--- /dev/null
+From dd209f60b953c2e2052e7b2a3e38cf6dd0f84263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 14:58:44 +0800
+Subject: ACPI / APEI: Release resources if gen_pool_add() fails
+
+From: Liguang Zhang <zhangliguang@linux.alibaba.com>
+
+[ Upstream commit 6abc7622271dc520f241462e2474c71723638851 ]
+
+Destroy ghes_estatus_pool and release memory allocated via vmalloc() on
+errors in ghes_estatus_pool_init() in order to avoid memory leaks.
+
+ [ bp: do the labels properly and with descriptive names and massage. ]
+
+Signed-off-by: Liguang Zhang <zhangliguang@linux.alibaba.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/1563173924-47479-1-git-send-email-zhangliguang@linux.alibaba.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index a66e00fe31fec..66205ec545553 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -153,6 +153,7 @@ static void ghes_unmap(void __iomem *vaddr, enum fixed_addresses fixmap_idx)
+ int ghes_estatus_pool_init(int num_ghes)
+ {
+ unsigned long addr, len;
++ int rc;
+
+ ghes_estatus_pool = gen_pool_create(GHES_ESTATUS_POOL_MIN_ALLOC_ORDER, -1);
+ if (!ghes_estatus_pool)
+@@ -164,7 +165,7 @@ int ghes_estatus_pool_init(int num_ghes)
+ ghes_estatus_pool_size_request = PAGE_ALIGN(len);
+ addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
+ if (!addr)
+- return -ENOMEM;
++ goto err_pool_alloc;
+
+ /*
+ * New allocation must be visible in all pgd before it can be found by
+@@ -172,7 +173,19 @@ int ghes_estatus_pool_init(int num_ghes)
+ */
+ vmalloc_sync_all();
+
+- return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
++ rc = gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
++ if (rc)
++ goto err_pool_add;
++
++ return 0;
++
++err_pool_add:
++ vfree((void *)addr);
++
++err_pool_alloc:
++ gen_pool_destroy(ghes_estatus_pool);
++
++ return -ENOMEM;
+ }
+
+ static int map_gen_v2(struct ghes *ghes)
+--
+2.20.1
+
--- /dev/null
+From f1ee82119e59457fcc7df7917579394e5b62b029 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 18:21:20 -0600
+Subject: ACPI / CPPC: do not require the _PSD method
+
+From: Al Stone <ahs3@redhat.com>
+
+[ Upstream commit 4c4cdc4c63853fee48c02e25c8605fb65a6c9924 ]
+
+According to the ACPI 6.3 specification, the _PSD method is optional
+when using CPPC. The underlying assumption is that each CPU can change
+frequency independently from all other CPUs; _PSD is provided to tell
+the OS that some processors can NOT do that.
+
+However, the acpi_get_psd() function returns ENODEV if there is no _PSD
+method present, or an ACPI error status if an error occurs when evaluating
+_PSD, if present. This makes _PSD mandatory when using CPPC, in violation
+of the specification, and only on Linux.
+
+This has forced some firmware writers to provide a dummy _PSD, even though
+it is irrelevant, but only because Linux requires it; other OSPMs follow
+the spec. We really do not want to have OS specific ACPI tables, though.
+
+So, correct acpi_get_psd() so that it does not return an error if there
+is no _PSD method present, but does return a failure when the method can
+not be executed properly. This allows _PSD to be optional as it should
+be.
+
+Signed-off-by: Al Stone <ahs3@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/cppc_acpi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 15f103d7532b0..3b2525908dd8c 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -365,8 +365,10 @@ static int acpi_get_psd(struct cpc_desc *cpc_ptr, acpi_handle handle)
+ union acpi_object *psd = NULL;
+ struct acpi_psd_package *pdomain;
+
+- status = acpi_evaluate_object_typed(handle, "_PSD", NULL, &buffer,
+- ACPI_TYPE_PACKAGE);
++ status = acpi_evaluate_object_typed(handle, "_PSD", NULL,
++ &buffer, ACPI_TYPE_PACKAGE);
++ if (status == AE_NOT_FOUND) /* _PSD is optional */
++ return 0;
+ if (ACPI_FAILURE(status))
+ return -ENODEV;
+
+--
+2.20.1
+
--- /dev/null
+From ff460c69e3cee5ad1f22bd10e816b1a9d4844bf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 00:08:27 -0500
+Subject: ACPI: custom_method: fix memory leaks
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 03d1571d9513369c17e6848476763ebbd10ec2cb ]
+
+In cm_write(), 'buf' is allocated through kzalloc(). In the following
+execution, if an error occurs, 'buf' is not deallocated, leading to memory
+leaks. To fix this issue, free 'buf' before returning the error.
+
+Fixes: 526b4af47f44 ("ACPI: Split out custom_method functionality into an own driver")
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/custom_method.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
+index b2ef4c2ec955d..fd66a736621cf 100644
+--- a/drivers/acpi/custom_method.c
++++ b/drivers/acpi/custom_method.c
+@@ -49,8 +49,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ if ((*ppos > max_size) ||
+ (*ppos + count > max_size) ||
+ (*ppos + count < count) ||
+- (count > uncopied_bytes))
++ (count > uncopied_bytes)) {
++ kfree(buf);
+ return -EINVAL;
++ }
+
+ if (copy_from_user(buf + (*ppos), user_buf, count)) {
+ kfree(buf);
+@@ -70,6 +72,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
+ add_taint(TAINT_OVERRIDDEN_ACPI_TABLE, LOCKDEP_NOW_UNRELIABLE);
+ }
+
++ kfree(buf);
+ return count;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ef7894e513719626a6381690de96076b66a14964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 22:44:19 -0500
+Subject: ACPI / PCI: fix acpi_pci_irq_enable() memory leak
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 29b49958cf73b439b17fa29e9a25210809a6c01c ]
+
+In acpi_pci_irq_enable(), 'entry' is allocated by kzalloc() in
+acpi_pci_irq_check_entry() (invoked from acpi_pci_irq_lookup()). However,
+it is not deallocated if acpi_pci_irq_valid() returns false, leading to a
+memory leak. To fix this issue, free 'entry' before returning 0.
+
+Fixes: e237a5518425 ("x86/ACPI/PCI: Recognize that Interrupt Line 255 means "not connected"")
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_irq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
+index d2549ae65e1b6..dea8a60e18a4c 100644
+--- a/drivers/acpi/pci_irq.c
++++ b/drivers/acpi/pci_irq.c
+@@ -449,8 +449,10 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
+ * No IRQ known to the ACPI subsystem - maybe the BIOS /
+ * driver reported one, then use it. Exit in any case.
+ */
+- if (!acpi_pci_irq_valid(dev, pin))
++ if (!acpi_pci_irq_valid(dev, pin)) {
++ kfree(entry);
+ return 0;
++ }
+
+ if (acpi_isa_register_gsi(dev))
+ dev_warn(&dev->dev, "PCI INT %c: no GSI\n",
+--
+2.20.1
+
--- /dev/null
+From 579b4bec7000caa6618c27055962d23894f94dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 13:10:37 +0200
+Subject: ACPI / processor: don't print errors for processorIDs == 0xff
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit 2c2b005f549544c13ef4cfb0e4842949066889bc ]
+
+Some platforms define their processors in this manner:
+ Device (SCK0)
+ {
+ Name (_HID, "ACPI0004" /* Module Device */) // _HID: Hardware ID
+ Name (_UID, "CPUSCK0") // _UID: Unique ID
+ Processor (CP00, 0x00, 0x00000410, 0x06){}
+ Processor (CP01, 0x02, 0x00000410, 0x06){}
+ Processor (CP02, 0x04, 0x00000410, 0x06){}
+ Processor (CP03, 0x06, 0x00000410, 0x06){}
+ Processor (CP04, 0x01, 0x00000410, 0x06){}
+ Processor (CP05, 0x03, 0x00000410, 0x06){}
+ Processor (CP06, 0x05, 0x00000410, 0x06){}
+ Processor (CP07, 0x07, 0x00000410, 0x06){}
+ Processor (CP08, 0xFF, 0x00000410, 0x06){}
+ Processor (CP09, 0xFF, 0x00000410, 0x06){}
+ Processor (CP0A, 0xFF, 0x00000410, 0x06){}
+ Processor (CP0B, 0xFF, 0x00000410, 0x06){}
+...
+
+The processors marked as 0xff are invalid, there are only 8 of them in
+this case.
+
+So do not print an error on ids == 0xff, just print an info message.
+Actually, we could return ENODEV even on the first CPU with ID 0xff, but
+ACPI spec does not forbid the 0xff value to be a processor ID. Given
+0xff could be a correct one, we would break working systems if we
+returned ENODEV.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_processor.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 24f065114d424..2c4dda0787e84 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -279,9 +279,13 @@ static int acpi_processor_get_info(struct acpi_device *device)
+ }
+
+ if (acpi_duplicate_processor_id(pr->acpi_id)) {
+- dev_err(&device->dev,
+- "Failed to get unique processor _UID (0x%x)\n",
+- pr->acpi_id);
++ if (pr->acpi_id == 0xff)
++ dev_info_once(&device->dev,
++ "Entry not well-defined, consider updating BIOS\n");
++ else
++ dev_err(&device->dev,
++ "Failed to get unique processor _UID (0x%x)\n",
++ pr->acpi_id);
+ return -ENODEV;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 88ef6f666040d4f76dd2fc4191c6235b9cde72c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 10:14:56 +0900
+Subject: ALSA: firewire-motu: add support for MOTU 4pre
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 6af86bdb8ad41f4cf1292d3b10857dc322758328 ]
+
+MOTU 4pre was launched in 2012 by MOTU, Inc. This commit allows userspace
+applications can transmit and receive PCM frames and MIDI messages for
+this model via ALSA PCM interface and RawMidi/Sequencer interfaces.
+
+The device supports MOTU protocol version 3. Unlike the other devices, the
+device is simply designed. The size of data block is fixed to 10 quadlets
+during available sampling rates (44.1 - 96.0 kHz). Each data block
+includes 1 source packet header, 2 data chunks for messages, 8 data chunks
+for PCM samples and 2 data chunks for padding to quadlet alignment. The
+device has no MIDI, optical, BNC and AES/EBU interfaces.
+
+Like support for the other MOTU devices, the quality of playback sound
+is not enough good with periodical noise yet.
+
+$ python2 crpp < ~/git/am-config-rom/motu/motu-4pre.img
+ ROM header and bus information block
+ -----------------------------------------------------------------
+400 041078cc bus_info_length 4, crc_length 16, crc 30924
+404 31333934 bus_name "1394"
+408 20ff7000 irmc 0, cmc 0, isc 1, bmc 0, cyc_clk_acc 255, max_rec 7 (256)
+40c 0001f200 company_id 0001f2 |
+410 000a41c5 device_id 00000a41c5 | EUI-64 0001f200000a41c5
+
+ root directory
+ -----------------------------------------------------------------
+414 0004ef04 directory_length 4, crc 61188
+418 030001f2 vendor
+41c 0c0083c0 node capabilities per IEEE 1394
+420 d1000002 --> unit directory at 428
+424 8d000005 --> eui-64 leaf at 438
+
+ unit directory at 428
+ -----------------------------------------------------------------
+428 0003ceda directory_length 3, crc 52954
+42c 120001f2 specifier id
+430 13000045 version
+434 17103800 model
+
+ eui-64 leaf at 438
+ -----------------------------------------------------------------
+438 0002d248 leaf_length 2, crc 53832
+43c 0001f200 company_id 0001f2 |
+440 000a41c5 device_id 00000a41c5 | EUI-64 0001f200000a41c5
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/motu/motu.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/sound/firewire/motu/motu.c b/sound/firewire/motu/motu.c
+index 03cda2166ea3d..72908b4de77c0 100644
+--- a/sound/firewire/motu/motu.c
++++ b/sound/firewire/motu/motu.c
+@@ -247,6 +247,17 @@ static const struct snd_motu_spec motu_audio_express = {
+ .analog_out_ports = 4,
+ };
+
++static const struct snd_motu_spec motu_4pre = {
++ .name = "4pre",
++ .protocol = &snd_motu_protocol_v3,
++ .flags = SND_MOTU_SPEC_SUPPORT_CLOCK_X2 |
++ SND_MOTU_SPEC_TX_MICINST_CHUNK |
++ SND_MOTU_SPEC_TX_RETURN_CHUNK |
++ SND_MOTU_SPEC_RX_SEPARETED_MAIN,
++ .analog_in_ports = 2,
++ .analog_out_ports = 2,
++};
++
+ #define SND_MOTU_DEV_ENTRY(model, data) \
+ { \
+ .match_flags = IEEE1394_MATCH_VENDOR_ID | \
+@@ -265,6 +276,7 @@ static const struct ieee1394_device_id motu_id_table[] = {
+ SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */
+ SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */
+ SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express),
++ SND_MOTU_DEV_ENTRY(0x000045, &motu_4pre),
+ { }
+ };
+ MODULE_DEVICE_TABLE(ieee1394, motu_id_table);
+--
+2.20.1
+
--- /dev/null
+From dd382636138b88729874f0bd8c815e4cd70cd9e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 16:37:54 +0200
+Subject: ALSA: hda - Add a quirk model for fixing Huawei Matebook X right
+ speaker
+
+From: Tomas Espeleta <tomas.espeleta@gmail.com>
+
+[ Upstream commit a2ef03fe617a8365fb7794531b11ba587509a9b9 ]
+
+[ This is rather a revival of the patch Tomas sent in months ago, but
+ applying only with the quirk model option -- tiwai ]
+
+Hard coded coefficients to make Huawuei Matebook X right speaker
+work. The Matebook X has a ALC298, please refer to bug 197801 on
+how these numbers were reverse engineered from the Windows driver
+
+The reversed engineered sequence represents a repeating pattern
+of verbs, and the only values that are changing periodically are
+written on indexes 0x23 and 0x25:
+
+0x500, 0x23
+0x400, VALUE1
+0x500, 0x25
+0x400, VALUE2
+
+* skipped reading sequences (0x500 - 0xc00 sequences are ignored)
+* static values from reverse engineering are used
+
+NOTE: since a significant risk is still considered, this is provided
+as an experimental fix that isn't applied as default for now. For
+enabling the fix, you'll have to choose huawei-mbx-stereo via model
+option of snd-hda-intel module.
+
+If we get feedback from users that this works stably, we may apply it
+per default.
+
+[ Some coding style fixes and replacement with AC_VERB_* by tiwai ]
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197801
+Signed-off-by: Tomas Espeleta <tomas.espeleta@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/sound/hd-audio/models.rst | 3 +
+ sound/pci/hda/patch_realtek.c | 74 +++++++++++++++++++++++++
+ 2 files changed, 77 insertions(+)
+
+diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
+index 7d7c191102a73..11298f0ce44db 100644
+--- a/Documentation/sound/hd-audio/models.rst
++++ b/Documentation/sound/hd-audio/models.rst
+@@ -260,6 +260,9 @@ alc295-hp-x360
+ HP Spectre X360 fixups
+ alc-sense-combo
+ Headset button support for Chrome platform
++huawei-mbx-stereo
++ Enable initialization verbs for Huawei MBX stereo speakers;
++ might be risky, try this at your own risk
+
+ ALC66x/67x/892
+ ==============
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c1ddfd2fac522..1bec62720374d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3755,6 +3755,72 @@ static void alc269_x101_hp_automute_hook(struct hda_codec *codec,
+ vref);
+ }
+
++/*
++ * Magic sequence to make Huawei Matebook X right speaker working (bko#197801)
++ */
++struct hda_alc298_mbxinit {
++ unsigned char value_0x23;
++ unsigned char value_0x25;
++};
++
++static void alc298_huawei_mbx_stereo_seq(struct hda_codec *codec,
++ const struct hda_alc298_mbxinit *initval,
++ bool first)
++{
++ snd_hda_codec_write(codec, 0x06, 0, AC_VERB_SET_DIGI_CONVERT_3, 0x0);
++ alc_write_coef_idx(codec, 0x26, 0xb000);
++
++ if (first)
++ snd_hda_codec_write(codec, 0x21, 0, AC_VERB_GET_PIN_SENSE, 0x0);
++
++ snd_hda_codec_write(codec, 0x6, 0, AC_VERB_SET_DIGI_CONVERT_3, 0x80);
++ alc_write_coef_idx(codec, 0x26, 0xf000);
++ alc_write_coef_idx(codec, 0x23, initval->value_0x23);
++
++ if (initval->value_0x23 != 0x1e)
++ alc_write_coef_idx(codec, 0x25, initval->value_0x25);
++
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x26);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb010);
++}
++
++static void alc298_fixup_huawei_mbx_stereo(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ /* Initialization magic */
++ static const struct hda_alc298_mbxinit dac_init[] = {
++ {0x0c, 0x00}, {0x0d, 0x00}, {0x0e, 0x00}, {0x0f, 0x00},
++ {0x10, 0x00}, {0x1a, 0x40}, {0x1b, 0x82}, {0x1c, 0x00},
++ {0x1d, 0x00}, {0x1e, 0x00}, {0x1f, 0x00},
++ {0x20, 0xc2}, {0x21, 0xc8}, {0x22, 0x26}, {0x23, 0x24},
++ {0x27, 0xff}, {0x28, 0xff}, {0x29, 0xff}, {0x2a, 0x8f},
++ {0x2b, 0x02}, {0x2c, 0x48}, {0x2d, 0x34}, {0x2e, 0x00},
++ {0x2f, 0x00},
++ {0x30, 0x00}, {0x31, 0x00}, {0x32, 0x00}, {0x33, 0x00},
++ {0x34, 0x00}, {0x35, 0x01}, {0x36, 0x93}, {0x37, 0x0c},
++ {0x38, 0x00}, {0x39, 0x00}, {0x3a, 0xf8}, {0x38, 0x80},
++ {}
++ };
++ const struct hda_alc298_mbxinit *seq;
++
++ if (action != HDA_FIXUP_ACT_INIT)
++ return;
++
++ /* Start */
++ snd_hda_codec_write(codec, 0x06, 0, AC_VERB_SET_DIGI_CONVERT_3, 0x00);
++ snd_hda_codec_write(codec, 0x06, 0, AC_VERB_SET_DIGI_CONVERT_3, 0x80);
++ alc_write_coef_idx(codec, 0x26, 0xf000);
++ alc_write_coef_idx(codec, 0x22, 0x31);
++ alc_write_coef_idx(codec, 0x23, 0x0b);
++ alc_write_coef_idx(codec, 0x25, 0x00);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_COEF_INDEX, 0x26);
++ snd_hda_codec_write(codec, 0x20, 0, AC_VERB_SET_PROC_COEF, 0xb010);
++
++ for (seq = dac_init; seq->value_0x23; seq++)
++ alc298_huawei_mbx_stereo_seq(codec, seq, seq == dac_init);
++}
++
+ static void alc269_fixup_x101_headset_mic(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -5780,6 +5846,7 @@ enum {
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ ALC255_FIXUP_DELL_HEADSET_MIC,
+ ALC256_FIXUP_HUAWEI_MACH_WX9_PINS,
++ ALC298_FIXUP_HUAWEI_MBX_STEREO,
+ ALC295_FIXUP_HP_X360,
+ ALC221_FIXUP_HP_HEADSET_MIC,
+ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+@@ -6089,6 +6156,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC255_FIXUP_MIC_MUTE_LED
+ },
++ [ALC298_FIXUP_HUAWEI_MBX_STEREO] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc298_fixup_huawei_mbx_stereo,
++ .chained = true,
++ .chain_id = ALC255_FIXUP_MIC_MUTE_LED
++ },
+ [ALC269_FIXUP_ASUS_X101_FUNC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_x101_headset_mic,
+@@ -7280,6 +7353,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC225_FIXUP_HEADSET_JACK, .name = "alc-headset-jack"},
+ {.id = ALC295_FIXUP_CHROME_BOOK, .name = "alc-chrome-book"},
+ {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
++ {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
+--
+2.20.1
+
--- /dev/null
+From 0672fc26bd409fd91da2f6e1aa56161bfe721847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2019 17:11:28 +0200
+Subject: ALSA: hda - Drop unsol event handler for Intel HDMI codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit f2dbe87c5ac1f88e6007ba1f1374f4bd8a197fb6 ]
+
+We don't need to deal with the unsol events for Intel chips that are
+tied with the graphics via audio component notifier. Although the
+presence of the audio component is checked at the beginning of
+hdmi_unsol_event(), better to short cut by dropping unsol_event ops.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204565
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index c380596b2e84c..36240def9bf58 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2616,6 +2616,8 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec,
+ /* precondition and allocation for Intel codecs */
+ static int alloc_intel_hdmi(struct hda_codec *codec)
+ {
++ int err;
++
+ /* requires i915 binding */
+ if (!codec->bus->core.audio_component) {
+ codec_info(codec, "No i915 binding for Intel HDMI/DP codec\n");
+@@ -2624,7 +2626,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec)
+ return -ENODEV;
+ }
+
+- return alloc_generic_hdmi(codec);
++ err = alloc_generic_hdmi(codec);
++ if (err < 0)
++ return err;
++ /* no need to handle unsol events */
++ codec->patch_ops.unsol_event = NULL;
++ return 0;
+ }
+
+ /* parse and post-process for Intel codecs */
+--
+2.20.1
+
--- /dev/null
+From 737ef4fcaf79d61aebd3a6b37cb81b02fa1ee710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Jul 2019 12:33:37 +0100
+Subject: ALSA: hda: Flush interrupts on disabling
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit caa8422d01e983782548648e125fd617cadcec3f ]
+
+I was looking at
+
+<4> [241.835158] general protection fault: 0000 [#1] PREEMPT SMP PTI
+<4> [241.835181] CPU: 1 PID: 214 Comm: kworker/1:3 Tainted: G U 5.2.0-CI-CI_DRM_6509+ #1
+<4> [241.835199] Hardware name: Dell Inc. OptiPlex 745 /0GW726, BIOS 2.3.1 05/21/2007
+<4> [241.835234] Workqueue: events snd_hdac_bus_process_unsol_events [snd_hda_core]
+<4> [241.835256] RIP: 0010:input_handle_event+0x16d/0x5e0
+<4> [241.835270] Code: 48 8b 93 58 01 00 00 8b 52 08 89 50 04 8b 83 f8 06 00 00 48 8b 93 00 07 00 00 8d 70 01 48 8d 04 c2 83 e1 08 89 b3 f8 06 00 00 <66> 89 28 66 44 89 60 02 44 89 68 04 8b 93 f8 06 00 00 0f 84 fd fe
+<4> [241.835304] RSP: 0018:ffffc9000019fda0 EFLAGS: 00010046
+<4> [241.835317] RAX: 6b6b6b6ec6c6c6c3 RBX: ffff8880290fefc8 RCX: 0000000000000000
+<4> [241.835332] RDX: 000000006b6b6b6b RSI: 000000006b6b6b6c RDI: 0000000000000046
+<4> [241.835347] RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000001
+<4> [241.835362] R10: ffffc9000019faa0 R11: 0000000000000000 R12: 0000000000000004
+<4> [241.835377] R13: 0000000000000000 R14: ffff8880290ff1d0 R15: 0000000000000293
+<4> [241.835392] FS: 0000000000000000(0000) GS:ffff88803de80000(0000) knlGS:0000000000000000
+<4> [241.835409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+<4> [241.835422] CR2: 00007ffe9a99e9b7 CR3: 000000002f588000 CR4: 00000000000006e0
+<4> [241.835436] Call Trace:
+<4> [241.835449] input_event+0x45/0x70
+<4> [241.835464] snd_jack_report+0xdc/0x100
+<4> [241.835490] snd_hda_jack_report_sync+0x83/0xc0 [snd_hda_codec]
+<4> [241.835512] snd_hdac_bus_process_unsol_events+0x5a/0x70 [snd_hda_core]
+<4> [241.835530] process_one_work+0x245/0x610
+
+which has the hallmarks of a worker queued from interrupt after it was
+supposedly cancelled (note the POISON_FREE), and I could not see where
+the interrupt would be flushed on shutdown so added the likely suspects.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111174
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_controller.c | 2 ++
+ sound/pci/hda/hda_intel.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
+index 3b0110545070a..196bbc85699e5 100644
+--- a/sound/hda/hdac_controller.c
++++ b/sound/hda/hdac_controller.c
+@@ -447,6 +447,8 @@ static void azx_int_disable(struct hdac_bus *bus)
+ list_for_each_entry(azx_dev, &bus->stream_list, list)
+ snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0);
+
++ synchronize_irq(bus->irq);
++
+ /* disable SIE for all streams */
+ snd_hdac_chip_writeb(bus, INTCTL, 0);
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index b0de3e3b33e5c..783f9a9c40ecd 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1349,9 +1349,9 @@ static int azx_free(struct azx *chip)
+ }
+
+ if (bus->chip_init) {
++ azx_stop_chip(chip);
+ azx_clear_irq_pending(chip);
+ azx_stop_all_streams(chip);
+- azx_stop_chip(chip);
+ }
+
+ if (bus->irq >= 0)
+--
+2.20.1
+
--- /dev/null
+From 911a4206f9acff7c7263457c2a9141911c0ffcc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jul 2019 14:30:23 +0200
+Subject: ALSA: hda/hdmi - Don't report spurious jack state changes
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 551626ec0ad28dc43cae3094c35be7088cc625ab ]
+
+The HDMI jack handling reports the state change always via
+snd_jack_report() whenever hdmi_present_sense() is called, even if the
+state itself doesn't change from the previous time. This is mostly
+harmless but still a bit confusing to user-space.
+
+This patch reduces such spurious jack state changes and reports only
+when the state really changed. Also, as a minor optimization, avoid
+overwriting the pin ELD data when the state is identical.
+
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 32 ++++++++++++++++++--------------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index bea7b09610809..c380596b2e84c 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1421,7 +1421,7 @@ static void hdmi_pcm_reset_pin(struct hdmi_spec *spec,
+ /* update per_pin ELD from the given new ELD;
+ * setup info frame and notification accordingly
+ */
+-static void update_eld(struct hda_codec *codec,
++static bool update_eld(struct hda_codec *codec,
+ struct hdmi_spec_per_pin *per_pin,
+ struct hdmi_eld *eld)
+ {
+@@ -1452,18 +1452,22 @@ static void update_eld(struct hda_codec *codec,
+ snd_hdmi_show_eld(codec, &eld->info);
+
+ eld_changed = (pin_eld->eld_valid != eld->eld_valid);
+- if (eld->eld_valid && pin_eld->eld_valid)
++ eld_changed |= (pin_eld->monitor_present != eld->monitor_present);
++ if (!eld_changed && eld->eld_valid && pin_eld->eld_valid)
+ if (pin_eld->eld_size != eld->eld_size ||
+ memcmp(pin_eld->eld_buffer, eld->eld_buffer,
+ eld->eld_size) != 0)
+ eld_changed = true;
+
+- pin_eld->monitor_present = eld->monitor_present;
+- pin_eld->eld_valid = eld->eld_valid;
+- pin_eld->eld_size = eld->eld_size;
+- if (eld->eld_valid)
+- memcpy(pin_eld->eld_buffer, eld->eld_buffer, eld->eld_size);
+- pin_eld->info = eld->info;
++ if (eld_changed) {
++ pin_eld->monitor_present = eld->monitor_present;
++ pin_eld->eld_valid = eld->eld_valid;
++ pin_eld->eld_size = eld->eld_size;
++ if (eld->eld_valid)
++ memcpy(pin_eld->eld_buffer, eld->eld_buffer,
++ eld->eld_size);
++ pin_eld->info = eld->info;
++ }
+
+ /*
+ * Re-setup pin and infoframe. This is needed e.g. when
+@@ -1481,6 +1485,7 @@ static void update_eld(struct hda_codec *codec,
+ SNDRV_CTL_EVENT_MASK_VALUE |
+ SNDRV_CTL_EVENT_MASK_INFO,
+ &get_hdmi_pcm(spec, pcm_idx)->eld_ctl->id);
++ return eld_changed;
+ }
+
+ /* update ELD and jack state via HD-audio verbs */
+@@ -1582,6 +1587,7 @@ static void sync_eld_via_acomp(struct hda_codec *codec,
+ struct hdmi_spec *spec = codec->spec;
+ struct hdmi_eld *eld = &spec->temp_eld;
+ struct snd_jack *jack = NULL;
++ bool changed;
+ int size;
+
+ mutex_lock(&per_pin->lock);
+@@ -1608,15 +1614,13 @@ static void sync_eld_via_acomp(struct hda_codec *codec,
+ * disconnected event. Jack must be fetched before update_eld()
+ */
+ jack = pin_idx_to_jack(codec, per_pin);
+- update_eld(codec, per_pin, eld);
++ changed = update_eld(codec, per_pin, eld);
+ if (jack == NULL)
+ jack = pin_idx_to_jack(codec, per_pin);
+- if (jack == NULL)
+- goto unlock;
+- snd_jack_report(jack,
+- (eld->monitor_present && eld->eld_valid) ?
++ if (changed && jack)
++ snd_jack_report(jack,
++ (eld->monitor_present && eld->eld_valid) ?
+ SND_JACK_AVOUT : 0);
+- unlock:
+ mutex_unlock(&per_pin->lock);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0256b02ab1166f441132634ce8738e9b322bf42e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 09:58:07 +0200
+Subject: ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 051c78af14fcd74a22b5af45548ad9d588247cc7 ]
+
+Lenovo ThinkCentre M73 and M93 don't seem to have a proper beep
+although the driver tries to probe and set up blindly.
+Blacklist these machines for suppressing the beep creation.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=204635
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1bec62720374d..d223a79ac934f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1058,6 +1058,9 @@ static const struct snd_pci_quirk beep_white_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x834a, "EeePC", 1),
+ SND_PCI_QUIRK(0x1458, 0xa002, "GA-MA790X", 1),
+ SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1),
++ /* blacklist -- no beep available */
++ SND_PCI_QUIRK(0x17aa, 0x309e, "Lenovo ThinkCentre M73", 0),
++ SND_PCI_QUIRK(0x17aa, 0x30a3, "Lenovo ThinkCentre M93", 0),
+ {}
+ };
+
+--
+2.20.1
+
--- /dev/null
+From bf3a91774ac00999521f408168ba077d2311681f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2019 11:42:34 +0200
+Subject: ALSA: hda - Show the fatal CORB/RIRB error more clearly
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit dd65f7e19c6961ba6a69f7c925021b7a270cb950 ]
+
+The last fallback of CORB/RIRB communication error recovery is to turn
+on the single command mode, and this last resort usually means that
+something is really screwed up. Instead of a normal dev_err(), show
+the error more clearly with dev_WARN() with the caller stack trace.
+
+Also, show the bus-reset fallback also as an error, too.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_controller.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 48d863736b3c3..a5a2e9fe77854 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -869,10 +869,13 @@ static int azx_rirb_get_response(struct hdac_bus *bus, unsigned int addr,
+ */
+ if (hbus->allow_bus_reset && !hbus->response_reset && !hbus->in_reset) {
+ hbus->response_reset = 1;
++ dev_err(chip->card->dev,
++ "No response from codec, resetting bus: last cmd=0x%08x\n",
++ bus->last_cmd[addr]);
+ return -EAGAIN; /* give a chance to retry */
+ }
+
+- dev_err(chip->card->dev,
++ dev_WARN(chip->card->dev,
+ "azx_get_response timeout, switching to single_cmd mode: last cmd=0x%08x\n",
+ bus->last_cmd[addr]);
+ chip->single_cmd = 1;
+--
+2.20.1
+
--- /dev/null
+From 372dfed2f58c4a0cc4d2bdef2d93b7a4c14de5d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2019 10:14:42 +0800
+Subject: ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in
+ build_adc_controls()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 2127c01b7f63b06a21559f56a8c81a3c6535bd1a ]
+
+In build_adc_controls(), there is an if statement on line 773 to check
+whether ak->adc_info is NULL:
+ if (! ak->adc_info ||
+ ! ak->adc_info[mixer_ch].switch_name)
+
+When ak->adc_info is NULL, it is used on line 792:
+ knew.name = ak->adc_info[mixer_ch].selector_name;
+
+Thus, a possible null-pointer dereference may occur.
+
+To fix this bug, referring to lines 773 and 774, ak->adc_info
+and ak->adc_info[mixer_ch].selector_name are checked before being used.
+
+This bug is found by a static analysis tool STCheck written by us.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/i2c/other/ak4xxx-adda.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
+index 5f59316f982ae..7d15093844b92 100644
+--- a/sound/i2c/other/ak4xxx-adda.c
++++ b/sound/i2c/other/ak4xxx-adda.c
+@@ -775,11 +775,12 @@ static int build_adc_controls(struct snd_akm4xxx *ak)
+ return err;
+
+ memset(&knew, 0, sizeof(knew));
+- knew.name = ak->adc_info[mixer_ch].selector_name;
+- if (!knew.name) {
++ if (!ak->adc_info ||
++ !ak->adc_info[mixer_ch].selector_name) {
+ knew.name = "Capture Channel";
+ knew.index = mixer_ch + ak->idx_offset * 2;
+- }
++ } else
++ knew.name = ak->adc_info[mixer_ch].selector_name;
+
+ knew.iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+ knew.info = ak4xxx_capture_source_info;
+--
+2.20.1
+
--- /dev/null
+From fd0933a4489bfc22757982681aefef86fd270c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 13:52:14 +0200
+Subject: ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid
+
+From: Ard van Breemen <ard@kwaak.net>
+
+[ Upstream commit 1b34121d9f26d272b0b2334209af6b6fc82d4bf1 ]
+
+The Linux kernel assumes that get_endpoint(alts,0) and
+get_endpoint(alts,1) are eachothers feedback endpoints.
+To reassure that validity it will test bsynchaddress to comply with that
+assumption. But if the bsyncaddress is 0 (invalid), it will flag that as
+a wrong assumption and return an error.
+Fix: Skip the test if bSynchAddress is 0.
+Note: those with a valid bSynchAddress should have a code quirck added.
+
+Signed-off-by: Ard van Breemen <ard@kwaak.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index e4bbf79de956e..33cd26763c0ee 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -457,6 +457,7 @@ static int set_sync_endpoint(struct snd_usb_substream *subs,
+ }
+ ep = get_endpoint(alts, 1)->bEndpointAddress;
+ if (get_endpoint(alts, 0)->bLength >= USB_DT_ENDPOINT_AUDIO_SIZE &&
++ get_endpoint(alts, 0)->bSynchAddress != 0 &&
+ ((is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress | USB_DIR_IN)) ||
+ (!is_playback && ep != (unsigned int)(get_endpoint(alts, 0)->bSynchAddress & ~USB_DIR_IN)))) {
+ dev_err(&dev->dev,
+--
+2.20.1
+
--- /dev/null
+From b69832b4a05d0581a7c6f16cffb81021dacd2eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 11:43:45 +0900
+Subject: ARM: at91: move platform-specific asm-offset.h to arch/arm/mach-at91
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 9fac85a6db8999922f2cd92dfe2e83e063b31a94 ]
+
+<generated/at91_pm_data-offsets.h> is only generated and included by
+arch/arm/mach-at91/, so it does not need to reside in the globally
+visible include/generated/.
+
+I renamed it to arch/arm/mach-at91/pm_data-offsets.h since the prefix
+'at91_' is just redundant in mach-at91/.
+
+My main motivation of this change is to avoid the race condition for
+the parallel build (-j) when CONFIG_IKHEADERS is enabled.
+
+When it is enabled, all the headers under include/ are archived into
+kernel/kheaders_data.tar.xz and exposed in the sysfs.
+
+In the parallel build, we have no idea in which order files are built.
+
+ - If at91_pm_data-offsets.h is built before kheaders_data.tar.xz,
+ the header will be included in the archive. Probably nobody will
+ use it, but it is harmless except that it will increase the archive
+ size needlessly.
+
+ - If kheaders_data.tar.xz is built before at91_pm_data-offsets.h,
+ the header will not be included in the archive. However, in the next
+ build, the archive will be re-generated to include the newly-found
+ at91_pm_data-offsets.h. This is not nice from the build system point
+ of view.
+
+ - If at91_pm_data-offsets.h and kheaders_data.tar.xz are built at the
+ same time, the corrupted header might be included in the archive,
+ which does not look nice either.
+
+This commit fixes the race.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Link: https://lore.kernel.org/r/20190823024346.591-1-yamada.masahiro@socionext.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/.gitignore | 1 +
+ arch/arm/mach-at91/Makefile | 5 +++--
+ arch/arm/mach-at91/pm_suspend.S | 2 +-
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+ create mode 100644 arch/arm/mach-at91/.gitignore
+
+diff --git a/arch/arm/mach-at91/.gitignore b/arch/arm/mach-at91/.gitignore
+new file mode 100644
+index 0000000000000..2ecd6f51c8a95
+--- /dev/null
++++ b/arch/arm/mach-at91/.gitignore
+@@ -0,0 +1 @@
++pm_data-offsets.h
+diff --git a/arch/arm/mach-at91/Makefile b/arch/arm/mach-at91/Makefile
+index 31b61f0e1c077..de64301dcff25 100644
+--- a/arch/arm/mach-at91/Makefile
++++ b/arch/arm/mach-at91/Makefile
+@@ -19,9 +19,10 @@ ifeq ($(CONFIG_PM_DEBUG),y)
+ CFLAGS_pm.o += -DDEBUG
+ endif
+
+-include/generated/at91_pm_data-offsets.h: arch/arm/mach-at91/pm_data-offsets.s FORCE
++$(obj)/pm_data-offsets.h: $(obj)/pm_data-offsets.s FORCE
+ $(call filechk,offsets,__PM_DATA_OFFSETS_H__)
+
+-arch/arm/mach-at91/pm_suspend.o: include/generated/at91_pm_data-offsets.h
++$(obj)/pm_suspend.o: $(obj)/pm_data-offsets.h
+
+ targets += pm_data-offsets.s
++clean-files += pm_data-offsets.h
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index c751f047b1166..ed57c879d4e17 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -10,7 +10,7 @@
+ #include <linux/linkage.h>
+ #include <linux/clk/at91_pmc.h>
+ #include "pm.h"
+-#include "generated/at91_pm_data-offsets.h"
++#include "pm_data-offsets.h"
+
+ #define SRAMC_SELF_FRESH_ACTIVE 0x01
+ #define SRAMC_SELF_FRESH_EXIT 0x00
+--
+2.20.1
+
--- /dev/null
+From 90bd9e15039cf27ab52ea35fe037b72aefe2bb4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 14:52:42 +0200
+Subject: ARM: dts: exynos: Mark LDO10 as always-on on Peach Pit/Pi Chromebooks
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 5b0eeeaa37615df37a9a30929b73e9defe61ca84 ]
+
+Commit aff138bf8e37 ("ARM: dts: exynos: Add TMU nodes regulator supply
+for Peach boards") assigned LDO10 to Exynos Thermal Measurement Unit,
+but it turned out that it supplies also some other critical parts and
+board freezes/crashes when it is turned off.
+
+The mentioned commit made Exynos TMU a consumer of that regulator and in
+typical case Exynos TMU driver keeps it enabled from early boot. However
+there are such configurations (example is multi_v7_defconfig), in which
+some of the regulators are compiled as modules and are not available
+from early boot. In such case it may happen that LDO10 is turned off by
+regulator core, because it has no consumers yet (in this case consumer
+drivers cannot get it, because the supply regulators for it are not yet
+available). This in turn causes the board to crash. This patch restores
+'always-on' property for the LDO10 regulator.
+
+Fixes: aff138bf8e37 ("ARM: dts: exynos: Add TMU nodes regulator supply for Peach boards")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-peach-pit.dts | 1 +
+ arch/arm/boot/dts/exynos5800-peach-pi.dts | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index f78db6809cca4..9eb48cabcca45 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -440,6 +440,7 @@
+ regulator-name = "vdd_ldo10";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-state-mem {
+ regulator-off-in-suspend;
+ };
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index e0f470fe54c81..4398f2d1fe881 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -440,6 +440,7 @@
+ regulator-name = "vdd_ldo10";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-state-mem {
+ regulator-off-in-suspend;
+ };
+--
+2.20.1
+
--- /dev/null
+From c2efbc837abb80d973f94b5f73d584b52fd7048f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 14:21:17 +0000
+Subject: ARM: dts: imx7-colibri: disable HS400
+
+From: Stefan Agner <stefan.agner@toradex.com>
+
+[ Upstream commit a95fbda08ee20cd063ce5826e0df95a2c22ea8c5 ]
+
+Force HS200 by masking bit 63 of the SDHCI capability register.
+The i.MX ESDHC driver uses SDHCI_QUIRK2_CAPS_BIT63_FOR_HS400. With
+that the stack checks bit 63 to descide whether HS400 is available.
+Using sdhci-caps-mask allows to mask bit 63. The stack then selects
+HS200 as operating mode.
+
+This prevents rare communication errors with minimal effect on
+performance:
+ sdhci-esdhc-imx 30b60000.usdhc: warning! HS400 strobe DLL
+ status REF not lock!
+
+Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
+Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
+Reviewed-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7-colibri.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi
+index 895fbde4d4333..c1ed83131b495 100644
+--- a/arch/arm/boot/dts/imx7-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7-colibri.dtsi
+@@ -323,6 +323,7 @@
+ vmmc-supply = <®_module_3v3>;
+ vqmmc-supply = <®_DCDC3>;
+ non-removable;
++ sdhci-caps-mask = <0x80000000 0x0>;
+ };
+
+ &iomuxc {
+--
+2.20.1
+
--- /dev/null
+From 0df08c19bb79266e7596efd63ee01218fc313d23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 04:12:27 +0100
+Subject: ARM: dts: imx7d: cl-som-imx7: make ethernet work again
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: André Draszik <git@andred.net>
+
+[ Upstream commit 9846a4524ac90b63496580b7ad50674b40d92a8f ]
+
+Recent changes to the atheros at803x driver caused
+ethernet to stop working on this board.
+In particular commit 6d4cd041f0af
+("net: phy: at803x: disable delay only for RGMII mode")
+and commit cd28d1d6e52e
+("net: phy: at803x: Disable phy delay for RGMII mode")
+fix the AR8031 driver to configure the phy's (RX/TX)
+delays as per the 'phy-mode' in the device tree.
+
+This now prevents ethernet from working on this board.
+
+It used to work before those commits, because the
+AR8031 comes out of reset with RX delay enabled, and
+the at803x driver didn't touch the delay configuration
+at all when "rgmii" mode was selected, and because
+arch/arm/mach-imx/mach-imx7d.c:ar8031_phy_fixup()
+unconditionally enables TX delay.
+
+Since above commits ar8031_phy_fixup() also has no
+effect anymore, and the end-result is that all delays
+are disabled in the phy, no ethernet.
+
+Update the device tree to restore functionality.
+
+Signed-off-by: André Draszik <git@andred.net>
+CC: Ilya Ledvich <ilya@compulab.co.il>
+CC: Igor Grinberg <grinberg@compulab.co.il>
+CC: Rob Herring <robh+dt@kernel.org>
+CC: Mark Rutland <mark.rutland@arm.com>
+CC: Shawn Guo <shawnguo@kernel.org>
+CC: Sascha Hauer <s.hauer@pengutronix.de>
+CC: Pengutronix Kernel Team <kernel@pengutronix.de>
+CC: Fabio Estevam <festevam@gmail.com>
+CC: NXP Linux Team <linux-imx@nxp.com>
+CC: devicetree@vger.kernel.org
+CC: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-cl-som-imx7.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+index e61567437d73c..62d5e9a4a7818 100644
+--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+@@ -44,7 +44,7 @@
+ <&clks IMX7D_ENET1_TIME_ROOT_CLK>;
+ assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>;
+ assigned-clock-rates = <0>, <100000000>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <ðphy0>;
+ fsl,magic-packet;
+ status = "okay";
+@@ -70,7 +70,7 @@
+ <&clks IMX7D_ENET2_TIME_ROOT_CLK>;
+ assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>;
+ assigned-clock-rates = <0>, <100000000>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <ðphy1>;
+ fsl,magic-packet;
+ status = "okay";
+--
+2.20.1
+
--- /dev/null
+From 07141c0c06911b75a1595c445a66f2da57cdd705 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 11:58:08 +0900
+Subject: ARM: OMAP2+: move platform-specific asm-offset.h to
+ arch/arm/mach-omap2
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit ccf4975dca233b1d6a74752d6ab35c239edc0d58 ]
+
+<generated/ti-pm-asm-offsets.h> is only generated and included by
+arch/arm/mach-omap2/, so it does not need to reside in the globally
+visible include/generated/.
+
+I renamed it to arch/arm/mach-omap2/pm-asm-offsets.h since the prefix
+'ti-' is just redundant in mach-omap2/.
+
+My main motivation of this change is to avoid the race condition for
+the parallel build (-j) when CONFIG_IKHEADERS is enabled.
+
+When it is enabled, all the headers under include/ are archived into
+kernel/kheaders_data.tar.xz and exposed in the sysfs.
+
+In the parallel build, we have no idea in which order files are built.
+
+ - If ti-pm-asm-offsets.h is built before kheaders_data.tar.xz,
+ the header will be included in the archive. Probably nobody will
+ use it, but it is harmless except that it will increase the archive
+ size needlessly.
+
+ - If kheaders_data.tar.xz is built before ti-pm-asm-offsets.h,
+ the header will not be included in the archive. However, in the next
+ build, the archive will be re-generated to include the newly-found
+ ti-pm-asm-offsets.h. This is not nice from the build system point
+ of view.
+
+ - If ti-pm-asm-offsets.h and kheaders_data.tar.xz are built at the
+ same time, the corrupted header might be included in the archive,
+ which does not look nice either.
+
+This commit fixes the race.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Tested-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/.gitignore | 1 +
+ arch/arm/mach-omap2/Makefile | 5 +++--
+ arch/arm/mach-omap2/sleep33xx.S | 2 +-
+ arch/arm/mach-omap2/sleep43xx.S | 2 +-
+ 4 files changed, 6 insertions(+), 4 deletions(-)
+ create mode 100644 arch/arm/mach-omap2/.gitignore
+
+diff --git a/arch/arm/mach-omap2/.gitignore b/arch/arm/mach-omap2/.gitignore
+new file mode 100644
+index 0000000000000..79a8d6ea71520
+--- /dev/null
++++ b/arch/arm/mach-omap2/.gitignore
+@@ -0,0 +1 @@
++pm-asm-offsets.h
+diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
+index 6006505516219..21c6d4bca3c0f 100644
+--- a/arch/arm/mach-omap2/Makefile
++++ b/arch/arm/mach-omap2/Makefile
+@@ -223,9 +223,10 @@ obj-y += omap_phy_internal.o
+
+ obj-$(CONFIG_MACH_OMAP2_TUSB6010) += usb-tusb6010.o
+
+-include/generated/ti-pm-asm-offsets.h: arch/arm/mach-omap2/pm-asm-offsets.s FORCE
++$(obj)/pm-asm-offsets.h: $(obj)/pm-asm-offsets.s FORCE
+ $(call filechk,offsets,__TI_PM_ASM_OFFSETS_H__)
+
+-$(obj)/sleep33xx.o $(obj)/sleep43xx.o: include/generated/ti-pm-asm-offsets.h
++$(obj)/sleep33xx.o $(obj)/sleep43xx.o: $(obj)/pm-asm-offsets.h
+
+ targets += pm-asm-offsets.s
++clean-files += pm-asm-offsets.h
+diff --git a/arch/arm/mach-omap2/sleep33xx.S b/arch/arm/mach-omap2/sleep33xx.S
+index 68fee339d3f12..dc221249bc22c 100644
+--- a/arch/arm/mach-omap2/sleep33xx.S
++++ b/arch/arm/mach-omap2/sleep33xx.S
+@@ -6,7 +6,6 @@
+ * Dave Gerlach, Vaibhav Bedia
+ */
+
+-#include <generated/ti-pm-asm-offsets.h>
+ #include <linux/linkage.h>
+ #include <linux/platform_data/pm33xx.h>
+ #include <linux/ti-emif-sram.h>
+@@ -15,6 +14,7 @@
+
+ #include "iomap.h"
+ #include "cm33xx.h"
++#include "pm-asm-offsets.h"
+
+ #define AM33XX_CM_CLKCTRL_MODULESTATE_DISABLED 0x00030000
+ #define AM33XX_CM_CLKCTRL_MODULEMODE_DISABLE 0x0003
+diff --git a/arch/arm/mach-omap2/sleep43xx.S b/arch/arm/mach-omap2/sleep43xx.S
+index c1f4e4852644e..90d2907a2eb27 100644
+--- a/arch/arm/mach-omap2/sleep43xx.S
++++ b/arch/arm/mach-omap2/sleep43xx.S
+@@ -6,7 +6,6 @@
+ * Dave Gerlach, Vaibhav Bedia
+ */
+
+-#include <generated/ti-pm-asm-offsets.h>
+ #include <linux/linkage.h>
+ #include <linux/ti-emif-sram.h>
+ #include <linux/platform_data/pm33xx.h>
+@@ -19,6 +18,7 @@
+ #include "iomap.h"
+ #include "omap-secure.h"
+ #include "omap44xx.h"
++#include "pm-asm-offsets.h"
+ #include "prm33xx.h"
+ #include "prcm43xx.h"
+
+--
+2.20.1
+
--- /dev/null
+From 84963567d8e0a4b43b75ed2350efd99706e7cfa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 18:33:19 +0200
+Subject: ARM: xscale: fix multi-cpu compilation
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c7b68049943079550d4e6af0f10aa3aabd64131a ]
+
+Building a combined ARMv4+XScale kernel produces these
+and other build failures:
+
+/tmp/copypage-xscale-3aa821.s: Assembler messages:
+/tmp/copypage-xscale-3aa821.s:167: Error: selected processor does not support `pld [r7,#0]' in ARM mode
+/tmp/copypage-xscale-3aa821.s:168: Error: selected processor does not support `pld [r7,#32]' in ARM mode
+/tmp/copypage-xscale-3aa821.s:169: Error: selected processor does not support `pld [r1,#0]' in ARM mode
+/tmp/copypage-xscale-3aa821.s:170: Error: selected processor does not support `pld [r1,#32]' in ARM mode
+/tmp/copypage-xscale-3aa821.s:171: Error: selected processor does not support `pld [r7,#64]' in ARM mode
+/tmp/copypage-xscale-3aa821.s:176: Error: selected processor does not support `ldrd r4,r5,[r7],#8' in ARM mode
+/tmp/copypage-xscale-3aa821.s:180: Error: selected processor does not support `strd r4,r5,[r1],#8' in ARM mode
+
+Add an explict .arch armv5 in the inline assembly to allow the ARMv5
+specific instructions regardless of the compiler -march= target.
+
+Link: https://lore.kernel.org/r/20190809163334.489360-5-arnd@arndb.de
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/copypage-xscale.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mm/copypage-xscale.c b/arch/arm/mm/copypage-xscale.c
+index 61d834157bc05..382e1c2855e85 100644
+--- a/arch/arm/mm/copypage-xscale.c
++++ b/arch/arm/mm/copypage-xscale.c
+@@ -42,6 +42,7 @@ static void mc_copy_user_page(void *from, void *to)
+ * when prefetching destination as well. (NP)
+ */
+ asm volatile ("\
++.arch xscale \n\
+ pld [%0, #0] \n\
+ pld [%0, #32] \n\
+ pld [%1, #0] \n\
+@@ -106,8 +107,9 @@ void
+ xscale_mc_clear_user_highpage(struct page *page, unsigned long vaddr)
+ {
+ void *ptr, *kaddr = kmap_atomic(page);
+- asm volatile(
+- "mov r1, %2 \n\
++ asm volatile("\
++.arch xscale \n\
++ mov r1, %2 \n\
+ mov r2, #0 \n\
+ mov r3, #0 \n\
+ 1: mov ip, %0 \n\
+--
+2.20.1
+
--- /dev/null
+From cb199aa2b98429bdfab1b3d6bff04ba47673f04f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jun 2019 18:21:57 +0800
+Subject: arm64: dts: imx8mq: Correct OPP table according to latest datasheet
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 9eced3a2f224a62a233761e8af18c907c532e192 ]
+
+According to latest datasheet (Rev.1, 10/2018) from below links,
+in the consumer datasheet, 1.5GHz is mentioned as highest opp but
+depends on speed grading fuse, and in the industrial datasheet,
+1.3GHz is mentioned as highest opp but depends on speed grading
+fuse. 1.5GHz and 1.3GHz opp use same voltage, so no need for
+consumer part to support 1.3GHz opp, with same voltage, CPU should
+run at highest frequency in order to go into idle as quick as
+possible, this can save power.
+
+That means for consumer part, 1GHz/1.5GHz are supported, for
+industrial part, 800MHz/1.3GHz are supported, and then check the
+speed grading fuse to limit the highest CPU frequency further.
+Correct the market segment bits in opp table to make them work
+according to datasheets.
+
+https://www.nxp.com/docs/en/data-sheet/IMX8MDQLQIEC.pdf
+https://www.nxp.com/docs/en/data-sheet/IMX8MDQLQCEC.pdf
+
+Fixes: 12629c5c3749 ("arm64: dts: imx8mq: Add cpu speed grading and all OPPs")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+index 52aae341d0da5..d1f4eb197af26 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+@@ -169,15 +169,14 @@
+ opp-1300000000 {
+ opp-hz = /bits/ 64 <1300000000>;
+ opp-microvolt = <1000000>;
+- opp-supported-hw = <0xc>, <0x7>;
++ opp-supported-hw = <0xc>, <0x4>;
+ clock-latency-ns = <150000>;
+ };
+
+ opp-1500000000 {
+ opp-hz = /bits/ 64 <1500000000>;
+ opp-microvolt = <1000000>;
+- /* Consumer only but rely on speed grading */
+- opp-supported-hw = <0x8>, <0x7>;
++ opp-supported-hw = <0x8>, <0x3>;
+ clock-latency-ns = <150000>;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From bdf5d32944db10fffba460f3422d156b7dc1cd6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 09:02:48 +0200
+Subject: arm64: dts: meson: fix boards regulators states format
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit f9717178b9be9477877d4c3776c61ff56d854ddf ]
+
+This fixes the following DT schemas check errors:
+meson-gxbb-odroidc2.dt.yaml: gpio-regulator-tf_io: states:0: Additional items are not allowed (1800000, 1 were unexpected)
+meson-gxbb-odroidc2.dt.yaml: gpio-regulator-tf_io: states:0: [3300000, 0, 1800000, 1] is too long
+meson-gxbb-nexbox-a95x.dt.yaml: gpio-regulator: states:0: Additional items are not allowed (3300000, 1 were unexpected)
+meson-gxbb-nexbox-a95x.dt.yaml: gpio-regulator: states:0: [1800000, 0, 3300000, 1] is too long
+meson-gxbb-p200.dt.yaml: gpio-regulator: states:0: Additional items are not allowed (3300000, 1 were unexpected)
+meson-gxbb-p200.dt.yaml: gpio-regulator: states:0: [1800000, 0, 3300000, 1] is too long
+meson-gxl-s905x-hwacom-amazetv.dt.yaml: gpio-regulator: states:0: Additional items are not allowed (3300000, 1 were unexpected)
+meson-gxl-s905x-hwacom-amazetv.dt.yaml: gpio-regulator: states:0: [1800000, 0, 3300000, 1] is too long
+meson-gxbb-p201.dt.yaml: gpio-regulator: states:0: Additional items are not allowed (3300000, 1 were unexpected)
+meson-gxbb-p201.dt.yaml: gpio-regulator: states:0: [1800000, 0, 3300000, 1] is too long
+meson-g12b-odroid-n2.dt.yaml: gpio-regulator-tf_io: states:0: Additional items are not allowed (1800000, 1 were unexpected)
+meson-g12b-odroid-n2.dt.yaml: gpio-regulator-tf_io: states:0: [3300000, 0, 1800000, 1] is too long
+meson-gxl-s905x-nexbox-a95x.dt.yaml: gpio-regulator: states:0: Additional items are not allowed (3300000, 1 were unexpected)
+meson-gxl-s905x-nexbox-a95x.dt.yaml: gpio-regulator: states:0: [1800000, 0, 3300000, 1] is too long
+
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts | 4 ++--
+ arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts | 4 ++--
+ arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 4 ++--
+ arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi | 4 ++--
+ .../arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts | 4 ++--
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts | 4 ++--
+ 6 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
+index 4e916e1f71f76..1c2a9ca491c02 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
+@@ -66,8 +66,8 @@
+ gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>;
+ gpios-states = <0>;
+
+- states = <3300000 0
+- 1800000 1>;
++ states = <3300000 0>,
++ <1800000 1>;
+ };
+
+ flash_1v8: regulator-flash_1v8 {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+index b636912a27157..afcf8a9f667b9 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts
+@@ -75,8 +75,8 @@
+ gpios-states = <1>;
+
+ /* Based on P200 schematics, signal CARD_1.8V/3.3V_CTR */
+- states = <1800000 0
+- 3300000 1>;
++ states = <1800000 0>,
++ <3300000 1>;
+ };
+
+ vddio_boot: regulator-vddio_boot {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index 9972b1515da61..6039adda12eec 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -77,8 +77,8 @@
+ gpios = <&gpio_ao GPIOAO_3 GPIO_ACTIVE_HIGH>;
+ gpios-states = <0>;
+
+- states = <3300000 0
+- 1800000 1>;
++ states = <3300000 0>,
++ <1800000 1>;
+ };
+
+ vcc1v8: regulator-vcc1v8 {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+index e8f925871edfc..89f7b41b0e9ef 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi
+@@ -46,8 +46,8 @@
+ gpios-states = <1>;
+
+ /* Based on P200 schematics, signal CARD_1.8V/3.3V_CTR */
+- states = <1800000 0
+- 3300000 1>;
++ states = <1800000 0>,
++ <3300000 1>;
+
+ regulator-settling-time-up-us = <10000>;
+ regulator-settling-time-down-us = <150000>;
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
+index 796baea7a0bfb..c8d74e61dec18 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts
+@@ -38,8 +38,8 @@
+ gpios-states = <1>;
+
+ /* Based on P200 schematics, signal CARD_1.8V/3.3V_CTR */
+- states = <1800000 0
+- 3300000 1>;
++ states = <1800000 0>,
++ <3300000 1>;
+ };
+
+ vddio_boot: regulator-vddio_boot {
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+index 26907ac829301..c433a031841f6 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts
+@@ -38,8 +38,8 @@
+ gpios-states = <1>;
+
+ /* Based on P200 schematics, signal CARD_1.8V/3.3V_CTR */
+- states = <1800000 0
+- 3300000 1>;
++ states = <1800000 0>,
++ <3300000 1>;
+ };
+
+ vddio_boot: regulator-vddio_boot {
+--
+2.20.1
+
--- /dev/null
+From 166a781ef769e2fc1cd94a300aa9044b94a09e89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2019 20:09:42 -0700
+Subject: arm64: dts: qcom: qcs404-evb: Mark WCSS clocks protected
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 54d895bea43c94f31304d59f82d755b7f4b59e7c ]
+
+'7d0c76bdf227 ("clk: qcom: Add WCSS gcc clock control for QCS404")'
+introduces two new clocks to gcc. These are not used before
+clk_disable_unused() and as such the clock framework tries to disable
+them.
+
+But on the EVB these registers are only accessible through TrustZone, so
+these clocks must be marked as "protected" to prevent the clock code
+from touching them.
+
+Numerical values are used as the constants are not yet available in a
+common tree.
+
+Reviewed-by: Niklas Cassel <niklas.cassel@linaro.org>
+Reported-by: Mark Brown <broonie@kernel.org>
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qcs404-evb.dtsi | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qcs404-evb.dtsi b/arch/arm64/boot/dts/qcom/qcs404-evb.dtsi
+index 11c0a7137823d..db6df76e97a1a 100644
+--- a/arch/arm64/boot/dts/qcom/qcs404-evb.dtsi
++++ b/arch/arm64/boot/dts/qcom/qcs404-evb.dtsi
+@@ -61,7 +61,9 @@
+ protected-clocks = <GCC_BIMC_CDSP_CLK>,
+ <GCC_CDSP_CFG_AHB_CLK>,
+ <GCC_CDSP_BIMC_CLK_SRC>,
+- <GCC_CDSP_TBU_CLK>;
++ <GCC_CDSP_TBU_CLK>,
++ <141>, /* GCC_WCSS_Q6_AHB_CLK */
++ <142>; /* GCC_WCSS_Q6_AXIM_CLK */
+ };
+
+ &pms405_spmi_regulators {
+--
+2.20.1
+
--- /dev/null
+From 6c4a674fbefd91c23ed7c868939211267c1f5f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2019 16:04:50 -0700
+Subject: arm64/efi: Move variable assignments after SECTIONS
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 90776dd1c427cbb4d381aa4b13338f1fb1d20f5e ]
+
+It seems that LLVM's linker does not correctly handle variable assignments
+involving section positions that are updated during the SECTIONS
+parsing. Commit aa69fb62bea1 ("arm64/efi: Mark __efistub_stext_offset as
+an absolute symbol explicitly") ran into this too, but found a different
+workaround.
