--- /dev/null
+From 627ead724eff33673597216f5020b72118827de4 Mon Sep 17 00:00:00 2001
+From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+Date: Thu, 28 Nov 2019 15:58:29 +0530
+Subject: ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()
+
+From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+
+commit 627ead724eff33673597216f5020b72118827de4 upstream.
+
+kmemleak reported backtrace:
+ [<bbee0454>] kmem_cache_alloc_trace+0x128/0x260
+ [<6677f215>] i2c_acpi_install_space_handler+0x4b/0xe0
+ [<1180f4fc>] i2c_register_adapter+0x186/0x400
+ [<6083baf7>] i2c_add_adapter+0x4e/0x70
+ [<a3ddf966>] intel_gmbus_setup+0x1a2/0x2c0 [i915]
+ [<84cb69ae>] i915_driver_probe+0x8d8/0x13a0 [i915]
+ [<81911d4b>] i915_pci_probe+0x48/0x160 [i915]
+ [<4b159af1>] pci_device_probe+0xdc/0x160
+ [<b3c64704>] really_probe+0x1ee/0x450
+ [<bc029f5a>] driver_probe_device+0x142/0x1b0
+ [<d8829d20>] device_driver_attach+0x49/0x50
+ [<de71f045>] __driver_attach+0xc9/0x150
+ [<df33ac83>] bus_for_each_dev+0x56/0xa0
+ [<80089bba>] driver_attach+0x19/0x20
+ [<cc73f583>] bus_add_driver+0x177/0x220
+ [<7b29d8c7>] driver_register+0x56/0xf0
+
+In i2c_acpi_remove_space_handler(), a leak occurs whenever the
+"data" parameter is initialized to 0 before being passed to
+acpi_bus_get_private_data().
+
+This is because the NULL pointer check in acpi_bus_get_private_data()
+(condition->if(!*data)) returns EINVAL and, in consequence, memory is
+never freed in i2c_acpi_remove_space_handler().
+
+Fix the NULL pointer check in acpi_bus_get_private_data() to follow
+the analogous check in acpi_get_data_full().
+
+Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+[ rjw: Subject & changelog ]
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -153,7 +153,7 @@ int acpi_bus_get_private_data(acpi_handl
+ {
+ acpi_status status;
+
+- if (!*data)
++ if (!data)
+ return -EINVAL;
+
+ status = acpi_get_data(handle, acpi_bus_private_data_handler, data);
--- /dev/null
+From 016b87ca5c8c6e9e87db442f04dc99609b11ed36 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 28 Nov 2019 23:47:51 +0100
+Subject: ACPI: EC: Rework flushing of pending work
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 016b87ca5c8c6e9e87db442f04dc99609b11ed36 upstream.
+
+There is a race condition in the ACPI EC driver, between
+__acpi_ec_flush_event() and acpi_ec_event_handler(), that may
+cause systems to stay in suspended-to-idle forever after a wakeup
+event coming from the EC.
+
+Namely, acpi_s2idle_wake() calls acpi_ec_flush_work() to wait until
+the delayed work resulting from the handling of the EC GPE in
+acpi_ec_dispatch_gpe() is processed, and that function invokes
+__acpi_ec_flush_event() which uses wait_event() to wait for
+ec->nr_pending_queries to become zero on ec->wait, and that wait
+queue may be woken up too early.
+
+Suppose that acpi_ec_dispatch_gpe() has caused acpi_ec_gpe_handler()
+to run, so advance_transaction() has been called and it has invoked
+acpi_ec_submit_query() to queue up an event work item, so
+ec->nr_pending_queries has been incremented (under ec->lock). The
+work function of that work item, acpi_ec_event_handler() runs later
+and calls acpi_ec_query() to process the event. That function calls
+acpi_ec_transaction() which invokes acpi_ec_transaction_unlocked()
+and the latter wakes up ec->wait under ec->lock, but it drops that
+lock before returning.
+
+When acpi_ec_query() returns, acpi_ec_event_handler() acquires
+ec->lock and decrements ec->nr_pending_queries, but at that point
+__acpi_ec_flush_event() (woken up previously) may already have
+acquired ec->lock, checked the value of ec->nr_pending_queries (and
+it would not have been zero then) and decided to go back to sleep.
+Next, if ec->nr_pending_queries is equal to zero now, the loop
+in acpi_ec_event_handler() terminates, ec->lock is released and
+acpi_ec_check_event() is called, but it does nothing unless
+ec_event_clearing is equal to ACPI_EC_EVT_TIMING_EVENT (which is
+not the case by default). In the end, if no more event work items
+have been queued up while executing acpi_ec_transaction_unlocked(),
+there is nothing to wake up __acpi_ec_flush_event() again and it
+sleeps forever, so the suspend-to-idle loop cannot make progress and
+the system is permanently suspended.
+
+To avoid this issue, notice that it actually is not necessary to
+wait for ec->nr_pending_queries to become zero in every case in
+which __acpi_ec_flush_event() is used.
+
+First, during platform-based system suspend (not suspend-to-idle),
+__acpi_ec_flush_event() is called by acpi_ec_disable_event() after
+clearing the EC_FLAGS_QUERY_ENABLED flag, which prevents
+acpi_ec_submit_query() from submitting any new event work items,
+so calling flush_scheduled_work() and flushing ec_query_wq
+subsequently (in order to wait until all of the queries in that
+queue have been processed) would be sufficient to flush all of
+the pending EC work in that case.
+
+Second, the purpose of the flushing of pending EC work while
+suspended-to-idle described above really is to wait until the
+first event work item coming from acpi_ec_dispatch_gpe() is
+complete, because it should produce system wakeup events if
+that is a valid EC-based system wakeup, so calling
+flush_scheduled_work() followed by flushing ec_query_wq is also
+sufficient for that purpose.
+
+Rework the code to follow the above observations.
+
+Fixes: 56b9918490 ("PM: sleep: Simplify suspend-to-idle control flow")
+Reported-by: Kenneth R. Crudup <kenny@panix.com>
+Tested-by: Kenneth R. Crudup <kenny@panix.com>
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/ec.c | 36 +++++++++++++-----------------------
+ 1 file changed, 13 insertions(+), 23 deletions(-)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -525,26 +525,10 @@ static void acpi_ec_enable_event(struct
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+-static bool acpi_ec_query_flushed(struct acpi_ec *ec)
++static void __acpi_ec_flush_work(void)
+ {
+- bool flushed;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&ec->lock, flags);
+- flushed = !ec->nr_pending_queries;
+- spin_unlock_irqrestore(&ec->lock, flags);
+- return flushed;
+-}
+-
+-static void __acpi_ec_flush_event(struct acpi_ec *ec)
+-{
+- /*
+- * When ec_freeze_events is true, we need to flush events in
+- * the proper position before entering the noirq stage.
+- */
+- wait_event(ec->wait, acpi_ec_query_flushed(ec));
+- if (ec_query_wq)
+- flush_workqueue(ec_query_wq);
++ flush_scheduled_work(); /* flush ec->work */
++ flush_workqueue(ec_query_wq); /* flush queries */
+ }
+
+ static void acpi_ec_disable_event(struct acpi_ec *ec)
+@@ -554,15 +538,21 @@ static void acpi_ec_disable_event(struct
+ spin_lock_irqsave(&ec->lock, flags);
+ __acpi_ec_disable_event(ec);
+ spin_unlock_irqrestore(&ec->lock, flags);
+- __acpi_ec_flush_event(ec);
++
++ /*
++ * When ec_freeze_events is true, we need to flush events in
++ * the proper position before entering the noirq stage.
++ */
++ __acpi_ec_flush_work();
+ }
+
+ void acpi_ec_flush_work(void)
+ {
+- if (first_ec)
+- __acpi_ec_flush_event(first_ec);
++ /* Without ec_query_wq there is nothing to flush. */
++ if (!ec_query_wq)
++ return;
+
+- flush_scheduled_work();
++ __acpi_ec_flush_work();
+ }
+ #endif /* CONFIG_PM_SLEEP */
+
--- /dev/null
+From 77adf9355304f8dcf09054280af5e23fc451ab3d Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 30 Oct 2019 18:05:45 +0300
+Subject: ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 77adf9355304f8dcf09054280af5e23fc451ab3d upstream.
+
+Valerio and others reported that commit 84c8b58ed3ad ("ACPI / hotplug /
+PCI: Don't scan bridges managed by native hotplug") prevents some recent
+LG and HP laptops from booting with endless loop of:
+
+ ACPI Error: No handler or method for GPE 08, disabling event (20190215/evgpe-835)
+ ACPI Error: No handler or method for GPE 09, disabling event (20190215/evgpe-835)
+ ACPI Error: No handler or method for GPE 0A, disabling event (20190215/evgpe-835)
+ ...
+
+What seems to happen is that during boot, after the initial PCI enumeration
+when EC is enabled the platform triggers ACPI Notify() to one of the root
+ports. The root port itself looks like this:
+
+ pci 0000:00:1b.0: PCI bridge to [bus 02-3a]
+ pci 0000:00:1b.0: bridge window [mem 0xc4000000-0xda0fffff]
+ pci 0000:00:1b.0: bridge window [mem 0x80000000-0xa1ffffff 64bit pref]
+
+The BIOS has configured the root port so that it does not have I/O bridge
+window.
+
+Now when the ACPI Notify() is triggered ACPI hotplug handler calls
+acpiphp_native_scan_bridge() for each non-hotplug bridge (as this system is
+using native PCIe hotplug) and pci_assign_unassigned_bridge_resources() to
+allocate resources.
+
+The device connected to the root port is a PCIe switch (Thunderbolt
+controller) with two hotplug downstream ports. Because of the hotplug ports
+__pci_bus_size_bridges() tries to add "additional I/O" of 256 bytes to each
+(DEFAULT_HOTPLUG_IO_SIZE). This gets further aligned to 4k as that's the
+minimum I/O window size so each hotplug port gets 4k I/O window and the
+same happens for the root port (which is also hotplug port). This means
+3 * 4k = 12k I/O window.
+
+Because of this pci_assign_unassigned_bridge_resources() ends up opening a
+I/O bridge window for the root port at first available I/O address which
+seems to be in range 0x1000 - 0x3fff. Normally this range is used for ACPI
+stuff such as GPE bits (below is part of /proc/ioports):
+
+ 1800-1803 : ACPI PM1a_EVT_BLK
+ 1804-1805 : ACPI PM1a_CNT_BLK
+ 1808-180b : ACPI PM_TMR
+ 1810-1815 : ACPI CPU throttle
+ 1850-1850 : ACPI PM2_CNT_BLK
+ 1854-1857 : pnp 00:05
+ 1860-187f : ACPI GPE0_BLK
+
+However, when the ACPI Notify() happened this range was not yet reserved
+for ACPI/PNP (that happens later) so PCI gets it. It then starts writing to
+this range and accidentally stomps over GPE bits among other things causing
+the endless stream of messages about missing GPE handler.
+
+This problem does not happen if "pci=hpiosize=0" is passed in the kernel
+command line. The reason is that then the kernel does not try to allocate
+the additional 256 bytes for each hotplug port.
+
+Fix this by allocating resources directly below the non-hotplug bridges
+where a new device may appear as a result of ACPI Notify(). This avoids the
+hotplug bridges and prevents opening the additional I/O window.
+
+Fixes: 84c8b58ed3ad ("ACPI / hotplug / PCI: Don't scan bridges managed by native hotplug")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=203617
+Link: https://lore.kernel.org/r/20191030150545.19885-1-mika.westerberg@linux.intel.com
+Reported-by: Valerio Passini <passini.valerio@gmail.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/hotplug/acpiphp_glue.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -449,8 +449,15 @@ static void acpiphp_native_scan_bridge(s
+
+ /* Scan non-hotplug bridges that need to be reconfigured */
+ for_each_pci_bridge(dev, bus) {
+- if (!hotplug_is_native(dev))
+- max = pci_scan_bridge(bus, dev, max, 1);
++ if (hotplug_is_native(dev))
++ continue;
++
++ max = pci_scan_bridge(bus, dev, max, 1);
++ if (dev->subordinate) {
++ pcibios_resource_survey_bus(dev->subordinate);
++ pci_bus_size_bridges(dev->subordinate);
++ pci_bus_assign_resources(dev->subordinate);
++ }
+ }
+ }
+
+@@ -480,7 +487,6 @@ static void enable_slot(struct acpiphp_s
+ if (PCI_SLOT(dev->devfn) == slot->device)
+ acpiphp_native_scan_bridge(dev);
+ }
+- pci_assign_unassigned_bridge_resources(bus->self);
+ } else {
+ LIST_HEAD(add_list);
+ int max, pass;
--- /dev/null
+From 6025e2fae3dde3c3d789d08f8ceacbdd9f90d471 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 24 Oct 2019 23:57:23 +0200
+Subject: ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6025e2fae3dde3c3d789d08f8ceacbdd9f90d471 upstream.
+
+The iGPU / GFX0 device's _PS0 method on the ASUS T200TA depends on the
+I2C1 controller (which is connected to the embedded controller). But unlike
+in the T100TA/T100CHI this dependency is not listed in the _DEP of the GFX0
+device.
+
+This results in the dev_WARN_ONCE(..., "Transfer while suspended\n") call
+in i2c-designware-master.c triggering and the AML code not working as it
+should.
+
+This commit fixes this by adding a dmi based quirk mechanism for devices
+which miss a _DEP, and adding a quirk for the LNXVIDEO depending on the
+I2C1 device on the Asus T200TA.
+
+Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller")
+Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: 4.20+ <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -10,6 +10,7 @@
+ #include <linux/acpi.h>
+ #include <linux/clkdev.h>
+ #include <linux/clk-provider.h>
++#include <linux/dmi.h>
+ #include <linux/err.h>
+ #include <linux/io.h>
+ #include <linux/mutex.h>
+@@ -463,6 +464,18 @@ struct lpss_device_links {
+ const char *consumer_hid;
+ const char *consumer_uid;
+ u32 flags;
++ const struct dmi_system_id *dep_missing_ids;
++};
++
++/* Please keep this list sorted alphabetically by vendor and model */
++static const struct dmi_system_id i2c1_dep_missing_dmi_ids[] = {
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "T200TA"),
++ },
++ },
++ {}
+ };
+
+ /*
+@@ -478,7 +491,8 @@ static const struct lpss_device_links lp
+ /* CHT iGPU depends on PMIC I2C controller */
+ {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
+ /* BYT iGPU depends on the Embedded Controller I2C controller (UID 1) */
+- {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
++ {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME,
++ i2c1_dep_missing_dmi_ids},
+ /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */
+ {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
+ /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */
+@@ -577,7 +591,8 @@ static void acpi_lpss_link_consumer(stru
+ if (!dev2)
+ return;
+
+- if (acpi_lpss_dep(ACPI_COMPANION(dev2), ACPI_HANDLE(dev1)))
++ if ((link->dep_missing_ids && dmi_check_system(link->dep_missing_ids))
++ || acpi_lpss_dep(ACPI_COMPANION(dev2), ACPI_HANDLE(dev1)))
+ device_link_add(dev2, dev1, link->flags);
+
+ put_device(dev2);
+@@ -592,7 +607,8 @@ static void acpi_lpss_link_supplier(stru
+ if (!dev2)
+ return;
+
+- if (acpi_lpss_dep(ACPI_COMPANION(dev1), ACPI_HANDLE(dev2)))
++ if ((link->dep_missing_ids && dmi_check_system(link->dep_missing_ids))
++ || acpi_lpss_dep(ACPI_COMPANION(dev1), ACPI_HANDLE(dev2)))
+ device_link_add(dev1, dev2, link->flags);
+
+ put_device(dev2);
--- /dev/null
+From b3b3519c04bdff91651d0a6deb79dbd4516b5d7b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 24 Oct 2019 23:57:22 +0200
+Subject: ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit b3b3519c04bdff91651d0a6deb79dbd4516b5d7b upstream.
+
+Various Asus Bay Trail devices (T100TA, T100CHI, T200TA) have an embedded
+controller connected to I2C1 and the iGPU (LNXVIDEO) _PS0/_PS3 methods
+access it, so we need to add a consumer link from LNXVIDEO to I2C1 on
+these devices to avoid suspend/resume ordering problems.
+
+Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller")
+Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: 4.20+ <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -477,6 +477,8 @@ static const struct lpss_device_links lp
+ {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME},
+ /* CHT iGPU depends on PMIC I2C controller */
+ {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
++ /* BYT iGPU depends on the Embedded Controller I2C controller (UID 1) */
++ {"80860F41", "1", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
+ /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */
+ {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
+ /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */
--- /dev/null
+From cc18735f208565343a9824adeca5305026598550 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 24 Oct 2019 23:57:21 +0200
+Subject: ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit cc18735f208565343a9824adeca5305026598550 upstream.
+
+So far on Bay Trail (BYT) we only have been adding a device_link adding
+the iGPU (LNXVIDEO) device as consumer for the I2C controller for the
+PMIC for I2C5, but the PMIC only uses I2C5 on BYT CR (cost reduced) on
+regular BYT platforms I2C7 is used and we were not adding the device_link
+sometimes causing resume ordering issues.
+
+This commit adds LNXVIDEO -> BYT I2C7 to the lpss_device_links table,
+fixing this.
+
+Fixes: 2d71ee0ce72f ("ACPI / LPSS: Add a device link from the GPU to the BYT I2C5 controller")
+Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: 4.20+ <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpi_lpss.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -473,9 +473,14 @@ struct lpss_device_links {
+ * the supplier is not enumerated until after the consumer is probed.
