug_profile(stru
+
+ error = kobject_init_and_add(&hotplug->kobj,
+ &acpi_hotplug_profile_ktype, hotplug_kobj, "%s", name);
+- if (error)
++ if (error) {
++ kobject_put(&hotplug->kobj);
+ goto err_out;
++ }
+
+ kobject_uevent(&hotplug->kobj, KOBJ_ADD);
+ return;
--- /dev/null
+From d9b8fbf15d05350b36081eddafcf7b15aa1add50 Mon Sep 17 00:00:00 2001
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Wed, 3 Jun 2020 17:24:59 +0800
+Subject: ALSA: es1688: Add the missed snd_card_free()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+commit d9b8fbf15d05350b36081eddafcf7b15aa1add50 upstream.
+
+snd_es968_pnp_detect() misses a snd_card_free() in a failed path.
+Add the missed function call to fix it.
+
+Fixes: a20971b201ac ("ALSA: Merge es1688 and es968 drivers")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200603092459.1424093-1-hslester96@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/isa/es1688/es1688.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/isa/es1688/es1688.c
++++ b/sound/isa/es1688/es1688.c
+@@ -267,8 +267,10 @@ static int snd_es968_pnp_detect(struct p
+ return error;
+ }
+ error = snd_es1688_probe(card, dev);
+- if (error < 0)
++ if (error < 0) {
++ snd_card_free(card);
+ return error;
++ }
+ pnp_set_card_drvdata(pcard, card);
+ snd_es968_pnp_is_probed = 1;
+ return 0;
--- /dev/null
+From bbd6aac3ae15bef762af03bf62e35ace5c4292bd Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sun, 10 May 2020 16:42:56 +0900
+Subject: ALSA: fireface: fix configuration error for nominal sampling transfer frequency
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit bbd6aac3ae15bef762af03bf62e35ace5c4292bd upstream.
+
+128000 and 192000 are congruence modulo 32000, thus it's wrong to
+distinguish them as multiple of 32000 and 48000 by modulo 32000 at
+first.
+
+Additionally, used condition statement to detect quadruple speed can
+cause missing bit flag.
+
+Furthermore, counter to ensure the configuration is wrong and it
+causes false positive.
+
+This commit fixes the above three bugs.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 60aec494b389 ("ALSA: fireface: support allocate_resources operation in latter protocol")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20200510074301.116224-2-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/fireface/ff-protocol-latter.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/sound/firewire/fireface/ff-protocol-latter.c
++++ b/sound/firewire/fireface/ff-protocol-latter.c
+@@ -107,18 +107,18 @@ static int latter_allocate_resources(str
+ int err;
+
+ // Set the number of data blocks transferred in a second.
+- if (rate % 32000 == 0)
+- code = 0x00;
++ if (rate % 48000 == 0)
++ code = 0x04;
+ else if (rate % 44100 == 0)
+ code = 0x02;
+- else if (rate % 48000 == 0)
+- code = 0x04;
++ else if (rate % 32000 == 0)
++ code = 0x00;
+ else
+ return -EINVAL;
+
+ if (rate >= 64000 && rate < 128000)
+ code |= 0x08;
+- else if (rate >= 128000 && rate < 192000)
++ else if (rate >= 128000)
+ code |= 0x10;
+
+ reg = cpu_to_le32(code);
+@@ -140,7 +140,7 @@ static int latter_allocate_resources(str
+ if (curr_rate == rate)
+ break;
+ }
+- if (count == 10)
++ if (count > 10)
+ return -ETIMEDOUT;
+
+ for (i = 0; i < ARRAY_SIZE(amdtp_rate_table); ++i) {
--- /dev/null
+From f4588cc425beb62e355bc2a5de5d5c83e26a74ca Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sun, 10 May 2020 16:42:57 +0900
+Subject: ALSA: fireface: start IR context immediately
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit f4588cc425beb62e355bc2a5de5d5c83e26a74ca upstream.
+
+In the latter models of RME Fireface series, device start to transfer
+packets several dozens of milliseconds. On the other hand, ALSA fireface
+driver starts IR context 2 milliseconds after the start. This results
+in loss to handle incoming packets on the context.
+
+This commit changes to start IR context immediately instead of
+postponement. For Fireface 800, this affects nothing because the device
+transfer packets 100 milliseconds or so after the start and this is
+within wait timeout.
+
+Cc: <stable@vger.kernel.org>
+Fixes: acfedcbe1ce4 ("ALSA: firewire-lib: postpone to start IR context")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20200510074301.116224-3-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/fireface/ff-stream.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/sound/firewire/fireface/ff-stream.c
++++ b/sound/firewire/fireface/ff-stream.c
+@@ -184,7 +184,6 @@ int snd_ff_stream_start_duplex(struct sn
+ */
+ if (!amdtp_stream_running(&ff->rx_stream)) {
+ int spd = fw_parent_device(ff->unit)->max_speed;
+- unsigned int ir_delay_cycle;
+
+ err = ff->spec->protocol->begin_session(ff, rate);
+ if (err < 0)
+@@ -200,14 +199,7 @@ int snd_ff_stream_start_duplex(struct sn
+ if (err < 0)
+ goto error;
+
+- // The device postpones start of transmission mostly for several
+- // cycles after receiving packets firstly.
+- if (ff->spec->protocol == &snd_ff_protocol_ff800)
+- ir_delay_cycle = 800; // = 100 msec
+- else
+- ir_delay_cycle = 16; // = 2 msec
+-
+- err = amdtp_domain_start(&ff->domain, ir_delay_cycle);
++ err = amdtp_domain_start(&ff->domain, 0);
+ if (err < 0)
+ goto error;
+
--- /dev/null
+From 27a7c67012cfa6d79f87fbb51afa13c6c0e24e34 Mon Sep 17 00:00:00 2001
+From: Hersen Wu <hersenxs.wu@amd.com>
+Date: Tue, 2 Jun 2020 21:31:37 -0400
+Subject: ALSA: hda: add sienna_cichlid audio asic id for sienna_cichlid up
+
+From: Hersen Wu <hersenxs.wu@amd.com>
+
+commit 27a7c67012cfa6d79f87fbb51afa13c6c0e24e34 upstream.
+
+dp/hdmi ati hda is not shown in audio settings
+
+[ rearranged to a more appropriate place per device number order
+ -- tiwai ]
+
+Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200603013137.1849404-1-alexander.deucher@amd.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2662,6 +2662,9 @@ static const struct pci_device_id azx_id
+ { PCI_DEVICE(0x1002, 0xab20),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS |
+ AZX_DCAPS_PM_RUNTIME },
++ { PCI_DEVICE(0x1002, 0xab28),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS |
++ AZX_DCAPS_PM_RUNTIME },
+ { PCI_DEVICE(0x1002, 0xab38),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS |
+ AZX_DCAPS_PM_RUNTIME },
--- /dev/null
+From 573fcbfd319ccef26caa3700320242accea7fd5c Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 8 Jun 2020 19:55:41 +0800
+Subject: ALSA: hda/realtek - add a pintbl quirk for several Lenovo machines
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 573fcbfd319ccef26caa3700320242accea7fd5c upstream.
