--- /dev/null
+From bfc913682464f45bc4d6044084e370f9048de9d5 Mon Sep 17 00:00:00 2001
+From: Meelis Roos <mroos@linux.ee>
+Date: Fri, 12 Oct 2018 12:27:51 +0300
+Subject: alpha: Fix Eiger NR_IRQS to 128
+
+From: Meelis Roos <mroos@linux.ee>
+
+commit bfc913682464f45bc4d6044084e370f9048de9d5 upstream.
+
+Eiger machine vector definition has nr_irqs 128, and working 2.6.26
+boot shows SCSI getting IRQ-s 64 and 65. Current kernel boot fails
+because Symbios SCSI fails to request IRQ-s and does not find the disks.
+It has been broken at least since 3.18 - the earliest I could test with
+my gcc-5.
+
+The headers have moved around and possibly another order of defines has
+worked in the past - but since 128 seems to be correct and used, fix
+arch/alpha/include/asm/irq.h to have NR_IRQS=128 for Eiger.
+
+This fixes 4.19-rc7 boot on my Force Flexor A264 (Eiger subarch).
+
+Cc: stable@vger.kernel.org # v3.18+
+Signed-off-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Matt Turner <mattst88@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/alpha/include/asm/irq.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/alpha/include/asm/irq.h
++++ b/arch/alpha/include/asm/irq.h
+@@ -56,15 +56,15 @@
+
+ #elif defined(CONFIG_ALPHA_DP264) || \
+ defined(CONFIG_ALPHA_LYNX) || \
+- defined(CONFIG_ALPHA_SHARK) || \
+- defined(CONFIG_ALPHA_EIGER)
++ defined(CONFIG_ALPHA_SHARK)
+ # define NR_IRQS 64
+
+ #elif defined(CONFIG_ALPHA_TITAN)
+ #define NR_IRQS 80
+
+ #elif defined(CONFIG_ALPHA_RAWHIDE) || \
+- defined(CONFIG_ALPHA_TAKARA)
++ defined(CONFIG_ALPHA_TAKARA) || \
++ defined(CONFIG_ALPHA_EIGER)
+ # define NR_IRQS 128
+
+ #elif defined(CONFIG_ALPHA_WILDFIRE)
--- /dev/null
+From 491af60ffb848b59e82f7c9145833222e0bf27a5 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyfox@gentoo.org>
+Date: Mon, 31 Dec 2018 11:53:55 +0000
+Subject: alpha: fix page fault handling for r16-r18 targets
+
+From: Sergei Trofimovich <slyfox@gentoo.org>
+
+commit 491af60ffb848b59e82f7c9145833222e0bf27a5 upstream.
+
+Fix page fault handling code to fixup r16-r18 registers.
+Before the patch code had off-by-two registers bug.
+This bug caused overwriting of ps,pc,gp registers instead
+of fixing intended r16,r17,r18 (see `struct pt_regs`).
+
+More details:
+
+Initially Dmitry noticed a kernel bug as a failure
+on strace test suite. Test passes unmapped userspace
+pointer to io_submit:
+
+```c
+ #include <err.h>
+ #include <unistd.h>
+ #include <sys/mman.h>
+ #include <asm/unistd.h>
+ int main(void)
+ {
+ unsigned long ctx = 0;
+ if (syscall(__NR_io_setup, 1, &ctx))
+ err(1, "io_setup");
+ const size_t page_size = sysconf(_SC_PAGESIZE);
+ const size_t size = page_size * 2;
+ void *ptr = mmap(NULL, size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (MAP_FAILED == ptr)
+ err(1, "mmap(%zu)", size);
+ if (munmap(ptr, size))
+ err(1, "munmap");
+ syscall(__NR_io_submit, ctx, 1, ptr + page_size);
+ syscall(__NR_io_destroy, ctx);
+ return 0;
+ }
+```
+
+Running this test causes kernel to crash when handling page fault:
+
+```
+ Unable to handle kernel paging request at virtual address ffffffffffff9468
+ CPU 3
+ aio(26027): Oops 0
+ pc = [<fffffc00004eddf8>] ra = [<fffffc00004edd5c>] ps = 0000 Not tainted
+ pc is at sys_io_submit+0x108/0x200
+ ra is at sys_io_submit+0x6c/0x200
+ v0 = fffffc00c58e6300 t0 = fffffffffffffff2 t1 = 000002000025e000
+ t2 = fffffc01f159fef8 t3 = fffffc0001009640 t4 = fffffc0000e0f6e0
+ t5 = 0000020001002e9e t6 = 4c41564e49452031 t7 = fffffc01f159c000
+ s0 = 0000000000000002 s1 = 000002000025e000 s2 = 0000000000000000
+ s3 = 0000000000000000 s4 = 0000000000000000 s5 = fffffffffffffff2
+ s6 = fffffc00c58e6300
+ a0 = fffffc00c58e6300 a1 = 0000000000000000 a2 = 000002000025e000
+ a3 = 00000200001ac260 a4 = 00000200001ac1e8 a5 = 0000000000000001
+ t8 = 0000000000000008 t9 = 000000011f8bce30 t10= 00000200001ac440
+ t11= 0000000000000000 pv = fffffc00006fd320 at = 0000000000000000
+ gp = 0000000000000000 sp = 00000000265fd174
+ Disabling lock debugging due to kernel taint
+ Trace:
+ [<fffffc0000311404>] entSys+0xa4/0xc0
+```
+
+Here `gp` has invalid value. `gp is s overwritten by a fixup for the
+following page fault handler in `io_submit` syscall handler:
+
+```
+ __se_sys_io_submit
+ ...
+ ldq a1,0(t1)
+ bne t0,4280 <__se_sys_io_submit+0x180>
+```
+
+After a page fault `t0` should contain -EFALUT and `a1` is 0.
+Instead `gp` was overwritten in place of `a1`.
+
+This happens due to a off-by-two bug in `dpf_reg()` for `r16-r18`
+(aka `a0-a2`).
+
+I think the bug went unnoticed for a long time as `gp` is one
+of scratch registers. Any kernel function call would re-calculate `gp`.
+
+Dmitry tracked down the bug origin back to 2.1.32 kernel version
+where trap_a{0,1,2} fields were inserted into struct pt_regs.
+And even before that `dpf_reg()` contained off-by-one error.
+
+Cc: Richard Henderson <rth@twiddle.net>
+Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Cc: linux-alpha@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reported-and-reviewed-by: "Dmitry V. Levin" <ldv@altlinux.org>
+Cc: stable@vger.kernel.org # v2.1.32+
+Bug: https://bugs.gentoo.org/672040
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+Signed-off-by: Matt Turner <mattst88@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/alpha/mm/fault.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/alpha/mm/fault.c
++++ b/arch/alpha/mm/fault.c
+@@ -78,7 +78,7 @@ __load_new_mm_context(struct mm_struct *
+ /* Macro for exception fixup code to access integer registers. */
+ #define dpf_reg(r) \
+ (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \
+- (r) <= 18 ? (r)+8 : (r)-10])
++ (r) <= 18 ? (r)+10 : (r)-10])
+
+ asmlinkage void
+ do_page_fault(unsigned long address, unsigned long mmcsr,
--- /dev/null
+From 4cd3016ce996494f78fdfd87ea35c8ca5d0b413e Mon Sep 17 00:00:00 2001
+From: Jurica Vukadin <jurica.vukadin@rt-rk.com>
+Date: Thu, 7 Feb 2019 16:29:37 +0100
+Subject: ALSA: hda - Add quirk for HP EliteBook 840 G5
+
+From: Jurica Vukadin <jurica.vukadin@rt-rk.com>
+
+commit 4cd3016ce996494f78fdfd87ea35c8ca5d0b413e upstream.
+
+This enables mute LED support and fixes switching jacks when the laptop
+is docked.
+
+Signed-off-by: Jurica Vukadin <jurica.vukadin@rt-rk.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -924,6 +924,7 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x83b2, "HP EliteBook 840 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
--- /dev/null
+From 00a399cad1a063e7665f06b6497a807db20441fd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 6 Feb 2019 07:30:44 +0100
+Subject: ALSA: pcm: Revert capture stream behavior change in blocking mode
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 00a399cad1a063e7665f06b6497a807db20441fd upstream.
+
+In the commit 62ba568f7aef ("ALSA: pcm: Return 0 when size <
+start_threshold in capture"), we changed the behavior of
+__snd_pcm_lib_xfer() to return immediately with 0 when a capture
+stream has a high start_threshold. This was intended to be a
+correction of the behavior consistency and looked harmless, but this
+was the culprit of the recent breakage reported by syzkaller, which
+was fixed by the commit e190161f96b8 ("ALSA: pcm: Fix tight loop of
+OSS capture stream").
+
+At the time for the OSS fix, I didn't touch the behavior for ALSA
+native API, as assuming that this behavior actually is good. But this
+turned out to be also broken actually for a similar deployment,
+e.g. one thread goes to a write loop in blocking mode while another
+thread controls the start/stop of the stream manually.
