--- /dev/null
+From 8ec60088398cd9f48b2fc88f9bf4a92df59d7200 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Jul 2019 08:56:51 +0200
+Subject: ALSA: hda - Don't resume forcibly i915 HDMI/DP codec
+
+[ Upstream commit 4914da2fb0c89205790503f20dfdde854f3afdd8 ]
+
+We apply the codec resume forcibly at system resume callback for
+updating and syncing the jack detection state that may have changed
+during sleeping. This is, however, superfluous for the codec like
+Intel HDMI/DP, where the jack detection is managed via the audio
+component notification; i.e. the jack state change shall be reported
+sooner or later from the graphics side at mode change.
+
+This patch changes the codec resume callback to avoid the forcible
+resume conditionally with a new flag, codec->relaxed_resume, for
+reducing the resume time. The flag is set in the codec probe.
+
+Although this doesn't fix the entire bug mentioned in the bugzilla
+entry below, it's still a good optimization and some improvements are
+seen.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201901
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_codec.c | 8 ++++++--
+ sound/pci/hda/hda_codec.h | 2 ++
+ sound/pci/hda/patch_hdmi.c | 6 +++++-
+ 3 files changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index a6233775e779f..82b0dc9f528f0 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2947,15 +2947,19 @@ static int hda_codec_runtime_resume(struct device *dev)
+ #ifdef CONFIG_PM_SLEEP
+ static int hda_codec_force_resume(struct device *dev)
+ {
++ struct hda_codec *codec = dev_to_hda_codec(dev);
++ bool forced_resume = !codec->relaxed_resume;
+ int ret;
+
+ /* The get/put pair below enforces the runtime resume even if the
+ * device hasn't been used at suspend time. This trick is needed to
+ * update the jack state change during the sleep.
+ */
+- pm_runtime_get_noresume(dev);
++ if (forced_resume)
++ pm_runtime_get_noresume(dev);
+ ret = pm_runtime_force_resume(dev);
+- pm_runtime_put(dev);
++ if (forced_resume)
++ pm_runtime_put(dev);
+ return ret;
+ }
+
+diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
+index acacc19002658..2003403ce1c82 100644
+--- a/sound/pci/hda/hda_codec.h
++++ b/sound/pci/hda/hda_codec.h
+@@ -261,6 +261,8 @@ struct hda_codec {
+ unsigned int auto_runtime_pm:1; /* enable automatic codec runtime pm */
+ unsigned int force_pin_prefix:1; /* Add location prefix */
+ unsigned int link_down_at_suspend:1; /* link down at runtime suspend */
++ unsigned int relaxed_resume:1; /* don't resume forcibly for jack */
++
+ #ifdef CONFIG_PM
+ unsigned long power_on_acct;
+ unsigned long power_off_acct;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 35931a18418f3..e4fbfb5557ab7 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2293,8 +2293,10 @@ static void generic_hdmi_free(struct hda_codec *codec)
+ struct hdmi_spec *spec = codec->spec;
+ int pin_idx, pcm_idx;
+
+- if (codec_has_acomp(codec))
++ if (codec_has_acomp(codec)) {
+ snd_hdac_acomp_register_notifier(&codec->bus->core, NULL);
++ codec->relaxed_resume = 0;
++ }
+
+ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+@@ -2550,6 +2552,8 @@ static void register_i915_notifier(struct hda_codec *codec)
+ spec->drm_audio_ops.pin_eld_notify = intel_pin_eld_notify;
+ snd_hdac_acomp_register_notifier(&codec->bus->core,
+ &spec->drm_audio_ops);
++ /* no need for forcible resume for jack check thanks to notifier */
++ codec->relaxed_resume = 1;
+ }
+
+ /* setup_stream ops override for HSW+ */
+--
+2.20.1
+
--- /dev/null
+From 0c0ca5b7c659e39720f06f81e33e2b2e3bb51fd7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 19 Jul 2019 10:27:54 +0200
+Subject: ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
+
+[ Upstream commit 2756d9143aa517b97961e85412882b8ce31371a6 ]
+
+It turned out that the recent Intel HD-audio controller chips show a
+significant stall during the system PM resume intermittently. It
+doesn't happen so often and usually it may read back successfully
+after one or more seconds, but in some rare worst cases the driver
+went into fallback mode.
+
+After trial-and-error, we found out that the communication stall seems
+covered by issuing the sync after each verb write, as already done for
+AMD and other chipsets. So this patch enables the write-sync flag for
+the recent Intel chips, Skylake and onward, as a workaround.
+
+Also, since Broxton and co have the very same driver flags as Skylake,
+refer to the Skylake driver flags instead of defining the same
+contents again for simplification.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201901
+Reported-and-tested-by: Todd Brandt <todd.e.brandt@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 7a3e34b120b33..c3e3d80ff7203 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -329,13 +329,11 @@ enum {
+
+ #define AZX_DCAPS_INTEL_SKYLAKE \
+ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
++ AZX_DCAPS_SYNC_WRITE |\
+ AZX_DCAPS_SEPARATE_STREAM_TAG | AZX_DCAPS_I915_COMPONENT |\
+ AZX_DCAPS_I915_POWERWELL)
+
+-#define AZX_DCAPS_INTEL_BROXTON \
+- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
+- AZX_DCAPS_SEPARATE_STREAM_TAG | AZX_DCAPS_I915_COMPONENT |\
+- AZX_DCAPS_I915_POWERWELL)
++#define AZX_DCAPS_INTEL_BROXTON AZX_DCAPS_INTEL_SKYLAKE
+
+ /* quirks for ATI SB / AMD Hudson */
+ #define AZX_DCAPS_PRESET_ATI_SB \
+--
+2.20.1
+
--- /dev/null
+From 7e4cad98572fb812e680b3f40106c641fbda975c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 25 Jan 2019 17:11:32 +0100
+Subject: ALSA: pcm: Fix tight loop of OSS capture stream
+
+[ Upstream commit e190161f96b88ffae870405fd6c3fdd1d2e7f98d ]
+
+When the trigger=off is passed for a PCM OSS stream, it sets the
+start_threshold of the given substream to the boundary size, so that
+it won't be automatically started. This can be problematic for a
+capture stream, unfortunately, as detected by syzkaller. The scenario
+is like the following:
+
+- In __snd_pcm_lib_xfer() that is invoked from snd_pcm_oss_read()
+ loop, we have a check whether the stream was already started or the
+ stream can be auto-started.
+- The function at this check returns 0 with trigger=off since we
+ explicitly disable the auto-start.
+- The loop continues and repeats calling __snd_pcm_lib_xfer() tightly,
+ which may lead to an RCU stall.
+
+This patch fixes the bug by simply allowing the wait for non-started
+stream in the case of OSS capture. For native usages, it's supposed
+to be done by the caller side (which is user-space), hence it returns
+zero like before.
+
+(In theory, __snd_pcm_lib_xfer() could wait even for the native API
+ usage cases, too; but I'd like to stay in a safer side for not
+ breaking the existing stuff for now.)
+
+Reported-by: syzbot+fbe0496f92a0ce7b786c@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 40013b26f6719..6c99fa8ac5fa1 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2112,6 +2112,13 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
++/* allow waiting for a capture stream that hasn't been started */
++#if IS_ENABLED(CONFIG_SND_PCM_OSS)
++#define wait_capture_start(substream) ((substream)->oss.oss)
++#else
++#define wait_capture_start(substream) false
++#endif
++
+ /* the common loop for read/write data */
+ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ void *data, bool interleaved,
+@@ -2182,7 +2189,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ err = snd_pcm_start(substream);
+ if (err < 0)
+ goto _end_unlock;
+- } else {
++ } else if (!wait_capture_start(substream)) {
+ /* nothing to do */
+ err = 0;
+ goto _end_unlock;
+--
+2.20.1
+
--- /dev/null
+From 665b0aa6e5d99034dc6658cf64ba5a240a084d6f Mon Sep 17 00:00:00 2001
+From: Ricardo Biehl Pasquali <pasqualirb@gmail.com>
+Date: Sat, 25 Aug 2018 16:53:23 -0300
+Subject: ALSA: pcm: Return 0 when size < start_threshold in capture
+
+[ Upstream commit 62ba568f7aef4beb0eda945a2b2a91b7a2b8f215 ]
+
+In __snd_pcm_lib_xfer(), when capture, if state is PREPARED
+and size is less than start_threshold nothing can be done.
+As there is no error, 0 is returned.
+
+Signed-off-by: Ricardo Biehl Pasquali <pasqualirb@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 4e6110d778bd2..7f71c2449af5e 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2173,11 +2173,16 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ goto _end_unlock;
+
+ if (!is_playback &&
+- runtime->status->state == SNDRV_PCM_STATE_PREPARED &&
+- size >= runtime->start_threshold) {
+- err = snd_pcm_start(substream);
+- if (err < 0)
++ runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
++ if (size >= runtime->start_threshold) {
++ err = snd_pcm_start(substream);
++ if (err < 0)
++ goto _end_unlock;
++ } else {
++ /* nothing to do */
++ err = 0;
+ goto _end_unlock;
++ }
+ }
+
+ runtime->twake = runtime->control->avail_min ? : 1;
+--
+2.20.1
+
--- /dev/null
+From abe681ee1a80974355b9de46aa5dbcf5a6fc8222 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 6 Feb 2019 07:30:44 +0100
+Subject: ALSA: pcm: Revert capture stream behavior change in blocking mode
+
+[ Upstream commit 00a399cad1a063e7665f06b6497a807db20441fd ]
+
+In the commit 62ba568f7aef ("ALSA: pcm: Return 0 when size <
+start_threshold in capture"), we changed the behavior of
+__snd_pcm_lib_xfer() to return immediately with 0 when a capture
+stream has a high start_threshold. This was intended to be a
+correction of the behavior consistency and looked harmless, but this
+was the culprit of the recent breakage reported by syzkaller, which
+was fixed by the commit e190161f96b8 ("ALSA: pcm: Fix tight loop of
+OSS capture stream").
+
+At the time for the OSS fix, I didn't touch the behavior for ALSA
+native API, as assuming that this behavior actually is good. But this
+turned out to be also broken actually for a similar deployment,
+e.g. one thread goes to a write loop in blocking mode while another
+thread controls the start/stop of the stream manually.
+
+Overall, the original commit is harmful, and it brings less merit to
+keep that behavior. Let's revert it.
+
+Fixes: 62ba568f7aef ("ALSA: pcm: Return 0 when size < start_threshold in capture")
+Fixes: e190161f96b8 ("ALSA: pcm: Fix tight loop of OSS capture stream")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 20 ++++----------------
+ 1 file changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 6c99fa8ac5fa1..6c0b30391ba99 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2112,13 +2112,6 @@ int pcm_lib_apply_appl_ptr(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-/* allow waiting for a capture stream that hasn't been started */
+-#if IS_ENABLED(CONFIG_SND_PCM_OSS)
+-#define wait_capture_start(substream) ((substream)->oss.oss)
+-#else
+-#define wait_capture_start(substream) false
+-#endif
+-
+ /* the common loop for read/write data */
+ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ void *data, bool interleaved,
+@@ -2184,16 +2177,11 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ snd_pcm_update_hw_ptr(substream);
+
+ if (!is_playback &&
+- runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
+- if (size >= runtime->start_threshold) {
+- err = snd_pcm_start(substream);
+- if (err < 0)
+- goto _end_unlock;
+- } else if (!wait_capture_start(substream)) {
+- /* nothing to do */
+- err = 0;
++ runtime->status->state == SNDRV_PCM_STATE_PREPARED &&
++ size >= runtime->start_threshold) {
++ err = snd_pcm_start(substream);
++ if (err < 0)
+ goto _end_unlock;
+- }
+ }
+
+ avail = snd_pcm_avail(substream);
+--
+2.20.1
+
--- /dev/null
+From 9d970af67299360eaacd6edb37d60730d5d5e2e3 Mon Sep 17 00:00:00 2001
+From: Ricardo Biehl Pasquali <pasqualirb@gmail.com>
+Date: Fri, 7 Sep 2018 16:58:54 -0300
+Subject: ALSA: pcm: Update hardware pointer before start capture
+
+[ Upstream commit 64b6acf60b665fffd419c23886a1cbeeb253cfb4 ]
+
+This ensures the transfer loop won't waste a run to read
+the few frames (if any) between start and hw_ptr update.
+It will wait for the next interrupt with wait_for_avail().
+
+Signed-off-by: Ricardo Biehl Pasquali <pasqualirb@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 7f71c2449af5e..40013b26f6719 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -2172,6 +2172,10 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ if (err < 0)
+ goto _end_unlock;
+
++ runtime->twake = runtime->control->avail_min ? : 1;
++ if (runtime->status->state == SNDRV_PCM_STATE_RUNNING)
++ snd_pcm_update_hw_ptr(substream);
++
+ if (!is_playback &&
+ runtime->status->state == SNDRV_PCM_STATE_PREPARED) {
+ if (size >= runtime->start_threshold) {
+@@ -2185,10 +2189,8 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(struct snd_pcm_substream *substream,
+ }
+ }
+
+- runtime->twake = runtime->control->avail_min ? : 1;
+- if (runtime->status->state == SNDRV_PCM_STATE_RUNNING)
+- snd_pcm_update_hw_ptr(substream);
+ avail = snd_pcm_avail(substream);
++
+ while (size > 0) {
+ snd_pcm_uframes_t frames, appl_ptr, appl_ofs;
+ snd_pcm_uframes_t cont;
+--
+2.20.1
+
--- /dev/null
+From 55f960babbca6d906fd97cf36f08f3d29ebccd2e Mon Sep 17 00:00:00 2001
+From: Mike Salvatore <mike.salvatore@canonical.com>
+Date: Wed, 12 Jun 2019 14:55:14 -0700
+Subject: apparmor: reset pos on failure to unpack for various functions
+
+[ Upstream commit 156e42996bd84eccb6acf319f19ce0cb140d00e3 ]
+
+Each function that manipulates the aa_ext struct should reset it's "pos"
+member on failure. This ensures that, on failure, no changes are made to
+the state of the aa_ext struct.
+
+There are paths were elements are optional and the error path is
+used to indicate the optional element is not present. This means
+instead of just aborting on error the unpack stream can become
+unsynchronized on optional elements, if using one of the affected
+functions.
+
+Cc: stable@vger.kernel.org
+Fixes: 736ec752d95e ("AppArmor: policy routines for loading and unpacking policy")
+Signed-off-by: Mike Salvatore <mike.salvatore@canonical.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/policy_unpack.c | 40 +++++++++++++++++++++++++------
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
+index 088ea2ac85706..612f737cee836 100644
+--- a/security/apparmor/policy_unpack.c
++++ b/security/apparmor/policy_unpack.c
+@@ -223,16 +223,21 @@ static void *kvmemdup(const void *src, size_t len)
+ static size_t unpack_u16_chunk(struct aa_ext *e, char **chunk)
+ {
+ size_t size = 0;
++ void *pos = e->pos;
+
+ if (!inbounds(e, sizeof(u16)))
+- return 0;
++ goto fail;
+ size = le16_to_cpu(get_unaligned((__le16 *) e->pos));
+ e->pos += sizeof(__le16);
+ if (!inbounds(e, size))
+- return 0;
++ goto fail;
+ *chunk = e->pos;
+ e->pos += size;
+ return size;
++
++fail:
++ e->pos = pos;
++ return 0;
+ }
+
+ /* unpack control byte */
+@@ -294,49 +299,66 @@ fail:
+
+ static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_U32, name)) {
+ if (!inbounds(e, sizeof(u32)))
+- return 0;
++ goto fail;
+ if (data)
+ *data = le32_to_cpu(get_unaligned((__le32 *) e->pos));
+ e->pos += sizeof(u32);
+ return 1;
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+ static bool unpack_u64(struct aa_ext *e, u64 *data, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_U64, name)) {
+ if (!inbounds(e, sizeof(u64)))
+- return 0;
++ goto fail;
+ if (data)
+ *data = le64_to_cpu(get_unaligned((__le64 *) e->pos));
+ e->pos += sizeof(u64);
+ return 1;
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+ static size_t unpack_array(struct aa_ext *e, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_ARRAY, name)) {
+ int size;
+ if (!inbounds(e, sizeof(u16)))
+- return 0;
++ goto fail;
+ size = (int)le16_to_cpu(get_unaligned((__le16 *) e->pos));
+ e->pos += sizeof(u16);
+ return size;
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+ static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
+ {
++ void *pos = e->pos;
++
+ if (unpack_nameX(e, AA_BLOB, name)) {
+ u32 size;
+ if (!inbounds(e, sizeof(u32)))
+- return 0;
++ goto fail;
+ size = le32_to_cpu(get_unaligned((__le32 *) e->pos));
+ e->pos += sizeof(u32);
+ if (inbounds(e, (size_t) size)) {
+@@ -345,6 +367,9 @@ static size_t unpack_blob(struct aa_ext *e, char **blob, const char *name)
+ return size;
+ }
+ }
++
++fail:
++ e->pos = pos;
+ return 0;
+ }
+
+@@ -361,9 +386,10 @@ static int unpack_str(struct aa_ext *e, const char **string, const char *name)
+ if (src_str[size - 1] != 0)
+ goto fail;
+ *string = src_str;
++
++ return size;
+ }
+ }
+- return size;
+
+ fail:
+ e->pos = pos;
+--
+2.20.1
+
--- /dev/null
+From 370789afe9ffa471d37eb6a51f8bf8a8d34ebade Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Mon, 10 Dec 2018 16:56:45 -0800
+Subject: ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal
+ arrives while handle_mm_fault
+
+[ Upstream commit 4d447455e73b47c43dd35fcc38ed823d3182a474 ]
+
+do_page_fault() forgot to relinquish mmap_sem if a signal came while
+handling handle_mm_fault() - due to say a ctl+c or oom etc.
+This would later cause a deadlock by acquiring it twice.
+
+This came to light when running libc testsuite tst-tls3-malloc test but
+is likely also the cause for prior seen LTP failures. Using lockdep
+clearly showed what the issue was.
+
+| # while true; do ./tst-tls3-malloc ; done
+| Didn't expect signal from child: got `Segmentation fault'
+| ^C
+| ============================================
+| WARNING: possible recursive locking detected
+| 4.17.0+ #25 Not tainted
+| --------------------------------------------
+| tst-tls3-malloc/510 is trying to acquire lock:
+| 606c7728 (&mm->mmap_sem){++++}, at: __might_fault+0x28/0x5c
+|
+|but task is already holding lock:
+|606c7728 (&mm->mmap_sem){++++}, at: do_page_fault+0x9c/0x2a0
+|
+| other info that might help us debug this:
+| Possible unsafe locking scenario:
+|
+| CPU0
+| ----
+| lock(&mm->mmap_sem);
+| lock(&mm->mmap_sem);
+|
+| *** DEADLOCK ***
+|
+
+------------------------------------------------------------
+What the change does is not obvious (note to myself)
+
+prior code was
+
+| do_page_fault
+|
+| down_read() <-- lock taken
+| handle_mm_fault <-- signal pending as this runs
+| if fatal_signal_pending
+| if VM_FAULT_ERROR
+| up_read
+| if user_mode
+| return <-- lock still held, this was the BUG
+
+New code
+
+| do_page_fault
+|
+| down_read() <-- lock taken
+| handle_mm_fault <-- signal pending as this runs
+| if fatal_signal_pending
+| if VM_FAULT_RETRY
+| return <-- not same case as above, but still OK since
+| core mm already relinq lock for FAULT_RETRY
+| ...
+|
+| < Now falls through for bug case above >
+|
+| up_read() <-- lock relinquished
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/mm/fault.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index db6913094be3c..f28db0b112a30 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -143,12 +143,17 @@ good_area:
+ */
+ fault = handle_mm_fault(vma, address, flags);
+
+- /* If Pagefault was interrupted by SIGKILL, exit page fault "early" */
+ if (unlikely(fatal_signal_pending(current))) {
+- if ((fault & VM_FAULT_ERROR) && !(fault & VM_FAULT_RETRY))
+- up_read(&mm->mmap_sem);
+- if (user_mode(regs))
++
++ /*
++ * if fault retry, mmap_sem already relinquished by core mm
++ * so OK to return to user mode (with signal handled first)
++ */
++ if (fault & VM_FAULT_RETRY) {
++ if (!user_mode(regs))
++ goto no_context;
+ return;
++ }
+ }
+
+ perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
+--
+2.20.1
+
--- /dev/null
+From a9fb3eeeaef1826ac0e9704173028150607276d6 Mon Sep 17 00:00:00 2001
+From: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Date: Wed, 7 Nov 2018 15:12:49 +0300
+Subject: ARC: mm: fix uninitialised signal code in do_page_fault
+
+[ Upstream commit 121e38e5acdc8e1e4cdb750fcdcc72f94e420968 ]
+
+Commit 15773ae938d8 ("signal/arc: Use force_sig_fault where
+appropriate") introduced undefined behaviour by leaving si_code
+unitiailized and leaking random kernel values to user space.
+
+Fixes: 15773ae938d8 ("signal/arc: Use force_sig_fault where appropriate")
+Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/mm/fault.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index a0366f9dca051..535cf18e8bf2c 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -66,7 +66,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ struct vm_area_struct *vma = NULL;
+ struct task_struct *tsk = current;
+ struct mm_struct *mm = tsk->mm;
+- int si_code;
++ int si_code = 0;
+ int ret;
+ vm_fault_t fault;
+ int write = regs->ecr_cause & ECR_C_PROTV_STORE; /* ST/EX */
+--
+2.20.1
+
--- /dev/null
+From f4300214a84e1934d5583b2532e4ecdca64af070 Mon Sep 17 00:00:00 2001
+From: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Date: Mon, 13 May 2019 20:28:00 +0300
+Subject: ARC: mm: SIGSEGV userspace trying to access kernel virtual memory
+
+[ Upstream commit a8c715b4dd73c26a81a9cc8dc792aa715d8b4bb2 ]
+
+As of today if userspace process tries to access a kernel virtual addres
+(0x7000_0000 to 0x7ffff_ffff) such that a legit kernel mapping already
+exists, that process hangs instead of being killed with SIGSEGV
+
+Fix that by ensuring that do_page_fault() handles kenrel vaddr only if
+in kernel mode.
+
+And given this, we can also simplify the code a bit. Now a vmalloc fault
+implies kernel mode so its failure (for some reason) can reuse the
+@no_context label and we can remove @bad_area_nosemaphore.
+
+Reproduce user test for original problem:
+
+------------------------>8-----------------
+ #include <stdlib.h>
+ #include <stdint.h>
+
+ int main(int argc, char *argv[])
+ {
+ volatile uint32_t temp;
+
+ temp = *(uint32_t *)(0x70000000);
+ }
+------------------------>8-----------------
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/mm/fault.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index 535cf18e8bf2c..4e8143de32e70 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -66,7 +66,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ struct vm_area_struct *vma = NULL;
+ struct task_struct *tsk = current;
+ struct mm_struct *mm = tsk->mm;
+- int si_code = 0;
++ int si_code = SEGV_MAPERR;
+ int ret;
+ vm_fault_t fault;
+ int write = regs->ecr_cause & ECR_C_PROTV_STORE; /* ST/EX */
+@@ -81,16 +81,14 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ * only copy the information from the master page table,
+ * nothing more.
+ */
+- if (address >= VMALLOC_START) {
++ if (address >= VMALLOC_START && !user_mode(regs)) {
+ ret = handle_kernel_vaddr_fault(address);
+ if (unlikely(ret))
+- goto bad_area_nosemaphore;
++ goto no_context;
+ else
+ return;
+ }
+
+- si_code = SEGV_MAPERR;
+-
+ /*
+ * If we're in an interrupt or have no user
+ * context, we must not take the fault..
+@@ -198,7 +196,6 @@ good_area:
+ bad_area:
+ up_read(&mm->mmap_sem);
+
+-bad_area_nosemaphore:
+ /* User mode accesses just cause a SIGSEGV */
+ if (user_mode(regs)) {
+ tsk->thread.fault_address = address;
+--
+2.20.1
+
--- /dev/null
+From d3e91a926edd7e13238dda775044a5c95aa5ad45 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 18 Dec 2018 10:39:58 -0800
+Subject: ARC: show_regs: lockdep: re-enable preemption
+
+[ Upstream commit f731a8e89f8c78985707c626680f3e24c7a60772 ]
+
+signal handling core calls show_regs() with preemption disabled which
+on ARC takes mmap_sem for mm/vma access, causing lockdep splat.
+
+| [ARCLinux]# ./segv-null-ptr
+| potentially unexpected fatal signal 11.
+| BUG: sleeping function called from invalid context at kernel/fork.c:1011
+| in_atomic(): 1, irqs_disabled(): 0, pid: 70, name: segv-null-ptr
+| no locks held by segv-null-ptr/70.
+| CPU: 0 PID: 70 Comm: segv-null-ptr Not tainted 4.18.0+ #69
+|
+| Stack Trace:
+| arc_unwind_core+0xcc/0x100
+| ___might_sleep+0x17a/0x190
+| mmput+0x16/0xb8
+| show_regs+0x52/0x310
+| get_signal+0x5ee/0x610
+| do_signal+0x2c/0x218
+| resume_user_mode_begin+0x90/0xd8
+
+Workaround by re-enabling preemption temporarily.
+
+Note that the preemption disabling in core code around show_regs()
+was introduced by commit 3a9f84d354ce ("signals, debug: fix BUG: using
+smp_processor_id() in preemptible code in print_fatal_signal()")
+
+to silence a differnt lockdep seen on x86 bakc in 2009.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/troubleshoot.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
+index 5c6663321e873..215f515442e03 100644
+--- a/arch/arc/kernel/troubleshoot.c
++++ b/arch/arc/kernel/troubleshoot.c
+@@ -179,6 +179,12 @@ void show_regs(struct pt_regs *regs)
+ struct task_struct *tsk = current;
+ struct callee_regs *cregs;
+
++ /*
++ * generic code calls us with preemption disabled, but some calls
++ * here could sleep, so re-enable to avoid lockdep splat
++ */
++ preempt_enable();
++
+ print_task_path_n_nm(tsk);
+ show_regs_print_info(KERN_INFO);
+
+@@ -221,6 +227,8 @@ void show_regs(struct pt_regs *regs)
+ cregs = (struct callee_regs *)current->thread.callee_reg;
+ if (cregs)
+ show_callee_regs(cregs);
++
++ preempt_disable();
+ }
+
+ void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
+--
+2.20.1
+
--- /dev/null
+From 1299563115cbeac501c176a793eb89c18804f668 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 21 Nov 2018 10:35:12 +0100
+Subject: ARM: davinci: da8xx: define gpio interrupts as separate resources
+
+[ Upstream commit 58a0afbf4c99ac355df16773af835b919b9432ee ]
+
+Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous
+IRQ numbering") the davinci GPIO driver fails to probe if we boot
+in legacy mode from any of the board files. Since the driver now
+expects every interrupt to be defined as a separate resource, split
+the definition of IRQ resources instead of having a single continuous
+interrupt range.
+
+Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/devices-da8xx.c | 40 +++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
+index 3c42bf9fa0618..708931b470909 100644
+--- a/arch/arm/mach-davinci/devices-da8xx.c
++++ b/arch/arm/mach-davinci/devices-da8xx.c
+@@ -704,6 +704,46 @@ static struct resource da8xx_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DA8XX_GPIO0,
++ .end = IRQ_DA8XX_GPIO0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO1,
++ .end = IRQ_DA8XX_GPIO1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO2,
++ .end = IRQ_DA8XX_GPIO2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO3,
++ .end = IRQ_DA8XX_GPIO3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO4,
++ .end = IRQ_DA8XX_GPIO4,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO5,
++ .end = IRQ_DA8XX_GPIO5,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO6,
++ .end = IRQ_DA8XX_GPIO6,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO7,
++ .end = IRQ_DA8XX_GPIO7,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DA8XX_GPIO8,
+ .end = IRQ_DA8XX_GPIO8,
+ .flags = IORESOURCE_IRQ,
+ },
+--
+2.20.1
+
--- /dev/null
+From 127fc3877b10769681d8240231c81a6fff2131c5 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 21 Nov 2018 10:35:15 +0100
+Subject: ARM: davinci: dm355: define gpio interrupts as separate resources
+
+[ Upstream commit 27db7baab640ea28d7994eda943fef170e347081 ]
+
+Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous
+IRQ numbering") the davinci GPIO driver fails to probe if we boot
+in legacy mode from any of the board files. Since the driver now
+expects every interrupt to be defined as a separate resource, split
+the definition of IRQ resources instead of having a single continuous
+interrupt range.
+
+Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/dm355.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
+index 9f7d38d12c888..2b0f5d97ab7c1 100644
+--- a/arch/arm/mach-davinci/dm355.c
++++ b/arch/arm/mach-davinci/dm355.c
+@@ -548,6 +548,36 @@ static struct resource dm355_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DM355_GPIOBNK0,
++ .end = IRQ_DM355_GPIOBNK0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK1,
++ .end = IRQ_DM355_GPIOBNK1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK2,
++ .end = IRQ_DM355_GPIOBNK2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK3,
++ .end = IRQ_DM355_GPIOBNK3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK4,
++ .end = IRQ_DM355_GPIOBNK4,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK5,
++ .end = IRQ_DM355_GPIOBNK5,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM355_GPIOBNK6,
+ .end = IRQ_DM355_GPIOBNK6,
+ .flags = IORESOURCE_IRQ,
+ },
+--
+2.20.1
+
--- /dev/null
+From d25e2da378c593018b1deda47d99e49d780a2f7c Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 21 Nov 2018 10:35:13 +0100
+Subject: ARM: davinci: dm365: define gpio interrupts as separate resources
+
+[ Upstream commit 193c04374e281a56c7d4f96e66d329671945bebe ]
+
+Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous
+IRQ numbering") the davinci GPIO driver fails to probe if we boot
+in legacy mode from any of the board files. Since the driver now
+expects every interrupt to be defined as a separate resource, split
+the definition of IRQ resources instead of having a single continuous
+interrupt range.
+
+Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/dm365.c | 35 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
+index abcf2a5ed89b5..42665914166a3 100644
+--- a/arch/arm/mach-davinci/dm365.c
++++ b/arch/arm/mach-davinci/dm365.c
+@@ -267,6 +267,41 @@ static struct resource dm365_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DM365_GPIO0,
++ .end = IRQ_DM365_GPIO0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO1,
++ .end = IRQ_DM365_GPIO1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO2,
++ .end = IRQ_DM365_GPIO2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO3,
++ .end = IRQ_DM365_GPIO3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO4,
++ .end = IRQ_DM365_GPIO4,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO5,
++ .end = IRQ_DM365_GPIO5,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO6,
++ .end = IRQ_DM365_GPIO6,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM365_GPIO7,
+ .end = IRQ_DM365_GPIO7,
+ .flags = IORESOURCE_IRQ,
+ },
+--
+2.20.1
+
--- /dev/null
+From 0d5065ae9bc7934a5d80295b03c3fdd609d9434f Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 21 Nov 2018 10:35:16 +0100
+Subject: ARM: davinci: dm644x: define gpio interrupts as separate resources
+
+[ Upstream commit adcf60ce14c8250761af9de907eb6c7d096c26d3 ]
+
+Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous
+IRQ numbering") the davinci GPIO driver fails to probe if we boot
+in legacy mode from any of the board files. Since the driver now
+expects every interrupt to be defined as a separate resource, split
+the definition of IRQ resources instead of having a single continuous
+interrupt range.
+
+Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/dm644x.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
+index 0720da7809a69..de1ec6dc01e94 100644
+--- a/arch/arm/mach-davinci/dm644x.c
++++ b/arch/arm/mach-davinci/dm644x.c
+@@ -492,6 +492,26 @@ static struct resource dm644_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_GPIOBNK0,
++ .end = IRQ_GPIOBNK0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK1,
++ .end = IRQ_GPIOBNK1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK2,
++ .end = IRQ_GPIOBNK2,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK3,
++ .end = IRQ_GPIOBNK3,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_GPIOBNK4,
+ .end = IRQ_GPIOBNK4,
+ .flags = IORESOURCE_IRQ,
+ },
+--
+2.20.1
+
--- /dev/null
+From 0525d50cbd34e59e3690f35ed7beba9689a515e3 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 21 Nov 2018 10:35:14 +0100
+Subject: ARM: davinci: dm646x: define gpio interrupts as separate resources
+
+[ Upstream commit 2c9c83491f30afbce25796e185cd4d5e36080e31 ]
+
+Since commit eb3744a2dd01 ("gpio: davinci: Do not assume continuous
+IRQ numbering") the davinci GPIO driver fails to probe if we boot
+in legacy mode from any of the board files. Since the driver now
+expects every interrupt to be defined as a separate resource, split
+the definition of IRQ resources instead of having a single continuous
+interrupt range.
+
+Fixes: eb3744a2dd01 ("gpio: davinci: Do not assume continuous IRQ numbering")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/dm646x.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
+index 6bd2ed069d0d7..d9b93e2806d22 100644
+--- a/arch/arm/mach-davinci/dm646x.c
++++ b/arch/arm/mach-davinci/dm646x.c
+@@ -442,6 +442,16 @@ static struct resource dm646x_gpio_resources[] = {
+ },
+ { /* interrupt */
+ .start = IRQ_DM646X_GPIOBNK0,
++ .end = IRQ_DM646X_GPIOBNK0,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM646X_GPIOBNK1,
++ .end = IRQ_DM646X_GPIOBNK1,
++ .flags = IORESOURCE_IRQ,
++ },
++ {
++ .start = IRQ_DM646X_GPIOBNK2,
+ .end = IRQ_DM646X_GPIOBNK2,
+ .flags = IORESOURCE_IRQ,
+ },
+--
+2.20.1
+
--- /dev/null
+From 28a8ec05ebfe2d0813de706657aeef38bc4d59f4 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 15 Jul 2019 22:21:01 +0200
+Subject: ARM: dts: gemini: Set DIR-685 SPI CS as active low
+
+[ Upstream commit f90b8fda3a9d72a9422ea80ae95843697f94ea4a ]
+
+The SPI to the display on the DIR-685 is active low, we were
+just saved by the SPI library enforcing active low on everything
+before, so set it as active low to avoid ambiguity.
+
+Link: https://lore.kernel.org/r/20190715202101.16060-1-linus.walleij@linaro.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/gemini-dlink-dir-685.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/gemini-dlink-dir-685.dts b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+index 502a361d1fe90..15d6157b661db 100644
+--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts
++++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+@@ -65,7 +65,7 @@
+ gpio-miso = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+ gpio-mosi = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+ /* Collides with pflash CE1, not so cool */
+- cs-gpios = <&gpio0 20 GPIO_ACTIVE_HIGH>;
++ cs-gpios = <&gpio0 20 GPIO_ACTIVE_LOW>;
+ num-chipselects = <1>;
+
+ panel: display@0 {
+--
+2.20.1
+
--- /dev/null
+From 7820122d8660a51a598f5e953b1cb666fc0c6083 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@gmail.com>
+Date: Tue, 26 Feb 2019 01:12:01 +0100
+Subject: ARM: dts: qcom: ipq4019: enlarge PCIe BAR range
+
+[ Upstream commit f3e35357cd460a8aeb48b8113dc4b761a7d5c828 ]
+
+David Bauer reported that the VDSL modem (attached via PCIe)
+on his AVM Fritz!Box 7530 was complaining about not having
+enough space in the BAR. A closer inspection of the old
+qcom-ipq40xx.dtsi pulled from the GL-iNet repository listed:
+
+| qcom,pcie@80000 {
+| compatible = "qcom,msm_pcie";
+| reg = <0x80000 0x2000>,
+| <0x99000 0x800>,
+| <0x40000000 0xf1d>,
+| <0x40000f20 0xa8>,
+| <0x40100000 0x1000>,
+| <0x40200000 0x100000>,
+| <0x40300000 0xd00000>;
+| reg-names = "parf", "phy", "dm_core", "elbi",
+| "conf", "io", "bars";
+
+Matching the reg-names with the listed reg leads to
+<0xd00000> as the size for the "bars".
+
+Cc: stable@vger.kernel.org
+BugLink: https://www.mail-archive.com/openwrt-devel@lists.openwrt.org/msg45212.html
+Reported-by: David Bauer <mail@david-bauer.net>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Andy Gross <agross@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 814ab7283228a..54d056b01bb51 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -386,8 +386,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000
+- 0x82000000 0 0x40300000 0x40300000 0 0x400000>;
++ ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
++ <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.20.1
+
--- /dev/null
+From e470a5c173c22f3f8f29409e3003f0b5d8cd252c Mon Sep 17 00:00:00 2001
+From: Niklas Cassel <niklas.cassel@linaro.org>
+Date: Thu, 24 Jan 2019 14:00:47 +0100
+Subject: ARM: dts: qcom: ipq4019: Fix MSI IRQ type
+
+[ Upstream commit 97131f85c08e024df49480ed499aae8fb754067f ]
+
+The databook clearly states that the MSI IRQ (msi_ctrl_int) is a level
+triggered interrupt.
+
+The msi_ctrl_int will be high for as long as any MSI status bit is set,
+thus the IRQ type should be set to IRQ_TYPE_LEVEL_HIGH, causing the
+IRQ handler to keep getting called, as long as any MSI status bit is set.
+
+A git grep shows that ipq4019 is the only SoC using snps,dw-pcie that has
+configured this IRQ incorrectly.
+
+Not having the correct IRQ type defined will cause us to lose interrupts,
+which in turn causes timeouts in the PCIe endpoint drivers.
+
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 2c3168d95a2d5..814ab7283228a 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -389,7 +389,7 @@
+ ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000
+ 0x82000000 0 0x40300000 0x40300000 0 0x400000>;
+
+- interrupts = <GIC_SPI 141 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0x7>;
+--
+2.20.1
+
--- /dev/null
+From 41f2b732538e0abe0e64657f855d6e530ecd1647 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Wed, 25 Jul 2018 10:37:48 +0200
+Subject: ARM: dts: qcom: ipq4019: fix PCI range
+
+[ Upstream commit da89f500cb55fb3f19c4b399b46d8add0abbd4d6 ]
+
+The PCI range is invalid and PCI attached devices doen't work.
+
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 78db67337ed4a..2c3168d95a2d5 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -387,7 +387,7 @@
+ #size-cells = <2>;
+
+ ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000
+- 0x82000000 0 0x48000000 0x48000000 0 0x10000000>;
++ 0x82000000 0 0x40300000 0x40300000 0 0x400000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "msi";
+--
+2.20.1
+
--- /dev/null
+From d902e4d3453074179f070eec10681223717a3b36 Mon Sep 17 00:00:00 2001
+From: Dmitry Voytik <voytikd@gmail.com>
+Date: Tue, 22 Jan 2019 23:38:48 +0100
+Subject: arm64: dts: rockchip: enable usb-host regulators at boot on
+ rk3328-rock64
+
+[ Upstream commit 26e2d7b03ea7ff254bf78305aa44dda62e70b78e ]
+
+After commit ef05bcb60c1a, boot from USB drives is broken.
+Fix this problem by enabling usb-host regulators during boot time.
+
+Fixes: ef05bcb60c1a ("arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Voytik <voytikd@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+index c142169a58fc5..e9147e35b7396 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -40,6 +40,7 @@
+ pinctrl-0 = <&usb30_host_drv>;
+ regulator-name = "vcc_host_5v";
+ regulator-always-on;
++ regulator-boot-on;
+ vin-supply = <&vcc_sys>;
+ };
+
+@@ -50,6 +51,7 @@
+ pinctrl-0 = <&usb20_host_drv>;
+ regulator-name = "vcc_host1_5v";
+ regulator-always-on;
++ regulator-boot-on;
+ vin-supply = <&vcc_sys>;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From e53578224a82d611d61293501cc12f58e2acbed8 Mon Sep 17 00:00:00 2001
+From: Dinh Nguyen <dinguyen@kernel.org>
+Date: Wed, 13 Mar 2019 17:28:37 -0500
+Subject: arm64: dts: stratix10: add the sysmgr-syscon property from the gmac's
+
+[ Upstream commit 8efd6365417a044db03009724ecc1a9521524913 ]
+
+The gmac ethernet driver uses the "altr,sysmgr-syscon" property to
+configure phy settings for the gmac controller.
+
+Add the "altr,sysmgr-syscon" property to all gmac nodes.
+
+This patch fixes:
+
+[ 0.917530] socfpga-dwmac ff800000.ethernet: No sysmgr-syscon node found
+[ 0.924209] socfpga-dwmac ff800000.ethernet: Unable to parse OF data
+
+Cc: stable@vger.kernel.org
+Reported-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index 5089aa64088fc..9a1ea8a464057 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -140,6 +140,7 @@
+ tx-fifo-depth = <16384>;
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
++ altr,sysmgr-syscon = <&sysmgr 0x44 0>;
+ status = "disabled";
+ };
+
+@@ -156,6 +157,7 @@
+ tx-fifo-depth = <16384>;
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
++ altr,sysmgr-syscon = <&sysmgr 0x48 0>;
+ status = "disabled";
+ };
+
+@@ -172,6 +174,7 @@
+ tx-fifo-depth = <16384>;
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
++ altr,sysmgr-syscon = <&sysmgr 0x4c 0>;
+ status = "disabled";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 218551d8fb910824f4416f4ac118d61e9a73b576 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:56 +0800
+Subject: bcache: add comments for mutex_lock(&b->write_lock)
+
+[ Upstream commit 41508bb7d46b74dba631017e5a702a86caf1db8c ]
+
+When accessing or modifying BTREE_NODE_dirty bit, it is not always
+necessary to acquire b->write_lock. In bch_btree_cache_free() and
+mca_reap() acquiring b->write_lock is necessary, and this patch adds
+comments to explain why mutex_lock(&b->write_lock) is necessary for
+checking or clearing BTREE_NODE_dirty bit there.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/btree.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 8c80833e73a9a..e0468fd41b6ea 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -649,6 +649,11 @@ static int mca_reap(struct btree *b, unsigned int min_order, bool flush)
+ up(&b->io_mutex);
+ }
+
++ /*
++ * BTREE_NODE_dirty might be cleared in btree_flush_btree() by
++ * __bch_btree_node_write(). To avoid an extra flush, acquire
++ * b->write_lock before checking BTREE_NODE_dirty bit.
++ */
+ mutex_lock(&b->write_lock);
+ if (btree_node_dirty(b))
+ __bch_btree_node_write(b, &cl);
+@@ -772,6 +777,11 @@ void bch_btree_cache_free(struct cache_set *c)
+ while (!list_empty(&c->btree_cache)) {
+ b = list_first_entry(&c->btree_cache, struct btree, list);
+
++ /*
++ * This function is called by cache_set_free(), no I/O
++ * request on cache now, it is unnecessary to acquire
++ * b->write_lock before clearing BTREE_NODE_dirty anymore.
++ */
+ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+ clear_bit(BTREE_NODE_dirty, &b->flags);
+--
+2.20.1
+
--- /dev/null
+From 65f84fefa52a0742eaca6b292151e85011f295ce Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:58 +0800
+Subject: bcache: fix race in btree_flush_write()
+
+[ Upstream commit 50a260e859964002dab162513a10f91ae9d3bcd3 ]
+
+There is a race between mca_reap(), btree_node_free() and journal code
+btree_flush_write(), which results very rare and strange deadlock or
+panic and are very hard to reproduce.
+
+Let me explain how the race happens. In btree_flush_write() one btree
+node with oldest journal pin is selected, then it is flushed to cache
+device, the select-and-flush is a two steps operation. Between these two
+steps, there are something may happen inside the race window,
+- The selected btree node was reaped by mca_reap() and allocated to
+ other requesters for other btree node.
+- The slected btree node was selected, flushed and released by mca
+ shrink callback bch_mca_scan().
+When btree_flush_write() tries to flush the selected btree node, firstly
+b->write_lock is held by mutex_lock(). If the race happens and the
+memory of selected btree node is allocated to other btree node, if that
+btree node's write_lock is held already, a deadlock very probably
+happens here. A worse case is the memory of the selected btree node is
+released, then all references to this btree node (e.g. b->write_lock)
+will trigger NULL pointer deference panic.
+
+This race was introduced in commit cafe56359144 ("bcache: A block layer
+cache"), and enlarged by commit c4dc2497d50d ("bcache: fix high CPU
+occupancy during journal"), which selected 128 btree nodes and flushed
+them one-by-one in a quite long time period.
+
+Such race is not easy to reproduce before. On a Lenovo SR650 server with
+48 Xeon cores, and configure 1 NVMe SSD as cache device, a MD raid0
+device assembled by 3 NVMe SSDs as backing device, this race can be
+observed around every 10,000 times btree_flush_write() gets called. Both
+deadlock and kernel panic all happened as aftermath of the race.
+
+The idea of the fix is to add a btree flag BTREE_NODE_journal_flush. It
+is set when selecting btree nodes, and cleared after btree nodes
+flushed. Then when mca_reap() selects a btree node with this bit set,
+this btree node will be skipped. Since mca_reap() only reaps btree node
+without BTREE_NODE_journal_flush flag, such race is avoided.
+
+Once corner case should be noticed, that is btree_node_free(). It might
+be called in some error handling code path. For example the following
+code piece from btree_split(),
+ 2149 err_free2:
+ 2150 bkey_put(b->c, &n2->key);
+ 2151 btree_node_free(n2);
+ 2152 rw_unlock(true, n2);
+ 2153 err_free1:
+ 2154 bkey_put(b->c, &n1->key);
+ 2155 btree_node_free(n1);
+ 2156 rw_unlock(true, n1);
+At line 2151 and 2155, the btree node n2 and n1 are released without
+mac_reap(), so BTREE_NODE_journal_flush also needs to be checked here.
+If btree_node_free() is called directly in such error handling path,
+and the selected btree node has BTREE_NODE_journal_flush bit set, just
+delay for 1 us and retry again. In this case this btree node won't
+be skipped, just retry until the BTREE_NODE_journal_flush bit cleared,
+and free the btree node memory.
+
+Fixes: cafe56359144 ("bcache: A block layer cache")
+Signed-off-by: Coly Li <colyli@suse.de>
+Reported-and-tested-by: kbuild test robot <lkp@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/btree.c | 28 +++++++++++++++++++++++++++-
+ drivers/md/bcache/btree.h | 2 ++
+ drivers/md/bcache/journal.c | 7 +++++++
+ 3 files changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index e0468fd41b6ea..45f684689c357 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -35,7 +35,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/sched/clock.h>
+ #include <linux/rculist.h>
+-
++#include <linux/delay.h>
+ #include <trace/events/bcache.h>
+
+ /*
+@@ -649,12 +649,25 @@ static int mca_reap(struct btree *b, unsigned int min_order, bool flush)
+ up(&b->io_mutex);
+ }
+
++retry:
+ /*
+ * BTREE_NODE_dirty might be cleared in btree_flush_btree() by
+ * __bch_btree_node_write(). To avoid an extra flush, acquire
+ * b->write_lock before checking BTREE_NODE_dirty bit.
+ */
+ mutex_lock(&b->write_lock);
++ /*
++ * If this btree node is selected in btree_flush_write() by journal
++ * code, delay and retry until the node is flushed by journal code
++ * and BTREE_NODE_journal_flush bit cleared by btree_flush_write().
++ */
++ if (btree_node_journal_flush(b)) {
++ pr_debug("bnode %p is flushing by journal, retry", b);
++ mutex_unlock(&b->write_lock);
++ udelay(1);
++ goto retry;
++ }
++
+ if (btree_node_dirty(b))
+ __bch_btree_node_write(b, &cl);
+ mutex_unlock(&b->write_lock);
+@@ -1071,7 +1084,20 @@ static void btree_node_free(struct btree *b)
+
+ BUG_ON(b == b->c->root);
+
++retry:
+ mutex_lock(&b->write_lock);
++ /*
++ * If the btree node is selected and flushing in btree_flush_write(),
++ * delay and retry until the BTREE_NODE_journal_flush bit cleared,
++ * then it is safe to free the btree node here. Otherwise this btree
++ * node will be in race condition.
++ */
++ if (btree_node_journal_flush(b)) {
++ mutex_unlock(&b->write_lock);
++ pr_debug("bnode %p journal_flush set, retry", b);
++ udelay(1);
++ goto retry;
++ }
+
+ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h
+index a68d6c55783bd..4d0cca145f699 100644
+--- a/drivers/md/bcache/btree.h
++++ b/drivers/md/bcache/btree.h
+@@ -158,11 +158,13 @@ enum btree_flags {
+ BTREE_NODE_io_error,
+ BTREE_NODE_dirty,
+ BTREE_NODE_write_idx,
++ BTREE_NODE_journal_flush,
+ };
+
+ BTREE_FLAG(io_error);
+ BTREE_FLAG(dirty);
+ BTREE_FLAG(write_idx);
++BTREE_FLAG(journal_flush);
+
+ static inline struct btree_write *btree_current_write(struct btree *b)
+ {
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index ec1e35a62934d..7bb15cddca5ec 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -404,6 +404,7 @@ static void btree_flush_write(struct cache_set *c)
+ retry:
+ best = NULL;
+
++ mutex_lock(&c->bucket_lock);
+ for_each_cached_btree(b, c, i)
+ if (btree_current_write(b)->journal) {
+ if (!best)
+@@ -416,9 +417,14 @@ retry:
+ }
+
+ b = best;
++ if (b)
++ set_btree_node_journal_flush(b);
++ mutex_unlock(&c->bucket_lock);
++
+ if (b) {
+ mutex_lock(&b->write_lock);
+ if (!btree_current_write(b)->journal) {
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ /* We raced */
+ atomic_long_inc(&c->retry_flush_write);
+@@ -426,6 +432,7 @@ retry:
+ }
+
+ __bch_btree_node_write(b, NULL);
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 61dde86d6ebf4bc1c6b23828bbafee1a340bcd3c Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:55 +0800
+Subject: bcache: only clear BTREE_NODE_dirty bit when it is set
+
+[ Upstream commit e5ec5f4765ada9c75fb3eee93a6e72f0e50599d5 ]
+
+In bch_btree_cache_free() and btree_node_free(), BTREE_NODE_dirty is
+always set no matter btree node is dirty or not. The code looks like
+this,
+ if (btree_node_dirty(b))
+ btree_complete_write(b, btree_current_write(b));
+ clear_bit(BTREE_NODE_dirty, &b->flags);
+
+Indeed if btree_node_dirty(b) returns false, it means BTREE_NODE_dirty
+bit is cleared, then it is unnecessary to clear the bit again.
+
+This patch only clears BTREE_NODE_dirty when btree_node_dirty(b) is
+true (the bit is set), to save a few CPU cycles.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/btree.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 3f4211b5cd334..8c80833e73a9a 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -772,10 +772,10 @@ void bch_btree_cache_free(struct cache_set *c)
+ while (!list_empty(&c->btree_cache)) {
+ b = list_first_entry(&c->btree_cache, struct btree, list);
+
+- if (btree_node_dirty(b))
++ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+- clear_bit(BTREE_NODE_dirty, &b->flags);
+-
++ clear_bit(BTREE_NODE_dirty, &b->flags);
++ }
+ mca_data_free(b);
+ }
+
+@@ -1063,9 +1063,10 @@ static void btree_node_free(struct btree *b)
+
+ mutex_lock(&b->write_lock);
+
+- if (btree_node_dirty(b))
++ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+- clear_bit(BTREE_NODE_dirty, &b->flags);
++ clear_bit(BTREE_NODE_dirty, &b->flags);
++ }
+
+ mutex_unlock(&b->write_lock);
+
+--
+2.20.1
+
--- /dev/null
+From 07f2697590477eba7c20ff25a331b40cc92cbab4 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Mon, 8 Oct 2018 20:41:18 +0800
+Subject: bcache: replace hard coded number with BUCKET_GC_GEN_MAX
+
+[ Upstream commit 149d0efada7777ad5a5242b095692af142f533d8 ]
+
+In extents.c:bch_extent_bad(), number 96 is used as parameter to call
+btree_bug_on(). The purpose is to check whether stale gen value exceeds
+BUCKET_GC_GEN_MAX, so it is better to use macro BUCKET_GC_GEN_MAX to
+make the code more understandable.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/extents.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c
+index c809724e6571e..9560043666999 100644
+--- a/drivers/md/bcache/extents.c
++++ b/drivers/md/bcache/extents.c
+@@ -553,7 +553,7 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k)
+ for (i = 0; i < KEY_PTRS(k); i++) {
+ stale = ptr_stale(b->c, k, i);
+
+- btree_bug_on(stale > 96, b,
++ btree_bug_on(stale > BUCKET_GC_GEN_MAX, b,
+ "key too stale: %i, need_gc %u",
+ stale, b->c->need_gc);
+
+--
+2.20.1
+
--- /dev/null
+From 7fd7fda5df396877d3db052643cd7e9814711534 Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui.linux@gmail.com>
+Date: Sat, 9 Feb 2019 12:52:58 +0800
+Subject: bcache: treat stale && dirty keys as bad keys
+
+[ Upstream commit 58ac323084ebf44f8470eeb8b82660f9d0ee3689 ]
+
+Stale && dirty keys can be produced in the follow way:
+After writeback in write_dirty_finish(), dirty keys k1 will
+replace by clean keys k2
+==>ret = bch_btree_insert(dc->disk.c, &keys, NULL, &w->key);
+==>btree_insert_fn(struct btree_op *b_op, struct btree *b)
+==>static int bch_btree_insert_node(struct btree *b,
+ struct btree_op *op,
+ struct keylist *insert_keys,
+ atomic_t *journal_ref,
+Then two steps:
+A) update k1 to k2 in btree node memory;
+ bch_btree_insert_keys(b, op, insert_keys, replace_key)
+B) Write the bset(contains k2) to cache disk by a 30s delay work
+ bch_btree_leaf_dirty(b, journal_ref).
+But before the 30s delay work write the bset to cache device,
+these things happened:
+A) GC works, and reclaim the bucket k2 point to;
+B) Allocator works, and invalidate the bucket k2 point to,
+ and increase the gen of the bucket, and place it into free_inc
+ fifo;
+C) Until now, the 30s delay work still does not finish work,
+ so in the disk, the key still is k1, it is dirty and stale
+ (its gen is smaller than the gen of the bucket). and then the
+ machine power off suddenly happens;
+D) When the machine power on again, after the btree reconstruction,
+ the stale dirty key appear.
+
+In bch_extent_bad(), when expensive_debug_checks is off, it would
+treat the dirty key as good even it is stale keys, and it would
+cause bellow probelms:
+A) In read_dirty() it would cause machine crash:
+ BUG_ON(ptr_stale(dc->disk.c, &w->key, 0));
+B) It could be worse when reads hits stale dirty keys, it would
+ read old incorrect data.
+
+This patch tolerate the existence of these stale && dirty keys,
+and treat them as bad key in bch_extent_bad().
+
+(Coly Li: fix indent which was modified by sender's email client)
+
+Signed-off-by: Tang Junhui <tang.junhui.linux@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/extents.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c
+index 9560043666999..886710043025f 100644
+--- a/drivers/md/bcache/extents.c
++++ b/drivers/md/bcache/extents.c
+@@ -538,6 +538,7 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k)
+ {
+ struct btree *b = container_of(bk, struct btree, keys);
+ unsigned int i, stale;
++ char buf[80];
+
+ if (!KEY_PTRS(k) ||
+ bch_extent_invalid(bk, k))
+@@ -547,19 +548,19 @@ static bool bch_extent_bad(struct btree_keys *bk, const struct bkey *k)
+ if (!ptr_available(b->c, k, i))
+ return true;
+
+- if (!expensive_debug_checks(b->c) && KEY_DIRTY(k))
+- return false;
+-
+ for (i = 0; i < KEY_PTRS(k); i++) {
+ stale = ptr_stale(b->c, k, i);
+
++ if (stale && KEY_DIRTY(k)) {
++ bch_extent_to_text(buf, sizeof(buf), k);
++ pr_info("stale dirty pointer, stale %u, key: %s",
++ stale, buf);
++ }
++
+ btree_bug_on(stale > BUCKET_GC_GEN_MAX, b,
+ "key too stale: %i, need_gc %u",
+ stale, b->c->need_gc);
+
+- btree_bug_on(stale && KEY_DIRTY(k) && KEY_SIZE(k),
+- b, "stale dirty pointer");
+-
+ if (stale)
+ return true;
+
+--
+2.20.1
+
--- /dev/null
+From 765ed1fda090e606305cb75533dafaddf0095038 Mon Sep 17 00:00:00 2001
+From: Dennis Zhou <dennis@kernel.org>
+Date: Fri, 5 Jul 2019 17:09:09 -0400
+Subject: blk-iolatency: fix STS_AGAIN handling
+
+[ Upstream commit c9b3007feca018d3f7061f5d5a14cb00766ffe9b ]
+
+The iolatency controller is based on rq_qos. It increments on
+rq_qos_throttle() and decrements on either rq_qos_cleanup() or
+rq_qos_done_bio(). a3fb01ba5af0 fixes the double accounting issue where
+blk_mq_make_request() may call both rq_qos_cleanup() and
+rq_qos_done_bio() on REQ_NO_WAIT. So checking STS_AGAIN prevents the
+double decrement.
+
+The above works upstream as the only way we can get STS_AGAIN is from
+blk_mq_get_request() failing. The STS_AGAIN handling isn't a real
+problem as bio_endio() skipping only happens on reserved tag allocation
+failures which can only be caused by driver bugs and already triggers
+WARN.
+
+However, the fix creates a not so great dependency on how STS_AGAIN can
+be propagated. Internally, we (Facebook) carry a patch that kills read
+ahead if a cgroup is io congested or a fatal signal is pending. This
+combined with chained bios progagate their bi_status to the parent is
+not already set can can cause the parent bio to not clean up properly
+even though it was successful. This consequently leaks the inflight
+counter and can hang all IOs under that blkg.
+
+To nip the adverse interaction early, this removes the rq_qos_cleanup()
+callback in iolatency in favor of cleaning up always on the
+rq_qos_done_bio() path.
+
+Fixes: a3fb01ba5af0 ("blk-iolatency: only account submitted bios")
+Debugged-by: Tejun Heo <tj@kernel.org>
+Debugged-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Dennis Zhou <dennis@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-iolatency.c | 51 ++++++++++++-------------------------------
+ 1 file changed, 14 insertions(+), 37 deletions(-)
+
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index 84ecdab41b691..0529e94a20f7f 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -566,10 +566,6 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ if (!blkg)
+ return;
+
+- /* We didn't actually submit this bio, don't account it. */
+- if (bio->bi_status == BLK_STS_AGAIN)
+- return;
+-
+ iolat = blkg_to_lat(bio->bi_blkg);
+ if (!iolat)
+ return;
+@@ -588,40 +584,22 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+
+ inflight = atomic_dec_return(&rqw->inflight);
+ WARN_ON_ONCE(inflight < 0);
+- if (iolat->min_lat_nsec == 0)
+- goto next;
+- iolatency_record_time(iolat, &bio->bi_issue, now,
+- issue_as_root);
+- window_start = atomic64_read(&iolat->window_start);
+- if (now > window_start &&
+- (now - window_start) >= iolat->cur_win_nsec) {
+- if (atomic64_cmpxchg(&iolat->window_start,
+- window_start, now) == window_start)
+- iolatency_check_latencies(iolat, now);
++ /*
++ * If bi_status is BLK_STS_AGAIN, the bio wasn't actually
++ * submitted, so do not account for it.
++ */
++ if (iolat->min_lat_nsec && bio->bi_status != BLK_STS_AGAIN) {
++ iolatency_record_time(iolat, &bio->bi_issue, now,
++ issue_as_root);
++ window_start = atomic64_read(&iolat->window_start);
++ if (now > window_start &&
++ (now - window_start) >= iolat->cur_win_nsec) {
++ if (atomic64_cmpxchg(&iolat->window_start,
++ window_start, now) == window_start)
++ iolatency_check_latencies(iolat, now);
++ }
+ }
+-next:
+- wake_up(&rqw->wait);
+- blkg = blkg->parent;
+- }
+-}
+-
+-static void blkcg_iolatency_cleanup(struct rq_qos *rqos, struct bio *bio)
+-{
+- struct blkcg_gq *blkg;
+-
+- blkg = bio->bi_blkg;
+- while (blkg && blkg->parent) {
+- struct rq_wait *rqw;
+- struct iolatency_grp *iolat;
+-
+- iolat = blkg_to_lat(blkg);
+- if (!iolat)
+- goto next;
+-
+- rqw = &iolat->rq_wait;
+- atomic_dec(&rqw->inflight);
+ wake_up(&rqw->wait);
+-next:
+ blkg = blkg->parent;
+ }
+ }
+@@ -637,7 +615,6 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos)
+
+ static struct rq_qos_ops blkcg_iolatency_ops = {
+ .throttle = blkcg_iolatency_throttle,
+- .cleanup = blkcg_iolatency_cleanup,
+ .done_bio = blkcg_iolatency_done_bio,
+ .exit = blkcg_iolatency_exit,
+ };
+--
+2.20.1
+
--- /dev/null
+From 608c138041e58815de06aa4c2a406e64ee9da923 Mon Sep 17 00:00:00 2001
+From: Liu Bo <bo.liu@linux.alibaba.com>
+Date: Fri, 25 Jan 2019 08:12:48 +0800
+Subject: Blk-iolatency: warn on negative inflight IO counter
+
+[ Upstream commit 391f552af213985d3d324c60004475759a7030c5 ]
+
+This is to catch any unexpected negative value of inflight IO counter.
+
+Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-iolatency.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c
+index f4f7c73fb8284..84ecdab41b691 100644
+--- a/block/blk-iolatency.c
++++ b/block/blk-iolatency.c
+@@ -560,6 +560,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ u64 now = ktime_to_ns(ktime_get());
+ bool issue_as_root = bio_issue_as_root_blkg(bio);
+ bool enabled = false;
++ int inflight = 0;
+
+ blkg = bio->bi_blkg;
+ if (!blkg)
+@@ -585,7 +586,8 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio)
+ }
+ rqw = &iolat->rq_wait;
+
+- atomic_dec(&rqw->inflight);
++ inflight = atomic_dec_return(&rqw->inflight);
++ WARN_ON_ONCE(inflight < 0);
+ if (iolat->min_lat_nsec == 0)
+ goto next;
+ iolatency_record_time(iolat, &bio->bi_issue, now,
+--
+2.20.1
+
--- /dev/null
+From ac444273bc5189cd43b0f14fb5c21265616a1e34 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Tue, 30 Apr 2019 09:52:25 +0800
+Subject: blk-mq: free hw queue's resource in hctx's release handler
+
+[ Upstream commit c7e2d94b3d1634988a95ac4d77a72dc7487ece06 ]
+
+Once blk_cleanup_queue() returns, tags shouldn't be used any more,
+because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2
+("blk-mq: Fix a use-after-free") fixes this issue exactly.
+
+However, that commit introduces another issue. Before 45a9c9d909b2,
+we are allowed to run queue during cleaning up queue if the queue's
+kobj refcount is held. After that commit, queue can't be run during
+queue cleaning up, otherwise oops can be triggered easily because
+some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue().
+
+We have invented ways for addressing this kind of issue before, such as:
+
+ 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done")
+ c2856ae2f315 ("blk-mq: quiesce queue before freeing queue")
+
+But still can't cover all cases, recently James reports another such
+kind of issue:
+
+ https://marc.info/?l=linux-scsi&m=155389088124782&w=2
+
+This issue can be quite hard to address by previous way, given
+scsi_run_queue() may run requeues for other LUNs.
+
+Fixes the above issue by freeing hctx's resources in its release handler, and this
+way is safe becasue tags isn't needed for freeing such hctx resource.
+
+This approach follows typical design pattern wrt. kobject's release handler.
+
+Cc: Dongli Zhang <dongli.zhang@oracle.com>
+Cc: James Smart <james.smart@broadcom.com>
+Cc: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: linux-scsi@vger.kernel.org,
+Cc: Martin K . Petersen <martin.petersen@oracle.com>,
+Cc: Christoph Hellwig <hch@lst.de>,
+Cc: James E . J . Bottomley <jejb@linux.vnet.ibm.com>,
+Reported-by: James Smart <james.smart@broadcom.com>
+Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Tested-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 3 ++-
+ block/blk-mq-sysfs.c | 6 ++++++
+ block/blk-mq.c | 8 ++------
+ block/blk-mq.h | 2 +-
+ 4 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 4a3e1f4178804..af635f878f966 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -816,7 +816,8 @@ void blk_cleanup_queue(struct request_queue *q)
+ blk_exit_queue(q);
+
+ if (q->mq_ops)
+- blk_mq_free_queue(q);
++ blk_mq_exit_queue(q);
++
+ percpu_ref_exit(&q->q_usage_counter);
+
+ spin_lock_irq(lock);
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index aafb44224c896..0b7297a43ccd2 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -10,6 +10,7 @@
+ #include <linux/smp.h>
+
+ #include <linux/blk-mq.h>
++#include "blk.h"
+ #include "blk-mq.h"
+ #include "blk-mq-tag.h"
+
+@@ -21,6 +22,11 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj)
+ {
+ struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+ kobj);
++
++ if (hctx->flags & BLK_MQ_F_BLOCKING)
++ cleanup_srcu_struct(hctx->srcu);
++ blk_free_flush_queue(hctx->fq);
++ sbitmap_free(&hctx->ctx_map);
+ free_cpumask_var(hctx->cpumask);
+ kfree(hctx->ctxs);
+ kfree(hctx);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 70d839b9c3b09..455fda99255a4 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2157,12 +2157,7 @@ static void blk_mq_exit_hctx(struct request_queue *q,
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+
+- if (hctx->flags & BLK_MQ_F_BLOCKING)
+- cleanup_srcu_struct(hctx->srcu);
+-
+ blk_mq_remove_cpuhp(hctx);
+- blk_free_flush_queue(hctx->fq);
+- sbitmap_free(&hctx->ctx_map);
+ }
+
+ static void blk_mq_exit_hw_queues(struct request_queue *q,
+@@ -2662,7 +2657,8 @@ err_exit:
+ }
+ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+
+-void blk_mq_free_queue(struct request_queue *q)
++/* tags can _not_ be used after returning from blk_mq_exit_queue */
++void blk_mq_exit_queue(struct request_queue *q)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
+
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 9497b47e2526c..5ad9251627f80 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -31,7 +31,7 @@ struct blk_mq_ctx {
+ } ____cacheline_aligned_in_smp;
+
+ void blk_mq_freeze_queue(struct request_queue *q);
+-void blk_mq_free_queue(struct request_queue *q);
++void blk_mq_exit_queue(struct request_queue *q);
+ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+ void blk_mq_wake_waiters(struct request_queue *q);
+ bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool);
+--
+2.20.1
+
--- /dev/null
+From 24b07751fb7fb8e2821a1c4464be8d5b52b4e0f8 Mon Sep 17 00:00:00 2001
+From: Omar Sandoval <osandov@fb.com>
+Date: Tue, 14 Aug 2018 11:09:52 -0700
+Subject: Btrfs: clean up scrub is_dev_replace parameter
+
+[ Upstream commit 32934280967d00dc2b5c4d3b63b21a9c8638326e ]
+
+struct scrub_ctx has an ->is_dev_replace member, so there's no point in
+passing around is_dev_replace where sctx is available.