+ */
+ static const struct lpss_device_links lpss_device_links[] = {
++ /* CHT External sdcard slot controller depends on PMIC I2C ctrl */
+ {"808622C1", "7", "80860F14", "3", DL_FLAG_PM_RUNTIME},
++ /* CHT iGPU depends on PMIC I2C controller */
+ {"808622C1", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
++ /* BYT CR iGPU depends on PMIC I2C controller (UID 5 on CR) */
+ {"80860F41", "5", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
++ /* BYT iGPU depends on PMIC I2C controller (UID 7 on non CR) */
++ {"80860F41", "7", "LNXVIDEO", NULL, DL_FLAG_PM_RUNTIME},
+ };
+
+ static bool hid_uid_match(struct acpi_device *adev,
--- /dev/null
+From 833a426cc471b6088011b3d67f1dc4e147614647 Mon Sep 17 00:00:00 2001
+From: Francesco Ruggeri <fruggeri@arista.com>
+Date: Tue, 19 Nov 2019 21:47:27 -0800
+Subject: ACPI: OSL: only free map once in osl.c
+
+From: Francesco Ruggeri <fruggeri@arista.com>
+
+commit 833a426cc471b6088011b3d67f1dc4e147614647 upstream.
+
+acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock
+before freeing the map. This creates a race condition the can result
+in the map being freed more than once.
+A panic can be caused by running
+
+for ((i=0; i<10; i++))
+do
+ for ((j=0; j<100000; j++))
+ do
+ cat /sys/firmware/acpi/tables/data/BERT >/dev/null
+ done &
+done
+
+This patch makes sure that only the process that drops the reference
+to 0 does the freeing.
+
+Fixes: b7c1fadd6c2e ("ACPI: Do not use krefs under a mutex in osl.c")
+Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
+Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/osl.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -374,19 +374,21 @@ void *__ref acpi_os_map_memory(acpi_phys
+ }
+ EXPORT_SYMBOL_GPL(acpi_os_map_memory);
+
+-static void acpi_os_drop_map_ref(struct acpi_ioremap *map)
++/* Must be called with mutex_lock(&acpi_ioremap_lock) */
++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map)
+ {
+- if (!--map->refcount)
++ unsigned long refcount = --map->refcount;
++
++ if (!refcount)
+ list_del_rcu(&map->list);
++ return refcount;
+ }
+
+ static void acpi_os_map_cleanup(struct acpi_ioremap *map)
+ {
+- if (!map->refcount) {
+- synchronize_rcu_expedited();
+- acpi_unmap(map->phys, map->virt);
+- kfree(map);
+- }
++ synchronize_rcu_expedited();
++ acpi_unmap(map->phys, map->virt);
++ kfree(map);
+ }
+
+ /**
+@@ -406,6 +408,7 @@ static void acpi_os_map_cleanup(struct a
+ void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size)
+ {
+ struct acpi_ioremap *map;
++ unsigned long refcount;
+
+ if (!acpi_permanent_mmap) {
+ __acpi_unmap_table(virt, size);
+@@ -419,10 +422,11 @@ void __ref acpi_os_unmap_iomem(void __io
+ WARN(true, PREFIX "%s: bad address %p\n", __func__, virt);
+ return;
+ }
+- acpi_os_drop_map_ref(map);
++ refcount = acpi_os_drop_map_ref(map);
+ mutex_unlock(&acpi_ioremap_lock);
+
+- acpi_os_map_cleanup(map);
++ if (!refcount)
++ acpi_os_map_cleanup(map);
+ }
+ EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem);
+
+@@ -457,6 +461,7 @@ void acpi_os_unmap_generic_address(struc
+ {
+ u64 addr;
+ struct acpi_ioremap *map;
++ unsigned long refcount;
+
+ if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY)
+ return;
+@@ -472,10 +477,11 @@ void acpi_os_unmap_generic_address(struc
+ mutex_unlock(&acpi_ioremap_lock);
+ return;
+ }
+- acpi_os_drop_map_ref(map);
++ refcount = acpi_os_drop_map_ref(map);
+ mutex_unlock(&acpi_ioremap_lock);
+
+- acpi_os_map_cleanup(map);
++ if (!refcount)
++ acpi_os_map_cleanup(map);
+ }
+ EXPORT_SYMBOL(acpi_os_unmap_generic_address);
+
--- /dev/null
+From b9ea0bae260f6aae546db224daa6ac1bd9d94b91 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 4 Dec 2019 02:54:27 +0100
+Subject: ACPI: PM: Avoid attaching ACPI PM domain to certain devices
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit b9ea0bae260f6aae546db224daa6ac1bd9d94b91 upstream.
+
+Certain ACPI-enumerated devices represented as platform devices in
+Linux, like fans, require special low-level power management handling
+implemented by their drivers that is not in agreement with the ACPI
+PM domain behavior. That leads to problems with managing ACPI fans
+during system-wide suspend and resume.
+
+For this reason, make acpi_dev_pm_attach() skip the affected devices
+by adding a list of device IDs to avoid to it and putting the IDs of
+the affected devices into that list.
+
+Fixes: e5cc8ef31267 (ACPI / PM: Provide ACPI PM callback routines for subsystems)
+Reported-by: Zhang Rui <rui.zhang@intel.com>
+Tested-by: Todd Brandt <todd.e.brandt@linux.intel.com>
+Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/device_pm.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1314,9 +1314,19 @@ static void acpi_dev_pm_detach(struct de
+ */
+ int acpi_dev_pm_attach(struct device *dev, bool power_on)
+ {
++ /*
++ * Skip devices whose ACPI companions match the device IDs below,
++ * because they require special power management handling incompatible
++ * with the generic ACPI PM domain.
++ */
++ static const struct acpi_device_id special_pm_ids[] = {
++ {"PNP0C0B", }, /* Generic ACPI fan */
++ {"INT3404", }, /* Fan */
++ {}
++ };
+ struct acpi_device *adev = ACPI_COMPANION(dev);
+
+- if (!adev)
++ if (!adev || !acpi_match_device_ids(adev, special_pm_ids))
+ return 0;
+
+ /*
--- /dev/null
+From a814dcc269830c9dbb8a83731cfc6fc5dd787f8d Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 1 Oct 2019 17:27:21 +0300
+Subject: ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit a814dcc269830c9dbb8a83731cfc6fc5dd787f8d upstream.
+
+We have a stub defined for the acpi_dev_get_first_match_dev() in acpi.h
+for the case when CONFIG_ACPI=n.
+
+Moreover, acpi_dev_put(), counterpart function, is already placed under
+CONFIG_ACPI.
+
+Thus, move acpi_dev_get_first_match_dev() under CONFIG_ACPI as well.
+
+Fixes: 817b4d64da03 ("ACPI / utils: Introduce acpi_dev_get_first_match_dev() helper")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: 5.2+ <stable@vger.kernel.org> # 5.2+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/acpi/acpi_bus.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/include/acpi/acpi_bus.h
++++ b/include/acpi/acpi_bus.h
+@@ -78,9 +78,6 @@ acpi_evaluate_dsm_typed(acpi_handle hand
+ bool acpi_dev_found(const char *hid);
+ bool acpi_dev_present(const char *hid, const char *uid, s64 hrv);
+
+-struct acpi_device *
+-acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv);
+-
+ #ifdef CONFIG_ACPI
+
+ #include <linux/proc_fs.h>
+@@ -683,6 +680,9 @@ static inline bool acpi_device_can_power
+ adev->power.states[ACPI_STATE_D3_HOT].flags.explicit_set);
+ }
+
++struct acpi_device *
++acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv);
++
+ static inline void acpi_dev_put(struct acpi_device *adev)
+ {
+ put_device(&adev->dev);
--- /dev/null
+From 480136343cbe89426d6c2ab74ffb4e3ee572c7ee Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Tue, 10 Dec 2019 00:05:41 +0900
+Subject: ALSA: fireface: fix return value in error path of isochronous resources reservation
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 480136343cbe89426d6c2ab74ffb4e3ee572c7ee upstream.
+
+Even if isochronous resources reservation fails, error code doesn't return
+in pcm.hw_params callback.
+
+Cc: <stable@vger.kernel.org> #5.3+
+Fixes: 55162d2bb0e8 ("ALSA: fireface: reserve/release isochronous resources in pcm.hw_params/hw_free callbacks")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20191209151655.GA8090@workstation
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/fireface/ff-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/fireface/ff-pcm.c
++++ b/sound/firewire/fireface/ff-pcm.c
+@@ -219,7 +219,7 @@ static int pcm_hw_params(struct snd_pcm_
+ mutex_unlock(&ff->mutex);
+ }
+
+- return 0;
++ return err;
+ }
+
+ static int pcm_hw_free(struct snd_pcm_substream *substream)
--- /dev/null
+From 5815bdfd7f54739be9abed1301d55f5e74d7ad1f Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Wed, 11 Dec 2019 13:13:21 +0800
+Subject: ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 5815bdfd7f54739be9abed1301d55f5e74d7ad1f upstream.
+
+After applying the fixup ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, the
+Line-out jack works well. And instead of adding a new set of pin
+definition in the pin_fixup_tbl, we put a more generic matching entry
+in the fallback_pin_fixup_tbl.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20191211051321.5883-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7672,11 +7672,6 @@ static const struct snd_hda_pin_quirk al
+ {0x1a, 0x90a70130},
+ {0x1b, 0x90170110},
+ {0x21, 0x03211020}),
+- SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
+- {0x12, 0xb7a60130},
+- {0x13, 0xb8a61140},
+- {0x16, 0x90170110},
+- {0x21, 0x04211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+ {0x12, 0x90a60130},
+ {0x14, 0x90170110},
+@@ -7864,6 +7859,9 @@ static const struct snd_hda_pin_quirk al
+ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+ {0x19, 0x40000000},
+ {0x1b, 0x40000000}),
++ SND_HDA_PIN_QUIRK(0x10ec0274, 0x1028, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
++ {0x19, 0x40000000},
++ {0x1a, 0x40000000}),
+ {}
+ };
+
--- /dev/null
+From 59a126aa3113fc23f03fedcafe3705f1de5aff50 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Tue, 10 Dec 2019 00:03:04 +0900
+Subject: ALSA: oxfw: fix return value in error path of isochronous resources reservation
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit 59a126aa3113fc23f03fedcafe3705f1de5aff50 upstream.
+
+Even if isochronous resources reservation fails, error code doesn't return
+in pcm.hw_params callback.
+
+Cc: <stable@vger.kernel.org> #5.3+
+Fixes: 4f380d007052 ("ALSA: oxfw: configure packet format in pcm.hw_params callback")
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20191209151655.GA8090@workstation
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/oxfw/oxfw-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/oxfw/oxfw-pcm.c
++++ b/sound/firewire/oxfw/oxfw-pcm.c
+@@ -255,7 +255,7 @@ static int pcm_playback_hw_params(struct
+ mutex_unlock(&oxfw->mutex);
+ }
+
+- return 0;
++ return err;
+ }
+
+ static int pcm_capture_hw_free(struct snd_pcm_substream *substream)
--- /dev/null
+From 315cee426f87658a6799815845788fde965ddaad Mon Sep 17 00:00:00 2001
+From: Denis Efremov <efremov@linux.com>
+Date: Mon, 30 Sep 2019 23:31:47 +0300
+Subject: ar5523: check NULL before memcpy() in ar5523_cmd()
+
+From: Denis Efremov <efremov@linux.com>
+
+commit 315cee426f87658a6799815845788fde965ddaad upstream.
+
+memcpy() call with "idata == NULL && ilen == 0" results in undefined
+behavior in ar5523_cmd(). For example, NULL is passed in callchain
+"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch
+adds ilen check before memcpy() call in ar5523_cmd() to prevent an
+undefined behavior.
+
+Cc: Pontus Fuchs <pontus.fuchs@gmail.com>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Cc: stable@vger.kernel.org
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar,
+
+ if (flags & AR5523_CMD_FLAG_MAGIC)
+ hdr->magic = cpu_to_be32(1 << 24);
+- memcpy(hdr + 1, idata, ilen);
++ if (ilen)
++ memcpy(hdr + 1, idata, ilen);
+
+ cmd->odata = odata;
+ cmd->olen = olen;
--- /dev/null
+From 287897f9aaa2ad1c923d9875914f57c4dc9159c8 Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Date: Sat, 16 Nov 2019 17:16:51 +0200
+Subject: ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity
+
+From: Jarkko Nikula <jarkko.nikula@bitmer.com>
+
+commit 287897f9aaa2ad1c923d9875914f57c4dc9159c8 upstream.
+
+The MMC card detection GPIO polarity is active low on TAO3530, like in many
+other similar boards. Now the card is not detected and it is unable to
+mount rootfs from an SD card.
+
+Fix this by using the correct polarity.
+
+This incorrect polarity was defined already in the commit 30d95c6d7092
+("ARM: dts: omap3: Add Technexion TAO3530 SOM omap3-tao3530.dtsi") in v3.18
+kernel and later changed to use defined GPIO constants in v4.4 kernel by
+the commit 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags
+cell for OMAP2+ boards").
+
+While the latter commit did not introduce the issue I'm marking it with
+Fixes tag due the v4.4 kernels still being maintained.
+
+Fixes: 3a637e008e54 ("ARM: dts: Use defined GPIO constants in flags cell for OMAP2+ boards")
+Cc: linux-stable <stable@vger.kernel.org> # 4.4+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/omap3-tao3530.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap3-tao3530.dtsi
++++ b/arch/arm/boot/dts/omap3-tao3530.dtsi
+@@ -222,7 +222,7 @@
+ pinctrl-0 = <&mmc1_pins>;
+ vmmc-supply = <&vmmc1>;
+ vqmmc-supply = <&vsim>;
+- cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&twl_gpio 0 GPIO_ACTIVE_LOW>;
+ bus-width = <8>;
+ };
+
--- /dev/null
+From fe965096c9495ddcf78ec163348105e2baf8d185 Mon Sep 17 00:00:00 2001
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+Date: Mon, 11 Nov 2019 15:50:48 +0800
+Subject: ASoC: fsl_audmix: Add spin lock to protect tdms
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+commit fe965096c9495ddcf78ec163348105e2baf8d185 upstream.
+
+Audmix support two substream, When two substream start
+to run, the trigger function may be called by two substream
+in same time, that the priv->tdms may be updated wrongly.
+
+The expected priv->tdms is 0x3, but sometimes the
+result is 0x2, or 0x1.
+
+Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Link: https://lore.kernel.org/r/1e706afe53fdd1fbbbc79277c48a98f8416ba873.1573458378.git.shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/fsl_audmix.c | 6 ++++++
+ sound/soc/fsl/fsl_audmix.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/sound/soc/fsl/fsl_audmix.c
++++ b/sound/soc/fsl/fsl_audmix.c
+@@ -286,6 +286,7 @@ static int fsl_audmix_dai_trigger(struct
+ struct snd_soc_dai *dai)
+ {
+ struct fsl_audmix *priv = snd_soc_dai_get_drvdata(dai);
++ unsigned long lock_flags;
+
+ /* Capture stream shall not be handled */
+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+@@ -295,12 +296,16 @@ static int fsl_audmix_dai_trigger(struct
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ spin_lock_irqsave(&priv->lock, lock_flags);
+ priv->tdms |= BIT(dai->driver->id);
++ spin_unlock_irqrestore(&priv->lock, lock_flags);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
++ spin_lock_irqsave(&priv->lock, lock_flags);
+ priv->tdms &= ~BIT(dai->driver->id);
++ spin_unlock_irqrestore(&priv->lock, lock_flags);
+ break;
+ default:
+ return -EINVAL;
+@@ -491,6 +496,7 @@ static int fsl_audmix_probe(struct platf
+ return PTR_ERR(priv->ipg_clk);
+ }
+
++ spin_lock_init(&priv->lock);
+ platform_set_drvdata(pdev, priv);
+ pm_runtime_enable(dev);
+
+--- a/sound/soc/fsl/fsl_audmix.h
++++ b/sound/soc/fsl/fsl_audmix.h
+@@ -96,6 +96,7 @@ struct fsl_audmix {
+ struct platform_device *pdev;
+ struct regmap *regmap;
+ struct clk *ipg_clk;
++ spinlock_t lock; /* Protect tdms */
+ u8 tdms;
+ };
+
--- /dev/null
+From 8f157d4ff039e03e2ed4cb602eeed2fd4687a58f Mon Sep 17 00:00:00 2001
+From: Pawel Harlozinski <pawel.harlozinski@linux.intel.com>
+Date: Tue, 12 Nov 2019 14:02:36 +0100
+Subject: ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report
+
+From: Pawel Harlozinski <pawel.harlozinski@linux.intel.com>
+
+commit 8f157d4ff039e03e2ed4cb602eeed2fd4687a58f upstream.
+
+Check for existance of jack before tracing.
+NULL pointer dereference has been reported by KASAN while unloading
+machine driver (snd_soc_cnl_rt274).
+
+Signed-off-by: Pawel Harlozinski <pawel.harlozinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20191112130237.10141-1-pawel.harlozinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-jack.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/soc-jack.c
++++ b/sound/soc/soc-jack.c
+@@ -82,10 +82,9 @@ void snd_soc_jack_report(struct snd_soc_
+ unsigned int sync = 0;
+ int enable;
+
+- trace_snd_soc_jack_report(jack, mask, status);
+-
+ if (!jack)
+ return;
++ trace_snd_soc_jack_report(jack, mask, status);
+
+ dapm = &jack->card->dapm;
+
--- /dev/null
+From e7cfd867fd9842f346688f28412eb83dec342900 Mon Sep 17 00:00:00 2001
+From: Jacob Rasmussen <jacobraz@chromium.org>
+Date: Mon, 11 Nov 2019 11:59:57 -0700
+Subject: ASoC: rt5645: Fixed buddy jack support.