+
+Overall, the original commit is harmful, and it brings less merit to
+keep that behavior. Let's revert it.
+
+Fixes: 62ba568f7aef ("ALSA: pcm: Return 0 when size < start_threshold in capture")
+Fixes: e190161f96b8 ("ALSA: pcm: Fix tight loop of OSS capture stream")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_lib.c | 20 ++++----------------
+ 1 file changed, 4 insertions(+), 16 deletions(-)
+
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2112,13 +2112,6 @@ int pcm_lib_apply_appl_ptr(struct snd_pc
+ return 0;
+ }
+
+-/* allow waiting for a capture stream that hasn't been started */
+-#if IS_ENABLED(CONFIG_SND_PCM_OSS)
+-#define wait_capture_start(substream) ((substream)->oss.oss)
+-#else
+-#define wait_capture_start(substream) false
+-#endif
+-
+ /* the common loop for read/write data */
+ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ void *data, bool interleaved,
+@@ -2184,16 +2177,11 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(str
+ snd_pcm_update_hw_ptr(substream);
+
+ if (!is_playback &&
+- runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
+- if (size >= runtime->start_threshold) {
+- err = snd_pcm_start(substream);
+- if (err < 0)
+- goto _end_unlock;
+- } else if (!wait_capture_start(substream)) {
+- /* nothing to do */
+- err = 0;
++ runtime->status->state == SNDRV_PCM_STATE_PREPARED &&
++ size >= runtime->start_threshold) {
++ err = snd_pcm_start(substream);
++ if (err < 0)
+ goto _end_unlock;
+- }
+ }
+
+ avail = snd_pcm_avail(substream);
--- /dev/null
+From 2bc16b9f3223d049b57202ee702fcb5b9b507019 Mon Sep 17 00:00:00 2001
+From: Manuel Reinhardt <manuel.rhdt@gmail.com>
+Date: Thu, 31 Jan 2019 15:32:35 +0100
+Subject: ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
+
+From: Manuel Reinhardt <manuel.rhdt@gmail.com>
+
+commit 2bc16b9f3223d049b57202ee702fcb5b9b507019 upstream.
+
+The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to
+separate function") introduced an error in the handling of quirks for
+implicit feedback endpoints. This commit fixes this.
+
+If a quirk successfully sets up an implicit feedback endpoint, usb-audio
+no longer tries to find the implicit fb endpoint itself.
+
+Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function")
+Signed-off-by: Manuel Reinhardt <manuel.rhdt@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -314,6 +314,9 @@ static int search_roland_implicit_fb(str
+ return 0;
+ }
+
++/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk
++ * applies. Returns 1 if a quirk was found.
++ */
+ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ struct usb_device *dev,
+ struct usb_interface_descriptor *altsd,
+@@ -384,7 +387,7 @@ add_sync_ep:
+
+ subs->data_endpoint->sync_master = subs->sync_endpoint;
+
+- return 0;
++ return 1;
+ }
+
+ static int set_sync_endpoint(struct snd_usb_substream *subs,
+@@ -423,6 +426,10 @@ static int set_sync_endpoint(struct snd_
+ if (err < 0)
+ return err;
+
++ /* endpoint set by quirk */
++ if (err > 0)
++ return 0;
++
+ if (altsd->bNumEndpoints < 2)
+ return 0;
+
--- /dev/null
+From d0243693fbf6fbd48b4efb2ba7210765983b03e3 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 15 Jan 2019 10:09:38 -0800
+Subject: ARM: OMAP5+: Fix inverted nirq pin interrupts with irq_set_type
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit d0243693fbf6fbd48b4efb2ba7210765983b03e3 upstream.
+
+Commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of
+IRQ_TYPE_NONE") started warning about incorrect dts usage for irqs.
+ARM GIC only supports active-high interrupts for SPI (Shared Peripheral
+Interrupts), and the Palmas PMIC by default is active-low.
+
+Palmas PMIC allows changing the interrupt polarity using register
+PALMAS_POLARITY_CTRL_INT_POLARITY, but configuring sys_nirq1 with
+a pull-down and setting PALMAS_POLARITY_CTRL_INT_POLARITY made the
+Palmas RTC interrupts stop working. This can be easily tested with
+kernel tools rtctest.c.
+
+Turns out the SoC inverts the sys_nirq pins for GIC as they do not go
+through a peripheral device but go directly to the MPUSS wakeupgen.
+I've verified this by muxing the interrupt line temporarily to gpio_wk16
+instead of sys_nirq1. with a gpio, the interrupt works fine both
+active-low and active-high with the SoC internal pull configured and
+palmas polarity configured. But as sys_nirq1, the interrupt only works
+when configured ACTIVE_LOW for palmas, and ACTIVE_HIGH for GIC.
+
+Note that there was a similar issue earlier with tegra114 and palmas
+interrupt polarity that got fixed by commit df545d1cd01a ("mfd: palmas:
+Provide irq flags through DT/platform data"). However, the difference
+between omap5 and tegra114 is that tegra inverts the palmas interrupt
+twice, once when entering tegra PMC, and again when exiting tegra PMC
+to GIC.
+
+Let's fix the issue by adding a custom wakeupgen_irq_set_type() for
+wakeupgen and invert any interrupts with wrong polarity. Let's also
+warn about any non-sysnirq pins using wrong polarity. Note that we
+also need to update the dts for the level as IRQ_TYPE_NONE never
+has irq_set_type() called, and let's add some comments and use proper
+pin nameing to avoid more confusion later on.
+
+Cc: Belisko Marek <marek.belisko@gmail.com>
+Cc: Dmitry Lifshitz <lifshitz@compulab.co.il>
+Cc: "Dr. H. Nikolaus Schaller" <hns@goldelico.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Laxman Dewangan <ldewangan@nvidia.com>
+Cc: Nishanth Menon <nm@ti.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: Richard Woodruff <r-woodruff2@ti.com>
+Cc: Santosh Shilimkar <ssantosh@kernel.org>
+Cc: Tero Kristo <t-kristo@ti.com>
+Cc: Thierry Reding <treding@nvidia.com>
+Cc: stable@vger.kernel.org # v4.17+
+Reported-by: Belisko Marek <marek.belisko@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/omap5-board-common.dtsi | 9 +++++--
+ arch/arm/boot/dts/omap5-cm-t54.dts | 12 +++++++++-
+ arch/arm/mach-omap2/omap-wakeupgen.c | 36 +++++++++++++++++++++++++++++-
+ 3 files changed, 52 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -317,7 +317,8 @@
+
+ palmas_sys_nirq_pins: pinmux_palmas_sys_nirq_pins {
+ pinctrl-single,pins = <
+- OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0) /* sys_nirq1 */
++ /* sys_nirq1 is pulled down as the SoC is inverting it for GIC */
++ OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0)
+ >;
+ };
+
+@@ -385,7 +386,8 @@
+
+ palmas: palmas@48 {
+ compatible = "ti,palmas";
+- interrupts = <GIC_SPI 7 IRQ_TYPE_NONE>; /* IRQ_SYS_1N */
++ /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
++ interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x48>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+@@ -651,7 +653,8 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&twl6040_pins>;
+
+- interrupts = <GIC_SPI 119 IRQ_TYPE_NONE>; /* IRQ_SYS_2N cascaded to gic */
++ /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
++ interrupts = <GIC_SPI 119 IRQ_TYPE_LEVEL_LOW>;
+
+ /* audpwron gpio defined in the board specific dts */
+
+--- a/arch/arm/boot/dts/omap5-cm-t54.dts
++++ b/arch/arm/boot/dts/omap5-cm-t54.dts
+@@ -181,6 +181,13 @@
+ OMAP5_IOPAD(0x0042, PIN_INPUT_PULLDOWN | MUX_MODE6) /* llib_wakereqin.gpio1_wk15 */
+ >;
+ };
++
++ palmas_sys_nirq_pins: pinmux_palmas_sys_nirq_pins {
++ pinctrl-single,pins = <
++ /* sys_nirq1 is pulled down as the SoC is inverting it for GIC */
++ OMAP5_IOPAD(0x068, PIN_INPUT_PULLUP | MUX_MODE0)
++ >;
++ };
+ };
+
+ &omap5_pmx_core {
+@@ -414,8 +421,11 @@
+
+ palmas: palmas@48 {
+ compatible = "ti,palmas";
+- interrupts = <GIC_SPI 7 IRQ_TYPE_NONE>; /* IRQ_SYS_1N */
+ reg = <0x48>;
++ pinctrl-0 = <&palmas_sys_nirq_pins>;
++ pinctrl-names = "default";
++ /* sys_nirq/ext_sys_irq pins get inverted at mpuss wakeupgen */
++ interrupts = <GIC_SPI 7 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+ #interrupt-cells = <2>;
+ ti,system-power-controller;
+--- a/arch/arm/mach-omap2/omap-wakeupgen.c
++++ b/arch/arm/mach-omap2/omap-wakeupgen.c
+@@ -50,6 +50,9 @@
+ #define OMAP4_NR_BANKS 4
+ #define OMAP4_NR_IRQS 128
+
++#define SYS_NIRQ1_EXT_SYS_IRQ_1 7
++#define SYS_NIRQ2_EXT_SYS_IRQ_2 119
++
+ static void __iomem *wakeupgen_base;
+ static void __iomem *sar_base;
+ static DEFINE_RAW_SPINLOCK(wakeupgen_lock);
+@@ -153,6 +156,37 @@ static void wakeupgen_unmask(struct irq_
+ irq_chip_unmask_parent(d);
+ }
+
++/*
++ * The sys_nirq pins bypass peripheral modules and are wired directly
++ * to MPUSS wakeupgen. They get automatically inverted for GIC.