+
+A couple of Lenovo ThinkCentre machines all have 2 front mics and they
+use the same codec alc623 and have the same pin config, so add a
+pintbl entry for those machines to apply the fixup
+ALC283_FIXUP_HEADSET_MIC.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20200608115541.9531-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8124,6 +8124,12 @@ static const struct snd_hda_pin_quirk al
+ ALC225_STANDARD_PINS,
+ {0x12, 0xb7a60130},
+ {0x17, 0x90170110}),
++ SND_HDA_PIN_QUIRK(0x10ec0623, 0x17aa, "Lenovo", ALC283_FIXUP_HEADSET_MIC,
++ {0x14, 0x01014010},
++ {0x17, 0x90170120},
++ {0x18, 0x02a11030},
++ {0x19, 0x02a1103f},
++ {0x21, 0x0221101f}),
+ {}
+ };
+
--- /dev/null
+From 951e2736f4b11b58dc44d41964fa17c3527d882a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Mon, 8 Jun 2020 18:50:39 +0200
+Subject: ALSA: pcm: disallow linking stream to itself
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 951e2736f4b11b58dc44d41964fa17c3527d882a upstream.
+
+Prevent SNDRV_PCM_IOCTL_LINK linking stream to itself - the code
+can't handle it. Fixed commit is not where bug was introduced, but
+changes the context significantly.
+
+Cc: stable@vger.kernel.org
+Fixes: 0888c321de70 ("pcm_native: switch to fdget()/fdput()")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/89c4a2487609a0ed6af3ecf01cc972bdc59a7a2d.1591634956.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_native.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -2166,6 +2166,12 @@ static int snd_pcm_link(struct snd_pcm_s
+ }
+ pcm_file = f.file->private_data;
+ substream1 = pcm_file->substream;
++
++ if (substream == substream1) {
++ res = -EINVAL;
++ goto _badf;
++ }
++
+ group = kzalloc(sizeof(*group), GFP_KERNEL);
+ if (!group) {
+ res = -ENOMEM;
--- /dev/null
+From e18035cf5cb3d2bf8e4f4d350a23608bd208b934 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Mon, 8 Jun 2020 12:06:32 +0200
+Subject: ALSA: pcm: fix snd_pcm_link() lockdep splat
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit e18035cf5cb3d2bf8e4f4d350a23608bd208b934 upstream.
+
+Add and use snd_pcm_stream_lock_nested() in snd_pcm_link/unlink
+implementation. The code is fine, but generates a lockdep complaint:
+
+============================================
+WARNING: possible recursive locking detected
+5.7.1mq+ #381 Tainted: G O
+--------------------------------------------
+pulseaudio/4180 is trying to acquire lock:
+ffff888402d6f508 (&group->lock){-...}-{2:2}, at: snd_pcm_common_ioctl+0xda8/0xee0 [snd_pcm]
+
+but task is already holding lock:
+ffff8883f7a8cf18 (&group->lock){-...}-{2:2}, at: snd_pcm_common_ioctl+0xe4e/0xee0 [snd_pcm]
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&group->lock);
+ lock(&group->lock);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+2 locks held by pulseaudio/4180:
+ #0: ffffffffa1a05190 (snd_pcm_link_rwsem){++++}-{3:3}, at: snd_pcm_common_ioctl+0xca0/0xee0 [snd_pcm]
+ #1: ffff8883f7a8cf18 (&group->lock){-...}-{2:2}, at: snd_pcm_common_ioctl+0xe4e/0xee0 [snd_pcm]
+[...]
+
+Cc: stable@vger.kernel.org
+Fixes: f57f3df03a8e ("ALSA: pcm: More fine-grained PCM link locking")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/37252c65941e58473b1219ca9fab03d48f47e3e3.1591610330.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/pcm_native.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -138,6 +138,16 @@ void snd_pcm_stream_lock_irq(struct snd_
+ }
+ EXPORT_SYMBOL_GPL(snd_pcm_stream_lock_irq);
+
++static void snd_pcm_stream_lock_nested(struct snd_pcm_substream *substream)
++{
++ struct snd_pcm_group *group = &substream->self_group;
++
++ if (substream->pcm->nonatomic)
++ mutex_lock_nested(&group->mutex, SINGLE_DEPTH_NESTING);
++ else
++ spin_lock_nested(&group->lock, SINGLE_DEPTH_NESTING);
++}
++
+ /**
+ * snd_pcm_stream_unlock_irq - Unlock the PCM stream
+ * @substream: PCM substream
+@@ -2200,7 +2210,7 @@ static int snd_pcm_link(struct snd_pcm_s
+ snd_pcm_stream_unlock_irq(substream);
+
+ snd_pcm_group_lock_irq(target_group, nonatomic);
+- snd_pcm_stream_lock(substream1);
++ snd_pcm_stream_lock_nested(substream1);
+ snd_pcm_group_assign(substream1, target_group);
+ refcount_inc(&target_group->refs);
+ snd_pcm_stream_unlock(substream1);
+@@ -2216,7 +2226,7 @@ static int snd_pcm_link(struct snd_pcm_s
+
+ static void relink_to_local(struct snd_pcm_substream *substream)
+ {
+- snd_pcm_stream_lock(substream);
++ snd_pcm_stream_lock_nested(substream);
+ snd_pcm_group_assign(substream, &substream->self_group);
+ snd_pcm_stream_unlock(substream);
+ }
--- /dev/null
+From 0c5086f5699906ec8e31ea6509239489f060f2dc Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Mon, 8 Jun 2020 14:26:28 +0800
+Subject: ALSA: usb-audio: Add vendor, product and profile name for HP Thunderbolt Dock
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 0c5086f5699906ec8e31ea6509239489f060f2dc upstream.
+
+The HP Thunderbolt Dock has two separate USB devices, one is for speaker
+and one is for headset. Add names for them so userspace can apply UCM
+settings.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200608062630.10806-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks-table.h | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -25,6 +25,26 @@
+ .idProduct = prod, \
+ .bInterfaceClass = USB_CLASS_VENDOR_SPEC
+
++/* HP Thunderbolt Dock Audio Headset */
++{
++ USB_DEVICE(0x03f0, 0x0269),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "HP",
++ .product_name = "Thunderbolt Dock Audio Headset",
++ .profile_name = "HP-Thunderbolt-Dock-Audio-Headset",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++/* HP Thunderbolt Dock Audio Module */
++{
++ USB_DEVICE(0x03f0, 0x0567),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "HP",
++ .product_name = "Thunderbolt Dock Audio Module",
++ .profile_name = "HP-Thunderbolt-Dock-Audio-Module",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
+ /* FTDI devices */
+ {
+ USB_DEVICE(0x0403, 0xb8d8),
--- /dev/null
+From 862b2509d157c629dd26d7ac6c6cdbf043d332eb Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 3 Jun 2020 17:37:08 +0200
+Subject: ALSA: usb-audio: Fix inconsistent card PM state after resume
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 862b2509d157c629dd26d7ac6c6cdbf043d332eb upstream.
+
+When a USB-audio interface gets runtime-suspended via auto-pm feature,
+the driver suspends all functionality and increment
+chip->num_suspended_intf. Later on, when the system gets suspended to
+S3, the driver increments chip->num_suspended_intf again, skips the
+device changes, and sets the card power state to
+SNDRV_CTL_POWER_D3hot. In return, when the system gets resumed from
+S3, the resume callback decrements chip->num_suspended_intf. Since
+this refcount is still not zero (it's been runtime-suspended), the
+whole resume is skipped. But there is a small pitfall here.