+
+However, this was not enough, as other variables were also miscalculated
+which manifested as boot failures under UEFI where __efistub__end was
+not taking the correct _end value (they should be the same):
+
+$ ld.lld -EL -maarch64elf --no-undefined -X -shared \
+ -Bsymbolic -z notext -z norelro --no-apply-dynamic-relocs \
+ -o vmlinux.lld -T poc.lds --whole-archive vmlinux.o && \
+ readelf -Ws vmlinux.lld | egrep '\b(__efistub_|)_end\b'
+368272: ffff000002218000 0 NOTYPE LOCAL HIDDEN 38 __efistub__end
+368322: ffff000012318000 0 NOTYPE GLOBAL DEFAULT 38 _end
+
+$ aarch64-linux-gnu-ld.bfd -EL -maarch64elf --no-undefined -X -shared \
+ -Bsymbolic -z notext -z norelro --no-apply-dynamic-relocs \
+ -o vmlinux.bfd -T poc.lds --whole-archive vmlinux.o && \
+ readelf -Ws vmlinux.bfd | egrep '\b(__efistub_|)_end\b'
+338124: ffff000012318000 0 NOTYPE LOCAL DEFAULT ABS __efistub__end
+383812: ffff000012318000 0 NOTYPE GLOBAL DEFAULT 15325 _end
+
+To work around this, all of the __efistub_-prefixed variable assignments
+need to be moved after the linker script's SECTIONS entry. As it turns
+out, this also solves the problem fixed in commit aa69fb62bea1, so those
+changes are reverted here.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/634
+Link: https://bugs.llvm.org/show_bug.cgi?id=42990
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/image-vars.h | 51 +++++++++++++++++++++++++++++++++
+ arch/arm64/kernel/image.h | 42 ---------------------------
+ arch/arm64/kernel/vmlinux.lds.S | 2 ++
+ 3 files changed, 53 insertions(+), 42 deletions(-)
+ create mode 100644 arch/arm64/kernel/image-vars.h
+
+diff --git a/arch/arm64/kernel/image-vars.h b/arch/arm64/kernel/image-vars.h
+new file mode 100644
+index 0000000000000..25a2a9b479c2f
+--- /dev/null
++++ b/arch/arm64/kernel/image-vars.h
+@@ -0,0 +1,51 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Linker script variables to be set after section resolution, as
++ * ld.lld does not like variables assigned before SECTIONS is processed.
++ */
++#ifndef __ARM64_KERNEL_IMAGE_VARS_H
++#define __ARM64_KERNEL_IMAGE_VARS_H
++
++#ifndef LINKER_SCRIPT
++#error This file should only be included in vmlinux.lds.S
++#endif
++
++#ifdef CONFIG_EFI
++
++__efistub_stext_offset = stext - _text;
++
++/*
++ * The EFI stub has its own symbol namespace prefixed by __efistub_, to
++ * isolate it from the kernel proper. The following symbols are legally
++ * accessed by the stub, so provide some aliases to make them accessible.
++ * Only include data symbols here, or text symbols of functions that are
++ * guaranteed to be safe when executed at another offset than they were
++ * linked at. The routines below are all implemented in assembler in a
++ * position independent manner
++ */
++__efistub_memcmp = __pi_memcmp;
++__efistub_memchr = __pi_memchr;
++__efistub_memcpy = __pi_memcpy;
++__efistub_memmove = __pi_memmove;
++__efistub_memset = __pi_memset;
++__efistub_strlen = __pi_strlen;
++__efistub_strnlen = __pi_strnlen;
++__efistub_strcmp = __pi_strcmp;
++__efistub_strncmp = __pi_strncmp;
++__efistub_strrchr = __pi_strrchr;
++__efistub___flush_dcache_area = __pi___flush_dcache_area;
++
++#ifdef CONFIG_KASAN
++__efistub___memcpy = __pi_memcpy;
++__efistub___memmove = __pi_memmove;
++__efistub___memset = __pi_memset;
++#endif
++
++__efistub__text = _text;
++__efistub__end = _end;
++__efistub__edata = _edata;
++__efistub_screen_info = screen_info;
++
++#endif
++
++#endif /* __ARM64_KERNEL_IMAGE_VARS_H */
+diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
+index 2b85c0d6fa3d1..c7d38c660372c 100644
+--- a/arch/arm64/kernel/image.h
++++ b/arch/arm64/kernel/image.h
+@@ -65,46 +65,4 @@
+ DEFINE_IMAGE_LE64(_kernel_offset_le, TEXT_OFFSET); \
+ DEFINE_IMAGE_LE64(_kernel_flags_le, __HEAD_FLAGS);
+
+-#ifdef CONFIG_EFI
+-
+-/*
+- * Use ABSOLUTE() to avoid ld.lld treating this as a relative symbol:
+- * https://github.com/ClangBuiltLinux/linux/issues/561
+- */
+-__efistub_stext_offset = ABSOLUTE(stext - _text);
+-
+-/*
+- * The EFI stub has its own symbol namespace prefixed by __efistub_, to
+- * isolate it from the kernel proper. The following symbols are legally
+- * accessed by the stub, so provide some aliases to make them accessible.
+- * Only include data symbols here, or text symbols of functions that are
+- * guaranteed to be safe when executed at another offset than they were
+- * linked at. The routines below are all implemented in assembler in a
+- * position independent manner
+- */
+-__efistub_memcmp = __pi_memcmp;
+-__efistub_memchr = __pi_memchr;
+-__efistub_memcpy = __pi_memcpy;
+-__efistub_memmove = __pi_memmove;
+-__efistub_memset = __pi_memset;
+-__efistub_strlen = __pi_strlen;
+-__efistub_strnlen = __pi_strnlen;
+-__efistub_strcmp = __pi_strcmp;
+-__efistub_strncmp = __pi_strncmp;
+-__efistub_strrchr = __pi_strrchr;
+-__efistub___flush_dcache_area = __pi___flush_dcache_area;
+-
+-#ifdef CONFIG_KASAN
+-__efistub___memcpy = __pi_memcpy;
+-__efistub___memmove = __pi_memmove;
+-__efistub___memset = __pi_memset;
+-#endif
+-
+-__efistub__text = _text;
+-__efistub__end = _end;
+-__efistub__edata = _edata;
+-__efistub_screen_info = screen_info;
+-
+-#endif
+-
+ #endif /* __ARM64_KERNEL_IMAGE_H */
+diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
+index 7fa0083749078..803b24d2464ae 100644
+--- a/arch/arm64/kernel/vmlinux.lds.S
++++ b/arch/arm64/kernel/vmlinux.lds.S
+@@ -245,6 +245,8 @@ SECTIONS
+ HEAD_SYMBOLS
+ }
+
++#include "image-vars.h"
++
+ /*
+ * The HYP init code and ID map text can't be longer than a page each,
+ * and should not cross a page boundary.
+--
+2.20.1
+
--- /dev/null
+From 32fa2b3de8884b5e2ec445c0475be5dbb6ec7521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 18:45:57 +0100
+Subject: arm64: entry: Move ct_user_exit before any other exception
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 2671828c3ff4ffadf777f793a1f3232d6e51394a ]
+
+When taking an SError or Debug exception from EL0, we run the C
+handler for these exceptions before updating the context tracking
+code and unmasking lower priority interrupts.
+
+When booting with nohz_full lockdep tells us we got this wrong:
+| =============================
+| WARNING: suspicious RCU usage
+| 5.3.0-rc2-00010-gb4b5e9dcb11b-dirty #11271 Not tainted
+| -----------------------------
+| include/linux/rcupdate.h:643 rcu_read_unlock() used illegally wh!
+|
+| other info that might help us debug this:
+|
+|
+| RCU used illegally from idle CPU!
+| rcu_scheduler_active = 2, debug_locks = 1
+| RCU used illegally from extended quiescent state!
+| 1 lock held by a.out/432:
+| #0: 00000000c7a79515 (rcu_read_lock){....}, at: brk_handler+0x00
+|
+| stack backtrace:
+| CPU: 1 PID: 432 Comm: a.out Not tainted 5.3.0-rc2-00010-gb4b5e9d1
+| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno De8
+| Call trace:
+| dump_backtrace+0x0/0x140
+| show_stack+0x14/0x20
+| dump_stack+0xbc/0x104
+| lockdep_rcu_suspicious+0xf8/0x108
+| brk_handler+0x164/0x1b0
+| do_debug_exception+0x11c/0x278
+| el0_dbg+0x14/0x20
+
+Moving the ct_user_exit calls to be before do_debug_exception() means
+they are also before trace_hardirqs_off() has been updated. Add a new
+ct_user_exit_irqoff macro to avoid the context-tracking code using
+irqsave/restore before we've updated trace_hardirqs_off(). To be
+consistent, do this everywhere.
+
+The C helper is called enter_from_user_mode() to match x86 in the hope
+we can merge them into kernel/context_tracking.c later.
+
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Fixes: 6c81fe7925cc4c42 ("arm64: enable context tracking")
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/exception.h | 2 ++
+ arch/arm64/kernel/entry.S | 36 ++++++++++++++++--------------
+ arch/arm64/kernel/traps.c | 9 ++++++++
+ 3 files changed, 30 insertions(+), 17 deletions(-)
+
+diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h
+index ed57b760f38cf..a17393ff66774 100644
+--- a/arch/arm64/include/asm/exception.h
++++ b/arch/arm64/include/asm/exception.h
+@@ -30,4 +30,6 @@ static inline u32 disr_to_esr(u64 disr)
+ return esr;
+ }
+
++asmlinkage void enter_from_user_mode(void);
++
+ #endif /* __ASM_EXCEPTION_H */
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 320a30dbe35ef..84a822748c84e 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -30,9 +30,9 @@
+ * Context tracking subsystem. Used to instrument transitions
+ * between user and kernel mode.
+ */
+- .macro ct_user_exit
++ .macro ct_user_exit_irqoff
+ #ifdef CONFIG_CONTEXT_TRACKING
+- bl context_tracking_user_exit
++ bl enter_from_user_mode
+ #endif
+ .endm
+
+@@ -792,8 +792,8 @@ el0_cp15:
+ /*
+ * Trapped CP15 (MRC, MCR, MRRC, MCRR) instructions
+ */
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, x25
+ mov x1, sp
+ bl do_cp15instr
+@@ -805,8 +805,8 @@ el0_da:
+ * Data abort handling
+ */
+ mrs x26, far_el1
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ clear_address_tag x0, x26
+ mov x1, x25
+ mov x2, sp
+@@ -818,11 +818,11 @@ el0_ia:
+ */
+ mrs x26, far_el1
+ gic_prio_kentry_setup tmp=x0
++ ct_user_exit_irqoff
+ enable_da_f
+ #ifdef CONFIG_TRACE_IRQFLAGS
+ bl trace_hardirqs_off
+ #endif
+- ct_user_exit
+ mov x0, x26
+ mov x1, x25
+ mov x2, sp
+@@ -832,8 +832,8 @@ el0_fpsimd_acc:
+ /*
+ * Floating Point or Advanced SIMD access
+ */
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, x25
+ mov x1, sp
+ bl do_fpsimd_acc
+@@ -842,8 +842,8 @@ el0_sve_acc:
+ /*
+ * Scalable Vector Extension access
+ */
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, x25
+ mov x1, sp
+ bl do_sve_acc
+@@ -852,8 +852,8 @@ el0_fpsimd_exc:
+ /*
+ * Floating Point, Advanced SIMD or SVE exception
+ */
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, x25
+ mov x1, sp
+ bl do_fpsimd_exc
+@@ -868,11 +868,11 @@ el0_sp_pc:
+ * Stack or PC alignment exception handling
+ */
+ gic_prio_kentry_setup tmp=x0
++ ct_user_exit_irqoff
+ enable_da_f
+ #ifdef CONFIG_TRACE_IRQFLAGS
+ bl trace_hardirqs_off
+ #endif
+- ct_user_exit
+ mov x0, x26
+ mov x1, x25
+ mov x2, sp
+@@ -882,8 +882,8 @@ el0_undef:
+ /*
+ * Undefined instruction
+ */
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, sp
+ bl do_undefinstr
+ b ret_to_user
+@@ -891,8 +891,8 @@ el0_sys:
+ /*
+ * System instructions, for trapped cache maintenance instructions
+ */
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, x25
+ mov x1, sp
+ bl do_sysinstr
+@@ -902,17 +902,18 @@ el0_dbg:
+ * Debug exception handling
+ */
+ tbnz x24, #0, el0_inv // EL0 only
++ mrs x24, far_el1
+ gic_prio_kentry_setup tmp=x3
+- mrs x0, far_el1
++ ct_user_exit_irqoff
++ mov x0, x24
+ mov x1, x25
+ mov x2, sp
+ bl do_debug_exception
+ enable_da_f
+- ct_user_exit
+ b ret_to_user
+ el0_inv:
++ ct_user_exit_irqoff
+ enable_daif
+- ct_user_exit
+ mov x0, sp
+ mov x1, #BAD_SYNC
+ mov x2, x25
+@@ -925,13 +926,13 @@ el0_irq:
+ kernel_entry 0
+ el0_irq_naked:
+ gic_prio_irq_setup pmr=x20, tmp=x0
++ ct_user_exit_irqoff
+ enable_da_f
+
+ #ifdef CONFIG_TRACE_IRQFLAGS
+ bl trace_hardirqs_off
+ #endif
+
+- ct_user_exit
+ #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+ tbz x22, #55, 1f
+ bl do_el0_irq_bp_hardening
+@@ -958,13 +959,14 @@ ENDPROC(el1_error)
+ el0_error:
+ kernel_entry 0
+ el0_error_naked:
+- mrs x1, esr_el1
++ mrs x25, esr_el1
+ gic_prio_kentry_setup tmp=x2
++ ct_user_exit_irqoff
+ enable_dbg
+ mov x0, sp
++ mov x1, x25
+ bl do_serror
+ enable_da_f
+- ct_user_exit
+ b ret_to_user
+ ENDPROC(el0_error)
+
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 32893b3d9164e..742a636861e77 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -7,9 +7,11 @@
+ */
+
+ #include <linux/bug.h>
++#include <linux/context_tracking.h>
+ #include <linux/signal.h>
+ #include <linux/personality.h>
+ #include <linux/kallsyms.h>
++#include <linux/kprobes.h>
+ #include <linux/spinlock.h>
+ #include <linux/uaccess.h>
+ #include <linux/hardirq.h>
+@@ -900,6 +902,13 @@ asmlinkage void do_serror(struct pt_regs *regs, unsigned int esr)
+ nmi_exit();
+ }
+
++asmlinkage void enter_from_user_mode(void)
++{
++ CT_WARN_ON(ct_state() != CONTEXT_USER);
++ user_exit_irqoff();
++}
++NOKPROBE_SYMBOL(enter_from_user_mode);
++
+ void __pte_error(const char *file, int line, unsigned long val)
+ {
+ pr_err("%s:%d: bad pte %016lx.\n", file, line, val);
+--
+2.20.1
+
--- /dev/null
+From c896c4abfa788a860e74f8132fe51c108581d0cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 18:12:57 +0100
+Subject: arm64: kpti: ensure patched kernel text is fetched from PoU
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit f32c7a8e45105bd0af76872bf6eef0438ff12fb2 ]
+
+While the MMUs is disabled, I-cache speculation can result in
+instructions being fetched from the PoC. During boot we may patch
+instructions (e.g. for alternatives and jump labels), and these may be
+dirty at the PoU (and stale at the PoC).
+
+Thus, while the MMU is disabled in the KPTI pagetable fixup code we may
+load stale instructions into the I-cache, potentially leading to
+subsequent crashes when executing regions of code which have been
+modified at runtime.
+
+Similarly to commit:
+
+ 8ec41987436d566f ("arm64: mm: ensure patched kernel text is fetched from PoU")
+
+... we can invalidate the I-cache after enabling the MMU to prevent such
+issues.
+
+The KPTI pagetable fixup code itself should be clean to the PoC per the
+boot protocol, so no maintenance is required for this code.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Reviewed-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/proc.S | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
+index 7dbf2be470f6c..28a8f7b87ff06 100644
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -286,6 +286,15 @@ skip_pgd:
+ msr sctlr_el1, x18
+ isb
+
++ /*
++ * Invalidate the local I-cache so that any instructions fetched
++ * speculatively from the PoC are discarded, since they may have
++ * been dynamically patched at the PoU.
++ */
++ ic iallu
++ dsb nsh
++ isb
++
+ /* Set the flag to zero to indicate that we're all done */
+ str wzr, [flag_ptr]
+ ret
+--
+2.20.1
+
--- /dev/null
+From 16983ff5bf56b86f9d83d79e5b85c2da691132aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 11:52:47 +0100
+Subject: arm64: lse: Make ARM64_LSE_ATOMICS depend on JUMP_LABEL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit b32baf91f60fb9c7010bff87e68132f2ce31d9a8 ]
+
+Support for LSE atomic instructions (CONFIG_ARM64_LSE_ATOMICS) relies on
+a static key to select between the legacy LL/SC implementation which is
+available on all arm64 CPUs and the super-duper LSE implementation which
+is available on CPUs implementing v8.1 and later.
+
+Unfortunately, when building a kernel with CONFIG_JUMP_LABEL disabled
+(e.g. because the toolchain doesn't support 'asm goto'), the static key
+inside the atomics code tries to use atomics itself. This results in a
+mess of circular includes and a build failure:
+
+In file included from ./arch/arm64/include/asm/lse.h:11,
+ from ./arch/arm64/include/asm/atomic.h:16,
+ from ./include/linux/atomic.h:7,
+ from ./include/asm-generic/bitops/atomic.h:5,
+ from ./arch/arm64/include/asm/bitops.h:26,
+ from ./include/linux/bitops.h:19,
+ from ./include/linux/kernel.h:12,
+ from ./include/asm-generic/bug.h:18,
+ from ./arch/arm64/include/asm/bug.h:26,
+ from ./include/linux/bug.h:5,
+ from ./include/linux/page-flags.h:10,
+ from kernel/bounds.c:10:
+./include/linux/jump_label.h: In function ‘static_key_count’:
+./include/linux/jump_label.h:254:9: error: implicit declaration of function ‘atomic_read’ [-Werror=implicit-function-declaration]
+ return atomic_read(&key->enabled);
+ ^~~~~~~~~~~
+
+[ ... more of the same ... ]
+
+Since LSE atomic instructions are not critical to the operation of the
+kernel, make them depend on JUMP_LABEL at compile time.
+
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index 3adcec05b1f67..27405ac94228b 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1263,6 +1263,7 @@ config ARM64_PAN
+
+ config ARM64_LSE_ATOMICS
+ bool "Atomic instructions"
++ depends on JUMP_LABEL
+ default y
+ help
+ As part of the Large System Extensions, ARMv8.1 introduces new
+--
+2.20.1
+
--- /dev/null
+From 41d0ca047aedff72922c6bdaffbee0b0a07b935a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jul 2019 14:41:15 +0800
+Subject: arm64: mm: free the initrd reserved memblock in a aligned manner
+
+From: Junhua Huang <huang.junhua@zte.com.cn>
+
+[ Upstream commit 13776f9d40a028a245bb766269e360f5b7a62721 ]
+
+We should free the initrd reserved memblock in an aligned manner,
+because the initrd reserves the memblock in an aligned manner
+in arm64_memblock_init().
+Otherwise there are some fragments in memblock_reserved regions
+after free_initrd_mem(). e.g.:
+/sys/kernel/debug/memblock # cat reserved
+ 0: 0x0000000080080000..0x00000000817fafff
+ 1: 0x0000000083400000..0x0000000083ffffff
+ 2: 0x0000000090000000..0x000000009000407f
+ 3: 0x00000000b0000000..0x00000000b000003f
+ 4: 0x00000000b26184ea..0x00000000b2618fff
+The fragments like the ranges from b0000000 to b000003f and
+from b26184ea to b2618fff should be freed.
+
+And we can do free_reserved_area() after memblock_free(),
+as free_reserved_area() calls __free_pages(), once we've done
+that it could be allocated somewhere else,
+but memblock and iomem still say this is reserved memory.
+
+Fixes: 05c58752f9dc ("arm64: To remove initrd reserved area entry from memblock")
+Signed-off-by: Junhua Huang <huang.junhua@zte.com.cn>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/init.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index f3c795278def0..b1ee6cb4b17fc 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -570,8 +570,12 @@ void free_initmem(void)
+ #ifdef CONFIG_BLK_DEV_INITRD
+ void __init free_initrd_mem(unsigned long start, unsigned long end)
+ {
++ unsigned long aligned_start, aligned_end;
++
++ aligned_start = __virt_to_phys(start) & PAGE_MASK;
++ aligned_end = PAGE_ALIGN(__virt_to_phys(end));
++ memblock_free(aligned_start, aligned_end - aligned_start);
+ free_reserved_area((void *)start, (void *)end, 0, "initrd");
+- memblock_free(__virt_to_phys(start), end - start);
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From de322b59dca6444057a5eeabac96b67e8dbc9aa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2019 23:05:03 -0400
+Subject: arm64/prefetch: fix a -Wtype-limits warning
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit b99286b088ea843b935dcfb29f187697359fe5cd ]
+
+The commit d5370f754875 ("arm64: prefetch: add alternative pattern for
+CPUs without a prefetcher") introduced MIDR_IS_CPU_MODEL_RANGE() to be
+used in has_no_hw_prefetch() with rv_min=0 which generates a compilation
+warning from GCC,
+
+In file included from ./arch/arm64/include/asm/cache.h:8,
+ from ./include/linux/cache.h:6,
+ from ./include/linux/printk.h:9,
+ from ./include/linux/kernel.h:15,
+ from ./include/linux/cpumask.h:10,
+ from arch/arm64/kernel/cpufeature.c:11:
+arch/arm64/kernel/cpufeature.c: In function 'has_no_hw_prefetch':
+./arch/arm64/include/asm/cputype.h:59:26: warning: comparison of
+unsigned expression >= 0 is always true [-Wtype-limits]
+_model == (model) && rv >= (rv_min) && rv <= (rv_max); \
+ ^~
+arch/arm64/kernel/cpufeature.c:889:9: note: in expansion of macro
+'MIDR_IS_CPU_MODEL_RANGE'
+return MIDR_IS_CPU_MODEL_RANGE(midr, MIDR_THUNDERX,
+ ^~~~~~~~~~~~~~~~~~~~~~~
+
+Fix it by converting MIDR_IS_CPU_MODEL_RANGE to a static inline
+function.
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/cputype.h | 21 +++++++++++----------
+ arch/arm64/kernel/cpufeature.c | 2 +-
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
+index e7d46631cc42b..b1454d117cd2c 100644
+--- a/arch/arm64/include/asm/cputype.h
++++ b/arch/arm64/include/asm/cputype.h
+@@ -51,14 +51,6 @@
+ #define MIDR_CPU_MODEL_MASK (MIDR_IMPLEMENTOR_MASK | MIDR_PARTNUM_MASK | \
+ MIDR_ARCHITECTURE_MASK)
+
+-#define MIDR_IS_CPU_MODEL_RANGE(midr, model, rv_min, rv_max) \
+-({ \
+- u32 _model = (midr) & MIDR_CPU_MODEL_MASK; \
+- u32 rv = (midr) & (MIDR_REVISION_MASK | MIDR_VARIANT_MASK); \
+- \
+- _model == (model) && rv >= (rv_min) && rv <= (rv_max); \
+- })
+-
+ #define ARM_CPU_IMP_ARM 0x41
+ #define ARM_CPU_IMP_APM 0x50
+ #define ARM_CPU_IMP_CAVIUM 0x43
+@@ -159,10 +151,19 @@ struct midr_range {
+ #define MIDR_REV(m, v, r) MIDR_RANGE(m, v, r, v, r)
+ #define MIDR_ALL_VERSIONS(m) MIDR_RANGE(m, 0, 0, 0xf, 0xf)
+
++static inline bool midr_is_cpu_model_range(u32 midr, u32 model, u32 rv_min,
++ u32 rv_max)
++{
++ u32 _model = midr & MIDR_CPU_MODEL_MASK;
++ u32 rv = midr & (MIDR_REVISION_MASK | MIDR_VARIANT_MASK);
++
++ return _model == model && rv >= rv_min && rv <= rv_max;
++}
++
+ static inline bool is_midr_in_range(u32 midr, struct midr_range const *range)
+ {
+- return MIDR_IS_CPU_MODEL_RANGE(midr, range->model,
+- range->rv_min, range->rv_max);
++ return midr_is_cpu_model_range(midr, range->model,
++ range->rv_min, range->rv_max);
+ }
+
+ static inline bool
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index b1fdc486aed82..9323bcc40a58a 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -894,7 +894,7 @@ static bool has_no_hw_prefetch(const struct arm64_cpu_capabilities *entry, int _
+ u32 midr = read_cpuid_id();
+
+ /* Cavium ThunderX pass 1.x and 2.x */
+- return MIDR_IS_CPU_MODEL_RANGE(midr, MIDR_THUNDERX,
++ return midr_is_cpu_model_range(midr, MIDR_THUNDERX,
+ MIDR_CPU_VAR_REV(0, 0),
+ MIDR_CPU_VAR_REV(1, MIDR_REVISION_MASK));
+ }
+--
+2.20.1
+
--- /dev/null
+From 206632c4838e6b6c7c6519757bbf3f7d66f50bfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 18:50:06 +0100
+Subject: arm64: Use correct ll/sc atomic constraints
+
+From: Andrew Murray <andrew.murray@arm.com>
+
+[ Upstream commit 580fa1b874711d633f9b145b7777b0e83ebf3787 ]
+
+The A64 ISA accepts distinct (but overlapping) ranges of immediates for:
+
+ * add arithmetic instructions ('I' machine constraint)
+ * sub arithmetic instructions ('J' machine constraint)
+ * 32-bit logical instructions ('K' machine constraint)
+ * 64-bit logical instructions ('L' machine constraint)
+
+... but we currently use the 'I' constraint for many atomic operations
+using sub or logical instructions, which is not always valid.
+
+When CONFIG_ARM64_LSE_ATOMICS is not set, this allows invalid immediates
+to be passed to instructions, potentially resulting in a build failure.
+When CONFIG_ARM64_LSE_ATOMICS is selected the out-of-line ll/sc atomics
+always use a register as they have no visibility of the value passed by
+the caller.
+
+This patch adds a constraint parameter to the ATOMIC_xx and
+__CMPXCHG_CASE macros so that we can pass appropriate constraints for
+each case, with uses updated accordingly.
+
+Unfortunately prior to GCC 8.1.0 the 'K' constraint erroneously accepted
+'4294967295', so we must instead force the use of a register.
+
+Signed-off-by: Andrew Murray <andrew.murray@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/atomic_ll_sc.h | 89 ++++++++++++++-------------
+ 1 file changed, 47 insertions(+), 42 deletions(-)
+
+diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
+index c8c850bc3dfb0..6dd011e0b434a 100644
+--- a/arch/arm64/include/asm/atomic_ll_sc.h
++++ b/arch/arm64/include/asm/atomic_ll_sc.h
+@@ -26,7 +26,7 @@
+ * (the optimize attribute silently ignores these options).
+ */
+
+-#define ATOMIC_OP(op, asm_op) \
++#define ATOMIC_OP(op, asm_op, constraint) \
+ __LL_SC_INLINE void \
+ __LL_SC_PREFIX(arch_atomic_##op(int i, atomic_t *v)) \
+ { \
+@@ -40,11 +40,11 @@ __LL_SC_PREFIX(arch_atomic_##op(int i, atomic_t *v)) \
+ " stxr %w1, %w0, %2\n" \
+ " cbnz %w1, 1b" \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i)); \
++ : #constraint "r" (i)); \
+ } \
+ __LL_SC_EXPORT(arch_atomic_##op);
+
+-#define ATOMIC_OP_RETURN(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC_OP_RETURN(name, mb, acq, rel, cl, op, asm_op, constraint)\
+ __LL_SC_INLINE int \
+ __LL_SC_PREFIX(arch_atomic_##op##_return##name(int i, atomic_t *v)) \
+ { \
+@@ -59,14 +59,14 @@ __LL_SC_PREFIX(arch_atomic_##op##_return##name(int i, atomic_t *v)) \
+ " cbnz %w1, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+ } \
+ __LL_SC_EXPORT(arch_atomic_##op##_return##name);
+
+-#define ATOMIC_FETCH_OP(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC_FETCH_OP(name, mb, acq, rel, cl, op, asm_op, constraint) \
+ __LL_SC_INLINE int \
+ __LL_SC_PREFIX(arch_atomic_fetch_##op##name(int i, atomic_t *v)) \
+ { \
+@@ -81,7 +81,7 @@ __LL_SC_PREFIX(arch_atomic_fetch_##op##name(int i, atomic_t *v)) \
+ " cbnz %w2, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (val), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+@@ -99,8 +99,8 @@ __LL_SC_EXPORT(arch_atomic_fetch_##op##name);
+ ATOMIC_FETCH_OP (_acquire, , a, , "memory", __VA_ARGS__)\
+ ATOMIC_FETCH_OP (_release, , , l, "memory", __VA_ARGS__)
+
+-ATOMIC_OPS(add, add)
+-ATOMIC_OPS(sub, sub)
++ATOMIC_OPS(add, add, I)
++ATOMIC_OPS(sub, sub, J)
+
+ #undef ATOMIC_OPS
+ #define ATOMIC_OPS(...) \
+@@ -110,17 +110,17 @@ ATOMIC_OPS(sub, sub)
+ ATOMIC_FETCH_OP (_acquire, , a, , "memory", __VA_ARGS__)\
+ ATOMIC_FETCH_OP (_release, , , l, "memory", __VA_ARGS__)
+
+-ATOMIC_OPS(and, and)
+-ATOMIC_OPS(andnot, bic)
+-ATOMIC_OPS(or, orr)
+-ATOMIC_OPS(xor, eor)
++ATOMIC_OPS(and, and, )
++ATOMIC_OPS(andnot, bic, )
++ATOMIC_OPS(or, orr, )
++ATOMIC_OPS(xor, eor, )
+
+ #undef ATOMIC_OPS
+ #undef ATOMIC_FETCH_OP
+ #undef ATOMIC_OP_RETURN
+ #undef ATOMIC_OP
+
+-#define ATOMIC64_OP(op, asm_op) \
++#define ATOMIC64_OP(op, asm_op, constraint) \
+ __LL_SC_INLINE void \
+ __LL_SC_PREFIX(arch_atomic64_##op(s64 i, atomic64_t *v)) \
+ { \
+@@ -134,11 +134,11 @@ __LL_SC_PREFIX(arch_atomic64_##op(s64 i, atomic64_t *v)) \
+ " stxr %w1, %0, %2\n" \
+ " cbnz %w1, 1b" \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i)); \
++ : #constraint "r" (i)); \
+ } \
+ __LL_SC_EXPORT(arch_atomic64_##op);
+
+-#define ATOMIC64_OP_RETURN(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC64_OP_RETURN(name, mb, acq, rel, cl, op, asm_op, constraint)\
+ __LL_SC_INLINE s64 \
+ __LL_SC_PREFIX(arch_atomic64_##op##_return##name(s64 i, atomic64_t *v))\
+ { \
+@@ -153,14 +153,14 @@ __LL_SC_PREFIX(arch_atomic64_##op##_return##name(s64 i, atomic64_t *v))\
+ " cbnz %w1, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+ } \
+ __LL_SC_EXPORT(arch_atomic64_##op##_return##name);
+
+-#define ATOMIC64_FETCH_OP(name, mb, acq, rel, cl, op, asm_op) \
++#define ATOMIC64_FETCH_OP(name, mb, acq, rel, cl, op, asm_op, constraint)\
+ __LL_SC_INLINE s64 \
+ __LL_SC_PREFIX(arch_atomic64_fetch_##op##name(s64 i, atomic64_t *v)) \
+ { \
+@@ -175,7 +175,7 @@ __LL_SC_PREFIX(arch_atomic64_fetch_##op##name(s64 i, atomic64_t *v)) \
+ " cbnz %w2, 1b\n" \
+ " " #mb \
+ : "=&r" (result), "=&r" (val), "=&r" (tmp), "+Q" (v->counter) \
+- : "Ir" (i) \
++ : #constraint "r" (i) \
+ : cl); \
+ \
+ return result; \
+@@ -193,8 +193,8 @@ __LL_SC_EXPORT(arch_atomic64_fetch_##op##name);
+ ATOMIC64_FETCH_OP (_acquire,, a, , "memory", __VA_ARGS__) \
+ ATOMIC64_FETCH_OP (_release,, , l, "memory", __VA_ARGS__)
+
+-ATOMIC64_OPS(add, add)
+-ATOMIC64_OPS(sub, sub)
++ATOMIC64_OPS(add, add, I)
++ATOMIC64_OPS(sub, sub, J)
+
+ #undef ATOMIC64_OPS
+ #define ATOMIC64_OPS(...) \
+@@ -204,10 +204,10 @@ ATOMIC64_OPS(sub, sub)
+ ATOMIC64_FETCH_OP (_acquire,, a, , "memory", __VA_ARGS__) \
+ ATOMIC64_FETCH_OP (_release,, , l, "memory", __VA_ARGS__)
+
+-ATOMIC64_OPS(and, and)
+-ATOMIC64_OPS(andnot, bic)
+-ATOMIC64_OPS(or, orr)
+-ATOMIC64_OPS(xor, eor)
++ATOMIC64_OPS(and, and, L)
++ATOMIC64_OPS(andnot, bic, )
++ATOMIC64_OPS(or, orr, L)
++ATOMIC64_OPS(xor, eor, L)
+
+ #undef ATOMIC64_OPS
+ #undef ATOMIC64_FETCH_OP
+@@ -237,7 +237,7 @@ __LL_SC_PREFIX(arch_atomic64_dec_if_positive(atomic64_t *v))
+ }
+ __LL_SC_EXPORT(arch_atomic64_dec_if_positive);
+
+-#define __CMPXCHG_CASE(w, sfx, name, sz, mb, acq, rel, cl) \
++#define __CMPXCHG_CASE(w, sfx, name, sz, mb, acq, rel, cl, constraint) \
+ __LL_SC_INLINE u##sz \
+ __LL_SC_PREFIX(__cmpxchg_case_##name##sz(volatile void *ptr, \
+ unsigned long old, \
+@@ -265,29 +265,34 @@ __LL_SC_PREFIX(__cmpxchg_case_##name##sz(volatile void *ptr, \
+ "2:" \
+ : [tmp] "=&r" (tmp), [oldval] "=&r" (oldval), \
+ [v] "+Q" (*(u##sz *)ptr) \
+- : [old] "Kr" (old), [new] "r" (new) \
++ : [old] #constraint "r" (old), [new] "r" (new) \
+ : cl); \
+ \
+ return oldval; \
+ } \
+ __LL_SC_EXPORT(__cmpxchg_case_##name##sz);
+
+-__CMPXCHG_CASE(w, b, , 8, , , , )
+-__CMPXCHG_CASE(w, h, , 16, , , , )
+-__CMPXCHG_CASE(w, , , 32, , , , )
+-__CMPXCHG_CASE( , , , 64, , , , )
+-__CMPXCHG_CASE(w, b, acq_, 8, , a, , "memory")
+-__CMPXCHG_CASE(w, h, acq_, 16, , a, , "memory")
+-__CMPXCHG_CASE(w, , acq_, 32, , a, , "memory")
+-__CMPXCHG_CASE( , , acq_, 64, , a, , "memory")
+-__CMPXCHG_CASE(w, b, rel_, 8, , , l, "memory")
+-__CMPXCHG_CASE(w, h, rel_, 16, , , l, "memory")
+-__CMPXCHG_CASE(w, , rel_, 32, , , l, "memory")
+-__CMPXCHG_CASE( , , rel_, 64, , , l, "memory")
+-__CMPXCHG_CASE(w, b, mb_, 8, dmb ish, , l, "memory")
+-__CMPXCHG_CASE(w, h, mb_, 16, dmb ish, , l, "memory")
+-__CMPXCHG_CASE(w, , mb_, 32, dmb ish, , l, "memory")
+-__CMPXCHG_CASE( , , mb_, 64, dmb ish, , l, "memory")
++/*
++ * Earlier versions of GCC (no later than 8.1.0) appear to incorrectly
++ * handle the 'K' constraint for the value 4294967295 - thus we use no
++ * constraint for 32 bit operations.
++ */
++__CMPXCHG_CASE(w, b, , 8, , , , , )
++__CMPXCHG_CASE(w, h, , 16, , , , , )
++__CMPXCHG_CASE(w, , , 32, , , , , )
++__CMPXCHG_CASE( , , , 64, , , , , L)
++__CMPXCHG_CASE(w, b, acq_, 8, , a, , "memory", )
++__CMPXCHG_CASE(w, h, acq_, 16, , a, , "memory", )
++__CMPXCHG_CASE(w, , acq_, 32, , a, , "memory", )
++__CMPXCHG_CASE( , , acq_, 64, , a, , "memory", L)
++__CMPXCHG_CASE(w, b, rel_, 8, , , l, "memory", )
++__CMPXCHG_CASE(w, h, rel_, 16, , , l, "memory", )
++__CMPXCHG_CASE(w, , rel_, 32, , , l, "memory", )
++__CMPXCHG_CASE( , , rel_, 64, , , l, "memory", L)
++__CMPXCHG_CASE(w, b, mb_, 8, dmb ish, , l, "memory", )
++__CMPXCHG_CASE(w, h, mb_, 16, dmb ish, , l, "memory", )
++__CMPXCHG_CASE(w, , mb_, 32, dmb ish, , l, "memory", )
++__CMPXCHG_CASE( , , mb_, 64, dmb ish, , l, "memory", L)
+
+ #undef __CMPXCHG_CASE
+
+--
+2.20.1
+
--- /dev/null
+From 369e70dc8ff07ccc388ca281b0a5b4e81a7d4668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2019 08:55:24 +0300
+Subject: ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is
+ not set
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 2ec42f3147e1610716f184b02e65d7f493eed925 ]
+
+Some tools use the snd_pcm_info_get_name() to try to identify PCMs or for
+other purposes.
+
+Currently it is left empty with the dmaengine-pcm, in this case copy the
+pcm->id string as pcm->name.
+
+For example IGT is using this to find the HDMI PCM for testing audio on it.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reported-by: Arthur She <arthur.she@linaro.org>
+Link: https://lore.kernel.org/r/20190906055524.7393-1-peter.ujfalusi@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-generic-dmaengine-pcm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c
+index 748f5f641002e..d93db2c2b5270 100644
+--- a/sound/soc/soc-generic-dmaengine-pcm.c
++++ b/sound/soc/soc-generic-dmaengine-pcm.c
+@@ -306,6 +306,12 @@ static int dmaengine_pcm_new(struct snd_soc_pcm_runtime *rtd)
+
+ if (!dmaengine_pcm_can_report_residue(dev, pcm->chan[i]))
+ pcm->flags |= SND_DMAENGINE_PCM_FLAG_NO_RESIDUE;
++
++ if (rtd->pcm->streams[i].pcm->name[0] == '\0') {
++ strncpy(rtd->pcm->streams[i].pcm->name,
++ rtd->pcm->streams[i].pcm->id,
++ sizeof(rtd->pcm->streams[i].pcm->name));
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From b69eefad0d047d4654d6a3978e66a60595faee55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 14:52:05 +0200
+Subject: ASoC: dt-bindings: sun4i-spdif: Fix dma-names warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 1a8e7cdfa4f5872bf0c202d09bff6628aba6b9f6 ]
+
+Even though the H6 compatible has been properly added, the exeption for the
+number of DMA channels hasn't been updated, leading in a validation
+warning.
+
+Fix this.
+
+Fixes: b20453031472 ("dt-bindings: sound: sun4i-spdif: Add Allwinner H6 compatible")
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://lore.kernel.org/r/20190828125209.28173-1-mripard@kernel.org
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml b/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml
+index e0284d8c3b636..38d4cede0860d 100644
+--- a/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml
++++ b/Documentation/devicetree/bindings/sound/allwinner,sun4i-a10-spdif.yaml
+@@ -70,7 +70,9 @@ allOf:
+ properties:
+ compatible:
+ contains:
+- const: allwinner,sun8i-h3-spdif
++ enum:
++ - allwinner,sun8i-h3-spdif
++ - allwinner,sun50i-h6-spdif
+
+ then:
+ properties:
+--
+2.20.1
+
--- /dev/null
+From 0d984b070e979673a1c7baef5c37baf145b2e467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 00:38:59 +0900
+Subject: ASoC: es8316: fix headphone mixer volume table
+
+From: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+
+[ Upstream commit f972d02fee2496024cfd6f59021c9d89d54922a6 ]
+
+This patch fix setting table of Headphone mixer volume.
+Current code uses 4 ... 7 values but these values are prohibited.
+
+Correct settings are the following:
+ 0000 -12dB
+ 0001 -10.5dB
+ 0010 -9dB
+ 0011 -7.5dB
+ 0100 -6dB
+ 1000 -4.5dB
+ 1001 -3dB
+ 1010 -1.5dB
+ 1011 0dB
+
+Signed-off-by: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+Reviewed-by: Daniel Drake <drake@endlessm.com>
+Link: https://lore.kernel.org/r/20190826153900.25969-1-katsuhiro@katsuster.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 6db002cc20582..96d04896193f2 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -51,7 +51,10 @@ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(adc_vol_tlv, -9600, 50, 1);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_max_gain_tlv, -650, 150, 0);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_min_gain_tlv, -1200, 150, 0);
+ static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(alc_target_tlv, -1650, 150, 0);
+-static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(hpmixer_gain_tlv, -1200, 150, 0);
++static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(hpmixer_gain_tlv,
++ 0, 4, TLV_DB_SCALE_ITEM(-1200, 150, 0),
++ 8, 11, TLV_DB_SCALE_ITEM(-450, 150, 0),
++);
+
+ static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(adc_pga_gain_tlv,
+ 0, 0, TLV_DB_SCALE_ITEM(-350, 0, 0),
+@@ -89,7 +92,7 @@ static const struct snd_kcontrol_new es8316_snd_controls[] = {
+ SOC_DOUBLE_TLV("Headphone Playback Volume", ES8316_CPHP_ICAL_VOL,
+ 4, 0, 3, 1, hpout_vol_tlv),
+ SOC_DOUBLE_TLV("Headphone Mixer Volume", ES8316_HPMIX_VOL,
+- 0, 4, 7, 0, hpmixer_gain_tlv),
++ 0, 4, 11, 0, hpmixer_gain_tlv),
+
+ SOC_ENUM("Playback Polarity", dacpol),
+ SOC_DOUBLE_R_TLV("DAC Playback Volume", ES8316_DAC_VOLL,
+--
+2.20.1
+
--- /dev/null
+From 75131a2210a21e33bd02fbd536157f45aa6932a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 13:20:17 -0400
+Subject: ASoC: fsl_ssi: Fix clock control issue in master mode
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 696d05225cebffd172008d212657be90e823eac0 ]
+
+The test case is
+arecord -Dhw:0 -d 10 -f S16_LE -r 48000 -c 2 temp.wav &
+aplay -Dhw:0 -d 30 -f S16_LE -r 48000 -c 2 test.wav
+
+There will be error after end of arecord:
+aplay: pcm_write:2051: write error: Input/output error
+
+Capture and Playback work in parallel in master mode, one
+substream stops, the other substream is impacted, the
+reason is that clock is disabled wrongly.
+
+The clock's reference count is not increased when second
+substream starts, the hw_param() function returns in the
+beginning because first substream is enabled, then in end
+of first substream, the hw_free() disables the clock.
+
+This patch is to move the clock enablement to the place
+before checking of the device enablement in hw_param().
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1567012817-12625-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_ssi.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
+index fa862af25c1a3..085855f9b08d4 100644
+--- a/sound/soc/fsl/fsl_ssi.c
++++ b/sound/soc/fsl/fsl_ssi.c
+@@ -799,15 +799,6 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream,
+ u32 wl = SSI_SxCCR_WL(sample_size);
+ int ret;
+
+- /*
+- * SSI is properly configured if it is enabled and running in
+- * the synchronous mode; Note that AC97 mode is an exception
+- * that should set separate configurations for STCCR and SRCCR
+- * despite running in the synchronous mode.
+- */
+- if (ssi->streams && ssi->synchronous)
+- return 0;
+-
+ if (fsl_ssi_is_i2s_master(ssi)) {
+ ret = fsl_ssi_set_bclk(substream, dai, hw_params);
+ if (ret)
+@@ -823,6 +814,15 @@ static int fsl_ssi_hw_params(struct snd_pcm_substream *substream,
+ }
+ }
+
++ /*
++ * SSI is properly configured if it is enabled and running in
++ * the synchronous mode; Note that AC97 mode is an exception
++ * that should set separate configurations for STCCR and SRCCR
++ * despite running in the synchronous mode.
++ */
++ if (ssi->streams && ssi->synchronous)
++ return 0;
++
+ if (!fsl_ssi_is_ac97(ssi)) {
+ /*
+ * Keep the ssi->i2s_net intact while having a local variable
+--
+2.20.1
+
--- /dev/null
+From 42aaff31202642466124ca43dd1b01b9cf6afa42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 09:50:30 -0500
+Subject: ASoC: hdac_hda: fix page fault issue by removing race
+
+From: Keyon Jie <yang.jie@linux.intel.com>
+
+[ Upstream commit 804cbf4bb063204ca6c2471baa694548aab02ce3 ]
+
+There is a race between hda codec device removing and the
+jack-detecting work, which will lead to a page fault issue as the
+latter work is accessing codec device which could be already removed.
+
+Here add the cancellation of jack-detecting work before codecs are actually
+removed to avoid the race and fix the issue.
+
+Bug: https://github.com/thesofproject/linux/issues/1067
+Signed-off-by: Keyon Jie <yang.jie@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190807145030.26117-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hda.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
+index 7d49402569149..91242b6f8ea7a 100644
+--- a/sound/soc/codecs/hdac_hda.c
++++ b/sound/soc/codecs/hdac_hda.c
+@@ -495,6 +495,10 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev)
+
+ static int hdac_hda_dev_remove(struct hdac_device *hdev)
+ {
++ struct hdac_hda_priv *hda_pvt;
++
++ hda_pvt = dev_get_drvdata(&hdev->dev);
++ cancel_delayed_work_sync(&hda_pvt->codec.jackpoll_work);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 19f87735beef6b29255afe475ef3f9f06cfe1ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 13:36:13 +0200
+Subject: ASoC: Intel: Haswell: Adjust machine device private context
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit ca964edf0ddbfec2cb10b3d251d09598e7ca9b13 ]
+
+Apart from Haswell machines, all other devices have their private data
+set to snd_soc_acpi_mach instance.
+
+Changes for HSW/ BDW boards introduced with series:
+https://patchwork.kernel.org/cover/10782035/
+
+added support for dai_link platform_name adjustments within card probe
+routines. These take for granted private_data points to
+snd_soc_acpi_mach whereas for Haswell, it's sst_pdata instead. Change
+private context of platform_device - representing machine board - to
+address this.
+
+Fixes: e87055d732e3 ("ASoC: Intel: haswell: platform name fixup support")
+Fixes: 7e40ddcf974a ("ASoC: Intel: bdw-rt5677: platform name fixup support")
+Fixes: 2d067b2807f9 ("ASoC: Intel: broadwell: platform name fixup support")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20190822113616.22702-2-cezary.rojewski@intel.com
+Tested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/sst-acpi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/common/sst-acpi.c b/sound/soc/intel/common/sst-acpi.c
+index 0e8e0a7a11df3..5854868650b9e 100644
+--- a/sound/soc/intel/common/sst-acpi.c
++++ b/sound/soc/intel/common/sst-acpi.c
+@@ -141,11 +141,12 @@ static int sst_acpi_probe(struct platform_device *pdev)
+ }
+
+ platform_set_drvdata(pdev, sst_acpi);
++ mach->pdata = sst_pdata;
+
+ /* register machine driver */
+ sst_acpi->pdev_mach =
+ platform_device_register_data(dev, mach->drv_name, -1,
+- sst_pdata, sizeof(*sst_pdata));
++ mach, sizeof(*mach));
+ if (IS_ERR(sst_acpi->pdev_mach))
+ return PTR_ERR(sst_acpi->pdev_mach);
+
+--
+2.20.1
+
--- /dev/null
+From e3508a01838bb8d8d672971d1573976d9739f6a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 19:24:09 +0300
+Subject: ASoC: mchp-i2s-mcc: Fix unprepare of GCLK
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit 988b59467b2b14523a266957affbe9eca3e99fc9 ]
+
+If hw_free() gets called after hw_params(), GCLK remains prepared,
+preventing further use of it. This patch fixes this by unpreparing the
+clock in hw_free() or if hw_params() gets an error.
+
+Fixes: 7e0cdf545a55 ("ASoC: mchp-i2s-mcc: add driver for I2SC Multi-Channel Controller")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20190820162411.24836-2-codrin.ciubotariu@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-i2s-mcc.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/atmel/mchp-i2s-mcc.c b/sound/soc/atmel/mchp-i2s-mcc.c
+index 8272915fa09b9..ab7d5f98e759e 100644
+--- a/sound/soc/atmel/mchp-i2s-mcc.c
++++ b/sound/soc/atmel/mchp-i2s-mcc.c
+@@ -670,8 +670,13 @@ static int mchp_i2s_mcc_hw_params(struct snd_pcm_substream *substream,
+ }
+
+ ret = regmap_write(dev->regmap, MCHP_I2SMCC_MRA, mra);
+- if (ret < 0)
++ if (ret < 0) {
++ if (dev->gclk_use) {
++ clk_unprepare(dev->gclk);
++ dev->gclk_use = 0;
++ }
+ return ret;
++ }
+ return regmap_write(dev->regmap, MCHP_I2SMCC_MRB, mrb);
+ }
+
+@@ -710,9 +715,13 @@ static int mchp_i2s_mcc_hw_free(struct snd_pcm_substream *substream,
+ regmap_write(dev->regmap, MCHP_I2SMCC_CR, MCHP_I2SMCC_CR_CKDIS);
+
+ if (dev->gclk_running) {
+- clk_disable_unprepare(dev->gclk);
++ clk_disable(dev->gclk);
+ dev->gclk_running = 0;
+ }
++ if (dev->gclk_use) {
++ clk_unprepare(dev->gclk);
++ dev->gclk_use = 0;
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From db8fd3830def28cb80c7c0ce692ca1c0b4dba96a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 19:24:10 +0300
+Subject: ASoC: mchp-i2s-mcc: Wait for RX/TX RDY only if controller is running
+
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+
+[ Upstream commit 0f6fc97501b790c971b11b52a654009d21c45238 ]
+
+Since hw_free() can be called multiple times and not just after a stop
+trigger command, we should check whether the RX or TX ready interrupt was
+truly enabled previously. For this, we assure that the condition of the
+wait event is always true, except when RX/TX interrupts are enabled.
+
+Fixes: 7e0cdf545a55 ("ASoC: mchp-i2s-mcc: add driver for I2SC Multi-Channel Controller")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20190820162411.24836-3-codrin.ciubotariu@microchip.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/mchp-i2s-mcc.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/atmel/mchp-i2s-mcc.c b/sound/soc/atmel/mchp-i2s-mcc.c
+index 86495883ca3f1..8272915fa09b9 100644
+--- a/sound/soc/atmel/mchp-i2s-mcc.c
++++ b/sound/soc/atmel/mchp-i2s-mcc.c
+@@ -686,22 +686,24 @@ static int mchp_i2s_mcc_hw_free(struct snd_pcm_substream *substream,
+ err = wait_event_interruptible_timeout(dev->wq_txrdy,
+ dev->tx_rdy,
+ msecs_to_jiffies(500));
++ if (err == 0) {
++ dev_warn_once(dev->dev,
++ "Timeout waiting for Tx ready\n");
++ regmap_write(dev->regmap, MCHP_I2SMCC_IDRA,
++ MCHP_I2SMCC_INT_TXRDY_MASK(dev->channels));
++ dev->tx_rdy = 1;
++ }
+ } else {
+ err = wait_event_interruptible_timeout(dev->wq_rxrdy,
+ dev->rx_rdy,
+ msecs_to_jiffies(500));
+- }
+-
+- if (err == 0) {
+- u32 idra;
+-
+- dev_warn_once(dev->dev, "Timeout waiting for %s\n",
+- is_playback ? "Tx ready" : "Rx ready");
+- if (is_playback)
+- idra = MCHP_I2SMCC_INT_TXRDY_MASK(dev->channels);
+- else
+- idra = MCHP_I2SMCC_INT_RXRDY_MASK(dev->channels);
+- regmap_write(dev->regmap, MCHP_I2SMCC_IDRA, idra);
++ if (err == 0) {
++ dev_warn_once(dev->dev,
++ "Timeout waiting for Rx ready\n");
++ regmap_write(dev->regmap, MCHP_I2SMCC_IDRA,
++ MCHP_I2SMCC_INT_RXRDY_MASK(dev->channels));
++ dev->rx_rdy = 1;
++ }
+ }
+
+ if (!mchp_i2s_mcc_is_running(dev)) {
+@@ -809,6 +811,8 @@ static int mchp_i2s_mcc_dai_probe(struct snd_soc_dai *dai)
+
+ init_waitqueue_head(&dev->wq_txrdy);
+ init_waitqueue_head(&dev->wq_rxrdy);
++ dev->tx_rdy = 1;
++ dev->rx_rdy = 1;
+
+ snd_soc_dai_init_dma_data(dai, &dev->playback, &dev->capture);
+
+--
+2.20.1
+
--- /dev/null
+From 90448b3396424e9d65adb5a093a9971a9a06a282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2019 12:45:38 +0900
+Subject: ASoC: rsnd: don't call clk_get_rate() under atomic context
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 06e8f5c842f2dbb232897ba967ea7b422745c271 ]
+
+ADG is using clk_get_rate() under atomic context, thus, we might
+have scheduling issue.
+To avoid this issue, we need to get/keep clk rate under
+non atomic context.
+
+We need to handle ADG as special device at Renesas Sound driver.
+From SW point of view, we want to impletent it as
+rsnd_mod_ops :: prepare, but it makes code just complicate.
+
+To avoid complicated code/patch, this patch adds new clk_rate[] array,
+and keep clk IN rate when rsnd_adg_clk_enable() was called.
+
+Reported-by: Leon Kong <Leon.KONG@cn.bosch.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Leon Kong <Leon.KONG@cn.bosch.com>
+Link: https://lore.kernel.org/r/87v9vb0xkp.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/adg.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
+index fce4e050a9b70..b9aacf3d3b29c 100644
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -30,6 +30,7 @@ struct rsnd_adg {
+ struct clk *clkout[CLKOUTMAX];
+ struct clk_onecell_data onecell;
+ struct rsnd_mod mod;
++ int clk_rate[CLKMAX];
+ u32 flags;
+ u32 ckr;
+ u32 rbga;
+@@ -114,9 +115,9 @@ static void __rsnd_adg_get_timesel_ratio(struct rsnd_priv *priv,
+ unsigned int val, en;
+ unsigned int min, diff;
+ unsigned int sel_rate[] = {
+- clk_get_rate(adg->clk[CLKA]), /* 0000: CLKA */
+- clk_get_rate(adg->clk[CLKB]), /* 0001: CLKB */
+- clk_get_rate(adg->clk[CLKC]), /* 0010: CLKC */
++ adg->clk_rate[CLKA], /* 0000: CLKA */
++ adg->clk_rate[CLKB], /* 0001: CLKB */
++ adg->clk_rate[CLKC], /* 0010: CLKC */
+ adg->rbga_rate_for_441khz, /* 0011: RBGA */
+ adg->rbgb_rate_for_48khz, /* 0100: RBGB */
+ };
+@@ -302,7 +303,7 @@ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate)
+ * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI.
+ */
+ for_each_rsnd_clk(clk, adg, i) {
+- if (rate == clk_get_rate(clk))
++ if (rate == adg->clk_rate[i])
+ return sel_table[i];
+ }
+
+@@ -369,10 +370,18 @@ void rsnd_adg_clk_control(struct rsnd_priv *priv, int enable)
+
+ for_each_rsnd_clk(clk, adg, i) {
+ ret = 0;
+- if (enable)
++ if (enable) {
+ ret = clk_prepare_enable(clk);
+- else
++
++ /*
++ * We shouldn't use clk_get_rate() under
++ * atomic context. Let's keep it when
++ * rsnd_adg_clk_enable() was called
++ */
++ adg->clk_rate[i] = clk_get_rate(adg->clk[i]);
++ } else {
+ clk_disable_unprepare(clk);
++ }
+
+ if (ret < 0)
+ dev_warn(dev, "can't use clk %d\n", i);
+--
+2.20.1
+
--- /dev/null
+From b02aa106d338d041d566986cf2f38b98d015de2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 10:05:37 +0000
+Subject: ASoC: sgtl5000: Fix charge pump source assignment
+
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+
+[ Upstream commit b6319b061ba279577fd7030a9848fbd6a17151e3 ]
+
+If VDDA != VDDIO and any of them is greater than 3.1V, charge pump
+source can be assigned automatically [1].
+
+[1] https://www.nxp.com/docs/en/data-sheet/SGTL5000.pdf
+
+Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Reviewed-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Reviewed-by: Igor Opaniuk <igor.opaniuk@toradex.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Link: https://lore.kernel.org/r/20190719100524.23300-7-oleksandr.suvorov@toradex.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index aad9eca41587e..7cbaedffa1ef7 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1173,12 +1173,17 @@ static int sgtl5000_set_power_regs(struct snd_soc_component *component)
+ SGTL5000_INT_OSC_EN);
+ /* Enable VDDC charge pump */
+ ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+- } else if (vddio >= 3100 && vdda >= 3100) {
++ } else {
+ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+- /* VDDC use VDDIO rail */
+- lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+- lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+- SGTL5000_VDDC_MAN_ASSN_SHIFT;
++ /*
++ * if vddio == vdda the source of charge pump should be
++ * assigned manually to VDDIO
++ */
++ if (vddio == vdda) {
++ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
++ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
++ SGTL5000_VDDC_MAN_ASSN_SHIFT;
++ }
+ }
+
+ snd_soc_component_write(component, SGTL5000_CHIP_LINREG_CTRL, lreg_ctrl);
+--
+2.20.1
+
--- /dev/null
+From 8d9635fb599b85673cff2c149136b0e45237edf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 10:05:35 +0000
+Subject: ASoC: sgtl5000: Fix of unmute outputs on probe
+
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+
+[ Upstream commit 631bc8f0134ae9620d86a96b8c5f9445d91a2dca ]
+
+To enable "zero cross detect" for ADC/HP, change
+HP_ZCD_EN/ADC_ZCD_EN bits only instead of writing the whole
+CHIP_ANA_CTRL register.
+
+Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Reviewed-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Reviewed-by: Igor Opaniuk <igor.opaniuk@toradex.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Link: https://lore.kernel.org/r/20190719100524.23300-6-oleksandr.suvorov@toradex.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index a6a4748c97f9d..aad9eca41587e 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1288,6 +1288,7 @@ static int sgtl5000_probe(struct snd_soc_component *component)
+ int ret;
+ u16 reg;
+ struct sgtl5000_priv *sgtl5000 = snd_soc_component_get_drvdata(component);
++ unsigned int zcd_mask = SGTL5000_HP_ZCD_EN | SGTL5000_ADC_ZCD_EN;
+
+ /* power up sgtl5000 */
+ ret = sgtl5000_set_power_regs(component);
+@@ -1315,9 +1316,8 @@ static int sgtl5000_probe(struct snd_soc_component *component)
+ 0x1f);
+ snd_soc_component_write(component, SGTL5000_CHIP_PAD_STRENGTH, reg);
+
+- snd_soc_component_write(component, SGTL5000_CHIP_ANA_CTRL,
+- SGTL5000_HP_ZCD_EN |
+- SGTL5000_ADC_ZCD_EN);
++ snd_soc_component_update_bits(component, SGTL5000_CHIP_ANA_CTRL,
++ zcd_mask, zcd_mask);
+
+ snd_soc_component_update_bits(component, SGTL5000_CHIP_MIC_CTRL,
+ SGTL5000_BIAS_R_MASK,
+--
+2.20.1
+
--- /dev/null
+From 6078801c37f3efed048c4bd166f41396a53fb23c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 00:04:50 -0700
+Subject: ASoC: SOF: Intel: hda: Make hdac_device device-managed
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit ef9bec27485fefb6b93168fea73fda0dc9638046 ]
+
+snd_hdac_ext_bus_device_exit() has been recently modified
+to no longer free the hdac device. SOF allocates memory for
+hdac_device and hda_hda_priv with kzalloc. Make them
+device-managed instead so that they will be freed when the
+SOF driver is unloaded.