++ */
++static int wakeupgen_irq_set_type(struct irq_data *d, unsigned int type)
++{
++ bool inverted = false;
++
++ switch (type) {
++ case IRQ_TYPE_LEVEL_LOW:
++ type &= ~IRQ_TYPE_LEVEL_MASK;
++ type |= IRQ_TYPE_LEVEL_HIGH;
++ inverted = true;
++ break;
++ case IRQ_TYPE_EDGE_FALLING:
++ type &= ~IRQ_TYPE_EDGE_BOTH;
++ type |= IRQ_TYPE_EDGE_RISING;
++ inverted = true;
++ break;
++ default:
++ break;
++ }
++
++ if (inverted && d->hwirq != SYS_NIRQ1_EXT_SYS_IRQ_1 &&
++ d->hwirq != SYS_NIRQ2_EXT_SYS_IRQ_2)
++ pr_warn("wakeupgen: irq%li polarity inverted in dts\n",
++ d->hwirq);
++
++ return irq_chip_set_type_parent(d, type);
++}
++
+ #ifdef CONFIG_HOTPLUG_CPU
+ static DEFINE_PER_CPU(u32 [MAX_NR_REG_BANKS], irqmasks);
+
+@@ -446,7 +480,7 @@ static struct irq_chip wakeupgen_chip =
+ .irq_mask = wakeupgen_mask,
+ .irq_unmask = wakeupgen_unmask,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+- .irq_set_type = irq_chip_set_type_parent,
++ .irq_set_type = wakeupgen_irq_set_type,
+ .flags = IRQCHIP_SKIP_SET_WAKE | IRQCHIP_MASK_ON_SUSPEND,
+ #ifdef CONFIG_SMP
+ .irq_set_affinity = irq_chip_set_affinity_parent,
--- /dev/null
+From 26e2d7b03ea7ff254bf78305aa44dda62e70b78e Mon Sep 17 00:00:00 2001
+From: Dmitry Voytik <voytikd@gmail.com>
+Date: Tue, 22 Jan 2019 23:38:48 +0100
+Subject: arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64
+
+From: Dmitry Voytik <voytikd@gmail.com>
+
+commit 26e2d7b03ea7ff254bf78305aa44dda62e70b78e upstream.
+
+After commit ef05bcb60c1a, boot from USB drives is broken.
+Fix this problem by enabling usb-host regulators during boot time.
+
+Fixes: ef05bcb60c1a ("arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Voytik <voytikd@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -40,6 +40,7 @@
+ pinctrl-0 = <&usb30_host_drv>;
+ regulator-name = "vcc_host_5v";
+ regulator-always-on;
++ regulator-boot-on;
+ vin-supply = <&vcc_sys>;
+ };
+
+@@ -51,6 +52,7 @@
+ pinctrl-0 = <&usb20_host_drv>;
+ regulator-name = "vcc_host1_5v";
+ regulator-always-on;
++ regulator-boot-on;
+ vin-supply = <&vcc_sys>;
+ };
+
--- /dev/null
+From 0ce23d6d42147a692768e6baaaa3db75c44f4235 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 17 Jan 2019 17:32:05 +0000
+Subject: ASoC: hdmi-codec: fix oops on re-probe
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 0ce23d6d42147a692768e6baaaa3db75c44f4235 upstream.
+
+hdmi-codec oopses the kernel when it is unbound from a successfully
+bound audio subsystem, and is then rebound:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000001c
+pgd = ee3f0000
+[0000001c] *pgd=3cc59831
+Internal error: Oops: 817 [#1] PREEMPT ARM
+Modules linked in: ext2 snd_soc_spdif_tx vmeta dove_thermal snd_soc_kirkwood ofpart marvell_cesa m25p80 orion_wdt mtd spi_nor des_generic gpio_ir_recv snd_soc_kirkwood_spdif bmm_dmabuf auth_rpcgss nfsd autofs4 etnaviv thermal_sys hwmon gpu_sched tda9950
+CPU: 0 PID: 1005 Comm: bash Not tainted 4.20.0+ #1762
+Hardware name: Marvell Dove (Cubox)
+PC is at hdmi_dai_probe+0x68/0x80
+LR is at find_held_lock+0x20/0x94
+pc : [<c04c7de0>] lr : [<c0063bf4>] psr: 600f0013
+sp : ee15bd28 ip : eebd8b1c fp : c093b488
+r10: ee048000 r9 : eebdab18 r8 : ee048600
+r7 : 00000001 r6 : 00000000 r5 : 00000000 r4 : ee82c100
+r3 : 00000006 r2 : 00000001 r1 : c067e38c r0 : ee82c100
+Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none[ 297.318599] Control: 10c5387d Table: 2e3f0019 DAC: 00000051
+Process bash (pid: 1005, stack limit = 0xee15a248)
+...
+[<c04c7de0>] (hdmi_dai_probe) from [<c04b7060>] (soc_probe_dai.part.9+0x34/0x70)
+[<c04b7060>] (soc_probe_dai.part.9) from [<c04b81a8>] (snd_soc_instantiate_card+0x734/0xc9c)
+[<c04b81a8>] (snd_soc_instantiate_card) from [<c04b8b6c>] (snd_soc_add_component+0x29c/0x378)
+[<c04b8b6c>] (snd_soc_add_component) from [<c04b8c8c>] (snd_soc_register_component+0x44/0x54)
+[<c04b8c8c>] (snd_soc_register_component) from [<c04c64b4>] (devm_snd_soc_register_component+0x48/0x84)
+[<c04c64b4>] (devm_snd_soc_register_component) from [<c04c7be8>] (hdmi_codec_probe+0x150/0x260)
+[<c04c7be8>] (hdmi_codec_probe) from [<c0373124>] (platform_drv_probe+0x48/0x98)
+
+This happens because hdmi_dai_probe() attempts to access the HDMI
+codec private data, but this has not been assigned by hdmi_dai_probe()
+before it calls devm_snd_soc_register_component(). Move the call to
+dev_set_drvdata() before devm_snd_soc_register_component() to avoid
+this oops.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/hdmi-codec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -795,6 +795,8 @@ static int hdmi_codec_probe(struct platf
+ if (hcd->spdif)
+ hcp->daidrv[i] = hdmi_spdif_dai;
+
++ dev_set_drvdata(dev, hcp);
++
+ ret = devm_snd_soc_register_component(dev, &hdmi_driver, hcp->daidrv,
+ dai_count);
+ if (ret) {
+@@ -802,8 +804,6 @@ static int hdmi_codec_probe(struct platf
+ __func__, ret);
+ return ret;
+ }
+-
+- dev_set_drvdata(dev, hcp);
+ return 0;
+ }
+
--- /dev/null
+From 90cc55f067f6ca0e64e5e52883ece47d8af7b67b Mon Sep 17 00:00:00 2001
+From: Jonathan Bakker <xc-racer2@live.ca>
+Date: Wed, 6 Feb 2019 10:45:37 -0800
+Subject: Input: bma150 - register input device after setting private data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream.
