--- /dev/null
+From e4ee1a8ada93cc902b26cc881d1580d72ab12692 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?=
+ <amadeuszx.slawinski@linux.intel.com>
+Date: Wed, 22 May 2019 11:21:41 -0500
+Subject: ALSA: hdac: fix memory release for SST and SOF drivers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 6d647b736a6b1cbf2f8deab0e6a94c34a6ea9d60 ]
+
+During the integration of HDaudio support, we changed the way in which
+we get hdev in snd_hdac_ext_bus_device_init() to use one preallocated
+with devm_kzalloc(), however it still left kfree(hdev) in
+snd_hdac_ext_bus_device_exit(). It leads to oopses when trying to
+rmmod and modprobe. Fix it, by just removing kfree call.
+
+SOF also uses some of the snd_hdac_ functions for HDAudio support but
+allocated the memory with kzalloc. A matching fix is provided
+separately to align all users of the snd_hdac_ library.
+
+Fixes: 6298542fa33b ("ALSA: hdac: remove memory allocation from snd_hdac_ext_bus_device_init")
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/ext/hdac_ext_bus.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/hda/ext/hdac_ext_bus.c b/sound/hda/ext/hdac_ext_bus.c
+index ec7715c6b0c0..c147ebe542da 100644
+--- a/sound/hda/ext/hdac_ext_bus.c
++++ b/sound/hda/ext/hdac_ext_bus.c
+@@ -172,7 +172,6 @@ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_init);
+ void snd_hdac_ext_bus_device_exit(struct hdac_device *hdev)
+ {
+ snd_hdac_device_exit(hdev);
+- kfree(hdev);
+ }
+ EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_device_exit);
+
+--
+2.20.1
+
--- /dev/null
+From 1e3984f55d5b7e0b3eb3963d97e353eb99cb1cc7 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 11 Jun 2019 12:47:34 +0100
+Subject: arm64: tlbflush: Ensure start/end of address range are aligned to
+ stride
+
+[ Upstream commit 01d57485fcdb9f9101a10a18e32d5f8b023cab86 ]
+
+Since commit 3d65b6bbc01e ("arm64: tlbi: Set MAX_TLBI_OPS to
+PTRS_PER_PTE"), we resort to per-ASID invalidation when attempting to
+perform more than PTRS_PER_PTE invalidation instructions in a single
+call to __flush_tlb_range(). Whilst this is beneficial, the mmu_gather
+code does not ensure that the end address of the range is rounded-up
+to the stride when freeing intermediate page tables in pXX_free_tlb(),
+which defeats our range checking.
+
+Align the bounds passed into __flush_tlb_range().
+
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Reported-by: Hanjun Guo <guohanjun@huawei.com>
+Tested-by: Hanjun Guo <guohanjun@huawei.com>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/tlbflush.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
+index 3a1870228946..dff8f9ea5754 100644
+--- a/arch/arm64/include/asm/tlbflush.h
++++ b/arch/arm64/include/asm/tlbflush.h
+@@ -195,6 +195,9 @@ static inline void __flush_tlb_range(struct vm_area_struct *vma,
+ unsigned long asid = ASID(vma->vm_mm);
+ unsigned long addr;
+
++ start = round_down(start, stride);
++ end = round_up(end, stride);
++
+ if ((end - start) >= (MAX_TLBI_OPS * stride)) {
+ flush_tlb_mm(vma->vm_mm);
+ return;
+--
+2.20.1
+
--- /dev/null
+From dcf754b892ee655cca3de1c366041ff686bbf692 Mon Sep 17 00:00:00 2001
+From: Viorel Suman <viorel.suman@nxp.com>
+Date: Thu, 9 May 2019 13:30:36 +0000
+Subject: ASoC: ak4458: add return value for ak4458_probe
+
+[ Upstream commit a8dee20d792432740509237943700fbcfc230bad ]
+
+AK4458 is probed successfully even if AK4458 is not present - this
+is caused by probe function returning no error on i2c access failure.
+Return an error on probe if i2c access has failed.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Signed-off-by: Viorel Suman <viorel.suman@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/ak4458.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
+index eab7c76cfcd9..4c5c3ec92609 100644
+--- a/sound/soc/codecs/ak4458.c
++++ b/sound/soc/codecs/ak4458.c
+@@ -536,9 +536,10 @@ static void ak4458_power_on(struct ak4458_priv *ak4458)
+ }
+ }
+
+-static void ak4458_init(struct snd_soc_component *component)
++static int ak4458_init(struct snd_soc_component *component)
+ {
+ struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component);
++ int ret;
+
+ /* External Mute ON */
+ if (ak4458->mute_gpiod)
+@@ -546,21 +547,21 @@ static void ak4458_init(struct snd_soc_component *component)
+
+ ak4458_power_on(ak4458);
+
+- snd_soc_component_update_bits(component, AK4458_00_CONTROL1,
++ ret = snd_soc_component_update_bits(component, AK4458_00_CONTROL1,
+ 0x80, 0x80); /* ACKS bit = 1; 10000000 */
++ if (ret < 0)
++ return ret;
+
+- ak4458_rstn_control(component, 1);
++ return ak4458_rstn_control(component, 1);
+ }
+
+ static int ak4458_probe(struct snd_soc_component *component)
+ {
+ struct ak4458_priv *ak4458 = snd_soc_component_get_drvdata(component);
+
+- ak4458_init(component);
+-
+ ak4458->fs = 48000;
+
+- return 0;
++ return ak4458_init(component);
+ }
+
+ static void ak4458_remove(struct snd_soc_component *component)
+--
+2.20.1
+
--- /dev/null
+From 22b6fd70bb4954a92ec057bcbe30e09758e80111 Mon Sep 17 00:00:00 2001
+From: Viorel Suman <viorel.suman@nxp.com>
+Date: Mon, 13 May 2019 10:02:42 +0000
+Subject: ASoC: ak4458: rstn_control - return a non-zero on error only
+
+[ Upstream commit 176a11834b65ec35e3b7a953f87fb9cc41309497 ]
+
+snd_soc_component_update_bits() may return 1 if operation
+was successful and the value of the register changed.
+Return a non-zero in ak4458_rstn_control for an error only.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Signed-off-by: Viorel Suman <viorel.suman@nxp.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/ak4458.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/ak4458.c b/sound/soc/codecs/ak4458.c
+index 4c5c3ec92609..71562154c0b1 100644
+--- a/sound/soc/codecs/ak4458.c
++++ b/sound/soc/codecs/ak4458.c
+@@ -304,7 +304,10 @@ static int ak4458_rstn_control(struct snd_soc_component *component, int bit)
+ AK4458_00_CONTROL1,
+ AK4458_RSTN_MASK,
+ 0x0);
+- return ret;
++ if (ret < 0)
++ return ret;
++
++ return 0;
+ }
+
+ static int ak4458_hw_params(struct snd_pcm_substream *substream,
+--
+2.20.1
+
--- /dev/null
+From b09972750d68a9cb42dc20343543210c96220f27 Mon Sep 17 00:00:00 2001
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Date: Fri, 7 Jun 2019 22:07:06 -0700
+Subject: ASoC: core: Fix deadlock in snd_soc_instantiate_card()
+
+[ Upstream commit 495f926c68ddb905a7a0192963096138c6a934e1 ]
+
+Move the client_mutex lock to snd_soc_unbind_card() before
+removing link components. This prevents the deadlock
+in the error path in snd_soc_instantiate_card().
+
+Fixes: 34ac3c3eb8 (ASoC: core: lock client_mutex while removing
+link components)
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 9df3bdeb5c47..c010cc864cf3 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1008,14 +1008,12 @@ static void soc_remove_link_components(struct snd_soc_card *card,
+ struct snd_soc_component *component;
+ struct snd_soc_rtdcom_list *rtdcom;
+
+- mutex_lock(&client_mutex);
+ for_each_rtdcom(rtd, rtdcom) {
+ component = rtdcom->component;
+
+ if (component->driver->remove_order == order)
+ soc_remove_component(component);
+ }
+- mutex_unlock(&client_mutex);
+ }
+
+ static void soc_remove_dai_links(struct snd_soc_card *card)
+@@ -2836,12 +2834,14 @@ static void snd_soc_unbind_card(struct snd_soc_card *card, bool unregister)
+ snd_soc_dapm_shutdown(card);
+ snd_soc_flush_all_delayed_work(card);
+
++ mutex_lock(&client_mutex);
+ /* remove all components used by DAI links on this card */
+ for_each_comp_order(order) {
+ for_each_card_rtds(card, rtd) {
+ soc_remove_link_components(card, rtd, order);
+ }
+ }
++ mutex_unlock(&client_mutex);
+
+ soc_cleanup_card_resources(card);
+ if (!unregister)
+--
+2.20.1
+
--- /dev/null
+From 3a43ae531379fd6386f7241e30f48596f6c406d5 Mon Sep 17 00:00:00 2001
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Date: Thu, 23 May 2019 10:12:01 -0700
+Subject: ASoC: core: lock client_mutex while removing link components
+
+[ Upstream commit 34ac3c3eb8f0c07252ceddf0a22dd240e5c91ccb ]
+
+Removing link components results in topology unloading. So,
+acquire the client_mutex before removing components in
+soc_remove_link_components. This will prevent the lockdep warning
+seen when dai links are removed during topology removal.
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index a7b4fab92f26..a4668a788ed5 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1008,12 +1008,14 @@ static void soc_remove_link_components(struct snd_soc_card *card,
+ struct snd_soc_component *component;
+ struct snd_soc_rtdcom_list *rtdcom;
+
++ mutex_lock(&client_mutex);
+ for_each_rtdcom(rtd, rtdcom) {
+ component = rtdcom->component;
+
+ if (component->driver->remove_order == order)
+ soc_remove_component(component);
+ }
++ mutex_unlock(&client_mutex);
+ }
+
+ static void soc_remove_dai_links(struct snd_soc_card *card)
+--
+2.20.1
+
--- /dev/null
+From da12cfdca11a9f6a11e2a2064e66e49988e6a918 Mon Sep 17 00:00:00 2001
+From: Tzung-Bi Shih <tzungbi@google.com>
+Date: Tue, 4 Jun 2019 11:31:02 +0800
+Subject: ASoC: core: move DAI pre-links initiation to snd_soc_instantiate_card
+
+[ Upstream commit 70fc53734e71ce51f46dfcfd1a1c319e1cfe080c ]
+
+Kernel crashes when an ASoC component rebinding.
+
+The dai_link->platforms has been reset to NULL by soc_cleanup_platform()
+in soc_cleanup_card_resources() when un-registering component. However,
+it has no chance to re-allocate the dai_link->platforms when registering
+the component again.
+
+Move the DAI pre-links initiation from snd_soc_register_card() to
+snd_soc_instantiate_card() to make sure all DAI pre-links get initiated
+when component rebinding.
+
+As an example, by using the following commands:
+- echo -n max98357a > /sys/bus/platform/drivers/max98357a/unbind
+- echo -n max98357a > /sys/bus/platform/drivers/max98357a/bind
+
+Got the error message:
+"Unable to handle kernel NULL pointer dereference at virtual address".
+
+The call trace:
+snd_soc_is_matching_component+0x30/0x6c
+soc_bind_dai_link+0x16c/0x240
+snd_soc_bind_card+0x1e4/0xb10
+snd_soc_add_component+0x270/0x300
+snd_soc_register_component+0x54/0x6c
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 27 ++++++++++-----------------
+ 1 file changed, 10 insertions(+), 17 deletions(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index a4668a788ed5..9df3bdeb5c47 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2069,6 +2069,16 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
+ int ret, i, order;
+
+ mutex_lock(&client_mutex);
++ for_each_card_prelinks(card, i, dai_link) {
++ ret = soc_init_dai_link(card, dai_link);
++ if (ret) {
++ soc_cleanup_platform(card);
++ dev_err(card->dev, "ASoC: failed to init link %s: %d\n",
++ dai_link->name, ret);
++ mutex_unlock(&client_mutex);
++ return ret;
++ }
++ }
+ mutex_lock_nested(&card->mutex, SND_SOC_CARD_CLASS_INIT);
+
+ card->dapm.bias_level = SND_SOC_BIAS_OFF;
+@@ -2793,26 +2803,9 @@ static int snd_soc_bind_card(struct snd_soc_card *card)
+ */
+ int snd_soc_register_card(struct snd_soc_card *card)
+ {
+- int i, ret;
+- struct snd_soc_dai_link *link;
+-
+ if (!card->name || !card->dev)
+ return -EINVAL;
+
+- mutex_lock(&client_mutex);
+- for_each_card_prelinks(card, i, link) {
+-
+- ret = soc_init_dai_link(card, link);
+- if (ret) {
+- soc_cleanup_platform(card);
+- dev_err(card->dev, "ASoC: failed to init link %s\n",
+- link->name);
+- mutex_unlock(&client_mutex);
+- return ret;
+- }
+- }
+- mutex_unlock(&client_mutex);
+-
+ dev_set_drvdata(card->dev, card);
+
+ snd_soc_initialize_card_lists(card);
+--
+2.20.1
+
--- /dev/null
+From 073a689586aef2a986ff5f12c0271d5751fcd164 Mon Sep 17 00:00:00 2001
+From: Matt Flax <flatmax@flatmax.org>
+Date: Wed, 8 May 2019 16:33:13 +1000
+Subject: ASoC : cs4265 : readable register too low
+
+[ Upstream commit f3df05c805983427319eddc2411a2105ee1757cf ]
+
+The cs4265_readable_register function stopped short of the maximum
+register.
+
+An example bug is taken from :
+https://github.com/Audio-Injector/Ultra/issues/25
+
+Where alsactl store fails with :
+Cannot read control '2,0,0,C Data Buffer,0': Input/output error
+
+This patch fixes the bug by setting the cs4265 to have readable
+registers up to the maximum hardware register CS4265_MAX_REGISTER.
+
+Signed-off-by: Matt Flax <flatmax@flatmax.org>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4265.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
+index ab27d2b94d02..c0190ec59e74 100644
+--- a/sound/soc/codecs/cs4265.c
++++ b/sound/soc/codecs/cs4265.c
+@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = {
+ static bool cs4265_readable_register(struct device *dev, unsigned int reg)
+ {
+ switch (reg) {
+- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2:
++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER:
+ return true;
+ default:
+ return false;
+--
+2.20.1
+
--- /dev/null
+From ed7fa1d421a7edafeee8dd8b8401651982e1d5b2 Mon Sep 17 00:00:00 2001
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Date: Fri, 31 May 2019 09:01:37 -0700
+Subject: ASoC: hda: fix unbalanced codec dev refcount for HDA_DEV_ASOC
+
+[ Upstream commit d6947bb234dcc86e878d502516d0fb9d635aa2ae ]
+
+HDA_DEV_ASOC type codec device refcounts are managed differently
+from HDA_DEV_LEGACY devices. The refcount is released explicitly
+in snd_hdac_ext_bus_device_remove() for ASOC type devices.