+
+From: Jacob Rasmussen <jacobraz@chromium.org>
+
+commit e7cfd867fd9842f346688f28412eb83dec342900 upstream.
+
+The headphone jack on buddy was broken with the following commit:
+commit 6b5da66322c5 ("ASoC: rt5645: read jd1_1 status for jd
+detection").
+This changes the jd_mode for buddy to 4 so buddy can read from the same
+register that was used in the working version of this driver without
+affecting any other devices that might use this, since no other device uses
+jd_mode = 4. To test this I plugged and uplugged the headphone jack, verifying
+audio works.
+
+Signed-off-by: Jacob Rasmussen <jacobraz@google.com>
+Reviewed-by: Ross Zwisler <zwisler@google.com>
+Link: https://lore.kernel.org/r/20191111185957.217244-1-jacobraz@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5645.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3270,6 +3270,9 @@ static void rt5645_jack_detect_work(stru
+ snd_soc_jack_report(rt5645->mic_jack,
+ report, SND_JACK_MICROPHONE);
+ return;
++ case 4:
++ val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002;
++ break;
+ default: /* read rt5645 jd1_1 status */
+ val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000;
+ break;
+@@ -3603,7 +3606,7 @@ static const struct rt5645_platform_data
+ static const struct rt5645_platform_data buddy_platform_data = {
+ .dmic1_data_pin = RT5645_DMIC_DATA_GPIO5,
+ .dmic2_data_pin = RT5645_DMIC_DATA_IN2P,
+- .jd_mode = 3,
++ .jd_mode = 4,
+ .level_trigger_irq = true,
+ };
+
+@@ -3999,6 +4002,7 @@ static int rt5645_i2c_probe(struct i2c_c
+ RT5645_JD1_MODE_1);
+ break;
+ case 3:
++ case 4:
+ regmap_update_bits(rt5645->regmap, RT5645_A_JD_CTRL1,
+ RT5645_JD1_MODE_MASK,
+ RT5645_JD1_MODE_2);
--- /dev/null
+From fe23be2d85b05f561431d75acddec726ea807d2a Mon Sep 17 00:00:00 2001
+From: Jacob Rasmussen <jacobraz@chromium.org>
+Date: Thu, 14 Nov 2019 16:20:11 -0700
+Subject: ASoC: rt5645: Fixed typo for buddy jack support.
+
+From: Jacob Rasmussen <jacobraz@chromium.org>
+
+commit fe23be2d85b05f561431d75acddec726ea807d2a upstream.
+
+Had a typo in e7cfd867fd98 that resulted in buddy jack support not being
+fixed.
+
+Fixes: e7cfd867fd98 ("ASoC: rt5645: Fixed buddy jack support.")
+Signed-off-by: Jacob Rasmussen <jacobraz@google.com>
+Reviewed-by: Ross Zwisler <zwisler@google.com>
+Cc: <jacobraz@google.com>
+CC: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20191114232011.165762-1-jacobraz@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5645.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3271,7 +3271,7 @@ static void rt5645_jack_detect_work(stru
+ report, SND_JACK_MICROPHONE);
+ return;
+ case 4:
+- val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x002;
++ val = snd_soc_component_read32(rt5645->component, RT5645_A_JD_CTRL1) & 0x0020;
+ break;
+ default: /* read rt5645 jd1_1 status */
+ val = snd_soc_component_read32(rt5645->component, RT5645_INT_IRQ_ST) & 0x1000;
--- /dev/null
+From 8962842ca5abdcf98e22ab3b2b45a103f0408b95 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@redhat.com>
+Date: Sat, 2 Nov 2019 16:02:15 +0800
+Subject: blk-mq: avoid sysfs buffer overflow with too many CPU cores
+
+From: Ming Lei <ming.lei@redhat.com>
+
+commit 8962842ca5abdcf98e22ab3b2b45a103f0408b95 upstream.
+
+It is reported that sysfs buffer overflow can be triggered if the system
+has too many CPU cores(>841 on 4K PAGE_SIZE) when showing CPUs of
+hctx via /sys/block/$DEV/mq/$N/cpu_list.
+
+Use snprintf to avoid the potential buffer overflow.
+
+This version doesn't change the attribute format, and simply stops
+showing CPU numbers if the buffer is going to overflow.
+
+Cc: stable@vger.kernel.org
+Fixes: 676141e48af7("blk-mq: don't dump CPU -> hw queue map on driver load")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq-sysfs.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -166,20 +166,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserv
+
+ static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page)
+ {
++ const size_t size = PAGE_SIZE - 1;
+ unsigned int i, first = 1;
+- ssize_t ret = 0;
++ int ret = 0, pos = 0;
+
+ for_each_cpu(i, hctx->cpumask) {
+ if (first)
+- ret += sprintf(ret + page, "%u", i);
++ ret = snprintf(pos + page, size - pos, "%u", i);
+ else
+- ret += sprintf(ret + page, ", %u", i);
++ ret = snprintf(pos + page, size - pos, ", %u", i);
++
++ if (ret >= size - pos)
++ break;
+
+ first = 0;
++ pos += ret;
+ }
+
+- ret += sprintf(ret + page, "\n");
+- return ret;
++ ret = snprintf(pos + page, size - pos, "\n");
++ return pos + ret;
+ }
+
+ static struct blk_mq_hw_ctx_sysfs_entry blk_mq_hw_sysfs_nr_tags = {
--- /dev/null
+From a713af394cf382a30dd28a1015cbe572f1b9ca75 Mon Sep 17 00:00:00 2001
+From: Aleksa Sarai <cyphar@cyphar.com>
+Date: Thu, 17 Oct 2019 02:50:01 +1100
+Subject: cgroup: pids: use atomic64_t for pids->limit
+
+From: Aleksa Sarai <cyphar@cyphar.com>
+
+commit a713af394cf382a30dd28a1015cbe572f1b9ca75 upstream.
+
+Because pids->limit can be changed concurrently (but we don't want to
+take a lock because it would be needlessly expensive), use atomic64_ts
+instead.
+
+Fixes: commit 49b786ea146f ("cgroup: implement the PIDs subsystem")
+Cc: stable@vger.kernel.org # v4.3+
+Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cgroup/pids.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/kernel/cgroup/pids.c
++++ b/kernel/cgroup/pids.c
+@@ -45,7 +45,7 @@ struct pids_cgroup {
+ * %PIDS_MAX = (%PID_MAX_LIMIT + 1).
+ */
+ atomic64_t counter;
+- int64_t limit;
++ atomic64_t limit;
+
+ /* Handle for "pids.events" */
+ struct cgroup_file events_file;
+@@ -73,8 +73,8 @@ pids_css_alloc(struct cgroup_subsys_stat
+ if (!pids)
+ return ERR_PTR(-ENOMEM);
+
+- pids->limit = PIDS_MAX;
+ atomic64_set(&pids->counter, 0);
++ atomic64_set(&pids->limit, PIDS_MAX);
+ atomic64_set(&pids->events_limit, 0);
+ return &pids->css;
+ }
+@@ -146,13 +146,14 @@ static int pids_try_charge(struct pids_c
+
+ for (p = pids; parent_pids(p); p = parent_pids(p)) {
+ int64_t new = atomic64_add_return(num, &p->counter);
++ int64_t limit = atomic64_read(&p->limit);
+
+ /*
+ * Since new is capped to the maximum number of pid_t, if
+ * p->limit is %PIDS_MAX then we know that this test will never
+ * fail.
+ */
+- if (new > p->limit)
++ if (new > limit)
+ goto revert;
+ }
+
+@@ -277,7 +278,7 @@ set_limit:
+ * Limit updates don't need to be mutex'd, since it isn't
+ * critical that any racing fork()s follow the new limit.
+ */
+- pids->limit = limit;
++ atomic64_set(&pids->limit, limit);
+ return nbytes;
+ }
+
+@@ -285,7 +286,7 @@ static int pids_max_show(struct seq_file
+ {
+ struct cgroup_subsys_state *css = seq_css(sf);
+ struct pids_cgroup *pids = css_pids(css);
+- int64_t limit = pids->limit;
++ int64_t limit = atomic64_read(&pids->limit);
+
+ if (limit >= PIDS_MAX)
+ seq_printf(sf, "%s\n", PIDS_MAX_STR);
--- /dev/null
+From edda32dabedb01f98b9d7b9a4492c13357834bbe Mon Sep 17 00:00:00 2001
+From: Yabin Cui <yabinc@google.com>
+Date: Mon, 4 Nov 2019 11:12:50 -0700
+Subject: coresight: Serialize enabling/disabling a link device.
+
+From: Yabin Cui <yabinc@google.com>
+
+commit edda32dabedb01f98b9d7b9a4492c13357834bbe upstream.
+
+When tracing etm data of multiple threads on multiple cpus through perf
+interface, some link devices are shared between paths of different cpus.
+It creates race conditions when different cpus wants to enable/disable
+the same link device at the same time.
+
+Example 1:
+Two cpus want to enable different ports of a coresight funnel, thus
+calling the funnel enable operation at the same time. But the funnel
+enable operation isn't reentrantable.
+
+Example 2:
+For an enabled coresight dynamic replicator with refcnt=1, one cpu wants
+to disable it, while another cpu wants to enable it. Ideally we still have
+an enabled replicator with refcnt=1 at the end. But in reality the result
+is uncertain.
+
+Since coresight devices claim themselves when enabled for self-hosted
+usage, the race conditions above usually make the link devices not usable
+after many cycles.
+
+To fix the race conditions, this patch uses spinlocks to serialize
+enabling/disabling link devices.
+
+Fixes: a06ae8609b3d ("coresight: add CoreSight core layer framework")
+Signed-off-by: Yabin Cui <yabinc@google.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: stable <stable@vger.kernel.org> # 5.3
+Link: https://lore.kernel.org/r/20191104181251.26732-14-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwtracing/coresight/coresight-funnel.c | 32 +++++++++++---
+ drivers/hwtracing/coresight/coresight-replicator.c | 33 ++++++++++++--
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 26 ++++++++---
+ drivers/hwtracing/coresight/coresight.c | 47 ++++++---------------
+ 4 files changed, 88 insertions(+), 50 deletions(-)
+
+--- a/drivers/hwtracing/coresight/coresight-funnel.c
++++ b/drivers/hwtracing/coresight/coresight-funnel.c
+@@ -38,12 +38,14 @@ DEFINE_CORESIGHT_DEVLIST(funnel_devs, "f
+ * @atclk: optional clock for the core parts of the funnel.
+ * @csdev: component vitals needed by the framework.
+ * @priority: port selection order.
++ * @spinlock: serialize enable/disable operations.
+ */
+ struct funnel_drvdata {
+ void __iomem *base;
+ struct clk *atclk;
+ struct coresight_device *csdev;
+ unsigned long priority;
++ spinlock_t spinlock;
+ };
+
+ static int dynamic_funnel_enable_hw(struct funnel_drvdata *drvdata, int port)
+@@ -76,11 +78,21 @@ static int funnel_enable(struct coresigh
+ {
+ int rc = 0;
+ struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
++ unsigned long flags;
++ bool first_enable = false;
+
+- if (drvdata->base)
+- rc = dynamic_funnel_enable_hw(drvdata, inport);
+-
++ spin_lock_irqsave(&drvdata->spinlock, flags);
++ if (atomic_read(&csdev->refcnt[inport]) == 0) {
++ if (drvdata->base)
++ rc = dynamic_funnel_enable_hw(drvdata, inport);
++ if (!rc)
++ first_enable = true;
++ }
+ if (!rc)
++ atomic_inc(&csdev->refcnt[inport]);
++ spin_unlock_irqrestore(&drvdata->spinlock, flags);
++
++ if (first_enable)
+ dev_dbg(&csdev->dev, "FUNNEL inport %d enabled\n", inport);
+ return rc;
+ }
+@@ -107,11 +119,19 @@ static void funnel_disable(struct coresi
+ int outport)
+ {
+ struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
++ unsigned long flags;
++ bool last_disable = false;
+
+- if (drvdata->base)
+- dynamic_funnel_disable_hw(drvdata, inport);
++ spin_lock_irqsave(&drvdata->spinlock, flags);
++ if (atomic_dec_return(&csdev->refcnt[inport]) == 0) {
++ if (drvdata->base)
++ dynamic_funnel_disable_hw(drvdata, inport);
++ last_disable = true;
++ }
++ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+- dev_dbg(&csdev->dev, "FUNNEL inport %d disabled\n", inport);
++ if (last_disable)
++ dev_dbg(&csdev->dev, "FUNNEL inport %d disabled\n", inport);
+ }
+
+ static const struct coresight_ops_link funnel_link_ops = {
+--- a/drivers/hwtracing/coresight/coresight-replicator.c
++++ b/drivers/hwtracing/coresight/coresight-replicator.c
+@@ -31,11 +31,13 @@ DEFINE_CORESIGHT_DEVLIST(replicator_devs
+ * whether this one is programmable or not.
+ * @atclk: optional clock for the core parts of the replicator.
+ * @csdev: component vitals needed by the framework
++ * @spinlock: serialize enable/disable operations.
+ */
+ struct replicator_drvdata {
+ void __iomem *base;
+ struct clk *atclk;
+ struct coresight_device *csdev;
++ spinlock_t spinlock;
+ };
+
+ static void dynamic_replicator_reset(struct replicator_drvdata *drvdata)
+@@ -97,10 +99,22 @@ static int replicator_enable(struct core
+ {
+ int rc = 0;
+ struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
++ unsigned long flags;
++ bool first_enable = false;
+
+- if (drvdata->base)
+- rc = dynamic_replicator_enable(drvdata, inport, outport);
++ spin_lock_irqsave(&drvdata->spinlock, flags);
++ if (atomic_read(&csdev->refcnt[outport]) == 0) {
++ if (drvdata->base)
++ rc = dynamic_replicator_enable(drvdata, inport,
++ outport);
++ if (!rc)
++ first_enable = true;
++ }
+ if (!rc)
++ atomic_inc(&csdev->refcnt[outport]);
++ spin_unlock_irqrestore(&drvdata->spinlock, flags);
++
++ if (first_enable)
+ dev_dbg(&csdev->dev, "REPLICATOR enabled\n");
+ return rc;
+ }
+@@ -137,10 +151,19 @@ static void replicator_disable(struct co
+ int outport)
+ {
+ struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
++ unsigned long flags;
++ bool last_disable = false;
+
+- if (drvdata->base)
+- dynamic_replicator_disable(drvdata, inport, outport);
+- dev_dbg(&csdev->dev, "REPLICATOR disabled\n");
++ spin_lock_irqsave(&drvdata->spinlock, flags);
++ if (atomic_dec_return(&csdev->refcnt[outport]) == 0) {
++ if (drvdata->base)
++ dynamic_replicator_disable(drvdata, inport, outport);
++ last_disable = true;
++ }
++ spin_unlock_irqrestore(&drvdata->spinlock, flags);
++
++ if (last_disable)
++ dev_dbg(&csdev->dev, "REPLICATOR disabled\n");
+ }
+
+ static const struct coresight_ops_link replicator_link_ops = {
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -334,9 +334,10 @@ static int tmc_disable_etf_sink(struct c
+ static int tmc_enable_etf_link(struct coresight_device *csdev,
+ int inport, int outport)
+ {
+- int ret;
++ int ret = 0;
+ unsigned long flags;
+ struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
++ bool first_enable = false;
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+ if (drvdata->reading) {
+@@ -344,12 +345,18 @@ static int tmc_enable_etf_link(struct co
+ return -EBUSY;
+ }
+
+- ret = tmc_etf_enable_hw(drvdata);
++ if (atomic_read(&csdev->refcnt[0]) == 0) {
++ ret = tmc_etf_enable_hw(drvdata);
++ if (!ret) {
++ drvdata->mode = CS_MODE_SYSFS;
++ first_enable = true;
++ }
++ }
+ if (!ret)
+- drvdata->mode = CS_MODE_SYSFS;
++ atomic_inc(&csdev->refcnt[0]);
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+- if (!ret)
++ if (first_enable)
+ dev_dbg(&csdev->dev, "TMC-ETF enabled\n");
+ return ret;
+ }
+@@ -359,6 +366,7 @@ static void tmc_disable_etf_link(struct
+ {
+ unsigned long flags;
+ struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
++ bool last_disable = false;
+
+ spin_lock_irqsave(&drvdata->spinlock, flags);
+ if (drvdata->reading) {
+@@ -366,11 +374,15 @@ static void tmc_disable_etf_link(struct
+ return;
+ }
+
+- tmc_etf_disable_hw(drvdata);
+- drvdata->mode = CS_MODE_DISABLED;
++ if (atomic_dec_return(&csdev->refcnt[0]) == 0) {
++ tmc_etf_disable_hw(drvdata);
++ drvdata->mode = CS_MODE_DISABLED;
++ last_disable = true;
++ }
+ spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+- dev_dbg(&csdev->dev, "TMC-ETF disabled\n");
++ if (last_disable)
++ dev_dbg(&csdev->dev, "TMC-ETF disabled\n");
+ }
+
+ static void *tmc_alloc_etf_buffer(struct coresight_device *csdev,
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -253,9 +253,9 @@ static int coresight_enable_link(struct
+ struct coresight_device *parent,
+ struct coresight_device *child)
+ {
+- int ret;
++ int ret = 0;
+ int link_subtype;
+- int refport, inport, outport;
++ int inport, outport;
+
+ if (!parent || !child)
+ return -EINVAL;
+@@ -264,29 +264,17 @@ static int coresight_enable_link(struct
+ outport = coresight_find_link_outport(csdev, child);
+ link_subtype = csdev->subtype.link_subtype;
+
+- if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG)
+- refport = inport;
+- else if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT)
+- refport = outport;
+- else
+- refport = 0;
+-
+- if (refport < 0)
+- return refport;
+-
+- if (atomic_inc_return(&csdev->refcnt[refport]) == 1) {
+- if (link_ops(csdev)->enable) {
+- ret = link_ops(csdev)->enable(csdev, inport, outport);
+- if (ret) {
+- atomic_dec(&csdev->refcnt[refport]);
+- return ret;
+- }
+- }
+- }
+-
+- csdev->enable = true;
++ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG && inport < 0)
++ return inport;
++ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT && outport < 0)
++ return outport;
++
++ if (link_ops(csdev)->enable)
++ ret = link_ops(csdev)->enable(csdev, inport, outport);
++ if (!ret)
++ csdev->enable = true;
+
+- return 0;
++ return ret;
+ }
+
+ static void coresight_disable_link(struct coresight_device *csdev,
+@@ -295,7 +283,7 @@ static void coresight_disable_link(struc
+ {
+ int i, nr_conns;
+ int link_subtype;
+- int refport, inport, outport;
++ int inport, outport;
+
+ if (!parent || !child)
+ return;
+@@ -305,20 +293,15 @@ static void coresight_disable_link(struc
+ link_subtype = csdev->subtype.link_subtype;
+
+ if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG) {
+- refport = inport;
+ nr_conns = csdev->pdata->nr_inport;
+ } else if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_SPLIT) {
+- refport = outport;
+ nr_conns = csdev->pdata->nr_outport;
+ } else {
+- refport = 0;
+ nr_conns = 1;
+ }
+
+- if (atomic_dec_return(&csdev->refcnt[refport]) == 0) {
+- if (link_ops(csdev)->disable)
+- link_ops(csdev)->disable(csdev, inport, outport);
+- }
++ if (link_ops(csdev)->disable)
++ link_ops(csdev)->disable(csdev, inport, outport);
+
+ for (i = 0; i < nr_conns; i++)
+ if (atomic_read(&csdev->refcnt[i]) != 0)
--- /dev/null
+From db0d32d84031188443e25edbd50a71a6e7ac5d1d Mon Sep 17 00:00:00 2001
+From: John Hubbard <jhubbard@nvidia.com>
+Date: Wed, 30 Oct 2019 22:21:59 -0700
+Subject: cpufreq: powernv: fix stack bloat and hard limit on number of CPUs
+
+From: John Hubbard <jhubbard@nvidia.com>
+
+commit db0d32d84031188443e25edbd50a71a6e7ac5d1d upstream.