+
+Because of the above change, hda_codec is device-managed and
+it will be freed when the ASoC device is removed. Freeing
+the codec in snd_hda_codec_dev_release() leads to kernel
+panic while unloading and reloading the ASoC driver. So,
+avoid freeing the hda_codec for ASoC driver. This is done in
+the same patch to avoid bisect failure.
+
+Signed-off-by: Libin Yang <libin.yang@intel.com>
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20190626070450.7229-1-ranjani.sridharan@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_codec.c | 8 +++++++-
+ sound/soc/sof/intel/hda-codec.c | 6 ++----
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 51f10ed9bc432..a2fb19129219e 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -846,7 +846,13 @@ static void snd_hda_codec_dev_release(struct device *dev)
+ snd_hda_sysfs_clear(codec);
+ kfree(codec->modelname);
+ kfree(codec->wcaps);
+- kfree(codec);
++
++ /*
++ * In the case of ASoC HD-audio, hda_codec is device managed.
++ * It will be freed when the ASoC device is removed.
++ */
++ if (codec->core.type == HDA_DEV_LEGACY)
++ kfree(codec);
+ }
+
+ #define DEV_NAME_LEN 31
+diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c
+index b8b37f0823094..0d8437b080bfa 100644
+--- a/sound/soc/sof/intel/hda-codec.c
++++ b/sound/soc/sof/intel/hda-codec.c
+@@ -62,8 +62,7 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address)
+ address, resp);
+
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA_AUDIO_CODEC)
+- /* snd_hdac_ext_bus_device_exit will use kfree to free hdev */
+- hda_priv = kzalloc(sizeof(*hda_priv), GFP_KERNEL);
++ hda_priv = devm_kzalloc(sdev->dev, sizeof(*hda_priv), GFP_KERNEL);
+ if (!hda_priv)
+ return -ENOMEM;
+
+@@ -82,8 +81,7 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address)
+
+ return 0;
+ #else
+- /* snd_hdac_ext_bus_device_exit will use kfree to free hdev */
+- hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
++ hdev = devm_kzalloc(sdev->dev, sizeof(*hdev), GFP_KERNEL);
+ if (!hdev)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From 09576481d5c4b5045e0d95029344cf8ef82fdd0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 09:13:42 -0500
+Subject: ASoC: SOF: pci: mark last_busy value at runtime PM init
+
+From: Pan Xiuli <xiuli.pan@linux.intel.com>
+
+[ Upstream commit f1b1b9b136827915624136624ff54aba5890a15b ]
+
+If last_busy value is not set at runtime PM enable, the device will be
+suspend immediately after usage counter is 0. Set the last_busy value to
+make sure delay is working at first boot up.
+
+Signed-off-by: Pan Xiuli <xiuli.pan@linux.intel.com>
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190722141402.7194-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/sof-pci-dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
+index 65d1bac4c6b8b..6fd3df7c57a3a 100644
+--- a/sound/soc/sof/sof-pci-dev.c
++++ b/sound/soc/sof/sof-pci-dev.c
+@@ -223,6 +223,9 @@ static void sof_pci_probe_complete(struct device *dev)
+ */
+ pm_runtime_allow(dev);
+
++ /* mark last_busy for pm_runtime to make sure not suspend immediately */
++ pm_runtime_mark_last_busy(dev);
++
+ /* follow recommendation in pci-driver.c to decrement usage counter */
+ pm_runtime_put_noidle(dev);
+ }
+--
+2.20.1
+
--- /dev/null
+From a73ade30fe816217fdbe68cf11f70eccacacef8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 09:13:43 -0500
+Subject: ASoC: SOF: reset DMA state in prepare
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 04c8027764bc82a325d3abc6f39a6a4642a937cb ]
+
+When application goes through SUSPEND/STOP->PREPARE->START
+cycle, we should always reprogram the SOF device to start
+DMA from a known state so that hw_ptr/appl_ptrs remain valid.
+This is expected by ALSA core as it resets the buffer
+state as part of prepare (see snd_pcm_do_prepare()).
+
+Fix the issue by forcing reconfiguration of the FW with
+STREAM_PCM_PARAMS in prepare(). Use combined logic to handle
+prepare and the existing flow to reprogram hw-params after
+system suspend.
+
+Without the fix, first call to pcm pointer() will return
+an invalid hw_ptr and application may immediately observe XRUN
+status, unless "start_threshold" SW parameter is set to maximum
+value by the application.
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190722141402.7194-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/pcm.c | 27 +++++++++++++++------------
+ sound/soc/sof/pm.c | 2 +-
+ sound/soc/sof/sof-priv.h | 2 +-
+ 3 files changed, 17 insertions(+), 14 deletions(-)
+
+diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c
+index 334e9d59b1baf..3b8955e755b24 100644
+--- a/sound/soc/sof/pcm.c
++++ b/sound/soc/sof/pcm.c
+@@ -208,12 +208,11 @@ static int sof_pcm_hw_params(struct snd_pcm_substream *substream,
+ if (ret < 0)
+ return ret;
+
++ spcm->prepared[substream->stream] = true;
++
+ /* save pcm hw_params */
+ memcpy(&spcm->params[substream->stream], params, sizeof(*params));
+
+- /* clear hw_params_upon_resume flag */
+- spcm->hw_params_upon_resume[substream->stream] = 0;
+-
+ return ret;
+ }
+
+@@ -236,6 +235,9 @@ static int sof_pcm_hw_free(struct snd_pcm_substream *substream)
+ if (!spcm)
+ return -EINVAL;
+
++ if (!spcm->prepared[substream->stream])
++ return 0;
++
+ dev_dbg(sdev->dev, "pcm: free stream %d dir %d\n", spcm->pcm.pcm_id,
+ substream->stream);
+
+@@ -258,6 +260,8 @@ static int sof_pcm_hw_free(struct snd_pcm_substream *substream)
+ if (ret < 0)
+ dev_err(sdev->dev, "error: platform hw free failed\n");
+
++ spcm->prepared[substream->stream] = false;
++
+ return ret;
+ }
+
+@@ -278,11 +282,7 @@ static int sof_pcm_prepare(struct snd_pcm_substream *substream)
+ if (!spcm)
+ return -EINVAL;
+
+- /*
+- * check if hw_params needs to be set-up again.
+- * This is only needed when resuming from system sleep.
+- */
+- if (!spcm->hw_params_upon_resume[substream->stream])
++ if (spcm->prepared[substream->stream])
+ return 0;
+
+ dev_dbg(sdev->dev, "pcm: prepare stream %d dir %d\n", spcm->pcm.pcm_id,
+@@ -311,6 +311,7 @@ static int sof_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ struct snd_sof_pcm *spcm;
+ struct sof_ipc_stream stream;
+ struct sof_ipc_reply reply;
++ bool reset_hw_params = false;
+ int ret;
+
+ /* nothing to do for BE */
+@@ -351,6 +352,7 @@ static int sof_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_STOP:
+ stream.hdr.cmd |= SOF_IPC_STREAM_TRIG_STOP;
++ reset_hw_params = true;
+ break;
+ default:
+ dev_err(sdev->dev, "error: unhandled trigger cmd %d\n", cmd);
+@@ -363,17 +365,17 @@ static int sof_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
+ ret = sof_ipc_tx_message(sdev->ipc, stream.hdr.cmd, &stream,
+ sizeof(stream), &reply, sizeof(reply));
+
+- if (ret < 0 || cmd != SNDRV_PCM_TRIGGER_SUSPEND)
++ if (ret < 0 || !reset_hw_params)
+ return ret;
+
+ /*
+- * The hw_free op is usually called when the pcm stream is closed.
+- * Since the stream is not closed during suspend, the DSP needs to be
+- * notified explicitly to free pcm to prevent errors upon resume.
++ * In case of stream is stopped, DSP must be reprogrammed upon
++ * restart, so free PCM here.
+ */
+ stream.hdr.size = sizeof(stream);
+ stream.hdr.cmd = SOF_IPC_GLB_STREAM_MSG | SOF_IPC_STREAM_PCM_FREE;
+ stream.comp_id = spcm->stream[substream->stream].comp_id;
++ spcm->prepared[substream->stream] = false;
+
+ /* send IPC to the DSP */
+ return sof_ipc_tx_message(sdev->ipc, stream.hdr.cmd, &stream,
+@@ -481,6 +483,7 @@ static int sof_pcm_open(struct snd_pcm_substream *substream)
+ spcm->stream[substream->stream].posn.host_posn = 0;
+ spcm->stream[substream->stream].posn.dai_posn = 0;
+ spcm->stream[substream->stream].substream = substream;
++ spcm->prepared[substream->stream] = false;
+
+ ret = snd_sof_pcm_platform_open(sdev, substream);
+ if (ret < 0)
+diff --git a/sound/soc/sof/pm.c b/sound/soc/sof/pm.c
+index 278abfd10490d..48c6d78d72e2e 100644
+--- a/sound/soc/sof/pm.c
++++ b/sound/soc/sof/pm.c
+@@ -233,7 +233,7 @@ static int sof_set_hw_params_upon_resume(struct snd_sof_dev *sdev)
+
+ state = substream->runtime->status->state;
+ if (state == SNDRV_PCM_STATE_SUSPENDED)
+- spcm->hw_params_upon_resume[dir] = 1;
++ spcm->prepared[dir] = false;
+ }
+ }
+
+diff --git a/sound/soc/sof/sof-priv.h b/sound/soc/sof/sof-priv.h
+index b8c0b2a226845..fa5cb7d2a6602 100644
+--- a/sound/soc/sof/sof-priv.h
++++ b/sound/soc/sof/sof-priv.h
+@@ -297,7 +297,7 @@ struct snd_sof_pcm {
+ struct snd_sof_pcm_stream stream[2];
+ struct list_head list; /* list in sdev pcm list */
+ struct snd_pcm_hw_params params[2];
+- int hw_params_upon_resume[2]; /* set up hw_params upon resume */
++ bool prepared[2]; /* PCM_PARAMS set successfully */
+ };
+
+ /* ALSA SOF Kcontrol device */
+--
+2.20.1
+
--- /dev/null
+From 11bed7e0f91eaf6c0229e6f4010179be4e2a59e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 21:25:14 +0200
+Subject: ASoC: sun4i-i2s: Don't use the oversample to calculate BCLK
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 7df8f9a20196072162d9dc8fe99943f2d35f23d5 ]
+
+The BCLK divider should be calculated using the parameters that actually
+make the BCLK rate: the number of channels, the sampling rate and the
+sample width.
+
+We've been using the oversample_rate previously because in the former SoCs,
+the BCLK's parent is MCLK, which in turn is being used to generate the
+oversample rate, so we end up with something like this:
+
+oversample = mclk_rate / sampling_rate
+bclk_div = oversample / word_size / channels
+
+So, bclk_div = mclk_rate / sampling_rate / word_size / channels.
+
+And this is actually better, since the oversampling ratio only plays a role
+because the MCLK is its parent, not because of what BCLK is supposed to be.
+
+Furthermore, that assumption of MCLK being the parent has been broken on
+newer SoCs, so let's use the proper formula, and have the parent rate as an
+argument.
+
+Fixes: 7d2993811a1e ("ASoC: sun4i-i2s: Add support for H3")
+Fixes: 21faaea1343f ("ASoC: sun4i-i2s: Add support for A83T")
+Fixes: 66ecce332538 ("ASoC: sun4i-i2s: Add compatibility with A64 codec I2S")
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://lore.kernel.org/r/c3595e3a9788c2ef2dcc30aa3c8c4953bb5cc249.1566242458.git-series.maxime.ripard@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index 7fa5c61169db0..ab8cb83c8b1a8 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -222,10 +222,11 @@ static const struct sun4i_i2s_clk_div sun4i_i2s_mclk_div[] = {
+ };
+
+ static int sun4i_i2s_get_bclk_div(struct sun4i_i2s *i2s,
+- unsigned int oversample_rate,
++ unsigned long parent_rate,
++ unsigned int sampling_rate,
+ unsigned int word_size)
+ {
+- int div = oversample_rate / word_size / 2;
++ int div = parent_rate / sampling_rate / word_size / 2;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(sun4i_i2s_bclk_div); i++) {
+@@ -315,8 +316,8 @@ static int sun4i_i2s_set_clk_rate(struct snd_soc_dai *dai,
+ return -EINVAL;
+ }
+
+- bclk_div = sun4i_i2s_get_bclk_div(i2s, oversample_rate,
+- word_size);
++ bclk_div = sun4i_i2s_get_bclk_div(i2s, i2s->mclk_freq,
++ rate, word_size);
+ if (bclk_div < 0) {
+ dev_err(dai->dev, "Unsupported BCLK divider: %d\n", bclk_div);
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From d7f61e58d9870e2bf62af5897858af091fff2347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 16:36:37 +0200
+Subject: ASoC: tlv320aic31xx: suppress error message for EPROBE_DEFER
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit b7e814deae33eb30f8f8c6528e8e69b107978d88 ]
+
+Both the supplies and reset GPIO might need a probe deferral for the
+resource to be available. Don't print a error message in that case, as
+it is a normal operating condition.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20190719143637.2018-1-l.stach@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic31xx.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c
+index 9b37e98da0db1..26a4f6cd32883 100644
+--- a/sound/soc/codecs/tlv320aic31xx.c
++++ b/sound/soc/codecs/tlv320aic31xx.c
+@@ -1553,7 +1553,8 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c,
+ aic31xx->gpio_reset = devm_gpiod_get_optional(aic31xx->dev, "reset",
+ GPIOD_OUT_LOW);
+ if (IS_ERR(aic31xx->gpio_reset)) {
+- dev_err(aic31xx->dev, "not able to acquire gpio\n");
++ if (PTR_ERR(aic31xx->gpio_reset) != -EPROBE_DEFER)
++ dev_err(aic31xx->dev, "not able to acquire gpio\n");
+ return PTR_ERR(aic31xx->gpio_reset);
+ }
+
+@@ -1564,7 +1565,9 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c,
+ ARRAY_SIZE(aic31xx->supplies),
+ aic31xx->supplies);
+ if (ret) {
+- dev_err(aic31xx->dev, "Failed to request supplies: %d\n", ret);
++ if (ret != -EPROBE_DEFER)
++ dev_err(aic31xx->dev,
++ "Failed to request supplies: %d\n", ret);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c3edd7bf36054e6648bfc3642510c1377fbc2407 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 15:16:04 +0900
+Subject: ASoC: uniphier: Fix double reset assersion when transitioning to
+ suspend state
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit c372a35550c8d60f673b20210eea58a06d6d38cb ]
+
+When transitioning to supend state, uniphier_aio_dai_suspend() is called
+and asserts reset lines and disables clocks.
+
+However, if there are two or more DAIs, uniphier_aio_dai_suspend() are
+called multiple times, and double reset assersion will cause.
+
+This patch defines the counter that has the number of DAIs at first, and
+whenever uniphier_aio_dai_suspend() are called, it decrements the
+counter. And only if the counter is zero, it asserts reset lines and
+disables clocks.
+
+In the same way, uniphier_aio_dai_resume() are called, it increments the
+counter after deasserting reset lines and enabling clocks.
+
+Fixes: 139a34200233 ("ASoC: uniphier: add support for UniPhier AIO CPU DAI driver")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Link: https://lore.kernel.org/r/1566281764-14059-1-git-send-email-hayashi.kunihiko@socionext.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/uniphier/aio-cpu.c | 31 +++++++++++++++++++++----------
+ sound/soc/uniphier/aio.h | 1 +
+ 2 files changed, 22 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/uniphier/aio-cpu.c b/sound/soc/uniphier/aio-cpu.c
+index ee90e6c3937ce..2ae582a99b636 100644
+--- a/sound/soc/uniphier/aio-cpu.c
++++ b/sound/soc/uniphier/aio-cpu.c
+@@ -424,8 +424,11 @@ int uniphier_aio_dai_suspend(struct snd_soc_dai *dai)
+ {
+ struct uniphier_aio *aio = uniphier_priv(dai);
+
+- reset_control_assert(aio->chip->rst);
+- clk_disable_unprepare(aio->chip->clk);
++ aio->chip->num_wup_aios--;
++ if (!aio->chip->num_wup_aios) {
++ reset_control_assert(aio->chip->rst);
++ clk_disable_unprepare(aio->chip->clk);
++ }
+
+ return 0;
+ }
+@@ -439,13 +442,15 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai)
+ if (!aio->chip->active)
+ return 0;
+
+- ret = clk_prepare_enable(aio->chip->clk);
+- if (ret)
+- return ret;
++ if (!aio->chip->num_wup_aios) {
++ ret = clk_prepare_enable(aio->chip->clk);
++ if (ret)
++ return ret;
+
+- ret = reset_control_deassert(aio->chip->rst);
+- if (ret)
+- goto err_out_clock;
++ ret = reset_control_deassert(aio->chip->rst);
++ if (ret)
++ goto err_out_clock;
++ }
+
+ aio_iecout_set_enable(aio->chip, true);
+ aio_chip_init(aio->chip);
+@@ -458,7 +463,7 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai)
+
+ ret = aio_init(sub);
+ if (ret)
+- goto err_out_clock;
++ goto err_out_reset;
+
+ if (!sub->setting)
+ continue;
+@@ -466,11 +471,16 @@ int uniphier_aio_dai_resume(struct snd_soc_dai *dai)
+ aio_port_reset(sub);
+ aio_src_reset(sub);
+ }
++ aio->chip->num_wup_aios++;
+
+ return 0;
+
++err_out_reset:
++ if (!aio->chip->num_wup_aios)
++ reset_control_assert(aio->chip->rst);
+ err_out_clock:
+- clk_disable_unprepare(aio->chip->clk);
++ if (!aio->chip->num_wup_aios)
++ clk_disable_unprepare(aio->chip->clk);
+
+ return ret;
+ }
+@@ -619,6 +629,7 @@ int uniphier_aio_probe(struct platform_device *pdev)
+ return PTR_ERR(chip->rst);
+
+ chip->num_aios = chip->chip_spec->num_dais;
++ chip->num_wup_aios = chip->num_aios;
+ chip->aios = devm_kcalloc(dev,
+ chip->num_aios, sizeof(struct uniphier_aio),
+ GFP_KERNEL);
+diff --git a/sound/soc/uniphier/aio.h b/sound/soc/uniphier/aio.h
+index ca6ccbae0ee8c..a7ff7e556429b 100644
+--- a/sound/soc/uniphier/aio.h
++++ b/sound/soc/uniphier/aio.h
+@@ -285,6 +285,7 @@ struct uniphier_aio_chip {
+
+ struct uniphier_aio *aios;
+ int num_aios;
++ int num_wup_aios;
+ struct uniphier_aio_pll *plls;
+ int num_plls;
+
+--
+2.20.1
+
--- /dev/null
+From b79c9248a4a1e7227a4dc385cd48d879827ba266 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 04:05:12 +0530
+Subject: base: soc: Export soc_device_register/unregister APIs
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit f7ccc7a397cf2ef64aebb2f726970b93203858d2 ]
+
+Qcom Socinfo driver can be built as a module, so
+export these two APIs.
+
+Tested-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Vaishali Thakkar <vaishali.thakkar@linaro.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/soc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/base/soc.c b/drivers/base/soc.c
+index 10b280f30217b..7e91894a380b5 100644
+--- a/drivers/base/soc.c
++++ b/drivers/base/soc.c
+@@ -157,6 +157,7 @@ struct soc_device *soc_device_register(struct soc_device_attribute *soc_dev_attr
+ out1:
+ return ERR_PTR(ret);
+ }
++EXPORT_SYMBOL_GPL(soc_device_register);
+
+ /* Ensure soc_dev->attr is freed prior to calling soc_device_unregister. */
+ void soc_device_unregister(struct soc_device *soc_dev)
+@@ -166,6 +167,7 @@ void soc_device_unregister(struct soc_device *soc_dev)
+ device_unregister(&soc_dev->dev);
+ early_soc_dev_attr = NULL;
+ }
++EXPORT_SYMBOL_GPL(soc_device_unregister);
+
+ static int __init soc_bus_register(void)
+ {
+--
+2.20.1
+
--- /dev/null
+From 2e39fdb26145b3ff9b5ac2795921b116af8ddea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 22:10:42 +0800
+Subject: blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 73d9c8d4c0017e21e1ff519474ceb1450484dc9a ]
+
+If blk_mq_init_allocated_queue->elevator_init_mq fails, need to release
+the previously requested resources.
+
+Fixes: d34849913819 ("blk-mq-sched: allow setting of default IO scheduler")
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 0835f4d8d42e7..a38ebb2a380c2 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2841,6 +2841,8 @@ static unsigned int nr_hw_queues(struct blk_mq_tag_set *set)
+ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
+ struct request_queue *q)
+ {
++ int ret = -ENOMEM;
++
+ /* mark the queue as mq asap */
+ q->mq_ops = set->ops;
+
+@@ -2902,17 +2904,18 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
+ blk_mq_map_swqueue(q);
+
+ if (!(set->flags & BLK_MQ_F_NO_SCHED)) {
+- int ret;
+-
+ ret = elevator_init_mq(q);
+ if (ret)
+- return ERR_PTR(ret);
++ goto err_tag_set;
+ }
+
+ return q;
+
++err_tag_set:
++ blk_mq_del_queue_tag_set(q);
+ err_hctxs:
+ kfree(q->queue_hw_ctx);
++ q->nr_hw_queues = 0;
+ err_sys_init:
+ blk_mq_sysfs_deinit(q);
+ err_poll:
+--
+2.20.1
+
--- /dev/null
+From fd1d6c2322e347a3eb8897aea0ea8559f88e46a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 15:59:03 +0800
+Subject: block: make rq sector size accessible for block stats
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 3d24430694077313c75c6b89f618db09943621e4 ]
+
+Currently rq->data_len will be decreased by partial completion or
+zeroed by completion, so when blk_stat_add() is invoked, data_len
+will be zero and there will never be samples in poll_cb because
+blk_mq_poll_stats_bkt() will return -1 if data_len is zero.
+
+We could move blk_stat_add() back to __blk_mq_complete_request(),
+but that would make the effort of trying to call ktime_get_ns()
+once in vain. Instead we can reuse throtl_size field, and use
+it for both block stats and block throttle, and adjust the
+logic in blk_mq_poll_stats_bkt() accordingly.
+
+Fixes: 4bc6339a583c ("block: move blk_stat_add() to __blk_mq_end_request()")
+Tested-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 11 +++++------
+ block/blk-throttle.c | 3 ++-
+ include/linux/blkdev.h | 15 ++++++++++++---
+ 3 files changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index a38ebb2a380c2..9b56428cad0e7 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -44,12 +44,12 @@ static void blk_mq_poll_stats_fn(struct blk_stat_callback *cb);
+
+ static int blk_mq_poll_stats_bkt(const struct request *rq)
+ {
+- int ddir, bytes, bucket;
++ int ddir, sectors, bucket;
+
+ ddir = rq_data_dir(rq);
+- bytes = blk_rq_bytes(rq);
++ sectors = blk_rq_stats_sectors(rq);
+
+- bucket = ddir + 2*(ilog2(bytes) - 9);
++ bucket = ddir + 2 * ilog2(sectors);
+
+ if (bucket < 0)
+ return -1;
+@@ -330,6 +330,7 @@ static struct request *blk_mq_rq_ctx_init(struct blk_mq_alloc_data *data,
+ else
+ rq->start_time_ns = 0;
+ rq->io_start_time_ns = 0;
++ rq->stats_sectors = 0;
+ rq->nr_phys_segments = 0;
+ #if defined(CONFIG_BLK_DEV_INTEGRITY)
+ rq->nr_integrity_segments = 0;
+@@ -673,9 +674,7 @@ void blk_mq_start_request(struct request *rq)
+
+ if (test_bit(QUEUE_FLAG_STATS, &q->queue_flags)) {
+ rq->io_start_time_ns = ktime_get_ns();
+-#ifdef CONFIG_BLK_DEV_THROTTLING_LOW
+- rq->throtl_size = blk_rq_sectors(rq);
+-#endif
++ rq->stats_sectors = blk_rq_sectors(rq);
+ rq->rq_flags |= RQF_STATS;
+ rq_qos_issue(q, rq);
+ }
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 8ab6c81532236..ee74bffe3504d 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -2246,7 +2246,8 @@ void blk_throtl_stat_add(struct request *rq, u64 time_ns)
+ struct request_queue *q = rq->q;
+ struct throtl_data *td = q->td;
+
+- throtl_track_latency(td, rq->throtl_size, req_op(rq), time_ns >> 10);
++ throtl_track_latency(td, blk_rq_stats_sectors(rq), req_op(rq),
++ time_ns >> 10);
+ }
+
+ void blk_throtl_bio_endio(struct bio *bio)
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 1ef375dafb1c1..ae51050c50949 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -202,9 +202,12 @@ struct request {
+ #ifdef CONFIG_BLK_WBT
+ unsigned short wbt_flags;
+ #endif
+-#ifdef CONFIG_BLK_DEV_THROTTLING_LOW
+- unsigned short throtl_size;
+-#endif
++ /*
++ * rq sectors used for blk stats. It has the same value
++ * with blk_rq_sectors(rq), except that it never be zeroed
++ * by completion.
++ */
++ unsigned short stats_sectors;
+
+ /*
+ * Number of scatter-gather DMA addr+len pairs after
+@@ -903,6 +906,7 @@ static inline struct request_queue *bdev_get_queue(struct block_device *bdev)
+ * blk_rq_err_bytes() : bytes left till the next error boundary
+ * blk_rq_sectors() : sectors left in the entire request
+ * blk_rq_cur_sectors() : sectors left in the current segment
++ * blk_rq_stats_sectors() : sectors of the entire request used for stats
+ */
+ static inline sector_t blk_rq_pos(const struct request *rq)
+ {
+@@ -931,6 +935,11 @@ static inline unsigned int blk_rq_cur_sectors(const struct request *rq)
+ return blk_rq_cur_bytes(rq) >> SECTOR_SHIFT;
+ }
+
++static inline unsigned int blk_rq_stats_sectors(const struct request *rq)
++{
++ return rq->stats_sectors;
++}
++
+ #ifdef CONFIG_BLK_DEV_ZONED
+ static inline unsigned int blk_rq_zone_no(struct request *rq)
+ {
+--
+2.20.1
+
--- /dev/null
+From 06cdf1b680a415c3312d7a17468bf3f97000e807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 17:00:32 +0800
+Subject: btrfs: delayed-inode: Kill the BUG_ON() in
+ btrfs_delete_delayed_dir_index()
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 933c22a7512c5c09b1fdc46b557384efe8d03233 ]
+
+There is one report of fuzzed image which leads to BUG_ON() in
+btrfs_delete_delayed_dir_index().
+
+Although that fuzzed image can already be addressed by enhanced
+extent-tree error handler, it's still better to hunt down more BUG_ON().
+
+This patch will hunt down two BUG_ON()s in
+btrfs_delete_delayed_dir_index():
+- One for error from btrfs_delayed_item_reserve_metadata()
+ Instead of BUG_ON(), we output an error message and free the item.
+ And return the error.
+ All callers of this function handles the error by aborting current
+ trasaction.
+
+- One for possible EEXIST from __btrfs_add_delayed_deletion_item()
+ That function can return -EEXIST.
+ We already have a good enough error message for that, only need to
+ clean up the reserved metadata space and allocated item.
+
+To help above cleanup, also modifiy __btrfs_remove_delayed_item() called
+in btrfs_release_delayed_item(), to skip unassociated item.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203253
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-inode.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 43fdb2992956a..6858a05606dd3 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -474,6 +474,9 @@ static void __btrfs_remove_delayed_item(struct btrfs_delayed_item *delayed_item)
+ struct rb_root_cached *root;
+ struct btrfs_delayed_root *delayed_root;
+
++ /* Not associated with any delayed_node */
++ if (!delayed_item->delayed_node)
++ return;
+ delayed_root = delayed_item->delayed_node->root->fs_info->delayed_root;
+
+ BUG_ON(!delayed_root);
+@@ -1525,7 +1528,12 @@ int btrfs_delete_delayed_dir_index(struct btrfs_trans_handle *trans,
+ * we have reserved enough space when we start a new transaction,
+ * so reserving metadata failure is impossible.
+ */
+- BUG_ON(ret);
++ if (ret < 0) {
++ btrfs_err(trans->fs_info,
++"metadata reservation failed for delayed dir item deltiona, should have been reserved");
++ btrfs_release_delayed_item(item);
++ goto end;
++ }
+
+ mutex_lock(&node->mutex);
+ ret = __btrfs_add_delayed_deletion_item(node, item);
+@@ -1534,7 +1542,8 @@ int btrfs_delete_delayed_dir_index(struct btrfs_trans_handle *trans,
+ "err add delayed dir index item(index: %llu) into the deletion tree of the delayed node(root id: %llu, inode id: %llu, errno: %d)",
+ index, node->root->root_key.objectid,
+ node->inode_id, ret);
+- BUG();
++ btrfs_delayed_item_release_metadata(dir->root, item);
++ btrfs_release_delayed_item(item);
+ }
+ mutex_unlock(&node->mutex);
+ end:
+--
+2.20.1
+
--- /dev/null
+From 2cf2652c68be53c5b6304f724817b26585dedcb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 10:14:15 +0800
+Subject: btrfs: Detect unbalanced tree with empty leaf before crashing btree
+ operations
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 62fdaa52a3d00a875da771719b6dc537ca79fce1 ]
+
+[BUG]
+With crafted image, btrfs will panic at btree operations:
+
+ kernel BUG at fs/btrfs/ctree.c:3894!
+ invalid opcode: 0000 [#1] SMP PTI
+ CPU: 0 PID: 1138 Comm: btrfs-transacti Not tainted 5.0.0-rc8+ #9
+ RIP: 0010:__push_leaf_left+0x6b6/0x6e0
+ RSP: 0018:ffffc0bd4128b990 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: ffffa0a4ab8f0e38 RCX: 0000000000000000
+ RDX: ffffa0a280000000 RSI: 0000000000000000 RDI: ffffa0a4b3814000
+ RBP: ffffc0bd4128ba38 R08: 0000000000001000 R09: ffffc0bd4128b948
+ R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000240
+ R13: ffffa0a4b556fb60 R14: ffffa0a4ab8f0af0 R15: ffffa0a4ab8f0af0
+ FS: 0000000000000000(0000) GS:ffffa0a4b7a00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f2461c80020 CR3: 000000022b32a006 CR4: 00000000000206f0
+ Call Trace:
+ ? _cond_resched+0x1a/0x50
+ push_leaf_left+0x179/0x190
+ btrfs_del_items+0x316/0x470
+ btrfs_del_csums+0x215/0x3a0
+ __btrfs_free_extent.isra.72+0x5a7/0xbe0
+ __btrfs_run_delayed_refs+0x539/0x1120
+ btrfs_run_delayed_refs+0xdb/0x1b0
+ btrfs_commit_transaction+0x52/0x950
+ ? start_transaction+0x94/0x450
+ transaction_kthread+0x163/0x190
+ kthread+0x105/0x140
+ ? btrfs_cleanup_transaction+0x560/0x560
+ ? kthread_destroy_worker+0x50/0x50
+ ret_from_fork+0x35/0x40
+ Modules linked in:
+ ---[ end trace c2425e6e89b5558f ]---
+
+[CAUSE]
+The offending csum tree looks like this:
+
+ checksum tree key (CSUM_TREE ROOT_ITEM 0)
+ node 29741056 level 1 items 14 free 107 generation 19 owner CSUM_TREE
+ ...
+ key (EXTENT_CSUM EXTENT_CSUM 85975040) block 29630464 gen 17
+ key (EXTENT_CSUM EXTENT_CSUM 89911296) block 29642752 gen 17 <<<
+ key (EXTENT_CSUM EXTENT_CSUM 92274688) block 29646848 gen 17
+ ...
+
+ leaf 29630464 items 6 free space 1 generation 17 owner CSUM_TREE
+ item 0 key (EXTENT_CSUM EXTENT_CSUM 85975040) itemoff 3987 itemsize 8
+ range start 85975040 end 85983232 length 8192
+ ...
+ leaf 29642752 items 0 free space 3995 generation 17 owner 0
+ ^ empty leaf invalid owner ^
+
+ leaf 29646848 items 1 free space 602 generation 17 owner CSUM_TREE
+ item 0 key (EXTENT_CSUM EXTENT_CSUM 92274688) itemoff 627 itemsize 3368
+ range start 92274688 end 95723520 length 3448832
+
+So we have a corrupted csum tree where one tree leaf is completely
+empty, causing unbalanced btree, thus leading to unexpected btree
+balance error.
+
+[FIX]
+For this particular case, we handle it in two directions to catch it:
+- Check if the tree block is empty through btrfs_verify_level_key()
+ So that invalid tree blocks won't be read out through
+ btrfs_search_slot() and its variants.
+
+- Check 0 tree owner in tree checker
+ NO tree is using 0 as its tree owner, detect it and reject at tree
+ block read time.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202821
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/disk-io.c | 10 ++++++++++
+ fs/btrfs/tree-checker.c | 6 ++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 97beb351a10cd..65af7eb3f7bd7 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -416,6 +416,16 @@ int btrfs_verify_level_key(struct extent_buffer *eb, int level,
+ */
+ if (btrfs_header_generation(eb) > fs_info->last_trans_committed)
+ return 0;
++
++ /* We have @first_key, so this @eb must have at least one item */
++ if (btrfs_header_nritems(eb) == 0) {
++ btrfs_err(fs_info,
++ "invalid tree nritems, bytenr=%llu nritems=0 expect >0",
++ eb->start);
++ WARN_ON(IS_ENABLED(CONFIG_BTRFS_DEBUG));
++ return -EUCLEAN;
++ }
++
+ if (found_level)
+ btrfs_node_key_to_cpu(eb, &found_key, 0);
+ else
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index d83adda6c090a..9634cae1e1b1d 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -991,6 +991,12 @@ static int check_leaf(struct extent_buffer *leaf, bool check_item_data)
+ owner);
+ return -EUCLEAN;
+ }
++ /* Unknown tree */
++ if (owner == 0) {
++ generic_err(leaf, 0,
++ "invalid owner, root 0 is not defined");
++ return -EUCLEAN;
++ }
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f60c833ae4472b309070ab90a6a13e38d90720f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 17:00:33 +0800
+Subject: btrfs: extent-tree: Make sure we only allocate extents from block
+ groups with the same type
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 2a28468e525f3924efed7f29f2bc5a2926e7e19a ]
+
+[BUG]
+With fuzzed image and MIXED_GROUPS super flag, we can hit the following
+BUG_ON():
+
+ kernel BUG at fs/btrfs/delayed-ref.c:491!
+ invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 0 PID: 1849 Comm: sync Tainted: G O 5.2.0-custom #27
+ RIP: 0010:update_existing_head_ref.cold+0x44/0x46 [btrfs]
+ Call Trace:
+ add_delayed_ref_head+0x20c/0x2d0 [btrfs]
+ btrfs_add_delayed_tree_ref+0x1fc/0x490 [btrfs]
+ btrfs_free_tree_block+0x123/0x380 [btrfs]
+ __btrfs_cow_block+0x435/0x500 [btrfs]
+ btrfs_cow_block+0x110/0x240 [btrfs]
+ btrfs_search_slot+0x230/0xa00 [btrfs]
+ ? __lock_acquire+0x105e/0x1e20
+ btrfs_insert_empty_items+0x67/0xc0 [btrfs]
+ alloc_reserved_file_extent+0x9e/0x340 [btrfs]
+ __btrfs_run_delayed_refs+0x78e/0x1240 [btrfs]
+ ? kvm_clock_read+0x18/0x30
+ ? __sched_clock_gtod_offset+0x21/0x50
+ btrfs_run_delayed_refs.part.0+0x4e/0x180 [btrfs]
+ btrfs_run_delayed_refs+0x23/0x30 [btrfs]
+ btrfs_commit_transaction+0x53/0x9f0 [btrfs]
+ btrfs_sync_fs+0x7c/0x1c0 [btrfs]
+ ? __ia32_sys_fdatasync+0x20/0x20
+ sync_fs_one_sb+0x23/0x30
+ iterate_supers+0x95/0x100
+ ksys_sync+0x62/0xb0
+ __ia32_sys_sync+0xe/0x20
+ do_syscall_64+0x65/0x240
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+[CAUSE]
+This situation is caused by several factors:
+- Fuzzed image
+ The extent tree of this fs missed one backref for extent tree root.
+ So we can allocated space from that slot.
+
+- MIXED_BG feature
+ Super block has MIXED_BG flag.
+
+- No mixed block groups exists
+ All block groups are just regular ones.
+
+This makes data space_info->block_groups[] contains metadata block
+groups. And when we reserve space for data, we can use space in
+metadata block group.
+
+Then we hit the following file operations:
+
+- fallocate
+ We need to allocate data extents.
+ find_free_extent() choose to use the metadata block to allocate space
+ from, and choose the space of extent tree root, since its backref is
+ missing.
+
+ This generate one delayed ref head with is_data = 1.
+
+- extent tree update
+ We need to update extent tree at run_delayed_ref time.
+
+ This generate one delayed ref head with is_data = 0, for the same
+ bytenr of old extent tree root.
+
+Then we trigger the BUG_ON().
+
+[FIX]
+The quick fix here is to check block_group->flags before using it.
+
+The problem can only happen for MIXED_GROUPS fs. Regular filesystems
+won't have space_info with DATA|METADATA flag, and no way to hit the
+bug.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203255
+Reported-by: Jungyeon Yoon <jungyeon.yoon@gmail.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent-tree.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 8b7eb22d508a5..ef2f80825c826 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5751,6 +5751,14 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ */
+ if ((flags & extra) && !(block_group->flags & extra))
+ goto loop;
++
++ /*
++ * This block group has different flags than we want.
++ * It's possible that we have MIXED_GROUP flag but no
++ * block group is mixed. Just skip such block group.
++ */
++ btrfs_release_block_group(block_group, delalloc);
++ continue;
+ }
+
+ have_block_group:
+--
+2.20.1
+
--- /dev/null
+From 055a9f002eb85ed3b0146702e41bc869ee314caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 17:00:34 +0800
+Subject: btrfs: tree-checker: Add ROOT_ITEM check
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 259ee7754b6793af8bdd77f9ca818bc41cfe9541 ]
+
+This patch will introduce ROOT_ITEM check, which includes:
+- Key->objectid and key->offset check
+ Currently only some easy check, e.g. 0 as rootid is invalid.
+
+- Item size check
+ Root item size is fixed.
+
+- Generation checks
+ Generation, generation_v2 and last_snapshot should not be greater than
+ super generation + 1
+
+- Level and alignment check
+ Level should be in [0, 7], and bytenr must be aligned to sector size.
+
+- Flags check
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203261
+Reported-by: Jungyeon Yoon <jungyeon.yoon@gmail.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/tree-checker.c | 92 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 92 insertions(+)
+
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index ccd5706199d76..d83adda6c090a 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -821,6 +821,95 @@ static int check_inode_item(struct extent_buffer *leaf,
+ return 0;
+ }
+
++static int check_root_item(struct extent_buffer *leaf, struct btrfs_key *key,
++ int slot)
++{
++ struct btrfs_fs_info *fs_info = leaf->fs_info;
++ struct btrfs_root_item ri;
++ const u64 valid_root_flags = BTRFS_ROOT_SUBVOL_RDONLY |
++ BTRFS_ROOT_SUBVOL_DEAD;
++
++ /* No such tree id */
++ if (key->objectid == 0) {
++ generic_err(leaf, slot, "invalid root id 0");
++ return -EUCLEAN;
++ }
++
++ /*
++ * Some older kernel may create ROOT_ITEM with non-zero offset, so here
++ * we only check offset for reloc tree whose key->offset must be a
++ * valid tree.
++ */
++ if (key->objectid == BTRFS_TREE_RELOC_OBJECTID && key->offset == 0) {
++ generic_err(leaf, slot, "invalid root id 0 for reloc tree");
++ return -EUCLEAN;
++ }
++
++ if (btrfs_item_size_nr(leaf, slot) != sizeof(ri)) {
++ generic_err(leaf, slot,
++ "invalid root item size, have %u expect %zu",
++ btrfs_item_size_nr(leaf, slot), sizeof(ri));
++ }
++
++ read_extent_buffer(leaf, &ri, btrfs_item_ptr_offset(leaf, slot),
++ sizeof(ri));
++
++ /* Generation related */
++ if (btrfs_root_generation(&ri) >
++ btrfs_super_generation(fs_info->super_copy) + 1) {
++ generic_err(leaf, slot,
++ "invalid root generation, have %llu expect (0, %llu]",
++ btrfs_root_generation(&ri),
++ btrfs_super_generation(fs_info->super_copy) + 1);
++ return -EUCLEAN;
++ }
++ if (btrfs_root_generation_v2(&ri) >
++ btrfs_super_generation(fs_info->super_copy) + 1) {
++ generic_err(leaf, slot,
++ "invalid root v2 generation, have %llu expect (0, %llu]",
++ btrfs_root_generation_v2(&ri),
++ btrfs_super_generation(fs_info->super_copy) + 1);
++ return -EUCLEAN;
++ }
++ if (btrfs_root_last_snapshot(&ri) >
++ btrfs_super_generation(fs_info->super_copy) + 1) {
++ generic_err(leaf, slot,
++ "invalid root last_snapshot, have %llu expect (0, %llu]",
++ btrfs_root_last_snapshot(&ri),
++ btrfs_super_generation(fs_info->super_copy) + 1);
++ return -EUCLEAN;
++ }
++
++ /* Alignment and level check */
++ if (!IS_ALIGNED(btrfs_root_bytenr(&ri), fs_info->sectorsize)) {
++ generic_err(leaf, slot,
++ "invalid root bytenr, have %llu expect to be aligned to %u",
++ btrfs_root_bytenr(&ri), fs_info->sectorsize);
++ return -EUCLEAN;
++ }
++ if (btrfs_root_level(&ri) >= BTRFS_MAX_LEVEL) {
++ generic_err(leaf, slot,
++ "invalid root level, have %u expect [0, %u]",
++ btrfs_root_level(&ri), BTRFS_MAX_LEVEL - 1);
++ return -EUCLEAN;
++ }
++ if (ri.drop_level >= BTRFS_MAX_LEVEL) {
++ generic_err(leaf, slot,
++ "invalid root level, have %u expect [0, %u]",
++ ri.drop_level, BTRFS_MAX_LEVEL - 1);
++ return -EUCLEAN;
++ }
++
++ /* Flags check */
++ if (btrfs_root_flags(&ri) & ~valid_root_flags) {
++ generic_err(leaf, slot,
++ "invalid root flags, have 0x%llx expect mask 0x%llx",
++ btrfs_root_flags(&ri), valid_root_flags);
++ return -EUCLEAN;
++ }
++ return 0;
++}
++
+ /*
+ * Common point to switch the item-specific validation.
+ */
+@@ -856,6 +945,9 @@ static int check_leaf_item(struct extent_buffer *leaf,
+ case BTRFS_INODE_ITEM_KEY:
+ ret = check_inode_item(leaf, key, slot);
+ break;
++ case BTRFS_ROOT_ITEM_KEY:
++ ret = check_root_item(leaf, key, slot);
++ break;
+ }
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 376c269d72ff99fe3965e0deb8b115b3ff60580d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 21:25:45 +0800
+Subject: closures: fix a race on wakeup from closure_sync
+
+From: Kent Overstreet <kent.overstreet@gmail.com>
+
+[ Upstream commit a22a9602b88fabf10847f238ff81fde5f906fef7 ]
+
+The race was when a thread using closure_sync() notices cl->s->done == 1
+before the thread calling closure_put() calls wake_up_process(). Then,
+it's possible for that thread to return and exit just before
+wake_up_process() is called - so we're trying to wake up a process that
+no longer exists.
+
+rcu_read_lock() is sufficient to protect against this, as there's an rcu
+barrier somewhere in the process teardown path.
+
+Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com>
+Acked-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/closure.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/closure.c b/drivers/md/bcache/closure.c
+index 73f5319295bc9..c12cd809ab193 100644
+--- a/drivers/md/bcache/closure.c
++++ b/drivers/md/bcache/closure.c
+@@ -105,8 +105,14 @@ struct closure_syncer {
+
+ static void closure_sync_fn(struct closure *cl)
+ {
+- cl->s->done = 1;
+- wake_up_process(cl->s->task);
++ struct closure_syncer *s = cl->s;
++ struct task_struct *p;
++
++ rcu_read_lock();
++ p = READ_ONCE(s->task);
++ s->done = 1;
++ wake_up_process(p);
++ rcu_read_unlock();
+ }
+
+ void __sched __closure_sync(struct closure *cl)
+--
+2.20.1
+
--- /dev/null
+From d6c1fa489c3a6fcb429df9ed6ffda6843f06e9bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jul 2019 23:38:15 +0530
+Subject: cpufreq: ap806: Add NULL check after kcalloc
+
+From: Hariprasad Kelam <hariprasad.kelam@gmail.com>
+
+[ Upstream commit 3355c91b79394593ebbb197c8e930a91826f4ff3 ]
+
+Add NULL check after kcalloc.
+
+Fix below issue reported by coccicheck
+./drivers/cpufreq/armada-8k-cpufreq.c:138:1-12: alloc with no test,
+possible model on line 151
+
+Signed-off-by: Hariprasad Kelam <hariprasad.kelam@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-8k-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/armada-8k-cpufreq.c b/drivers/cpufreq/armada-8k-cpufreq.c
+index 988ebc326bdbb..39e34f5066d3d 100644
+--- a/drivers/cpufreq/armada-8k-cpufreq.c
++++ b/drivers/cpufreq/armada-8k-cpufreq.c
+@@ -136,6 +136,8 @@ static int __init armada_8k_cpufreq_init(void)
+
+ nb_cpus = num_possible_cpus();
+ freq_tables = kcalloc(nb_cpus, sizeof(*freq_tables), GFP_KERNEL);
++ if (!freq_tables)
++ return -ENOMEM;
+ cpumask_copy(&cpus, cpu_possible_mask);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 3bbf43356c19b49a68801cd19381da5354bfaa00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Aug 2019 02:32:22 -0400
+Subject: cpufreq: imx-cpufreq-dt: Add i.MX8MN support
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 75c000c4bcbe2b0eb82baf90c7dd75c7380cc3fd ]
+
+i.MX8MN has different speed grading definition as below, it has 4 bits
+to define speed grading, add support for it.
+
+ SPEED_GRADE[3:0] MHz
+ 0000 2300
+ 0001 2200
+ 0010 2100
+ 0011 2000
+ 0100 1900
+ 0101 1800
+ 0110 1700
+ 0111 1600
+ 1000 1500
+ 1001 1400
+ 1010 1300
+ 1011 1200
+ 1100 1100
+ 1101 1000
+ 1110 900
+ 1111 800
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/imx-cpufreq-dt.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/imx-cpufreq-dt.c b/drivers/cpufreq/imx-cpufreq-dt.c
+index 4f85f3112784f..35db14cf31026 100644
+--- a/drivers/cpufreq/imx-cpufreq-dt.c
++++ b/drivers/cpufreq/imx-cpufreq-dt.c
+@@ -16,6 +16,7 @@
+
+ #define OCOTP_CFG3_SPEED_GRADE_SHIFT 8
+ #define OCOTP_CFG3_SPEED_GRADE_MASK (0x3 << 8)
++#define IMX8MN_OCOTP_CFG3_SPEED_GRADE_MASK (0xf << 8)
+ #define OCOTP_CFG3_MKT_SEGMENT_SHIFT 6
+ #define OCOTP_CFG3_MKT_SEGMENT_MASK (0x3 << 6)
+
+@@ -34,7 +35,12 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- speed_grade = (cell_value & OCOTP_CFG3_SPEED_GRADE_MASK) >> OCOTP_CFG3_SPEED_GRADE_SHIFT;
++ if (of_machine_is_compatible("fsl,imx8mn"))
++ speed_grade = (cell_value & IMX8MN_OCOTP_CFG3_SPEED_GRADE_MASK)
++ >> OCOTP_CFG3_SPEED_GRADE_SHIFT;
++ else
++ speed_grade = (cell_value & OCOTP_CFG3_SPEED_GRADE_MASK)
++ >> OCOTP_CFG3_SPEED_GRADE_SHIFT;
+ mkt_segment = (cell_value & OCOTP_CFG3_MKT_SEGMENT_MASK) >> OCOTP_CFG3_MKT_SEGMENT_SHIFT;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From c24b7e5606f80d760f3b3c27dea572a1dcbb45d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 12:12:42 +0200
+Subject: cpuidle: teo: Allow tick to be stopped if PM QoS is used
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit cab09f3d2d2a0a6cb3dfb678660d67a2c3764f50 ]
+
+The TEO goveror prevents the scheduler tick from being stopped (unless
+stopped already) if there is a PM QoS latency constraint for the given
+CPU and the target residency of the deepest idle state matching that
+constraint is below the tick boundary.
+
+However, that is problematic if CPUs with PM QoS latency constraints
+are idle for long times, because it effectively causes the tick to
+run on them all the time which is wasteful. [It is also confusing
+and questionable if they are full dynticks CPUs.]
+
+To address that issue, modify the TEO governor to carry out the
+entire search for the most suitable idle state (from the target
+residency perspective) even if a latency constraint is present,
+to allow it to determine the expected idle duration in all cases.
+
+Also, when using the last several measured idle duration values
+to refine the idle state selection, make it compare those values
+with the current expected idle duration value (instead of
+comparing them with the target residency of the idle state
+selected so far) which should prevent the tick from being
+retained when it makes sense to stop it sometimes (especially
+in the presence of PM QoS latency constraints).
+
+Fixes: b26bf6ab716f ("cpuidle: New timer events oriented governor for tickless systems")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/governors/teo.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/cpuidle/governors/teo.c b/drivers/cpuidle/governors/teo.c
+index 7d05efdbd3c66..12d9e6cecf1de 100644
+--- a/drivers/cpuidle/governors/teo.c
++++ b/drivers/cpuidle/governors/teo.c
+@@ -242,7 +242,7 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ struct teo_cpu *cpu_data = per_cpu_ptr(&teo_cpus, dev->cpu);
+ int latency_req = cpuidle_governor_latency_req(dev->cpu);
+ unsigned int duration_us, count;
+- int max_early_idx, idx, i;
++ int max_early_idx, constraint_idx, idx, i;
+ ktime_t delta_tick;
+
+ if (cpu_data->last_state >= 0) {
+@@ -257,6 +257,7 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+
+ count = 0;
+ max_early_idx = -1;
++ constraint_idx = drv->state_count;
+ idx = -1;
+
+ for (i = 0; i < drv->state_count; i++) {
+@@ -286,16 +287,8 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ if (s->target_residency > duration_us)
+ break;
+
+- if (s->exit_latency > latency_req) {
+- /*
+- * If we break out of the loop for latency reasons, use
+- * the target residency of the selected state as the
+- * expected idle duration to avoid stopping the tick
+- * as long as that target residency is low enough.
+- */
+- duration_us = drv->states[idx].target_residency;
+- goto refine;
+- }
++ if (s->exit_latency > latency_req && constraint_idx > i)
++ constraint_idx = i;
+
+ idx = i;
+
+@@ -321,7 +314,13 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ duration_us = drv->states[idx].target_residency;
+ }
+
+-refine:
++ /*
++ * If there is a latency constraint, it may be necessary to use a
++ * shallower idle state than the one selected so far.
++ */
++ if (constraint_idx < idx)
++ idx = constraint_idx;
++
+ if (idx < 0) {
+ idx = 0; /* No states enabled. Must use 0. */
+ } else if (idx > 0) {
+@@ -331,13 +330,12 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+
+ /*
+ * Count and sum the most recent idle duration values less than
+- * the target residency of the state selected so far, find the
+- * max.
++ * the current expected idle duration value.
+ */
+ for (i = 0; i < INTERVALS; i++) {
+ unsigned int val = cpu_data->intervals[i];
+
+- if (val >= drv->states[idx].target_residency)
++ if (val >= duration_us)
+ continue;
+
+ count++;
+@@ -356,8 +354,10 @@ static int teo_select(struct cpuidle_driver *drv, struct cpuidle_device *dev,
+ * would be too shallow.
+ */
+ if (!(tick_nohz_tick_stopped() && avg_us < TICK_USEC)) {
+- idx = teo_find_shallower_state(drv, dev, idx, avg_us);
+ duration_us = avg_us;
++ if (drv->states[idx].target_residency > avg_us)
++ idx = teo_find_shallower_state(drv, dev,
++ idx, avg_us);
+ }
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 01c7c23ce591f9e39b00fed294f41d6619b4d7d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 19:15:18 +0200
+Subject: dmaengine: bcm2835: Print error in case setting DMA mask fails
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit 72503b25ee363827aafffc3e8d872e6a92a7e422 ]
+
+During enabling of the RPi 4, we found out that the driver doesn't provide
+a helpful error message in case setting DMA mask fails. So add one.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Link: https://lore.kernel.org/r/1563297318-4900-1-git-send-email-wahrenst@gmx.net
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/bcm2835-dma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
+index 8101ff2f05c1c..970f654611bdd 100644
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -871,8 +871,10 @@ static int bcm2835_dma_probe(struct platform_device *pdev)
+ pdev->dev.dma_mask = &pdev->dev.coherent_dma_mask;
+
+ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+- if (rc)
++ if (rc) {
++ dev_err(&pdev->dev, "Unable to set DMA mask\n");
+ return rc;
++ }
+
+ od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL);
+ if (!od)
+--
+2.20.1
+
--- /dev/null
+From 8f31c045cbf60c8138819f118e016005ce656cd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 18:33:17 +0200
+Subject: dmaengine: iop-adma: use correct printk format strings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 00c9755524fbaa28117be774d7c92fddb5ca02f3 ]
+
+When compile-testing on other architectures, we get lots of warnings
+about incorrect format strings, like:
+
+ drivers/dma/iop-adma.c: In function 'iop_adma_alloc_slots':
+ drivers/dma/iop-adma.c:307:6: warning: format '%x' expects argument of type 'unsigned int', but argument 6 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=]
+
+ drivers/dma/iop-adma.c: In function 'iop_adma_prep_dma_memcpy':
+>> drivers/dma/iop-adma.c:518:40: warning: format '%u' expects argument of type 'unsigned int', but argument 5 has type 'size_t {aka long unsigned int}' [-Wformat=]
+
+Use %zu for printing size_t as required, and cast the dma_addr_t
+arguments to 'u64' for printing with %llx. Ideally this should use
+the %pad format string, but that requires an lvalue argument that
+doesn't work here.
+
+Link: https://lore.kernel.org/r/20190809163334.489360-3-arnd@arndb.de
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/iop-adma.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
+index c6c0143670d9d..a776857d89c8f 100644
+--- a/drivers/dma/iop-adma.c
++++ b/drivers/dma/iop-adma.c
+@@ -116,9 +116,9 @@ static void __iop_adma_slot_cleanup(struct iop_adma_chan *iop_chan)
+ list_for_each_entry_safe(iter, _iter, &iop_chan->chain,
+ chain_node) {
+ pr_debug("\tcookie: %d slot: %d busy: %d "
+- "this_desc: %#x next_desc: %#x ack: %d\n",
++ "this_desc: %#x next_desc: %#llx ack: %d\n",
+ iter->async_tx.cookie, iter->idx, busy,
+- iter->async_tx.phys, iop_desc_get_next_desc(iter),
++ iter->async_tx.phys, (u64)iop_desc_get_next_desc(iter),
+ async_tx_test_ack(&iter->async_tx));
+ prefetch(_iter);
+ prefetch(&_iter->async_tx);
+@@ -306,9 +306,9 @@ iop_adma_alloc_slots(struct iop_adma_chan *iop_chan, int num_slots,
+ int i;
+ dev_dbg(iop_chan->device->common.dev,
+ "allocated slot: %d "
+- "(desc %p phys: %#x) slots_per_op %d\n",
++ "(desc %p phys: %#llx) slots_per_op %d\n",
+ iter->idx, iter->hw_desc,
+- iter->async_tx.phys, slots_per_op);
++ (u64)iter->async_tx.phys, slots_per_op);
+
+ /* pre-ack all but the last descriptor */
+ if (num_slots != slots_per_op)
+@@ -516,7 +516,7 @@ iop_adma_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dma_dest,
+ return NULL;
+ BUG_ON(len > IOP_ADMA_MAX_BYTE_COUNT);
+
+- dev_dbg(iop_chan->device->common.dev, "%s len: %u\n",
++ dev_dbg(iop_chan->device->common.dev, "%s len: %zu\n",
+ __func__, len);
+
+ spin_lock_bh(&iop_chan->lock);
+@@ -549,7 +549,7 @@ iop_adma_prep_dma_xor(struct dma_chan *chan, dma_addr_t dma_dest,
+ BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT);
+
+ dev_dbg(iop_chan->device->common.dev,
+- "%s src_cnt: %d len: %u flags: %lx\n",
++ "%s src_cnt: %d len: %zu flags: %lx\n",
+ __func__, src_cnt, len, flags);
+
+ spin_lock_bh(&iop_chan->lock);
+@@ -582,7 +582,7 @@ iop_adma_prep_dma_xor_val(struct dma_chan *chan, dma_addr_t *dma_src,
+ if (unlikely(!len))
+ return NULL;
+
+- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n",
++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n",
+ __func__, src_cnt, len);
+
+ spin_lock_bh(&iop_chan->lock);
+@@ -620,7 +620,7 @@ iop_adma_prep_dma_pq(struct dma_chan *chan, dma_addr_t *dst, dma_addr_t *src,
+ BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT);
+
+ dev_dbg(iop_chan->device->common.dev,
+- "%s src_cnt: %d len: %u flags: %lx\n",
++ "%s src_cnt: %d len: %zu flags: %lx\n",
+ __func__, src_cnt, len, flags);
+
+ if (dmaf_p_disabled_continue(flags))
+@@ -683,7 +683,7 @@ iop_adma_prep_dma_pq_val(struct dma_chan *chan, dma_addr_t *pq, dma_addr_t *src,
+ return NULL;
+ BUG_ON(len > IOP_ADMA_XOR_MAX_BYTE_COUNT);
+
+- dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %u\n",
++ dev_dbg(iop_chan->device->common.dev, "%s src_cnt: %d len: %zu\n",
+ __func__, src_cnt, len);
+
+ spin_lock_bh(&iop_chan->lock);
+--
+2.20.1
+
--- /dev/null
+From 160fab755af13016c8ccefadb2db7ab14ec0a9ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 15:56:14 +0300
+Subject: dmaengine: ti: edma: Do not reset reserved paRAM slots
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit c5dbe60664b3660f5ac5854e21273ea2e7ff698f ]
+
+Skip resetting paRAM slots marked as reserved as they might be used by
+other cores.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20190823125618.8133-2-peter.ujfalusi@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index ceabdea40ae0f..982631d4e1f8a 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2273,9 +2273,6 @@ static int edma_probe(struct platform_device *pdev)
+
+ ecc->default_queue = info->default_queue;
+
+- for (i = 0; i < ecc->num_slots; i++)
+- edma_write_slot(ecc, i, &dummy_paramset);
+-
+ if (info->rsv) {
+ /* Set the reserved slots in inuse list */
+ rsv_slots = info->rsv->rsv_slots;
+@@ -2288,6 +2285,12 @@ static int edma_probe(struct platform_device *pdev)
+ }
+ }
+
++ for (i = 0; i < ecc->num_slots; i++) {
++ /* Reset only unused - not reserved - paRAM slots */
++ if (!test_bit(i, ecc->slot_inuse))
++ edma_write_slot(ecc, i, &dummy_paramset);
++ }
++
+ /* Clear the xbar mapped channels in unused list */
+ xbar_chans = info->xbar_chans;
+ if (xbar_chans) {
+--
+2.20.1
+
--- /dev/null
+From 84e1929d845377c41403783153dfc84c9c1cd0ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2019 21:14:18 +0200
+Subject: drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2)
+
+From: Ahzo <Ahzo@tutanota.com>
+
+[ Upstream commit f659bb6dae58c113805f92822e4c16ddd3156b79 ]
+
+This fixes screen corruption/flickering on 75 Hz displays.