+So, remove the put_device() call in snd_hda_codec_dev_free()
+for such devices to make the refcount balanced. This will prevent
+the NULL pointer exception when the codec driver is released
+after the card is freed.
+
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_codec.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index b20eb7fc83eb..fcdf2cd3783b 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -840,7 +840,14 @@ static int snd_hda_codec_dev_free(struct snd_device *device)
+ if (codec->core.type == HDA_DEV_LEGACY)
+ snd_hdac_device_unregister(&codec->core);
+ codec_display_power(codec, false);
+- put_device(hda_codec_dev(codec));
++
++ /*
++ * In the case of ASoC HD-audio bus, the device refcount is released in
++ * snd_hdac_ext_bus_device_remove() explicitly.
++ */
++ if (codec->core.type == HDA_DEV_LEGACY)
++ put_device(hda_codec_dev(codec));
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 01aba57e5d2159d431d9999efc2161b8a1043ece Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Kov=C3=A1cs=20Tam=C3=A1s?= <kepszlok@zohomail.eu>
+Date: Fri, 31 May 2019 19:22:26 +0200
+Subject: ASoC: Intel: Baytrail: add quirk for Aegex 10 (RU2) tablet
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 3e951e7914408aee196db77a5cb377801c85692a ]
+
+This tablet has an incorrect acpi identifier just like
+Thinkpad10 tablet, which is why it is trying to load the RT5640 driver
+instead of the RT5762 driver. The RT5640 driver, on the other hand, checks
+the hardware ID, so no driver are loaded during boot. This fix resolves to
+load the RT5672 driver on this tablet during boot. It also provides the
+correct IO configuration, like the jack detect mode 3, for 1.8V pullup. I
+would like to thank Pierre-Louis Bossart for helping with this patch.
+
+Signed-off-by: Kovács Tamás <kepszlok@zohomail.eu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5670.c | 12 ++++++++++++
+ .../soc/intel/common/soc-acpi-intel-byt-match.c | 17 +++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
+index 9a037108b1ae..a746e11ccfe3 100644
+--- a/sound/soc/codecs/rt5670.c
++++ b/sound/soc/codecs/rt5670.c
+@@ -2882,6 +2882,18 @@ static const struct dmi_system_id dmi_platform_intel_quirks[] = {
+ RT5670_DEV_GPIO |
+ RT5670_JD_MODE3),
+ },
++ {
++ .callback = rt5670_quirk_cb,
++ .ident = "Aegex 10 tablet (RU2)",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "AEGEX"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "RU2"),
++ },
++ .driver_data = (unsigned long *)(RT5670_DMIC_EN |
++ RT5670_DMIC2_INR |
++ RT5670_DEV_GPIO |
++ RT5670_JD_MODE3),
++ },
+ {}
+ };
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-byt-match.c b/sound/soc/intel/common/soc-acpi-intel-byt-match.c
+index fe812a909db4..3a37f4eca437 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-byt-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-byt-match.c
+@@ -22,6 +22,7 @@ static unsigned long byt_machine_id;
+
+ #define BYT_THINKPAD_10 1
+ #define BYT_POV_P1006W 2
++#define BYT_AEGEX_10 3
+
+ static int byt_thinkpad10_quirk_cb(const struct dmi_system_id *id)
+ {
+@@ -35,6 +36,12 @@ static int byt_pov_p1006w_quirk_cb(const struct dmi_system_id *id)
+ return 1;
+ }
+
++static int byt_aegex10_quirk_cb(const struct dmi_system_id *id)
++{
++ byt_machine_id = BYT_AEGEX_10;
++ return 1;
++}
++
+ static const struct dmi_system_id byt_table[] = {
+ {
+ .callback = byt_thinkpad10_quirk_cb,
+@@ -75,9 +82,18 @@ static const struct dmi_system_id byt_table[] = {
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "0E57"),
+ },
+ },
++ {
++ /* Aegex 10 tablet (RU2) */
++ .callback = byt_aegex10_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "AEGEX"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "RU2"),
++ },
++ },
+ { }
+ };
+
++/* The Thinkapd 10 and Aegex 10 tablets have the same ID problem */
+ static struct snd_soc_acpi_mach byt_thinkpad_10 = {
+ .id = "10EC5640",
+ .drv_name = "cht-bsw-rt5672",
+@@ -104,6 +120,7 @@ static struct snd_soc_acpi_mach *byt_quirk(void *arg)
+
+ switch (byt_machine_id) {
+ case BYT_THINKPAD_10:
++ case BYT_AEGEX_10:
+ return &byt_thinkpad_10;
+ case BYT_POV_P1006W:
+ return &byt_pov_p1006w;
+--
+2.20.1
+
--- /dev/null
+From daeb20d3cfe38568411351983fb734d6c6b340a4 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Tue, 4 Jun 2019 15:08:56 -0500
+Subject: ASoC: Intel: bytcht_es8316: fix kernel oops with platform_name
+ override
+
+[ Upstream commit 79136a016add1acb690fe8d96be50dd22a143d26 ]
+
+The platform override code uses devm_ functions to allocate memory for
+the new name but the card device is not initialized. Fix by moving the
+init earlier.
+
+Fixes: e4bc6b1195f64 ("ASoC: Intel: bytcht_es8316: platform name fixup support")
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index d2a7e6ba11ae..1c686f83220a 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -471,6 +471,7 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+ }
+
+ /* override plaform name, if required */
++ byt_cht_es8316_card.dev = dev;
+ platform_name = mach->mach_params.platform;
+
+ ret = snd_soc_fixup_dai_links_platform_name(&byt_cht_es8316_card,
+@@ -538,7 +539,6 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+ (quirk & BYT_CHT_ES8316_MONO_SPEAKER) ? "mono" : "stereo",
+ mic_name[BYT_CHT_ES8316_MAP(quirk)]);
+ byt_cht_es8316_card.long_name = long_name;
+- byt_cht_es8316_card.dev = dev;
+ snd_soc_card_set_drvdata(&byt_cht_es8316_card, priv);
+
+ ret = devm_snd_soc_register_card(dev, &byt_cht_es8316_card);
+--
+2.20.1
+
--- /dev/null
+From ce6786b98ef6cd13214fc37da73c2d86459209a0 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Tue, 4 Jun 2019 15:08:55 -0500
+Subject: ASoC: Intel: cht_bsw_max98090: fix kernel oops with platform_name
+ override
+
+[ Upstream commit fb54555134b9b17835545e4d096b5550c27eed64 ]
+
+The platform override code uses devm_ functions to allocate memory for
+the new name but the card device is not initialized. Fix by moving the
+init earlier.
+
+Fixes: 7e7e24d7c7ff0 ("ASoC: Intel: cht_bsw_max98090_ti: platform name fixup support")
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/cht_bsw_max98090_ti.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+index c0e0844f75b9..572e336ae0f9 100644
+--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+@@ -454,6 +454,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ }
+
+ /* override plaform name, if required */
++ snd_soc_card_cht.dev = &pdev->dev;
+ mach = (&pdev->dev)->platform_data;
+ platform_name = mach->mach_params.platform;
+
+@@ -463,7 +464,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ return ret_val;
+
+ /* register the soc card */
+- snd_soc_card_cht.dev = &pdev->dev;
+ snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
+
+ if (drv->quirks & QUIRK_PMC_PLT_CLK_0)
+--
+2.20.1
+
--- /dev/null
+From 6e495d823216a9c1fe658356c33be902c84a5604 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Tue, 4 Jun 2019 15:08:57 -0500
+Subject: ASoC: Intel: cht_bsw_nau8824: fix kernel oops with platform_name
+ override
+
+[ Upstream commit 096701e8131425044d2054a0c210d6ea24ee7386 ]
+
+The platform override code uses devm_ functions to allocate memory for
+the new name but the card device is not initialized. Fix by moving the
+init earlier.
+
+Fixes: 4506db8043341 ("ASoC: Intel: cht_bsw_nau8824: platform name fixup support")
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/cht_bsw_nau8824.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/cht_bsw_nau8824.c b/sound/soc/intel/boards/cht_bsw_nau8824.c
+index 02c2fa239331..20fae391c75a 100644
+--- a/sound/soc/intel/boards/cht_bsw_nau8824.c
++++ b/sound/soc/intel/boards/cht_bsw_nau8824.c
+@@ -257,6 +257,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
+
+ /* override plaform name, if required */
++ snd_soc_card_cht.dev = &pdev->dev;
+ mach = (&pdev->dev)->platform_data;
+ platform_name = mach->mach_params.platform;
+
+@@ -266,7 +267,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ return ret_val;
+
+ /* register the soc card */
+- snd_soc_card_cht.dev = &pdev->dev;
+ ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht);
+ if (ret_val) {
+ dev_err(&pdev->dev,
+--
+2.20.1
+
--- /dev/null
+From a7f136a0d7c51f3c36b30bd77122b545b3cc99ad Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Tue, 4 Jun 2019 15:08:58 -0500
+Subject: ASoC: Intel: cht_bsw_rt5672: fix kernel oops with platform_name
+ override
+
+[ Upstream commit 9bbc799318a34061703f2a980e2b6df7fc6760f0 ]
+
+The platform override code uses devm_ functions to allocate memory for
+the new name but the card device is not initialized. Fix by moving the
+init earlier.
+
+Fixes: f403906da05cd ("ASoC: Intel: cht_bsw_rt5672: platform name fixup support")
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/cht_bsw_rt5672.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/cht_bsw_rt5672.c b/sound/soc/intel/boards/cht_bsw_rt5672.c
+index 3d5a2b3a06f0..87ce3857376d 100644
+--- a/sound/soc/intel/boards/cht_bsw_rt5672.c
++++ b/sound/soc/intel/boards/cht_bsw_rt5672.c
+@@ -425,6 +425,7 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ }
+
+ /* override plaform name, if required */
++ snd_soc_card_cht.dev = &pdev->dev;
+ platform_name = mach->mach_params.platform;
+
+ ret_val = snd_soc_fixup_dai_links_platform_name(&snd_soc_card_cht,
+@@ -442,7 +443,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
+ snd_soc_card_set_drvdata(&snd_soc_card_cht, drv);
+
+ /* register the soc card */
+- snd_soc_card_cht.dev = &pdev->dev;
+ ret_val = devm_snd_soc_register_card(&pdev->dev, &snd_soc_card_cht);
+ if (ret_val) {
+ dev_err(&pdev->dev,
+--
+2.20.1
+
--- /dev/null
+From f1e1d5b1e6a89115a6e3ef8d5b4096022e13f749 Mon Sep 17 00:00:00 2001
+From: Alex Levin <levinale@chromium.org>
+Date: Fri, 7 Jun 2019 15:19:11 -0700
+Subject: ASoC: Intel: sst: fix kmalloc call with wrong flags
+
+[ Upstream commit 3da428ff2aa5a5191ba2f1630eea75f03242f3f2 ]
+
+When calling kmalloc with GFP_KERNEL in case CONFIG_SLOB is unset,
+kmem_cache_alloc_trace is called.
+
+In case CONFIG_TRACING is set, kmem_cache_alloc_trace will ball
+slab_alloc, which will call slab_pre_alloc_hook which might_sleep_if.