+
+Otherwise we introduce a race condition where userspace can request input
+before we're ready leading to null pointer dereference such as
+
+input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3
+Unable to handle kernel NULL pointer dereference at virtual address 00000018
+pgd = (ptrval)
+[00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000
+Internal error: Oops: 17 [#1] PREEMPT ARM
+Modules linked in: bma150 input_polldev [last unloaded: bma150]
+CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46
+Hardware name: Samsung S5PC110/S5PV210-based board
+PC is at input_event+0x8/0x60
+LR is at bma150_report_xyz+0x9c/0xe0 [bma150]
+pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013
+sp : a4c1fd78 ip : 00000081 fp : 00020000
+r10: 00000000 r9 : a5e2944c r8 : a7455000
+r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048
+r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000
+Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+Control: 10c5387d Table: 54e34019 DAC: 00000051
+Process accelerometer (pid: 2870, stack limit = 0x(ptrval))
+Stackck: (0xa4c1fd78 to 0xa4c20000)
+fd60: fffffff3 fc813f6c
+fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324
+fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10
+fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0
+fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c
+fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000
+fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041
+fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8
+fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001
+fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048
+fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8
+fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720
+fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00
+ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3
+ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002
+ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c
+ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100
+ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000
+ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000
+ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038
+ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000
+[<80450f70>] (input_event) from [<a5e2817c>] (0xa5e2817c)
+Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018)
+---[ end trace 1c691ee85f2ff243 ]---
+
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/misc/bma150.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/input/misc/bma150.c
++++ b/drivers/input/misc/bma150.c
+@@ -481,13 +481,14 @@ static int bma150_register_input_device(
+ idev->close = bma150_irq_close;
+ input_set_drvdata(idev, bma150);
+
++ bma150->input = idev;
++
+ error = input_register_device(idev);
+ if (error) {
+ input_free_device(idev);
+ return error;
+ }
+
+- bma150->input = idev;
+ return 0;
+ }
+
+@@ -510,15 +511,15 @@ static int bma150_register_polled_device
+
+ bma150_init_input_device(bma150, ipoll_dev->input);
+
++ bma150->input_polled = ipoll_dev;
++ bma150->input = ipoll_dev->input;
++
+ error = input_register_polled_device(ipoll_dev);
+ if (error) {
+ input_free_polled_device(ipoll_dev);
+ return error;
+ }
+
+- bma150->input_polled = ipoll_dev;
+- bma150->input = ipoll_dev->input;
+-
+ return 0;
+ }
+
--- /dev/null
+From 7ad222b3aed350adfc27ee7eec4587ffe55dfdce Mon Sep 17 00:00:00 2001
+From: Mauro Ciancio <mauro@acadeu.com>
+Date: Mon, 14 Jan 2019 10:24:53 -0300
+Subject: Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
+
+From: Mauro Ciancio <mauro@acadeu.com>
+
+commit 7ad222b3aed350adfc27ee7eec4587ffe55dfdce upstream.
+
+This adds ELAN0617 to the ACPI table to support Elan touchpad found in
+Lenovo V330-15ISK.
+
+Signed-off-by: Mauro Ciancio <mauro@acadeu.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elan_i2c_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1345,6 +1345,7 @@ static const struct acpi_device_id elan_
+ { "ELAN060C", 0 },
+ { "ELAN0611", 0 },
+ { "ELAN0612", 0 },
++ { "ELAN0617", 0 },
+ { "ELAN0618", 0 },
+ { "ELAN061C", 0 },
+ { "ELAN061D", 0 },
--- /dev/null
+From e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 Mon Sep 17 00:00:00 2001
+From: Matti Kurkela <Matti.Kurkela@iki.fi>
+Date: Thu, 7 Feb 2019 23:49:23 -0800
+Subject: Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
+
+From: Matti Kurkela <Matti.Kurkela@iki.fi>
+
+commit e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 upstream.
+
+Like Fujitsu CELSIUS H760, the H780 also has a three-button Elantech
+touchpad, but the driver needs to be told so to enable the middle touchpad
+button.
+
+The elantech_dmi_force_crc_enabled quirk was not necessary with the H780.
+
+Also document the fw_version and caps values detected for both H760 and
+H780 models.
+
+Signed-off-by: Matti Kurkela <Matti.Kurkela@iki.fi>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elantech.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1119,6 +1119,8 @@ static int elantech_get_resolution_v4(st
+ * Asus UX31 0x361f00 20, 15, 0e clickpad
+ * Asus UX32VD 0x361f02 00, 15, 0e clickpad
+ * Avatar AVIU-145A2 0x361f00 ? clickpad
++ * Fujitsu CELSIUS H760 0x570f02 40, 14, 0c 3 hw buttons (**)
++ * Fujitsu CELSIUS H780 0x5d0f02 41, 16, 0d 3 hw buttons (**)
+ * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons
+ * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons
+ * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons
+@@ -1171,6 +1173,13 @@ static const struct dmi_system_id elante
+ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"),
+ },
+ },
++ {
++ /* Fujitsu H780 also has a middle button */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"),
++ },
++ },
+ #endif
+ { }
+ };
--- /dev/null
+From 98ae70cc476e833332a2c6bb72f941a25f0de226 Mon Sep 17 00:00:00 2001
+From: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Date: Thu, 14 Feb 2019 12:08:58 +0800
+Subject: kvm: vmx: Fix entry number check for add_atomic_switch_msr()
+
+From: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+
+commit 98ae70cc476e833332a2c6bb72f941a25f0de226 upstream.
+
+Commit ca83b4a7f2d068da79a0 ("x86/KVM/VMX: Add find_msr() helper function")
+introduces the helper function find_msr(), which returns -ENOENT when
+not find the msr in vmx->msr_autoload.guest/host. Correct checking contion
+of no more available entry in vmx->msr_autoload.
+
+Fixes: ca83b4a7f2d0 ("x86/KVM/VMX: Add find_msr() helper function")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2779,7 +2779,8 @@ static void add_atomic_switch_msr(struct
+ if (!entry_only)
+ j = find_msr(&m->host, msr);
+
+- if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) {
++ if ((i < 0 && m->guest.nr == NR_AUTOLOAD_MSRS) ||
++ (j < 0 && m->host.nr == NR_AUTOLOAD_MSRS)) {
+ printk_once(KERN_WARNING "Not enough msr switch entries. "
+ "Can't add msr %x\n", msr);
+ return;
--- /dev/null
+From 27dd768ed8db48beefc4d9e006c58e7a00342bde Mon Sep 17 00:00:00 2001
+From: Sandeep Patil <sspatil@android.com>
+Date: Tue, 12 Feb 2019 15:36:11 -0800
+Subject: mm: proc: smaps_rollup: fix pss_locked calculation
+
+From: Sandeep Patil <sspatil@android.com>
+
+commit 27dd768ed8db48beefc4d9e006c58e7a00342bde upstream.
+
+The 'pss_locked' field of smaps_rollup was being calculated incorrectly.
+It accumulated the current pss everytime a locked VMA was found. Fix
+that by adding to 'pss_locked' the same time as that of 'pss' if the vma
+being walked is locked.
+
+Link: http://lkml.kernel.org/r/20190203065425.14650-1-sspatil@android.com
+Fixes: 493b0e9d945f ("mm: add /proc/pid/smaps_rollup")
+Signed-off-by: Sandeep Patil <sspatil@android.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Daniel Colascione <dancol@google.com>
+Cc: <stable@vger.kernel.org> [4.14.x, 4.19.x]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/task_mmu.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -423,7 +423,7 @@ struct mem_size_stats {
+ };
+
+ static void smaps_account(struct mem_size_stats *mss, struct page *page,
+- bool compound, bool young, bool dirty)
++ bool compound, bool young, bool dirty, bool locked)
+ {
+ int i, nr = compound ? 1 << compound_order(page) : 1;
+ unsigned long size = nr * PAGE_SIZE;
+@@ -450,24 +450,31 @@ static void smaps_account(struct mem_siz
+ else
+ mss->private_clean += size;
+ mss->pss += (u64)size << PSS_SHIFT;
++ if (locked)
++ mss->pss_locked += (u64)size << PSS_SHIFT;
+ return;
+ }
+
+ for (i = 0; i < nr; i++, page++) {
+ int mapcount = page_mapcount(page);
++ unsigned long pss = (PAGE_SIZE << PSS_SHIFT);
+
+ if (mapcount >= 2) {
+ if (dirty || PageDirty(page))
+ mss->shared_dirty += PAGE_SIZE;
+ else
+ mss->shared_clean += PAGE_SIZE;
+- mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
++ mss->pss += pss / mapcount;
++ if (locked)
++ mss->pss_locked += pss / mapcount;
+ } else {
+ if (dirty || PageDirty(page))
+ mss->private_dirty += PAGE_SIZE;
+ else
+ mss->private_clean += PAGE_SIZE;
+- mss->pss += PAGE_SIZE << PSS_SHIFT;
++ mss->pss += pss;
++ if (locked)
++ mss->pss_locked += pss;
+ }
+ }
+ }
+@@ -490,6 +497,7 @@ static void smaps_pte_entry(pte_t *pte,
+ {
+ struct mem_size_stats *mss = walk->private;
+ struct vm_area_struct *vma = walk->vma;
++ bool locked = !!(vma->vm_flags & VM_LOCKED);
+ struct page *page = NULL;
+
+ if (pte_present(*pte)) {
+@@ -532,7 +540,7 @@ static void smaps_pte_entry(pte_t *pte,
+ if (!page)
+ return;
+
+- smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte));
++ smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked);
+ }
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+@@ -541,6 +549,7 @@ static void smaps_pmd_entry(pmd_t *pmd,
+ {
+ struct mem_size_stats *mss = walk->private;
+ struct vm_area_struct *vma = walk->vma;
++ bool locked = !!(vma->vm_flags & VM_LOCKED);
+ struct page *page;
+
+ /* FOLL_DUMP will return -EFAULT on huge zero page */
+@@ -555,7 +564,7 @@ static void smaps_pmd_entry(pmd_t *pmd,
+ /* pass */;
+ else
+ VM_BUG_ON_PAGE(1, page);
+- smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
++ smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked);
+ }
+ #else
+ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
+@@ -737,11 +746,8 @@ static void smap_gather_stats(struct vm_
+ }
+ }
+ #endif
+-
+ /* mmap_sem is held in m_start */
+ walk_page_vma(vma, &smaps_walk);
+- if (vma->vm_flags & VM_LOCKED)
+- mss->pss_locked += mss->pss;
+ }
+
+ #define SEQ_PUT_DEC(str, val) \
--- /dev/null
+From dcf6e2e38a1c7ccbc535de5e1d9b14998847499d Mon Sep 17 00:00:00 2001
+From: Zachary Hays <zhays@lexmark.com>
+Date: Thu, 7 Feb 2019 10:03:08 -0500
+Subject: mmc: block: handle complete_work on separate workqueue
+
+From: Zachary Hays <zhays@lexmark.com>
+
+commit dcf6e2e38a1c7ccbc535de5e1d9b14998847499d upstream.