+
+v2: make print statement debug only (Alex)
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=102646
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Ahzo <Ahzo@tutanota.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 487aeee1cf8a5..3c1084de5d59f 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -4068,6 +4068,11 @@ static int smu7_program_display_gap(struct pp_hwmgr *hwmgr)
+
+ data->frame_time_x2 = frame_time_in_us * 2 / 100;
+
++ if (data->frame_time_x2 < 280) {
++ pr_debug("%s: enforce minimal VBITimeout: %d -> 280\n", __func__, data->frame_time_x2);
++ data->frame_time_x2 = 280;
++ }
++
+ display_gap2 = pre_vbi_time_in_us * (ref_clock / 100);
+
+ cgs_write_ind_register(hwmgr->device, CGS_IND_REG__SMC, ixCG_DISPLAY_GAP_CNTL2, display_gap2);
+--
+2.20.1
+
--- /dev/null
+From 0a0e15eb349051771c7d2fd8a97e4b321982d364 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 12:43:12 +0300
+Subject: drm: fix module name in edid_firmware log message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit ade925995b172f1d7410d1c665b2f47c5e99bef0 ]
+
+The module is drm_kms_helper, not drm_kms_firmware.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204549
+Reported-by: Göran Uddeborg <goeran@uddeborg.se>
+Fixes: ac6c35a4d8c7 ("drm: add backwards compatibility support for drm_kms_helper.edid_firmware")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190821094312.5514-1-jani.nikula@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_kms_helper_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_kms_helper_common.c b/drivers/gpu/drm/drm_kms_helper_common.c
+index d9a5ac81949e2..221a8528c9937 100644
+--- a/drivers/gpu/drm/drm_kms_helper_common.c
++++ b/drivers/gpu/drm/drm_kms_helper_common.c
+@@ -40,7 +40,7 @@ MODULE_LICENSE("GPL and additional rights");
+ /* Backward compatibility for drm_kms_helper.edid_firmware */
+ static int edid_firmware_set(const char *val, const struct kernel_param *kp)
+ {
+- DRM_NOTE("drm_kms_firmware.edid_firmware is deprecated, please use drm.edid_firmware instead.\n");
++ DRM_NOTE("drm_kms_helper.edid_firmware is deprecated, please use drm.edid_firmware instead.\n");
+
+ return __drm_set_edid_firmware_path(val);
+ }
+--
+2.20.1
+
--- /dev/null
+From 81fa0a47bc44d98d00cd86c53292bf2a76883067 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2019 12:55:45 +0800
+Subject: e1000e: add workaround for possible stalled packet
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit e5e9a2ecfe780975820e157b922edee715710b66 ]
+
+This works around a possible stalled packet issue, which may occur due to
+clock recovery from the PCH being too slow, when the LAN is transitioning
+from K1 at 1G link speed.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204057
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000e/ich8lan.c | 10 ++++++++++
+ drivers/net/ethernet/intel/e1000e/ich8lan.h | 2 +-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+index 395b057014809..a1fab77b2096a 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
+@@ -1429,6 +1429,16 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
+ else
+ phy_reg |= 0xFA;
+ e1e_wphy_locked(hw, I217_PLL_CLOCK_GATE_REG, phy_reg);
++
++ if (speed == SPEED_1000) {
++ hw->phy.ops.read_reg_locked(hw, HV_PM_CTRL,
++ &phy_reg);
++
++ phy_reg |= HV_PM_CTRL_K1_CLK_REQ;
++
++ hw->phy.ops.write_reg_locked(hw, HV_PM_CTRL,
++ phy_reg);
++ }
+ }
+ hw->phy.ops.release(hw);
+
+diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+index eb09c755fa172..1502895eb45dd 100644
+--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
+@@ -210,7 +210,7 @@
+
+ /* PHY Power Management Control */
+ #define HV_PM_CTRL PHY_REG(770, 17)
+-#define HV_PM_CTRL_PLL_STOP_IN_K1_GIGA 0x100
++#define HV_PM_CTRL_K1_CLK_REQ 0x200
+ #define HV_PM_CTRL_K1_ENABLE 0x4000
+
+ #define I217_PLL_CLOCK_GATE_REG PHY_REG(772, 28)
+--
+2.20.1
+
--- /dev/null
+From 2afb837c731c24bf2654345acdb308a76f0607b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 16:47:17 +0300
+Subject: EDAC/altera: Use the proper type for the IRQ status bits
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8faa1cf6ed82f33009f63986c3776cc48af1b7b2 ]
+
+Smatch complains about the cast of a u32 pointer to unsigned long:
+
+ drivers/edac/altera_edac.c:1878 altr_edac_a10_irq_handler()
+ warn: passing casted pointer '&irq_status' to 'find_first_bit()'
+
+This code wouldn't work on a 64 bit big endian system because it would
+read past the end of &irq_status.
+
+ [ bp: massage. ]
+
+Fixes: 13ab8448d2c9 ("EDAC, altera: Add ECC Manager IRQ controller support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Thor Thayer <thor.thayer@linux.intel.com>
+Cc: James Morse <james.morse@arm.com>
+Cc: kernel-janitors@vger.kernel.org
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20190624134717.GA1754@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/altera_edac.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
+index c2e693e34d434..bf024ec0116c7 100644
+--- a/drivers/edac/altera_edac.c
++++ b/drivers/edac/altera_edac.c
+@@ -1866,6 +1866,7 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc)
+ struct altr_arria10_edac *edac = irq_desc_get_handler_data(desc);
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+ int irq = irq_desc_get_irq(desc);
++ unsigned long bits;
+
+ dberr = (irq == edac->db_irq) ? 1 : 0;
+ sm_offset = dberr ? A10_SYSMGR_ECC_INTSTAT_DERR_OFST :
+@@ -1875,7 +1876,8 @@ static void altr_edac_a10_irq_handler(struct irq_desc *desc)
+
+ regmap_read(edac->ecc_mgr_map, sm_offset, &irq_status);
+
+- for_each_set_bit(bit, (unsigned long *)&irq_status, 32) {
++ bits = irq_status;
++ for_each_set_bit(bit, &bits, 32) {
+ irq = irq_linear_revmap(edac->domain, dberr * 32 + bit);
+ if (irq)
+ generic_handle_irq(irq);
+--
+2.20.1
+
--- /dev/null
+From 3840dd5c21b3ff7c31ed8ed39f6b4ab438726261 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 00:00:00 +0000
+Subject: EDAC/amd64: Decode syndrome before translating address
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit 8a2eaab7daf03b23ac902481218034ae2fae5e16 ]
+
+AMD Family 17h systems currently require address translation in order to
+report the system address of a DRAM ECC error. This is currently done
+before decoding the syndrome information. The syndrome information does
+not depend on the address translation, so the proper EDAC csrow/channel
+reporting can function without the address. However, the syndrome
+information will not be decoded if the address translation fails.
+
+Decode the syndrome information before doing the address translation.
+The syndrome information is architecturally defined in MCA_SYND and can
+be considered robust. The address translation is system-specific and may
+fail on newer systems without proper updates to the translation
+algorithm.
+
+Fixes: 713ad54675fd ("EDAC, amd64: Define and register UMC error decode function")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20190821235938.118710-6-Yazen.Ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/amd64_edac.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index ffe56a8fe39da..608fdab566b32 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2550,13 +2550,6 @@ static void decode_umc_error(int node_id, struct mce *m)
+
+ err.channel = find_umc_channel(m);
+
+- if (umc_normaddr_to_sysaddr(m->addr, pvt->mc_node_id, err.channel, &sys_addr)) {
+- err.err_code = ERR_NORM_ADDR;
+- goto log_error;
+- }
+-
+- error_address_to_page_and_offset(sys_addr, &err);
+-
+ if (!(m->status & MCI_STATUS_SYNDV)) {
+ err.err_code = ERR_SYND;
+ goto log_error;
+@@ -2573,6 +2566,13 @@ static void decode_umc_error(int node_id, struct mce *m)
+
+ err.csrow = m->synd & 0x7;
+
++ if (umc_normaddr_to_sysaddr(m->addr, pvt->mc_node_id, err.channel, &sys_addr)) {
++ err.err_code = ERR_NORM_ADDR;
++ goto log_error;
++ }
++
++ error_address_to_page_and_offset(sys_addr, &err);
++
+ log_error:
+ __log_ecc_error(mci, &err, ecc_type);
+ }
+--
+2.20.1
+
--- /dev/null
+From 3e79169e10cd2eccf52c7b734fde2f027bdab41f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 23:59:56 +0000
+Subject: EDAC/amd64: Recognize DRAM device type ECC capability
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit f8be8e5680225ac9caf07d4545f8529b7395327f ]
+
+AMD Family 17h systems support x4 and x16 DRAM devices. However, the
+device type is not checked when setting mci.edac_ctl_cap.
+
+Set the appropriate capability flag based on the device type.
+
+Default to x8 DRAM device when neither the x4 or x16 bits are set.
+
+ [ bp: reverse cpk_en check to save an indentation level. ]
+
+Fixes: 2d09d8f301f5 ("EDAC, amd64: Determine EDAC MC capabilities on Fam17h")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20190821235938.118710-3-Yazen.Ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/amd64_edac.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index dd60cf5a3d969..ffe56a8fe39da 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -3150,12 +3150,15 @@ static bool ecc_enabled(struct pci_dev *F3, u16 nid)
+ static inline void
+ f17h_determine_edac_ctl_cap(struct mem_ctl_info *mci, struct amd64_pvt *pvt)
+ {
+- u8 i, ecc_en = 1, cpk_en = 1;
++ u8 i, ecc_en = 1, cpk_en = 1, dev_x4 = 1, dev_x16 = 1;
+
+ for_each_umc(i) {
+ if (pvt->umc[i].sdp_ctrl & UMC_SDP_INIT) {
+ ecc_en &= !!(pvt->umc[i].umc_cap_hi & UMC_ECC_ENABLED);
+ cpk_en &= !!(pvt->umc[i].umc_cap_hi & UMC_ECC_CHIPKILL_CAP);
++
++ dev_x4 &= !!(pvt->umc[i].dimm_cfg & BIT(6));
++ dev_x16 &= !!(pvt->umc[i].dimm_cfg & BIT(7));
+ }
+ }
+
+@@ -3163,8 +3166,15 @@ f17h_determine_edac_ctl_cap(struct mem_ctl_info *mci, struct amd64_pvt *pvt)
+ if (ecc_en) {
+ mci->edac_ctl_cap |= EDAC_FLAG_SECDED;
+
+- if (cpk_en)
++ if (!cpk_en)
++ return;
++
++ if (dev_x4)
+ mci->edac_ctl_cap |= EDAC_FLAG_S4ECD4ED;
++ else if (dev_x16)
++ mci->edac_ctl_cap |= EDAC_FLAG_S16ECD16ED;
++ else
++ mci->edac_ctl_cap |= EDAC_FLAG_S8ECD8ED;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8e4e929174987fc3f9cbccdc04c59a2be73dfd48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 23:59:55 +0000
+Subject: EDAC/amd64: Support more than two controllers for chip selects
+ handling
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit d971e28e2ce4696fcc32998c8aced5e47701fffe ]
+
+The struct chip_select array that's used for saving chip select bases
+and masks is fixed at length of two. There should be one struct
+chip_select for each controller, so this array should be increased to
+support systems that may have more than two controllers.
+
+Increase the size of the struct chip_select array to eight, which is the
+largest number of controllers per die currently supported on AMD
+systems.
+
+Fix number of DIMMs and Chip Select bases/masks on Family17h, because
+AMD Family 17h systems support 2 DIMMs, 4 CS bases, and 2 CS masks per
+channel.
+
+Also, carve out the Family 17h+ reading of the bases/masks into a
+separate function. This effectively reverts the original bases/masks
+reading code to before Family 17h support was added.
+
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20190821235938.118710-2-Yazen.Ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/amd64_edac.c | 123 +++++++++++++++++++++-----------------
+ drivers/edac/amd64_edac.h | 5 +-
+ 2 files changed, 71 insertions(+), 57 deletions(-)
+
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 873437be86d9c..dd60cf5a3d969 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -810,7 +810,7 @@ static void debug_display_dimm_sizes_df(struct amd64_pvt *pvt, u8 ctrl)
+
+ edac_printk(KERN_DEBUG, EDAC_MC, "UMC%d chip selects:\n", ctrl);
+
+- for (dimm = 0; dimm < 4; dimm++) {
++ for (dimm = 0; dimm < 2; dimm++) {
+ size0 = 0;
+ cs0 = dimm * 2;
+
+@@ -942,89 +942,102 @@ static void prep_chip_selects(struct amd64_pvt *pvt)
+ } else if (pvt->fam == 0x15 && pvt->model == 0x30) {
+ pvt->csels[0].b_cnt = pvt->csels[1].b_cnt = 4;
+ pvt->csels[0].m_cnt = pvt->csels[1].m_cnt = 2;
++ } else if (pvt->fam >= 0x17) {
++ int umc;
++
++ for_each_umc(umc) {
++ pvt->csels[umc].b_cnt = 4;
++ pvt->csels[umc].m_cnt = 2;
++ }
++
+ } else {
+ pvt->csels[0].b_cnt = pvt->csels[1].b_cnt = 8;
+ pvt->csels[0].m_cnt = pvt->csels[1].m_cnt = 4;
+ }
+ }
+
++static void read_umc_base_mask(struct amd64_pvt *pvt)
++{
++ u32 umc_base_reg, umc_mask_reg;
++ u32 base_reg, mask_reg;
++ u32 *base, *mask;
++ int cs, umc;
++
++ for_each_umc(umc) {
++ umc_base_reg = get_umc_base(umc) + UMCCH_BASE_ADDR;
++
++ for_each_chip_select(cs, umc, pvt) {
++ base = &pvt->csels[umc].csbases[cs];
++
++ base_reg = umc_base_reg + (cs * 4);
++
++ if (!amd_smn_read(pvt->mc_node_id, base_reg, base))
++ edac_dbg(0, " DCSB%d[%d]=0x%08x reg: 0x%x\n",
++ umc, cs, *base, base_reg);
++ }
++
++ umc_mask_reg = get_umc_base(umc) + UMCCH_ADDR_MASK;
++
++ for_each_chip_select_mask(cs, umc, pvt) {
++ mask = &pvt->csels[umc].csmasks[cs];
++
++ mask_reg = umc_mask_reg + (cs * 4);
++
++ if (!amd_smn_read(pvt->mc_node_id, mask_reg, mask))
++ edac_dbg(0, " DCSM%d[%d]=0x%08x reg: 0x%x\n",
++ umc, cs, *mask, mask_reg);
++ }
++ }
++}
++
+ /*
+ * Function 2 Offset F10_DCSB0; read in the DCS Base and DCS Mask registers
+ */
+ static void read_dct_base_mask(struct amd64_pvt *pvt)
+ {
+- int base_reg0, base_reg1, mask_reg0, mask_reg1, cs;
++ int cs;
+
+ prep_chip_selects(pvt);
+
+- if (pvt->umc) {
+- base_reg0 = get_umc_base(0) + UMCCH_BASE_ADDR;
+- base_reg1 = get_umc_base(1) + UMCCH_BASE_ADDR;
+- mask_reg0 = get_umc_base(0) + UMCCH_ADDR_MASK;
+- mask_reg1 = get_umc_base(1) + UMCCH_ADDR_MASK;
+- } else {
+- base_reg0 = DCSB0;
+- base_reg1 = DCSB1;
+- mask_reg0 = DCSM0;
+- mask_reg1 = DCSM1;
+- }
++ if (pvt->umc)
++ return read_umc_base_mask(pvt);
+
+ for_each_chip_select(cs, 0, pvt) {
+- int reg0 = base_reg0 + (cs * 4);
+- int reg1 = base_reg1 + (cs * 4);
++ int reg0 = DCSB0 + (cs * 4);
++ int reg1 = DCSB1 + (cs * 4);
+ u32 *base0 = &pvt->csels[0].csbases[cs];
+ u32 *base1 = &pvt->csels[1].csbases[cs];
+
+- if (pvt->umc) {
+- if (!amd_smn_read(pvt->mc_node_id, reg0, base0))
+- edac_dbg(0, " DCSB0[%d]=0x%08x reg: 0x%x\n",
+- cs, *base0, reg0);
+-
+- if (!amd_smn_read(pvt->mc_node_id, reg1, base1))
+- edac_dbg(0, " DCSB1[%d]=0x%08x reg: 0x%x\n",
+- cs, *base1, reg1);
+- } else {
+- if (!amd64_read_dct_pci_cfg(pvt, 0, reg0, base0))
+- edac_dbg(0, " DCSB0[%d]=0x%08x reg: F2x%x\n",
+- cs, *base0, reg0);
++ if (!amd64_read_dct_pci_cfg(pvt, 0, reg0, base0))
++ edac_dbg(0, " DCSB0[%d]=0x%08x reg: F2x%x\n",
++ cs, *base0, reg0);
+
+- if (pvt->fam == 0xf)
+- continue;
++ if (pvt->fam == 0xf)
++ continue;
+
+- if (!amd64_read_dct_pci_cfg(pvt, 1, reg0, base1))
+- edac_dbg(0, " DCSB1[%d]=0x%08x reg: F2x%x\n",
+- cs, *base1, (pvt->fam == 0x10) ? reg1
+- : reg0);
+- }
++ if (!amd64_read_dct_pci_cfg(pvt, 1, reg0, base1))
++ edac_dbg(0, " DCSB1[%d]=0x%08x reg: F2x%x\n",
++ cs, *base1, (pvt->fam == 0x10) ? reg1
++ : reg0);
+ }
+
+ for_each_chip_select_mask(cs, 0, pvt) {
+- int reg0 = mask_reg0 + (cs * 4);
+- int reg1 = mask_reg1 + (cs * 4);
++ int reg0 = DCSM0 + (cs * 4);
++ int reg1 = DCSM1 + (cs * 4);
+ u32 *mask0 = &pvt->csels[0].csmasks[cs];
+ u32 *mask1 = &pvt->csels[1].csmasks[cs];
+
+- if (pvt->umc) {
+- if (!amd_smn_read(pvt->mc_node_id, reg0, mask0))
+- edac_dbg(0, " DCSM0[%d]=0x%08x reg: 0x%x\n",
+- cs, *mask0, reg0);
+-
+- if (!amd_smn_read(pvt->mc_node_id, reg1, mask1))
+- edac_dbg(0, " DCSM1[%d]=0x%08x reg: 0x%x\n",
+- cs, *mask1, reg1);
+- } else {
+- if (!amd64_read_dct_pci_cfg(pvt, 0, reg0, mask0))
+- edac_dbg(0, " DCSM0[%d]=0x%08x reg: F2x%x\n",
+- cs, *mask0, reg0);
++ if (!amd64_read_dct_pci_cfg(pvt, 0, reg0, mask0))
++ edac_dbg(0, " DCSM0[%d]=0x%08x reg: F2x%x\n",
++ cs, *mask0, reg0);
+
+- if (pvt->fam == 0xf)
+- continue;
++ if (pvt->fam == 0xf)
++ continue;
+
+- if (!amd64_read_dct_pci_cfg(pvt, 1, reg0, mask1))
+- edac_dbg(0, " DCSM1[%d]=0x%08x reg: F2x%x\n",
+- cs, *mask1, (pvt->fam == 0x10) ? reg1
+- : reg0);
+- }
++ if (!amd64_read_dct_pci_cfg(pvt, 1, reg0, mask1))
++ edac_dbg(0, " DCSM1[%d]=0x%08x reg: F2x%x\n",
++ cs, *mask1, (pvt->fam == 0x10) ? reg1
++ : reg0);
+ }
+ }
+
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index 8f66472f7adc2..4dce6a2ac75f9 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -96,6 +96,7 @@
+ /* Hardware limit on ChipSelect rows per MC and processors per system */
+ #define NUM_CHIPSELECTS 8
+ #define DRAM_RANGES 8
++#define NUM_CONTROLLERS 8
+
+ #define ON true
+ #define OFF false
+@@ -351,8 +352,8 @@ struct amd64_pvt {
+ u32 dbam0; /* DRAM Base Address Mapping reg for DCT0 */
+ u32 dbam1; /* DRAM Base Address Mapping reg for DCT1 */
+
+- /* one for each DCT */
+- struct chip_select csels[2];
++ /* one for each DCT/UMC */
++ struct chip_select csels[NUM_CONTROLLERS];
+
+ /* DRAM base and limit pairs F1x[78,70,68,60,58,50,48,40] */
+ struct dram_range ranges[DRAM_RANGES];
+--
+2.20.1
+
--- /dev/null
+From 6a5441822be0ddee40e4977b8cc5596267fe8f7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 15:08:55 +0000
+Subject: EDAC/mc: Fix grain_bits calculation
+
+From: Robert Richter <rrichter@marvell.com>
+
+[ Upstream commit 3724ace582d9f675134985727fd5e9811f23c059 ]
+
+The grain in EDAC is defined as "minimum granularity for an error
+report, in bytes". The following calculation of the grain_bits in
+edac_mc is wrong:
+
+ grain_bits = fls_long(e->grain) + 1;
+
+Where grain_bits is defined as:
+
+ grain = 1 << grain_bits
+
+Example:
+
+ grain = 8 # 64 bit (8 bytes)
+ grain_bits = fls_long(8) + 1
+ grain_bits = 4 + 1 = 5
+
+ grain = 1 << grain_bits
+ grain = 1 << 5 = 32
+
+Replace it with the correct calculation:
+
+ grain_bits = fls_long(e->grain - 1);
+
+The example gives now:
+
+ grain_bits = fls_long(8 - 1)
+ grain_bits = fls_long(7)
+ grain_bits = 3
+
+ grain = 1 << 3 = 8
+
+Also, check if the hardware reports a reasonable grain != 0 and fallback
+with a warning to 1 byte granularity otherwise.
+
+ [ bp: massage a bit. ]
+
+Signed-off-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Tony Luck <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/20190624150758.6695-2-rrichter@marvell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/edac_mc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index 64922c8fa7e3b..d899d86897d06 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -1235,9 +1235,13 @@ void edac_mc_handle_error(const enum hw_event_mc_err_type type,
+ if (p > e->location)
+ *(p - 1) = '\0';
+
+- /* Report the error via the trace interface */
+- grain_bits = fls_long(e->grain) + 1;
++ /* Sanity-check driver-supplied grain value. */
++ if (WARN_ON_ONCE(!e->grain))
++ e->grain = 1;
++
++ grain_bits = fls_long(e->grain - 1);
+
++ /* Report the error via the trace interface */
+ if (IS_ENABLED(CONFIG_RAS))
+ trace_mc_event(type, e->msg, e->label, e->error_count,
+ mci->mc_idx, e->top_layer, e->mid_layer,
+--
+2.20.1
+
--- /dev/null
+From 64ec3a7dafc1284610a273ae0cb8d0c4d4982570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 14:18:02 +0000
+Subject: EDAC, pnd2: Fix ioremap() size in dnv_rd_reg()
+
+From: Stephen Douthit <stephend@silicom-usa.com>
+
+[ Upstream commit 29a3388bfcce7a6d087051376ea02bf8326a957b ]
+
+Depending on how BIOS has marked the reserved region containing the 32KB
+MCHBAR you can get warnings like:
+
+resource sanity check: requesting [mem 0xfed10000-0xfed1ffff], which spans more than reserved [mem 0xfed10000-0xfed17fff]
+caller dnv_rd_reg+0xc8/0x240 [pnd2_edac] mapping multiple BARs
+
+Not all of the mmio regions used in dnv_rd_reg() are the same size. The
+MCHBAR window is 32KB and the sideband ports are 64KB. Pass the correct
+size to ioremap() depending on which resource we're reading from.
+
+Signed-off-by: Stephen Douthit <stephend@silicom-usa.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/pnd2_edac.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c
+index ca25f8fe57ef3..1ad538baaa4a9 100644
+--- a/drivers/edac/pnd2_edac.c
++++ b/drivers/edac/pnd2_edac.c
+@@ -260,11 +260,14 @@ static u64 get_sideband_reg_base_addr(void)
+ }
+ }
+
++#define DNV_MCHBAR_SIZE 0x8000
++#define DNV_SB_PORT_SIZE 0x10000
+ static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *name)
+ {
+ struct pci_dev *pdev;
+ char *base;
+ u64 addr;
++ unsigned long size;
+
+ if (op == 4) {
+ pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x1980, NULL);
+@@ -279,15 +282,17 @@ static int dnv_rd_reg(int port, int off, int op, void *data, size_t sz, char *na
+ addr = get_mem_ctrl_hub_base_addr();
+ if (!addr)
+ return -ENODEV;
++ size = DNV_MCHBAR_SIZE;
+ } else {
+ /* MMIO via sideband register base address */
+ addr = get_sideband_reg_base_addr();
+ if (!addr)
+ return -ENODEV;
+ addr += (port << 16);
++ size = DNV_SB_PORT_SIZE;
+ }
+
+- base = ioremap((resource_size_t)addr, 0x10000);
++ base = ioremap((resource_size_t)addr, size);
+ if (!base)
+ return -ENODEV;
+
+--
+2.20.1
+
--- /dev/null
+From 83412fef54f8cde6c5e6d8686aef7ee3c23bcdab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2019 09:43:37 +0800
+Subject: efi: cper: print AER info of PCIe fatal error
+
+From: Xiaofei Tan <tanxiaofei@huawei.com>
+
+[ Upstream commit b194a77fcc4001dc40aecdd15d249648e8a436d1 ]
+
+AER info of PCIe fatal error is not printed in the current driver.
+Because APEI driver will panic directly for fatal error, and can't
+run to the place of printing AER info.
+
+An example log is as following:
+{763}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 11
+{763}[Hardware Error]: event severity: fatal
+{763}[Hardware Error]: Error 0, type: fatal
+{763}[Hardware Error]: section_type: PCIe error
+{763}[Hardware Error]: port_type: 0, PCIe end point
+{763}[Hardware Error]: version: 4.0
+{763}[Hardware Error]: command: 0x0000, status: 0x0010
+{763}[Hardware Error]: device_id: 0000:82:00.0
+{763}[Hardware Error]: slot: 0
+{763}[Hardware Error]: secondary_bus: 0x00
+{763}[Hardware Error]: vendor_id: 0x8086, device_id: 0x10fb
+{763}[Hardware Error]: class_code: 000002
+Kernel panic - not syncing: Fatal hardware error!
+
+This issue was imported by the patch, '37448adfc7ce ("aerdrv: Move
+cper_print_aer() call out of interrupt context")'. To fix this issue,
+this patch adds print of AER info in cper_print_pcie() for fatal error.
+
+Here is the example log after this patch applied:
+{24}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 10
+{24}[Hardware Error]: event severity: fatal
+{24}[Hardware Error]: Error 0, type: fatal
+{24}[Hardware Error]: section_type: PCIe error
+{24}[Hardware Error]: port_type: 0, PCIe end point
+{24}[Hardware Error]: version: 4.0
+{24}[Hardware Error]: command: 0x0546, status: 0x4010
+{24}[Hardware Error]: device_id: 0000:01:00.0
+{24}[Hardware Error]: slot: 0
+{24}[Hardware Error]: secondary_bus: 0x00
+{24}[Hardware Error]: vendor_id: 0x15b3, device_id: 0x1019
+{24}[Hardware Error]: class_code: 000002
+{24}[Hardware Error]: aer_uncor_status: 0x00040000, aer_uncor_mask: 0x00000000
+{24}[Hardware Error]: aer_uncor_severity: 0x00062010
+{24}[Hardware Error]: TLP Header: 000000c0 01010000 00000001 00000000
+Kernel panic - not syncing: Fatal hardware error!
+
+Fixes: 37448adfc7ce ("aerdrv: Move cper_print_aer() call out of interrupt context")
+Signed-off-by: Xiaofei Tan <tanxiaofei@huawei.com>
+Reviewed-by: James Morse <james.morse@arm.com>
+[ardb: put parens around terms of && operator]
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/cper.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 8fa977c7861f9..addf0749dd8b6 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -390,6 +390,21 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie,
+ printk(
+ "%s""bridge: secondary_status: 0x%04x, control: 0x%04x\n",
+ pfx, pcie->bridge.secondary_status, pcie->bridge.control);
++
++ /* Fatal errors call __ghes_panic() before AER handler prints this */
++ if ((pcie->validation_bits & CPER_PCIE_VALID_AER_INFO) &&
++ (gdata->error_severity & CPER_SEV_FATAL)) {
++ struct aer_capability_regs *aer;
++
++ aer = (struct aer_capability_regs *)pcie->aer_info;
++ printk("%saer_uncor_status: 0x%08x, aer_uncor_mask: 0x%08x\n",
++ pfx, aer->uncor_status, aer->uncor_mask);
++ printk("%saer_uncor_severity: 0x%08x\n",
++ pfx, aer->uncor_severity);
++ printk("%sTLP Header: %08x %08x %08x %08x\n", pfx,
++ aer->header_log.dw0, aer->header_log.dw1,
++ aer->header_log.dw2, aer->header_log.dw3);
++ }
+ }
+
+ static void cper_print_tstamp(const char *pfx,
+--
+2.20.1
+
--- /dev/null
+From ac137b2159f902f0722aff83c12d6cf6114b1cdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2019 15:48:36 +0100
+Subject: firmware: arm_scmi: Check if platform has released shmem before using
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 9dc34d635c67e57051853855c43249408641a5ab ]
+
+Sometimes platfom may take too long to respond to the command and OS
+might timeout before platform transfer the ownership of the shared
+memory region to the OS with the response.
+
+Since the mailbox channel associated with the channel is freed and new
+commands are dispatch on the same channel, OS needs to wait until it
+gets back the ownership. If not, either OS may end up overwriting the
+platform response for the last command(which is fine as OS timed out
+that command) or platform might overwrite the payload for the next
+command with the response for the old.
+
+The latter is problematic as platform may end up interpretting the
+response as the payload. In order to avoid such race, let's wait until
+the OS gets back the ownership before we prepare the shared memory with
+the payload for the next command.
+
+Reported-by: Jim Quinlan <james.quinlan@broadcom.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/driver.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index b5bc4c7a8fab2..b49c9e6f4bf10 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -271,6 +271,14 @@ static void scmi_tx_prepare(struct mbox_client *cl, void *m)
+ struct scmi_chan_info *cinfo = client_to_scmi_chan_info(cl);
+ struct scmi_shared_mem __iomem *mem = cinfo->payload;
+
++ /*
++ * Ideally channel must be free by now unless OS timeout last
++ * request and platform continued to process the same, wait
++ * until it releases the shared memory, otherwise we may endup
++ * overwriting its response with new message payload or vice-versa
++ */
++ spin_until_cond(ioread32(&mem->channel_status) &
++ SCMI_SHMEM_CHAN_STAT_CHANNEL_FREE);
+ /* Mark channel busy + clear error */
+ iowrite32(0x0, &mem->channel_status);
+ iowrite32(t->hdr.poll_completion ? 0 : SCMI_SHMEM_FLAG_INTR_ENABLED,
+--
+2.20.1
+
--- /dev/null
+From 4c139add9dfb35d9b320fdc9cda2933b6afd682f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2019 14:09:21 -0700
+Subject: firmware: qcom_scm: Use proper types for dma mappings
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 6e37ccf78a53296c6c7bf426065762c27829eb84 ]
+
+We need to use the proper types and convert between physical addresses
+and dma addresses here to avoid mismatch warnings. This is especially
+important on systems with a different size for dma addresses and
+physical addresses. Otherwise, we get the following warning:
+
+ drivers/firmware/qcom_scm.c: In function "qcom_scm_assign_mem":
+ drivers/firmware/qcom_scm.c:469:47: error: passing argument 3 of "dma_alloc_coherent" from incompatible pointer type [-Werror=incompatible-pointer-types]
+
+We also fix the size argument to dma_free_coherent() because that size
+doesn't need to be aligned after it's already aligned on the allocation
+size. In fact, dma debugging expects the same arguments to be passed to
+both the allocation and freeing sides of the functions so changing the
+size is incorrect regardless.
+
+Reported-by: Ian Jackson <ian.jackson@citrix.com>
+Cc: Ian Jackson <ian.jackson@citrix.com>
+Cc: Julien Grall <julien.grall@arm.com>
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: Avaneesh Kumar Dwivedi <akdwived@codeaurora.org>
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 2ddc118dba1b4..74b84244a0db8 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -9,6 +9,7 @@
+ #include <linux/init.h>
+ #include <linux/cpumask.h>
+ #include <linux/export.h>
++#include <linux/dma-direct.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/module.h>
+ #include <linux/types.h>
+@@ -440,6 +441,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ phys_addr_t mem_to_map_phys;
+ phys_addr_t dest_phys;
+ phys_addr_t ptr_phys;
++ dma_addr_t ptr_dma;
+ size_t mem_to_map_sz;
+ size_t dest_sz;
+ size_t src_sz;
+@@ -457,9 +459,10 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+ ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) +
+ ALIGN(dest_sz, SZ_64);
+
+- ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_phys, GFP_KERNEL);
++ ptr = dma_alloc_coherent(__scm->dev, ptr_sz, &ptr_dma, GFP_KERNEL);
+ if (!ptr)
+ return -ENOMEM;
++ ptr_phys = dma_to_phys(__scm->dev, ptr_dma);
+
+ /* Fill source vmid detail */
+ src = ptr;
+@@ -489,7 +492,7 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
+
+ ret = __qcom_scm_assign_mem(__scm->dev, mem_to_map_phys, mem_to_map_sz,
+ ptr_phys, src_sz, dest_phys, dest_sz);
+- dma_free_coherent(__scm->dev, ALIGN(ptr_sz, SZ_64), ptr, ptr_phys);
++ dma_free_coherent(__scm->dev, ptr_sz, ptr, ptr_dma);
+ if (ret) {
+ dev_err(__scm->dev,
+ "Assign memory protection call failed %d.\n", ret);
+--
+2.20.1
+
--- /dev/null
+From 5f9328fdf7809a455b30c71e4208f8a632ee7379 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 10:07:47 +0100
+Subject: gpio: madera: Add support for Cirrus Logic CS47L15
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit d06be8bc290aa255b9fd8602e60fb9f487aa0f48 ]
+
+As the gpio is common to all madera codecs all that is needed
+is to setup the correct number of GPIO pins for the CS47L15.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190722090748.20807-3-ckeepax@opensource.cirrus.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-madera.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpio/gpio-madera.c b/drivers/gpio/gpio-madera.c
+index 4dbc837d12155..19db5a500eb0d 100644
+--- a/drivers/gpio/gpio-madera.c
++++ b/drivers/gpio/gpio-madera.c
+@@ -136,6 +136,9 @@ static int madera_gpio_probe(struct platform_device *pdev)
+ madera_gpio->gpio_chip.parent = pdev->dev.parent;
+
+ switch (madera->type) {
++ case CS47L15:
++ madera_gpio->gpio_chip.ngpio = CS47L15_NUM_GPIOS;
++ break;
+ case CS47L35:
+ madera_gpio->gpio_chip.ngpio = CS47L35_NUM_GPIOS;
+ break;
+--
+2.20.1
+
--- /dev/null
+From 9f0173001344d836f24126d8712d6206b9ddf2d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 10:07:48 +0100
+Subject: gpio: madera: Add support for Cirrus Logic CS47L92
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 74d2d0e68701bcd53d2cf771dd3b3cb9f84bed5c ]
+
+As the gpio is common to all madera codecs all that is needed
+is to setup the correct number of GPIO pins for the CS47L92.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190722090748.20807-4-ckeepax@opensource.cirrus.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-madera.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpio/gpio-madera.c b/drivers/gpio/gpio-madera.c
+index 19db5a500eb0d..be963113f6722 100644
+--- a/drivers/gpio/gpio-madera.c
++++ b/drivers/gpio/gpio-madera.c
+@@ -150,6 +150,11 @@ static int madera_gpio_probe(struct platform_device *pdev)
+ case CS47L91:
+ madera_gpio->gpio_chip.ngpio = CS47L90_NUM_GPIOS;
+ break;
++ case CS42L92:
++ case CS47L92:
++ case CS47L93:
++ madera_gpio->gpio_chip.ngpio = CS47L92_NUM_GPIOS;
++ break;
+ default:
+ dev_err(&pdev->dev, "Unknown chip variant %d\n", madera->type);
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From f813c5b2f06083cb61b3cc7508bad808f2abf30f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 11:01:10 +0300
+Subject: hwmon: (acpi_power_meter) Change log level for 'unsafe software power
+ cap'
+
+From: Wang Shenran <shenran268@gmail.com>
+
+[ Upstream commit 6e4d91aa071810deac2cd052161aefb376ecf04e ]
+
+At boot time, the acpi_power_meter driver logs the following error level
+message: "Ignoring unsafe software power cap". Having read about it from
+a few sources, it seems that the error message can be quite misleading.
+
+While the message can imply that Linux is ignoring the fact that the
+system is operating in potentially dangerous conditions, the truth is
+the driver found an ACPI_PMC object that supports software power
+capping. The driver simply decides not to use it, perhaps because it
+doesn't support the object.
+
+The best solution is probably changing the log level from error to warning.
+All sources I have found, regarding the error, have downplayed its
+significance. There is not much of a reason for it to be on error level,
+while causing potential confusions or misinterpretations.
+
+Signed-off-by: Wang Shenran <shenran268@gmail.com>
+Link: https://lore.kernel.org/r/20190724080110.6952-1-shenran268@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/acpi_power_meter.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
+index 6ba1a08253f0a..4cf25458f0b95 100644
+--- a/drivers/hwmon/acpi_power_meter.c
++++ b/drivers/hwmon/acpi_power_meter.c
+@@ -681,8 +681,8 @@ static int setup_attrs(struct acpi_power_meter_resource *resource)
+
+ if (resource->caps.flags & POWER_METER_CAN_CAP) {
+ if (!can_cap_in_hardware()) {
+- dev_err(&resource->acpi_dev->dev,
+- "Ignoring unsafe software power cap!\n");
++ dev_warn(&resource->acpi_dev->dev,
++ "Ignoring unsafe software power cap!\n");
+ goto skip_unsafe_cap;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0a2249cbdf1adb13a108080ad344fcabdbbd95e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:46:53 +0300
+Subject: hwmon: (k10temp) Add support for AMD family 17h, model 70h CPUs
+
+From: Marcel Bocu <marcel.p.bocu@gmail.com>
+
+[ Upstream commit 12163cfbfc0f804cc7d27bc20e8d266ce7459260 ]
+
+It would seem like model 70h is behaving in the same way as model 30h,
+so let's just add the new F3 PCI ID to the list of compatible devices.
+
+Unlike previous Ryzen/Threadripper, Ryzen gen 3 processors do not need
+temperature offsets anymore. This has been reported in the press and
+verified on my Ryzen 3700X by checking that the idle temperature
+reported by k10temp is matching the temperature reported by the
+firmware.
+
+Vicki Pfau sent an identical patch after I checked that no-one had
+written this patch. I would have been happy about dropping my patch but
+unlike for his patch series, I had already Cc:ed the x86 people and
+they already reviewed the changes. Since Vicki has not answered to
+any email after his initial series, let's assume she is on vacation
+and let's avoid duplication of reviews from the maintainers and merge
+my series. To acknowledge Vicki's anteriority, I added her S-o-b to
+the patch.
+
+v2, suggested by Guenter Roeck and Brian Woods:
+ - rename from 71h to 70h
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Marcel Bocu <marcel.p.bocu@gmail.com>
+Tested-by: Marcel Bocu <marcel.p.bocu@gmail.com>
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: x86@kernel.org
+Cc: "Woods, Brian" <Brian.Woods@amd.com>
+Cc: Clemens Ladisch <clemens@ladisch.de>
+Cc: Jean Delvare <jdelvare@suse.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: linux-hwmon@vger.kernel.org
+Link: https://lore.kernel.org/r/20190722174653.2391-1-marcel.p.bocu@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/k10temp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index c77e89239dcd9..5c1dddde193c3 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -349,6 +349,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F3) },
+ { PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
+ {}
+ };
+--
+2.20.1
+
--- /dev/null
+From 26ba4752c404bc47beb87fbe982971fddb73b77b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2019 15:46:33 +0800
+Subject: ia64:unwind: fix double free for mod->arch.init_unw_table
+
+From: chenzefeng <chenzefeng2@huawei.com>
+
+[ Upstream commit c5e5c48c16422521d363c33cfb0dcf58f88c119b ]
+
+The function free_module in file kernel/module.c as follow:
+
+void free_module(struct module *mod) {
+ ......
+ module_arch_cleanup(mod);
+ ......
+ module_arch_freeing_init(mod);
+ ......
+}
+
+Both module_arch_cleanup and module_arch_freeing_init function
+would free the mod->arch.init_unw_table, which cause double free.
+
+Here, set mod->arch.init_unw_table = NULL after remove the unwind
+table to avoid double free.
+
+Signed-off-by: chenzefeng <chenzefeng2@huawei.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/module.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
+index 326448f9df160..1a42ba885188a 100644
+--- a/arch/ia64/kernel/module.c
++++ b/arch/ia64/kernel/module.c
+@@ -914,10 +914,14 @@ module_finalize (const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, struct module *mo
+ void
+ module_arch_cleanup (struct module *mod)
+ {
+- if (mod->arch.init_unw_table)
++ if (mod->arch.init_unw_table) {
+ unw_remove_unwind_table(mod->arch.init_unw_table);
+- if (mod->arch.core_unw_table)
++ mod->arch.init_unw_table = NULL;
++ }
++ if (mod->arch.core_unw_table) {
+ unw_remove_unwind_table(mod->arch.core_unw_table);
++ mod->arch.core_unw_table = NULL;
++ }
+ }
+
+ void *dereference_module_function_descriptor(struct module *mod, void *ptr)
+--
+2.20.1
+
--- /dev/null
+From 1c45d73c8bb1f87592bfe7eef1d5b8b6a1f9d608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Jun 2019 07:46:43 -0700
+Subject: idle: Prevent late-arriving interrupts from disrupting offline
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit e78a7614f3876ac649b3df608789cb6ef74d0480 ]
+
+Scheduling-clock interrupts can arrive late in the CPU-offline process,
+after idle entry and the subsequent call to cpuhp_report_idle_dead().
+Once execution passes the call to rcu_report_dead(), RCU is ignoring
+the CPU, which results in lockdep complaints when the interrupt handler
+uses RCU:
+
+------------------------------------------------------------------------
+
+=============================
+WARNING: suspicious RCU usage
+5.2.0-rc1+ #681 Not tainted
+-----------------------------
+kernel/sched/fair.c:9542 suspicious rcu_dereference_check() usage!
+
+other info that might help us debug this:
+
+RCU used illegally from offline CPU!
+rcu_scheduler_active = 2, debug_locks = 1
+no locks held by swapper/5/0.
+
+stack backtrace:
+CPU: 5 PID: 0 Comm: swapper/5 Not tainted 5.2.0-rc1+ #681
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Bochs 01/01/2011
+Call Trace:
+ <IRQ>
+ dump_stack+0x5e/0x8b
+ trigger_load_balance+0xa8/0x390
+ ? tick_sched_do_timer+0x60/0x60
+ update_process_times+0x3b/0x50
+ tick_sched_handle+0x2f/0x40
+ tick_sched_timer+0x32/0x70
+ __hrtimer_run_queues+0xd3/0x3b0
+ hrtimer_interrupt+0x11d/0x270
+ ? sched_clock_local+0xc/0x74
+ smp_apic_timer_interrupt+0x79/0x200
+ apic_timer_interrupt+0xf/0x20
+ </IRQ>
+RIP: 0010:delay_tsc+0x22/0x50
+Code: ff 0f 1f 80 00 00 00 00 65 44 8b 05 18 a7 11 48 0f ae e8 0f 31 48 89 d6 48 c1 e6 20 48 09 c6 eb 0e f3 90 65 8b 05 fe a6 11 48 <41> 39 c0 75 18 0f ae e8 0f 31 48 c1 e2 20 48 09 c2 48 89 d0 48 29
+RSP: 0000:ffff8f92c0157ed0 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13
+RAX: 0000000000000005 RBX: ffff8c861f356400 RCX: ffff8f92c0157e64
+RDX: 000000321214c8cc RSI: 00000032120daa7f RDI: 0000000000260f15
+RBP: 0000000000000005 R08: 0000000000000005 R09: 0000000000000000
+R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
+R13: 0000000000000000 R14: ffff8c861ee18000 R15: ffff8c861ee18000
+ cpuhp_report_idle_dead+0x31/0x60
+ do_idle+0x1d5/0x200
+ ? _raw_spin_unlock_irqrestore+0x2d/0x40
+ cpu_startup_entry+0x14/0x20
+ start_secondary+0x151/0x170
+ secondary_startup_64+0xa4/0xb0
+
+------------------------------------------------------------------------
+
+This happens rarely, but can be forced by happen more often by
+placing delays in cpuhp_report_idle_dead() following the call to
+rcu_report_dead(). With this in place, the following rcutorture
+scenario reproduces the problem within a few minutes:
+
+tools/testing/selftests/rcutorture/bin/kvm.sh --cpus 8 --duration 5 --kconfig "CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_PROVE_LOCKING=y" --configs "TREE04"
+
+This commit uses the crude but effective expedient of moving the disabling
+of interrupts within the idle loop to precede the cpu_is_offline()
+check. It also invokes tick_nohz_idle_stop_tick() instead of
+tick_nohz_idle_stop_tick_protected() to shut off the scheduling-clock
+interrupt.
+
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@kernel.org>
+[ paulmck: Revert tick_nohz_idle_stop_tick_protected() removal, new callers. ]
+Signed-off-by: Paul E. McKenney <paulmck@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/idle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
+index 80940939b7336..e4bc4aa739b83 100644
+--- a/kernel/sched/idle.c
++++ b/kernel/sched/idle.c
+@@ -241,13 +241,14 @@ static void do_idle(void)
+ check_pgt_cache();
+ rmb();
+
++ local_irq_disable();
++
+ if (cpu_is_offline(cpu)) {
+- tick_nohz_idle_stop_tick_protected();
++ tick_nohz_idle_stop_tick();
+ cpuhp_report_idle_dead();
+ arch_cpu_idle_dead();
+ }
+
+- local_irq_disable();
+ arch_cpu_idle_enter();
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 3290d805127c21bed01369db964d1f068d0a011f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 20:50:39 +0800
+Subject: io_uring: fix wrong sequence setting logic
+
+From: Jackie Liu <liuyun01@kylinos.cn>
+
+[ Upstream commit 8776f3fa15a5cd213c4dfab7ddaf557983374ea6 ]
+
+Sqo_thread will get sqring in batches, which will cause
+ctx->cached_sq_head to be added in batches. if one of these
+sqes is set with the DRAIN flag, then he will never get a
+chance to process, and finally sqo_thread will not exit.
+
+Fixes: de0617e4671 ("io_uring: add support for marking commands as draining")
+Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index cfb48bd088e12..06d048341fa41 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -288,6 +288,7 @@ struct io_ring_ctx {
+ struct sqe_submit {
+ const struct io_uring_sqe *sqe;
+ unsigned short index;
++ u32 sequence;
+ bool has_user;
+ bool needs_lock;
+ bool needs_fixed_file;
+@@ -2040,7 +2041,7 @@ static int io_req_set_file(struct io_ring_ctx *ctx, const struct sqe_submit *s,
+
+ if (flags & IOSQE_IO_DRAIN) {
+ req->flags |= REQ_F_IO_DRAIN;
+- req->sequence = ctx->cached_sq_head - 1;
++ req->sequence = s->sequence;
+ }
+
+ if (!io_op_needs_file(s->sqe))
+@@ -2247,6 +2248,7 @@ static bool io_get_sqring(struct io_ring_ctx *ctx, struct sqe_submit *s)
+ if (head < ctx->sq_entries) {
+ s->index = head;
+ s->sqe = &ctx->sq_sqes[head];
++ s->sequence = ctx->cached_sq_head;
+ ctx->cached_sq_head++;
+ return true;
+ }
+--
+2.20.1
+
--- /dev/null
+From 2234a871dd0c2f3c5d95332948796e5ad1018140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 13:10:04 +0800
+Subject: iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 93d051550ee02eaff9a2541d825605a7bd778027 ]
+
+Raven Ridge systems may have malfunction touchpad or hang at boot if
+incorrect IVRS IOAPIC is provided by BIOS.
+
+Users already found correct "ivrs_ioapic=" values, let's put them inside
+kernel to workaround buggy BIOS.
+
+BugLink: https://bugs.launchpad.net/bugs/1795292
+BugLink: https://bugs.launchpad.net/bugs/1837688
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/Makefile | 2 +-
+ drivers/iommu/amd_iommu.h | 14 +++++
+ drivers/iommu/amd_iommu_init.c | 5 +-
+ drivers/iommu/amd_iommu_quirks.c | 92 ++++++++++++++++++++++++++++++++
+ 4 files changed, 111 insertions(+), 2 deletions(-)
+ create mode 100644 drivers/iommu/amd_iommu.h
+ create mode 100644 drivers/iommu/amd_iommu_quirks.c
+
+diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
+index f13f36ae1af65..c6a277e698484 100644
+--- a/drivers/iommu/Makefile
++++ b/drivers/iommu/Makefile
+@@ -10,7 +10,7 @@ obj-$(CONFIG_IOMMU_IO_PGTABLE_LPAE) += io-pgtable-arm.o
+ obj-$(CONFIG_IOMMU_IOVA) += iova.o
+ obj-$(CONFIG_OF_IOMMU) += of_iommu.o
+ obj-$(CONFIG_MSM_IOMMU) += msm_iommu.o
+-obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o
++obj-$(CONFIG_AMD_IOMMU) += amd_iommu.o amd_iommu_init.o amd_iommu_quirks.o
+ obj-$(CONFIG_AMD_IOMMU_DEBUGFS) += amd_iommu_debugfs.o
+ obj-$(CONFIG_AMD_IOMMU_V2) += amd_iommu_v2.o
+ obj-$(CONFIG_ARM_SMMU) += arm-smmu.o
+diff --git a/drivers/iommu/amd_iommu.h b/drivers/iommu/amd_iommu.h
+new file mode 100644
+index 0000000000000..12d540d9b59b0
+--- /dev/null
++++ b/drivers/iommu/amd_iommu.h
+@@ -0,0 +1,14 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef AMD_IOMMU_H
++#define AMD_IOMMU_H
++
++int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line);
++
++#ifdef CONFIG_DMI
++void amd_iommu_apply_ivrs_quirks(void);
++#else
++static void amd_iommu_apply_ivrs_quirks(void) { }
++#endif
++
++#endif
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 4413aa67000e5..568c52317757c 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -32,6 +32,7 @@
+ #include <asm/irq_remapping.h>
+
+ #include <linux/crash_dump.h>
++#include "amd_iommu.h"
+ #include "amd_iommu_proto.h"
+ #include "amd_iommu_types.h"
+ #include "irq_remapping.h"
+@@ -1002,7 +1003,7 @@ static void __init set_dev_entry_from_acpi(struct amd_iommu *iommu,
+ set_iommu_for_device(iommu, devid);
+ }
+
+-static int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line)
++int __init add_special_device(u8 type, u8 id, u16 *devid, bool cmd_line)
+ {
+ struct devid_map *entry;
+ struct list_head *list;
+@@ -1153,6 +1154,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu,
+ if (ret)
+ return ret;
+
++ amd_iommu_apply_ivrs_quirks();
++
+ /*
+ * First save the recommended feature enable bits from ACPI
+ */
+diff --git a/drivers/iommu/amd_iommu_quirks.c b/drivers/iommu/amd_iommu_quirks.c
+new file mode 100644
+index 0000000000000..c235f79b7a200
+--- /dev/null
++++ b/drivers/iommu/amd_iommu_quirks.c
+@@ -0,0 +1,92 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++/*
++ * Quirks for AMD IOMMU
++ *
++ * Copyright (C) 2019 Kai-Heng Feng <kai.heng.feng@canonical.com>
++ */
++
++#ifdef CONFIG_DMI
++#include <linux/dmi.h>
++
++#include "amd_iommu.h"
++
++#define IVHD_SPECIAL_IOAPIC 1
++
++struct ivrs_quirk_entry {
++ u8 id;
++ u16 devid;
++};
++
++enum {
++ DELL_INSPIRON_7375 = 0,
++ DELL_LATITUDE_5495,
++ LENOVO_IDEAPAD_330S_15ARR,
++};
++
++static const struct ivrs_quirk_entry ivrs_ioapic_quirks[][3] __initconst = {
++ /* ivrs_ioapic[4]=00:14.0 ivrs_ioapic[5]=00:00.2 */
++ [DELL_INSPIRON_7375] = {
++ { .id = 4, .devid = 0xa0 },
++ { .id = 5, .devid = 0x2 },
++ {}
++ },
++ /* ivrs_ioapic[4]=00:14.0 */
++ [DELL_LATITUDE_5495] = {
++ { .id = 4, .devid = 0xa0 },
++ {}
++ },
++ /* ivrs_ioapic[32]=00:14.0 */
++ [LENOVO_IDEAPAD_330S_15ARR] = {
++ { .id = 32, .devid = 0xa0 },
++ {}
++ },
++ {}
++};
++
++static int __init ivrs_ioapic_quirk_cb(const struct dmi_system_id *d)
++{
++ const struct ivrs_quirk_entry *i;
++
++ for (i = d->driver_data; i->id != 0 && i->devid != 0; i++)
++ add_special_device(IVHD_SPECIAL_IOAPIC, i->id, (u16 *)&i->devid, 0);
++
++ return 0;
++}
++
++static const struct dmi_system_id ivrs_quirks[] __initconst = {
++ {
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Dell Inspiron 7375",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7375"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_INSPIRON_7375],
++ },
++ {
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Dell Latitude 5495",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 5495"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[DELL_LATITUDE_5495],
++ },
++ {
++ .callback = ivrs_ioapic_quirk_cb,
++ .ident = "Lenovo ideapad 330S-15ARR",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "81FB"),
++ },
++ .driver_data = (void *)&ivrs_ioapic_quirks[LENOVO_IDEAPAD_330S_15ARR],
++ },
++ {}
++};
++
++void __init amd_iommu_apply_ivrs_quirks(void)
++{
++ dmi_check_system(ivrs_quirks);
++}
++#endif
+--
+2.20.1
+
--- /dev/null
+From 48595214eb3939ce9a3e24db35136fc270ac215b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 17:39:43 -0400
+Subject: iommu/amd: Silence warnings under memory pressure
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 3d708895325b78506e8daf00ef31549476e8586a ]
+
+When running heavy memory pressure workloads, the system is throwing
+endless warnings,
+
+smartpqi 0000:23:00.0: AMD-Vi: IOMMU mapping error in map_sg (io-pages:
+5 reason: -12)
+Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40
+07/10/2019
+swapper/10: page allocation failure: order:0, mode:0xa20(GFP_ATOMIC),
+nodemask=(null),cpuset=/,mems_allowed=0,4
+Call Trace:
+ <IRQ>
+ dump_stack+0x62/0x9a
+ warn_alloc.cold.43+0x8a/0x148
+ __alloc_pages_nodemask+0x1a5c/0x1bb0
+ get_zeroed_page+0x16/0x20
+ iommu_map_page+0x477/0x540
+ map_sg+0x1ce/0x2f0
+ scsi_dma_map+0xc6/0x160
+ pqi_raid_submit_scsi_cmd_with_io_request+0x1c3/0x470 [smartpqi]
+ do_IRQ+0x81/0x170
+ common_interrupt+0xf/0xf
+ </IRQ>
+
+because the allocation could fail from iommu_map_page(), and the volume
+of this call could be huge which may generate a lot of serial console
+output and cosumes all CPUs.
+
+Fix it by silencing the warning in this call site, and there is still a
+dev_err() later to notify the failure.
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 61de81965c44e..e1259429ded2f 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2577,7 +2577,9 @@ static int map_sg(struct device *dev, struct scatterlist *sglist,
+
+ bus_addr = address + s->dma_address + (j << PAGE_SHIFT);
+ phys_addr = (sg_phys(s) & PAGE_MASK) + (j << PAGE_SHIFT);
+- ret = iommu_map_page(domain, bus_addr, phys_addr, PAGE_SIZE, prot, GFP_ATOMIC);
++ ret = iommu_map_page(domain, bus_addr, phys_addr,
++ PAGE_SIZE, prot,
++ GFP_ATOMIC | __GFP_NOWARN);
+ if (ret)
+ goto out_unmap;
+
+--
+2.20.1
+
--- /dev/null
+From 42e9102f3f4ae6b1a2221d861a858a469afa8f4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 06:13:38 -0700
+Subject: iommu/iova: Avoid false sharing on fq_timer_on
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 0d87308cca2c124f9bce02383f1d9632c9be89c4 ]
+
+In commit 14bd9a607f90 ("iommu/iova: Separate atomic variables
+to improve performance") Jinyu Qi identified that the atomic_cmpxchg()
+in queue_iova() was causing a performance loss and moved critical fields
+so that the false sharing would not impact them.
+
+However, avoiding the false sharing in the first place seems easy.
+We should attempt the atomic_cmpxchg() no more than 100 times
+per second. Adding an atomic_read() will keep the cache
+line mostly shared.
+
+This false sharing came with commit 9a005a800ae8
+("iommu/iova: Add flush timer").
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Fixes: 9a005a800ae8 ('iommu/iova: Add flush timer')
+Cc: Jinyu Qi <jinyuqi@huawei.com>
+Cc: Joerg Roedel <jroedel@suse.de>
+Acked-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iova.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index 3e1a8a6755723..41c605b0058f9 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -577,7 +577,9 @@ void queue_iova(struct iova_domain *iovad,
+
+ spin_unlock_irqrestore(&fq->lock, flags);
+
+- if (atomic_cmpxchg(&iovad->fq_timer_on, 0, 1) == 0)
++ /* Avoid false sharing as much as possible. */
++ if (!atomic_read(&iovad->fq_timer_on) &&
++ !atomic_cmpxchg(&iovad->fq_timer_on, 0, 1))
+ mod_timer(&iovad->fq_timer,
+ jiffies + msecs_to_jiffies(IOVA_FQ_TIMEOUT));
+ }
+--
+2.20.1
+
--- /dev/null
+From beaa7173a9455f6807667525a1fc60f19a04ab2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 14:56:47 +0100
+Subject: irqchip/gic-v3-its: Fix LPI release for Multi-MSI devices
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit c9c96e30ecaa0aafa225aa1a5392cb7db17c7a82 ]
+
+When allocating a range of LPIs for a Multi-MSI capable device,
+this allocation extended to the closest power of 2.
+
+But on the release path, the interrupts are released one by
+one. This results in not releasing the "extra" range, leaking
+the its_device. Trying to reprobe the device will then fail.
+
+Fix it by releasing the LPIs the same way we allocate them.
+
+Fixes: 8208d1708b88 ("irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size")
+Reported-by: Jiaxing Luo <luojiaxing@huawei.com>
+Tested-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/f5e948aa-e32f-3f74-ae30-31fee06c2a74@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 1b5c3672aea27..c3a8d732805f5 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2641,14 +2641,13 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ struct its_node *its = its_dev->its;
+ int i;
+
++ bitmap_release_region(its_dev->event_map.lpi_map,
++ its_get_event_id(irq_domain_get_irq_data(domain, virq)),
++ get_count_order(nr_irqs));
++
+ for (i = 0; i < nr_irqs; i++) {
+ struct irq_data *data = irq_domain_get_irq_data(domain,
+ virq + i);
+- u32 event = its_get_event_id(data);
+-
+- /* Mark interrupt index as unused */
+- clear_bit(event, its_dev->event_map.lpi_map);
+-
+ /* Nuke the entry in the domain */
+ irq_domain_reset_irq_data(data);
+ }
+--
+2.20.1
+
--- /dev/null
+From d9d07bd8655de7f2bb306b03ff3237a98b0f6523 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 11:32:20 +0200
+Subject: irqchip/sifive-plic: set max threshold for ignored handlers
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 9ce06497c2722a0f9109e4cc3ce35b7a69617886 ]
+
+When running in M-mode, the S-mode plic handlers are still listed in the
+device tree. Ignore them by setting the maximum threshold.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-sifive-plic.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index cf755964f2f8b..c72c036aea768 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -244,6 +244,7 @@ static int __init plic_init(struct device_node *node,
+ struct plic_handler *handler;
+ irq_hw_number_t hwirq;
+ int cpu, hartid;
++ u32 threshold = 0;
+
+ if (of_irq_parse_one(node, i, &parent)) {
+ pr_err("failed to parse parent for context %d.\n", i);
+@@ -266,10 +267,16 @@ static int __init plic_init(struct device_node *node,
+ continue;
+ }
+
++ /*
++ * When running in M-mode we need to ignore the S-mode handler.