+
+The context in which it is called in this case, the
+intel_sst_interrupt_mrfld, calling a sleeping kmalloc generates a BUG():
+
+Fixes: 972b0d456e64 ("ASoC: Intel: remove GFP_ATOMIC, use GFP_KERNEL")
+
+[ 20.250671] BUG: sleeping function called from invalid context at mm/slab.h:422
+[ 20.250683] in_atomic(): 1, irqs_disabled(): 1, pid: 1791, name: Chrome_IOThread
+[ 20.250690] CPU: 0 PID: 1791 Comm: Chrome_IOThread Tainted: G W 4.19.43 #61
+[ 20.250693] Hardware name: GOOGLE Kefka, BIOS Google_Kefka.7287.337.0 03/02/2017
+[ 20.250697] Call Trace:
+[ 20.250704] <IRQ>
+[ 20.250716] dump_stack+0x7e/0xc3
+[ 20.250725] ___might_sleep+0x12a/0x140
+[ 20.250731] kmem_cache_alloc_trace+0x53/0x1c5
+[ 20.250736] ? update_cfs_rq_load_avg+0x17e/0x1aa
+[ 20.250740] ? cpu_load_update+0x6c/0xc2
+[ 20.250746] sst_create_ipc_msg+0x2d/0x88
+[ 20.250752] intel_sst_interrupt_mrfld+0x12a/0x22c
+[ 20.250758] __handle_irq_event_percpu+0x133/0x228
+[ 20.250764] handle_irq_event_percpu+0x35/0x7a
+[ 20.250768] handle_irq_event+0x36/0x55
+[ 20.250773] handle_fasteoi_irq+0xab/0x16c
+[ 20.250779] handle_irq+0xd9/0x11e
+[ 20.250785] do_IRQ+0x54/0xe0
+[ 20.250791] common_interrupt+0xf/0xf
+[ 20.250795] </IRQ>
+[ 20.250800] RIP: 0010:__lru_cache_add+0x4e/0xad
+[ 20.250806] Code: 00 01 48 c7 c7 b8 df 01 00 65 48 03 3c 25 28 f1 00 00 48 8b 48 08 48 89 ca 48 ff ca f6 c1 01 48 0f 44 d0 f0 ff 42 34 0f b6 0f <89> ca fe c2 88 17 48 89 44 cf 08 80 fa 0f 74 0e 48 8b 08 66 85 c9
+[ 20.250809] RSP: 0000:ffffa568810bfd98 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd6
+[ 20.250814] RAX: ffffd3b904eb1940 RBX: ffffd3b904eb1940 RCX: 0000000000000004
+[ 20.250817] RDX: ffffd3b904eb1940 RSI: ffffa10ee5c47450 RDI: ffffa10efba1dfb8
+[ 20.250821] RBP: ffffa568810bfda8 R08: ffffa10ef9c741c1 R09: dead000000000100
+[ 20.250824] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa10ee8d52a40
+[ 20.250827] R13: ffffa10ee8d52000 R14: ffffa10ee5c47450 R15: 800000013ac65067
+[ 20.250835] lru_cache_add_active_or_unevictable+0x4e/0xb8
+[ 20.250841] handle_mm_fault+0xd98/0x10c4
+[ 20.250848] __do_page_fault+0x235/0x42d
+[ 20.250853] ? page_fault+0x8/0x30
+[ 20.250858] do_page_fault+0x3d/0x17a
+[ 20.250862] ? page_fault+0x8/0x30
+[ 20.250866] page_fault+0x1e/0x30
+[ 20.250872] RIP: 0033:0x7962fdea9304
+[ 20.250875] Code: 0f 11 4c 17 f0 c3 48 3b 15 f1 26 31 00 0f 83 e2 00 00 00 48 39 f7 72 0f 74 12 4c 8d 0c 16 4c 39 cf 0f 82 63 01 00 00 48 89 d1 <f3> a4 c3 80 fa 08 73 12 80 fa 04 73 1e 80 fa 01 77 26 72 05 0f b6
+[ 20.250879] RSP: 002b:00007962f4db5468 EFLAGS: 00010206
+[ 20.250883] RAX: 00003c8cc9d47008 RBX: 0000000000000000 RCX: 0000000000001b48
+[ 20.250886] RDX: 0000000000002b40 RSI: 00003c8cc9551000 RDI: 00003c8cc9d48000
+[ 20.250890] RBP: 00007962f4db5820 R08: 0000000000000000 R09: 00003c8cc9552b48
+[ 20.250893] R10: 0000562dd1064d30 R11: 00003c8cc825b908 R12: 00003c8cc966d3c0
+[ 20.250896] R13: 00003c8cc9e280c0 R14: 0000000000000000 R15: 0000000000000000
+
+Signed-off-by: Alex Levin <levinale@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/atom/sst/sst_pvt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/atom/sst/sst_pvt.c b/sound/soc/intel/atom/sst/sst_pvt.c
+index 00a37a09dc9b..dba0ca07ebf9 100644
+--- a/sound/soc/intel/atom/sst/sst_pvt.c
++++ b/sound/soc/intel/atom/sst/sst_pvt.c
+@@ -166,11 +166,11 @@ int sst_create_ipc_msg(struct ipc_post **arg, bool large)
+ {
+ struct ipc_post *msg;
+
+- msg = kzalloc(sizeof(*msg), GFP_KERNEL);
++ msg = kzalloc(sizeof(*msg), GFP_ATOMIC);
+ if (!msg)
+ return -ENOMEM;
+ if (large) {
+- msg->mailbox_data = kzalloc(SST_MAILBOX_SIZE, GFP_KERNEL);
++ msg->mailbox_data = kzalloc(SST_MAILBOX_SIZE, GFP_ATOMIC);
+ if (!msg->mailbox_data) {
+ kfree(msg);
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 767e347d968f956247956b3893833b34a09e4637 Mon Sep 17 00:00:00 2001
+From: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Date: Tue, 4 Jun 2019 18:49:09 +0800
+Subject: ASoC: max98090: remove 24-bit format support if RJ is 0
+
+[ Upstream commit 5628c8979642a076f91ee86c3bae5ad251639af0 ]
+
+The supported formats are S16_LE and S24_LE now. However, by datasheet
+of max98090, S24_LE is only supported when it is in the right justified
+mode. We should remove 24-bit format if it is not in that mode to avoid
+triggering error.
+
+Signed-off-by: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98090.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 7619ea31ab50..ada8c25e643d 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1909,6 +1909,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090,
+ return 0;
+ }
+
++static int max98090_dai_startup(struct snd_pcm_substream *substream,
++ struct snd_soc_dai *dai)
++{
++ struct snd_soc_component *component = dai->component;
++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component);
++ unsigned int fmt = max98090->dai_fmt;
++
++ /* Remove 24-bit format support if it is not in right justified mode. */
++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) {
++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16);
++ }
++ return 0;
++}
++
+ static int max98090_dai_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params,
+ struct snd_soc_dai *dai)
+@@ -2316,6 +2331,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect);
+ #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+ static const struct snd_soc_dai_ops max98090_dai_ops = {
++ .startup = max98090_dai_startup,
+ .set_sysclk = max98090_dai_set_sysclk,
+ .set_fmt = max98090_dai_set_fmt,
+ .set_tdm_slot = max98090_set_tdm_slot,
+--
+2.20.1
+
--- /dev/null
+From d9244276dae0813c0391c43c0798ae792bb94915 Mon Sep 17 00:00:00 2001
+From: Libin Yang <libin.yang@intel.com>
+Date: Wed, 8 May 2019 10:32:41 +0800
+Subject: ASoC: soc-pcm: BE dai needs prepare when pause release after resume
+
+[ Upstream commit 5087a8f17df868601cd7568299e91c28086d2b45 ]
+
+If playback/capture is paused and system enters S3, after system returns
+from suspend, BE dai needs to call prepare() callback when playback/capture
+is released from pause if RESUME_INFO flag is not set.
+
+Currently, the dpcm_be_dai_prepare() function will block calling prepare()
+if the pcm is in SND_SOC_DPCM_STATE_PAUSED state. This will cause the
+following test case fail if the pcm uses BE:
+
+playback -> pause -> S3 suspend -> S3 resume -> pause release
+
+The playback may exit abnormally when pause is released because the BE dai
+prepare() is not called.
+
+This patch allows dpcm_be_dai_prepare() to call dai prepare() callback in
+SND_SOC_DPCM_STATE_PAUSED state.
+
+Signed-off-by: Libin Yang <libin.yang@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index be80a12fba27..2a3aacec8057 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2469,7 +2469,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
+
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) &&
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
+ continue;
+
+ dev_dbg(be->dev, "ASoC: prepare BE %s\n",
+--
+2.20.1
+
--- /dev/null
+From d299c1d26fcf78fba75777d8476370e62c9ea9bf Mon Sep 17 00:00:00 2001
+From: Marcus Cooper <codekipper@gmail.com>
+Date: Mon, 3 Jun 2019 19:47:28 +0200
+Subject: ASoC: sun4i-i2s: Add offset to RX channel select
+
+[ Upstream commit f9927000cb35f250051f0f1878db12ee2626eea1 ]
+
+Whilst testing the capture functionality of the i2s on the newer
+SoCs it was noticed that the recording was somewhat distorted.
+This was due to the offset not being set correctly on the receiver
+side.
+
+Signed-off-by: Marcus Cooper <codekipper@gmail.com>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index 8162e107e50b..bc128e2a6096 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -460,6 +460,10 @@ static int sun4i_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ regmap_update_bits(i2s->regmap, SUN8I_I2S_TX_CHAN_SEL_REG,
+ SUN8I_I2S_TX_CHAN_OFFSET_MASK,
+ SUN8I_I2S_TX_CHAN_OFFSET(offset));
++
++ regmap_update_bits(i2s->regmap, SUN8I_I2S_RX_CHAN_SEL_REG,
++ SUN8I_I2S_TX_CHAN_OFFSET_MASK,
++ SUN8I_I2S_TX_CHAN_OFFSET(offset));
+ }
+
+ regmap_field_write(i2s->field_fmt_mode, val);
+--
+2.20.1
+
--- /dev/null
+From 110781dddb7d665efd3581b9a2f261e3eef18c0e Mon Sep 17 00:00:00 2001
+From: Marcus Cooper <codekipper@gmail.com>
+Date: Mon, 3 Jun 2019 19:47:27 +0200
+Subject: ASoC: sun4i-i2s: Fix sun8i tx channel offset mask
+
+[ Upstream commit 7e46169a5f35762f335898a75d1b8a242f2ae0f5 ]
+
+Although not causing any noticeable issues, the mask for the
+channel offset is covering too many bits.
+
+Signed-off-by: Marcus Cooper <codekipper@gmail.com>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index d5ec1a20499d..8162e107e50b 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -110,7 +110,7 @@
+
+ #define SUN8I_I2S_TX_CHAN_MAP_REG 0x44
+ #define SUN8I_I2S_TX_CHAN_SEL_REG 0x34
+-#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 11)
++#define SUN8I_I2S_TX_CHAN_OFFSET_MASK GENMASK(13, 12)
+ #define SUN8I_I2S_TX_CHAN_OFFSET(offset) (offset << 12)
+ #define SUN8I_I2S_TX_CHAN_EN_MASK GENMASK(11, 4)
+ #define SUN8I_I2S_TX_CHAN_EN(num_chan) (((1 << num_chan) - 1) << 4)
+--
+2.20.1
+
--- /dev/null
+From 07fa85e9c92fbf9bfb598b7be513c5645167901e Mon Sep 17 00:00:00 2001
+From: Joel Savitz <jsavitz@redhat.com>
+Date: Wed, 12 Jun 2019 11:50:48 -0400
+Subject: cpuset: restore sanity to cpuset_cpus_allowed_fallback()
+
+[ Upstream commit d477f8c202d1f0d4791ab1263ca7657bbe5cf79e ]
+
+In the case that a process is constrained by taskset(1) (i.e.
+sched_setaffinity(2)) to a subset of available cpus, and all of those are
+subsequently offlined, the scheduler will set tsk->cpus_allowed to
+the current value of task_cs(tsk)->effective_cpus.
+
+This is done via a call to do_set_cpus_allowed() in the context of
+cpuset_cpus_allowed_fallback() made by the scheduler when this case is
+detected. This is the only call made to cpuset_cpus_allowed_fallback()
+in the latest mainline kernel.
+
+However, this is not sane behavior.
+
+I will demonstrate this on a system running the latest upstream kernel
+with the following initial configuration:
+
+ # grep -i cpu /proc/$$/status
+ Cpus_allowed: ffffffff,fffffff
+ Cpus_allowed_list: 0-63
+
+(Where cpus 32-63 are provided via smt.)
+
+If we limit our current shell process to cpu2 only and then offline it
+and reonline it:
+
+ # taskset -p 4 $$
+ pid 2272's current affinity mask: ffffffffffffffff
+ pid 2272's new affinity mask: 4
+
+ # echo off > /sys/devices/system/cpu/cpu2/online
+ # dmesg | tail -3
+ [ 2195.866089] process 2272 (bash) no longer affine to cpu2
+ [ 2195.872700] IRQ 114: no longer affine to CPU2
+ [ 2195.879128] smpboot: CPU 2 is now offline
+
+ # echo on > /sys/devices/system/cpu/cpu2/online
+ # dmesg | tail -1
+ [ 2617.043572] smpboot: Booting Node 0 Processor 2 APIC 0x4
+
+We see that our current process now has an affinity mask containing
+every cpu available on the system _except_ the one we originally
+constrained it to:
+
+ # grep -i cpu /proc/$$/status
+ Cpus_allowed: ffffffff,fffffffb
+ Cpus_allowed_list: 0-1,3-63
+
+This is not sane behavior, as the scheduler can now not only place the
+process on previously forbidden cpus, it can't even schedule it on
+the cpu it was originally constrained to!
+
+Other cases result in even more exotic affinity masks. Take for instance
+a process with an affinity mask containing only cpus provided by smt at
+the moment that smt is toggled, in a configuration such as the following:
+
+ # taskset -p f000000000 $$
+ # grep -i cpu /proc/$$/status
+ Cpus_allowed: 000000f0,00000000
+ Cpus_allowed_list: 36-39
+
+A double toggle of smt results in the following behavior:
+
+ # echo off > /sys/devices/system/cpu/smt/control
+ # echo on > /sys/devices/system/cpu/smt/control
+ # grep -i cpus /proc/$$/status
+ Cpus_allowed: ffffff00,ffffffff
+ Cpus_allowed_list: 0-31,40-63
+
+This is even less sane than the previous case, as the new affinity mask
+excludes all smt-provided cpus with ids less than those that were
+previously in the affinity mask, as well as those that were actually in
+the mask.
+
+With this patch applied, both of these cases end in the following state:
+
+ # grep -i cpu /proc/$$/status
+ Cpus_allowed: ffffffff,ffffffff
+ Cpus_allowed_list: 0-63
+
+The original policy is discarded. Though not ideal, it is the simplest way
+to restore sanity to this fallback case without reinventing the cpuset
+wheel that rolls down the kernel just fine in cgroup v2. A user who wishes
+for the previous affinity mask to be restored in this fallback case can use
+that mechanism instead.
+
+This patch modifies scheduler behavior by instead resetting the mask to
+task_cs(tsk)->cpus_allowed by default, and cpu_possible mask in legacy
+mode. I tested the cases above on both modes.
+
+Note that the scheduler uses this fallback mechanism if and only if
+_every_ other valid avenue has been traveled, and it is the last resort
+before calling BUG().
+
+Suggested-by: Waiman Long <longman@redhat.com>
+Suggested-by: Phil Auld <pauld@redhat.com>
+Signed-off-by: Joel Savitz <jsavitz@redhat.com>
+Acked-by: Phil Auld <pauld@redhat.com>
+Acked-by: Waiman Long <longman@redhat.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 4834c4214e9c..6c9deb2cc687 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -3255,10 +3255,23 @@ void cpuset_cpus_allowed(struct task_struct *tsk, struct cpumask *pmask)
+ spin_unlock_irqrestore(&callback_lock, flags);
+ }
+
++/**
++ * cpuset_cpus_allowed_fallback - final fallback before complete catastrophe.
++ * @tsk: pointer to task_struct with which the scheduler is struggling
++ *
++ * Description: In the case that the scheduler cannot find an allowed cpu in
++ * tsk->cpus_allowed, we fall back to task_cs(tsk)->cpus_allowed. In legacy
++ * mode however, this value is the same as task_cs(tsk)->effective_cpus,
++ * which will not contain a sane cpumask during cases such as cpu hotplugging.
++ * This is the absolute last resort for the scheduler and it is only used if
++ * _every_ other avenue has been traveled.
++ **/
++
+ void cpuset_cpus_allowed_fallback(struct task_struct *tsk)
+ {
+ rcu_read_lock();
+- do_set_cpus_allowed(tsk, task_cs(tsk)->effective_cpus);
++ do_set_cpus_allowed(tsk, is_in_v2_mode() ?