+
+The problem is that the driver doesn't restore the card power state
+after this resume call, leaving it as SNDRV_CTL_POWER_D3hot. So,
+even after the system resume finishes, the card instance still appears
+as if it were system-suspended, and this confuses many ioctl accesses
+that are blocked unexpectedly.
+
+In details, we have two issues behind the scene: one is that the card
+power state is changed only when the refcount becomes zero, and
+another is that the prior auto-suspend check is kept in a boolean
+flag. Although the latter problem is almost negligible since the
+auto-pm feature is imposed only on the primary interface, but this can
+be a potential problem on the devices with multiple interfaces.
+
+This patch addresses those issues by the following:
+
+- Replace chip->autosuspended boolean flag with chip->system_suspend
+ counter
+
+- At the first system-suspend, chip->num_suspended_intf is recorded to
+ chip->system_suspend
+
+- At system-resume, the card power state is restored when the
+ chip->num_suspended_intf refcount reaches to chip->system_suspend,
+ i.e. the state returns to the auto-suspended
+
+Also, the patch fixes yet another hidden problem by the code
+refactoring along with the fixes above: namely, when some resume
+procedure failed, the driver left chip->num_suspended_intf that was
+already decreased, and it might lead to the refcount unbalance.
+In the new code, the refcount decrement is done after the whole resume
+procedure, and the problem is avoided as well.
+
+Fixes: 0662292aec05 ("ALSA: usb-audio: Handle normal and auto-suspend equally")
+Reported-and-tested-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200603153709.6293-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 19 ++++++++++++-------
+ sound/usb/usbaudio.h | 2 +-
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -843,9 +843,6 @@ static int usb_audio_suspend(struct usb_
+ if (chip == (void *)-1L)
+ return 0;
+
+- chip->autosuspended = !!PMSG_IS_AUTO(message);
+- if (!chip->autosuspended)
+- snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot);
+ if (!chip->num_suspended_intf++) {
+ list_for_each_entry(as, &chip->pcm_list, list) {
+ snd_usb_pcm_suspend(as);
+@@ -858,6 +855,11 @@ static int usb_audio_suspend(struct usb_
+ snd_usb_mixer_suspend(mixer);
+ }
+
++ if (!PMSG_IS_AUTO(message) && !chip->system_suspend) {
++ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D3hot);
++ chip->system_suspend = chip->num_suspended_intf;
++ }
++
+ return 0;
+ }
+
+@@ -871,10 +873,10 @@ static int __usb_audio_resume(struct usb
+
+ if (chip == (void *)-1L)
+ return 0;
+- if (--chip->num_suspended_intf)
+- return 0;
+
+ atomic_inc(&chip->active); /* avoid autopm */
++ if (chip->num_suspended_intf > 1)
++ goto out;
+
+ list_for_each_entry(as, &chip->pcm_list, list) {
+ err = snd_usb_pcm_resume(as);
+@@ -896,9 +898,12 @@ static int __usb_audio_resume(struct usb
+ snd_usbmidi_resume(p);
+ }
+
+- if (!chip->autosuspended)
++ out:
++ if (chip->num_suspended_intf == chip->system_suspend) {
+ snd_power_change_state(chip->card, SNDRV_CTL_POWER_D0);
+- chip->autosuspended = 0;
++ chip->system_suspend = 0;
++ }
++ chip->num_suspended_intf--;
+
+ err_out:
+ atomic_dec(&chip->active); /* allow autopm after this point */
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -26,7 +26,7 @@ struct snd_usb_audio {
+ struct usb_interface *pm_intf;
+ u32 usb_id;
+ struct mutex mutex;
+- unsigned int autosuspended:1;
++ unsigned int system_suspend;
+ atomic_t active;
+ atomic_t shutdown;
+ atomic_t usage_count;
--- /dev/null
+From a194c33f45f83068ef13bf1d16e26d4ca3ecc098 Mon Sep 17 00:00:00 2001
+From: Nick Desaulniers <ndesaulniers@google.com>
+Date: Mon, 8 Jun 2020 13:38:17 -0700
+Subject: arm64: acpi: fix UBSAN warning
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+commit a194c33f45f83068ef13bf1d16e26d4ca3ecc098 upstream.
+
+Will reported a UBSAN warning:
+
+UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6
+member access within null pointer of type 'struct acpi_madt_generic_interrupt'
+CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc6-00124-g96bc42ff0a82 #1
+Call trace:
+ dump_backtrace+0x0/0x384
+ show_stack+0x28/0x38
+ dump_stack+0xec/0x174
+ handle_null_ptr_deref+0x134/0x174
+ __ubsan_handle_type_mismatch_v1+0x84/0xa4
+ acpi_parse_gic_cpu_interface+0x60/0xe8
+ acpi_parse_entries_array+0x288/0x498
+ acpi_table_parse_entries_array+0x178/0x1b4
+ acpi_table_parse_madt+0xa4/0x110
+ acpi_parse_and_init_cpus+0x38/0x100
+ smp_init_cpus+0x74/0x258
+ setup_arch+0x350/0x3ec
+ start_kernel+0x98/0x6f4
+
+This is from the use of the ACPI_OFFSET in
+arch/arm64/include/asm/acpi.h. Replace its use with offsetof from
+include/linux/stddef.h which should implement the same logic using
+__builtin_offsetof, so that UBSAN wont warn.
+
+Reported-by: Will Deacon <will@kernel.org>
+Suggested-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
+Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/lkml/20200521100952.GA5360@willie-the-truck/
+Link: https://lore.kernel.org/r/20200608203818.189423-1-ndesaulniers@google.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/acpi.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/include/asm/acpi.h
++++ b/arch/arm64/include/asm/acpi.h
+@@ -12,6 +12,7 @@
+ #include <linux/efi.h>
+ #include <linux/memblock.h>
+ #include <linux/psci.h>
++#include <linux/stddef.h>
+
+ #include <asm/cputype.h>
+ #include <asm/io.h>
+@@ -31,14 +32,14 @@
+ * is therefore used to delimit the MADT GICC structure minimum length
+ * appropriately.
+ */
+-#define ACPI_MADT_GICC_MIN_LENGTH ACPI_OFFSET( \
++#define ACPI_MADT_GICC_MIN_LENGTH offsetof( \
+ struct acpi_madt_generic_interrupt, efficiency_class)
+
+ #define BAD_MADT_GICC_ENTRY(entry, end) \
+ (!(entry) || (entry)->header.length < ACPI_MADT_GICC_MIN_LENGTH || \
+ (unsigned long)(entry) + (entry)->header.length > (end))
+
+-#define ACPI_MADT_GICC_SPE (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \
++#define ACPI_MADT_GICC_SPE (offsetof(struct acpi_madt_generic_interrupt, \
+ spe_interrupt) + sizeof(u16))
+
+ /* Basic configuration for ACPI */
--- /dev/null
+From 81c4f4d924d5d009b5ed785a3e22b18d0f7b831f Mon Sep 17 00:00:00 2001
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+Date: Wed, 10 Jun 2020 18:41:41 -0700
+Subject: lib: fix bitmap_parse() on 64-bit big endian archs
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+commit 81c4f4d924d5d009b5ed785a3e22b18d0f7b831f upstream.