+
+The kblockd workqueue is created with the WQ_MEM_RECLAIM flag set.
+This generates a rescuer thread for that queue that will trigger when
+the CPU is under heavy load and collect the uncompleted work.
+
+In the case of mmc, this creates the possibility of a deadlock when
+there are multiple partitions on the device as other blk-mq work is
+also run on the same queue. For example:
+
+- worker 0 claims the mmc host to work on partition 1
+- worker 1 attempts to claim the host for partition 2 but has to wait
+ for worker 0 to finish
+- worker 0 schedules complete_work to release the host
+- rescuer thread is triggered after time-out and collects the dangling
+ work
+- rescuer thread attempts to complete the work in order starting with
+ claim host
+- the task to release host is now blocked by a task to claim it and
+ will never be called
+
+The above results in multiple hung tasks that lead to failures to
+mount partitions.
+
+Handling complete_work on a separate workqueue avoids this by keeping
+the work completion tasks separate from the other blk-mq work. This
+allows the host to be released without getting blocked by other tasks
+attempting to claim the host.
+
+Signed-off-by: Zachary Hays <zhays@lexmark.com>
+Fixes: 81196976ed94 ("mmc: block: Add blk-mq support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/block.c | 10 +++++++++-
+ include/linux/mmc/card.h | 1 +
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2114,7 +2114,7 @@ static void mmc_blk_mq_req_done(struct m
+ if (waiting)
+ wake_up(&mq->wait);
+ else
+- kblockd_schedule_work(&mq->complete_work);
++ queue_work(mq->card->complete_wq, &mq->complete_work);
+
+ return;
+ }
+@@ -2928,6 +2928,13 @@ static int mmc_blk_probe(struct mmc_card
+
+ mmc_fixup_device(card, mmc_blk_fixups);
+
++ card->complete_wq = alloc_workqueue("mmc_complete",
++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
++ if (unlikely(!card->complete_wq)) {
++ pr_err("Failed to create mmc completion workqueue");
++ return -ENOMEM;
++ }
++
+ md = mmc_blk_alloc(card);
+ if (IS_ERR(md))
+ return PTR_ERR(md);
+@@ -2991,6 +2998,7 @@ static void mmc_blk_remove(struct mmc_ca
+ pm_runtime_put_noidle(&card->dev);
+ mmc_blk_remove_req(md);
+ dev_set_drvdata(&card->dev, NULL);
++ destroy_workqueue(card->complete_wq);
+ }
+
+ static int _mmc_blk_suspend(struct mmc_card *card)
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -308,6 +308,7 @@ struct mmc_card {
+ unsigned int nr_parts;
+
+ unsigned int bouncesz; /* Bounce buffer size */
++ struct workqueue_struct *complete_wq; /* Private workqueue */
+ };
+
+ static inline bool mmc_large_sector(struct mmc_card *card)
--- /dev/null
+From d49d92ace4974510dd5845ff91860823cf30dc08 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 5 Feb 2019 23:42:23 +0800
+Subject: mmc: sunxi: Disable HS-DDR mode for H5 eMMC controller by default
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit d49d92ace4974510dd5845ff91860823cf30dc08 upstream.
+
+Some H5 boards seem to not have proper trace lengths for eMMC to be able
+to use the default setting for the delay chains under HS-DDR mode. These
+include the Bananapi M2+ H5 and NanoPi NEO Core2. However the Libre
+Computer ALL-H3-CC-H5 works just fine.
+
+For the H5 (at least for now), default to not enabling HS-DDR modes in
+the driver, and expect the device tree to signal HS-DDR capability on
+boards that work.
+
+Reported-by: Chris Blake <chrisrblake93@gmail.com>
+Fixes: 07bafc1e3536 ("mmc: sunxi: Use new timing mode for A64 eMMC controller")
+Cc: <stable@vger.kernel.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sunxi-mmc.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sunxi-mmc.c
++++ b/drivers/mmc/host/sunxi-mmc.c
+@@ -1399,7 +1399,16 @@ static int sunxi_mmc_probe(struct platfo
+ mmc->caps |= MMC_CAP_MMC_HIGHSPEED | MMC_CAP_SD_HIGHSPEED |
+ MMC_CAP_ERASE | MMC_CAP_SDIO_IRQ;
+
+- if (host->cfg->clk_delays || host->use_new_timings)
++ /*
++ * Some H5 devices do not have signal traces precise enough to
++ * use HS DDR mode for their eMMC chips.
++ *
++ * We still enable HS DDR modes for all the other controller
++ * variants that support them.
++ */
++ if ((host->cfg->clk_delays || host->use_new_timings) &&
++ !of_device_is_compatible(pdev->dev.of_node,
++ "allwinner,sun50i-h5-emmc"))
+ mmc->caps |= MMC_CAP_1_8V_DDR | MMC_CAP_3_3V_DDR;
+
+ ret = mmc_of_parse(mmc);
--- /dev/null
+From d6f11e7d91f2ac85f66194fe3ef8789b49901d64 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 5 Feb 2019 23:42:24 +0800
+Subject: mmc: sunxi: Filter out unsupported modes declared in the device tree
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit d6f11e7d91f2ac85f66194fe3ef8789b49901d64 upstream.
+
+The MMC device tree bindings include properties used to signal various
+signalling speed modes. Until now the sunxi driver was accepting them
+without any further filtering, while the sunxi device trees were not
+actually using them.
+
+Since some of the H5 boards can not run at higher speed modes stably,
+we are resorting to declaring the higher speed modes per-board.
+
+Regardless, having boards declare modes and blindly following them,
+even without proper support in the driver, is generally a bad thing.
+
+Filter out all unsupported modes from the capabilities mask after
+the device tree properties have been parsed.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sunxi-mmc.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/mmc/host/sunxi-mmc.c
++++ b/drivers/mmc/host/sunxi-mmc.c
+@@ -1415,6 +1415,21 @@ static int sunxi_mmc_probe(struct platfo
+ if (ret)
+ goto error_free_dma;
+
++ /*
++ * If we don't support delay chains in the SoC, we can't use any
++ * of the higher speed modes. Mask them out in case the device
++ * tree specifies the properties for them, which gets added to
++ * the caps by mmc_of_parse() above.
++ */
++ if (!(host->cfg->clk_delays || host->use_new_timings)) {
++ mmc->caps &= ~(MMC_CAP_3_3V_DDR | MMC_CAP_1_8V_DDR |
++ MMC_CAP_1_2V_DDR | MMC_CAP_UHS);
++ mmc->caps2 &= ~MMC_CAP2_HS200;
++ }
++
++ /* TODO: This driver doesn't support HS400 mode yet */
++ mmc->caps2 &= ~MMC_CAP2_HS400;
++
+ ret = sunxi_mmc_init_host(host);
+ if (ret)
+ goto error_free_dma;
--- /dev/null
+From 528871b456026e6127d95b1b2bd8e3a003dc1614 Mon Sep 17 00:00:00 2001
+From: Ingo Molnar <mingo@kernel.org>
+Date: Wed, 13 Feb 2019 07:57:02 +0100
+Subject: perf/core: Fix impossible ring-buffer sizes warning
+
+From: Ingo Molnar <mingo@kernel.org>
+
+commit 528871b456026e6127d95b1b2bd8e3a003dc1614 upstream.
+
+The following commit:
+
+ 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes")
+
+results in perf recording failures with larger mmap areas:
+
+ root@skl:/tmp# perf record -g -a
+ failed to mmap with 12 (Cannot allocate memory)
+
+The root cause is that the following condition is buggy:
+
+ if (order_base_2(size) >= MAX_ORDER)
+ goto fail;
+
+The problem is that @size is in bytes and MAX_ORDER is in pages,
+so the right test is:
+
+ if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER)
+ goto fail;
+
+Fix it.