++ task_cs(tsk)->cpus_allowed : cpu_possible_mask);
+ rcu_read_unlock();
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From c69da6945276b842428b3ba1be14cfad09de223e Mon Sep 17 00:00:00 2001
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+Date: Wed, 29 May 2019 18:25:54 +0800
+Subject: drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
+
+[ Upstream commit cf49b24ffa62766f8f04cd1c4cf17b75d29b240a ]
+
+shutdown all CRTC when unbinding drm driver.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index e7362bdafa82..8718d123ccaa 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -311,6 +311,7 @@ err_config_cleanup:
+ static void mtk_drm_kms_deinit(struct drm_device *drm)
+ {
+ drm_kms_helper_poll_fini(drm);
++ drm_atomic_helper_shutdown(drm);
+
+ component_unbind_all(drm->dev, drm);
+ drm_mode_config_cleanup(drm);
+--
+2.20.1
+
--- /dev/null
+From 28a4f2975ea5685837105d0c1219a4c62b31f298 Mon Sep 17 00:00:00 2001
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+Date: Thu, 30 May 2019 17:18:47 +0800
+Subject: drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
+
+[ Upstream commit 2458d9d6d94be982b917e93c61a89b4426f32e31 ]
+
+mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), which
+needs ovl irq for drm_crtc_wait_one_vblank(), since after mtk_dsi_stop() is
+called, ovl irq will be disabled. If drm_crtc_wait_one_vblank() is called
+after last irq, it will timeout with this message: "vblank wait timed out
+on crtc 0". This happens sometimes when turning off the screen.
+
+In drm_atomic_helper.c#disable_outputs(),
+the calling sequence when turning off the screen is:
+
+1. mtk_dsi_encoder_disable()
+ --> mtk_output_dsi_disable()
+ --> mtk_dsi_stop(); /* sometimes make vblank timeout in
+ atomic_disable */
+ --> mtk_dsi_poweroff();
+2. mtk_drm_crtc_atomic_disable()
+ --> drm_crtc_wait_one_vblank();
+ ...
+ --> mtk_dsi_ddp_stop()
+ --> mtk_dsi_poweroff();
+
+mtk_dsi_poweroff() has reference count design, change to make
+mtk_dsi_stop() called in mtk_dsi_poweroff() when refcount is 0.
+
+Fixes: 0707632b5bac ("drm/mediatek: update DSI sub driver flow for sending commands to panel")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 1ae3be99e0ff..179f2b080342 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -630,6 +630,15 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi)
+ if (--dsi->refcount != 0)
+ return;
+
++ /*
++ * mtk_dsi_stop() and mtk_dsi_start() is asymmetric, since
++ * mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(),
++ * which needs irq for vblank, and mtk_dsi_stop() will disable irq.
++ * mtk_dsi_start() needs to be called in mtk_output_dsi_enable(),
++ * after dsi is fully set.
++ */
++ mtk_dsi_stop(dsi);
++
+ if (!mtk_dsi_switch_to_cmd_mode(dsi, VM_DONE_INT_FLAG, 500)) {
+ if (dsi->panel) {
+ if (drm_panel_unprepare(dsi->panel)) {
+@@ -696,7 +705,6 @@ static void mtk_output_dsi_disable(struct mtk_dsi *dsi)
+ }
+ }
+
+- mtk_dsi_stop(dsi);
+ mtk_dsi_poweroff(dsi);
+
+ dsi->enabled = false;
+--
+2.20.1
+
--- /dev/null
+From 4d2db5b71cc98d9824764984dcc8f7c322e6ab4d Mon Sep 17 00:00:00 2001
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+Date: Wed, 29 May 2019 18:25:55 +0800
+Subject: drm/mediatek: clear num_pipes when unbind driver
+
+[ Upstream commit a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396 ]
+
+num_pipes is used for mutex created in mtk_drm_crtc_create(). If we
+don't clear num_pipes count, when rebinding driver, the count will
+be accumulated. From mtk_disp_mutex_get(), there can only be at most
+10 mutex id. Clear this number so it starts from 0 in every rebind.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index 8718d123ccaa..bbfe3a464aea 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -400,6 +400,7 @@ static void mtk_drm_unbind(struct device *dev)
+ drm_dev_unregister(private->drm);
+ mtk_drm_kms_deinit(private->drm);
+ drm_dev_put(private->drm);
++ private->num_pipes = 0;
+ private->drm = NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8ad796d1eb388f065172884fbaa36747394d0cde Mon Sep 17 00:00:00 2001
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+Date: Wed, 29 May 2019 18:25:52 +0800
+Subject: drm/mediatek: fix unbind functions
+
+[ Upstream commit 8fd7a37b191f93737f6280a9b5de65f98acc12c9 ]
+
+detatch panel in mtk_dsi_destroy_conn_enc(), since .bind will try to
+attach it again.
+
+Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index b00eb2d2e086..1ae3be99e0ff 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -844,6 +844,8 @@ static void mtk_dsi_destroy_conn_enc(struct mtk_dsi *dsi)
+ /* Skip connector cleanup if creation was delegated to the bridge */
+ if (dsi->conn.dev)
+ drm_connector_cleanup(&dsi->conn);
++ if (dsi->panel)
++ drm_panel_detach(dsi->panel);
+ }
+
+ static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp)
+--
+2.20.1
+
--- /dev/null
+From 2aa9618c9d9a21ceaa422c45a6f4bac395ff84b2 Mon Sep 17 00:00:00 2001
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+Date: Wed, 29 May 2019 18:25:53 +0800
+Subject: drm/mediatek: unbind components in mtk_drm_unbind()
+
+[ Upstream commit f0fd848342802bc0f74620d387eead53e8905804 ]
+
+Unbinding components (i.e. mtk_dsi and mtk_disp_ovl/rdma/color) will
+trigger master(mtk_drm)'s .unbind(), and currently mtk_drm's unbind
+won't actually unbind components. During the next bind,
+mtk_drm_kms_init() is called, and the components are added back.
+
+.unbind() should call mtk_drm_kms_deinit() to unbind components.
+
+And since component_master_del() in .remove() will trigger .unbind(),
+which will also unregister device, it's fine to remove original functions
+called here.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+index 57ce4708ef1b..e7362bdafa82 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -397,6 +397,7 @@ static void mtk_drm_unbind(struct device *dev)
+ struct mtk_drm_private *private = dev_get_drvdata(dev);
+
+ drm_dev_unregister(private->drm);
++ mtk_drm_kms_deinit(private->drm);
+ drm_dev_put(private->drm);
+ private->drm = NULL;
+ }
+@@ -568,13 +569,8 @@ err_node:
+ static int mtk_drm_remove(struct platform_device *pdev)
+ {
+ struct mtk_drm_private *private = platform_get_drvdata(pdev);
+- struct drm_device *drm = private->drm;
+ int i;
+
+- drm_dev_unregister(drm);
+- mtk_drm_kms_deinit(drm);
+- drm_dev_put(drm);
+-
+ component_master_del(&pdev->dev, &mtk_drm_ops);
+ pm_runtime_disable(&pdev->dev);
+ of_node_put(private->mutex_node);
+--
+2.20.1
+
--- /dev/null
+From 74d1b078b8b1465d15fde8e33fbe86eb6268bb36 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 24 May 2019 14:57:59 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for GPD MicroPC
+
+[ Upstream commit 652b8b086538c8a10de5aa5cbdaef79333b46358 ]
+
+GPD has done it again, make a nice device (good), use way too generic
+DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly).
+
+Because of the too generic DMI strings this entry is also doing bios-date
+matching, so the gpd_micropc data struct may very well need to be updated
+with some extra bios-dates in the future.
+
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190524125759.14131-2-hdegoede@redhat.com
+(cherry picked from commit f2f2bb60d998abde10de7e483ef9e17639892450)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 019f148d5a78..dd982563304d 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -42,6 +42,14 @@ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data gpd_micropc = {
++ .width = 720,
++ .height = 1280,
++ .bios_dates = (const char * const []){ "04/26/2019",
++ NULL },
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ .width = 1200,
+ .height = 1920,
+@@ -101,6 +109,14 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+ },
+ .driver_data = (void *)&asus_t100ha,
++ }, { /* GPD MicroPC (generic strings, also match on bios date) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++ },
++ .driver_data = (void *)&gpd_micropc,
+ }, { /*
+ * GPD Pocket, note that the the DMI data is less generic then
+ * it seems, devices with a board-vendor of "AMI Corporation"
+--
+2.20.1
+
--- /dev/null
+From 629c249ca3135d154c41d709e66f9d9ee8090fd5 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 24 May 2019 14:57:58 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for GPD pocket2
+
+[ Upstream commit 15abc7110a77555d3bf72aaef46d1557db0a4ac5 ]
+
+GPD has done it again, make a nice device (good), use way too generic
+DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly).
+
+Because of the too generic DMI strings this entry is also doing bios-date
+matching, so the gpd_pocket2 data struct may very well need to be updated
+with some extra bios-dates in the future.
+
+Changes in v2:
+-Add one more known BIOS date to the list of BIOS dates
+
+Cc: Jurgen Kramer <gtmkramer@xs4all.nl>
+Reported-by: Jurgen Kramer <gtmkramer@xs4all.nl>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190524125759.14131-1-hdegoede@redhat.com
+(cherry picked from commit 6dab9102dd7b144e5723915438e0d6c473018cd0)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index 52e445bb1aa5..019f148d5a78 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -50,6 +50,14 @@ static const struct drm_dmi_panel_orientation_data gpd_pocket = {
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data gpd_pocket2 = {
++ .width = 1200,
++ .height = 1920,
++ .bios_dates = (const char * const []){ "06/28/2018", "08/28/2018",
++ "12/07/2018", NULL },
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data gpd_win = {
+ .width = 720,
+ .height = 1280,
+@@ -106,6 +114,14 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_pocket,
++ }, { /* GPD Pocket 2 (generic strings, also match on bios date) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
++ },
++ .driver_data = (void *)&gpd_pocket2,
+ }, { /* GPD Win (same note on DMI match as GPD Pocket) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+--
+2.20.1
+
--- /dev/null
+From 9e8a3a69ea2e690d38cffbff77da364cadc64cd5 Mon Sep 17 00:00:00 2001
+From: Wei Li <liwei391@huawei.com>
+Date: Thu, 6 Jun 2019 11:17:54 +0800
+Subject: ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
+
+[ Upstream commit 04e03d9a616c19a47178eaca835358610e63a1dd ]
+
+The mapper may be NULL when called from register_ftrace_function_probe()
+with probe->data == NULL.
+
+This issue can be reproduced as follow (it may be covered by compiler
+optimization sometime):
+
+/ # cat /sys/kernel/debug/tracing/set_ftrace_filter
+#### all functions enabled ####
+/ # echo foo_bar:dump > /sys/kernel/debug/tracing/set_ftrace_filter
+[ 206.949100] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[ 206.952402] Mem abort info:
+[ 206.952819] ESR = 0x96000006
+[ 206.955326] Exception class = DABT (current EL), IL = 32 bits
+[ 206.955844] SET = 0, FnV = 0
+[ 206.956272] EA = 0, S1PTW = 0
+[ 206.956652] Data abort info:
+[ 206.957320] ISV = 0, ISS = 0x00000006
+[ 206.959271] CM = 0, WnR = 0
+[ 206.959938] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000419f3a000
+[ 206.960483] [0000000000000000] pgd=0000000411a87003, pud=0000000411a83003, pmd=0000000000000000
+[ 206.964953] Internal error: Oops: 96000006 [#1] SMP
+[ 206.971122] Dumping ftrace buffer:
+[ 206.973677] (ftrace buffer empty)
+[ 206.975258] Modules linked in:
+[ 206.976631] Process sh (pid: 281, stack limit = 0x(____ptrval____))
+[ 206.978449] CPU: 10 PID: 281 Comm: sh Not tainted 5.2.0-rc1+ #17
+[ 206.978955] Hardware name: linux,dummy-virt (DT)
+[ 206.979883] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 206.980499] pc : free_ftrace_func_mapper+0x2c/0x118
+[ 206.980874] lr : ftrace_count_free+0x68/0x80
+[ 206.982539] sp : ffff0000182f3ab0
+[ 206.983102] x29: ffff0000182f3ab0 x28: ffff8003d0ec1700
+[ 206.983632] x27: ffff000013054b40 x26: 0000000000000001
+[ 206.984000] x25: ffff00001385f000 x24: 0000000000000000
+[ 206.984394] x23: ffff000013453000 x22: ffff000013054000
+[ 206.984775] x21: 0000000000000000 x20: ffff00001385fe28
+[ 206.986575] x19: ffff000013872c30 x18: 0000000000000000
+[ 206.987111] x17: 0000000000000000 x16: 0000000000000000
+[ 206.987491] x15: ffffffffffffffb0 x14: 0000000000000000
+[ 206.987850] x13: 000000000017430e x12: 0000000000000580
+[ 206.988251] x11: 0000000000000000 x10: cccccccccccccccc
+[ 206.988740] x9 : 0000000000000000 x8 : ffff000013917550
+[ 206.990198] x7 : ffff000012fac2e8 x6 : ffff000012fac000
+[ 206.991008] x5 : ffff0000103da588 x4 : 0000000000000001
+[ 206.991395] x3 : 0000000000000001 x2 : ffff000013872a28
+[ 206.991771] x1 : 0000000000000000 x0 : 0000000000000000
+[ 206.992557] Call trace:
+[ 206.993101] free_ftrace_func_mapper+0x2c/0x118
+[ 206.994827] ftrace_count_free+0x68/0x80
+[ 206.995238] release_probe+0xfc/0x1d0
+[ 206.995555] register_ftrace_function_probe+0x4a8/0x868
+[ 206.995923] ftrace_trace_probe_callback.isra.4+0xb8/0x180
+[ 206.996330] ftrace_dump_callback+0x50/0x70
+[ 206.996663] ftrace_regex_write.isra.29+0x290/0x3a8
+[ 206.997157] ftrace_filter_write+0x44/0x60
+[ 206.998971] __vfs_write+0x64/0xf0
+[ 206.999285] vfs_write+0x14c/0x2f0
+[ 206.999591] ksys_write+0xbc/0x1b0
+[ 206.999888] __arm64_sys_write+0x3c/0x58
+[ 207.000246] el0_svc_common.constprop.0+0x408/0x5f0
+[ 207.000607] el0_svc_handler+0x144/0x1c8
+[ 207.000916] el0_svc+0x8/0xc
+[ 207.003699] Code: aa0003f8 a9025bf5 aa0103f5 f946ea80 (f9400303)
+[ 207.008388] ---[ end trace 7b6d11b5f542bdf1 ]---
+[ 207.010126] Kernel panic - not syncing: Fatal exception
+[ 207.011322] SMP: stopping secondary CPUs
+[ 207.013956] Dumping ftrace buffer:
+[ 207.014595] (ftrace buffer empty)
+[ 207.015632] Kernel Offset: disabled
+[ 207.017187] CPU features: 0x002,20006008
+[ 207.017985] Memory Limit: none
+[ 207.019825] ---[ end Kernel panic - not syncing: Fatal exception ]---
+
+Link: http://lkml.kernel.org/r/20190606031754.10798-1-liwei391@huawei.com
+
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 045e7f46a74a..2469d54b3e43 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4230,10 +4230,13 @@ void free_ftrace_func_mapper(struct ftrace_func_mapper *mapper,
+ struct ftrace_func_entry *entry;
+ struct ftrace_func_map *map;
+ struct hlist_head *hhd;
+- int size = 1 << mapper->hash.size_bits;
+- int i;
++ int size, i;
++
++ if (!mapper)
++ return;
+
+ if (free_func && mapper->hash.count) {
++ size = 1 << mapper->hash.size_bits;
+ for (i = 0; i < size; i++) {
+ hhd = &mapper->hash.buckets[i];
+ hlist_for_each_entry(entry, hhd, hlist) {
+--
+2.20.1
+
--- /dev/null
+From 040c08b8952ac619c0750ad17ca3138bf8148f89 Mon Sep 17 00:00:00 2001
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+Date: Tue, 4 Jun 2019 14:35:58 +0200
+Subject: gpio: pca953x: hack to fix 24 bit gpio expanders
+
+[ Upstream commit 3b00691cc46a4089368a008b30655a8343411715 ]
+
+24 bit expanders use REG_ADDR_AI in combination with register addressing. This
+conflicts with regmap which takes this bit as part of the register number,
+i.e. a second cache entry is defined for accessed with REG_ADDR_AI being
+set although on the chip it is the same register as with REG_ADDR_AI being
+cleared.