+
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 23 +++++++++--------------
+ 1 file changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 3be1456b5116b..4bcc275f76128 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -3022,8 +3022,7 @@ out:
+ static noinline_for_stack int scrub_stripe(struct scrub_ctx *sctx,
+ struct map_lookup *map,
+ struct btrfs_device *scrub_dev,
+- int num, u64 base, u64 length,
+- int is_dev_replace)
++ int num, u64 base, u64 length)
+ {
+ struct btrfs_path *path, *ppath;
+ struct btrfs_fs_info *fs_info = sctx->fs_info;
+@@ -3299,7 +3298,7 @@ again:
+ extent_physical = extent_logical - logical + physical;
+ extent_dev = scrub_dev;
+ extent_mirror_num = mirror_num;
+- if (is_dev_replace)
++ if (sctx->is_dev_replace)
+ scrub_remap_extent(fs_info, extent_logical,
+ extent_len, &extent_physical,
+ &extent_dev,
+@@ -3397,8 +3396,7 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
+ struct btrfs_device *scrub_dev,
+ u64 chunk_offset, u64 length,
+ u64 dev_offset,
+- struct btrfs_block_group_cache *cache,
+- int is_dev_replace)
++ struct btrfs_block_group_cache *cache)
+ {
+ struct btrfs_fs_info *fs_info = sctx->fs_info;
+ struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;
+@@ -3435,8 +3433,7 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx,
+ if (map->stripes[i].dev->bdev == scrub_dev->bdev &&
+ map->stripes[i].physical == dev_offset) {
+ ret = scrub_stripe(sctx, map, scrub_dev, i,
+- chunk_offset, length,
+- is_dev_replace);
++ chunk_offset, length);
+ if (ret)
+ goto out;
+ }
+@@ -3449,8 +3446,7 @@ out:
+
+ static noinline_for_stack
+ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+- struct btrfs_device *scrub_dev, u64 start, u64 end,
+- int is_dev_replace)
++ struct btrfs_device *scrub_dev, u64 start, u64 end)
+ {
+ struct btrfs_dev_extent *dev_extent = NULL;
+ struct btrfs_path *path;
+@@ -3544,7 +3540,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+ */
+ scrub_pause_on(fs_info);
+ ret = btrfs_inc_block_group_ro(cache);
+- if (!ret && is_dev_replace) {
++ if (!ret && sctx->is_dev_replace) {
+ /*
+ * If we are doing a device replace wait for any tasks
+ * that started dellaloc right before we set the block
+@@ -3609,7 +3605,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+ dev_replace->item_needs_writeback = 1;
+ btrfs_dev_replace_write_unlock(&fs_info->dev_replace);
+ ret = scrub_chunk(sctx, scrub_dev, chunk_offset, length,
+- found_key.offset, cache, is_dev_replace);
++ found_key.offset, cache);
+
+ /*
+ * flush, submit all pending read and write bios, afterwards
+@@ -3670,7 +3666,7 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,
+ btrfs_put_block_group(cache);
+ if (ret)
+ break;
+- if (is_dev_replace &&
++ if (sctx->is_dev_replace &&
+ atomic64_read(&dev_replace->num_write_errors) > 0) {
+ ret = -EIO;
+ break;
+@@ -3893,8 +3889,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ }
+
+ if (!ret)
+- ret = scrub_enumerate_chunks(sctx, dev, start, end,
+- is_dev_replace);
++ ret = scrub_enumerate_chunks(sctx, dev, start, end);
+
+ wait_event(sctx->list_wait, atomic_read(&sctx->bios_in_flight) == 0);
+ atomic_dec(&fs_info->scrubs_running);
+--
+2.20.1
+
--- /dev/null
+From ad553c0afd5401ecef7f6d1ef8832507510b9a97 Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Thu, 6 Jun 2019 12:07:15 +0200
+Subject: btrfs: correctly validate compression type
+
+[ Upstream commit aa53e3bfac7205fb3a8815ac1c937fd6ed01b41e ]
+
+Nikolay reported the following KASAN splat when running btrfs/048:
+
+[ 1843.470920] ==================================================================
+[ 1843.471971] BUG: KASAN: slab-out-of-bounds in strncmp+0x66/0xb0
+[ 1843.472775] Read of size 1 at addr ffff888111e369e2 by task btrfs/3979
+
+[ 1843.473904] CPU: 3 PID: 3979 Comm: btrfs Not tainted 5.2.0-rc3-default #536
+[ 1843.475009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 1843.476322] Call Trace:
+[ 1843.476674] dump_stack+0x7c/0xbb
+[ 1843.477132] ? strncmp+0x66/0xb0
+[ 1843.477587] print_address_description+0x114/0x320
+[ 1843.478256] ? strncmp+0x66/0xb0
+[ 1843.478740] ? strncmp+0x66/0xb0
+[ 1843.479185] __kasan_report+0x14e/0x192
+[ 1843.479759] ? strncmp+0x66/0xb0
+[ 1843.480209] kasan_report+0xe/0x20
+[ 1843.480679] strncmp+0x66/0xb0
+[ 1843.481105] prop_compression_validate+0x24/0x70
+[ 1843.481798] btrfs_xattr_handler_set_prop+0x65/0x160
+[ 1843.482509] __vfs_setxattr+0x71/0x90
+[ 1843.483012] __vfs_setxattr_noperm+0x84/0x130
+[ 1843.483606] vfs_setxattr+0xac/0xb0
+[ 1843.484085] setxattr+0x18c/0x230
+[ 1843.484546] ? vfs_setxattr+0xb0/0xb0
+[ 1843.485048] ? __mod_node_page_state+0x1f/0xa0
+[ 1843.485672] ? _raw_spin_unlock+0x24/0x40
+[ 1843.486233] ? __handle_mm_fault+0x988/0x1290
+[ 1843.486823] ? lock_acquire+0xb4/0x1e0
+[ 1843.487330] ? lock_acquire+0xb4/0x1e0
+[ 1843.487842] ? mnt_want_write_file+0x3c/0x80
+[ 1843.488442] ? debug_lockdep_rcu_enabled+0x22/0x40
+[ 1843.489089] ? rcu_sync_lockdep_assert+0xe/0x70
+[ 1843.489707] ? __sb_start_write+0x158/0x200
+[ 1843.490278] ? mnt_want_write_file+0x3c/0x80
+[ 1843.490855] ? __mnt_want_write+0x98/0xe0
+[ 1843.491397] __x64_sys_fsetxattr+0xba/0xe0
+[ 1843.492201] ? trace_hardirqs_off_thunk+0x1a/0x1c
+[ 1843.493201] do_syscall_64+0x6c/0x230
+[ 1843.493988] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 1843.495041] RIP: 0033:0x7fa7a8a7707a
+[ 1843.495819] Code: 48 8b 0d 21 de 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 be 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ee dd 2b 00 f7 d8 64 89 01 48
+[ 1843.499203] RSP: 002b:00007ffcb73bca38 EFLAGS: 00000202 ORIG_RAX: 00000000000000be
+[ 1843.500210] RAX: ffffffffffffffda RBX: 00007ffcb73bda9d RCX: 00007fa7a8a7707a
+[ 1843.501170] RDX: 00007ffcb73bda9d RSI: 00000000006dc050 RDI: 0000000000000003
+[ 1843.502152] RBP: 00000000006dc050 R08: 0000000000000000 R09: 0000000000000000
+[ 1843.503109] R10: 0000000000000002 R11: 0000000000000202 R12: 00007ffcb73bda91
+[ 1843.504055] R13: 0000000000000003 R14: 00007ffcb73bda82 R15: ffffffffffffffff
+
+[ 1843.505268] Allocated by task 3979:
+[ 1843.505771] save_stack+0x19/0x80
+[ 1843.506211] __kasan_kmalloc.constprop.5+0xa0/0xd0
+[ 1843.506836] setxattr+0xeb/0x230
+[ 1843.507264] __x64_sys_fsetxattr+0xba/0xe0
+[ 1843.507886] do_syscall_64+0x6c/0x230
+[ 1843.508429] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+[ 1843.509558] Freed by task 0:
+[ 1843.510188] (stack is not available)
+
+[ 1843.511309] The buggy address belongs to the object at ffff888111e369e0
+ which belongs to the cache kmalloc-8 of size 8
+[ 1843.514095] The buggy address is located 2 bytes inside of
+ 8-byte region [ffff888111e369e0, ffff888111e369e8)
+[ 1843.516524] The buggy address belongs to the page:
+[ 1843.517561] page:ffff88813f478d80 refcount:1 mapcount:0 mapping:ffff88811940c300 index:0xffff888111e373b8 compound_mapcount: 0
+[ 1843.519993] flags: 0x4404000010200(slab|head)
+[ 1843.520951] raw: 0004404000010200 ffff88813f48b008 ffff888119403d50 ffff88811940c300
+[ 1843.522616] raw: ffff888111e373b8 000000000016000f 00000001ffffffff 0000000000000000
+[ 1843.524281] page dumped because: kasan: bad access detected
+
+[ 1843.525936] Memory state around the buggy address:
+[ 1843.526975] ffff888111e36880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 1843.528479] ffff888111e36900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 1843.530138] >ffff888111e36980: fc fc fc fc fc fc fc fc fc fc fc fc 02 fc fc fc
+[ 1843.531877] ^
+[ 1843.533287] ffff888111e36a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 1843.534874] ffff888111e36a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 1843.536468] ==================================================================
+
+This is caused by supplying a too short compression value ('lz') in the
+test-case and comparing it to 'lzo' with strncmp() and a length of 3.
+strncmp() read past the 'lz' when looking for the 'o' and thus caused an
+out-of-bounds read.
+
+Introduce a new check 'btrfs_compress_is_valid_type()' which not only
+checks the user-supplied value against known compression types, but also
+employs checks for too short values.
+
+Reported-by: Nikolay Borisov <nborisov@suse.com>
+Fixes: 272e5326c783 ("btrfs: prop: fix vanished compression property after failed set")
+CC: stable@vger.kernel.org # 5.1+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/compression.c | 16 ++++++++++++++++
+ fs/btrfs/compression.h | 1 +
+ fs/btrfs/props.c | 6 +-----
+ 3 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
+index 9bfa66592aa7b..c71e534ca7ef6 100644
+--- a/fs/btrfs/compression.c
++++ b/fs/btrfs/compression.c
+@@ -42,6 +42,22 @@ const char* btrfs_compress_type2str(enum btrfs_compression_type type)
+ return NULL;
+ }
+
++bool btrfs_compress_is_valid_type(const char *str, size_t len)
++{
++ int i;
++
++ for (i = 1; i < ARRAY_SIZE(btrfs_compress_types); i++) {
++ size_t comp_len = strlen(btrfs_compress_types[i]);
++
++ if (len < comp_len)
++ continue;
++
++ if (!strncmp(btrfs_compress_types[i], str, comp_len))
++ return true;
++ }
++ return false;
++}
++
+ static int btrfs_decompress_bio(struct compressed_bio *cb);
+
+ static inline int compressed_bio_size(struct btrfs_fs_info *fs_info,
+diff --git a/fs/btrfs/compression.h b/fs/btrfs/compression.h
+index ddda9b80bf204..f97d90a1fa531 100644
+--- a/fs/btrfs/compression.h
++++ b/fs/btrfs/compression.h
+@@ -127,6 +127,7 @@ extern const struct btrfs_compress_op btrfs_lzo_compress;
+ extern const struct btrfs_compress_op btrfs_zstd_compress;
+
+ const char* btrfs_compress_type2str(enum btrfs_compression_type type);
++bool btrfs_compress_is_valid_type(const char *str, size_t len);
+
+ int btrfs_compress_heuristic(struct inode *inode, u64 start, u64 end);
+
+diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c
+index 61d22a56c0ba4..6980a0e13f18e 100644
+--- a/fs/btrfs/props.c
++++ b/fs/btrfs/props.c
+@@ -366,11 +366,7 @@ int btrfs_subvol_inherit_props(struct btrfs_trans_handle *trans,
+
+ static int prop_compression_validate(const char *value, size_t len)
+ {
+- if (!strncmp("lzo", value, 3))
+- return 0;
+- else if (!strncmp("zlib", value, 4))
+- return 0;
+- else if (!strncmp("zstd", value, 4))
++ if (btrfs_compress_is_valid_type(value, len))
+ return 0;
+
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From cf556fa0b22e31e1660d1c81356f5553e9d92f30 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 26 Nov 2018 20:07:17 +0000
+Subject: Btrfs: fix deadlock with memory reclaim during scrub
+
+[ Upstream commit a5fb11429167ee6ddeeacc554efaf5776b36433a ]
+
+When a transaction commit starts, it attempts to pause scrub and it blocks
+until the scrub is paused. So while the transaction is blocked waiting for
+scrub to pause, we can not do memory allocation with GFP_KERNEL from scrub,
+otherwise we risk getting into a deadlock with reclaim.
+
+Checking for scrub pause requests is done early at the beginning of the
+while loop of scrub_stripe() and later in the loop, scrub_extent() and
+scrub_raid56_parity() are called, which in turn call scrub_pages() and
+scrub_pages_for_parity() respectively. These last two functions do memory
+allocations using GFP_KERNEL. Same problem could happen while scrubbing
+the super blocks, since it calls scrub_pages().
+
+We also can not have any of the worker tasks, created by the scrub task,
+doing GFP_KERNEL allocations, because before pausing, the scrub task waits
+for all the worker tasks to complete (also done at scrub_stripe()).
+
+So make sure GFP_NOFS is used for the memory allocations because at any
+time a scrub pause request can happen from another task that started to
+commit a transaction.
+
+Fixes: 58c4e173847a ("btrfs: scrub: use GFP_KERNEL on the submission path")
+CC: stable@vger.kernel.org # 4.6+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 35 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 4bcc275f76128..5a2d10ba747f7 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -322,6 +322,7 @@ static struct full_stripe_lock *insert_full_stripe_lock(
+ struct rb_node *parent = NULL;
+ struct full_stripe_lock *entry;
+ struct full_stripe_lock *ret;
++ unsigned int nofs_flag;
+
+ lockdep_assert_held(&locks_root->lock);
+
+@@ -339,8 +340,17 @@ static struct full_stripe_lock *insert_full_stripe_lock(
+ }
+ }
+
+- /* Insert new lock */
++ /*
++ * Insert new lock.
++ *
++ * We must use GFP_NOFS because the scrub task might be waiting for a
++ * worker task executing this function and in turn a transaction commit
++ * might be waiting the scrub task to pause (which needs to wait for all
++ * the worker tasks to complete before pausing).
++ */
++ nofs_flag = memalloc_nofs_save();
+ ret = kmalloc(sizeof(*ret), GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!ret)
+ return ERR_PTR(-ENOMEM);
+ ret->logical = fstripe_logical;
+@@ -1622,8 +1632,19 @@ static int scrub_add_page_to_wr_bio(struct scrub_ctx *sctx,
+ mutex_lock(&sctx->wr_lock);
+ again:
+ if (!sctx->wr_curr_bio) {
++ unsigned int nofs_flag;
++
++ /*
++ * We must use GFP_NOFS because the scrub task might be waiting
++ * for a worker task executing this function and in turn a
++ * transaction commit might be waiting the scrub task to pause
++ * (which needs to wait for all the worker tasks to complete
++ * before pausing).
++ */
++ nofs_flag = memalloc_nofs_save();
+ sctx->wr_curr_bio = kzalloc(sizeof(*sctx->wr_curr_bio),
+ GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!sctx->wr_curr_bio) {
+ mutex_unlock(&sctx->wr_lock);
+ return -ENOMEM;
+@@ -3775,6 +3796,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ struct scrub_ctx *sctx;
+ int ret;
+ struct btrfs_device *dev;
++ unsigned int nofs_flag;
+
+ if (btrfs_fs_closing(fs_info))
+ return -EINVAL;
+@@ -3878,6 +3900,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ atomic_inc(&fs_info->scrubs_running);
+ mutex_unlock(&fs_info->scrub_lock);
+
++ /*
++ * In order to avoid deadlock with reclaim when there is a transaction
++ * trying to pause scrub, make sure we use GFP_NOFS for all the
++ * allocations done at btrfs_scrub_pages() and scrub_pages_for_parity()
++ * invoked by our callees. The pausing request is done when the
++ * transaction commit starts, and it blocks the transaction until scrub
++ * is paused (done at specific points at scrub_stripe() or right above
++ * before incrementing fs_info->scrubs_running).
++ */
++ nofs_flag = memalloc_nofs_save();
+ if (!is_dev_replace) {
+ /*
+ * by holding device list mutex, we can
+@@ -3890,6 +3922,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+
+ if (!ret)
+ ret = scrub_enumerate_chunks(sctx, dev, start, end);
++ memalloc_nofs_restore(nofs_flag);
+
+ wait_event(sctx->list_wait, atomic_read(&sctx->bios_in_flight) == 0);
+ atomic_dec(&fs_info->scrubs_running);
+--
+2.20.1
+
--- /dev/null
+From f0d79239e10447620dc5bc91173d11886f1a1e85 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Wed, 21 Nov 2018 17:10:52 +0200
+Subject: btrfs: Fix error handling in btrfs_cleanup_ordered_extents
+
+[ Upstream commit d1051d6ebf8ef3517a5a3cf82bba8436d190f1c2 ]
+
+Running btrfs/124 in a loop hung up on me sporadically with the
+following call trace:
+
+ btrfs D 0 5760 5324 0x00000000
+ Call Trace:
+ ? __schedule+0x243/0x800
+ schedule+0x33/0x90
+ btrfs_start_ordered_extent+0x10c/0x1b0 [btrfs]
+ ? wait_woken+0xa0/0xa0
+ btrfs_wait_ordered_range+0xbb/0x100 [btrfs]
+ btrfs_relocate_block_group+0x1ff/0x230 [btrfs]
+ btrfs_relocate_chunk+0x49/0x100 [btrfs]
+ btrfs_balance+0xbeb/0x1740 [btrfs]
+ btrfs_ioctl_balance+0x2ee/0x380 [btrfs]
+ btrfs_ioctl+0x1691/0x3110 [btrfs]
+ ? lockdep_hardirqs_on+0xed/0x180
+ ? __handle_mm_fault+0x8e7/0xfb0
+ ? _raw_spin_unlock+0x24/0x30
+ ? __handle_mm_fault+0x8e7/0xfb0
+ ? do_vfs_ioctl+0xa5/0x6e0
+ ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
+ do_vfs_ioctl+0xa5/0x6e0
+ ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
+ ksys_ioctl+0x3a/0x70
+ __x64_sys_ioctl+0x16/0x20
+ do_syscall_64+0x60/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+This happens because during page writeback it's valid for
+writepage_delalloc to instantiate a delalloc range which doesn't belong
+to the page currently being written back.
+
+The reason this case is valid is due to find_lock_delalloc_range
+returning any available range after the passed delalloc_start and
+ignoring whether the page under writeback is within that range.
+
+In turn ordered extents (OE) are always created for the returned range
+from find_lock_delalloc_range. If, however, a failure occurs while OE
+are being created then the clean up code in btrfs_cleanup_ordered_extents
+will be called.
+
+Unfortunately the code in btrfs_cleanup_ordered_extents doesn't consider
+the case of such 'foreign' range being processed and instead it always
+assumes that the range OE are created for belongs to the page. This
+leads to the first page of such foregin range to not be cleaned up since
+it's deliberately missed and skipped by the current cleaning up code.
+
+Fix this by correctly checking whether the current page belongs to the
+range being instantiated and if so adjsut the range parameters passed
+for cleaning up. If it doesn't, then just clean the whole OE range
+directly.
+
+Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang")
+CC: stable@vger.kernel.org # 4.14+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 29 ++++++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index bfacce295ef1e..98c535ae038da 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -110,17 +110,17 @@ static void __endio_write_update_ordered(struct inode *inode,
+ * extent_clear_unlock_delalloc() to clear both the bits EXTENT_DO_ACCOUNTING
+ * and EXTENT_DELALLOC simultaneously, because that causes the reserved metadata
+ * to be released, which we want to happen only when finishing the ordered
+- * extent (btrfs_finish_ordered_io()). Also note that the caller of
+- * btrfs_run_delalloc_range already does proper cleanup for the first page of
+- * the range, that is, it invokes the callback writepage_end_io_hook() for the
+- * range of the first page.
++ * extent (btrfs_finish_ordered_io()).
+ */
+ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
+- const u64 offset,
+- const u64 bytes)
++ struct page *locked_page,
++ u64 offset, u64 bytes)
+ {
+ unsigned long index = offset >> PAGE_SHIFT;
+ unsigned long end_index = (offset + bytes - 1) >> PAGE_SHIFT;
++ u64 page_start = page_offset(locked_page);
++ u64 page_end = page_start + PAGE_SIZE - 1;
++
+ struct page *page;
+
+ while (index <= end_index) {
+@@ -131,8 +131,18 @@ static inline void btrfs_cleanup_ordered_extents(struct inode *inode,
+ ClearPagePrivate2(page);
+ put_page(page);
+ }
+- return __endio_write_update_ordered(inode, offset + PAGE_SIZE,
+- bytes - PAGE_SIZE, false);
++
++ /*
++ * In case this page belongs to the delalloc range being instantiated
++ * then skip it, since the first page of a range is going to be
++ * properly cleaned up by the caller of run_delalloc_range
++ */
++ if (page_start >= offset && page_end <= (offset + bytes - 1)) {
++ offset += PAGE_SIZE;
++ bytes -= PAGE_SIZE;
++ }
++
++ return __endio_write_update_ordered(inode, offset, bytes, false);
+ }
+
+ static int btrfs_dirty_inode(struct inode *inode);
+@@ -1629,7 +1639,8 @@ int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
+ write_flags);
+ }
+ if (ret)
+- btrfs_cleanup_ordered_extents(inode, start, end - start + 1);
++ btrfs_cleanup_ordered_extents(inode, locked_page, start,
++ end - start + 1);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6784712d94d287205739c8ad88e68004680a6c08 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Wed, 12 Jun 2019 11:05:42 +0100
+Subject: Btrfs: fix race between block group removal and block group
+ allocation
+
+[ Upstream commit 8eaf40c0e24e98899a0f3ac9d25a33aafe13822a ]
+
+If a task is removing the block group that currently has the highest start
+offset amongst all existing block groups, there is a short time window
+where it races with a concurrent block group allocation, resulting in a
+transaction abort with an error code of EEXIST.
+
+The following diagram explains the race in detail:
+
+ Task A Task B
+
+ btrfs_remove_block_group(bg offset X)
+
+ remove_extent_mapping(em offset X)
+ -> removes extent map X from the
+ tree of extent maps
+ (fs_info->mapping_tree), so the
+ next call to find_next_chunk()
+ will return offset X
+
+ btrfs_alloc_chunk()
+ find_next_chunk()
+ --> returns offset X
+
+ __btrfs_alloc_chunk(offset X)
+ btrfs_make_block_group()
+ btrfs_create_block_group_cache()
+ --> creates btrfs_block_group_cache
+ object with a key corresponding
+ to the block group item in the
+ extent, the key is:
+ (offset X, BTRFS_BLOCK_GROUP_ITEM_KEY, 1G)
+
+ --> adds the btrfs_block_group_cache object
+ to the list new_bgs of the transaction
+ handle
+
+ btrfs_end_transaction(trans handle)
+ __btrfs_end_transaction()
+ btrfs_create_pending_block_groups()
+ --> sees the new btrfs_block_group_cache
+ in the new_bgs list of the transaction
+ handle
+ --> its call to btrfs_insert_item() fails
+ with -EEXIST when attempting to insert
+ the block group item key
+ (offset X, BTRFS_BLOCK_GROUP_ITEM_KEY, 1G)
+ because task A has not removed that key yet
+ --> aborts the running transaction with
+ error -EEXIST
+
+ btrfs_del_item()
+ -> removes the block group's key from
+ the extent tree, key is
+ (offset X, BTRFS_BLOCK_GROUP_ITEM_KEY, 1G)
+
+A sample transaction abort trace:
+
+ [78912.403537] ------------[ cut here ]------------
+ [78912.403811] BTRFS: Transaction aborted (error -17)
+ [78912.404082] WARNING: CPU: 2 PID: 20465 at fs/btrfs/extent-tree.c:10551 btrfs_create_pending_block_groups+0x196/0x250 [btrfs]
+ (...)
+ [78912.405642] CPU: 2 PID: 20465 Comm: btrfs Tainted: G W 5.0.0-btrfs-next-46 #1
+ [78912.405941] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014
+ [78912.406586] RIP: 0010:btrfs_create_pending_block_groups+0x196/0x250 [btrfs]
+ (...)
+ [78912.407636] RSP: 0018:ffff9d3d4b7e3b08 EFLAGS: 00010282
+ [78912.407997] RAX: 0000000000000000 RBX: ffff90959a3796f0 RCX: 0000000000000006
+ [78912.408369] RDX: 0000000000000007 RSI: 0000000000000001 RDI: ffff909636b16860
+ [78912.408746] RBP: ffff909626758a58 R08: 0000000000000000 R09: 0000000000000000
+ [78912.409144] R10: ffff9095ff462400 R11: 0000000000000000 R12: ffff90959a379588
+ [78912.409521] R13: ffff909626758ab0 R14: ffff9095036c0000 R15: ffff9095299e1158
+ [78912.409899] FS: 00007f387f16f700(0000) GS:ffff909636b00000(0000) knlGS:0000000000000000
+ [78912.410285] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [78912.410673] CR2: 00007f429fc87cbc CR3: 000000014440a004 CR4: 00000000003606e0
+ [78912.411095] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [78912.411496] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [78912.411898] Call Trace:
+ [78912.412318] __btrfs_end_transaction+0x5b/0x1c0 [btrfs]
+ [78912.412746] btrfs_inc_block_group_ro+0xcf/0x160 [btrfs]
+ [78912.413179] scrub_enumerate_chunks+0x188/0x5b0 [btrfs]
+ [78912.413622] ? __mutex_unlock_slowpath+0x100/0x2a0
+ [78912.414078] btrfs_scrub_dev+0x2ef/0x720 [btrfs]
+ [78912.414535] ? __sb_start_write+0xd4/0x1c0
+ [78912.414963] ? mnt_want_write_file+0x24/0x50
+ [78912.415403] btrfs_ioctl+0x17fb/0x3120 [btrfs]
+ [78912.415832] ? lock_acquire+0xa6/0x190
+ [78912.416256] ? do_vfs_ioctl+0xa2/0x6f0
+ [78912.416685] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
+ [78912.417116] do_vfs_ioctl+0xa2/0x6f0
+ [78912.417534] ? __fget+0x113/0x200
+ [78912.417954] ksys_ioctl+0x70/0x80
+ [78912.418369] __x64_sys_ioctl+0x16/0x20
+ [78912.418812] do_syscall_64+0x60/0x1b0
+ [78912.419231] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [78912.419644] RIP: 0033:0x7f3880252dd7
+ (...)
+ [78912.420957] RSP: 002b:00007f387f16ed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+ [78912.421426] RAX: ffffffffffffffda RBX: 000055f5becc1df0 RCX: 00007f3880252dd7
+ [78912.421889] RDX: 000055f5becc1df0 RSI: 00000000c400941b RDI: 0000000000000003
+ [78912.422354] RBP: 0000000000000000 R08: 00007f387f16f700 R09: 0000000000000000
+ [78912.422790] R10: 00007f387f16f700 R11: 0000000000000246 R12: 0000000000000000
+ [78912.423202] R13: 00007ffda49c266f R14: 0000000000000000 R15: 00007f388145e040
+ [78912.425505] ---[ end trace eb9bfe7c426fc4d3 ]---
+
+Fix this by calling remove_extent_mapping(), at btrfs_remove_block_group(),
+only at the very end, after removing the block group item key from the
+extent tree (and removing the free space tree entry if we are using the
+free space tree feature).
+
+Fixes: 04216820fe83d5 ("Btrfs: fix race between fs trimming and block group remove/allocation")
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 34 ++++++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 16 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 0cc800d22a081..88c939f7aad96 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10478,22 +10478,6 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ }
+ spin_unlock(&block_group->lock);
+
+- if (remove_em) {
+- struct extent_map_tree *em_tree;
+-
+- em_tree = &fs_info->mapping_tree.map_tree;
+- write_lock(&em_tree->lock);
+- /*
+- * The em might be in the pending_chunks list, so make sure the
+- * chunk mutex is locked, since remove_extent_mapping() will
+- * delete us from that list.
+- */
+- remove_extent_mapping(em_tree, em);
+- write_unlock(&em_tree->lock);
+- /* once for the tree */
+- free_extent_map(em);
+- }
+-
+ mutex_unlock(&fs_info->chunk_mutex);
+
+ ret = remove_block_group_free_space(trans, block_group);
+@@ -10510,6 +10494,24 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ goto out;
+
+ ret = btrfs_del_item(trans, root, path);
++ if (ret)
++ goto out;
++
++ if (remove_em) {
++ struct extent_map_tree *em_tree;
++
++ em_tree = &fs_info->mapping_tree.map_tree;
++ write_lock(&em_tree->lock);
++ /*
++ * The em might be in the pending_chunks list, so make sure the
++ * chunk mutex is locked, since remove_extent_mapping() will
++ * delete us from that list.
++ */
++ remove_extent_mapping(em_tree, em);
++ write_unlock(&em_tree->lock);
++ /* once for the tree */
++ free_extent_map(em);
++ }
+ out:
+ btrfs_free_path(path);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From d3043917046779ed735d7e6c34c6766bc2f418d9 Mon Sep 17 00:00:00 2001
+From: Dan Robertson <dan@dlrobertson.com>
+Date: Tue, 19 Feb 2019 02:56:43 +0000
+Subject: btrfs: init csum_list before possible free
+
+[ Upstream commit e49be14b8d80e23bb7c53d78c21717a474ade76b ]
+
+The scrub_ctx csum_list member must be initialized before scrub_free_ctx
+is called. If the csum_list is not initialized beforehand, the
+list_empty call in scrub_free_csums will result in a null deref if the
+allocation fails in the for loop.
+
+Fixes: a2de733c78fa ("btrfs: scrub")
+CC: stable@vger.kernel.org # 3.0+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Dan Robertson <dan@dlrobertson.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index a08a4d6f540f9..916c397704679 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -592,6 +592,7 @@ static noinline_for_stack struct scrub_ctx *scrub_setup_ctx(
+ sctx->pages_per_rd_bio = SCRUB_PAGES_PER_RD_BIO;
+ sctx->curr = -1;
+ sctx->fs_info = fs_info;
++ INIT_LIST_HEAD(&sctx->csum_list);
+ for (i = 0; i < SCRUB_BIOS_PER_SCTX; ++i) {
+ struct scrub_bio *sbio;
+
+@@ -616,7 +617,6 @@ static noinline_for_stack struct scrub_ctx *scrub_setup_ctx(
+ atomic_set(&sctx->workers_pending, 0);
+ atomic_set(&sctx->cancel_req, 0);
+ sctx->csum_size = btrfs_super_csum_size(fs_info->super_copy);
+- INIT_LIST_HEAD(&sctx->csum_list);
+
+ spin_lock_init(&sctx->list_lock);
+ spin_lock_init(&sctx->stat_lock);
+--
+2.20.1
+
--- /dev/null
+From 93e2b5450bc09b0be59bb50b40d7830ac047fbbc Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Thu, 1 Nov 2018 14:09:46 +0200
+Subject: btrfs: Remove extent_io_ops::fill_delalloc
+
+[ Upstream commit 5eaad97af8aeff38debe7d3c69ec3a0d71f8350f ]
+
+This callback is called only from writepage_delalloc which in turn is
+guaranteed to be called from the data page writeout path. In the end
+there is no reason to have the call to this function to be indrected via
+the extent_io_ops structure. This patch removes the callback definition,
+exports the function and calls it directly. No functional changes.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ rename to btrfs_run_delalloc_range ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 3 +++
+ fs/btrfs/extent_io.c | 20 +++++++++-----------
+ fs/btrfs/extent_io.h | 5 -----
+ fs/btrfs/inode.c | 15 +++++++--------
+ 4 files changed, 19 insertions(+), 24 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 82682da5a40dd..4644f9b629a53 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3200,6 +3200,9 @@ int btrfs_prealloc_file_range_trans(struct inode *inode,
+ struct btrfs_trans_handle *trans, int mode,
+ u64 start, u64 num_bytes, u64 min_size,
+ loff_t actual_len, u64 *alloc_hint);
++int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
++ u64 start, u64 end, int *page_started, unsigned long *nr_written,
++ struct writeback_control *wbc);
+ extern const struct dentry_operations btrfs_dentry_operations;
+ #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+ void btrfs_test_inode_set_ops(struct inode *inode);
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 90b0a6eff5350..cb598eb4f3bd1 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3199,7 +3199,7 @@ static void update_nr_written(struct writeback_control *wbc,
+ /*
+ * helper for __extent_writepage, doing all of the delayed allocation setup.
+ *
+- * This returns 1 if our fill_delalloc function did all the work required
++ * This returns 1 if btrfs_run_delalloc_range function did all the work required
+ * to write the page (copy into inline extent). In this case the IO has
+ * been started and the page is already unlocked.
+ *
+@@ -3220,7 +3220,7 @@ static noinline_for_stack int writepage_delalloc(struct inode *inode,
+ int ret;
+ int page_started = 0;
+
+- if (epd->extent_locked || !tree->ops || !tree->ops->fill_delalloc)
++ if (epd->extent_locked)
+ return 0;
+
+ while (delalloc_end < page_end) {
+@@ -3233,18 +3233,16 @@ static noinline_for_stack int writepage_delalloc(struct inode *inode,
+ delalloc_start = delalloc_end + 1;
+ continue;
+ }
+- ret = tree->ops->fill_delalloc(inode, page,
+- delalloc_start,
+- delalloc_end,
+- &page_started,
+- nr_written, wbc);
++ ret = btrfs_run_delalloc_range(inode, page, delalloc_start,
++ delalloc_end, &page_started, nr_written, wbc);
+ /* File system has been set read-only */
+ if (ret) {
+ SetPageError(page);
+- /* fill_delalloc should be return < 0 for error
+- * but just in case, we use > 0 here meaning the
+- * IO is started, so we don't want to return > 0
+- * unless things are going well.
++ /*
++ * btrfs_run_delalloc_range should return < 0 for error
++ * but just in case, we use > 0 here meaning the IO is
++ * started, so we don't want to return > 0 unless
++ * things are going well.
+ */
+ ret = ret < 0 ? ret : -EIO;
+ goto done;
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index b4d03e677e1d7..ed27becd963c5 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -106,11 +106,6 @@ struct extent_io_ops {
+ /*
+ * Optional hooks, called if the pointer is not NULL
+ */
+- int (*fill_delalloc)(void *private_data, struct page *locked_page,
+- u64 start, u64 end, int *page_started,
+- unsigned long *nr_written,
+- struct writeback_control *wbc);
+-
+ int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
+ void (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+ struct extent_state *state, int uptodate);
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 355ff08e9d44e..bfacce295ef1e 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -110,8 +110,8 @@ static void __endio_write_update_ordered(struct inode *inode,
+ * extent_clear_unlock_delalloc() to clear both the bits EXTENT_DO_ACCOUNTING
+ * and EXTENT_DELALLOC simultaneously, because that causes the reserved metadata
+ * to be released, which we want to happen only when finishing the ordered
+- * extent (btrfs_finish_ordered_io()). Also note that the caller of the
+- * fill_delalloc() callback already does proper cleanup for the first page of
++ * extent (btrfs_finish_ordered_io()). Also note that the caller of
++ * btrfs_run_delalloc_range already does proper cleanup for the first page of
+ * the range, that is, it invokes the callback writepage_end_io_hook() for the
+ * range of the first page.
+ */
+@@ -1599,12 +1599,12 @@ static inline int need_force_cow(struct inode *inode, u64 start, u64 end)
+ }
+
+ /*
+- * extent_io.c call back to do delayed allocation processing
++ * Function to process delayed allocation (create CoW) for ranges which are
++ * being touched for the first time.
+ */
+-static int run_delalloc_range(void *private_data, struct page *locked_page,
+- u64 start, u64 end, int *page_started,
+- unsigned long *nr_written,
+- struct writeback_control *wbc)
++int btrfs_run_delalloc_range(void *private_data, struct page *locked_page,
++ u64 start, u64 end, int *page_started, unsigned long *nr_written,
++ struct writeback_control *wbc)
+ {
+ struct inode *inode = private_data;
+ int ret;
+@@ -10598,7 +10598,6 @@ static const struct extent_io_ops btrfs_extent_io_ops = {
+ .readpage_io_failed_hook = btrfs_readpage_io_failed_hook,
+
+ /* optional callbacks */
+- .fill_delalloc = run_delalloc_range,
+ .writepage_end_io_hook = btrfs_writepage_end_io_hook,
+ .writepage_start_hook = btrfs_writepage_start_hook,
+ .set_bit_hook = btrfs_set_bit_hook,
+--
+2.20.1
+
--- /dev/null
+From 95a4ea128d2f5ab2e0eeaf4a7904085a0989a380 Mon Sep 17 00:00:00 2001
+From: Anand Jain <anand.jain@oracle.com>
+Date: Wed, 30 Jan 2019 14:45:00 +0800
+Subject: btrfs: scrub: fix circular locking dependency warning
+
+[ Upstream commit 1cec3f27168d7835ff3d23ab371cd548440131bb ]
+
+This fixes a longstanding lockdep warning triggered by
+fstests/btrfs/011.
+
+Circular locking dependency check reports warning[1], that's because the
+btrfs_scrub_dev() calls the stack #0 below with, the fs_info::scrub_lock
+held. The test case leading to this warning:
+
+ $ mkfs.btrfs -f /dev/sdb
+ $ mount /dev/sdb /btrfs
+ $ btrfs scrub start -B /btrfs
+
+In fact we have fs_info::scrub_workers_refcnt to track if the init and destroy
+of the scrub workers are needed. So once we have incremented and decremented
+the fs_info::scrub_workers_refcnt value in the thread, its ok to drop the
+scrub_lock, and then actually do the btrfs_destroy_workqueue() part. So this
+patch drops the scrub_lock before calling btrfs_destroy_workqueue().
+
+ [359.258534] ======================================================
+ [359.260305] WARNING: possible circular locking dependency detected
+ [359.261938] 5.0.0-rc6-default #461 Not tainted
+ [359.263135] ------------------------------------------------------
+ [359.264672] btrfs/20975 is trying to acquire lock:
+ [359.265927] 00000000d4d32bea ((wq_completion)"%s-%s""btrfs", name){+.+.}, at: flush_workqueue+0x87/0x540
+ [359.268416]
+ [359.268416] but task is already holding lock:
+ [359.270061] 0000000053ea26a6 (&fs_info->scrub_lock){+.+.}, at: btrfs_scrub_dev+0x322/0x590 [btrfs]
+ [359.272418]
+ [359.272418] which lock already depends on the new lock.
+ [359.272418]
+ [359.274692]
+ [359.274692] the existing dependency chain (in reverse order) is:
+ [359.276671]
+ [359.276671] -> #3 (&fs_info->scrub_lock){+.+.}:
+ [359.278187] __mutex_lock+0x86/0x9c0
+ [359.279086] btrfs_scrub_pause+0x31/0x100 [btrfs]
+ [359.280421] btrfs_commit_transaction+0x1e4/0x9e0 [btrfs]
+ [359.281931] close_ctree+0x30b/0x350 [btrfs]
+ [359.283208] generic_shutdown_super+0x64/0x100
+ [359.284516] kill_anon_super+0x14/0x30
+ [359.285658] btrfs_kill_super+0x12/0xa0 [btrfs]
+ [359.286964] deactivate_locked_super+0x29/0x60
+ [359.288242] cleanup_mnt+0x3b/0x70
+ [359.289310] task_work_run+0x98/0xc0
+ [359.290428] exit_to_usermode_loop+0x83/0x90
+ [359.291445] do_syscall_64+0x15b/0x180
+ [359.292598] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [359.294011]
+ [359.294011] -> #2 (sb_internal#2){.+.+}:
+ [359.295432] __sb_start_write+0x113/0x1d0
+ [359.296394] start_transaction+0x369/0x500 [btrfs]
+ [359.297471] btrfs_finish_ordered_io+0x2aa/0x7c0 [btrfs]
+ [359.298629] normal_work_helper+0xcd/0x530 [btrfs]
+ [359.299698] process_one_work+0x246/0x610
+ [359.300898] worker_thread+0x3c/0x390
+ [359.302020] kthread+0x116/0x130
+ [359.303053] ret_from_fork+0x24/0x30
+ [359.304152]
+ [359.304152] -> #1 ((work_completion)(&work->normal_work)){+.+.}:
+ [359.306100] process_one_work+0x21f/0x610
+ [359.307302] worker_thread+0x3c/0x390
+ [359.308465] kthread+0x116/0x130
+ [359.309357] ret_from_fork+0x24/0x30
+ [359.310229]
+ [359.310229] -> #0 ((wq_completion)"%s-%s""btrfs", name){+.+.}:
+ [359.311812] lock_acquire+0x90/0x180
+ [359.312929] flush_workqueue+0xaa/0x540
+ [359.313845] drain_workqueue+0xa1/0x180
+ [359.314761] destroy_workqueue+0x17/0x240
+ [359.315754] btrfs_destroy_workqueue+0x57/0x200 [btrfs]
+ [359.317245] scrub_workers_put+0x2c/0x60 [btrfs]
+ [359.318585] btrfs_scrub_dev+0x336/0x590 [btrfs]
+ [359.319944] btrfs_dev_replace_by_ioctl.cold.19+0x179/0x1bb [btrfs]
+ [359.321622] btrfs_ioctl+0x28a4/0x2e40 [btrfs]
+ [359.322908] do_vfs_ioctl+0xa2/0x6d0
+ [359.324021] ksys_ioctl+0x3a/0x70
+ [359.325066] __x64_sys_ioctl+0x16/0x20
+ [359.326236] do_syscall_64+0x54/0x180
+ [359.327379] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [359.328772]
+ [359.328772] other info that might help us debug this:
+ [359.328772]
+ [359.330990] Chain exists of:
+ [359.330990] (wq_completion)"%s-%s""btrfs", name --> sb_internal#2 --> &fs_info->scrub_lock
+ [359.330990]
+ [359.334376] Possible unsafe locking scenario:
+ [359.334376]
+ [359.336020] CPU0 CPU1
+ [359.337070] ---- ----
+ [359.337821] lock(&fs_info->scrub_lock);
+ [359.338506] lock(sb_internal#2);
+ [359.339506] lock(&fs_info->scrub_lock);
+ [359.341461] lock((wq_completion)"%s-%s""btrfs", name);
+ [359.342437]
+ [359.342437] *** DEADLOCK ***
+ [359.342437]
+ [359.343745] 1 lock held by btrfs/20975:
+ [359.344788] #0: 0000000053ea26a6 (&fs_info->scrub_lock){+.+.}, at: btrfs_scrub_dev+0x322/0x590 [btrfs]
+ [359.346778]
+ [359.346778] stack backtrace:
+ [359.347897] CPU: 0 PID: 20975 Comm: btrfs Not tainted 5.0.0-rc6-default #461
+ [359.348983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014
+ [359.350501] Call Trace:
+ [359.350931] dump_stack+0x67/0x90
+ [359.351676] print_circular_bug.isra.37.cold.56+0x15c/0x195
+ [359.353569] check_prev_add.constprop.44+0x4f9/0x750
+ [359.354849] ? check_prev_add.constprop.44+0x286/0x750
+ [359.356505] __lock_acquire+0xb84/0xf10
+ [359.357505] lock_acquire+0x90/0x180
+ [359.358271] ? flush_workqueue+0x87/0x540
+ [359.359098] flush_workqueue+0xaa/0x540
+ [359.359912] ? flush_workqueue+0x87/0x540
+ [359.360740] ? drain_workqueue+0x1e/0x180
+ [359.361565] ? drain_workqueue+0xa1/0x180
+ [359.362391] drain_workqueue+0xa1/0x180
+ [359.363193] destroy_workqueue+0x17/0x240
+ [359.364539] btrfs_destroy_workqueue+0x57/0x200 [btrfs]
+ [359.365673] scrub_workers_put+0x2c/0x60 [btrfs]
+ [359.366618] btrfs_scrub_dev+0x336/0x590 [btrfs]
+ [359.367594] ? start_transaction+0xa1/0x500 [btrfs]
+ [359.368679] btrfs_dev_replace_by_ioctl.cold.19+0x179/0x1bb [btrfs]
+ [359.369545] btrfs_ioctl+0x28a4/0x2e40 [btrfs]
+ [359.370186] ? __lock_acquire+0x263/0xf10
+ [359.370777] ? kvm_clock_read+0x14/0x30
+ [359.371392] ? kvm_sched_clock_read+0x5/0x10
+ [359.372248] ? sched_clock+0x5/0x10
+ [359.372786] ? sched_clock_cpu+0xc/0xc0
+ [359.373662] ? do_vfs_ioctl+0xa2/0x6d0
+ [359.374552] do_vfs_ioctl+0xa2/0x6d0
+ [359.375378] ? do_sigaction+0xff/0x250
+ [359.376233] ksys_ioctl+0x3a/0x70
+ [359.376954] __x64_sys_ioctl+0x16/0x20
+ [359.377772] do_syscall_64+0x54/0x180
+ [359.378841] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [359.380422] RIP: 0033:0x7f5429296a97
+
+Backporting to older kernels: scrub_nocow_workers must be freed the same
+way as the others.
+
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+[ update changelog ]
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 56c4d2236484f..a08a4d6f540f9 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -3778,16 +3778,6 @@ fail_scrub_workers:
+ return -ENOMEM;
+ }
+
+-static noinline_for_stack void scrub_workers_put(struct btrfs_fs_info *fs_info)
+-{
+- if (--fs_info->scrub_workers_refcnt == 0) {
+- btrfs_destroy_workqueue(fs_info->scrub_workers);
+- btrfs_destroy_workqueue(fs_info->scrub_wr_completion_workers);
+- btrfs_destroy_workqueue(fs_info->scrub_parity_workers);
+- }
+- WARN_ON(fs_info->scrub_workers_refcnt < 0);
+-}
+-
+ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ u64 end, struct btrfs_scrub_progress *progress,
+ int readonly, int is_dev_replace)
+@@ -3796,6 +3786,9 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ int ret;
+ struct btrfs_device *dev;
+ unsigned int nofs_flag;
++ struct btrfs_workqueue *scrub_workers = NULL;
++ struct btrfs_workqueue *scrub_wr_comp = NULL;
++ struct btrfs_workqueue *scrub_parity = NULL;
+
+ if (btrfs_fs_closing(fs_info))
+ return -EINVAL;
+@@ -3935,9 +3928,16 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+
+ mutex_lock(&fs_info->scrub_lock);
+ dev->scrub_ctx = NULL;
+- scrub_workers_put(fs_info);
++ if (--fs_info->scrub_workers_refcnt == 0) {
++ scrub_workers = fs_info->scrub_workers;
++ scrub_wr_comp = fs_info->scrub_wr_completion_workers;
++ scrub_parity = fs_info->scrub_parity_workers;
++ }
+ mutex_unlock(&fs_info->scrub_lock);
+
++ btrfs_destroy_workqueue(scrub_workers);
++ btrfs_destroy_workqueue(scrub_wr_comp);
++ btrfs_destroy_workqueue(scrub_parity);
+ scrub_put_ctx(sctx);
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 22f025b418c19dd4fd2d23f7bf3038075b62aeb9 Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.com>
+Date: Tue, 4 Dec 2018 16:11:56 +0100
+Subject: btrfs: scrub: move scrub_setup_ctx allocation out of
+ device_list_mutex
+
+[ Upstream commit 0e94c4f45d14cf89d1f40c91b0a8517e791672a7 ]
+
+The scrub context is allocated with GFP_KERNEL and called from
+btrfs_scrub_dev under the fs_info::device_list_mutex. This is not safe
+regarding reclaim that could try to flush filesystem data in order to
+get the memory. And the device_list_mutex is held during superblock
+commit, so this would cause a lockup.
+
+Move the alocation and initialization before any changes that require
+the mutex.
+
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index efaad3e1b295a..56c4d2236484f 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -3837,13 +3837,18 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ return -EINVAL;
+ }
+
++ /* Allocate outside of device_list_mutex */
++ sctx = scrub_setup_ctx(fs_info, is_dev_replace);
++ if (IS_ERR(sctx))
++ return PTR_ERR(sctx);
+
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ dev = btrfs_find_device(fs_info, devid, NULL, NULL);
+ if (!dev || (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) &&
+ !is_dev_replace)) {
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out_free_ctx;
+ }
+
+ if (!is_dev_replace && !readonly &&
+@@ -3851,7 +3856,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+ btrfs_err_in_rcu(fs_info, "scrub: device %s is not writable",
+ rcu_str_deref(dev->name));
+- return -EROFS;
++ ret = -EROFS;
++ goto out_free_ctx;
+ }
+
+ mutex_lock(&fs_info->scrub_lock);
+@@ -3859,7 +3865,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &dev->dev_state)) {
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return -EIO;
++ ret = -EIO;
++ goto out_free_ctx;
+ }
+
+ btrfs_dev_replace_read_lock(&fs_info->dev_replace);
+@@ -3869,7 +3876,8 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return -EINPROGRESS;
++ ret = -EINPROGRESS;
++ goto out_free_ctx;
+ }
+ btrfs_dev_replace_read_unlock(&fs_info->dev_replace);
+
+@@ -3877,16 +3885,9 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ if (ret) {
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- return ret;
++ goto out_free_ctx;
+ }
+
+- sctx = scrub_setup_ctx(fs_info, is_dev_replace);
+- if (IS_ERR(sctx)) {
+- mutex_unlock(&fs_info->scrub_lock);
+- mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+- scrub_workers_put(fs_info);
+- return PTR_ERR(sctx);
+- }
+ sctx->readonly = readonly;
+ dev->scrub_ctx = sctx;
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+@@ -3939,6 +3940,11 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+
+ scrub_put_ctx(sctx);
+
++ return ret;
++
++out_free_ctx:
++ scrub_free_ctx(sctx);
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c8fcf208e998d4bccf3c57543aa8b4c0e245d85a Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.com>
+Date: Tue, 4 Dec 2018 16:11:55 +0100
+Subject: btrfs: scrub: pass fs_info to scrub_setup_ctx
+
+[ Upstream commit 92f7ba434f51e8e9317f1d166105889aa230abd2 ]
+
+We can pass fs_info directly as this is the only member of btrfs_device
+that's bing used inside scrub_setup_ctx.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/scrub.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
+index 5a2d10ba747f7..efaad3e1b295a 100644
+--- a/fs/btrfs/scrub.c
++++ b/fs/btrfs/scrub.c
+@@ -578,12 +578,11 @@ static void scrub_put_ctx(struct scrub_ctx *sctx)
+ scrub_free_ctx(sctx);
+ }
+
+-static noinline_for_stack
+-struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace)
++static noinline_for_stack struct scrub_ctx *scrub_setup_ctx(
++ struct btrfs_fs_info *fs_info, int is_dev_replace)
+ {
+ struct scrub_ctx *sctx;
+ int i;
+- struct btrfs_fs_info *fs_info = dev->fs_info;
+
+ sctx = kzalloc(sizeof(*sctx), GFP_KERNEL);
+ if (!sctx)
+@@ -592,7 +591,7 @@ struct scrub_ctx *scrub_setup_ctx(struct btrfs_device *dev, int is_dev_replace)
+ sctx->is_dev_replace = is_dev_replace;
+ sctx->pages_per_rd_bio = SCRUB_PAGES_PER_RD_BIO;
+ sctx->curr = -1;
+- sctx->fs_info = dev->fs_info;
++ sctx->fs_info = fs_info;
+ for (i = 0; i < SCRUB_BIOS_PER_SCTX; ++i) {
+ struct scrub_bio *sbio;
+
+@@ -3881,7 +3880,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start,
+ return ret;
+ }
+
+- sctx = scrub_setup_ctx(dev, is_dev_replace);
++ sctx = scrub_setup_ctx(fs_info, is_dev_replace);
+ if (IS_ERR(sctx)) {
+ mutex_unlock(&fs_info->scrub_lock);
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+--
+2.20.1
+
--- /dev/null
+From 2f4bcf4632454fba8d48c2ee82824114ab6fc612 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Tue, 8 Jan 2019 14:08:18 +0800
+Subject: btrfs: Use real device structure to verify dev extent
+
+[ Upstream commit 1b3922a8bc74231f9a767d1be6d9a061a4d4eeab ]
+
+[BUG]
+Linux v5.0-rc1 will fail fstests/btrfs/163 with the following kernel
+message:
+
+ BTRFS error (device dm-6): dev extent devid 1 physical offset 13631488 len 8388608 is beyond device boundary 0
+ BTRFS error (device dm-6): failed to verify dev extents against chunks: -117
+ BTRFS error (device dm-6): open_ctree failed
+
+[CAUSE]
+Commit cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent
+mapping check") introduced strict check on dev extents.
+
+We use btrfs_find_device() with dev uuid and fs uuid set to NULL, and
+only dependent on @devid to find the real device.
+
+For seed devices, we call clone_fs_devices() in open_seed_devices() to
+allow us search seed devices directly.
+
+However clone_fs_devices() just populates devices with devid and dev
+uuid, without populating other essential members, like disk_total_bytes.
+
+This makes any device returned by btrfs_find_device(fs_info, devid,
+NULL, NULL) is just a dummy, with 0 disk_total_bytes, and any dev
+extents on the seed device will not pass the device boundary check.
+
+[FIX]
+This patch will try to verify the device returned by btrfs_find_device()
+and if it's a dummy then re-search in seed devices.
+
+Fixes: cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check")
+CC: stable@vger.kernel.org # 4.19+
+Reported-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index c20708bfae561..a8297e7489d98 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7469,6 +7469,18 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+ ret = -EUCLEAN;
+ goto out;
+ }
++
++ /* It's possible this device is a dummy for seed device */
++ if (dev->disk_total_bytes == 0) {
++ dev = find_device(fs_info->fs_devices->seed, devid, NULL);
++ if (!dev) {
++ btrfs_err(fs_info, "failed to find seed devid %llu",
++ devid);
++ ret = -EUCLEAN;
++ goto out;
++ }
++ }
++
+ if (physical_offset + physical_len > dev->disk_total_bytes) {
+ btrfs_err(fs_info,
+ "dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
+--
+2.20.1
+
--- /dev/null
+From 5b8010de3f459807f57bed33e5d2e91a718b74da Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 5 Oct 2018 17:45:55 +0800
+Subject: btrfs: volumes: Make sure no dev extent is beyond device boundary
+
+[ Upstream commit 05a37c48604c19b50873fd9663f9140c150469d1 ]
+
+Add extra dev extent end check against device boundary.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 6e008bd5c8cd1..c20708bfae561 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7411,6 +7411,7 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+ struct extent_map_tree *em_tree = &fs_info->mapping_tree.map_tree;
+ struct extent_map *em;
+ struct map_lookup *map;
++ struct btrfs_device *dev;
+ u64 stripe_len;
+ bool found = false;
+ int ret = 0;
+@@ -7460,6 +7461,22 @@ static int verify_one_dev_extent(struct btrfs_fs_info *fs_info,
+ physical_offset, devid);
+ ret = -EUCLEAN;
+ }
++
++ /* Make sure no dev extent is beyond device bondary */
++ dev = btrfs_find_device(fs_info, devid, NULL, NULL);
++ if (!dev) {
++ btrfs_err(fs_info, "failed to find devid %llu", devid);
++ ret = -EUCLEAN;
++ goto out;
++ }
++ if (physical_offset + physical_len > dev->disk_total_bytes) {
++ btrfs_err(fs_info,
++"dev extent devid %llu physical offset %llu len %llu is beyond device boundary %llu",
++ devid, physical_offset, physical_len,
++ dev->disk_total_bytes);
++ ret = -EUCLEAN;
++ goto out;
++ }
+ out:
+ free_extent_map(em);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 9a0b41187c6f94abef2a0dc20597b329c30faceb Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Sun, 2 Jun 2019 09:45:38 +0800
+Subject: ceph: use ceph_evict_inode to cleanup inode's resource
+
+[ Upstream commit 87bc5b895d94a0f40fe170d4cf5771c8e8f85d15 ]
+
+remove_session_caps() relies on __wait_on_freeing_inode(), to wait for
+freeing inode to remove its caps. But VFS wakes freeing inode waiters
+before calling destroy_inode().
+
+Cc: stable@vger.kernel.org
+Link: https://tracker.ceph.com/issues/40102
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/inode.c | 7 +++++--
+ fs/ceph/super.c | 2 +-
+ fs/ceph/super.h | 2 +-
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 11f19432a74c4..665a86f83f4b0 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -528,13 +528,16 @@ static void ceph_i_callback(struct rcu_head *head)
+ kmem_cache_free(ceph_inode_cachep, ci);
+ }
+
+-void ceph_destroy_inode(struct inode *inode)
++void ceph_evict_inode(struct inode *inode)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+ struct ceph_inode_frag *frag;
+ struct rb_node *n;
+
+- dout("destroy_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
++ dout("evict_inode %p ino %llx.%llx\n", inode, ceph_vinop(inode));
++
++ truncate_inode_pages_final(&inode->i_data);
++ clear_inode(inode);
+
+ ceph_fscache_unregister_inode_cookie(ci);
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index c5cf46e43f2e7..02528e11bf331 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -827,9 +827,9 @@ static int ceph_remount(struct super_block *sb, int *flags, char *data)
+
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
+- .destroy_inode = ceph_destroy_inode,
+ .write_inode = ceph_write_inode,
+ .drop_inode = ceph_drop_inode,
++ .evict_inode = ceph_evict_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
+ .remount_fs = ceph_remount,
+diff --git a/fs/ceph/super.h b/fs/ceph/super.h
+index 0180193097905..6e968e48e5e4b 100644
+--- a/fs/ceph/super.h
++++ b/fs/ceph/super.h
+@@ -854,7 +854,7 @@ static inline bool __ceph_have_pending_cap_snap(struct ceph_inode_info *ci)
+ extern const struct inode_operations ceph_file_iops;
+
+ extern struct inode *ceph_alloc_inode(struct super_block *sb);
+-extern void ceph_destroy_inode(struct inode *inode);
++extern void ceph_evict_inode(struct inode *inode);
+ extern int ceph_drop_inode(struct inode *inode);
+
+ extern struct inode *ceph_get_inode(struct super_block *sb,
+--
+2.20.1
+
--- /dev/null
+From 8fc3023d02cfedf842d69c4b805765db69bc5b95 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Wed, 5 Jun 2019 10:38:38 +1000
+Subject: cifs: add spinlock for the openFileList to cifsInodeInfo
+
+[ Upstream commit 487317c99477d00f22370625d53be3239febabbe ]
+
+We can not depend on the tcon->open_file_lock here since in multiuser mode
+we may have the same file/inode open via multiple different tcons.
+
+The current code is race prone and will crash if one user deletes a file
+at the same time a different user opens/create the file.
+
+To avoid this we need to have a spinlock attached to the inode and not the tcon.
+
+RHBZ: 1580165
+
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsfs.c | 1 +
+ fs/cifs/cifsglob.h | 5 +++++
+ fs/cifs/file.c | 8 ++++++--
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index fb32f3d6925e8..64e3888f30e6d 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -292,6 +292,7 @@ cifs_alloc_inode(struct super_block *sb)
+ cifs_inode->uniqueid = 0;
+ cifs_inode->createtime = 0;
+ cifs_inode->epoch = 0;
++ spin_lock_init(&cifs_inode->open_file_lock);
+ generate_random_uuid(cifs_inode->lease_key);
+
+ /*
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 0ee0072c1f362..57af9bac0045a 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1287,6 +1287,7 @@ struct cifsInodeInfo {
+ struct rw_semaphore lock_sem; /* protect the fields above */
+ /* BB add in lists for dirty pages i.e. write caching info for oplock */
+ struct list_head openFileList;
++ spinlock_t open_file_lock; /* protects openFileList */
+ __u32 cifsAttrs; /* e.g. DOS archive bit, sparse, compressed, system */
+ unsigned int oplock; /* oplock/lease level we have */
+ unsigned int epoch; /* used to track lease state changes */
+@@ -1687,10 +1688,14 @@ require use of the stronger protocol */
+ * tcp_ses_lock protects:
+ * list operations on tcp and SMB session lists
+ * tcon->open_file_lock protects the list of open files hanging off the tcon
++ * inode->open_file_lock protects the openFileList hanging off the inode
+ * cfile->file_info_lock protects counters and fields in cifs file struct
+ * f_owner.lock protects certain per file struct operations
+ * mapping->page_lock protects certain per page operations
+ *
++ * Note that the cifs_tcon.open_file_lock should be taken before
++ * not after the cifsInodeInfo.open_file_lock
++ *
+ * Semaphores
+ * ----------
+ * sesSem operations on smb session
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 933013543edab..8703b5f26f452 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -336,10 +336,12 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ list_add(&cfile->tlist, &tcon->openFileList);
+
+ /* if readable file instance put first in list*/
++ spin_lock(&cinode->open_file_lock);
+ if (file->f_mode & FMODE_READ)
+ list_add(&cfile->flist, &cinode->openFileList);
+ else
+ list_add_tail(&cfile->flist, &cinode->openFileList);
++ spin_unlock(&cinode->open_file_lock);
+ spin_unlock(&tcon->open_file_lock);
+
+ if (fid->purge_cache)
+@@ -411,7 +413,9 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ cifs_add_pending_open_locked(&fid, cifs_file->tlink, &open);
+
+ /* remove it from the lists */
++ spin_lock(&cifsi->open_file_lock);
+ list_del(&cifs_file->flist);
++ spin_unlock(&cifsi->open_file_lock);
+ list_del(&cifs_file->tlist);
+
+ if (list_empty(&cifsi->openFileList)) {
+@@ -1929,10 +1933,10 @@ refind_writable:
+ if (!rc)
+ return inv_file;
+ else {
+- spin_lock(&tcon->open_file_lock);
++ spin_lock(&cifs_inode->open_file_lock);
+ list_move_tail(&inv_file->flist,
+ &cifs_inode->openFileList);
+- spin_unlock(&tcon->open_file_lock);
++ spin_unlock(&cifs_inode->open_file_lock);
+ cifsFileInfo_put(inv_file);
+ ++refind;
+ inv_file = NULL;
+--
+2.20.1
+
--- /dev/null
+From ed212c02f4a8a499ff040558390b11aa438b9b14 Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <pshilov@microsoft.com>
+Date: Tue, 8 Jan 2019 11:15:28 -0800
+Subject: CIFS: Fix error paths in writeback code
+
+[ Upstream commit 9a66396f1857cc1de06f4f4771797315e1a4ea56 ]
+
+This patch aims to address writeback code problems related to error
+paths. In particular it respects EINTR and related error codes and
+stores and returns the first error occurred during writeback.
+
+Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
+Acked-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsglob.h | 19 +++++++++++++++++++
+ fs/cifs/cifssmb.c | 7 ++++---
+ fs/cifs/file.c | 29 +++++++++++++++++++++++------
+ fs/cifs/inode.c | 10 ++++++++++
+ 4 files changed, 56 insertions(+), 9 deletions(-)
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 6f227cc781e5d..0ee0072c1f362 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1563,6 +1563,25 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param,
+ kfree(param);
+ }
+
++static inline bool is_interrupt_error(int error)
++{
++ switch (error) {
++ case -EINTR:
++ case -ERESTARTSYS:
++ case -ERESTARTNOHAND:
++ case -ERESTARTNOINTR:
++ return true;
++ }
++ return false;
++}
++
++static inline bool is_retryable_error(int error)
++{
++ if (is_interrupt_error(error) || error == -EAGAIN)
++ return true;
++ return false;
++}
++
+ #define MID_FREE 0
+ #define MID_REQUEST_ALLOCATED 1
+ #define MID_REQUEST_SUBMITTED 2
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index 269471c8f42bf..a5cb7b2d1ac5d 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2042,7 +2042,7 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+
+ for (j = 0; j < nr_pages; j++) {
+ unlock_page(wdata2->pages[j]);
+- if (rc != 0 && rc != -EAGAIN) {
++ if (rc != 0 && !is_retryable_error(rc)) {
+ SetPageError(wdata2->pages[j]);
+ end_page_writeback(wdata2->pages[j]);
+ put_page(wdata2->pages[j]);
+@@ -2051,7 +2051,7 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+
+ if (rc) {
+ kref_put(&wdata2->refcount, cifs_writedata_release);
+- if (rc == -EAGAIN)
++ if (is_retryable_error(rc))
+ continue;
+ break;
+ }
+@@ -2060,7 +2060,8 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+ i += nr_pages;
+ } while (i < wdata->nr_pages);
+
+- mapping_set_error(inode->i_mapping, rc);
++ if (rc != 0 && !is_retryable_error(rc))
++ mapping_set_error(inode->i_mapping, rc);
+ kref_put(&wdata->refcount, cifs_writedata_release);
+ }
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 23cee91ed442e..933013543edab 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -749,7 +749,8 @@ reopen_success:
+
+ if (can_flush) {
+ rc = filemap_write_and_wait(inode->i_mapping);
+- mapping_set_error(inode->i_mapping, rc);
++ if (!is_interrupt_error(rc))
++ mapping_set_error(inode->i_mapping, rc);
+
+ if (tcon->unix_ext)
+ rc = cifs_get_inode_info_unix(&inode, full_path,
+@@ -2137,6 +2138,7 @@ static int cifs_writepages(struct address_space *mapping,
+ pgoff_t end, index;
+ struct cifs_writedata *wdata;
+ int rc = 0;
++ int saved_rc = 0;
+
+ /*
+ * If wsize is smaller than the page cache size, default to writing
+@@ -2163,8 +2165,10 @@ retry:
+
+ rc = server->ops->wait_mtu_credits(server, cifs_sb->wsize,
+ &wsize, &credits);
+- if (rc)
++ if (rc != 0) {
++ done = true;
+ break;
++ }
+
+ tofind = min((wsize / PAGE_SIZE) - 1, end - index) + 1;
+
+@@ -2172,6 +2176,7 @@ retry:
+ &found_pages);
+ if (!wdata) {
+ rc = -ENOMEM;
++ done = true;
+ add_credits_and_wake_if(server, credits, 0);
+ break;
+ }
+@@ -2200,7 +2205,7 @@ retry:
+ if (rc != 0) {
+ add_credits_and_wake_if(server, wdata->credits, 0);
+ for (i = 0; i < nr_pages; ++i) {
+- if (rc == -EAGAIN)
++ if (is_retryable_error(rc))
+ redirty_page_for_writepage(wbc,
+ wdata->pages[i]);
+ else
+@@ -2208,7 +2213,7 @@ retry:
+ end_page_writeback(wdata->pages[i]);
+ put_page(wdata->pages[i]);
+ }
+- if (rc != -EAGAIN)
++ if (!is_retryable_error(rc))
+ mapping_set_error(mapping, rc);
+ }
+ kref_put(&wdata->refcount, cifs_writedata_release);
+@@ -2218,6 +2223,15 @@ retry:
+ continue;
+ }
+
++ /* Return immediately if we received a signal during writing */
++ if (is_interrupt_error(rc)) {
++ done = true;
++ break;
++ }
++
++ if (rc != 0 && saved_rc == 0)
++ saved_rc = rc;
++
+ wbc->nr_to_write -= nr_pages;
+ if (wbc->nr_to_write <= 0)
+ done = true;
+@@ -2235,6 +2249,9 @@ retry:
+ goto retry;
+ }
+
++ if (saved_rc != 0)
++ rc = saved_rc;
++
+ if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+ mapping->writeback_index = index;
+
+@@ -2266,8 +2283,8 @@ cifs_writepage_locked(struct page *page, struct writeback_control *wbc)
+ set_page_writeback(page);
+ retry_write:
+ rc = cifs_partialpagewrite(page, 0, PAGE_SIZE);
+- if (rc == -EAGAIN) {
+- if (wbc->sync_mode == WB_SYNC_ALL)
++ if (is_retryable_error(rc)) {
++ if (wbc->sync_mode == WB_SYNC_ALL && rc == -EAGAIN)
+ goto retry_write;
+ redirty_page_for_writepage(wbc, page);
+ } else if (rc != 0) {
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 1fadd314ae7f9..53f3d08898af8 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2261,6 +2261,11 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
+ * the flush returns error?
+ */
+ rc = filemap_write_and_wait(inode->i_mapping);
++ if (is_interrupt_error(rc)) {
++ rc = -ERESTARTSYS;
++ goto out;
++ }
++
+ mapping_set_error(inode->i_mapping, rc);
+ rc = 0;
+
+@@ -2404,6 +2409,11 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs)
+ * the flush returns error?
+ */
+ rc = filemap_write_and_wait(inode->i_mapping);
++ if (is_interrupt_error(rc)) {
++ rc = -ERESTARTSYS;
++ goto cifs_setattr_exit;
++ }
++
+ mapping_set_error(inode->i_mapping, rc);
+ rc = 0;
+
+--
+2.20.1
+
--- /dev/null
+From 47931bd73d7544d27cadfda516afb2d2784b65a4 Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <pshilov@microsoft.com>
+Date: Tue, 29 Jan 2019 16:40:28 -0800
+Subject: CIFS: Fix leaking locked VFS cache pages in writeback retry
+
+[ Upstream commit 165df9a080b6863ae286fa01780c13d87cd81076 ]
+
+If we don't find a writable file handle when retrying writepages
+we break of the loop and do not unlock and put pages neither from
+wdata2 nor from the original wdata. Fix this by walking through
+all the remaining pages and cleanup them properly.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifssmb.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index a5cb7b2d1ac5d..86a54b809c484 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2033,12 +2033,13 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+
+ wdata2->cfile = find_writable_file(CIFS_I(inode), false);
+ if (!wdata2->cfile) {
+- cifs_dbg(VFS, "No writable handles for inode\n");
++ cifs_dbg(VFS, "No writable handle to retry writepages\n");
+ rc = -EBADF;
+- break;
++ } else {
++ wdata2->pid = wdata2->cfile->pid;
++ rc = server->ops->async_writev(wdata2,
++ cifs_writedata_release);
+ }
+- wdata2->pid = wdata2->cfile->pid;
+- rc = server->ops->async_writev(wdata2, cifs_writedata_release);
+
+ for (j = 0; j < nr_pages; j++) {
+ unlock_page(wdata2->pages[j]);
+@@ -2053,6 +2054,7 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+ kref_put(&wdata2->refcount, cifs_writedata_release);
+ if (is_retryable_error(rc))
+ continue;
++ i += nr_pages;
+ break;
+ }
+
+@@ -2060,6 +2062,13 @@ cifs_writev_requeue(struct cifs_writedata *wdata)
+ i += nr_pages;
+ } while (i < wdata->nr_pages);
+
++ /* cleanup remaining pages from the original wdata */
++ for (; i < wdata->nr_pages; i++) {
++ SetPageError(wdata->pages[i]);
++ end_page_writeback(wdata->pages[i]);
++ put_page(wdata->pages[i]);
++ }
++
+ if (rc != 0 && !is_retryable_error(rc))
+ mapping_set_error(inode->i_mapping, rc);
+ kref_put(&wdata->refcount, cifs_writedata_release);
+--
+2.20.1
+
--- /dev/null
+From fc06990db1e1263c362784303dd276dfebf265c2 Mon Sep 17 00:00:00 2001
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Date: Sat, 6 Apr 2019 15:30:38 +0800
+Subject: cifs: Fix lease buffer length error
+
+[ Upstream commit b57a55e2200ede754e4dc9cce4ba9402544b9365 ]
+
+There is a KASAN slab-out-of-bounds:
+BUG: KASAN: slab-out-of-bounds in _copy_from_iter_full+0x783/0xaa0
+Read of size 80 at addr ffff88810c35e180 by task mount.cifs/539
+
+CPU: 1 PID: 539 Comm: mount.cifs Not tainted 4.19 #10
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+ rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014
+Call Trace:
+ dump_stack+0xdd/0x12a
+ print_address_description+0xa7/0x540
+ kasan_report+0x1ff/0x550
+ check_memory_region+0x2f1/0x310
+ memcpy+0x2f/0x80
+ _copy_from_iter_full+0x783/0xaa0
+ tcp_sendmsg_locked+0x1840/0x4140
+ tcp_sendmsg+0x37/0x60
+ inet_sendmsg+0x18c/0x490
+ sock_sendmsg+0xae/0x130
+ smb_send_kvec+0x29c/0x520
+ __smb_send_rqst+0x3ef/0xc60
+ smb_send_rqst+0x25a/0x2e0
+ compound_send_recv+0x9e8/0x2af0
+ cifs_send_recv+0x24/0x30
+ SMB2_open+0x35e/0x1620
+ open_shroot+0x27b/0x490
+ smb2_open_op_close+0x4e1/0x590
+ smb2_query_path_info+0x2ac/0x650
+ cifs_get_inode_info+0x1058/0x28f0
+ cifs_root_iget+0x3bb/0xf80
+ cifs_smb3_do_mount+0xe00/0x14c0
+ cifs_do_mount+0x15/0x20
+ mount_fs+0x5e/0x290
+ vfs_kern_mount+0x88/0x460
+ do_mount+0x398/0x31e0
+ ksys_mount+0xc6/0x150
+ __x64_sys_mount+0xea/0x190
+ do_syscall_64+0x122/0x590
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+It can be reproduced by the following step:
+ 1. samba configured with: server max protocol = SMB2_10
+ 2. mount -o vers=default
+
+When parse the mount version parameter, the 'ops' and 'vals'
+was setted to smb30, if negotiate result is smb21, just
+update the 'ops' to smb21, but the 'vals' is still smb30.
+When add lease context, the iov_base is allocated with smb21
+ops, but the iov_len is initiallited with the smb30. Because
+the iov_len is longer than iov_base, when send the message,
+copy array out of bounds.
+
+we need to keep the 'ops' and 'vals' consistent.
+
+Fixes: 9764c02fcbad ("SMB3: Add support for multidialect negotiate (SMB2.1 and later)")
+Fixes: d5c7076b772a ("smb3: add smb3.1.1 to default dialect list")
+
+Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 2bc47eb6215e2..cbe633f1840a2 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -712,6 +712,7 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
+ } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
+ /* ops set to 3.0 by default for default so update */
+ ses->server->ops = &smb21_operations;
++ ses->server->vals = &smb21_values;
+ }
+ } else if (le16_to_cpu(rsp->DialectRevision) !=
+ ses->server->vals->protocol_id) {
+--
+2.20.1
+
--- /dev/null
+From f20eef4fdca6d0dbf8894ca34095b949730c7164 Mon Sep 17 00:00:00 2001
+From: "Paulo Alcantara (SUSE)" <paulo@paulo.ac>
+Date: Tue, 18 Jun 2019 16:16:02 -0300
+Subject: cifs: Properly handle auto disabling of serverino option
+
+[ Upstream commit 29fbeb7a908a60a5ae8c50fbe171cb8fdcef1980 ]
+
+Fix mount options comparison when serverino option is turned off later
+in cifs_autodisable_serverino() and thus avoiding mismatch of new cifs
+mounts.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Paulo Alcantara (SUSE) <paulo@paulo.ac>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilove@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifs_fs_sb.h | 5 +++++
+ fs/cifs/connect.c | 8 ++++++--
+ fs/cifs/misc.c | 1 +
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
+index 9731d0d891e7e..aba2b48d4da1a 100644
+--- a/fs/cifs/cifs_fs_sb.h
++++ b/fs/cifs/cifs_fs_sb.h
+@@ -72,5 +72,10 @@ struct cifs_sb_info {
+ struct delayed_work prune_tlinks;
+ struct rcu_head rcu;
+ char *prepath;
++ /*
++ * Indicate whether serverino option was turned off later
++ * (cifs_autodisable_serverino) in order to match new mounts.