+
+The following build warning occurred on powerpc 64-bit builds:
+
+drivers/cpufreq/powernv-cpufreq.c: In function 'init_chip_info':
+drivers/cpufreq/powernv-cpufreq.c:1070:1: warning: the frame size of
+1040 bytes is larger than 1024 bytes [-Wframe-larger-than=]
+
+This is with a cross-compiler based on gcc 8.1.0, which I got from:
+ https://mirrors.edge.kernel.org/pub/tools/crosstool/files/bin/x86_64/8.1.0/
+
+The warning is due to putting 1024 bytes on the stack:
+
+ unsigned int chip[256];
+
+...and it's also undesirable to have a hard limit on the number of
+CPUs here.
+
+Fix both problems by dynamically allocating based on num_possible_cpus,
+as recommended by Michael Ellerman.
+
+Fixes: 053819e0bf840 ("cpufreq: powernv: Handle throttling due to Pmax capping at chip level")
+Signed-off-by: John Hubbard <jhubbard@nvidia.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: 4.10+ <stable@vger.kernel.org> # 4.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernv-cpufreq.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -1041,9 +1041,14 @@ static struct cpufreq_driver powernv_cpu
+
+ static int init_chip_info(void)
+ {
+- unsigned int chip[256];
++ unsigned int *chip;
+ unsigned int cpu, i;
+ unsigned int prev_chip_id = UINT_MAX;
++ int ret = 0;
++
++ chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL);
++ if (!chip)
++ return -ENOMEM;
+
+ for_each_possible_cpu(cpu) {
+ unsigned int id = cpu_to_chip_id(cpu);
+@@ -1055,8 +1060,10 @@ static int init_chip_info(void)
+ }
+
+ chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL);
+- if (!chips)
+- return -ENOMEM;
++ if (!chips) {
++ ret = -ENOMEM;
++ goto free_and_return;
++ }
+
+ for (i = 0; i < nr_chips; i++) {
+ chips[i].id = chip[i];
+@@ -1066,7 +1073,9 @@ static int init_chip_info(void)
+ per_cpu(chip_info, cpu) = &chips[i];
+ }
+
+- return 0;
++free_and_return:
++ kfree(chip);
++ return ret;
+ }
+
+ static inline void clean_chip_info(void)
--- /dev/null
+From 918c1fe9fbbe46fcf56837ff21f0ef96424e8b29 Mon Sep 17 00:00:00 2001
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Wed, 23 Oct 2019 09:57:14 +0800
+Subject: cpuidle: Do not unset the driver if it is there already
+
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+
+commit 918c1fe9fbbe46fcf56837ff21f0ef96424e8b29 upstream.
+
+Fix __cpuidle_set_driver() to check if any of the CPUs in the mask has
+a driver different from drv already and, if so, return -EBUSY before
+updating any cpuidle_drivers per-CPU pointers.
+
+Fixes: 82467a5a885d ("cpuidle: simplify multiple driver support")
+Cc: 3.11+ <stable@vger.kernel.org> # 3.11+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+[ rjw: Subject & changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/driver.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/cpuidle/driver.c
++++ b/drivers/cpuidle/driver.c
+@@ -62,24 +62,23 @@ static inline void __cpuidle_unset_drive
+ * __cpuidle_set_driver - set per CPU driver variables for the given driver.
+ * @drv: a valid pointer to a struct cpuidle_driver
+ *
+- * For each CPU in the driver's cpumask, unset the registered driver per CPU
+- * to @drv.
+- *
+- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already.
++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver
++ * different from drv already.
+ */
+ static inline int __cpuidle_set_driver(struct cpuidle_driver *drv)
+ {
+ int cpu;
+
+ for_each_cpu(cpu, drv->cpumask) {
++ struct cpuidle_driver *old_drv;
+
+- if (__cpuidle_get_cpu_driver(cpu)) {
+- __cpuidle_unset_driver(drv);
++ old_drv = __cpuidle_get_cpu_driver(cpu);
++ if (old_drv && old_drv != drv)
+ return -EBUSY;
+- }
++ }
+
++ for_each_cpu(cpu, drv->cpumask)
+ per_cpu(cpuidle_drivers, cpu) = drv;
+- }
+
+ return 0;
+ }
--- /dev/null
+From e43dcf20215f0287ea113102617ca04daa76b70e Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 10 Oct 2019 23:36:15 +0200
+Subject: cpuidle: teo: Consider hits and misses metrics of disabled states
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit e43dcf20215f0287ea113102617ca04daa76b70e upstream.
+
+The TEO governor uses idle duration "bins" defined in accordance with
+the CPU idle states table provided by the driver, so that each "bin"
+covers the idle duration range between the target residency of the
+idle state corresponding to it and the target residency of the closest
+deeper idle state. The governor collects statistics for each bin
+regardless of whether or not the idle state corresponding to it is
+currently enabled.
+
+In particular, the "hits" and "misses" metrics measure the likelihood
+of a situation in which both the time till the next timer (sleep
+length) and the idle duration measured after wakeup fall into the
+given bin. Namely, if the "hits" value is greater than the "misses"
+one, that situation is more likely than the one in which the sleep
+length falls into the given bin, but the idle duration measured after
+wakeup falls into a bin corresponding to one of the shallower idle
+states.
+
+If the idle state corresponding to the given bin is disabled, it
+cannot be selected and if it turns out to be the one that should be
+selected, a shallower idle state needs to be used instead of it.
+Nevertheless, the metrics collected for the bin corresponding to it
+are still valid and need to be taken into account as though that
+state had not been disabled.
+
+For this reason, make teo_select() always use the "hits" and "misses"
+values of the idle duration range that the sleep length falls into
+even if the specific idle state corresponding to it is disabled and
+if the "hits" values is greater than the "misses" one, select the
+closest enabled shallower idle state in that case.
+
+Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/governors/teo.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+--- a/drivers/cpuidle/governors/teo.c
++++ b/drivers/cpuidle/governors/teo.c
+@@ -233,7 +233,7 @@ static int teo_select(struct cpuidle_dri
+ {
+ struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu);
+ int latency_req = cpuidle_governor_latency_req(dev->cpu);
+- unsigned int duration_us, early_hits;
++ unsigned int duration_us, hits, misses, early_hits;
+ int max_early_idx, constraint_idx, idx, i;
+ ktime_t delta_tick;
+
+@@ -247,6 +247,8 @@ static int teo_select(struct cpuidle_dri
+ cpu_data->sleep_length_ns = tick_nohz_get_sleep_length(&delta_tick);
+ duration_us = ktime_to_us(cpu_data->sleep_length_ns);
+
++ hits = 0;
++ misses = 0;
+ early_hits = 0;
+ max_early_idx = -1;
+ constraint_idx = drv->state_count;
+@@ -265,6 +267,17 @@ static int teo_select(struct cpuidle_dri
+ continue;
+
+ /*
++ * This state is disabled, so the range of idle duration
++ * values corresponding to it is covered by the current
++ * candidate state, but still the "hits" and "misses"
++ * metrics of the disabled state need to be used to
++ * decide whether or not the state covering the range in
++ * question is good enough.
++ */
++ hits = cpu_data->states[i].hits;
++ misses = cpu_data->states[i].misses;
++
++ /*
+ * If the "early hits" metric of a disabled state is
+ * greater than the current maximum, it should be taken
+ * into account, because it would be a mistake to select
+@@ -280,8 +293,11 @@ static int teo_select(struct cpuidle_dri
+ continue;
+ }
+
+- if (idx < 0)
++ if (idx < 0) {
+ idx = i; /* first enabled state */
++ hits = cpu_data->states[i].hits;
++ misses = cpu_data->states[i].misses;
++ }
+
+ if (s->target_residency > duration_us)
+ break;
+@@ -290,6 +306,8 @@ static int teo_select(struct cpuidle_dri
+ constraint_idx = i;
+
+ idx = i;
++ hits = cpu_data->states[i].hits;
++ misses = cpu_data->states[i].misses;
+
+ if (early_hits < cpu_data->states[i].early_hits &&
+ !(tick_nohz_tick_stopped() &&
+@@ -307,8 +325,7 @@ static int teo_select(struct cpuidle_dri
+ * "early hits" metric, but if that cannot be determined, just use the
+ * state selected so far.
+ */
+- if (cpu_data->states[idx].hits <= cpu_data->states[idx].misses &&
+- max_early_idx >= 0) {
++ if (hits <= misses && max_early_idx >= 0) {
+ idx = max_early_idx;
+ duration_us = drv->states[idx].target_residency;
+ }
--- /dev/null
+From 159e48560f51d9c2aa02d762a18cd24f7868ab27 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 10 Oct 2019 23:37:39 +0200
+Subject: cpuidle: teo: Fix "early hits" handling for disabled idle states
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 159e48560f51d9c2aa02d762a18cd24f7868ab27 upstream.
+
+The TEO governor uses idle duration "bins" defined in accordance with
+the CPU idle states table provided by the driver, so that each "bin"
+covers the idle duration range between the target residency of the
+idle state corresponding to it and the target residency of the closest
+deeper idle state. The governor collects statistics for each bin
+regardless of whether or not the idle state corresponding to it is
+currently enabled.
+
+In particular, the "early hits" metric measures the likelihood of a
+situation in which the idle duration measured after wakeup falls into
+to given bin, but the time till the next timer (sleep length) falls
+into a bin corresponding to one of the deeper idle states. It is
+used when the "hits" and "misses" metrics indicate that the state
+"matching" the sleep length should not be selected, so that the state
+with the maximum "early hits" value is selected instead of it.
+
+If the idle state corresponding to the given bin is disabled, it
+cannot be selected and if it turns out to be the one that should be
+selected, a shallower idle state needs to be used instead of it.
+Nevertheless, the metrics collected for the bin corresponding to it
+are still valid and need to be taken into account as though that
+state had not been disabled.
+
+As far as the "early hits" metric is concerned, teo_select() tries to
+take disabled states into account, but the state index corresponding
+to the maximum "early hits" value computed by it may be incorrect.
+Namely, it always uses the index of the previous maximum "early hits"
+state then, but there may be enabled idle states closer to the
+disabled one in question. In particular, if the current candidate
+state (whose index is the idx value) is closer to the disabled one
+and the "early hits" value of the disabled state is greater than the
+current maximum, the index of the current candidate state (idx)
+should replace the "maximum early hits state" index.
+
+Modify the code to handle that case correctly.
+
+Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems")
+Reported-by: Doug Smythies <dsmythies@telus.net>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/governors/teo.c | 35 ++++++++++++++++++++++++++---------
+ 1 file changed, 26 insertions(+), 9 deletions(-)
+
+--- a/drivers/cpuidle/governors/teo.c
++++ b/drivers/cpuidle/governors/teo.c
+@@ -277,18 +277,35 @@ static int teo_select(struct cpuidle_dri
+ hits = cpu_data->states[i].hits;
+ misses = cpu_data->states[i].misses;
+
++ if (early_hits >= cpu_data->states[i].early_hits ||
++ idx < 0)
++ continue;
++
++ /*
++ * If the current candidate state has been the one with
++ * the maximum "early hits" metric so far, the "early
++ * hits" metric of the disabled state replaces the
++ * current "early hits" count to avoid selecting a
++ * deeper state with lower "early hits" metric.
++ */
++ if (max_early_idx == idx) {
++ early_hits = cpu_data->states[i].early_hits;
++ continue;
++ }
++
+ /*
+- * If the "early hits" metric of a disabled state is
+- * greater than the current maximum, it should be taken
+- * into account, because it would be a mistake to select
+- * a deeper state with lower "early hits" metric. The
+- * index cannot be changed to point to it, however, so
+- * just increase the "early hits" count alone and let
+- * the index still point to a shallower idle state.
++ * The current candidate state is closer to the disabled
++ * one than the current maximum "early hits" state, so
++ * replace the latter with it, but in case the maximum
++ * "early hits" state index has not been set so far,
++ * check if the current candidate state is not too
++ * shallow for that role.
+ */
+- if (max_early_idx >= 0 &&
+- early_hits < cpu_data->states[i].early_hits)
++ if (!(tick_nohz_tick_stopped() &&
++ drv->states[idx].target_residency < TICK_USEC)) {
+ early_hits = cpu_data->states[i].early_hits;
++ max_early_idx = idx;
++ }
+
+ continue;
+ }
--- /dev/null
+From 069ce2ef1a6dd84cbd4d897b333e30f825e021f0 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 10 Oct 2019 23:32:17 +0200
+Subject: cpuidle: teo: Ignore disabled idle states that are too deep
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 069ce2ef1a6dd84cbd4d897b333e30f825e021f0 upstream.
+
+Prevent disabled CPU idle state with target residencies beyond the
+anticipated idle duration from being taken into account by the TEO
+governor.
+
+Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/governors/teo.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/cpuidle/governors/teo.c
++++ b/drivers/cpuidle/governors/teo.c
+@@ -258,6 +258,13 @@ static int teo_select(struct cpuidle_dri
+
+ if (s->disabled || su->disable) {
+ /*
++ * Ignore disabled states with target residencies beyond
++ * the anticipated idle duration.
++ */
++ if (s->target_residency > duration_us)
++ continue;
++
++ /*
+ * If the "early hits" metric of a disabled state is
+ * greater than the current maximum, it should be taken
+ * into account, because it would be a mistake to select
--- /dev/null
+From 4f690bb8ce4cc5d3fabe3a8e9c2401de1554cdc1 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 10 Oct 2019 23:32:59 +0200
+Subject: cpuidle: teo: Rename local variable in teo_select()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 4f690bb8ce4cc5d3fabe3a8e9c2401de1554cdc1 upstream.
+
+Rename a local variable in teo_select() in preparation for subsequent
+code modifications, no intentional impact.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/governors/teo.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/drivers/cpuidle/governors/teo.c
++++ b/drivers/cpuidle/governors/teo.c
+@@ -233,7 +233,7 @@ static int teo_select(struct cpuidle_dri
+ {
+ struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu);
+ int latency_req = cpuidle_governor_latency_req(dev->cpu);
+- unsigned int duration_us, count;
++ unsigned int duration_us, early_hits;
+ int max_early_idx, constraint_idx, idx, i;
+ ktime_t delta_tick;
+
+@@ -247,7 +247,7 @@ static int teo_select(struct cpuidle_dri
+ cpu_data->sleep_length_ns = tick_nohz_get_sleep_length(&delta_tick);
+ duration_us = ktime_to_us(cpu_data->sleep_length_ns);
+
+- count = 0;
++ early_hits = 0;
+ max_early_idx = -1;
+ constraint_idx = drv->state_count;
+ idx = -1;
+@@ -270,12 +270,12 @@ static int teo_select(struct cpuidle_dri
+ * into account, because it would be a mistake to select
+ * a deeper state with lower "early hits" metric. The
+ * index cannot be changed to point to it, however, so
+- * just increase the max count alone and let the index
+- * still point to a shallower idle state.