+
+The problem was introduced by
+
+ commit b32cecb46bdc ("gpio: pca953x: Extract the register address mangling to single function")
+
+but only became visible by
+
+ commit 8b9f9d4dc511 ("regmap: verify if register is writeable before writing operations")
+
+because before, the regmap size was effectively ignored and
+pca953x_writeable_register() did know to ignore REG_ADDR_AI. Still, there
+were two separate cache entries created.
+
+Since the use of REG_ADDR_AI seems to be static we can work around this
+issue by simply increasing the size of the regmap to cover the "virtual"
+registers with REG_ADDR_AI being set. This only means that half of the
+regmap buffer will be unused.
+
+Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
+Suggested-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index 7e76830b3368..b6f10e56dfa0 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -306,7 +306,8 @@ static const struct regmap_config pca953x_i2c_regmap = {
+ .volatile_reg = pca953x_volatile_register,
+
+ .cache_type = REGCACHE_RBTREE,
+- .max_register = 0x7f,
++ /* REVISIT: should be 0x7f but some 24 bit chips use REG_ADDR_AI */
++ .max_register = 0xff,
+ };
+
+ static u8 pca953x_recalc_addr(struct pca953x_chip *chip, int reg, int off,
+--
+2.20.1
+
--- /dev/null
+From 7dda87a8f7d9724b55446914f1ca1fc460945e14 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?B=C5=82a=C5=BCej=20Szczygie=C5=82?= <spaz16@wp.pl>
+Date: Sun, 12 May 2019 22:33:13 +0200
+Subject: HID: a4tech: fix horizontal scrolling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit abf82e8f7e9af40a49e3d905187c662a43c96c8f ]
+
+Since recent high resolution scrolling changes the A4Tech driver must
+check for the "REL_WHEEL_HI_RES" usage code.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=203369
+Fixes: 2dc702c991e3774af9d7ce410eef410ca9e2357e ("HID: input: use the Resolution Multiplier for high-resolution scrolling")
+Signed-off-by: Błażej Szczygieł <spaz16@wp.pl>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-a4tech.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
+index 9428ea7cdf8a..c3a6ce3613fe 100644
+--- a/drivers/hid/hid-a4tech.c
++++ b/drivers/hid/hid-a4tech.c
+@@ -38,8 +38,10 @@ static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ {
+ struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+
+- if (usage->type == EV_REL && usage->code == REL_WHEEL)
++ if (usage->type == EV_REL && usage->code == REL_WHEEL_HI_RES) {
+ set_bit(REL_HWHEEL, *bit);
++ set_bit(REL_HWHEEL_HI_RES, *bit);
++ }
+
+ if ((a4->quirks & A4_2WHEEL_MOUSE_HACK_7) && usage->hid == 0x00090007)
+ return -1;
+@@ -60,7 +62,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ input = field->hidinput->input;
+
+ if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8) {
+- if (usage->type == EV_REL && usage->code == REL_WHEEL) {
++ if (usage->type == EV_REL && usage->code == REL_WHEEL_HI_RES) {
+ a4->delayed_value = value;
+ return 1;
+ }
+@@ -68,6 +70,8 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ if (usage->hid == 0x000100b8) {
+ input_event(input, EV_REL, value ? REL_HWHEEL :
+ REL_WHEEL, a4->delayed_value);
++ input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES :
++ REL_WHEEL_HI_RES, a4->delayed_value * 120);
+ return 1;
+ }
+ }
+@@ -77,8 +81,9 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ return 1;
+ }
+
+- if (usage->code == REL_WHEEL && a4->hw_wheel) {
++ if (usage->code == REL_WHEEL_HI_RES && a4->hw_wheel) {
+ input_event(input, usage->type, REL_HWHEEL, value);
++ input_event(input, usage->type, REL_HWHEEL_HI_RES, value * 120);
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c9eaa1952cc4489049c5ecda3088ba7844a1c417 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Mon, 22 Apr 2019 14:57:04 +0800
+Subject: HID: i2c-hid: add iBall Aer3 to descriptor override
+
+[ Upstream commit eb6964fa6509b4f1152313f1e0bb67f0c54a6046 ]
+
+This device uses the SIPODEV SP1064 touchpad, which does not
+supply descriptors, so it has to be added to the override
+list.
+
+BugLink: https://bugs.launchpad.net/bugs/1825718
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index fd1b6eea6d2f..75078c83be1a 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -354,6 +354,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "iBall Aer3",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "iBall"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Aer3"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ { } /* Terminate list */
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 73cbda38ec24bffdd52aa072e8a6c8b009594017 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 30 May 2019 22:24:24 +0200
+Subject: i2c: pca-platform: Fix GPIO lookup code
+
+[ Upstream commit a0cac264a86fbf4d6cb201fbbb73c1d335e3248a ]
+
+The devm_gpiod_request_gpiod() call will add "-gpios" to
+any passed connection ID before looking it up.
+
+I do not think the reset GPIO on this platform is named
+"reset-gpios-gpios" but rather "reset-gpios" in the device
+tree, so fix this up so that we get a proper reset GPIO
+handle.
+
+Also drop the inclusion of the legacy GPIO header.
+
+Fixes: 0e8ce93bdceb ("i2c: pca-platform: add devicetree awareness")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-pca-platform.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
+index de3fe6e828cb..f50afa8e3cba 100644
+--- a/drivers/i2c/busses/i2c-pca-platform.c
++++ b/drivers/i2c/busses/i2c-pca-platform.c
+@@ -21,7 +21,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/i2c-algo-pca.h>
+ #include <linux/platform_data/i2c-pca-platform.h>
+-#include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/io.h>
+ #include <linux/of.h>
+@@ -173,7 +172,7 @@ static int i2c_pca_pf_probe(struct platform_device *pdev)
+ i2c->adap.dev.parent = &pdev->dev;
+ i2c->adap.dev.of_node = np;
+
+- i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset-gpios", GPIOD_OUT_LOW);
++ i2c->gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(i2c->gpio))
+ return PTR_ERR(i2c->gpio);
+
+--
+2.20.1
+
--- /dev/null
+From 5af6605cbc3297fb9670378f1a373b75bf3337d1 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Tue, 21 May 2019 15:30:16 +0800
+Subject: iommu/vt-d: Set the right field for Page Walk Snoop
+
+[ Upstream commit 66d78ad316b0e1ca5ae19663468554e2c0e31c26 ]
+
+Set the page walk snoop to the right bit, otherwise the domain
+id field will be overlapped.
+
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Fixes: 6f7db75e1c469 ("iommu/vt-d: Add second level page table interface")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-pasid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c
+index 03b12d2ee213..fdf05c45d516 100644
+--- a/drivers/iommu/intel-pasid.c
++++ b/drivers/iommu/intel-pasid.c
+@@ -387,7 +387,7 @@ static inline void pasid_set_present(struct pasid_entry *pe)
+ */
+ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value)
+ {
+- pasid_set_bits(&pe->val[1], 1 << 23, value);
++ pasid_set_bits(&pe->val[1], 1 << 23, value << 23);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 444e505bcdb8509aa3706c9c71ed798f2b3e8621 Mon Sep 17 00:00:00 2001
+From: swkhack <swkhack@gmail.com>
+Date: Thu, 13 Jun 2019 15:56:08 -0700
+Subject: mm/mlock.c: change count_mm_mlocked_page_nr return type
+
+[ Upstream commit 0874bb49bb21bf24deda853e8bf61b8325e24bcb ]
+
+On a 64-bit machine the value of "vma->vm_end - vma->vm_start" may be
+negative when using 32 bit ints and the "count >> PAGE_SHIFT"'s result
+will be wrong. So change the local variable and return value to
+unsigned long to fix the problem.
+
+Link: http://lkml.kernel.org/r/20190513023701.83056-1-swkhack@gmail.com
+Fixes: 0cf2f6f6dc60 ("mm: mlock: check against vma for actual mlock() size")
+Signed-off-by: swkhack <swkhack@gmail.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/mlock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/mlock.c b/mm/mlock.c
+index 080f3b36415b..d614163f569b 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -636,11 +636,11 @@ static int apply_vma_lock_flags(unsigned long start, size_t len,
+ * is also counted.
+ * Return value: previously mlocked page counts
+ */
+-static int count_mm_mlocked_page_nr(struct mm_struct *mm,
++static unsigned long count_mm_mlocked_page_nr(struct mm_struct *mm,
+ unsigned long start, size_t len)
+ {
+ struct vm_area_struct *vma;
+- int count = 0;
++ unsigned long count = 0;
+
+ if (mm == NULL)
+ mm = current->mm;
+--
+2.20.1
+
--- /dev/null
+From ca7631feb071b87e7c40a365c16cf9e72b537e48 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 13 Jun 2019 20:07:22 -0500
+Subject: module: Fix livepatch/ftrace module text permissions race
+
+[ Upstream commit 9f255b632bf12c4dd7fc31caee89aa991ef75176 ]
+
+It's possible for livepatch and ftrace to be toggling a module's text
+permissions at the same time, resulting in the following panic:
+
+ BUG: unable to handle page fault for address: ffffffffc005b1d9
+ #PF: supervisor write access in kernel mode
+ #PF: error_code(0x0003) - permissions violation
+ PGD 3ea0c067 P4D 3ea0c067 PUD 3ea0e067 PMD 3cc13067 PTE 3b8a1061
+ Oops: 0003 [#1] PREEMPT SMP PTI
+ CPU: 1 PID: 453 Comm: insmod Tainted: G O K 5.2.0-rc1-a188339ca5 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014
+ RIP: 0010:apply_relocate_add+0xbe/0x14c
+ Code: fa 0b 74 21 48 83 fa 18 74 38 48 83 fa 0a 75 40 eb 08 48 83 38 00 74 33 eb 53 83 38 00 75 4e 89 08 89 c8 eb 0a 83 38 00 75 43 <89> 08 48 63 c1 48 39 c8 74 2e eb 48 83 38 00 75 32 48 29 c1 89 08
+ RSP: 0018:ffffb223c00dbb10 EFLAGS: 00010246
+ RAX: ffffffffc005b1d9 RBX: 0000000000000000 RCX: ffffffff8b200060
+ RDX: 000000000000000b RSI: 0000004b0000000b RDI: ffff96bdfcd33000
+ RBP: ffffb223c00dbb38 R08: ffffffffc005d040 R09: ffffffffc005c1f0
+ R10: ffff96bdfcd33c40 R11: ffff96bdfcd33b80 R12: 0000000000000018
+ R13: ffffffffc005c1f0 R14: ffffffffc005e708 R15: ffffffff8b2fbc74
+ FS: 00007f5f447beba8(0000) GS:ffff96bdff900000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffffffc005b1d9 CR3: 000000003cedc002 CR4: 0000000000360ea0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ klp_init_object_loaded+0x10f/0x219
+ ? preempt_latency_start+0x21/0x57
+ klp_enable_patch+0x662/0x809
+ ? virt_to_head_page+0x3a/0x3c
+ ? kfree+0x8c/0x126
+ patch_init+0x2ed/0x1000 [livepatch_test02]
+ ? 0xffffffffc0060000
+ do_one_initcall+0x9f/0x1c5
+ ? kmem_cache_alloc_trace+0xc4/0xd4
+ ? do_init_module+0x27/0x210
+ do_init_module+0x5f/0x210
+ load_module+0x1c41/0x2290
+ ? fsnotify_path+0x3b/0x42
+ ? strstarts+0x2b/0x2b
+ ? kernel_read+0x58/0x65
+ __do_sys_finit_module+0x9f/0xc3
+ ? __do_sys_finit_module+0x9f/0xc3
+ __x64_sys_finit_module+0x1a/0x1c
+ do_syscall_64+0x52/0x61
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+The above panic occurs when loading two modules at the same time with
+ftrace enabled, where at least one of the modules is a livepatch module:
+
+CPU0 CPU1
+klp_enable_patch()
+ klp_init_object_loaded()
+ module_disable_ro()
+ ftrace_module_enable()
+ ftrace_arch_code_modify_post_process()
+ set_all_modules_text_ro()
+ klp_write_object_relocations()
+ apply_relocate_add()
+ *patches read-only code* - BOOM
+
+A similar race exists when toggling ftrace while loading a livepatch
+module.
+
+Fix it by ensuring that the livepatch and ftrace code patching
+operations -- and their respective permissions changes -- are protected
+by the text_mutex.