++ * Here we assume it always comes later, but that might be a
++ * little fragile.
++ */
+ handler = per_cpu_ptr(&plic_handlers, cpu);
+ if (handler->present) {
+ pr_warn("handler already present for context %d.\n", i);
+- continue;
++ threshold = 0xffffffff;
++ goto done;
+ }
+
+ handler->present = true;
+@@ -279,8 +286,9 @@ static int __init plic_init(struct device_node *node,
+ handler->enable_base =
+ plic_regs + ENABLE_BASE + i * ENABLE_PER_HART;
+
++done:
+ /* priority must be > threshold to trigger an interrupt */
+- writel(0, handler->hart_base + CONTEXT_THRESHOLD);
++ writel(threshold, handler->hart_base + CONTEXT_THRESHOLD);
+ for (hwirq = 1; hwirq <= nr_irqs; hwirq++)
+ plic_toggle(handler, hwirq, 0);
+ nr_handlers++;
+--
+2.20.1
+
--- /dev/null
+From 35cbd2e8ba23c71c82361f8d84f0bbc4403ead22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 18:50:05 +0100
+Subject: jump_label: Don't warn on __exit jump entries
+
+From: Andrew Murray <andrew.murray@arm.com>
+
+[ Upstream commit 8f35eaa5f2de020073a48ad51112237c5932cfcc ]
+
+On architectures that discard .exit.* sections at runtime, a
+warning is printed for each jump label that is used within an
+in-kernel __exit annotated function:
+
+can't patch jump_label at ehci_hcd_cleanup+0x8/0x3c
+WARNING: CPU: 0 PID: 1 at kernel/jump_label.c:410 __jump_label_update+0x12c/0x138
+
+As these functions will never get executed (they are free'd along
+with the rest of initmem) - we do not need to patch them and should
+not display any warnings.
+
+The warning is displayed because the test required to satisfy
+jump_entry_is_init is based on init_section_contains (__init_begin to
+__init_end) whereas the test in __jump_label_update is based on
+init_kernel_text (_sinittext to _einittext) via kernel_text_address).
+
+Fixes: 19483677684b ("jump_label: Annotate entries that operate on __init code earlier")
+Signed-off-by: Andrew Murray <andrew.murray@arm.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/jump_label.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/jump_label.c b/kernel/jump_label.c
+index df3008419a1d0..cdb3ffab128b6 100644
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -407,7 +407,9 @@ static bool jump_label_can_update(struct jump_entry *entry, bool init)
+ return false;
+
+ if (!kernel_text_address(jump_entry_code(entry))) {
+- WARN_ONCE(1, "can't patch jump_label at %pS", (void *)jump_entry_code(entry));
++ WARN_ONCE(!jump_entry_is_init(entry),
++ "can't patch jump_label at %pS",
++ (void *)jump_entry_code(entry));
+ return false;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 896ef40c6e41049f3288f53bfc2be57aa5449620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2019 15:31:57 +0100
+Subject: kasan/arm64: fix CONFIG_KASAN_SW_TAGS && KASAN_INLINE
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 34b5560db40d2941cfbe82eca1641353d5aed1a9 ]
+
+The generic Makefile.kasan propagates CONFIG_KASAN_SHADOW_OFFSET into
+KASAN_SHADOW_OFFSET, but only does so for CONFIG_KASAN_GENERIC.
+
+Since commit:
+
+ 6bd1d0be0e97936d ("arm64: kasan: Switch to using KASAN_SHADOW_OFFSET")
+
+... arm64 defines CONFIG_KASAN_SHADOW_OFFSET in Kconfig rather than
+defining KASAN_SHADOW_OFFSET in a Makefile. Thus, if
+CONFIG_KASAN_SW_TAGS && KASAN_INLINE are selected, we get build time
+splats due to KASAN_SHADOW_OFFSET not being set:
+
+| [mark@lakrids:~/src/linux]% usellvm 8.0.1 usekorg 8.1.0 make ARCH=arm64 CROSS_COMPILE=aarch64-linux- CC=clang
+| scripts/kconfig/conf --syncconfig Kconfig
+| CC scripts/mod/empty.o
+| clang (LLVM option parsing): for the -hwasan-mapping-offset option: '' value invalid for uint argument!
+| scripts/Makefile.build:273: recipe for target 'scripts/mod/empty.o' failed
+| make[1]: *** [scripts/mod/empty.o] Error 1
+| Makefile:1123: recipe for target 'prepare0' failed
+| make: *** [prepare0] Error 2
+
+Let's fix this by always propagating CONFIG_KASAN_SHADOW_OFFSET into
+KASAN_SHADOW_OFFSET if CONFIG_KASAN is selected, moving the existing
+common definition of +CFLAGS_KASAN_NOSANITIZE to the top of
+Makefile.kasan.
+
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Tested-by Steve Capper <steve.capper@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.kasan | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/scripts/Makefile.kasan b/scripts/Makefile.kasan
+index 6410bd22fe387..03757cc60e06c 100644
+--- a/scripts/Makefile.kasan
++++ b/scripts/Makefile.kasan
+@@ -1,4 +1,9 @@
+ # SPDX-License-Identifier: GPL-2.0
++ifdef CONFIG_KASAN
++CFLAGS_KASAN_NOSANITIZE := -fno-builtin
++KASAN_SHADOW_OFFSET ?= $(CONFIG_KASAN_SHADOW_OFFSET)
++endif
++
+ ifdef CONFIG_KASAN_GENERIC
+
+ ifdef CONFIG_KASAN_INLINE
+@@ -7,8 +12,6 @@ else
+ call_threshold := 0
+ endif
+
+-KASAN_SHADOW_OFFSET ?= $(CONFIG_KASAN_SHADOW_OFFSET)
+-
+ CFLAGS_KASAN_MINIMAL := -fsanitize=kernel-address
+
+ cc-param = $(call cc-option, -mllvm -$(1), $(call cc-option, --param $(1)))
+@@ -45,7 +48,3 @@ CFLAGS_KASAN := -fsanitize=kernel-hwaddress \
+ $(instrumentation_flags)
+
+ endif # CONFIG_KASAN_SW_TAGS
+-
+-ifdef CONFIG_KASAN
+-CFLAGS_KASAN_NOSANITIZE := -fno-builtin
+-endif
+--
+2.20.1
+
--- /dev/null
+From 753088cbd1cb32a4d915f02a90d64434101a0099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 20:08:21 +0900
+Subject: kprobes: Prohibit probing on BUG() and WARN() address
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit e336b4027775cb458dc713745e526fa1a1996b2a ]
+
+Since BUG() and WARN() may use a trap (e.g. UD2 on x86) to
+get the address where the BUG() has occurred, kprobes can not
+do single-step out-of-line that instruction. So prohibit
+probing on such address.
+
+Without this fix, if someone put a kprobe on WARN(), the
+kernel will crash with invalid opcode error instead of
+outputing warning message, because kernel can not find
+correct bug address.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/156750890133.19112.3393666300746167111.stgit@devnote2
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bug.h | 5 +++++
+ kernel/kprobes.c | 3 ++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/bug.h b/include/linux/bug.h
+index fe5916550da8c..f639bd0122f39 100644
+--- a/include/linux/bug.h
++++ b/include/linux/bug.h
+@@ -47,6 +47,11 @@ void generic_bug_clear_once(void);
+
+ #else /* !CONFIG_GENERIC_BUG */
+
++static inline void *find_bug(unsigned long bugaddr)
++{
++ return NULL;
++}
++
+ static inline enum bug_trap_type report_bug(unsigned long bug_addr,
+ struct pt_regs *regs)
+ {
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index d9770a5393c89..ebe8315a756a2 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1514,7 +1514,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
+ /* Ensure it is not in reserved area nor out of text */
+ if (!kernel_text_address((unsigned long) p->addr) ||
+ within_kprobe_blacklist((unsigned long) p->addr) ||
+- jump_label_text_reserved(p->addr, p->addr)) {
++ jump_label_text_reserved(p->addr, p->addr) ||
++ find_bug((unsigned long)p->addr)) {
+ ret = -EINVAL;
+ goto out;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3f5fe157cf0f395584b13515eaac8048bec6bf42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Jun 2019 19:42:04 +0200
+Subject: kvm: Nested KVM MMUs need PAE root too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiří Paleček <jpalecek@web.de>
+
+[ Upstream commit 1cfff4d9a5d01fa61e5768a6afffc81ae1c8ecb9 ]
+
+On AMD processors, in PAE 32bit mode, nested KVM instances don't
+work. The L0 host get a kernel OOPS, which is related to
+arch.mmu->pae_root being NULL.
+
+The reason for this is that when setting up nested KVM instance,
+arch.mmu is set to &arch.guest_mmu (while normally, it would be
+&arch.root_mmu). However, the initialization and allocation of
+pae_root only creates it in root_mmu. KVM code (ie. in
+mmu_alloc_shadow_roots) then accesses arch.mmu->pae_root, which is the
+unallocated arch.guest_mmu->pae_root.
+
+This fix just allocates (and frees) pae_root in both guest_mmu and
+root_mmu (and also lm_root if it was allocated). The allocation is
+subject to previous restrictions ie. it won't allocate anything on
+64-bit and AFAIK not on Intel.
+
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=203923
+Fixes: 14c07ad89f4d ("x86/kvm/mmu: introduce guest_mmu")
+Signed-off-by: Jiri Palecek <jpalecek@web.de>
+Tested-by: Jiri Palecek <jpalecek@web.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index a63964e7cec7b..c68bf3aab12c1 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5611,13 +5611,13 @@ slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot,
+ PT_PAGE_TABLE_LEVEL, lock_flush_tlb);
+ }
+
+-static void free_mmu_pages(struct kvm_vcpu *vcpu)
++static void free_mmu_pages(struct kvm_mmu *mmu)
+ {
+- free_page((unsigned long)vcpu->arch.mmu->pae_root);
+- free_page((unsigned long)vcpu->arch.mmu->lm_root);
++ free_page((unsigned long)mmu->pae_root);
++ free_page((unsigned long)mmu->lm_root);
+ }
+
+-static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
++static int alloc_mmu_pages(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)
+ {
+ struct page *page;
+ int i;
+@@ -5638,9 +5638,9 @@ static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
+ if (!page)
+ return -ENOMEM;
+
+- vcpu->arch.mmu->pae_root = page_address(page);
++ mmu->pae_root = page_address(page);
+ for (i = 0; i < 4; ++i)
+- vcpu->arch.mmu->pae_root[i] = INVALID_PAGE;
++ mmu->pae_root[i] = INVALID_PAGE;
+
+ return 0;
+ }
+@@ -5648,6 +5648,7 @@ static int alloc_mmu_pages(struct kvm_vcpu *vcpu)
+ int kvm_mmu_create(struct kvm_vcpu *vcpu)
+ {
+ uint i;
++ int ret;
+
+ vcpu->arch.mmu = &vcpu->arch.root_mmu;
+ vcpu->arch.walk_mmu = &vcpu->arch.root_mmu;
+@@ -5665,7 +5666,19 @@ int kvm_mmu_create(struct kvm_vcpu *vcpu)
+ vcpu->arch.guest_mmu.prev_roots[i] = KVM_MMU_ROOT_INFO_INVALID;
+
+ vcpu->arch.nested_mmu.translate_gpa = translate_nested_gpa;
+- return alloc_mmu_pages(vcpu);
++
++ ret = alloc_mmu_pages(vcpu, &vcpu->arch.guest_mmu);
++ if (ret)
++ return ret;
++
++ ret = alloc_mmu_pages(vcpu, &vcpu->arch.root_mmu);
++ if (ret)
++ goto fail_allocate_root;
++
++ return ret;
++ fail_allocate_root:
++ free_mmu_pages(&vcpu->arch.guest_mmu);
++ return ret;
+ }
+
+
+@@ -6168,7 +6181,8 @@ unsigned long kvm_mmu_calculate_default_mmu_pages(struct kvm *kvm)
+ void kvm_mmu_destroy(struct kvm_vcpu *vcpu)
+ {
+ kvm_mmu_unload(vcpu);
+- free_mmu_pages(vcpu);
++ free_mmu_pages(&vcpu->arch.root_mmu);
++ free_mmu_pages(&vcpu->arch.guest_mmu);
+ mmu_free_memory_caches(vcpu);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 61c158047d35426b9508e9030aac11bc25b7135b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 15:41:42 -0500
+Subject: led: triggers: Fix a memory leak bug
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 60e2dde1e91ae0addb21ac380cc36ebee7534e49 ]
+
+In led_trigger_set(), 'event' is allocated in kasprintf(). However, it is
+not deallocated in the following execution if the label 'err_activate' or
+'err_add_groups' is entered, leading to memory leaks. To fix this issue,
+free 'event' before returning the error.
+
+Fixes: 52c47742f79d ("leds: triggers: send uevent when changing triggers")
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-triggers.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
+index 8d11a5e232271..eff1bda8b5200 100644
+--- a/drivers/leds/led-triggers.c
++++ b/drivers/leds/led-triggers.c
+@@ -173,6 +173,7 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig)
+ list_del(&led_cdev->trig_list);
+ write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
+ led_set_brightness(led_cdev, LED_OFF);
++ kfree(event);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7e9ed860395573363c5ce1a0efbbceafbf4897cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jul 2019 14:56:06 -0700
+Subject: leds: leds-lp5562 allow firmware files up to the maximum length
+
+From: Nick Stoughton <nstoughton@logitech.com>
+
+[ Upstream commit ed2abfebb041473092b41527903f93390d38afa7 ]
+
+Firmware files are in ASCII, using 2 hex characters per byte. The
+maximum length of a firmware string is therefore
+
+16 (commands) * 2 (bytes per command) * 2 (characters per byte) = 64
+
+Fixes: ff45262a85db ("leds: add new LP5562 LED driver")
+Signed-off-by: Nick Stoughton <nstoughton@logitech.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp5562.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp5562.c b/drivers/leds/leds-lp5562.c
+index 37632fc637414..edb57c42e8b1d 100644
+--- a/drivers/leds/leds-lp5562.c
++++ b/drivers/leds/leds-lp5562.c
+@@ -260,7 +260,11 @@ static void lp5562_firmware_loaded(struct lp55xx_chip *chip)
+ {
+ const struct firmware *fw = chip->fw;
+
+- if (fw->size > LP5562_PROGRAM_LENGTH) {
++ /*
++ * the firmware is encoded in ascii hex character, with 2 chars
++ * per byte
++ */
++ if (fw->size > (LP5562_PROGRAM_LENGTH * 2)) {
+ dev_err(&chip->cl->dev, "firmware data size overflow: %zu\n",
+ fw->size);
+ return;
+--
+2.20.1
+
--- /dev/null
+From 6020ee949ecdf8a37158242004662c717bf3d19e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 14:53:05 -0500
+Subject: leds: lm3532: Fixes for the driver for stability
+
+From: Dan Murphy <dmurphy@ti.com>
+
+[ Upstream commit 6559ac32998248182572e1ccae79dc2eb40ac7c6 ]
+
+Fixed misspelled words, added error check during probe
+on the init of the registers, and fixed ALS/I2C control
+mode.
+
+Fixes: bc1b8492c764 ("leds: lm3532: Introduce the lm3532 LED driver")
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Dan Murphy <dmurphy@ti.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lm3532.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/leds/leds-lm3532.c b/drivers/leds/leds-lm3532.c
+index 180895b83b888..e55a64847fe2f 100644
+--- a/drivers/leds/leds-lm3532.c
++++ b/drivers/leds/leds-lm3532.c
+@@ -40,7 +40,7 @@
+ #define LM3532_REG_ZN_3_LO 0x67
+ #define LM3532_REG_MAX 0x7e
+
+-/* Contorl Enable */
++/* Control Enable */
+ #define LM3532_CTRL_A_ENABLE BIT(0)
+ #define LM3532_CTRL_B_ENABLE BIT(1)
+ #define LM3532_CTRL_C_ENABLE BIT(2)
+@@ -302,7 +302,7 @@ static int lm3532_led_disable(struct lm3532_led *led_data)
+ int ret;
+
+ ret = regmap_update_bits(led_data->priv->regmap, LM3532_REG_ENABLE,
+- ctrl_en_val, ~ctrl_en_val);
++ ctrl_en_val, 0);
+ if (ret) {
+ dev_err(led_data->priv->dev, "Failed to set ctrl:%d\n", ret);
+ return ret;
+@@ -321,7 +321,7 @@ static int lm3532_brightness_set(struct led_classdev *led_cdev,
+
+ mutex_lock(&led->priv->lock);
+
+- if (led->mode == LM3532_BL_MODE_ALS) {
++ if (led->mode == LM3532_ALS_CTRL) {
+ if (brt_val > LED_OFF)
+ ret = lm3532_led_enable(led);
+ else
+@@ -542,11 +542,14 @@ static int lm3532_parse_node(struct lm3532_data *priv)
+ }
+
+ if (led->mode == LM3532_BL_MODE_ALS) {
++ led->mode = LM3532_ALS_CTRL;
+ ret = lm3532_parse_als(priv);
+ if (ret)
+ dev_err(&priv->client->dev, "Failed to parse als\n");
+ else
+ lm3532_als_configure(priv, led);
++ } else {
++ led->mode = LM3532_I2C_CTRL;
+ }
+
+ led->num_leds = fwnode_property_read_u32_array(child,
+@@ -590,7 +593,13 @@ static int lm3532_parse_node(struct lm3532_data *priv)
+ goto child_out;
+ }
+
+- lm3532_init_registers(led);
++ ret = lm3532_init_registers(led);
++ if (ret) {
++ dev_err(&priv->client->dev, "register init err: %d\n",
++ ret);
++ fwnode_handle_put(child);
++ goto child_out;
++ }
+
+ i++;
+ }
+--
+2.20.1
+
--- /dev/null
+From 879297158d90bea11cb575a54fc1ae6c27d7b28e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 16:30:34 -0700
+Subject: libata/ahci: Drop PCS quirk for Denverton and beyond
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit c312ef176399e04fc5f7f2809d9a589751fbf6d9 ]
+
+The Linux ahci driver has historically implemented a configuration fixup
+for platforms / platform-firmware that fails to enable the ports prior
+to OS hand-off at boot. The fixup was originally implemented way back
+before ahci moved from drivers/scsi/ to drivers/ata/, and was updated in
+2007 via commit 49f290903935 "ahci: update PCS programming". The quirk
+sets a port-enable bitmap in the PCS register at offset 0x92.
+
+This quirk could be applied generically up until the arrival of the
+Denverton (DNV) platform. The DNV AHCI controller architecture supports
+more than 6 ports and along with that the PCS register location and
+format were updated to allow for more possible ports in the bitmap. DNV
+AHCI expands the register to 32-bits and moves it to offset 0x94.
+
+As it stands there are no known problem reports with existing Linux
+trying to set bits at offset 0x92 which indicates that the quirk is not
+applicable. Likely it is not applicable on a wider range of platforms,
+but it is difficult to discern which platforms if any still depend on
+the quirk.
+
+Rather than try to fix the PCS quirk to consider the DNV register layout
+instead require explicit opt-in. The assumption is that the OS driver
+need not touch this register, and platforms can be added with a new
+boad_ahci_pcs7 board-id when / if problematic platforms are found in the
+future. The logic in ahci_intel_pcs_quirk() looks for all Intel AHCI
+instances with "legacy" board-ids and otherwise skips the quirk if the
+board was matched by class-code.
+
+Reported-by: Stephen Douthit <stephend@silicom-usa.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Reviewed-by: Stephen Douthit <stephend@silicom-usa.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci.c | 116 +++++++++++++++++++++++++++------------------
+ drivers/ata/ahci.h | 2 +
+ 2 files changed, 71 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index f7652baa63370..3e63294304c72 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -65,6 +65,12 @@ enum board_ids {
+ board_ahci_sb700, /* for SB700 and SB800 */
+ board_ahci_vt8251,
+
++ /*
++ * board IDs for Intel chipsets that support more than 6 ports
++ * *and* end up needing the PCS quirk.
++ */
++ board_ahci_pcs7,
++
+ /* aliases */
+ board_ahci_mcp_linux = board_ahci_mcp65,
+ board_ahci_mcp67 = board_ahci_mcp65,
+@@ -220,6 +226,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ .udma_mask = ATA_UDMA6,
+ .port_ops = &ahci_vt8251_ops,
+ },
++ [board_ahci_pcs7] = {
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_ops,
++ },
+ };
+
+ static const struct pci_device_id ahci_pci_tbl[] = {
+@@ -264,26 +276,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
+ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci_mobile }, /* PCH M RAID */
+ { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
+- { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b0), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b1), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b2), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b3), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b4), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b5), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b6), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19b7), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19bE), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19bF), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c0), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c1), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c2), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c3), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c4), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c5), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c6), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19c7), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19cE), board_ahci_pcs7 }, /* DNV AHCI */
++ { PCI_VDEVICE(INTEL, 0x19cF), board_ahci_pcs7 }, /* DNV AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci_mobile }, /* CPT M AHCI */
+ { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
+@@ -623,30 +635,6 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
+ ahci_save_initial_config(&pdev->dev, hpriv);
+ }
+
+-static int ahci_pci_reset_controller(struct ata_host *host)
+-{
+- struct pci_dev *pdev = to_pci_dev(host->dev);
+- int rc;
+-
+- rc = ahci_reset_controller(host);
+- if (rc)
+- return rc;
+-
+- if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+- struct ahci_host_priv *hpriv = host->private_data;
+- u16 tmp16;
+-
+- /* configure PCS */
+- pci_read_config_word(pdev, 0x92, &tmp16);
+- if ((tmp16 & hpriv->port_map) != hpriv->port_map) {
+- tmp16 |= hpriv->port_map;
+- pci_write_config_word(pdev, 0x92, tmp16);
+- }
+- }
+-
+- return 0;
+-}
+-
+ static void ahci_pci_init_controller(struct ata_host *host)
+ {
+ struct ahci_host_priv *hpriv = host->private_data;
+@@ -849,7 +837,7 @@ static int ahci_pci_device_runtime_resume(struct device *dev)
+ struct ata_host *host = pci_get_drvdata(pdev);
+ int rc;
+
+- rc = ahci_pci_reset_controller(host);
++ rc = ahci_reset_controller(host);
+ if (rc)
+ return rc;
+ ahci_pci_init_controller(host);
+@@ -884,7 +872,7 @@ static int ahci_pci_device_resume(struct device *dev)
+ ahci_mcp89_apple_enable(pdev);
+
+ if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
+- rc = ahci_pci_reset_controller(host);
++ rc = ahci_reset_controller(host);
+ if (rc)
+ return rc;
+
+@@ -1619,6 +1607,34 @@ static void ahci_update_initial_lpm_policy(struct ata_port *ap,
+ ap->target_lpm_policy = policy;
+ }
+
++static void ahci_intel_pcs_quirk(struct pci_dev *pdev, struct ahci_host_priv *hpriv)
++{
++ const struct pci_device_id *id = pci_match_id(ahci_pci_tbl, pdev);
++ u16 tmp16;
++
++ /*
++ * Only apply the 6-port PCS quirk for known legacy platforms.
++ */
++ if (!id || id->vendor != PCI_VENDOR_ID_INTEL)
++ return;
++ if (((enum board_ids) id->driver_data) < board_ahci_pcs7)
++ return;
++
++ /*
++ * port_map is determined from PORTS_IMPL PCI register which is
++ * implemented as write or write-once register. If the register
++ * isn't programmed, ahci automatically generates it from number
++ * of ports, which is good enough for PCS programming. It is
++ * otherwise expected that platform firmware enables the ports
++ * before the OS boots.
++ */
++ pci_read_config_word(pdev, PCS_6, &tmp16);
++ if ((tmp16 & hpriv->port_map) != hpriv->port_map) {
++ tmp16 |= hpriv->port_map;
++ pci_write_config_word(pdev, PCS_6, tmp16);
++ }
++}
++
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ unsigned int board_id = ent->driver_data;
+@@ -1731,6 +1747,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /* save initial config */
+ ahci_pci_save_initial_config(pdev, hpriv);
+
++ /*
++ * If platform firmware failed to enable ports, try to enable
++ * them here.
++ */
++ ahci_intel_pcs_quirk(pdev, hpriv);
++
+ /* prepare host */
+ if (hpriv->cap & HOST_CAP_NCQ) {
+ pi.flags |= ATA_FLAG_NCQ;
+@@ -1840,7 +1862,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (rc)
+ return rc;
+
+- rc = ahci_pci_reset_controller(host);
++ rc = ahci_reset_controller(host);
+ if (rc)
+ return rc;
+
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index 0570629d719d8..3dbf398c92eaf 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -247,6 +247,8 @@ enum {
+ ATA_FLAG_ACPI_SATA | ATA_FLAG_AN,
+
+ ICH_MAP = 0x90, /* ICH MAP register */
++ PCS_6 = 0x92, /* 6 port PCS */
++ PCS_7 = 0x94, /* 7+ port PCS (Denverton) */
+
+ /* em constants */
+ EM_MAX_SLOTS = 8,
+--
+2.20.1
+
--- /dev/null
+From 03e3c5194ea1e34344af234c89c3510afa61f9b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2019 13:31:38 +0000
+Subject: libertas: Add missing sentinel at end of if_usb.c fw_table
+
+From: Kevin Easton <kevin@guarana.org>
+
+[ Upstream commit 764f3f1ecffc434096e0a2b02f1a6cc964a89df6 ]
+
+This sentinel tells the firmware loading process when to stop.
+
+Reported-and-tested-by: syzbot+98156c174c5a2cad9f8f@syzkaller.appspotmail.com
+Signed-off-by: Kevin Easton <kevin@guarana.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/if_usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index afac2481909b6..20436a289d5cd 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -50,7 +50,8 @@ static const struct lbs_fw_table fw_table[] = {
+ { MODEL_8388, "libertas/usb8388_v5.bin", NULL },
+ { MODEL_8388, "libertas/usb8388.bin", NULL },
+ { MODEL_8388, "usb8388.bin", NULL },
+- { MODEL_8682, "libertas/usb8682.bin", NULL }
++ { MODEL_8682, "libertas/usb8682.bin", NULL },
++ { 0, NULL, NULL }
+ };
+
+ static const struct usb_device_id if_usb_table[] = {
+--
+2.20.1
+
--- /dev/null
+From 5bb11b9c03476c2f63290dbbe0189377dd4191e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 09:07:01 +0000
+Subject: libperf: Fix alignment trap with xyarray contents in 'perf stat'
+
+From: Gerald BAEZA <gerald.baeza@st.com>
+
+[ Upstream commit d9c5c083416500e95da098c01be092b937def7fa ]
+
+Following the patch 'perf stat: Fix --no-scale', an alignment trap
+happens in process_counter_values() on ARMv7 platforms due to the
+attempt to copy non 64 bits aligned double words (pointed by 'count')
+via a NEON vectored instruction ('vld1' with 64 bits alignment
+constraint).
+
+This patch sets a 64 bits alignment constraint on 'contents[]' field in
+'struct xyarray' since the 'count' pointer used above points to such a
+structure.
+
+Signed-off-by: Gerald Baeza <gerald.baeza@st.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1566464769-16374-1-git-send-email-gerald.baeza@st.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/xyarray.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/xyarray.h b/tools/perf/util/xyarray.h
+index 7ffe562e7ae7f..2627b038b6f2a 100644
+--- a/tools/perf/util/xyarray.h
++++ b/tools/perf/util/xyarray.h
+@@ -2,6 +2,7 @@
+ #ifndef _PERF_XYARRAY_H_
+ #define _PERF_XYARRAY_H_ 1
+
++#include <linux/compiler.h>
+ #include <sys/types.h>
+
+ struct xyarray {
+@@ -10,7 +11,7 @@ struct xyarray {
+ size_t entries;
+ size_t max_x;
+ size_t max_y;
+- char contents[];
++ char contents[] __aligned(8);
+ };
+
+ struct xyarray *xyarray__new(int xlen, int ylen, size_t entry_size);
+--
+2.20.1
+
--- /dev/null
+From 6eee06e9f9b09dfe0f119525bd6d0e4dddef7ee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2019 16:43:15 -0400
+Subject: libtraceevent: Change users plugin directory
+
+From: Tzvetomir Stoyanov <tstoyanov@vmware.com>
+
+[ Upstream commit e97fd1383cd77c467d2aed7fa4e596789df83977 ]
+
+To be compliant with XDG user directory layout, the user's plugin
+directory is changed from ~/.traceevent/plugins to
+~/.local/lib/traceevent/plugins/
+
+Suggested-by: Patrick McLean <chutzpah@gentoo.org>
+Signed-off-by: Tzvetomir Stoyanov <tstoyanov@vmware.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Patrick McLean <chutzpah@gentoo.org>
+Cc: linux-trace-devel@vger.kernel.org
+Link: https://lore.kernel.org/linux-trace-devel/20190313144206.41e75cf8@patrickm/
+Link: http://lore.kernel.org/linux-trace-devel/20190801074959.22023-4-tz.stoyanov@gmail.com
+Link: http://lore.kernel.org/lkml/20190805204355.344622683@goodmis.org
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/traceevent/Makefile | 6 +++---
+ tools/lib/traceevent/event-plugin.c | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
+index 3292c290654f6..86ce17a1f7fb6 100644
+--- a/tools/lib/traceevent/Makefile
++++ b/tools/lib/traceevent/Makefile
+@@ -62,15 +62,15 @@ set_plugin_dir := 1
+
+ # Set plugin_dir to preffered global plugin location
+ # If we install under $HOME directory we go under
+-# $(HOME)/.traceevent/plugins
++# $(HOME)/.local/lib/traceevent/plugins
+ #
+ # We dont set PLUGIN_DIR in case we install under $HOME
+ # directory, because by default the code looks under:
+-# $(HOME)/.traceevent/plugins by default.
++# $(HOME)/.local/lib/traceevent/plugins by default.
+ #
+ ifeq ($(plugin_dir),)
+ ifeq ($(prefix),$(HOME))
+-override plugin_dir = $(HOME)/.traceevent/plugins
++override plugin_dir = $(HOME)/.local/lib/traceevent/plugins
+ set_plugin_dir := 0
+ else
+ override plugin_dir = $(libdir)/traceevent/plugins
+diff --git a/tools/lib/traceevent/event-plugin.c b/tools/lib/traceevent/event-plugin.c
+index 8ca28de9337a5..e1f7ddd5a6cf0 100644
+--- a/tools/lib/traceevent/event-plugin.c
++++ b/tools/lib/traceevent/event-plugin.c
+@@ -18,7 +18,7 @@
+ #include "event-utils.h"
+ #include "trace-seq.h"
+
+-#define LOCAL_PLUGIN_DIR ".traceevent/plugins"
++#define LOCAL_PLUGIN_DIR ".local/lib/traceevent/plugins/"
+
+ static struct registered_plugin_options {
+ struct registered_plugin_options *next;
+--
+2.20.1
+
--- /dev/null
+From 3f2759369d67f024aec18d2ca04ea1e1aa5c1287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 01:48:28 +0100
+Subject: loop: Add LOOP_SET_DIRECT_IO to compat ioctl
+
+From: Alessio Balsini <balsini@android.com>
+
+[ Upstream commit fdbe4eeeb1aac219b14f10c0ed31ae5d1123e9b8 ]
+
+Enabling Direct I/O with loop devices helps reducing memory usage by
+avoiding double caching. 32 bit applications running on 64 bits systems
+are currently not able to request direct I/O because is missing from the
+lo_compat_ioctl.
+
+This patch fixes the compatibility issue mentioned above by exporting
+LOOP_SET_DIRECT_IO as additional lo_compat_ioctl() entry.
+The input argument for this ioctl is a single long converted to a 1-bit
+boolean, so compatibility is preserved.
+
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Alessio Balsini <balsini@android.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index ab7ca5989097a..1410fa8936538 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1755,6 +1755,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ case LOOP_SET_FD:
+ case LOOP_CHANGE_FD:
+ case LOOP_SET_BLOCK_SIZE:
++ case LOOP_SET_DIRECT_IO:
+ err = lo_ioctl(bdev, mode, cmd, arg);
+ break;
+ default:
+--
+2.20.1
+
--- /dev/null
+From c7c26f3e7a43caba2b28762e7f39f154af385444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 10:10:25 +1000
+Subject: m68k: Prevent some compiler warnings in Coldfire builds
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 94c04390225bcd8283103fd0c04be20cc30cc979 ]
+
+Since commit d3b41b6bb49e ("m68k: Dispatch nvram_ops calls to Atari or
+Mac functions"), Coldfire builds generate compiler warnings due to the
+unconditional inclusion of asm/atarihw.h and asm/macintosh.h.
+
+The inclusion of asm/atarihw.h causes warnings like this:
+
+In file included from ./arch/m68k/include/asm/atarihw.h:25:0,
+ from arch/m68k/kernel/setup_mm.c:41,
+ from arch/m68k/kernel/setup.c:3:
+./arch/m68k/include/asm/raw_io.h:39:0: warning: "__raw_readb" redefined
+ #define __raw_readb in_8
+
+In file included from ./arch/m68k/include/asm/io.h:6:0,
+ from arch/m68k/kernel/setup_mm.c:36,
+ from arch/m68k/kernel/setup.c:3:
+./arch/m68k/include/asm/io_no.h:16:0: note: this is the location of the previous definition
+ #define __raw_readb(addr) \
+...
+
+This issue is resolved by dropping the asm/raw_io.h include. It turns out
+that asm/io_mm.h already includes that header file.
+
+Moving the relevant macro definitions helps to clarify this dependency
+and make it safe to include asm/atarihw.h.
+
+The other warnings look like this:
+
+In file included from arch/m68k/kernel/setup_mm.c:48:0,
+ from arch/m68k/kernel/setup.c:3:
+./arch/m68k/include/asm/macintosh.h:19:35: warning: 'struct irq_data' declared inside parameter list will not be visible outside of this definition or declaration
+ extern void mac_irq_enable(struct irq_data *data);
+ ^~~~~~~~
+...
+
+This issue is resolved by adding the missing linux/irq.h include.
+
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Acked-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/include/asm/atarihw.h | 9 ---------
+ arch/m68k/include/asm/io_mm.h | 6 +++++-
+ arch/m68k/include/asm/macintosh.h | 1 +
+ 3 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/arch/m68k/include/asm/atarihw.h b/arch/m68k/include/asm/atarihw.h
+index 533008262b691..5e5601c382b80 100644
+--- a/arch/m68k/include/asm/atarihw.h
++++ b/arch/m68k/include/asm/atarihw.h
+@@ -22,7 +22,6 @@
+
+ #include <linux/types.h>
+ #include <asm/bootinfo-atari.h>
+-#include <asm/raw_io.h>
+ #include <asm/kmap.h>
+
+ extern u_long atari_mch_cookie;
+@@ -132,14 +131,6 @@ extern struct atari_hw_present atari_hw_present;
+ */
+
+
+-#define atari_readb raw_inb
+-#define atari_writeb raw_outb
+-
+-#define atari_inb_p raw_inb
+-#define atari_outb_p raw_outb
+-
+-
+-
+ #include <linux/mm.h>
+ #include <asm/cacheflush.h>
+
+diff --git a/arch/m68k/include/asm/io_mm.h b/arch/m68k/include/asm/io_mm.h
+index 6c03ca5bc4365..819f611dccf28 100644
+--- a/arch/m68k/include/asm/io_mm.h
++++ b/arch/m68k/include/asm/io_mm.h
+@@ -29,7 +29,11 @@
+ #include <asm-generic/iomap.h>
+
+ #ifdef CONFIG_ATARI
+-#include <asm/atarihw.h>
++#define atari_readb raw_inb
++#define atari_writeb raw_outb
++
++#define atari_inb_p raw_inb
++#define atari_outb_p raw_outb
+ #endif
+
+
+diff --git a/arch/m68k/include/asm/macintosh.h b/arch/m68k/include/asm/macintosh.h
+index d9a08bed4b128..f653b60f2afcf 100644
+--- a/arch/m68k/include/asm/macintosh.h
++++ b/arch/m68k/include/asm/macintosh.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/seq_file.h>
+ #include <linux/interrupt.h>
++#include <linux/irq.h>
+
+ #include <asm/bootinfo-mac.h>
+
+--
+2.20.1
+
--- /dev/null
+From 625ae0b61bb62e7a6e230f845ddffdf4a42c22ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 11:09:21 +0200
+Subject: md: don't call spare_active in md_reap_sync_thread if all member
+ devices can't work
+
+From: Guoqing Jiang <jgq516@gmail.com>
+
+[ Upstream commit 0d8ed0e9bf9643f27f4816dca61081784dedb38d ]
+
+When add one disk to array, the md_reap_sync_thread is responsible
+to activate the spare and set In_sync flag for the new member in
+spare_active().
+
+But if raid1 has one member disk A, and disk B is added to the array.
+Then we offline A before all the datas are synchronized from A to B,
+obviously B doesn't have the latest data as A, but B is still marked
+with In_sync flag.
+
+So let's not call spare_active under the condition, otherwise B is
+still showed with 'U' state which is not correct.
+
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 24638ccedce42..fd62be3ca2871 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9043,7 +9043,8 @@ void md_reap_sync_thread(struct mddev *mddev)
+ /* resync has finished, collect result */
+ md_unregister_thread(&mddev->sync_thread);
+ if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
+- !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
++ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery) &&
++ mddev->degraded != mddev->raid_disks) {
+ /* success...*/
+ /* activate any spares */
+ if (mddev->pers->spare_active(mddev)) {
+--
+2.20.1
+
--- /dev/null
+From f05ad111cf80a66f26914c15de8cc19f936f5731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 11:09:20 +0200
+Subject: md: don't set In_sync if array is frozen
+
+From: Guoqing Jiang <jgq516@gmail.com>
+
+[ Upstream commit 062f5b2ae12a153644c765e7ba3b0f825427be1d ]
+
+When a disk is added to array, the following path is called in mdadm.
+
+Manage_subdevs -> sysfs_freeze_array
+ -> Manage_add
+ -> sysfs_set_str(&info, NULL, "sync_action","idle")
+
+Then from kernel side, Manage_add invokes the path (add_new_disk ->
+validate_super = super_1_validate) to set In_sync flag.
+
+Since In_sync means "device is in_sync with rest of array", and the new
+added disk need to resync thread to help the synchronization of data.
+And md_reap_sync_thread would call spare_active to set In_sync for the
+new added disk finally. So don't set In_sync if array is in frozen.
+
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index fd62be3ca2871..232ea1f519963 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1826,8 +1826,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
+ if (!(le32_to_cpu(sb->feature_map) &
+ MD_FEATURE_RECOVERY_BITMAP))
+ rdev->saved_raid_disk = -1;
+- } else
+- set_bit(In_sync, &rdev->flags);
++ } else {
++ /*
++ * If the array is FROZEN, then the device can't
++ * be in_sync with rest of array.
++ */
++ if (!test_bit(MD_RECOVERY_FROZEN,
++ &mddev->recovery))
++ set_bit(In_sync, &rdev->flags);
++ }
+ rdev->raid_disk = role;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7783e98e9b06df7dedbce44b27faddff766b4716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 13:48:46 +0800
+Subject: md/raid1: end bio when the device faulty
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+[ Upstream commit eeba6809d8d58908b5ed1b5ceb5fcb09a98a7cad ]
+
+When write bio return error, it would be added to conf->retry_list
+and wait for raid1d thread to retry write and acknowledge badblocks.
+
+In narrow_write_error(), the error bio will be split in the unit of
+badblock shift (such as one sector) and raid1d thread issues them
+one by one. Until all of the splited bio has finished, raid1d thread
+can go on processing other things, which is time consuming.
+
+But, there is a scene for error handling that is not necessary.
+When the device has been set faulty, flush_bio_list() may end
+bios in pending_bio_list with error status. Since these bios
+has not been issued to the device actually, error handlding to
+retry write and acknowledge badblocks make no sense.
+
+Even without that scene, when the device is faulty, badblocks info
+can not be written out to the device. Thus, we also no need to
+handle the error IO.
+
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 34e26834ad28b..501a3b4d82f33 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -447,19 +447,21 @@ static void raid1_end_write_request(struct bio *bio)
+ /* We never try FailFast to WriteMostly devices */
+ !test_bit(WriteMostly, &rdev->flags)) {
+ md_error(r1_bio->mddev, rdev);
+- if (!test_bit(Faulty, &rdev->flags))
+- /* This is the only remaining device,
+- * We need to retry the write without
+- * FailFast
+- */
+- set_bit(R1BIO_WriteError, &r1_bio->state);
+- else {
+- /* Finished with this branch */
+- r1_bio->bios[mirror] = NULL;
+- to_put = bio;
+- }
+- } else
++ }
++
++ /*
++ * When the device is faulty, it is not necessary to
++ * handle write error.
++ * For failfast, this is the only remaining device,
++ * We need to retry the write without FailFast.
++ */
++ if (!test_bit(Faulty, &rdev->flags))
+ set_bit(R1BIO_WriteError, &r1_bio->state);
++ else {
++ /* Finished with this branch */
++ r1_bio->bios[mirror] = NULL;
++ to_put = bio;
++ }
+ } else {
+ /*
+ * Set R1BIO_Uptodate in our master bio, so that we
+--
+2.20.1
+
--- /dev/null
+From 10cae78673282706d3c50585e4e1f9c3cc228245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 21:12:41 +0800
+Subject: md/raid1: fail run raid1 array when active disk less than one
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+[ Upstream commit 07f1a6850c5d5a65c917c3165692b5179ac4cb6b ]
+
+When run test case:
+ mdadm -CR /dev/md1 -l 1 -n 4 /dev/sd[a-d] --assume-clean --bitmap=internal
+ mdadm -S /dev/md1
+ mdadm -A /dev/md1 /dev/sd[b-c] --run --force
+
+ mdadm --zero /dev/sda
+ mdadm /dev/md1 -a /dev/sda
+
+ echo offline > /sys/block/sdc/device/state
+ echo offline > /sys/block/sdb/device/state
+ sleep 5
+ mdadm -S /dev/md1
+
+ echo running > /sys/block/sdb/device/state
+ echo running > /sys/block/sdc/device/state
+ mdadm -A /dev/md1 /dev/sd[a-c] --run --force
+
+mdadm run fail with kernel message as follow:
+[ 172.986064] md: kicking non-fresh sdb from array!
+[ 173.004210] md: kicking non-fresh sdc from array!
+[ 173.022383] md/raid1:md1: active with 0 out of 4 mirrors
+[ 173.022406] md1: failed to create bitmap (-5)
+
+In fact, when active disk in raid1 array less than one, we
+need to return fail in raid1_run().
+
+Reviewed-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 501a3b4d82f33..5afbb7df06e70 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -3129,6 +3129,13 @@ static int raid1_run(struct mddev *mddev)
+ !test_bit(In_sync, &conf->mirrors[i].rdev->flags) ||
+ test_bit(Faulty, &conf->mirrors[i].rdev->flags))
+ mddev->degraded++;
++ /*
++ * RAID1 needs at least one disk in active
++ */
++ if (conf->raid_disks - mddev->degraded < 1) {
++ ret = -EINVAL;
++ goto abort;
++ }
+
+ if (conf->raid_disks - mddev->degraded == 1)
+ mddev->recovery_cp = MaxSector;
+@@ -3162,8 +3169,12 @@ static int raid1_run(struct mddev *mddev)
+ ret = md_integrity_register(mddev);
+ if (ret) {
+ md_unregister_thread(&mddev->thread);
+- raid1_free(mddev, conf);
++ goto abort;
+ }
++ return 0;
++
++abort:
++ raid1_free(mddev, conf);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 47814287397c90d754b15ed3f9037bdb3efdca25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 11:46:40 -0300
+Subject: media: aspeed-video: address a protential usage of an unitialized var
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+[ Upstream commit 31b8b0bd6e55c3ea5a08bb8141fa5d3c90600e3b ]
+
+While this might not occur in practice, if the device is doing
+the right thing, it would be teoretically be possible to have
+both hsync_counter and vsync_counter negatives.
+
+If this ever happen, ctrl will be undefined, but the driver
+will still call:
+
+ aspeed_video_update(video, VE_CTRL, 0, ctrl);
+
+Change the code to prevent this to happen.
+
+This was warned by cppcheck:
+
+ [drivers/media/platform/aspeed-video.c:653]: (error) Uninitialized variable: ctrl
+
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index f899ac3b4a613..4ef37cfc84467 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -630,7 +630,7 @@ static void aspeed_video_check_and_set_polarity(struct aspeed_video *video)
+ }
+
+ if (hsync_counter < 0 || vsync_counter < 0) {
+- u32 ctrl;
++ u32 ctrl = 0;
+
+ if (hsync_counter < 0) {
+ ctrl = VE_CTRL_HSYNC_POL;
+@@ -650,7 +650,8 @@ static void aspeed_video_check_and_set_polarity(struct aspeed_video *video)
+ V4L2_DV_VSYNC_POS_POL;
+ }
+
+- aspeed_video_update(video, VE_CTRL, 0, ctrl);
++ if (ctrl)
++ aspeed_video_update(video, VE_CTRL, 0, ctrl);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3088f093d236cf35173f67476a87b44d3bddbb4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 08:12:59 -0300
+Subject: media: cec-notifier: clear cec_adap in cec_notifier_unregister
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 14d5511691e5290103bc480998bc322e68f139d4 ]
+
+If cec_notifier_cec_adap_unregister() is called before
+cec_unregister_adapter() then everything is OK (and this is the
+case today). But if it is the other way around, then
+cec_notifier_unregister() is called first, and that doesn't
+set n->cec_adap to NULL.
+
+So if e.g. cec_notifier_set_phys_addr() is called after
+cec_notifier_unregister() but before cec_unregister_adapter()
+then n->cec_adap points to an unregistered and likely deleted
+cec adapter. So just set n->cec_adap->notifier and n->cec_adap
+to NULL for rubustness.
+
+Eventually cec_notifier_unregister will disappear and this will
+be simplified substantially.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/cec-notifier.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/cec/cec-notifier.c b/drivers/media/cec/cec-notifier.c
+index 52a867bde15fd..4d82a5522072e 100644
+--- a/drivers/media/cec/cec-notifier.c
++++ b/drivers/media/cec/cec-notifier.c
+@@ -218,6 +218,8 @@ void cec_notifier_unregister(struct cec_notifier *n)
+
+ mutex_lock(&n->lock);
+ n->callback = NULL;
++ n->cec_adap->notifier = NULL;
++ n->cec_adap = NULL;
+ mutex_unlock(&n->lock);
+ cec_notifier_put(n);
+ }
+--
+2.20.1
+
--- /dev/null
+From 89cbe44efad1cbd3ffcb6b3c3d092c5b8fd22e9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Aug 2019 02:27:46 -0300
+Subject: media: cpia2_usb: fix memory leaks
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 1c770f0f52dca1a2323c594f01f5ec6f1dddc97f ]
+
+In submit_urbs(), 'cam->sbuf[i].data' is allocated through kmalloc_array().
+However, it is not deallocated if the following allocation for urbs fails.
+To fix this issue, free 'cam->sbuf[i].data' if usb_alloc_urb() fails.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/cpia2/cpia2_usb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
+index 17468f7d78ed2..3ab80a7b44985 100644
+--- a/drivers/media/usb/cpia2/cpia2_usb.c
++++ b/drivers/media/usb/cpia2/cpia2_usb.c
+@@ -676,6 +676,10 @@ static int submit_urbs(struct camera_data *cam)
+ if (!urb) {
+ for (j = 0; j < i; j++)
+ usb_free_urb(cam->sbuf[j].urb);
++ for (j = 0; j < NUM_SBUF; j++) {
++ kfree(cam->sbuf[j].data);
++ cam->sbuf[j].data = NULL;
++ }
+ return -ENOMEM;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From efbd19aae319745a63f3a731bcd4f4ba353af4ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 08:14:53 -0400
+Subject: media: dib0700: fix link error for dibx000_i2c_set_speed
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 765bb8610d305ee488b35d07e2a04ae52fb2df9c ]
+
+When CONFIG_DVB_DIB9000 is disabled, we can still compile code that
+now fails to link against dibx000_i2c_set_speed:
+
+drivers/media/usb/dvb-usb/dib0700_devices.o: In function `dib01x0_pmu_update.constprop.7':
+dib0700_devices.c:(.text.unlikely+0x1c9c): undefined reference to `dibx000_i2c_set_speed'
+
+The call sites are both through dib01x0_pmu_update(), which gets passed
+an 'i2c' pointer from dib9000_get_i2c_master(), which has returned
+NULL. Checking this pointer seems to be a good idea anyway, and it avoids
+the link failure in most cases.
+
+Sean Young found another case that is not fixed by that, where certain
+gcc versions leave an unused function in place that causes the link error,
+but adding an explict IS_ENABLED() check also solves this.
+
+Fixes: b7f54910ce01 ("V4L/DVB (4647): Added module for DiB0700 based devices")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb/dib0700_devices.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
+index 66d685065e065..ab7a100ec84fe 100644
+--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
+@@ -2439,9 +2439,13 @@ static int dib9090_tuner_attach(struct dvb_usb_adapter *adap)
+ 8, 0x0486,
+ };
+
++ if (!IS_ENABLED(CONFIG_DVB_DIB9000))
++ return -ENODEV;
+ if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &dib9090_dib0090_config) == NULL)
+ return -ENODEV;
+ i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0);
++ if (!i2c)
++ return -ENODEV;
+ if (dib01x0_pmu_update(i2c, data_dib190, 10) != 0)
+ return -ENODEV;
+ dib0700_set_i2c_speed(adap->dev, 1500);
+@@ -2517,10 +2521,14 @@ static int nim9090md_tuner_attach(struct dvb_usb_adapter *adap)
+ 0, 0x00ef,
+ 8, 0x0406,
+ };
++ if (!IS_ENABLED(CONFIG_DVB_DIB9000))
++ return -ENODEV;
+ i2c = dib9000_get_tuner_interface(adap->fe_adap[0].fe);
+ if (dvb_attach(dib0090_fw_register, adap->fe_adap[0].fe, i2c, &nim9090md_dib0090_config[0]) == NULL)
+ return -ENODEV;
+ i2c = dib9000_get_i2c_master(adap->fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_1_2, 0);
++ if (!i2c)
++ return -ENODEV;
+ if (dib01x0_pmu_update(i2c, data_dib190, 10) < 0)
+ return -ENODEV;
+
+--
+2.20.1
+
--- /dev/null
+From f8d0a3578298a08eab3c5841a73cfa42677c9f51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Aug 2019 00:45:40 -0300
+Subject: media: dvb-core: fix a memory leak bug
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit fcd5ce4b3936242e6679875a4d3c3acfc8743e15 ]
+
+In dvb_create_media_entity(), 'dvbdev->entity' is allocated through
+kzalloc(). Then, 'dvbdev->pads' is allocated through kcalloc(). However, if
+kcalloc() fails, the allocated 'dvbdev->entity' is not deallocated, leading
+to a memory leak bug. To fix this issue, free 'dvbdev->entity' before
+returning -ENOMEM.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index a3393cd4e584f..7557fbf9d3068 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -339,8 +339,10 @@ static int dvb_create_media_entity(struct dvb_device *dvbdev,
+ if (npads) {
+ dvbdev->pads = kcalloc(npads, sizeof(*dvbdev->pads),
+ GFP_KERNEL);
+- if (!dvbdev->pads)
++ if (!dvbdev->pads) {
++ kfree(dvbdev->entity);
+ return -ENOMEM;
++ }
+ }
+
+ switch (type) {
+--
+2.20.1
+
--- /dev/null
+From 0fb768355df7479196ed74197f79acadab6da2a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Aug 2019 00:12:03 -0300
+Subject: media: dvb-frontends: use ida for pll number
+
+From: Sean Young <sean@mess.org>
+
+[ Upstream commit c268e7adea52be0093de1164c425f3c8d8927770 ]
+
+KASAN: global-out-of-bounds Read in dvb_pll_attach
+
+Syzbot reported global-out-of-bounds Read in dvb_pll_attach, while
+accessing id[dvb_pll_devcount], because dvb_pll_devcount was 65,
+that is more than size of 'id' which is DVB_PLL_MAX(64).
+
+Rather than increasing dvb_pll_devcount every time, use ida so that
+numbers are allocated correctly. This does mean that no more than
+64 devices can be attached at the same time, but this is more than
+sufficient.
+
+usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the
+software demuxer
+dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0)
+usb 1-1: media controller created
+dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
+tc90522 0-0018: Toshiba TC90522 attached.
+usb 1-1: DVB: registering adapter 0 frontend 0 (Toshiba TC90522 ISDB-T
+module)...
+dvbdev: dvb_create_media_entity: media entity 'Toshiba TC90522 ISDB-T
+module' registered.
+==================================================================
+BUG: KASAN: global-out-of-bounds in dvb_pll_attach+0x6c5/0x830
+drivers/media/dvb-frontends/dvb-pll.c:798
+Read of size 4 at addr ffffffff89c9e5e0 by task kworker/0:1/12
+
+CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.2.0-rc6+ #13
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xca/0x13e lib/dump_stack.c:113
+ print_address_description+0x67/0x231 mm/kasan/report.c:188
+ __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:317
+ kasan_report+0xe/0x20 mm/kasan/common.c:614
+ dvb_pll_attach+0x6c5/0x830 drivers/media/dvb-frontends/dvb-pll.c:798
+ dvb_pll_probe+0xfe/0x174 drivers/media/dvb-frontends/dvb-pll.c:877
+ i2c_device_probe+0x790/0xaa0 drivers/i2c/i2c-core-base.c:389
+ really_probe+0x281/0x660 drivers/base/dd.c:509
+ driver_probe_device+0x104/0x210 drivers/base/dd.c:670
+ __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
+ bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x217/0x360 drivers/base/dd.c:843
+ bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
+ device_add+0xae6/0x16f0 drivers/base/core.c:2111
+ i2c_new_client_device+0x5b3/0xc40 drivers/i2c/i2c-core-base.c:778
+ i2c_new_device+0x19/0x50 drivers/i2c/i2c-core-base.c:821
+ dvb_module_probe+0xf9/0x220 drivers/media/dvb-core/dvbdev.c:985
+ friio_tuner_attach+0x125/0x1d0 drivers/media/usb/dvb-usb-v2/gl861.c:536
+ dvb_usbv2_adapter_frontend_init
+drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:675 [inline]
+ dvb_usbv2_adapter_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:804
+[inline]
+ dvb_usbv2_init drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:865 [inline]
+ dvb_usbv2_probe.cold+0x24dc/0x255d
+drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:980
+ usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:361
+ really_probe+0x281/0x660 drivers/base/dd.c:509
+ driver_probe_device+0x104/0x210 drivers/base/dd.c:670
+ __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
+ bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x217/0x360 drivers/base/dd.c:843
+ bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
+ device_add+0xae6/0x16f0 drivers/base/core.c:2111
+ usb_set_configuration+0xdf6/0x1670 drivers/usb/core/message.c:2023
+ generic_probe+0x9d/0xd5 drivers/usb/core/generic.c:210
+ usb_probe_device+0x99/0x100 drivers/usb/core/driver.c:266
+ really_probe+0x281/0x660 drivers/base/dd.c:509
+ driver_probe_device+0x104/0x210 drivers/base/dd.c:670
+ __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:777
+ bus_for_each_drv+0x15c/0x1e0 drivers/base/bus.c:454
+ __device_attach+0x217/0x360 drivers/base/dd.c:843
+ bus_probe_device+0x1e4/0x290 drivers/base/bus.c:514
+ device_add+0xae6/0x16f0 drivers/base/core.c:2111
+ usb_new_device.cold+0x8c1/0x1016 drivers/usb/core/hub.c:2534
+ hub_port_connect drivers/usb/core/hub.c:5089 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
+ port_event drivers/usb/core/hub.c:5350 [inline]
+ hub_event+0x1ada/0x3590 drivers/usb/core/hub.c:5432
+ process_one_work+0x905/0x1570 kernel/workqueue.c:2269
+ process_scheduled_works kernel/workqueue.c:2331 [inline]
+ worker_thread+0x7ab/0xe20 kernel/workqueue.c:2417
+ kthread+0x30b/0x410 kernel/kthread.c:255
+ ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
+
+The buggy address belongs to the variable:
+ id+0x100/0x120
+
+Memory state around the buggy address:
+ ffffffff89c9e480: fa fa fa fa 00 00 fa fa fa fa fa fa 00 00 00 00
+ ffffffff89c9e500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+> ffffffff89c9e580: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
+ ^
+ ffffffff89c9e600: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
+ ffffffff89c9e680: 04 fa fa fa fa fa fa fa 04 fa fa fa fa fa fa fa
+==================================================================
+
+Reported-by: syzbot+8a8f48672560c8ca59dd@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dvb-pll.c | 40 ++++++++++++++++-----------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/dvb-pll.c b/drivers/media/dvb-frontends/dvb-pll.c
+index ba0c49107bd28..d45b4ddc8f912 100644
+--- a/drivers/media/dvb-frontends/dvb-pll.c
++++ b/drivers/media/dvb-frontends/dvb-pll.c
+@@ -9,6 +9,7 @@
+
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/idr.h>
+ #include <linux/dvb/frontend.h>
+ #include <asm/types.h>
+
+@@ -34,8 +35,7 @@ struct dvb_pll_priv {
+ };
+
+ #define DVB_PLL_MAX 64
+-
+-static unsigned int dvb_pll_devcount;
++static DEFINE_IDA(pll_ida);
+
+ static int debug;
+ module_param(debug, int, 0644);
+@@ -787,6 +787,7 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ struct dvb_pll_priv *priv = NULL;
+ int ret;
+ const struct dvb_pll_desc *desc;
++ int nr;
+
+ b1 = kmalloc(1, GFP_KERNEL);
+ if (!b1)
+@@ -795,9 +796,14 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ b1[0] = 0;
+ msg.buf = b1;
+
+- if ((id[dvb_pll_devcount] > DVB_PLL_UNDEFINED) &&
+- (id[dvb_pll_devcount] < ARRAY_SIZE(pll_list)))
+- pll_desc_id = id[dvb_pll_devcount];
++ nr = ida_simple_get(&pll_ida, 0, DVB_PLL_MAX, GFP_KERNEL);
++ if (nr < 0) {
++ kfree(b1);
++ return NULL;
++ }
++
++ if (id[nr] > DVB_PLL_UNDEFINED && id[nr] < ARRAY_SIZE(pll_list))
++ pll_desc_id = id[nr];
+
+ BUG_ON(pll_desc_id < 1 || pll_desc_id >= ARRAY_SIZE(pll_list));
+
+@@ -808,24 +814,20 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ fe->ops.i2c_gate_ctrl(fe, 1);
+
+ ret = i2c_transfer (i2c, &msg, 1);
+- if (ret != 1) {
+- kfree(b1);
+- return NULL;
+- }
++ if (ret != 1)
++ goto out;
+ if (fe->ops.i2c_gate_ctrl)
+ fe->ops.i2c_gate_ctrl(fe, 0);
+ }
+
+ priv = kzalloc(sizeof(struct dvb_pll_priv), GFP_KERNEL);
+- if (!priv) {
+- kfree(b1);
+- return NULL;
+- }
++ if (!priv)
++ goto out;
+
+ priv->pll_i2c_address = pll_addr;
+ priv->i2c = i2c;
+ priv->pll_desc = desc;
+- priv->nr = dvb_pll_devcount++;
++ priv->nr = nr;
+
+ memcpy(&fe->ops.tuner_ops, &dvb_pll_tuner_ops,
+ sizeof(struct dvb_tuner_ops));
+@@ -858,6 +860,11 @@ struct dvb_frontend *dvb_pll_attach(struct dvb_frontend *fe, int pll_addr,
+ kfree(b1);
+
+ return fe;
++out:
++ kfree(b1);
++ ida_simple_remove(&pll_ida, nr);
++
++ return NULL;
+ }
+ EXPORT_SYMBOL(dvb_pll_attach);
+
+@@ -894,9 +901,10 @@ dvb_pll_probe(struct i2c_client *client, const struct i2c_device_id *id)
+
+ static int dvb_pll_remove(struct i2c_client *client)
+ {
+- struct dvb_frontend *fe;
++ struct dvb_frontend *fe = i2c_get_clientdata(client);
++ struct dvb_pll_priv *priv = fe->tuner_priv;
+
+- fe = i2c_get_clientdata(client);
++ ida_simple_remove(&pll_ida, priv->nr);
+ dvb_pll_release(fe);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 74cbb53840f97c16a730b1bc102ca46620eb17ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2019 02:05:51 -0300
+Subject: media: em28xx: modules workqueue not inited for 2nd device
+
+From: Sean Young <sean@mess.org>
+
+[ Upstream commit 46e4a26615cc7854340e4b69ca59ee78d6f20c8b ]
+
+syzbot reports an error on flush_request_modules() for the second device.