++ * just increase the "early hits" count alone and let
++ * the index still point to a shallower idle state.
+ */
+ if (max_early_idx >= 0 &&
+- count < cpu_data->states[i].early_hits)
+- count = cpu_data->states[i].early_hits;
++ early_hits < cpu_data->states[i].early_hits)
++ early_hits = cpu_data->states[i].early_hits;
+
+ continue;
+ }
+@@ -291,10 +291,10 @@ static int teo_select(struct cpuidle_dri
+
+ idx = i;
+
+- if (count < cpu_data->states[i].early_hits &&
++ if (early_hits < cpu_data->states[i].early_hits &&
+ !(tick_nohz_tick_stopped() &&
+ drv->states[i].target_residency < TICK_USEC)) {
+- count = cpu_data->states[i].early_hits;
++ early_hits = cpu_data->states[i].early_hits;
+ max_early_idx = i;
+ }
+ }
+@@ -323,10 +323,9 @@ static int teo_select(struct cpuidle_dri
+ if (idx < 0) {
+ idx = 0; /* No states enabled. Must use 0. */
+ } else if (idx > 0) {
++ unsigned int count = 0;
+ u64 sum = 0;
+
+- count = 0;
+-
+ /*
+ * Count and sum the most recent idle duration values less than
+ * the current expected idle duration value.
--- /dev/null
+From 36fcb4292473cb9c9ce7706d038bcf0eda5cabeb Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Fri, 6 Dec 2019 13:07:41 -0200
+Subject: cpuidle: use first valid target residency as poll time
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit 36fcb4292473cb9c9ce7706d038bcf0eda5cabeb upstream.
+
+Commit 259231a04561 ("cpuidle: add poll_limit_ns to cpuidle_device
+structure") changed, by mistake, the target residency from the first
+available sleep state to the last available sleep state (which should
+be longer).
+
+This might cause excessive polling.
+
+Fixes: 259231a04561 ("cpuidle: add poll_limit_ns to cpuidle_device structure")
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Cc: 5.4+ <stable@vger.kernel.org> # 5.4+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpuidle/cpuidle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -384,6 +384,7 @@ u64 cpuidle_poll_time(struct cpuidle_dri
+ continue;
+
+ limit_ns = (u64)drv->states[i].target_residency * NSEC_PER_USEC;
++ break;
+ }
+
+ dev->poll_limit_ns = limit_ns;
--- /dev/null
+From 0a5239985a3bc084738851afdf3fceb7d5651b0c Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Fri, 29 Nov 2019 14:59:05 +0100
+Subject: drm/panfrost: Open/close the perfcnt BO
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 0a5239985a3bc084738851afdf3fceb7d5651b0c upstream.
+
+Commit a5efb4c9a562 ("drm/panfrost: Restructure the GEM object creation")
+moved the drm_mm_insert_node_generic() call to the gem->open() hook,
+but forgot to update perfcnt accordingly.
+
+Patch the perfcnt logic to call panfrost_gem_open/close() where
+appropriate.
+
+Fixes: a5efb4c9a562 ("drm/panfrost: Restructure the GEM object creation")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Acked-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191129135908.2439529-6-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panfrost/panfrost_drv.c | 2 +-
+ drivers/gpu/drm/panfrost/panfrost_gem.c | 4 ++--
+ drivers/gpu/drm/panfrost/panfrost_gem.h | 4 ++++
+ drivers/gpu/drm/panfrost/panfrost_perfcnt.c | 23 ++++++++++++++---------
+ drivers/gpu/drm/panfrost/panfrost_perfcnt.h | 2 +-
+ 5 files changed, 22 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
++++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
+@@ -443,7 +443,7 @@ panfrost_postclose(struct drm_device *de
+ {
+ struct panfrost_file_priv *panfrost_priv = file->driver_priv;
+
+- panfrost_perfcnt_close(panfrost_priv);
++ panfrost_perfcnt_close(file);
+ panfrost_job_close(panfrost_priv);
+
+ panfrost_mmu_pgtable_free(panfrost_priv);
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c
+@@ -41,7 +41,7 @@ static void panfrost_gem_free_object(str
+ drm_gem_shmem_free_object(obj);
+ }
+
+-static int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv)
++int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv)
+ {
+ int ret;
+ size_t size = obj->size;
+@@ -80,7 +80,7 @@ static int panfrost_gem_open(struct drm_
+ return ret;
+ }
+
+-static void panfrost_gem_close(struct drm_gem_object *obj, struct drm_file *file_priv)
++void panfrost_gem_close(struct drm_gem_object *obj, struct drm_file *file_priv)
+ {
+ struct panfrost_gem_object *bo = to_panfrost_bo(obj);
+ struct panfrost_file_priv *priv = file_priv->driver_priv;
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.h
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h
+@@ -45,6 +45,10 @@ panfrost_gem_create_with_handle(struct d
+ u32 flags,
+ uint32_t *handle);
+
++int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv);
++void panfrost_gem_close(struct drm_gem_object *obj,
++ struct drm_file *file_priv);
++
+ void panfrost_gem_shrinker_init(struct drm_device *dev);
+ void panfrost_gem_shrinker_cleanup(struct drm_device *dev);
+
+--- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
++++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
+@@ -67,9 +67,10 @@ static int panfrost_perfcnt_dump_locked(
+ }
+
+ static int panfrost_perfcnt_enable_locked(struct panfrost_device *pfdev,
+- struct panfrost_file_priv *user,
++ struct drm_file *file_priv,
+ unsigned int counterset)
+ {
++ struct panfrost_file_priv *user = file_priv->driver_priv;
+ struct panfrost_perfcnt *perfcnt = pfdev->perfcnt;
+ struct drm_gem_shmem_object *bo;
+ u32 cfg;
+@@ -91,14 +92,14 @@ static int panfrost_perfcnt_enable_locke
+ perfcnt->bo = to_panfrost_bo(&bo->base);
+
+ /* Map the perfcnt buf in the address space attached to file_priv. */
+- ret = panfrost_mmu_map(perfcnt->bo);
++ ret = panfrost_gem_open(&perfcnt->bo->base.base, file_priv);
+ if (ret)
+ goto err_put_bo;
+
+ perfcnt->buf = drm_gem_shmem_vmap(&bo->base);
+ if (IS_ERR(perfcnt->buf)) {
+ ret = PTR_ERR(perfcnt->buf);
+- goto err_put_bo;
++ goto err_close_bo;
+ }
+
+ /*
+@@ -157,14 +158,17 @@ static int panfrost_perfcnt_enable_locke
+
+ err_vunmap:
+ drm_gem_shmem_vunmap(&perfcnt->bo->base.base, perfcnt->buf);
++err_close_bo:
++ panfrost_gem_close(&perfcnt->bo->base.base, file_priv);
+ err_put_bo:
+ drm_gem_object_put_unlocked(&bo->base);
+ return ret;
+ }
+
+ static int panfrost_perfcnt_disable_locked(struct panfrost_device *pfdev,
+- struct panfrost_file_priv *user)
++ struct drm_file *file_priv)
+ {
++ struct panfrost_file_priv *user = file_priv->driver_priv;
+ struct panfrost_perfcnt *perfcnt = pfdev->perfcnt;
+
+ if (user != perfcnt->user)
+@@ -180,6 +184,7 @@ static int panfrost_perfcnt_disable_lock
+ perfcnt->user = NULL;
+ drm_gem_shmem_vunmap(&perfcnt->bo->base.base, perfcnt->buf);
+ perfcnt->buf = NULL;
++ panfrost_gem_close(&perfcnt->bo->base.base, file_priv);
+ drm_gem_object_put_unlocked(&perfcnt->bo->base.base);
+ perfcnt->bo = NULL;
+ pm_runtime_mark_last_busy(pfdev->dev);
+@@ -191,7 +196,6 @@ static int panfrost_perfcnt_disable_lock
+ int panfrost_ioctl_perfcnt_enable(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
+ {
+- struct panfrost_file_priv *pfile = file_priv->driver_priv;
+ struct panfrost_device *pfdev = dev->dev_private;
+ struct panfrost_perfcnt *perfcnt = pfdev->perfcnt;
+ struct drm_panfrost_perfcnt_enable *req = data;
+@@ -207,10 +211,10 @@ int panfrost_ioctl_perfcnt_enable(struct
+
+ mutex_lock(&perfcnt->lock);
+ if (req->enable)
+- ret = panfrost_perfcnt_enable_locked(pfdev, pfile,
++ ret = panfrost_perfcnt_enable_locked(pfdev, file_priv,
+ req->counterset);
+ else
+- ret = panfrost_perfcnt_disable_locked(pfdev, pfile);
++ ret = panfrost_perfcnt_disable_locked(pfdev, file_priv);
+ mutex_unlock(&perfcnt->lock);
+
+ return ret;
+@@ -248,15 +252,16 @@ out:
+ return ret;
+ }
+
+-void panfrost_perfcnt_close(struct panfrost_file_priv *pfile)
++void panfrost_perfcnt_close(struct drm_file *file_priv)
+ {
++ struct panfrost_file_priv *pfile = file_priv->driver_priv;
+ struct panfrost_device *pfdev = pfile->pfdev;
+ struct panfrost_perfcnt *perfcnt = pfdev->perfcnt;
+
+ pm_runtime_get_sync(pfdev->dev);
+ mutex_lock(&perfcnt->lock);
+ if (perfcnt->user == pfile)
+- panfrost_perfcnt_disable_locked(pfdev, pfile);
++ panfrost_perfcnt_disable_locked(pfdev, file_priv);
+ mutex_unlock(&perfcnt->lock);
+ pm_runtime_mark_last_busy(pfdev->dev);
+ pm_runtime_put_autosuspend(pfdev->dev);
+--- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.h
++++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.h
+@@ -9,7 +9,7 @@ void panfrost_perfcnt_sample_done(struct
+ void panfrost_perfcnt_clean_cache_done(struct panfrost_device *pfdev);
+ int panfrost_perfcnt_init(struct panfrost_device *pfdev);
+ void panfrost_perfcnt_fini(struct panfrost_device *pfdev);
+-void panfrost_perfcnt_close(struct panfrost_file_priv *pfile);
++void panfrost_perfcnt_close(struct drm_file *file_priv);
+ int panfrost_ioctl_perfcnt_enable(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
+ int panfrost_ioctl_perfcnt_dump(struct drm_device *dev, void *data,
--- /dev/null
+From 926d1650176448d7684b991fbe1a5b1a8289e97c Mon Sep 17 00:00:00 2001
+From: Gao Xiang <xiang@kernel.org>
+Date: Sun, 1 Dec 2019 16:01:09 +0800
+Subject: erofs: zero out when listxattr is called with no xattr
+
+From: Gao Xiang <gaoxiang25@huawei.com>
+
+commit 926d1650176448d7684b991fbe1a5b1a8289e97c upstream.
+
+As David reported [1], ENODATA returns when attempting
+to modify files by using EROFS as an overlayfs lower layer.
+
+The root cause is that listxattr could return unexpected
+-ENODATA by mistake for inodes without xattr. That breaks
+listxattr return value convention and it can cause copy
+up failure when used with overlayfs.
+
+Resolve by zeroing out if no xattr is found for listxattr.
+
+[1] https://lore.kernel.org/r/CAEvUa7nxnby+rxK-KRMA46=exeOMApkDMAV08AjMkkPnTPV4CQ@mail.gmail.com
+Link: https://lore.kernel.org/r/20191201084040.29275-1-hsiangkao@aol.com
+Fixes: cadf1ccf1b00 ("staging: erofs: add error handling for xattr submodule")
+Cc: <stable@vger.kernel.org> # 4.19+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/erofs/xattr.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/erofs/xattr.c
++++ b/fs/erofs/xattr.c
+@@ -649,6 +649,8 @@ ssize_t erofs_listxattr(struct dentry *d
+ struct listxattr_iter it;
+
+ ret = init_inode_xattrs(d_inode(dentry));
++ if (ret == -ENOATTR)
++ return 0;
+ if (ret)
+ return ret;
+
--- /dev/null
+From 512592779a337feb5905d8fcf9498dbf33672d4a Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 20 Nov 2019 15:08:04 +0200
+Subject: intel_th: Fix a double put_device() in error path
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 512592779a337feb5905d8fcf9498dbf33672d4a upstream.
+
+Commit a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
+factored out intel_th_subdevice_alloc() from intel_th_populate(), but got
+the error path wrong, resulting in two instances of a double put_device()
+on a freshly initialized, but not 'added' device.
+
+Fix this by only doing one put_device() in the error path.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
+Reported-by: Wen Yang <wenyang@linux.alibaba.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org # v4.14+
+Link: https://lore.kernel.org/r/20191120130806.44028-2-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/core.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/core.c
++++ b/drivers/hwtracing/intel_th/core.c
+@@ -649,10 +649,8 @@ intel_th_subdevice_alloc(struct intel_th
+ }
+
+ err = intel_th_device_add_resources(thdev, res, subdev->nres);
+- if (err) {
+- put_device(&thdev->dev);
++ if (err)
+ goto fail_put_device;
+- }
+
+ if (subdev->type == INTEL_TH_OUTPUT) {
+ if (subdev->mknode)
+@@ -667,10 +665,8 @@ intel_th_subdevice_alloc(struct intel_th
+ }
+
+ err = device_add(&thdev->dev);
+- if (err) {
+- put_device(&thdev->dev);
++ if (err)
+ goto fail_free_res;
+- }
+
+ /* need switch driver to be loaded to enumerate the rest */
+ if (subdev->type == INTEL_TH_SWITCH && !req) {
--- /dev/null
+From 6a1743422a7c0fda26764a544136cac13e5ae486 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 20 Nov 2019 15:08:05 +0200
+Subject: intel_th: pci: Add Ice Lake CPU support
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 6a1743422a7c0fda26764a544136cac13e5ae486 upstream.
+
+This adds support for the Trace Hub in Ice Lake CPU.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20191120130806.44028-3-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -210,6 +210,11 @@ static const struct pci_device_id intel_
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
++ /* Ice Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8a29),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
+ /* Tiger Lake PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
--- /dev/null
+From 6e6c18bcb78c0dc0601ebe216bed12c844492d0c Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 20 Nov 2019 15:08:06 +0200
+Subject: intel_th: pci: Add Tiger Lake CPU support
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 6e6c18bcb78c0dc0601ebe216bed12c844492d0c upstream.
+
+This adds support for the Trace Hub in Tiger Lake CPU.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20191120130806.44028-4-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -215,6 +215,11 @@ static const struct pci_device_id intel_
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
++ /* Tiger Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9a33),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
+ /* Tiger Lake PCH */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa0a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
--- /dev/null
+From 775d78319f1ceb32be8eb3b1202ccdc60e9cb7f1 Mon Sep 17 00:00:00 2001
+From: David Jeffery <djeffery@redhat.com>
+Date: Mon, 16 Sep 2019 13:15:14 -0400
+Subject: md: improve handling of bio with REQ_PREFLUSH in md_flush_request()
+
+From: David Jeffery <djeffery@redhat.com>
+
+commit 775d78319f1ceb32be8eb3b1202ccdc60e9cb7f1 upstream.
+
+If pers->make_request fails in md_flush_request(), the bio is lost. To
+fix this, pass back a bool to indicate if the original make_request call
+should continue to handle the I/O and instead of assuming the flush logic
+will push it to completion.
+
+Convert md_flush_request to return a bool and no longer calls the raid
+driver's make_request function. If the return is true, then the md flush
+logic has or will complete the bio and the md make_request call is done.
+If false, then the md make_request function needs to keep processing like
+it is a normal bio. Let the original call to md_handle_request handle any
+need to retry sending the bio to the raid driver's make_request function
+should it be needed.
+
+Also mark md_flush_request and the make_request function pointer as
+__must_check to issue warnings should these critical return values be
+ignored.
+
+Fixes: 2bc13b83e629 ("md: batch flush requests.")
+Cc: stable@vger.kernel.org # # v4.19+
+Cc: NeilBrown <neilb@suse.com>
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Reviewed-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md-linear.c | 5 ++---
+ drivers/md/md-multipath.c | 5 ++---
+ drivers/md/md.c | 11 +++++++++--
+ drivers/md/md.h | 4 ++--
+ drivers/md/raid0.c | 5 ++---
+ drivers/md/raid1.c | 5 ++---
+ drivers/md/raid10.c | 5 ++---
+ drivers/md/raid5.c | 4 ++--
+ 8 files changed, 23 insertions(+), 21 deletions(-)
+
+--- a/drivers/md/md-linear.c
++++ b/drivers/md/md-linear.c
+@@ -244,10 +244,9 @@ static bool linear_make_request(struct m
+ sector_t start_sector, end_sector, data_offset;
+ sector_t bio_sector = bio->bi_iter.bi_sector;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ tmp_dev = which_dev(mddev, bio_sector);
+ start_sector = tmp_dev->end_sector - tmp_dev->rdev->sectors;
+--- a/drivers/md/md-multipath.c
++++ b/drivers/md/md-multipath.c
+@@ -104,10 +104,9 @@ static bool multipath_make_request(struc
+ struct multipath_bh * mp_bh;
+ struct multipath_info *multipath;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ mp_bh = mempool_alloc(&conf->pool, GFP_NOIO);
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -550,7 +550,13 @@ static void md_submit_flush_data(struct
+ }
+ }
+
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++/*
++ * Manages consolidation of flushes and submitting any flushes needed for
++ * a bio with REQ_PREFLUSH. Returns true if the bio is finished or is
++ * being finished in another context. Returns false if the flushing is
++ * complete but still needs the I/O portion of the bio to be processed.