++ */
++ bool mnt_cifs_serverino_autodisabled;
+ };
+ #endif /* _CIFS_FS_SB_H */
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index c53a2e86ed544..208430bb66fc6 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3247,12 +3247,16 @@ compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+ {
+ struct cifs_sb_info *old = CIFS_SB(sb);
+ struct cifs_sb_info *new = mnt_data->cifs_sb;
++ unsigned int oldflags = old->mnt_cifs_flags & CIFS_MOUNT_MASK;
++ unsigned int newflags = new->mnt_cifs_flags & CIFS_MOUNT_MASK;
+
+ if ((sb->s_flags & CIFS_MS_MASK) != (mnt_data->flags & CIFS_MS_MASK))
+ return 0;
+
+- if ((old->mnt_cifs_flags & CIFS_MOUNT_MASK) !=
+- (new->mnt_cifs_flags & CIFS_MOUNT_MASK))
++ if (old->mnt_cifs_serverino_autodisabled)
++ newflags &= ~CIFS_MOUNT_SERVER_INUM;
++
++ if (oldflags != newflags)
+ return 0;
+
+ /*
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index facc94e159a16..e45f8e321371c 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -523,6 +523,7 @@ cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+ {
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+ cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
++ cifs_sb->mnt_cifs_serverino_autodisabled = true;
+ cifs_dbg(VFS, "Autodisabling the use of server inode numbers on %s. This server doesn't seem to support them properly. Hardlinks will not be recognized on this mount. Consider mounting with the \"noserverino\" option to silence this message.\n",
+ cifs_sb_master_tcon(cifs_sb)->treeName);
+ }
+--
+2.20.1
+
--- /dev/null
+From 9d6ffc80806607462c1f5d4f4b4ef604ab0deb9b Mon Sep 17 00:00:00 2001
+From: Long Li <longli@microsoft.com>
+Date: Mon, 15 Apr 2019 14:49:17 -0700
+Subject: cifs: smbd: take an array of reqeusts when sending upper layer data
+
+[ Upstream commit 4739f2328661d070f93f9bcc8afb2a82706c826d ]
+
+To support compounding, __smb_send_rqst() now sends an array of requests to
+the transport layer.
+Change smbd_send() to take an array of requests, and send them in as few
+packets as possible.
+
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smbdirect.c | 55 +++++++++++++++++++++++----------------------
+ fs/cifs/smbdirect.h | 5 +++--
+ fs/cifs/transport.c | 2 +-
+ 3 files changed, 32 insertions(+), 30 deletions(-)
+
+diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c
+index 5fdb9a509a97f..1959931e14c1e 100644
+--- a/fs/cifs/smbdirect.c
++++ b/fs/cifs/smbdirect.c
+@@ -2090,7 +2090,8 @@ int smbd_recv(struct smbd_connection *info, struct msghdr *msg)
+ * rqst: the data to write
+ * return value: 0 if successfully write, otherwise error code
+ */
+-int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
++int smbd_send(struct TCP_Server_Info *server,
++ int num_rqst, struct smb_rqst *rqst_array)
+ {
+ struct smbd_connection *info = server->smbd_conn;
+ struct kvec vec;
+@@ -2102,6 +2103,8 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ info->max_send_size - sizeof(struct smbd_data_transfer);
+ struct kvec *iov;
+ int rc;
++ struct smb_rqst *rqst;
++ int rqst_idx;
+
+ info->smbd_send_pending++;
+ if (info->transport_status != SMBD_CONNECTED) {
+@@ -2109,47 +2112,41 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ goto done;
+ }
+
+- /*
+- * Skip the RFC1002 length defined in MS-SMB2 section 2.1
+- * It is used only for TCP transport in the iov[0]
+- * In future we may want to add a transport layer under protocol
+- * layer so this will only be issued to TCP transport
+- */
+-
+- if (rqst->rq_iov[0].iov_len != 4) {
+- log_write(ERR, "expected the pdu length in 1st iov, but got %zu\n", rqst->rq_iov[0].iov_len);
+- return -EINVAL;
+- }
+-
+ /*
+ * Add in the page array if there is one. The caller needs to set
+ * rq_tailsz to PAGE_SIZE when the buffer has multiple pages and
+ * ends at page boundary
+ */
+- buflen = smb_rqst_len(server, rqst);
++ remaining_data_length = 0;
++ for (i = 0; i < num_rqst; i++)
++ remaining_data_length += smb_rqst_len(server, &rqst_array[i]);
+
+- if (buflen + sizeof(struct smbd_data_transfer) >
++ if (remaining_data_length + sizeof(struct smbd_data_transfer) >
+ info->max_fragmented_send_size) {
+ log_write(ERR, "payload size %d > max size %d\n",
+- buflen, info->max_fragmented_send_size);
++ remaining_data_length, info->max_fragmented_send_size);
+ rc = -EINVAL;
+ goto done;
+ }
+
+- iov = &rqst->rq_iov[1];
++ rqst_idx = 0;
++
++next_rqst:
++ rqst = &rqst_array[rqst_idx];
++ iov = rqst->rq_iov;
+
+- cifs_dbg(FYI, "Sending smb (RDMA): smb_len=%u\n", buflen);
+- for (i = 0; i < rqst->rq_nvec-1; i++)
++ cifs_dbg(FYI, "Sending smb (RDMA): idx=%d smb_len=%lu\n",
++ rqst_idx, smb_rqst_len(server, rqst));
++ for (i = 0; i < rqst->rq_nvec; i++)
+ dump_smb(iov[i].iov_base, iov[i].iov_len);
+
+- remaining_data_length = buflen;
+
+- log_write(INFO, "rqst->rq_nvec=%d rqst->rq_npages=%d rq_pagesz=%d "
+- "rq_tailsz=%d buflen=%d\n",
+- rqst->rq_nvec, rqst->rq_npages, rqst->rq_pagesz,
+- rqst->rq_tailsz, buflen);
++ log_write(INFO, "rqst_idx=%d nvec=%d rqst->rq_npages=%d rq_pagesz=%d "
++ "rq_tailsz=%d buflen=%lu\n",
++ rqst_idx, rqst->rq_nvec, rqst->rq_npages, rqst->rq_pagesz,
++ rqst->rq_tailsz, smb_rqst_len(server, rqst));
+
+- start = i = iov[0].iov_len ? 0 : 1;
++ start = i = 0;
+ buflen = 0;
+ while (true) {
+ buflen += iov[i].iov_len;
+@@ -2197,14 +2194,14 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ goto done;
+ }
+ i++;
+- if (i == rqst->rq_nvec-1)
++ if (i == rqst->rq_nvec)
+ break;
+ }
+ start = i;
+ buflen = 0;
+ } else {
+ i++;
+- if (i == rqst->rq_nvec-1) {
++ if (i == rqst->rq_nvec) {
+ /* send out all remaining vecs */
+ remaining_data_length -= buflen;
+ log_write(INFO,
+@@ -2248,6 +2245,10 @@ int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst)
+ }
+ }
+
++ rqst_idx++;
++ if (rqst_idx < num_rqst)
++ goto next_rqst;
++
+ done:
+ /*
+ * As an optimization, we don't wait for individual I/O to finish
+diff --git a/fs/cifs/smbdirect.h b/fs/cifs/smbdirect.h
+index a11096254f296..b5c240ff21919 100644
+--- a/fs/cifs/smbdirect.h
++++ b/fs/cifs/smbdirect.h
+@@ -292,7 +292,8 @@ void smbd_destroy(struct smbd_connection *info);
+
+ /* Interface for carrying upper layer I/O through send/recv */
+ int smbd_recv(struct smbd_connection *info, struct msghdr *msg);
+-int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst);
++int smbd_send(struct TCP_Server_Info *server,
++ int num_rqst, struct smb_rqst *rqst);
+
+ enum mr_state {
+ MR_READY,
+@@ -332,7 +333,7 @@ static inline void *smbd_get_connection(
+ static inline int smbd_reconnect(struct TCP_Server_Info *server) {return -1; }
+ static inline void smbd_destroy(struct smbd_connection *info) {}
+ static inline int smbd_recv(struct smbd_connection *info, struct msghdr *msg) {return -1; }
+-static inline int smbd_send(struct TCP_Server_Info *server, struct smb_rqst *rqst) {return -1; }
++static inline int smbd_send(struct TCP_Server_Info *server, int num_rqst, struct smb_rqst *rqst) {return -1; }
+ #endif
+
+ #endif
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index f2938bd95c40e..fe77f41bff9f2 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -287,7 +287,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ __be32 rfc1002_marker;
+
+ if (cifs_rdma_enabled(server) && server->smbd_conn) {
+- rc = smbd_send(server, rqst);
++ rc = smbd_send(server, num_rqst, rqst);
+ goto smbd_done;
+ }
+ if (ssocket == NULL)
+--
+2.20.1
+
--- /dev/null
+From fe1fa5f0c226b41e297559ef662c4244620ba81e Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Thu, 18 Oct 2018 12:13:40 -0700
+Subject: clk: s2mps11: Add used attribute to s2mps11_dt_match
+
+[ Upstream commit 9c940bbe2bb47e03ca5e937d30b6a50bf9c0e671 ]
+
+Clang warns after commit 8985167ecf57 ("clk: s2mps11: Fix matching when
+built as module and DT node contains compatible"):
+
+drivers/clk/clk-s2mps11.c:242:34: warning: variable 's2mps11_dt_match'
+is not needed and will not be emitted [-Wunneeded-internal-declaration]
+static const struct of_device_id s2mps11_dt_match[] = {
+ ^
+1 warning generated.
+
+This warning happens when a variable is used in some construct that
+doesn't require a reference to that variable to be emitted in the symbol
+table; in this case, it's MODULE_DEVICE_TABLE, which only needs to hold
+the data of the variable, not the variable itself.
+
+$ nm -S drivers/clk/clk-s2mps11.o | rg s2mps11_dt_match
+00000078 000003d4 R __mod_of__s2mps11_dt_match_device_table
+
+Normally, with device ID table variables, it means that the variable
+just needs to be tied to the device declaration at the bottom of the
+file, like s2mps11_clk_id:
+
+$ nm -S drivers/clk/clk-s2mps11.o | rg s2mps11_clk_id
+00000000 00000078 R __mod_platform__s2mps11_clk_id_device_table
+00000000 00000078 r s2mps11_clk_id
+
+However, because the comment above this deliberately doesn't want this
+variable added to .of_match_table, we need to mark s2mps11_dt_match as
+__used to silence this warning. This makes it clear to Clang that the
+variable is used for something, even if a reference to it isn't being
+emitted.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Fixes: 8985167ecf57 ("clk: s2mps11: Fix matching when built as module and DT node contains compatible")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-s2mps11.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index 0934d3724495a..4080d4e78e8e4 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -255,7 +255,7 @@ MODULE_DEVICE_TABLE(platform, s2mps11_clk_id);
+ * This requires of_device_id table. In the same time this will not change the
+ * actual *device* matching so do not add .of_match_table.
+ */
+-static const struct of_device_id s2mps11_dt_match[] = {
++static const struct of_device_id s2mps11_dt_match[] __used = {
+ {
+ .compatible = "samsung,s2mps11-clk",
+ .data = (void *)S2MPS11X,
+--
+2.20.1
+
--- /dev/null
+From 19fab3125180972cb7d2f730c9b958c7759631c6 Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Mon, 3 Dec 2018 10:28:40 +0000
+Subject: clk: tegra: Fix maximum audio sync clock for Tegra124/210
+
+[ Upstream commit 845d782d91448e0fbca686bca2cc9f9c2a9ba3e7 ]
+
+The maximum frequency supported for I2S on Tegra124 and Tegra210 is
+24.576MHz (as stated in the Tegra TK1 data sheet for Tegra124 and the
+Jetson TX1 module data sheet for Tegra210). However, the maximum I2S
+frequency is limited to 24MHz because that is the maximum frequency of
+the audio sync clock. Increase the maximum audio sync clock frequency
+to 24.576MHz for Tegra124 and Tegra210 in order to support 24.576MHz
+for I2S.
+
+Update the tegra_clk_register_sync_source() function so that it does
+not set the initial rate for the sync clocks and use the clock init
+tables to set the initial rate instead.
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-audio-sync.c | 3 +--
+ drivers/clk/tegra/clk-tegra-audio.c | 7 ++-----
+ drivers/clk/tegra/clk-tegra114.c | 9 ++++++++-
+ drivers/clk/tegra/clk-tegra124.c | 9 ++++++++-
+ drivers/clk/tegra/clk-tegra210.c | 9 ++++++++-
+ drivers/clk/tegra/clk-tegra30.c | 9 ++++++++-
+ drivers/clk/tegra/clk.h | 4 ++--
+ 7 files changed, 37 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-audio-sync.c b/drivers/clk/tegra/clk-audio-sync.c
+index 92d04ce2dee6b..53cdc0ec40f33 100644
+--- a/drivers/clk/tegra/clk-audio-sync.c
++++ b/drivers/clk/tegra/clk-audio-sync.c
+@@ -55,7 +55,7 @@ const struct clk_ops tegra_clk_sync_source_ops = {
+ };
+
+ struct clk *tegra_clk_register_sync_source(const char *name,
+- unsigned long rate, unsigned long max_rate)
++ unsigned long max_rate)
+ {
+ struct tegra_clk_sync_source *sync;
+ struct clk_init_data init;
+@@ -67,7 +67,6 @@ struct clk *tegra_clk_register_sync_source(const char *name,
+ return ERR_PTR(-ENOMEM);
+ }
+
+- sync->rate = rate;
+ sync->max_rate = max_rate;
+
+ init.ops = &tegra_clk_sync_source_ops;
+diff --git a/drivers/clk/tegra/clk-tegra-audio.c b/drivers/clk/tegra/clk-tegra-audio.c
+index b37cae7af26da..02dd6487d855d 100644
+--- a/drivers/clk/tegra/clk-tegra-audio.c
++++ b/drivers/clk/tegra/clk-tegra-audio.c
+@@ -49,8 +49,6 @@ struct tegra_sync_source_initdata {
+ #define SYNC(_name) \
+ {\
+ .name = #_name,\
+- .rate = 24000000,\
+- .max_rate = 24000000,\
+ .clk_id = tegra_clk_ ## _name,\
+ }
+
+@@ -176,7 +174,7 @@ static void __init tegra_audio_sync_clk_init(void __iomem *clk_base,
+ void __init tegra_audio_clk_init(void __iomem *clk_base,
+ void __iomem *pmc_base, struct tegra_clk *tegra_clks,
+ struct tegra_audio_clk_info *audio_info,
+- unsigned int num_plls)
++ unsigned int num_plls, unsigned long sync_max_rate)
+ {
+ struct clk *clk;
+ struct clk **dt_clk;
+@@ -221,8 +219,7 @@ void __init tegra_audio_clk_init(void __iomem *clk_base,
+ if (!dt_clk)
+ continue;
+
+- clk = tegra_clk_register_sync_source(data->name,
+- data->rate, data->max_rate);
++ clk = tegra_clk_register_sync_source(data->name, sync_max_rate);
+ *dt_clk = clk;
+ }
+
+diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
+index 1824f014202b0..625d110913308 100644
+--- a/drivers/clk/tegra/clk-tegra114.c
++++ b/drivers/clk/tegra/clk-tegra114.c
+@@ -1190,6 +1190,13 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA114_CLK_XUSB_FALCON_SRC, TEGRA114_CLK_PLL_P, 204000000, 0 },
+ { TEGRA114_CLK_XUSB_HOST_SRC, TEGRA114_CLK_PLL_P, 102000000, 0 },
+ { TEGRA114_CLK_VDE, TEGRA114_CLK_CLK_MAX, 600000000, 0 },
++ { TEGRA114_CLK_SPDIF_IN_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S0_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S1_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S2_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S3_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_I2S4_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA114_CLK_VIMCLK_SYNC, TEGRA114_CLK_CLK_MAX, 24000000, 0 },
+ /* must be the last entry */
+ { TEGRA114_CLK_CLK_MAX, TEGRA114_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -1362,7 +1369,7 @@ static void __init tegra114_clock_init(struct device_node *np)
+ tegra114_periph_clk_init(clk_base, pmc_base);
+ tegra_audio_clk_init(clk_base, pmc_base, tegra114_clks,
+ tegra114_audio_plls,
+- ARRAY_SIZE(tegra114_audio_plls));
++ ARRAY_SIZE(tegra114_audio_plls), 24000000);
+ tegra_pmc_clk_init(pmc_base, tegra114_clks);
+ tegra_super_clk_gen4_init(clk_base, pmc_base, tegra114_clks,
+ &pll_x_params);
+diff --git a/drivers/clk/tegra/clk-tegra124.c b/drivers/clk/tegra/clk-tegra124.c
+index b6cf28ca2ed29..df0018f7bf7ed 100644
+--- a/drivers/clk/tegra/clk-tegra124.c
++++ b/drivers/clk/tegra/clk-tegra124.c
+@@ -1291,6 +1291,13 @@ static struct tegra_clk_init_table common_init_table[] __initdata = {
+ { TEGRA124_CLK_CSITE, TEGRA124_CLK_CLK_MAX, 0, 1 },
+ { TEGRA124_CLK_TSENSOR, TEGRA124_CLK_CLK_M, 400000, 0 },
+ { TEGRA124_CLK_VIC03, TEGRA124_CLK_PLL_C3, 0, 0 },
++ { TEGRA124_CLK_SPDIF_IN_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S0_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S1_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S2_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S3_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_I2S4_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA124_CLK_VIMCLK_SYNC, TEGRA124_CLK_CLK_MAX, 24576000, 0 },
+ /* must be the last entry */
+ { TEGRA124_CLK_CLK_MAX, TEGRA124_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -1455,7 +1462,7 @@ static void __init tegra124_132_clock_init_pre(struct device_node *np)
+ tegra124_periph_clk_init(clk_base, pmc_base);
+ tegra_audio_clk_init(clk_base, pmc_base, tegra124_clks,
+ tegra124_audio_plls,
+- ARRAY_SIZE(tegra124_audio_plls));
++ ARRAY_SIZE(tegra124_audio_plls), 24576000);
+ tegra_pmc_clk_init(pmc_base, tegra124_clks);
+
+ /* For Tegra124 & Tegra132, PLLD is the only source for DSIA & DSIB */
+diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
+index 4e1bc23c98655..f58480fe17674 100644
+--- a/drivers/clk/tegra/clk-tegra210.c
++++ b/drivers/clk/tegra/clk-tegra210.c
+@@ -3369,6 +3369,13 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA210_CLK_SOC_THERM, TEGRA210_CLK_PLL_P, 51000000, 0 },
+ { TEGRA210_CLK_CCLK_G, TEGRA210_CLK_CLK_MAX, 0, 1 },
+ { TEGRA210_CLK_PLL_U_OUT2, TEGRA210_CLK_CLK_MAX, 60000000, 1 },
++ { TEGRA210_CLK_SPDIF_IN_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S0_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S1_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S2_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S3_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_I2S4_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_VIMCLK_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
+ /* This MUST be the last entry. */
+ { TEGRA210_CLK_CLK_MAX, TEGRA210_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -3562,7 +3569,7 @@ static void __init tegra210_clock_init(struct device_node *np)
+ tegra210_periph_clk_init(clk_base, pmc_base);
+ tegra_audio_clk_init(clk_base, pmc_base, tegra210_clks,
+ tegra210_audio_plls,
+- ARRAY_SIZE(tegra210_audio_plls));
++ ARRAY_SIZE(tegra210_audio_plls), 24576000);
+ tegra_pmc_clk_init(pmc_base, tegra210_clks);
+
+ /* For Tegra210, PLLD is the only source for DSIA & DSIB */
+diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c
+index acfe661b2ae72..e0aaecd98fbff 100644
+--- a/drivers/clk/tegra/clk-tegra30.c
++++ b/drivers/clk/tegra/clk-tegra30.c
+@@ -1267,6 +1267,13 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA30_CLK_GR3D2, TEGRA30_CLK_PLL_C, 300000000, 0 },
+ { TEGRA30_CLK_PLL_U, TEGRA30_CLK_CLK_MAX, 480000000, 0 },
+ { TEGRA30_CLK_VDE, TEGRA30_CLK_CLK_MAX, 600000000, 0 },
++ { TEGRA30_CLK_SPDIF_IN_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S0_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S1_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S2_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S3_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_I2S4_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
++ { TEGRA30_CLK_VIMCLK_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 },
+ /* must be the last entry */
+ { TEGRA30_CLK_CLK_MAX, TEGRA30_CLK_CLK_MAX, 0, 0 },
+ };
+@@ -1344,7 +1351,7 @@ static void __init tegra30_clock_init(struct device_node *np)
+ tegra30_periph_clk_init();
+ tegra_audio_clk_init(clk_base, pmc_base, tegra30_clks,
+ tegra30_audio_plls,
+- ARRAY_SIZE(tegra30_audio_plls));
++ ARRAY_SIZE(tegra30_audio_plls), 24000000);
+ tegra_pmc_clk_init(pmc_base, tegra30_clks);
+
+ tegra_init_dup_clks(tegra_clk_duplicates, clks, TEGRA30_CLK_CLK_MAX);
+diff --git a/drivers/clk/tegra/clk.h b/drivers/clk/tegra/clk.h
+index d2c3a010f8e9b..09bccbb9640c4 100644
+--- a/drivers/clk/tegra/clk.h
++++ b/drivers/clk/tegra/clk.h
+@@ -41,7 +41,7 @@ extern const struct clk_ops tegra_clk_sync_source_ops;
+ extern int *periph_clk_enb_refcnt;
+
+ struct clk *tegra_clk_register_sync_source(const char *name,
+- unsigned long fixed_rate, unsigned long max_rate);
++ unsigned long max_rate);
+
+ /**
+ * struct tegra_clk_frac_div - fractional divider clock
+@@ -796,7 +796,7 @@ void tegra_register_devclks(struct tegra_devclk *dev_clks, int num);
+ void tegra_audio_clk_init(void __iomem *clk_base,
+ void __iomem *pmc_base, struct tegra_clk *tegra_clks,
+ struct tegra_audio_clk_info *audio_info,
+- unsigned int num_plls);
++ unsigned int num_plls, unsigned long sync_max_rate);
+
+ void tegra_periph_clk_init(void __iomem *clk_base, void __iomem *pmc_base,
+ struct tegra_clk *tegra_clks,
+--
+2.20.1
+
--- /dev/null
+From e872159b420e1312d3bcde78a1777262eea24c1e Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Wed, 5 Jun 2019 15:01:39 +0100
+Subject: clk: tegra210: Fix default rates for HDA clocks
+
+[ Upstream commit 9caec6620f25b6d15646bbdb93062c872ba3b56f ]
+
+Currently the default clock rates for the HDA and HDA2CODEC_2X clocks
+are both 19.2MHz. However, the default rates for these clocks should
+actually be 51MHz and 48MHz, respectively. The current clock settings
+results in a distorted output during audio playback. Correct the default
+clock rates for these clocks by specifying them in the clock init table
+for Tegra210.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-tegra210.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
+index f58480fe17674..080bfa24863ee 100644
+--- a/drivers/clk/tegra/clk-tegra210.c
++++ b/drivers/clk/tegra/clk-tegra210.c
+@@ -3376,6 +3376,8 @@ static struct tegra_clk_init_table init_table[] __initdata = {
+ { TEGRA210_CLK_I2S3_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
+ { TEGRA210_CLK_I2S4_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
+ { TEGRA210_CLK_VIMCLK_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
++ { TEGRA210_CLK_HDA, TEGRA210_CLK_PLL_P, 51000000, 0 },
++ { TEGRA210_CLK_HDA2CODEC_2X, TEGRA210_CLK_PLL_P, 48000000, 0 },
+ /* This MUST be the last entry. */
+ { TEGRA210_CLK_CLK_MAX, TEGRA210_CLK_CLK_MAX, 0, 0 },
+ };
+--
+2.20.1
+
--- /dev/null
+From 1de61788a31ce8b036b03fa6ed7b65301e4c2e8c Mon Sep 17 00:00:00 2001
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+Date: Mon, 11 Feb 2019 16:27:58 +0200
+Subject: crypto: ccree - add missing inline qualifier
+
+[ Upstream commit f1071c3e2473ae19a7f5d892a187c4cab1a61f2e ]
+
+Commit 1358c13a48c4 ("crypto: ccree - fix resume race condition on init")
+was missing a "inline" qualifier for stub function used when CONFIG_PM
+is not set causing a build warning.
+
+Fixes: 1358c13a48c4 ("crypto: ccree - fix resume race condition on init")
+Cc: stable@kernel.org # v4.20
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_pm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccree/cc_pm.h b/drivers/crypto/ccree/cc_pm.h
+index f626243570209..907a6db4d6c03 100644
+--- a/drivers/crypto/ccree/cc_pm.h
++++ b/drivers/crypto/ccree/cc_pm.h
+@@ -30,7 +30,7 @@ static inline int cc_pm_init(struct cc_drvdata *drvdata)
+ return 0;
+ }
+
+-static void cc_pm_go(struct cc_drvdata *drvdata) {}
++static inline void cc_pm_go(struct cc_drvdata *drvdata) {}
+
+ static inline void cc_pm_fini(struct cc_drvdata *drvdata) {}
+
+--
+2.20.1
+
--- /dev/null
+From da588b8776fd9ea89bbe95a3e0a421664bb8c03c Mon Sep 17 00:00:00 2001
+From: Gilad Ben-Yossef <gilad@benyossef.com>
+Date: Thu, 7 Feb 2019 15:36:11 +0200
+Subject: crypto: ccree - fix resume race condition on init
+
+[ Upstream commit 1358c13a48c43f5e4de0c1835291837a27b9720c ]
+
+We were enabling autosuspend, which is using data set by the
+hash module, prior to the hash module being inited, casuing
+a crash on resume as part of the startup sequence if the race
+was lost.
+
+This was never a real problem because the PM infra was using low
+res timers so we were always winning the race, until commit 8234f6734c5d
+("PM-runtime: Switch autosuspend over to using hrtimers") changed that :-)
+
+Fix this by seperating the PM setup and enablement and doing the
+latter only at the end of the init sequence.
+
+Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: stable@kernel.org # v4.20
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccree/cc_driver.c | 7 ++++---
+ drivers/crypto/ccree/cc_pm.c | 13 ++++++-------
+ drivers/crypto/ccree/cc_pm.h | 3 +++
+ 3 files changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/ccree/cc_driver.c b/drivers/crypto/ccree/cc_driver.c
+index 1ff229c2aeab1..186a2536fb8b9 100644
+--- a/drivers/crypto/ccree/cc_driver.c
++++ b/drivers/crypto/ccree/cc_driver.c
+@@ -364,7 +364,7 @@ static int init_cc_resources(struct platform_device *plat_dev)
+ rc = cc_ivgen_init(new_drvdata);
+ if (rc) {
+ dev_err(dev, "cc_ivgen_init failed\n");
+- goto post_power_mgr_err;
++ goto post_buf_mgr_err;
+ }
+
+ /* Allocate crypto algs */
+@@ -387,6 +387,9 @@ static int init_cc_resources(struct platform_device *plat_dev)
+ goto post_hash_err;
+ }
+
++ /* All set, we can allow autosuspend */
++ cc_pm_go(new_drvdata);
++
+ /* If we got here and FIPS mode is enabled
+ * it means all FIPS test passed, so let TEE
+ * know we're good.
+@@ -401,8 +404,6 @@ post_cipher_err:
+ cc_cipher_free(new_drvdata);
+ post_ivgen_err:
+ cc_ivgen_fini(new_drvdata);
+-post_power_mgr_err:
+- cc_pm_fini(new_drvdata);
+ post_buf_mgr_err:
+ cc_buffer_mgr_fini(new_drvdata);
+ post_req_mgr_err:
+diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c
+index 79fc0a37ba6e4..638082dff183a 100644
+--- a/drivers/crypto/ccree/cc_pm.c
++++ b/drivers/crypto/ccree/cc_pm.c
+@@ -103,20 +103,19 @@ int cc_pm_put_suspend(struct device *dev)
+
+ int cc_pm_init(struct cc_drvdata *drvdata)
+ {
+- int rc = 0;
+ struct device *dev = drvdata_to_dev(drvdata);
+
+ /* must be before the enabling to avoid resdundent suspending */
+ pm_runtime_set_autosuspend_delay(dev, CC_SUSPEND_TIMEOUT);
+ pm_runtime_use_autosuspend(dev);
+ /* activate the PM module */
+- rc = pm_runtime_set_active(dev);
+- if (rc)
+- return rc;
+- /* enable the PM module*/
+- pm_runtime_enable(dev);
++ return pm_runtime_set_active(dev);
++}
+
+- return rc;
++/* enable the PM module*/
++void cc_pm_go(struct cc_drvdata *drvdata)
++{
++ pm_runtime_enable(drvdata_to_dev(drvdata));
+ }
+
+ void cc_pm_fini(struct cc_drvdata *drvdata)
+diff --git a/drivers/crypto/ccree/cc_pm.h b/drivers/crypto/ccree/cc_pm.h
+index 020a5403c58ba..f626243570209 100644
+--- a/drivers/crypto/ccree/cc_pm.h
++++ b/drivers/crypto/ccree/cc_pm.h
+@@ -16,6 +16,7 @@
+ extern const struct dev_pm_ops ccree_pm;
+
+ int cc_pm_init(struct cc_drvdata *drvdata);
++void cc_pm_go(struct cc_drvdata *drvdata);
+ void cc_pm_fini(struct cc_drvdata *drvdata);
+ int cc_pm_suspend(struct device *dev);
+ int cc_pm_resume(struct device *dev);
+@@ -29,6 +30,8 @@ static inline int cc_pm_init(struct cc_drvdata *drvdata)
+ return 0;
+ }
+
++static void cc_pm_go(struct cc_drvdata *drvdata) {}
++
+ static inline void cc_pm_fini(struct cc_drvdata *drvdata) {}
+
+ static inline int cc_pm_suspend(struct device *dev)
+--
+2.20.1
+
--- /dev/null
+From 8aa357f0c3cd526bb780e67e3e72c889ae8715f3 Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Wed, 15 May 2019 16:23:43 +0200
+Subject: dm crypt: move detailed message into debug level
+
+[ Upstream commit 7a1cd7238fde6ab367384a4a2998cba48330c398 ]
+
+The information about tag size should not be printed without debug info
+set. Also print device major:minor in the error message to identify the
+device instance.
+
+Also use rate limiting and debug level for info about used crypto API
+implementaton. This is important because during online reencryption
+the existing message saturates syslog (because we are moving hotzone
+across the whole device).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-crypt.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index f3dcc7640319e..34f5de13a93d1 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -949,6 +949,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+ {
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ struct blk_integrity *bi = blk_get_integrity(cc->dev->bdev->bd_disk);
++ struct mapped_device *md = dm_table_get_md(ti->table);
+
+ /* From now we require underlying device with our integrity profile */
+ if (!bi || strcasecmp(bi->profile->name, "DM-DIF-EXT-TAG")) {
+@@ -968,7 +969,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+
+ if (crypt_integrity_aead(cc)) {
+ cc->integrity_tag_size = cc->on_disk_tag_size - cc->integrity_iv_size;
+- DMINFO("Integrity AEAD, tag size %u, IV size %u.",
++ DMDEBUG("%s: Integrity AEAD, tag size %u, IV size %u.", dm_device_name(md),
+ cc->integrity_tag_size, cc->integrity_iv_size);
+
+ if (crypto_aead_setauthsize(any_tfm_aead(cc), cc->integrity_tag_size)) {
+@@ -976,7 +977,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+ return -EINVAL;
+ }
+ } else if (cc->integrity_iv_size)
+- DMINFO("Additional per-sector space %u bytes for IV.",
++ DMDEBUG("%s: Additional per-sector space %u bytes for IV.", dm_device_name(md),
+ cc->integrity_iv_size);
+
+ if ((cc->integrity_tag_size + cc->integrity_iv_size) != bi->tag_size) {
+--
+2.20.1
+
--- /dev/null
+From 24626e7feef010bc6a82b847fab353bee7c67813 Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Wed, 24 Apr 2019 23:19:05 +0800
+Subject: dm mpath: fix missing call of path selector type->end_io
+
+[ Upstream commit 5de719e3d01b4abe0de0d7b857148a880ff2a90b ]
+
+After commit 396eaf21ee17 ("blk-mq: improve DM's blk-mq IO merging via
+blk_insert_cloned_request feedback"), map_request() will requeue the tio
+when issued clone request return BLK_STS_RESOURCE or BLK_STS_DEV_RESOURCE.
+
+Thus, if device driver status is error, a tio may be requeued multiple
+times until the return value is not DM_MAPIO_REQUEUE. That means
+type->start_io may be called multiple times, while type->end_io is only
+called when IO complete.
+
+In fact, even without commit 396eaf21ee17, setup_clone() failure can
+also cause tio requeue and associated missed call to type->end_io.
+
+The service-time path selector selects path based on in_flight_size,
+which is increased by st_start_io() and decreased by st_end_io().
+Missed calls to st_end_io() can lead to in_flight_size count error and
+will cause the selector to make the wrong choice. In addition,
+queue-length path selector will also be affected.
+
+To fix the problem, call type->end_io in ->release_clone_rq before tio
+requeue. map_info is passed to ->release_clone_rq() for map_request()
+error path that result in requeue.
+
+Fixes: 396eaf21ee17 ("blk-mq: improve DM's blk-mq IO merging via blk_insert_cloned_request feedback")
+Cc: stable@vger.kernl.org
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-mpath.c | 17 ++++++++++++++++-
+ drivers/md/dm-rq.c | 8 ++++----
+ drivers/md/dm-target.c | 3 ++-
+ include/linux/device-mapper.h | 3 ++-
+ 4 files changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index baa966e2778c0..481e54ded9dc7 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -554,8 +554,23 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
+ return DM_MAPIO_REMAPPED;
+ }
+
+-static void multipath_release_clone(struct request *clone)
++static void multipath_release_clone(struct request *clone,
++ union map_info *map_context)
+ {
++ if (unlikely(map_context)) {
++ /*
++ * non-NULL map_context means caller is still map
++ * method; must undo multipath_clone_and_map()
++ */
++ struct dm_mpath_io *mpio = get_mpio(map_context);
++ struct pgpath *pgpath = mpio->pgpath;
++
++ if (pgpath && pgpath->pg->ps.type->end_io)
++ pgpath->pg->ps.type->end_io(&pgpath->pg->ps,
++ &pgpath->path,
++ mpio->nr_bytes);
++ }
++
+ blk_put_request(clone);
+ }
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 264b84e274aac..17c6a73c536c6 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -219,7 +219,7 @@ static void dm_end_request(struct request *clone, blk_status_t error)
+ struct request *rq = tio->orig;
+
+ blk_rq_unprep_clone(clone);
+- tio->ti->type->release_clone_rq(clone);
++ tio->ti->type->release_clone_rq(clone, NULL);
+
+ rq_end_stats(md, rq);
+ if (!rq->q->mq_ops)
+@@ -270,7 +270,7 @@ static void dm_requeue_original_request(struct dm_rq_target_io *tio, bool delay_
+ rq_end_stats(md, rq);
+ if (tio->clone) {
+ blk_rq_unprep_clone(tio->clone);
+- tio->ti->type->release_clone_rq(tio->clone);
++ tio->ti->type->release_clone_rq(tio->clone, NULL);
+ }
+
+ if (!rq->q->mq_ops)
+@@ -495,7 +495,7 @@ check_again:
+ case DM_MAPIO_REMAPPED:
+ if (setup_clone(clone, rq, tio, GFP_ATOMIC)) {
+ /* -ENOMEM */
+- ti->type->release_clone_rq(clone);
++ ti->type->release_clone_rq(clone, &tio->info);
+ return DM_MAPIO_REQUEUE;
+ }
+
+@@ -505,7 +505,7 @@ check_again:
+ ret = dm_dispatch_clone_request(clone, rq);
+ if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) {
+ blk_rq_unprep_clone(clone);
+- tio->ti->type->release_clone_rq(clone);
++ tio->ti->type->release_clone_rq(clone, &tio->info);
+ tio->clone = NULL;
+ if (!rq->q->mq_ops)
+ r = DM_MAPIO_DELAY_REQUEUE;
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 314d17ca64668..64dd0b34fcf49 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -136,7 +136,8 @@ static int io_err_clone_and_map_rq(struct dm_target *ti, struct request *rq,
+ return DM_MAPIO_KILL;
+ }
+
+-static void io_err_release_clone_rq(struct request *clone)
++static void io_err_release_clone_rq(struct request *clone,
++ union map_info *map_context)
+ {
+ }
+
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index bef2e36c01b4b..91f9f95ad5066 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -62,7 +62,8 @@ typedef int (*dm_clone_and_map_request_fn) (struct dm_target *ti,
+ struct request *rq,
+ union map_info *map_context,
+ struct request **clone);
+-typedef void (*dm_release_clone_request_fn) (struct request *clone);
++typedef void (*dm_release_clone_request_fn) (struct request *clone,
++ union map_info *map_context);
+
+ /*
+ * Returns:
+--
+2.20.1
+
--- /dev/null
+From d6c0e2c3005f5143b5c077c323e70a3557cfa1ed Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Tue, 2 Jul 2019 15:50:08 -0400
+Subject: dm thin metadata: check if in fail_io mode when setting needs_check
+
+[ Upstream commit 54fa16ee532705985e6c946da455856f18f63ee1 ]
+
+Check if in fail_io mode at start of dm_pool_metadata_set_needs_check().
+Otherwise dm_pool_metadata_set_needs_check()'s superblock_lock() can
+crash in dm_bm_write_lock() while accessing the block manager object
+that was previously destroyed as part of a failed
+dm_pool_abort_metadata() that ultimately set fail_io to begin with.
+
+Also, update DMERR() message to more accurately describe
+superblock_lock() failure.
+
+Cc: stable@vger.kernel.org
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-thin-metadata.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
+index ed3caceaed07c..6a26afcc1fd6b 100644
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -2001,16 +2001,19 @@ int dm_pool_register_metadata_threshold(struct dm_pool_metadata *pmd,
+
+ int dm_pool_metadata_set_needs_check(struct dm_pool_metadata *pmd)
+ {
+- int r;
++ int r = -EINVAL;
+ struct dm_block *sblock;
+ struct thin_disk_superblock *disk_super;
+
+ down_write(&pmd->root_lock);
++ if (pmd->fail_io)
++ goto out;
++
+ pmd->flags |= THIN_METADATA_NEEDS_CHECK_FLAG;
+
+ r = superblock_lock(pmd, &sblock);
+ if (r) {
+- DMERR("couldn't read superblock");
++ DMERR("couldn't lock superblock");
+ goto out;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4d553e1a24a052dec526c0b5b78cd0531b1f0067 Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Sun, 23 Sep 2018 21:10:42 +0000
+Subject: Drivers: hv: kvp: Fix the indentation of some "break" statements
+
+[ Upstream commit d544c22d6951be3386ac59bb9a99c9bc566b3f09 ]
+
+No functional change.
+
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv_kvp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
+index 57715a0c81202..a7513a8a8e372 100644
+--- a/drivers/hv/hv_kvp.c
++++ b/drivers/hv/hv_kvp.c
+@@ -420,7 +420,7 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_set.data.value,
+ HV_KVP_EXCHANGE_MAX_VALUE_SIZE - 1) + 1;
+- break;
++ break;
+
+ case REG_U32:
+ /*
+@@ -456,7 +456,7 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_set.data.key,
+ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+- break;
++ break;
+
+ case KVP_OP_DELETE:
+ message->body.kvp_delete.key_size =
+@@ -466,12 +466,12 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_delete.key,
+ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+- break;
++ break;
+
+ case KVP_OP_ENUMERATE:
+ message->body.kvp_enum_data.index =
+ in_msg->body.kvp_enum_data.index;
+- break;
++ break;
+ }
+
+ kvp_transaction.state = HVUTIL_USERSPACE_REQ;
+--
+2.20.1
+
--- /dev/null
+From 6cca6859c393146dba00a508586272fa9cfc1e7f Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Thu, 18 Oct 2018 05:09:30 +0000
+Subject: Drivers: hv: kvp: Fix the recent regression caused by incorrect
+ clean-up
+
+[ Upstream commit e670de54c813b5bc3672dd1c67871dc60e9206f4 ]
+
+In kvp_send_key(), we do need call process_ib_ipinfo() if
+message->kvp_hdr.operation is KVP_OP_GET_IP_INFO, because it turns out
+the userland hv_kvp_daemon needs the info of operation, adapter_id and
+addr_family. With the incorrect fc62c3b1977d, the host can't get the
+VM's IP via KVP.
+
+And, fc62c3b1977d added a "break;", but actually forgot to initialize
+the key_size/value in the case of KVP_OP_SET, so the default key_size of
+0 is passed to the kvp daemon, and the pool files
+/var/lib/hyperv/.kvp_pool_* can't be updated.
+
+This patch effectively rolls back the previous fc62c3b1977d, and
+correctly fixes the "this statement may fall through" warnings.
+
+This patch is tested on WS 2012 R2 and 2016.
+
+Fixes: fc62c3b1977d ("Drivers: hv: kvp: Fix two "this statement may fall through" warnings")
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv_kvp.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
+index a7513a8a8e372..d6106e1a0d4af 100644
+--- a/drivers/hv/hv_kvp.c
++++ b/drivers/hv/hv_kvp.c
+@@ -353,6 +353,9 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
+
+ out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
+
++ /* fallthrough */
++
++ case KVP_OP_GET_IP_INFO:
+ utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
+ MAX_ADAPTER_ID_SIZE,
+ UTF16_LITTLE_ENDIAN,
+@@ -405,7 +408,11 @@ kvp_send_key(struct work_struct *dummy)
+ process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
+ break;
+ case KVP_OP_GET_IP_INFO:
+- /* We only need to pass on message->kvp_hdr.operation. */
++ /*
++ * We only need to pass on the info of operation, adapter_id
++ * and addr_family to the userland kvp daemon.
++ */
++ process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
+ break;
+ case KVP_OP_SET:
+ switch (in_msg->body.kvp_set.data.value_type) {
+@@ -446,9 +453,9 @@ kvp_send_key(struct work_struct *dummy)
+
+ }
+
+- break;
+-
+- case KVP_OP_GET:
++ /*
++ * The key is always a string - utf16 encoding.
++ */
+ message->body.kvp_set.data.key_size =
+ utf16s_to_utf8s(
+ (wchar_t *)in_msg->body.kvp_set.data.key,
+@@ -456,6 +463,17 @@ kvp_send_key(struct work_struct *dummy)
+ UTF16_LITTLE_ENDIAN,
+ message->body.kvp_set.data.key,
+ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
++
++ break;
++
++ case KVP_OP_GET:
++ message->body.kvp_get.data.key_size =
++ utf16s_to_utf8s(
++ (wchar_t *)in_msg->body.kvp_get.data.key,
++ in_msg->body.kvp_get.data.key_size,
++ UTF16_LITTLE_ENDIAN,
++ message->body.kvp_get.data.key,
++ HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
+ break;
+
+ case KVP_OP_DELETE:
+--
+2.20.1
+
--- /dev/null
+From e11ba487407dd89ff6fde62e630cdd804268d58f Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Sun, 23 Sep 2018 21:10:43 +0000
+Subject: Drivers: hv: kvp: Fix two "this statement may fall through" warnings
+
+[ Upstream commit fc62c3b1977d62e6374fd6e28d371bb42dfa5c9d ]
+
+We don't need to call process_ib_ipinfo() if message->kvp_hdr.operation is
+KVP_OP_GET_IP_INFO in kvp_send_key(), because here we just need to pass on
+the op code from the host to the userspace; when the userspace returns
+the info requested by the host, we pass the info on to the host in
+kvp_respond_to_host() -> process_ob_ipinfo(). BTW, the current buggy code
+actually doesn't cause any harm, because only message->kvp_hdr.operation
+is used by the userspace, in the case of KVP_OP_GET_IP_INFO.
+
+The patch also adds a missing "break;" in kvp_send_key(). BTW, the current
+buggy code actually doesn't cause any harm, because in the case of
+KVP_OP_SET, the unexpected fall-through corrupts
+message->body.kvp_set.data.key_size, but that is not really used: see
+the definition of struct hv_kvp_exchg_msg_value.
+
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv_kvp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
+index 5eed1e7da15c4..57715a0c81202 100644
+--- a/drivers/hv/hv_kvp.c
++++ b/drivers/hv/hv_kvp.c
+@@ -353,7 +353,6 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
+
+ out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
+
+- default:
+ utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
+ MAX_ADAPTER_ID_SIZE,
+ UTF16_LITTLE_ENDIAN,
+@@ -406,7 +405,7 @@ kvp_send_key(struct work_struct *dummy)
+ process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
+ break;
+ case KVP_OP_GET_IP_INFO:
+- process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
++ /* We only need to pass on message->kvp_hdr.operation. */
+ break;
+ case KVP_OP_SET:
+ switch (in_msg->body.kvp_set.data.value_type) {
+@@ -446,6 +445,9 @@ kvp_send_key(struct work_struct *dummy)
+ break;
+
+ }
++
++ break;
++
+ case KVP_OP_GET:
+ message->body.kvp_set.data.key_size =
+ utf16s_to_utf8s(
+--
+2.20.1
+
--- /dev/null
+From 1ad0b6d6bc63ee8face03d690a0831b2ee7b9c97 Mon Sep 17 00:00:00 2001
+From: Ben Dooks <ben.dooks@codethink.co.uk>
+Date: Fri, 1 Mar 2019 12:00:46 +0000
+Subject: drm: add __user attribute to ptr_to_compat()
+
+[ Upstream commit e552f0851070fe4975d610a99910be4e9bf5d7bd ]
+
+The ptr_to_compat() call takes a "void __user *", so cast
+the compat drm calls that use it to avoid the following
+warnings from sparse:
+
+drivers/gpu/drm/drm_ioc32.c:188:39: warning: incorrect type in argument 1 (different address spaces)
+drivers/gpu/drm/drm_ioc32.c:188:39: expected void [noderef] <asn:1>*uptr
+drivers/gpu/drm/drm_ioc32.c:188:39: got void *[addressable] [assigned] handle
+drivers/gpu/drm/drm_ioc32.c:529:41: warning: incorrect type in argument 1 (different address spaces)
+drivers/gpu/drm/drm_ioc32.c:529:41: expected void [noderef] <asn:1>*uptr
+drivers/gpu/drm/drm_ioc32.c:529:41: got void *[addressable] [assigned] handle
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190301120046.26961-1-ben.dooks@codethink.co.uk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_ioc32.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index 138680b37c709..f8672238d444b 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -185,7 +185,7 @@ static int compat_drm_getmap(struct file *file, unsigned int cmd,
+ m32.size = map.size;
+ m32.type = map.type;
+ m32.flags = map.flags;
+- m32.handle = ptr_to_compat(map.handle);
++ m32.handle = ptr_to_compat((void __user *)map.handle);
+ m32.mtrr = map.mtrr;
+ if (copy_to_user(argp, &m32, sizeof(m32)))
+ return -EFAULT;
+@@ -216,7 +216,7 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
+
+ m32.offset = map.offset;
+ m32.mtrr = map.mtrr;
+- m32.handle = ptr_to_compat(map.handle);
++ m32.handle = ptr_to_compat((void __user *)map.handle);
+ if (map.handle != compat_ptr(m32.handle))
+ pr_err_ratelimited("compat_drm_addmap truncated handle %p for type %d offset %x\n",
+ map.handle, m32.type, m32.offset);
+@@ -529,7 +529,7 @@ static int compat_drm_getsareactx(struct file *file, unsigned int cmd,
+ if (err)
+ return err;
+
+- req32.handle = ptr_to_compat(req.handle);
++ req32.handle = ptr_to_compat((void __user *)req.handle);
+ if (copy_to_user(argp, &req32, sizeof(req32)))
+ return -EFAULT;
+
+--
+2.20.1
+
--- /dev/null
+From bc7850f6db1bf68a93ff5afe88622b32142a7475 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 19 Nov 2018 19:44:55 +0000
+Subject: drm/amd/dm: Understand why attaching path/tile properties are needed
+
+[ Upstream commit 04ac4b0ed412f65230b456fcd9aa07e13befff89 ]
+
+Path property is used for userspace to know what MST connector goes to what actual DRM DisplayPort connector, the tiling property is for tiling configurations. Not sure what else there is to figure out.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
+Cc: Stable <stable@vger.kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 59445c83f0238..c85bea70d9652 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -377,9 +377,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ drm_connector_attach_encoder(&aconnector->base,
+ &aconnector->mst_encoder->base);
+
+- /*
+- * TODO: understand why this one is needed
+- */
+ drm_object_attach_property(
+ &connector->base,
+ dev->mode_config.path_property,
+--
+2.20.1
+
--- /dev/null
+From 8323990d9fd16a3c120369d2fa6650d416cf584e Mon Sep 17 00:00:00 2001
+From: Rex Zhu <Rex.Zhu@amd.com>
+Date: Tue, 13 Nov 2018 11:15:56 +0800
+Subject: drm/amd/pp: Fix truncated clock value when set watermark
+
+[ Upstream commit 4d454e9ffdb1ef5a51ebc147b5389c96048db683 ]
+
+the clk value should be tranferred to MHz first and
+then transfer to uint16. otherwise, the clock value
+will be truncated.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reported-by: Hersen Wu <hersenxs.wu@amd.com>
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/powerplay/hwmgr/smu_helper.c | 32 +++++++++----------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+index a321c465b7dce..cede78cdf28db 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+@@ -669,20 +669,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
+ for (i = 0; i < wm_with_clock_ranges->num_wm_dmif_sets; i++) {
+ table->WatermarkRow[1][i].MinClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_dcfclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].MaxClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].MinUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].MaxUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[1][i].WmSetting = (uint8_t)
+ wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_set_id;
+ }
+@@ -690,20 +690,20 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
+ for (i = 0; i < wm_with_clock_ranges->num_wm_mcif_sets; i++) {
+ table->WatermarkRow[0][i].MinClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_socclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].MaxClock =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_socclk_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].MinUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_min_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].MaxUclk =
+ cpu_to_le16((uint16_t)
+- (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz) /
+- 1000);
++ (wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_max_mem_clk_in_khz /
++ 1000));
+ table->WatermarkRow[0][i].WmSetting = (uint8_t)
+ wm_with_clock_ranges->wm_mcif_clocks_ranges[i].wm_set_id;
+ }
+--
+2.20.1
+
--- /dev/null
+From ab2f996e231597a41d29a717ecb668a1a71bc889 Mon Sep 17 00:00:00 2001
+From: Louis Li <Ching-shih.Li@amd.com>
+Date: Sat, 25 May 2019 06:39:47 +0800
+Subject: drm/amdgpu: fix ring test failure issue during s3 in vce 3.0 (V2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit ce0e22f5d886d1b56c7ab4347c45b9ac5fcc058d ]
+
+[What]
+vce ring test fails consistently during resume in s3 cycle, due to
+mismatch read & write pointers.
+On debug/analysis its found that rptr to be compared is not being
+correctly updated/read, which leads to this failure.
+Below is the failure signature:
+ [drm:amdgpu_vce_ring_test_ring] *ERROR* amdgpu: ring 12 test failed
+ [drm:amdgpu_device_ip_resume_phase2] *ERROR* resume of IP block <vce_v3_0> failed -110
+ [drm:amdgpu_device_resume] *ERROR* amdgpu_device_ip_resume failed (-110).
+
+[How]
+fetch rptr appropriately, meaning move its read location further down
+in the code flow.
+With this patch applied the s3 failure is no more seen for >5k s3 cycles,
+which otherwise is pretty consistent.
+
+V2: remove reduntant fetch of rptr
+
+Signed-off-by: Louis Li <Ching-shih.Li@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+index 5f3f540738187..17862b9ecccd7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -1070,7 +1070,7 @@ void amdgpu_vce_ring_emit_fence(struct amdgpu_ring *ring, u64 addr, u64 seq,
+ int amdgpu_vce_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r, timeout = adev->usec_timeout;
+
+@@ -1084,6 +1084,9 @@ int amdgpu_vce_ring_test_ring(struct amdgpu_ring *ring)
+ ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, VCE_CMD_END);
+ amdgpu_ring_commit(ring);
+
+--
+2.20.1
+
--- /dev/null
+From bad100f13110bfb536571db446f0ae0a7a44ef1b Mon Sep 17 00:00:00 2001
+From: Feifei Xu <Feifei.Xu@amd.com>
+Date: Thu, 26 Jul 2018 12:31:34 +0800
+Subject: drm/amdgpu/gfx9: Update gfx9 golden settings.
+
+[ Upstream commit 54d682d9a5b357eb711994fa94ef1bc44d7ce9d9 ]
+
+Update the goldensettings for vega20.
+
+Signed-off-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 46568497ef181..f040ec10eecf6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -82,7 +82,7 @@ MODULE_FIRMWARE("amdgpu/raven_rlc.bin");
+
+ static const struct soc15_reg_golden golden_settings_gc_9_0[] =
+ {
+- SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xf00fffff, 0x00000420),
++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xf00fffff, 0x00000400),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGB_GPU_ID, 0x0000000f, 0x00000000),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_BINNER_EVENT_CNTL_3, 0x00000003, 0x82400024),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_ENHANCE, 0x3fffffff, 0x00000001),
+--
+2.20.1
+
--- /dev/null
+From a07fcf0afad45efa060a4f6a9d2cc30c2e827cf7 Mon Sep 17 00:00:00 2001
+From: Feifei Xu <Feifei.Xu@amd.com>
+Date: Tue, 16 Oct 2018 14:54:46 +0800
+Subject: drm/amdgpu: Update gc_9_0 golden settings.
+
+[ Upstream commit c55045adf7210d246a016c961916f078ed31a951 ]
+
+Add mmDB_DEBUG3 settings.
+
+Signed-off-by: Feifei Xu <Feifei.Xu@amd.com>
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index f040ec10eecf6..7824116498169 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -83,6 +83,7 @@ MODULE_FIRMWARE("amdgpu/raven_rlc.bin");
+ static const struct soc15_reg_golden golden_settings_gc_9_0[] =
+ {
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG2, 0xf00fffff, 0x00000400),
++ SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0x80000000, 0x80000000),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmGB_GPU_ID, 0x0000000f, 0x00000000),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_BINNER_EVENT_CNTL_3, 0x00000003, 0x82400024),
+ SOC15_REG_GOLDEN_VALUE(GC, 0, mmPA_SC_ENHANCE, 0x3fffffff, 0x00000001),
+--
+2.20.1
+
--- /dev/null
+From f479f98196d3718ba214beeb2f807fb13a77b267 Mon Sep 17 00:00:00 2001
+From: Shirish S <shirish.s@amd.com>
+Date: Tue, 4 Jun 2019 21:25:03 +0530
+Subject: drm/amdgpu/{uvd,vcn}: fetch ring's read_ptr after alloc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 517b91f4cde3043d77b2178548473e8545ef07cb ]
+
+[What]
+readptr read always returns zero, since most likely
+these blocks are either power or clock gated.
+
+[How]
+fetch rptr after amdgpu_ring_alloc() which informs
+the power management code that the block is about to be
+used and hence the gating is turned off.
+
+Signed-off-by: Louis Li <Ching-shih.Li@amd.com>
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 5 ++++-
+ drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c | 5 ++++-
+ drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 5 ++++-
+ 3 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+index 400fc74bbae27..205e683fb9206 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+@@ -431,7 +431,7 @@ error:
+ int amdgpu_vcn_enc_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r;
+
+@@ -441,6 +441,9 @@ int amdgpu_vcn_enc_ring_test_ring(struct amdgpu_ring *ring)
+ ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, VCN_ENC_CMD_END);
+ amdgpu_ring_commit(ring);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+index d4070839ac809..80613a74df420 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+@@ -170,7 +170,7 @@ static void uvd_v6_0_enc_ring_set_wptr(struct amdgpu_ring *ring)
+ static int uvd_v6_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r;
+
+@@ -180,6 +180,9 @@ static int uvd_v6_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, HEVC_ENC_CMD_END);
+ amdgpu_ring_commit(ring);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+index 057151b17b456..ce16b8329af04 100644
+--- a/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c
+@@ -175,7 +175,7 @@ static void uvd_v7_0_enc_ring_set_wptr(struct amdgpu_ring *ring)
+ static int uvd_v7_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_device *adev = ring->adev;
+- uint32_t rptr = amdgpu_ring_get_rptr(ring);
++ uint32_t rptr;
+ unsigned i;
+ int r;
+
+@@ -188,6 +188,9 @@ static int uvd_v7_0_enc_ring_test_ring(struct amdgpu_ring *ring)
+ ring->me, ring->idx, r);
+ return r;
+ }
++
++ rptr = amdgpu_ring_get_rptr(ring);
++
+ amdgpu_ring_write(ring, HEVC_ENC_CMD_END);
+ amdgpu_ring_commit(ring);
+
+--
+2.20.1
+
--- /dev/null
+From 236e7323478cd34d2ce0b7203c423331b0972e3b Mon Sep 17 00:00:00 2001
+From: Kent Russell <kent.russell@amd.com>
+Date: Mon, 13 May 2019 09:00:05 -0400
+Subject: drm/amdkfd: Add missing Polaris10 ID
+
+[ Upstream commit 0a5a9c276c335870a1cecc4f02b76d6d6f663c8b ]
+
+This was added to amdgpu but was missed in amdkfd
+
+Signed-off-by: Kent Russell <kent.russell@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.rg
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 5aba50f63ac6f..938d0053a8208 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -310,6 +310,7 @@ static const struct kfd_deviceid supported_devices[] = {
+ { 0x67CF, &polaris10_device_info }, /* Polaris10 */
+ { 0x67D0, &polaris10_vf_device_info }, /* Polaris10 vf*/
+ { 0x67DF, &polaris10_device_info }, /* Polaris10 */
++ { 0x6FDF, &polaris10_device_info }, /* Polaris10 */
+ { 0x67E0, &polaris11_device_info }, /* Polaris11 */
+ { 0x67E1, &polaris11_device_info }, /* Polaris11 */
+ { 0x67E3, &polaris11_device_info }, /* Polaris11 */
+--
+2.20.1
+
--- /dev/null
+From e0bc1e4b4380a7c3cf3499022c7473e7e0c874ec Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 9 Oct 2018 16:44:24 -0400
+Subject: drm/atomic_helper: Allow DPMS On<->Off changes for unregistered
+ connectors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 34ca26a98ad67edd6e4870fe2d4aa047d41a51dd ]
+
+It appears when testing my previous fix for some of the legacy
+modesetting issues with MST, I misattributed some kernel splats that
+started appearing on my machine after a rebase as being from upstream.
+But it appears they actually came from my patch series:
+
+[ 2.980512] [drm:drm_atomic_helper_check_modeset [drm_kms_helper]] Updating routing for [CONNECTOR:65:eDP-1]
+[ 2.980516] [drm:drm_atomic_helper_check_modeset [drm_kms_helper]] [CONNECTOR:65:eDP-1] is not registered
+[ 2.980516] ------------[ cut here ]------------
+[ 2.980519] Could not determine valid watermarks for inherited state
+[ 2.980553] WARNING: CPU: 3 PID: 551 at drivers/gpu/drm/i915/intel_display.c:14983 intel_modeset_init+0x14d7/0x19f0 [i915]
+[ 2.980556] Modules linked in: i915(O+) i2c_algo_bit drm_kms_helper(O) syscopyarea sysfillrect sysimgblt fb_sys_fops drm(O) intel_rapl x86_pkg_temp_thermal iTCO_wdt wmi_bmof coretemp crc32_pclmul psmouse i2c_i801 mei_me mei i2c_core lpc_ich mfd_core tpm_tis tpm_tis_core wmi tpm thinkpad_acpi pcc_cpufreq video ehci_pci crc32c_intel serio_raw ehci_hcd xhci_pci xhci_hcd
+[ 2.980577] CPU: 3 PID: 551 Comm: systemd-udevd Tainted: G O 4.19.0-rc7Lyude-Test+ #1
+[ 2.980579] Hardware name: LENOVO 20BWS1KY00/20BWS1KY00, BIOS JBET63WW (1.27 ) 11/10/2016
+[ 2.980605] RIP: 0010:intel_modeset_init+0x14d7/0x19f0 [i915]
+[ 2.980607] Code: 89 df e8 ec 27 02 00 e9 24 f2 ff ff be 03 00 00 00 48 89 df e8 da 27 02 00 e9 26 f2 ff ff 48 c7 c7 c8 d1 34 a0 e8 23 cf dc e0 <0f> 0b e9 7c fd ff ff f6 c4 04 0f 85 37 f7 ff ff 48 8b 83 60 08 00
+[ 2.980611] RSP: 0018:ffffc90000287988 EFLAGS: 00010282
+[ 2.980614] RAX: 0000000000000000 RBX: ffff88031b488000 RCX: 0000000000000006
+[ 2.980617] RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff880321ad54d0
+[ 2.980620] RBP: ffffc90000287a10 R08: 000000000000040a R09: 0000000000000065
+[ 2.980623] R10: ffff88030ebb8f00 R11: ffffffff81416590 R12: ffff88031b488000
+[ 2.980626] R13: ffff88031b4883a0 R14: ffffc900002879a8 R15: ffff880319099800
+[ 2.980630] FS: 00007f475620d180(0000) GS:ffff880321ac0000(0000) knlGS:0000000000000000
+[ 2.980633] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 2.980636] CR2: 00007f9ef28018a0 CR3: 000000031b72c001 CR4: 00000000003606e0
+[ 2.980639] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 2.980642] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 2.980645] Call Trace:
+[ 2.980675] i915_driver_load+0xb0e/0xdc0 [i915]
+[ 2.980681] ? kernfs_add_one+0xe7/0x130
+[ 2.980709] i915_pci_probe+0x46/0x60 [i915]
+[ 2.980715] pci_device_probe+0xd4/0x150
+[ 2.980719] really_probe+0x243/0x3b0
+[ 2.980722] driver_probe_device+0xba/0x100
+[ 2.980726] __driver_attach+0xe4/0x110
+[ 2.980729] ? driver_probe_device+0x100/0x100
+[ 2.980733] bus_for_each_dev+0x74/0xb0
+[ 2.980736] driver_attach+0x1e/0x20
+[ 2.980739] bus_add_driver+0x159/0x230
+[ 2.980743] ? 0xffffffffa0393000
+[ 2.980746] driver_register+0x70/0xc0
+[ 2.980749] ? 0xffffffffa0393000
+[ 2.980753] __pci_register_driver+0x57/0x60
+[ 2.980780] i915_init+0x55/0x58 [i915]
+[ 2.980785] do_one_initcall+0x4a/0x1c4
+[ 2.980789] ? do_init_module+0x27/0x210
+[ 2.980793] ? kmem_cache_alloc_trace+0x131/0x190
+[ 2.980797] do_init_module+0x60/0x210
+[ 2.980800] load_module+0x2063/0x22e0
+[ 2.980804] ? vfs_read+0x116/0x140
+[ 2.980807] ? vfs_read+0x116/0x140
+[ 2.980811] __do_sys_finit_module+0xbd/0x120
+[ 2.980814] ? __do_sys_finit_module+0xbd/0x120
+[ 2.980818] __x64_sys_finit_module+0x1a/0x20
+[ 2.980821] do_syscall_64+0x5a/0x110
+[ 2.980824] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 2.980826] RIP: 0033:0x7f4754e32879
+[ 2.980828] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f7 45 2c 00 f7 d8 64 89 01 48
+[ 2.980831] RSP: 002b:00007fff43fd97d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[ 2.980834] RAX: ffffffffffffffda RBX: 0000559a44ca64f0 RCX: 00007f4754e32879
+[ 2.980836] RDX: 0000000000000000 RSI: 00007f475599f4cd RDI: 0000000000000018
+[ 2.980838] RBP: 00007f475599f4cd R08: 0000000000000000 R09: 0000000000000000
+[ 2.980839] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000000
+[ 2.980841] R13: 0000559a44c92fd0 R14: 0000000000020000 R15: 0000000000000000
+[ 2.980881] WARNING: CPU: 3 PID: 551 at drivers/gpu/drm/i915/intel_display.c:14983 intel_modeset_init+0x14d7/0x19f0 [i915]
+[ 2.980884] ---[ end trace 5eb47a76277d4731 ]---
+
+The cause of this appears to be due to the fact that if there's
+pre-existing display state that was set by the BIOS when i915 loads, it
+will attempt to perform a modeset before the driver is registered with
+userspace. Since this happens before the driver's registered with
+userspace, it's connectors are also unregistered and thus-states which
+would turn on DPMS on a connector end up getting rejected since the
+connector isn't registered.
+
+These bugs managed to get past Intel's CI partially due to the fact it
+never ran a full test on my patches for some reason, but also because
+all of the tests unload the GPU once before running. Since this bug is
+only really triggered when the drivers tries to perform a modeset before
+it's been fully registered with userspace when coming from whatever
+display configuration the firmware left us with, it likely would never
+have been picked up by CI in the first place.
+
+After some discussion with vsyrjala, we decided the best course of
+action would be to just move the unregistered connector checks out of
+update_connector_routing() and into drm_atomic_set_crtc_for_connector().
+The reason for this being that legacy modesetting isn't going to be
+expecting failures anywhere (at least this is the case with X), so
+ideally we want to ensure that any DPMS changes will still work even on
+unregistered connectors. Instead, we now only reject new modesets which
+would change the current CRTC assigned to an unregistered connector
+unless no new CRTC is being assigned to replace the connector's previous
+one.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Fixes: 4d80273976bf ("drm/atomic_helper: Disallow new modesets on unregistered connectors")
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181009204424.21462-1-lyude@redhat.com
+(cherry picked from commit b5d29843d8ef86d4cde4742e095b81b7fd41e688)
+Fixes: e96550956fbc ("drm/atomic_helper: Disallow new modesets on unregistered connectors")
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_atomic.c | 21 +++++++++++++++++++++
+ drivers/gpu/drm/drm_atomic_helper.c | 21 +--------------------
+ 2 files changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 281cf9cbb44c4..1a4b44923aeca 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1702,6 +1702,27 @@ drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state,
+ struct drm_connector *connector = conn_state->connector;
+ struct drm_crtc_state *crtc_state;
+
++ /*
++ * For compatibility with legacy users, we want to make sure that
++ * we allow DPMS On<->Off modesets on unregistered connectors, since
++ * legacy modesetting users will not be expecting these to fail. We do
++ * not however, want to allow legacy users to assign a connector
++ * that's been unregistered from sysfs to another CRTC, since doing
++ * this with a now non-existent connector could potentially leave us
++ * in an invalid state.
++ *
++ * Since the connector can be unregistered at any point during an
++ * atomic check or commit, this is racy. But that's OK: all we care
++ * about is ensuring that userspace can't use this connector for new
++ * configurations after it's been notified that the connector is no
++ * longer present.
++ */
++ if (!READ_ONCE(connector->registered) && crtc) {
++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
++ connector->base.id, connector->name);
++ return -EINVAL;
++ }
++
+ if (conn_state->crtc == crtc)
+ return 0;
+
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index 71c70a031a043..c22062cc99923 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -307,26 +307,6 @@ update_connector_routing(struct drm_atomic_state *state,
+ return 0;
+ }
+
+- crtc_state = drm_atomic_get_new_crtc_state(state,
+- new_connector_state->crtc);
+- /*
+- * For compatibility with legacy users, we want to make sure that
+- * we allow DPMS On->Off modesets on unregistered connectors. Modesets
+- * which would result in anything else must be considered invalid, to
+- * avoid turning on new displays on dead connectors.
+- *
+- * Since the connector can be unregistered at any point during an
+- * atomic check or commit, this is racy. But that's OK: all we care
+- * about is ensuring that userspace can't do anything but shut off the
+- * display on a connector that was destroyed after its been notified,
+- * not before.
+- */
+- if (!READ_ONCE(connector->registered) && crtc_state->active) {
+- DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
+- connector->base.id, connector->name);
+- return -EINVAL;
+- }
+-
+ funcs = connector->helper_private;
+
+ if (funcs->atomic_best_encoder)
+@@ -371,6 +351,7 @@ update_connector_routing(struct drm_atomic_state *state,
+
+ set_best_encoder(state, new_connector_state, new_encoder);
+
++ crtc_state = drm_atomic_get_new_crtc_state(state, new_connector_state->crtc);
+ crtc_state->connectors_changed = true;
+
+ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d:%s]\n",
+--
+2.20.1
+
--- /dev/null
+From c088976472ee5c46b5355b4091fe7e6cd4dc67de Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 8 Oct 2018 19:24:30 -0400
+Subject: drm/atomic_helper: Disallow new modesets on unregistered connectors
+
+[ Upstream commit 4d80273976bf880c4bed9359b8f2d45663140c86 ]
+
+With the exception of modesets which would switch the DPMS state of a
+connector from on to off, we want to make sure that we disallow all
+modesets which would result in enabling a new monitor or a new mode
+configuration on a monitor if the connector for the display in question
+is no longer registered. This allows us to stop userspace from trying to
+enable new displays on connectors for an MST topology that were just
+removed from the system, without preventing userspace from disabling
+DPMS on those connectors.
+
+Changes since v5:
+- Fix typo in comment, nothing else
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-2-lyude@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index c22062cc99923..71c70a031a043 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -307,6 +307,26 @@ update_connector_routing(struct drm_atomic_state *state,
+ return 0;
+ }
+
++ crtc_state = drm_atomic_get_new_crtc_state(state,
++ new_connector_state->crtc);
++ /*
++ * For compatibility with legacy users, we want to make sure that
++ * we allow DPMS On->Off modesets on unregistered connectors. Modesets
++ * which would result in anything else must be considered invalid, to
++ * avoid turning on new displays on dead connectors.
++ *
++ * Since the connector can be unregistered at any point during an
++ * atomic check or commit, this is racy. But that's OK: all we care
++ * about is ensuring that userspace can't do anything but shut off the
++ * display on a connector that was destroyed after its been notified,
++ * not before.
++ */
++ if (!READ_ONCE(connector->registered) && crtc_state->active) {
++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] is not registered\n",
++ connector->base.id, connector->name);
++ return -EINVAL;
++ }
++
+ funcs = connector->helper_private;
+
+ if (funcs->atomic_best_encoder)
+@@ -351,7 +371,6 @@ update_connector_routing(struct drm_atomic_state *state,
+
+ set_best_encoder(state, new_connector_state, new_encoder);
+
+- crtc_state = drm_atomic_get_new_crtc_state(state, new_connector_state->crtc);
+ crtc_state->connectors_changed = true;
+
+ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] using [ENCODER:%d:%s] on [CRTC:%d:%s]\n",
+--
+2.20.1
+
--- /dev/null
+From ce4e1383177343930fc16ec595a8e6c98144bd23 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sun, 12 Aug 2018 23:36:29 +0100
+Subject: drm/i915: Cleanup gt powerstate from gem
+
+[ Upstream commit 30b710840e4b9c9699d3d4b33fb19ad8880d4614 ]
+
+Since the gt powerstate is allocated by i915_gem_init, clean it from
+i915_gem_fini for symmetry and to correct the imbalance on error.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180812223642.24865-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 3 +++
+ drivers/gpu/drm/i915/intel_display.c | 4 ----
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 5019dfd8bcf16..e81abd468a15d 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -5624,6 +5624,7 @@ err_uc_misc:
+ void i915_gem_fini(struct drm_i915_private *dev_priv)
+ {
+ i915_gem_suspend_late(dev_priv);
++ intel_disable_gt_powersave(dev_priv);
+
+ /* Flush any outstanding unpin_work. */
+ i915_gem_drain_workqueue(dev_priv);
+@@ -5635,6 +5636,8 @@ void i915_gem_fini(struct drm_i915_private *dev_priv)
+ i915_gem_contexts_fini(dev_priv);
+ mutex_unlock(&dev_priv->drm.struct_mutex);
+
++ intel_cleanup_gt_powersave(dev_priv);
++
+ intel_uc_fini_misc(dev_priv);
+ i915_gem_cleanup_userptr(dev_priv);
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 2622dfc7d2d9a..6902fd2da19ca 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -15972,8 +15972,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
+ flush_work(&dev_priv->atomic_helper.free_work);
+ WARN_ON(!llist_empty(&dev_priv->atomic_helper.free_list));
+
+- intel_disable_gt_powersave(dev_priv);
+-
+ /*
+ * Interrupts and polling as the first thing to avoid creating havoc.