+
+Commit 2d6261583be0 ("lib: rework bitmap_parse()") does not take into
+account order of halfwords on 64-bit big endian architectures. As
+result (at least) Receive Packet Steering, IRQ affinity masks and
+runtime kernel test "test_bitmap" get broken on s390.
+
+[andriy.shevchenko@linux.intel.com: convert infinite while loop to a for loop]
+ Link: http://lkml.kernel.org/r/20200609140535.87160-1-andriy.shevchenko@linux.intel.com
+
+Fixes: 2d6261583be0 ("lib: rework bitmap_parse()")
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Yury Norov <yury.norov@gmail.com>
+Cc: Amritha Nambiar <amritha.nambiar@intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Miklos Szeredi <mszeredi@redhat.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: "Tobin C . Harding" <tobin@kernel.org>
+Cc: Vineet Gupta <vineet.gupta1@synopsys.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/1591634471-17647-1-git-send-email-agordeev@linux.ibm.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/bitmap.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -740,8 +740,9 @@ int bitmap_parse(const char *start, unsi
+ int chunks = BITS_TO_U32(nmaskbits);
+ u32 *bitmap = (u32 *)maskp;
+ int unset_bit;
++ int chunk;
+
+- while (1) {
++ for (chunk = 0; ; chunk++) {
+ end = bitmap_find_region_reverse(start, end);
+ if (start > end)
+ break;
+@@ -749,7 +750,11 @@ int bitmap_parse(const char *start, unsi
+ if (!chunks--)
+ return -EOVERFLOW;
+
+- end = bitmap_get_x32_reverse(start, end, bitmap++);
++#if defined(CONFIG_64BIT) && defined(__BIG_ENDIAN)
++ end = bitmap_get_x32_reverse(start, end, &bitmap[chunk ^ 1]);
++#else
++ end = bitmap_get_x32_reverse(start, end, &bitmap[chunk]);
++#endif
+ if (IS_ERR(end))
+ return PTR_ERR(end);
+ }
--- /dev/null
+From b5265c813ce4efbfa2e46fd27cdf9a7f44a35d2e Mon Sep 17 00:00:00 2001
+From: Dave Rodgman <dave.rodgman@arm.com>
+Date: Thu, 11 Jun 2020 17:34:54 -0700
+Subject: lib/lzo: fix ambiguous encoding bug in lzo-rle
+
+From: Dave Rodgman <dave.rodgman@arm.com>
+
+commit b5265c813ce4efbfa2e46fd27cdf9a7f44a35d2e upstream.
+
+In some rare cases, for input data over 32 KB, lzo-rle could encode two
+different inputs to the same compressed representation, so that
+decompression is then ambiguous (i.e. data may be corrupted - although
+zram is not affected because it operates over 4 KB pages).
+
+This modifies the compressor without changing the decompressor or the
+bitstream format, such that:
+
+ - there is no change to how data produced by the old compressor is
+ decompressed
+
+ - an old decompressor will correctly decode data from the updated
+ compressor
+
+ - performance and compression ratio are not affected
+
+ - we avoid introducing a new bitstream format
+
+In testing over 12.8M real-world files totalling 903 GB, three files
+were affected by this bug. I also constructed 37M semi-random 64 KB
+files totalling 2.27 TB, and saw no affected files. Finally I tested
+over files constructed to contain each of the ~1024 possible bad input
+sequences; for all of these cases, updated lzo-rle worked correctly.
+
+There is no significant impact to performance or compression ratio.
+
+Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Dave Rodgman <dave.rodgman@arm.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Cc: Markus F.X.J. Oberhumer <markus@oberhumer.com>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Nitin Gupta <ngupta@vflare.org>
+Cc: Chao Yu <yuchao0@huawei.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200507100203.29785-1-dave.rodgman@arm.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/lzo.txt | 8 ++++++--
+ lib/lzo/lzo1x_compress.c | 13 +++++++++++++
+ 2 files changed, 19 insertions(+), 2 deletions(-)
+
+--- a/Documentation/lzo.txt
++++ b/Documentation/lzo.txt
+@@ -159,11 +159,15 @@ Byte sequences
+ distance = 16384 + (H << 14) + D
+ state = S (copy S literals after this block)
+ End of stream is reached if distance == 16384
++ In version 1 only, to prevent ambiguity with the RLE case when
++ ((distance & 0x803f) == 0x803f) && (261 <= length <= 264), the
++ compressor must not emit block copies where distance and length
++ meet these conditions.
+
+ In version 1 only, this instruction is also used to encode a run of
+- zeros if distance = 0xbfff, i.e. H = 1 and the D bits are all 1.
++ zeros if distance = 0xbfff, i.e. H = 1 and the D bits are all 1.
+ In this case, it is followed by a fourth byte, X.
+- run length = ((X << 3) | (0 0 0 0 0 L L L)) + 4.
++ run length = ((X << 3) | (0 0 0 0 0 L L L)) + 4
+
+ 0 0 1 L L L L L (32..63)
+ Copy of small block within 16kB distance (preferably less than 34B)
+--- a/lib/lzo/lzo1x_compress.c
++++ b/lib/lzo/lzo1x_compress.c
+@@ -268,6 +268,19 @@ m_len_done:
+ *op++ = (M4_MARKER | ((m_off >> 11) & 8)
+ | (m_len - 2));
+ else {
++ if (unlikely(((m_off & 0x403f) == 0x403f)
++ && (m_len >= 261)
++ && (m_len <= 264))
++ && likely(bitstream_version)) {
++ // Under lzo-rle, block copies
++ // for 261 <= length <= 264 and
++ // (distance & 0x80f3) == 0x80f3
++ // can result in ambiguous
++ // output. Adjust length
++ // to 260 to prevent ambiguity.
++ ip -= m_len - 260;
++ m_len = 260;
++ }
+ m_len -= M4_MAX_LEN;
+ *op++ = (M4_MARKER | ((m_off >> 11) & 8));
+ while (unlikely(m_len > 255)) {
--- /dev/null
+From 8301c719a2bd131436438e49130ee381d30933f5 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Date: Wed, 10 Jun 2020 18:41:35 -0700
+Subject: nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+commit 8301c719a2bd131436438e49130ee381d30933f5 upstream.
+
+After commit c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if
+mapping has no dirty pages"), the following null pointer dereference has
+been reported on nilfs2:
+
+ BUG: kernel NULL pointer dereference, address: 00000000000000a8
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP PTI
+ ...
+ RIP: 0010:percpu_counter_add_batch+0xa/0x60
+ ...
+ Call Trace:
+ __test_set_page_writeback+0x2d3/0x330
+ nilfs_segctor_do_construct+0x10d3/0x2110 [nilfs2]
+ nilfs_segctor_construct+0x168/0x260 [nilfs2]
+ nilfs_segctor_thread+0x127/0x3b0 [nilfs2]
+ kthread+0xf8/0x130
+ ...