+
+Link: http://lkml.kernel.org/r/ab43d56ab909469ac5d2520c5d944ad6d4abd476.1560474114.git.jpoimboe@redhat.com
+
+Reported-by: Johannes Erdfelt <johannes@erdfelt.com>
+Fixes: 444d13ff10fb ("modules: add ro_after_init support")
+Acked-by: Jessica Yu <jeyu@kernel.org>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/livepatch/core.c | 6 ++++++
+ kernel/trace/ftrace.c | 10 +++++++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index eb0ee10a1981..05d5b0afc864 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -30,6 +30,7 @@
+ #include <linux/elf.h>
+ #include <linux/moduleloader.h>
+ #include <linux/completion.h>
++#include <linux/memory.h>
+ #include <asm/cacheflush.h>
+ #include "core.h"
+ #include "patch.h"
+@@ -746,16 +747,21 @@ static int klp_init_object_loaded(struct klp_patch *patch,
+ struct klp_func *func;
+ int ret;
+
++ mutex_lock(&text_mutex);
++
+ module_disable_ro(patch->mod);
+ ret = klp_write_object_relocations(patch->mod, obj);
+ if (ret) {
+ module_enable_ro(patch->mod, true);
++ mutex_unlock(&text_mutex);
+ return ret;
+ }
+
+ arch_klp_init_object_loaded(patch, obj);
+ module_enable_ro(patch->mod, true);
+
++ mutex_unlock(&text_mutex);
++
+ klp_for_each_func(obj, func) {
+ ret = klp_find_object_symbol(obj->name, func->old_name,
+ func->old_sympos,
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 538f0b1c7ea2..045e7f46a74a 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -34,6 +34,7 @@
+ #include <linux/hash.h>
+ #include <linux/rcupdate.h>
+ #include <linux/kprobes.h>
++#include <linux/memory.h>
+
+ #include <trace/events/sched.h>
+
+@@ -2614,10 +2615,12 @@ static void ftrace_run_update_code(int command)
+ {
+ int ret;
+
++ mutex_lock(&text_mutex);
++
+ ret = ftrace_arch_code_modify_prepare();
+ FTRACE_WARN_ON(ret);
+ if (ret)
+- return;
++ goto out_unlock;
+
+ /*
+ * By default we use stop_machine() to modify the code.
+@@ -2629,6 +2632,9 @@ static void ftrace_run_update_code(int command)
+
+ ret = ftrace_arch_code_modify_post_process();
+ FTRACE_WARN_ON(ret);
++
++out_unlock:
++ mutex_unlock(&text_mutex);
+ }
+
+ static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
+@@ -5779,6 +5785,7 @@ void ftrace_module_enable(struct module *mod)
+ struct ftrace_page *pg;
+
+ mutex_lock(&ftrace_lock);
++ mutex_lock(&text_mutex);
+
+ if (ftrace_disabled)
+ goto out_unlock;
+@@ -5840,6 +5847,7 @@ void ftrace_module_enable(struct module *mod)
+ ftrace_arch_code_modify_post_process();
+
+ out_unlock:
++ mutex_unlock(&text_mutex);
+ mutex_unlock(&ftrace_lock);
+
+ process_cached_mods(mod->name);
+--
+2.20.1
+
--- /dev/null
+From 10850ad0bfc2a15bbe576f90db9b57998d18ebb3 Mon Sep 17 00:00:00 2001
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Thu, 23 May 2019 16:41:52 +0000
+Subject: platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove
+ flow
+
+[ Upstream commit 8c2eb7b6468ad4aa5600aed01aa0715f921a3f8b ]
+
+Add devm_free_irq() call to mlxreg-hotplug remove() for clean release
+of devices irq resource. Fix debugobjects warning triggered by rmmod
+It prevents of use-after-free memory, related to
+mlxreg_hotplug_work_handler.
+
+Issue has been reported as debugobjects warning triggered by
+'rmmod mlxtreg-hotplug' flow, while running kernel with
+CONFIG_DEBUG_OBJECTS* options.
+
+[ 2489.623551] ODEBUG: free active (active state 0) object type: work_struct hint: mlxreg_hotplug_work_handler+0x0/0x7f0 [mlxreg_hotplug]
+[ 2489.637097] WARNING: CPU: 5 PID: 3924 at lib/debugobjects.c:328 debug_print_object+0xfe/0x180
+[ 2489.637165] RIP: 0010:debug_print_object+0xfe/0x180
+?
+[ 2489.637214] Call Trace:
+[ 2489.637225] __debug_check_no_obj_freed+0x25e/0x320
+[ 2489.637231] kfree+0x82/0x110
+[ 2489.637238] release_nodes+0x33c/0x4e0
+[ 2489.637242] ? devres_remove_group+0x1b0/0x1b0
+[ 2489.637247] device_release_driver_internal+0x146/0x270
+[ 2489.637251] driver_detach+0x73/0xe0
+[ 2489.637254] bus_remove_driver+0xa1/0x170
+[ 2489.637261] __x64_sys_delete_module+0x29e/0x320
+[ 2489.637265] ? __ia32_sys_delete_module+0x320/0x320
+[ 2489.637268] ? blkcg_exit_queue+0x20/0x20
+[ 2489.637273] ? task_work_run+0x7d/0x100
+[ 2489.637278] ? exit_to_usermode_loop+0x5b/0xf0
+[ 2489.637281] do_syscall_64+0x73/0x160
+[ 2489.637287] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 2489.637290] RIP: 0033:0x7f95c3596fd7
+
+The difference in release flow with and with no devm_free_irq is listed
+below:
+
+bus: 'platform': remove driver mlxreg-hotplug
+ mlxreg_hotplug_remove(start)
+ -> devm_free_irq (with new code)
+ mlxreg_hotplug_remove (end)
+ release_nodes (start)
+ mlxreg-hotplug: DEVRES REL devm_hwmon_release (8 bytes)
+ device: 'hwmon3': device_unregister
+ PM: Removing info for No Bus:hwmon3
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (88 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (6 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (5 bytes)
+ mlxreg-hotplug: DEVRES REL devm_irq_release (16 bytes) (no new code)
+ mlxreg-hotplug: DEVRES REL devm_kzalloc_release (1376 bytes)
+ ------------[ cut here ]------------ (no new code):
+ ODEBUG: free active (active state 0) object type: work_struct hint: mlxreg_hotplug_work_handler
+
+ release_nodes(end)
+driver: 'mlxreg-hotplug': driver_release
+
+Fixes: 1f976f6978bf ("platform/x86: Move Mellanox platform hotplug driver to platform/mellanox")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxreg-hotplug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/mellanox/mlxreg-hotplug.c b/drivers/platform/mellanox/mlxreg-hotplug.c
+index 687ce6817d0d..f85a1b9d129b 100644
+--- a/drivers/platform/mellanox/mlxreg-hotplug.c
++++ b/drivers/platform/mellanox/mlxreg-hotplug.c
+@@ -694,6 +694,7 @@ static int mlxreg_hotplug_remove(struct platform_device *pdev)
+
+ /* Clean interrupts setup. */
+ mlxreg_hotplug_unset_irq(priv);
++ devm_free_irq(&pdev->dev, priv->irq, priv);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 38789c41817903237aeb3abce999a2f4d5b7d7f3 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 12 Jun 2019 09:02:02 +0200
+Subject: platform/x86: asus-wmi: Only Tell EC the OS will handle display
+ hotkeys from asus_nb_wmi
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 401fee8195d401b2b94dee57383f627050724d5b ]
+
+Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will
+handle the display off hotkey") causes the backlight to be permanently off
+on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC
+1015BX, Asus EeePC 1025C).
+
+The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added
+by that commit is made conditional in this commit and only enabled in
+the quirk_entry structs in the asus-nb-wmi driver fixing the broken
+display / backlight on various EeePC laptop models.
+
+Cc: João Paulo Rechi Vita <jprvita@endlessm.com>
+Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++
+ drivers/platform/x86/asus-wmi.c | 2 +-
+ drivers/platform/x86/asus-wmi.h | 1 +
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index b6f2ff95c3ed..59f3a37a44d7 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,
+
+ static struct quirk_entry quirk_asus_unknown = {
+ .wapf = 0,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_q500a = {
+ .i8042_filter = asus_q500a_i8042_filter,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ /*
+@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = {
+ static struct quirk_entry quirk_asus_x55u = {
+ .wapf = 4,
+ .wmi_backlight_power = true,
++ .wmi_backlight_set_devstate = true,
+ .no_display_toggle = true,
+ };
+
+ static struct quirk_entry quirk_asus_wapf4 = {
+ .wapf = 4,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_x200ca = {
+ .wapf = 2,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_ux303ub = {
+ .wmi_backlight_native = true,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_x550lb = {
++ .wmi_backlight_set_devstate = true,
+ .xusb2pr = 0x01D9,
+ };
+
+ static struct quirk_entry quirk_asus_forceals = {
++ .wmi_backlight_set_devstate = true,
+ .wmi_force_als_set = true,
+ };
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index ee1fa93708ec..a66e99500c12 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -2131,7 +2131,7 @@ static int asus_wmi_add(struct platform_device *pdev)
+ err = asus_wmi_backlight_init(asus);
+ if (err && err != -ENODEV)
+ goto fail_backlight;
+- } else
++ } else if (asus->driver->quirks->wmi_backlight_set_devstate)
+ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
+
+ status = wmi_install_notify_handler(asus->driver->event_guid,
+diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
+index 6c1311f4b04d..57a79bddb286 100644
+--- a/drivers/platform/x86/asus-wmi.h
++++ b/drivers/platform/x86/asus-wmi.h
+@@ -44,6 +44,7 @@ struct quirk_entry {
+ bool store_backlight_power;
+ bool wmi_backlight_power;
+ bool wmi_backlight_native;
++ bool wmi_backlight_set_devstate;
+ bool wmi_force_als_set;
+ int wapf;
+ /*
+--
+2.20.1
+
--- /dev/null
+From 9b2e888ddec6beb2ad94e78476fb0a2286eb3a55 Mon Sep 17 00:00:00 2001
+From: Mathew King <mathewk@chromium.org>
+Date: Mon, 20 May 2019 16:41:24 -0600
+Subject: platform/x86: intel-vbtn: Report switch events when event wakes
+ device
+
+[ Upstream commit cb1921b17adbe6509538098ac431033378cd7165 ]
+
+When a switch event, such as tablet mode/laptop mode or docked/undocked,
+wakes a device make sure that the value of the swich is reported.
+Without when a device is put in tablet mode from laptop mode when it is
+suspended or vice versa the device will wake up but mode will be
+incorrect.
+
+Tested by suspending a device in laptop mode and putting it in tablet
+mode, the device resumes and is in tablet mode. When suspending the
+device in tablet mode and putting it in laptop mode the device resumes
+and is in laptop mode.
+
+Signed-off-by: Mathew King <mathewk@chromium.org>
+Reviewed-by: Jett Rink <jettrink@chromium.org>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-vbtn.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index 06cd7e818ed5..a0d0cecff55f 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -76,12 +76,24 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
+ struct platform_device *device = context;
+ struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev);
+ unsigned int val = !(event & 1); /* Even=press, Odd=release */
+- const struct key_entry *ke_rel;
++ const struct key_entry *ke, *ke_rel;
+ bool autorelease;
+
+ if (priv->wakeup_mode) {
+- if (sparse_keymap_entry_from_scancode(priv->input_dev, event)) {
++ ke = sparse_keymap_entry_from_scancode(priv->input_dev, event);
++ if (ke) {
+ pm_wakeup_hard_event(&device->dev);
++
++ /*
++ * Switch events like tablet mode will wake the device
++ * and report the new switch position to the input
++ * subsystem.
++ */
++ if (ke->type == KE_SW)
++ sparse_keymap_report_event(priv->input_dev,
++ event,
++ val,
++ 0);
+ return;
+ }
+ goto out_unknown;
+--
+2.20.1
+
--- /dev/null
+From d483636c0db5cd4848cc5164a09e0d4c0bafd1a6 Mon Sep 17 00:00:00 2001
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Wed, 5 Jun 2019 07:51:03 +0000
+Subject: platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device
+ registration
+
+[ Upstream commit 160da20b254dd4bfc5828f12c208fa831ad4be6c ]
+
+Fix the issue found while running kernel with the option
+CONFIG_DEBUG_TEST_DRIVER_REMOVE.
+Driver 'mlx-platform' registers 'i2c_mlxcpld' device and then registers
+few underlying 'i2c-mux-reg' devices:
+ priv->pdev_i2c = platform_device_register_simple("i2c_mlxcpld", nr,
+ NULL, 0);
+ ...
+ for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) {
+ priv->pdev_mux[i] = platform_device_register_resndata(
+ &mlxplat_dev->dev,
+ "i2c-mux-reg", i, NULL,
+ 0, &mlxplat_mux_data[i],
+ sizeof(mlxplat_mux_data[i]));
+
+But actual parent of "i2c-mux-reg" device is priv->pdev_i2c->dev and
+not mlxplat_dev->dev.
+Patch fixes parent device parameter in a call to
+platform_device_register_resndata() for "i2c-mux-reg".
+
+It solves the race during initialization flow while 'i2c_mlxcpld.1' is
+removing after probe, while 'i2c-mux-reg.0' is still in probing flow:
+'i2c_mlxcpld.1' flow: probe -> remove -> probe.
+'i2c-mux-reg.0' flow: probe -> ...