+ * Too much stuff here (turning of connectors, ...) would
+@@ -16001,8 +15999,6 @@ void intel_modeset_cleanup(struct drm_device *dev)
+
+ intel_cleanup_overlay(dev_priv);
+
+- intel_cleanup_gt_powersave(dev_priv);
+-
+ intel_teardown_gmbus(dev_priv);
+
+ destroy_workqueue(dev_priv->modeset_wq);
+--
+2.20.1
+
--- /dev/null
+From fd431f2a891d3a7e795b500189c1f5de1d557521 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 8 Oct 2018 19:24:34 -0400
+Subject: drm/i915: Fix intel_dp_mst_best_encoder()
+
+[ Upstream commit a9f9ca33d1fe9325f414914be526c0fc4ba5281c ]
+
+Currently, i915 appears to rely on blocking modesets on
+no-longer-present MSTB ports by simply returning NULL for
+->best_encoder(), which in turn causes any new atomic commits that don't
+disable the CRTC to fail. This is wrong however, since we still want to
+allow userspace to disable CRTCs on no-longer-present MSTB ports by
+changing the DPMS state to off and this still requires that we retrieve
+an encoder.
+
+So, fix this by always returning a valid encoder regardless of the state
+of the MST port.
+
+Changes since v1:
+- Remove mst atomic helper, since this got replaced with a much simpler
+ solution
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20181008232437.5571-6-lyude@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/intel_dp_mst.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index 1fec0c71b4d95..58ba14966d4f1 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -408,8 +408,6 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+ struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+- if (!READ_ONCE(connector->registered))
+- return NULL;
+ return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fb801c80078b0d9e8740a6824a46d5cc5b6132fe Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Tue, 16 Oct 2018 19:00:11 +0300
+Subject: drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 914a4fd8cd28016038ce749a818a836124a8d270 ]
+
+If BIOS configured a Y tiled FB we failed to set up the backing object
+tiling accordingly, leading to a lack of GT fence installed and a
+garbled console.
+
+The problem was bisected to
+commit 011f22eb545a ("drm/i915: Do NOT skip the first 4k of stolen memory for pre-allocated buffers v2")
+but it just revealed a pre-existing issue.
+
+Kudos to Ville who suspected a missing fence looking at the corruption
+on the screen.
+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: <ronald@innovation.ch>
+Cc: <stable@vger.kernel.org>
+Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reported-by: <ronald@innovation.ch>
+Tested-by: <ronald@innovation.ch>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108264
+Fixes: bc8d7dffacb1 ("drm/i915/skl: Provide a Skylake version of get_plane_config()")
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181016160011.28347-1-imre.deak@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/intel_display.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index f5367bdc04049..2622dfc7d2d9a 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2712,6 +2712,17 @@ intel_alloc_initial_plane_obj(struct intel_crtc *crtc,
+ if (size_aligned * 2 > dev_priv->stolen_usable_size)
+ return false;
+
++ switch (fb->modifier) {
++ case DRM_FORMAT_MOD_LINEAR:
++ case I915_FORMAT_MOD_X_TILED:
++ case I915_FORMAT_MOD_Y_TILED:
++ break;
++ default:
++ DRM_DEBUG_DRIVER("Unsupported modifier for initial FB: 0x%llx\n",
++ fb->modifier);
++ return false;
++ }
++
+ mutex_lock(&dev->struct_mutex);
+ obj = i915_gem_object_create_stolen_for_preallocated(dev_priv,
+ base_aligned,
+@@ -2721,8 +2732,17 @@ intel_alloc_initial_plane_obj(struct intel_crtc *crtc,
+ if (!obj)
+ return false;
+
+- if (plane_config->tiling == I915_TILING_X)
+- obj->tiling_and_stride = fb->pitches[0] | I915_TILING_X;
++ switch (plane_config->tiling) {
++ case I915_TILING_NONE:
++ break;
++ case I915_TILING_X:
++ case I915_TILING_Y:
++ obj->tiling_and_stride = fb->pitches[0] | plane_config->tiling;
++ break;
++ default:
++ MISSING_CASE(plane_config->tiling);
++ return false;
++ }
+
+ mode_cmd.pixel_format = fb->format->format;
+ mode_cmd.width = fb->width;
+@@ -8812,6 +8832,7 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
+ fb->modifier = I915_FORMAT_MOD_X_TILED;
+ break;
+ case PLANE_CTL_TILED_Y:
++ plane_config->tiling = I915_TILING_Y;
+ if (val & PLANE_CTL_RENDER_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Y_TILED_CCS;
+ else
+--
+2.20.1
+
--- /dev/null
+From 06c4c1eb38a735cda63e211047e462debb1a1c97 Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Thu, 7 Feb 2019 10:54:54 +0200
+Subject: drm/i915: Handle vm_mmap error during I915_GEM_MMAP ioctl with WC set
+
+[ Upstream commit ebfb6977801da521d8d5d752d373a187e2a2b9b3 ]
+
+Add err goto label and use it when VMA can't be established or changes
+underneath.
+
+v2:
+- Dropping Fixes: as it's indeed impossible to race an object to the
+ error address. (Chris)
+v3:
+- Use IS_ERR_VALUE (Chris)
+
+Reported-by: Adam Zabrocki <adamza@microsoft.com>
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
+Cc: Adam Zabrocki <adamza@microsoft.com>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> #v2
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190207085454.10598-2-joonas.lahtinen@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index e81abd468a15d..9634d3adb8d01 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1881,6 +1881,9 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ addr = vm_mmap(obj->base.filp, 0, args->size,
+ PROT_READ | PROT_WRITE, MAP_SHARED,
+ args->offset);
++ if (IS_ERR_VALUE(addr))
++ goto err;
++
+ if (args->flags & I915_MMAP_WC) {
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+@@ -1896,17 +1899,22 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ else
+ addr = -ENOMEM;
+ up_write(&mm->mmap_sem);
++ if (IS_ERR_VALUE(addr))
++ goto err;
+
+ /* This may race, but that's ok, it only gets set */
+ WRITE_ONCE(obj->frontbuffer_ggtt_origin, ORIGIN_CPU);
+ }
+ i915_gem_object_put(obj);
+- if (IS_ERR((void *)addr))
+- return addr;
+
+ args->addr_ptr = (uint64_t) addr;
+
+ return 0;
++
++err:
++ i915_gem_object_put(obj);
++
++ return addr;
+ }
+
+ static unsigned int tile_row_pages(struct drm_i915_gem_object *obj)
+--
+2.20.1
+
--- /dev/null
+From 0138f48cd85428a4ad3b8739284826a40f26d6cc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Roberto=20de=20Souza?= <jose.souza@intel.com>
+Date: Mon, 19 Nov 2018 15:01:01 -0800
+Subject: drm/i915/ilk: Fix warning when reading emon_status with no output
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit cab870b7fdf3c4be747d88de5248b28db7d4055e ]
+
+When there is no output no one will hold a runtime_pm reference
+causing a warning when trying to read emom_status in debugfs.
+
+[22.756480] ------------[ cut here ]------------
+[22.756489] RPM wakelock ref not held during HW access
+[22.756578] WARNING: CPU: 0 PID: 1058 at drivers/gpu/drm/i915/intel_drv.h:2104 gen5_read32+0x16b/0x1a0 [i915]
+[22.756580] Modules linked in: snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic i915 coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core e1000e snd_pcm mei_me prime_numbers mei lpc_ich
+[22.756595] CPU: 0 PID: 1058 Comm: debugfs_test Not tainted 4.20.0-rc1-CI-Trybot_3219+ #1
+[22.756597] Hardware name: Hewlett-Packard HP Compaq 8100 Elite SFF PC/304Ah, BIOS 786H1 v01.13 07/14/2011
+[22.756634] RIP: 0010:gen5_read32+0x16b/0x1a0 [i915]
+[22.756637] Code: a4 ea e0 0f 0b e9 d2 fe ff ff 80 3d a5 71 19 00 00 0f 85 d3 fe ff ff 48 c7 c7 48 d0 2d a0 c6 05 91 71 19 00 01 e8 35 a4 ea e0 <0f> 0b e9 b9 fe ff ff e8 69 c6 f2 e0 85 c0 75 92 48 c7 c2 78 d0 2d
+[22.756639] RSP: 0018:ffffc90000f1fd38 EFLAGS: 00010282
+[22.756642] RAX: 0000000000000000 RBX: ffff8801f7ab0000 RCX: 0000000000000006
+[22.756643] RDX: 0000000000000006 RSI: ffffffff8212886a RDI: ffffffff820d6d57
+[22.756645] RBP: 0000000000011020 R08: 0000000043e3d1a8 R09: 0000000000000000
+[22.756647] R10: ffffc90000f1fd80 R11: 0000000000000000 R12: 0000000000000001
+[22.756649] R13: ffff8801f7ab0068 R14: 0000000000000001 R15: ffff88020d53d188
+[22.756651] FS: 00007f2878849980(0000) GS:ffff880213a00000(0000) knlGS:0000000000000000
+[22.756653] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[22.756655] CR2: 00005638deedf028 CR3: 0000000203292001 CR4: 00000000000206f0
+[22.756657] Call Trace:
+[22.756689] i915_mch_val+0x1b/0x60 [i915]
+[22.756721] i915_emon_status+0x45/0xd0 [i915]
+[22.756730] seq_read+0xdb/0x3c0
+[22.756736] ? lockdep_hardirqs_off+0x94/0xd0
+[22.756740] ? __slab_free+0x24e/0x510
+[22.756746] full_proxy_read+0x52/0x90
+[22.756752] __vfs_read+0x31/0x170
+[22.756759] ? do_sys_open+0x13b/0x240
+[22.756763] ? rcu_read_lock_sched_held+0x6f/0x80
+[22.756766] vfs_read+0x9e/0x140
+[22.756770] ksys_read+0x50/0xc0
+[22.756775] do_syscall_64+0x55/0x190
+[22.756781] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[22.756783] RIP: 0033:0x7f28781dc34e
+[22.756786] Code: 00 00 00 00 48 8b 15 71 8c 20 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff c3 0f 1f 40 00 8b 05 ba d0 20 00 85 c0 75 16 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 5a f3 c3 0f 1f 84 00 00 00 00 00 41 54 55 49
+[22.756787] RSP: 002b:00007ffd33fa0d08 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[22.756790] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f28781dc34e
+[22.756792] RDX: 0000000000000200 RSI: 00007ffd33fa0d50 RDI: 0000000000000008
+[22.756794] RBP: 00007ffd33fa0f60 R08: 0000000000000000 R09: 0000000000000020
+[22.756796] R10: 0000000000000000 R11: 0000000000000246 R12: 00005638de45c2c0
+[22.756797] R13: 00007ffd33fa14b0 R14: 0000000000000000 R15: 0000000000000000
+[22.756806] irq event stamp: 47950
+[22.756811] hardirqs last enabled at (47949): [<ffffffff810fba74>] vprintk_emit+0x124/0x320
+[22.756813] hardirqs last disabled at (47950): [<ffffffff810019b0>] trace_hardirqs_off_thunk+0x1a/0x1c
+[22.756816] softirqs last enabled at (47518): [<ffffffff81c0033a>] __do_softirq+0x33a/0x4b9
+[22.756820] softirqs last disabled at (47479): [<ffffffff8108df29>] irq_exit+0xa9/0xc0
+[22.756858] WARNING: CPU: 0 PID: 1058 at drivers/gpu/drm/i915/intel_drv.h:2104 gen5_read32+0x16b/0x1a0 [i915]
+[22.756860] ---[ end trace bf56fa7d6a3cbf7a ]
+
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181119230101.32460-1-jose.souza@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_debugfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index f9ce35da4123e..e063e98d1e82e 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -1788,6 +1788,8 @@ static int i915_emon_status(struct seq_file *m, void *unused)
+ if (!IS_GEN5(dev_priv))
+ return -ENODEV;
+
++ intel_runtime_pm_get(dev_priv);
++
+ ret = mutex_lock_interruptible(&dev->struct_mutex);
+ if (ret)
+ return ret;
+@@ -1802,6 +1804,8 @@ static int i915_emon_status(struct seq_file *m, void *unused)
+ seq_printf(m, "GFX power: %ld\n", gfx);
+ seq_printf(m, "Total power: %ld\n", chipset + gfx);
+
++ intel_runtime_pm_put(dev_priv);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3915ce4390ea4ec09987dc2e11dbb0bdbea8b4f5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 17 Jul 2019 14:45:36 +0300
+Subject: drm/i915: Make sure cdclk is high enough for DP audio on VLV/CHV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit a8f196a0fa6391a436f63f360a1fb57031fdf26c ]
+
+On VLV/CHV there is some kind of linkage between the cdclk frequency
+and the DP link frequency. The spec says:
+"For DP audio configuration, cdclk frequency shall be set to
+ meet the following requirements:
+ DP Link Frequency(MHz) | Cdclk frequency(MHz)
+ 270 | 320 or higher
+ 162 | 200 or higher"
+
+I suspect that would more accurately be expressed as
+"cdclk >= DP link clock", and in any case we can express it like
+that in the code because of the limited set of cdclk (200, 266,
+320, 400 MHz) and link frequencies (162 and 270 MHz) we support.
+
+Without this we can end up in a situation where the cdclk
+is too low and enabling DP audio will kill the pipe. Happens
+eg. with 2560x1440 modes where the 266MHz cdclk is sufficient
+to pump the pixels (241.5 MHz dotclock) but is too low for
+the DP audio due to the link frequency being 270 MHz.
+
+v2: Spell out the cdclk and link frequencies we actually support
+
+Cc: stable@vger.kernel.org
+Tested-by: Stefan Gottwald <gottwald@igel.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111149
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190717114536.22937-1-ville.syrjala@linux.intel.com
+Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
+(cherry picked from commit bffb31f73b29a60ef693842d8744950c2819851d)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/intel_cdclk.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
+index 29075c7634280..7b4906ede148b 100644
+--- a/drivers/gpu/drm/i915/intel_cdclk.c
++++ b/drivers/gpu/drm/i915/intel_cdclk.c
+@@ -2208,6 +2208,17 @@ int intel_crtc_compute_min_cdclk(const struct intel_crtc_state *crtc_state)
+ if (INTEL_GEN(dev_priv) >= 9)
+ min_cdclk = max(2 * 96000, min_cdclk);
+
++ /*
++ * "For DP audio configuration, cdclk frequency shall be set to
++ * meet the following requirements:
++ * DP Link Frequency(MHz) | Cdclk frequency(MHz)
++ * 270 | 320 or higher
++ * 162 | 200 or higher"
++ */
++ if ((IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) &&
++ intel_crtc_has_dp_encoder(crtc_state) && crtc_state->has_audio)
++ min_cdclk = max(crtc_state->port_clock, min_cdclk);
++
+ /*
+ * On Valleyview some DSI panels lose (v|h)sync when the clock is lower
+ * than 320000KHz.
+--
+2.20.1
+
--- /dev/null
+From e3a007947165e5edc0bf4f3024df7e817d5ce4d8 Mon Sep 17 00:00:00 2001
+From: Jan-Marek Glogowski <glogow@fbihome.de>
+Date: Sat, 25 Aug 2018 15:10:35 -0400
+Subject: drm/i915: Re-apply "Perform link quality check, unconditionally
+ during long pulse"
+
+[ Upstream commit 3cf71bc9904d7ee4a25a822c5dcb54c7804ea388 ]
+
+This re-applies the workaround for "some DP sinks, [which] are a
+little nuts" from commit 1a36147bb939 ("drm/i915: Perform link
+quality check unconditionally during long pulse").
+It makes the secondary AOC E2460P monitor connected via DP to an
+acer Veriton N4640G usable again.
+
+This hunk was dropped in commit c85d200e8321 ("drm/i915: Move SST
+DP link retraining into the ->post_hotplug() hook")
+
+Fixes: c85d200e8321 ("drm/i915: Move SST DP link retraining into the ->post_hotplug() hook")
+[Cleaned up commit message, added stable cc]
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Jan-Marek Glogowski <glogow@fbihome.de>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20180825191035.3945-1-lyude@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/intel_dp.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index f92079e19de8d..20cd4c8acecc3 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -4739,6 +4739,22 @@ intel_dp_long_pulse(struct intel_connector *connector,
+ */
+ status = connector_status_disconnected;
+ goto out;
++ } else {
++ /*
++ * If display is now connected check links status,
++ * there has been known issues of link loss triggering
++ * long pulse.
++ *
++ * Some sinks (eg. ASUS PB287Q) seem to perform some
++ * weird HPD ping pong during modesets. So we can apparently
++ * end up with HPD going low during a modeset, and then
++ * going back up soon after. And once that happens we must
++ * retrain the link to get a picture. That's in case no
++ * userspace component reacted to intermittent HPD dip.
++ */
++ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
++
++ intel_dp_retrain_link(encoder, ctx);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 02403a00bc538519d7f2766223591262c471cfee Mon Sep 17 00:00:00 2001
+From: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Date: Tue, 21 Aug 2018 18:50:53 -0700
+Subject: drm/i915: Rename PLANE_CTL_DECOMPRESSION_ENABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 53867b46fa8443713b3aee520d6ca558b222d829 ]
+
+Rename PLANE_CTL_DECOMPRESSION_ENABLE to resemble the bpsec name -
+PLANE_CTL_RENDER_DECOMPRESSION_ENABLE
+
+Suggested-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dhinakaran Pandiyan <dhinakaran.pandiyan@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180822015053.1420-2-dhinakaran.pandiyan@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_reg.h | 2 +-
+ drivers/gpu/drm/i915/intel_display.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 16f5d2d938014..4e070afb2738b 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -6531,7 +6531,7 @@ enum {
+ #define PLANE_CTL_YUV422_UYVY (1 << 16)
+ #define PLANE_CTL_YUV422_YVYU (2 << 16)
+ #define PLANE_CTL_YUV422_VYUY (3 << 16)
+-#define PLANE_CTL_DECOMPRESSION_ENABLE (1 << 15)
++#define PLANE_CTL_RENDER_DECOMPRESSION_ENABLE (1 << 15)
+ #define PLANE_CTL_TRICKLE_FEED_DISABLE (1 << 14)
+ #define PLANE_CTL_PLANE_GAMMA_DISABLE (1 << 13) /* Pre-GLK */
+ #define PLANE_CTL_TILED_MASK (0x7 << 10)
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 3bd44d042a1d9..f5367bdc04049 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -3561,11 +3561,11 @@ static u32 skl_plane_ctl_tiling(uint64_t fb_modifier)
+ case I915_FORMAT_MOD_Y_TILED:
+ return PLANE_CTL_TILED_Y;
+ case I915_FORMAT_MOD_Y_TILED_CCS:
+- return PLANE_CTL_TILED_Y | PLANE_CTL_DECOMPRESSION_ENABLE;
++ return PLANE_CTL_TILED_Y | PLANE_CTL_RENDER_DECOMPRESSION_ENABLE;
+ case I915_FORMAT_MOD_Yf_TILED:
+ return PLANE_CTL_TILED_YF;
+ case I915_FORMAT_MOD_Yf_TILED_CCS:
+- return PLANE_CTL_TILED_YF | PLANE_CTL_DECOMPRESSION_ENABLE;
++ return PLANE_CTL_TILED_YF | PLANE_CTL_RENDER_DECOMPRESSION_ENABLE;
+ default:
+ MISSING_CASE(fb_modifier);
+ }
+@@ -8812,13 +8812,13 @@ skylake_get_initial_plane_config(struct intel_crtc *crtc,
+ fb->modifier = I915_FORMAT_MOD_X_TILED;
+ break;
+ case PLANE_CTL_TILED_Y:
+- if (val & PLANE_CTL_DECOMPRESSION_ENABLE)
++ if (val & PLANE_CTL_RENDER_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Y_TILED_CCS;
+ else
+ fb->modifier = I915_FORMAT_MOD_Y_TILED;
+ break;
+ case PLANE_CTL_TILED_YF:
+- if (val & PLANE_CTL_DECOMPRESSION_ENABLE)
++ if (val & PLANE_CTL_RENDER_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Yf_TILED_CCS;
+ else
+ fb->modifier = I915_FORMAT_MOD_Yf_TILED;
+--
+2.20.1
+
--- /dev/null
+From 9f0942440dcf5d41b7f1ed7544755e9069e588c7 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 26 Jul 2018 09:50:32 +0100
+Subject: drm/i915: Restore sane defaults for KMS on GEM error load
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 7ed43df720c007d60bee6d81da07bcdc7e4a55ae ]
+
+If we fail during GEM initialisation, we scrub the HW state by
+performing a device level GPU resuet. However, we want to leave the
+system in a usable state (with functioning KMS but no GEM) so after
+scrubbing the HW state, we need to restore some sane defaults and
+re-enable the low-level common parts of the GPU (such as the GMCH).
+
+v2: Restore GTT entries.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180726085033.4044-2-chris@chris-wilson.co.uk
+Reviewed-by: Michał Winiarski <michal.winiarski@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 03cda197fb6b8..5019dfd8bcf16 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -5595,6 +5595,8 @@ err_uc_misc:
+ i915_gem_cleanup_userptr(dev_priv);
+
+ if (ret == -EIO) {
++ mutex_lock(&dev_priv->drm.struct_mutex);
++
+ /*
+ * Allow engine initialisation to fail by marking the GPU as
+ * wedged. But we only want to do this where the GPU is angry,
+@@ -5605,7 +5607,14 @@ err_uc_misc:
+ "Failed to initialize GPU, declaring it wedged!\n");
+ i915_gem_set_wedged(dev_priv);
+ }
+- ret = 0;
++
++ /* Minimal basic recovery for KMS */
++ ret = i915_ggtt_enable_hw(dev_priv);
++ i915_gem_restore_gtt_mappings(dev_priv);
++ i915_gem_restore_fences(dev_priv);
++ intel_init_clock_gating(dev_priv);
++
++ mutex_unlock(&dev_priv->drm.struct_mutex);
+ }
+
+ i915_gem_drain_freed_objects(dev_priv);
+--
+2.20.1
+
--- /dev/null
+From 6fdd8f2746f3e31b8b45dda950e0fd64d8953cbf Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 14 Mar 2019 07:58:29 +0000
+Subject: drm/i915: Sanity check mmap length against object size
+
+[ Upstream commit 000c4f90e3f0194eef218ff2c6a8fd8ca1de4313 ]
+
+We assumed that vm_mmap() would reject an attempt to mmap past the end of
+the filp (our object), but we were wrong.
+
+Applications that tried to use the mmap beyond the end of the object
+would be greeted by a SIGBUS. After this patch, those applications will
+be told about the error on creating the mmap, rather than at a random
+moment on later access.
+
+Reported-by: Antonio Argenziano <antonio.argenziano@intel.com>
+Testcase: igt/gem_mmap/bad-size
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Antonio Argenziano <antonio.argenziano@intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190314075829.16838-1-chris@chris-wilson.co.uk
+(cherry picked from commit 794a11cb67201ad1bb61af510bb8460280feb3f3)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 9634d3adb8d01..9372877100420 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1874,8 +1874,13 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ * pages from.
+ */
+ if (!obj->base.filp) {
+- i915_gem_object_put(obj);
+- return -ENXIO;
++ addr = -ENXIO;
++ goto err;
++ }
++
++ if (range_overflows(args->offset, args->size, (u64)obj->base.size)) {
++ addr = -EINVAL;
++ goto err;
+ }
+
+ addr = vm_mmap(obj->base.filp, 0, args->size,
+@@ -1889,8 +1894,8 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ struct vm_area_struct *vma;
+
+ if (down_write_killable(&mm->mmap_sem)) {
+- i915_gem_object_put(obj);
+- return -EINTR;
++ addr = -EINTR;
++ goto err;
+ }
+ vma = find_vma(mm, addr);
+ if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
+@@ -1908,12 +1913,10 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ i915_gem_object_put(obj);
+
+ args->addr_ptr = (uint64_t) addr;
+-
+ return 0;
+
+ err:
+ i915_gem_object_put(obj);
+-
+ return addr;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 07184c731f3c22337b17bfb0a0e8cc654a1d606b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 8 Jul 2019 15:03:27 +0100
+Subject: drm/i915/userptr: Acquire the page lock around set_page_dirty()
+
+[ Upstream commit aa56a292ce623734ddd30f52d73f527d1f3529b5 ]
+
+set_page_dirty says:
+
+ For pages with a mapping this should be done under the page lock
+ for the benefit of asynchronous memory errors who prefer a
+ consistent dirty state. This rule can be broken in some special
+ cases, but should be better not to.
+
+Under those rules, it is only safe for us to use the plain set_page_dirty
+calls for shmemfs/anonymous memory. Userptr may be used with real
+mappings and so needs to use the locked version (set_page_dirty_lock).
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203317
+Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl")
+References: 6dcc693bc57f ("ext4: warn when page is dirtied without buffers")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190708140327.26825-1-chris@chris-wilson.co.uk
+(cherry picked from commit cb6d7c7dc7ff8cace666ddec66334117a6068ce2)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_gem_userptr.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
+index 2c9b284036d10..e13ea2ecd669c 100644
+--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
+@@ -692,7 +692,15 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj,
+
+ for_each_sgt_page(page, sgt_iter, pages) {
+ if (obj->mm.dirty)
+- set_page_dirty(page);
++ /*
++ * As this may not be anonymous memory (e.g. shmem)
++ * but exist on a real mapping, we have to lock
++ * the page in order to dirty it -- holding
++ * the page reference is not sufficient to
++ * prevent the inode from being truncated.
++ * Play safe and take the lock.
++ */
++ set_page_dirty_lock(page);
+
+ mark_page_accessed(page);
+ put_page(page);
+--
+2.20.1
+
--- /dev/null
+From 46de4217434353b2dade3a9bbf49fe6ce17c15fb Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 28 Jan 2019 16:03:50 -0500
+Subject: drm/nouveau: Don't WARN_ON VCPI allocation failures
+
+[ Upstream commit b513a18cf1d705bd04efd91c417e79e4938be093 ]
+
+This is much louder then we want. VCPI allocation failures are quite
+normal, since they will happen if any part of the modesetting process is
+interrupted by removing the DP MST topology in question. So just print a
+debugging message on VCPI failures instead.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: f479c0ba4a17 ("drm/nouveau/kms/nv50: initial support for DP 1.2 multi-stream")
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: nouveau@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v4.10+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/disp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index f889d41a281fa..5e01bfb69d7a3 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -759,7 +759,8 @@ nv50_msto_enable(struct drm_encoder *encoder)
+
+ slots = drm_dp_find_vcpi_slots(&mstm->mgr, mstc->pbn);
+ r = drm_dp_mst_allocate_vcpi(&mstm->mgr, mstc->port, mstc->pbn, slots);
+- WARN_ON(!r);
++ if (!r)
++ DRM_DEBUG_KMS("Failed to allocate VCPI\n");
+
+ if (!mstm->links++)
+ nv50_outp_acquire(mstm->outp);
+--
+2.20.1
+
--- /dev/null
+From 74090c1c3977ec2c4231b1c17b19947c32a95912 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9bastien=20Szymanski?=
+ <sebastien.szymanski@armadeus.com>
+Date: Tue, 7 May 2019 17:27:12 +0200
+Subject: drm/panel: Add support for Armadeus ST0700 Adapt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit c479450f61c7f1f248c9a54aedacd2a6ca521ff8 ]
+
+This patch adds support for the Armadeus ST0700 Adapt. It comes with a
+Santek ST0700I5Y-RBSLW 7.0" WVGA (800x480) TFT and an adapter board so
+that it can be connected on the TFT header of Armadeus Dev boards.
+
+Cc: stable@vger.kernel.org # v4.19
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190507152713.27494-1-sebastien.szymanski@armadeus.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/panel/armadeus,st0700-adapt.txt | 9 ++++++
+ drivers/gpu/drm/panel/panel-simple.c | 29 +++++++++++++++++++
+ 2 files changed, 38 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt
+
+diff --git a/Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt b/Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt
+new file mode 100644
+index 0000000000000..a30d63db3c8f7
+--- /dev/null
++++ b/Documentation/devicetree/bindings/display/panel/armadeus,st0700-adapt.txt
+@@ -0,0 +1,9 @@
++Armadeus ST0700 Adapt. A Santek ST0700I5Y-RBSLW 7.0" WVGA (800x480) TFT with
++an adapter board.
++
++Required properties:
++- compatible: "armadeus,st0700-adapt"
++- power-supply: see panel-common.txt
++
++Optional properties:
++- backlight: see panel-common.txt
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index b1d41c4921dd5..5fd94e2060297 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -436,6 +436,32 @@ static const struct panel_desc ampire_am800480r3tmqwa1h = {
+ .bus_format = MEDIA_BUS_FMT_RGB666_1X18,
+ };
+
++static const struct display_timing santek_st0700i5y_rbslw_f_timing = {
++ .pixelclock = { 26400000, 33300000, 46800000 },
++ .hactive = { 800, 800, 800 },
++ .hfront_porch = { 16, 210, 354 },
++ .hback_porch = { 45, 36, 6 },
++ .hsync_len = { 1, 10, 40 },
++ .vactive = { 480, 480, 480 },
++ .vfront_porch = { 7, 22, 147 },
++ .vback_porch = { 22, 13, 3 },
++ .vsync_len = { 1, 10, 20 },
++ .flags = DISPLAY_FLAGS_HSYNC_LOW | DISPLAY_FLAGS_VSYNC_LOW |
++ DISPLAY_FLAGS_DE_HIGH | DISPLAY_FLAGS_PIXDATA_POSEDGE
++};
++
++static const struct panel_desc armadeus_st0700_adapt = {
++ .timings = &santek_st0700i5y_rbslw_f_timing,
++ .num_timings = 1,
++ .bpc = 6,
++ .size = {
++ .width = 154,
++ .height = 86,
++ },
++ .bus_format = MEDIA_BUS_FMT_RGB666_1X18,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_POSEDGE,
++};
++
+ static const struct drm_display_mode auo_b101aw03_mode = {
+ .clock = 51450,
+ .hdisplay = 1024,
+@@ -2330,6 +2356,9 @@ static const struct of_device_id platform_of_match[] = {
+ }, {
+ .compatible = "ampire,am800480r3tmqwa1h",
+ .data = &ire_am800480r3tmqwa1h,
++ }, {
++ .compatible = "armadeus,st0700-adapt",
++ .data = &armadeus_st0700_adapt,
+ }, {
+ .compatible = "auo,b101aw03",
+ .data = &auo_b101aw03,
+--
+2.20.1
+
--- /dev/null
+From bf0f16c3978bff2584ddc8827f0751d5209bdc80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 27 Nov 2018 20:20:04 +0200
+Subject: drm/vblank: Allow dynamic per-crtc max_vblank_count
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit ed20151a7699bb2c77eba3610199789a126940c4 ]
+
+On i965gm we need to adjust max_vblank_count dynamically
+depending on whether the TV encoder is used or not. To
+that end add a per-crtc max_vblank_count that takes
+precedence over its device wide counterpart. The driver
+can now call drm_crtc_set_max_vblank_count() to configure
+the per-crtc value before calling drm_vblank_on().
+
+Also looks like there was some discussion about exynos needing
+similar treatment.
+
+v2: Drop the extra max_vblank_count!=0 check for the
+ WARN(last!=current), will take care of it in i915 code (Daniel)
+ WARN_ON(!inmodeset) (Daniel)
+ WARN_ON(dev->max_vblank_count)
+ Pimp up the docs (Daniel)
+
+Cc: stable@vger.kernel.org
+Cc: Inki Dae <inki.dae@samsung.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181127182004.28885-1-ville.syrjala@linux.intel.com
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_vblank.c | 45 +++++++++++++++++++++++++++++++++---
+ include/drm/drm_device.h | 8 ++++++-
+ include/drm/drm_vblank.h | 22 ++++++++++++++++++
+ 3 files changed, 71 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_vblank.c b/drivers/gpu/drm/drm_vblank.c
+index 28cdcf76b6f99..d1859bcc7ccbc 100644
+--- a/drivers/gpu/drm/drm_vblank.c
++++ b/drivers/gpu/drm/drm_vblank.c
+@@ -105,13 +105,20 @@ static void store_vblank(struct drm_device *dev, unsigned int pipe,
+ write_sequnlock(&vblank->seqlock);
+ }
+
++static u32 drm_max_vblank_count(struct drm_device *dev, unsigned int pipe)
++{
++ struct drm_vblank_crtc *vblank = &dev->vblank[pipe];
++
++ return vblank->max_vblank_count ?: dev->max_vblank_count;
++}
++
+ /*
+ * "No hw counter" fallback implementation of .get_vblank_counter() hook,
+ * if there is no useable hardware frame counter available.
+ */
+ static u32 drm_vblank_no_hw_counter(struct drm_device *dev, unsigned int pipe)
+ {
+- WARN_ON_ONCE(dev->max_vblank_count != 0);
++ WARN_ON_ONCE(drm_max_vblank_count(dev, pipe) != 0);
+ return 0;
+ }
+
+@@ -198,6 +205,7 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe,
+ ktime_t t_vblank;
+ int count = DRM_TIMESTAMP_MAXRETRIES;
+ int framedur_ns = vblank->framedur_ns;
++ u32 max_vblank_count = drm_max_vblank_count(dev, pipe);
+
+ /*
+ * Interrupts were disabled prior to this call, so deal with counter
+@@ -216,9 +224,9 @@ static void drm_update_vblank_count(struct drm_device *dev, unsigned int pipe,
+ rc = drm_get_last_vbltimestamp(dev, pipe, &t_vblank, in_vblank_irq);
+ } while (cur_vblank != __get_vblank_counter(dev, pipe) && --count > 0);
+
+- if (dev->max_vblank_count != 0) {
++ if (max_vblank_count) {
+ /* trust the hw counter when it's around */
+- diff = (cur_vblank - vblank->last) & dev->max_vblank_count;
++ diff = (cur_vblank - vblank->last) & max_vblank_count;
+ } else if (rc && framedur_ns) {
+ u64 diff_ns = ktime_to_ns(ktime_sub(t_vblank, vblank->time));
+
+@@ -1204,6 +1212,37 @@ void drm_crtc_vblank_reset(struct drm_crtc *crtc)
+ }
+ EXPORT_SYMBOL(drm_crtc_vblank_reset);
+
++/**
++ * drm_crtc_set_max_vblank_count - configure the hw max vblank counter value
++ * @crtc: CRTC in question
++ * @max_vblank_count: max hardware vblank counter value
++ *
++ * Update the maximum hardware vblank counter value for @crtc
++ * at runtime. Useful for hardware where the operation of the
++ * hardware vblank counter depends on the currently active
++ * display configuration.
++ *
++ * For example, if the hardware vblank counter does not work
++ * when a specific connector is active the maximum can be set
++ * to zero. And when that specific connector isn't active the
++ * maximum can again be set to the appropriate non-zero value.
++ *
++ * If used, must be called before drm_vblank_on().
++ */
++void drm_crtc_set_max_vblank_count(struct drm_crtc *crtc,
++ u32 max_vblank_count)
++{
++ struct drm_device *dev = crtc->dev;
++ unsigned int pipe = drm_crtc_index(crtc);
++ struct drm_vblank_crtc *vblank = &dev->vblank[pipe];
++
++ WARN_ON(dev->max_vblank_count);
++ WARN_ON(!READ_ONCE(vblank->inmodeset));
++
++ vblank->max_vblank_count = max_vblank_count;
++}
++EXPORT_SYMBOL(drm_crtc_set_max_vblank_count);
++
+ /**
+ * drm_crtc_vblank_on - enable vblank events on a CRTC
+ * @crtc: CRTC in question
+diff --git a/include/drm/drm_device.h b/include/drm/drm_device.h
+index f9c6e0e3aec7d..fa117e11458ae 100644
+--- a/include/drm/drm_device.h
++++ b/include/drm/drm_device.h
+@@ -174,7 +174,13 @@ struct drm_device {
+ * races and imprecision over longer time periods, hence exposing a
+ * hardware vblank counter is always recommended.
+ *
+- * If non-zeor, &drm_crtc_funcs.get_vblank_counter must be set.
++ * This is the statically configured device wide maximum. The driver
++ * can instead choose to use a runtime configurable per-crtc value
++ * &drm_vblank_crtc.max_vblank_count, in which case @max_vblank_count
++ * must be left at zero. See drm_crtc_set_max_vblank_count() on how
++ * to use the per-crtc value.
++ *
++ * If non-zero, &drm_crtc_funcs.get_vblank_counter must be set.
+ */
+ u32 max_vblank_count; /**< size of vblank counter register */
+
+diff --git a/include/drm/drm_vblank.h b/include/drm/drm_vblank.h
+index d25a9603ab570..e9c676381fd4f 100644
+--- a/include/drm/drm_vblank.h
++++ b/include/drm/drm_vblank.h
+@@ -128,6 +128,26 @@ struct drm_vblank_crtc {
+ * @last: Protected by &drm_device.vbl_lock, used for wraparound handling.
+ */
+ u32 last;
++ /**
++ * @max_vblank_count:
++ *
++ * Maximum value of the vblank registers for this crtc. This value +1
++ * will result in a wrap-around of the vblank register. It is used
++ * by the vblank core to handle wrap-arounds.
++ *
++ * If set to zero the vblank core will try to guess the elapsed vblanks
++ * between times when the vblank interrupt is disabled through
++ * high-precision timestamps. That approach is suffering from small
++ * races and imprecision over longer time periods, hence exposing a
++ * hardware vblank counter is always recommended.
++ *
++ * This is the runtime configurable per-crtc maximum set through
++ * drm_crtc_set_max_vblank_count(). If this is used the driver
++ * must leave the device wide &drm_device.max_vblank_count at zero.
++ *
++ * If non-zero, &drm_crtc_funcs.get_vblank_counter must be set.
++ */
++ u32 max_vblank_count;
+ /**
+ * @inmodeset: Tracks whether the vblank is disabled due to a modeset.
+ * For legacy driver bit 2 additionally tracks whether an additional
+@@ -206,4 +226,6 @@ bool drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev,
+ void drm_calc_timestamping_constants(struct drm_crtc *crtc,
+ const struct drm_display_mode *mode);
+ wait_queue_head_t *drm_crtc_vblank_waitqueue(struct drm_crtc *crtc);
++void drm_crtc_set_max_vblank_count(struct drm_crtc *crtc,
++ u32 max_vblank_count);
+ #endif
+--
+2.20.1
+
--- /dev/null
+From cb872c8eaabfe7526255706d3aaa8e8715775a37 Mon Sep 17 00:00:00 2001
+From: Jonathan Bakker <xc-racer2@live.ca>
+Date: Fri, 7 Dec 2018 20:11:36 +0100
+Subject: dt-bindings: iio: adc: exynos-adc: Add S5PV210 variant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit a9b0a2a7c19316588421b94946c8e2e5a84ac14e ]
+
+Add information about new compatible for S5PV210
+
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/iio/adc/samsung,exynos-adc.txt | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt b/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
+index 6c49db7f8ad25..a10c1f89037de 100644
+--- a/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
++++ b/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
+@@ -11,7 +11,7 @@ New driver handles the following
+
+ Required properties:
+ - compatible: Must be "samsung,exynos-adc-v1"
+- for exynos4412/5250 and s5pv210 controllers.
++ for exynos4412/5250 controllers.
+ Must be "samsung,exynos-adc-v2" for
+ future controllers.
+ Must be "samsung,exynos3250-adc" for
+@@ -28,6 +28,8 @@ Required properties:
+ the ADC in s3c2443 and compatibles
+ Must be "samsung,s3c6410-adc" for
+ the ADC in s3c6410 and compatibles
++ Must be "samsung,s5pv210-adc" for
++ the ADC in s5pv210 and compatibles
+ - reg: List of ADC register address range
+ - The base address and range of ADC register
+ - The base address and range of ADC_PHY register (every
+--
+2.20.1
+
--- /dev/null
+From 59ae6da353eb6d2b2a73cc8feae7270423728338 Mon Sep 17 00:00:00 2001
+From: Christoph Muellner <christoph.muellner@theobroma-systems.com>
+Date: Fri, 22 Mar 2019 12:38:04 +0100
+Subject: dt-bindings: mmc: Add disable-cqe-dcmd property.
+
+[ Upstream commit 28f22fb755ecf9f933f045bc0afdb8140641b01c ]
+
+Add disable-cqe-dcmd as optional property for MMC hosts.
+This property allows to disable or not enable the direct command
+features of the command queue engine.
+
+Signed-off-by: Christoph Muellner <christoph.muellner@theobroma-systems.com>
+Signed-off-by: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
+Fixes: 84362d79f436 ("mmc: sdhci-of-arasan: Add CQHCI support for arasan,sdhci-5.1")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mmc/mmc.txt | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/mmc/mmc.txt b/Documentation/devicetree/bindings/mmc/mmc.txt
+index cdbcfd3a4ff21..c269dbe384fea 100644
+--- a/Documentation/devicetree/bindings/mmc/mmc.txt
++++ b/Documentation/devicetree/bindings/mmc/mmc.txt
+@@ -64,6 +64,8 @@ Optional properties:
+ whether pwrseq-simple is used. Default to 10ms if no available.
+ - supports-cqe : The presence of this property indicates that the corresponding
+ MMC host controller supports HW command queue feature.
++- disable-cqe-dcmd: This property indicates that the MMC controller's command
++ queue engine (CQE) does not support direct commands (DCMDs).
+
+ *NOTE* on CD and WP polarity. To use common for all SD/MMC host controllers line
+ polarity properties, we have to fix the meaning of the "normal" and "inverted"
+--
+2.20.1
+
--- /dev/null
+From ec10f1b81c9e2acf5f2ee66ed018fcd61b444967 Mon Sep 17 00:00:00 2001
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+Date: Wed, 23 Jan 2019 11:30:51 -0800
+Subject: dt-bindings: mmc: Add supports-cqe property
+
+[ Upstream commit c7fddbd5db5cffd10ed4d18efa20e36803d1899f ]
+
+Add supports-cqe optional property for MMC hosts.
+
+This property is used to identify the specific host controller
+supporting command queue.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mmc/mmc.txt | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/mmc/mmc.txt b/Documentation/devicetree/bindings/mmc/mmc.txt
+index f5a0923b34ca1..cdbcfd3a4ff21 100644
+--- a/Documentation/devicetree/bindings/mmc/mmc.txt
++++ b/Documentation/devicetree/bindings/mmc/mmc.txt
+@@ -62,6 +62,8 @@ Optional properties:
+ be referred to mmc-pwrseq-simple.txt. But now it's reused as a tunable delay
+ waiting for I/O signalling and card power supply to be stable, regardless of
+ whether pwrseq-simple is used. Default to 10ms if no available.
++- supports-cqe : The presence of this property indicates that the corresponding
++ MMC host controller supports HW command queue feature.
+
+ *NOTE* on CD and WP polarity. To use common for all SD/MMC host controllers line
+ polarity properties, we have to fix the meaning of the "normal" and "inverted"
+--
+2.20.1
+
--- /dev/null
+From d8ac0194d24f280c09785a2228eab52b84db161b Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 22 May 2019 10:27:01 -0400
+Subject: ext4: don't perform block validity checks on the journal inode
+
+[ Upstream commit 0a944e8a6c66ca04c7afbaa17e22bf208a8b37f0 ]
+
+Since the journal inode is already checked when we added it to the
+block validity's system zone, if we check it again, we'll just trigger
+a failure.
+
+This was causing failures like this:
+
+[ 53.897001] EXT4-fs error (device sda): ext4_find_extent:909: inode
+#8: comm jbd2/sda-8: pblk 121667583 bad header/extent: invalid extent entries - magic f30a, entries 8, max 340(340), depth 0(0)
+[ 53.931430] jbd2_journal_bmap: journal block not found at offset 49 on sda-8
+[ 53.938480] Aborting journal on device sda-8.
+
+... but only if the system was under enough memory pressure that
+logical->physical mapping for the journal inode gets pushed out of the
+extent cache. (This is why it wasn't noticed earlier.)
+
+Fixes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity")
+Reported-by: Dan Rue <dan.rue@linaro.org>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 45aea792d22a0..00bf0b67aae87 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -518,10 +518,14 @@ __read_extent_tree_block(const char *function, unsigned int line,
+ }
+ if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE))
+ return bh;
+- err = __ext4_ext_check(function, line, inode,
+- ext_block_hdr(bh), depth, pblk);
+- if (err)
+- goto errout;
++ if (!ext4_has_feature_journal(inode->i_sb) ||
++ (inode->i_ino !=
++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) {
++ err = __ext4_ext_check(function, line, inode,
++ ext_block_hdr(bh), depth, pblk);
++ if (err)
++ goto errout;
++ }
+ set_buffer_verified(bh);
+ /*
+ * If this is a leaf block, cache all of its entries
+--
+2.20.1
+
--- /dev/null
+From f48dcab25503ff8f9e2d2627fdcdc86f40f68863 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 15 May 2019 00:51:19 -0400
+Subject: ext4: fix block validity checks for journal inodes using indirect
+ blocks
+
+[ Upstream commit 170417c8c7bb2cbbdd949bf5c443c0c8f24a203b ]
+
+Commit 345c0dbf3a30 ("ext4: protect journal inode's blocks using
+block_validity") failed to add an exception for the journal inode in
+ext4_check_blockref(), which is the function used by ext4_get_branch()
+for indirect blocks. This caused attempts to read from the ext3-style
+journals to fail with:
+
+[ 848.968550] EXT4-fs error (device sdb7): ext4_get_branch:171: inode #8: block 30343695: comm jbd2/sdb7-8: invalid block
+
+Fix this by adding the missing exception check.
+
+Fixes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity")
+Reported-by: Arthur Marsh <arthur.marsh@internode.on.net>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/block_validity.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 9409b1e11a22e..cd7129b622f85 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -275,6 +275,11 @@ int ext4_check_blockref(const char *function, unsigned int line,
+ __le32 *bref = p;
+ unsigned int blk;
+
++ if (ext4_has_feature_journal(inode->i_sb) &&
++ (inode->i_ino ==
++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
++ return 0;
++
+ while (bref < p+max) {
+ blk = le32_to_cpu(*bref++);
+ if (blk &&
+--
+2.20.1
+
--- /dev/null
+From c1218f33a4a434824934278bc6f5c3bb9bd44c78 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Tue, 9 Apr 2019 23:37:08 -0400
+Subject: ext4: protect journal inode's blocks using block_validity
+
+[ Upstream commit 345c0dbf3a30872d9b204db96b5857cd00808cae ]
+
+Add the blocks which belong to the journal inode to block_validity's
+system zone so attempts to deallocate or overwrite the journal due a
+corrupted file system where the journal blocks are also claimed by
+another inode.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202879
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/block_validity.c | 48 ++++++++++++++++++++++++++++++++++++++++
+ fs/ext4/inode.c | 4 ++++
+ 2 files changed, 52 insertions(+)
+
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 913061c0de1b3..9409b1e11a22e 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -137,6 +137,48 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ printk(KERN_CONT "\n");
+ }
+
++static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
++{
++ struct inode *inode;
++ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ struct ext4_map_blocks map;
++ u32 i = 0, err = 0, num, n;
++
++ if ((ino < EXT4_ROOT_INO) ||
++ (ino > le32_to_cpu(sbi->s_es->s_inodes_count)))
++ return -EINVAL;
++ inode = ext4_iget(sb, ino, EXT4_IGET_SPECIAL);
++ if (IS_ERR(inode))
++ return PTR_ERR(inode);
++ num = (inode->i_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits;
++ while (i < num) {
++ map.m_lblk = i;
++ map.m_len = num - i;
++ n = ext4_map_blocks(NULL, inode, &map, 0);
++ if (n < 0) {
++ err = n;
++ break;
++ }
++ if (n == 0) {
++ i++;
++ } else {
++ if (!ext4_data_block_valid(sbi, map.m_pblk, n)) {
++ ext4_error(sb, "blocks %llu-%llu from inode %u "
++ "overlap system zone", map.m_pblk,
++ map.m_pblk + map.m_len - 1, ino);
++ err = -EFSCORRUPTED;
++ break;
++ }
++ err = add_system_zone(sbi, map.m_pblk, n);
++ if (err < 0)
++ break;
++ i += n;
++ }
++ }
++ iput(inode);
++ return err;
++}
++
+ int ext4_setup_system_zone(struct super_block *sb)
+ {
+ ext4_group_t ngroups = ext4_get_groups_count(sb);
+@@ -171,6 +213,12 @@ int ext4_setup_system_zone(struct super_block *sb)
+ if (ret)
+ return ret;
+ }
++ if (ext4_has_feature_journal(sb) && sbi->s_es->s_journal_inum) {
++ ret = ext4_protect_reserved_inode(sb,
++ le32_to_cpu(sbi->s_es->s_journal_inum));
++ if (ret)
++ return ret;
++ }
+
+ if (test_opt(sb, DEBUG))
+ debug_print_tree(sbi);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index e65559bf77281..cff6277f7a9ff 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -399,6 +399,10 @@ static int __check_block_validity(struct inode *inode, const char *func,
+ unsigned int line,
+ struct ext4_map_blocks *map)
+ {
++ if (ext4_has_feature_journal(inode->i_sb) &&
++ (inode->i_ino ==
++ le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum)))
++ return 0;
+ if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk,
+ map->m_len)) {
+ ext4_error_inode(inode, func, line, map->m_pblk,
+--
+2.20.1
+
--- /dev/null
+From 3ae1dafbe68357a549d224ae276cacf5f7992850 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 10 May 2019 22:06:38 -0400
+Subject: ext4: unsigned int compared against zero
+
+[ Upstream commit fbbbbd2f28aec991f3fbc248df211550fbdfd58c ]
+
+There are two cases where u32 variables n and err are being checked
+for less than zero error values, the checks is always false because
+the variables are not signed. Fix this by making the variables ints.
+
+Addresses-Coverity: ("Unsigned compared against 0")
+Fixes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/block_validity.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index cd7129b622f85..e8e27cdc2f677 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -142,7 +142,8 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
+ struct inode *inode;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+ struct ext4_map_blocks map;
+- u32 i = 0, err = 0, num, n;
++ u32 i = 0, num;
++ int err = 0, n;
+
+ if ((ino < EXT4_ROOT_INO) ||
+ (ino > le32_to_cpu(sbi->s_es->s_inodes_count)))
+--
+2.20.1
+
--- /dev/null
+From b75627ee3c040359ad704e91f7f541982d6dce40 Mon Sep 17 00:00:00 2001
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Mon, 8 Jul 2019 10:23:43 +0200
+Subject: gpio: don't WARN() on NULL descs if gpiolib is disabled
+
+[ Upstream commit ffe0bbabb0cffceceae07484fde1ec2a63b1537c ]
+
+If gpiolib is disabled, we use the inline stubs from gpio/consumer.h
+instead of regular definitions of GPIO API. The stubs for 'optional'
+variants of gpiod_get routines return NULL in this case as if the
+relevant GPIO wasn't found. This is correct so far.
+
+Calling other (non-gpio_get) stubs from this header triggers a warning
+because the GPIO descriptor couldn't have been requested. The warning
+however is unconditional (WARN_ON(1)) and is emitted even if the passed
+descriptor pointer is NULL.
+
+We don't want to force the users of 'optional' gpio_get to check the
+returned pointer before calling e.g. gpiod_set_value() so let's only
+WARN on non-NULL descriptors.
+
+Cc: stable@vger.kernel.org
+Reported-by: Claus H. Stovgaard <cst@phaseone.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/consumer.h | 62 +++++++++++++++++------------------
+ 1 file changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index acc4279ad5e3f..412098b24f58b 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -222,7 +222,7 @@ static inline void gpiod_put(struct gpio_desc *desc)
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+
+ static inline void gpiod_put_array(struct gpio_descs *descs)
+@@ -230,7 +230,7 @@ static inline void gpiod_put_array(struct gpio_descs *descs)
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(descs);
+ }
+
+ static inline struct gpio_desc *__must_check
+@@ -283,7 +283,7 @@ static inline void devm_gpiod_put(struct device *dev, struct gpio_desc *desc)
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+
+ static inline void devm_gpiod_put_array(struct device *dev,
+@@ -292,32 +292,32 @@ static inline void devm_gpiod_put_array(struct device *dev,
+ might_sleep();
+
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(descs);
+ }
+
+
+ static inline int gpiod_get_direction(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+ static inline int gpiod_direction_input(struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+ static inline int gpiod_direction_output(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+ static inline int gpiod_direction_output_raw(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+
+@@ -325,7 +325,7 @@ static inline int gpiod_direction_output_raw(struct gpio_desc *desc, int value)
+ static inline int gpiod_get_value(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_array_value(unsigned int array_size,
+@@ -333,25 +333,25 @@ static inline int gpiod_get_array_value(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_value(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline void gpiod_set_array_value(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ }
+ static inline int gpiod_get_raw_value(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_raw_array_value(unsigned int array_size,
+@@ -359,27 +359,27 @@ static inline int gpiod_get_raw_array_value(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_raw_value(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline int gpiod_set_raw_array_value(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+
+ static inline int gpiod_get_value_cansleep(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_array_value_cansleep(unsigned int array_size,
+@@ -387,25 +387,25 @@ static inline int gpiod_get_array_value_cansleep(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline void gpiod_set_array_value_cansleep(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ }
+ static inline int gpiod_get_raw_value_cansleep(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_get_raw_array_value_cansleep(unsigned int array_size,
+@@ -413,55 +413,55 @@ static inline int gpiod_get_raw_array_value_cansleep(unsigned int array_size,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+ static inline void gpiod_set_raw_value_cansleep(struct gpio_desc *desc,
+ int value)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ }
+ static inline int gpiod_set_raw_array_value_cansleep(unsigned int array_size,
+ struct gpio_desc **desc_array,
+ int *value_array)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc_array);
+ return 0;
+ }
+
+ static inline int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+
+ static inline int gpiod_set_transitory(struct gpio_desc *desc, bool transitory)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -ENOSYS;
+ }
+
+ static inline int gpiod_is_active_low(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+ static inline int gpiod_cansleep(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return 0;
+ }
+
+ static inline int gpiod_to_irq(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -EINVAL;
+ }
+
+@@ -469,7 +469,7 @@ static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+ const char *name)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -EINVAL;
+ }
+
+@@ -481,7 +481,7 @@ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+ {
+ /* GPIO can never have been requested */
+- WARN_ON(1);
++ WARN_ON(desc);
+ return -EINVAL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e7acc76c9d144499831d77312b096c0e6ac5341c Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Wed, 31 Jul 2019 01:25:45 +0000
+Subject: hv_sock: Fix hang when a connection is closed
+
+[ Upstream commit 685703b497bacea8765bb409d6b73455b73c540e ]
+
+There is a race condition for an established connection that is being closed
+by the guest: the refcnt is 4 at the end of hvs_release() (Note: here the
+'remove_sock' is false):
+
+1 for the initial value;
+1 for the sk being in the bound list;
+1 for the sk being in the connected list;
+1 for the delayed close_work.
+
+After hvs_release() finishes, __vsock_release() -> sock_put(sk) *may*
+decrease the refcnt to 3.
+
+Concurrently, hvs_close_connection() runs in another thread:
+ calls vsock_remove_sock() to decrease the refcnt by 2;
+ call sock_put() to decrease the refcnt to 0, and free the sk;
+ next, the "release_sock(sk)" may hang due to use-after-free.
+
+In the above, after hvs_release() finishes, if hvs_close_connection() runs
+faster than "__vsock_release() -> sock_put(sk)", then there is not any issue,
+because at the beginning of hvs_close_connection(), the refcnt is still 4.
+
+The issue can be resolved if an extra reference is taken when the
+connection is established.
+
+Fixes: a9eeb998c28d ("hv_sock: Add support for delayed close")
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Reviewed-by: Sunil Muthuswamy <sunilmut@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/hyperv_transport.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index 9c7da811d130f..98f193fd5315e 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -320,6 +320,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
+ lock_sock(sk);
+ hvs_do_close_lock_held(vsock_sk(sk), true);
+ release_sock(sk);
++
++ /* Release the refcnt for the channel that's opened in
++ * hvs_open_connection().
++ */
++ sock_put(sk);
+ }
+
+ static void hvs_open_connection(struct vmbus_channel *chan)
+@@ -388,6 +393,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
+ }
+
+ set_per_channel_state(chan, conn_from_host ? new : sk);
++
++ /* This reference will be dropped by hvs_close_connection(). */
++ sock_hold(conn_from_host ? new : sk);
+ vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
+
+ /* Set the pending send size to max packet size to always get
+--
+2.20.1
+
--- /dev/null
+From 2e7d7eb38a5f9c31f1ec9d9d13a94a3650499238 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Mon, 22 Jul 2019 20:55:27 +0200
+Subject: i2c: at91: disable TXRDY interrupt after sending data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit d12e3aae160fb26b534c4496b211d6e60a5179ed ]
+
+Driver was not disabling TXRDY interrupt after last TX byte.
+This caused interrupt storm until transfer timeouts for slow
+or broken device on the bus. The patch fixes the interrupt storm
+on my SAMA5D2-based board.
+
+Cc: stable@vger.kernel.org # 5.2.x
+[v5.2 introduced file split; the patch should apply to i2c-at91.c before the split]
+Fixes: fac368a04048 ("i2c: at91: add new driver")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Tested-by: Raag Jadav <raagjadav@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-at91.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
+index 3f3e8b3bf5ff9..0998a388d2ed5 100644
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -270,9 +270,11 @@ static void at91_twi_write_next_byte(struct at91_twi_dev *dev)
+ writeb_relaxed(*dev->buf, dev->base + AT91_TWI_THR);
+
+ /* send stop when last byte has been written */
+- if (--dev->buf_len == 0)
++ if (--dev->buf_len == 0) {
+ if (!dev->use_alt_cmd)
+ at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_TXRDY);
++ }
+
+ dev_dbg(dev->dev, "wrote 0x%x, to go %zu\n", *dev->buf, dev->buf_len);
+
+@@ -690,9 +692,8 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
+ } else {
+ at91_twi_write_next_byte(dev);
+ at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP |
+- AT91_TWI_NACK |
+- AT91_TWI_TXRDY);
++ AT91_TWI_TXCOMP | AT91_TWI_NACK |
++ (dev->buf_len ? AT91_TWI_TXRDY : 0));
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f07a49cea7e8d401a3856aa9285018063250f8f3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Mon, 22 Jul 2019 21:05:56 +0200
+Subject: i2c: at91: fix clk_offset for sama5d2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit b1ac6704493fa14b5dc19eb6b69a73932361a131 ]
+
+In SAMA5D2 datasheet, TWIHS_CWGR register rescription mentions clock
+offset of 3 cycles (compared to 4 in eg. SAMA5D3).
+
+Cc: stable@vger.kernel.org # 5.2.x
+[needs applying to i2c-at91.c instead for earlier kernels]
+Fixes: 0ef6f3213dac ("i2c: at91: add support for new alternative command mode")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-at91.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
+index 0998a388d2ed5..d51bf536bdf75 100644
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -914,7 +914,7 @@ static struct at91_twi_pdata sama5d4_config = {
+
+ static struct at91_twi_pdata sama5d2_config = {
+ .clk_max_div = 7,
+- .clk_offset = 4,
++ .clk_offset = 3,
+ .has_unre_flag = true,
+ .has_alt_cmd = true,
+ .has_hold_field = true,
+--
+2.20.1
+
--- /dev/null
+From 4ef8c2af6a0b9a25591661a8d652df456cf4e2e9 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Fri, 14 Jun 2019 12:32:26 -0400
+Subject: IB/hfi1: Avoid hardlockup with flushlist_lock
+
+[ Upstream commit cf131a81967583ae737df6383a0893b9fee75b4e ]
+
+Heavy contention of the sde flushlist_lock can cause hard lockups at
+extreme scale when the flushing logic is under stress.
+
+Mitigate by replacing the item at a time copy to the local list with
+an O(1) list_splice_init() and using the high priority work queue to
+do the flushes.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/sdma.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
+index 88e326d6cc494..d648a4167832c 100644
+--- a/drivers/infiniband/hw/hfi1/sdma.c
++++ b/drivers/infiniband/hw/hfi1/sdma.c
+@@ -410,10 +410,7 @@ static void sdma_flush(struct sdma_engine *sde)
+ sdma_flush_descq(sde);
+ spin_lock_irqsave(&sde->flushlist_lock, flags);
+ /* copy flush list */
+- list_for_each_entry_safe(txp, txp_next, &sde->flushlist, list) {
+- list_del_init(&txp->list);
+- list_add_tail(&txp->list, &flushlist);
+- }
++ list_splice_init(&sde->flushlist, &flushlist);
+ spin_unlock_irqrestore(&sde->flushlist_lock, flags);
+ /* flush from flush list */
+ list_for_each_entry_safe(txp, txp_next, &flushlist, list)
+@@ -2426,7 +2423,7 @@ unlock_noconn:
+ wait->tx_count++;
+ wait->count += tx->num_desc;
+ }
+- schedule_work(&sde->flush_worker);
++ queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker);
+ ret = -ECOMM;
+ goto unlock;
+ nodesc:
+@@ -2526,7 +2523,7 @@ unlock_noconn:
+ }
+ }
+ spin_unlock(&sde->flushlist_lock);
+- schedule_work(&sde->flush_worker);
++ queue_work_on(sde->cpu, system_highpri_wq, &sde->flush_worker);
+ ret = -ECOMM;
+ goto update_tail;
+ nodesc:
+--
+2.20.1
+
--- /dev/null
+From 51153733938db5a198410445db517a6ac8a3dec9 Mon Sep 17 00:00:00 2001
+From: Moni Shoua <monis@mellanox.com>
+Date: Mon, 2 Sep 2019 10:16:07 -0400
+Subject: IB/mlx5: Reset access mask when looping inside page fault handler
+
+[ Upstream commit 1abe186ed8a6593069bc122da55fc684383fdc1c ]
+
+If page-fault handler spans multiple MRs then the access mask needs to
+be reset before each MR handling or otherwise write access will be
+granted to mapped pages instead of read-only.
+
+Cc: <stable@vger.kernel.org> # 3.19
+Fixes: 7bdf65d411c1 ("IB/mlx5: Handle page faults")
+Reported-by: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/odp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
+index 9e1cac8cb2609..453e5c4ac19f4 100644
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -497,7 +497,7 @@ void mlx5_ib_free_implicit_mr(struct mlx5_ib_mr *imr)
+ static int pagefault_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr,
+ u64 io_virt, size_t bcnt, u32 *bytes_mapped)
+ {
+- u64 access_mask = ODP_READ_ALLOWED_BIT;
++ u64 access_mask;
+ int npages = 0, page_shift, np;
+ u64 start_idx, page_mask;
+ struct ib_umem_odp *odp;
+@@ -522,6 +522,7 @@ next_mr:
+ page_shift = mr->umem->page_shift;
+ page_mask = ~(BIT(page_shift) - 1);
+ start_idx = (io_virt - (mr->mmkey.iova & page_mask)) >> page_shift;
++ access_mask = ODP_READ_ALLOWED_BIT;
+
+ if (mr->umem->writable)
+ access_mask |= ODP_WRITE_ALLOWED_BIT;
+--
+2.20.1
+
--- /dev/null
+From 889b9fee61b5962816e059946b934a9e65439ab9 Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Thu, 24 Jan 2019 14:33:12 +0200
+Subject: IB/uverbs: Fix OOPs upon device disassociation
+
+[ Upstream commit 425784aa5b029eeb80498c73a68f62c3ad1d3b3f ]
+
+The async_file might be freed before the disassociation has been ended,
+causing qp shutdown to use after free on it.
+
+Since uverbs_destroy_ufile_hw is not a fence, it returns if a
+disassociation is ongoing in another thread. It has to be written this way
+to avoid deadlock. However this means that the ufile FD close cannot
+destroy anything that may still be used by an active kref, such as the the
+async_file.
+
+To fix that move the kref_put() to be in ib_uverbs_release_file().
+
+ BUG: unable to handle kernel paging request at ffffffffba682787
+ PGD bc80e067 P4D bc80e067 PUD bc80f063 PMD 1313df163 PTE 80000000bc682061
+ Oops: 0003 [#1] SMP PTI
+ CPU: 1 PID: 32410 Comm: bash Tainted: G OE 4.20.0-rc6+ #3
+ Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
+ RIP: 0010:__pv_queued_spin_lock_slowpath+0x1b3/0x2a0
+ Code: 98 83 e2 60 49 89 df 48 8b 04 c5 80 18 72 ba 48 8d
+ ba 80 32 02 00 ba 00 80 00 00 4c 8d 65 14 41 bd 01 00 00 00 48 01 c7 85
+ d2 <48> 89 2f 48 89 fb 74 14 8b 45 08 85 c0 75 42 84 d2 74 6b f3 90 83
+ RSP: 0018:ffffc1bbc064fb58 EFLAGS: 00010006
+ RAX: ffffffffba65f4e7 RBX: ffff9f209c656c00 RCX: 0000000000000001
+ RDX: 0000000000008000 RSI: 0000000000000000 RDI: ffffffffba682787
+ RBP: ffff9f217bb23280 R08: 0000000000000001 R09: 0000000000000000
+ R10: ffff9f209d2c7800 R11: ffffffffffffffe8 R12: ffff9f217bb23294
+ R13: 0000000000000001 R14: 0000000000000000 R15: ffff9f209c656c00
+ FS: 00007fac55aad740(0000) GS:ffff9f217bb00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffffffba682787 CR3: 000000012f8e0000 CR4: 00000000000006e0
+ Call Trace:
+ _raw_spin_lock_irq+0x27/0x30
+ ib_uverbs_release_uevent+0x1e/0xa0 [ib_uverbs]
+ uverbs_free_qp+0x7e/0x90 [ib_uverbs]
+ destroy_hw_idr_uobject+0x1c/0x50 [ib_uverbs]
+ uverbs_destroy_uobject+0x2e/0x180 [ib_uverbs]
+ __uverbs_cleanup_ufile+0x73/0x90 [ib_uverbs]
+ uverbs_destroy_ufile_hw+0x5d/0x120 [ib_uverbs]
+ ib_uverbs_remove_one+0xea/0x240 [ib_uverbs]
+ ib_unregister_device+0xfb/0x200 [ib_core]
+ mlx5_ib_remove+0x51/0xe0 [mlx5_ib]
+ mlx5_remove_device+0xc1/0xd0 [mlx5_core]
+ mlx5_unregister_device+0x3d/0xb0 [mlx5_core]
+ remove_one+0x2a/0x90 [mlx5_core]
+ pci_device_remove+0x3b/0xc0
+ device_release_driver_internal+0x16d/0x240
+ unbind_store+0xb2/0x100
+ kernfs_fop_write+0x102/0x180
+ __vfs_write+0x36/0x1a0
+ ? __alloc_fd+0xa9/0x170
+ ? set_close_on_exec+0x49/0x70
+ vfs_write+0xad/0x1a0
+ ksys_write+0x52/0xc0
+ do_syscall_64+0x5b/0x180
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7fac551aac60
+
+Cc: <stable@vger.kernel.org> # 4.2
+Fixes: 036b10635739 ("IB/uverbs: Enable device removal when there are active user space applications")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 50152c1b10045..357de3b4fdddf 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -265,6 +265,9 @@ void ib_uverbs_release_file(struct kref *ref)
+ if (atomic_dec_and_test(&file->device->refcount))
+ ib_uverbs_comp_dev(file->device);
+
++ if (file->async_file)
++ kref_put(&file->async_file->ref,
++ ib_uverbs_release_async_event_file);
+ kobject_put(&file->device->kobj);
+ kfree(file);
+ }
+@@ -915,10 +918,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ }
+ mutex_unlock(&file->device->lists_mutex);
+
+- if (file->async_file)
+- kref_put(&file->async_file->ref,
+- ib_uverbs_release_async_event_file);
+-
+ kref_put(&file->ref, ib_uverbs_release_file);
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 61d648ab38496c6abe43a6260ff2737e8bfe2c5d Mon Sep 17 00:00:00 2001
+From: Jonathan Bakker <xc-racer2@live.ca>
+Date: Fri, 7 Dec 2018 20:11:34 +0100
+Subject: iio: adc: exynos-adc: Add S5PV210 variant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 882bf52fdeab47dbe991cc0e564b0b51c571d0a3 ]
+
+S5PV210's ADC variant is almost the same as v1 except that it has 10
+channels and doesn't require the pmu register
+
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/exynos_adc.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
+index 4be29ed447559..41da522fc6735 100644
+--- a/drivers/iio/adc/exynos_adc.c
++++ b/drivers/iio/adc/exynos_adc.c
+@@ -115,6 +115,7 @@
+ #define MAX_ADC_V2_CHANNELS 10
+ #define MAX_ADC_V1_CHANNELS 8
+ #define MAX_EXYNOS3250_ADC_CHANNELS 2
++#define MAX_S5PV210_ADC_CHANNELS 10
+
+ /* Bit definitions common for ADC_V1 and ADC_V2 */
+ #define ADC_CON_EN_START (1u << 0)
+@@ -282,6 +283,16 @@ static const struct exynos_adc_data exynos_adc_v1_data = {
+ .start_conv = exynos_adc_v1_start_conv,
+ };
+
++static const struct exynos_adc_data exynos_adc_s5pv210_data = {
++ .num_channels = MAX_S5PV210_ADC_CHANNELS,
++ .mask = ADC_DATX_MASK, /* 12 bit ADC resolution */
++
++ .init_hw = exynos_adc_v1_init_hw,
++ .exit_hw = exynos_adc_v1_exit_hw,
++ .clear_irq = exynos_adc_v1_clear_irq,
++ .start_conv = exynos_adc_v1_start_conv,
++};
++
+ static void exynos_adc_s3c2416_start_conv(struct exynos_adc *info,
+ unsigned long addr)
+ {
+@@ -478,6 +489,9 @@ static const struct of_device_id exynos_adc_match[] = {
+ }, {
+ .compatible = "samsung,s3c6410-adc",
+ .data = &exynos_adc_s3c64xx_data,
++ }, {
++ .compatible = "samsung,s5pv210-adc",
++ .data = &exynos_adc_s5pv210_data,
+ }, {
+ .compatible = "samsung,exynos-adc-v1",
+ .data = &exynos_adc_v1_data,
+--
+2.20.1
+
--- /dev/null
+From 3f9c5385f1e5fcb2840437098f03fc6d422aa91f Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Tue, 12 Feb 2019 18:45:49 +0100
+Subject: iio: adc: exynos-adc: Use proper number of channels for Exynos4x12
+
+[ Upstream commit 103cda6a3b8d2c10d5f8cd7abad118e9db8f4776 ]
+
+Exynos4212 and Exynos4412 have only four ADC channels so using
+"samsung,exynos-adc-v1" compatible (for eight channels ADCv1) on them is
+wrong. Add a new compatible for Exynos4x12.
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/iio/adc/samsung,exynos-adc.txt | 4 +++-
+ drivers/iio/adc/exynos_adc.c | 17 +++++++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt b/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
+index a10c1f89037de..e1fe02f3e3e9c 100644
+--- a/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
++++ b/Documentation/devicetree/bindings/iio/adc/samsung,exynos-adc.txt
+@@ -11,11 +11,13 @@ New driver handles the following
+
+ Required properties:
+ - compatible: Must be "samsung,exynos-adc-v1"
+- for exynos4412/5250 controllers.
++ for Exynos5250 controllers.
+ Must be "samsung,exynos-adc-v2" for
+ future controllers.
+ Must be "samsung,exynos3250-adc" for
+ controllers compatible with ADC of Exynos3250.
++ Must be "samsung,exynos4212-adc" for
++ controllers compatible with ADC of Exynos4212 and Exynos4412.