+
+This crash turned out to be caused by set_page_writeback() call for
+segment summary buffers at nilfs_segctor_prepare_write().
+
+set_page_writeback() can call inc_wb_stat(inode_to_wb(inode),
+WB_WRITEBACK) where inode_to_wb(inode) is NULL if the inode of
+underlying block device does not have an associated wb.
+
+This fixes the issue by calling inode_attach_wb() in advance to ensure
+to associate the bdev inode with its wb.
+
+Fixes: c3aab9a0bd91 ("mm/filemap.c: don't initiate writeback if mapping has no dirty pages")
+Reported-by: Walton Hoops <me@waltonhoops.com>
+Reported-by: Tomas Hlavaty <tom@logand.com>
+Reported-by: ARAI Shun-ichi <hermes@ceres.dti.ne.jp>
+Reported-by: Hideki EIRAKU <hdk1983@gmail.com>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: <stable@vger.kernel.org> [5.4+]
+Link: http://lkml.kernel.org/r/20200608.011819.1399059588922299158.konishi.ryusuke@gmail.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nilfs2/segment.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -2780,6 +2780,8 @@ int nilfs_attach_log_writer(struct super
+ if (!nilfs->ns_writer)
+ return -ENOMEM;
+
++ inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL);
++
+ err = nilfs_segctor_start_thread(nilfs->ns_writer);
+ if (err) {
+ kfree(nilfs->ns_writer);
--- /dev/null
+From 64c7d7ea22d86cacb65d0c097cc447bc0e6d8abd Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 21 May 2020 19:08:09 +0200
+Subject: PM: runtime: clk: Fix clk_pm_runtime_get() error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 64c7d7ea22d86cacb65d0c097cc447bc0e6d8abd upstream.
+
+clk_pm_runtime_get() assumes that the PM-runtime usage counter will
+be dropped by pm_runtime_get_sync() on errors, which is not the case,
+so PM-runtime references to devices acquired by the former are leaked
+on errors returned by the latter.
+
+Fix this by modifying clk_pm_runtime_get() to drop the reference if
+pm_runtime_get_sync() returns an error.
+
+Fixes: 9a34b45397e5 clk: Add support for runtime PM
+Cc: 4.15+ <stable@vger.kernel.org> # 4.15+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -114,7 +114,11 @@ static int clk_pm_runtime_get(struct clk
+ return 0;
+
+ ret = pm_runtime_get_sync(core->dev);
+- return ret < 0 ? ret : 0;
++ if (ret < 0) {
++ pm_runtime_put_noidle(core->dev);
++ return ret;
++ }
++ return 0;
+ }
+
+ static void clk_pm_runtime_put(struct clk_core *core)
--- /dev/null
+From 8f065acec7573672dd15916e31d1e9b2e785566c Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Mon, 25 May 2020 13:59:52 +0300
+Subject: serial: imx: Initialize lock for non-registered console
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 8f065acec7573672dd15916e31d1e9b2e785566c upstream.
+
+The commit a3cb39d258ef
+("serial: core: Allow detach and attach serial device for console")
+changed a bit logic behind lock initialization since for most of the console
+driver it's supposed to have lock already initialized even if console is not
+enabled. However, it's not the case for Freescale IMX console.
+
+Initialize lock explicitly in the ->probe().
+
+Note, there is still an open question should or shouldn't not this driver
+register console properly.
+
+Fixes: a3cb39d258ef ("serial: core: Allow detach and attach serial device for console")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20200525105952.13744-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/imx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2398,6 +2398,9 @@ static int imx_uart_probe(struct platfor
+ }
+ }
+
++ /* We need to initialize lock even for non-registered console */
++ spin_lock_init(&sport->port.lock);
++
+ imx_uart_ports[sport->port.line] = sport;
+
+ platform_set_drvdata(pdev, sport);
io_uring-use-kvfree-in-io_sqe_buffer_register.patch
io_uring-allow-o_nonblock-async-retry.patch
efi-efivars-add-missing-kobject_put-in-sysfs-entry-creation-error-path.patch
+smb3-fix-incorrect-number-of-credits-when-ioctl-maxoutputresponse-64k.patch
+smb3-add-indatalen-that-can-be-a-non-zero-value-to-calculation-of-credit-charge-in-smb2-ioctl.patch
+smb3-fix-typo-in-mount-options-displayed-in-proc-mounts.patch
+serial-imx-initialize-lock-for-non-registered-console.patch
+watchdog-imx_sc_wdt-fix-reboot-on-crash.patch
+alsa-es1688-add-the-missed-snd_card_free.patch
+alsa-hda-add-sienna_cichlid-audio-asic-id-for-sienna_cichlid-up.patch
+alsa-fireface-fix-configuration-error-for-nominal-sampling-transfer-frequency.patch
+alsa-fireface-start-ir-context-immediately.patch
+alsa-hda-realtek-add-a-pintbl-quirk-for-several-lenovo-machines.patch
+alsa-pcm-disallow-linking-stream-to-itself.patch
+alsa-pcm-fix-snd_pcm_link-lockdep-splat.patch
+alsa-usb-audio-fix-inconsistent-card-pm-state-after-resume.patch
+alsa-usb-audio-add-vendor-product-and-profile-name-for-hp-thunderbolt-dock.patch
+acpi-sysfs-fix-reference-count-leak-in-acpi_sysfs_add_hotplug_profile.patch
+acpi-cppc-fix-reference-count-leak-in-acpi_cppc_processor_probe.patch
+acpi-ged-add-support-for-_exx-_lxx-handler-methods.patch
+acpi-pm-avoid-using-power-resources-if-there-are-none-for-d0.patch
+arm64-acpi-fix-ubsan-warning.patch
+lib-lzo-fix-ambiguous-encoding-bug-in-lzo-rle.patch
+nilfs2-fix-null-pointer-dereference-at-nilfs_segctor_do_construct.patch
+lib-fix-bitmap_parse-on-64-bit-big-endian-archs.patch
+spi-dw-fix-controller-unregister-order.patch
+spi-fix-controller-unregister-order.patch
+spi-pxa2xx-fix-controller-unregister-order.patch
+spi-pxa2xx-fix-runtime-pm-ref-imbalance-on-probe-error.patch
+spi-bcm2835-fix-controller-unregister-order.patch
+spi-bcm2835aux-fix-controller-unregister-order.patch
+spi-bcm-qspi-handle-clock-probe-deferral.patch
+spi-bcm-qspi-when-tx-rx-buffer-is-null-set-to-0.patch
+pm-runtime-clk-fix-clk_pm_runtime_get-error-path.patch
--- /dev/null
+From ebf57440ec59a36e1fc5fe91e31d66ae0d1662d0 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <namjae.jeon@samsung.com>
+Date: Thu, 11 Jun 2020 11:21:19 +0900
+Subject: smb3: add indatalen that can be a non-zero value to calculation of credit charge in smb2 ioctl
+
+From: Namjae Jeon <namjae.jeon@samsung.com>
+
+commit ebf57440ec59a36e1fc5fe91e31d66ae0d1662d0 upstream.
+
+Some of tests in xfstests failed with cifsd kernel server since commit
+e80ddeb2f70e. cifsd kernel server validates credit charge from client
+by calculating it base on max((InputCount + OutputCount) and
+(MaxInputResponse + MaxOutputResponse)) according to specification.