++ */
++bool md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
+ ktime_t start = ktime_get_boottime();
+ spin_lock_irq(&mddev->lock);
+@@ -575,9 +581,10 @@ void md_flush_request(struct mddev *mdde
+ bio_endio(bio);
+ else {
+ bio->bi_opf &= ~REQ_PREFLUSH;
+- mddev->pers->make_request(mddev, bio);
++ return false;
+ }
+ }
++ return true;
+ }
+ EXPORT_SYMBOL(md_flush_request);
+
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -550,7 +550,7 @@ struct md_personality
+ int level;
+ struct list_head list;
+ struct module *owner;
+- bool (*make_request)(struct mddev *mddev, struct bio *bio);
++ bool __must_check (*make_request)(struct mddev *mddev, struct bio *bio);
+ /*
+ * start up works that do NOT require md_thread. tasks that
+ * requires md_thread should go into start()
+@@ -703,7 +703,7 @@ extern void md_error(struct mddev *mddev
+ extern void md_finish_reshape(struct mddev *mddev);
+
+ extern int mddev_congested(struct mddev *mddev, int bits);
+-extern void md_flush_request(struct mddev *mddev, struct bio *bio);
++extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio);
+ extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
+ sector_t sector, int size, struct page *page);
+ extern int md_super_wait(struct mddev *mddev);
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -575,10 +575,9 @@ static bool raid0_make_request(struct md
+ unsigned chunk_sects;
+ unsigned sectors;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) {
+ raid0_handle_discard(mddev, bio);
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1567,10 +1567,9 @@ static bool raid1_make_request(struct md
+ {
+ sector_t sectors;
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ /*
+ * There is a limit to the maximum size, but
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1525,10 +1525,9 @@ static bool raid10_make_request(struct m
+ int chunk_sects = chunk_mask + 1;
+ int sectors = bio_sectors(bio);
+
+- if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
+- md_flush_request(mddev, bio);
++ if (unlikely(bio->bi_opf & REQ_PREFLUSH)
++ && md_flush_request(mddev, bio))
+ return true;
+- }
+
+ if (!md_write_start(mddev, bio))
+ return false;
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5592,8 +5592,8 @@ static bool raid5_make_request(struct md
+ if (ret == 0)
+ return true;
+ if (ret == -ENODEV) {
+- md_flush_request(mddev, bi);
+- return true;
++ if (md_flush_request(mddev, bi))
++ return true;
+ }
+ /* ret == -EAGAIN, fallback */
+ /*
--- /dev/null
+From 11609a7e21f8cea42630350aa57662928fa4dc63 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 10 Oct 2019 10:13:31 -0300
+Subject: media: bdisp: fix memleak on release
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 11609a7e21f8cea42630350aa57662928fa4dc63 upstream.
+
+If a process is interrupted while accessing the video device and the
+device lock is contended, release() could return early and fail to free
+related resources.
+
+Note that the return value of the v4l2 release file operation is
+ignored.
+
+Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
+Cc: stable <stable@vger.kernel.org> # 4.2
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Fabien Dessenne <fabien.dessenne@st.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -651,8 +651,7 @@ static int bdisp_release(struct file *fi
+
+ dev_dbg(bdisp->dev, "%s\n", __func__);
+
+- if (mutex_lock_interruptible(&bdisp->lock))
+- return -ERESTARTSYS;
++ mutex_lock(&bdisp->lock);
+
+ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+
--- /dev/null
+From 806e0cdfee0b99efbb450f9f6e69deb7118602fc Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Date: Mon, 16 Sep 2019 02:47:41 -0300
+Subject: media: cec.h: CEC_OP_REC_FLAG_ values were swapped
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+commit 806e0cdfee0b99efbb450f9f6e69deb7118602fc upstream.
+
+CEC_OP_REC_FLAG_NOT_USED is 0 and CEC_OP_REC_FLAG_USED is 1, not the
+other way around.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Reported-by: Jiunn Chang <c0d1n61at3@gmail.com>
+Cc: <stable@vger.kernel.org> # for v4.10 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/linux/cec.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/uapi/linux/cec.h
++++ b/include/uapi/linux/cec.h
+@@ -768,8 +768,8 @@ struct cec_event {
+ #define CEC_MSG_SELECT_DIGITAL_SERVICE 0x93
+ #define CEC_MSG_TUNER_DEVICE_STATUS 0x07
+ /* Recording Flag Operand (rec_flag) */
+-#define CEC_OP_REC_FLAG_USED 0
+-#define CEC_OP_REC_FLAG_NOT_USED 1
++#define CEC_OP_REC_FLAG_NOT_USED 0
++#define CEC_OP_REC_FLAG_USED 1
+ /* Tuner Display Info Operand (tuner_display_info) */
+ #define CEC_OP_TUNER_DISPLAY_INFO_DIGITAL 0
+ #define CEC_OP_TUNER_DISPLAY_INFO_NONE 1
--- /dev/null
+From 658f9d9921d7e76af03f689b5f0ffde042b8bf5b Mon Sep 17 00:00:00 2001
+From: Francois Buergisser <fbuergisser@chromium.org>
+Date: Tue, 29 Oct 2019 02:24:47 +0100
+Subject: media: hantro: Fix motion vectors usage condition
+
+From: Francois Buergisser <fbuergisser@chromium.org>
+
+commit 658f9d9921d7e76af03f689b5f0ffde042b8bf5b upstream.
+
+The setting of the motion vectors usage and the setting of motion
+vectors address are currently done under different conditions.
+
+When decoding pre-recorded videos, this results of leaving the motion
+vectors address unset, resulting in faulty memory accesses. Fix it
+by using the same condition everywhere, which matches the profiles
+that support motion vectors.
+
+Fixes: dea0a82f3d22 ("media: hantro: Add support for H264 decoding on G1")
+Signed-off-by: Francois Buergisser <fbuergisser@chromium.org>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Tested-by: Boris Brezillon <boris.brezillon@collabora.com>
+Cc: <stable@vger.kernel.org> # for v5.4 and up
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_g1_h264_dec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/media/hantro/hantro_g1_h264_dec.c
++++ b/drivers/staging/media/hantro/hantro_g1_h264_dec.c
+@@ -35,7 +35,7 @@ static void set_params(struct hantro_ctx
+ if (sps->flags & V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD)
+ reg |= G1_REG_DEC_CTRL0_SEQ_MBAFF_E;
+ reg |= G1_REG_DEC_CTRL0_PICORD_COUNT_E;
+- if (dec_param->nal_ref_idc)
++ if (sps->profile_idc > 66 && dec_param->nal_ref_idc)
+ reg |= G1_REG_DEC_CTRL0_WRITE_MVS_E;
+
+ if (!(sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY) &&
+@@ -246,7 +246,7 @@ static void set_buffers(struct hantro_ct
+ vdpu_write_relaxed(vpu, dst_dma, G1_REG_ADDR_DST);
+
+ /* Higher profiles require DMV buffer appended to reference frames. */
+- if (ctrls->sps->profile_idc > 66) {
++ if (ctrls->sps->profile_idc > 66 && ctrls->decode->nal_ref_idc) {
+ size_t pic_size = ctx->h264_dec.pic_size;
+ size_t mv_offset = round_up(pic_size, 8);
+
--- /dev/null
+From 58c93a548b0248fad6437f8c8921f9b031c3892a Mon Sep 17 00:00:00 2001
+From: Francois Buergisser <fbuergisser@chromium.org>
+Date: Tue, 29 Oct 2019 02:24:48 +0100
+Subject: media: hantro: Fix picture order count table enable
+
+From: Francois Buergisser <fbuergisser@chromium.org>
+
+commit 58c93a548b0248fad6437f8c8921f9b031c3892a upstream.
+
+The picture order count table only makes sense for profiles
+higher than Baseline. This is confirmed by the H.264 specification
+(See 8.2.1 Decoding process for picture order count), which
+clarifies how POC are used for features not present in Baseline.
+
+"""
+Picture order counts are used to determine initial picture orderings
+for reference pictures in the decoding of B slices, to represent picture
+order differences between frames or fields for motion vector derivation
+in temporal direct mode, for implicit mode weighted prediction in B slices,
+and for decoder conformance checking.
+"""
+
+As a side note, this change matches various vendors downstream codebases,
+including ChromiumOS and IMX VPU libraries.
+
+Fixes: dea0a82f3d22 ("media: hantro: Add support for H264 decoding on G1")
+Signed-off-by: Francois Buergisser <fbuergisser@chromium.org>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Tested-by: Boris Brezillon <boris.brezillon@collabora.com>
+Cc: <stable@vger.kernel.org> # for v5.4 and up
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_g1_h264_dec.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/media/hantro/hantro_g1_h264_dec.c
++++ b/drivers/staging/media/hantro/hantro_g1_h264_dec.c
+@@ -34,9 +34,11 @@ static void set_params(struct hantro_ctx
+ reg = G1_REG_DEC_CTRL0_DEC_AXI_WR_ID(0x0);
+ if (sps->flags & V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD)
+ reg |= G1_REG_DEC_CTRL0_SEQ_MBAFF_E;
+- reg |= G1_REG_DEC_CTRL0_PICORD_COUNT_E;
+- if (sps->profile_idc > 66 && dec_param->nal_ref_idc)
+- reg |= G1_REG_DEC_CTRL0_WRITE_MVS_E;
++ if (sps->profile_idc > 66) {
++ reg |= G1_REG_DEC_CTRL0_PICORD_COUNT_E;
++ if (dec_param->nal_ref_idc)
++ reg |= G1_REG_DEC_CTRL0_WRITE_MVS_E;
++ }
+
+ if (!(sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY) &&
+ (sps->flags & V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD ||
--- /dev/null
+From ae02d49493b5d32bb3e035fdeb1655346f5e1ea5 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@collabora.com>
+Date: Mon, 7 Oct 2019 19:45:02 +0200
+Subject: media: hantro: Fix s_fmt for dynamic resolution changes
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+commit ae02d49493b5d32bb3e035fdeb1655346f5e1ea5 upstream.
+
+Commit 953aaa1492c53 ("media: rockchip/vpu: Prepare things to support decoders")
+changed the conditions under S_FMT was allowed for OUTPUT
+CAPTURE buffers.
+
+However, and according to the mem-to-mem stateless decoder specification,
+in order to support dynamic resolution changes, S_FMT should be allowed
+even if OUTPUT buffers have been allocated.
+
+Relax decoder S_FMT restrictions on OUTPUT buffers, allowing a
+resolution modification, provided the pixel format stays the same.
+
+Tested on RK3288 platforms using ChromiumOS Video Decode/Encode
+Accelerator Unittests.
+
+[hverkuil: fix typo: In other -> In order]
+
+Fixes: 953aaa1492c53 ("media: rockchip/vpu: Prepare things to support decoders")
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Cc: <stable@vger.kernel.org> # for v5.4 and up
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_v4l2.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/staging/media/hantro/hantro_v4l2.c
++++ b/drivers/staging/media/hantro/hantro_v4l2.c
+@@ -367,20 +367,27 @@ vidioc_s_fmt_out_mplane(struct file *fil
+ {
+ struct v4l2_pix_format_mplane *pix_mp = &f->fmt.pix_mp;
+ struct hantro_ctx *ctx = fh_to_ctx(priv);
++ struct vb2_queue *vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
+ const struct hantro_fmt *formats;
+ unsigned int num_fmts;
+- struct vb2_queue *vq;
+ int ret;
+
+- /* Change not allowed if queue is busy. */
+- vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
+- if (vb2_is_busy(vq))
+- return -EBUSY;
++ ret = vidioc_try_fmt_out_mplane(file, priv, f);
++ if (ret)
++ return ret;
+
+ if (!hantro_is_encoder_ctx(ctx)) {
+ struct vb2_queue *peer_vq;
+
+ /*
++ * In order to support dynamic resolution change,
++ * the decoder admits a resolution change, as long
++ * as the pixelformat remains. Can't be done if streaming.
++ */
++ if (vb2_is_streaming(vq) || (vb2_is_busy(vq) &&
++ pix_mp->pixelformat != ctx->src_fmt.pixelformat))
++ return -EBUSY;
++ /*
+ * Since format change on the OUTPUT queue will reset
+ * the CAPTURE queue, we can't allow doing so
+ * when the CAPTURE queue has buffers allocated.
+@@ -389,12 +396,15 @@ vidioc_s_fmt_out_mplane(struct file *fil
+ V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+ if (vb2_is_busy(peer_vq))
+ return -EBUSY;
++ } else {
++ /*
++ * The encoder doesn't admit a format change if
++ * there are OUTPUT buffers allocated.
++ */
++ if (vb2_is_busy(vq))
++ return -EBUSY;
+ }
+
+- ret = vidioc_try_fmt_out_mplane(file, priv, f);
+- if (ret)
+- return ret;
+-
+ formats = hantro_get_formats(ctx, &num_fmts);
+ ctx->vpu_src_fmt = hantro_find_format(formats, num_fmts,
+ pix_mp->pixelformat);
--- /dev/null
+From 1091eb830627625dcf79958d99353c2391f41708 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 10 Oct 2019 10:13:32 -0300
+Subject: media: radio: wl1273: fix interrupt masking on release
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 1091eb830627625dcf79958d99353c2391f41708 upstream.
+
+If a process is interrupted while accessing the radio device and the
+core lock is contended, release() could return early and fail to update
+the interrupt mask.
+
+Note that the return value of the v4l2 release file operation is
+ignored.
+
+Fixes: 87d1a50ce451 ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver")
+Cc: stable <stable@vger.kernel.org> # 2.6.38
+Cc: Matti Aaltonen <matti.j.aaltonen@nokia.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/radio/radio-wl1273.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/radio/radio-wl1273.c
++++ b/drivers/media/radio/radio-wl1273.c
+@@ -1148,8 +1148,7 @@ static int wl1273_fm_fops_release(struct
+ if (radio->rds_users > 0) {
+ radio->rds_users--;
+ if (radio->rds_users == 0) {
+- if (mutex_lock_interruptible(&core->lock))
+- return -EINTR;
++ mutex_lock(&core->lock);
+
+ radio->irq_flags &= ~WL1273_RDS_EVENT;
+
--- /dev/null
+From 3ea35d5db448c27807acbcc7a2306cf65c5e6397 Mon Sep 17 00:00:00 2001
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Date: Tue, 5 Nov 2019 18:53:17 +0100
+Subject: media: vimc: sen: remove unused kthread_sen field
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+commit 3ea35d5db448c27807acbcc7a2306cf65c5e6397 upstream.
+
+The field kthread_sen in the vimc_sen_device is
+not set and used. So remove the field and
+the code that check if it is non NULL
+
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Cc: <stable@vger.kernel.org> # for v5.4 and up
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/vimc/vimc-sensor.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/media/platform/vimc/vimc-sensor.c
++++ b/drivers/media/platform/vimc/vimc-sensor.c
+@@ -25,7 +25,6 @@ struct vimc_sen_device {
+ struct v4l2_subdev sd;
+ struct device *dev;
+ struct tpg_data tpg;
+- struct task_struct *kthread_sen;
+ u8 *frame;
+ /* The active format */
+ struct v4l2_mbus_framefmt mbus_format;
+@@ -208,10 +207,6 @@ static int vimc_sen_s_stream(struct v4l2
+ const struct vimc_pix_map *vpix;
+ unsigned int frame_size;
+
+- if (vsen->kthread_sen)
+- /* tpg is already executing */
+- return 0;
+-
+ /* Calculate the frame size */
+ vpix = vimc_pix_map_by_code(vsen->mbus_format.code);
+ frame_size = vsen->mbus_format.width * vpix->bpp *
--- /dev/null
+From f6498b922e57aecbe3b7fa30a308d9d586c0c369 Mon Sep 17 00:00:00 2001
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+Date: Thu, 7 Nov 2019 11:30:37 +0100
+Subject: mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+commit f6498b922e57aecbe3b7fa30a308d9d586c0c369 upstream.
+
+Pandora_wl1251_init_card was used to do special pdata based
+setup of the sdio mmc interface. This does no longer work with
+v4.7 and later. A fix requires a device tree based mmc3 setup.
+
+Therefore we move the special setup to omap_hsmmc.c instead
+of calling some pdata supplied init_card function.
+
+The new code checks for a DT child node compatible to wl1251
+so it will not affect other MMC3 use cases.
+
+Generally, this code was and still is a hack and should be
+moved to mmc core to e.g. read such properties from optional
+DT child nodes.
+
+Fixes: 81eef6ca9201 ("mmc: omap_hsmmc: Use dma_request_chan() for requesting DMA channel")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.7+
+[Ulf: Fixed up some checkpatch complaints]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/omap_hsmmc.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1512,6 +1512,36 @@ static void omap_hsmmc_init_card(struct
+
+ if (mmc_pdata(host)->init_card)
+ mmc_pdata(host)->init_card(card);
++ else if (card->type == MMC_TYPE_SDIO ||
++ card->type == MMC_TYPE_SD_COMBO) {
++ struct device_node *np = mmc_dev(mmc)->of_node;
++
++ /*
++ * REVISIT: should be moved to sdio core and made more
++ * general e.g. by expanding the DT bindings of child nodes
++ * to provide a mechanism to provide this information:
++ * Documentation/devicetree/bindings/mmc/mmc-card.txt
++ */
++
++ np = of_get_compatible_child(np, "ti,wl1251");
++ if (np) {
++ /*
++ * We have TI wl1251 attached to MMC3. Pass this
++ * information to the SDIO core because it can't be
++ * probed by normal methods.