+
+[ 12:621096] Registering platform device 'i2c_mlxcpld.1'. Parent at platform
+[ 12:621117] device: 'i2c_mlxcpld.1': device_add
+[ 12:621155] bus: 'platform': add device i2c_mlxcpld.1
+[ 12:621384] Registering platform device 'i2c-mux-reg.0'. Parent at mlxplat
+[ 12:621395] device: 'i2c-mux-reg.0': device_add
+[ 12:621425] bus: 'platform': add device i2c-mux-reg.0
+[ 12:621806] Registering platform device 'i2c-mux-reg.1'. Parent at mlxplat
+[ 12:621828] device: 'i2c-mux-reg.1': device_add
+[ 12:621892] bus: 'platform': add device i2c-mux-reg.1
+[ 12:621906] bus: 'platform': add driver i2c_mlxcpld
+[ 12:621996] bus: 'platform': driver_probe_device: matched device i2c_mlxcpld.1 with driver i2c_mlxcpld
+[ 12:622003] bus: 'platform': really_probe: probing driver i2c_mlxcpld with device i2c_mlxcpld.1
+[ 12:622100] i2c_mlxcpld i2c_mlxcpld.1: no default pinctrl state
+[ 12:622293] device: 'i2c-1': device_add
+[ 12:627280] bus: 'i2c': add device i2c-1
+[ 12:627692] device: 'i2c-1': device_add
+[ 12.629639] bus: 'platform': add driver i2c-mux-reg
+[ 12.629718] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg
+[ 12.629723] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0
+[ 12.629818] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state
+[ 12.629981] platform i2c-mux-reg.0: Driver i2c-mux-reg requests probe deferral
+[ 12.629986] platform i2c-mux-reg.0: Added to deferred list
+[ 12.629992] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.1 with driver i2c-mux-reg
+[ 12.629997] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.1
+[ 12.630091] i2c-mux-reg i2c-mux-reg.1: no default pinctrl state
+[ 12.630247] platform i2c-mux-reg.1: Driver i2c-mux-reg requests probe deferral
+[ 12.630252] platform i2c-mux-reg.1: Added to deferred list
+[ 12.640892] devices_kset: Moving i2c-mux-reg.0 to end of list
+[ 12.640900] platform i2c-mux-reg.0: Retrying from deferred list
+[ 12.640911] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg
+[ 12.640919] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0
+[ 12.640999] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state
+[ 12.641177] platform i2c-mux-reg.0: Driver i2c-mux-reg requests probe deferral
+[ 12.641187] platform i2c-mux-reg.0: Added to deferred list
+[ 12.641198] devices_kset: Moving i2c-mux-reg.1 to end of list
+[ 12.641219] platform i2c-mux-reg.1: Retrying from deferred list
+[ 12.641237] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.1 with driver i2c-mux-reg
+[ 12.641247] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.1
+[ 12.641331] i2c-mux-reg i2c-mux-reg.1: no default pinctrl state
+[ 12.641465] platform i2c-mux-reg.1: Driver i2c-mux-reg requests probe deferral
+[ 12.641469] platform i2c-mux-reg.1: Added to deferred list
+[ 12.646427] device: 'i2c-1': device_add
+[ 12.646647] bus: 'i2c': add device i2c-1
+[ 12.647104] device: 'i2c-1': device_add
+[ 12.669231] devices_kset: Moving i2c-mux-reg.0 to end of list
+[ 12.669240] platform i2c-mux-reg.0: Retrying from deferred list
+[ 12.669258] bus: 'platform': driver_probe_device: matched device i2c-mux-reg.0 with driver i2c-mux-reg
+[ 12.669263] bus: 'platform': really_probe: probing driver i2c-mux-reg with device i2c-mux-reg.0
+[ 12.669343] i2c-mux-reg i2c-mux-reg.0: no default pinctrl state
+[ 12.669585] device: 'i2c-2': device_add
+[ 12.669795] bus: 'i2c': add device i2c-2
+[ 12.670201] device: 'i2c-2': device_add
+[ 12.671427] i2c i2c-1: Added multiplexed i2c bus 2
+[ 12.671514] device: 'i2c-3': device_add
+[ 12.671724] bus: 'i2c': add device i2c-3
+[ 12.672136] device: 'i2c-3': device_add
+[ 12.673378] i2c i2c-1: Added multiplexed i2c bus 3
+[ 12.673472] device: 'i2c-4': device_add
+[ 12.673676] bus: 'i2c': add device i2c-4
+[ 12.674060] device: 'i2c-4': device_add
+[ 12.675861] i2c i2c-1: Added multiplexed i2c bus 4
+[ 12.675941] device: 'i2c-5': device_add
+[ 12.676150] bus: 'i2c': add device i2c-5
+[ 12.676550] device: 'i2c-5': device_add
+[ 12.678103] i2c i2c-1: Added multiplexed i2c bus 5
+[ 12.678193] device: 'i2c-6': device_add
+[ 12.678395] bus: 'i2c': add device i2c-6
+[ 12.678774] device: 'i2c-6': device_add
+[ 12.679969] i2c i2c-1: Added multiplexed i2c bus 6
+[ 12.680065] device: 'i2c-7': device_add
+[ 12.680275] bus: 'i2c': add device i2c-7
+[ 12.680913] device: 'i2c-7': device_add
+[ 12.682506] i2c i2c-1: Added multiplexed i2c bus 7
+[ 12.682600] device: 'i2c-8': device_add
+[ 12.682808] bus: 'i2c': add device i2c-8
+[ 12.683189] device: 'i2c-8': device_add
+[ 12.683907] device: 'i2c-1': device_unregister
+[ 12.683945] device: 'i2c-1': device_unregister
+[ 12.684387] device: 'i2c-1': device_create_release
+[ 12.684536] bus: 'i2c': remove device i2c-1
+[ 12.686019] i2c i2c-8: Failed to create compatibility class link
+[ 12.686086] ------------[ cut here ]------------
+[ 12.686087] can't create symlink to mux device
+[ 12.686224] Workqueue: events deferred_probe_work_func
+[ 12.686135] WARNING: CPU: 7 PID: 436 at drivers/i2c/i2c-mux.c:416 i2c_mux_add_adapter+0x729/0x7d0 [i2c_mux]
+[ 12.686232] RIP: 0010:i2c_mux_add_adapter+0x729/0x7d0 [i2c_mux]
+[ 0x190/0x190 [i2c_mux]
+[ 12.686300] ? i2c_mux_alloc+0xac/0x110 [i2c_mux]
+[ 12.686306] ? i2c_mux_reg_set+0x200/0x200 [i2c_mux_reg]
+[ 12.686313] i2c_mux_reg_probe+0x22c/0x731 [i2c_mux_reg]
+[ 12.686322] ? i2c_mux_reg_deselect+0x60/0x60 [i2c_mux_reg]
+[ 12.686346] platform_drv_probe+0xa8/0x110
+[ 12.686351] really_probe+0x185/0x720
+[ 12.686358] driver_probe_device+0xdf/0x1f0
+...
+[ 12.686522] i2c i2c-1: Added multiplexed i2c bus 8
+[ 12.686621] device: 'i2c-9': device_add
+[ 12.686626] kobject_add_internal failed for i2c-9 (error: -2 parent: i2c-1)
+[ 12.694729] i2c-core: adapter 'i2c-1-mux (chan_id 8)': can't register device (-2)
+[ 12.705726] i2c i2c-1: failed to add mux-adapter 8 as bus 9 (error=-2)
+[ 12.714494] device: 'i2c-8': device_unregister
+[ 12.714537] device: 'i2c-8': device_unregister
+
+Fixes: 6613d18e9038 ("platform/x86: mlx-platform: Move module from arch/x86")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 48fa7573e29b..0e5f073e51bc 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -1828,7 +1828,7 @@ static int __init mlxplat_init(void)
+
+ for (i = 0; i < ARRAY_SIZE(mlxplat_mux_data); i++) {
+ priv->pdev_mux[i] = platform_device_register_resndata(
+- &mlxplat_dev->dev,
++ &priv->pdev_i2c->dev,
+ "i2c-mux-reg", i, NULL,
+ 0, &mlxplat_mux_data[i],
+ sizeof(mlxplat_mux_data[i]));
+--
+2.20.1
+
--- /dev/null
+From 179ff5afab80a5d4028a121c3ea221d3b9c9e9f5 Mon Sep 17 00:00:00 2001
+From: Manuel Traut <manut@linutronix.de>
+Date: Thu, 13 Jun 2019 15:55:52 -0700
+Subject: scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE
+
+[ Upstream commit c04e32e911653442fc834be6e92e072aeebe01a1 ]
+
+At least for ARM64 kernels compiled with the crosstoolchain from
+Debian/stretch or with the toolchain from kernel.org the line number is
+not decoded correctly by 'decode_stacktrace.sh':
+
+ $ echo "[ 136.513051] f1+0x0/0xc [kcrash]" | \
+ CROSS_COMPILE=/opt/gcc-8.1.0-nolibc/aarch64-linux/bin/aarch64-linux- \
+ ./scripts/decode_stacktrace.sh /scratch/linux-arm64/vmlinux \
+ /scratch/linux-arm64 \
+ /nfs/debian/lib/modules/4.20.0-devel
+ [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:68) kcrash
+
+If addr2line from the toolchain is used the decoded line number is correct:
+
+ [ 136.513051] f1 (/linux/drivers/staging/kcrash/kcrash.c:57) kcrash
+
+Link: http://lkml.kernel.org/r/20190527083425.3763-1-manut@linutronix.de
+Signed-off-by: Manuel Traut <manut@linutronix.de>
+Acked-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/decode_stacktrace.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index bcdd45df3f51..a7a36209a193 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -73,7 +73,7 @@ parse_symbol() {
+ if [[ "${cache[$module,$address]+isset}" == "isset" ]]; then
+ local code=${cache[$module,$address]}
+ else
+- local code=$(addr2line -i -e "$objfile" "$address")
++ local code=$(${CROSS_COMPILE}addr2line -i -e "$objfile" "$address")
+ cache[$module,$address]=$code
+ fi
+
+--
+2.20.1
+
--- /dev/null
+From 929878cb4aeac59624c97b5bb7f529161662749f Mon Sep 17 00:00:00 2001
+From: Don Brace <don.brace@microsemi.com>
+Date: Mon, 3 Jun 2019 16:43:29 -0500
+Subject: scsi: hpsa: correct ioaccel2 chaining
+
+[ Upstream commit 625d7d3518875c4d303c652a198feaa13d9f52d9 ]
+
+- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_LAST_SG for
+ the last s/g element.
+
+- set ioaccel2_sg_element member 'chain_indicator' to IOACCEL2_CHAIN when
+ chaining.
+
+Reviewed-by: Bader Ali - Saleh <bader.alisaleh@microsemi.com>
+Reviewed-by: Scott Teel <scott.teel@microsemi.com>
+Reviewed-by: Matt Perricone <matt.perricone@microsemi.com>
+Signed-off-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hpsa.c | 7 ++++++-
+ drivers/scsi/hpsa_cmd.h | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index f044e7d10d63..2d181e5e65ff 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -4925,7 +4925,7 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg->reserved[0] = 0;
+ curr_sg->reserved[1] = 0;
+ curr_sg->reserved[2] = 0;
+- curr_sg->chain_indicator = 0x80;
++ curr_sg->chain_indicator = IOACCEL2_CHAIN;
+
+ curr_sg = h->ioaccel2_cmd_sg_list[c->cmdindex];
+ }
+@@ -4942,6 +4942,11 @@ static int hpsa_scsi_ioaccel2_queue_command(struct ctlr_info *h,
+ curr_sg++;
+ }
+
++ /*
++ * Set the last s/g element bit
++ */
++ (curr_sg - 1)->chain_indicator = IOACCEL2_LAST_SG;
++
+ switch (cmd->sc_data_direction) {
+ case DMA_TO_DEVICE:
+ cp->direction &= ~IOACCEL2_DIRECTION_MASK;
+diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h
+index 21a726e2eec6..f6afca4b2319 100644
+--- a/drivers/scsi/hpsa_cmd.h
++++ b/drivers/scsi/hpsa_cmd.h
+@@ -517,6 +517,7 @@ struct ioaccel2_sg_element {
+ u8 reserved[3];
+ u8 chain_indicator;
+ #define IOACCEL2_CHAIN 0x80
++#define IOACCEL2_LAST_SG 0x40
+ };
+
+ /*
+--
+2.20.1
+
netfilter-nft_flow_offload-don-t-offload-when-sequence-numbers-need-adjustment.patch
netfilter-nft_flow_offload-ipcb-is-only-valid-for-ipv4-family.patch
idr-fix-idr_get_next-race-with-idr_remove.patch
+hid-i2c-hid-add-iball-aer3-to-descriptor-override.patch
+asoc-cs4265-readable-register-too-low.patch
+asoc-ak4458-add-return-value-for-ak4458_probe.patch
+asoc-soc-pcm-be-dai-needs-prepare-when-pause-release.patch
+asoc-ak4458-rstn_control-return-a-non-zero-on-error-.patch
+spi-bitbang-fix-null-pointer-dereference-in-spi_unre.patch
+asoc-core-lock-client_mutex-while-removing-link-comp.patch
+iommu-vt-d-set-the-right-field-for-page-walk-snoop.patch
+hid-a4tech-fix-horizontal-scrolling.patch
+asoc-intel-baytrail-add-quirk-for-aegex-10-ru2-table.patch
+asoc-hda-fix-unbalanced-codec-dev-refcount-for-hda_d.patch
+drm-mediatek-fix-unbind-functions.patch
+drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
+drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
+drm-mediatek-clear-num_pipes-when-unbind-driver.patch
+drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
+asoc-max98090-remove-24-bit-format-support-if-rj-is-.patch
+asoc-sun4i-i2s-fix-sun8i-tx-channel-offset-mask.patch
+asoc-sun4i-i2s-add-offset-to-rx-channel-select.patch
+x86-cpu-add-more-icelake-model-numbers.patch
+usb-gadget-fusb300_udc-fix-memory-leak-of-fusb300-ep.patch
+usb-gadget-udc-lpc32xx-allocate-descriptor-with-gfp_.patch
+usb-gadget-dwc2-fix-zlp-handling.patch
+asoc-intel-cht_bsw_max98090-fix-kernel-oops-with-pla.patch
+asoc-intel-bytcht_es8316-fix-kernel-oops-with-platfo.patch
+asoc-intel-cht_bsw_nau8824-fix-kernel-oops-with-plat.patch
+asoc-intel-cht_bsw_rt5672-fix-kernel-oops-with-platf.patch
+asoc-core-move-dai-pre-links-initiation-to-snd_soc_i.patch
+alsa-hdac-fix-memory-release-for-sst-and-sof-drivers.patch
+soc-rt274-fix-internal-jack-assignment-in-set_jack-c.patch
+scsi-hpsa-correct-ioaccel2-chaining.patch
+gpio-pca953x-hack-to-fix-24-bit-gpio-expanders.patch
+drm-panel-orientation-quirks-add-quirk-for-gpd-pocke.patch
+drm-panel-orientation-quirks-add-quirk-for-gpd-micro.patch
+asoc-core-fix-deadlock-in-snd_soc_instantiate_card.patch
+asoc-intel-sst-fix-kmalloc-call-with-wrong-flags.patch
+platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch
+platform-x86-intel-vbtn-report-switch-events-when-ev.patch
+platform-x86-mlx-platform-fix-parent-device-in-i2c-m.patch
+platform-mellanox-mlxreg-hotplug-add-devm_free_irq-c.patch
+i2c-pca-platform-fix-gpio-lookup-code.patch
+arm64-tlbflush-ensure-start-end-of-address-range-are.patch
+cpuset-restore-sanity-to-cpuset_cpus_allowed_fallbac.patch
+scripts-decode_stacktrace.sh-prefix-addr2line-with-c.patch
+mm-mlock.c-change-count_mm_mlocked_page_nr-return-ty.patch
+tracing-avoid-build-warning-with-have_nop_mcount.patch
+module-fix-livepatch-ftrace-module-text-permissions-.patch
+ftrace-fix-null-pointer-dereference-in-free_ftrace_f.patch
--- /dev/null
+From 89b2d3e98f09c4c17f63ac70ab110e1c794e3d37 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?=
+ <amadeuszx.slawinski@linux.intel.com>
+Date: Wed, 5 Jun 2019 15:45:52 +0200
+Subject: SoC: rt274: Fix internal jack assignment in set_jack callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 04268bf2757a125616b6c2140e6250f43b7b737a ]
+
+When we call snd_soc_component_set_jack(component, NULL, NULL) we should
+set rt274->jack to passed jack, so when interrupt is triggered it calls
+snd_soc_jack_report(rt274->jack, ...) with proper value.