+
+MS-SMB2 specification describe credit charge calculation of smb2 ioctl :
+
+If Connection.SupportsMultiCredit is TRUE, the server MUST validate
+CreditCharge based on the maximum of (InputCount + OutputCount) and
+(MaxInputResponse + MaxOutputResponse), as specified in section 3.3.5.2.5.
+If the validation fails, it MUST fail the IOCTL request with
+STATUS_INVALID_PARAMETER.
+
+This patch add indatalen that can be a non-zero value to calculation of
+credit charge in SMB2_ioctl_init().
+
+Fixes: e80ddeb2f70e ("smb3: fix incorrect number of credits when ioctl
+MaxOutputResponse > 64K")
+Cc: Stable <stable@vger.kernel.org>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Cc: Steve French <smfrench@gmail.com>
+Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2pdu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2922,7 +2922,9 @@ SMB2_ioctl_init(struct cifs_tcon *tcon,
+ * response size smaller.
+ */
+ req->MaxOutputResponse = cpu_to_le32(max_response_size);
+- req->sync_hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(max_response_size, SMB2_MAX_BUFFER_SIZE));
++ req->sync_hdr.CreditCharge =
++ cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size),
++ SMB2_MAX_BUFFER_SIZE));
+ if (is_fsctl)
+ req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
+ else
--- /dev/null
+From e80ddeb2f70ebd0786aa7cdba3e58bc931fa0bb5 Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Wed, 3 Jun 2020 01:33:58 -0500
+Subject: smb3: fix incorrect number of credits when ioctl MaxOutputResponse > 64K
+
+From: Steve French <stfrench@microsoft.com>
+
+commit e80ddeb2f70ebd0786aa7cdba3e58bc931fa0bb5 upstream.
+
+We were not checking to see if ioctl requests asked for more than
+64K (ie when CIFSMaxBufSize was > 64K) so when setting larger
+CIFSMaxBufSize then ioctls would fail with invalid parameter errors.
+When requests ask for more than 64K in MaxOutputResponse then we
+need to ask for more than 1 credit.
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2pdu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2922,7 +2922,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon,
+ * response size smaller.
+ */
+ req->MaxOutputResponse = cpu_to_le32(max_response_size);
+-
++ req->sync_hdr.CreditCharge = cpu_to_le16(DIV_ROUND_UP(max_response_size, SMB2_MAX_BUFFER_SIZE));
+ if (is_fsctl)
+ req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
+ else
--- /dev/null
+From 7866c177a03b18be3d83175014c643546e5b53c6 Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Tue, 9 Jun 2020 19:50:40 -0500
+Subject: smb3: fix typo in mount options displayed in /proc/mounts
+
+From: Steve French <stfrench@microsoft.com>
+
+commit 7866c177a03b18be3d83175014c643546e5b53c6 upstream.
+
+Missing the final 's' in "max_channels" mount option when displayed in
+/proc/mounts (or by mount command)
+
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Shyam Prasad N <nspmangalore@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifsfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -621,7 +621,7 @@ cifs_show_options(struct seq_file *s, st
+ seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
+
+ if (tcon->ses->chan_max > 1)
+- seq_printf(s, ",multichannel,max_channel=%zu",
++ seq_printf(s, ",multichannel,max_channels=%zu",
+ tcon->ses->chan_max);
+
+ return 0;
--- /dev/null
+From 0392727c261bab65a35cd4f82ee9459bc237591d Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 20 Apr 2020 15:08:45 -0400
+Subject: spi: bcm-qspi: Handle clock probe deferral
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 0392727c261bab65a35cd4f82ee9459bc237591d upstream.
+
+The clock provider may not be ready by the time spi-bcm-qspi gets
+probed, handle probe deferral using devm_clk_get_optional().
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200420190853.45614-2-kdasu.kdev@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm-qspi.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1222,6 +1222,11 @@ int bcm_qspi_probe(struct platform_devic
+ }
+
+ qspi = spi_master_get_devdata(master);
++
++ qspi->clk = devm_clk_get_optional(&pdev->dev, NULL);
++ if (IS_ERR(qspi->clk))
++ return PTR_ERR(qspi->clk);
++
+ qspi->pdev = pdev;
+ qspi->trans_pos.trans = NULL;
+ qspi->trans_pos.byte = 0;
+@@ -1335,13 +1340,6 @@ int bcm_qspi_probe(struct platform_devic
+ qspi->soc_intc = NULL;
+ }
+
+- qspi->clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(qspi->clk)) {
+- dev_warn(dev, "unable to get clock\n");
+- ret = PTR_ERR(qspi->clk);
+- goto qspi_probe_err;
+- }
+-
+ ret = clk_prepare_enable(qspi->clk);
+ if (ret) {
+ dev_err(dev, "failed to prepare clock\n");
--- /dev/null
+From 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c Mon Sep 17 00:00:00 2001
+From: Justin Chen <justinpopo6@gmail.com>
+Date: Mon, 20 Apr 2020 15:08:49 -0400
+Subject: spi: bcm-qspi: when tx/rx buffer is NULL set to 0
+
+From: Justin Chen <justinpopo6@gmail.com>
+
+commit 4df3bea7f9d2ddd9ac2c29ba945c7c4db2def29c upstream.
+
+Currently we set the tx/rx buffer to 0xff when NULL. This causes
+problems with some spi slaves where 0xff is a valid command. Looking
+at other drivers, the tx/rx buffer is usually set to 0x00 when NULL.
+Following this convention solves the issue.
+
+Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver")
+Signed-off-by: Justin Chen <justinpopo6@gmail.com>
+Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200420190853.45614-6-kdasu.kdev@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm-qspi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -670,7 +670,7 @@ static void read_from_hw(struct bcm_qspi
+ if (buf)
+ buf[tp.byte] = read_rxram_slot_u8(qspi, slot);
+ dev_dbg(&qspi->pdev->dev, "RD %02x\n",
+- buf ? buf[tp.byte] : 0xff);
++ buf ? buf[tp.byte] : 0x0);
+ } else {
+ u16 *buf = tp.trans->rx_buf;
+
+@@ -678,7 +678,7 @@ static void read_from_hw(struct bcm_qspi
+ buf[tp.byte / 2] = read_rxram_slot_u16(qspi,
+ slot);
+ dev_dbg(&qspi->pdev->dev, "RD %04x\n",
+- buf ? buf[tp.byte] : 0xffff);
++ buf ? buf[tp.byte / 2] : 0x0);
+ }
+
+ update_qspi_trans_byte_count(qspi, &tp,
+@@ -733,13 +733,13 @@ static int write_to_hw(struct bcm_qspi *
+ while (!tstatus && slot < MSPI_NUM_CDRAM) {
+ if (tp.trans->bits_per_word <= 8) {
+ const u8 *buf = tp.trans->tx_buf;
+- u8 val = buf ? buf[tp.byte] : 0xff;
++ u8 val = buf ? buf[tp.byte] : 0x00;
+
+ write_txram_slot_u8(qspi, slot, val);
+ dev_dbg(&qspi->pdev->dev, "WR %02x\n", val);
+ } else {
+ const u16 *buf = tp.trans->tx_buf;
+- u16 val = buf ? buf[tp.byte / 2] : 0xffff;
++ u16 val = buf ? buf[tp.byte / 2] : 0x0000;
+
+ write_txram_slot_u16(qspi, slot, val);
+ dev_dbg(&qspi->pdev->dev, "WR %04x\n", val);
--- /dev/null
+From 9dd277ff92d06f6aa95b39936ad83981d781f49b Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Fri, 15 May 2020 17:58:02 +0200
+Subject: spi: bcm2835: Fix controller unregister order
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 9dd277ff92d06f6aa95b39936ad83981d781f49b upstream.