+ Must be "samsung,exynos7-adc" for
+ the ADC in Exynos7 and compatibles
+ Must be "samsung,s3c2410-adc" for
+diff --git a/drivers/iio/adc/exynos_adc.c b/drivers/iio/adc/exynos_adc.c
+index 41da522fc6735..1ca2c4d39f878 100644
+--- a/drivers/iio/adc/exynos_adc.c
++++ b/drivers/iio/adc/exynos_adc.c
+@@ -115,6 +115,7 @@
+ #define MAX_ADC_V2_CHANNELS 10
+ #define MAX_ADC_V1_CHANNELS 8
+ #define MAX_EXYNOS3250_ADC_CHANNELS 2
++#define MAX_EXYNOS4212_ADC_CHANNELS 4
+ #define MAX_S5PV210_ADC_CHANNELS 10
+
+ /* Bit definitions common for ADC_V1 and ADC_V2 */
+@@ -271,6 +272,19 @@ static void exynos_adc_v1_start_conv(struct exynos_adc *info,
+ writel(con1 | ADC_CON_EN_START, ADC_V1_CON(info->regs));
+ }
+
++/* Exynos4212 and 4412 is like ADCv1 but with four channels only */
++static const struct exynos_adc_data exynos4212_adc_data = {
++ .num_channels = MAX_EXYNOS4212_ADC_CHANNELS,
++ .mask = ADC_DATX_MASK, /* 12 bit ADC resolution */
++ .needs_adc_phy = true,
++ .phy_offset = EXYNOS_ADCV1_PHY_OFFSET,
++
++ .init_hw = exynos_adc_v1_init_hw,
++ .exit_hw = exynos_adc_v1_exit_hw,
++ .clear_irq = exynos_adc_v1_clear_irq,
++ .start_conv = exynos_adc_v1_start_conv,
++};
++
+ static const struct exynos_adc_data exynos_adc_v1_data = {
+ .num_channels = MAX_ADC_V1_CHANNELS,
+ .mask = ADC_DATX_MASK, /* 12 bit ADC resolution */
+@@ -492,6 +506,9 @@ static const struct of_device_id exynos_adc_match[] = {
+ }, {
+ .compatible = "samsung,s5pv210-adc",
+ .data = &exynos_adc_s5pv210_data,
++ }, {
++ .compatible = "samsung,exynos4212-adc",
++ .data = &exynos4212_adc_data,
+ }, {
+ .compatible = "samsung,exynos-adc-v1",
+ .data = &exynos_adc_v1_data,
+--
+2.20.1
+
--- /dev/null
+From e0146cf71023f06ca607626211181d35ed0ae111 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 18 Jul 2019 15:57:49 +0200
+Subject: iio: adc: gyroadc: fix uninitialized return code
+
+[ Upstream commit 90c6260c1905a68fb596844087f2223bd4657fee ]
+
+gcc-9 complains about a blatant uninitialized variable use that
+all earlier compiler versions missed:
+
+drivers/iio/adc/rcar-gyroadc.c:510:5: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized]
+
+Return -EINVAL instead here and a few lines above it where
+we accidentally return 0 on failure.
+
+Cc: stable@vger.kernel.org
+Fixes: 059c53b32329 ("iio: adc: Add Renesas GyroADC driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/rcar-gyroadc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/rcar-gyroadc.c b/drivers/iio/adc/rcar-gyroadc.c
+index dcb50172186f4..f3a966ab35dcb 100644
+--- a/drivers/iio/adc/rcar-gyroadc.c
++++ b/drivers/iio/adc/rcar-gyroadc.c
+@@ -391,7 +391,7 @@ static int rcar_gyroadc_parse_subdevs(struct iio_dev *indio_dev)
+ dev_err(dev,
+ "Only %i channels supported with %s, but reg = <%i>.\n",
+ num_channels, child->name, reg);
+- return ret;
++ return -EINVAL;
+ }
+ }
+
+@@ -400,7 +400,7 @@ static int rcar_gyroadc_parse_subdevs(struct iio_dev *indio_dev)
+ dev_err(dev,
+ "Channel %i uses different ADC mode than the rest.\n",
+ reg);
+- return ret;
++ return -EINVAL;
+ }
+
+ /* Channel is valid, grab the regulator. */
+--
+2.20.1
+
--- /dev/null
+From e2a491e12800f67ddf353870e65b51687fd70c97 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Sat, 20 Jul 2019 19:08:48 +0100
+Subject: iommu/iova: Remove stale cached32_node
+
+[ Upstream commit 9eed17d37c77171cf5ffb95c4257f87df3cd4c8f ]
+
+Since the cached32_node is allowed to be advanced above dma_32bit_pfn
+(to provide a shortcut into the limited range), we need to be careful to
+remove the to be freed node if it is the cached32_node.
+
+[ 48.477773] BUG: KASAN: use-after-free in __cached_rbnode_delete_update+0x68/0x110
+[ 48.477812] Read of size 8 at addr ffff88870fc19020 by task kworker/u8:1/37
+[ 48.477843]
+[ 48.477879] CPU: 1 PID: 37 Comm: kworker/u8:1 Tainted: G U 5.2.0+ #735
+[ 48.477915] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017
+[ 48.478047] Workqueue: i915 __i915_gem_free_work [i915]
+[ 48.478075] Call Trace:
+[ 48.478111] dump_stack+0x5b/0x90
+[ 48.478137] print_address_description+0x67/0x237
+[ 48.478178] ? __cached_rbnode_delete_update+0x68/0x110
+[ 48.478212] __kasan_report.cold.3+0x1c/0x38
+[ 48.478240] ? __cached_rbnode_delete_update+0x68/0x110
+[ 48.478280] ? __cached_rbnode_delete_update+0x68/0x110
+[ 48.478308] __cached_rbnode_delete_update+0x68/0x110
+[ 48.478344] private_free_iova+0x2b/0x60
+[ 48.478378] iova_magazine_free_pfns+0x46/0xa0
+[ 48.478403] free_iova_fast+0x277/0x340
+[ 48.478443] fq_ring_free+0x15a/0x1a0
+[ 48.478473] queue_iova+0x19c/0x1f0
+[ 48.478597] cleanup_page_dma.isra.64+0x62/0xb0 [i915]
+[ 48.478712] __gen8_ppgtt_cleanup+0x63/0x80 [i915]
+[ 48.478826] __gen8_ppgtt_cleanup+0x42/0x80 [i915]
+[ 48.478940] __gen8_ppgtt_clear+0x433/0x4b0 [i915]
+[ 48.479053] __gen8_ppgtt_clear+0x462/0x4b0 [i915]
+[ 48.479081] ? __sg_free_table+0x9e/0xf0
+[ 48.479116] ? kfree+0x7f/0x150
+[ 48.479234] i915_vma_unbind+0x1e2/0x240 [i915]
+[ 48.479352] i915_vma_destroy+0x3a/0x280 [i915]
+[ 48.479465] __i915_gem_free_objects+0xf0/0x2d0 [i915]
+[ 48.479579] __i915_gem_free_work+0x41/0xa0 [i915]
+[ 48.479607] process_one_work+0x495/0x710
+[ 48.479642] worker_thread+0x4c7/0x6f0
+[ 48.479687] ? process_one_work+0x710/0x710
+[ 48.479724] kthread+0x1b2/0x1d0
+[ 48.479774] ? kthread_create_worker_on_cpu+0xa0/0xa0
+[ 48.479820] ret_from_fork+0x1f/0x30
+[ 48.479864]
+[ 48.479907] Allocated by task 631:
+[ 48.479944] save_stack+0x19/0x80
+[ 48.479994] __kasan_kmalloc.constprop.6+0xc1/0xd0
+[ 48.480038] kmem_cache_alloc+0x91/0xf0
+[ 48.480082] alloc_iova+0x2b/0x1e0
+[ 48.480125] alloc_iova_fast+0x58/0x376
+[ 48.480166] intel_alloc_iova+0x90/0xc0
+[ 48.480214] intel_map_sg+0xde/0x1f0
+[ 48.480343] i915_gem_gtt_prepare_pages+0xb8/0x170 [i915]
+[ 48.480465] huge_get_pages+0x232/0x2b0 [i915]
+[ 48.480590] ____i915_gem_object_get_pages+0x40/0xb0 [i915]
+[ 48.480712] __i915_gem_object_get_pages+0x90/0xa0 [i915]
+[ 48.480834] i915_gem_object_prepare_write+0x2d6/0x330 [i915]
+[ 48.480955] create_test_object.isra.54+0x1a9/0x3e0 [i915]
+[ 48.481075] igt_shared_ctx_exec+0x365/0x3c0 [i915]
+[ 48.481210] __i915_subtests.cold.4+0x30/0x92 [i915]
+[ 48.481341] __run_selftests.cold.3+0xa9/0x119 [i915]
+[ 48.481466] i915_live_selftests+0x3c/0x70 [i915]
+[ 48.481583] i915_pci_probe+0xe7/0x220 [i915]
+[ 48.481620] pci_device_probe+0xe0/0x180
+[ 48.481665] really_probe+0x163/0x4e0
+[ 48.481710] device_driver_attach+0x85/0x90
+[ 48.481750] __driver_attach+0xa5/0x180
+[ 48.481796] bus_for_each_dev+0xda/0x130
+[ 48.481831] bus_add_driver+0x205/0x2e0
+[ 48.481882] driver_register+0xca/0x140
+[ 48.481927] do_one_initcall+0x6c/0x1af
+[ 48.481970] do_init_module+0x106/0x350
+[ 48.482010] load_module+0x3d2c/0x3ea0
+[ 48.482058] __do_sys_finit_module+0x110/0x180
+[ 48.482102] do_syscall_64+0x62/0x1f0
+[ 48.482147] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 48.482190]
+[ 48.482224] Freed by task 37:
+[ 48.482273] save_stack+0x19/0x80
+[ 48.482318] __kasan_slab_free+0x12e/0x180
+[ 48.482363] kmem_cache_free+0x70/0x140
+[ 48.482406] __free_iova+0x1d/0x30
+[ 48.482445] fq_ring_free+0x15a/0x1a0
+[ 48.482490] queue_iova+0x19c/0x1f0
+[ 48.482624] cleanup_page_dma.isra.64+0x62/0xb0 [i915]
+[ 48.482749] __gen8_ppgtt_cleanup+0x63/0x80 [i915]
+[ 48.482873] __gen8_ppgtt_cleanup+0x42/0x80 [i915]
+[ 48.482999] __gen8_ppgtt_clear+0x433/0x4b0 [i915]
+[ 48.483123] __gen8_ppgtt_clear+0x462/0x4b0 [i915]
+[ 48.483250] i915_vma_unbind+0x1e2/0x240 [i915]
+[ 48.483378] i915_vma_destroy+0x3a/0x280 [i915]
+[ 48.483500] __i915_gem_free_objects+0xf0/0x2d0 [i915]
+[ 48.483622] __i915_gem_free_work+0x41/0xa0 [i915]
+[ 48.483659] process_one_work+0x495/0x710
+[ 48.483704] worker_thread+0x4c7/0x6f0
+[ 48.483748] kthread+0x1b2/0x1d0
+[ 48.483787] ret_from_fork+0x1f/0x30
+[ 48.483831]
+[ 48.483868] The buggy address belongs to the object at ffff88870fc19000
+[ 48.483868] which belongs to the cache iommu_iova of size 40
+[ 48.483920] The buggy address is located 32 bytes inside of
+[ 48.483920] 40-byte region [ffff88870fc19000, ffff88870fc19028)
+[ 48.483964] The buggy address belongs to the page:
+[ 48.484006] page:ffffea001c3f0600 refcount:1 mapcount:0 mapping:ffff8888181a91c0 index:0x0 compound_mapcount: 0
+[ 48.484045] flags: 0x8000000000010200(slab|head)
+[ 48.484096] raw: 8000000000010200 ffffea001c421a08 ffffea001c447e88 ffff8888181a91c0
+[ 48.484141] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000
+[ 48.484188] page dumped because: kasan: bad access detected
+[ 48.484230]
+[ 48.484265] Memory state around the buggy address:
+[ 48.484314] ffff88870fc18f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 48.484361] ffff88870fc18f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 48.484406] >ffff88870fc19000: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
+[ 48.484451] ^
+[ 48.484494] ffff88870fc19080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+[ 48.484530] ffff88870fc19100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108602
+Fixes: e60aa7b53845 ("iommu/iova: Extend rbtree node caching")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Joerg Roedel <jroedel@suse.de>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: <stable@vger.kernel.org> # v4.15+
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iova.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 60348d707b993..9a576ae837dcb 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -148,8 +148,9 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free)
+ struct iova *cached_iova;
+
+ cached_iova = rb_entry(iovad->cached32_node, struct iova, node);
+- if (free->pfn_hi < iovad->dma_32bit_pfn &&
+- free->pfn_lo >= cached_iova->pfn_lo)
++ if (free == cached_iova ||
++ (free->pfn_hi < iovad->dma_32bit_pfn &&
++ free->pfn_lo >= cached_iova->pfn_lo))
+ iovad->cached32_node = rb_next(&free->node);
+
+ cached_iova = rb_entry(iovad->cached_node, struct iova, node);
+--
+2.20.1
+
--- /dev/null
+From cbb215fec197417c88d4e6ce13c459a16fbac3a6 Mon Sep 17 00:00:00 2001
+From: Ihab Zhaika <ihab.zhaika@intel.com>
+Date: Mon, 4 Feb 2019 10:16:03 +0200
+Subject: iwlwifi: add new card for 9260 series
+
+[ Upstream commit 3941310cf665b8a7965424d2a185c80782faa030 ]
+
+Add one PCI ID for 9260 series.
+
+CC: <stable@vger.kernel.org> # 4.14+
+Signed-off-by: Ihab Zhaika <ihab.zhaika@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index d3a1c13bcf6f1..0982bd99b1c3c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -601,6 +601,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x4018, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+--
+2.20.1
+
--- /dev/null
+From 7dcee13fd412a4e9c2f5d6991d779ebaee83c518 Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Wed, 15 Aug 2018 22:07:25 +0300
+Subject: iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules
+
+[ Upstream commit ab27926d9e4ae23df4f4d98e31f067c8b486bb4f ]
+
+The devices with PCI device ID 0x34F0 are part of the SoC and can be
+combined with some different external RF modules. The configuration
+for these devices should reflect that, but are currently mixed up. To
+avoid confusion with discrete devices, add part of the firmware to be
+used and the official name of the device to the cfg structs.
+
+This is least reorganization possible (without messing things even
+more) that could be done as a bugfix for this SoC. Further
+reorganization of this code will be done separately.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/cfg/22000.c | 65 ++++++++++++++++++-
+ .../net/wireless/intel/iwlwifi/iwl-config.h | 9 ++-
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 55 ++++++++--------
+ 3 files changed, 97 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index 91ca77c7571ce..b4347806a59ed 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -77,10 +77,13 @@
+ #define IWL_22000_HR_FW_PRE "iwlwifi-Qu-a0-hr-a0-"
+ #define IWL_22000_HR_CDB_FW_PRE "iwlwifi-QuIcp-z0-hrcdb-a0-"
+ #define IWL_22000_HR_A_F0_FW_PRE "iwlwifi-QuQnj-f0-hr-a0-"
+-#define IWL_22000_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_HR_B_F0_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_QU_B_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_HR_B_FW_PRE "iwlwifi-QuQnj-b0-hr-b0-"
+ #define IWL_22000_JF_B0_FW_PRE "iwlwifi-QuQnj-a0-jf-b0-"
+ #define IWL_22000_HR_A0_FW_PRE "iwlwifi-QuQnj-a0-hr-a0-"
+ #define IWL_22000_SU_Z0_FW_PRE "iwlwifi-su-z0-"
++#define IWL_QU_B_JF_B_FW_PRE "iwlwifi-Qu-b0-jf-b0-"
+
+ #define IWL_22000_HR_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
+@@ -88,7 +91,11 @@
+ IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_A_F0_FW_PRE __stringify(api) ".ucode"
+-#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
++#define IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(api) \
++ IWL_22000_HR_B_F0_FW_PRE __stringify(api) ".ucode"
++#define IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(api) \
++ IWL_22000_QU_B_HR_B_FW_PRE __stringify(api) ".ucode"
++#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
+@@ -96,6 +103,8 @@
+ IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
+ IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
++#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
++ IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+
+ #define NVM_HW_SECTION_NUM_FAMILY_22000 10
+
+@@ -190,7 +199,54 @@ const struct iwl_cfg iwl22000_2ac_cfg_jf = {
+
+ const struct iwl_cfg iwl22000_2ax_cfg_hr = {
+ .name = "Intel(R) Dual Band Wireless AX 22000",
+- .fw_name_pre = IWL_22000_HR_FW_PRE,
++ .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
++ IWL_DEVICE_22500,
++ /*
++ * This device doesn't support receiving BlockAck with a large bitmap
++ * so we need to restrict the size of transmitted aggregation to the
++ * HT size; mac80211 would otherwise pick the HE max (256) by default.
++ */
++ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
++};
++
++/*
++ * All JF radio modules are part of the 9000 series, but the MAC part
++ * looks more like 22000. That's why this device is here, but called
++ * 9560 nevertheless.
++ */
++const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9461",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9462",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9560",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl22000_2ax_cfg_jf = {
++ .name = "Intel(R) Dual Band Wireless AX 22000",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+@@ -264,7 +320,10 @@ const struct iwl_cfg iwl22560_2ax_cfg_su_cdb = {
+ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+index 12fddcf15bab3..2e9fd7a303985 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -574,11 +574,18 @@ extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
++extern const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl22000_2ax_cfg_jf;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0_f0;
++extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0_f0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0;
+ extern const struct iwl_cfg iwl22560_2ax_cfg_su_cdb;
+-#endif /* CONFIG_IWLMVM */
++#endif /* CPTCFG_IWLMVM || CPTCFG_IWLFMAC */
+
+ #endif /* __IWL_CONFIG_H__ */
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 5d65500a8aa75..d3a1c13bcf6f1 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -696,34 +696,33 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x4234, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x42A4, iwl9462_2ac_cfg_shared_clk)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++
++ {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ {IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_cfg_soc)},
+--
+2.20.1
+
--- /dev/null
+From ce7b14e552b31fe663518809e1966184efa7ed19 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 11 Jun 2019 23:00:07 +0800
+Subject: kernel/module: Fix mem leak in module_add_modinfo_attrs
+
+[ Upstream commit bc6f2a757d525e001268c3658bd88822e768f8db ]
+
+In module_add_modinfo_attrs if sysfs_create_file
+fails, we forget to free allocated modinfo_attrs
+and roll back the sysfs files.
+
+Fixes: 03e88ae1b13d ("[PATCH] fix module sysfs files reference counting")
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 2dec3d4a9b627..0d86fc73d63d1 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1694,6 +1694,8 @@ static int add_usage_links(struct module *mod)
+ return ret;
+ }
+
++static void module_remove_modinfo_attrs(struct module *mod, int end);
++
+ static int module_add_modinfo_attrs(struct module *mod)
+ {
+ struct module_attribute *attr;
+@@ -1708,24 +1710,34 @@ static int module_add_modinfo_attrs(struct module *mod)
+ return -ENOMEM;
+
+ temp_attr = mod->modinfo_attrs;
+- for (i = 0; (attr = modinfo_attrs[i]) && !error; i++) {
++ for (i = 0; (attr = modinfo_attrs[i]); i++) {
+ if (!attr->test || attr->test(mod)) {
+ memcpy(temp_attr, attr, sizeof(*temp_attr));
+ sysfs_attr_init(&temp_attr->attr);
+ error = sysfs_create_file(&mod->mkobj.kobj,
+ &temp_attr->attr);
++ if (error)
++ goto error_out;
+ ++temp_attr;
+ }
+ }
++
++ return 0;
++
++error_out:
++ if (i > 0)
++ module_remove_modinfo_attrs(mod, --i);
+ return error;
+ }
+
+-static void module_remove_modinfo_attrs(struct module *mod)
++static void module_remove_modinfo_attrs(struct module *mod, int end)
+ {
+ struct module_attribute *attr;
+ int i;
+
+ for (i = 0; (attr = &mod->modinfo_attrs[i]); i++) {
++ if (end >= 0 && i > end)
++ break;
+ /* pick a field to test for end of list */
+ if (!attr->attr.name)
+ break;
+@@ -1813,7 +1825,7 @@ static int mod_sysfs_setup(struct module *mod,
+ return 0;
+
+ out_unreg_modinfo_attrs:
+- module_remove_modinfo_attrs(mod);
++ module_remove_modinfo_attrs(mod, -1);
+ out_unreg_param:
+ module_param_sysfs_remove(mod);
+ out_unreg_holders:
+@@ -1849,7 +1861,7 @@ static void mod_sysfs_fini(struct module *mod)
+ {
+ }
+
+-static void module_remove_modinfo_attrs(struct module *mod)
++static void module_remove_modinfo_attrs(struct module *mod, int end)
+ {
+ }
+
+@@ -1865,7 +1877,7 @@ static void init_param_lock(struct module *mod)
+ static void mod_sysfs_teardown(struct module *mod)
+ {
+ del_usage_links(mod);
+- module_remove_modinfo_attrs(mod);
++ module_remove_modinfo_attrs(mod, -1);
+ module_param_sysfs_remove(mod);
+ kobject_put(mod->mkobj.drivers_dir);
+ kobject_put(mod->holders_dir);
+--
+2.20.1
+
--- /dev/null
+From e21ee8039e7687afcbefb1c3604367ce2b121212 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 28 Sep 2018 00:51:20 +0100
+Subject: keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
+
+[ Upstream commit 2ecefa0a15fd0ef88b9cd5d15ceb813008136431 ]
+
+The keyctl_dh_params struct in uapi/linux/keyctl.h contains the symbol
+"private" which means that the header file will cause compilation failure
+if #included in to a C++ program. Further, the patch that added the same
+struct to the keyutils package named the symbol "priv", not "private".
+
+The previous attempt to fix this (commit 8a2336e549d3) did so by simply
+renaming the kernel's copy of the field to dh_private, but this then breaks
+existing userspace and as such has been reverted (commit 8c0f9f5b309d).
+
+[And note, to those who think that wrapping the struct in extern "C" {}
+ will work: it won't; that only changes how symbol names are presented to
+ the assembler and linker.].
+
+Instead, insert an anonymous union around the "private" member and add a
+second member in there with the name "priv" to match the one in the
+keyutils package. The "private" member is then wrapped in !__cplusplus
+cpp-conditionals to hide it from C++.
+
+Fixes: ddbb41148724 ("KEYS: Add KEYCTL_DH_COMPUTE command")
+Fixes: 8a2336e549d3 ("uapi/linux/keyctl.h: don't use C++ reserved keyword as a struct member name")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Randy Dunlap <rdunlap@infradead.org>
+cc: Lubomir Rintel <lkundrak@v3.sk>
+cc: James Morris <jmorris@namei.org>
+cc: Mat Martineau <mathew.j.martineau@linux.intel.com>
+cc: Stephan Mueller <smueller@chronox.de>
+cc: Andrew Morton <akpm@linux-foundation.org>
+cc: Linus Torvalds <torvalds@linux-foundation.org>
+cc: stable@vger.kernel.org
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/keyctl.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
+index 7b8c9e19bad1c..0f3cb13db8e93 100644
+--- a/include/uapi/linux/keyctl.h
++++ b/include/uapi/linux/keyctl.h
+@@ -65,7 +65,12 @@
+
+ /* keyctl structures */
+ struct keyctl_dh_params {
+- __s32 private;
++ union {
++#ifndef __cplusplus
++ __s32 private;
++#endif
++ __s32 priv;
++ };
+ __s32 prime;
+ __s32 base;
+ };
+--
+2.20.1
+
--- /dev/null
+From b05a85c7d83bd52f57eb09d18a66d69598a47908 Mon Sep 17 00:00:00 2001
+From: Peter Xu <peterx@redhat.com>
+Date: Sun, 5 May 2019 16:56:42 +0800
+Subject: kvm: Check irqchip mode before assign irqfd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 654f1f13ea56b92bacade8ce2725aea0457f91c0 ]
+
+When assigning kvm irqfd we didn't check the irqchip mode but we allow
+KVM_IRQFD to succeed with all the irqchip modes. However it does not
+make much sense to create irqfd even without the kernel chips. Let's
+provide a arch-dependent helper to check whether a specific irqfd is
+allowed by the arch. At least for x86, it should make sense to check:
+
+- when irqchip mode is NONE, all irqfds should be disallowed, and,
+
+- when irqchip mode is SPLIT, irqfds that are with resamplefd should
+ be disallowed.
+
+For either of the case, previously we'll silently ignore the irq or
+the irq ack event if the irqchip mode is incorrect. However that can
+cause misterious guest behaviors and it can be hard to triage. Let's
+fail KVM_IRQFD even earlier to detect these incorrect configurations.
+
+CC: Paolo Bonzini <pbonzini@redhat.com>
+CC: Radim Krčmář <rkrcmar@redhat.com>
+CC: Alex Williamson <alex.williamson@redhat.com>
+CC: Eduardo Habkost <ehabkost@redhat.com>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/irq.c | 7 +++++++
+ arch/x86/kvm/irq.h | 1 +
+ virt/kvm/eventfd.c | 9 +++++++++
+ 3 files changed, 17 insertions(+)
+
+diff --git a/arch/x86/kvm/irq.c b/arch/x86/kvm/irq.c
+index faa264822cee3..007bc654f928a 100644
+--- a/arch/x86/kvm/irq.c
++++ b/arch/x86/kvm/irq.c
+@@ -172,3 +172,10 @@ void __kvm_migrate_timers(struct kvm_vcpu *vcpu)
+ __kvm_migrate_apic_timer(vcpu);
+ __kvm_migrate_pit_timer(vcpu);
+ }
++
++bool kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args)
++{
++ bool resample = args->flags & KVM_IRQFD_FLAG_RESAMPLE;
++
++ return resample ? irqchip_kernel(kvm) : irqchip_in_kernel(kvm);
++}
+diff --git a/arch/x86/kvm/irq.h b/arch/x86/kvm/irq.h
+index d5005cc265217..fd210cdd49839 100644
+--- a/arch/x86/kvm/irq.h
++++ b/arch/x86/kvm/irq.h
+@@ -114,6 +114,7 @@ static inline int irqchip_in_kernel(struct kvm *kvm)
+ return mode != KVM_IRQCHIP_NONE;
+ }
+
++bool kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args);
+ void kvm_inject_pending_timer_irqs(struct kvm_vcpu *vcpu);
+ void kvm_inject_apic_timer_irqs(struct kvm_vcpu *vcpu);
+ void kvm_apic_nmi_wd_deliver(struct kvm_vcpu *vcpu);
+diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
+index b20b751286fc6..757a17f5ebdeb 100644
+--- a/virt/kvm/eventfd.c
++++ b/virt/kvm/eventfd.c
+@@ -44,6 +44,12 @@
+
+ static struct workqueue_struct *irqfd_cleanup_wq;
+
++bool __attribute__((weak))
++kvm_arch_irqfd_allowed(struct kvm *kvm, struct kvm_irqfd *args)
++{
++ return true;
++}
++
+ static void
+ irqfd_inject(struct work_struct *work)
+ {
+@@ -297,6 +303,9 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
+ if (!kvm_arch_intc_initialized(kvm))
+ return -EAGAIN;
+
++ if (!kvm_arch_irqfd_allowed(kvm, args))
++ return -EINVAL;
++
+ irqfd = kzalloc(sizeof(*irqfd), GFP_KERNEL);
+ if (!irqfd)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 9f7bbcd9e5b259904d8fbaa2558dbba00506b11c Mon Sep 17 00:00:00 2001
+From: Ladi Prosek <lprosek@redhat.com>
+Date: Tue, 16 Oct 2018 18:49:59 +0200
+Subject: KVM: hyperv: define VP assist page helpers
+
+[ Upstream commit 72bbf9358c3676bd89dc4bd8fb0b1f2a11c288fc ]
+
+The state related to the VP assist page is still managed by the LAPIC
+code in the pv_eoi field.
+
+Signed-off-by: Ladi Prosek <lprosek@redhat.com>
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Liran Alon <liran.alon@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/hyperv.c | 23 +++++++++++++++++++++--
+ arch/x86/kvm/hyperv.h | 4 ++++
+ arch/x86/kvm/lapic.c | 4 ++--
+ arch/x86/kvm/lapic.h | 2 +-
+ arch/x86/kvm/x86.c | 2 +-
+ 5 files changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 2bb554b90b3c2..5842c5f587fe9 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -691,6 +691,24 @@ void kvm_hv_vcpu_uninit(struct kvm_vcpu *vcpu)
+ stimer_cleanup(&hv_vcpu->stimer[i]);
+ }
+
++bool kvm_hv_assist_page_enabled(struct kvm_vcpu *vcpu)
++{
++ if (!(vcpu->arch.hyperv.hv_vapic & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE))
++ return false;
++ return vcpu->arch.pv_eoi.msr_val & KVM_MSR_ENABLED;
++}
++EXPORT_SYMBOL_GPL(kvm_hv_assist_page_enabled);
++
++bool kvm_hv_get_assist_page(struct kvm_vcpu *vcpu,
++ struct hv_vp_assist_page *assist_page)
++{
++ if (!kvm_hv_assist_page_enabled(vcpu))
++ return false;
++ return !kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.pv_eoi.data,
++ assist_page, sizeof(*assist_page));
++}
++EXPORT_SYMBOL_GPL(kvm_hv_get_assist_page);
++
+ static void stimer_prepare_msg(struct kvm_vcpu_hv_stimer *stimer)
+ {
+ struct hv_message *msg = &stimer->msg;
+@@ -1076,7 +1094,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+
+ if (!(data & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE)) {
+ hv_vcpu->hv_vapic = data;
+- if (kvm_lapic_enable_pv_eoi(vcpu, 0))
++ if (kvm_lapic_enable_pv_eoi(vcpu, 0, 0))
+ return 1;
+ break;
+ }
+@@ -1089,7 +1107,8 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ hv_vcpu->hv_vapic = data;
+ kvm_vcpu_mark_page_dirty(vcpu, gfn);
+ if (kvm_lapic_enable_pv_eoi(vcpu,
+- gfn_to_gpa(gfn) | KVM_MSR_ENABLED))
++ gfn_to_gpa(gfn) | KVM_MSR_ENABLED,
++ sizeof(struct hv_vp_assist_page)))
+ return 1;
+ break;
+ }
+diff --git a/arch/x86/kvm/hyperv.h b/arch/x86/kvm/hyperv.h
+index d6aa969e20f19..0e66c12ed2c3d 100644
+--- a/arch/x86/kvm/hyperv.h
++++ b/arch/x86/kvm/hyperv.h
+@@ -62,6 +62,10 @@ void kvm_hv_vcpu_init(struct kvm_vcpu *vcpu);
+ void kvm_hv_vcpu_postcreate(struct kvm_vcpu *vcpu);
+ void kvm_hv_vcpu_uninit(struct kvm_vcpu *vcpu);
+
++bool kvm_hv_assist_page_enabled(struct kvm_vcpu *vcpu);
++bool kvm_hv_get_assist_page(struct kvm_vcpu *vcpu,
++ struct hv_vp_assist_page *assist_page);
++
+ static inline struct kvm_vcpu_hv_stimer *vcpu_to_stimer(struct kvm_vcpu *vcpu,
+ int timer_index)
+ {
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 5f5bc59768042..5427fd0aa97e1 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2633,7 +2633,7 @@ int kvm_hv_vapic_msr_read(struct kvm_vcpu *vcpu, u32 reg, u64 *data)
+ return 0;
+ }
+
+-int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
++int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data, unsigned long len)
+ {
+ u64 addr = data & ~KVM_MSR_ENABLED;
+ if (!IS_ALIGNED(addr, 4))
+@@ -2643,7 +2643,7 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
+ if (!pv_eoi_enabled(vcpu))
+ return 0;
+ return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
+- addr, sizeof(u8));
++ addr, len);
+ }
+
+ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h
+index ed0ed39abd369..ff6ef9c3d760c 100644
+--- a/arch/x86/kvm/lapic.h
++++ b/arch/x86/kvm/lapic.h
+@@ -120,7 +120,7 @@ static inline bool kvm_hv_vapic_assist_page_enabled(struct kvm_vcpu *vcpu)
+ return vcpu->arch.hyperv.hv_vapic & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE;
+ }
+
+-int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data);
++int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data, unsigned long len);
+ void kvm_lapic_init(void);
+ void kvm_lapic_exit(void);
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index c27ce60590905..86e35df8fbce3 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2494,7 +2494,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+
+ break;
+ case MSR_KVM_PV_EOI_EN:
+- if (kvm_lapic_enable_pv_eoi(vcpu, data))
++ if (kvm_lapic_enable_pv_eoi(vcpu, data, sizeof(u8)))
+ return 1;
+ break;
+
+--
+2.20.1
+
--- /dev/null
+From 3c7d17e10ce76da5dfd41c29176d51e8cf5e8309 Mon Sep 17 00:00:00 2001
+From: Ben Gardon <bgardon@google.com>
+Date: Mon, 8 Apr 2019 11:07:30 -0700
+Subject: kvm: mmu: Fix overflow on kvm mmu page limit calculation
+
+[ Upstream commit bc8a3d8925a8fa09fa550e0da115d95851ce33c6 ]
+
+KVM bases its memory usage limits on the total number of guest pages
+across all memslots. However, those limits, and the calculations to
+produce them, use 32 bit unsigned integers. This can result in overflow
+if a VM has more guest pages that can be represented by a u32. As a
+result of this overflow, KVM can use a low limit on the number of MMU
+pages it will allocate. This makes KVM unable to map all of guest memory
+at once, prompting spurious faults.
+
+Tested: Ran all kvm-unit-tests on an Intel Haswell machine. This patch
+ introduced no new failures.
+
+Signed-off-by: Ben Gardon <bgardon@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/kvm_host.h | 12 ++++++------
+ arch/x86/kvm/mmu.c | 13 ++++++-------
+ arch/x86/kvm/mmu.h | 2 +-
+ arch/x86/kvm/x86.c | 4 ++--
+ 4 files changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index b6417454a9d79..0d3f5cf3ff3ea 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -117,7 +117,7 @@ static inline gfn_t gfn_to_index(gfn_t gfn, gfn_t base_gfn, int level)
+ }
+
+ #define KVM_PERMILLE_MMU_PAGES 20
+-#define KVM_MIN_ALLOC_MMU_PAGES 64
++#define KVM_MIN_ALLOC_MMU_PAGES 64UL
+ #define KVM_MMU_HASH_SHIFT 12
+ #define KVM_NUM_MMU_PAGES (1 << KVM_MMU_HASH_SHIFT)
+ #define KVM_MIN_FREE_MMU_PAGES 5
+@@ -796,9 +796,9 @@ enum kvm_irqchip_mode {
+ };
+
+ struct kvm_arch {
+- unsigned int n_used_mmu_pages;
+- unsigned int n_requested_mmu_pages;
+- unsigned int n_max_mmu_pages;
++ unsigned long n_used_mmu_pages;
++ unsigned long n_requested_mmu_pages;
++ unsigned long n_max_mmu_pages;
+ unsigned int indirect_shadow_pages;
+ unsigned long mmu_valid_gen;
+ struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
+@@ -1201,8 +1201,8 @@ void kvm_mmu_clear_dirty_pt_masked(struct kvm *kvm,
+ gfn_t gfn_offset, unsigned long mask);
+ void kvm_mmu_zap_all(struct kvm *kvm);
+ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen);
+-unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
+-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int kvm_nr_mmu_pages);
++unsigned long kvm_mmu_calculate_mmu_pages(struct kvm *kvm);
++void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long kvm_nr_mmu_pages);
+
+ int load_pdptrs(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, unsigned long cr3);
+ bool pdptrs_changed(struct kvm_vcpu *vcpu);
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index cdc0c460950f3..88940261fb537 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1954,7 +1954,7 @@ static int is_empty_shadow_page(u64 *spt)
+ * aggregate version in order to make the slab shrinker
+ * faster
+ */
+-static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, int nr)
++static inline void kvm_mod_used_mmu_pages(struct kvm *kvm, unsigned long nr)
+ {
+ kvm->arch.n_used_mmu_pages += nr;
+ percpu_counter_add(&kvm_total_used_mmu_pages, nr);
+@@ -2704,7 +2704,7 @@ static bool prepare_zap_oldest_mmu_page(struct kvm *kvm,
+ * Changing the number of mmu pages allocated to the vm
+ * Note: if goal_nr_mmu_pages is too small, you will get dead lock
+ */
+-void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned int goal_nr_mmu_pages)
++void kvm_mmu_change_mmu_pages(struct kvm *kvm, unsigned long goal_nr_mmu_pages)
+ {
+ LIST_HEAD(invalid_list);
+
+@@ -5926,10 +5926,10 @@ out:
+ /*
+ * Caculate mmu pages needed for kvm.
+ */
+-unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
++unsigned long kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
+ {
+- unsigned int nr_mmu_pages;
+- unsigned int nr_pages = 0;
++ unsigned long nr_mmu_pages;
++ unsigned long nr_pages = 0;
+ struct kvm_memslots *slots;
+ struct kvm_memory_slot *memslot;
+ int i;
+@@ -5942,8 +5942,7 @@ unsigned int kvm_mmu_calculate_mmu_pages(struct kvm *kvm)
+ }
+
+ nr_mmu_pages = nr_pages * KVM_PERMILLE_MMU_PAGES / 1000;
+- nr_mmu_pages = max(nr_mmu_pages,
+- (unsigned int) KVM_MIN_ALLOC_MMU_PAGES);
++ nr_mmu_pages = max(nr_mmu_pages, KVM_MIN_ALLOC_MMU_PAGES);
+
+ return nr_mmu_pages;
+ }
+diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
+index 1fab69c0b2f32..65892288bf510 100644
+--- a/arch/x86/kvm/mmu.h
++++ b/arch/x86/kvm/mmu.h
+@@ -69,7 +69,7 @@ bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
+ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code,
+ u64 fault_address, char *insn, int insn_len);
+
+-static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
++static inline unsigned long kvm_mmu_available_pages(struct kvm *kvm)
+ {
+ if (kvm->arch.n_max_mmu_pages > kvm->arch.n_used_mmu_pages)
+ return kvm->arch.n_max_mmu_pages -
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 86e35df8fbce3..33b2e3e07f925 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4116,7 +4116,7 @@ static int kvm_vm_ioctl_set_identity_map_addr(struct kvm *kvm,
+ }
+
+ static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
+- u32 kvm_nr_mmu_pages)
++ unsigned long kvm_nr_mmu_pages)
+ {
+ if (kvm_nr_mmu_pages < KVM_MIN_ALLOC_MMU_PAGES)
+ return -EINVAL;
+@@ -4130,7 +4130,7 @@ static int kvm_vm_ioctl_set_nr_mmu_pages(struct kvm *kvm,
+ return 0;
+ }
+
+-static int kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
++static unsigned long kvm_vm_ioctl_get_nr_mmu_pages(struct kvm *kvm)
+ {
+ return kvm->arch.n_max_mmu_pages;
+ }
+--
+2.20.1
+
--- /dev/null
+From c7229c5357de2af96abf83104f6e9369e35917bb Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Thu, 20 Jun 2019 16:00:40 +1000
+Subject: KVM: PPC: Book3S HV: Fix CR0 setting in TM emulation
+
+[ Upstream commit 3fefd1cd95df04da67c83c1cb93b663f04b3324f ]
+
+When emulating tsr, treclaim and trechkpt, we incorrectly set CR0. The
+code currently sets:
+ CR0 <- 00 || MSR[TS]
+but according to the ISA it should be:
+ CR0 <- 0 || MSR[TS] || 0
+
+This fixes the bit shift to put the bits in the correct location.
+
+This is a data integrity issue as CR0 is corrupted.
+
+Fixes: 4bb3c7a0208f ("KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9")
+Cc: stable@vger.kernel.org # v4.17+
+Tested-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv_tm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv_tm.c b/arch/powerpc/kvm/book3s_hv_tm.c
+index 888e2609e3f15..31cd0f327c8a2 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm.c
++++ b/arch/powerpc/kvm/book3s_hv_tm.c
+@@ -131,7 +131,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ }
+ /* Set CR0 to indicate previous transactional state */
+ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ /* L=1 => tresume, L=0 => tsuspend */
+ if (instr & (1 << 21)) {
+ if (MSR_TM_SUSPENDED(msr))
+@@ -175,7 +175,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+
+ /* Set CR0 to indicate previous transactional state */
+ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK;
+ return RESUME_GUEST;
+
+@@ -205,7 +205,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+
+ /* Set CR0 to indicate previous transactional state */
+ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ vcpu->arch.shregs.msr = msr | MSR_TS_S;
+ return RESUME_GUEST;
+ }
+--
+2.20.1
+
--- /dev/null
+From 5b2401c6c6e864183c20ae676564ab9393f407f5 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Fri, 16 Nov 2018 21:28:18 +1100
+Subject: KVM: PPC: Book3S HV: Fix race between kvm_unmap_hva_range and MMU
+ mode switch
+
+[ Upstream commit 234ff0b729ad882d20f7996591a964965647addf ]
+
+Testing has revealed an occasional crash which appears to be caused
+by a race between kvmppc_switch_mmu_to_hpt and kvm_unmap_hva_range_hv.
+The symptom is a NULL pointer dereference in __find_linux_pte() called
+from kvm_unmap_radix() with kvm->arch.pgtable == NULL.
+
+Looking at kvmppc_switch_mmu_to_hpt(), it does indeed clear
+kvm->arch.pgtable (via kvmppc_free_radix()) before setting
+kvm->arch.radix to NULL, and there is nothing to prevent
+kvm_unmap_hva_range_hv() or the other MMU callback functions from
+being called concurrently with kvmppc_switch_mmu_to_hpt() or
+kvmppc_switch_mmu_to_radix().
+
+This patch therefore adds calls to spin_lock/unlock on the kvm->mmu_lock
+around the assignments to kvm->arch.radix, and makes sure that the
+partition-scoped radix tree or HPT is only freed after changing
+kvm->arch.radix.
+
+This also takes the kvm->mmu_lock in kvmppc_rmap_reset() to make sure
+that the clearing of each rmap array (one per memslot) doesn't happen
+concurrently with use of the array in the kvm_unmap_hva_range_hv()
+or the other MMU callbacks.
+
+Fixes: 18c3640cefc7 ("KVM: PPC: Book3S HV: Add infrastructure for running HPT guests on radix host")
+Cc: stable@vger.kernel.org # v4.15+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_64_mmu_hv.c | 3 +++
+ arch/powerpc/kvm/book3s_hv.c | 15 +++++++++++----
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+index 68e14afecac85..a488c105b9234 100644
+--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
+@@ -744,12 +744,15 @@ void kvmppc_rmap_reset(struct kvm *kvm)
+ srcu_idx = srcu_read_lock(&kvm->srcu);
+ slots = kvm_memslots(kvm);
+ kvm_for_each_memslot(memslot, slots) {
++ /* Mutual exclusion with kvm_unmap_hva_range etc. */
++ spin_lock(&kvm->mmu_lock);
+ /*
+ * This assumes it is acceptable to lose reference and
+ * change bits across a reset.
+ */
+ memset(memslot->arch.rmap, 0,
+ memslot->npages * sizeof(*memslot->arch.rmap));
++ spin_unlock(&kvm->mmu_lock);
+ }
+ srcu_read_unlock(&kvm->srcu, srcu_idx);
+ }
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 083dcedba11ce..9595db30e6b87 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -3813,12 +3813,15 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
+ /* Must be called with kvm->lock held and mmu_ready = 0 and no vcpus running */
+ int kvmppc_switch_mmu_to_hpt(struct kvm *kvm)
+ {
++ kvmppc_rmap_reset(kvm);
++ kvm->arch.process_table = 0;
++ /* Mutual exclusion with kvm_unmap_hva_range etc. */
++ spin_lock(&kvm->mmu_lock);
++ kvm->arch.radix = 0;
++ spin_unlock(&kvm->mmu_lock);
+ kvmppc_free_radix(kvm);
+ kvmppc_update_lpcr(kvm, LPCR_VPM1,
+ LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);
+- kvmppc_rmap_reset(kvm);
+- kvm->arch.radix = 0;
+- kvm->arch.process_table = 0;
+ return 0;
+ }
+
+@@ -3831,10 +3834,14 @@ int kvmppc_switch_mmu_to_radix(struct kvm *kvm)
+ if (err)
+ return err;
+
++ kvmppc_rmap_reset(kvm);
++ /* Mutual exclusion with kvm_unmap_hva_range etc. */
++ spin_lock(&kvm->mmu_lock);
++ kvm->arch.radix = 1;
++ spin_unlock(&kvm->mmu_lock);
+ kvmppc_free_hpt(&kvm->arch.hpt);
+ kvmppc_update_lpcr(kvm, LPCR_UPRT | LPCR_GTSE | LPCR_HR,
+ LPCR_VPM1 | LPCR_UPRT | LPCR_GTSE | LPCR_HR);
+- kvm->arch.radix = 1;
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 06a61a298b849ee69ce7d40edeb3213f821233d1 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 8 Oct 2018 16:30:58 +1100
+Subject: KVM: PPC: Use ccr field in pt_regs struct embedded in vcpu struct
+
+[ Upstream commit fd0944baad806dfb4c777124ec712c55b714ff51 ]
+
+When the 'regs' field was added to struct kvm_vcpu_arch, the code
+was changed to use several of the fields inside regs (e.g., gpr, lr,
+etc.) but not the ccr field, because the ccr field in struct pt_regs
+is 64 bits on 64-bit platforms, but the cr field in kvm_vcpu_arch is
+only 32 bits. This changes the code to use the regs.ccr field
+instead of cr, and changes the assembly code on 64-bit platforms to
+use 64-bit loads and stores instead of 32-bit ones.
+
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/kvm_book3s.h | 4 ++--
+ arch/powerpc/include/asm/kvm_book3s_64.h | 4 ++--
+ arch/powerpc/include/asm/kvm_booke.h | 4 ++--
+ arch/powerpc/include/asm/kvm_host.h | 2 --
+ arch/powerpc/kernel/asm-offsets.c | 4 ++--
+ arch/powerpc/kvm/book3s_emulate.c | 12 ++++++------
+ arch/powerpc/kvm/book3s_hv.c | 4 ++--
+ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 4 ++--
+ arch/powerpc/kvm/book3s_hv_tm.c | 6 +++---
+ arch/powerpc/kvm/book3s_hv_tm_builtin.c | 5 +++--
+ arch/powerpc/kvm/book3s_pr.c | 4 ++--
+ arch/powerpc/kvm/bookehv_interrupts.S | 8 ++++----
+ arch/powerpc/kvm/emulate_loadstore.c | 1 -
+ 13 files changed, 30 insertions(+), 32 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/kvm_book3s.h b/arch/powerpc/include/asm/kvm_book3s.h
+index 83a9aa3cf6891..dd18d8174504f 100644
+--- a/arch/powerpc/include/asm/kvm_book3s.h
++++ b/arch/powerpc/include/asm/kvm_book3s.h
+@@ -301,12 +301,12 @@ static inline ulong kvmppc_get_gpr(struct kvm_vcpu *vcpu, int num)
+
+ static inline void kvmppc_set_cr(struct kvm_vcpu *vcpu, u32 val)
+ {
+- vcpu->arch.cr = val;
++ vcpu->arch.regs.ccr = val;
+ }
+
+ static inline u32 kvmppc_get_cr(struct kvm_vcpu *vcpu)
+ {
+- return vcpu->arch.cr;
++ return vcpu->arch.regs.ccr;
+ }
+
+ static inline void kvmppc_set_xer(struct kvm_vcpu *vcpu, ulong val)
+diff --git a/arch/powerpc/include/asm/kvm_book3s_64.h b/arch/powerpc/include/asm/kvm_book3s_64.h
+index dc435a5af7d6c..14fa07c73f44d 100644
+--- a/arch/powerpc/include/asm/kvm_book3s_64.h
++++ b/arch/powerpc/include/asm/kvm_book3s_64.h
+@@ -482,7 +482,7 @@ static inline u64 sanitize_msr(u64 msr)
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ static inline void copy_from_checkpoint(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.cr = vcpu->arch.cr_tm;
++ vcpu->arch.regs.ccr = vcpu->arch.cr_tm;
+ vcpu->arch.regs.xer = vcpu->arch.xer_tm;
+ vcpu->arch.regs.link = vcpu->arch.lr_tm;
+ vcpu->arch.regs.ctr = vcpu->arch.ctr_tm;
+@@ -499,7 +499,7 @@ static inline void copy_from_checkpoint(struct kvm_vcpu *vcpu)
+
+ static inline void copy_to_checkpoint(struct kvm_vcpu *vcpu)
+ {
+- vcpu->arch.cr_tm = vcpu->arch.cr;
++ vcpu->arch.cr_tm = vcpu->arch.regs.ccr;
+ vcpu->arch.xer_tm = vcpu->arch.regs.xer;
+ vcpu->arch.lr_tm = vcpu->arch.regs.link;
+ vcpu->arch.ctr_tm = vcpu->arch.regs.ctr;
+diff --git a/arch/powerpc/include/asm/kvm_booke.h b/arch/powerpc/include/asm/kvm_booke.h
+index d513e3ed1c659..f0cef625f17ce 100644
+--- a/arch/powerpc/include/asm/kvm_booke.h
++++ b/arch/powerpc/include/asm/kvm_booke.h
+@@ -46,12 +46,12 @@ static inline ulong kvmppc_get_gpr(struct kvm_vcpu *vcpu, int num)
+
+ static inline void kvmppc_set_cr(struct kvm_vcpu *vcpu, u32 val)
+ {
+- vcpu->arch.cr = val;
++ vcpu->arch.regs.ccr = val;
+ }
+
+ static inline u32 kvmppc_get_cr(struct kvm_vcpu *vcpu)
+ {
+- return vcpu->arch.cr;
++ return vcpu->arch.regs.ccr;
+ }
+
+ static inline void kvmppc_set_xer(struct kvm_vcpu *vcpu, ulong val)
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index 2b6049e839706..2f95e38f05491 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -538,8 +538,6 @@ struct kvm_vcpu_arch {
+ ulong tar;
+ #endif
+
+- u32 cr;
+-
+ #ifdef CONFIG_PPC_BOOK3S
+ ulong hflags;
+ ulong guest_owned_ext;
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index 89cf15566c4e8..7c3738d890e8b 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -438,7 +438,7 @@ int main(void)
+ #ifdef CONFIG_PPC_BOOK3S
+ OFFSET(VCPU_TAR, kvm_vcpu, arch.tar);
+ #endif
+- OFFSET(VCPU_CR, kvm_vcpu, arch.cr);
++ OFFSET(VCPU_CR, kvm_vcpu, arch.regs.ccr);
+ OFFSET(VCPU_PC, kvm_vcpu, arch.regs.nip);
+ #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+ OFFSET(VCPU_MSR, kvm_vcpu, arch.shregs.msr);
+@@ -695,7 +695,7 @@ int main(void)
+ #endif /* CONFIG_PPC_BOOK3S_64 */
+
+ #else /* CONFIG_PPC_BOOK3S */
+- OFFSET(VCPU_CR, kvm_vcpu, arch.cr);
++ OFFSET(VCPU_CR, kvm_vcpu, arch.regs.ccr);
+ OFFSET(VCPU_XER, kvm_vcpu, arch.regs.xer);
+ OFFSET(VCPU_LR, kvm_vcpu, arch.regs.link);
+ OFFSET(VCPU_CTR, kvm_vcpu, arch.regs.ctr);
+diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
+index 36b11c5a0dbb9..2654df220d054 100644
+--- a/arch/powerpc/kvm/book3s_emulate.c
++++ b/arch/powerpc/kvm/book3s_emulate.c
+@@ -110,7 +110,7 @@ static inline void kvmppc_copyto_vcpu_tm(struct kvm_vcpu *vcpu)
+ vcpu->arch.ctr_tm = vcpu->arch.regs.ctr;
+ vcpu->arch.tar_tm = vcpu->arch.tar;
+ vcpu->arch.lr_tm = vcpu->arch.regs.link;
+- vcpu->arch.cr_tm = vcpu->arch.cr;
++ vcpu->arch.cr_tm = vcpu->arch.regs.ccr;
+ vcpu->arch.xer_tm = vcpu->arch.regs.xer;
+ vcpu->arch.vrsave_tm = vcpu->arch.vrsave;
+ }
+@@ -129,7 +129,7 @@ static inline void kvmppc_copyfrom_vcpu_tm(struct kvm_vcpu *vcpu)
+ vcpu->arch.regs.ctr = vcpu->arch.ctr_tm;
+ vcpu->arch.tar = vcpu->arch.tar_tm;
+ vcpu->arch.regs.link = vcpu->arch.lr_tm;
+- vcpu->arch.cr = vcpu->arch.cr_tm;
++ vcpu->arch.regs.ccr = vcpu->arch.cr_tm;
+ vcpu->arch.regs.xer = vcpu->arch.xer_tm;
+ vcpu->arch.vrsave = vcpu->arch.vrsave_tm;
+ }
+@@ -141,7 +141,7 @@ static void kvmppc_emulate_treclaim(struct kvm_vcpu *vcpu, int ra_val)
+ uint64_t texasr;
+
+ /* CR0 = 0 | MSR[TS] | 0 */
+- vcpu->arch.cr = (vcpu->arch.cr & ~(CR0_MASK << CR0_SHIFT)) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & ~(CR0_MASK << CR0_SHIFT)) |
+ (((guest_msr & MSR_TS_MASK) >> (MSR_TS_S_LG - 1))
+ << CR0_SHIFT);
+
+@@ -220,7 +220,7 @@ void kvmppc_emulate_tabort(struct kvm_vcpu *vcpu, int ra_val)
+ tm_abort(ra_val);
+
+ /* CR0 = 0 | MSR[TS] | 0 */
+- vcpu->arch.cr = (vcpu->arch.cr & ~(CR0_MASK << CR0_SHIFT)) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & ~(CR0_MASK << CR0_SHIFT)) |
+ (((guest_msr & MSR_TS_MASK) >> (MSR_TS_S_LG - 1))
+ << CR0_SHIFT);
+
+@@ -494,8 +494,8 @@ int kvmppc_core_emulate_op_pr(struct kvm_run *run, struct kvm_vcpu *vcpu,
+
+ if (!(kvmppc_get_msr(vcpu) & MSR_PR)) {
+ preempt_disable();
+- vcpu->arch.cr = (CR0_TBEGIN_FAILURE |
+- (vcpu->arch.cr & ~(CR0_MASK << CR0_SHIFT)));
++ vcpu->arch.regs.ccr = (CR0_TBEGIN_FAILURE |
++ (vcpu->arch.regs.ccr & ~(CR0_MASK << CR0_SHIFT)));
+
+ vcpu->arch.texasr = (TEXASR_FS | TEXASR_EXACT |
+ (((u64)(TM_CAUSE_EMULATE | TM_CAUSE_PERSISTENT))
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 9595db30e6b87..05b32cc12e417 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -410,8 +410,8 @@ static void kvmppc_dump_regs(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.sprg0, vcpu->arch.shregs.sprg1);
+ pr_err("sprg2 = %.16llx sprg3 = %.16llx\n",
+ vcpu->arch.shregs.sprg2, vcpu->arch.shregs.sprg3);
+- pr_err("cr = %.8x xer = %.16lx dsisr = %.8x\n",
+- vcpu->arch.cr, vcpu->arch.regs.xer, vcpu->arch.shregs.dsisr);
++ pr_err("cr = %.8lx xer = %.16lx dsisr = %.8x\n",
++ vcpu->arch.regs.ccr, vcpu->arch.regs.xer, vcpu->arch.shregs.dsisr);
+ pr_err("dar = %.16llx\n", vcpu->arch.shregs.dar);
+ pr_err("fault dar = %.16lx dsisr = %.8x\n",
+ vcpu->arch.fault_dar, vcpu->arch.fault_dsisr);
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 5902a60f92268..68c7591f2b5f7 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -1209,7 +1209,7 @@ BEGIN_FTR_SECTION
+ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
+
+ ld r5, VCPU_LR(r4)
+- lwz r6, VCPU_CR(r4)
++ ld r6, VCPU_CR(r4)
+ mtlr r5
+ mtcr r6
+
+@@ -1320,7 +1320,7 @@ kvmppc_interrupt_hv:
+ std r3, VCPU_GPR(R12)(r9)
+ /* CR is in the high half of r12 */
+ srdi r4, r12, 32
+- stw r4, VCPU_CR(r9)
++ std r4, VCPU_CR(r9)
+ BEGIN_FTR_SECTION
+ ld r3, HSTATE_CFAR(r13)
+ std r3, VCPU_CFAR(r9)
+diff --git a/arch/powerpc/kvm/book3s_hv_tm.c b/arch/powerpc/kvm/book3s_hv_tm.c
+index 008285058f9b5..888e2609e3f15 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm.c
++++ b/arch/powerpc/kvm/book3s_hv_tm.c
+@@ -130,7 +130,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ return RESUME_GUEST;
+ }
+ /* Set CR0 to indicate previous transactional state */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
+ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
+ /* L=1 => tresume, L=0 => tsuspend */
+ if (instr & (1 << 21)) {
+@@ -174,7 +174,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ copy_from_checkpoint(vcpu);
+
+ /* Set CR0 to indicate previous transactional state */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
+ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK;
+ return RESUME_GUEST;
+@@ -204,7 +204,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ copy_to_checkpoint(vcpu);
+
+ /* Set CR0 to indicate previous transactional state */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
+ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
+ vcpu->arch.shregs.msr = msr | MSR_TS_S;
+ return RESUME_GUEST;
+diff --git a/arch/powerpc/kvm/book3s_hv_tm_builtin.c b/arch/powerpc/kvm/book3s_hv_tm_builtin.c
+index b2c7c6fca4f96..3cf5863bc06e8 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm_builtin.c
++++ b/arch/powerpc/kvm/book3s_hv_tm_builtin.c
+@@ -89,7 +89,8 @@ int kvmhv_p9_tm_emulation_early(struct kvm_vcpu *vcpu)
+ if (instr & (1 << 21))
+ vcpu->arch.shregs.msr = (msr & ~MSR_TS_MASK) | MSR_TS_T;
+ /* Set CR0 to 0b0010 */
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) | 0x20000000;
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) |
++ 0x20000000;
+ return 1;
+ }
+
+@@ -105,5 +106,5 @@ void kvmhv_emulate_tm_rollback(struct kvm_vcpu *vcpu)
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK; /* go to N state */
+ vcpu->arch.regs.nip = vcpu->arch.tfhar;
+ copy_from_checkpoint(vcpu);
+- vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) | 0xa0000000;
++ vcpu->arch.regs.ccr = (vcpu->arch.regs.ccr & 0x0fffffff) | 0xa0000000;
+ }
+diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c
+index 614ebb4261f76..de9702219dee9 100644
+--- a/arch/powerpc/kvm/book3s_pr.c
++++ b/arch/powerpc/kvm/book3s_pr.c
+@@ -167,7 +167,7 @@ void kvmppc_copy_to_svcpu(struct kvm_vcpu *vcpu)
+ svcpu->gpr[11] = vcpu->arch.regs.gpr[11];
+ svcpu->gpr[12] = vcpu->arch.regs.gpr[12];
+ svcpu->gpr[13] = vcpu->arch.regs.gpr[13];
+- svcpu->cr = vcpu->arch.cr;
++ svcpu->cr = vcpu->arch.regs.ccr;
+ svcpu->xer = vcpu->arch.regs.xer;
+ svcpu->ctr = vcpu->arch.regs.ctr;
+ svcpu->lr = vcpu->arch.regs.link;
+@@ -249,7 +249,7 @@ void kvmppc_copy_from_svcpu(struct kvm_vcpu *vcpu)
+ vcpu->arch.regs.gpr[11] = svcpu->gpr[11];
+ vcpu->arch.regs.gpr[12] = svcpu->gpr[12];
+ vcpu->arch.regs.gpr[13] = svcpu->gpr[13];
+- vcpu->arch.cr = svcpu->cr;
++ vcpu->arch.regs.ccr = svcpu->cr;
+ vcpu->arch.regs.xer = svcpu->xer;
+ vcpu->arch.regs.ctr = svcpu->ctr;
+ vcpu->arch.regs.link = svcpu->lr;
+diff --git a/arch/powerpc/kvm/bookehv_interrupts.S b/arch/powerpc/kvm/bookehv_interrupts.S
+index 612b7f6a887f8..4e5081e584098 100644
+--- a/arch/powerpc/kvm/bookehv_interrupts.S
++++ b/arch/powerpc/kvm/bookehv_interrupts.S
+@@ -186,7 +186,7 @@ END_BTB_FLUSH_SECTION
+ */
+ PPC_LL r4, PACACURRENT(r13)
+ PPC_LL r4, (THREAD + THREAD_KVM_VCPU)(r4)
+- stw r10, VCPU_CR(r4)
++ PPC_STL r10, VCPU_CR(r4)
+ PPC_STL r11, VCPU_GPR(R4)(r4)
+ PPC_STL r5, VCPU_GPR(R5)(r4)
+ PPC_STL r6, VCPU_GPR(R6)(r4)
+@@ -296,7 +296,7 @@ _GLOBAL(kvmppc_handler_\intno\()_\srr1)
+ PPC_STL r4, VCPU_GPR(R4)(r11)
+ PPC_LL r4, THREAD_NORMSAVE(0)(r10)
+ PPC_STL r5, VCPU_GPR(R5)(r11)
+- stw r13, VCPU_CR(r11)
++ PPC_STL r13, VCPU_CR(r11)
+ mfspr r5, \srr0
+ PPC_STL r3, VCPU_GPR(R10)(r11)
+ PPC_LL r3, THREAD_NORMSAVE(2)(r10)
+@@ -323,7 +323,7 @@ _GLOBAL(kvmppc_handler_\intno\()_\srr1)
+ PPC_STL r4, VCPU_GPR(R4)(r11)
+ PPC_LL r4, GPR9(r8)
+ PPC_STL r5, VCPU_GPR(R5)(r11)
+- stw r9, VCPU_CR(r11)
++ PPC_STL r9, VCPU_CR(r11)
+ mfspr r5, \srr0
+ PPC_STL r3, VCPU_GPR(R8)(r11)
+ PPC_LL r3, GPR10(r8)
+@@ -647,7 +647,7 @@ lightweight_exit:
+ PPC_LL r3, VCPU_LR(r4)
+ PPC_LL r5, VCPU_XER(r4)
+ PPC_LL r6, VCPU_CTR(r4)
+- lwz r7, VCPU_CR(r4)
++ PPC_LL r7, VCPU_CR(r4)
+ PPC_LL r8, VCPU_PC(r4)
+ PPC_LD(r9, VCPU_SHARED_MSR, r11)
+ PPC_LL r0, VCPU_GPR(R0)(r4)
+diff --git a/arch/powerpc/kvm/emulate_loadstore.c b/arch/powerpc/kvm/emulate_loadstore.c
+index 75dce1ef3bc83..f91b1309a0a86 100644
+--- a/arch/powerpc/kvm/emulate_loadstore.c
++++ b/arch/powerpc/kvm/emulate_loadstore.c
+@@ -117,7 +117,6 @@ int kvmppc_emulate_loadstore(struct kvm_vcpu *vcpu)
+
+ emulated = EMULATE_FAIL;
+ vcpu->arch.regs.msr = vcpu->arch.shared->msr;
+- vcpu->arch.regs.ccr = vcpu->arch.cr;
+ if (analyse_instr(&op, &vcpu->arch.regs, inst) == 0) {
+ int type = op.type & INSTR_TYPE_MASK;
+ int size = GETSIZE(op.type);
+--
+2.20.1
+
--- /dev/null
+From e594dadf7ec41a70c0e1e1a0d82fb2426d7e82b9 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Tue, 7 May 2019 09:06:27 -0700
+Subject: KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad
+ value
+
+[ Upstream commit d28f4290b53a157191ed9991ad05dffe9e8c0c89 ]
+
+The behavior of WRMSR is in no way dependent on whether or not KVM
+consumes the value.
+
+Fixes: 4566654bb9be9 ("KVM: vmx: Inject #GP on invalid PAT CR")
+Cc: stable@vger.kernel.org
+Cc: Nadav Amit <nadav.amit@gmail.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index feff7ed44a2bb..e4bba840a0708 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -4265,9 +4265,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ MSR_TYPE_W);
+ break;
+ case MSR_IA32_CR_PAT:
++ if (!kvm_pat_valid(data))
++ return 1;
++
+ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- if (!kvm_pat_valid(data))
+- return 1;
+ vmcs_write64(GUEST_IA32_PAT, data);
+ vcpu->arch.pat = data;
+ break;
+--
+2.20.1
+
--- /dev/null
+From 8a9f3b7cab2bb81b8635dc1cf6d1433e2aeea440 Mon Sep 17 00:00:00 2001
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Mon, 2 Sep 2019 15:43:32 -0400
+Subject: KVM: VMX: check CPUID before allowing read/write of IA32_XSS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 4d763b168e9c5c366b05812c7bba7662e5ea3669 ]
+
+Raise #GP when guest read/write IA32_XSS, but the CPUID bits
+say that it shouldn't exist.
+
+Fixes: 203000993de5 (kvm: vmx: add MSR logic for XSAVES)
+Reported-by: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Reported-by: Tao Xu <tao3.xu@intel.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 82253d31842a2..2938b4bcc9684 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -4135,7 +4135,10 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return vmx_get_vmx_msr(&vmx->nested.msrs, msr_info->index,
+ &msr_info->data);
+ case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported())
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+ return 1;
+ msr_info->data = vcpu->arch.ia32_xss;
+ break;
+@@ -4302,7 +4305,10 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return 1;
+ return vmx_set_vmx_msr(vcpu, msr_index, data);
+ case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported())
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+ return 1;
+ /*
+ * The only supported bit as of Skylake is bit 8, but
+--
+2.20.1
+
--- /dev/null
+From 10f7d5707051e9206f6637c8155c35be2ab1b466 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Mon, 2 Sep 2019 08:33:15 -0400
+Subject: KVM: VMX: Compare only a single byte for VMCS' "launched" in vCPU-run
+
+[ Upstream commit 61c08aa9606d4e48a8a50639c956448a720174c3 ]
+
+The vCPU-run asm blob does a manual comparison of a VMCS' launched
+status to execute the correct VM-Enter instruction, i.e. VMLAUNCH vs.
+VMRESUME. The launched flag is a bool, which is a typedef of _Bool.
+C99 does not define an exact size for _Bool, stating only that is must
+be large enough to hold '0' and '1'. Most, if not all, compilers use
+a single byte for _Bool, including gcc[1].
+
+Originally, 'launched' was of type 'int' and so the asm blob used 'cmpl'
+to check the launch status. When 'launched' was moved to be stored on a
+per-VMCS basis, struct vcpu_vmx's "temporary" __launched flag was added
+in order to avoid having to pass the current VMCS into the asm blob.
+The new '__launched' was defined as a 'bool' and not an 'int', but the
+'cmp' instruction was not updated.
+
+This has not caused any known problems, likely due to compilers aligning
+variables to 4-byte or 8-byte boundaries and KVM zeroing out struct
+vcpu_vmx during allocation. I.e. vCPU-run accesses "junk" data, it just
+happens to always be zero and so doesn't affect the result.
+
+[1] https://gcc.gnu.org/ml/gcc-patches/2000-10/msg01127.html
+
+Fixes: d462b8192368 ("KVM: VMX: Keep list of loaded VMCSs, instead of vcpus")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2e310ea62d609..562f5dc4645b6 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10808,7 +10808,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ "mov %%" _ASM_AX", %%cr2 \n\t"
+ "3: \n\t"
+ /* Check if vmlaunch of vmresume is needed */
+- "cmpl $0, %c[launched](%0) \n\t"
++ "cmpb $0, %c[launched](%0) \n\t"
+ /* Load guest registers. Don't clobber flags. */
+ "mov %c[rax](%0), %%" _ASM_AX " \n\t"
+ "mov %c[rbx](%0), %%" _ASM_BX " \n\t"
+--
+2.20.1
+
--- /dev/null
+From e735105239fe5044daa1c1929cda5043d9dd17e8 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Mon, 2 Sep 2019 15:38:20 -0400
+Subject: KVM: VMX: Fix handling of #MC that occurs during VM-Entry
+
+[ Upstream commit beb8d93b3e423043e079ef3dda19dad7b28467a8 ]
+
+A previous fix to prevent KVM from consuming stale VMCS state after a
+failed VM-Entry inadvertantly blocked KVM's handling of machine checks
+that occur during VM-Entry.
+
+Per Intel's SDM, a #MC during VM-Entry is handled in one of three ways,
+depending on when the #MC is recognoized. As it pertains to this bug
+fix, the third case explicitly states EXIT_REASON_MCE_DURING_VMENTRY
+is handled like any other VM-Exit during VM-Entry, i.e. sets bit 31 to
+indicate the VM-Entry failed.
+
+If a machine-check event occurs during a VM entry, one of the following occurs:
+ - The machine-check event is handled as if it occurred before the VM entry:
+ ...
+ - The machine-check event is handled after VM entry completes:
+ ...
+ - A VM-entry failure occurs as described in Section 26.7. The basic
+ exit reason is 41, for "VM-entry failure due to machine-check event".
+
+Explicitly handle EXIT_REASON_MCE_DURING_VMENTRY as a one-off case in
+vmx_vcpu_run() instead of binning it into vmx_complete_atomic_exit().
+Doing so allows vmx_vcpu_run() to handle VMX_EXIT_REASONS_FAILED_VMENTRY
+in a sane fashion and also simplifies vmx_complete_atomic_exit() since
+VMCS.VM_EXIT_INTR_INFO is guaranteed to be fresh.
+
+Fixes: b060ca3b2e9e7 ("kvm: vmx: Handle VMLAUNCH/VMRESUME failure properly")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index e4bba840a0708..82253d31842a2 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10438,28 +10438,21 @@ static void vmx_apicv_post_state_restore(struct kvm_vcpu *vcpu)
+
+ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+ {
+- u32 exit_intr_info = 0;
+- u16 basic_exit_reason = (u16)vmx->exit_reason;
+-
+- if (!(basic_exit_reason == EXIT_REASON_MCE_DURING_VMENTRY
+- || basic_exit_reason == EXIT_REASON_EXCEPTION_NMI))
++ if (vmx->exit_reason != EXIT_REASON_EXCEPTION_NMI)
+ return;
+
+- if (!(vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- vmx->exit_intr_info = exit_intr_info;
++ vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+
+ /* if exit due to PF check for async PF */
+- if (is_page_fault(exit_intr_info))
++ if (is_page_fault(vmx->exit_intr_info))
+ vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
+
+ /* Handle machine checks before interrupts are enabled */
+- if (basic_exit_reason == EXIT_REASON_MCE_DURING_VMENTRY ||
+- is_machine_check(exit_intr_info))
++ if (is_machine_check(vmx->exit_intr_info))
+ kvm_machine_check();
+
+ /* We need to handle NMIs before interrupts are enabled */
+- if (is_nmi(exit_intr_info)) {
++ if (is_nmi(vmx->exit_intr_info)) {
+ kvm_before_interrupt(&vmx->vcpu);
+ asm("int $2");
+ kvm_after_interrupt(&vmx->vcpu);
+@@ -10980,6 +10973,9 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ vmx->idt_vectoring_info = 0;
+
+ vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
++ if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
++ kvm_machine_check();
++
+ if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+ return;
+
+--
+2.20.1
+
--- /dev/null
+From b7ce62502ffb34e8e99ab18436ce781536ff6191 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Tue, 2 Apr 2019 08:10:48 -0700
+Subject: KVM: x86: Always use 32-bit SMRAM save state for 32-bit kernels
+
+[ Upstream commit b68f3cc7d978943fcf85148165b00594c38db776 ]
+
+Invoking the 64-bit variation on a 32-bit kenrel will crash the guest,
+trigger a WARN, and/or lead to a buffer overrun in the host, e.g.
+rsm_load_state_64() writes r8-r15 unconditionally, but enum kvm_reg and
+thus x86_emulate_ctxt._regs only define r8-r15 for CONFIG_X86_64.