+
+This fixes problem in machine where in register, we call
+snd_soc_register(component, &headset, NULL), which just calls
+rt274_mic_detect via callback.
+Now when machine driver is removed "headset" will be gone, so we
+need to tell codec driver that it's gone with:
+snd_soc_register(component, NULL, NULL), but we also need to be able
+to handle NULL jack argument here gracefully.
+If we don't set it to NULL, next time the rt274_irq runs it will call
+snd_soc_jack_report with first argument being invalid pointer and there
+will be Oops.
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt274.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
+index adf59039a3b6..cdd312db3e78 100644
+--- a/sound/soc/codecs/rt274.c
++++ b/sound/soc/codecs/rt274.c
+@@ -405,6 +405,8 @@ static int rt274_mic_detect(struct snd_soc_component *component,
+ {
+ struct rt274_priv *rt274 = snd_soc_component_get_drvdata(component);
+
++ rt274->jack = jack;
++
+ if (jack == NULL) {
+ /* Disable jack detection */
+ regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL,
+@@ -412,7 +414,6 @@ static int rt274_mic_detect(struct snd_soc_component *component,
+
+ return 0;
+ }
+- rt274->jack = jack;
+
+ regmap_update_bits(rt274->regmap, RT274_EAPD_GPIO_IRQ_CTRL,
+ RT274_IRQ_EN, RT274_IRQ_EN);
+--
+2.20.1
+
--- /dev/null
+From 566344b56665d2b190cd215624dba680d53e99ea Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 16 May 2019 15:56:56 +0800
+Subject: spi: bitbang: Fix NULL pointer dereference in spi_unregister_master
+
+[ Upstream commit 5caaf29af5ca82d5da8bc1d0ad07d9e664ccf1d8 ]
+
+If spi_register_master fails in spi_bitbang_start
+because device_add failure, We should return the
+error code other than 0, otherwise calling
+spi_bitbang_stop may trigger NULL pointer dereference
+like this:
+
+BUG: KASAN: null-ptr-deref in __list_del_entry_valid+0x45/0xd0
+Read of size 8 at addr 0000000000000000 by task syz-executor.0/3661
+
+CPU: 0 PID: 3661 Comm: syz-executor.0 Not tainted 5.1.0+ #28
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ dump_stack+0xa9/0x10e
+ ? __list_del_entry_valid+0x45/0xd0
+ ? __list_del_entry_valid+0x45/0xd0
+ __kasan_report+0x171/0x18d
+ ? __list_del_entry_valid+0x45/0xd0
+ kasan_report+0xe/0x20
+ __list_del_entry_valid+0x45/0xd0
+ spi_unregister_controller+0x99/0x1b0
+ spi_lm70llp_attach+0x3ae/0x4b0 [spi_lm70llp]
+ ? 0xffffffffc1128000
+ ? klist_next+0x131/0x1e0
+ ? driver_detach+0x40/0x40 [parport]
+ port_check+0x3b/0x50 [parport]
+ bus_for_each_dev+0x115/0x180
+ ? subsys_dev_iter_exit+0x20/0x20
+ __parport_register_driver+0x1f0/0x210 [parport]
+ ? 0xffffffffc1150000
+ do_one_initcall+0xb9/0x3b5
+ ? perf_trace_initcall_level+0x270/0x270
+ ? kasan_unpoison_shadow+0x30/0x40
+ ? kasan_unpoison_shadow+0x30/0x40
+ do_init_module+0xe0/0x330
+ load_module+0x38eb/0x4270
+ ? module_frob_arch_sections+0x20/0x20
+ ? kernel_read_file+0x188/0x3f0
+ ? find_held_lock+0x6d/0xd0
+ ? fput_many+0x1a/0xe0
+ ? __do_sys_finit_module+0x162/0x190
+ __do_sys_finit_module+0x162/0x190
+ ? __ia32_sys_init_module+0x40/0x40
+ ? __mutex_unlock_slowpath+0xb4/0x3f0
+ ? wait_for_completion+0x240/0x240
+ ? vfs_write+0x160/0x2a0
+ ? lockdep_hardirqs_off+0xb5/0x100
+ ? mark_held_locks+0x1a/0x90
+ ? do_syscall_64+0x14/0x2a0
+ do_syscall_64+0x72/0x2a0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 702a4879ec33 ("spi: bitbang: Let spi_bitbang_start() take a reference to master")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bitbang.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
+index dd9a8c54a693..be95be4fe985 100644
+--- a/drivers/spi/spi-bitbang.c
++++ b/drivers/spi/spi-bitbang.c
+@@ -403,7 +403,7 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
+ if (ret)
+ spi_master_put(master);
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(spi_bitbang_start);
+
+--
+2.20.1
+
--- /dev/null
+From dc6af5be5479f77f28e2492cf9739a79fa138e78 Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Wed, 5 Jun 2019 13:11:58 +0200
+Subject: tracing: avoid build warning with HAVE_NOP_MCOUNT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit cbdaeaf050b730ea02e9ab4ff844ce54d85dbe1d ]
+
+Selecting HAVE_NOP_MCOUNT enables -mnop-mcount (if gcc supports it)
+and sets CC_USING_NOP_MCOUNT. Reuse __is_defined (which is suitable for
+testing CC_USING_* defines) to avoid conditional compilation and fix
+the following gcc 9 warning on s390:
+
+kernel/trace/ftrace.c:2514:1: warning: ‘ftrace_code_disable’ defined
+but not used [-Wunused-function]
+
+Link: http://lkml.kernel.org/r/patch.git-1a82d13f33ac.your-ad-here.call-01559732716-ext-6629@work.hours
+
+Fixes: 2f4df0017baed ("tracing: Add -mcount-nop option support")
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index b920358dd8f7..538f0b1c7ea2 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2939,14 +2939,13 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs)
+ p = &pg->records[i];
+ p->flags = rec_flags;
+
+-#ifndef CC_USING_NOP_MCOUNT
+ /*
+ * Do the initial record conversion from mcount jump
+ * to the NOP instructions.
+ */
+- if (!ftrace_code_disable(mod, p))
++ if (!__is_defined(CC_USING_NOP_MCOUNT) &&
++ !ftrace_code_disable(mod, p))
+ break;
+-#endif
+
+ update_cnt++;
+ }
+--
+2.20.1
+
--- /dev/null
+From cf595dd886985ae1bd570bcd8967eb9d11c8177b Mon Sep 17 00:00:00 2001
+From: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Date: Mon, 1 Apr 2019 12:50:45 +0200
+Subject: usb: gadget: dwc2: fix zlp handling
+
+[ Upstream commit 066cfd0770aba8a9ac79b59d99530653885d919d ]
+
+The patch 10209abe87f5ebfd482a00323f5236d6094d0865
+usb: dwc2: gadget: Add scatter-gather mode
+
+avoided a NULL pointer dereference (hs_ep->req == NULL) by
+calling dwc2_gadget_fill_nonisoc_xfer_dma_one() directly instead of through
+the dwc2_gadget_config_nonisoc_xfer_ddma() wrapper, which unconditionally
+dereferenced the said pointer.
+
+However, this was based on an incorrect assumption that in the context of
+dwc2_hsotg_program_zlp() the pointer is always NULL, which is not the case.
+The result were SB CV MSC tests failing starting from Test Case 6.
+
+Instead, this patch reverts to calling the wrapper and adds a check for
+the pointer being NULL inside the wrapper.
+
+Fixes: 10209abe87f5 (usb: dwc2: gadget: Add scatter-gather mode)
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index a749de7604c6..c99ef9753930 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -833,19 +833,22 @@ static void dwc2_gadget_fill_nonisoc_xfer_ddma_one(struct dwc2_hsotg_ep *hs_ep,
+ * with corresponding information based on transfer data.
+ */
+ static void dwc2_gadget_config_nonisoc_xfer_ddma(struct dwc2_hsotg_ep *hs_ep,
+- struct usb_request *ureq,
+- unsigned int offset,
++ dma_addr_t dma_buff,
+ unsigned int len)
+ {
++ struct usb_request *ureq = NULL;
+ struct dwc2_dma_desc *desc = hs_ep->desc_list;
+ struct scatterlist *sg;
+ int i;
+ u8 desc_count = 0;
+
++ if (hs_ep->req)
++ ureq = &hs_ep->req->req;
++
+ /* non-DMA sg buffer */
+- if (!ureq->num_sgs) {
++ if (!ureq || !ureq->num_sgs) {
+ dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &desc,
+- ureq->dma + offset, len, true);
++ dma_buff, len, true);
+ return;
+ }
+
+@@ -1133,7 +1136,7 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg,
+ offset = ureq->actual;
+
+ /* Fill DDMA chain entries */
+- dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, ureq, offset,
++ dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, ureq->dma + offset,
+ length);
+
+ /* write descriptor chain address to control register */
+@@ -2026,12 +2029,13 @@ static void dwc2_hsotg_program_zlp(struct dwc2_hsotg *hsotg,
+ dev_dbg(hsotg->dev, "Receiving zero-length packet on ep%d\n",
+ index);
+ if (using_desc_dma(hsotg)) {
++ /* Not specific buffer needed for ep0 ZLP */
++ dma_addr_t dma = hs_ep->desc_list_dma;
++
+ if (!index)
+ dwc2_gadget_set_ep0_desc_chain(hsotg, hs_ep);
+
+- /* Not specific buffer needed for ep0 ZLP */
+- dwc2_gadget_fill_nonisoc_xfer_ddma_one(hs_ep, &hs_ep->desc_list,
+- hs_ep->desc_list_dma, 0, true);
++ dwc2_gadget_config_nonisoc_xfer_ddma(hs_ep, dma, 0);
+ } else {
+ dwc2_writel(hsotg, DXEPTSIZ_MC(1) | DXEPTSIZ_PKTCNT(1) |
+ DXEPTSIZ_XFERSIZE(0),
+--
+2.20.1
+
--- /dev/null
+From 6ed093a7f7875b0f318ec953e671e953af4f8ec5 Mon Sep 17 00:00:00 2001
+From: Young Xiao <92siuyang@gmail.com>
+Date: Tue, 28 May 2019 20:17:54 +0800
+Subject: usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]
+
+[ Upstream commit 62fd0e0a24abeebe2c19fce49dd5716d9b62042d ]
+
+There is no deallocation of fusb300->ep[i] elements, allocated at
+fusb300_probe.
+
+The patch adds deallocation of fusb300->ep array elements.
+
+Signed-off-by: Young Xiao <92siuyang@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fusb300_udc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
+index 263804d154a7..00e3f66836a9 100644
+--- a/drivers/usb/gadget/udc/fusb300_udc.c
++++ b/drivers/usb/gadget/udc/fusb300_udc.c
+@@ -1342,12 +1342,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = {
+ static int fusb300_remove(struct platform_device *pdev)
+ {
+ struct fusb300 *fusb300 = platform_get_drvdata(pdev);
++ int i;
+
+ usb_del_gadget_udc(&fusb300->gadget);
+ iounmap(fusb300->reg);
+ free_irq(platform_get_irq(pdev, 0), fusb300);
+
+ fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
++ kfree(fusb300->ep[i]);
+ kfree(fusb300);
+
+ return 0;
+@@ -1491,6 +1494,8 @@ clean_up:
+ if (fusb300->ep0_req)
+ fusb300_free_request(&fusb300->ep[0]->ep,
+ fusb300->ep0_req);
++ for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
++ kfree(fusb300->ep[i]);
+ kfree(fusb300);
+ }
+ if (reg)
+--
+2.20.1
+
--- /dev/null
+From 0b06ae982033f8960bafa23cace4bcbe4ccac760 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Wed, 22 May 2019 14:07:36 +0200
+Subject: usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC
+
+[ Upstream commit fbc318afadd6e7ae2252d6158cf7d0c5a2132f7d ]
+
+Gadget drivers may queue request in interrupt context. This would lead to
+a descriptor allocation in that context. In that case we would hit
+BUG_ON(in_interrupt()) in __get_vm_area_node.
+
+Also remove the unnecessary cast.
+
+Acked-by: Sylvain Lemieux <slemieux.tyco@gmail.com>
+Tested-by: James Grant <jamesg@zaltys.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
+index b0781771704e..eafc2a00c96a 100644
+--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
++++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
+@@ -922,8 +922,7 @@ static struct lpc32xx_usbd_dd_gad *udc_dd_alloc(struct lpc32xx_udc *udc)
+ dma_addr_t dma;
+ struct lpc32xx_usbd_dd_gad *dd;
+
+- dd = (struct lpc32xx_usbd_dd_gad *) dma_pool_alloc(
+- udc->dd_cache, (GFP_KERNEL | GFP_DMA), &dma);
++ dd = dma_pool_alloc(udc->dd_cache, GFP_ATOMIC | GFP_DMA, &dma);
+ if (dd)
+ dd->this_dma = dma;
+
+--
+2.20.1
+
--- /dev/null
+From 01c7acdcff6fd16ad9f4f5617b18c0ee52b23554 Mon Sep 17 00:00:00 2001
+From: Kan Liang <kan.liang@linux.intel.com>
+Date: Mon, 3 Jun 2019 06:41:20 -0700
+Subject: x86/CPU: Add more Icelake model numbers
+
+[ Upstream commit e35faeb64146f2015f2aec14b358ae508e4066db ]
+
+Add the CPUID model numbers of Icelake (ICL) desktop and server
+processors to the Intel family list.
+
+ [ Qiuxu: Sort the macros by model number. ]
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Cc: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
+Cc: rui.zhang@intel.com
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20190603134122.13853-1-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/intel-family.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index 9f15384c504a..310118805f57 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -52,6 +52,9 @@
+
+ #define INTEL_FAM6_CANNONLAKE_MOBILE 0x66
+
++#define INTEL_FAM6_ICELAKE_X 0x6A
++#define INTEL_FAM6_ICELAKE_XEON_D 0x6C
++#define INTEL_FAM6_ICELAKE_DESKTOP 0x7D
+ #define INTEL_FAM6_ICELAKE_MOBILE 0x7E
+
+ /* "Small Core" Processors (Atom) */
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