+
+The BCM2835 SPI driver uses devm_spi_register_controller() on bind.
+As a consequence, on unbind, __device_release_driver() first invokes
+bcm2835_spi_remove() before unregistering the SPI controller via
+devres_release_all().
+
+This order is incorrect: bcm2835_spi_remove() tears down the DMA
+channels and turns off the SPI controller, including its interrupts
+and clock. The SPI controller is thus no longer usable.
+
+When the SPI controller is subsequently unregistered, it unbinds all
+its slave devices. If their drivers need to access the SPI bus,
+e.g. to quiesce their interrupts, unbinding will fail.
+
+As a rule, devm_spi_register_controller() must not be used if the
+->remove() hook performs teardown steps which shall be performed
+after unbinding of slaves.
+
+Fix by using the non-devm variant spi_register_controller(). Note that
+the struct spi_controller as well as the driver-private data are not
+freed until after bcm2835_spi_remove() has finished, so accessing them
+is safe.
+
+Fixes: 247263dba208 ("spi: bcm2835: use devm_spi_register_master()")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v3.13+
+Link: https://lore.kernel.org/r/2397dd70cdbe95e0bc4da2b9fca0f31cb94e5aed.1589557526.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm2835.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -1347,7 +1347,7 @@ static int bcm2835_spi_probe(struct plat
+ goto out_dma_release;
+ }
+
+- err = devm_spi_register_controller(&pdev->dev, ctlr);
++ err = spi_register_controller(ctlr);
+ if (err) {
+ dev_err(&pdev->dev, "could not register SPI controller: %d\n",
+ err);
+@@ -1374,6 +1374,8 @@ static int bcm2835_spi_remove(struct pla
+
+ bcm2835_debugfs_remove(bs);
+
++ spi_unregister_controller(ctlr);
++
+ /* Clear FIFOs, and disable the HW block */
+ bcm2835_wr(bs, BCM2835_SPI_CS,
+ BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX);
--- /dev/null
+From b9dd3f6d417258ad0beeb292a1bc74200149f15d Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Fri, 15 May 2020 17:58:03 +0200
+Subject: spi: bcm2835aux: Fix controller unregister order
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit b9dd3f6d417258ad0beeb292a1bc74200149f15d upstream.
+
+The BCM2835aux SPI driver uses devm_spi_register_master() on bind.
+As a consequence, on unbind, __device_release_driver() first invokes
+bcm2835aux_spi_remove() before unregistering the SPI controller via
+devres_release_all().
+
+This order is incorrect: bcm2835aux_spi_remove() turns off the SPI
+controller, including its interrupts and clock. The SPI controller
+is thus no longer usable.
+
+When the SPI controller is subsequently unregistered, it unbinds all
+its slave devices. If their drivers need to access the SPI bus,
+e.g. to quiesce their interrupts, unbinding will fail.
+
+As a rule, devm_spi_register_master() must not be used if the
+->remove() hook performs teardown steps which shall be performed
+after unbinding of slaves.
+
+Fix by using the non-devm variant spi_register_master(). Note that the
+struct spi_master as well as the driver-private data are not freed until
+after bcm2835aux_spi_remove() has finished, so accessing them is safe.
+
+Fixes: 1ea29b39f4c8 ("spi: bcm2835aux: add bcm2835 auxiliary spi device driver")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v4.4+
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Link: https://lore.kernel.org/r/32f27f4d8242e4d75f9a53f7e8f1f77483b08669.1589557526.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-bcm2835aux.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -569,7 +569,7 @@ static int bcm2835aux_spi_probe(struct p
+ goto out_clk_disable;
+ }
+
+- err = devm_spi_register_master(&pdev->dev, master);
++ err = spi_register_master(master);
+ if (err) {
+ dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+ goto out_clk_disable;
+@@ -593,6 +593,8 @@ static int bcm2835aux_spi_remove(struct
+
+ bcm2835aux_debugfs_remove(bs);
+
++ spi_unregister_master(master);
++
+ bcm2835aux_spi_reset_hw(bs);
+
+ /* disable the HW block by releasing the clock */
--- /dev/null
+From ca8b19d61e3fce5d2d7790cde27a0b57bcb3f341 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Mon, 25 May 2020 14:25:01 +0200
+Subject: spi: dw: Fix controller unregister order
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit ca8b19d61e3fce5d2d7790cde27a0b57bcb3f341 upstream.
+
+The Designware SPI driver uses devm_spi_register_controller() on bind.
+As a consequence, on unbind, __device_release_driver() first invokes
+dw_spi_remove_host() before unregistering the SPI controller via
+devres_release_all().
+
+This order is incorrect: dw_spi_remove_host() shuts down the chip,
+rendering the SPI bus inaccessible even though the SPI controller is
+still registered. When the SPI controller is subsequently unregistered,
+it unbinds all its slave devices. Because their drivers cannot access
+the SPI bus, e.g. to quiesce interrupts, the slave devices may be left
+in an improper state.
+
+As a rule, devm_spi_register_controller() must not be used if the
+->remove() hook performs teardown steps which shall be performed after
+unregistering the controller and specifically after unbinding of slaves.
+
+Fix by reverting to the non-devm variant of spi_register_controller().
+
+An alternative approach would be to use device-managed functions for all
+steps in dw_spi_remove_host(), e.g. by calling devm_add_action_or_reset()
+on probe. However that approach would add more LoC to the driver and
+it wouldn't lend itself as well to backporting to stable.
+
+Fixes: 04f421e7b0b1 ("spi: dw: use managed resources")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org # v3.14+
+Cc: Baruch Siach <baruch@tkos.co.il>
+Link: https://lore.kernel.org/r/3fff8cb8ae44a9893840d0688be15bb88c090a14.1590408496.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-dw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -534,7 +534,7 @@ int dw_spi_add_host(struct device *dev,
+ }
+ }
+
+- ret = devm_spi_register_controller(dev, master);
++ ret = spi_register_controller(master);
+ if (ret) {
+ dev_err(&master->dev, "problem registering spi master\n");
+ goto err_dma_exit;
+@@ -558,6 +558,8 @@ void dw_spi_remove_host(struct dw_spi *d
+ {
+ dw_spi_debugfs_remove(dws);
+
++ spi_unregister_controller(dws->master);
++
+ if (dws->dma_ops && dws->dma_ops->dma_exit)
+ dws->dma_ops->dma_exit(dws);
+
--- /dev/null
+From 84855678add8aba927faf76bc2f130a40f94b6f7 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Fri, 15 May 2020 17:58:01 +0200
+Subject: spi: Fix controller unregister order
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 84855678add8aba927faf76bc2f130a40f94b6f7 upstream.