+This workqueue was never initialised so simply remove the offending line.
+
+usb 1-1: USB disconnect, device number 2
+em28xx 1-1:1.153: Disconnecting em28xx #1
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 12 at kernel/workqueue.c:3031
+__flush_work.cold+0x2c/0x36 kernel/workqueue.c:3031
+Kernel panic - not syncing: panic_on_warn set ...
+CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc2+ #25
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xca/0x13e lib/dump_stack.c:113
+ panic+0x2a3/0x6da kernel/panic.c:219
+ __warn.cold+0x20/0x4a kernel/panic.c:576
+ report_bug+0x262/0x2a0 lib/bug.c:186
+ fixup_bug arch/x86/kernel/traps.c:179 [inline]
+ fixup_bug arch/x86/kernel/traps.c:174 [inline]
+ do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
+ do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
+ invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1026
+RIP: 0010:__flush_work.cold+0x2c/0x36 kernel/workqueue.c:3031
+Code: 9a 22 00 48 c7 c7 20 e4 c5 85 e8 d9 3a 0d 00 0f 0b 45 31 e4 e9 98 86
+ff ff e8 51 9a 22 00 48 c7 c7 20 e4 c5 85 e8 be 3a 0d 00 <0f> 0b 45 31 e4
+e9 7d 86 ff ff e8 36 9a 22 00 48 c7 c7 20 e4 c5 85
+RSP: 0018:ffff8881da20f720 EFLAGS: 00010286
+RAX: 0000000000000024 RBX: dffffc0000000000 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: ffffffff8128a0fd RDI: ffffed103b441ed6
+RBP: ffff8881da20f888 R08: 0000000000000024 R09: fffffbfff11acd9a
+R10: fffffbfff11acd99 R11: ffffffff88d66ccf R12: 0000000000000000
+R13: 0000000000000001 R14: ffff8881c6685df8 R15: ffff8881d2a85b78
+ flush_request_modules drivers/media/usb/em28xx/em28xx-cards.c:3325 [inline]
+ em28xx_usb_disconnect.cold+0x280/0x2a6
+drivers/media/usb/em28xx/em28xx-cards.c:4023
+ usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:423
+ __device_release_driver drivers/base/dd.c:1120 [inline]
+ device_release_driver_internal+0x404/0x4c0 drivers/base/dd.c:1151
+ bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:556
+ device_del+0x420/0xb10 drivers/base/core.c:2288
+ usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1237
+ usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2199
+ hub_port_connect drivers/usb/core/hub.c:4949 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
+ port_event drivers/usb/core/hub.c:5359 [inline]
+ hub_event+0x1454/0x3640 drivers/usb/core/hub.c:5441
+ process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
+ process_scheduled_works kernel/workqueue.c:2331 [inline]
+ worker_thread+0x7ab/0xe20 kernel/workqueue.c:2417
+ kthread+0x318/0x420 kernel/kthread.c:255
+ ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
+Kernel Offset: disabled
+Rebooting in 86400 seconds..
+
+Fixes: be7fd3c3a8c5e ("media: em28xx: Hauppauge DualHD second tuner functionality)
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Brad Love <brad@nextdimension.cc>
+Reported-by: syzbot+b7f57261c521087d89bb@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 1283c7ca9ad51..1de835a591a06 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4020,7 +4020,6 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
+ dev->dev_next->disconnected = 1;
+ dev_info(&dev->intf->dev, "Disconnecting %s\n",
+ dev->dev_next->name);
+- flush_request_modules(dev->dev_next);
+ }
+
+ dev->disconnected = 1;
+--
+2.20.1
+
--- /dev/null
+From 7998b26efd4a6d48918526f33a4dcfc063a89d98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2019 23:01:15 -0400
+Subject: media: exynos4-is: fix leaked of_node references
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit da79bf41a4d170ca93cc8f3881a70d734a071c37 ]
+
+The call to of_get_child_by_name returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+drivers/media/platform/exynos4-is/fimc-is.c:813:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function.
+drivers/media/platform/exynos4-is/fimc-is.c:870:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function.
+drivers/media/platform/exynos4-is/fimc-is.c:885:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 807, but without a corresponding object release within this function.
+drivers/media/platform/exynos4-is/media-dev.c:545:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 541, but without a corresponding object release within this function.
+drivers/media/platform/exynos4-is/media-dev.c:528:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 499, but without a corresponding object release within this function.
+drivers/media/platform/exynos4-is/media-dev.c:534:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 499, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/exynos4-is/fimc-is.c | 1 +
+ drivers/media/platform/exynos4-is/media-dev.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c
+index e043d55133a31..b7cc8e651e327 100644
+--- a/drivers/media/platform/exynos4-is/fimc-is.c
++++ b/drivers/media/platform/exynos4-is/fimc-is.c
+@@ -806,6 +806,7 @@ static int fimc_is_probe(struct platform_device *pdev)
+ return -ENODEV;
+
+ is->pmu_regs = of_iomap(node, 0);
++ of_node_put(node);
+ if (!is->pmu_regs)
+ return -ENOMEM;
+
+diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
+index d53427a8db11d..a838189d44902 100644
+--- a/drivers/media/platform/exynos4-is/media-dev.c
++++ b/drivers/media/platform/exynos4-is/media-dev.c
+@@ -501,6 +501,7 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
+ continue;
+
+ ret = fimc_md_parse_port_node(fmd, port, index);
++ of_node_put(port);
+ if (ret < 0) {
+ of_node_put(node);
+ goto cleanup;
+@@ -542,6 +543,7 @@ static int __of_get_csis_id(struct device_node *np)
+ if (!np)
+ return -EINVAL;
+ of_property_read_u32(np, "reg", ®);
++ of_node_put(np);
+ return reg - FIMC_INPUT_MIPI_CSI2_0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2e1ac1ada05a70dcfcb0f713329306ede39baaa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jul 2019 06:59:52 -0300
+Subject: media: fdp1: Reduce FCP not found message level to debug
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4fd22938569c14f6092c05880ca387409d78355f ]
+
+When support for the IPMMU is not enabled, the FDP driver may be
+probe-deferred multiple times, causing several messages to be printed
+like:
+
+ rcar_fdp1 fe940000.fdp1: FCP not found (-517)
+ rcar_fdp1 fe944000.fdp1: FCP not found (-517)
+
+Fix this by reducing the message level to debug level, as is done in the
+VSP1 driver.
+
+Fixes: 4710b752e029f3f8 ("[media] v4l: Add Renesas R-Car FDP1 Driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 43aae9b6bb20e..c23ec127c2776 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2306,7 +2306,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ fdp1->fcp = rcar_fcp_get(fcp_node);
+ of_node_put(fcp_node);
+ if (IS_ERR(fdp1->fcp)) {
+- dev_err(&pdev->dev, "FCP not found (%ld)\n",
++ dev_dbg(&pdev->dev, "FCP not found (%ld)\n",
+ PTR_ERR(fdp1->fcp));
+ return PTR_ERR(fdp1->fcp);
+ }
+--
+2.20.1
+
--- /dev/null
+From 21a17040ffac9d0e6652b109f001975dbe1156e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 03:38:13 -0300
+Subject: media: gspca: zero usb_buf on error
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 4843a543fad3bf8221cf14e5d5f32d15cee89e84 ]
+
+If reg_r() fails, then gspca_dev->usb_buf was left uninitialized,
+and some drivers used the contents of that buffer in logic.
+
+This caused several syzbot errors:
+
+https://syzkaller.appspot.com/bug?extid=397fd082ce5143e2f67d
+https://syzkaller.appspot.com/bug?extid=1a35278dd0ebfb3a038a
+https://syzkaller.appspot.com/bug?extid=06ddf1788cfd048c5e82
+
+I analyzed the gspca drivers and zeroed the buffer where needed.
+
+Reported-and-tested-by: syzbot+1a35278dd0ebfb3a038a@syzkaller.appspotmail.com
+Reported-and-tested-by: syzbot+397fd082ce5143e2f67d@syzkaller.appspotmail.com
+Reported-and-tested-by: syzbot+06ddf1788cfd048c5e82@syzkaller.appspotmail.com
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/gspca/konica.c | 5 +++++
+ drivers/media/usb/gspca/nw80x.c | 5 +++++
+ drivers/media/usb/gspca/ov519.c | 10 ++++++++++
+ drivers/media/usb/gspca/ov534.c | 5 +++++
+ drivers/media/usb/gspca/ov534_9.c | 1 +
+ drivers/media/usb/gspca/se401.c | 5 +++++
+ drivers/media/usb/gspca/sn9c20x.c | 5 +++++
+ drivers/media/usb/gspca/sonixb.c | 5 +++++
+ drivers/media/usb/gspca/sonixj.c | 5 +++++
+ drivers/media/usb/gspca/spca1528.c | 5 +++++
+ drivers/media/usb/gspca/sq930x.c | 5 +++++
+ drivers/media/usb/gspca/sunplus.c | 5 +++++
+ drivers/media/usb/gspca/vc032x.c | 5 +++++
+ drivers/media/usb/gspca/w996Xcf.c | 5 +++++
+ 14 files changed, 71 insertions(+)
+
+diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
+index d8e40137a2043..53db9a2895ea5 100644
+--- a/drivers/media/usb/gspca/konica.c
++++ b/drivers/media/usb/gspca/konica.c
+@@ -114,6 +114,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 value, u16 index)
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, 2);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/nw80x.c b/drivers/media/usb/gspca/nw80x.c
+index 59649704beba1..880f569bda30f 100644
+--- a/drivers/media/usb/gspca/nw80x.c
++++ b/drivers/media/usb/gspca/nw80x.c
+@@ -1572,6 +1572,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ return;
+ }
+ if (len == 1)
+diff --git a/drivers/media/usb/gspca/ov519.c b/drivers/media/usb/gspca/ov519.c
+index cfb1f53bc17e7..f417dfc0b8729 100644
+--- a/drivers/media/usb/gspca/ov519.c
++++ b/drivers/media/usb/gspca/ov519.c
+@@ -2073,6 +2073,11 @@ static int reg_r(struct sd *sd, u16 index)
+ } else {
+ gspca_err(gspca_dev, "reg_r %02x failed %d\n", index, ret);
+ sd->gspca_dev.usb_err = ret;
++ /*
++ * Make sure the result is zeroed to avoid uninitialized
++ * values.
++ */
++ gspca_dev->usb_buf[0] = 0;
+ }
+
+ return ret;
+@@ -2101,6 +2106,11 @@ static int reg_r8(struct sd *sd,
+ } else {
+ gspca_err(gspca_dev, "reg_r8 %02x failed %d\n", index, ret);
+ sd->gspca_dev.usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, 8);
+ }
+
+ return ret;
+diff --git a/drivers/media/usb/gspca/ov534.c b/drivers/media/usb/gspca/ov534.c
+index 56521c991db45..185c1f10fb30b 100644
+--- a/drivers/media/usb/gspca/ov534.c
++++ b/drivers/media/usb/gspca/ov534.c
+@@ -693,6 +693,11 @@ static u8 ov534_reg_read(struct gspca_dev *gspca_dev, u16 reg)
+ if (ret < 0) {
+ pr_err("read failed %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the result is zeroed to avoid uninitialized
++ * values.
++ */
++ gspca_dev->usb_buf[0] = 0;
+ }
+ return gspca_dev->usb_buf[0];
+ }
+diff --git a/drivers/media/usb/gspca/ov534_9.c b/drivers/media/usb/gspca/ov534_9.c
+index 867f860a96500..91efc650cf769 100644
+--- a/drivers/media/usb/gspca/ov534_9.c
++++ b/drivers/media/usb/gspca/ov534_9.c
+@@ -1145,6 +1145,7 @@ static u8 reg_r(struct gspca_dev *gspca_dev, u16 reg)
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ return 0;
+ }
+ return gspca_dev->usb_buf[0];
+ }
+diff --git a/drivers/media/usb/gspca/se401.c b/drivers/media/usb/gspca/se401.c
+index 061deee138c31..e087cfb5980b0 100644
+--- a/drivers/media/usb/gspca/se401.c
++++ b/drivers/media/usb/gspca/se401.c
+@@ -101,6 +101,11 @@ static void se401_read_req(struct gspca_dev *gspca_dev, u16 req, int silent)
+ pr_err("read req failed req %#04x error %d\n",
+ req, err);
+ gspca_dev->usb_err = err;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, READ_REQ_SIZE);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sn9c20x.c b/drivers/media/usb/gspca/sn9c20x.c
+index b43f89fee6c1d..12a2395a36ac6 100644
+--- a/drivers/media/usb/gspca/sn9c20x.c
++++ b/drivers/media/usb/gspca/sn9c20x.c
+@@ -909,6 +909,11 @@ static void reg_r(struct gspca_dev *gspca_dev, u16 reg, u16 length)
+ if (unlikely(result < 0 || result != length)) {
+ pr_err("Read register %02x failed %d\n", reg, result);
+ gspca_dev->usb_err = result;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
+index 046fc2c2a1350..4d655e2da9cba 100644
+--- a/drivers/media/usb/gspca/sonixb.c
++++ b/drivers/media/usb/gspca/sonixb.c
+@@ -453,6 +453,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ dev_err(gspca_dev->v4l2_dev.dev,
+ "Error reading register %02x: %d\n", value, res);
+ gspca_dev->usb_err = res;
++ /*
++ * Make sure the result is zeroed to avoid uninitialized
++ * values.
++ */
++ gspca_dev->usb_buf[0] = 0;
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
+index 50a6c8425827f..2e1bd2df8304a 100644
+--- a/drivers/media/usb/gspca/sonixj.c
++++ b/drivers/media/usb/gspca/sonixj.c
+@@ -1162,6 +1162,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/spca1528.c b/drivers/media/usb/gspca/spca1528.c
+index 2ae03b60163ff..ccc477944ef82 100644
+--- a/drivers/media/usb/gspca/spca1528.c
++++ b/drivers/media/usb/gspca/spca1528.c
+@@ -71,6 +71,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sq930x.c b/drivers/media/usb/gspca/sq930x.c
+index d1ba0888d7989..c3610247a90e0 100644
+--- a/drivers/media/usb/gspca/sq930x.c
++++ b/drivers/media/usb/gspca/sq930x.c
+@@ -425,6 +425,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r %04x failed %d\n", value, ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/sunplus.c b/drivers/media/usb/gspca/sunplus.c
+index d0ddfa957ca9f..f4a4222f0d2e4 100644
+--- a/drivers/media/usb/gspca/sunplus.c
++++ b/drivers/media/usb/gspca/sunplus.c
+@@ -255,6 +255,11 @@ static void reg_r(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+
+diff --git a/drivers/media/usb/gspca/vc032x.c b/drivers/media/usb/gspca/vc032x.c
+index 588a847ea4834..4cb7c92ea1328 100644
+--- a/drivers/media/usb/gspca/vc032x.c
++++ b/drivers/media/usb/gspca/vc032x.c
+@@ -2906,6 +2906,11 @@ static void reg_r_i(struct gspca_dev *gspca_dev,
+ if (ret < 0) {
+ pr_err("reg_r err %d\n", ret);
+ gspca_dev->usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(gspca_dev->usb_buf, 0, USB_BUF_SZ);
+ }
+ }
+ static void reg_r(struct gspca_dev *gspca_dev,
+diff --git a/drivers/media/usb/gspca/w996Xcf.c b/drivers/media/usb/gspca/w996Xcf.c
+index 16b679c2de21f..a8350ee9712fb 100644
+--- a/drivers/media/usb/gspca/w996Xcf.c
++++ b/drivers/media/usb/gspca/w996Xcf.c
+@@ -133,6 +133,11 @@ static int w9968cf_read_sb(struct sd *sd)
+ } else {
+ pr_err("Read SB reg [01] failed\n");
+ sd->gspca_dev.usb_err = ret;
++ /*
++ * Make sure the buffer is zeroed to avoid uninitialized
++ * values.
++ */
++ memset(sd->gspca_dev.usb_buf, 0, 2);
+ }
+
+ udelay(W9968CF_I2C_BUS_DELAY);
+--
+2.20.1
+
--- /dev/null
+From 16865434fd3d0d4498732609ddc775e9b57cc42b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jul 2019 10:19:46 -0400
+Subject: media: hdpvr: Add device num check and handling
+
+From: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
+
+[ Upstream commit d4a6a9537bc32811486282206ecfb7c53754b74d ]
+
+Add hdpvr device num check and error handling
+
+We need to increment the device count atomically before we checkout a
+device to make sure that we do not reach the max count, otherwise we get
+out-of-bounds errors as reported by syzbot.
+
+Reported-and-tested-by: syzbot+aac8d0d7205f112045d2@syzkaller.appspotmail.com
+
+Signed-off-by: Luke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/hdpvr/hdpvr-core.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
+index 9b9d894d29bcb..a0905c81d2cb2 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-core.c
++++ b/drivers/media/usb/hdpvr/hdpvr-core.c
+@@ -271,6 +271,7 @@ static int hdpvr_probe(struct usb_interface *interface,
+ #endif
+ size_t buffer_size;
+ int i;
++ int dev_num;
+ int retval = -ENOMEM;
+
+ /* allocate memory for our device state and initialize it */
+@@ -368,8 +369,17 @@ static int hdpvr_probe(struct usb_interface *interface,
+ }
+ #endif
+
++ dev_num = atomic_inc_return(&dev_nr);
++ if (dev_num >= HDPVR_MAX) {
++ v4l2_err(&dev->v4l2_dev,
++ "max device number reached, device register failed\n");
++ atomic_dec(&dev_nr);
++ retval = -ENODEV;
++ goto reg_fail;
++ }
++
+ retval = hdpvr_register_videodev(dev, &interface->dev,
+- video_nr[atomic_inc_return(&dev_nr)]);
++ video_nr[dev_num]);
+ if (retval < 0) {
+ v4l2_err(&dev->v4l2_dev, "registering videodev failed\n");
+ goto reg_fail;
+--
+2.20.1
+
--- /dev/null
+From 044f060e215c27a9e3949ecc5a0193ea77ff7a82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 10:00:33 -0300
+Subject: media: hdpvr: add terminating 0 at end of string
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 8b8900b729e4f31f12ac1127bde137c775c327e6 ]
+
+dev->usbc_buf was passed as argument for %s, but it was not safeguarded
+by a terminating 0.
+
+This caused this syzbot issue:
+
+https://syzkaller.appspot.com/bug?extid=79d18aac4bf1770dd050
+
+Reported-and-tested-by: syzbot+79d18aac4bf1770dd050@syzkaller.appspotmail.com
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/hdpvr/hdpvr-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
+index a0905c81d2cb2..b75c18a012a73 100644
+--- a/drivers/media/usb/hdpvr/hdpvr-core.c
++++ b/drivers/media/usb/hdpvr/hdpvr-core.c
+@@ -137,6 +137,7 @@ static int device_authorization(struct hdpvr_device *dev)
+
+ dev->fw_ver = dev->usbc_buf[1];
+
++ dev->usbc_buf[46] = '\0';
+ v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",
+ dev->fw_ver, &dev->usbc_buf[2]);
+
+--
+2.20.1
+
--- /dev/null
+From 930b0a4e6abe704474d407c6dce9746604caf4d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 07:00:34 -0400
+Subject: media: i2c: ov5640: Check for devm_gpiod_get_optional() error
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 8791a102ce579346cea9d2f911afef1c1985213c ]
+
+The power down and reset GPIO are optional, but the return value
+from devm_gpiod_get_optional() needs to be checked and propagated
+in the case of error, so that probe deferral can work.
+
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 759d60c6d6304..afe7920557a8f 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -3022,9 +3022,14 @@ static int ov5640_probe(struct i2c_client *client,
+ /* request optional power down pin */
+ sensor->pwdn_gpio = devm_gpiod_get_optional(dev, "powerdown",
+ GPIOD_OUT_HIGH);
++ if (IS_ERR(sensor->pwdn_gpio))
++ return PTR_ERR(sensor->pwdn_gpio);
++
+ /* request optional reset pin */
+ sensor->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+ GPIOD_OUT_HIGH);
++ if (IS_ERR(sensor->reset_gpio))
++ return PTR_ERR(sensor->reset_gpio);
+
+ v4l2_i2c_subdev_init(&sensor->sd, client, &ov5640_subdev_ops);
+
+--
+2.20.1
+
--- /dev/null
+From 963849bddd733e001f27bed77d7a24000e48dc7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 08:05:40 -0300
+Subject: media: i2c: ov5645: Fix power sequence
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 092e8eb90a7dc7dd210cd4e2ea36075d0a7f96af ]
+
+This is mostly a port of Jacopo's fix:
+
+ commit aa4bb8b8838ffcc776a79f49a4d7476b82405349
+ Author: Jacopo Mondi <jacopo@jmondi.org>
+ Date: Fri Jul 6 05:51:52 2018 -0400
+
+ media: ov5640: Re-work MIPI startup sequence
+
+In the OV5645 case, the changes are:
+
+- At set_power(1) time power up MIPI Tx/Rx and set data and clock lanes in
+ LP11 during 'sleep' and 'idle' with MIPI clock in non-continuous mode.
+- At set_power(0) time power down MIPI Tx/Rx (in addition to the current
+ power down of regulators and clock gating).
+- At s_stream time enable/disable the MIPI interface output.
+
+With this commit the sensor is able to enter LP-11 mode during power up,
+as expected by some CSI-2 controllers.
+
+Many thanks to Fabio Estevam for his help debugging this issue.
+
+Tested-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5645.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/ov5645.c b/drivers/media/i2c/ov5645.c
+index 124c8df046337..58972c884705c 100644
+--- a/drivers/media/i2c/ov5645.c
++++ b/drivers/media/i2c/ov5645.c
+@@ -45,6 +45,8 @@
+ #define OV5645_CHIP_ID_HIGH_BYTE 0x56
+ #define OV5645_CHIP_ID_LOW 0x300b
+ #define OV5645_CHIP_ID_LOW_BYTE 0x45
++#define OV5645_IO_MIPI_CTRL00 0x300e
++#define OV5645_PAD_OUTPUT00 0x3019
+ #define OV5645_AWB_MANUAL_CONTROL 0x3406
+ #define OV5645_AWB_MANUAL_ENABLE BIT(0)
+ #define OV5645_AEC_PK_MANUAL 0x3503
+@@ -55,6 +57,7 @@
+ #define OV5645_ISP_VFLIP BIT(2)
+ #define OV5645_TIMING_TC_REG21 0x3821
+ #define OV5645_SENSOR_MIRROR BIT(1)
++#define OV5645_MIPI_CTRL00 0x4800
+ #define OV5645_PRE_ISP_TEST_SETTING_1 0x503d
+ #define OV5645_TEST_PATTERN_MASK 0x3
+ #define OV5645_SET_TEST_PATTERN(x) ((x) & OV5645_TEST_PATTERN_MASK)
+@@ -121,7 +124,6 @@ static const struct reg_value ov5645_global_init_setting[] = {
+ { 0x3503, 0x07 },
+ { 0x3002, 0x1c },
+ { 0x3006, 0xc3 },
+- { 0x300e, 0x45 },
+ { 0x3017, 0x00 },
+ { 0x3018, 0x00 },
+ { 0x302e, 0x0b },
+@@ -350,7 +352,10 @@ static const struct reg_value ov5645_global_init_setting[] = {
+ { 0x3a1f, 0x14 },
+ { 0x0601, 0x02 },
+ { 0x3008, 0x42 },
+- { 0x3008, 0x02 }
++ { 0x3008, 0x02 },
++ { OV5645_IO_MIPI_CTRL00, 0x40 },
++ { OV5645_MIPI_CTRL00, 0x24 },
++ { OV5645_PAD_OUTPUT00, 0x70 }
+ };
+
+ static const struct reg_value ov5645_setting_sxga[] = {
+@@ -737,13 +742,9 @@ static int ov5645_s_power(struct v4l2_subdev *sd, int on)
+ goto exit;
+ }
+
+- ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0,
+- OV5645_SYSTEM_CTRL0_STOP);
+- if (ret < 0) {
+- ov5645_set_power_off(ov5645);
+- goto exit;
+- }
++ usleep_range(500, 1000);
+ } else {
++ ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x58);
+ ov5645_set_power_off(ov5645);
+ }
+ }
+@@ -1049,11 +1050,20 @@ static int ov5645_s_stream(struct v4l2_subdev *subdev, int enable)
+ dev_err(ov5645->dev, "could not sync v4l2 controls\n");
+ return ret;
+ }
++
++ ret = ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x45);
++ if (ret < 0)
++ return ret;
++
+ ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0,
+ OV5645_SYSTEM_CTRL0_START);
+ if (ret < 0)
+ return ret;
+ } else {
++ ret = ov5645_write_reg(ov5645, OV5645_IO_MIPI_CTRL00, 0x40);
++ if (ret < 0)
++ return ret;
++
+ ret = ov5645_write_reg(ov5645, OV5645_SYSTEM_CTRL0,
+ OV5645_SYSTEM_CTRL0_STOP);
+ if (ret < 0)
+--
+2.20.1
+
--- /dev/null
+From a83574a2a017eb55d0d836f25fc5c8cdfe2baf36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 13:52:15 -0300
+Subject: media: i2c: tda1997x: prevent potential NULL pointer access
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 2f822f1da08ac5c93e351e79d22920f08fa51baf ]
+
+i2c_new_dummy() can fail returning a NULL pointer. This is not checked
+and the returned pointer is blindly used. Convert to
+devm_i2c_new_dummy_client() which returns an ERR_PTR and also add a
+validity check. Using devm_* here also fixes a leak because the dummy
+client was not released in the probe error path.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tda1997x.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
+index a62ede0966361..5e68182001ecc 100644
+--- a/drivers/media/i2c/tda1997x.c
++++ b/drivers/media/i2c/tda1997x.c
+@@ -2691,7 +2691,13 @@ static int tda1997x_probe(struct i2c_client *client,
+ }
+
+ ret = 0x34 + ((io_read(sd, REG_SLAVE_ADDR)>>4) & 0x03);
+- state->client_cec = i2c_new_dummy(client->adapter, ret);
++ state->client_cec = devm_i2c_new_dummy_device(&client->dev,
++ client->adapter, ret);
++ if (IS_ERR(state->client_cec)) {
++ ret = PTR_ERR(state->client_cec);
++ goto err_free_mutex;
++ }
++
+ v4l_info(client, "CEC slave address 0x%02x\n", ret);
+
+ ret = tda1997x_core_init(sd);
+@@ -2798,7 +2804,6 @@ static int tda1997x_remove(struct i2c_client *client)
+ media_entity_cleanup(&sd->entity);
+ v4l2_ctrl_handler_free(&state->hdl);
+ regulator_bulk_disable(TDA1997X_NUM_SUPPLIES, state->supplies);
+- i2c_unregister_device(state->client_cec);
+ cancel_delayed_work(&state->delayed_work_enable_hpd);
+ mutex_destroy(&state->page_lock);
+ mutex_destroy(&state->lock);
+--
+2.20.1
+
--- /dev/null
+From a13eba4b313e6ab45a3231c96ff414d7f093a3c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2019 05:50:44 -0300
+Subject: media: iguanair: add sanity checks
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit ab1cbdf159beba7395a13ab70bc71180929ca064 ]
+
+The driver needs to check the endpoint types, too, as opposed
+to the number of endpoints. This also requires moving the check earlier.
+
+Reported-by: syzbot+01a77b82edaa374068e1@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/iguanair.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
+index ea05e125016a7..872d6441e512c 100644
+--- a/drivers/media/rc/iguanair.c
++++ b/drivers/media/rc/iguanair.c
+@@ -413,6 +413,10 @@ static int iguanair_probe(struct usb_interface *intf,
+ int ret, pipein, pipeout;
+ struct usb_host_interface *idesc;
+
++ idesc = intf->altsetting;
++ if (idesc->desc.bNumEndpoints < 2)
++ return -ENODEV;
++
+ ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+ rc = rc_allocate_device(RC_DRIVER_IR_RAW);
+ if (!ir || !rc) {
+@@ -427,18 +431,13 @@ static int iguanair_probe(struct usb_interface *intf,
+ ir->urb_in = usb_alloc_urb(0, GFP_KERNEL);
+ ir->urb_out = usb_alloc_urb(0, GFP_KERNEL);
+
+- if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out) {
++ if (!ir->buf_in || !ir->packet || !ir->urb_in || !ir->urb_out ||
++ !usb_endpoint_is_int_in(&idesc->endpoint[0].desc) ||
++ !usb_endpoint_is_int_out(&idesc->endpoint[1].desc)) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
+- idesc = intf->altsetting;
+-
+- if (idesc->desc.bNumEndpoints < 2) {
+- ret = -ENODEV;
+- goto out;
+- }
+-
+ ir->rc = rc;
+ ir->dev = &intf->dev;
+ ir->udev = udev;
+--
+2.20.1
+
--- /dev/null
+From 642a4103d84c884a8e5b587a03ca4251e9bfdf36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2019 19:29:12 -0300
+Subject: media: imx: mipi csi-2: Don't fail if initial state times-out
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 0d5078c7172c46db6c58718d817b9fcf769554b4 ]
+
+Not all sensors will be able to guarantee a proper initial state.
+This may be either because the driver is not properly written,
+or (probably unlikely) because the hardware won't support it.
+
+While the right solution in the former case is to fix the sensor
+driver, the real world not always allows right solutions, due to lack
+of available documentation and support on these sensors.
+
+Let's relax this requirement, and allow the driver to support stream start,
+even if the sensor initial sequence wasn't the expected.
+
+Also improve the warning message to better explain the problem and provide
+a hint that the sensor driver needs to be fixed.
+
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Steve Longerbeam <slongerbeam@gmail.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx6-mipi-csi2.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx6-mipi-csi2.c b/drivers/staging/media/imx/imx6-mipi-csi2.c
+index f29e28df36ed8..bfa4b254c4e48 100644
+--- a/drivers/staging/media/imx/imx6-mipi-csi2.c
++++ b/drivers/staging/media/imx/imx6-mipi-csi2.c
+@@ -243,7 +243,7 @@ static int __maybe_unused csi2_dphy_wait_ulp(struct csi2_dev *csi2)
+ }
+
+ /* Waits for low-power LP-11 state on data and clock lanes. */
+-static int csi2_dphy_wait_stopstate(struct csi2_dev *csi2)
++static void csi2_dphy_wait_stopstate(struct csi2_dev *csi2)
+ {
+ u32 mask, reg;
+ int ret;
+@@ -254,11 +254,9 @@ static int csi2_dphy_wait_stopstate(struct csi2_dev *csi2)
+ ret = readl_poll_timeout(csi2->base + CSI2_PHY_STATE, reg,
+ (reg & mask) == mask, 0, 500000);
+ if (ret) {
+- v4l2_err(&csi2->sd, "LP-11 timeout, phy_state = 0x%08x\n", reg);
+- return ret;
++ v4l2_warn(&csi2->sd, "LP-11 wait timeout, likely a sensor driver bug, expect capture failures.\n");
++ v4l2_warn(&csi2->sd, "phy_state = 0x%08x\n", reg);
+ }
+-
+- return 0;
+ }
+
+ /* Wait for active clock on the clock lane. */
+@@ -316,9 +314,7 @@ static int csi2_start(struct csi2_dev *csi2)
+ csi2_enable(csi2, true);
+
+ /* Step 5 */
+- ret = csi2_dphy_wait_stopstate(csi2);
+- if (ret)
+- goto err_assert_reset;
++ csi2_dphy_wait_stopstate(csi2);
+
+ /* Step 6 */
+ ret = v4l2_subdev_call(csi2->src_sd, video, s_stream, 1);
+--
+2.20.1
+
--- /dev/null
+From 9057c27fb2ea04a9978e340d570e2affb13affd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 13:41:19 -0300
+Subject: media: mceusb: fix (eliminate) TX IR signal length limit
+
+From: A Sun <as1033x@comcast.net>
+
+[ Upstream commit 9fc3ce31f5bde660197f35135e90a1cced58aa2c ]
+
+Fix and eliminate mceusb's IR length limit for IR signals transmitted to
+the MCE IR blaster ports.
+
+An IR signal TX exceeding 306 pulse/space samples presently causes -EINVAL
+return error. There's no such limitation nor error with the MCE device
+hardware. And valid IR signals exist with more than 400 pulse/space for the
+control of certain appliances (eg Panasonic ACXA75C00600 air conditioner).
+
+The scope of this patch is limited to the mceusb driver. There are still
+IR signal TX length and time constraints that related modules of rc core
+(eg LIRC) impose, further up the driver stack.
+
+Changes for mceusb_tx_ir():
+
+Converts and sends LIRC IR pulse/space sequence to MCE device IR
+pulse/space format.
+
+Break long length LIRC sequence into multiple (unlimited number of) parts
+for sending to the MCE device.
+Reduce kernel stack IR buffer size: 128 (was 384)
+Increase MCE IR data packet size: 31 (was 5)
+Zero time LIRC pulse/space no longer copied to MCE IR data.
+Eliminate overwriting the source/input LIRC IR data in txbuf[].
+Eliminate -EINVAL return; return number of IR samples sent (>0) or
+MCE write error code (<0).
+
+New mce_write() and mce_write_callback():
+
+Implements synchronous blocking I/O, with timeout, for writing/sending
+data to the MCE device.
+
+An unlimited multipart IR signal sent to the MCE device faster than real
+time requires flow control absent with the original mce_request_packet()
+and mce_async_callback() asynchronous I/O implementation. Also absent is
+TX error feedback.
+
+mce_write() combines and replaces mce_request_packet() and
+mce_async_callback() with conversion to synchronous I/O.
+mce_write() returns bytes sent (>0) or MCE device write error (<0).
+Debug hex dump TX data before processing.
+
+Rename mce_async_out() -> mce_command_out():
+
+The original name is misleading with underlying synchronous I/O
+implementation. Function renamed to mce_command_out().
+
+Changes in mceusb_handle_command():
+
+Add support for MCE device error case MCE_RSP_TX_TIMEOUT
+"IR TX timeout (TX buffer underrun)"
+
+Changes in mceusb_dev_printdata():
+
+Changes support test and debug of multipart TX IR.
+
+Add buffer boundary information (offset and buffer size) to TX hex dump.
+Correct TX trace bug "Raw IR data, 0 pulse/space samples"
+Add trace for MCE_RSP_TX_TIMEOUT "IR TX timeout (TX buffer underrun)"
+
+Other changes:
+
+The driver's write to USB device architecture change (async to sync I/O)
+is significant so we bump DRIVER_VERSION to "1.95" (from "1.94").
+
+Tests:
+
+$ cat -n irdata1 | head -3
+ 1 carrier 36000
+ 2 pulse 6350
+ 3 space 6350
+$ cat -n irdata1 | tail -3
+ 76 pulse 6350
+ 77 space 6350
+ 78 pulse 6350
+$ ir-ctl -s irdata1
+
+[1549021.073612] mceusb 1-1.3:1.0: requesting 36000 HZ carrier
+[1549021.073635] mceusb 1-1.3:1.0: tx data[0]: 9f 06 01 45 (len=4 sz=4)
+[1549021.073649] mceusb 1-1.3:1.0: Request carrier of 35714 Hz (period 28us)
+[1549021.073848] mceusb 1-1.3:1.0: tx done status = 4 (wait = 100, expire = 100 (1000ms), urb->actual_length = 4, urb->status = 0)
+[1549021.074689] mceusb 1-1.3:1.0: rx data[0]: 9f 06 01 45 (len=4 sz=4)
+[1549021.074701] mceusb 1-1.3:1.0: Got carrier of 35714 Hz (period 28us)
+[1549021.102023] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3)
+[1549021.102036] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03
+[1549021.102219] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0)
+[1549021.131979] mceusb 1-1.3:1.0: tx data[0]: 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 9e ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f ff 7f 91 ff (len=81 sz=81)
+[1549021.131992] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples
+[1549021.133592] mceusb 1-1.3:1.0: tx done status = 81 (wait = 100, expire = 100 (1000ms), urb->actual_length = 81, urb->status = 0)
+
+Hex dumps limited to 64 bytes.
+0xff is MCE maximum time pulse, 0x7f is MCE maximum time space.
+
+$ cat -n irdata2 | head -3
+ 1 carrier 36000
+ 2 pulse 50
+ 3 space 50
+$ cat -n irdata2 | tail -3
+ 254 pulse 50
+ 255 space 50
+ 256 pulse 50
+$ ir-ctl -s irdata2
+
+[1549306.586998] mceusb 1-1.3:1.0: tx data[0]: 9f 08 03 (len=3 sz=3)
+[1549306.587015] mceusb 1-1.3:1.0: Request transmit blaster mask of 0x03
+[1549306.587252] mceusb 1-1.3:1.0: tx done status = 3 (wait = 100, expire = 100 (1000ms), urb->actual_length = 3, urb->status = 0)
+[1549306.613275] mceusb 1-1.3:1.0: tx data[0]: 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 9e 81 (len=128 sz=128)
+[1549306.613291] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples
+[1549306.614837] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0)
+[1549306.614861] mceusb 1-1.3:1.0: tx data[0]: 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 01 81 9e 01 (len=128 sz=128)
+[1549306.614869] mceusb 1-1.3:1.0: Raw IR data, 30 pulse/space samples
+[1549306.620199] mceusb 1-1.3:1.0: tx done status = 128 (wait = 100, expire = 100 (1000ms), urb->actual_length = 128, urb->status = 0)
+[1549306.620212] mceusb 1-1.3:1.0: tx data[0]: 89 81 01 81 01 81 01 81 01 81 80 (len=11 sz=11)
+[1549306.620221] mceusb 1-1.3:1.0: Raw IR data, 9 pulse/space samples
+[1549306.633294] mceusb 1-1.3:1.0: tx done status = 11 (wait = 98, expire = 100 (1000ms), urb->actual_length = 11, urb->status = 0)
+
+Hex dumps limited to 64 bytes.
+0x81 is MCE minimum time pulse, 0x01 is MCE minimum time space.
+TX IR part 3 sz=11 shows 20msec I/O blocking delay
+(100expire - 98wait = 2jiffies)
+
+Signed-off-by: A Sun <as1033x@comcast.net>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/mceusb.c | 334 ++++++++++++++++++++++----------------
+ 1 file changed, 196 insertions(+), 138 deletions(-)
+
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index 4d5351ebb9408..9929fcdec74de 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -31,21 +31,22 @@
+ #include <linux/pm_wakeup.h>
+ #include <media/rc-core.h>
+
+-#define DRIVER_VERSION "1.94"
++#define DRIVER_VERSION "1.95"
+ #define DRIVER_AUTHOR "Jarod Wilson <jarod@redhat.com>"
+ #define DRIVER_DESC "Windows Media Center Ed. eHome Infrared Transceiver " \
+ "device driver"
+ #define DRIVER_NAME "mceusb"
+
++#define USB_TX_TIMEOUT 1000 /* in milliseconds */
+ #define USB_CTRL_MSG_SZ 2 /* Size of usb ctrl msg on gen1 hw */
+ #define MCE_G1_INIT_MSGS 40 /* Init messages on gen1 hw to throw out */
+
+ /* MCE constants */
+-#define MCE_CMDBUF_SIZE 384 /* MCE Command buffer length */
++#define MCE_IRBUF_SIZE 128 /* TX IR buffer length */
+ #define MCE_TIME_UNIT 50 /* Approx 50us resolution */
+-#define MCE_CODE_LENGTH 5 /* Normal length of packet (with header) */
+-#define MCE_PACKET_SIZE 4 /* Normal length of packet (without header) */
+-#define MCE_IRDATA_HEADER 0x84 /* Actual header format is 0x80 + num_bytes */
++#define MCE_PACKET_SIZE 31 /* Max length of packet (with header) */
++#define MCE_IRDATA_HEADER (0x80 + MCE_PACKET_SIZE - 1)
++ /* Actual format is 0x80 + num_bytes */
+ #define MCE_IRDATA_TRAILER 0x80 /* End of IR data */
+ #define MCE_MAX_CHANNELS 2 /* Two transmitters, hardware dependent? */
+ #define MCE_DEFAULT_TX_MASK 0x03 /* Vals: TX1=0x01, TX2=0x02, ALL=0x03 */
+@@ -607,9 +608,9 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ if (len <= skip)
+ return;
+
+- dev_dbg(dev, "%cx data: %*ph (length=%d)",
+- (out ? 't' : 'r'),
+- min(len, buf_len - offset), buf + offset, len);
++ dev_dbg(dev, "%cx data[%d]: %*ph (len=%d sz=%d)",
++ (out ? 't' : 'r'), offset,
++ min(len, buf_len - offset), buf + offset, len, buf_len);
+
+ inout = out ? "Request" : "Got";
+
+@@ -731,6 +732,9 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ case MCE_RSP_CMD_ILLEGAL:
+ dev_dbg(dev, "Illegal PORT_IR command");
+ break;
++ case MCE_RSP_TX_TIMEOUT:
++ dev_dbg(dev, "IR TX timeout (TX buffer underrun)");
++ break;
+ default:
+ dev_dbg(dev, "Unknown command 0x%02x 0x%02x",
+ cmd, subcmd);
+@@ -745,13 +749,14 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ dev_dbg(dev, "End of raw IR data");
+ else if ((cmd != MCE_CMD_PORT_IR) &&
+ ((cmd & MCE_PORT_MASK) == MCE_COMMAND_IRDATA))
+- dev_dbg(dev, "Raw IR data, %d pulse/space samples", ir->rem);
++ dev_dbg(dev, "Raw IR data, %d pulse/space samples",
++ cmd & MCE_PACKET_LENGTH_MASK);
+ #endif
+ }
+
+ /*
+ * Schedule work that can't be done in interrupt handlers
+- * (mceusb_dev_recv() and mce_async_callback()) nor tasklets.
++ * (mceusb_dev_recv() and mce_write_callback()) nor tasklets.
+ * Invokes mceusb_deferred_kevent() for recovering from
+ * error events specified by the kevent bit field.
+ */
+@@ -764,23 +769,80 @@ static void mceusb_defer_kevent(struct mceusb_dev *ir, int kevent)
+ dev_dbg(ir->dev, "kevent %d scheduled", kevent);
+ }
+
+-static void mce_async_callback(struct urb *urb)
++static void mce_write_callback(struct urb *urb)
+ {
+- struct mceusb_dev *ir;
+- int len;
+-
+ if (!urb)
+ return;
+
+- ir = urb->context;
++ complete(urb->context);
++}
++
++/*
++ * Write (TX/send) data to MCE device USB endpoint out.
++ * Used for IR blaster TX and MCE device commands.
++ *
++ * Return: The number of bytes written (> 0) or errno (< 0).
++ */
++static int mce_write(struct mceusb_dev *ir, u8 *data, int size)
++{
++ int ret;
++ struct urb *urb;
++ struct device *dev = ir->dev;
++ unsigned char *buf_out;
++ struct completion tx_done;
++ unsigned long expire;
++ unsigned long ret_wait;
++
++ mceusb_dev_printdata(ir, data, size, 0, size, true);
++
++ urb = usb_alloc_urb(0, GFP_KERNEL);
++ if (unlikely(!urb)) {
++ dev_err(dev, "Error: mce write couldn't allocate urb");
++ return -ENOMEM;
++ }
++
++ buf_out = kmalloc(size, GFP_KERNEL);
++ if (!buf_out) {
++ usb_free_urb(urb);
++ return -ENOMEM;
++ }
++
++ init_completion(&tx_done);
++
++ /* outbound data */
++ if (usb_endpoint_xfer_int(ir->usb_ep_out))
++ usb_fill_int_urb(urb, ir->usbdev, ir->pipe_out,
++ buf_out, size, mce_write_callback, &tx_done,
++ ir->usb_ep_out->bInterval);
++ else
++ usb_fill_bulk_urb(urb, ir->usbdev, ir->pipe_out,
++ buf_out, size, mce_write_callback, &tx_done);
++ memcpy(buf_out, data, size);
++
++ ret = usb_submit_urb(urb, GFP_KERNEL);
++ if (ret) {
++ dev_err(dev, "Error: mce write submit urb error = %d", ret);
++ kfree(buf_out);
++ usb_free_urb(urb);
++ return ret;
++ }
++
++ expire = msecs_to_jiffies(USB_TX_TIMEOUT);
++ ret_wait = wait_for_completion_timeout(&tx_done, expire);
++ if (!ret_wait) {
++ dev_err(dev, "Error: mce write timed out (expire = %lu (%dms))",
++ expire, USB_TX_TIMEOUT);
++ usb_kill_urb(urb);
++ ret = (urb->status == -ENOENT ? -ETIMEDOUT : urb->status);
++ } else {
++ ret = urb->status;
++ }
++ if (ret >= 0)
++ ret = urb->actual_length; /* bytes written */
+
+ switch (urb->status) {
+ /* success */
+ case 0:
+- len = urb->actual_length;
+-
+- mceusb_dev_printdata(ir, urb->transfer_buffer, len,
+- 0, len, true);
+ break;
+
+ case -ECONNRESET:
+@@ -790,140 +852,135 @@ static void mce_async_callback(struct urb *urb)
+ break;
+
+ case -EPIPE:
+- dev_err(ir->dev, "Error: request urb status = %d (TX HALT)",
++ dev_err(ir->dev, "Error: mce write urb status = %d (TX HALT)",
+ urb->status);
+ mceusb_defer_kevent(ir, EVENT_TX_HALT);
+ break;
+
+ default:
+- dev_err(ir->dev, "Error: request urb status = %d", urb->status);
++ dev_err(ir->dev, "Error: mce write urb status = %d",
++ urb->status);
+ break;
+ }
+
+- /* the transfer buffer and urb were allocated in mce_request_packet */
+- kfree(urb->transfer_buffer);
+- usb_free_urb(urb);
+-}
+-
+-/* request outgoing (send) usb packet - used to initialize remote */
+-static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data,
+- int size)
+-{
+- int res;
+- struct urb *async_urb;
+- struct device *dev = ir->dev;
+- unsigned char *async_buf;
++ dev_dbg(dev, "tx done status = %d (wait = %lu, expire = %lu (%dms), urb->actual_length = %d, urb->status = %d)",
++ ret, ret_wait, expire, USB_TX_TIMEOUT,
++ urb->actual_length, urb->status);
+
+- async_urb = usb_alloc_urb(0, GFP_KERNEL);
+- if (unlikely(!async_urb)) {
+- dev_err(dev, "Error, couldn't allocate urb!");
+- return;
+- }
+-
+- async_buf = kmalloc(size, GFP_KERNEL);
+- if (!async_buf) {
+- usb_free_urb(async_urb);
+- return;
+- }
+-
+- /* outbound data */
+- if (usb_endpoint_xfer_int(ir->usb_ep_out))
+- usb_fill_int_urb(async_urb, ir->usbdev, ir->pipe_out,
+- async_buf, size, mce_async_callback, ir,
+- ir->usb_ep_out->bInterval);
+- else
+- usb_fill_bulk_urb(async_urb, ir->usbdev, ir->pipe_out,
+- async_buf, size, mce_async_callback, ir);
+-
+- memcpy(async_buf, data, size);
+-
+- dev_dbg(dev, "send request called (size=%#x)", size);
++ kfree(buf_out);
++ usb_free_urb(urb);
+
+- res = usb_submit_urb(async_urb, GFP_ATOMIC);
+- if (res) {
+- dev_err(dev, "send request FAILED! (res=%d)", res);
+- kfree(async_buf);
+- usb_free_urb(async_urb);
+- return;
+- }
+- dev_dbg(dev, "send request complete (res=%d)", res);
++ return ret;
+ }
+
+-static void mce_async_out(struct mceusb_dev *ir, unsigned char *data, int size)
++static void mce_command_out(struct mceusb_dev *ir, u8 *data, int size)
+ {
+ int rsize = sizeof(DEVICE_RESUME);
+
+ if (ir->need_reset) {
+ ir->need_reset = false;
+- mce_request_packet(ir, DEVICE_RESUME, rsize);
++ mce_write(ir, DEVICE_RESUME, rsize);
+ msleep(10);
+ }
+
+- mce_request_packet(ir, data, size);
++ mce_write(ir, data, size);
+ msleep(10);
+ }
+
+-/* Send data out the IR blaster port(s) */
++/*
++ * Transmit IR out the MCE device IR blaster port(s).
++ *
++ * Convert IR pulse/space sequence from LIRC to MCE format.
++ * Break up a long IR sequence into multiple parts (MCE IR data packets).
++ *
++ * u32 txbuf[] consists of IR pulse, space, ..., and pulse times in usec.
++ * Pulses and spaces are implicit by their position.
++ * The first IR sample, txbuf[0], is always a pulse.
++ *
++ * u8 irbuf[] consists of multiple IR data packets for the MCE device.
++ * A packet is 1 u8 MCE_IRDATA_HEADER and up to 30 u8 IR samples.
++ * An IR sample is 1-bit pulse/space flag with 7-bit time
++ * in MCE time units (50usec).
++ *
++ * Return: The number of IR samples sent (> 0) or errno (< 0).
++ */
+ static int mceusb_tx_ir(struct rc_dev *dev, unsigned *txbuf, unsigned count)
+ {
+ struct mceusb_dev *ir = dev->priv;
+- int i, length, ret = 0;
+- int cmdcount = 0;
+- unsigned char cmdbuf[MCE_CMDBUF_SIZE];
+-
+- /* MCE tx init header */
+- cmdbuf[cmdcount++] = MCE_CMD_PORT_IR;
+- cmdbuf[cmdcount++] = MCE_CMD_SETIRTXPORTS;
+- cmdbuf[cmdcount++] = ir->tx_mask;
++ u8 cmdbuf[3] = { MCE_CMD_PORT_IR, MCE_CMD_SETIRTXPORTS, 0x00 };
++ u8 irbuf[MCE_IRBUF_SIZE];
++ int ircount = 0;
++ unsigned int irsample;
++ int i, length, ret;
+
+ /* Send the set TX ports command */
+- mce_async_out(ir, cmdbuf, cmdcount);
+- cmdcount = 0;
+-
+- /* Generate mce packet data */
+- for (i = 0; (i < count) && (cmdcount < MCE_CMDBUF_SIZE); i++) {
+- txbuf[i] = txbuf[i] / MCE_TIME_UNIT;
+-
+- do { /* loop to support long pulses/spaces > 127*50us=6.35ms */
+-
+- /* Insert mce packet header every 4th entry */
+- if ((cmdcount < MCE_CMDBUF_SIZE) &&
+- (cmdcount % MCE_CODE_LENGTH) == 0)
+- cmdbuf[cmdcount++] = MCE_IRDATA_HEADER;
+-
+- /* Insert mce packet data */
+- if (cmdcount < MCE_CMDBUF_SIZE)
+- cmdbuf[cmdcount++] =
+- (txbuf[i] < MCE_PULSE_BIT ?
+- txbuf[i] : MCE_MAX_PULSE_LENGTH) |
+- (i & 1 ? 0x00 : MCE_PULSE_BIT);
+- else {
+- ret = -EINVAL;
+- goto out;
++ cmdbuf[2] = ir->tx_mask;
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
++
++ /* Generate mce IR data packet */
++ for (i = 0; i < count; i++) {
++ irsample = txbuf[i] / MCE_TIME_UNIT;
++
++ /* loop to support long pulses/spaces > 6350us (127*50us) */
++ while (irsample > 0) {
++ /* Insert IR header every 30th entry */
++ if (ircount % MCE_PACKET_SIZE == 0) {
++ /* Room for IR header and one IR sample? */
++ if (ircount >= MCE_IRBUF_SIZE - 1) {
++ /* Send near full buffer */
++ ret = mce_write(ir, irbuf, ircount);
++ if (ret < 0)
++ return ret;
++ ircount = 0;
++ }
++ irbuf[ircount++] = MCE_IRDATA_HEADER;
+ }
+
+- } while ((txbuf[i] > MCE_MAX_PULSE_LENGTH) &&
+- (txbuf[i] -= MCE_MAX_PULSE_LENGTH));
+- }
+-
+- /* Check if we have room for the empty packet at the end */
+- if (cmdcount >= MCE_CMDBUF_SIZE) {
+- ret = -EINVAL;
+- goto out;
+- }
++ /* Insert IR sample */
++ if (irsample <= MCE_MAX_PULSE_LENGTH) {
++ irbuf[ircount] = irsample;
++ irsample = 0;
++ } else {
++ irbuf[ircount] = MCE_MAX_PULSE_LENGTH;
++ irsample -= MCE_MAX_PULSE_LENGTH;
++ }
++ /*
++ * Even i = IR pulse
++ * Odd i = IR space
++ */
++ irbuf[ircount] |= (i & 1 ? 0 : MCE_PULSE_BIT);
++ ircount++;
++
++ /* IR buffer full? */
++ if (ircount >= MCE_IRBUF_SIZE) {
++ /* Fix packet length in last header */
++ length = ircount % MCE_PACKET_SIZE;
++ if (length > 0)
++ irbuf[ircount - length] -=
++ MCE_PACKET_SIZE - length;
++ /* Send full buffer */
++ ret = mce_write(ir, irbuf, ircount);
++ if (ret < 0)
++ return ret;
++ ircount = 0;
++ }
++ }
++ } /* after for loop, 0 <= ircount < MCE_IRBUF_SIZE */
+
+ /* Fix packet length in last header */
+- length = cmdcount % MCE_CODE_LENGTH;
+- cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length;
++ length = ircount % MCE_PACKET_SIZE;
++ if (length > 0)
++ irbuf[ircount - length] -= MCE_PACKET_SIZE - length;
+
+- /* All mce commands end with an empty packet (0x80) */
+- cmdbuf[cmdcount++] = MCE_IRDATA_TRAILER;
++ /* Append IR trailer (0x80) to final partial (or empty) IR buffer */
++ irbuf[ircount++] = MCE_IRDATA_TRAILER;
+
+- /* Transmit the command to the mce device */
+- mce_async_out(ir, cmdbuf, cmdcount);
++ /* Send final buffer */
++ ret = mce_write(ir, irbuf, ircount);
++ if (ret < 0)
++ return ret;
+
+-out:
+- return ret ? ret : count;
++ return count;
+ }
+
+ /* Sets active IR outputs -- mce devices typically have two */
+@@ -963,7 +1020,7 @@ static int mceusb_set_tx_carrier(struct rc_dev *dev, u32 carrier)
+ cmdbuf[2] = MCE_CMD_SIG_END;
+ cmdbuf[3] = MCE_IRDATA_TRAILER;
+ dev_dbg(ir->dev, "disabling carrier modulation");
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ return 0;
+ }
+
+@@ -977,7 +1034,7 @@ static int mceusb_set_tx_carrier(struct rc_dev *dev, u32 carrier)
+ carrier);
+
+ /* Transmit new carrier to mce device */
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ return 0;
+ }
+ }
+@@ -1000,10 +1057,10 @@ static int mceusb_set_timeout(struct rc_dev *dev, unsigned int timeout)
+ cmdbuf[2] = units >> 8;
+ cmdbuf[3] = units;
+
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+
+ /* get receiver timeout value */
+- mce_async_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
++ mce_command_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
+
+ return 0;
+ }
+@@ -1028,7 +1085,7 @@ static int mceusb_set_rx_wideband(struct rc_dev *dev, int enable)
+ ir->wideband_rx_enabled = false;
+ cmdbuf[2] = 1; /* port 1 is long range receiver */
+ }
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ /* response from device sets ir->learning_active */
+
+ return 0;
+@@ -1051,7 +1108,7 @@ static int mceusb_set_rx_carrier_report(struct rc_dev *dev, int enable)
+ ir->carrier_report_enabled = true;
+ if (!ir->learning_active) {
+ cmdbuf[2] = 2; /* port 2 is short range receiver */
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ }
+ } else {
+ ir->carrier_report_enabled = false;
+@@ -1062,7 +1119,7 @@ static int mceusb_set_rx_carrier_report(struct rc_dev *dev, int enable)
+ */
+ if (ir->learning_active && !ir->wideband_rx_enabled) {
+ cmdbuf[2] = 1; /* port 1 is long range receiver */
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ }
+ }
+
+@@ -1141,6 +1198,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index)
+ }
+ break;
+ case MCE_RSP_CMD_ILLEGAL:
++ case MCE_RSP_TX_TIMEOUT:
+ ir->need_reset = true;
+ break;
+ default:
+@@ -1279,7 +1337,7 @@ static void mceusb_get_emulator_version(struct mceusb_dev *ir)
+ {
+ /* If we get no reply or an illegal command reply, its ver 1, says MS */
+ ir->emver = 1;
+- mce_async_out(ir, GET_EMVER, sizeof(GET_EMVER));
++ mce_command_out(ir, GET_EMVER, sizeof(GET_EMVER));
+ }
+
+ static void mceusb_gen1_init(struct mceusb_dev *ir)
+@@ -1325,10 +1383,10 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ dev_dbg(dev, "set handshake - retC = %d", ret);
+
+ /* device resume */
+- mce_async_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
++ mce_command_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
+
+ /* get hw/sw revision? */
+- mce_async_out(ir, GET_REVISION, sizeof(GET_REVISION));
++ mce_command_out(ir, GET_REVISION, sizeof(GET_REVISION));
+
+ kfree(data);
+ }
+@@ -1336,13 +1394,13 @@ static void mceusb_gen1_init(struct mceusb_dev *ir)
+ static void mceusb_gen2_init(struct mceusb_dev *ir)
+ {
+ /* device resume */
+- mce_async_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
++ mce_command_out(ir, DEVICE_RESUME, sizeof(DEVICE_RESUME));
+
+ /* get wake version (protocol, key, address) */
+- mce_async_out(ir, GET_WAKEVERSION, sizeof(GET_WAKEVERSION));
++ mce_command_out(ir, GET_WAKEVERSION, sizeof(GET_WAKEVERSION));
+
+ /* unknown what this one actually returns... */
+- mce_async_out(ir, GET_UNKNOWN2, sizeof(GET_UNKNOWN2));
++ mce_command_out(ir, GET_UNKNOWN2, sizeof(GET_UNKNOWN2));
+ }
+
+ static void mceusb_get_parameters(struct mceusb_dev *ir)
+@@ -1356,24 +1414,24 @@ static void mceusb_get_parameters(struct mceusb_dev *ir)
+ ir->num_rxports = 2;
+
+ /* get number of tx and rx ports */
+- mce_async_out(ir, GET_NUM_PORTS, sizeof(GET_NUM_PORTS));
++ mce_command_out(ir, GET_NUM_PORTS, sizeof(GET_NUM_PORTS));
+
+ /* get the carrier and frequency */
+- mce_async_out(ir, GET_CARRIER_FREQ, sizeof(GET_CARRIER_FREQ));
++ mce_command_out(ir, GET_CARRIER_FREQ, sizeof(GET_CARRIER_FREQ));
+
+ if (ir->num_txports && !ir->flags.no_tx)
+ /* get the transmitter bitmask */
+- mce_async_out(ir, GET_TX_BITMASK, sizeof(GET_TX_BITMASK));
++ mce_command_out(ir, GET_TX_BITMASK, sizeof(GET_TX_BITMASK));
+
+ /* get receiver timeout value */
+- mce_async_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
++ mce_command_out(ir, GET_RX_TIMEOUT, sizeof(GET_RX_TIMEOUT));
+
+ /* get receiver sensor setting */
+- mce_async_out(ir, GET_RX_SENSOR, sizeof(GET_RX_SENSOR));
++ mce_command_out(ir, GET_RX_SENSOR, sizeof(GET_RX_SENSOR));
+
+ for (i = 0; i < ir->num_txports; i++) {
+ cmdbuf[2] = i;
+- mce_async_out(ir, cmdbuf, sizeof(cmdbuf));
++ mce_command_out(ir, cmdbuf, sizeof(cmdbuf));
+ }
+ }
+
+@@ -1382,7 +1440,7 @@ static void mceusb_flash_led(struct mceusb_dev *ir)
+ if (ir->emver < 2)
+ return;
+
+- mce_async_out(ir, FLASH_LED, sizeof(FLASH_LED));
++ mce_command_out(ir, FLASH_LED, sizeof(FLASH_LED));
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 6844ec3584485c68070bab7f55c1d8f143a2b813 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Aug 2019 19:01:36 -0300
+Subject: media: media/platform: fsl-viu.c: fix build for MICROBLAZE
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 6898dd580a045341f844862ceb775144156ec1af ]
+
+arch/microblaze/ defines out_be32() and in_be32(), so don't do that
+again in the driver source.