+
+KVM allows userspace to report long mode support via CPUID, even though
+the guest is all but guaranteed to crash if it actually tries to enable
+long mode. But, a pure 32-bit guest that is ignorant of long mode will
+happily plod along.
+
+SMM complicates things as 64-bit CPUs use a different SMRAM save state
+area. KVM handles this correctly for 64-bit kernels, e.g. uses the
+legacy save state map if userspace has hid long mode from the guest,
+but doesn't fare well when userspace reports long mode support on a
+32-bit host kernel (32-bit KVM doesn't support 64-bit guests).
+
+Since the alternative is to crash the guest, e.g. by not loading state
+or explicitly requesting shutdown, unconditionally use the legacy SMRAM
+save state map for 32-bit KVM. If a guest has managed to get far enough
+to handle SMIs when running under a weird/buggy userspace hypervisor,
+then don't deliberately crash the guest since there are no downsides
+(from KVM's perspective) to allow it to continue running.
+
+Fixes: 660a5d517aaab ("KVM: x86: save/load state on SMM switch")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/emulate.c | 10 ++++++++++
+ arch/x86/kvm/x86.c | 10 ++++++----
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 4a688ef9e4481..429728b35bca1 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2331,12 +2331,16 @@ static int em_lseg(struct x86_emulate_ctxt *ctxt)
+
+ static int emulator_has_longmode(struct x86_emulate_ctxt *ctxt)
+ {
++#ifdef CONFIG_X86_64
+ u32 eax, ebx, ecx, edx;
+
+ eax = 0x80000001;
+ ecx = 0;
+ ctxt->ops->get_cpuid(ctxt, &eax, &ebx, &ecx, &edx, false);
+ return edx & bit(X86_FEATURE_LM);
++#else
++ return false;
++#endif
+ }
+
+ #define GET_SMSTATE(type, smbase, offset) \
+@@ -2381,6 +2385,7 @@ static int rsm_load_seg_32(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+ return X86EMUL_CONTINUE;
+ }
+
++#ifdef CONFIG_X86_64
+ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+ {
+ struct desc_struct desc;
+@@ -2399,6 +2404,7 @@ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n)
+ ctxt->ops->set_segment(ctxt, selector, &desc, base3, n);
+ return X86EMUL_CONTINUE;
+ }
++#endif
+
+ static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt,
+ u64 cr0, u64 cr3, u64 cr4)
+@@ -2499,6 +2505,7 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase)
+ return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4);
+ }
+
++#ifdef CONFIG_X86_64
+ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
+ {
+ struct desc_struct desc;
+@@ -2560,6 +2567,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase)
+
+ return X86EMUL_CONTINUE;
+ }
++#endif
+
+ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ {
+@@ -2616,9 +2624,11 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ if (ctxt->ops->pre_leave_smm(ctxt, smbase))
+ return X86EMUL_UNHANDLEABLE;
+
++#ifdef CONFIG_X86_64
+ if (emulator_has_longmode(ctxt))
+ ret = rsm_load_state_64(ctxt, smbase + 0x8000);
+ else
++#endif
+ ret = rsm_load_state_32(ctxt, smbase + 0x8000);
+
+ if (ret != X86EMUL_CONTINUE) {
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index a846ed13ba53c..cbc39751f36bc 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7227,9 +7227,9 @@ static void enter_smm_save_state_32(struct kvm_vcpu *vcpu, char *buf)
+ put_smstate(u32, buf, 0x7ef8, vcpu->arch.smbase);
+ }
+
++#ifdef CONFIG_X86_64
+ static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
+ {
+-#ifdef CONFIG_X86_64
+ struct desc_ptr dt;
+ struct kvm_segment seg;
+ unsigned long val;
+@@ -7279,10 +7279,8 @@ static void enter_smm_save_state_64(struct kvm_vcpu *vcpu, char *buf)
+
+ for (i = 0; i < 6; i++)
+ enter_smm_save_seg_64(vcpu, buf, i);
+-#else
+- WARN_ON_ONCE(1);
+-#endif
+ }
++#endif
+
+ static void enter_smm(struct kvm_vcpu *vcpu)
+ {
+@@ -7293,9 +7291,11 @@ static void enter_smm(struct kvm_vcpu *vcpu)
+
+ trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
+ memset(buf, 0, 512);
++#ifdef CONFIG_X86_64
+ if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
+ enter_smm_save_state_64(vcpu, buf);
+ else
++#endif
+ enter_smm_save_state_32(vcpu, buf);
+
+ /*
+@@ -7353,8 +7353,10 @@ static void enter_smm(struct kvm_vcpu *vcpu)
+ kvm_set_segment(vcpu, &ds, VCPU_SREG_GS);
+ kvm_set_segment(vcpu, &ds, VCPU_SREG_SS);
+
++#ifdef CONFIG_X86_64
+ if (guest_cpuid_has(vcpu, X86_FEATURE_LM))
+ kvm_x86_ops->set_efer(vcpu, 0);
++#endif
+
+ kvm_update_cpuid(vcpu);
+ kvm_mmu_reset_context(vcpu);
+--
+2.20.1
+
--- /dev/null
+From 7bfc838b9481dd1d1ec3864460112e9ed8c144c2 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Wed, 26 Sep 2018 19:02:55 +0200
+Subject: KVM: x86: hyperv: consistently use 'hv_vcpu' for 'struct kvm_vcpu_hv'
+ variables
+
+[ Upstream commit 1779a39f786397760ae7a7cc03cf37697d8ae58d ]
+
+Rename 'hv' to 'hv_vcpu' in kvm_hv_set_msr/kvm_hv_get_msr(); 'hv' is
+'reserved' for 'struct kvm_hv' variables across the file.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/hyperv.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 73fa074b9089a..3f2775aac5545 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -1042,20 +1042,20 @@ static u64 current_task_runtime_100ns(void)
+
+ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ {
+- struct kvm_vcpu_hv *hv = &vcpu->arch.hyperv;
++ struct kvm_vcpu_hv *hv_vcpu = &vcpu->arch.hyperv;
+
+ switch (msr) {
+ case HV_X64_MSR_VP_INDEX:
+ if (!host || (u32)data >= KVM_MAX_VCPUS)
+ return 1;
+- hv->vp_index = (u32)data;
++ hv_vcpu->vp_index = (u32)data;
+ break;
+ case HV_X64_MSR_VP_ASSIST_PAGE: {
+ u64 gfn;
+ unsigned long addr;
+
+ if (!(data & HV_X64_MSR_VP_ASSIST_PAGE_ENABLE)) {
+- hv->hv_vapic = data;
++ hv_vcpu->hv_vapic = data;
+ if (kvm_lapic_enable_pv_eoi(vcpu, 0))
+ return 1;
+ break;
+@@ -1066,7 +1066,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ return 1;
+ if (__clear_user((void __user *)addr, PAGE_SIZE))
+ return 1;
+- hv->hv_vapic = data;
++ hv_vcpu->hv_vapic = data;
+ kvm_vcpu_mark_page_dirty(vcpu, gfn);
+ if (kvm_lapic_enable_pv_eoi(vcpu,
+ gfn_to_gpa(gfn) | KVM_MSR_ENABLED))
+@@ -1082,7 +1082,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ case HV_X64_MSR_VP_RUNTIME:
+ if (!host)
+ return 1;
+- hv->runtime_offset = data - current_task_runtime_100ns();
++ hv_vcpu->runtime_offset = data - current_task_runtime_100ns();
+ break;
+ case HV_X64_MSR_SCONTROL:
+ case HV_X64_MSR_SVERSION:
+@@ -1174,11 +1174,11 @@ static int kvm_hv_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata,
+ bool host)
+ {
+ u64 data = 0;
+- struct kvm_vcpu_hv *hv = &vcpu->arch.hyperv;
++ struct kvm_vcpu_hv *hv_vcpu = &vcpu->arch.hyperv;
+
+ switch (msr) {
+ case HV_X64_MSR_VP_INDEX:
+- data = hv->vp_index;
++ data = hv_vcpu->vp_index;
+ break;
+ case HV_X64_MSR_EOI:
+ return kvm_hv_vapic_msr_read(vcpu, APIC_EOI, pdata);
+@@ -1187,10 +1187,10 @@ static int kvm_hv_get_msr(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata,
+ case HV_X64_MSR_TPR:
+ return kvm_hv_vapic_msr_read(vcpu, APIC_TASKPRI, pdata);
+ case HV_X64_MSR_VP_ASSIST_PAGE:
+- data = hv->hv_vapic;
++ data = hv_vcpu->hv_vapic;
+ break;
+ case HV_X64_MSR_VP_RUNTIME:
+- data = current_task_runtime_100ns() + hv->runtime_offset;
++ data = current_task_runtime_100ns() + hv_vcpu->runtime_offset;
+ break;
+ case HV_X64_MSR_SCONTROL:
+ case HV_X64_MSR_SVERSION:
+--
+2.20.1
+
--- /dev/null
+From c9cdf3b35c2ce8ed8598f9b74d3e94f266c3a4c7 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Wed, 22 Aug 2018 12:18:28 +0200
+Subject: KVM: x86: hyperv: enforce vp_index < KVM_MAX_VCPUS
+
+[ Upstream commit 9170200ec0ebad70e5b9902bc93e2b1b11456a3b ]
+
+Hyper-V TLFS (5.0b) states:
+
+> Virtual processors are identified by using an index (VP index). The
+> maximum number of virtual processors per partition supported by the
+> current implementation of the hypervisor can be obtained through CPUID
+> leaf 0x40000005. A virtual processor index must be less than the
+> maximum number of virtual processors per partition.
+
+Forbid userspace to set VP_INDEX above KVM_MAX_VCPUS. get_vcpu_by_vpidx()
+can now be optimized to bail early when supplied vpidx is >= KVM_MAX_VCPUS.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/hyperv.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 229d996051653..73fa074b9089a 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -132,8 +132,10 @@ static struct kvm_vcpu *get_vcpu_by_vpidx(struct kvm *kvm, u32 vpidx)
+ struct kvm_vcpu *vcpu = NULL;
+ int i;
+
+- if (vpidx < KVM_MAX_VCPUS)
+- vcpu = kvm_get_vcpu(kvm, vpidx);
++ if (vpidx >= KVM_MAX_VCPUS)
++ return NULL;
++
++ vcpu = kvm_get_vcpu(kvm, vpidx);
+ if (vcpu && vcpu_to_hv_vcpu(vcpu)->vp_index == vpidx)
+ return vcpu;
+ kvm_for_each_vcpu(i, vcpu, kvm)
+@@ -1044,7 +1046,7 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+
+ switch (msr) {
+ case HV_X64_MSR_VP_INDEX:
+- if (!host)
++ if (!host || (u32)data >= KVM_MAX_VCPUS)
+ return 1;
+ hv->vp_index = (u32)data;
+ break;
+--
+2.20.1
+
--- /dev/null
+From 61e14d24813cd6aaf6cb08caa5ac42929d6ca53d Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Wed, 26 Sep 2018 19:02:56 +0200
+Subject: KVM: x86: hyperv: keep track of mismatched VP indexes
+
+[ Upstream commit 87ee613d076351950b74383215437f841ebbeb75 ]
+
+In most common cases VP index of a vcpu matches its vcpu index. Userspace
+is, however, free to set any mapping it wishes and we need to account for
+that when we need to find a vCPU with a particular VP index. To keep search
+algorithms optimal in both cases introduce 'num_mismatched_vp_indexes'
+counter showing how many vCPUs with mismatching VP index we have. In case
+the counter is zero we can assume vp_index == vcpu_idx.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Reviewed-by: Roman Kagan <rkagan@virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/kvm_host.h | 3 +++
+ arch/x86/kvm/hyperv.c | 26 +++++++++++++++++++++++---
+ 2 files changed, 26 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 3245b95ad2d97..b6417454a9d79 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -784,6 +784,9 @@ struct kvm_hv {
+ u64 hv_reenlightenment_control;
+ u64 hv_tsc_emulation_control;
+ u64 hv_tsc_emulation_status;
++
++ /* How many vCPUs have VP index != vCPU index */
++ atomic_t num_mismatched_vp_indexes;
+ };
+
+ enum kvm_irqchip_mode {
+diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c
+index 3f2775aac5545..2bb554b90b3c2 100644
+--- a/arch/x86/kvm/hyperv.c
++++ b/arch/x86/kvm/hyperv.c
+@@ -1045,11 +1045,31 @@ static int kvm_hv_set_msr(struct kvm_vcpu *vcpu, u32 msr, u64 data, bool host)
+ struct kvm_vcpu_hv *hv_vcpu = &vcpu->arch.hyperv;
+
+ switch (msr) {
+- case HV_X64_MSR_VP_INDEX:
+- if (!host || (u32)data >= KVM_MAX_VCPUS)
++ case HV_X64_MSR_VP_INDEX: {
++ struct kvm_hv *hv = &vcpu->kvm->arch.hyperv;
++ int vcpu_idx = kvm_vcpu_get_idx(vcpu);
++ u32 new_vp_index = (u32)data;
++
++ if (!host || new_vp_index >= KVM_MAX_VCPUS)
+ return 1;
+- hv_vcpu->vp_index = (u32)data;
++
++ if (new_vp_index == hv_vcpu->vp_index)
++ return 0;
++
++ /*
++ * The VP index is initialized to vcpu_index by
++ * kvm_hv_vcpu_postcreate so they initially match. Now the
++ * VP index is changing, adjust num_mismatched_vp_indexes if
++ * it now matches or no longer matches vcpu_idx.
++ */
++ if (hv_vcpu->vp_index == vcpu_idx)
++ atomic_inc(&hv->num_mismatched_vp_indexes);
++ else if (new_vp_index == vcpu_idx)
++ atomic_dec(&hv->num_mismatched_vp_indexes);
++
++ hv_vcpu->vp_index = new_vp_index;
+ break;
++ }
+ case HV_X64_MSR_VP_ASSIST_PAGE: {
+ u64 gfn;
+ unsigned long addr;
+--
+2.20.1
+
--- /dev/null
+From d0e31c7e5272c9b4e18ff136b50d432ce4ae4c4c Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 10 Apr 2019 11:41:40 +0200
+Subject: KVM: x86: optimize check for valid PAT value
+
+[ Upstream commit 674ea351cdeb01d2740edce31db7f2d79ce6095d ]
+
+This check will soon be done on every nested vmentry and vmexit,
+"parallelize" it using bitwise operations.
+
+Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mtrr.c | 10 +---------
+ arch/x86/kvm/vmx.c | 2 +-
+ arch/x86/kvm/x86.h | 10 ++++++++++
+ 3 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
+index e9ea2d45ae66b..9f72cc427158e 100644
+--- a/arch/x86/kvm/mtrr.c
++++ b/arch/x86/kvm/mtrr.c
+@@ -48,11 +48,6 @@ static bool msr_mtrr_valid(unsigned msr)
+ return false;
+ }
+
+-static bool valid_pat_type(unsigned t)
+-{
+- return t < 8 && (1 << t) & 0xf3; /* 0, 1, 4, 5, 6, 7 */
+-}
+-
+ static bool valid_mtrr_type(unsigned t)
+ {
+ return t < 8 && (1 << t) & 0x73; /* 0, 1, 4, 5, 6 */
+@@ -67,10 +62,7 @@ bool kvm_mtrr_valid(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ return false;
+
+ if (msr == MSR_IA32_CR_PAT) {
+- for (i = 0; i < 8; i++)
+- if (!valid_pat_type((data >> (i * 8)) & 0xff))
+- return false;
+- return true;
++ return kvm_pat_valid(data);
+ } else if (msr == MSR_MTRRdefType) {
+ if (data & ~0xcff)
+ return false;
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index ee9ff20da3902..feff7ed44a2bb 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -4266,7 +4266,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ break;
+ case MSR_IA32_CR_PAT:
+ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
++ if (!kvm_pat_valid(data))
+ return 1;
+ vmcs_write64(GUEST_IA32_PAT, data);
+ vcpu->arch.pat = data;
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index 8889e0c029a70..3a91ea760f073 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -345,6 +345,16 @@ static inline void kvm_after_interrupt(struct kvm_vcpu *vcpu)
+ __this_cpu_write(current_vcpu, NULL);
+ }
+
++
++static inline bool kvm_pat_valid(u64 data)
++{
++ if (data & 0xF8F8F8F8F8F8F8F8ull)
++ return false;
++ /* 0, 1, 4, 5, 6, 7 are valid values. */
++ return (data | ((data & 0x0202020202020202ull) << 1)) == data;
++}
++
+ void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu);
+ void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu);
++
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 189471af76f37769615c55869db4647918f6680d Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Thu, 13 Sep 2018 08:00:39 -0400
+Subject: media: cec: remove cec-edid.c
+
+[ Upstream commit f94d463f1b7f83d465ed77521821583dbcdaa3c5 ]
+
+Move cec_get_edid_phys_addr() to cec-adap.c. It's not worth keeping
+a separate source for this.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: <stable@vger.kernel.org> # for v4.17 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/Makefile | 2 +-
+ drivers/media/cec/cec-adap.c | 13 +++++++++++++
+ drivers/media/cec/cec-edid.c | 24 ------------------------
+ 3 files changed, 14 insertions(+), 25 deletions(-)
+ delete mode 100644 drivers/media/cec/cec-edid.c
+
+diff --git a/drivers/media/cec/Makefile b/drivers/media/cec/Makefile
+index 29a2ab9e77c5d..ad8677d8c8967 100644
+--- a/drivers/media/cec/Makefile
++++ b/drivers/media/cec/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-cec-objs := cec-core.o cec-adap.o cec-api.o cec-edid.o
++cec-objs := cec-core.o cec-adap.o cec-api.o
+
+ ifeq ($(CONFIG_CEC_NOTIFIER),y)
+ cec-objs += cec-notifier.o
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index a7ea27d2aa8ef..4a15d53f659ec 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -62,6 +62,19 @@ static unsigned int cec_log_addr2dev(const struct cec_adapter *adap, u8 log_addr
+ return adap->log_addrs.primary_device_type[i < 0 ? 0 : i];
+ }
+
++u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
++ unsigned int *offset)
++{
++ unsigned int loc = cec_get_edid_spa_location(edid, size);
++
++ if (offset)
++ *offset = loc;
++ if (loc == 0)
++ return CEC_PHYS_ADDR_INVALID;
++ return (edid[loc] << 8) | edid[loc + 1];
++}
++EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
++
+ /*
+ * Queue a new event for this filehandle. If ts == 0, then set it
+ * to the current time.
+diff --git a/drivers/media/cec/cec-edid.c b/drivers/media/cec/cec-edid.c
+deleted file mode 100644
+index e2f54eec08294..0000000000000
+--- a/drivers/media/cec/cec-edid.c
++++ /dev/null
+@@ -1,24 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * cec-edid - HDMI Consumer Electronics Control EDID & CEC helper functions
+- *
+- * Copyright 2016 Cisco Systems, Inc. and/or its affiliates. All rights reserved.
+- */
+-
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#include <linux/types.h>
+-#include <media/cec.h>
+-
+-u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+- unsigned int *offset)
+-{
+- unsigned int loc = cec_get_edid_spa_location(edid, size);
+-
+- if (offset)
+- *offset = loc;
+- if (loc == 0)
+- return CEC_PHYS_ADDR_INVALID;
+- return (edid[loc] << 8) | edid[loc + 1];
+-}
+-EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
+--
+2.20.1
+
--- /dev/null
+From 42e568811d903813603e99af569cb63a94873094 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Thu, 13 Sep 2018 03:40:56 -0400
+Subject: media: cec/v4l2: move V4L2 specific CEC functions to V4L2
+
+[ Upstream commit 9cfd2753f8f3923f89cbb15f940f3aa0e7202d3e ]
+
+Several CEC functions are actually specific for use with receivers,
+i.e. they should be part of the V4L2 subsystem, not CEC.
+
+These functions deal with validating and modifying EDIDs for (HDMI)
+receivers, and they do not actually have anything to do with the CEC
+subsystem and whether or not CEC is enabled. The problem was that if
+the CEC_CORE config option was not set, then these functions would
+become stubs, but that's not right: they should always be valid.
+
+So replace the cec_ prefix by v4l2_ and move them to v4l2-dv-timings.c.
+Update all drivers that call these accordingly.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Cc: <stable@vger.kernel.org> # for v4.17 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/cec-edid.c | 71 --------
+ drivers/media/i2c/adv7604.c | 4 +-
+ drivers/media/i2c/adv7842.c | 4 +-
+ drivers/media/i2c/tc358743.c | 2 +-
+ drivers/media/platform/vivid/vivid-vid-cap.c | 4 +-
+ .../media/platform/vivid/vivid-vid-common.c | 2 +-
+ drivers/media/v4l2-core/v4l2-dv-timings.c | 151 ++++++++++++++++++
+ include/media/cec.h | 80 ----------
+ include/media/v4l2-dv-timings.h | 6 +
+ 9 files changed, 165 insertions(+), 159 deletions(-)
+
+diff --git a/drivers/media/cec/cec-edid.c b/drivers/media/cec/cec-edid.c
+index f587e8eaefd81..e2f54eec08294 100644
+--- a/drivers/media/cec/cec-edid.c
++++ b/drivers/media/cec/cec-edid.c
+@@ -22,74 +22,3 @@ u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ return (edid[loc] << 8) | edid[loc + 1];
+ }
+ EXPORT_SYMBOL_GPL(cec_get_edid_phys_addr);
+-
+-void cec_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr)
+-{
+- unsigned int loc = cec_get_edid_spa_location(edid, size);
+- u8 sum = 0;
+- unsigned int i;
+-
+- if (loc == 0)
+- return;
+- edid[loc] = phys_addr >> 8;
+- edid[loc + 1] = phys_addr & 0xff;
+- loc &= ~0x7f;
+-
+- /* update the checksum */
+- for (i = loc; i < loc + 127; i++)
+- sum += edid[i];
+- edid[i] = 256 - sum;
+-}
+-EXPORT_SYMBOL_GPL(cec_set_edid_phys_addr);
+-
+-u16 cec_phys_addr_for_input(u16 phys_addr, u8 input)
+-{
+- /* Check if input is sane */
+- if (WARN_ON(input == 0 || input > 0xf))
+- return CEC_PHYS_ADDR_INVALID;
+-
+- if (phys_addr == 0)
+- return input << 12;
+-
+- if ((phys_addr & 0x0fff) == 0)
+- return phys_addr | (input << 8);
+-
+- if ((phys_addr & 0x00ff) == 0)
+- return phys_addr | (input << 4);
+-
+- if ((phys_addr & 0x000f) == 0)
+- return phys_addr | input;
+-
+- /*
+- * All nibbles are used so no valid physical addresses can be assigned
+- * to the input.
+- */
+- return CEC_PHYS_ADDR_INVALID;
+-}
+-EXPORT_SYMBOL_GPL(cec_phys_addr_for_input);
+-
+-int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port)
+-{
+- int i;
+-
+- if (parent)
+- *parent = phys_addr;
+- if (port)
+- *port = 0;
+- if (phys_addr == CEC_PHYS_ADDR_INVALID)
+- return 0;
+- for (i = 0; i < 16; i += 4)
+- if (phys_addr & (0xf << i))
+- break;
+- if (i == 16)
+- return 0;
+- if (parent)
+- *parent = phys_addr & (0xfff0 << i);
+- if (port)
+- *port = (phys_addr >> i) & 0xf;
+- for (i += 4; i < 16; i += 4)
+- if ((phys_addr & (0xf << i)) == 0)
+- return -EINVAL;
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(cec_phys_addr_validate);
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index f01964c36ad57..a4b0a89c7e7e6 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2297,8 +2297,8 @@ static int adv76xx_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+ edid->blocks = 2;
+ return -E2BIG;
+ }
+- pa = cec_get_edid_phys_addr(edid->edid, edid->blocks * 128, &spa_loc);
+- err = cec_phys_addr_validate(pa, &pa, NULL);
++ pa = v4l2_get_edid_phys_addr(edid->edid, edid->blocks * 128, &spa_loc);
++ err = v4l2_phys_addr_validate(pa, &pa, NULL);
+ if (err)
+ return err;
+
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index bb43a75ed6d0b..58662ba92d4f8 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -791,8 +791,8 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port)
+ return 0;
+ }
+
+- pa = cec_get_edid_phys_addr(edid, 256, &spa_loc);
+- err = cec_phys_addr_validate(pa, &pa, NULL);
++ pa = v4l2_get_edid_phys_addr(edid, 256, &spa_loc);
++ err = v4l2_phys_addr_validate(pa, &pa, NULL);
+ if (err)
+ return err;
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 26070fb6ce4eb..e4c0a27b636aa 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1789,7 +1789,7 @@ static int tc358743_s_edid(struct v4l2_subdev *sd,
+ return -E2BIG;
+ }
+ pa = cec_get_edid_phys_addr(edid->edid, edid->blocks * 128, NULL);
+- err = cec_phys_addr_validate(pa, &pa, NULL);
++ err = v4l2_phys_addr_validate(pa, &pa, NULL);
+ if (err)
+ return err;
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 3b09ffceefd56..2e273f4dfc295 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -1724,7 +1724,7 @@ int vidioc_s_edid(struct file *file, void *_fh,
+ return -E2BIG;
+ }
+ phys_addr = cec_get_edid_phys_addr(edid->edid, edid->blocks * 128, NULL);
+- ret = cec_phys_addr_validate(phys_addr, &phys_addr, NULL);
++ ret = v4l2_phys_addr_validate(phys_addr, &phys_addr, NULL);
+ if (ret)
+ return ret;
+
+@@ -1740,7 +1740,7 @@ set_phys_addr:
+
+ for (i = 0; i < MAX_OUTPUTS && dev->cec_tx_adap[i]; i++)
+ cec_s_phys_addr(dev->cec_tx_adap[i],
+- cec_phys_addr_for_input(phys_addr, i + 1),
++ v4l2_phys_addr_for_input(phys_addr, i + 1),
+ false);
+ return 0;
+ }
+diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c
+index 2079861d2270f..e108e9befb77f 100644
+--- a/drivers/media/platform/vivid/vivid-vid-common.c
++++ b/drivers/media/platform/vivid/vivid-vid-common.c
+@@ -863,7 +863,7 @@ int vidioc_g_edid(struct file *file, void *_fh,
+ if (edid->blocks > dev->edid_blocks - edid->start_block)
+ edid->blocks = dev->edid_blocks - edid->start_block;
+ if (adap)
+- cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);
++ v4l2_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr);
+ memcpy(edid->edid, dev->edid + edid->start_block * 128, edid->blocks * 128);
+ return 0;
+ }
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index c7c600c1f63b8..a24b40dfec97a 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -15,6 +15,7 @@
+ #include <media/v4l2-dv-timings.h>
+ #include <linux/math64.h>
+ #include <linux/hdmi.h>
++#include <media/cec.h>
+
+ MODULE_AUTHOR("Hans Verkuil");
+ MODULE_DESCRIPTION("V4L2 DV Timings Helper Functions");
+@@ -942,3 +943,153 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ return c;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_hdmi_rx_colorimetry);
++
++/**
++ * v4l2_get_edid_phys_addr() - find and return the physical address
++ *
++ * @edid: pointer to the EDID data
++ * @size: size in bytes of the EDID data
++ * @offset: If not %NULL then the location of the physical address
++ * bytes in the EDID will be returned here. This is set to 0
++ * if there is no physical address found.
++ *
++ * Return: the physical address or CEC_PHYS_ADDR_INVALID if there is none.
++ */
++u16 v4l2_get_edid_phys_addr(const u8 *edid, unsigned int size,
++ unsigned int *offset)
++{
++ unsigned int loc = cec_get_edid_spa_location(edid, size);
++
++ if (offset)
++ *offset = loc;
++ if (loc == 0)
++ return CEC_PHYS_ADDR_INVALID;
++ return (edid[loc] << 8) | edid[loc + 1];
++}
++EXPORT_SYMBOL_GPL(v4l2_get_edid_phys_addr);
++
++/**
++ * v4l2_set_edid_phys_addr() - find and set the physical address
++ *
++ * @edid: pointer to the EDID data
++ * @size: size in bytes of the EDID data
++ * @phys_addr: the new physical address
++ *
++ * This function finds the location of the physical address in the EDID
++ * and fills in the given physical address and updates the checksum
++ * at the end of the EDID block. It does nothing if the EDID doesn't
++ * contain a physical address.
++ */
++void v4l2_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr)
++{
++ unsigned int loc = cec_get_edid_spa_location(edid, size);
++ u8 sum = 0;
++ unsigned int i;
++
++ if (loc == 0)
++ return;
++ edid[loc] = phys_addr >> 8;
++ edid[loc + 1] = phys_addr & 0xff;
++ loc &= ~0x7f;
++
++ /* update the checksum */
++ for (i = loc; i < loc + 127; i++)
++ sum += edid[i];
++ edid[i] = 256 - sum;
++}
++EXPORT_SYMBOL_GPL(v4l2_set_edid_phys_addr);
++
++/**
++ * v4l2_phys_addr_for_input() - calculate the PA for an input
++ *
++ * @phys_addr: the physical address of the parent
++ * @input: the number of the input port, must be between 1 and 15
++ *
++ * This function calculates a new physical address based on the input
++ * port number. For example:
++ *
++ * PA = 0.0.0.0 and input = 2 becomes 2.0.0.0
++ *
++ * PA = 3.0.0.0 and input = 1 becomes 3.1.0.0
++ *
++ * PA = 3.2.1.0 and input = 5 becomes 3.2.1.5
++ *
++ * PA = 3.2.1.3 and input = 5 becomes f.f.f.f since it maxed out the depth.
++ *
++ * Return: the new physical address or CEC_PHYS_ADDR_INVALID.
++ */
++u16 v4l2_phys_addr_for_input(u16 phys_addr, u8 input)
++{
++ /* Check if input is sane */
++ if (WARN_ON(input == 0 || input > 0xf))
++ return CEC_PHYS_ADDR_INVALID;
++
++ if (phys_addr == 0)
++ return input << 12;
++
++ if ((phys_addr & 0x0fff) == 0)
++ return phys_addr | (input << 8);
++
++ if ((phys_addr & 0x00ff) == 0)
++ return phys_addr | (input << 4);
++
++ if ((phys_addr & 0x000f) == 0)
++ return phys_addr | input;
++
++ /*
++ * All nibbles are used so no valid physical addresses can be assigned
++ * to the input.
++ */
++ return CEC_PHYS_ADDR_INVALID;
++}
++EXPORT_SYMBOL_GPL(v4l2_phys_addr_for_input);
++
++/**
++ * v4l2_phys_addr_validate() - validate a physical address from an EDID
++ *
++ * @phys_addr: the physical address to validate
++ * @parent: if not %NULL, then this is filled with the parents PA.
++ * @port: if not %NULL, then this is filled with the input port.
++ *
++ * This validates a physical address as read from an EDID. If the
++ * PA is invalid (such as 1.0.1.0 since '0' is only allowed at the end),
++ * then it will return -EINVAL.
++ *
++ * The parent PA is passed into %parent and the input port is passed into
++ * %port. For example:
++ *
++ * PA = 0.0.0.0: has parent 0.0.0.0 and input port 0.
++ *
++ * PA = 1.0.0.0: has parent 0.0.0.0 and input port 1.
++ *
++ * PA = 3.2.0.0: has parent 3.0.0.0 and input port 2.
++ *
++ * PA = f.f.f.f: has parent f.f.f.f and input port 0.
++ *
++ * Return: 0 if the PA is valid, -EINVAL if not.
++ */
++int v4l2_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port)
++{
++ int i;
++
++ if (parent)
++ *parent = phys_addr;
++ if (port)
++ *port = 0;
++ if (phys_addr == CEC_PHYS_ADDR_INVALID)
++ return 0;
++ for (i = 0; i < 16; i += 4)
++ if (phys_addr & (0xf << i))
++ break;
++ if (i == 16)
++ return 0;
++ if (parent)
++ *parent = phys_addr & (0xfff0 << i);
++ if (port)
++ *port = (phys_addr >> i) & 0xf;
++ for (i += 4; i < 16; i += 4)
++ if ((phys_addr & (0xf << i)) == 0)
++ return -EINVAL;
++ return 0;
++}
++EXPORT_SYMBOL_GPL(v4l2_phys_addr_validate);
+diff --git a/include/media/cec.h b/include/media/cec.h
+index dc4b412e8fa1e..59bf280e9715c 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -333,67 +333,6 @@ void cec_queue_pin_5v_event(struct cec_adapter *adap, bool is_high, ktime_t ts);
+ u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ unsigned int *offset);
+
+-/**
+- * cec_set_edid_phys_addr() - find and set the physical address
+- *
+- * @edid: pointer to the EDID data
+- * @size: size in bytes of the EDID data
+- * @phys_addr: the new physical address
+- *
+- * This function finds the location of the physical address in the EDID
+- * and fills in the given physical address and updates the checksum
+- * at the end of the EDID block. It does nothing if the EDID doesn't
+- * contain a physical address.
+- */
+-void cec_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr);
+-
+-/**
+- * cec_phys_addr_for_input() - calculate the PA for an input
+- *
+- * @phys_addr: the physical address of the parent
+- * @input: the number of the input port, must be between 1 and 15
+- *
+- * This function calculates a new physical address based on the input
+- * port number. For example:
+- *
+- * PA = 0.0.0.0 and input = 2 becomes 2.0.0.0
+- *
+- * PA = 3.0.0.0 and input = 1 becomes 3.1.0.0
+- *
+- * PA = 3.2.1.0 and input = 5 becomes 3.2.1.5
+- *
+- * PA = 3.2.1.3 and input = 5 becomes f.f.f.f since it maxed out the depth.
+- *
+- * Return: the new physical address or CEC_PHYS_ADDR_INVALID.
+- */
+-u16 cec_phys_addr_for_input(u16 phys_addr, u8 input);
+-
+-/**
+- * cec_phys_addr_validate() - validate a physical address from an EDID
+- *
+- * @phys_addr: the physical address to validate
+- * @parent: if not %NULL, then this is filled with the parents PA.
+- * @port: if not %NULL, then this is filled with the input port.
+- *
+- * This validates a physical address as read from an EDID. If the
+- * PA is invalid (such as 1.0.1.0 since '0' is only allowed at the end),
+- * then it will return -EINVAL.
+- *
+- * The parent PA is passed into %parent and the input port is passed into
+- * %port. For example:
+- *
+- * PA = 0.0.0.0: has parent 0.0.0.0 and input port 0.
+- *
+- * PA = 1.0.0.0: has parent 0.0.0.0 and input port 1.
+- *
+- * PA = 3.2.0.0: has parent 3.0.0.0 and input port 2.
+- *
+- * PA = f.f.f.f: has parent f.f.f.f and input port 0.
+- *
+- * Return: 0 if the PA is valid, -EINVAL if not.
+- */
+-int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
+-
+ #else
+
+ static inline int cec_register_adapter(struct cec_adapter *adap,
+@@ -428,25 +367,6 @@ static inline u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ return CEC_PHYS_ADDR_INVALID;
+ }
+
+-static inline void cec_set_edid_phys_addr(u8 *edid, unsigned int size,
+- u16 phys_addr)
+-{
+-}
+-
+-static inline u16 cec_phys_addr_for_input(u16 phys_addr, u8 input)
+-{
+- return CEC_PHYS_ADDR_INVALID;
+-}
+-
+-static inline int cec_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port)
+-{
+- if (parent)
+- *parent = phys_addr;
+- if (port)
+- *port = 0;
+- return 0;
+-}
+-
+ #endif
+
+ /**
+diff --git a/include/media/v4l2-dv-timings.h b/include/media/v4l2-dv-timings.h
+index 17cb27df1b813..4e7732d3908c4 100644
+--- a/include/media/v4l2-dv-timings.h
++++ b/include/media/v4l2-dv-timings.h
+@@ -234,4 +234,10 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ const struct hdmi_vendor_infoframe *hdmi,
+ unsigned int height);
+
++u16 v4l2_get_edid_phys_addr(const u8 *edid, unsigned int size,
++ unsigned int *offset);
++void v4l2_set_edid_phys_addr(u8 *edid, unsigned int size, u16 phys_addr);
++u16 v4l2_phys_addr_for_input(u16 phys_addr, u8 input);
++int v4l2_phys_addr_validate(u16 phys_addr, u16 *parent, u16 *port);
++
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 0261647cf33623ac6eecfa36b12cd02891a6d36c Mon Sep 17 00:00:00 2001
+From: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Date: Mon, 18 Mar 2019 12:40:05 -0400
+Subject: media: i2c: tda1997x: select V4L2_FWNODE
+
+[ Upstream commit 5f2efda71c09b12012053f457fac7692f268b72c ]
+
+Building tda1997x fails now unless V4L2_FWNODE is selected:
+
+drivers/media/i2c/tda1997x.o: in function `tda1997x_parse_dt'
+undefined reference to `v4l2_fwnode_endpoint_parse'
+
+While at it, also sort the selections alphabetically
+
+Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
+
+Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Cc: stable@vger.kernel.org # v4.17+
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 63c9ac2c6a5ff..8b1ae1d6680b7 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -60,8 +60,9 @@ config VIDEO_TDA1997X
+ tristate "NXP TDA1997x HDMI receiver"
+ depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
+ depends on SND_SOC
+- select SND_PCM
+ select HDMI
++ select SND_PCM
++ select V4L2_FWNODE
+ ---help---
+ V4L2 subdevice driver for the NXP TDA1997x HDMI receivers.
+
+--
+2.20.1
+
--- /dev/null
+From 144ac7ecd69aac244e6086a28059afebf78ed22d Mon Sep 17 00:00:00 2001
+From: Fabien Dessenne <fabien.dessenne@st.com>
+Date: Fri, 31 May 2019 05:18:15 -0400
+Subject: media: stm32-dcmi: fix irq = 0 case
+
+[ Upstream commit dbb9fcc8c2d8d4ea1104f51d4947a8a8199a2cb5 ]
+
+Manage the irq = 0 case, where we shall return an error.
+
+Fixes: b5b5a27bee58 ("media: stm32-dcmi: return appropriate error codes during probe")
+
+Signed-off-by: Fabien Dessenne <fabien.dessenne@st.com>
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/stm32/stm32-dcmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
+index d386822658922..1d9c028e52cba 100644
+--- a/drivers/media/platform/stm32/stm32-dcmi.c
++++ b/drivers/media/platform/stm32/stm32-dcmi.c
+@@ -1681,7 +1681,7 @@ static int dcmi_probe(struct platform_device *pdev)
+ if (irq <= 0) {
+ if (irq != -EPROBE_DEFER)
+ dev_err(&pdev->dev, "Could not get irq\n");
+- return irq;
++ return irq ? irq : -ENXIO;
+ }
+
+ dcmi->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+--
+2.20.1
+
--- /dev/null
+From a98203a4261efa6ba5c48d319ec072d7091e8eab Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 11 Jan 2019 07:07:25 -0500
+Subject: media: vim2m: only cancel work if it is for right context
+
+[ Upstream commit 240809ef6630a4ce57c273c2d79ffb657cd361eb ]
+
+cancel_delayed_work_sync() was called for any queue, but it should only
+be called for the queue that is associated with the currently running job.
+
+Otherwise, if two filehandles are streaming at the same time, then closing the
+first will cancel the work which might still be running for a job from the
+second filehandle. As a result the second filehandle will never be able to
+finish the job and an attempt to stop streaming on that second filehandle will
+stall.
+
+Fixes: 52117be68b82 ("media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work")
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: <stable@vger.kernel.org> # for v4.20 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index de7f9fe7e7cd9..7b8cf661f2386 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -801,7 +801,9 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
+ struct vb2_v4l2_buffer *vbuf;
+ unsigned long flags;
+
+- cancel_delayed_work_sync(&dev->work_run);
++ if (v4l2_m2m_get_curr_priv(dev->m2m_dev) == ctx)
++ cancel_delayed_work_sync(&dev->work_run);
++
+ for (;;) {
+ if (V4L2_TYPE_IS_OUTPUT(q->type))
+ vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+--
+2.20.1
+
--- /dev/null
+From 56bcd62ca2c7effdca2434b045c881dadfca6ca9 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Date: Wed, 7 Nov 2018 09:04:54 -0500
+Subject: media: vim2m: use cancel_delayed_work_sync instead of
+ flush_schedule_work
+
+[ Upstream commit 52117be68b82ee05c96da0a7beec319906ccf6cc ]
+
+The use of flush_schedule_work() made no sense and caused a syzkaller error.
+Replace with the correct cancel_delayed_work_sync().
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: syzbot+69780d144754b8071f4b@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org> # for v4.20 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index 6f87ef025ff19..de7f9fe7e7cd9 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -797,10 +797,11 @@ static int vim2m_start_streaming(struct vb2_queue *q, unsigned count)
+ static void vim2m_stop_streaming(struct vb2_queue *q)
+ {
+ struct vim2m_ctx *ctx = vb2_get_drv_priv(q);
++ struct vim2m_dev *dev = ctx->dev;
+ struct vb2_v4l2_buffer *vbuf;
+ unsigned long flags;
+
+- flush_scheduled_work();
++ cancel_delayed_work_sync(&dev->work_run);
+ for (;;) {
+ if (V4L2_TYPE_IS_OUTPUT(q->type))
+ vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+--
+2.20.1
+
--- /dev/null
+From ef9f87693055584e42950a0cd91beae1681d5215 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Mon, 21 May 2018 04:54:56 -0400
+Subject: media: vim2m: use workqueue
+
+[ Upstream commit 144bd0ee304c7d0690eec285aee93019d3f30fc8 ]
+
+v4l2_ctrl uses mutexes, so we can't setup a ctrl_handler in
+interrupt context. Switch to a workqueue instead and drop the timer.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reviewed-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 25 ++++++++++---------------
+ 1 file changed, 10 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index 462099a141e4a..6f87ef025ff19 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -3,7 +3,8 @@
+ *
+ * This is a virtual device driver for testing mem-to-mem videobuf framework.
+ * It simulates a device that uses memory buffers for both source and
+- * destination, processes the data and issues an "irq" (simulated by a timer).
++ * destination, processes the data and issues an "irq" (simulated by a delayed
++ * workqueue).
+ * The device is capable of multi-instance, multi-buffer-per-transaction
+ * operation (via the mem2mem framework).
+ *
+@@ -19,7 +20,6 @@
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/fs.h>
+-#include <linux/timer.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
+
+@@ -148,7 +148,7 @@ struct vim2m_dev {
+ struct mutex dev_mutex;
+ spinlock_t irqlock;
+
+- struct timer_list timer;
++ struct delayed_work work_run;
+
+ struct v4l2_m2m_dev *m2m_dev;
+ };
+@@ -336,12 +336,6 @@ static int device_process(struct vim2m_ctx *ctx,
+ return 0;
+ }
+
+-static void schedule_irq(struct vim2m_dev *dev, int msec_timeout)
+-{
+- dprintk(dev, "Scheduling a simulated irq\n");
+- mod_timer(&dev->timer, jiffies + msecs_to_jiffies(msec_timeout));
+-}
+-
+ /*
+ * mem2mem callbacks
+ */
+@@ -387,13 +381,14 @@ static void device_run(void *priv)
+
+ device_process(ctx, src_buf, dst_buf);
+
+- /* Run a timer, which simulates a hardware irq */
+- schedule_irq(dev, ctx->transtime);
++ /* Run delayed work, which simulates a hardware irq */
++ schedule_delayed_work(&dev->work_run, msecs_to_jiffies(ctx->transtime));
+ }
+
+-static void device_isr(struct timer_list *t)
++static void device_work(struct work_struct *w)
+ {
+- struct vim2m_dev *vim2m_dev = from_timer(vim2m_dev, t, timer);
++ struct vim2m_dev *vim2m_dev =
++ container_of(w, struct vim2m_dev, work_run.work);
+ struct vim2m_ctx *curr_ctx;
+ struct vb2_v4l2_buffer *src_vb, *dst_vb;
+ unsigned long flags;
+@@ -805,6 +800,7 @@ static void vim2m_stop_streaming(struct vb2_queue *q)
+ struct vb2_v4l2_buffer *vbuf;
+ unsigned long flags;
+
++ flush_scheduled_work();
+ for (;;) {
+ if (V4L2_TYPE_IS_OUTPUT(q->type))
+ vbuf = v4l2_m2m_src_buf_remove(ctx->fh.m2m_ctx);
+@@ -1015,6 +1011,7 @@ static int vim2m_probe(struct platform_device *pdev)
+ vfd = &dev->vfd;
+ vfd->lock = &dev->dev_mutex;
+ vfd->v4l2_dev = &dev->v4l2_dev;
++ INIT_DELAYED_WORK(&dev->work_run, device_work);
+
+ ret = video_register_device(vfd, VFL_TYPE_GRABBER, 0);
+ if (ret) {
+@@ -1026,7 +1023,6 @@ static int vim2m_probe(struct platform_device *pdev)
+ v4l2_info(&dev->v4l2_dev,
+ "Device registered as /dev/video%d\n", vfd->num);
+
+- timer_setup(&dev->timer, device_isr, 0);
+ platform_set_drvdata(pdev, dev);
+
+ dev->m2m_dev = v4l2_m2m_init(&m2m_ops);
+@@ -1083,7 +1079,6 @@ static int vim2m_remove(struct platform_device *pdev)
+ media_device_cleanup(&dev->mdev);
+ #endif
+ v4l2_m2m_release(dev->m2m_dev);
+- del_timer_sync(&dev->timer);
+ video_unregister_device(&dev->vfd);
+ v4l2_device_unregister(&dev->v4l2_dev);
+
+--
+2.20.1
+
--- /dev/null
+From b904a41bc059f12e6208db397cd5ab8678c9e1f2 Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Mon, 21 Jan 2019 16:11:28 +0200
+Subject: mfd: Kconfig: Fix I2C_DESIGNWARE_PLATFORM dependencies
+
+[ Upstream commit 09fdc98577120d4f47601c3127efde726a2300c6 ]
+
+INTEL_SOC_PMIC, INTEL_SOC_PMIC_CHTWC and MFD_TPS68470 select the
+I2C_DESIGNWARE_PLATFORM without its dependencies making it possible to see
+warning and build error like below:
+
+WARNING: unmet direct dependencies detected for I2C_DESIGNWARE_PLATFORM
+ Depends on [n]: I2C [=y] && HAS_IOMEM [=y] && (ACPI [=y] && COMMON_CLK [=n] || !ACPI [=y])
+ Selected by [y]:
+ - MFD_TPS68470 [=y] && HAS_IOMEM [=y] && ACPI [=y] && I2C [=y]=y
+
+/usr/bin/ld: drivers/i2c/busses/i2c-designware-platdrv.o: in function `dw_i2c_plat_resume':
+i2c-designware-platdrv.c:(.text+0x62): undefined reference to `i2c_dw_prepare_clk'
+/usr/bin/ld: drivers/i2c/busses/i2c-designware-platdrv.o: in function `dw_i2c_plat_suspend':
+i2c-designware-platdrv.c:(.text+0x9a): undefined reference to `i2c_dw_prepare_clk'
+/usr/bin/ld: drivers/i2c/busses/i2c-designware-platdrv.o: in function `dw_i2c_plat_probe':
+i2c-designware-platdrv.c:(.text+0x41c): undefined reference to `i2c_dw_prepare_clk'
+/usr/bin/ld: i2c-designware-platdrv.c:(.text+0x438): undefined reference to `i2c_dw_read_comp_param'
+/usr/bin/ld: i2c-designware-platdrv.c:(.text+0x545): undefined reference to `i2c_dw_probe'
+/usr/bin/ld: i2c-designware-platdrv.c:(.text+0x727): undefined reference to `i2c_dw_probe_slave'
+
+Fix this by making above options to depend on I2C_DESIGNWARE_PLATFORM
+being built-in. I2C_DESIGNWARE_PLATFORM is a visible symbol with
+dependencies so in general the select should be avoided.
+
+Fixes: acebcff9eda8 ("mfd: intel_soc_pmic: Select designware i2c-bus driver")
+Fixes: de85d79f4aab ("mfd: Add Cherry Trail Whiskey Cove PMIC driver")
+Fixes: 9bbf6a15ce19 ("mfd: Add support for TPS68470 device")
+Cc: Stable <stable@vger.kernel.org> # v4.14+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/Kconfig | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 11841f4b7b2ba..dd938a5d04094 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -509,10 +509,10 @@ config INTEL_SOC_PMIC
+ bool "Support for Crystal Cove PMIC"
+ depends on ACPI && HAS_IOMEM && I2C=y && GPIOLIB && COMMON_CLK
+ depends on X86 || COMPILE_TEST
++ depends on I2C_DESIGNWARE_PLATFORM=y
+ select MFD_CORE
+ select REGMAP_I2C
+ select REGMAP_IRQ
+- select I2C_DESIGNWARE_PLATFORM
+ help
+ Select this option to enable support for Crystal Cove PMIC
+ on some Intel SoC systems. The PMIC provides ADC, GPIO,
+@@ -538,10 +538,10 @@ config INTEL_SOC_PMIC_CHTWC
+ bool "Support for Intel Cherry Trail Whiskey Cove PMIC"
+ depends on ACPI && HAS_IOMEM && I2C=y && COMMON_CLK
+ depends on X86 || COMPILE_TEST
++ depends on I2C_DESIGNWARE_PLATFORM=y
+ select MFD_CORE
+ select REGMAP_I2C
+ select REGMAP_IRQ
+- select I2C_DESIGNWARE_PLATFORM
+ help
+ Select this option to enable support for the Intel Cherry Trail
+ Whiskey Cove PMIC found on some Intel Cherry Trail systems.
+@@ -1403,9 +1403,9 @@ config MFD_TPS65217
+ config MFD_TPS68470
+ bool "TI TPS68470 Power Management / LED chips"
+ depends on ACPI && I2C=y
++ depends on I2C_DESIGNWARE_PLATFORM=y
+ select MFD_CORE
+ select REGMAP_I2C
+- select I2C_DESIGNWARE_PLATFORM
+ help
+ If you say yes here you get support for the TPS68470 series of
+ Power Management / LED chips.
+--
+2.20.1
+
--- /dev/null
+From d6f430f95fd450ccf790cf44b0faa1d7d6d0c06d Mon Sep 17 00:00:00 2001
+From: Ralph Campbell <rcampbell@nvidia.com>
+Date: Fri, 2 Aug 2019 21:49:08 -0700
+Subject: mm/migrate.c: initialize pud_entry in migrate_vma()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 7b358c6f12dc82364f6d317f8c8f1d794adbc3f5 ]
+
+When CONFIG_MIGRATE_VMA_HELPER is enabled, migrate_vma() calls
+migrate_vma_collect() which initializes a struct mm_walk but didn't
+initialize mm_walk.pud_entry. (Found by code inspection) Use a C
+structure initialization to make sure it is set to NULL.
+
+Link: http://lkml.kernel.org/r/20190719233225.12243-1-rcampbell@nvidia.com
+Fixes: 8763cb45ab967 ("mm/migrate: new memory migration helper for use with device memory")
+Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
+Reviewed-by: John Hubbard <jhubbard@nvidia.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: "Jérôme Glisse" <jglisse@redhat.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/migrate.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index b2ea7d1e6f248..0c48191a90368 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -2328,16 +2328,13 @@ next:
+ */
+ static void migrate_vma_collect(struct migrate_vma *migrate)
+ {
+- struct mm_walk mm_walk;
+-
+- mm_walk.pmd_entry = migrate_vma_collect_pmd;
+- mm_walk.pte_entry = NULL;
+- mm_walk.pte_hole = migrate_vma_collect_hole;
+- mm_walk.hugetlb_entry = NULL;
+- mm_walk.test_walk = NULL;
+- mm_walk.vma = migrate->vma;
+- mm_walk.mm = migrate->vma->vm_mm;
+- mm_walk.private = migrate;
++ struct mm_walk mm_walk = {
++ .pmd_entry = migrate_vma_collect_pmd,
++ .pte_hole = migrate_vma_collect_hole,
++ .vma = migrate->vma,
++ .mm = migrate->vma->vm_mm,
++ .private = migrate,
++ };
+
+ mmu_notifier_invalidate_range_start(mm_walk.mm,
+ migrate->start,
+--
+2.20.1
+
--- /dev/null
+From 3549fa37c9194b11b6856126d2c7380eaa864a85 Mon Sep 17 00:00:00 2001
+From: Takeshi Saito <takeshi.saito.xv@renesas.com>
+Date: Tue, 29 Jan 2019 06:40:39 +0100
+Subject: mmc: renesas_sdhi: Fix card initialization failure in high speed mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit d30ae056adb81e1d2b8b953efa74735a020b8e3b ]
+
+This fixes card initialization failure in high speed mode.
+
+If U-Boot uses SDR or HS200/400 mode before starting Linux and Linux
+DT does not enable SDR/HS200/HS400 mode, card initialization fails in
+high speed mode.
+
+It is necessary to initialize SCC registers during card initialization
+phase. HW reset function is registered only for a port with either of
+SDR/HS200/HS400 properties in device tree. If SDR/HS200/HS400 properties
+are not present in device tree, SCC registers will not be reset. In SoC
+that support SCC registers, HW reset function should be registered
+regardless of the configuration of device tree.
+
+Reproduction procedure:
+- Use U-Boot that support MMC HS200/400 mode.
+- Delete HS200/HS400 properties in device tree.
+ (Delete mmc-hs200-1_8v and mmc-hs400-1_8v)
+- MMC port works high speed mode and all commands fail.
+
+Signed-off-by: Takeshi Saito <takeshi.saito.xv@renesas.com>
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+Cc: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Cc: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 45baf5d9120e3..61f0faddfd889 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -636,6 +636,13 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ host->ops.card_busy = renesas_sdhi_card_busy;
+ host->ops.start_signal_voltage_switch =
+ renesas_sdhi_start_signal_voltage_switch;
++
++ /* SDR and HS200/400 registers requires HW reset */
++ if (of_data && of_data->scc_offset) {
++ priv->scc_ctl = host->ctl + of_data->scc_offset;
++ host->mmc->caps |= MMC_CAP_HW_RESET;
++ host->hw_reset = renesas_sdhi_hw_reset;
++ }
+ }
+
+ /* Orginally registers were 16 bit apart, could be 32 or 64 nowadays */
+@@ -693,8 +700,6 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ const struct renesas_sdhi_scc *taps = of_data->taps;
+ bool hit = false;
+
+- host->mmc->caps |= MMC_CAP_HW_RESET;
+-
+ for (i = 0; i < of_data->taps_num; i++) {
+ if (taps[i].clk_rate == 0 ||
+ taps[i].clk_rate == host->mmc->f_max) {
+@@ -707,12 +712,10 @@ int renesas_sdhi_probe(struct platform_device *pdev,
+ if (!hit)
+ dev_warn(&host->pdev->dev, "Unknown clock rate for SDR104\n");
+
+- priv->scc_ctl = host->ctl + of_data->scc_offset;
+ host->init_tuning = renesas_sdhi_init_tuning;
+ host->prepare_tuning = renesas_sdhi_prepare_tuning;
+ host->select_tuning = renesas_sdhi_select_tuning;
+ host->check_scc_error = renesas_sdhi_check_scc_error;
+- host->hw_reset = renesas_sdhi_hw_reset;
+ host->prepare_hs400_tuning =
+ renesas_sdhi_prepare_hs400_tuning;
+ host->hs400_downgrade = renesas_sdhi_disable_scc;
+--
+2.20.1
+
--- /dev/null
+From db9e9ebfa8f42030ebc0acc12110b6885b3373ed Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Mon, 8 Apr 2019 11:32:11 +0300
+Subject: mmc: sdhci-pci: Add support for Intel CML
+
+[ Upstream commit 765c59675ab571caf7ada456bbfd23a73136b535 ]
+
+Add PCI Ids for Intel CML.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-pci-core.c | 2 ++
+ drivers/mmc/host/sdhci-pci.h | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index c4115bae5db18..71794391f48fa 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -1577,6 +1577,8 @@ static const struct pci_device_id pci_ids[] = {
+ SDHCI_PCI_DEVICE(INTEL, CNPH_SD, intel_byt_sd),
+ SDHCI_PCI_DEVICE(INTEL, ICP_EMMC, intel_glk_emmc),
+ SDHCI_PCI_DEVICE(INTEL, ICP_SD, intel_byt_sd),
++ SDHCI_PCI_DEVICE(INTEL, CML_EMMC, intel_glk_emmc),
++ SDHCI_PCI_DEVICE(INTEL, CML_SD, intel_byt_sd),
+ SDHCI_PCI_DEVICE(O2, 8120, o2),
+ SDHCI_PCI_DEVICE(O2, 8220, o2),
+ SDHCI_PCI_DEVICE(O2, 8221, o2),
+diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
+index 2ef0bdca91974..6f04a62b2998e 100644
+--- a/drivers/mmc/host/sdhci-pci.h
++++ b/drivers/mmc/host/sdhci-pci.h
+@@ -50,6 +50,8 @@
+ #define PCI_DEVICE_ID_INTEL_CNPH_SD 0xa375
+ #define PCI_DEVICE_ID_INTEL_ICP_EMMC 0x34c4
+ #define PCI_DEVICE_ID_INTEL_ICP_SD 0x34f8
++#define PCI_DEVICE_ID_INTEL_CML_EMMC 0x02c4
++#define PCI_DEVICE_ID_INTEL_CML_SD 0x02f5
+
+ #define PCI_DEVICE_ID_SYSKONNECT_8000 0x8000
+ #define PCI_DEVICE_ID_VIA_95D0 0x95d0
+--
+2.20.1
+
--- /dev/null
+From f9c0d4ae8e655a311176b1ad1b10e29d40d8a645 Mon Sep 17 00:00:00 2001
+From: Jessica Yu <jeyu@kernel.org>
+Date: Tue, 23 Jul 2019 15:26:28 +0200
+Subject: modules: always page-align module section allocations
+
+[ Upstream commit 38f054d549a869f22a02224cd276a27bf14b6171 ]
+
+Some arches (e.g., arm64, x86) have moved towards non-executable
+module_alloc() allocations for security hardening reasons. That means
+that the module loader will need to set the text section of a module to
+executable, regardless of whether or not CONFIG_STRICT_MODULE_RWX is set.
+
+When CONFIG_STRICT_MODULE_RWX=y, module section allocations are always
+page-aligned to handle memory rwx permissions. On some arches with
+CONFIG_STRICT_MODULE_RWX=n however, when setting the module text to
+executable, the BUG_ON() in frob_text() gets triggered since module
+section allocations are not page-aligned when CONFIG_STRICT_MODULE_RWX=n.
+Since the set_memory_* API works with pages, and since we need to call
+set_memory_x() regardless of whether CONFIG_STRICT_MODULE_RWX is set, we
+might as well page-align all module section allocations for ease of
+managing rwx permissions of module sections (text, rodata, etc).
+
+Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n")
+Reported-by: Martin Kaiser <lists@kaiser.cx>
+Reported-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Tested-by: David Lechner <david@lechnology.com>
+Tested-by: Martin Kaiser <martin@kaiser.cx>
+Tested-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 3fda10c549a25..2dec3d4a9b627 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -76,14 +76,9 @@
+
+ /*
+ * Modules' sections will be aligned on page boundaries
+- * to ensure complete separation of code and data, but
+- * only when CONFIG_STRICT_MODULE_RWX=y
++ * to ensure complete separation of code and data
+ */
+-#ifdef CONFIG_STRICT_MODULE_RWX
+ # define debug_align(X) ALIGN(X, PAGE_SIZE)
+-#else
+-# define debug_align(X) (X)
+-#endif
+
+ /* If this is set, the section belongs in the init part of the module */
+ #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1))
+--
+2.20.1
+
--- /dev/null
+From 3633a7ed64b93d83696b9cadb8ba9d19f8c6b4e8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 2 Sep 2019 08:55:14 -0400
+Subject: mt76: fix corrupted software generated tx CCMP PN
+
+[ Upstream commit 906d2d3f874a54183df5a609fda180adf0462428 ]
+
+Since ccmp_pn is u8 *, the second half needs to start at array index 4
+instead of 0. Fixes a connection stall after a certain amount of traffic
+
+Fixes: 23405236460b9 ("mt76: fix transmission of encrypted management frames")
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c
+index 6542644bc3259..cec31f0c3017b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac_common.c
+@@ -402,7 +402,7 @@ void mt76x2_mac_write_txwi(struct mt76x2_dev *dev, struct mt76x2_txwi *txwi,
+ ccmp_pn[6] = pn >> 32;
+ ccmp_pn[7] = pn >> 40;
+ txwi->iv = *((__le32 *)&ccmp_pn[0]);
+- txwi->eiv = *((__le32 *)&ccmp_pn[1]);
++ txwi->eiv = *((__le32 *)&ccmp_pn[4]);
+ }
+
+ spin_lock_bh(&dev->mt76.lock);
+--
+2.20.1
+
--- /dev/null
+From b0373156cd9284cada8cf03f7f61cad7857f5e80 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Fri, 19 Jul 2019 14:08:37 -0400
+Subject: NFSv4: Fix delegation state recovery
+
+[ Upstream commit 5eb8d18ca0e001c6055da2b7f30d8f6dca23a44f ]
+
+Once we clear the NFS_DELEGATED_STATE flag, we're telling
+nfs_delegation_claim_opens() that we're done recovering all open state
+for that stateid, so we really need to ensure that we test for all
+open modes that are currently cached and recover them before exiting
+nfs4_open_delegation_recall().
+
+Fixes: 24311f884189d ("NFSv4: Recovery of recalled read delegations...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Cc: stable@vger.kernel.org # v4.3+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 2 +-
+ fs/nfs/delegation.h | 2 +-
+ fs/nfs/nfs4proc.c | 25 ++++++++++++-------------
+ 3 files changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 75fe92eaa6818..1624618c2bc72 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -153,7 +153,7 @@ again:
+ /* Block nfs4_proc_unlck */
+ mutex_lock(&sp->so_delegreturn_mutex);
+ seq = raw_seqcount_begin(&sp->so_reclaim_seqcount);
+- err = nfs4_open_delegation_recall(ctx, state, stateid, type);
++ err = nfs4_open_delegation_recall(ctx, state, stateid);
+ if (!err)
+ err = nfs_delegation_claim_locks(ctx, state, stateid);
+ if (!err && read_seqcount_retry(&sp->so_reclaim_seqcount, seq))
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index bb1ef8c37af42..c95477823fa6b 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -61,7 +61,7 @@ void nfs_reap_expired_delegations(struct nfs_client *clp);
+
+ /* NFSv4 delegation-related procedures */
+ int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync);
+-int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid, fmode_t type);
++int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid);
+ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, const nfs4_stateid *stateid);
+ bool nfs4_copy_delegation_stateid(struct inode *inode, fmode_t flags, nfs4_stateid *dst, struct rpc_cred **cred);
+ bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 31ae3bd5d9d20..621e3cf90f4eb 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2113,12 +2113,10 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ case -NFS4ERR_BAD_HIGH_SLOT:
+ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
+ case -NFS4ERR_DEADSESSION:
+- set_bit(NFS_DELEGATED_STATE, &state->flags);
+ nfs4_schedule_session_recovery(server->nfs_client->cl_session, err);
+ return -EAGAIN;
+ case -NFS4ERR_STALE_CLIENTID:
+ case -NFS4ERR_STALE_STATEID:
+- set_bit(NFS_DELEGATED_STATE, &state->flags);
+ /* Don't recall a delegation if it was lost */
+ nfs4_schedule_lease_recovery(server->nfs_client);
+ return -EAGAIN;
+@@ -2139,7 +2137,6 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ return -EAGAIN;
+ case -NFS4ERR_DELAY:
+ case -NFS4ERR_GRACE:
+- set_bit(NFS_DELEGATED_STATE, &state->flags);
+ ssleep(1);
+ return -EAGAIN;
+ case -ENOMEM:
+@@ -2155,8 +2152,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ }
+
+ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
+- struct nfs4_state *state, const nfs4_stateid *stateid,
+- fmode_t type)
++ struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+ struct nfs_server *server = NFS_SERVER(state->inode);
+ struct nfs4_opendata *opendata;
+@@ -2167,20 +2163,23 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
+ if (IS_ERR(opendata))
+ return PTR_ERR(opendata);
+ nfs4_stateid_copy(&opendata->o_arg.u.delegation, stateid);
+- nfs_state_clear_delegation(state);
+- switch (type & (FMODE_READ|FMODE_WRITE)) {
+- case FMODE_READ|FMODE_WRITE:
+- case FMODE_WRITE:
++ if (!test_bit(NFS_O_RDWR_STATE, &state->flags)) {
+ err = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE);
+ if (err)
+- break;
++ goto out;
++ }
++ if (!test_bit(NFS_O_WRONLY_STATE, &state->flags)) {
+ err = nfs4_open_recover_helper(opendata, FMODE_WRITE);
+ if (err)
+- break;
+- /* Fall through */
+- case FMODE_READ:
++ goto out;
++ }
++ if (!test_bit(NFS_O_RDONLY_STATE, &state->flags)) {
+ err = nfs4_open_recover_helper(opendata, FMODE_READ);
++ if (err)
++ goto out;
+ }
++ nfs_state_clear_delegation(state);
++out:
+ nfs4_opendata_put(opendata);
+ return nfs4_handle_delegation_recall_error(server, state, stateid, NULL, err);
+ }
+--
+2.20.1
+
--- /dev/null
+From 1be96c408b7232d97d89861b00fd3a43248529b9 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Mon, 22 Jul 2019 12:44:50 +0530
+Subject: {nl,mac}80211: fix interface combinations on crypto controlled
+ devices
+
+[ Upstream commit e6f4051123fd33901e9655a675b22aefcdc5d277 ]
+
+Commit 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on
+crypto controlled devices") has introduced a change which allows
+4addr operation on crypto controlled devices (ex: ath10k). This
+change has inadvertently impacted the interface combinations logic
+on such devices.
+
+General rule is that software interfaces like AP/VLAN should not be
+listed under supported interface combinations and should not be
+considered during validation of these combinations; because of the
+aforementioned change, AP/VLAN interfaces(if present) will be checked
+against interfaces supported by the device and blocks valid interface
+combinations.
+
+Consider a case where an AP and AP/VLAN are up and running; when a
+second AP device is brought up on the same physical device, this AP
+will be checked against the AP/VLAN interface (which will not be
+part of supported interface combinations of the device) and blocks
+second AP to come up.
+
+Add a new API cfg80211_iftype_allowed() to fix the problem, this
+API works for all devices with/without SW crypto control.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Fixes: 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices")
+Link: https://lore.kernel.org/r/1563779690-9716-1-git-send-email-mpubbise@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 15 +++++++++++++++
+ net/mac80211/util.c | 7 +++----
+ net/wireless/core.c | 6 ++----
+ net/wireless/nl80211.c | 4 +---
+ net/wireless/util.c | 27 +++++++++++++++++++++++++--
+ 5 files changed, 46 insertions(+), 13 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 67e0a990144a6..468deae5d603e 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6562,6 +6562,21 @@ int cfg80211_external_auth_request(struct net_device *netdev,
+ struct cfg80211_external_auth_params *params,
+ gfp_t gfp);
+
++/**
++ * cfg80211_iftype_allowed - check whether the interface can be allowed
++ * @wiphy: the wiphy
++ * @iftype: interface type
++ * @is_4addr: use_4addr flag, must be '0' when check_swif is '1'
++ * @check_swif: check iftype against software interfaces
++ *
++ * Check whether the interface is allowed to operate; additionally, this API
++ * can be used to check iftype against the software interfaces when
++ * check_swif is '1'.
++ */
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++ bool is_4addr, u8 check_swif);
++
++
+ /* Logging, debugging and troubleshooting/diagnostic helpers. */
+
+ /* wiphy_printk helpers, similar to dev_printk */
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index c59638574cf8b..f101a6460b44b 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3527,9 +3527,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ }
+
+ /* Always allow software iftypes */
+- if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
+- (iftype == NL80211_IFTYPE_AP_VLAN &&
+- local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
++ if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
+ if (radar_detect)
+ return -EINVAL;
+ return 0;
+@@ -3564,7 +3562,8 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+
+ if (sdata_iter == sdata ||
+ !ieee80211_sdata_running(sdata_iter) ||
+- local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
++ cfg80211_iftype_allowed(local->hw.wiphy,
++ wdev_iter->iftype, 0, 1))
+ continue;
+
+ params.iftype_num[wdev_iter->iftype]++;
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 2a46ec3cb72c1..68660781aa51f 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1335,10 +1335,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ }
+ break;
+ case NETDEV_PRE_UP:
+- if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) &&
+- !(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
+- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
+- wdev->use_4addr))
++ if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype,
++ wdev->use_4addr, 0))
+ return notifier_from_errno(-EOPNOTSUPP);
+
+ if (rfkill_blocked(rdev->rfkill))
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 8e2f03ab4cc9f..2a85bff6a8f35 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3210,9 +3210,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ return err;
+ }
+
+- if (!(rdev->wiphy.interface_modes & (1 << type)) &&
+- !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
+- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
++ if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
+ return -EOPNOTSUPP;
+
+ err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index d57e2f679a3e4..c14e8f6e5e198 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1670,7 +1670,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+ num_interfaces += params->iftype_num[iftype];
+ if (params->iftype_num[iftype] > 0 &&
+- !(wiphy->software_iftypes & BIT(iftype)))
++ !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ used_iftypes |= BIT(iftype);
+ }
+
+@@ -1692,7 +1692,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ return -ENOMEM;
+
+ for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+- if (wiphy->software_iftypes & BIT(iftype))
++ if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ continue;
+ for (j = 0; j < c->n_limits; j++) {
+ all_iftypes |= limits[j].types;
+@@ -1895,3 +1895,26 @@ EXPORT_SYMBOL(rfc1042_header);
+ const unsigned char bridge_tunnel_header[] __aligned(2) =
+ { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
+ EXPORT_SYMBOL(bridge_tunnel_header);
++
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++ bool is_4addr, u8 check_swif)
++
++{
++ bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
++
++ switch (check_swif) {
++ case 0:
++ if (is_vlan && is_4addr)
++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++ return wiphy->interface_modes & BIT(iftype);
++ case 1:
++ if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++ return wiphy->software_iftypes & BIT(iftype);
++ default:
++ break;
++ }
++
++ return false;
++}
++EXPORT_SYMBOL(cfg80211_iftype_allowed);
+--
+2.20.1
+
--- /dev/null
+From 641bf4a76d8e1be8c3517cb06e16d0a82d7baddc Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Fri, 3 May 2019 11:43:52 +0200
+Subject: nvme-fc: use separate work queue to avoid warning
+
+[ Upstream commit 8730c1ddb69bdeeb10c1f613a4e15e95862b1981 ]
+
+When tearing down a controller the following warning is issued:
+
+WARNING: CPU: 0 PID: 30681 at ../kernel/workqueue.c:2418 check_flush_dependency
+
+This happens as the err_work workqueue item is scheduled on the
+system workqueue (which has WQ_MEM_RECLAIM not set), but is flushed
+from a workqueue which has WQ_MEM_RECLAIM set.
+
+Fix this by providing an FC-NVMe specific workqueue.