+
+Reported-by: "Jin, Yao" <yao.jin@linux.intel.com>
+Bisected-by: Borislav Petkov <bp@alien8.de>
+Analyzed-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Julien Thierry <julien.thierry@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: <stable@vger.kernel.org>
+Fixes: 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/ring_buffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -734,7 +734,7 @@ struct ring_buffer *rb_alloc(int nr_page
+ size = sizeof(struct ring_buffer);
+ size += nr_pages * sizeof(void *);
+
+- if (order_base_2(size) >= MAX_ORDER)
++ if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER)
+ goto fail;
+
+ rb = kzalloc(size, GFP_KERNEL);
--- /dev/null
+From 81ec3f3c4c4d78f2d3b6689c9816bfbdf7417dbb Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Mon, 4 Feb 2019 13:35:32 +0100
+Subject: perf/x86: Add check_period PMU callback
+
+From: Jiri Olsa <jolsa@redhat.com>
+
+commit 81ec3f3c4c4d78f2d3b6689c9816bfbdf7417dbb upstream.
+
+Vince (and later on Ravi) reported crashes in the BTS code during
+fuzzing with the following backtrace:
+
+ general protection fault: 0000 [#1] SMP PTI
+ ...
+ RIP: 0010:perf_prepare_sample+0x8f/0x510
+ ...
+ Call Trace:
+ <IRQ>
+ ? intel_pmu_drain_bts_buffer+0x194/0x230
+ intel_pmu_drain_bts_buffer+0x160/0x230
+ ? tick_nohz_irq_exit+0x31/0x40
+ ? smp_call_function_single_interrupt+0x48/0xe0
+ ? call_function_single_interrupt+0xf/0x20
+ ? call_function_single_interrupt+0xa/0x20
+ ? x86_schedule_events+0x1a0/0x2f0
+ ? x86_pmu_commit_txn+0xb4/0x100
+ ? find_busiest_group+0x47/0x5d0
+ ? perf_event_set_state.part.42+0x12/0x50
+ ? perf_mux_hrtimer_restart+0x40/0xb0
+ intel_pmu_disable_event+0xae/0x100
+ ? intel_pmu_disable_event+0xae/0x100
+ x86_pmu_stop+0x7a/0xb0
+ x86_pmu_del+0x57/0x120
+ event_sched_out.isra.101+0x83/0x180
+ group_sched_out.part.103+0x57/0xe0
+ ctx_sched_out+0x188/0x240
+ ctx_resched+0xa8/0xd0
+ __perf_event_enable+0x193/0x1e0
+ event_function+0x8e/0xc0
+ remote_function+0x41/0x50
+ flush_smp_call_function_queue+0x68/0x100
+ generic_smp_call_function_single_interrupt+0x13/0x30
+ smp_call_function_single_interrupt+0x3e/0xe0
+ call_function_single_interrupt+0xf/0x20
+ </IRQ>
+
+The reason is that while event init code does several checks
+for BTS events and prevents several unwanted config bits for
+BTS event (like precise_ip), the PERF_EVENT_IOC_PERIOD allows
+to create BTS event without those checks being done.
+
+Following sequence will cause the crash:
+
+If we create an 'almost' BTS event with precise_ip and callchains,
+and it into a BTS event it will crash the perf_prepare_sample()
+function because precise_ip events are expected to come
+in with callchain data initialized, but that's not the
+case for intel_pmu_drain_bts_buffer() caller.
+
+Adding a check_period callback to be called before the period
+is changed via PERF_EVENT_IOC_PERIOD. It will deny the change
+if the event would become BTS. Plus adding also the limit_period
+check as well.
+
+Reported-by: Vince Weaver <vincent.weaver@maine.edu>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: <stable@vger.kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20190204123532.GA4794@krava
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/core.c | 14 ++++++++++++++
+ arch/x86/events/intel/core.c | 9 +++++++++
+ arch/x86/events/perf_event.h | 16 ++++++++++++++--
+ include/linux/perf_event.h | 5 +++++
+ kernel/events/core.c | 16 ++++++++++++++++
+ 5 files changed, 58 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -2278,6 +2278,19 @@ void perf_check_microcode(void)
+ x86_pmu.check_microcode();
+ }
+
++static int x86_pmu_check_period(struct perf_event *event, u64 value)
++{
++ if (x86_pmu.check_period && x86_pmu.check_period(event, value))
++ return -EINVAL;
++
++ if (value && x86_pmu.limit_period) {
++ if (x86_pmu.limit_period(event, value) > value)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static struct pmu pmu = {
+ .pmu_enable = x86_pmu_enable,
+ .pmu_disable = x86_pmu_disable,
+@@ -2302,6 +2315,7 @@ static struct pmu pmu = {
+ .event_idx = x86_pmu_event_idx,
+ .sched_task = x86_pmu_sched_task,
+ .task_ctx_size = sizeof(struct x86_perf_task_context),
++ .check_period = x86_pmu_check_period,
+ };
+
+ void arch_perf_update_userpage(struct perf_event *event,
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3587,6 +3587,11 @@ static void intel_pmu_sched_task(struct
+ intel_pmu_lbr_sched_task(ctx, sched_in);
+ }
+
++static int intel_pmu_check_period(struct perf_event *event, u64 value)
++{
++ return intel_pmu_has_bts_period(event, value) ? -EINVAL : 0;
++}
++
+ PMU_FORMAT_ATTR(offcore_rsp, "config1:0-63");
+
+ PMU_FORMAT_ATTR(ldlat, "config1:0-15");
+@@ -3667,6 +3672,8 @@ static __initconst const struct x86_pmu
+ .cpu_starting = intel_pmu_cpu_starting,
+ .cpu_dying = intel_pmu_cpu_dying,
+ .cpu_dead = intel_pmu_cpu_dead,
++
++ .check_period = intel_pmu_check_period,
+ };
+
+ static struct attribute *intel_pmu_attrs[];
+@@ -3711,6 +3718,8 @@ static __initconst const struct x86_pmu
+
+ .guest_get_msrs = intel_guest_get_msrs,
+ .sched_task = intel_pmu_sched_task,
++
++ .check_period = intel_pmu_check_period,
+ };
+
+ static __init void intel_clovertown_quirk(void)
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -646,6 +646,11 @@ struct x86_pmu {
+ * Intel host/guest support (KVM)
+ */
+ struct perf_guest_switch_msr *(*guest_get_msrs)(int *nr);
++
++ /*
++ * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
++ */
++ int (*check_period) (struct perf_event *event, u64 period);
+ };
+
+ struct x86_perf_task_context {
+@@ -857,7 +862,7 @@ static inline int amd_pmu_init(void)
+
+ #ifdef CONFIG_CPU_SUP_INTEL
+
+-static inline bool intel_pmu_has_bts(struct perf_event *event)
++static inline bool intel_pmu_has_bts_period(struct perf_event *event, u64 period)
+ {
+ struct hw_perf_event *hwc = &event->hw;
+ unsigned int hw_event, bts_event;
+@@ -868,7 +873,14 @@ static inline bool intel_pmu_has_bts(str
+ hw_event = hwc->config & INTEL_ARCH_EVENT_MASK;
+ bts_event = x86_pmu.event_map(PERF_COUNT_HW_BRANCH_INSTRUCTIONS);
+
+- return hw_event == bts_event && hwc->sample_period == 1;
++ return hw_event == bts_event && period == 1;
++}
++
++static inline bool intel_pmu_has_bts(struct perf_event *event)
++{
++ struct hw_perf_event *hwc = &event->hw;
++
++ return intel_pmu_has_bts_period(event, hwc->sample_period);
+ }
+
+ int intel_pmu_save_and_restart(struct perf_event *event);
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -447,6 +447,11 @@ struct pmu {
+ * Filter events for PMU-specific reasons.
+ */
+ int (*filter_match) (struct perf_event *event); /* optional */
++
++ /*
++ * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
++ */
++ int (*check_period) (struct perf_event *event, u64 value); /* optional */
+ };
+
+ enum perf_addr_filter_action_t {
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4963,6 +4963,11 @@ static void __perf_event_period(struct p
+ }
+ }
+
++static int perf_event_check_period(struct perf_event *event, u64 value)
++{
++ return event->pmu->check_period(event, value);
++}
++
+ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ {
+ u64 value;
+@@ -4979,6 +4984,9 @@ static int perf_event_period(struct perf
+ if (event->attr.freq && value > sysctl_perf_event_sample_rate)
+ return -EINVAL;
+
++ if (perf_event_check_period(event, value))
++ return -EINVAL;
++
+ event_function_call(event, __perf_event_period, &value);
+
+ return 0;
+@@ -9391,6 +9399,11 @@ static int perf_pmu_nop_int(struct pmu *
+ return 0;
+ }
+
++static int perf_event_nop_int(struct perf_event *event, u64 value)
++{
++ return 0;
++}
++
+ static DEFINE_PER_CPU(unsigned int, nop_txn_flags);
+
+ static void perf_pmu_start_txn(struct pmu *pmu, unsigned int flags)
+@@ -9691,6 +9704,9 @@ got_cpu_context:
+ pmu->pmu_disable = perf_pmu_nop_void;
+ }
+
++ if (!pmu->check_period)
++ pmu->check_period = perf_event_nop_int;
++
+ if (!pmu->event_idx)
+ pmu->event_idx = perf_event_idx_default;
+
--- /dev/null
+From f420c54e4b12c1361c6ed313002ee7bd7ac58362 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 11 Feb 2019 14:32:40 -0800
+Subject: Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit f420c54e4b12c1361c6ed313002ee7bd7ac58362 upstream.