+
+Fixes these build warnings:
+
+../drivers/media/platform/fsl-viu.c:36: warning: "out_be32" redefined
+../arch/microblaze/include/asm/io.h:50: note: this is the location of the previous definition
+../drivers/media/platform/fsl-viu.c:37: warning: "in_be32" redefined
+../arch/microblaze/include/asm/io.h:53: note: this is the location of the previous definition
+
+Fixes: 29d750686331 ("media: fsl-viu: allow building it with COMPILE_TEST")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/fsl-viu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c
+index 691be788e38b3..b74e4f50d7d9f 100644
+--- a/drivers/media/platform/fsl-viu.c
++++ b/drivers/media/platform/fsl-viu.c
+@@ -32,7 +32,7 @@
+ #define VIU_VERSION "0.5.1"
+
+ /* Allow building this driver with COMPILE_TEST */
+-#ifndef CONFIG_PPC
++#if !defined(CONFIG_PPC) && !defined(CONFIG_MICROBLAZE)
+ #define out_be32(v, a) iowrite32be(a, (void __iomem *)v)
+ #define in_be32(a) ioread32be((void __iomem *)a)
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 137cc0784fe8e585daa7ea33afd85bb6cc28a243 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 18:47:00 -0400
+Subject: media: mtk-cir: lower de-glitch counter for rc-mm protocol
+
+From: Sean Young <sean@mess.org>
+
+[ Upstream commit 5dd4b89dc098bf22cd13e82a308f42a02c102b2b ]
+
+The rc-mm protocol can't be decoded by the mtk-cir since the de-glitch
+filter removes pulses/spaces shorter than 294 microseconds.
+
+Tested on a BananaPi R2.
+
+Signed-off-by: Sean Young <sean@mess.org>
+Acked-by: Sean Wang <sean.wang@kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/mtk-cir.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/rc/mtk-cir.c b/drivers/media/rc/mtk-cir.c
+index 50fb0aebb8d40..f2259082e3d82 100644
+--- a/drivers/media/rc/mtk-cir.c
++++ b/drivers/media/rc/mtk-cir.c
+@@ -35,6 +35,11 @@
+ /* Fields containing pulse width data */
+ #define MTK_WIDTH_MASK (GENMASK(7, 0))
+
++/* IR threshold */
++#define MTK_IRTHD 0x14
++#define MTK_DG_CNT_MASK (GENMASK(12, 8))
++#define MTK_DG_CNT(x) ((x) << 8)
++
+ /* Bit to enable interrupt */
+ #define MTK_IRINT_EN BIT(0)
+
+@@ -398,6 +403,9 @@ static int mtk_ir_probe(struct platform_device *pdev)
+ mtk_w32_mask(ir, val, ir->data->fields[MTK_HW_PERIOD].mask,
+ ir->data->fields[MTK_HW_PERIOD].reg);
+
++ /* Set de-glitch counter */
++ mtk_w32_mask(ir, MTK_DG_CNT(1), MTK_DG_CNT_MASK, MTK_IRTHD);
++
+ /* Enable IR and PWM */
+ val = mtk_r32(ir, MTK_CONFIG_HIGH_REG);
+ val |= MTK_OK_COUNT(ir->data->ok_count) | MTK_PWM_EN | MTK_IR_EN;
+--
+2.20.1
+
--- /dev/null
+From 18315d2768dedad00bf2ed0c6ccd5ffbc54572b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 08:32:50 -0300
+Subject: media: mtk-mdp: fix reference count on old device tree
+
+From: Matthias Brugger <matthias.bgg@gmail.com>
+
+[ Upstream commit 864919ea0380e62adb2503b89825fe358acb8216 ]
+
+of_get_next_child() increments the reference count of the returning
+device_node. Decrement it in the check if we are using the old or the
+new DTB.
+
+Fixes: ba1f1f70c2c0 ("[media] media: mtk-mdp: Fix mdp device tree")
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Acked-by: Houlong Wei <houlong.wei@mediatek.com>
+[hverkuil-cisco@xs4all.nl: use node instead of parent as temp variable]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-mdp/mtk_mdp_core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_core.c b/drivers/media/platform/mtk-mdp/mtk_mdp_core.c
+index fc9faec85edb6..5d44f2e92dd50 100644
+--- a/drivers/media/platform/mtk-mdp/mtk_mdp_core.c
++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_core.c
+@@ -110,7 +110,9 @@ static int mtk_mdp_probe(struct platform_device *pdev)
+ mutex_init(&mdp->vpulock);
+
+ /* Old dts had the components as child nodes */
+- if (of_get_next_child(dev->of_node, NULL)) {
++ node = of_get_next_child(dev->of_node, NULL);
++ if (node) {
++ of_node_put(node);
+ parent = dev->of_node;
+ dev_warn(dev, "device tree is out of date\n");
+ } else {
+--
+2.20.1
+
--- /dev/null
+From f8535c963c95ca3b4e097a7b50aa3174fc823adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 11:21:27 -0300
+Subject: media: omap3isp: Don't set streaming state on random subdevs
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 7ef57be07ac146e70535747797ef4aee0f06e9f9 ]
+
+The streaming state should be set to the first upstream sub-device only,
+not everywhere, for a sub-device driver itself knows how to best control
+the streaming state of its own upstream sub-devices.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/isp.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 83216fc7156b3..9cdb43859ae09 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -719,6 +719,10 @@ static int isp_pipeline_enable(struct isp_pipeline *pipe,
+ s_stream, mode);
+ pipe->do_propagation = true;
+ }
++
++ /* Stop at the first external sub-device. */
++ if (subdev->dev != isp->dev)
++ break;
+ }
+
+ return 0;
+@@ -833,6 +837,10 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
+ &subdev->entity);
+ failure = -ETIMEDOUT;
+ }
++
++ /* Stop at the first external sub-device. */
++ if (subdev->dev != isp->dev)
++ break;
+ }
+
+ return failure;
+--
+2.20.1
+
--- /dev/null
+From 567c8d6ef582136811701ca25f5db6cb7badb735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 11:19:00 -0300
+Subject: media: omap3isp: Set device on omap3isp subdevs
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit e9eb103f027725053a4b02f93d7f2858b56747ce ]
+
+The omap3isp driver registered subdevs without the dev field being set. Do
+that now.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/ispccdc.c | 1 +
+ drivers/media/platform/omap3isp/ispccp2.c | 1 +
+ drivers/media/platform/omap3isp/ispcsi2.c | 1 +
+ drivers/media/platform/omap3isp/isppreview.c | 1 +
+ drivers/media/platform/omap3isp/ispresizer.c | 1 +
+ drivers/media/platform/omap3isp/ispstat.c | 2 ++
+ 6 files changed, 7 insertions(+)
+
+diff --git a/drivers/media/platform/omap3isp/ispccdc.c b/drivers/media/platform/omap3isp/ispccdc.c
+index 1ba8a5ba343f6..e2f336c715a4d 100644
+--- a/drivers/media/platform/omap3isp/ispccdc.c
++++ b/drivers/media/platform/omap3isp/ispccdc.c
+@@ -2602,6 +2602,7 @@ int omap3isp_ccdc_register_entities(struct isp_ccdc_device *ccdc,
+ int ret;
+
+ /* Register the subdev and video node. */
++ ccdc->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &ccdc->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispccp2.c b/drivers/media/platform/omap3isp/ispccp2.c
+index efca45bb02c8b..d0a49cdfd22d2 100644
+--- a/drivers/media/platform/omap3isp/ispccp2.c
++++ b/drivers/media/platform/omap3isp/ispccp2.c
+@@ -1031,6 +1031,7 @@ int omap3isp_ccp2_register_entities(struct isp_ccp2_device *ccp2,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ ccp2->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &ccp2->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispcsi2.c b/drivers/media/platform/omap3isp/ispcsi2.c
+index e85917f4a50cc..fd493c5e4e24f 100644
+--- a/drivers/media/platform/omap3isp/ispcsi2.c
++++ b/drivers/media/platform/omap3isp/ispcsi2.c
+@@ -1198,6 +1198,7 @@ int omap3isp_csi2_register_entities(struct isp_csi2_device *csi2,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ csi2->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &csi2->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c
+index 40e22400cf5ec..97d660606d984 100644
+--- a/drivers/media/platform/omap3isp/isppreview.c
++++ b/drivers/media/platform/omap3isp/isppreview.c
+@@ -2225,6 +2225,7 @@ int omap3isp_preview_register_entities(struct isp_prev_device *prev,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ prev->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &prev->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispresizer.c b/drivers/media/platform/omap3isp/ispresizer.c
+index 21ca6954df72f..78d9dd7ea2da7 100644
+--- a/drivers/media/platform/omap3isp/ispresizer.c
++++ b/drivers/media/platform/omap3isp/ispresizer.c
+@@ -1681,6 +1681,7 @@ int omap3isp_resizer_register_entities(struct isp_res_device *res,
+ int ret;
+
+ /* Register the subdev and video nodes. */
++ res->subdev.dev = vdev->mdev->dev;
+ ret = v4l2_device_register_subdev(vdev, &res->subdev);
+ if (ret < 0)
+ goto error;
+diff --git a/drivers/media/platform/omap3isp/ispstat.c b/drivers/media/platform/omap3isp/ispstat.c
+index 62b2eacb96fd1..5b9b57f4d9bf8 100644
+--- a/drivers/media/platform/omap3isp/ispstat.c
++++ b/drivers/media/platform/omap3isp/ispstat.c
+@@ -1026,6 +1026,8 @@ void omap3isp_stat_unregister_entities(struct ispstat *stat)
+ int omap3isp_stat_register_entities(struct ispstat *stat,
+ struct v4l2_device *vdev)
+ {
++ stat->subdev.dev = vdev->mdev->dev;
++
+ return v4l2_device_register_subdev(vdev, &stat->subdev);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0a1f33558a317c08d4604e3a6500842057e77b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 11:55:07 -0300
+Subject: media: ov9650: add a sanity check
+
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+
+[ Upstream commit 093347abc7a4e0490e3c962ecbde2dc272a8f708 ]
+
+As pointed by cppcheck:
+
+ [drivers/media/i2c/ov9650.c:706]: (error) Shifting by a negative value is undefined behaviour
+ [drivers/media/i2c/ov9650.c:707]: (error) Shifting by a negative value is undefined behaviour
+ [drivers/media/i2c/ov9650.c:721]: (error) Shifting by a negative value is undefined behaviour
+
+Prevent mangling with gains with invalid values.
+
+As pointed by Sylvester, this should never happen in practice,
+as min value of V4L2_CID_GAIN control is 16 (gain is always >= 16
+and m is always >= 0), but it is too hard for a static analyzer
+to get this, as the logic with validates control min/max is
+elsewhere inside V4L2 core.
+
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov9650.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/i2c/ov9650.c b/drivers/media/i2c/ov9650.c
+index 30ab2225fbd0c..b350f5c1a9890 100644
+--- a/drivers/media/i2c/ov9650.c
++++ b/drivers/media/i2c/ov9650.c
+@@ -703,6 +703,11 @@ static int ov965x_set_gain(struct ov965x *ov965x, int auto_gain)
+ for (m = 6; m >= 0; m--)
+ if (gain >= (1 << m) * 16)
+ break;
++
++ /* Sanity check: don't adjust the gain with a negative value */
++ if (m < 0)
++ return -EINVAL;
++
+ rgain = (gain - ((1 << m) * 16)) / (1 << m);
+ rgain |= (((1 << m) - 1) << 4);
+
+--
+2.20.1
+
--- /dev/null
+From 0f84697882e261f540e9a0646f57f0e13d4b4bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 09:40:52 -0300
+Subject: media: radio/si470x: kill urb on error
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ]
+
+In the probe() function radio->int_in_urb was not killed if an
+error occurred in the probe sequence. It was also missing in
+the disconnect.
+
+This caused this syzbot issue:
+
+https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99
+
+Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
+index 49073747b1e7b..fedff68d8c496 100644
+--- a/drivers/media/radio/si470x/radio-si470x-usb.c
++++ b/drivers/media/radio/si470x/radio-si470x-usb.c
+@@ -734,7 +734,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
+ /* start radio */
+ retval = si470x_start_usb(radio);
+ if (retval < 0)
+- goto err_all;
++ goto err_buf;
+
+ /* set initial frequency */
+ si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
+@@ -749,6 +749,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
+
+ return 0;
+ err_all:
++ usb_kill_urb(radio->int_in_urb);
++err_buf:
+ kfree(radio->buffer);
+ err_ctrl:
+ v4l2_ctrl_handler_free(&radio->hdl);
+@@ -822,6 +824,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
+ mutex_lock(&radio->lock);
+ v4l2_device_disconnect(&radio->v4l2_dev);
+ video_unregister_device(&radio->videodev);
++ usb_kill_urb(radio->int_in_urb);
+ usb_set_intfdata(intf, NULL);
+ mutex_unlock(&radio->lock);
+ v4l2_device_put(&radio->v4l2_dev);
+--
+2.20.1
+
--- /dev/null
+From f8a5a35e67a4c9a60354179b382e548ed7c230ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 13:37:46 -0300
+Subject: media: rc: imon: Allow iMON RC protocol for ffdc 7e device
+
+From: Darius Rad <alpha@area49.net>
+
+[ Upstream commit b20a6e298bcb8cb8ae18de26baaf462a6418515b ]
+
+Allow selecting the IR protocol, MCE or iMON, for a device that
+identifies as follows (with config id 0x7e):
+
+15c2:ffdc SoundGraph Inc. iMON PAD Remote Controller
+
+As the driver is structured to default to iMON when both RC
+protocols are supported, existing users of this device (using MCE
+protocol) will need to manually switch to MCE (RC-6) protocol from
+userspace (with ir-keytable, sysfs).
+
+Signed-off-by: Darius Rad <alpha@area49.net>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 7bee72108b0ee..37a850421fbb1 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -1826,12 +1826,17 @@ static void imon_get_ffdc_type(struct imon_context *ictx)
+ break;
+ /* iMON VFD, MCE IR */
+ case 0x46:
+- case 0x7e:
+ case 0x9e:
+ dev_info(ictx->dev, "0xffdc iMON VFD, MCE IR");
+ detected_display_type = IMON_DISPLAY_TYPE_VFD;
+ allowed_protos = RC_PROTO_BIT_RC6_MCE;
+ break;
++ /* iMON VFD, iMON or MCE IR */
++ case 0x7e:
++ dev_info(ictx->dev, "0xffdc iMON VFD, iMON or MCE IR");
++ detected_display_type = IMON_DISPLAY_TYPE_VFD;
++ allowed_protos |= RC_PROTO_BIT_RC6_MCE;
++ break;
+ /* iMON LCD, MCE IR */
+ case 0x9f:
+ dev_info(ictx->dev, "0xffdc iMON LCD, MCE IR");
+--
+2.20.1
+
--- /dev/null
+From c2453243aab29d080855308ce36f06920fd10169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 19:05:55 -0300
+Subject: media: saa7134: fix terminology around
+ saa7134_i2c_eeprom_md7134_gate()
+
+From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+
+[ Upstream commit 9d802222a3405599d6e1984d9324cddf592ea1f4 ]
+
+saa7134_i2c_eeprom_md7134_gate() function and the associated comment uses
+an inverted i2c gate open / closed terminology.
+Let's fix this.
+
+Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+[hverkuil-cisco@xs4all.nl: fix alignment checkpatch warning]
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-i2c.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-i2c.c b/drivers/media/pci/saa7134/saa7134-i2c.c
+index 493b1858815fb..04e85765373ec 100644
+--- a/drivers/media/pci/saa7134/saa7134-i2c.c
++++ b/drivers/media/pci/saa7134/saa7134-i2c.c
+@@ -342,7 +342,11 @@ static const struct i2c_client saa7134_client_template = {
+
+ /* ----------------------------------------------------------- */
+
+-/* On Medion 7134 reading EEPROM needs DVB-T demod i2c gate open */
++/*
++ * On Medion 7134 reading the SAA7134 chip config EEPROM needs DVB-T
++ * demod i2c gate closed due to an address clash between this EEPROM
++ * and the demod one.
++ */
+ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev)
+ {
+ u8 subaddr = 0x7, dmdregval;
+@@ -359,14 +363,14 @@ static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev)
+
+ ret = i2c_transfer(&dev->i2c_adap, i2cgatemsg_r, 2);
+ if ((ret == 2) && (dmdregval & 0x2)) {
+- pr_debug("%s: DVB-T demod i2c gate was left closed\n",
++ pr_debug("%s: DVB-T demod i2c gate was left open\n",
+ dev->name);
+
+ data[0] = subaddr;
+ data[1] = (dmdregval & ~0x2);
+ if (i2c_transfer(&dev->i2c_adap, i2cgatemsg_w, 1) != 1)
+- pr_err("%s: EEPROM i2c gate open failure\n",
+- dev->name);
++ pr_err("%s: EEPROM i2c gate close failure\n",
++ dev->name);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2425806e152529b8216f5f865266f9d1c4ea6d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Aug 2019 02:40:14 -0300
+Subject: media: saa7146: add cleanup in hexium_attach()
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 42e64117d3b4a759013f77bbcf25ab6700e55de7 ]
+
+If saa7146_register_device() fails, no cleanup is executed, leading to
+memory/resource leaks. To fix this issue, perform necessary cleanup work
+before returning the error.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7146/hexium_gemini.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c
+index dca20a3d98e25..f962269306707 100644
+--- a/drivers/media/pci/saa7146/hexium_gemini.c
++++ b/drivers/media/pci/saa7146/hexium_gemini.c
+@@ -292,6 +292,9 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d
+ ret = saa7146_register_device(&hexium->video_dev, dev, "hexium gemini", VFL_TYPE_GRABBER);
+ if (ret < 0) {
+ pr_err("cannot register capture v4l2 device. skipping.\n");
++ saa7146_vv_release(dev);
++ i2c_del_adapter(&hexium->i2c_adapter);
++ kfree(hexium);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f75fa59a3d4fa15a997d40f5a0f8ba134de64668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 23:41:29 -0300
+Subject: media: staging: tegra-vde: Fix build error
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 6b2265975239ab655069d796b822835a593e1cc7 ]
+
+If IOMMU_SUPPORT is not set, and COMPILE_TEST is y,
+IOMMU_IOVA may be set to m. So building will fails:
+
+drivers/staging/media/tegra-vde/iommu.o: In function `tegra_vde_iommu_map':
+iommu.c:(.text+0x41): undefined reference to `alloc_iova'
+iommu.c:(.text+0x56): undefined reference to `__free_iova'
+
+Select IOMMU_IOVA while COMPILE_TEST is set to fix this.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Suggested-by: Dmitry Osipenko <digetx@gmail.com>
+Fixes: b301f8de1925 ("media: staging: media: tegra-vde: Add IOMMU support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/tegra-vde/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/tegra-vde/Kconfig b/drivers/staging/media/tegra-vde/Kconfig
+index 2e7f644ae5911..ba49ea50b8c0b 100644
+--- a/drivers/staging/media/tegra-vde/Kconfig
++++ b/drivers/staging/media/tegra-vde/Kconfig
+@@ -3,7 +3,7 @@ config TEGRA_VDE
+ tristate "NVIDIA Tegra Video Decoder Engine driver"
+ depends on ARCH_TEGRA || COMPILE_TEST
+ select DMA_SHARED_BUFFER
+- select IOMMU_IOVA if IOMMU_SUPPORT
++ select IOMMU_IOVA if (IOMMU_SUPPORT || COMPILE_TEST)
+ select SRAM
+ help
+ Say Y here to enable support for the NVIDIA Tegra video decoder
+--
+2.20.1
+
--- /dev/null
+From 8965916b66adb5c01df9297af967b5f5a34d5568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 12:19:05 -0300
+Subject: media: ttusb-dec: Fix info-leak in ttusb_dec_send_command()
+
+From: Tomas Bortoli <tomasbortoli@gmail.com>
+
+[ Upstream commit a10feaf8c464c3f9cfdd3a8a7ce17e1c0d498da1 ]
+
+The function at issue does not always initialize each byte allocated
+for 'b' and can therefore leak uninitialized memory to a USB device in
+the call to usb_bulk_msg()
+
+Use kzalloc() instead of kmalloc()
+
+Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
+Reported-by: syzbot+0522702e9d67142379f1@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/ttusb-dec/ttusb_dec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
+index 1d0afa340f47c..3198f9624b7c0 100644
+--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
+@@ -319,7 +319,7 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
+
+ dprintk("%s\n", __func__);
+
+- b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
++ b = kzalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+ if (!b)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From 137eea7638964f2107aa5e4b1ce10a9a7e730b3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2019 08:44:32 -0400
+Subject: media: vb2: reorder checks in vb2_poll()
+
+From: Michael Tretter <m.tretter@pengutronix.de>
+
+[ Upstream commit 8d86a15649957c182e90fa2b1267c16699bc12f1 ]
+
+When reaching the end of stream, V4L2 clients may expect the
+V4L2_EOS_EVENT before being able to dequeue the last buffer, which has
+the V4L2_BUF_FLAG_LAST flag set.
+
+If the vb2_poll() function first checks for events and afterwards if
+buffers are available, a driver can queue the V4L2_EOS_EVENT event and
+return the buffer after the check for events but before the check for
+buffers. This causes vb2_poll() to signal that the buffer with
+V4L2_BUF_FLAG_LAST can be read without the V4L2_EOS_EVENT being
+available.
+
+First, check for available buffers and afterwards for events to ensure
+that if vb2_poll() signals POLLIN | POLLRDNORM for the
+V4L2_BUF_FLAG_LAST buffer, it also signals POLLPRI for the
+V4L2_EOS_EVENT.
+
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/videobuf2/videobuf2-v4l2.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/common/videobuf2/videobuf2-v4l2.c b/drivers/media/common/videobuf2/videobuf2-v4l2.c
+index 40d76eb4c2fe7..5a9ba3846f0a5 100644
+--- a/drivers/media/common/videobuf2/videobuf2-v4l2.c
++++ b/drivers/media/common/videobuf2/videobuf2-v4l2.c
+@@ -872,17 +872,19 @@ EXPORT_SYMBOL_GPL(vb2_queue_release);
+ __poll_t vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
+ {
+ struct video_device *vfd = video_devdata(file);
+- __poll_t res = 0;
++ __poll_t res;
++
++ res = vb2_core_poll(q, file, wait);
+
+ if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) {
+ struct v4l2_fh *fh = file->private_data;
+
+ poll_wait(file, &fh->wait, wait);
+ if (v4l2_event_pending(fh))
+- res = EPOLLPRI;
++ res |= EPOLLPRI;
+ }
+
+- return res | vb2_core_poll(q, file, wait);
++ return res;
+ }
+ EXPORT_SYMBOL_GPL(vb2_poll);
+
+--
+2.20.1
+
--- /dev/null
+From fca75435cf4ba26a6c247182f2fa30fae0547bc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2019 04:26:43 -0400
+Subject: media: vivid:add sanity check to avoid divide error and set value to
+ 1 if 0.
+
+From: Vandana BN <bnvandana@gmail.com>
+
+[ Upstream commit aa9c2182c45421d54ed27c2a1765f7adedce291b ]
+
+Syzbot reported divide error in vivid_thread_vid_cap, which has been
+seen only once and does not have a reproducer.
+This patch adds sanity checks for the
+denominator value with WARN_ON if it is 0 and replaces it with 1.
+
+divide error: 0000 [#1] PREEMPT SMP KASAN
+kobject: 'tx-0' (0000000017161f7f): kobject_uevent_env
+CPU: 0 PID: 23689 Comm: vivid-003-vid-c Not tainted 5.0.0-rc4+ #58
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+RIP: 0010:vivid_cap_update_frame_period
+drivers/media/platform/vivid/vivid-kthread-cap.c:661 [inline]
+RIP: 0010:vivid_thread_vid_cap+0x221/0x284
+drivers/media/platform/vivid/vivid-kthread-cap.c:789
+Code: 48 c1 e9 03 0f b6 0c 11 48 89 f2 48 69 c0 00 ca 9a 3b 83 c2 03 38
+ca
+7c 08 84 c9 0f 85 f0 1e 00 00 41 8b 8f 24 64 00 00 31 d2 <48> f7 f1 49
+89
+c4 48 89 c3 49 8d 87 28 64 00 00 48 89 c2 48 89 45
+RSP: 0018:ffff88808b4afd68 EFLAGS: 00010246
+kobject: 'tx-0' (0000000017161f7f): fill_kobj_path: path
+= '/devices/virtual/net/gre0/queues/tx-0'
+RAX: 000000de5a6f8e00 RBX: 0000000100047b22 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000004
+RBP: ffff88808b4aff00 R08: ffff88804862e1c0 R09: ffffffff89997008
+R10: ffffffff89997010 R11: 0000000000000001 R12: 00000000fffffffc
+R13: ffff8880a17e0500 R14: ffff88803e40f760 R15: ffff8882182b0140
+FS: 0000000000000000(0000) GS:ffff8880ae800000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000004cdc90 CR3: 000000005d827000 CR4: 00000000001426f0
+Call Trace:
+kobject: 'gretap0' (00000000d7549098): kobject_add_internal: parent:
+'net',
+set: 'devices'
+kobject: 'loop2' (0000000094ed4ee4): kobject_uevent_env
+kobject: 'loop2' (0000000094ed4ee4): fill_kobj_path: path
+= '/devices/virtual/block/loop2'
+ kthread+0x357/0x430 kernel/kthread.c:246
+kobject: 'gretap0' (00000000d7549098): kobject_uevent_env
+ ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
+Modules linked in:
+kobject: 'gretap0' (00000000d7549098): fill_kobj_path: path
+= '/devices/virtual/net/gretap0'
+---[ end trace bc5c8b25b64d768f ]---
+kobject: 'loop1' (0000000032036b86): kobject_uevent_env
+RIP: 0010:vivid_cap_update_frame_period
+drivers/media/platform/vivid/vivid-kthread-cap.c:661 [inline]
+RIP: 0010:vivid_thread_vid_cap+0x221/0x2840
+drivers/media/platform/vivid/vivid-kthread-cap.c:789
+kobject: 'loop1' (0000000032036b86): fill_kobj_path: path
+= '/devices/virtual/block/loop1'
+Code: 48 c1 e9 03 0f b6 0c 11 48 89 f2 48 69 c0 00 ca 9a 3b 83 c2 03 38
+ca
+7c 08 84 c9 0f 85 f0 1e 00 00 41 8b 8f 24 64 00 00 31 d2 <48> f7 f1 49
+89
+c4 48 89 c3 49 8d 87 28 64 00 00 48 89 c2 48 89 45
+kobject: 'loop0' (00000000dd9927c3): kobject_uevent_env
+RSP: 0018:ffff88808b4afd68 EFLAGS: 00010246
+RAX: 000000de5a6f8e00 RBX: 0000000100047b22 RCX: 0000000000000000
+kobject: 'queues' (000000007ed20666): kobject_add_internal:
+parent: 'gretap0', set: '<NULL>'
+RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000004
+RBP: ffff88808b4aff00 R08: ffff88804862e1c0 R09: ffffffff89997008
+kobject: 'loop0' (00000000dd9927c3): fill_kobj_path: path
+= '/devices/virtual/block/loop0'
+R10: ffffffff89997010 R11: 0000000000000001 R12: 00000000fffffffc
+kobject: 'queues' (000000007ed20666): kobject_uevent_env
+R13: ffff8880a17e0500 R14: ffff88803e40f760 R15: ffff8882182b0140
+FS: 0000000000000000(0000) GS:ffff8880ae800000(0000)
+knlGS:0000000000000000
+kobject: 'loop5' (00000000a41f9e79): kobject_uevent_env
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+kobject: 'queues' (000000007ed20666): kobject_uevent_env: filter
+function
+caused the event to drop!
+CR2: 00000000004cdc90 CR3: 000000005d827000 CR4: 00000000001426f0
+kobject: 'loop5' (00000000a41f9e79): fill_kobj_path: path
+= '/devices/virtual/block/loop5'
+
+Reported-by: syz...@syzkaller.appspotmail.com
+Signed-off-by: Vandana BN <bnvandana@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-kthread-cap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c
+index 6cf495a7d5cc1..ed466d737a90d 100644
+--- a/drivers/media/platform/vivid/vivid-kthread-cap.c
++++ b/drivers/media/platform/vivid/vivid-kthread-cap.c
+@@ -658,6 +658,8 @@ static void vivid_cap_update_frame_period(struct vivid_dev *dev)
+ u64 f_period;
+
+ f_period = (u64)dev->timeperframe_vid_cap.numerator * 1000000000;
++ if (WARN_ON(dev->timeperframe_vid_cap.denominator == 0))
++ dev->timeperframe_vid_cap.denominator = 1;
+ do_div(f_period, dev->timeperframe_vid_cap.denominator);
+ if (dev->field_cap == V4L2_FIELD_ALTERNATE)
+ f_period >>= 1;
+--
+2.20.1
+
--- /dev/null
+From c9cb4f76d266fb1930ea35dec51fb5af8c191486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2019 10:16:43 -0400
+Subject: media: vivid: work around high stack usage with clang
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1a03f91c2c2419c3709c4554952c66695575e91c ]
+
+Building a KASAN-enabled kernel with clang ends up in a case where too
+much is inlined into vivid_thread_vid_cap() and the stack usage grows
+a lot, possibly when the register allocation fails to produce efficient
+code and spills a lot of temporaries to the stack. This uses more
+than twice the amount of stack than the sum of the individual functions
+when they are not inlined:
+
+drivers/media/platform/vivid/vivid-kthread-cap.c:766:12: error: stack frame size of 2208 bytes in function 'vivid_thread_vid_cap' [-Werror,-Wframe-larger-than=]
+
+Marking two of the key functions in here as 'noinline_for_stack' avoids
+the pathological case in clang without any apparent downside for gcc.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-kthread-cap.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c
+index ed466d737a90d..003319d7816d7 100644
+--- a/drivers/media/platform/vivid/vivid-kthread-cap.c
++++ b/drivers/media/platform/vivid/vivid-kthread-cap.c
+@@ -232,8 +232,8 @@ static void *plane_vaddr(struct tpg_data *tpg, struct vivid_buffer *buf,
+ return vbuf;
+ }
+
+-static int vivid_copy_buffer(struct vivid_dev *dev, unsigned p, u8 *vcapbuf,
+- struct vivid_buffer *vid_cap_buf)
++static noinline_for_stack int vivid_copy_buffer(struct vivid_dev *dev, unsigned p,
++ u8 *vcapbuf, struct vivid_buffer *vid_cap_buf)
+ {
+ bool blank = dev->must_blank[vid_cap_buf->vb.vb2_buf.index];
+ struct tpg_data *tpg = &dev->tpg;
+@@ -672,7 +672,8 @@ static void vivid_cap_update_frame_period(struct vivid_dev *dev)
+ dev->cap_frame_period = f_period;
+ }
+
+-static void vivid_thread_vid_cap_tick(struct vivid_dev *dev, int dropped_bufs)
++static noinline_for_stack void vivid_thread_vid_cap_tick(struct vivid_dev *dev,
++ int dropped_bufs)
+ {
+ struct vivid_buffer *vid_cap_buf = NULL;
+ struct vivid_buffer *vbi_cap_buf = NULL;
+--
+2.20.1
+
--- /dev/null
+From 83887054fc58c0b2fbee3f7bc937e089fd428e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2019 14:11:24 -0300
+Subject: media: vsp1: fix memory leak of dl on error return path
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 70c55c1ad1a76e804ee5330e134674f5d2741cb7 ]
+
+Currently when the call vsp1_dl_body_get fails and returns null the
+error return path leaks the allocation of dl. Fix this by kfree'ing
+dl before returning.
+
+Addresses-Coverity: ("Resource leak")
+
+Fixes: 5d7936b8e27d ("media: vsp1: Convert display lists to use new body pool")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vsp1/vsp1_dl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c
+index 104b6f5145364..d7b43037e500a 100644
+--- a/drivers/media/platform/vsp1/vsp1_dl.c
++++ b/drivers/media/platform/vsp1/vsp1_dl.c
+@@ -557,8 +557,10 @@ static struct vsp1_dl_list *vsp1_dl_list_alloc(struct vsp1_dl_manager *dlm)
+
+ /* Get a default body for our list. */
+ dl->body0 = vsp1_dl_body_get(dlm->pool);
+- if (!dl->body0)
++ if (!dl->body0) {
++ kfree(dl);
+ return NULL;
++ }
+
+ header_offset = dl->body0->max_entries * sizeof(*dl->body0->entries);
+
+--
+2.20.1
+
--- /dev/null
+From 44baa177b131add290c8b8cabb0c6033073cbebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2019 12:12:26 +0200
+Subject: mmc: core: Add helper function to indicate if SDIO IRQs is enabled
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit bd880b00697befb73eff7220ee20bdae4fdd487b ]
+
+To avoid each host driver supporting SDIO IRQs, from keeping track
+internally about if SDIO IRQs has been claimed, let's introduce a common
+helper function, sdio_irq_claimed().
+
+The function returns true if SDIO IRQs are claimed, via using the
+information about the number of claimed irqs. This is safe, even without
+any locks, as long as the helper function is called only from
+runtime/system suspend callbacks of the host driver.
+
+Tested-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mmc/host.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index 4a351cb7f20fc..cf87c673cbb81 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -493,6 +493,15 @@ void mmc_command_done(struct mmc_host *host, struct mmc_request *mrq);
+
+ void mmc_cqe_request_done(struct mmc_host *host, struct mmc_request *mrq);
+
++/*
++ * May be called from host driver's system/runtime suspend/resume callbacks,
++ * to know if SDIO IRQs has been claimed.
++ */
++static inline bool sdio_irq_claimed(struct mmc_host *host)
++{
++ return host->sdio_irqs > 0;
++}
++
+ static inline void mmc_signal_sdio_irq(struct mmc_host *host)
+ {
+ host->ops->enable_sdio_irq(host, 0);
+--
+2.20.1
+
--- /dev/null
+From f20dd12444850f089c1d545a79400ad73a5a9751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2019 12:12:30 +0200
+Subject: mmc: core: Clarify sdio_irq_pending flag for
+ MMC_CAP2_SDIO_IRQ_NOTHREAD
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 36d57efb4af534dd6b442ea0b9a04aa6dfa37abe ]
+
+The sdio_irq_pending flag is used to let host drivers indicate that it has
+signaled an IRQ. If that is the case and we only have a single SDIO func
+that have claimed an SDIO IRQ, our assumption is that we can avoid reading
+the SDIO_CCCR_INTx register and just call the SDIO func irq handler
+immediately. This makes sense, but the flag is set/cleared in a somewhat
+messy order, let's fix that up according to below.
+
+First, the flag is currently set in sdio_run_irqs(), which is executed as a
+work that was scheduled from sdio_signal_irq(). To make it more implicit
+that the host have signaled an IRQ, let's instead immediately set the flag
+in sdio_signal_irq(). This also makes the behavior consistent with host
+drivers that uses the legacy, mmc_signal_sdio_irq() API. This have no
+functional impact, because we don't expect host drivers to call
+sdio_signal_irq() until after the work (sdio_run_irqs()) have been executed
+anyways.
+
+Second, currently we never clears the flag when using the sdio_run_irqs()
+work, but only when using the sdio_irq_thread(). Let make the behavior
+consistent, by moving the flag to be cleared inside the common
+process_sdio_pending_irqs() function. Additionally, tweak the behavior of
+the flag slightly, by avoiding to clear it unless we processed the SDIO
+IRQ. The purpose with this at this point, is to keep the information about
+whether there have been an SDIO IRQ signaled by the host, so at system
+resume we can decide to process it without reading the SDIO_CCCR_INTx
+register.
+
+Tested-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/sdio_irq.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c
+index 0bcc5e83bd1a0..40109a6159228 100644
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -31,6 +31,7 @@ static int process_sdio_pending_irqs(struct mmc_host *host)
+ {
+ struct mmc_card *card = host->card;
+ int i, ret, count;
++ bool sdio_irq_pending = host->sdio_irq_pending;
+ unsigned char pending;
+ struct sdio_func *func;
+
+@@ -38,13 +39,16 @@ static int process_sdio_pending_irqs(struct mmc_host *host)
+ if (mmc_card_suspended(card))
+ return 0;
+
++ /* Clear the flag to indicate that we have processed the IRQ. */
++ host->sdio_irq_pending = false;
++
+ /*
+ * Optimization, if there is only 1 function interrupt registered
+ * and we know an IRQ was signaled then call irq handler directly.
+ * Otherwise do the full probe.
+ */
+ func = card->sdio_single_irq;
+- if (func && host->sdio_irq_pending) {
++ if (func && sdio_irq_pending) {
+ func->irq_handler(func);
+ return 1;
+ }
+@@ -96,7 +100,6 @@ static void sdio_run_irqs(struct mmc_host *host)
+ {
+ mmc_claim_host(host);
+ if (host->sdio_irqs) {
+- host->sdio_irq_pending = true;
+ process_sdio_pending_irqs(host);
+ if (host->ops->ack_sdio_irq)
+ host->ops->ack_sdio_irq(host);
+@@ -114,6 +117,7 @@ void sdio_irq_work(struct work_struct *work)
+
+ void sdio_signal_irq(struct mmc_host *host)
+ {
++ host->sdio_irq_pending = true;
+ queue_delayed_work(system_wq, &host->sdio_irq_work, 0);
+ }
+ EXPORT_SYMBOL_GPL(sdio_signal_irq);
+@@ -159,7 +163,6 @@ static int sdio_irq_thread(void *_host)
+ if (ret)
+ break;
+ ret = process_sdio_pending_irqs(host);
+- host->sdio_irq_pending = false;
+ mmc_release_host(host);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 85f6e8c4e0db4771e56e34ccfad4d2274a276d87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2019 12:12:27 +0200
+Subject: mmc: dw_mmc: Re-store SDIO IRQs mask at system resume
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 7c526608d5afb62cbc967225e2ccaacfdd142e9d ]
+
+In cases when SDIO IRQs have been enabled, runtime suspend is prevented by
+the driver. However, this still means dw_mci_runtime_suspend|resume() gets
+called during system suspend/resume, via pm_runtime_force_suspend|resume().
+This means during system suspend/resume, the register context of the dw_mmc
+device most likely loses its register context, even in cases when SDIO IRQs
+have been enabled.
+
+To re-enable the SDIO IRQs during system resume, the dw_mmc driver
+currently relies on the mmc core to re-enable the SDIO IRQs when it resumes
+the SDIO card, but this isn't the recommended solution. Instead, it's
+better to deal with this locally in the dw_mmc driver, so let's do that.
+
+Tested-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/dw_mmc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index eea52e2c5a0ce..79c55c7b4afd9 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -3460,6 +3460,10 @@ int dw_mci_runtime_resume(struct device *dev)
+ /* Force setup bus to guarantee available clock output */
+ dw_mci_setup_bus(host->slot, true);
+
++ /* Re-enable SDIO interrupts. */
++ if (sdio_irq_claimed(host->slot->mmc))
++ __dw_mci_enable_sdio_irq(host->slot, 1);
++
+ /* Now that slots are all setup, we can enable card detect */
+ dw_mci_enable_cd(host);
+
+--
+2.20.1
+
--- /dev/null
+From 9e8e8bd3f62402b652af5ab4c9d4d0318b4f1d6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 14:09:20 +0200
+Subject: mmc: mtk-sd: Re-store SDIO IRQs mask at system resume
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 1c81d69d4c98aab56c5a7d5a810f84aefdb37e9b ]
+
+In cases when SDIO IRQs have been enabled, runtime suspend is prevented by
+the driver. However, this still means msdc_runtime_suspend|resume() gets
+called during system suspend/resume, via pm_runtime_force_suspend|resume().
+
+This means during system suspend/resume, the register context of the mtk-sd
+device most likely loses its register context, even in cases when SDIO IRQs
+have been enabled.
+
+To re-enable the SDIO IRQs during system resume, the mtk-sd driver
+currently relies on the mmc core to re-enable the SDIO IRQs when it resumes
+the SDIO card, but this isn't the recommended solution. Instead, it's
+better to deal with this locally in the mtk-sd driver, so let's do that.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mtk-sd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 33f4b6387ef71..978c8ccce7e31 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -2421,6 +2421,9 @@ static void msdc_restore_reg(struct msdc_host *host)
+ } else {
+ writel(host->save_para.pad_tune, host->base + tune_reg);
+ }
++
++ if (sdio_irq_claimed(host->mmc))
++ __msdc_enable_sdio_irq(host, 1);
+ }
+
+ static int msdc_runtime_suspend(struct device *dev)
+--
+2.20.1
+
--- /dev/null
+From 72800658344bd2eb7dd5fb615bb63734a924ba06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 07:51:14 -0400
+Subject: mmc: sdhci: Fix incorrect switch to HS mode
+
+From: Al Cooper <alcooperx@gmail.com>
+
+[ Upstream commit c894e33ddc1910e14d6f2a2016f60ab613fd8b37 ]
+
+When switching from any MMC speed mode that requires 1.8v
+(HS200, HS400 and HS400ES) to High Speed (HS) mode, the system
+ends up configured for SDR12 with a 50MHz clock which is an illegal
+mode.
+
+This happens because the SDHCI_CTRL_VDD_180 bit in the
+SDHCI_HOST_CONTROL2 register is left set and when this bit is
+set, the speed mode is controlled by the SDHCI_CTRL_UHS field
+in the SDHCI_HOST_CONTROL2 register. The SDHCI_CTRL_UHS field
+will end up being set to 0 (SDR12) by sdhci_set_uhs_signaling()
+because there is no UHS mode being set.
+
+The fix is to change sdhci_set_uhs_signaling() to set the
+SDHCI_CTRL_UHS field to SDR25 (which is the same as HS) for
+any switch to HS mode.
+
+This was found on a new eMMC controller that does strict checking
+of the speed mode and the corresponding clock rate. It caused the
+switch to HS400 mode to fail because part of the sequence to switch
+to HS400 requires a switch from HS200 to HS before going to HS400.
+
+Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index a5dc5aae973e6..c66e66fbaeb40 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1849,7 +1849,9 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR104;
+ else if (timing == MMC_TIMING_UHS_SDR12)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR12;
+- else if (timing == MMC_TIMING_UHS_SDR25)
++ else if (timing == MMC_TIMING_SD_HS ||
++ timing == MMC_TIMING_MMC_HS ||
++ timing == MMC_TIMING_UHS_SDR25)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR25;
+ else if (timing == MMC_TIMING_UHS_SDR50)
+ ctrl_2 |= SDHCI_CTRL_UHS_SDR50;
+--
+2.20.1
+
--- /dev/null
+From fe267e174f26493c422308287ecde6882b30b229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2019 11:39:51 -0500
+Subject: nbd: add missing config put
+
+From: Mike Christie <mchristi@redhat.com>
+
+[ Upstream commit 887e975c4172d0d5670c39ead2f18ba1e4ec8133 ]
+
+Fix bug added with the patch:
+
+commit 8f3ea35929a0806ad1397db99a89ffee0140822a
+Author: Josef Bacik <josef@toxicpanda.com>
+Date: Mon Jul 16 12:11:35 2018 -0400
+
+ nbd: handle unexpected replies better
+
+where if the timeout handler runs when the completion path is and we fail
+to grab the mutex in the timeout handler we will leave a config reference
+and cannot free the config later.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index e21d2ded732b7..a69a90ad92088 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -357,8 +357,10 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
+ }
+ config = nbd->config;
+
+- if (!mutex_trylock(&cmd->lock))
++ if (!mutex_trylock(&cmd->lock)) {
++ nbd_config_put(nbd);
+ return BLK_EH_RESET_TIMER;
++ }
+
+ if (config->num_connections > 1) {
+ dev_err_ratelimited(nbd_to_dev(nbd),
+--
+2.20.1
+
--- /dev/null
+From ad47c365807c7458959a5a9b3767e028d8f1e749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 16:40:35 +0200
+Subject: net: lpc-enet: fix printk format strings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit de6f97b2bace0e2eb6c3a86e124d1e652a587b56 ]
+
+compile-testing this driver on other architectures showed
+multiple warnings:
+
+ drivers/net/ethernet/nxp/lpc_eth.c: In function 'lpc_eth_drv_probe':
+ drivers/net/ethernet/nxp/lpc_eth.c:1337:19: warning: format '%d' expects argument of type 'int', but argument 4 has type 'resource_size_t {aka long long unsigned int}' [-Wformat=]
+
+ drivers/net/ethernet/nxp/lpc_eth.c:1342:19: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'dma_addr_t {aka long long unsigned int}' [-Wformat=]
+
+Use format strings that work on all architectures.
+
+Link: https://lore.kernel.org/r/20190809144043.476786-10-arnd@arndb.de
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/nxp/lpc_eth.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
+index f7e11f1b0426c..b0c8be127bee1 100644
+--- a/drivers/net/ethernet/nxp/lpc_eth.c
++++ b/drivers/net/ethernet/nxp/lpc_eth.c
+@@ -1344,13 +1344,14 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
+ pldat->dma_buff_base_p = dma_handle;
+
+ netdev_dbg(ndev, "IO address space :%pR\n", res);
+- netdev_dbg(ndev, "IO address size :%d\n", resource_size(res));
++ netdev_dbg(ndev, "IO address size :%zd\n",
++ (size_t)resource_size(res));
+ netdev_dbg(ndev, "IO address (mapped) :0x%p\n",
+ pldat->net_base);
+ netdev_dbg(ndev, "IRQ number :%d\n", ndev->irq);
+- netdev_dbg(ndev, "DMA buffer size :%d\n", pldat->dma_buff_size);
+- netdev_dbg(ndev, "DMA buffer P address :0x%08x\n",
+- pldat->dma_buff_base_p);
++ netdev_dbg(ndev, "DMA buffer size :%zd\n", pldat->dma_buff_size);
++ netdev_dbg(ndev, "DMA buffer P address :%pad\n",
++ &pldat->dma_buff_base_p);
+ netdev_dbg(ndev, "DMA buffer V address :0x%p\n",
+ pldat->dma_buff_base_v);
+
+@@ -1397,8 +1398,8 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_out_unregister_netdev;
+
+- netdev_info(ndev, "LPC mac at 0x%08x irq %d\n",
+- res->start, ndev->irq);
++ netdev_info(ndev, "LPC mac at 0x%08lx irq %d\n",
++ (unsigned long)res->start, ndev->irq);
+
+ device_init_wakeup(dev, 1);
+ device_set_wakeup_enable(dev, 0);
+--
+2.20.1
+
--- /dev/null
+From 64a8820dd75bc9f0d1d27a6d7963e283badbfc1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 13:00:10 -0700
+Subject: nvme-multipath: fix ana log nsid lookup when nsid is not found
+
+From: Anton Eidelman <anton@lightbitslabs.com>
+
+[ Upstream commit e01f91dff91c7b16a6e3faf2565017d497a73f83 ]
+
+ANA log parsing invokes nvme_update_ana_state() per ANA group desc.
+This updates the state of namespaces with nsids in desc->nsids[].
+
+Both ctrl->namespaces list and desc->nsids[] array are sorted by nsid.
+Hence nvme_update_ana_state() performs a single walk over ctrl->namespaces:
+- if current namespace matches the current desc->nsids[n],
+ this namespace is updated, and n is incremented.
+- the process stops when it encounters the end of either
+ ctrl->namespaces end or desc->nsids[]
+
+In case desc->nsids[n] does not match any of ctrl->namespaces,
+the remaining nsids following desc->nsids[n] will not be updated.
+Such situation was considered abnormal and generated WARN_ON_ONCE.
+
+However ANA log MAY contain nsids not (yet) found in ctrl->namespaces.
+For example, lets consider the following scenario:
+- nvme0 exposes namespaces with nsids = [2, 3] to the host
+- a new namespace nsid = 1 is added dynamically
+- also, a ANA topology change is triggered
+- NS_CHANGED aen is generated and triggers scan_work
+- before scan_work discovers nsid=1 and creates a namespace, a NOTICE_ANA
+ aen was issues and ana_work receives ANA log with nsids=[1, 2, 3]
+
+Result: ana_work fails to update ANA state on existing namespaces [2, 3]
+
+Solution:
+Change the way nvme_update_ana_state() namespace list walk
+checks the current namespace against desc->nsids[n] as follows:
+a) ns->head->ns_id < desc->nsids[n]: keep walking ctrl->namespaces.
+b) ns->head->ns_id == desc->nsids[n]: match, update the namespace
+c) ns->head->ns_id >= desc->nsids[n]: skip to desc->nsids[n+1]
+
+This enables correct operation in the scenario described above.
+This also allows ANA log to contain nsids currently invisible
+to the host, i.e. inactive nsids.
+
+Signed-off-by: Anton Eidelman <anton@lightbitslabs.com>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index af831d3d15d07..30de7efef0035 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -509,14 +509,16 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
+
+ down_write(&ctrl->namespaces_rwsem);
+ list_for_each_entry(ns, &ctrl->namespaces, list) {
+- if (ns->head->ns_id != le32_to_cpu(desc->nsids[n]))
++ unsigned nsid = le32_to_cpu(desc->nsids[n]);
++
++ if (ns->head->ns_id < nsid)
+ continue;
+- nvme_update_ns_ana_state(desc, ns);
++ if (ns->head->ns_id == nsid)
++ nvme_update_ns_ana_state(desc, ns);
+ if (++n == nr_nsids)
+ break;
+ }
+ up_write(&ctrl->namespaces_rwsem);
+- WARN_ON_ONCE(n < nr_nsids);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 697a22b6b30179dac22e097188a0f3dc4be1d2a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 02:22:36 +0000
+Subject: nvmet: fix data units read and written counters in SMART log
+
+From: Tom Wu <tomwu@mellanox.com>
+
+[ Upstream commit 3bec2e3754becebd4c452999adb49bc62c575ea4 ]
+
+In nvme spec 1.3 there is a definition for data write/read counters
+from SMART log, (See section 5.14.1.2):
+ This value is reported in thousands (i.e., a value of 1
+ corresponds to 1000 units of 512 bytes read) and is rounded up.
+
+However, in nvme target where value is reported with actual units,
+but not thousands of units as the spec requires.
+
+Signed-off-by: Tom Wu <tomwu@mellanox.com>
+Reviewed-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index 4dc12ea52f23c..51800a9ce9a91 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -81,9 +81,11 @@ static u16 nvmet_get_smart_log_nsid(struct nvmet_req *req,
+ goto out;
+
+ host_reads = part_stat_read(ns->bdev->bd_part, ios[READ]);
+- data_units_read = part_stat_read(ns->bdev->bd_part, sectors[READ]);
++ data_units_read = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part,
++ sectors[READ]), 1000);
+ host_writes = part_stat_read(ns->bdev->bd_part, ios[WRITE]);
+- data_units_written = part_stat_read(ns->bdev->bd_part, sectors[WRITE]);
++ data_units_written = DIV_ROUND_UP(part_stat_read(ns->bdev->bd_part,
++ sectors[WRITE]), 1000);
+
+ put_unaligned_le64(host_reads, &slog->host_reads[0]);
+ put_unaligned_le64(data_units_read, &slog->data_units_read[0]);
+@@ -111,11 +113,11 @@ static u16 nvmet_get_smart_log_all(struct nvmet_req *req,
+ if (!ns->bdev)
+ continue;
+ host_reads += part_stat_read(ns->bdev->bd_part, ios[READ]);
+- data_units_read +=
+- part_stat_read(ns->bdev->bd_part, sectors[READ]);
++ data_units_read += DIV_ROUND_UP(
++ part_stat_read(ns->bdev->bd_part, sectors[READ]), 1000);
+ host_writes += part_stat_read(ns->bdev->bd_part, ios[WRITE]);
+- data_units_written +=
+- part_stat_read(ns->bdev->bd_part, sectors[WRITE]);
++ data_units_written += DIV_ROUND_UP(
++ part_stat_read(ns->bdev->bd_part, sectors[WRITE]), 1000);
+
+ }
+ rcu_read_unlock();
+--
+2.20.1
+
--- /dev/null
+From cf1b4ef1d96069a3199012c334d317c554baa36c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2019 11:20:55 -0300
+Subject: perf config: Honour $PERF_CONFIG env var to specify alternate
+ .perfconfig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 61a461fcbd62d42c29a1ea6a9cc3838ad9f49401 ]
+
+We had this comment in Documentation/perf_counter/config.c, i.e. since
+when we got this from the git sources, but never really did that
+getenv("PERF_CONFIG"), do it now as I need to disable whatever
+~/.perfconfig root has so that tests parsing tool output are done for
+the expected default output or that we specify an alternate config file
+that when read will make the tools produce expected output.
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Taeung Song <treeze.taeung@gmail.com>
+Fixes: 078006012401 ("perf_counter tools: add in basic glue from Git")
+Link: https://lkml.kernel.org/n/tip-jo209zac9rut0dz1rqvbdlgm@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/perf.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/perf/perf.c b/tools/perf/perf.c
+index 97e2628ea5dd1..d4e4d53e8b44b 100644
+--- a/tools/perf/perf.c
++++ b/tools/perf/perf.c
+@@ -441,6 +441,9 @@ int main(int argc, const char **argv)
+
+ srandom(time(NULL));
+
++ /* Setting $PERF_CONFIG makes perf read _only_ the given config file. */
++ config_exclusive_filename = getenv("PERF_CONFIG");
++
+ err = perf_config(perf_default_config, NULL);
+ if (err)
+ return err;
+--
+2.20.1
+
--- /dev/null
+From 9df697d9a252b6d0bf36530aaa9ecb74da777a36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 16:48:50 -0300
+Subject: perf evlist: Use unshare(CLONE_FS) in sb threads to let
+ setns(CLONE_NEWNS) work
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit b397f8468fa27f08b83b348ffa56a226f72453af ]
+
+When we started using a thread to catch the PERF_RECORD_BPF_EVENT meta
+data events to then ask the kernel for further info (BTF, etc) for BPF
+programs shortly after they get loaded, we forgot to use
+unshare(CLONE_FS) as was done in:
+
+ 868a832918f6 ("perf top: Support lookup of symbols in other mount namespaces.")
+
+Do it so that we can enter the namespaces to read the build-ids at the
+end of a 'perf record' session for the DSOs that had hits.
+
+Before:
+
+Starting a 'stress-ng --cpus 8' inside a container and then, outside the
+container running:
+
+ # perf record -a --namespaces sleep 5
+ # perf buildid-list | grep stress-ng
+ #
+
+We would end up with a 'perf.data' file that had no entry in its
+build-id table for the /usr/bin/stress-ng binary inside the container
+that got tons of PERF_RECORD_SAMPLEs.
+
+After:
+
+ # perf buildid-list | grep stress-ng
+ f2ed02c68341183a124b9b0f6e2e6c493c465b29 /usr/bin/stress-ng
+ #
+
+Then its just a matter of making sure that that binary debuginfo package
+gets available in a place that 'perf report' will look at build-id keyed
+ELF files, which, in my case, on a f30 notebook, was a matter of
+installing the debuginfo file for the distro used in the container,
+fedora 31:
+
+ # rpm -ivh http://fedora.c3sl.ufpr.br/linux/development/31/Everything/x86_64/debug/tree/Packages/s/stress-ng-debuginfo-0.07.29-10.fc31.x86_64.rpm
+
+Then, because perf currently looks for those debuginfo files (richer ELF
+symtab) inside that namespace (look at the setns calls):
+
+ openat(AT_FDCWD, "/proc/self/ns/mnt", O_RDONLY) = 137
+ openat(AT_FDCWD, "/proc/13169/ns/mnt", O_RDONLY) = 139
+ setns(139, CLONE_NEWNS) = 0
+ stat("/usr/bin/stress-ng", {st_mode=S_IFREG|0755, st_size=3065416, ...}) = 0
+ openat(AT_FDCWD, "/usr/bin/stress-ng", O_RDONLY) = 140
+ fcntl(140, F_GETFD) = 0
+ fstat(140, {st_mode=S_IFREG|0755, st_size=3065416, ...}) = 0
+ mmap(NULL, 3065416, PROT_READ, MAP_PRIVATE, 140, 0) = 0x7ff2fdc5b000
+ munmap(0x7ff2fdc5b000, 3065416) = 0
+ close(140) = 0
+ stat("stress-ng-0.07.29-10.fc31.x86_64.debug", 0x7fff45d71260) = -1 ENOENT (No such file or directory)
+ stat("/usr/bin/stress-ng-0.07.29-10.fc31.x86_64.debug", 0x7fff45d71260) = -1 ENOENT (No such file or directory)
+ stat("/usr/bin/.debug/stress-ng-0.07.29-10.fc31.x86_64.debug", 0x7fff45d71260) = -1 ENOENT (No such file or directory)
+ stat("/usr/lib/debug/usr/bin/stress-ng-0.07.29-10.fc31.x86_64.debug", 0x7fff45d71260) = -1 ENOENT (No such file or directory)
+ stat("/root/.debug/.build-id/f2/ed02c68341183a124b9b0f6e2e6c493c465b29", 0x7fff45d711e0) = -1 ENOENT (No such file or directory)
+
+To only then go back to the "host" namespace to look just in the users's
+~/.debug cache:
+
+ setns(137, CLONE_NEWNS) = 0
+ chdir("/root") = 0
+ close(137) = 0
+ close(139) = 0
+ stat("/root/.debug/.build-id/f2/ed02c68341183a124b9b0f6e2e6c493c465b29/elf", 0x7fff45d732e0) = -1 ENOENT (No such file or directory)
+
+It continues to fail to resolve symbols:
+
+ # perf report | grep stress-ng | head -5
+ 9.50% stress-ng-cpu stress-ng [.] 0x0000000000021ac1
+ 8.58% stress-ng-cpu stress-ng [.] 0x0000000000021ab4
+ 8.51% stress-ng-cpu stress-ng [.] 0x0000000000021489
+ 7.17% stress-ng-cpu stress-ng [.] 0x00000000000219b6
+ 3.93% stress-ng-cpu stress-ng [.] 0x0000000000021478
+ #
+
+To overcome that we use:
+
+ # perf buildid-cache -v --add /usr/lib/debug/usr/bin/stress-ng-0.07.29-10.fc31.x86_64.debug
+ Adding f2ed02c68341183a124b9b0f6e2e6c493c465b29 /usr/lib/debug/usr/bin/stress-ng-0.07.29-10.fc31.x86_64.debug: Ok
+ #
+ # ls -la /root/.debug/.build-id/f2/ed02c68341183a124b9b0f6e2e6c493c465b29/elf
+ -rw-r--r--. 3 root root 2401184 Jul 27 07:03 /root/.debug/.build-id/f2/ed02c68341183a124b9b0f6e2e6c493c465b29/elf
+ # file /root/.debug/.build-id/f2/ed02c68341183a124b9b0f6e2e6c493c465b29/elf
+ /root/.debug/.build-id/f2/ed02c68341183a124b9b0f6e2e6c493c465b29/elf: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter \004, BuildID[sha1]=f2ed02c68341183a124b9b0f6e2e6c493c465b29, for GNU/Linux 3.2.0, with debug_info, not stripped, too many notes (256)
+ #
+
+Now it finally works:
+
+ # perf report | grep stress-ng | head -5
+ 23.59% stress-ng-cpu stress-ng [.] ackermann
+ 23.33% stress-ng-cpu stress-ng [.] is_prime
+ 17.36% stress-ng-cpu stress-ng [.] stress_cpu_sieve
+ 6.08% stress-ng-cpu stress-ng [.] stress_cpu_correlate
+ 3.55% stress-ng-cpu stress-ng [.] queens_try
+ #
+
+I'll make sure that it looks for the build-id keyed files in both the
+"host" namespace (the namespace the user running 'perf record' was a the
+time of the recording) and in the container namespace, as it shouldn't
+matter where a content based key lookup finds the ELF file to use in
+resolving symbols, etc.