+
+Fixes: 4cff280a5fcc ("nvme-fc: resolve io failures during connect")
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 67dec8860bf3c..565bddcfd130d 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -206,7 +206,7 @@ static LIST_HEAD(nvme_fc_lport_list);
+ static DEFINE_IDA(nvme_fc_local_port_cnt);
+ static DEFINE_IDA(nvme_fc_ctrl_cnt);
+
+-
++static struct workqueue_struct *nvme_fc_wq;
+
+ /*
+ * These items are short-term. They will eventually be moved into
+@@ -2053,7 +2053,7 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
+ */
+ if (ctrl->ctrl.state == NVME_CTRL_CONNECTING) {
+ active = atomic_xchg(&ctrl->err_work_active, 1);
+- if (!active && !schedule_work(&ctrl->err_work)) {
++ if (!active && !queue_work(nvme_fc_wq, &ctrl->err_work)) {
+ atomic_set(&ctrl->err_work_active, 0);
+ WARN_ON(1);
+ }
+@@ -3321,6 +3321,10 @@ static int __init nvme_fc_init_module(void)
+ {
+ int ret;
+
++ nvme_fc_wq = alloc_workqueue("nvme_fc_wq", WQ_MEM_RECLAIM, 0);
++ if (!nvme_fc_wq)
++ return -ENOMEM;
++
+ /*
+ * NOTE:
+ * It is expected that in the future the kernel will combine
+@@ -3338,7 +3342,8 @@ static int __init nvme_fc_init_module(void)
+ fc_class = class_create(THIS_MODULE, "fc");
+ if (IS_ERR(fc_class)) {
+ pr_err("couldn't register class fc\n");
+- return PTR_ERR(fc_class);
++ ret = PTR_ERR(fc_class);
++ goto out_destroy_wq;
+ }
+
+ /*
+@@ -3362,6 +3367,9 @@ out_destroy_device:
+ device_destroy(fc_class, MKDEV(0, 0));
+ out_destroy_class:
+ class_destroy(fc_class);
++out_destroy_wq:
++ destroy_workqueue(nvme_fc_wq);
++
+ return ret;
+ }
+
+@@ -3378,6 +3386,7 @@ static void __exit nvme_fc_exit_module(void)
+
+ device_destroy(fc_class, MKDEV(0, 0));
+ class_destroy(fc_class);
++ destroy_workqueue(nvme_fc_wq);
+ }
+
+ module_init(nvme_fc_init_module);
+--
+2.20.1
+
--- /dev/null
+From 0f1579a9bc0dfe325c50c74a2fec19ebed4903e7 Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Wed, 10 Oct 2018 15:55:05 -0500
+Subject: PCI: Add macro for Switchtec quirk declarations
+
+[ Upstream commit 01d5d7fa8376c6b5acda86e16fcad22de6bba486 ]
+
+Add SWITCHTEC_QUIRK() to reduce redundancy in declaring devices that use
+quirk_switchtec_ntb_dma_alias().
+
+By itself, this is no functional change, but a subsequent patch updates
+SWITCHTEC_QUIRK() to fix ad281ecf1c7d ("PCI: Add DMA alias quirk for
+Microsemi Switchtec NTB").
+
+Fixes: ad281ecf1c7d ("PCI: Add DMA alias quirk for Microsemi Switchtec NTB")
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+[bhelgaas: split to separate patch]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 90 +++++++++++++++++---------------------------
+ 1 file changed, 34 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 28c64f84bfe72..6cda8b7ecc821 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5082,59 +5082,37 @@ static void quirk_switchtec_ntb_dma_alias(struct pci_dev *pdev)
+ pci_iounmap(pdev, mmio);
+ pci_disable_device(pdev);
+ }
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8531,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8532,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8533,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8534,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8535,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8536,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8543,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8544,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8545,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8546,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8551,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8552,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8553,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8554,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8555,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8556,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8561,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8562,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8563,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8564,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8565,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8566,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8571,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8572,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8573,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8574,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8575,
+- quirk_switchtec_ntb_dma_alias);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, 0x8576,
+- quirk_switchtec_ntb_dma_alias);
++#define SWITCHTEC_QUIRK(vid) \
++ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, vid, \
++ quirk_switchtec_ntb_dma_alias)
++
++SWITCHTEC_QUIRK(0x8531); /* PFX 24xG3 */
++SWITCHTEC_QUIRK(0x8532); /* PFX 32xG3 */
++SWITCHTEC_QUIRK(0x8533); /* PFX 48xG3 */
++SWITCHTEC_QUIRK(0x8534); /* PFX 64xG3 */
++SWITCHTEC_QUIRK(0x8535); /* PFX 80xG3 */
++SWITCHTEC_QUIRK(0x8536); /* PFX 96xG3 */
++SWITCHTEC_QUIRK(0x8541); /* PSX 24xG3 */
++SWITCHTEC_QUIRK(0x8542); /* PSX 32xG3 */
++SWITCHTEC_QUIRK(0x8543); /* PSX 48xG3 */
++SWITCHTEC_QUIRK(0x8544); /* PSX 64xG3 */
++SWITCHTEC_QUIRK(0x8545); /* PSX 80xG3 */
++SWITCHTEC_QUIRK(0x8546); /* PSX 96xG3 */
++SWITCHTEC_QUIRK(0x8551); /* PAX 24XG3 */
++SWITCHTEC_QUIRK(0x8552); /* PAX 32XG3 */
++SWITCHTEC_QUIRK(0x8553); /* PAX 48XG3 */
++SWITCHTEC_QUIRK(0x8554); /* PAX 64XG3 */
++SWITCHTEC_QUIRK(0x8555); /* PAX 80XG3 */
++SWITCHTEC_QUIRK(0x8556); /* PAX 96XG3 */
++SWITCHTEC_QUIRK(0x8561); /* PFXL 24XG3 */
++SWITCHTEC_QUIRK(0x8562); /* PFXL 32XG3 */
++SWITCHTEC_QUIRK(0x8563); /* PFXL 48XG3 */
++SWITCHTEC_QUIRK(0x8564); /* PFXL 64XG3 */
++SWITCHTEC_QUIRK(0x8565); /* PFXL 80XG3 */
++SWITCHTEC_QUIRK(0x8566); /* PFXL 96XG3 */
++SWITCHTEC_QUIRK(0x8571); /* PFXI 24XG3 */
++SWITCHTEC_QUIRK(0x8572); /* PFXI 32XG3 */
++SWITCHTEC_QUIRK(0x8573); /* PFXI 48XG3 */
++SWITCHTEC_QUIRK(0x8574); /* PFXI 64XG3 */
++SWITCHTEC_QUIRK(0x8575); /* PFXI 80XG3 */
++SWITCHTEC_QUIRK(0x8576); /* PFXI 96XG3 */
+--
+2.20.1
+
--- /dev/null
+From f7c75a9306808627b756e077c8f91a3a67546039 Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Date: Fri, 29 Mar 2019 11:58:53 +0000
+Subject: PCI: dwc: Use devm_pci_alloc_host_bridge() to simplify code
+
+[ Upstream commit e6fdd3bf5aecd8615f31a5128775b9abcf3e0d86 ]
+
+Use devm_pci_alloc_host_bridge() to simplify the error code path. This
+also fixes a leak in the dw_pcie_host_init() error path.
+
+Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+CC: stable@vger.kernel.org # v4.13+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../pci/controller/dwc/pcie-designware-host.c | 21 +++++++------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index acd50920c2ffd..b57ee79f6d699 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -356,7 +356,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ dev_err(dev, "Missing *config* reg space\n");
+ }
+
+- bridge = pci_alloc_host_bridge(0);
++ bridge = devm_pci_alloc_host_bridge(dev, 0);
+ if (!bridge)
+ return -ENOMEM;
+
+@@ -367,7 +367,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+
+ ret = devm_request_pci_bus_resources(dev, &bridge->windows);
+ if (ret)
+- goto error;
++ return ret;
+
+ /* Get the I/O and memory ranges from DT */
+ resource_list_for_each_entry_safe(win, tmp, &bridge->windows) {
+@@ -411,8 +411,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ resource_size(pp->cfg));
+ if (!pci->dbi_base) {
+ dev_err(dev, "Error with ioremap\n");
+- ret = -ENOMEM;
+- goto error;
++ return -ENOMEM;
+ }
+ }
+
+@@ -423,8 +422,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pp->cfg0_base, pp->cfg0_size);
+ if (!pp->va_cfg0_base) {
+ dev_err(dev, "Error with ioremap in function\n");
+- ret = -ENOMEM;
+- goto error;
++ return -ENOMEM;
+ }
+ }
+
+@@ -434,8 +432,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pp->cfg1_size);
+ if (!pp->va_cfg1_base) {
+ dev_err(dev, "Error with ioremap\n");
+- ret = -ENOMEM;
+- goto error;
++ return -ENOMEM;
+ }
+ }
+
+@@ -458,14 +455,14 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ pp->num_vectors == 0) {
+ dev_err(dev,
+ "Invalid number of vectors\n");
+- goto error;
++ return -EINVAL;
+ }
+ }
+
+ if (!pp->ops->msi_host_init) {
+ ret = dw_pcie_allocate_domains(pp);
+ if (ret)
+- goto error;
++ return ret;
+
+ if (pp->msi_irq)
+ irq_set_chained_handler_and_data(pp->msi_irq,
+@@ -474,7 +471,7 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ } else {
+ ret = pp->ops->msi_host_init(pp);
+ if (ret < 0)
+- goto error;
++ return ret;
+ }
+ }
+
+@@ -514,8 +511,6 @@ int dw_pcie_host_init(struct pcie_port *pp)
+ err_free_msi:
+ if (pci_msi_enabled() && !pp->ops->msi_host_init)
+ dw_pcie_free_msi(pp);
+-error:
+- pci_free_host_bridge(bridge);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 68662a2c612b6ba3b774d4d1b6653f034c2791a2 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Fri, 25 Jan 2019 15:26:16 -0800
+Subject: PCI: qcom: Don't deassert reset GPIO during probe
+
+[ Upstream commit 02b485e31d98265189b91f3e69c43df2ed50610c ]
+
+Acquiring the reset GPIO low means that reset is being deasserted, this
+is followed almost immediately with qcom_pcie_host_init() asserting it,
+initializing it and then finally deasserting it again, for the link to
+come up.
+
+Some PCIe devices requires a minimum time between the initial deassert
+and subsequent reset cycles. In a platform that boots with the reset
+GPIO asserted this requirement is being violated by this deassert/assert
+pulse.
+
+Acquire the reset GPIO high to prevent this situation by matching the
+state to the subsequent asserted state.
+
+Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+[lorenzo.pieralisi@arm.com: updated commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Stanimir Varbanov <svarbanov@mm-sol.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 79f06c76ae071..e292801fff7fd 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1230,7 +1230,7 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+
+ pcie->ops = of_device_get_match_data(dev);
+
+- pcie->reset = devm_gpiod_get_optional(dev, "perst", GPIOD_OUT_LOW);
++ pcie->reset = devm_gpiod_get_optional(dev, "perst", GPIOD_OUT_HIGH);
+ if (IS_ERR(pcie->reset)) {
+ ret = PTR_ERR(pcie->reset);
+ goto err_pm_runtime_put;
+--
+2.20.1
+
--- /dev/null
+From 7554ba04f86e8ef51a22ed809b6e307e4052c286 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Fri, 31 Aug 2018 15:55:10 -0700
+Subject: PCI: qcom: Fix error handling in runtime PM support
+
+[ Upstream commit 6e5da6f7d82474e94c2d4a38cf9ca4edbb3e03a0 ]
+
+The driver does not cope with the fact that probe can fail in a number
+of cases after enabling runtime PM on the device; this results in
+warnings about "Unbalanced pm_runtime_enable". Furthermore if probe
+fails after invoking qcom_pcie_host_init() the power-domain will be left
+referenced.
+
+As it is not possible for the error handling in qcom_pcie_host_init() to
+handle errors happening after returning from that function the
+pm_runtime_get_sync() is moved to qcom_pcie_probe() as well.
+
+Fixes: 854b69efbdd2 ("PCI: qcom: add runtime pm support to pcie_port")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+[lorenzo.pieralisi@arm.com: updated commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Stanimir Varbanov <svarbanov@mm-sol.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 56 ++++++++++++++++++--------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c
+index 87a8887fd4d3e..79f06c76ae071 100644
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1091,7 +1091,6 @@ static int qcom_pcie_host_init(struct pcie_port *pp)
+ struct qcom_pcie *pcie = to_qcom_pcie(pci);
+ int ret;
+
+- pm_runtime_get_sync(pci->dev);
+ qcom_ep_reset_assert(pcie);
+
+ ret = pcie->ops->init(pcie);
+@@ -1128,7 +1127,6 @@ err_disable_phy:
+ phy_power_off(pcie->phy);
+ err_deinit:
+ pcie->ops->deinit(pcie);
+- pm_runtime_put(pci->dev);
+
+ return ret;
+ }
+@@ -1218,6 +1216,12 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ pm_runtime_enable(dev);
++ ret = pm_runtime_get_sync(dev);
++ if (ret < 0) {
++ pm_runtime_disable(dev);
++ return ret;
++ }
++
+ pci->dev = dev;
+ pci->ops = &dw_pcie_ops;
+ pp = &pci->pp;
+@@ -1227,44 +1231,56 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+ pcie->ops = of_device_get_match_data(dev);
+
+ pcie->reset = devm_gpiod_get_optional(dev, "perst", GPIOD_OUT_LOW);
+- if (IS_ERR(pcie->reset))
+- return PTR_ERR(pcie->reset);
++ if (IS_ERR(pcie->reset)) {
++ ret = PTR_ERR(pcie->reset);
++ goto err_pm_runtime_put;
++ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "parf");
+ pcie->parf = devm_ioremap_resource(dev, res);
+- if (IS_ERR(pcie->parf))
+- return PTR_ERR(pcie->parf);
++ if (IS_ERR(pcie->parf)) {
++ ret = PTR_ERR(pcie->parf);
++ goto err_pm_runtime_put;
++ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dbi");
+ pci->dbi_base = devm_pci_remap_cfg_resource(dev, res);
+- if (IS_ERR(pci->dbi_base))
+- return PTR_ERR(pci->dbi_base);
++ if (IS_ERR(pci->dbi_base)) {
++ ret = PTR_ERR(pci->dbi_base);
++ goto err_pm_runtime_put;
++ }
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "elbi");
+ pcie->elbi = devm_ioremap_resource(dev, res);
+- if (IS_ERR(pcie->elbi))
+- return PTR_ERR(pcie->elbi);
++ if (IS_ERR(pcie->elbi)) {
++ ret = PTR_ERR(pcie->elbi);
++ goto err_pm_runtime_put;
++ }
+
+ pcie->phy = devm_phy_optional_get(dev, "pciephy");
+- if (IS_ERR(pcie->phy))
+- return PTR_ERR(pcie->phy);
++ if (IS_ERR(pcie->phy)) {
++ ret = PTR_ERR(pcie->phy);
++ goto err_pm_runtime_put;
++ }
+
+ ret = pcie->ops->get_resources(pcie);
+ if (ret)
+- return ret;
++ goto err_pm_runtime_put;
+
+ pp->ops = &qcom_pcie_dw_ops;
+
+ if (IS_ENABLED(CONFIG_PCI_MSI)) {
+ pp->msi_irq = platform_get_irq_byname(pdev, "msi");
+- if (pp->msi_irq < 0)
+- return pp->msi_irq;
++ if (pp->msi_irq < 0) {
++ ret = pp->msi_irq;
++ goto err_pm_runtime_put;
++ }
+ }
+
+ ret = phy_init(pcie->phy);
+ if (ret) {
+ pm_runtime_disable(&pdev->dev);
+- return ret;
++ goto err_pm_runtime_put;
+ }
+
+ platform_set_drvdata(pdev, pcie);
+@@ -1273,10 +1289,16 @@ static int qcom_pcie_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(dev, "cannot initialize host\n");
+ pm_runtime_disable(&pdev->dev);
+- return ret;
++ goto err_pm_runtime_put;
+ }
+
+ return 0;
++
++err_pm_runtime_put:
++ pm_runtime_put(dev);
++ pm_runtime_disable(dev);
++
++ return ret;
+ }
+
+ static const struct of_device_id qcom_pcie_match[] = {
+--
+2.20.1
+
--- /dev/null
+From f54152e0dcbf09b63cbcf248a36774dd9c35bec3 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Thu, 1 Aug 2019 18:01:17 -0400
+Subject: PCI: Reset both NVIDIA GPU and HDA in ThinkPad P50 workaround
+
+[ Upstream commit ad54567ad5d8e938ee6cf02e4f3867f18835ae6e ]
+
+quirk_reset_lenovo_thinkpad_50_nvgpu() resets NVIDIA GPUs to work around
+an apparent BIOS defect. It previously used pci_reset_function(), and
+the available method was a bus reset, which was fine because there was
+only one function on the bus. After b516ea586d71 ("PCI: Enable NVIDIA
+HDA controllers"), there are now two functions (the HDA controller and
+the GPU itself) on the bus, so the reset fails.
+
+Use pci_reset_bus() explicitly instead of pci_reset_function() since it's
+OK to reset both devices.
+
+[bhelgaas: commit log, add e0547c81bfcf]
+Fixes: b516ea586d71 ("PCI: Enable NVIDIA HDA controllers")
+Fixes: e0547c81bfcf ("PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary")
+Link: https://lore.kernel.org/r/20190801220117.14952-1-lyude@redhat.com
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Ben Skeggs <bskeggs@redhat.com>
+Cc: Lukas Wunner <lukas@wunner.de>
+Cc: Daniel Drake <drake@endlessm.com>
+Cc: Aaron Plattner <aplattner@nvidia.com>
+Cc: Peter Wu <peter@lekensteyn.nl>
+Cc: Ilia Mirkin <imirkin@alum.mit.edu>
+Cc: Karol Herbst <kherbst@redhat.com>
+Cc: Maik Freudenberg <hhfeuer@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 311f8a33e62ff..06be52912dcdb 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5162,7 +5162,7 @@ static void quirk_reset_lenovo_thinkpad_p50_nvgpu(struct pci_dev *pdev)
+ */
+ if (ioread32(map + 0x2240c) & 0x2) {
+ pci_info(pdev, FW_BUG "GPU left initialized by EFI, resetting\n");
+- ret = pci_reset_function(pdev);
++ ret = pci_reset_bus(pdev);
+ if (ret < 0)
+ pci_err(pdev, "Failed to reset GPU: %d\n", ret);
+ }
+--
+2.20.1
+
--- /dev/null
+From a69517396cd993bceb487ec3bb78226474b508fc Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 12 Feb 2019 17:02:30 -0500
+Subject: PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary
+
+[ Upstream commit e0547c81bfcfad01cbbfa93a5e66bb98ab932f80 ]
+
+On ThinkPad P50 SKUs with an Nvidia Quadro M1000M instead of the M2000M
+variant, the BIOS does not always reset the secondary Nvidia GPU during
+reboot if the laptop is configured in Hybrid Graphics mode. The reason is
+unknown, but the following steps and possibly a good bit of patience will
+reproduce the issue:
+
+ 1. Boot up the laptop normally in Hybrid Graphics mode
+ 2. Make sure nouveau is loaded and that the GPU is awake
+ 3. Allow the Nvidia GPU to runtime suspend itself after being idle
+ 4. Reboot the machine, the more sudden the better (e.g. sysrq-b may help)
+ 5. If nouveau loads up properly, reboot the machine again and go back to
+ step 2 until you reproduce the issue
+
+This results in some very strange behavior: the GPU will be left in exactly
+the same state it was in when the previously booted kernel started the
+reboot. This has all sorts of bad side effects: for starters, this
+completely breaks nouveau starting with a mysterious EVO channel failure
+that happens well before we've actually used the EVO channel for anything:
+
+ nouveau 0000:01:00.0: disp: chid 0 mthd 0000 data 00000400 00001000 00000002
+
+This causes a timeout trying to bring up the GR ctx:
+
+ nouveau 0000:01:00.0: timeout
+ WARNING: CPU: 0 PID: 12 at drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c:1547 gf100_grctx_generate+0x7b2/0x850 [nouveau]
+ Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET82W (1.55 ) 12/18/2018
+ Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper]
+ ...
+ nouveau 0000:01:00.0: gr: wait for idle timeout (en: 1, ctxsw: 0, busy: 1)
+ nouveau 0000:01:00.0: gr: wait for idle timeout (en: 1, ctxsw: 0, busy: 1)
+ nouveau 0000:01:00.0: fifo: fault 01 [WRITE] at 0000000000008000 engine 00 [GR] client 15 [HUB/SCC_NB] reason c4 [] on channel -1 [0000000000 unknown]
+
+The GPU never manages to recover. Booting without loading nouveau causes
+issues as well, since the GPU starts sending spurious interrupts that cause
+other device's IRQs to get disabled by the kernel:
+
+ irq 16: nobody cared (try booting with the "irqpoll" option)
+ ...
+ handlers:
+ [<000000007faa9e99>] i801_isr [i2c_i801]
+ Disabling IRQ #16
+ ...
+ serio: RMI4 PS/2 pass-through port at rmi4-00.fn03
+ i801_smbus 0000:00:1f.4: Timeout waiting for interrupt!
+ i801_smbus 0000:00:1f.4: Transaction timeout
+ rmi4_f03 rmi4-00.fn03: rmi_f03_pt_write: Failed to write to F03 TX register (-110).
+ i801_smbus 0000:00:1f.4: Timeout waiting for interrupt!
+ i801_smbus 0000:00:1f.4: Transaction timeout
+ rmi4_physical rmi4-00: rmi_driver_set_irq_bits: Failed to change enabled interrupts!
+
+This causes the touchpad and sometimes other things to get disabled.
+
+Since this happens without nouveau, we can't fix this problem from nouveau
+itself.
+
+Add a PCI quirk for the specific P50 variant of this GPU. Make sure the
+GPU is advertising NoReset- so we don't reset the GPU when the machine is
+in Dedicated graphics mode (where the GPU being initialized by the BIOS is
+normal and expected). Map the GPU MMIO space and read the magic 0x2240c
+register, which will have bit 1 set if the device was POSTed during a
+previous boot. Once we've confirmed all of this, reset the GPU and
+re-disable it - bringing it back to a healthy state.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=203003
+Link: https://lore.kernel.org/lkml/20190212220230.1568-1-lyude@redhat.com
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: nouveau@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: Karol Herbst <kherbst@redhat.com>
+Cc: Ben Skeggs <skeggsb@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 58 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 58 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6cda8b7ecc821..311f8a33e62ff 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5116,3 +5116,61 @@ SWITCHTEC_QUIRK(0x8573); /* PFXI 48XG3 */
+ SWITCHTEC_QUIRK(0x8574); /* PFXI 64XG3 */
+ SWITCHTEC_QUIRK(0x8575); /* PFXI 80XG3 */
+ SWITCHTEC_QUIRK(0x8576); /* PFXI 96XG3 */
++
++/*
++ * On Lenovo Thinkpad P50 SKUs with a Nvidia Quadro M1000M, the BIOS does
++ * not always reset the secondary Nvidia GPU between reboots if the system
++ * is configured to use Hybrid Graphics mode. This results in the GPU
++ * being left in whatever state it was in during the *previous* boot, which
++ * causes spurious interrupts from the GPU, which in turn causes us to
++ * disable the wrong IRQ and end up breaking the touchpad. Unsurprisingly,
++ * this also completely breaks nouveau.
++ *
++ * Luckily, it seems a simple reset of the Nvidia GPU brings it back to a
++ * clean state and fixes all these issues.
++ *
++ * When the machine is configured in Dedicated display mode, the issue
++ * doesn't occur. Fortunately the GPU advertises NoReset+ when in this
++ * mode, so we can detect that and avoid resetting it.
++ */
++static void quirk_reset_lenovo_thinkpad_p50_nvgpu(struct pci_dev *pdev)
++{
++ void __iomem *map;
++ int ret;
++
++ if (pdev->subsystem_vendor != PCI_VENDOR_ID_LENOVO ||
++ pdev->subsystem_device != 0x222e ||
++ !pdev->reset_fn)
++ return;
++
++ if (pci_enable_device_mem(pdev))
++ return;
++
++ /*
++ * Based on nvkm_device_ctor() in
++ * drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++ */
++ map = pci_iomap(pdev, 0, 0x23000);
++ if (!map) {
++ pci_err(pdev, "Can't map MMIO space\n");
++ goto out_disable;
++ }
++
++ /*
++ * Make sure the GPU looks like it's been POSTed before resetting
++ * it.
++ */
++ if (ioread32(map + 0x2240c) & 0x2) {
++ pci_info(pdev, FW_BUG "GPU left initialized by EFI, resetting\n");
++ ret = pci_reset_function(pdev);
++ if (ret < 0)
++ pci_err(pdev, "Failed to reset GPU: %d\n", ret);
++ }
++
++ iounmap(map);
++out_disable:
++ pci_disable_device(pdev);
++}
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, 0x13b1,
++ PCI_CLASS_DISPLAY_VGA, 8,
++ quirk_reset_lenovo_thinkpad_p50_nvgpu);
+--
+2.20.1
+
--- /dev/null
+From fe403a7052f495fb0ad819eb4624bb7191d62e8f Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Fri, 10 May 2019 06:31:28 +0000
+Subject: powerpc/64: mark start_here_multiplatform as __ref
+
+[ Upstream commit 9c4e4c90ec24652921e31e9551fcaedc26eec86d ]
+
+Otherwise, the following warning is encountered:
+
+WARNING: vmlinux.o(.text+0x3dc6): Section mismatch in reference from the variable start_here_multiplatform to the function .init.text:.early_setup()
+The function start_here_multiplatform() references
+the function __init .early_setup().
+This is often because start_here_multiplatform lacks a __init
+annotation or the annotation of .early_setup is wrong.
+
+Fixes: 56c46bba9bbf ("powerpc/64: Fix booting large kernels with STRICT_KERNEL_RWX")
+Cc: Russell Currey <ruscur@russell.cc>
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_64.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 9168a247e24ff..3fb564f3e8874 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -906,6 +906,7 @@ p_toc: .8byte __toc_start + 0x8000 - 0b
+ /*
+ * This is where the main kernel code starts.
+ */
++__REF
+ start_here_multiplatform:
+ /* set up the TOC */
+ bl relative_toc
+@@ -981,6 +982,7 @@ start_here_multiplatform:
+ RFI
+ b . /* prevent speculative execution */
+
++ .previous
+ /* This is where all platforms converge execution */
+
+ start_here_common:
+--
+2.20.1
+
--- /dev/null
+From 717d876915cb70736bc45e9891758937345eb5e2 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Fri, 22 Feb 2019 13:22:08 +1100
+Subject: powerpc/kvm: Save and restore host AMR/IAMR/UAMOR
+
+[ Upstream commit c3c7470c75566a077c8dc71dcf8f1948b8ddfab4 ]
+
+When the hash MMU is active the AMR, IAMR and UAMOR are used for
+pkeys. The AMR is directly writable by user space, and the UAMOR masks
+those writes, meaning both registers are effectively user register
+state. The IAMR is used to create an execute only key.
+
+Also we must maintain the value of at least the AMR when running in
+process context, so that any memory accesses done by the kernel on
+behalf of the process are correctly controlled by the AMR.
+
+Although we are correctly switching all registers when going into a
+guest, on returning to the host we just write 0 into all regs, except
+on Power9 where we restore the IAMR correctly.
+
+This could be observed by a user process if it writes the AMR, then
+runs a guest and we then return immediately to it without
+rescheduling. Because we have written 0 to the AMR that would have the
+effect of granting read/write permission to pages that the process was
+trying to protect.
+
+In addition, when using the Radix MMU, the AMR can prevent inadvertent
+kernel access to userspace data, writing 0 to the AMR disables that
+protection.
+
+So save and restore AMR, IAMR and UAMOR.
+
+Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem")
+Cc: stable@vger.kernel.org # v4.16+
+Signed-off-by: Russell Currey <ruscur@russell.cc>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv_rmhandlers.S | 26 ++++++++++++++++---------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 1d14046124a01..5902a60f92268 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -56,6 +56,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
+ #define STACK_SLOT_DAWR (SFS-56)
+ #define STACK_SLOT_DAWRX (SFS-64)
+ #define STACK_SLOT_HFSCR (SFS-72)
++#define STACK_SLOT_AMR (SFS-80)
++#define STACK_SLOT_UAMOR (SFS-88)
+
+ /*
+ * Call kvmppc_hv_entry in real mode.
+@@ -760,11 +762,9 @@ BEGIN_FTR_SECTION
+ mfspr r5, SPRN_TIDR
+ mfspr r6, SPRN_PSSCR
+ mfspr r7, SPRN_PID
+- mfspr r8, SPRN_IAMR
+ std r5, STACK_SLOT_TID(r1)
+ std r6, STACK_SLOT_PSSCR(r1)
+ std r7, STACK_SLOT_PID(r1)
+- std r8, STACK_SLOT_IAMR(r1)
+ mfspr r5, SPRN_HFSCR
+ std r5, STACK_SLOT_HFSCR(r1)
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+@@ -772,11 +772,18 @@ BEGIN_FTR_SECTION
+ mfspr r5, SPRN_CIABR
+ mfspr r6, SPRN_DAWR
+ mfspr r7, SPRN_DAWRX
++ mfspr r8, SPRN_IAMR
+ std r5, STACK_SLOT_CIABR(r1)
+ std r6, STACK_SLOT_DAWR(r1)
+ std r7, STACK_SLOT_DAWRX(r1)
++ std r8, STACK_SLOT_IAMR(r1)
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
+
++ mfspr r5, SPRN_AMR
++ std r5, STACK_SLOT_AMR(r1)
++ mfspr r6, SPRN_UAMOR
++ std r6, STACK_SLOT_UAMOR(r1)
++
+ BEGIN_FTR_SECTION
+ /* Set partition DABR */
+ /* Do this before re-enabling PMU to avoid P7 DABR corruption bug */
+@@ -1713,22 +1720,25 @@ ALT_FTR_SECTION_END_IFCLR(CPU_FTR_ARCH_300)
+ mtspr SPRN_PSPB, r0
+ mtspr SPRN_WORT, r0
+ BEGIN_FTR_SECTION
+- mtspr SPRN_IAMR, r0
+ mtspr SPRN_TCSCR, r0
+ /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
+ li r0, 1
+ sldi r0, r0, 31
+ mtspr SPRN_MMCRS, r0
+ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_300)
+-8:
+
+- /* Save and reset AMR and UAMOR before turning on the MMU */
++ /* Save and restore AMR, IAMR and UAMOR before turning on the MMU */
++ ld r8, STACK_SLOT_IAMR(r1)
++ mtspr SPRN_IAMR, r8
++
++8: /* Power7 jumps back in here */
+ mfspr r5,SPRN_AMR
+ mfspr r6,SPRN_UAMOR
+ std r5,VCPU_AMR(r9)
+ std r6,VCPU_UAMOR(r9)
+- li r6,0
+- mtspr SPRN_AMR,r6
++ ld r5,STACK_SLOT_AMR(r1)
++ ld r6,STACK_SLOT_UAMOR(r1)
++ mtspr SPRN_AMR, r5
+ mtspr SPRN_UAMOR, r6
+
+ /* Switch DSCR back to host value */
+@@ -1897,11 +1907,9 @@ BEGIN_FTR_SECTION
+ ld r5, STACK_SLOT_TID(r1)
+ ld r6, STACK_SLOT_PSSCR(r1)
+ ld r7, STACK_SLOT_PID(r1)
+- ld r8, STACK_SLOT_IAMR(r1)
+ mtspr SPRN_TIDR, r5
+ mtspr SPRN_PSSCR, r6
+ mtspr SPRN_PID, r7
+- mtspr SPRN_IAMR, r8
+ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
+
+ #ifdef CONFIG_PPC_RADIX_MMU
+--
+2.20.1
+
--- /dev/null
+From 953f9fa1b475c04ed943e555a4635526f38eccec Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Date: Wed, 10 Jul 2019 15:20:18 +1000
+Subject: powerpc/mm: Limit rma_size to 1TB when running without HV mode
+
+[ Upstream commit da0ef93310e67ae6902efded60b6724dab27a5d1 ]
+
+The virtual real mode addressing (VRMA) mechanism is used when a
+partition is using HPT (Hash Page Table) translation and performs real
+mode accesses (MSR[IR|DR] = 0) in non-hypervisor mode. In this mode
+effective address bits 0:23 are treated as zero (i.e. the access is
+aliased to 0) and the access is performed using an implicit 1TB SLB
+entry.
+
+The size of the RMA (Real Memory Area) is communicated to the guest as
+the size of the first memory region in the device tree. And because of
+the mechanism described above can be expected to not exceed 1TB. In
+the event that the host erroneously represents the RMA as being larger
+than 1TB, guest accesses in real mode to memory addresses above 1TB
+will be aliased down to below 1TB. This means that a memory access
+performed in real mode may differ to one performed in virtual mode for
+the same memory address, which would likely have unintended
+consequences.
+
+To avoid this outcome have the guest explicitly limit the size of the
+RMA to the current maximum, which is 1TB. This means that even if the
+first memory block is larger than 1TB, only the first 1TB should be
+accessed in real mode.
+
+Fixes: c610d65c0ad0 ("powerpc/pseries: lift RTAS limit for hash")
+Cc: stable@vger.kernel.org # v4.16+
+Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Tested-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190710052018.14628-1-sjitindarsingh@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/hash_utils_64.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
+index f23a89d8e4ce6..29fd8940867e5 100644
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -1859,11 +1859,20 @@ void hash__setup_initial_memory_limit(phys_addr_t first_memblock_base,
+ *
+ * For guests on platforms before POWER9, we clamp the it limit to 1G
+ * to avoid some funky things such as RTAS bugs etc...
++ *
++ * On POWER9 we limit to 1TB in case the host erroneously told us that
++ * the RMA was >1TB. Effective address bits 0:23 are treated as zero
++ * (meaning the access is aliased to zero i.e. addr = addr % 1TB)
++ * for virtual real mode addressing and so it doesn't make sense to
++ * have an area larger than 1TB as it can't be addressed.
+ */
+ if (!early_cpu_has_feature(CPU_FTR_HVMODE)) {
+ ppc64_rma_size = first_memblock_size;
+ if (!early_cpu_has_feature(CPU_FTR_ARCH_300))
+ ppc64_rma_size = min_t(u64, ppc64_rma_size, 0x40000000);
++ else
++ ppc64_rma_size = min_t(u64, ppc64_rma_size,
++ 1UL << SID_SHIFT_1T);
+
+ /* Finally limit subsequent allocations */
+ memblock_set_current_limit(ppc64_rma_size);
+--
+2.20.1
+
--- /dev/null
+From 869182e20965836bfafd1470f573c4fa9e62b292 Mon Sep 17 00:00:00 2001
+From: Ram Pai <linuxram@us.ibm.com>
+Date: Thu, 20 Dec 2018 12:03:30 -0800
+Subject: powerpc/pkeys: Fix handling of pkey state across fork()
+
+[ Upstream commit 2cd4bd192ee94848695c1c052d87913260e10f36 ]
+
+Protection key tracking information is not copied over to the
+mm_struct of the child during fork(). This can cause the child to
+erroneously allocate keys that were already allocated. Any allocated
+execute-only key is lost aswell.
+
+Add code; called by dup_mmap(), to copy the pkey state from parent to
+child explicitly.
+
+This problem was originally found by Dave Hansen on x86, which turns
+out to be a problem on powerpc aswell.
+
+Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem")
+Cc: stable@vger.kernel.org # v4.16+
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Ram Pai <linuxram@us.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/mmu_context.h | 15 +++++++++------
+ arch/powerpc/mm/pkeys.c | 10 ++++++++++
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index b694d6af11508..ae953958c0f33 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -217,12 +217,6 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
+ #endif
+ }
+
+-static inline int arch_dup_mmap(struct mm_struct *oldmm,
+- struct mm_struct *mm)
+-{
+- return 0;
+-}
+-
+ #ifndef CONFIG_PPC_BOOK3S_64
+ static inline void arch_exit_mmap(struct mm_struct *mm)
+ {
+@@ -247,6 +241,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
+ #ifdef CONFIG_PPC_MEM_KEYS
+ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
+ bool execute, bool foreign);
++void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);
+ #else /* CONFIG_PPC_MEM_KEYS */
+ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ bool write, bool execute, bool foreign)
+@@ -259,6 +254,7 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ #define thread_pkey_regs_save(thread)
+ #define thread_pkey_regs_restore(new_thread, old_thread)
+ #define thread_pkey_regs_init(thread)
++#define arch_dup_pkeys(oldmm, mm)
+
+ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
+ {
+@@ -267,5 +263,12 @@ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
+
+ #endif /* CONFIG_PPC_MEM_KEYS */
+
++static inline int arch_dup_mmap(struct mm_struct *oldmm,
++ struct mm_struct *mm)
++{
++ arch_dup_pkeys(oldmm, mm);
++ return 0;
++}
++
+ #endif /* __KERNEL__ */
+ #endif /* __ASM_POWERPC_MMU_CONTEXT_H */
+diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
+index b271b283c785e..25a8dd9cd71db 100644
+--- a/arch/powerpc/mm/pkeys.c
++++ b/arch/powerpc/mm/pkeys.c
+@@ -414,3 +414,13 @@ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
+
+ return pkey_access_permitted(vma_pkey(vma), write, execute);
+ }
++
++void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm)
++{
++ if (static_branch_likely(&pkey_disabled))
++ return;
++
++ /* Duplicate the oldmm pkey state in mm: */
++ mm_pkey_allocation_map(mm) = mm_pkey_allocation_map(oldmm);
++ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
++}
+--
+2.20.1
+
--- /dev/null
+From 3603f9f64b0cb847406bc0f615a10be7d6cdef20 Mon Sep 17 00:00:00 2001
+From: David Francis <David.Francis@amd.com>
+Date: Thu, 18 Oct 2018 11:21:15 -0400
+Subject: powerplay: Respect units on max dcfclk watermark
+
+[ Upstream commit f191415b24a3ad3fa22088af7cd7fc328a2f469f ]
+
+In a refactor, the watermark clock inputs to
+powerplay from DC were changed from units of 10kHz to
+kHz clocks.
+
+One division by 100 was not converted into a division
+by 1000.
+
+Signed-off-by: David Francis <David.Francis@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+index 2aab1b4759459..a321c465b7dce 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+@@ -674,7 +674,7 @@ int smu_set_watermarks_for_clocks_ranges(void *wt_table,
+ table->WatermarkRow[1][i].MaxClock =
+ cpu_to_le16((uint16_t)
+ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_max_dcfclk_clk_in_khz) /
+- 100);
++ 1000);
+ table->WatermarkRow[1][i].MinUclk =
+ cpu_to_le16((uint16_t)
+ (wm_with_clock_ranges->wm_dmif_clocks_ranges[i].wm_min_mem_clk_in_khz) /
+--
+2.20.1
+
--- /dev/null
+From 4aab0c04eef05cbdde97b2497fe8c0b9b572ed97 Mon Sep 17 00:00:00 2001
+From: Norbert Manthey <nmanthey@amazon.de>
+Date: Fri, 5 Jul 2019 15:06:00 +0200
+Subject: pstore: Fix double-free in pstore_mkfile() failure path
+
+[ Upstream commit 4c6d80e1144bdf48cae6b602ae30d41f3e5c76a9 ]
+
+The pstore_mkfile() function is passed a pointer to a struct
+pstore_record. On success it consumes this 'record' pointer and
+references it from the created inode.
+
+On failure, however, it may or may not free the record. There are even
+two different code paths which return -ENOMEM -- one of which does and
+the other doesn't free the record.
+
+Make the behaviour deterministic by never consuming and freeing the
+record when returning failure, allowing the caller to do the cleanup
+consistently.
+
+Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
+Link: https://lore.kernel.org/r/1562331960-26198-1-git-send-email-nmanthey@amazon.de
+Fixes: 83f70f0769ddd ("pstore: Do not duplicate record metadata")
+Fixes: 1dfff7dd67d1a ("pstore: Pass record contents instead of copying")
+Cc: stable@vger.kernel.org
+[kees: also move "private" allocation location, rename inode cleanup label]
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/inode.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index 8cf2218b46a75..6f90d91a8733a 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -330,10 +330,6 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
+ goto fail;
+ inode->i_mode = S_IFREG | 0444;
+ inode->i_fop = &pstore_file_operations;
+- private = kzalloc(sizeof(*private), GFP_KERNEL);
+- if (!private)
+- goto fail_alloc;
+- private->record = record;
+
+ switch (record->type) {
+ case PSTORE_TYPE_DMESG:
+@@ -383,12 +379,16 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
+ break;
+ }
+
++ private = kzalloc(sizeof(*private), GFP_KERNEL);
++ if (!private)
++ goto fail_inode;
++
+ dentry = d_alloc_name(root, name);
+ if (!dentry)
+ goto fail_private;
+
++ private->record = record;
+ inode->i_size = private->total_size = size;
+-
+ inode->i_private = private;
+
+ if (record->time.tv_sec)
+@@ -404,7 +404,7 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record)
+
+ fail_private:
+ free_pstore_private(private);
+-fail_alloc:
++fail_inode:
+ iput(inode);
+
+ fail:
+--
+2.20.1
+
--- /dev/null
+From de67ee0582dd03283eaaed60deadaf57b2e7ba62 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 29 May 2019 09:38:31 -0700
+Subject: RDMA/srp: Accept again source addresses that do not have a port
+ number
+
+[ Upstream commit bcef5b7215681250c4bf8961dfe15e9e4fef97d0 ]
+
+The function srp_parse_in() is used both for parsing source address
+specifications and for target address specifications. Target addresses
+must have a port number. Having to specify a port number for source
+addresses is inconvenient. Make sure that srp_parse_in() supports again
+parsing addresses with no port number.
+
+Cc: <stable@vger.kernel.org>
+Fixes: c62adb7def71 ("IB/srp: Fix IPv6 address parsing")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 9da30d88a615e..bc6a44a16445c 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -3404,13 +3404,14 @@ static const match_table_t srp_opt_tokens = {
+ * @net: [in] Network namespace.
+ * @sa: [out] Address family, IP address and port number.
+ * @addr_port_str: [in] IP address and port number.
++ * @has_port: [out] Whether or not @addr_port_str includes a port number.
+ *
+ * Parse the following address formats:
+ * - IPv4: <ip_address>:<port>, e.g. 1.2.3.4:5.
+ * - IPv6: \[<ipv6_address>\]:<port>, e.g. [1::2:3%4]:5.
+ */
+ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa,
+- const char *addr_port_str)
++ const char *addr_port_str, bool *has_port)
+ {
+ char *addr_end, *addr = kstrdup(addr_port_str, GFP_KERNEL);
+ char *port_str;
+@@ -3419,9 +3420,12 @@ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa,
+ if (!addr)
+ return -ENOMEM;
+ port_str = strrchr(addr, ':');
+- if (!port_str)
+- return -EINVAL;
+- *port_str++ = '\0';
++ if (port_str && strchr(port_str, ']'))
++ port_str = NULL;
++ if (port_str)
++ *port_str++ = '\0';
++ if (has_port)
++ *has_port = port_str != NULL;
+ ret = inet_pton_with_scope(net, AF_INET, addr, port_str, sa);
+ if (ret && addr[0]) {
+ addr_end = addr + strlen(addr) - 1;
+@@ -3443,6 +3447,7 @@ static int srp_parse_options(struct net *net, const char *buf,
+ char *p;
+ substring_t args[MAX_OPT_ARGS];
+ unsigned long long ull;
++ bool has_port;
+ int opt_mask = 0;
+ int token;
+ int ret = -EINVAL;
+@@ -3541,7 +3546,8 @@ static int srp_parse_options(struct net *net, const char *buf,
+ ret = -ENOMEM;
+ goto out;
+ }
+- ret = srp_parse_in(net, &target->rdma_cm.src.ss, p);
++ ret = srp_parse_in(net, &target->rdma_cm.src.ss, p,
++ NULL);
+ if (ret < 0) {
+ pr_warn("bad source parameter '%s'\n", p);
+ kfree(p);
+@@ -3557,7 +3563,10 @@ static int srp_parse_options(struct net *net, const char *buf,
+ ret = -ENOMEM;
+ goto out;
+ }
+- ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p);
++ ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p,
++ &has_port);
++ if (!has_port)
++ ret = -EINVAL;
+ if (ret < 0) {
+ pr_warn("bad dest parameter '%s'\n", p);
+ kfree(p);
+--
+2.20.1
+
--- /dev/null
+From 8c429f260f8770b260195a5ef2330c61d1ddff90 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 17 Dec 2018 13:20:34 -0800
+Subject: RDMA/srp: Document srp_parse_in() arguments
+
+[ Upstream commit e37df2d5b569390e3b80ebed9a73fd5b9dcda010 ]
+
+This patch avoids that a warning is reported when building with W=1.
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 2c1114ee0c6da..9da30d88a615e 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -3401,6 +3401,9 @@ static const match_table_t srp_opt_tokens = {
+
+ /**
+ * srp_parse_in - parse an IP address and port number combination
++ * @net: [in] Network namespace.
++ * @sa: [out] Address family, IP address and port number.
++ * @addr_port_str: [in] IP address and port number.
+ *
+ * Parse the following address formats:
+ * - IPv4: <ip_address>:<port>, e.g. 1.2.3.4:5.
+--
+2.20.1
+
--- /dev/null
+From 6eb4ac425748955939aa1aabbb2950700de0b831 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Mon, 8 Oct 2018 19:08:05 -0700
+Subject: remoteproc: qcom: q6v5-mss: add SCM probe dependency
+
+[ Upstream commit bbcda30271752bb7490f2e2aef5411dbcae69116 ]
+
+The memory ownership transfer request is performed using SCM, ensure
+that SCM is available before we probe the driver if memory protection is
+needed by the subsystem.
+
+Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch")
+Cc: stable@vger.kernel.org
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+[bjorn: Added condition for need_mem_protection, updated commit message]
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5_pil.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c
+index d7a4b9eca5d25..6a84b6372897d 100644
+--- a/drivers/remoteproc/qcom_q6v5_pil.c
++++ b/drivers/remoteproc/qcom_q6v5_pil.c
+@@ -1132,6 +1132,9 @@ static int q6v5_probe(struct platform_device *pdev)
+ if (!desc)
+ return -EINVAL;
+
++ if (desc->need_mem_protection && !qcom_scm_is_available())
++ return -EPROBE_DEFER;
++
+ rproc = rproc_alloc(&pdev->dev, pdev->name, &q6v5_ops,
+ desc->hexagon_mba_image, sizeof(*qproc));
+ if (!rproc) {
+--
+2.20.1
+
--- /dev/null
+From 48c56a32d5d02af0e05cfd2a7cd9a26ac2f724c6 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Tue, 9 Oct 2018 15:25:27 -0700
+Subject: remoteproc: qcom: q6v5: shore up resource probe handling
+
+[ Upstream commit 1e2517d126171a41f801738ffd19687836cd178a ]
+
+Commit d5269c4553a6 ("remoteproc: qcom: q6v5: Propagate EPROBE_DEFER")
+fixed up our probe code to handle -EPROBE_DEFER, but it ignored one of
+our interrupts, and it also didn't really handle all the other error
+codes you might get (e.g., with a bad DT definition). Handle those all
+explicitly.
+
+Fixes: d5269c4553a6 ("remoteproc: qcom: q6v5: Propagate EPROBE_DEFER")
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 44 +++++++++++++++++++++++++++-------
+ 1 file changed, 36 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index e9ab90c19304f..602af839421de 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -188,6 +188,14 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ init_completion(&q6v5->stop_done);
+
+ q6v5->wdog_irq = platform_get_irq_byname(pdev, "wdog");
++ if (q6v5->wdog_irq < 0) {
++ if (q6v5->wdog_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve wdog IRQ: %d\n",
++ q6v5->wdog_irq);
++ return q6v5->wdog_irq;
++ }
++
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->wdog_irq,
+ NULL, q6v5_wdog_interrupt,
+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+@@ -198,8 +206,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->fatal_irq = platform_get_irq_byname(pdev, "fatal");
+- if (q6v5->fatal_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->fatal_irq < 0) {
++ if (q6v5->fatal_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve fatal IRQ: %d\n",
++ q6v5->fatal_irq);
++ return q6v5->fatal_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->fatal_irq,
+ NULL, q6v5_fatal_interrupt,
+@@ -211,8 +224,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->ready_irq = platform_get_irq_byname(pdev, "ready");
+- if (q6v5->ready_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->ready_irq < 0) {
++ if (q6v5->ready_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve ready IRQ: %d\n",
++ q6v5->ready_irq);
++ return q6v5->ready_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->ready_irq,
+ NULL, q6v5_ready_interrupt,
+@@ -224,8 +242,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ }
+
+ q6v5->handover_irq = platform_get_irq_byname(pdev, "handover");
+- if (q6v5->handover_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->handover_irq < 0) {
++ if (q6v5->handover_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve handover IRQ: %d\n",
++ q6v5->handover_irq);
++ return q6v5->handover_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->handover_irq,
+ NULL, q6v5_handover_interrupt,
+@@ -238,8 +261,13 @@ int qcom_q6v5_init(struct qcom_q6v5 *q6v5, struct platform_device *pdev,
+ disable_irq(q6v5->handover_irq);
+
+ q6v5->stop_irq = platform_get_irq_byname(pdev, "stop-ack");
+- if (q6v5->stop_irq == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (q6v5->stop_irq < 0) {
++ if (q6v5->stop_irq != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "failed to retrieve stop-ack IRQ: %d\n",
++ q6v5->stop_irq);
++ return q6v5->stop_irq;
++ }
+
+ ret = devm_request_threaded_irq(&pdev->dev, q6v5->stop_irq,
+ NULL, q6v5_stop_interrupt,
+--
+2.20.1
+
--- /dev/null
+From 14e7cd8375dcd0088fe1d1df388a74f7f0dc55ab Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 27 Sep 2018 09:22:09 -0500
+Subject: resource: Fix find_next_iomem_res() iteration issue
+
+[ Upstream commit 010a93bf97c72f43aac664d0a685942f83d1a103 ]
+
+Previously find_next_iomem_res() used "*res" as both an input parameter for
+the range to search and the type of resource to search for, and an output
+parameter for the resource we found, which makes the interface confusing.
+
+The current callers use find_next_iomem_res() incorrectly because they
+allocate a single struct resource and use it for repeated calls to
+find_next_iomem_res(). When find_next_iomem_res() returns a resource, it
+overwrites the start, end, flags, and desc members of the struct. If we
+call find_next_iomem_res() again, we must update or restore these fields.
+The previous code restored res.start and res.end, but not res.flags or
+res.desc.
+
+Since the callers did not restore res.flags, if they searched for flags
+IORESOURCE_MEM | IORESOURCE_BUSY and found a resource with flags
+IORESOURCE_MEM | IORESOURCE_BUSY | IORESOURCE_SYSRAM, the next search would
+incorrectly skip resources unless they were also marked as
+IORESOURCE_SYSRAM.
+
+Fix this by restructuring the interface so it takes explicit "start, end,
+flags" parameters and uses "*res" only as an output parameter.
+
+Based on a patch by Lianbo Jiang <lijiang@redhat.com>.
+
+ [ bp: While at it:
+ - make comments kernel-doc style.
+ -
+
+Originally-by: http://lore.kernel.org/lkml/20180921073211.20097-2-lijiang@redhat.com
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: Andrew Morton <akpm@linux-foundation.org>
+CC: Brijesh Singh <brijesh.singh@amd.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: H. Peter Anvin <hpa@zytor.com>
+CC: Lianbo Jiang <lijiang@redhat.com>
+CC: Takashi Iwai <tiwai@suse.de>
+CC: Thomas Gleixner <tglx@linutronix.de>
+CC: Tom Lendacky <thomas.lendacky@amd.com>
+CC: Vivek Goyal <vgoyal@redhat.com>
+CC: Yaowei Bai <baiyaowei@cmss.chinamobile.com>
+CC: bhe@redhat.com
+CC: dan.j.williams@intel.com
+CC: dyoung@redhat.com
+CC: kexec@lists.infradead.org
+CC: mingo@redhat.com
+CC: x86-ml <x86@kernel.org>
+Link: http://lkml.kernel.org/r/153805812916.1157.177580438135143788.stgit@bhelgaas-glaptop.roam.corp.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/resource.c | 96 +++++++++++++++++++++--------------------------
+ 1 file changed, 42 insertions(+), 54 deletions(-)
+
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 155ec873ea4d1..38b8d11c9eaf4 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -318,24 +318,27 @@ int release_resource(struct resource *old)
+
+ EXPORT_SYMBOL(release_resource);
+
+-/*
+- * Finds the lowest iomem resource existing within [res->start..res->end].
+- * The caller must specify res->start, res->end, res->flags, and optionally
+- * desc. If found, returns 0, res is overwritten, if not found, returns -1.
+- * This function walks the whole tree and not just first level children until
+- * and unless first_level_children_only is true.
++/**
++ * Finds the lowest iomem resource that covers part of [start..end]. The
++ * caller must specify start, end, flags, and desc (which may be
++ * IORES_DESC_NONE).
++ *
++ * If a resource is found, returns 0 and *res is overwritten with the part
++ * of the resource that's within [start..end]; if none is found, returns
++ * -1.
++ *
++ * This function walks the whole tree and not just first level children
++ * unless @first_level_children_only is true.
+ */
+-static int find_next_iomem_res(struct resource *res, unsigned long desc,
+- bool first_level_children_only)
++static int find_next_iomem_res(resource_size_t start, resource_size_t end,
++ unsigned long flags, unsigned long desc,
++ bool first_level_children_only,
++ struct resource *res)
+ {
+- resource_size_t start, end;
+ struct resource *p;
+ bool sibling_only = false;
+
+ BUG_ON(!res);
+-
+- start = res->start;
+- end = res->end;
+ BUG_ON(start >= end);
+
+ if (first_level_children_only)
+@@ -344,7 +347,7 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
+ read_lock(&resource_lock);
+
+ for (p = iomem_resource.child; p; p = next_resource(p, sibling_only)) {
+- if ((p->flags & res->flags) != res->flags)
++ if ((p->flags & flags) != flags)
+ continue;
+ if ((desc != IORES_DESC_NONE) && (desc != p->desc))
+ continue;
+@@ -359,32 +362,31 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
+ read_unlock(&resource_lock);
+ if (!p)
+ return -1;
++
+ /* copy data */
+- if (res->start < p->start)
+- res->start = p->start;
+- if (res->end > p->end)
+- res->end = p->end;
++ res->start = max(start, p->start);
++ res->end = min(end, p->end);
+ res->flags = p->flags;
+ res->desc = p->desc;
+ return 0;
+ }
+
+-static int __walk_iomem_res_desc(struct resource *res, unsigned long desc,
+- bool first_level_children_only,
+- void *arg,
++static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end,
++ unsigned long flags, unsigned long desc,
++ bool first_level_children_only, void *arg,
+ int (*func)(struct resource *, void *))
+ {
+- u64 orig_end = res->end;
++ struct resource res;
+ int ret = -1;
+
+- while ((res->start < res->end) &&
+- !find_next_iomem_res(res, desc, first_level_children_only)) {
+- ret = (*func)(res, arg);
++ while (start < end &&
++ !find_next_iomem_res(start, end, flags, desc,
++ first_level_children_only, &res)) {
++ ret = (*func)(&res, arg);
+ if (ret)
+ break;
+
+- res->start = res->end + 1;
+- res->end = orig_end;
++ start = res.end + 1;
+ }
+
+ return ret;
+@@ -407,13 +409,7 @@ static int __walk_iomem_res_desc(struct resource *res, unsigned long desc,
+ int walk_iomem_res_desc(unsigned long desc, unsigned long flags, u64 start,
+ u64 end, void *arg, int (*func)(struct resource *, void *))
+ {
+- struct resource res;
+-
+- res.start = start;
+- res.end = end;
+- res.flags = flags;
+-
+- return __walk_iomem_res_desc(&res, desc, false, arg, func);
++ return __walk_iomem_res_desc(start, end, flags, desc, false, arg, func);
+ }
+ EXPORT_SYMBOL_GPL(walk_iomem_res_desc);
+
+@@ -427,13 +423,9 @@ EXPORT_SYMBOL_GPL(walk_iomem_res_desc);
+ int walk_system_ram_res(u64 start, u64 end, void *arg,
+ int (*func)(struct resource *, void *))
+ {
+- struct resource res;
++ unsigned long flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+
+- res.start = start;
+- res.end = end;
+- res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+-
+- return __walk_iomem_res_desc(&res, IORES_DESC_NONE, true,
++ return __walk_iomem_res_desc(start, end, flags, IORES_DESC_NONE, true,
+ arg, func);
+ }
+
+@@ -444,13 +436,9 @@ int walk_system_ram_res(u64 start, u64 end, void *arg,
+ int walk_mem_res(u64 start, u64 end, void *arg,
+ int (*func)(struct resource *, void *))
+ {
+- struct resource res;
++ unsigned long flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+
+- res.start = start;
+- res.end = end;
+- res.flags = IORESOURCE_MEM | IORESOURCE_BUSY;
+-
+- return __walk_iomem_res_desc(&res, IORES_DESC_NONE, true,
++ return __walk_iomem_res_desc(start, end, flags, IORES_DESC_NONE, true,
+ arg, func);
+ }
+
+@@ -464,25 +452,25 @@ int walk_mem_res(u64 start, u64 end, void *arg,
+ int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages,
+ void *arg, int (*func)(unsigned long, unsigned long, void *))
+ {
++ resource_size_t start, end;
++ unsigned long flags;
+ struct resource res;
+ unsigned long pfn, end_pfn;
+- u64 orig_end;
+ int ret = -1;
+
+- res.start = (u64) start_pfn << PAGE_SHIFT;
+- res.end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1;
+- res.flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+- orig_end = res.end;
+- while ((res.start < res.end) &&
+- (find_next_iomem_res(&res, IORES_DESC_NONE, true) >= 0)) {
++ start = (u64) start_pfn << PAGE_SHIFT;
++ end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1;
++ flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
++ while (start < end &&
++ !find_next_iomem_res(start, end, flags, IORES_DESC_NONE,
++ true, &res)) {
+ pfn = (res.start + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ end_pfn = (res.end + 1) >> PAGE_SHIFT;
+ if (end_pfn > pfn)
+ ret = (*func)(pfn, end_pfn - pfn, arg);
+ if (ret)
+ break;
+- res.start = res.end + 1;
+- res.end = orig_end;
++ start = res.end + 1;
+ }
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 2ca04355a063ab6355cce76e215eceaac3edcc1d Mon Sep 17 00:00:00 2001
+From: Nadav Amit <namit@vmware.com>
+Date: Thu, 18 Jul 2019 15:57:31 -0700
+Subject: resource: fix locking in find_next_iomem_res()
+
+[ Upstream commit 49f17c26c123b60fd1c74629eef077740d16ffc2 ]
+
+Since resources can be removed, locking should ensure that the resource
+is not removed while accessing it. However, find_next_iomem_res() does
+not hold the lock while copying the data of the resource.
+
+Keep holding the lock while the data is copied. While at it, change the
+return value to a more informative value. It is disregarded by the
+callers.
+
+[akpm@linux-foundation.org: fix find_next_iomem_res() documentation]
+Link: http://lkml.kernel.org/r/20190613045903.4922-2-namit@vmware.com
+Fixes: ff3cc952d3f00 ("resource: Add remove_resource interface")
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Toshi Kani <toshi.kani@hpe.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/resource.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 38b8d11c9eaf4..bce773cc5e416 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -325,7 +325,7 @@ EXPORT_SYMBOL(release_resource);
+ *
+ * If a resource is found, returns 0 and *res is overwritten with the part
+ * of the resource that's within [start..end]; if none is found, returns
+- * -1.
++ * -ENODEV. Returns -EINVAL for invalid parameters.
+ *
+ * This function walks the whole tree and not just first level children
+ * unless @first_level_children_only is true.
+@@ -359,16 +359,16 @@ static int find_next_iomem_res(resource_size_t start, resource_size_t end,
+ break;
+ }
+
++ if (p) {
++ /* copy data */
++ res->start = max(start, p->start);
++ res->end = min(end, p->end);
++ res->flags = p->flags;
++ res->desc = p->desc;
++ }
++
+ read_unlock(&resource_lock);
+- if (!p)
+- return -1;
+-
+- /* copy data */
+- res->start = max(start, p->start);
+- res->end = min(end, p->end);
+- res->flags = p->flags;
+- res->desc = p->desc;
+- return 0;
++ return p ? 0 : -ENODEV;
+ }
+
+ static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end,
+--
+2.20.1
+
--- /dev/null
+From 510eff8f0d113dd5d748772a55b8adbdf8c7dec9 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 27 Sep 2018 09:22:02 -0500
+Subject: resource: Include resource end in walk_*() interfaces
+
+[ Upstream commit a98959fdbda1849a01b2150bb635ed559ec06700 ]
+
+find_next_iomem_res() finds an iomem resource that covers part of a range
+described by "start, end". All callers expect that range to be inclusive,
+i.e., both start and end are included, but find_next_iomem_res() doesn't
+handle the end address correctly.
+
+If it finds an iomem resource that contains exactly the end address, it
+skips it, e.g., if "start, end" is [0x0-0x10000] and there happens to be an
+iomem resource [mem 0x10000-0x10000] (the single byte at 0x10000), we skip
+it:
+
+ find_next_iomem_res(...)
+ {
+ start = 0x0;
+ end = 0x10000;
+ for (p = next_resource(...)) {
+ # p->start = 0x10000;
+ # p->end = 0x10000;
+ # we *should* return this resource, but this condition is false:
+ if ((p->end >= start) && (p->start < end))
+ break;
+
+Adjust find_next_iomem_res() so it allows a resource that includes the
+single byte at the end of the range. This is a corner case that we
+probably don't see in practice.
+
+Fixes: 58c1b5b07907 ("[PATCH] memory hotadd fixes: find_next_system_ram catch range fix")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: Andrew Morton <akpm@linux-foundation.org>
+CC: Brijesh Singh <brijesh.singh@amd.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: H. Peter Anvin <hpa@zytor.com>
+CC: Lianbo Jiang <lijiang@redhat.com>
+CC: Takashi Iwai <tiwai@suse.de>
+CC: Thomas Gleixner <tglx@linutronix.de>
+CC: Tom Lendacky <thomas.lendacky@amd.com>
+CC: Vivek Goyal <vgoyal@redhat.com>
+CC: Yaowei Bai <baiyaowei@cmss.chinamobile.com>
+CC: bhe@redhat.com
+CC: dan.j.williams@intel.com
+CC: dyoung@redhat.com
+CC: kexec@lists.infradead.org
+CC: mingo@redhat.com
+CC: x86-ml <x86@kernel.org>
+Link: http://lkml.kernel.org/r/153805812254.1157.16736368485811773752.stgit@bhelgaas-glaptop.roam.corp.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/resource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/resource.c b/kernel/resource.c
+index 30e1bc68503b5..155ec873ea4d1 100644
+--- a/kernel/resource.c
++++ b/kernel/resource.c
+@@ -319,7 +319,7 @@ int release_resource(struct resource *old)
+ EXPORT_SYMBOL(release_resource);
+
+ /*
+- * Finds the lowest iomem resource existing within [res->start.res->end).
++ * Finds the lowest iomem resource existing within [res->start..res->end].
+ * The caller must specify res->start, res->end, res->flags, and optionally
+ * desc. If found, returns 0, res is overwritten, if not found, returns -1.
+ * This function walks the whole tree and not just first level children until
+@@ -352,7 +352,7 @@ static int find_next_iomem_res(struct resource *res, unsigned long desc,
+ p = NULL;
+ break;
+ }
+- if ((p->end >= start) && (p->start < end))
++ if ((p->end >= start) && (p->start <= end))
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2842e6c5774dbec82b47ca8ec4d343843645b9a9 Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@gmail.com>
+Date: Thu, 6 Dec 2018 11:26:26 +0100
+Subject: riscv: remove unused variable in ftrace
+
+[ Upstream commit 397182e0db56b8894a43631ce72de14d90a29834 ]
+
+Noticed while building kernel-4.20.0-0.rc5.git2.1.fc30 for
+Fedora 30/RISCV.
+
+[..]
+BUILDSTDERR: arch/riscv/kernel/ftrace.c: In function 'prepare_ftrace_return':
+BUILDSTDERR: arch/riscv/kernel/ftrace.c:135:6: warning: unused variable 'err' [-Wunused-variable]
+BUILDSTDERR: int err;
+BUILDSTDERR: ^~~
+[..]
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@gmail.com>
+Fixes: e949b6db51dc1 ("riscv/function_graph: Simplify with function_graph_enter()")
+Reviewed-by: Olof Johansson <olof@lixom.net>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/ftrace.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index c433f6d3dd64f..a840b7d074f7d 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -132,7 +132,6 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ {
+ unsigned long return_hooker = (unsigned long)&return_to_handler;
+ unsigned long old;
+- int err;
+
+ if (unlikely(atomic_read(¤t->tracing_graph_pause)))
+ return;
+--
+2.20.1
+
--- /dev/null
+From 49bcf77cebaac2d3687416075100f83cc272a4cf Mon Sep 17 00:00:00 2001
+From: Harald Freudenberger <freude@linux.ibm.com>
+Date: Fri, 9 Nov 2018 14:59:24 +0100
+Subject: s390/zcrypt: reinit ap queue state machine during device probe
+
+[ Upstream commit 104f708fd1241b22f808bdf066ab67dc5a051de5 ]
+
+Until the vfio-ap driver came into live there was a well known
+agreement about the way how ap devices are initialized and their
+states when the driver's probe function is called.
+
+However, the vfio device driver when receiving an ap queue device does
+additional resets thereby removing the registration for interrupts for
+the ap device done by the ap bus core code. So when later the vfio
+driver releases the device and one of the default zcrypt drivers takes
+care of the device the interrupt registration needs to get
+renewed. The current code does no renew and result is that requests
+send into such a queue will never see a reply processed - the
+application hangs.
+
+This patch adds a function which resets the aq queue state machine for
+the ap queue device and triggers the walk through the initial states
+(which are reset and registration for interrupts). This function is
+now called before the driver's probe function is invoked.
+
+When the association between driver and device is released, the
+driver's remove function is called. The current implementation calls a
+ap queue function ap_queue_remove(). This invokation has been moved to
+the ap bus function to make the probe / remove pair for ap bus and
+drivers more symmetric.
+
+Fixes: 7e0bdbe5c21c ("s390/zcrypt: AP bus support for alternate driver(s)")
+Cc: stable@vger.kernel.org # 4.19+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Reviewd-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Reviewd-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_bus.c | 8 ++++----
+ drivers/s390/crypto/ap_bus.h | 1 +
+ drivers/s390/crypto/ap_queue.c | 15 +++++++++++++++
+ drivers/s390/crypto/zcrypt_cex2a.c | 1 -
+ drivers/s390/crypto/zcrypt_cex4.c | 1 -
+ drivers/s390/crypto/zcrypt_pcixcc.c | 1 -
+ 6 files changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index a57b969b89733..3be54651698a3 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -777,6 +777,8 @@ static int ap_device_probe(struct device *dev)
+ drvres = ap_drv->flags & AP_DRIVER_FLAG_DEFAULT;
+ if (!!devres != !!drvres)
+ return -ENODEV;
++ /* (re-)init queue's state machine */
++ ap_queue_reinit_state(to_ap_queue(dev));
+ }
+
+ /* Add queue/card to list of active queues/cards */
+@@ -809,6 +811,8 @@ static int ap_device_remove(struct device *dev)
+ struct ap_device *ap_dev = to_ap_dev(dev);
+ struct ap_driver *ap_drv = ap_dev->drv;
+
++ if (is_queue_dev(dev))
++ ap_queue_remove(to_ap_queue(dev));
+ if (ap_drv->remove)
+ ap_drv->remove(ap_dev);
+
+@@ -1446,10 +1450,6 @@ static void ap_scan_bus(struct work_struct *unused)
+ aq->ap_dev.device.parent = &ac->ap_dev.device;
+ dev_set_name(&aq->ap_dev.device,
+ "%02x.%04x", id, dom);
+- /* Start with a device reset */
+- spin_lock_bh(&aq->lock);
+- ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
+- spin_unlock_bh(&aq->lock);
+ /* Register device */
+ rc = device_register(&aq->ap_dev.device);
+ if (rc) {
+diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
+index 5246cd8c16a60..7e85d238767ba 100644
+--- a/drivers/s390/crypto/ap_bus.h
++++ b/drivers/s390/crypto/ap_bus.h
+@@ -253,6 +253,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type);
+ void ap_queue_remove(struct ap_queue *aq);
+ void ap_queue_suspend(struct ap_device *ap_dev);
+ void ap_queue_resume(struct ap_device *ap_dev);
++void ap_queue_reinit_state(struct ap_queue *aq);
+
+ struct ap_card *ap_card_create(int id, int queue_depth, int raw_device_type,
+ int comp_device_type, unsigned int functions);
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 66f7334bcb032..0aa4b3ccc948c 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -718,5 +718,20 @@ void ap_queue_remove(struct ap_queue *aq)
+ {
+ ap_flush_queue(aq);
+ del_timer_sync(&aq->timeout);
++
++ /* reset with zero, also clears irq registration */
++ spin_lock_bh(&aq->lock);
++ ap_zapq(aq->qid);
++ aq->state = AP_STATE_BORKED;
++ spin_unlock_bh(&aq->lock);
+ }
+ EXPORT_SYMBOL(ap_queue_remove);
++
++void ap_queue_reinit_state(struct ap_queue *aq)
++{
++ spin_lock_bh(&aq->lock);
++ aq->state = AP_STATE_RESET_START;
++ ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
++ spin_unlock_bh(&aq->lock);
++}
++EXPORT_SYMBOL(ap_queue_reinit_state);
+diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
+index f4ae5fa30ec97..ff17a00273f77 100644
+--- a/drivers/s390/crypto/zcrypt_cex2a.c
++++ b/drivers/s390/crypto/zcrypt_cex2a.c
+@@ -198,7 +198,6 @@ static void zcrypt_cex2a_queue_remove(struct ap_device *ap_dev)
+ struct ap_queue *aq = to_ap_queue(&ap_dev->device);
+ struct zcrypt_queue *zq = aq->private;
+
+- ap_queue_remove(aq);
+ if (zq)
+ zcrypt_queue_unregister(zq);
+ }
+diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
+index 35d58dbbc4da3..2a42e5962317a 100644
+--- a/drivers/s390/crypto/zcrypt_cex4.c
++++ b/drivers/s390/crypto/zcrypt_cex4.c
+@@ -273,7 +273,6 @@ static void zcrypt_cex4_queue_remove(struct ap_device *ap_dev)
+ struct ap_queue *aq = to_ap_queue(&ap_dev->device);
+ struct zcrypt_queue *zq = aq->private;
+
+- ap_queue_remove(aq);
+ if (zq)
+ zcrypt_queue_unregister(zq);
+ }
+diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
+index 94d9f7224aea3..baa683c3f5d30 100644
+--- a/drivers/s390/crypto/zcrypt_pcixcc.c
++++ b/drivers/s390/crypto/zcrypt_pcixcc.c
+@@ -276,7 +276,6 @@ static void zcrypt_pcixcc_queue_remove(struct ap_device *ap_dev)
+ struct ap_queue *aq = to_ap_queue(&ap_dev->device);
+ struct zcrypt_queue *zq = aq->private;
+
+- ap_queue_remove(aq);
+ if (zq)
+ zcrypt_queue_unregister(zq);
+ }
+--
+2.20.1
+
--- /dev/null
+From bfad50b575aa3d5a0941aa552b23449f103dccb5 Mon Sep 17 00:00:00 2001
+From: Nicolas Boichat <drinkcat@chromium.org>
+Date: Thu, 11 Jul 2019 20:52:27 -0700
+Subject: scripts/decode_stacktrace: match basepath using shell prefix
+ operator, not regex
+
+[ Upstream commit 31013836a71e07751a6827f9d2ad41ef502ddaff ]
+
+The basepath may contain special characters, which would confuse the regex
+matcher. ${var#prefix} does the right thing.