+
+When an SPI controller unregisters, it unbinds all its slave devices.
+For this, their drivers may need to access the SPI bus, e.g. to quiesce
+interrupts.
+
+However since commit ffbbdd21329f ("spi: create a message queueing
+infrastructure"), spi_destroy_queue() is executed before unbinding the
+slaves. It sets ctlr->running = false, thereby preventing SPI bus
+access and causing unbinding of slave devices to fail.
+
+Fix by unbinding slaves before calling spi_destroy_queue().
+
+Fixes: ffbbdd21329f ("spi: create a message queueing infrastructure")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v3.4+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/8aaf9d44c153fe233b17bc2dec4eb679898d7e7b.1589557526.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2760,6 +2760,8 @@ void spi_unregister_controller(struct sp
+ struct spi_controller *found;
+ int id = ctlr->bus_num;
+
++ device_for_each_child(&ctlr->dev, NULL, __unregister);
++
+ /* First make sure that this controller was ever added */
+ mutex_lock(&board_lock);
+ found = idr_find(&spi_master_idr, id);
+@@ -2772,7 +2774,6 @@ void spi_unregister_controller(struct sp
+ list_del(&ctlr->list);
+ mutex_unlock(&board_lock);
+
+- device_for_each_child(&ctlr->dev, NULL, __unregister);
+ device_unregister(&ctlr->dev);
+ /* free bus id */
+ mutex_lock(&board_lock);
--- /dev/null
+From 32e5b57232c0411e7dea96625c415510430ac079 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Mon, 25 May 2020 14:25:02 +0200
+Subject: spi: pxa2xx: Fix controller unregister order
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 32e5b57232c0411e7dea96625c415510430ac079 upstream.
+
+The PXA2xx SPI driver uses devm_spi_register_controller() on bind.
+As a consequence, on unbind, __device_release_driver() first invokes
+pxa2xx_spi_remove() before unregistering the SPI controller via
+devres_release_all().
+
+This order is incorrect: pxa2xx_spi_remove() disables the chip,
+rendering the SPI bus inaccessible even though the SPI controller is
+still registered. When the SPI controller is subsequently unregistered,
+it unbinds all its slave devices. Because their drivers cannot access
+the SPI bus, e.g. to quiesce interrupts, the slave devices may be left
+in an improper state.
+
+As a rule, devm_spi_register_controller() must not be used if the
+->remove() hook performs teardown steps which shall be performed after
+unregistering the controller and specifically after unbinding of slaves.
+
+Fix by reverting to the non-devm variant of spi_register_controller().
+
+An alternative approach would be to use device-managed functions for all
+steps in pxa2xx_spi_remove(), e.g. by calling devm_add_action_or_reset()
+on probe. However that approach would add more LoC to the driver and
+it wouldn't lend itself as well to backporting to stable.
+
+The improper use of devm_spi_register_controller() was introduced in 2013
+by commit a807fcd090d6 ("spi: pxa2xx: use devm_spi_register_master()"),
+but all earlier versions of the driver going back to 2006 were likewise
+broken because they invoked spi_unregister_master() at the end of
+pxa2xx_spi_remove(), rather than at the beginning.
+
+Fixes: e0c9905e87ac ("[PATCH] SPI: add PXA2xx SSP SPI Driver")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org # v2.6.17+
+Cc: Tsuchiya Yuto <kitakar@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206403#c1
+Link: https://lore.kernel.org/r/834c446b1cf3284d2660f1bee1ebe3e737cd02a9.1590408496.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-pxa2xx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1884,7 +1884,7 @@ static int pxa2xx_spi_probe(struct platf
+
+ /* Register with the SPI framework */
+ platform_set_drvdata(pdev, drv_data);
+- status = devm_spi_register_controller(&pdev->dev, controller);
++ status = spi_register_controller(controller);
+ if (status != 0) {
+ dev_err(&pdev->dev, "problem registering spi controller\n");
+ goto out_error_pm_runtime_enabled;
+@@ -1916,6 +1916,8 @@ static int pxa2xx_spi_remove(struct plat
+
+ pm_runtime_get_sync(&pdev->dev);
+
++ spi_unregister_controller(drv_data->controller);
++
+ /* Disable the SSP at the peripheral and SOC level */
+ pxa2xx_spi_write(drv_data, SSCR0, 0);
+ clk_disable_unprepare(ssp->clk);
--- /dev/null
+From 65e318e17358a3fd4fcb5a69d89b14016dee2f06 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Mon, 25 May 2020 14:25:03 +0200
+Subject: spi: pxa2xx: Fix runtime PM ref imbalance on probe error
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit 65e318e17358a3fd4fcb5a69d89b14016dee2f06 upstream.
+
+The PXA2xx SPI driver releases a runtime PM ref in the probe error path
+even though it hasn't acquired a ref earlier.
+
+Apparently commit e2b714afee32 ("spi: pxa2xx: Disable runtime PM if
+controller registration fails") sought to copy-paste the invocation of
+pm_runtime_disable() from pxa2xx_spi_remove(), but erroneously copied
+the call to pm_runtime_put_noidle() as well. Drop it.
+
+Fixes: e2b714afee32 ("spi: pxa2xx: Disable runtime PM if controller registration fails")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org # v4.17+
+Cc: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/58b2ac6942ca1f91aaeeafe512144bc5343e1d84.1590408496.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-pxa2xx.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1893,7 +1893,6 @@ static int pxa2xx_spi_probe(struct platf
+ return status;
+
+ out_error_pm_runtime_enabled:
+- pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+
+ out_error_clock_enabled:
--- /dev/null
+From e56d48e92b1017b6a8dbe64923a889283733fd96 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@gmail.com>
+Date: Sun, 12 Apr 2020 20:01:22 -0300
+Subject: watchdog: imx_sc_wdt: Fix reboot on crash
+
+From: Fabio Estevam <festevam@gmail.com>
+
+commit e56d48e92b1017b6a8dbe64923a889283733fd96 upstream.
+
+Currently when running the samples/watchdog/watchdog-simple.c
+application and forcing a kernel crash by doing:
+
+# ./watchdog-simple &
+# echo c > /proc/sysrq-trigger
+
+The system does not reboot as expected.
+
+Fix it by calling imx_sc_wdt_set_timeout() to configure the i.MX8QXP
+watchdog with a proper timeout.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 986857acbc9a ("watchdog: imx_sc: Add i.MX system controller watchdog support")
+Reported-by: Breno Lima <breno.lima@nxp.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: Breno Lima <breno.lima@nxp.com>
+Link: https://lore.kernel.org/r/20200412230122.5601-1-festevam@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/imx_sc_wdt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/watchdog/imx_sc_wdt.c
++++ b/drivers/watchdog/imx_sc_wdt.c
+@@ -175,6 +175,11 @@ static int imx_sc_wdt_probe(struct platf
+ wdog->timeout = DEFAULT_TIMEOUT;
+
+ watchdog_init_timeout(wdog, 0, dev);
++
++ ret = imx_sc_wdt_set_timeout(wdog, wdog->timeout);
++ if (ret)
++ return ret;
++
+ watchdog_stop_on_reboot(wdog);
+ watchdog_stop_on_unregister(wdog);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