+
+This reverts commit 7db54c89f0b30a101584e09d3729144e6170059d as it
+breaks Acer Aspire V-371 and other devices. According to Elan:
+
+"Acer Aspire F5-573G is MS Precision touchpad which should use hid
+ multitouch driver. ELAN0501 should not be added in elan_i2c."
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202503
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elan_i2c_core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1336,7 +1336,6 @@ MODULE_DEVICE_TABLE(i2c, elan_id);
+ static const struct acpi_device_id elan_acpi_id[] = {
+ { "ELAN0000", 0 },
+ { "ELAN0100", 0 },
+- { "ELAN0501", 0 },
+ { "ELAN0600", 0 },
+ { "ELAN0602", 0 },
+ { "ELAN0605", 0 },
--- /dev/null
+From 69056ee6a8a3d576ed31e38b3b14c70d6c74edcc Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Tue, 12 Feb 2019 15:35:51 -0800
+Subject: Revert "mm: don't reclaim inodes with many attached pages"
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit 69056ee6a8a3d576ed31e38b3b14c70d6c74edcc upstream.
+
+This reverts commit a76cf1a474d7d ("mm: don't reclaim inodes with many
+attached pages").
+
+This change causes serious changes to page cache and inode cache
+behaviour and balance, resulting in major performance regressions when
+combining worklaods such as large file copies and kernel compiles.
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=202441
+
+This change is a hack to work around the problems introduced by changing
+how agressive shrinkers are on small caches in commit 172b06c32b94 ("mm:
+slowly shrink slabs with a relatively small number of objects"). It
+creates more problems than it solves, wasn't adequately reviewed or
+tested, so it needs to be reverted.
+
+Link: http://lkml.kernel.org/r/20190130041707.27750-2-david@fromorbit.com
+Fixes: a76cf1a474d7d ("mm: don't reclaim inodes with many attached pages")
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Cc: Wolfgang Walter <linux@stwm.de>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: Spock <dairinin@gmail.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/inode.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -730,11 +730,8 @@ static enum lru_status inode_lru_isolate
+ return LRU_REMOVED;
+ }
+
+- /*
+- * Recently referenced inodes and inodes with many attached pages
+- * get one more pass.
+- */
+- if (inode->i_state & I_REFERENCED || inode->i_data.nrpages > 1) {
++ /* recently referenced inodes get one more pass */
++ if (inode->i_state & I_REFERENCED) {
+ inode->i_state &= ~I_REFERENCED;
+ spin_unlock(&inode->i_lock);
+ return LRU_ROTATE;
--- /dev/null
+From a9a238e83fbb0df31c3b9b67003f8f9d1d1b6c96 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Tue, 12 Feb 2019 15:35:55 -0800
+Subject: Revert "mm: slowly shrink slabs with a relatively small number of objects"
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit a9a238e83fbb0df31c3b9b67003f8f9d1d1b6c96 upstream.
+
+This reverts commit 172b06c32b9497 ("mm: slowly shrink slabs with a
+relatively small number of objects").
+
+This change changes the agressiveness of shrinker reclaim, causing small
+cache and low priority reclaim to greatly increase scanning pressure on
+small caches. As a result, light memory pressure has a disproportionate
+affect on small caches, and causes large caches to be reclaimed much
+faster than previously.
+
+As a result, it greatly perturbs the delicate balance of the VFS caches
+(dentry/inode vs file page cache) such that the inode/dentry caches are
+reclaimed much, much faster than the page cache and this drives us into
+several other caching imbalance related problems.
+
+As such, this is a bad change and needs to be reverted.
+
+[ Needs some massaging to retain the later seekless shrinker
+ modifications.]
+
+Link: http://lkml.kernel.org/r/20190130041707.27750-3-david@fromorbit.com
+Fixes: 172b06c32b9497 ("mm: slowly shrink slabs with a relatively small number of objects")
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Cc: Wolfgang Walter <linux@stwm.de>
+Cc: Roman Gushchin <guro@fb.com>
+Cc: Spock <dairinin@gmail.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmscan.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -487,16 +487,6 @@ static unsigned long do_shrink_slab(stru
+ delta = freeable / 2;
+ }
+
+- /*
+- * Make sure we apply some minimal pressure on default priority
+- * even on small cgroups. Stale objects are not only consuming memory
+- * by themselves, but can also hold a reference to a dying cgroup,
+- * preventing it from being reclaimed. A dying cgroup with all
+- * corresponding structures like per-cpu stats and kmem caches
+- * can be really big, so it may lead to a significant waste of memory.
+- */
+- delta = max_t(unsigned long long, delta, min(freeable, batch_size));
+-
+ total_scan += delta;
+ if (total_scan < 0) {
+ pr_err("shrink_slab: %pF negative objects to delete nr=%ld\n",
--- /dev/null
+From 3bf6b57ec2ec945e5a6edf5c202a754f1e852ecd Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Thu, 14 Feb 2019 12:33:19 -0500
+Subject: Revert "nfsd4: return default lease period"
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 3bf6b57ec2ec945e5a6edf5c202a754f1e852ecd upstream.
+
+This reverts commit d6ebf5088f09472c1136cd506bdc27034a6763f8.
+
+I forgot that the kernel's default lease period should never be
+decreased!
+
+After a kernel upgrade, the kernel has no way of knowing on its own what
+the previous lease time was. Unless userspace tells it otherwise, it
+will assume the previous lease period was the same.
+
+So if we decrease this value in a kernel upgrade, we end up enforcing a
+grace period that's too short, and clients will fail to reclaim state in
+time. Symptoms may include EIO and log messages like "NFS:
+nfs4_reclaim_open_state: Lock reclaim failed!"
+
+There was no real justification for the lease period decrease anyway.
+
+Reported-by: Donald Buczek <buczek@molgen.mpg.de>
+Fixes: d6ebf5088f09 "nfsd4: return default lease period"
+Cc: stable@vger.kernel.org
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfsctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1239,8 +1239,8 @@ static __net_init int nfsd_init_net(stru
+ retval = nfsd_idmap_init(net);
+ if (retval)
+ goto out_idmap_error;
+- nn->nfsd4_lease = 45; /* default lease time */
+- nn->nfsd4_grace = 45;
++ nn->nfsd4_lease = 90; /* default lease time */
++ nn->nfsd4_grace = 90;
+ nn->somebody_reclaimed = false;
+ nn->clverifier_counter = prandom_u32();
+ nn->clientid_counter = prandom_u32();
--- /dev/null
+From e3613bb8afc2a9474c9214d65c8326c5ac02135e Mon Sep 17 00:00:00 2001
+From: Stefan O'Rear <sorear2@gmail.com>
+Date: Sun, 16 Dec 2018 13:03:36 -0500
+Subject: riscv: Add pte bit to distinguish swap from invalid
+
+From: Stefan O'Rear <sorear2@gmail.com>
+
+commit e3613bb8afc2a9474c9214d65c8326c5ac02135e upstream.
+
+Previously, invalid PTEs and swap PTEs had the same binary
+representation, causing errors when attempting to unmap PROT_NONE
+mappings, including implicit unmap on exit.
+
+Typical error:
+
+swap_info_get: Bad swap file entry 40000000007a9879
+BUG: Bad page map in process a.out pte:3d4c3cc0 pmd:3e521401
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Stefan O'Rear <sorear2@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/include/asm/pgtable-bits.h | 6 ++++++
+ arch/riscv/include/asm/pgtable.h | 8 ++++----
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/arch/riscv/include/asm/pgtable-bits.h
++++ b/arch/riscv/include/asm/pgtable-bits.h
+@@ -35,6 +35,12 @@
+ #define _PAGE_SPECIAL _PAGE_SOFT
+ #define _PAGE_TABLE _PAGE_PRESENT
+
++/*
++ * _PAGE_PROT_NONE is set on not-present pages (and ignored by the hardware) to
++ * distinguish them from swapped out pages
++ */
++#define _PAGE_PROT_NONE _PAGE_READ
++
+ #define _PAGE_PFN_SHIFT 10
+
+ /* Set of bits to preserve across pte_modify() */
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -44,7 +44,7 @@
+ /* Page protection bits */
+ #define _PAGE_BASE (_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_USER)
+
+-#define PAGE_NONE __pgprot(0)
++#define PAGE_NONE __pgprot(_PAGE_PROT_NONE)
+ #define PAGE_READ __pgprot(_PAGE_BASE | _PAGE_READ)
+ #define PAGE_WRITE __pgprot(_PAGE_BASE | _PAGE_READ | _PAGE_WRITE)
+ #define PAGE_EXEC __pgprot(_PAGE_BASE | _PAGE_EXEC)
+@@ -98,7 +98,7 @@ extern unsigned long empty_zero_page[PAG
+
+ static inline int pmd_present(pmd_t pmd)
+ {
+- return (pmd_val(pmd) & _PAGE_PRESENT);
++ return (pmd_val(pmd) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
+ }
+
+ static inline int pmd_none(pmd_t pmd)
+@@ -178,7 +178,7 @@ static inline pte_t *pte_offset_kernel(p
+
+ static inline int pte_present(pte_t pte)
+ {
+- return (pte_val(pte) & _PAGE_PRESENT);
++ return (pte_val(pte) & (_PAGE_PRESENT | _PAGE_PROT_NONE));
+ }
+
+ static inline int pte_none(pte_t pte)
+@@ -380,7 +380,7 @@ static inline int ptep_clear_flush_young
+ *
+ * Format of swap PTE:
+ * bit 0: _PAGE_PRESENT (zero)
+- * bit 1: reserved for future use (zero)
++ * bit 1: _PAGE_PROT_NONE (zero)
+ * bits 2 to 6: swap type
+ * bits 7 to XLEN-1: swap offset
+ */
--- /dev/null
+From 634692ab7007e8e3fec758ab0b26e65abf7c79e0 Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Thu, 17 Jan 2019 11:20:28 +0100
+Subject: s390/suspend: fix stack setup in swsusp_arch_suspend
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 634692ab7007e8e3fec758ab0b26e65abf7c79e0 upstream.