+
+Link: http://lkml.kernel.org/r/20190518055946.181563-1-drinkcat@chromium.org
+Fixes: 67a28de47faa8358 ("scripts/decode_stacktrace: only strip base path when a prefix of the path")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/decode_stacktrace.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index c4a9ddb174bc5..5aa75a0a1cede 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -78,7 +78,7 @@ parse_symbol() {
+ fi
+
+ # Strip out the base of the path
+- code=${code//^$basepath/""}
++ code=${code#$basepath/}
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+--
+2.20.1
+
--- /dev/null
+From 7af80dc299fe6b46da069f744f438d2dcd8524b3 Mon Sep 17 00:00:00 2001
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Date: Tue, 16 Oct 2018 23:37:42 -0700
+Subject: scsi: megaraid_sas: Add check for reset adapter bit
+
+[ Upstream commit de93b40d98ead27ee2f7f7df93fdd4914a6c8d8d ]
+
+For SAS3 and later controllers, FW sets the reset adapter bit indicating
+the driver to perform a controller reset. Driver needs to check if this
+bit is set before doing a reset. This reduces the driver probe failure
+time to 180seconds in case there is a faulty controller connected.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 33 +++++++++++++++--------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index b6fc7c6337610..749f10146f630 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5218,7 +5218,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ {
+ u32 max_sectors_1;
+ u32 max_sectors_2, tmp_sectors, msix_enable;
+- u32 scratch_pad_2, scratch_pad_3, scratch_pad_4;
++ u32 scratch_pad_2, scratch_pad_3, scratch_pad_4, status_reg;
+ resource_size_t base_addr;
+ struct megasas_register_set __iomem *reg_set;
+ struct megasas_ctrl_info *ctrl_info = NULL;
+@@ -5226,6 +5226,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ int i, j, loop, fw_msix_count = 0;
+ struct IOV_111 *iovPtr;
+ struct fusion_context *fusion;
++ bool do_adp_reset = true;
+
+ fusion = instance->ctrl_context;
+
+@@ -5274,19 +5275,29 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ }
+
+ if (megasas_transition_to_ready(instance, 0)) {
+- atomic_set(&instance->fw_reset_no_pci_access, 1);
+- instance->instancet->adp_reset
+- (instance, instance->reg_set);
+- atomic_set(&instance->fw_reset_no_pci_access, 0);
+- dev_info(&instance->pdev->dev,
+- "FW restarted successfully from %s!\n",
+- __func__);
++ if (instance->adapter_type >= INVADER_SERIES) {
++ status_reg = instance->instancet->read_fw_status_reg(
++ instance->reg_set);
++ do_adp_reset = status_reg & MFI_RESET_ADAPTER;
++ }
+
+- /*waitting for about 30 second before retry*/
+- ssleep(30);
++ if (do_adp_reset) {
++ atomic_set(&instance->fw_reset_no_pci_access, 1);
++ instance->instancet->adp_reset
++ (instance, instance->reg_set);
++ atomic_set(&instance->fw_reset_no_pci_access, 0);
++ dev_info(&instance->pdev->dev,
++ "FW restarted successfully from %s!\n",
++ __func__);
++
++ /*waiting for about 30 second before retry*/
++ ssleep(30);
+
+- if (megasas_transition_to_ready(instance, 0))
++ if (megasas_transition_to_ready(instance, 0))
++ goto fail_ready_state;
++ } else {
+ goto fail_ready_state;
++ }
+ }
+
+ megasas_init_ctrl_params(instance);
+--
+2.20.1
+
--- /dev/null
+From 1f644e12fd0affdf9a569bdfb5560b93eecabf95 Mon Sep 17 00:00:00 2001
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Date: Tue, 16 Oct 2018 23:37:46 -0700
+Subject: scsi: megaraid_sas: Fix combined reply queue mode detection
+
+[ Upstream commit e29c322133472628c6de85efb99ccd3b3df5571e ]
+
+For Invader series, if FW supports more than 8 MSI-x vectors, driver needs
+to enable combined reply queue mode. For Ventura series, driver enables
+combined reply queue mode in case of more than 16 MSI-x vectors.
+
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 806ceabcabc3f..b6fc7c6337610 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5325,12 +5325,29 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ instance->msix_vectors = (scratch_pad_2
+ & MR_MAX_REPLY_QUEUES_OFFSET) + 1;
+ fw_msix_count = instance->msix_vectors;
+- } else { /* Invader series supports more than 8 MSI-x vectors*/
++ } else {
+ instance->msix_vectors = ((scratch_pad_2
+ & MR_MAX_REPLY_QUEUES_EXT_OFFSET)
+ >> MR_MAX_REPLY_QUEUES_EXT_OFFSET_SHIFT) + 1;
+- if (instance->msix_vectors > 16)
+- instance->msix_combined = true;
++
++ /*
++ * For Invader series, > 8 MSI-x vectors
++ * supported by FW/HW implies combined
++ * reply queue mode is enabled.
++ * For Ventura series, > 16 MSI-x vectors
++ * supported by FW/HW implies combined
++ * reply queue mode is enabled.
++ */
++ switch (instance->adapter_type) {
++ case INVADER_SERIES:
++ if (instance->msix_vectors > 8)
++ instance->msix_combined = true;
++ break;
++ case VENTURA_SERIES:
++ if (instance->msix_vectors > 16)
++ instance->msix_combined = true;
++ break;
++ }
+
+ if (rdpq_enable)
+ instance->is_rdpq = (scratch_pad_2 & MR_RDPQ_MODE_OFFSET) ?
+--
+2.20.1
+
--- /dev/null
+From 03add86f061d544d33bf9cb9f622bac7f4e8c263 Mon Sep 17 00:00:00 2001
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Date: Tue, 18 Dec 2018 05:59:54 -0800
+Subject: scsi: megaraid_sas: Use 63-bit DMA addressing
+
+[ Upstream commit 894169db12463cea08d0e2a9e35f42b291340e5a ]
+
+Although MegaRAID controllers support 64-bit DMA addressing, as per
+hardware design, DMA address with all 64-bits set
+(0xFFFFFFFF-FFFFFFFF) results in a firmware fault.
+
+Driver will set 63-bit DMA mask to ensure the above address will not be
+used.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 749f10146f630..bc37666f998e6 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -6056,13 +6056,13 @@ static int megasas_io_attach(struct megasas_instance *instance)
+ * @instance: Adapter soft state
+ * Description:
+ *
+- * For Ventura, driver/FW will operate in 64bit DMA addresses.
++ * For Ventura, driver/FW will operate in 63bit DMA addresses.
+ *
+ * For invader-
+ * By default, driver/FW will operate in 32bit DMA addresses
+ * for consistent DMA mapping but if 32 bit consistent
+- * DMA mask fails, driver will try with 64 bit consistent
+- * mask provided FW is true 64bit DMA capable
++ * DMA mask fails, driver will try with 63 bit consistent
++ * mask provided FW is true 63bit DMA capable
+ *
+ * For older controllers(Thunderbolt and MFI based adapters)-
+ * driver/FW will operate in 32 bit consistent DMA addresses.
+@@ -6075,15 +6075,15 @@ megasas_set_dma_mask(struct megasas_instance *instance)
+ u32 scratch_pad_2;
+
+ pdev = instance->pdev;
+- consistent_mask = (instance->adapter_type == VENTURA_SERIES) ?
+- DMA_BIT_MASK(64) : DMA_BIT_MASK(32);
++ consistent_mask = (instance->adapter_type >= VENTURA_SERIES) ?
++ DMA_BIT_MASK(63) : DMA_BIT_MASK(32);
+
+ if (IS_DMA64) {
+- if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
++ if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(63)) &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
+ goto fail_set_dma_mask;
+
+- if ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) &&
++ if ((*pdev->dev.dma_mask == DMA_BIT_MASK(63)) &&
+ (dma_set_coherent_mask(&pdev->dev, consistent_mask) &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))) {
+ /*
+@@ -6096,7 +6096,7 @@ megasas_set_dma_mask(struct megasas_instance *instance)
+ if (!(scratch_pad_2 & MR_CAN_HANDLE_64_BIT_DMA_OFFSET))
+ goto fail_set_dma_mask;
+ else if (dma_set_mask_and_coherent(&pdev->dev,
+- DMA_BIT_MASK(64)))
++ DMA_BIT_MASK(63)))
+ goto fail_set_dma_mask;
+ }
+ } else if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)))
+@@ -6108,8 +6108,8 @@ megasas_set_dma_mask(struct megasas_instance *instance)
+ instance->consistent_mask_64bit = true;
+
+ dev_info(&pdev->dev, "%s bit DMA mask and %s bit consistent mask\n",
+- ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "64" : "32"),
+- (instance->consistent_mask_64bit ? "64" : "32"));
++ ((*pdev->dev.dma_mask == DMA_BIT_MASK(64)) ? "63" : "32"),
++ (instance->consistent_mask_64bit ? "63" : "32"));
+
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From 3cca1c5cabd2853147a05740f7a6f96d353b4656 Mon Sep 17 00:00:00 2001
+From: Giridhar Malavali <giridhar.malavali@cavium.com>
+Date: Wed, 26 Sep 2018 22:05:18 -0700
+Subject: scsi: qla2xxx: Move log messages before issuing command to firmware
+
+[ Upstream commit 9fe278f44b4bc06cc61e33b2af65f87d507d13d0 ]
+
+There is a probability that the SRB structure might have been released by the
+time the debug log message dereferences it. This patch moved the log messages
+before the command is issued to the firmware to prevent unknown behavior and
+kernel crash
+
+Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Giridhar Malavali <giridhar.malavali@cavium.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 15 ++++++-----
+ drivers/scsi/qla2xxx/qla_init.c | 48 +++++++++++++++++----------------
+ 2 files changed, 33 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 1f1a05a90d3d7..fc08e46a93ca9 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3360,15 +3360,15 @@ int qla24xx_async_gpsc(scsi_qla_host_t *vha, fc_port_t *fcport)
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
+ sp->done = qla24xx_async_gpsc_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_disc, vha, 0x205e,
+ "Async-%s %8phC hdl=%x loopid=%x portid=%02x%02x%02x.\n",
+ sp->name, fcport->port_name, sp->handle,
+ fcport->loop_id, fcport->d_id.b.domain,
+ fcport->d_id.b.area, fcport->d_id.b.al_pa);
++
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ return rval;
+
+ done_free_sp:
+@@ -3729,13 +3729,14 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id)
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
+ sp->done = qla2x00_async_gpnid_sp_done;
+
++ ql_dbg(ql_dbg_disc, vha, 0x2067,
++ "Async-%s hdl=%x ID %3phC.\n", sp->name,
++ sp->handle, ct_req->req.port_id.port_id);
++
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS)
+ goto done_free_sp;
+
+- ql_dbg(ql_dbg_disc, vha, 0x2067,
+- "Async-%s hdl=%x ID %3phC.\n", sp->name,
+- sp->handle, ct_req->req.port_id.port_id);
+ return rval;
+
+ done_free_sp:
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index ddce32fe0513a..39a8f4a671aaa 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -247,6 +247,12 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+
+ }
+
++ ql_dbg(ql_dbg_disc, vha, 0x2072,
++ "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
++ "retries=%d.\n", fcport->port_name, sp->handle, fcport->loop_id,
++ fcport->d_id.b.domain, fcport->d_id.b.area, fcport->d_id.b.al_pa,
++ fcport->login_retry);
++
+ rval = qla2x00_start_sp(sp);
+ if (rval != QLA_SUCCESS) {
+ fcport->flags |= FCF_LOGIN_NEEDED;
+@@ -254,11 +260,6 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ goto done_free_sp;
+ }
+
+- ql_dbg(ql_dbg_disc, vha, 0x2072,
+- "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
+- "retries=%d.\n", fcport->port_name, sp->handle, fcport->loop_id,
+- fcport->d_id.b.domain, fcport->d_id.b.area, fcport->d_id.b.al_pa,
+- fcport->login_retry);
+ return rval;
+
+ done_free_sp:
+@@ -303,15 +304,16 @@ qla2x00_async_logout(struct scsi_qla_host *vha, fc_port_t *fcport)
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+ sp->done = qla2x00_async_logout_sp_done;
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+
+ ql_dbg(ql_dbg_disc, vha, 0x2070,
+ "Async-logout - hdl=%x loop-id=%x portid=%02x%02x%02x %8phC.\n",
+ sp->handle, fcport->loop_id, fcport->d_id.b.domain,
+ fcport->d_id.b.area, fcport->d_id.b.al_pa,
+ fcport->port_name);
++
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ return rval;
+
+ done_free_sp:
+@@ -489,13 +491,15 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport,
+ sp->done = qla2x00_async_adisc_sp_done;
+ if (data[1] & QLA_LOGIO_LOGIN_RETRIED)
+ lio->u.logio.flags |= SRB_LOGIN_RETRIED;
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+
+ ql_dbg(ql_dbg_disc, vha, 0x206f,
+ "Async-adisc - hdl=%x loopid=%x portid=%06x %8phC.\n",
+ sp->handle, fcport->loop_id, fcport->d_id.b24, fcport->port_name);
++
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
++
+ return rval;
+
+ done_free_sp:
+@@ -1161,14 +1165,13 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt)
+
+ sp->done = qla24xx_async_gpdb_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_disc, vha, 0x20dc,
+ "Async-%s %8phC hndl %x opt %x\n",
+ sp->name, fcport->port_name, sp->handle, opt);
+
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ return rval;
+
+ done_free_sp:
+@@ -1698,15 +1701,14 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun,
+ tm_iocb->u.tmf.data = tag;
+ sp->done = qla2x00_tmf_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_taskm, vha, 0x802f,
+ "Async-tmf hdl=%x loop-id=%x portid=%02x%02x%02x.\n",
+ sp->handle, fcport->loop_id, fcport->d_id.b.domain,
+ fcport->d_id.b.area, fcport->d_id.b.al_pa);
+
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
+ wait_for_completion(&tm_iocb->u.tmf.comp);
+
+ rval = tm_iocb->u.tmf.data;
+@@ -1790,14 +1792,14 @@ qla24xx_async_abort_cmd(srb_t *cmd_sp, bool wait)
+
+ sp->done = qla24xx_abort_sp_done;
+
+- rval = qla2x00_start_sp(sp);
+- if (rval != QLA_SUCCESS)
+- goto done_free_sp;
+-
+ ql_dbg(ql_dbg_async, vha, 0x507c,
+ "Abort command issued - hdl=%x, target_id=%x\n",
+ cmd_sp->handle, fcport->tgt_id);
+
++ rval = qla2x00_start_sp(sp);
++ if (rval != QLA_SUCCESS)
++ goto done_free_sp;
++
+ if (wait) {
+ wait_for_completion(&abt_iocb->u.abt.comp);
+ rval = abt_iocb->u.abt.comp_status == CS_COMPLETE ?
+--
+2.20.1
+
--- /dev/null
+From 2eb51207a772594521cc215cc97551ea9d468863 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 15 Oct 2018 08:51:37 -0700
+Subject: scsi: target/core: Use the SECTOR_SHIFT constant
+
+[ Upstream commit 80b045b385cfef10939c913fbfeb19ce5491c1f2 ]
+
+Instead of duplicating the SECTOR_SHIFT definition from <linux/blkdev.h>,
+use it. This patch does not change any functionality.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_iblock.c | 4 ++--
+ drivers/target/target_core_iblock.h | 1 -
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
+index ce1321a5cb7bf..1bc9b14236d8b 100644
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -514,7 +514,7 @@ iblock_execute_write_same(struct se_cmd *cmd)
+ }
+
+ /* Always in 512 byte units for Linux/Block */
+- block_lba += sg->length >> IBLOCK_LBA_SHIFT;
++ block_lba += sg->length >> SECTOR_SHIFT;
+ sectors -= 1;
+ }
+
+@@ -757,7 +757,7 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
+ }
+
+ /* Always in 512 byte units for Linux/Block */
+- block_lba += sg->length >> IBLOCK_LBA_SHIFT;
++ block_lba += sg->length >> SECTOR_SHIFT;
+ sg_num--;
+ }
+
+diff --git a/drivers/target/target_core_iblock.h b/drivers/target/target_core_iblock.h
+index 9cc3843404d44..cefc641145b3b 100644
+--- a/drivers/target/target_core_iblock.h
++++ b/drivers/target/target_core_iblock.h
+@@ -9,7 +9,6 @@
+ #define IBLOCK_VERSION "4.0"
+
+ #define IBLOCK_MAX_CDBS 16
+-#define IBLOCK_LBA_SHIFT 9
+
+ struct iblock_req {
+ refcount_t pending;
+--
+2.20.1
+
--- /dev/null
+From d695d5bbe366e7c25f397c8095e56b94513f9905 Mon Sep 17 00:00:00 2001
+From: Roman Bolshakov <r.bolshakov@yadro.com>
+Date: Tue, 2 Jul 2019 22:16:38 +0300
+Subject: scsi: target/iblock: Fix overrun in WRITE SAME emulation
+
+[ Upstream commit 5676234f20fef02f6ca9bd66c63a8860fce62645 ]
+
+WRITE SAME corrupts data on the block device behind iblock if the command
+is emulated. The emulation code issues (M - 1) * N times more bios than
+requested, where M is the number of 512 blocks per real block size and N is
+the NUMBER OF LOGICAL BLOCKS specified in WRITE SAME command. So, for a
+device with 4k blocks, 7 * N more LBAs gets written after the requested
+range.
+
+The issue happens because the number of 512 byte sectors to be written is
+decreased one by one while the real bios are typically from 1 to 8 512 byte
+sectors per bio.
+
+Fixes: c66ac9db8d4a ("[SCSI] target: Add LIO target core v4.0.0-rc6")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_iblock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
+index 1bc9b14236d8b..854b2bcca7c1a 100644
+--- a/drivers/target/target_core_iblock.c
++++ b/drivers/target/target_core_iblock.c
+@@ -515,7 +515,7 @@ iblock_execute_write_same(struct se_cmd *cmd)
+
+ /* Always in 512 byte units for Linux/Block */
+ block_lba += sg->length >> SECTOR_SHIFT;
+- sectors -= 1;
++ sectors -= sg->length >> SECTOR_SHIFT;
+ }
+
+ iblock_submit_bios(&list);
+--
+2.20.1
+
--- /dev/null
+From 60187e4f07629ee94d797a8318ee5b59f0074545 Mon Sep 17 00:00:00 2001
+From: Benjamin Block <bblock@linux.ibm.com>
+Date: Tue, 2 Jul 2019 23:02:01 +0200
+Subject: scsi: zfcp: fix request object use-after-free in send path causing
+ wrong traces
+
+[ Upstream commit 106d45f350c7cac876844dc685845cba4ffdb70b ]
+
+When tracing instances where we open and close WKA ports, we also pass the
+request-ID of the respective FSF command.
+
+But after successfully sending the FSF command we must not use the
+request-object anymore, as this might result in an use-after-free (see
+"zfcp: fix request object use-after-free in send path causing seqno
+errors" ).
+
+To fix this add a new variable that caches the request-ID before sending
+the request. This won't change during the hand-off to the FCP channel,
+and so it's safe to trace this cached request-ID later, instead of using
+the request object.
+
+Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
+Fixes: d27a7cb91960 ("zfcp: trace on request for open and close of WKA port")
+Cc: <stable@vger.kernel.org> #2.6.38+
+Reviewed-by: Steffen Maier <maier@linux.ibm.com>
+Reviewed-by: Jens Remus <jremus@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_fsf.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 3c86e27f094de..aff073a5b52bf 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -1594,6 +1594,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+ struct zfcp_fsf_req *req;
++ unsigned long req_id = 0;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1616,6 +1617,8 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ hton24(req->qtcb->bottom.support.d_id, wka_port->d_id);
+ req->data = wka_port;
+
++ req_id = req->req_id;
++
+ zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
+ retval = zfcp_fsf_req_send(req);
+ if (retval)
+@@ -1623,7 +1626,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
+ if (!retval)
+- zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
++ zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req_id);
+ return retval;
+ }
+
+@@ -1649,6 +1652,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+ struct zfcp_fsf_req *req;
++ unsigned long req_id = 0;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1671,6 +1675,8 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ req->data = wka_port;
+ req->qtcb->header.port_handle = wka_port->handle;
+
++ req_id = req->req_id;
++
+ zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
+ retval = zfcp_fsf_req_send(req);
+ if (retval)
+@@ -1678,7 +1684,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
+ if (!retval)
+- zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
++ zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req_id);
+ return retval;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 299538fa8d01a1c524d0cadf09fbb78007641e91 Mon Sep 17 00:00:00 2001
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Tue, 21 May 2019 14:40:47 +0800
+Subject: selftests: fib_rule_tests: use pre-defined DEV_ADDR
+
+[ Upstream commit 34632975cafdd07ce80e85c2eda4e9c16b5f2faa ]
+
+DEV_ADDR is defined but not used. Use it in address setting.
+Do the same with IPv6 for consistency.
+
+Reported-by: David Ahern <dsahern@gmail.com>
+Fixes: fc82d93e57e3 ("selftests: fib_rule_tests: fix local IPv4 address typo")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fib_rule_tests.sh | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fib_rule_tests.sh b/tools/testing/selftests/net/fib_rule_tests.sh
+index 1ba069967fa2b..ba2d9fab28d0f 100755
+--- a/tools/testing/selftests/net/fib_rule_tests.sh
++++ b/tools/testing/selftests/net/fib_rule_tests.sh
+@@ -15,6 +15,7 @@ GW_IP6=2001:db8:1::2
+ SRC_IP6=2001:db8:1::3
+
+ DEV_ADDR=192.51.100.1
++DEV_ADDR6=2001:db8:1::1
+ DEV=dummy0
+
+ log_test()
+@@ -55,8 +56,8 @@ setup()
+
+ $IP link add dummy0 type dummy
+ $IP link set dev dummy0 up
+- $IP address add 192.51.100.1/24 dev dummy0
+- $IP -6 address add 2001:db8:1::1/64 dev dummy0
++ $IP address add $DEV_ADDR/24 dev dummy0
++ $IP -6 address add $DEV_ADDR6/64 dev dummy0
+
+ set +e
+ }
+--
+2.20.1
+
powerpc-tm-fix-restoring-fp-vmx-facility-incorrectly-on-interrupts.patch
batman-adv-fix-uninit-value-in-batadv_netlink_get_ifindex.patch
batman-adv-only-read-ogm-tvlv_len-after-buffer-len-check.patch
+hv_sock-fix-hang-when-a-connection-is-closed.patch
+blk-iolatency-warn-on-negative-inflight-io-counter.patch
+blk-iolatency-fix-sts_again-handling.patch
+nl-mac-80211-fix-interface-combinations-on-crypto-co.patch
+timekeeping-use-proper-ktime_add-when-adding-nsecs-i.patch
+selftests-fib_rule_tests-use-pre-defined-dev_addr.patch
+x86-ftrace-fix-warning-and-considate-ftrace_jmp_repl.patch
+powerpc-64-mark-start_here_multiplatform-as-__ref.patch
+media-stm32-dcmi-fix-irq-0-case.patch
+arm64-dts-rockchip-enable-usb-host-regulators-at-boo.patch
+scripts-decode_stacktrace-match-basepath-using-shell.patch
+riscv-remove-unused-variable-in-ftrace.patch
+nvme-fc-use-separate-work-queue-to-avoid-warning.patch
+clk-s2mps11-add-used-attribute-to-s2mps11_dt_match.patch
+remoteproc-qcom-q6v5-shore-up-resource-probe-handlin.patch
+modules-always-page-align-module-section-allocations.patch
+kernel-module-fix-mem-leak-in-module_add_modinfo_att.patch
+drm-i915-re-apply-perform-link-quality-check-uncondi.patch
+media-cec-v4l2-move-v4l2-specific-cec-functions-to-v.patch
+media-cec-remove-cec-edid.c.patch
+scsi-qla2xxx-move-log-messages-before-issuing-comman.patch
+keys-fix-the-use-of-the-c-keyword-private-in-uapi-li.patch
+drivers-hv-kvp-fix-two-this-statement-may-fall-throu.patch
+x86-hibernate-fix-nosave_regions-setup-for-hibernati.patch
+remoteproc-qcom-q6v5-mss-add-scm-probe-dependency.patch
+drm-amdgpu-gfx9-update-gfx9-golden-settings.patch
+drm-amdgpu-update-gc_9_0-golden-settings.patch
+kvm-x86-hyperv-enforce-vp_index-kvm_max_vcpus.patch
+kvm-x86-hyperv-consistently-use-hv_vcpu-for-struct-k.patch
+kvm-x86-hyperv-keep-track-of-mismatched-vp-indexes.patch
+kvm-hyperv-define-vp-assist-page-helpers.patch
+x86-kvm-lapic-preserve-gfn_to_hva_cache-len-on-cache.patch
+drm-i915-fix-intel_dp_mst_best_encoder.patch
+drm-i915-rename-plane_ctl_decompression_enable.patch
+drm-i915-gen9-fix-initial-readout-for-y-tiled-frameb.patch
+drm-atomic_helper-disallow-new-modesets-on-unregiste.patch
+drivers-hv-kvp-fix-the-indentation-of-some-break-sta.patch
+drivers-hv-kvp-fix-the-recent-regression-caused-by-i.patch
+powerplay-respect-units-on-max-dcfclk-watermark.patch
+drm-amd-pp-fix-truncated-clock-value-when-set-waterm.patch
+drm-amd-dm-understand-why-attaching-path-tile-proper.patch
+arm-davinci-da8xx-define-gpio-interrupts-as-separate.patch
+arm-davinci-dm365-define-gpio-interrupts-as-separate.patch
+arm-davinci-dm646x-define-gpio-interrupts-as-separat.patch
+arm-davinci-dm355-define-gpio-interrupts-as-separate.patch
+arm-davinci-dm644x-define-gpio-interrupts-as-separat.patch
+s390-zcrypt-reinit-ap-queue-state-machine-during-dev.patch
+media-vim2m-use-workqueue.patch
+media-vim2m-use-cancel_delayed_work_sync-instead-of-.patch
+drm-i915-restore-sane-defaults-for-kms-on-gem-error-.patch
+drm-i915-cleanup-gt-powerstate-from-gem.patch
+kvm-ppc-book3s-hv-fix-race-between-kvm_unmap_hva_ran.patch
+btrfs-clean-up-scrub-is_dev_replace-parameter.patch
+btrfs-fix-deadlock-with-memory-reclaim-during-scrub.patch
+btrfs-remove-extent_io_ops-fill_delalloc.patch
+btrfs-fix-error-handling-in-btrfs_cleanup_ordered_ex.patch
+scsi-megaraid_sas-fix-combined-reply-queue-mode-dete.patch
+scsi-megaraid_sas-add-check-for-reset-adapter-bit.patch
+scsi-megaraid_sas-use-63-bit-dma-addressing.patch
+powerpc-pkeys-fix-handling-of-pkey-state-across-fork.patch
+btrfs-volumes-make-sure-no-dev-extent-is-beyond-devi.patch
+btrfs-use-real-device-structure-to-verify-dev-extent.patch
+media-vim2m-only-cancel-work-if-it-is-for-right-cont.patch
+arc-show_regs-lockdep-re-enable-preemption.patch
+arc-mm-do_page_fault-fixes-1-relinquish-mmap_sem-if-.patch
+alsa-pcm-return-0-when-size-start_threshold-in-captu.patch
+alsa-pcm-update-hardware-pointer-before-start-captur.patch
+alsa-pcm-fix-tight-loop-of-oss-capture-stream.patch
+ib-uverbs-fix-oops-upon-device-disassociation.patch
+crypto-ccree-fix-resume-race-condition-on-init.patch
+alsa-pcm-revert-capture-stream-behavior-change-in-bl.patch
+crypto-ccree-add-missing-inline-qualifier.patch
+drm-vblank-allow-dynamic-per-crtc-max_vblank_count.patch
+drm-i915-ilk-fix-warning-when-reading-emon_status-wi.patch
+mfd-kconfig-fix-i2c_designware_platform-dependencies.patch
+tpm-fix-some-name-collisions-with-drivers-char-tpm.h.patch
+bcache-replace-hard-coded-number-with-bucket_gc_gen_.patch
+bcache-treat-stale-dirty-keys-as-bad-keys.patch
+kvm-vmx-compare-only-a-single-byte-for-vmcs-launched.patch
+iio-adc-exynos-adc-add-s5pv210-variant.patch
+dt-bindings-iio-adc-exynos-adc-add-s5pv210-variant.patch
+iio-adc-exynos-adc-use-proper-number-of-channels-for.patch
+mt76-fix-corrupted-software-generated-tx-ccmp-pn.patch
+drm-nouveau-don-t-warn_on-vcpi-allocation-failures.patch
+iwlwifi-fix-devices-with-pci-device-id-0x34f0-and-11.patch
+iwlwifi-add-new-card-for-9260-series.patch
+x86-kvmclock-set-offset-for-kvm-unstable-clock.patch
+spi-spi-gpio-fix-spi_cs_high-capability.patch
+powerpc-kvm-save-and-restore-host-amr-iamr-uamor.patch
+mmc-renesas_sdhi-fix-card-initialization-failure-in-.patch
+btrfs-scrub-pass-fs_info-to-scrub_setup_ctx.patch
+btrfs-scrub-move-scrub_setup_ctx-allocation-out-of-d.patch
+btrfs-scrub-fix-circular-locking-dependency-warning.patch
+btrfs-init-csum_list-before-possible-free.patch
+pci-qcom-fix-error-handling-in-runtime-pm-support.patch
+pci-qcom-don-t-deassert-reset-gpio-during-probe.patch
+drm-add-__user-attribute-to-ptr_to_compat.patch
+cifs-fix-error-paths-in-writeback-code.patch
+cifs-fix-leaking-locked-vfs-cache-pages-in-writeback.patch
+drm-i915-handle-vm_mmap-error-during-i915_gem_mmap-i.patch
+drm-i915-sanity-check-mmap-length-against-object-siz.patch
+usb-typec-tcpm-try-pd-2.0-if-sink-does-not-respond-t.patch
+arm64-dts-stratix10-add-the-sysmgr-syscon-property-f.patch
+ib-mlx5-reset-access-mask-when-looping-inside-page-f.patch
+kvm-mmu-fix-overflow-on-kvm-mmu-page-limit-calculati.patch
+x86-kvm-move-kvm_load-put_guest_xcr0-into-atomic-con.patch
+kvm-x86-always-use-32-bit-smram-save-state-for-32-bi.patch
+cifs-fix-lease-buffer-length-error.patch
+media-i2c-tda1997x-select-v4l2_fwnode.patch
+ext4-protect-journal-inode-s-blocks-using-block_vali.patch
+arm-dts-qcom-ipq4019-fix-pci-range.patch
+arm-dts-qcom-ipq4019-fix-msi-irq-type.patch
+arm-dts-qcom-ipq4019-enlarge-pcie-bar-range.patch
+dt-bindings-mmc-add-supports-cqe-property.patch
+dt-bindings-mmc-add-disable-cqe-dcmd-property.patch
+pci-add-macro-for-switchtec-quirk-declarations.patch
+pci-reset-lenovo-thinkpad-p50-nvgpu-at-boot-if-neces.patch
+dm-mpath-fix-missing-call-of-path-selector-type-end_.patch
+blk-mq-free-hw-queue-s-resource-in-hctx-s-release-ha.patch
+mmc-sdhci-pci-add-support-for-intel-cml.patch
+pci-dwc-use-devm_pci_alloc_host_bridge-to-simplify-c.patch
+cifs-smbd-take-an-array-of-reqeusts-when-sending-upp.patch
+dm-crypt-move-detailed-message-into-debug-level.patch
+signal-arc-use-force_sig_fault-where-appropriate.patch
+arc-mm-fix-uninitialised-signal-code-in-do_page_faul.patch
+arc-mm-sigsegv-userspace-trying-to-access-kernel-vir.patch
+drm-amdkfd-add-missing-polaris10-id.patch
+kvm-check-irqchip-mode-before-assign-irqfd.patch
+drm-amdgpu-fix-ring-test-failure-issue-during-s3-in-.patch
+drm-amdgpu-uvd-vcn-fetch-ring-s-read_ptr-after-alloc.patch
+btrfs-fix-race-between-block-group-removal-and-block.patch
+cifs-add-spinlock-for-the-openfilelist-to-cifsinodei.patch
+clk-tegra-fix-maximum-audio-sync-clock-for-tegra124-.patch
+clk-tegra210-fix-default-rates-for-hda-clocks.patch
+ib-hfi1-avoid-hardlockup-with-flushlist_lock.patch
+apparmor-reset-pos-on-failure-to-unpack-for-various-.patch
+scsi-target-core-use-the-sector_shift-constant.patch
+scsi-target-iblock-fix-overrun-in-write-same-emulati.patch
+staging-wilc1000-fix-error-path-cleanup-in-wilc_wlan.patch
+scsi-zfcp-fix-request-object-use-after-free-in-send-.patch
+cifs-properly-handle-auto-disabling-of-serverino-opt.patch
+alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch
+ceph-use-ceph_evict_inode-to-cleanup-inode-s-resourc.patch
+kvm-x86-optimize-check-for-valid-pat-value.patch
+kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat.patch
+kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-ent.patch
+kvm-vmx-check-cpuid-before-allowing-read-write-of-ia.patch
+kvm-ppc-use-ccr-field-in-pt_regs-struct-embedded-in-.patch
+kvm-ppc-book3s-hv-fix-cr0-setting-in-tm-emulation.patch
+arm-dts-gemini-set-dir-685-spi-cs-as-active-low.patch
+rdma-srp-document-srp_parse_in-arguments.patch
+rdma-srp-accept-again-source-addresses-that-do-not-h.patch
+btrfs-correctly-validate-compression-type.patch
+resource-include-resource-end-in-walk_-interfaces.patch
+resource-fix-find_next_iomem_res-iteration-issue.patch
+resource-fix-locking-in-find_next_iomem_res.patch
+pstore-fix-double-free-in-pstore_mkfile-failure-path.patch
+dm-thin-metadata-check-if-in-fail_io-mode-when-setti.patch
+drm-panel-add-support-for-armadeus-st0700-adapt.patch
+alsa-hda-fix-intermittent-corb-rirb-stall-on-intel-c.patch
+powerpc-mm-limit-rma_size-to-1tb-when-running-withou.patch
+iommu-iova-remove-stale-cached32_node.patch
+gpio-don-t-warn-on-null-descs-if-gpiolib-is-disabled.patch
+i2c-at91-disable-txrdy-interrupt-after-sending-data.patch
+i2c-at91-fix-clk_offset-for-sama5d2.patch
+mm-migrate.c-initialize-pud_entry-in-migrate_vma.patch
+iio-adc-gyroadc-fix-uninitialized-return-code.patch
+nfsv4-fix-delegation-state-recovery.patch
+bcache-only-clear-btree_node_dirty-bit-when-it-is-se.patch
+bcache-add-comments-for-mutex_lock-b-write_lock.patch
+bcache-fix-race-in-btree_flush_write.patch
+drm-i915-userptr-acquire-the-page-lock-around-set_pa.patch
+drm-i915-make-sure-cdclk-is-high-enough-for-dp-audio.patch
+virtio-s390-fix-race-on-airq_areas.patch
+drm-atomic_helper-allow-dpms-on-off-changes-for-unre.patch
+ext4-don-t-perform-block-validity-checks-on-the-jour.patch
+ext4-fix-block-validity-checks-for-journal-inodes-us.patch
+ext4-unsigned-int-compared-against-zero.patch
+pci-reset-both-nvidia-gpu-and-hda-in-thinkpad-p50-wo.patch
--- /dev/null
+From 74a91828d706718323c062d65ec01683e07e9115 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Tue, 1 Aug 2017 13:41:34 -0500
+Subject: signal/arc: Use force_sig_fault where appropriate
+
+[ Upstream commit 15773ae938d8d93d982461990bebad6e1d7a1830 ]
+
+Acked-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/mm/fault.c | 20 +++++---------------
+ 1 file changed, 5 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c
+index f28db0b112a30..a0366f9dca051 100644
+--- a/arch/arc/mm/fault.c
++++ b/arch/arc/mm/fault.c
+@@ -66,14 +66,12 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ struct vm_area_struct *vma = NULL;
+ struct task_struct *tsk = current;
+ struct mm_struct *mm = tsk->mm;
+- siginfo_t info;
++ int si_code;
+ int ret;
+ vm_fault_t fault;
+ int write = regs->ecr_cause & ECR_C_PROTV_STORE; /* ST/EX */
+ unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+
+- clear_siginfo(&info);
+-
+ /*
+ * We fault-in kernel-space virtual memory on-demand. The
+ * 'reference' page table is init_mm.pgd.
+@@ -91,7 +89,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs)
+ return;
+ }
+
+- info.si_code = SEGV_MAPERR;
++ si_code = SEGV_MAPERR;
+
+ /*
+ * If we're in an interrupt or have no user
+@@ -119,7 +117,7 @@ retry:
+ * we can handle it..
+ */
+ good_area:
+- info.si_code = SEGV_ACCERR;
++ si_code = SEGV_ACCERR;
+
+ /* Handle protection violation, execute on heap or stack */
+
+@@ -204,11 +202,7 @@ bad_area_nosemaphore:
+ /* User mode accesses just cause a SIGSEGV */
+ if (user_mode(regs)) {
+ tsk->thread.fault_address = address;
+- info.si_signo = SIGSEGV;
+- info.si_errno = 0;
+- /* info.si_code has been set above */
+- info.si_addr = (void __user *)address;
+- force_sig_info(SIGSEGV, &info, tsk);
++ force_sig_fault(SIGSEGV, si_code, (void __user *)address, tsk);
+ return;
+ }
+
+@@ -243,9 +237,5 @@ do_sigbus:
+ goto no_context;
+
+ tsk->thread.fault_address = address;
+- info.si_signo = SIGBUS;
+- info.si_errno = 0;
+- info.si_code = BUS_ADRERR;
+- info.si_addr = (void __user *)address;
+- force_sig_info(SIGBUS, &info, tsk);
++ force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address, tsk);
+ }
+--
+2.20.1
+
--- /dev/null
+From 715f3465a5cc290e4301aebed1270ce8fef59a4e Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 21 Feb 2019 15:59:58 +0000
+Subject: spi: spi-gpio: fix SPI_CS_HIGH capability
+
+[ Upstream commit b89fefda7d4e3a649129584d855be233c7465264 ]
+
+spi-gpio is capable of dealing with active-high chip-selects.
+Unfortunately, commit 4b859db2c606 ("spi: spi-gpio: add SPI_3WIRE
+support") broke this by setting master->mode_bits, which overrides
+the setting in the spi-bitbang code. Fix this.
+
+[Fixed a trivial conflict with SPI_3WIRE_HIZ support -- broonie]
+
+Fixes: 4b859db2c606 ("spi: spi-gpio: add SPI_3WIRE support")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-gpio.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 088772ebef9bd..77838d8fd9bb6 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -410,7 +410,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ return status;
+
+ master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32);
+- master->mode_bits = SPI_3WIRE | SPI_CPHA | SPI_CPOL;
++ master->mode_bits = SPI_3WIRE | SPI_CPHA | SPI_CPOL | SPI_CS_HIGH;
+ master->flags = master_flags;
+ master->bus_num = pdev->id;
+ /* The master needs to think there is a chipselect even if not connected */
+@@ -437,7 +437,6 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ spi_gpio->bitbang.txrx_word[SPI_MODE_3] = spi_gpio_spec_txrx_word_mode3;
+ }
+ spi_gpio->bitbang.setup_transfer = spi_bitbang_setup_transfer;
+- spi_gpio->bitbang.flags = SPI_CS_HIGH;
+
+ status = spi_bitbang_start(&spi_gpio->bitbang);
+ if (status)
+--
+2.20.1
+
--- /dev/null
+From 34fc2e7bd5b7a31d134e271bcc52be60c15341c0 Mon Sep 17 00:00:00 2001
+From: Ajay Singh <ajay.kathat@microchip.com>
+Date: Wed, 26 Jun 2019 12:40:48 +0000
+Subject: staging: wilc1000: fix error path cleanup in wilc_wlan_initialize()
+
+[ Upstream commit 6419f818ababebc1116fb2d0e220bd4fe835d0e3 ]
+
+For the error path in wilc_wlan_initialize(), the resources are not
+cleanup in the correct order. Reverted the previous changes and use the
+correct order to free during error condition.
+
+Fixes: b46d68825c2d ("staging: wilc1000: remove COMPLEMENT_BOOT")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/wilc1000/linux_wlan.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
+index 649caae2b6033..25798119426b3 100644
+--- a/drivers/staging/wilc1000/linux_wlan.c
++++ b/drivers/staging/wilc1000/linux_wlan.c
+@@ -649,17 +649,17 @@ static int wilc_wlan_initialize(struct net_device *dev, struct wilc_vif *vif)
+ goto fail_locks;
+ }
+
+- if (wl->gpio_irq && init_irq(dev)) {
+- ret = -EIO;
+- goto fail_locks;
+- }
+-
+ ret = wlan_initialize_threads(dev);
+ if (ret < 0) {
+ ret = -EIO;
+ goto fail_wilc_wlan;
+ }
+
++ if (wl->gpio_irq && init_irq(dev)) {
++ ret = -EIO;
++ goto fail_threads;
++ }
++
+ if (!wl->dev_irq_num &&
+ wl->hif_func->enable_interrupt &&
+ wl->hif_func->enable_interrupt(wl)) {
+@@ -715,7 +715,7 @@ fail_irq_enable:
+ fail_irq_init:
+ if (wl->dev_irq_num)
+ deinit_irq(dev);
+-
++fail_threads:
+ wlan_deinitialize_threads(dev);
+ fail_wilc_wlan:
+ wilc_wlan_cleanup(dev);
+--
+2.20.1
+
--- /dev/null
+From ed24a9aaa01eb9e5d4373eb68a76fda0f86b21b4 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Fri, 21 Jun 2019 22:32:47 +0200
+Subject: timekeeping: Use proper ktime_add when adding nsecs in coarse offset
+
+[ Upstream commit 0354c1a3cdf31f44b035cfad14d32282e815a572 ]
+
+While this doesn't actually amount to a real difference, since the macro
+evaluates to the same thing, every place else operates on ktime_t using
+these functions, so let's not break the pattern.
+
+Fixes: e3ff9c3678b4 ("timekeeping: Repair ktime_get_coarse*() granularity")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lkml.kernel.org/r/20190621203249.3909-1-Jason@zx2c4.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 443edcddac8ab..c2708e1f0c69f 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -823,7 +823,7 @@ ktime_t ktime_get_coarse_with_offset(enum tk_offsets offs)
+
+ } while (read_seqcount_retry(&tk_core.seq, seq));
+
+- return base + nsecs;
++ return ktime_add_ns(base, nsecs);
+ }
+ EXPORT_SYMBOL_GPL(ktime_get_coarse_with_offset);
+
+--
+2.20.1
+
--- /dev/null
+From a7b8ca7a11d8ff059c3821dfefcd691a3a68383d Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Date: Tue, 5 Feb 2019 11:14:00 +0200
+Subject: tpm: Fix some name collisions with drivers/char/tpm.h
+
+[ Upstream commit 8ab547a2dcfac6ec184a5e036e1093eb3f7a215c ]
+
+* Rename TPM_BUFSIZE defined in drivers/char/tpm/st33zp24/st33zp24.h to
+ ST33ZP24_BUFSIZE.
+* Rename TPM_BUFSIZE defined in drivers/char/tpm/tpm_i2c_infineon.c to
+ TPM_I2C_INFINEON_BUFSIZE.
+* Rename TPM_RETRY in tpm_i2c_nuvoton to TPM_I2C_RETRIES.
+* Remove TPM_HEADER_SIZE from tpm_i2c_nuvoton.
+
+Cc: stable@vger.kernel.org
+Fixes: bf38b8710892 ("tpm/tpm_i2c_stm_st33: Split tpm_i2c_tpm_st33 in 2 layers (core + phy)")
+Fixes: aad628c1d91a ("char/tpm: Add new driver for Infineon I2C TIS TPM")
+Fixes: 32d33b29ba07 ("TPM: Retry SaveState command in suspend path")
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/st33zp24/i2c.c | 2 +-
+ drivers/char/tpm/st33zp24/spi.c | 2 +-
+ drivers/char/tpm/st33zp24/st33zp24.h | 4 ++--
+ drivers/char/tpm/tpm_i2c_infineon.c | 15 ++++++++-------
+ drivers/char/tpm/tpm_i2c_nuvoton.c | 16 +++++++---------
+ 5 files changed, 19 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/char/tpm/st33zp24/i2c.c b/drivers/char/tpm/st33zp24/i2c.c
+index be5d1abd3e8ef..8390c5b54c3be 100644
+--- a/drivers/char/tpm/st33zp24/i2c.c
++++ b/drivers/char/tpm/st33zp24/i2c.c
+@@ -33,7 +33,7 @@
+
+ struct st33zp24_i2c_phy {
+ struct i2c_client *client;
+- u8 buf[TPM_BUFSIZE + 1];
++ u8 buf[ST33ZP24_BUFSIZE + 1];
+ int io_lpcpd;
+ };
+
+diff --git a/drivers/char/tpm/st33zp24/spi.c b/drivers/char/tpm/st33zp24/spi.c
+index d7909ab287a85..ff019a1e3c68f 100644
+--- a/drivers/char/tpm/st33zp24/spi.c
++++ b/drivers/char/tpm/st33zp24/spi.c
+@@ -63,7 +63,7 @@
+ * some latency byte before the answer is available (max 15).
+ * We have 2048 + 1024 + 15.
+ */
+-#define ST33ZP24_SPI_BUFFER_SIZE (TPM_BUFSIZE + (TPM_BUFSIZE / 2) +\
++#define ST33ZP24_SPI_BUFFER_SIZE (ST33ZP24_BUFSIZE + (ST33ZP24_BUFSIZE / 2) +\
+ MAX_SPI_LATENCY)
+
+
+diff --git a/drivers/char/tpm/st33zp24/st33zp24.h b/drivers/char/tpm/st33zp24/st33zp24.h
+index 6f4a4198af6aa..20da0a84988d6 100644
+--- a/drivers/char/tpm/st33zp24/st33zp24.h
++++ b/drivers/char/tpm/st33zp24/st33zp24.h
+@@ -18,8 +18,8 @@
+ #ifndef __LOCAL_ST33ZP24_H__
+ #define __LOCAL_ST33ZP24_H__
+
+-#define TPM_WRITE_DIRECTION 0x80
+-#define TPM_BUFSIZE 2048
++#define TPM_WRITE_DIRECTION 0x80
++#define ST33ZP24_BUFSIZE 2048
+
+ struct st33zp24_dev {
+ struct tpm_chip *chip;
+diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
+index 977fd42daa1b1..3b4e9672ff6cd 100644
+--- a/drivers/char/tpm/tpm_i2c_infineon.c
++++ b/drivers/char/tpm/tpm_i2c_infineon.c
+@@ -26,8 +26,7 @@
+ #include <linux/wait.h>
+ #include "tpm.h"
+
+-/* max. buffer size supported by our TPM */
+-#define TPM_BUFSIZE 1260
++#define TPM_I2C_INFINEON_BUFSIZE 1260
+
+ /* max. number of iterations after I2C NAK */
+ #define MAX_COUNT 3
+@@ -63,11 +62,13 @@ enum i2c_chip_type {
+ UNKNOWN,
+ };
+
+-/* Structure to store I2C TPM specific stuff */
+ struct tpm_inf_dev {
+ struct i2c_client *client;
+ int locality;
+- u8 buf[TPM_BUFSIZE + sizeof(u8)]; /* max. buffer size + addr */
++ /* In addition to the data itself, the buffer must fit the 7-bit I2C
++ * address and the direction bit.
++ */
++ u8 buf[TPM_I2C_INFINEON_BUFSIZE + 1];
+ struct tpm_chip *chip;
+ enum i2c_chip_type chip_type;
+ unsigned int adapterlimit;
+@@ -219,7 +220,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len,
+ .buf = tpm_dev.buf
+ };
+
+- if (len > TPM_BUFSIZE)
++ if (len > TPM_I2C_INFINEON_BUFSIZE)
+ return -EINVAL;
+
+ if (!tpm_dev.client->adapter->algo->master_xfer)
+@@ -527,8 +528,8 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ u8 retries = 0;
+ u8 sts = TPM_STS_GO;
+
+- if (len > TPM_BUFSIZE)
+- return -E2BIG; /* command is too long for our tpm, sorry */
++ if (len > TPM_I2C_INFINEON_BUFSIZE)
++ return -E2BIG;
+
+ if (request_locality(chip, 0) < 0)
+ return -EBUSY;
+diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
+index b8defdfdf2dc6..2803080097841 100644
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -35,14 +35,12 @@
+ #include "tpm.h"
+
+ /* I2C interface offsets */
+-#define TPM_STS 0x00
+-#define TPM_BURST_COUNT 0x01
+-#define TPM_DATA_FIFO_W 0x20
+-#define TPM_DATA_FIFO_R 0x40
+-#define TPM_VID_DID_RID 0x60
+-/* TPM command header size */
+-#define TPM_HEADER_SIZE 10
+-#define TPM_RETRY 5
++#define TPM_STS 0x00
++#define TPM_BURST_COUNT 0x01
++#define TPM_DATA_FIFO_W 0x20
++#define TPM_DATA_FIFO_R 0x40
++#define TPM_VID_DID_RID 0x60
++#define TPM_I2C_RETRIES 5
+ /*
+ * I2C bus device maximum buffer size w/o counting I2C address or command
+ * i.e. max size required for I2C write is 34 = addr, command, 32 bytes data
+@@ -292,7 +290,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ dev_err(dev, "%s() count < header size\n", __func__);
+ return -EIO;
+ }
+- for (retries = 0; retries < TPM_RETRY; retries++) {
++ for (retries = 0; retries < TPM_I2C_RETRIES; retries++) {
+ if (retries > 0) {
+ /* if this is not the first trial, set responseRetry */
+ i2c_nuvoton_write_status(client,
+--
+2.20.1
+
--- /dev/null
+From 9cd546e52f7757f1de02abdffaf21b2716fbc903 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 16 Mar 2019 16:57:12 +0100
+Subject: usb: typec: tcpm: Try PD-2.0 if sink does not respond to 3.0
+ source-caps
+
+[ Upstream commit 976daf9d1199932df80e7b04546d1a1bd4ed5ece ]
+
+PD 2.0 sinks are supposed to accept src-capabilities with a 3.0 header and
+simply ignore any src PDOs which the sink does not understand such as PPS
+but some 2.0 sinks instead ignore the entire PD_DATA_SOURCE_CAP message,
+causing contract negotiation to fail.
+
+This commit fixes such sinks not working by re-trying the contract
+negotiation with PD-2.0 source-caps messages if we don't have a contract
+after PD_N_HARD_RESET_COUNT hard-reset attempts.
+
+The problem fixed by this commit was noticed with a Type-C to VGA dongle.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/tcpm.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index fb20aa974ae12..819ae3b2bd7e8 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -37,6 +37,7 @@
+ S(SRC_ATTACHED), \
+ S(SRC_STARTUP), \
+ S(SRC_SEND_CAPABILITIES), \
++ S(SRC_SEND_CAPABILITIES_TIMEOUT), \
+ S(SRC_NEGOTIATE_CAPABILITIES), \
+ S(SRC_TRANSITION_SUPPLY), \
+ S(SRC_READY), \
+@@ -2987,10 +2988,34 @@ static void run_state_machine(struct tcpm_port *port)
+ /* port->hard_reset_count = 0; */
+ port->caps_count = 0;
+ port->pd_capable = true;
+- tcpm_set_state_cond(port, hard_reset_state(port),
++ tcpm_set_state_cond(port, SRC_SEND_CAPABILITIES_TIMEOUT,
+ PD_T_SEND_SOURCE_CAP);
+ }
+ break;
++ case SRC_SEND_CAPABILITIES_TIMEOUT:
++ /*
++ * Error recovery for a PD_DATA_SOURCE_CAP reply timeout.
++ *
++ * PD 2.0 sinks are supposed to accept src-capabilities with a
++ * 3.0 header and simply ignore any src PDOs which the sink does
++ * not understand such as PPS but some 2.0 sinks instead ignore
++ * the entire PD_DATA_SOURCE_CAP message, causing contract
++ * negotiation to fail.
++ *
++ * After PD_N_HARD_RESET_COUNT hard-reset attempts, we try
++ * sending src-capabilities with a lower PD revision to
++ * make these broken sinks work.
++ */
++ if (port->hard_reset_count < PD_N_HARD_RESET_COUNT) {
++ tcpm_set_state(port, HARD_RESET_SEND, 0);
++ } else if (port->negotiated_rev > PD_REV20) {
++ port->negotiated_rev--;
++ port->hard_reset_count = 0;
++ tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
++ } else {
++ tcpm_set_state(port, hard_reset_state(port), 0);
++ }
++ break;
+ case SRC_NEGOTIATE_CAPABILITIES:
+ ret = tcpm_pd_check_request(port);
+ if (ret < 0) {
+--
+2.20.1
+
--- /dev/null
+From 025a27bc809808b675243021b2783abc14125579 Mon Sep 17 00:00:00 2001
+From: Halil Pasic <pasic@linux.ibm.com>
+Date: Tue, 23 Jul 2019 17:11:01 +0200
+Subject: virtio/s390: fix race on airq_areas[]
+
+[ Upstream commit 4f419eb14272e0698e8c55bb5f3f266cc2a21c81 ]
+
+The access to airq_areas was racy ever since the adapter interrupts got
+introduced to virtio-ccw, but since commit 39c7dcb15892 ("virtio/s390:
+make airq summary indicators DMA") this became an issue in practice as
+well. Namely before that commit the airq_info that got overwritten was
+still functional. After that commit however the two infos share a
+summary_indicator, which aggravates the situation. Which means
+auto-online mechanism occasionally hangs the boot with virtio_blk.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: 96b14536d935 ("virtio-ccw: virtio-ccw adapter interrupt support.")
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/virtio/virtio_ccw.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
+index ec54538f7ae1c..67efdf25657f3 100644
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -132,6 +132,7 @@ struct airq_info {
+ struct airq_iv *aiv;
+ };
+ static struct airq_info *airq_areas[MAX_AIRQ_AREAS];
++static DEFINE_MUTEX(airq_areas_lock);
+
+ #define CCW_CMD_SET_VQ 0x13
+ #define CCW_CMD_VDEV_RESET 0x33
+@@ -244,9 +245,11 @@ static unsigned long get_airq_indicator(struct virtqueue *vqs[], int nvqs,
+ unsigned long bit, flags;
+
+ for (i = 0; i < MAX_AIRQ_AREAS && !indicator_addr; i++) {
++ mutex_lock(&airq_areas_lock);
+ if (!airq_areas[i])
+ airq_areas[i] = new_airq_info();
+ info = airq_areas[i];
++ mutex_unlock(&airq_areas_lock);
+ if (!info)
+ return 0;
+ write_lock_irqsave(&info->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 9f0aeace0c3f96cf0ac41fe1092258bd1ee1914d Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 4 Mar 2019 16:35:22 -0500
+Subject: x86/ftrace: Fix warning and considate ftrace_jmp_replace() and
+ ftrace_call_replace()
+
+[ Upstream commit 745cfeaac09ce359130a5451d90cb0bd4094c290 ]
+
+Arnd reported the following compiler warning:
+
+arch/x86/kernel/ftrace.c:669:23: error: 'ftrace_jmp_replace' defined but not used [-Werror=unused-function]
+
+The ftrace_jmp_replace() function now only has a single user and should be
+simply moved by that user. But looking at the code, it shows that
+ftrace_jmp_replace() is similar to ftrace_call_replace() except that instead
+of using the opcode of 0xe8 it uses 0xe9. It makes more sense to consolidate
+that function into one implementation that both ftrace_jmp_replace() and
+ftrace_call_replace() use by passing in the op code separate.
+
+The structure in ftrace_code_union is also modified to replace the "e8"
+field with the more appropriate name "op".
+
+Cc: stable@vger.kernel.org
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Link: http://lkml.kernel.org/r/20190304200748.1418790-1-arnd@arndb.de
+Fixes: d2a68c4effd8 ("x86/ftrace: Do not call function graph from dynamic trampolines")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/ftrace.c | 42 ++++++++++++++++------------------------
+ 1 file changed, 17 insertions(+), 25 deletions(-)
+
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index 50d309662d78c..5790671857e55 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -53,7 +53,7 @@ int ftrace_arch_code_modify_post_process(void)
+ union ftrace_code_union {
+ char code[MCOUNT_INSN_SIZE];
+ struct {
+- unsigned char e8;
++ unsigned char op;
+ int offset;
+ } __attribute__((packed));
+ };
+@@ -63,20 +63,23 @@ static int ftrace_calc_offset(long ip, long addr)
+ return (int)(addr - ip);
+ }
+
+-static unsigned char *ftrace_call_replace(unsigned long ip, unsigned long addr)
++static unsigned char *
++ftrace_text_replace(unsigned char op, unsigned long ip, unsigned long addr)
+ {
+ static union ftrace_code_union calc;
+
+- calc.e8 = 0xe8;
++ calc.op = op;
+ calc.offset = ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr);
+
+- /*
+- * No locking needed, this must be called via kstop_machine
+- * which in essence is like running on a uniprocessor machine.
+- */
+ return calc.code;
+ }
+
++static unsigned char *
++ftrace_call_replace(unsigned long ip, unsigned long addr)
++{
++ return ftrace_text_replace(0xe8, ip, addr);
++}
++
+ static inline int
+ within(unsigned long addr, unsigned long start, unsigned long end)
+ {
+@@ -686,22 +689,6 @@ int __init ftrace_dyn_arch_init(void)
+ return 0;
+ }
+
+-#if defined(CONFIG_X86_64) || defined(CONFIG_FUNCTION_GRAPH_TRACER)
+-static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
+-{
+- static union ftrace_code_union calc;
+-
+- /* Jmp not a call (ignore the .e8) */
+- calc.e8 = 0xe9;
+- calc.offset = ftrace_calc_offset(ip + MCOUNT_INSN_SIZE, addr);
+-
+- /*
+- * ftrace external locks synchronize the access to the static variable.
+- */
+- return calc.code;
+-}
+-#endif
+-
+ /* Currently only x86_64 supports dynamic trampolines */
+ #ifdef CONFIG_X86_64
+
+@@ -923,8 +910,8 @@ static void *addr_from_call(void *ptr)
+ return NULL;
+
+ /* Make sure this is a call */
+- if (WARN_ON_ONCE(calc.e8 != 0xe8)) {
+- pr_warn("Expected e8, got %x\n", calc.e8);
++ if (WARN_ON_ONCE(calc.op != 0xe8)) {
++ pr_warn("Expected e8, got %x\n", calc.op);
+ return NULL;
+ }
+
+@@ -995,6 +982,11 @@ void arch_ftrace_trampoline_free(struct ftrace_ops *ops)
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ extern void ftrace_graph_call(void);
+
++static unsigned char *ftrace_jmp_replace(unsigned long ip, unsigned long addr)
++{
++ return ftrace_text_replace(0xe9, ip, addr);
++}
++
+ static int ftrace_mod_jmp(unsigned long ip, void *func)
+ {
+ unsigned char *new;
+--
+2.20.1
+
--- /dev/null
+From e2eaa124ffe13d08ab870d864be7133db67f6eac Mon Sep 17 00:00:00 2001
+From: Zhimin Gu <kookoo.gu@intel.com>
+Date: Fri, 21 Sep 2018 14:26:24 +0800
+Subject: x86, hibernate: Fix nosave_regions setup for hibernation
+
+[ Upstream commit cc55f7537db6af371e9c1c6a71161ee40f918824 ]
+
+On 32bit systems, nosave_regions(non RAM areas) located between
+max_low_pfn and max_pfn are not excluded from hibernation snapshot
+currently, which may result in a machine check exception when
+trying to access these unsafe regions during hibernation:
+
+[ 612.800453] Disabling lock debugging due to kernel taint
+[ 612.805786] mce: [Hardware Error]: CPU 0: Machine Check Exception: 5 Bank 6: fe00000000801136
+[ 612.814344] mce: [Hardware Error]: RIP !INEXACT! 60:<00000000d90be566> {swsusp_save+0x436/0x560}
+[ 612.823167] mce: [Hardware Error]: TSC 1f5939fe276 ADDR dd000000 MISC 30e0000086
+[ 612.830677] mce: [Hardware Error]: PROCESSOR 0:306c3 TIME 1529487426 SOCKET 0 APIC 0 microcode 24
+[ 612.839581] mce: [Hardware Error]: Run the above through 'mcelog --ascii'
+[ 612.846394] mce: [Hardware Error]: Machine check: Processor context corrupt
+[ 612.853380] Kernel panic - not syncing: Fatal machine check
+[ 612.858978] Kernel Offset: 0x18000000 from 0xc1000000 (relocation range: 0xc0000000-0xf7ffdfff)
+
+This is because on 32bit systems, pages above max_low_pfn are regarded
+as high memeory, and accessing unsafe pages might cause expected MCE.
+On the problematic 32bit system, there are reserved memory above low
+memory, which triggered the MCE:
+
+e820 memory mapping:
+[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009d7ff] usable
+[ 0.000000] BIOS-e820: [mem 0x000000000009d800-0x000000000009ffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000000e0000-0x00000000000fffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x00000000d160cfff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000d160d000-0x00000000d1613fff] ACPI NVS
+[ 0.000000] BIOS-e820: [mem 0x00000000d1614000-0x00000000d1a44fff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000d1a45000-0x00000000d1ecffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000d1ed0000-0x00000000d7eeafff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000d7eeb000-0x00000000d7ffffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000d8000000-0x00000000d875ffff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000d8760000-0x00000000d87fffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000d8800000-0x00000000d8fadfff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000d8fae000-0x00000000d8ffffff] ACPI data
+[ 0.000000] BIOS-e820: [mem 0x00000000d9000000-0x00000000da71bfff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000da71c000-0x00000000da7fffff] ACPI NVS
+[ 0.000000] BIOS-e820: [mem 0x00000000da800000-0x00000000dbb8bfff] usable
+[ 0.000000] BIOS-e820: [mem 0x00000000dbb8c000-0x00000000dbffffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000dd000000-0x00000000df1fffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000f8000000-0x00000000fbffffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000fec00000-0x00000000fec00fff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000fed00000-0x00000000fed03fff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000fed1c000-0x00000000fed1ffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000fee00000-0x00000000fee00fff] reserved
+[ 0.000000] BIOS-e820: [mem 0x00000000ff000000-0x00000000ffffffff] reserved
+[ 0.000000] BIOS-e820: [mem 0x0000000100000000-0x000000041edfffff] usable
+
+Fix this problem by changing pfn limit from max_low_pfn to max_pfn.
+This fix does not impact 64bit system because on 64bit max_low_pfn
+is the same as max_pfn.
+
+Signed-off-by: Zhimin Gu <kookoo.gu@intel.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Chen Yu <yu.c.chen@intel.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
+index b4866badb235a..90ecc108bc8a5 100644
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -1251,7 +1251,7 @@ void __init setup_arch(char **cmdline_p)
+ x86_init.hyper.guest_late_init();
+
+ e820__reserve_resources();
+- e820__register_nosave_regions(max_low_pfn);
++ e820__register_nosave_regions(max_pfn);
+
+ x86_init.resources.reserve_resources();
+
+--
+2.20.1
+
--- /dev/null
+From 9e7ce25d459513d4aac0cc74000e3536401c3091 Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Tue, 16 Oct 2018 18:50:06 +0200
+Subject: x86/kvm/lapic: preserve gfn_to_hva_cache len on cache reinit
+
+[ Upstream commit a7c42bb6da6b1b54b2e7bd567636d72d87b10a79 ]
+
+vcpu->arch.pv_eoi is accessible through both HV_X64_MSR_VP_ASSIST_PAGE and
+MSR_KVM_PV_EOI_EN so on migration userspace may try to restore them in any
+order. Values match, however, kvm_lapic_enable_pv_eoi() uses different
+length: for Hyper-V case it's the whole struct hv_vp_assist_page, for KVM
+native case it is 8. In case we restore KVM-native MSR last cache will
+be reinitialized with len=8 so trying to access VP assist page beyond
+8 bytes with kvm_read_guest_cached() will fail.
+
+Check if we re-initializing cache for the same address and preserve length
+in case it was greater.
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/lapic.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 5427fd0aa97e1..262e49301cae6 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2636,14 +2636,22 @@ int kvm_hv_vapic_msr_read(struct kvm_vcpu *vcpu, u32 reg, u64 *data)
+ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data, unsigned long len)
+ {
+ u64 addr = data & ~KVM_MSR_ENABLED;
++ struct gfn_to_hva_cache *ghc = &vcpu->arch.pv_eoi.data;
++ unsigned long new_len;
++
+ if (!IS_ALIGNED(addr, 4))
+ return 1;
+
+ vcpu->arch.pv_eoi.msr_val = data;
+ if (!pv_eoi_enabled(vcpu))
+ return 0;
+- return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
+- addr, len);
++
++ if (addr == ghc->gpa && len <= ghc->len)
++ new_len = ghc->len;
++ else
++ new_len = len;
++
++ return kvm_gfn_to_hva_cache_init(vcpu->kvm, ghc, addr, new_len);
+ }
+
+ void kvm_apic_accept_events(struct kvm_vcpu *vcpu)
+--
+2.20.1
+
--- /dev/null
+From 492ad10d6c587a4a14ffe073c51615def22de18d Mon Sep 17 00:00:00 2001
+From: WANG Chao <chao.wang@ucloud.cn>
+Date: Fri, 12 Apr 2019 15:55:39 +0800
+Subject: x86/kvm: move kvm_load/put_guest_xcr0 into atomic context
+
+[ Upstream commit 1811d979c71621aafc7b879477202d286f7e863b ]
+
+guest xcr0 could leak into host when MCE happens in guest mode. Because
+do_machine_check() could schedule out at a few places.
+
+For example:
+
+kvm_load_guest_xcr0
+...
+kvm_x86_ops->run(vcpu) {
+ vmx_vcpu_run
+ vmx_complete_atomic_exit
+ kvm_machine_check
+ do_machine_check
+ do_memory_failure
+ memory_failure
+ lock_page
+
+In this case, host_xcr0 is 0x2ff, guest vcpu xcr0 is 0xff. After schedule
+out, host cpu has guest xcr0 loaded (0xff).
+
+In __switch_to {
+ switch_fpu_finish
+ copy_kernel_to_fpregs
+ XRSTORS
+
+If any bit i in XSTATE_BV[i] == 1 and xcr0[i] == 0, XRSTORS will
+generate #GP (In this case, bit 9). Then ex_handler_fprestore kicks in
+and tries to reinitialize fpu by restoring init fpu state. Same story as
+last #GP, except we get DOUBLE FAULT this time.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: WANG Chao <chao.wang@ucloud.cn>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm.c | 2 ++
+ arch/x86/kvm/vmx.c | 4 ++++
+ arch/x86/kvm/x86.c | 10 ++++------
+ arch/x86/kvm/x86.h | 2 ++
+ 4 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 0f33f00aa4dfe..ac2cc2ed7a85f 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5622,6 +5622,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
+ svm->vmcb->save.cr2 = vcpu->arch.cr2;
+
+ clgi();
++ kvm_load_guest_xcr0(vcpu);
+
+ /*
+ * If this vCPU has touched SPEC_CTRL, restore the guest's value if
+@@ -5769,6 +5770,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
+ if (unlikely(svm->vmcb->control.exit_code == SVM_EXIT_NMI))
+ kvm_before_interrupt(&svm->vcpu);
+
++ kvm_put_guest_xcr0(vcpu);
+ stgi();
+
+ /* Any pending NMI will happen here */
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 562f5dc4645b6..ee9ff20da3902 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10756,6 +10756,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)
+ vmx_set_interrupt_shadow(vcpu, 0);
+
++ kvm_load_guest_xcr0(vcpu);
++
+ if (static_cpu_has(X86_FEATURE_PKU) &&
+ kvm_read_cr4_bits(vcpu, X86_CR4_PKE) &&
+ vcpu->arch.pkru != vmx->host_pkru)
+@@ -10971,6 +10973,8 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ __write_pkru(vmx->host_pkru);
+ }
+
++ kvm_put_guest_xcr0(vcpu);
++
+ vmx->nested.nested_run_pending = 0;
+ vmx->idt_vectoring_info = 0;
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 33b2e3e07f925..a846ed13ba53c 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -713,7 +713,7 @@ void kvm_lmsw(struct kvm_vcpu *vcpu, unsigned long msw)
+ }
+ EXPORT_SYMBOL_GPL(kvm_lmsw);
+
+-static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
++void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
+ {
+ if (kvm_read_cr4_bits(vcpu, X86_CR4_OSXSAVE) &&
+ !vcpu->guest_xcr0_loaded) {
+@@ -723,8 +723,9 @@ static void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu)
+ vcpu->guest_xcr0_loaded = 1;
+ }
+ }
++EXPORT_SYMBOL_GPL(kvm_load_guest_xcr0);
+
+-static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
++void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
+ {
+ if (vcpu->guest_xcr0_loaded) {
+ if (vcpu->arch.xcr0 != host_xcr0)
+@@ -732,6 +733,7 @@ static void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu)
+ vcpu->guest_xcr0_loaded = 0;
+ }
+ }
++EXPORT_SYMBOL_GPL(kvm_put_guest_xcr0);
+
+ static int __kvm_set_xcr(struct kvm_vcpu *vcpu, u32 index, u64 xcr)
+ {
+@@ -7649,8 +7651,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ goto cancel_injection;
+ }
+
+- kvm_load_guest_xcr0(vcpu);
+-
+ if (req_immediate_exit) {
+ kvm_make_request(KVM_REQ_EVENT, vcpu);
+ kvm_x86_ops->request_immediate_exit(vcpu);
+@@ -7703,8 +7703,6 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ vcpu->mode = OUTSIDE_GUEST_MODE;
+ smp_wmb();
+
+- kvm_put_guest_xcr0(vcpu);
+-
+ kvm_before_interrupt(vcpu);
+ kvm_x86_ops->handle_external_intr(vcpu);
+ kvm_after_interrupt(vcpu);
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index 1826ed9dd1c8f..8889e0c029a70 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -345,4 +345,6 @@ static inline void kvm_after_interrupt(struct kvm_vcpu *vcpu)
+ __this_cpu_write(current_vcpu, NULL);
+ }
+
++void kvm_load_guest_xcr0(struct kvm_vcpu *vcpu);
++void kvm_put_guest_xcr0(struct kvm_vcpu *vcpu);
+ #endif
+--
+2.20.1
+
--- /dev/null
+From d58c1594ce119313eaf06af886bb52441721e06e Mon Sep 17 00:00:00 2001
+From: Pavel Tatashin <pasha.tatashin@soleen.com>
+Date: Sat, 26 Jan 2019 12:49:56 -0500
+Subject: x86/kvmclock: set offset for kvm unstable clock
+
+[ Upstream commit b5179ec4187251a751832193693d6e474d3445ac ]
+
+VMs may show incorrect uptime and dmesg printk offsets on hypervisors with
+unstable clock. The problem is produced when VM is rebooted without exiting
+from qemu.
+
+The fix is to calculate clock offset not only for stable clock but for
+unstable clock as well, and use kvm_sched_clock_read() which substracts
+the offset for both clocks.
+
+This is safe, because pvclock_clocksource_read() does the right thing and
+makes sure that clock always goes forward, so once offset is calculated
+with unstable clock, we won't get new reads that are smaller than offset,
+and thus won't get negative results.
+
+Thank you Jon DeVree for helping to reproduce this issue.
+
+Fixes: 857baa87b642 ("sched/clock: Enable sched clock early")
+Cc: stable@vger.kernel.org
+Reported-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvmclock.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index 013fe3d21dbb3..2ec202cb9dfd4 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -117,12 +117,8 @@ static u64 kvm_sched_clock_read(void)
+
+ static inline void kvm_sched_clock_init(bool stable)
+ {
+- if (!stable) {
+- pv_time_ops.sched_clock = kvm_clock_read;
++ if (!stable)
+ clear_sched_clock_stable();
+- return;
+- }
+-
+ kvm_sched_clock_offset = kvm_clock_read();
+ pv_time_ops.sched_clock = kvm_sched_clock_read;
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