++ */
++
++ dev_info(host->dev, "found wl1251\n");
++ card->quirks |= MMC_QUIRK_NONSTD_SDIO;
++ card->cccr.wide_bus = 1;
++ card->cis.vendor = 0x104c;
++ card->cis.device = 0x9066;
++ card->cis.blksize = 512;
++ card->cis.max_dtr = 24000000;
++ card->ocr = 0x80;
++ of_node_put(np);
++ }
++ }
+ }
+
+ static void omap_hsmmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
--- /dev/null
+From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001
+From: Leo Yan <leo.yan@linaro.org>
+Date: Thu, 7 Nov 2019 10:02:44 +0800
+Subject: perf tests: Fix out of bounds memory access
+
+From: Leo Yan <leo.yan@linaro.org>
+
+commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream.
+
+The test case 'Read backward ring buffer' failed on 32-bit architectures
+which were found by LKFT perf testing. The test failed on arm32 x15
+device, qemu_arm32, qemu_i386, and found intermittent failure on i386;
+the failure log is as below:
+
+ 50: Read backward ring buffer :
+ --- start ---
+ test child forked, pid 510
+ Using CPUID GenuineIntel-6-9E-9
+ mmap size 1052672B
+ mmap size 8192B
+ Finished reading overwrite ring buffer: rewind
+ free(): invalid next size (fast)
+ test child interrupted
+ ---- end ----
+ Read backward ring buffer: FAILED!
+
+The log hints there have issue for memory usage, thus free() reports
+error 'invalid next size' and directly exit for the case. Finally, this
+issue is root caused as out of bounds memory access for the data array
+'evsel->id'.
+
+The backward ring buffer test invokes do_test() twice. 'evsel->id' is
+allocated at the first call with the flow:
+
+ test__backward_ring_buffer()
+ `-> do_test()
+ `-> evlist__mmap()
+ `-> evlist__mmap_ex()
+ `-> perf_evsel__alloc_id()
+
+So 'evsel->id' is allocated with one item, and it will be used in
+function perf_evlist__id_add():
+
+ evsel->id[0] = id
+ evsel->ids = 1
+
+At the second call for do_test(), it skips to initialize 'evsel->id'
+and reuses the array which is allocated in the first call. But
+'evsel->ids' contains the stale value. Thus:
+
+ evsel->id[1] = id -> out of bound access
+ evsel->ids = 2
+
+To fix this issue, we will use evlist__open() and evlist__close() pair
+functions to prepare and cleanup context for evlist; so 'evsel->id' and
+'evsel->ids' can be initialized properly when invoke do_test() and avoid
+the out of bounds memory access.
+
+Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: stable@vger.kernel.org # v4.10+
+Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/tests/backward-ring-buffer.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/tools/perf/tests/backward-ring-buffer.c
++++ b/tools/perf/tests/backward-ring-buffer.c
+@@ -147,6 +147,15 @@ int test__backward_ring_buffer(struct te
+ goto out_delete_evlist;
+ }
+
++ evlist__close(evlist);
++
++ err = evlist__open(evlist);
++ if (err < 0) {
++ pr_debug("perf_evlist__open: %s\n",
++ str_error_r(errno, sbuf, sizeof(sbuf)));
++ goto out_delete_evlist;
++ }
++
+ err = do_test(evlist, 1, &sample_count, &comm_count);
+ if (err != TEST_OK)
+ goto out_delete_evlist;
--- /dev/null
+From 04fb02757ae5188031eb71b2f6f189edb1caf5dc Mon Sep 17 00:00:00 2001
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+Date: Fri, 15 Nov 2019 16:57:52 +0100
+Subject: pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type()
+
+From: Gregory CLEMENT <gregory.clement@bootlin.com>
+
+commit 04fb02757ae5188031eb71b2f6f189edb1caf5dc upstream.
+
+As explained in the following commit a9a1a4833613 ("pinctrl:
+armada-37xx: Fix gpio interrupt setup") the armada_37xx_irq_set_type()
+function can be called before the initialization of the mask field.
+
+That means that we can't use this field in this function and need to
+workaround it using hwirq.
+
+Fixes: 30ac0d3b0702 ("pinctrl: armada-37xx: Add edge both type gpio irq support")
+Cc: stable@vger.kernel.org
+Reported-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Link: https://lore.kernel.org/r/20191115155752.2562-1-gregory.clement@bootlin.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -595,10 +595,10 @@ static int armada_37xx_irq_set_type(stru
+ regmap_read(info->regmap, in_reg, &in_val);
+
+ /* Set initial polarity based on current input level. */
+- if (in_val & d->mask)
+- val |= d->mask; /* falling */
++ if (in_val & BIT(d->hwirq % GPIO_PER_REG))
++ val |= BIT(d->hwirq % GPIO_PER_REG); /* falling */
+ else
+- val &= ~d->mask; /* rising */
++ val &= ~(BIT(d->hwirq % GPIO_PER_REG)); /* rising */
+ break;
+ }
+ default:
--- /dev/null
+From 930d3a4907ae6cdb476db23fc7caa86e9de1e557 Mon Sep 17 00:00:00 2001
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Mon, 30 Sep 2019 09:58:04 -0500
+Subject: pinctrl: rza2: Fix gpio name typos
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+commit 930d3a4907ae6cdb476db23fc7caa86e9de1e557 upstream.
+
+Fix apparent copy/paste errors that were overlooked in the original driver.
+ "P0_4" -> "PF_4"
+ "P0_3" -> "PG_3"
+
+Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Link: https://lore.kernel.org/r/20190930145804.30497-1-chris.brandt@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/pinctrl-rza2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-rza2.c
++++ b/drivers/pinctrl/pinctrl-rza2.c
+@@ -213,8 +213,8 @@ static const char * const rza2_gpio_name
+ "PC_0", "PC_1", "PC_2", "PC_3", "PC_4", "PC_5", "PC_6", "PC_7",
+ "PD_0", "PD_1", "PD_2", "PD_3", "PD_4", "PD_5", "PD_6", "PD_7",
+ "PE_0", "PE_1", "PE_2", "PE_3", "PE_4", "PE_5", "PE_6", "PE_7",
+- "PF_0", "PF_1", "PF_2", "PF_3", "P0_4", "PF_5", "PF_6", "PF_7",
+- "PG_0", "PG_1", "PG_2", "P0_3", "PG_4", "PG_5", "PG_6", "PG_7",
++ "PF_0", "PF_1", "PF_2", "PF_3", "PF_4", "PF_5", "PF_6", "PF_7",
++ "PG_0", "PG_1", "PG_2", "PG_3", "PG_4", "PG_5", "PG_6", "PG_7",
+ "PH_0", "PH_1", "PH_2", "PH_3", "PH_4", "PH_5", "PH_6", "PH_7",
+ /* port I does not exist */
+ "PJ_0", "PJ_1", "PJ_2", "PJ_3", "PJ_4", "PJ_5", "PJ_6", "PJ_7",
--- /dev/null
+From 3d2557ab75d4c568c79eefa2e550e0d80348a6bd Mon Sep 17 00:00:00 2001
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+Date: Sun, 4 Aug 2019 21:32:00 +0530
+Subject: pinctrl: samsung: Add of_node_put() before return in error path
+
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+
+commit 3d2557ab75d4c568c79eefa2e550e0d80348a6bd upstream.
+
+Each iteration of for_each_child_of_node puts the previous node, but in
+the case of a return from the middle of the loop, there is no put, thus
+causing a memory leak. Hence add an of_node_put before the return of
+exynos_eint_wkup_init() error path.
+Issue found with Coccinelle.
+
+Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
+Cc: <stable@vger.kernel.org>
+Fixes: 14c255d35b25 ("pinctrl: exynos: Add irq_chip instance for Exynos7 wakeup interrupts")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-exynos.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -486,8 +486,10 @@ int exynos_eint_wkup_init(struct samsung
+ if (match) {
+ irq_chip = kmemdup(match->data,
+ sizeof(*irq_chip), GFP_KERNEL);
+- if (!irq_chip)
++ if (!irq_chip) {
++ of_node_put(np);
+ return -ENOMEM;
++ }
+ wkup_np = np;
+ break;
+ }
--- /dev/null
+From 5c7f48dd14e892e3e920dd6bbbd52df79e1b3b41 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 5 Aug 2019 18:27:07 +0200
+Subject: pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 5c7f48dd14e892e3e920dd6bbbd52df79e1b3b41 upstream.
+
+In exynos_eint_wkup_init() the for_each_child_of_node() loop is used
+with a break to find a matching child node. Although each iteration of
+for_each_child_of_node puts the previous node, but early exit from loop
+misses it. This leads to leak of device node.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 43b169db1841 ("pinctrl: add exynos4210 specific extensions for samsung pinctrl driver")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-exynos.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -506,6 +506,7 @@ int exynos_eint_wkup_init(struct samsung
+ bank->nr_pins, &exynos_eint_irqd_ops, bank);
+ if (!bank->irq_domain) {
+ dev_err(dev, "wkup irq domain add failed\n");
++ of_node_put(wkup_np);
+ return -ENXIO;
+ }
+
+@@ -520,8 +521,10 @@ int exynos_eint_wkup_init(struct samsung
+ weint_data = devm_kcalloc(dev,
+ bank->nr_pins, sizeof(*weint_data),
+ GFP_KERNEL);
+- if (!weint_data)
++ if (!weint_data) {
++ of_node_put(wkup_np);
+ return -ENOMEM;
++ }
+
+ for (idx = 0; idx < bank->nr_pins; ++idx) {
+ irq = irq_of_parse_and_map(bank->of_node, idx);
+@@ -538,10 +541,13 @@ int exynos_eint_wkup_init(struct samsung
+ }
+ }
+
+- if (!muxed_banks)
++ if (!muxed_banks) {
++ of_node_put(wkup_np);
+ return 0;
++ }
+
+ irq = irq_of_parse_and_map(wkup_np, 0);
++ of_node_put(wkup_np);
+ if (!irq) {
+ dev_err(dev, "irq number for muxed EINTs not found\n");
+ return 0;
--- /dev/null
+From a322b3377f4bac32aa25fb1acb9e7afbbbbd0137 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 5 Aug 2019 18:27:10 +0200
+Subject: pinctrl: samsung: Fix device node refcount leaks in init code
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit a322b3377f4bac32aa25fb1acb9e7afbbbbd0137 upstream.
+
+Several functions use for_each_child_of_node() loop with a break to find
+a matching child node. Although each iteration of
+for_each_child_of_node puts the previous node, but early exit from loop
+misses it. This leads to leak of device node.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 9a2c1c3b91aa ("pinctrl: samsung: Allow grouping multiple pinmux/pinconf nodes")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-samsung.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
+@@ -272,6 +272,7 @@ static int samsung_dt_node_to_map(struct
+ &reserved_maps, num_maps);
+ if (ret < 0) {
+ samsung_dt_free_map(pctldev, *map, *num_maps);
++ of_node_put(np);
+ return ret;
+ }
+ }
+@@ -785,8 +786,10 @@ static struct samsung_pmx_func *samsung_
+ if (!of_get_child_count(cfg_np)) {
+ ret = samsung_pinctrl_create_function(dev, drvdata,
+ cfg_np, func);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(cfg_np);
+ return ERR_PTR(ret);
++ }
+ if (ret > 0) {
+ ++func;
+ ++func_cnt;
+@@ -797,8 +800,11 @@ static struct samsung_pmx_func *samsung_
+ for_each_child_of_node(cfg_np, func_np) {
+ ret = samsung_pinctrl_create_function(dev, drvdata,
+ func_np, func);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(func_np);
++ of_node_put(cfg_np);
+ return ERR_PTR(ret);
++ }
+ if (ret > 0) {
+ ++func;
+ ++func_cnt;
--- /dev/null
+From 6fbbcb050802d6ea109f387e961b1dbcc3a80c96 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 5 Aug 2019 18:27:08 +0200
+Subject: pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 6fbbcb050802d6ea109f387e961b1dbcc3a80c96 upstream.
+
+In s3c24xx_eint_init() the for_each_child_of_node() loop is used with a
+break to find a matching child node. Although each iteration of
+for_each_child_of_node puts the previous node, but early exit from loop
+misses it. This leads to leak of device node.
+
+Cc: <stable@vger.kernel.org>
+Fixes: af99a7507469 ("pinctrl: Add pinctrl-s3c24xx driver")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-s3c24xx.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c
+@@ -490,8 +490,10 @@ static int s3c24xx_eint_init(struct sams
+ return -ENODEV;
+
+ eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL);
+- if (!eint_data)
++ if (!eint_data) {
++ of_node_put(eint_np);
+ return -ENOMEM;
++ }
+
+ eint_data->drvdata = d;
+
+@@ -503,12 +505,14 @@ static int s3c24xx_eint_init(struct sams
+ irq = irq_of_parse_and_map(eint_np, i);
+ if (!irq) {
+ dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i);
++ of_node_put(eint_np);
+ return -ENXIO;
+ }
+
+ eint_data->parents[i] = irq;
+ irq_set_chained_handler_and_data(irq, handlers[i], eint_data);
+ }
++ of_node_put(eint_np);
+
+ bank = d->pin_banks;
+ for (i = 0; i < d->nr_banks; ++i, ++bank) {
--- /dev/null
+From 7f028caadf6c37580d0f59c6c094ed09afc04062 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 5 Aug 2019 18:27:09 +0200
+Subject: pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 7f028caadf6c37580d0f59c6c094ed09afc04062 upstream.
+
+In s3c64xx_eint_eint0_init() the for_each_child_of_node() loop is used
+with a break to find a matching child node. Although each iteration of
+for_each_child_of_node puts the previous node, but early exit from loop
+misses it. This leads to leak of device node.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 61dd72613177 ("pinctrl: Add pinctrl-s3c64xx driver")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-s3c64xx.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c
+@@ -704,8 +704,10 @@ static int s3c64xx_eint_eint0_init(struc
+ return -ENODEV;
+
+ data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL);
+- if (!data)
++ if (!data) {
++ of_node_put(eint0_np);
+ return -ENOMEM;
++ }
+ data->drvdata = d;
+
+ for (i = 0; i < NUM_EINT0_IRQ; ++i) {
+@@ -714,6 +716,7 @@ static int s3c64xx_eint_eint0_init(struc
+ irq = irq_of_parse_and_map(eint0_np, i);
+ if (!irq) {
+ dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i);
++ of_node_put(eint0_np);
+ return -ENXIO;
+ }
+
+@@ -721,6 +724,7 @@ static int s3c64xx_eint_eint0_init(struc
+ s3c64xx_eint0_handlers[i],
+ data);
+ }
++ of_node_put(eint0_np);
+
+ bank = d->pin_banks;
+ for (i = 0; i < d->nr_banks; ++i, ++bank) {
--- /dev/null
+From 2abb0d5268ae7b5ddf82099b1f8d5aa8414637d4 Mon Sep 17 00:00:00 2001
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Tue, 24 Sep 2019 10:52:23 +0300
+Subject: PM / devfreq: Lock devfreq in trans_stat_show
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+commit 2abb0d5268ae7b5ddf82099b1f8d5aa8414637d4 upstream.
+
+There is no locking in this sysfs show function so stats printing can
+race with a devfreq_update_status called as part of freq switching or
+with initialization.
+
+Also add an assert in devfreq_update_status to make it clear that lock
+must be held by caller.
+
+Fixes: 39688ce6facd ("PM / devfreq: account suspend/resume for stats")
+Cc: stable@vger.kernel.org
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/devfreq/devfreq.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -160,6 +160,7 @@ int devfreq_update_status(struct devfreq
+ int lev, prev_lev, ret = 0;
+ unsigned long cur_time;
+
++ lockdep_assert_held(&devfreq->lock);
+ cur_time = jiffies;
+
+ /* Immediately exit if previous_freq is not initialized yet. */
+@@ -1397,12 +1398,17 @@ static ssize_t trans_stat_show(struct de
+ int i, j;
+ unsigned int max_state = devfreq->profile->max_state;
+
+- if (!devfreq->stop_polling &&
+- devfreq_update_status(devfreq, devfreq->previous_freq))
+- return 0;
+ if (max_state == 0)
+ return sprintf(buf, "Not Supported.\n");
+
++ mutex_lock(&devfreq->lock);
++ if (!devfreq->stop_polling &&
++ devfreq_update_status(devfreq, devfreq->previous_freq)) {
++ mutex_unlock(&devfreq->lock);
++ return 0;
++ }
++ mutex_unlock(&devfreq->lock);
++
+ len = sprintf(buf, " From : To\n");
+ len += sprintf(buf + len, " :");
+ for (i = 0; i < max_state; i++)
--- /dev/null
+From 249fad734a25889a4f23ed014d43634af6798063 Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Mon, 18 Nov 2019 09:14:52 +0530
+Subject: powerpc/perf: Disable trace_imc pmu
+
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+
+commit 249fad734a25889a4f23ed014d43634af6798063 upstream.
+
+When a root user or a user with CAP_SYS_ADMIN privilege uses any
+trace_imc performance monitoring unit events, to monitor application
+or KVM threads, it may result in a checkstop (System crash).
+
+The cause is frequent switching of the "trace/accumulation" mode of
+the In-Memory Collection hardware (LDBAR).
+
+This patch disables the trace_imc PMU unit entirely to avoid
+triggering the checkstop. A future patch will reenable it at a later
+stage once a workaround has been developed.