+
+The patch that added support for the virtually mapped kernel stacks changed
+swsusp_arch_suspend to switch to the nodat-stack as the vmap stack is not
+available while going in and out of suspend.
+
+Unfortunately the switch to the nodat-stack is incorrect which breaks
+suspend to disk.
+
+Cc: stable@vger.kernel.org # v4.20
+Fixes: ce3dc447493f ("s390: add support for virtually mapped kernel stacks")
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/swsusp.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/kernel/swsusp.S
++++ b/arch/s390/kernel/swsusp.S
+@@ -30,10 +30,10 @@
+ .section .text
+ ENTRY(swsusp_arch_suspend)
+ lg %r1,__LC_NODAT_STACK
+- aghi %r1,-STACK_FRAME_OVERHEAD
+ stmg %r6,%r15,__SF_GPRS(%r1)
++ aghi %r1,-STACK_FRAME_OVERHEAD
+ stg %r15,__SF_BACKCHAIN(%r1)
+- lgr %r1,%r15
++ lgr %r15,%r1
+
+ /* Store FPU registers */
+ brasl %r14,save_fpu_regs
--- /dev/null
+From 8f9aca0c45322a807a343fc32f95f2500f83b9ae Mon Sep 17 00:00:00 2001
+From: Harald Freudenberger <freude@linux.ibm.com>
+Date: Wed, 23 Jan 2019 13:41:35 +0100
+Subject: s390/zcrypt: fix specification exception on z196 during ap probe
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+commit 8f9aca0c45322a807a343fc32f95f2500f83b9ae upstream.
+
+The older machines don't have the QCI instruction available.
+With support for up to 256 crypto cards the probing of each
+card has been extended to check card ids from 0 up to 255.
+For machines with QCI support there is a filter limiting the
+range of probed cards. The older machines (z196 and older)
+don't have this filter and so since support for 256 cards is
+in the driver all cards are probed. However, these machines
+also require to have the card id fit into 6 bits. Exceeding
+this limit results in a specification exception which happens
+on every kernel startup even when there is no crypto configured
+and used at all.
+
+This fix limits the range of probed crypto cards to 64 if
+there is no QCI instruction available to obey to the older
+ap architecture and so fixes the specification exceptions
+on z196 machines.
+
+Cc: stable@vger.kernel.org # v4.17+
+Fixes: af4a72276d49 ("s390/zcrypt: Support up to 256 crypto adapters.")
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/crypto/ap_bus.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -248,7 +248,8 @@ static inline int ap_test_config(unsigne
+ static inline int ap_test_config_card_id(unsigned int id)
+ {
+ if (!ap_configuration) /* QCI not supported */
+- return 1;
++ /* only ids 0...3F may be probed */
++ return id < 0x40 ? 1 : 0;
+ return ap_test_config(ap_configuration->apm, id);
+ }
+
cifs-do-not-assume-one-credit-for-async-responses.patch
cifs-fix-mounts-if-the-client-is-low-on-credits.patch
gpio-mxc-move-gpio-noirq-suspend-resume-to-syscore-p.patch
+revert-input-elan_i2c-add-acpi-id-for-touchpad-in-asus-aspire-f5-573g.patch
+input-elan_i2c-add-acpi-id-for-touchpad-in-lenovo-v330-15isk.patch
+arm64-dts-rockchip-enable-usb-host-regulators-at-boot-on-rk3328-rock64.patch
+arm-omap5-fix-inverted-nirq-pin-interrupts-with-irq_set_type.patch
+perf-core-fix-impossible-ring-buffer-sizes-warning.patch
+perf-x86-add-check_period-pmu-callback.patch
+alsa-hda-add-quirk-for-hp-elitebook-840-g5.patch
+alsa-usb-audio-fix-implicit-fb-endpoint-setup-by-quirk.patch
+alsa-pcm-revert-capture-stream-behavior-change-in-blocking-mode.patch
+asoc-hdmi-codec-fix-oops-on-re-probe.patch
+tools-uapi-fix-alpha-support.patch
+riscv-add-pte-bit-to-distinguish-swap-from-invalid.patch
+x86-kvm-nvmx-read-from-msr_ia32_vmx_procbased_ctls2-only-when-it-is-available.patch
+kvm-vmx-fix-entry-number-check-for-add_atomic_switch_msr.patch
+mmc-sunxi-disable-hs-ddr-mode-for-h5-emmc-controller-by-default.patch
+mmc-sunxi-filter-out-unsupported-modes-declared-in-the-device-tree.patch
+mmc-block-handle-complete_work-on-separate-workqueue.patch
+input-bma150-register-input-device-after-setting-private-data.patch
+input-elantech-enable-3rd-button-support-on-fujitsu-celsius-h780.patch
+revert-nfsd4-return-default-lease-period.patch
+revert-mm-don-t-reclaim-inodes-with-many-attached-pages.patch
+revert-mm-slowly-shrink-slabs-with-a-relatively-small-number-of-objects.patch
+mm-proc-smaps_rollup-fix-pss_locked-calculation.patch
+alpha-fix-page-fault-handling-for-r16-r18-targets.patch
+alpha-fix-eiger-nr_irqs-to-128.patch
+s390-suspend-fix-stack-setup-in-swsusp_arch_suspend.patch
+s390-zcrypt-fix-specification-exception-on-z196-during-ap-probe.patch
--- /dev/null
+From 842fc0f5dc5c9f9bd91f891554996d903c40cf35 Mon Sep 17 00:00:00 2001
+From: Bob Tracy <rct@frus.com>
+Date: Mon, 21 Jan 2019 21:09:14 -0800
+Subject: tools uapi: fix Alpha support
+
+From: Bob Tracy <rct@frus.com>
+
+commit 842fc0f5dc5c9f9bd91f891554996d903c40cf35 upstream.
+
+Cc: stable@vger.kernel.org # v4.18+
+Signed-off-by: Bob Tracy <rct@frus.com>
+Signed-off-by: Matt Turner <mattst88@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/include/uapi/asm/bitsperlong.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/include/uapi/asm/bitsperlong.h
++++ b/tools/include/uapi/asm/bitsperlong.h
+@@ -15,6 +15,8 @@
+ #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
+ #elif defined(__riscv)
+ #include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
++#elif defined(__alpha__)
++#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
+ #else
+ #include <asm-generic/bitsperlong.h>
+ #endif
--- /dev/null
+From 6b1971c694975e49af302229202c0043568b1791 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Thu, 7 Feb 2019 11:42:14 +0100
+Subject: x86/kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is available
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+commit 6b1971c694975e49af302229202c0043568b1791 upstream.
+
+SDM says MSR_IA32_VMX_PROCBASED_CTLS2 is only available "If
+(CPUID.01H:ECX.[5] && IA32_VMX_PROCBASED_CTLS[63])". It was found that
+some old cpus (namely "Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz (family: 0x6,
+model: 0xf, stepping: 0x6") don't have it. Add the missing check.
+
+Reported-by: Zdenek Kaspar <zkaspar82@gmail.com>
+Tested-by: Zdenek Kaspar <zkaspar82@gmail.com>
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3620,9 +3620,11 @@ static void nested_vmx_setup_ctls_msrs(s
+ * secondary cpu-based controls. Do not include those that
+ * depend on CPUID bits, they are added later by vmx_cpuid_update.
+ */
+- rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
+- msrs->secondary_ctls_low,
+- msrs->secondary_ctls_high);
++ if (msrs->procbased_ctls_high & CPU_BASED_ACTIVATE_SECONDARY_CONTROLS)
++ rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
++ msrs->secondary_ctls_low,
++ msrs->secondary_ctls_high);
++
+ msrs->secondary_ctls_low = 0;
+ msrs->secondary_ctls_high &=
+ SECONDARY_EXEC_DESC |
projects / thirdparty / kernel / stable-queue.git / commitdiff