+
+Fixes: 012ae244845f ("powerpc/perf: Trace imc PMU functions")
+Cc: stable@vger.kernel.org # v5.2+
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Tested-by: Hariharan T.S. <hari@linux.ibm.com>
+[mpe: Add pr_info_once() so dmesg shows the PMU has been disabled]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191118034452.9939-1-maddy@linux.vnet.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/powernv/opal-imc.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -285,7 +285,14 @@ static int opal_imc_counters_probe(struc
+ domain = IMC_DOMAIN_THREAD;
+ break;
+ case IMC_TYPE_TRACE:
+- domain = IMC_DOMAIN_TRACE;
++ /*
++ * FIXME. Using trace_imc events to monitor application
++ * or KVM thread performance can cause a checkstop
++ * (system crash).
++ * Disable it for now.
++ */
++ pr_info_once("IMC: disabling trace_imc PMU\n");
++ domain = -1;
+ break;
+ default:
+ pr_warn("IMC Unknown Device type \n");
--- /dev/null
+From 998174042da229e2cf5841f574aba4a743e69650 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 8 Nov 2019 21:34:30 +0100
+Subject: ppdev: fix PPGETTIME/PPSETTIME ioctls
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 998174042da229e2cf5841f574aba4a743e69650 upstream.
+
+Going through the uses of timeval in the user space API,
+I noticed two bugs in ppdev that were introduced in the y2038
+conversion:
+
+* The range check was accidentally moved from ppsettime to
+ ppgettime
+
+* On sparc64, the microseconds are in the other half of the
+ 64-bit word.
+
+Fix both, and mark the fix for stable backports.
+
+Cc: stable@vger.kernel.org
+Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20191108203435.112759-8-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/ppdev.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/char/ppdev.c
++++ b/drivers/char/ppdev.c
+@@ -619,20 +619,27 @@ static int pp_do_ioctl(struct file *file
+ if (copy_from_user(time32, argp, sizeof(time32)))
+ return -EFAULT;
+
++ if ((time32[0] < 0) || (time32[1] < 0))
++ return -EINVAL;
++
+ return pp_set_timeout(pp->pdev, time32[0], time32[1]);
+
+ case PPSETTIME64:
+ if (copy_from_user(time64, argp, sizeof(time64)))
+ return -EFAULT;
+
++ if ((time64[0] < 0) || (time64[1] < 0))
++ return -EINVAL;
++
++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
++ time64[1] >>= 32;
++
+ return pp_set_timeout(pp->pdev, time64[0], time64[1]);
+
+ case PPGETTIME32:
+ jiffies_to_timespec64(pp->pdev->timeout, &ts);
+ time32[0] = ts.tv_sec;
+ time32[1] = ts.tv_nsec / NSEC_PER_USEC;
+- if ((time32[0] < 0) || (time32[1] < 0))
+- return -EINVAL;
+
+ if (copy_to_user(argp, time32, sizeof(time32)))
+ return -EFAULT;
+@@ -643,8 +650,9 @@ static int pp_do_ioctl(struct file *file
+ jiffies_to_timespec64(pp->pdev->timeout, &ts);
+ time64[0] = ts.tv_sec;
+ time64[1] = ts.tv_nsec / NSEC_PER_USEC;
+- if ((time64[0] < 0) || (time64[1] < 0))
+- return -EINVAL;
++
++ if (IS_ENABLED(CONFIG_SPARC64) && !in_compat_syscall())
++ time64[1] <<= 32;
+
+ if (copy_to_user(argp, time64, sizeof(time64)))
+ return -EFAULT;
--- /dev/null
+From ecdfdfdbe4d4c74029f2b416b7ee6d0aeb56364a Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 25 Oct 2019 15:58:27 -0700
+Subject: RDMA/core: Fix ib_dma_max_seg_size()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit ecdfdfdbe4d4c74029f2b416b7ee6d0aeb56364a upstream.
+
+If dev->dma_device->params == NULL then the maximum DMA segment size is 64
+KB. See also the dma_get_max_seg_size() implementation. This patch fixes
+the following kernel warning:
+
+ DMA-API: infiniband rxe0: mapping sg segment longer than device claims to support [len=126976] [max=65536]
+ WARNING: CPU: 4 PID: 4848 at kernel/dma/debug.c:1220 debug_dma_map_sg+0x3d9/0x450
+ RIP: 0010:debug_dma_map_sg+0x3d9/0x450
+ Call Trace:
+ srp_queuecommand+0x626/0x18d0 [ib_srp]
+ scsi_queue_rq+0xd02/0x13e0 [scsi_mod]
+ __blk_mq_try_issue_directly+0x2b3/0x3f0
+ blk_mq_request_issue_directly+0xac/0xf0
+ blk_insert_cloned_request+0xdf/0x170
+ dm_mq_queue_rq+0x43d/0x830 [dm_mod]
+ __blk_mq_try_issue_directly+0x2b3/0x3f0
+ blk_mq_request_issue_directly+0xac/0xf0
+ blk_mq_try_issue_list_directly+0xb8/0x170
+ blk_mq_sched_insert_requests+0x23c/0x3b0
+ blk_mq_flush_plug_list+0x529/0x730
+ blk_flush_plug_list+0x21f/0x260
+ blk_mq_make_request+0x56b/0xf20
+ generic_make_request+0x196/0x660
+ submit_bio+0xae/0x290
+ blkdev_direct_IO+0x822/0x900
+ generic_file_direct_write+0x110/0x200
+ __generic_file_write_iter+0x124/0x2a0
+ blkdev_write_iter+0x168/0x270
+ aio_write+0x1c4/0x310
+ io_submit_one+0x971/0x1390
+ __x64_sys_io_submit+0x12a/0x390
+ do_syscall_64+0x6f/0x2e0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Link: https://lore.kernel.org/r/20191025225830.257535-2-bvanassche@acm.org
+Cc: <stable@vger.kernel.org>
+Fixes: 0b5cb3300ae5 ("RDMA/srp: Increase max_segment_size")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/rdma/ib_verbs.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -4043,9 +4043,7 @@ static inline void ib_dma_unmap_sg_attrs
+ */
+ static inline unsigned int ib_dma_max_seg_size(struct ib_device *dev)
+ {
+- struct device_dma_parameters *p = dev->dma_device->dma_parms;
+-
+- return p ? p->max_segment_size : UINT_MAX;
++ return dma_get_max_seg_size(dev->dma_device);
+ }
+
+ /**
--- /dev/null
+From ab874f22d35a8058d8fdee5f13eb69d8867efeae Mon Sep 17 00:00:00 2001
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Date: Wed, 11 Sep 2019 19:42:23 +0200
+Subject: s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported
+
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+
+commit ab874f22d35a8058d8fdee5f13eb69d8867efeae upstream.
+
+On older HW or under a hypervisor, w/o the instruction-execution-
+protection (IEP) facility, and also w/o EDAT-1, a translation-specification
+exception may be recognized when bit 55 of a pte is one (_PAGE_NOEXEC).
+
+The current code tries to prevent setting _PAGE_NOEXEC in such cases,
+by removing it within set_pte_at(). However, ptep_set_access_flags()
+will modify a pte directly, w/o using set_pte_at(). There is at least
+one scenario where this can result in an active pte with _PAGE_NOEXEC
+set, which would then lead to a panic due to a translation-specification
+exception (write to swapped out page):
+
+do_swap_page
+ pte = mk_pte (with _PAGE_NOEXEC bit)
+ set_pte_at (will remove _PAGE_NOEXEC bit in page table, but keep it
+ in local variable pte)
+ vmf->orig_pte = pte (pte still contains _PAGE_NOEXEC bit)
+ do_wp_page
+ wp_page_reuse
+ entry = vmf->orig_pte (still with _PAGE_NOEXEC bit)
+ ptep_set_access_flags (writes entry with _PAGE_NOEXEC bit)
+
+Fix this by clearing _PAGE_NOEXEC already in mk_pte_phys(), where the
+pgprot value is applied, so that no pte with _PAGE_NOEXEC will ever be
+visible, if it is not supported. The check in set_pte_at() can then also
+be removed.
+
+Cc: <stable@vger.kernel.org> # 4.11+
+Fixes: 57d7f939e7bd ("s390: add no-execute support")
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/include/asm/pgtable.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -1173,8 +1173,6 @@ void gmap_pmdp_idte_global(struct mm_str
+ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
+ pte_t *ptep, pte_t entry)
+ {
+- if (!MACHINE_HAS_NX)
+- pte_val(entry) &= ~_PAGE_NOEXEC;
+ if (pte_present(entry))
+ pte_val(entry) &= ~_PAGE_UNUSED;
+ if (mm_has_pgste(mm))
+@@ -1191,6 +1189,8 @@ static inline pte_t mk_pte_phys(unsigned
+ {
+ pte_t __pte;
+ pte_val(__pte) = physpage + pgprot_val(pgprot);
++ if (!MACHINE_HAS_NX)
++ pte_val(__pte) &= ~_PAGE_NOEXEC;
+ return pte_mkyoung(__pte);
+ }
+
dm-zoned-reduce-overhead-of-backing-device-checks.patch
workqueue-fix-spurious-sanity-check-failures-in-destroy_workqueue.patch
workqueue-fix-pwq-ref-leak-in-rescuer_thread.patch
+asoc-rt5645-fixed-buddy-jack-support.patch
+asoc-rt5645-fixed-typo-for-buddy-jack-support.patch
+asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch
+asoc-fsl_audmix-add-spin-lock-to-protect-tdms.patch
+md-improve-handling-of-bio-with-req_preflush-in-md_flush_request.patch
+blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch
+cgroup-pids-use-atomic64_t-for-pids-limit.patch
+wil6210-check-len-before-memcpy-calls.patch
+ar5523-check-null-before-memcpy-in-ar5523_cmd.patch
+s390-mm-properly-clear-_page_noexec-bit-when-it-is-not-supported.patch
+media-hantro-fix-s_fmt-for-dynamic-resolution-changes.patch
+media-hantro-fix-motion-vectors-usage-condition.patch
+media-hantro-fix-picture-order-count-table-enable.patch
+media-vimc-sen-remove-unused-kthread_sen-field.patch
+media-bdisp-fix-memleak-on-release.patch
+media-radio-wl1273-fix-interrupt-masking-on-release.patch
+media-cec.h-cec_op_rec_flag_-values-were-swapped.patch
+cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch
+cpuidle-teo-ignore-disabled-idle-states-that-are-too-deep.patch
+cpuidle-teo-rename-local-variable-in-teo_select.patch
+cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch
+cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch
+cpuidle-use-first-valid-target-residency-as-poll-time.patch
+erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch
+perf-tests-fix-out-of-bounds-memory-access.patch
+drm-panfrost-open-close-the-perfcnt-bo.patch
+powerpc-perf-disable-trace_imc-pmu.patch
+intel_th-fix-a-double-put_device-in-error-path.patch
+intel_th-pci-add-ice-lake-cpu-support.patch
+intel_th-pci-add-tiger-lake-cpu-support.patch
+pm-devfreq-lock-devfreq-in-trans_stat_show.patch
+cpufreq-powernv-fix-stack-bloat-and-hard-limit-on-number-of-cpus.patch
+alsa-fireface-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch
+alsa-oxfw-fix-return-value-in-error-path-of-isochronous-resources-reservation.patch
+alsa-hda-realtek-line-out-jack-doesn-t-work-on-a-dell-aio.patch
+acpi-utils-move-acpi_dev_get_first_match_dev-under-config_acpi.patch
+acpi-lpss-add-lnxvideo-byt-i2c7-to-lpss_device_links.patch
+acpi-lpss-add-lnxvideo-byt-i2c1-to-lpss_device_links.patch
+acpi-lpss-add-dmi-quirk-for-skipping-_dep-check-for-some-device-links.patch
+acpi-hotplug-pci-allocate-resources-directly-under-the-non-hotplug-bridge.patch
+acpi-osl-only-free-map-once-in-osl.c.patch
+acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch
+acpi-ec-rework-flushing-of-pending-work.patch
+acpi-pm-avoid-attaching-acpi-pm-domain-to-certain-devices.patch
+pinctrl-rza2-fix-gpio-name-typos.patch
+pinctrl-armada-37xx-fix-irq-mask-access-in-armada_37xx_irq_set_type.patch
+pinctrl-samsung-add-of_node_put-before-return-in-error-path.patch
+pinctrl-samsung-fix-device-node-refcount-leaks-in-exynos-wakeup-controller-init.patch
+pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup-controller-init.patch
+pinctrl-samsung-fix-device-node-refcount-leaks-in-init-code.patch
+pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup-controller-init.patch
+mmc-host-omap_hsmmc-add-code-for-special-init-of-wl1251-to-get-rid-of-pandora_wl1251_init_card.patch
+arm-dts-omap3-tao3530-fix-incorrect-mmc-card-detection-gpio-polarity.patch
+rdma-core-fix-ib_dma_max_seg_size.patch
+ppdev-fix-ppgettime-ppsettime-ioctls.patch
+stm-class-lose-the-protocol-driver-when-dropping-its-reference.patch
+coresight-serialize-enabling-disabling-a-link-device.patch
--- /dev/null
+From 0a8f72fafb3f72a08df4ee491fcbeaafd6de85fd Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Thu, 14 Nov 2019 08:42:00 +0200
+Subject: stm class: Lose the protocol driver when dropping its reference
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 0a8f72fafb3f72a08df4ee491fcbeaafd6de85fd upstream.
+
+Commit c7fd62bc69d02 ("stm class: Introduce framing protocol drivers")
+forgot to tear down the link between an stm device and its protocol
+driver when policy is removed. This leads to an invalid pointer reference
+if one tries to write to an stm device after the policy has been removed
+and the protocol driver module unloaded, leading to the below splat:
+
+> BUG: unable to handle page fault for address: ffffffffc0737068
+> #PF: supervisor read access in kernel mode
+> #PF: error_code(0x0000) - not-present page
+> PGD 3d780f067 P4D 3d780f067 PUD 3d7811067 PMD 492781067 PTE 0
+> Oops: 0000 [#1] SMP NOPTI
+> CPU: 1 PID: 26122 Comm: cat Not tainted 5.4.0-rc5+ #1
+> RIP: 0010:stm_output_free+0x40/0xc0 [stm_core]
+> Call Trace:
+> stm_char_release+0x3e/0x70 [stm_core]
+> __fput+0xc6/0x260
+> ____fput+0xe/0x10
+> task_work_run+0x9d/0xc0
+> exit_to_usermode_loop+0x103/0x110
+> do_syscall_64+0x19d/0x1e0
+> entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fix this by tearing down the link from an stm device to its protocol
+driver when the policy involving that driver is removed.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: c7fd62bc69d02 ("stm class: Introduce framing protocol drivers")
+Reported-by: Ammy Yi <ammy.yi@intel.com>
+Tested-by: Ammy Yi <ammy.yi@intel.com>
+CC: stable@vger.kernel.org # v4.20+
+Link: https://lore.kernel.org/r/20191114064201.43089-2-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/policy.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwtracing/stm/policy.c
++++ b/drivers/hwtracing/stm/policy.c
+@@ -345,7 +345,11 @@ void stp_policy_unbind(struct stp_policy
+ stm->policy = NULL;
+ policy->stm = NULL;
+
++ /*
++ * Drop the reference on the protocol driver and lose the link.
++ */
+ stm_put_protocol(stm->pdrv);
++ stm->pdrv = NULL;
+ stm_put_device(stm);
+ }
+
--- /dev/null
+From 2c840676be8ffc624bf9bb4490d944fd13c02d71 Mon Sep 17 00:00:00 2001
+From: Denis Efremov <efremov@linux.com>
+Date: Tue, 1 Oct 2019 15:08:23 +0300
+Subject: wil6210: check len before memcpy() calls
+
+From: Denis Efremov <efremov@linux.com>
+
+commit 2c840676be8ffc624bf9bb4490d944fd13c02d71 upstream.
+
+memcpy() in wmi_set_ie() and wmi_update_ft_ies() is called with
+src == NULL and len == 0. This is an undefined behavior. Fix it
+by checking "ie_len > 0" before the memcpy() calls.
+
+As suggested by GCC documentation:
+"The pointers passed to memmove (and similar functions in <string.h>)
+must be non-null even when nbytes==0, so GCC can use that information
+to remove the check after the memmove call." [1]
+
+[1] https://gcc.gnu.org/gcc-4.9/porting_to.html
+
+Cc: Maya Erez <merez@codeaurora.org>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: stable@vger.kernel.org
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/wil6210/wmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -2505,7 +2505,8 @@ int wmi_set_ie(struct wil6210_vif *vif,
+ cmd->mgmt_frm_type = type;
+ /* BUG: FW API define ieLen as u8. Will fix FW */
+ cmd->ie_len = cpu_to_le16(ie_len);
+- memcpy(cmd->ie_info, ie, ie_len);
++ if (ie_len)
++ memcpy(cmd->ie_info, ie, ie_len);
+ rc = wmi_send(wil, WMI_SET_APPIE_CMDID, vif->mid, cmd, len);
+ kfree(cmd);
+ out:
+@@ -2541,7 +2542,8 @@ int wmi_update_ft_ies(struct wil6210_vif
+ }
+
+ cmd->ie_len = cpu_to_le16(ie_len);
+- memcpy(cmd->ie_info, ie, ie_len);
++ if (ie_len)
++ memcpy(cmd->ie_info, ie, ie_len);
+ rc = wmi_send(wil, WMI_UPDATE_FT_IES_CMDID, vif->mid, cmd, len);
+ kfree(cmd);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