+
+Reported-by: Karl Rister <krister@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Brendan Gregg <brendan.d.gregg@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Krister Johansen <kjlx@templeofstupid.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stanislav Fomichev <sdf@google.com>
+Cc: Thomas-Mich Richter <tmricht@linux.vnet.ibm.com>
+Fixes: 657ee5531903 ("perf evlist: Introduce side band thread")
+Link: https://lkml.kernel.org/n/tip-g79k0jz41adiaeuqud742t2l@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evlist.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
+index b0364d923f764..070c3bd578827 100644
+--- a/tools/perf/util/evlist.c
++++ b/tools/perf/util/evlist.c
+@@ -20,6 +20,7 @@
+ #include "bpf-event.h"
+ #include <signal.h>
+ #include <unistd.h>
++#include <sched.h>
+
+ #include "parse-events.h"
+ #include <subcmd/parse-options.h>
+@@ -1870,6 +1871,14 @@ static void *perf_evlist__poll_thread(void *arg)
+ struct perf_evlist *evlist = arg;
+ bool draining = false;
+ int i, done = 0;
++ /*
++ * In order to read symbols from other namespaces perf to needs to call
++ * setns(2). This isn't permitted if the struct_fs has multiple users.
++ * unshare(2) the fs so that we may continue to setns into namespaces
++ * that we're observing when, for instance, reading the build-ids at
++ * the end of a 'perf record' session.
++ */
++ unshare(CLONE_FS);
+
+ while (!done) {
+ bool got_data = false;
+--
+2.20.1
+
--- /dev/null
+From 54a277c389061fc501624f51a13426d7b797f5f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 10:44:17 -0400
+Subject: perf ftrace: Use CAP_SYS_ADMIN instead of euid==0
+
+From: Igor Lubashev <ilubashe@akamai.com>
+
+[ Upstream commit c766f3df635de14295e410c6dd5410bc416c24a0 ]
+
+The kernel requires CAP_SYS_ADMIN instead of euid==0 to mount debugfs
+for ftrace. Make perf do the same.
+
+Signed-off-by: Igor Lubashev <ilubashe@akamai.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: James Morris <jmorris@namei.org>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lkml.kernel.org/r/bd8763b72ed4d58d0b42d44fbc7eb474d32e53a3.1565188228.git.ilubashe@akamai.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-ftrace.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
+index 0193128104056..10971255fd2dc 100644
+--- a/tools/perf/builtin-ftrace.c
++++ b/tools/perf/builtin-ftrace.c
+@@ -13,6 +13,7 @@
+ #include <signal.h>
+ #include <fcntl.h>
+ #include <poll.h>
++#include <linux/capability.h>
+
+ #include "debug.h"
+ #include <subcmd/parse-options.h>
+@@ -21,6 +22,7 @@
+ #include "target.h"
+ #include "cpumap.h"
+ #include "thread_map.h"
++#include "util/cap.h"
+ #include "util/config.h"
+
+
+@@ -281,7 +283,7 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace, int argc, const char **argv)
+ .events = POLLIN,
+ };
+
+- if (geteuid() != 0) {
++ if (!perf_cap__capable(CAP_SYS_ADMIN)) {
+ pr_err("ftrace only works for root!\n");
+ return -1;
+ }
+--
+2.20.1
+
--- /dev/null
+From 828441ef4bcf71bd4e5321861b96e2702532aa42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 11:48:57 +0800
+Subject: perf record: Support aarch64 random socket_id assignment
+
+From: Tan Xiaojun <tanxiaojun@huawei.com>
+
+[ Upstream commit 0a4d8fb229dd78f9e0752817339e19e903b37a60 ]
+
+Same as in the commit 01766229533f ("perf record: Support s390 random
+socket_id assignment"), aarch64 also have this problem.
+
+Without this fix:
+
+ [root@localhost perf]# ./perf report --header -I -v
+ ...
+ socket_id number is too big.You may need to upgrade the perf tool.
+
+ # ========
+ # captured on : Thu Aug 1 22:58:38 2019
+ # header version : 1
+ ...
+ # Core ID and Socket ID information is not available
+ ...
+
+With this fix:
+ [root@localhost perf]# ./perf report --header -I -v
+ ...
+ cpumask list: 0-31
+ cpumask list: 32-63
+ cpumask list: 64-95
+ cpumask list: 96-127
+
+ # ========
+ # captured on : Thu Aug 1 22:58:38 2019
+ # header version : 1
+ ...
+ # CPU 0: Core ID 0, Socket ID 36
+ # CPU 1: Core ID 1, Socket ID 36
+ ...
+ # CPU 126: Core ID 126, Socket ID 8442
+ # CPU 127: Core ID 127, Socket ID 8442
+ ...
+
+Signed-off-by: Tan Xiaojun <tanxiaojun@huawei.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
+Link: http://lkml.kernel.org/r/1564717737-21602-1-git-send-email-tanxiaojun@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/header.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 1903d7ec97976..bf7cf12495539 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2251,8 +2251,10 @@ static int process_cpu_topology(struct feat_fd *ff, void *data __maybe_unused)
+ /* On s390 the socket_id number is not related to the numbers of cpus.
+ * The socket_id number might be higher than the numbers of cpus.
+ * This depends on the configuration.
++ * AArch64 is the same.
+ */
+- if (ph->env.arch && !strncmp(ph->env.arch, "s390", 4))
++ if (ph->env.arch && (!strncmp(ph->env.arch, "s390", 4)
++ || !strncmp(ph->env.arch, "aarch64", 7)))
+ do_core_id_test = false;
+
+ for (i = 0; i < (u32)cpu_nr; i++) {
+--
+2.20.1
+
--- /dev/null
+From 453fe87d7a51b3dcdce6c99238eb310e935712a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Aug 2019 14:03:38 -0700
+Subject: perf report: Fix --ns time sort key output
+
+From: Andi Kleen <ak@linux.intel.com>
+
+[ Upstream commit 3dab6ac080dcd7f71cb9ceb84ad7dafecd6f7c07 ]
+
+If the user specified --ns, the column to print the sort time stamp
+wasn't wide enough to actually print the full nanoseconds.
+
+Widen the time key column width when --ns is specified.
+
+Before:
+
+ % perf record -a sleep 1
+ % perf report --sort time,overhead,symbol --stdio --ns
+ ...
+ 2.39% 187851.10000 [k] smp_call_function_single - -
+ 1.53% 187851.10000 [k] intel_idle - -
+ 0.59% 187851.10000 [.] __wcscmp_ifunc - -
+ 0.33% 187851.10000 [.] 0000000000000000 - -
+ 0.28% 187851.10000 [k] cpuidle_enter_state - -
+
+After:
+
+ % perf report --sort time,overhead,symbol --stdio --ns
+ ...
+ 2.39% 187851.100000000 [k] smp_call_function_single - -
+ 1.53% 187851.100000000 [k] intel_idle - -
+ 0.59% 187851.100000000 [.] __wcscmp_ifunc - -
+ 0.33% 187851.100000000 [.] 0000000000000000 - -
+ 0.28% 187851.100000000 [k] cpuidle_enter_state - -
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: http://lkml.kernel.org/r/20190823210338.12360-2-andi@firstfloor.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/hist.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
+index f24fd1954f6c9..6bd270a1e93e0 100644
+--- a/tools/perf/util/hist.c
++++ b/tools/perf/util/hist.c
+@@ -193,7 +193,10 @@ void hists__calc_col_len(struct hists *hists, struct hist_entry *h)
+ hists__new_col_len(hists, HISTC_MEM_LVL, 21 + 3);
+ hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12);
+ hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12);
+- hists__new_col_len(hists, HISTC_TIME, 12);
++ if (symbol_conf.nanosecs)
++ hists__new_col_len(hists, HISTC_TIME, 16);
++ else
++ hists__new_col_len(hists, HISTC_TIME, 12);
+
+ if (h->srcline) {
+ len = MAX(strlen(h->srcline), strlen(sort_srcline.se_header));
+--
+2.20.1
+
--- /dev/null
+From ce9f1e1b78bc932b566e63ae08a88246caa6b4a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 11:27:48 -0500
+Subject: perf script: Fix memory leaks in list_scripts()
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 3b4acbb92dbda4829e021e5c6d5410658849fa1c ]
+
+In case memory resources for *buf* and *paths* were allocated, jump to
+*out* and release them before return.
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Addresses-Coverity-ID: 1444328 ("Resource leak")
+Fixes: 6f3da20e151f ("perf report: Support builtin perf script in scripts menu")
+Link: http://lkml.kernel.org/r/20190408162748.GA21008@embeddedor
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/ui/browsers/scripts.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/ui/browsers/scripts.c b/tools/perf/ui/browsers/scripts.c
+index 4d565cc14076c..0355d4aaf2eed 100644
+--- a/tools/perf/ui/browsers/scripts.c
++++ b/tools/perf/ui/browsers/scripts.c
+@@ -131,8 +131,10 @@ static int list_scripts(char *script_name, bool *custom,
+ int key = ui_browser__input_window("perf script command",
+ "Enter perf script command line (without perf script prefix)",
+ script_args, "", 0);
+- if (key != K_ENTER)
+- return -1;
++ if (key != K_ENTER) {
++ ret = -1;
++ goto out;
++ }
+ sprintf(script_name, "%s script %s", perf, script_args);
+ } else if (choice < num + max_std) {
+ strcpy(script_name, paths[choice]);
+--
+2.20.1
+
--- /dev/null
+From 7700cd5b54251d0fb8b8789bdb91a470eb4967ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2019 11:37:44 -0300
+Subject: perf test vfs_getname: Disable ~/.perfconfig to get default output
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 4fe94ce1c6ba678b5f12b94bb9996eea4fc99e85 ]
+
+To get the expected output we have to ignore whatever changes the user
+has in its ~/.perfconfig file, so set PERF_CONFIG to /dev/null to
+achieve that.
+
+Before:
+
+ # egrep 'trace|show_' ~/.perfconfig
+ [trace]
+ show_zeros = yes
+ show_duration = no
+ show_timestamp = no
+ show_arg_names = no
+ show_prefix = yes
+ # echo $PERF_CONFIG
+
+ # perf test "trace + vfs_getname"
+ 70: Check open filename arg using perf trace + vfs_getname: FAILED!
+ # export PERF_CONFIG=/dev/null
+ # perf test "trace + vfs_getname"
+ 70: Check open filename arg using perf trace + vfs_getname: Ok
+ #
+
+After:
+
+ # egrep 'trace|show_' ~/.perfconfig
+ [trace]
+ show_zeros = yes
+ show_duration = no
+ show_timestamp = no
+ show_arg_names = no
+ show_prefix = yes
+ # echo $PERF_CONFIG
+
+ # perf test "trace + vfs_getname"
+ 70: Check open filename arg using perf trace + vfs_getname: Ok
+ #
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Luis Cláudio Gonçalves <lclaudio@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Taeung Song <treeze.taeung@gmail.com>
+Link: https://lkml.kernel.org/n/tip-3up27pexg5i3exuzqrvt4m8u@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/shell/trace+probe_vfs_getname.sh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+index 45d269b0157eb..11cc2af13f2bb 100755
+--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+@@ -32,6 +32,10 @@ if [ $err -ne 0 ] ; then
+ exit $err
+ fi
+
++# Do not use whatever ~/.perfconfig file, it may change the output
++# via trace.{show_timestamp,show_prefix,etc}
++export PERF_CONFIG=/dev/null
++
+ trace_open_vfs_getname
+ err=$?
+ rm -f ${file}
+--
+2.20.1
+
--- /dev/null
+From fd035185b307d1a1dbf0635b0acac803c5ae2ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 13:22:53 -0700
+Subject: perf tools: Fix paths in include statements
+
+From: Luke Mujica <lukemujica@google.com>
+
+[ Upstream commit 2b75863b0845764529e01014a5c90664d8044cbe ]
+
+These paths point to the wrong location but still work because they get
+picked up by a -I flag that happens to direct to the correct file. Fix
+paths to lead to the actual file location without help from include
+flags.
+
+Signed-off-by: Luke Mujica <lukemujica@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lkml.kernel.org/r/20190719202253.220261-1-lukemujica@google.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/arch/x86/util/kvm-stat.c | 4 ++--
+ tools/perf/arch/x86/util/tsc.c | 6 +++---
+ tools/perf/ui/helpline.c | 4 ++--
+ tools/perf/ui/util.c | 2 +-
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/tools/perf/arch/x86/util/kvm-stat.c b/tools/perf/arch/x86/util/kvm-stat.c
+index 865a9762f22ef..3f84403c0983a 100644
+--- a/tools/perf/arch/x86/util/kvm-stat.c
++++ b/tools/perf/arch/x86/util/kvm-stat.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <errno.h>
+-#include "../../util/kvm-stat.h"
+-#include "../../util/evsel.h"
++#include "../../../util/kvm-stat.h"
++#include "../../../util/evsel.h"
+ #include <asm/svm.h>
+ #include <asm/vmx.h>
+ #include <asm/kvm.h>
+diff --git a/tools/perf/arch/x86/util/tsc.c b/tools/perf/arch/x86/util/tsc.c
+index 950539f9a4f77..b1eb963b4a6e1 100644
+--- a/tools/perf/arch/x86/util/tsc.c
++++ b/tools/perf/arch/x86/util/tsc.c
+@@ -5,10 +5,10 @@
+ #include <linux/stddef.h>
+ #include <linux/perf_event.h>
+
+-#include "../../perf.h"
++#include "../../../perf.h"
+ #include <linux/types.h>
+-#include "../../util/debug.h"
+-#include "../../util/tsc.h"
++#include "../../../util/debug.h"
++#include "../../../util/tsc.h"
+
+ int perf_read_tsc_conversion(const struct perf_event_mmap_page *pc,
+ struct perf_tsc_conversion *tc)
+diff --git a/tools/perf/ui/helpline.c b/tools/perf/ui/helpline.c
+index b3c421429ed44..54bcd08df87e3 100644
+--- a/tools/perf/ui/helpline.c
++++ b/tools/perf/ui/helpline.c
+@@ -3,10 +3,10 @@
+ #include <stdlib.h>
+ #include <string.h>
+
+-#include "../debug.h"
++#include "../util/debug.h"
+ #include "helpline.h"
+ #include "ui.h"
+-#include "../util.h"
++#include "../util/util.h"
+
+ char ui_helpline__current[512];
+
+diff --git a/tools/perf/ui/util.c b/tools/perf/ui/util.c
+index 63bf06e80ab9d..9ed76e88a3e4c 100644
+--- a/tools/perf/ui/util.c
++++ b/tools/perf/ui/util.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include "util.h"
+-#include "../debug.h"
++#include "../util/debug.h"
+
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From cf7ad7599ce619fe9f2552dfa79bfec516cba901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 20:36:25 -0700
+Subject: perf trace beauty ioctl: Fix off-by-one error in cmd->string table
+
+From: Benjamin Peterson <benjamin@python.org>
+
+[ Upstream commit b92675f4a9c02dd78052645597dac9e270679ddf ]
+
+While tracing a program that calls isatty(3), I noticed that strace
+reported TCGETS for the request argument of the underlying ioctl(2)
+syscall while perf trace reported TCSETS. strace is corrrect. The bug in
+perf was due to the tty ioctl beauty table starting at 0x5400 rather
+than 0x5401.
+
+Committer testing:
+
+ Using augmented_raw_syscalls.o and settings to make 'perf trace'
+ use strace formatting, i.e. with this in ~/.perfconfig
+
+ # cat ~/.perfconfig
+ [trace]
+ add_events = /home/acme/git/linux/tools/perf/examples/bpf/augmented_raw_syscalls.c
+ show_zeros = yes
+ show_duration = no
+ no_inherit = yes
+ show_timestamp = no
+ show_arg_names = no
+ args_alignment = 40
+ show_prefix = yes
+
+ # strace -e ioctl stty > /dev/null
+ ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
+ ioctl(1, TIOCGWINSZ, 0x7fff8a9b0860) = -1 ENOTTY (Inappropriate ioctl for device)
+ ioctl(1, TCGETS, 0x7fff8a9b0540) = -1 ENOTTY (Inappropriate ioctl for device)
+ +++ exited with 0 +++
+ #
+
+Before:
+
+ # perf trace -e ioctl stty > /dev/null
+ ioctl(0, TCSETS, 0x7fff2cf79f20) = 0
+ ioctl(1, TIOCSWINSZ, 0x7fff2cf79f40) = -1 ENOTTY (Inappropriate ioctl for device)
+ ioctl(1, TCSETS, 0x7fff2cf79c20) = -1 ENOTTY (Inappropriate ioctl for device)
+ #
+
+After:
+
+ # perf trace -e ioctl stty > /dev/null
+ ioctl(0, TCGETS, 0x7ffed0763920) = 0
+ ioctl(1, TIOCGWINSZ, 0x7ffed0763940) = -1 ENOTTY (Inappropriate ioctl for device)
+ ioctl(1, TCGETS, 0x7ffed0763620) = -1 ENOTTY (Inappropriate ioctl for device)
+ #
+
+Signed-off-by: Benjamin Peterson <benjamin@python.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: 1cc47f2d46206d67285aea0ca7e8450af571da13 ("perf trace beauty ioctl: Improve 'cmd' beautifier")
+Link: http://lkml.kernel.org/r/20190823033625.18814-1-benjamin@python.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/trace/beauty/ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/trace/beauty/ioctl.c b/tools/perf/trace/beauty/ioctl.c
+index 52242fa4072b0..e19eb6ea361d7 100644
+--- a/tools/perf/trace/beauty/ioctl.c
++++ b/tools/perf/trace/beauty/ioctl.c
+@@ -21,7 +21,7 @@
+ static size_t ioctl__scnprintf_tty_cmd(int nr, int dir, char *bf, size_t size)
+ {
+ static const char *ioctl_tty_cmd[] = {
+- "TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW",
++ [_IOC_NR(TCGETS)] = "TCGETS", "TCSETS", "TCSETSW", "TCSETSF", "TCGETA", "TCSETA", "TCSETAW",
+ "TCSETAF", "TCSBRK", "TCXONC", "TCFLSH", "TIOCEXCL", "TIOCNXCL", "TIOCSCTTY",
+ "TIOCGPGRP", "TIOCSPGRP", "TIOCOUTQ", "TIOCSTI", "TIOCGWINSZ", "TIOCSWINSZ",
+ "TIOCMGET", "TIOCMBIS", "TIOCMBIC", "TIOCMSET", "TIOCGSOFTCAR", "TIOCSSOFTCAR",
+--
+2.20.1
+
--- /dev/null
+From 15edab59c8d7e672c4cd1218f3a8b672892fb6ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 11:01:45 +0100
+Subject: perf unwind: Fix libunwind when tid != pid
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit e8ba2906f6b9054102ad035ac9cafad9d4168589 ]
+
+Commit e5adfc3e7e77 ("perf map: Synthesize maps only for thread group
+leader") changed the recording side so that we no longer get mmap events
+for threads other than the thread group leader (when synthesising these
+events for threads which exist before perf is started).
+
+When a file recorded after this change is loaded, the lack of mmap
+records mean that unwinding is not set up for any other threads.
+
+This can be seen in a simple record/report scenario:
+
+ perf record --call-graph=dwarf -t $TID
+ perf report
+
+If $TID is a process ID then the report will show call graphs, but if
+$TID is a secondary thread the output is as if --call-graph=none was
+specified.
+
+Following the rationale in that commit, move the libunwind fields into
+struct map_groups and update the libunwind functions to take this
+instead of the struct thread. This is only required for
+unwind__finish_access which must now be called from map_groups__delete
+and the others are changed for symmetry.
+
+Note that unwind__get_entries keeps the thread argument since it is
+required for symbol lookup and the libdw unwind provider uses the thread
+ID.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: e5adfc3e7e77 ("perf map: Synthesize maps only for thread group leader")
+Link: http://lkml.kernel.org/r/20190815100146.28842-2-john@metanate.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/map.c | 3 ++-
+ tools/perf/util/map_groups.h | 4 +++
+ tools/perf/util/thread.c | 7 +++--
+ tools/perf/util/thread.h | 4 ---
+ tools/perf/util/unwind-libunwind-local.c | 18 ++++++-------
+ tools/perf/util/unwind-libunwind.c | 34 ++++++++++++------------
+ tools/perf/util/unwind.h | 25 ++++++++---------
+ 7 files changed, 48 insertions(+), 47 deletions(-)
+
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 668410b1d426f..7666206d06fa7 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -647,6 +647,7 @@ struct map_groups *map_groups__new(struct machine *machine)
+ void map_groups__delete(struct map_groups *mg)
+ {
+ map_groups__exit(mg);
++ unwind__finish_access(mg);
+ free(mg);
+ }
+
+@@ -887,7 +888,7 @@ int map_groups__clone(struct thread *thread, struct map_groups *parent)
+ if (new == NULL)
+ goto out_unlock;
+
+- err = unwind__prepare_access(thread, new, NULL);
++ err = unwind__prepare_access(mg, new, NULL);
+ if (err)
+ goto out_unlock;
+
+diff --git a/tools/perf/util/map_groups.h b/tools/perf/util/map_groups.h
+index 5f25efa6d6bcd..77252e14008fb 100644
+--- a/tools/perf/util/map_groups.h
++++ b/tools/perf/util/map_groups.h
+@@ -31,6 +31,10 @@ struct map_groups {
+ struct maps maps;
+ struct machine *machine;
+ refcount_t refcnt;
++#ifdef HAVE_LIBUNWIND_SUPPORT
++ void *addr_space;
++ struct unwind_libunwind_ops *unwind_libunwind_ops;
++#endif
+ };
+
+ #define KMAP_NAME_LEN 256
+diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
+index 590793cc51424..bbf7816cba31c 100644
+--- a/tools/perf/util/thread.c
++++ b/tools/perf/util/thread.c
+@@ -105,7 +105,6 @@ void thread__delete(struct thread *thread)
+ }
+ up_write(&thread->comm_lock);
+
+- unwind__finish_access(thread);
+ nsinfo__zput(thread->nsinfo);
+ srccode_state_free(&thread->srccode_state);
+
+@@ -252,7 +251,7 @@ static int ____thread__set_comm(struct thread *thread, const char *str,
+ list_add(&new->list, &thread->comm_list);
+
+ if (exec)
+- unwind__flush_access(thread);
++ unwind__flush_access(thread->mg);
+ }
+
+ thread->comm_set = true;
+@@ -332,7 +331,7 @@ int thread__insert_map(struct thread *thread, struct map *map)
+ {
+ int ret;
+
+- ret = unwind__prepare_access(thread, map, NULL);
++ ret = unwind__prepare_access(thread->mg, map, NULL);
+ if (ret)
+ return ret;
+
+@@ -352,7 +351,7 @@ static int __thread__prepare_access(struct thread *thread)
+ down_read(&maps->lock);
+
+ for (map = maps__first(maps); map; map = map__next(map)) {
+- err = unwind__prepare_access(thread, map, &initialized);
++ err = unwind__prepare_access(thread->mg, map, &initialized);
+ if (err || initialized)
+ break;
+ }
+diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
+index e97ef6977eb91..bf06113be4f3f 100644
+--- a/tools/perf/util/thread.h
++++ b/tools/perf/util/thread.h
+@@ -44,10 +44,6 @@ struct thread {
+ struct thread_stack *ts;
+ struct nsinfo *nsinfo;
+ struct srccode_state srccode_state;
+-#ifdef HAVE_LIBUNWIND_SUPPORT
+- void *addr_space;
+- struct unwind_libunwind_ops *unwind_libunwind_ops;
+-#endif
+ bool filter;
+ int filter_entry_depth;
+ };
+diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
+index 71a788921b621..ebdbb056510cb 100644
+--- a/tools/perf/util/unwind-libunwind-local.c
++++ b/tools/perf/util/unwind-libunwind-local.c
+@@ -616,26 +616,26 @@ static unw_accessors_t accessors = {
+ .get_proc_name = get_proc_name,
+ };
+
+-static int _unwind__prepare_access(struct thread *thread)
++static int _unwind__prepare_access(struct map_groups *mg)
+ {
+- thread->addr_space = unw_create_addr_space(&accessors, 0);
+- if (!thread->addr_space) {
++ mg->addr_space = unw_create_addr_space(&accessors, 0);
++ if (!mg->addr_space) {
+ pr_err("unwind: Can't create unwind address space.\n");
+ return -ENOMEM;
+ }
+
+- unw_set_caching_policy(thread->addr_space, UNW_CACHE_GLOBAL);
++ unw_set_caching_policy(mg->addr_space, UNW_CACHE_GLOBAL);
+ return 0;
+ }
+
+-static void _unwind__flush_access(struct thread *thread)
++static void _unwind__flush_access(struct map_groups *mg)
+ {
+- unw_flush_cache(thread->addr_space, 0, 0);
++ unw_flush_cache(mg->addr_space, 0, 0);
+ }
+
+-static void _unwind__finish_access(struct thread *thread)
++static void _unwind__finish_access(struct map_groups *mg)
+ {
+- unw_destroy_addr_space(thread->addr_space);
++ unw_destroy_addr_space(mg->addr_space);
+ }
+
+ static int get_entries(struct unwind_info *ui, unwind_entry_cb_t cb,
+@@ -660,7 +660,7 @@ static int get_entries(struct unwind_info *ui, unwind_entry_cb_t cb,
+ */
+ if (max_stack - 1 > 0) {
+ WARN_ONCE(!ui->thread, "WARNING: ui->thread is NULL");
+- addr_space = ui->thread->addr_space;
++ addr_space = ui->thread->mg->addr_space;
+
+ if (addr_space == NULL)
+ return -1;
+diff --git a/tools/perf/util/unwind-libunwind.c b/tools/perf/util/unwind-libunwind.c
+index c0811977d7d54..b843f9d0a9ea2 100644
+--- a/tools/perf/util/unwind-libunwind.c
++++ b/tools/perf/util/unwind-libunwind.c
+@@ -11,13 +11,13 @@ struct unwind_libunwind_ops __weak *local_unwind_libunwind_ops;
+ struct unwind_libunwind_ops __weak *x86_32_unwind_libunwind_ops;
+ struct unwind_libunwind_ops __weak *arm64_unwind_libunwind_ops;
+
+-static void unwind__register_ops(struct thread *thread,
++static void unwind__register_ops(struct map_groups *mg,
+ struct unwind_libunwind_ops *ops)
+ {
+- thread->unwind_libunwind_ops = ops;
++ mg->unwind_libunwind_ops = ops;
+ }
+
+-int unwind__prepare_access(struct thread *thread, struct map *map,
++int unwind__prepare_access(struct map_groups *mg, struct map *map,
+ bool *initialized)
+ {
+ const char *arch;
+@@ -28,7 +28,7 @@ int unwind__prepare_access(struct thread *thread, struct map *map,
+ if (!dwarf_callchain_users)
+ return 0;
+
+- if (thread->addr_space) {
++ if (mg->addr_space) {
+ pr_debug("unwind: thread map already set, dso=%s\n",
+ map->dso->name);
+ if (initialized)
+@@ -37,14 +37,14 @@ int unwind__prepare_access(struct thread *thread, struct map *map,
+ }
+
+ /* env->arch is NULL for live-mode (i.e. perf top) */
+- if (!thread->mg->machine->env || !thread->mg->machine->env->arch)
++ if (!mg->machine->env || !mg->machine->env->arch)
+ goto out_register;
+
+- dso_type = dso__type(map->dso, thread->mg->machine);
++ dso_type = dso__type(map->dso, mg->machine);
+ if (dso_type == DSO__TYPE_UNKNOWN)
+ return 0;
+
+- arch = perf_env__arch(thread->mg->machine->env);
++ arch = perf_env__arch(mg->machine->env);
+
+ if (!strcmp(arch, "x86")) {
+ if (dso_type != DSO__TYPE_64BIT)
+@@ -59,37 +59,37 @@ int unwind__prepare_access(struct thread *thread, struct map *map,
+ return 0;
+ }
+ out_register:
+- unwind__register_ops(thread, ops);
++ unwind__register_ops(mg, ops);
+
+- err = thread->unwind_libunwind_ops->prepare_access(thread);
++ err = mg->unwind_libunwind_ops->prepare_access(mg);
+ if (initialized)
+ *initialized = err ? false : true;
+ return err;
+ }
+
+-void unwind__flush_access(struct thread *thread)
++void unwind__flush_access(struct map_groups *mg)
+ {
+ if (!dwarf_callchain_users)
+ return;
+
+- if (thread->unwind_libunwind_ops)
+- thread->unwind_libunwind_ops->flush_access(thread);
++ if (mg->unwind_libunwind_ops)
++ mg->unwind_libunwind_ops->flush_access(mg);
+ }
+
+-void unwind__finish_access(struct thread *thread)
++void unwind__finish_access(struct map_groups *mg)
+ {
+ if (!dwarf_callchain_users)
+ return;
+
+- if (thread->unwind_libunwind_ops)
+- thread->unwind_libunwind_ops->finish_access(thread);
++ if (mg->unwind_libunwind_ops)
++ mg->unwind_libunwind_ops->finish_access(mg);
+ }
+
+ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
+ struct thread *thread,
+ struct perf_sample *data, int max_stack)
+ {
+- if (thread->unwind_libunwind_ops)
+- return thread->unwind_libunwind_ops->get_entries(cb, arg, thread, data, max_stack);
++ if (thread->mg->unwind_libunwind_ops)
++ return thread->mg->unwind_libunwind_ops->get_entries(cb, arg, thread, data, max_stack);
+ return 0;
+ }
+diff --git a/tools/perf/util/unwind.h b/tools/perf/util/unwind.h
+index 8a44a1569a21b..3a7d00c20d862 100644
+--- a/tools/perf/util/unwind.h
++++ b/tools/perf/util/unwind.h
+@@ -6,6 +6,7 @@
+ #include <linux/types.h>
+
+ struct map;
++struct map_groups;
+ struct perf_sample;
+ struct symbol;
+ struct thread;
+@@ -19,9 +20,9 @@ struct unwind_entry {
+ typedef int (*unwind_entry_cb_t)(struct unwind_entry *entry, void *arg);
+
+ struct unwind_libunwind_ops {
+- int (*prepare_access)(struct thread *thread);
+- void (*flush_access)(struct thread *thread);
+- void (*finish_access)(struct thread *thread);
++ int (*prepare_access)(struct map_groups *mg);
++ void (*flush_access)(struct map_groups *mg);
++ void (*finish_access)(struct map_groups *mg);
+ int (*get_entries)(unwind_entry_cb_t cb, void *arg,
+ struct thread *thread,
+ struct perf_sample *data, int max_stack);
+@@ -46,20 +47,20 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg,
+ #endif
+
+ int LIBUNWIND__ARCH_REG_ID(int regnum);
+-int unwind__prepare_access(struct thread *thread, struct map *map,
++int unwind__prepare_access(struct map_groups *mg, struct map *map,
+ bool *initialized);
+-void unwind__flush_access(struct thread *thread);
+-void unwind__finish_access(struct thread *thread);
++void unwind__flush_access(struct map_groups *mg);
++void unwind__finish_access(struct map_groups *mg);
+ #else
+-static inline int unwind__prepare_access(struct thread *thread __maybe_unused,
++static inline int unwind__prepare_access(struct map_groups *mg __maybe_unused,
+ struct map *map __maybe_unused,
+ bool *initialized __maybe_unused)
+ {
+ return 0;
+ }
+
+-static inline void unwind__flush_access(struct thread *thread __maybe_unused) {}
+-static inline void unwind__finish_access(struct thread *thread __maybe_unused) {}
++static inline void unwind__flush_access(struct map_groups *mg __maybe_unused) {}
++static inline void unwind__finish_access(struct map_groups *mg __maybe_unused) {}
+ #endif
+ #else
+ static inline int
+@@ -72,14 +73,14 @@ unwind__get_entries(unwind_entry_cb_t cb __maybe_unused,
+ return 0;
+ }
+
+-static inline int unwind__prepare_access(struct thread *thread __maybe_unused,
++static inline int unwind__prepare_access(struct map_groups *mg __maybe_unused,
+ struct map *map __maybe_unused,
+ bool *initialized __maybe_unused)
+ {
+ return 0;
+ }
+
+-static inline void unwind__flush_access(struct thread *thread __maybe_unused) {}
+-static inline void unwind__finish_access(struct thread *thread __maybe_unused) {}
++static inline void unwind__flush_access(struct map_groups *mg __maybe_unused) {}
++static inline void unwind__finish_access(struct map_groups *mg __maybe_unused) {}
+ #endif /* HAVE_DWARF_UNWIND_SUPPORT */
+ #endif /* __UNWIND_H */
+--
+2.20.1
+
--- /dev/null
+From 9b418fb58c554cb2ac16e019910920b0920a7ab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 21:41:39 -0400
+Subject: platform/x86: intel_pmc_core: Do not ioremap RAM
+
+From: M. Vefa Bicakci <m.v.b@runbox.com>
+
+[ Upstream commit 7d505758b1e556cdf65a5e451744fe0ae8063d17 ]
+
+On a Xen-based PVH virtual machine with more than 4 GiB of RAM,
+intel_pmc_core fails initialization with the following warning message
+from the kernel, indicating that the driver is attempting to ioremap
+RAM:
+
+ ioremap on RAM at 0x00000000fe000000 - 0x00000000fe001fff
+ WARNING: CPU: 1 PID: 434 at arch/x86/mm/ioremap.c:186 __ioremap_caller.constprop.0+0x2aa/0x2c0
+...
+ Call Trace:
+ ? pmc_core_probe+0x87/0x2d0 [intel_pmc_core]
+ pmc_core_probe+0x87/0x2d0 [intel_pmc_core]
+
+This issue appears to manifest itself because of the following fallback
+mechanism in the driver:
+
+ if (lpit_read_residency_count_address(&slp_s0_addr))
+ pmcdev->base_addr = PMC_BASE_ADDR_DEFAULT;
+
+The validity of address PMC_BASE_ADDR_DEFAULT (i.e., 0xFE000000) is not
+verified by the driver, which is what this patch introduces. With this
+patch, if address PMC_BASE_ADDR_DEFAULT is in RAM, then the driver will
+not attempt to ioremap the aforementioned address.
+
+Signed-off-by: M. Vefa Bicakci <m.v.b@runbox.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_pmc_core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/intel_pmc_core.c b/drivers/platform/x86/intel_pmc_core.c
+index c510d0d724759..3b6b8dcc47678 100644
+--- a/drivers/platform/x86/intel_pmc_core.c
++++ b/drivers/platform/x86/intel_pmc_core.c
+@@ -878,10 +878,14 @@ static int pmc_core_probe(struct platform_device *pdev)
+ if (pmcdev->map == &spt_reg_map && !pci_dev_present(pmc_pci_ids))
+ pmcdev->map = &cnp_reg_map;
+
+- if (lpit_read_residency_count_address(&slp_s0_addr))
++ if (lpit_read_residency_count_address(&slp_s0_addr)) {
+ pmcdev->base_addr = PMC_BASE_ADDR_DEFAULT;
+- else
++
++ if (page_is_ram(PHYS_PFN(pmcdev->base_addr)))
++ return -ENODEV;
++ } else {
+ pmcdev->base_addr = slp_s0_addr - pmcdev->map->slp_s0_offset;
++ }
+
+ pmcdev->regbase = ioremap(pmcdev->base_addr,
+ pmcdev->map->regmap_length);
+--
+2.20.1
+
--- /dev/null
+From 284e3e0de050248b07d961c31932338a4fccb770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 21:41:40 -0400
+Subject: platform/x86: intel_pmc_core_pltdrv: Module removal warning fix
+
+From: M. Vefa Bicakci <m.v.b@runbox.com>
+
+[ Upstream commit 0b43e41e93815ecd9616759cf5d64d3a7be8e6fb ]
+
+Prior to this commit, removing the intel_pmc_core_pltdrv module
+would cause the following warning:
+
+ Device 'intel_pmc_core.0' does not have a release() function, it is broken and must be fixed. See Documentation/kobject.txt.
+ WARNING: CPU: 0 PID: 2202 at drivers/base/core.c:1238 device_release+0x6f/0x80
+
+This commit hence adds an empty release function for the driver.
+
+Signed-off-by: M. Vefa Bicakci <m.v.b@runbox.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_pmc_core_pltdrv.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/intel_pmc_core_pltdrv.c b/drivers/platform/x86/intel_pmc_core_pltdrv.c
+index a8754a6db1b8b..186540014c480 100644
+--- a/drivers/platform/x86/intel_pmc_core_pltdrv.c
++++ b/drivers/platform/x86/intel_pmc_core_pltdrv.c
+@@ -18,8 +18,16 @@
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+
++static void intel_pmc_core_release(struct device *dev)
++{
++ /* Nothing to do. */
++}
++
+ static struct platform_device pmc_core_device = {
+ .name = "intel_pmc_core",
++ .dev = {
++ .release = intel_pmc_core_release,
++ },
+ };
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 4710491e6bf289f0ee291154a030534dfe5a15d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 15:38:35 +0200
+Subject: PM / devfreq: exynos-bus: Correct clock enable sequence
+
+From: Kamil Konieczny <k.konieczny@partner.samsung.com>
+
+[ Upstream commit 2c2b20e0da89c76759ee28c6824413ab2fa3bfc6 ]
+
+Regulators should be enabled before clocks to avoid h/w hang. This
+require change in exynos_bus_probe() to move exynos_bus_parse_of()
+after exynos_bus_parent_parse_of() and change in error handling.
+Similar change is needed in exynos_bus_exit() where clock should be
+disabled before regulators.
+
+Signed-off-by: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/exynos-bus.c | 31 +++++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/devfreq/exynos-bus.c b/drivers/devfreq/exynos-bus.c
+index d9f377912c104..7c06df8bd74fe 100644
+--- a/drivers/devfreq/exynos-bus.c
++++ b/drivers/devfreq/exynos-bus.c
+@@ -191,11 +191,10 @@ static void exynos_bus_exit(struct device *dev)
+ if (ret < 0)
+ dev_warn(dev, "failed to disable the devfreq-event devices\n");
+
+- if (bus->regulator)
+- regulator_disable(bus->regulator);
+-
+ dev_pm_opp_of_remove_table(dev);
+ clk_disable_unprepare(bus->clk);
++ if (bus->regulator)
++ regulator_disable(bus->regulator);
+ }
+
+ /*
+@@ -383,6 +382,7 @@ static int exynos_bus_probe(struct platform_device *pdev)
+ struct exynos_bus *bus;
+ int ret, max_state;
+ unsigned long min_freq, max_freq;
++ bool passive = false;
+
+ if (!np) {
+ dev_err(dev, "failed to find devicetree node\n");
+@@ -396,27 +396,27 @@ static int exynos_bus_probe(struct platform_device *pdev)
+ bus->dev = &pdev->dev;
+ platform_set_drvdata(pdev, bus);
+
+- /* Parse the device-tree to get the resource information */
+- ret = exynos_bus_parse_of(np, bus);
+- if (ret < 0)
+- return ret;
+-
+ profile = devm_kzalloc(dev, sizeof(*profile), GFP_KERNEL);
+- if (!profile) {
+- ret = -ENOMEM;
+- goto err;
+- }
++ if (!profile)
++ return -ENOMEM;
+
+ node = of_parse_phandle(dev->of_node, "devfreq", 0);
+ if (node) {
+ of_node_put(node);
+- goto passive;
++ passive = true;
+ } else {
+ ret = exynos_bus_parent_parse_of(np, bus);
++ if (ret < 0)
++ return ret;
+ }
+
++ /* Parse the device-tree to get the resource information */
++ ret = exynos_bus_parse_of(np, bus);
+ if (ret < 0)
+- goto err;
++ goto err_reg;
++
++ if (passive)
++ goto passive;
+
+ /* Initialize the struct profile and governor data for parent device */
+ profile->polling_ms = 50;
+@@ -507,6 +507,9 @@ static int exynos_bus_probe(struct platform_device *pdev)
+ err:
+ dev_pm_opp_of_remove_table(dev);
+ clk_disable_unprepare(bus->clk);
++err_reg:
++ if (!passive)
++ regulator_disable(bus->regulator);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From bcdefcf0c995410c1481b572cb9929d052c598c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 18:39:49 -0300
+Subject: PM / devfreq: Fix kernel oops on governor module load
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 7544fd7f384591038646d3cd9efb311ab4509e24 ]
+
+A bit unexpectedly (but still documented), request_module may
+return a positive value, in case of a modprobe error.
+This is currently causing issues in the devfreq framework.
+
+When a request_module exits with a positive value, we currently
+return that via ERR_PTR. However, because the value is positive,
+it's not a ERR_VALUE proper, and is therefore treated as a
+valid struct devfreq_governor pointer, leading to a kernel oops.
+
+Fix this by returning -EINVAL if request_module returns a positive
+value.
+
+Fixes: b53b0128052ff ("PM / devfreq: Fix static checker warning in try_then_request_governor")
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/devfreq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index ab22bf8a12d69..a0e19802149fc 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -254,7 +254,7 @@ static struct devfreq_governor *try_then_request_governor(const char *name)
+ /* Restore previous state before return */
+ mutex_lock(&devfreq_list_lock);
+ if (err)
+- return ERR_PTR(err);
++ return (err < 0) ? ERR_PTR(err) : ERR_PTR(-EINVAL);
+
+ governor = find_devfreq_governor(name);
+ }
+--
+2.20.1
+
--- /dev/null
+From 303d1025556f7291a5b00d843a1c84d86fe8b418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2019 21:37:37 +0900
+Subject: PM / devfreq: passive: fix compiler warning
+
+From: MyungJoo Ham <myungjoo.ham@samsung.com>
+
+[ Upstream commit 0465814831a926ce2f83e8f606d067d86745234e ]
+
+The recent commit of
+PM / devfreq: passive: Use non-devm notifiers
+had incurred compiler warning, "unused variable 'dev'".
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/governor_passive.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c
+index da485477065c5..be6eeab9c814e 100644
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -149,7 +149,6 @@ static int devfreq_passive_notifier_call(struct notifier_block *nb,
+ static int devfreq_passive_event_handler(struct devfreq *devfreq,
+ unsigned int event, void *data)
+ {
+- struct device *dev = devfreq->dev.parent;
+ struct devfreq_passive_data *p_data
+ = (struct devfreq_passive_data *)devfreq->data;
+ struct devfreq *parent = (struct devfreq *)p_data->parent;
+--
+2.20.1
+
--- /dev/null
+From ef86c7bee87c037a43f1a878d63e12c4524514a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 19:54:08 +0300
+Subject: PM / devfreq: passive: Use non-devm notifiers
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 0ef7c7cce43f6ecc2b96d447e69b2900a9655f7c ]
+
+The devfreq passive governor registers and unregisters devfreq
+transition notifiers on DEVFREQ_GOV_START/GOV_STOP using devm wrappers.
+
+If devfreq itself is registered with devm then a warning is triggered on
+rmmod from devm_devfreq_unregister_notifier. Call stack looks like this:
+
+ devm_devfreq_unregister_notifier+0x30/0x40
+ devfreq_passive_event_handler+0x4c/0x88
+ devfreq_remove_device.part.8+0x6c/0x9c
+ devm_devfreq_dev_release+0x18/0x20
+ release_nodes+0x1b0/0x220
+ devres_release_all+0x78/0x84
+ device_release_driver_internal+0x100/0x1c0
+ driver_detach+0x4c/0x90
+ bus_remove_driver+0x7c/0xd0
+ driver_unregister+0x2c/0x58
+ platform_driver_unregister+0x10/0x18
+ imx_devfreq_platdrv_exit+0x14/0xd40 [imx_devfreq]
+
+This happens because devres_release_all will first remove all the nodes
+into a separate todo list so the nested devres_release from
+devm_devfreq_unregister_notifier won't find anything.
+
+Fix the warning by calling the non-devm APIS for frequency notification.
+Using devm wrappers is not actually useful for a governor anyway: it
+relies on the devfreq core to correctly match the GOV_START/GOV_STOP
+notifications.
+
+Fixes: 996133119f57 ("PM / devfreq: Add new passive governor")
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/governor_passive.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c
+index 58308948b8637..da485477065c5 100644
+--- a/drivers/devfreq/governor_passive.c
++++ b/drivers/devfreq/governor_passive.c
+@@ -165,12 +165,12 @@ static int devfreq_passive_event_handler(struct devfreq *devfreq,
+ p_data->this = devfreq;
+
+ nb->notifier_call = devfreq_passive_notifier_call;
+- ret = devm_devfreq_register_notifier(dev, parent, nb,
++ ret = devfreq_register_notifier(parent, nb,
+ DEVFREQ_TRANSITION_NOTIFIER);
+ break;
+ case DEVFREQ_GOV_STOP:
+- devm_devfreq_unregister_notifier(dev, parent, nb,
+- DEVFREQ_TRANSITION_NOTIFIER);
++ WARN_ON(devfreq_unregister_notifier(parent, nb,
++ DEVFREQ_TRANSITION_NOTIFIER));
+ break;
+ default:
+ break;
+--
+2.20.1
+
--- /dev/null
+From 5f86b167d78d7844ec9fa049d1ae65b569e3038b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 16:31:46 +0200
+Subject: posix-cpu-timers: Sanitize bogus WARNONS
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 692117c1f7a6770ed41dd8f277cd9fed1dfb16f1 ]
+
+Warning when p == NULL and then proceeding and dereferencing p does not
+make any sense as the kernel will crash with a NULL pointer dereference
+right away.
+
+Bailing out when p == NULL and returning an error code does not cure the
+underlying problem which caused p to be NULL. Though it might allow to
+do proper debugging.
+
+Same applies to the clock id check in set_process_cpu_timer().
+
+Clean them up and make them return without trying to do further damage.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Link: https://lkml.kernel.org/r/20190819143801.846497772@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/posix-cpu-timers.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
+index 0a426f4e31251..5bbad147a90cf 100644
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -375,7 +375,8 @@ static int posix_cpu_timer_del(struct k_itimer *timer)
+ struct sighand_struct *sighand;
+ struct task_struct *p = timer->it.cpu.task;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return -EINVAL;
+
+ /*
+ * Protect against sighand release/switch in exit/exec and process/
+@@ -580,7 +581,8 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
+ u64 old_expires, new_expires, old_incr, val;
+ int ret;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return -EINVAL;
+
+ /*
+ * Use the to_ktime conversion because that clamps the maximum
+@@ -715,10 +717,11 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
+
+ static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec64 *itp)
+ {
+- u64 now;
+ struct task_struct *p = timer->it.cpu.task;
++ u64 now;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return;
+
+ /*
+ * Easy part: convert the reload time.
+@@ -1000,12 +1003,13 @@ static void check_process_timers(struct task_struct *tsk,
+ */
+ static void posix_cpu_timer_rearm(struct k_itimer *timer)
+ {
++ struct task_struct *p = timer->it.cpu.task;
+ struct sighand_struct *sighand;
+ unsigned long flags;
+- struct task_struct *p = timer->it.cpu.task;
+ u64 now;
+
+- WARN_ON_ONCE(p == NULL);
++ if (WARN_ON_ONCE(!p))
++ return;
+
+ /*
+ * Fetch the current sample and update the timer's expiry time.
+@@ -1202,7 +1206,9 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
+ u64 now;
+ int ret;
+
+- WARN_ON_ONCE(clock_idx == CPUCLOCK_SCHED);
++ if (WARN_ON_ONCE(clock_idx >= CPUCLOCK_SCHED))
++ return;
++
+ ret = cpu_timer_sample_group(clock_idx, tsk, &now);
+
+ if (oldval && ret != -EINVAL) {
+--
+2.20.1
+
--- /dev/null
+From 99eaea8d082c851bc01ae0dc44b5f54cf8103e71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 17:23:19 +1000
+Subject: powerpc/Makefile: Always pass --synthetic to nm if supported
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 117acf5c29dd89e4c86761c365b9724dba0d9763 ]
+
+Back in 2004 we added logic to arch/ppc64/Makefile to pass
+the --synthetic option to nm, if it was supported by nm.
+
+Then in 2005 when arch/ppc64 and arch/ppc were merged, the logic to
+add --synthetic was moved inside an #ifdef CONFIG_PPC64 block within
+arch/powerpc/Makefile, and has remained there since.
+
+That was fine, though crufty, until recently when a change to
+init/Kconfig added a config time check that uses $(NM). On powerpc
+that leads to an infinite loop because Kconfig uses $(NM) to calculate
+some values, then the powerpc Makefile changes $(NM), which Kconfig
+notices and restarts.
+
+The original commit that added --synthetic simply said:
+ On new toolchains we need to use nm --synthetic or we miss code
+ symbols.
+
+And the nm man page says that the --synthetic option causes nm to:
+ Include synthetic symbols in the output. These are special symbols
+ created by the linker for various purposes.
+
+So it seems safe to always pass --synthetic if nm supports it, ie. on
+32-bit and 64-bit, it just means 32-bit kernels might have more
+symbols reported (and in practice I see no extra symbols). Making it
+unconditional avoids the #ifdef CONFIG_PPC64, which in turn avoids the
+infinite loop.
+
+Debugged-by: Peter Collingbourne <pcc@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index c345b79414a96..403f7e193833a 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -39,13 +39,11 @@ endif
+ uname := $(shell uname -m)
+ KBUILD_DEFCONFIG := $(if $(filter ppc%,$(uname)),$(uname),ppc64)_defconfig
+
+-ifdef CONFIG_PPC64
+ new_nm := $(shell if $(NM) --help 2>&1 | grep -- '--synthetic' > /dev/null; then echo y; else echo n; fi)
+
+ ifeq ($(new_nm),y)
+ NM := $(NM) --synthetic
+ endif
+-endif
+
+ # BITS is used as extension for files which are available in a 32 bit
+ # and a 64 bit version to simplify shared Makefiles.
+--
+2.20.1
+
--- /dev/null
+From 93cd785cd44b081ad22e94da8240f825132dfb07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2019 09:21:33 -0400
+Subject: raid5: don't increment read_errors on EILSEQ return
+
+From: Nigel Croxon <ncroxon@redhat.com>
+
+[ Upstream commit b76b4715eba0d0ed574f58918b29c1b2f0fa37a8 ]
+
+While MD continues to count read errors returned by the lower layer.
+If those errors are -EILSEQ, instead of -EIO, it should NOT increase
+the read_errors count.
+
+When RAID6 is set up on dm-integrity target that detects massive
+corruption, the leg will be ejected from the array. Even if the
+issue is correctable with a sector re-write and the array has
+necessary redundancy to correct it.
+
+The leg is ejected because it runs up the rdev->read_errors beyond
+conf->max_nr_stripes. The return status in dm-drypt when there is
+a data integrity error is -EILSEQ (BLK_STS_PROTECTION).
+
+Signed-off-by: Nigel Croxon <ncroxon@redhat.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid5.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 21514edb2bea3..d574701185db9 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2526,7 +2526,8 @@ static void raid5_end_read_request(struct bio * bi)
+ int set_bad = 0;
+
+ clear_bit(R5_UPTODATE, &sh->dev[i].flags);
+- atomic_inc(&rdev->read_errors);
++ if (!(bi->bi_status == BLK_STS_PROTECTION))
++ atomic_inc(&rdev->read_errors);
+ if (test_bit(R5_ReadRepl, &sh->dev[i].flags))
+ pr_warn_ratelimited(
+ "md/raid:%s: read error on replacement device (sector %llu on %s).\n",
+--
+2.20.1
+
--- /dev/null
+From a67dc31e9e7721b2d0f6c411a85d3e4beadd6f7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 10:06:29 +0200
+Subject: raid5: don't set STRIPE_HANDLE to stripe which is in batch list
+
+From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+
+[ Upstream commit 6ce220dd2f8ea71d6afc29b9a7524c12e39f374a ]
+
+If stripe in batch list is set with STRIPE_HANDLE flag, then the stripe
+could be set with STRIPE_ACTIVE by the handle_stripe function. And if
+error happens to the batch_head at the same time, break_stripe_batch_list
+is called, then below warning could happen (the same report in [1]), it
+means a member of batch list was set with STRIPE_ACTIVE.
+
+[7028915.431770] stripe state: 2001
+[7028915.431815] ------------[ cut here ]------------
+[7028915.431828] WARNING: CPU: 18 PID: 29089 at drivers/md/raid5.c:4614 break_stripe_batch_list+0x203/0x240 [raid456]
+[...]
+[7028915.431879] CPU: 18 PID: 29089 Comm: kworker/u82:5 Tainted: G O 4.14.86-1-storage #4.14.86-1.2~deb9
+[7028915.431881] Hardware name: Supermicro SSG-2028R-ACR24L/X10DRH-iT, BIOS 3.1 06/18/2018
+[7028915.431888] Workqueue: raid5wq raid5_do_work [raid456]
+[7028915.431890] task: ffff9ab0ef36d7c0 task.stack: ffffb72926f84000
+[7028915.431896] RIP: 0010:break_stripe_batch_list+0x203/0x240 [raid456]
+[7028915.431898] RSP: 0018:ffffb72926f87ba8 EFLAGS: 00010286
+[7028915.431900] RAX: 0000000000000012 RBX: ffff9aaa84a98000 RCX: 0000000000000000
+[7028915.431901] RDX: 0000000000000000 RSI: ffff9ab2bfa15458 RDI: ffff9ab2bfa15458
+[7028915.431902] RBP: ffff9aaa8fb4e900 R08: 0000000000000001 R09: 0000000000002eb4
+[7028915.431903] R10: 00000000ffffffff R11: 0000000000000000 R12: ffff9ab1736f1b00
+[7028915.431904] R13: 0000000000000000 R14: ffff9aaa8fb4e900 R15: 0000000000000001
+[7028915.431906] FS: 0000000000000000(0000) GS:ffff9ab2bfa00000(0000) knlGS:0000000000000000
+[7028915.431907] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[7028915.431908] CR2: 00007ff953b9f5d8 CR3: 0000000bf4009002 CR4: 00000000003606e0
+[7028915.431909] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[7028915.431910] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[7028915.431910] Call Trace:
+[7028915.431923] handle_stripe+0x8e7/0x2020 [raid456]
+[7028915.431930] ? __wake_up_common_lock+0x89/0xc0
+[7028915.431935] handle_active_stripes.isra.58+0x35f/0x560 [raid456]
+[7028915.431939] raid5_do_work+0xc6/0x1f0 [raid456]
+
+Also commit 59fc630b8b5f9f ("RAID5: batch adjacent full stripe write")
+said "If a stripe is added to batch list, then only the first stripe
+of the list should be put to handle_list and run handle_stripe."
+
+So don't set STRIPE_HANDLE to stripe which is already in batch list,
+otherwise the stripe could be put to handle_list and run handle_stripe,
+then the above warning could be triggered.
+
+[1]. https://www.spinics.net/lists/raid/msg62552.html
+
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid5.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 3de4e13bde984..21514edb2bea3 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5718,7 +5718,8 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi)
+ do_flush = false;
+ }
+
+- set_bit(STRIPE_HANDLE, &sh->state);
++ if (!sh->batch_head)
++ set_bit(STRIPE_HANDLE, &sh->state);
+ clear_bit(STRIPE_DELAYED, &sh->state);
+ if ((!sh->batch_head || sh == sh->batch_head) &&
+ (bi->bi_opf & REQ_SYNC) &&
+--
+2.20.1
+
--- /dev/null
+From f9b1134887828d12665315c0b69897ba9d0bcd45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 16:32:27 +0200
+Subject: RAS: Build debugfs.o only when enabled in Kconfig
+
+From: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+
+[ Upstream commit b6ff24f7b5101101ff897dfdde3f37924e676bc2 ]
+
+In addition, the 0day bot reported this build error:
+
+ >> drivers/ras/debugfs.c:10:5: error: redefinition of 'ras_userspace_consumers'
+ int ras_userspace_consumers(void)
+ ^~~~~~~~~~~~~~~~~~~~~~~
+ In file included from drivers/ras/debugfs.c:3:0:
+ include/linux/ras.h:14:19: note: previous definition of 'ras_userspace_consumers' was here
+ static inline int ras_userspace_consumers(void) { return 0; }
+ ^~~~~~~~~~~~~~~~~~~~~~~
+
+for a riscv-specific .config where CONFIG_DEBUG_FS is not set. Fix all
+that by making debugfs.o depend on that define.
+
+ [ bp: Rewrite commit message. ]
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: linux-edac@vger.kernel.org
+Cc: x86@kernel.org
+Link: http://lkml.kernel.org/r/7053.1565218556@turing-police
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ras/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ras/Makefile b/drivers/ras/Makefile
+index ef6777e14d3df..6f0404f501071 100644
+--- a/drivers/ras/Makefile
++++ b/drivers/ras/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-obj-$(CONFIG_RAS) += ras.o debugfs.o
++obj-$(CONFIG_RAS) += ras.o
++obj-$(CONFIG_DEBUG_FS) += debugfs.o
+ obj-$(CONFIG_RAS_CEC) += cec.o
+--
+2.20.1
+
--- /dev/null
+From 70cca939be565452842c8b298c9ac828c0dfdc93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 18:59:29 -0400
+Subject: RAS: Fix prototype warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valdis Klētnieks <valdis.kletnieks@vt.edu>
+
+[ Upstream commit 0a54b809a3a2c31e1055b45b03708eb730222be1 ]
+
+When building with C=2 and/or W=1, legitimate warnings are issued about
+missing prototypes:
+
+ CHECK drivers/ras/debugfs.c
+ drivers/ras/debugfs.c:4:15: warning: symbol 'ras_debugfs_dir' was not declared. Should it be static?
+ drivers/ras/debugfs.c:8:5: warning: symbol 'ras_userspace_consumers' was not declared. Should it be static?
+ drivers/ras/debugfs.c:38:12: warning: symbol 'ras_add_daemon_trace' was not declared. Should it be static?
+ drivers/ras/debugfs.c:54:13: warning: symbol 'ras_debugfs_init' was not declared. Should it be static?
+ CC drivers/ras/debugfs.o
+ drivers/ras/debugfs.c:8:5: warning: no previous prototype for 'ras_userspace_consumers' [-Wmissing-prototypes]
+ 8 | int ras_userspace_consumers(void)
+ | ^~~~~~~~~~~~~~~~~~~~~~~
+ drivers/ras/debugfs.c:38:12: warning: no previous prototype for 'ras_add_daemon_trace' [-Wmissing-prototypes]
+ 38 | int __init ras_add_daemon_trace(void)
+ | ^~~~~~~~~~~~~~~~~~~~
+ drivers/ras/debugfs.c:54:13: warning: no previous prototype for 'ras_debugfs_init' [-Wmissing-prototypes]
+ 54 | void __init ras_debugfs_init(void)
+ | ^~~~~~~~~~~~~~~~
+
+Provide the proper includes.
+
+ [ bp: Take care of the same warnings for cec.c too. ]
+
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: linux-edac@vger.kernel.org
+Cc: x86@kernel.org
+Link: http://lkml.kernel.org/r/7168.1565218769@turing-police
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ras/cec.c | 1 +
+ drivers/ras/debugfs.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
+index 5d545806d9303..c09cf55e2d204 100644
+--- a/drivers/ras/cec.c
++++ b/drivers/ras/cec.c
+@@ -4,6 +4,7 @@
+ */
+ #include <linux/mm.h>
+ #include <linux/gfp.h>
++#include <linux/ras.h>
+ #include <linux/kernel.h>
+ #include <linux/workqueue.h>
+
+diff --git a/drivers/ras/debugfs.c b/drivers/ras/debugfs.c
+index 9c1b717efad86..0d4f985afbf37 100644
+--- a/drivers/ras/debugfs.c
++++ b/drivers/ras/debugfs.c
+@@ -1,5 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ #include <linux/debugfs.h>
++#include <linux/ras.h>
++#include "debugfs.h"
+
+ struct dentry *ras_debugfs_dir;
+
+--
+2.20.1
+
--- /dev/null
+From a600b2a07133528549fb15851b682ec3d4e39347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2019 15:42:51 -0700
+Subject: rcu: Add destroy_work_on_stack() to match INIT_WORK_ONSTACK()
+
+From: Paul E. McKenney <paulmck@linux.ibm.com>
+
+[ Upstream commit fbad01af8c3bb9618848abde8054ab7e0c2330fe ]
+
+The synchronize_rcu_expedited() function has an INIT_WORK_ONSTACK(),
+but lacks the corresponding destroy_work_on_stack(). This commit
+therefore adds destroy_work_on_stack().
+
+Reported-by: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Paul E. McKenney <paulmck@linux.ibm.com>
+Acked-by: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_exp.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index af7e7b9c86afa..513b403b683b7 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -792,6 +792,7 @@ static int rcu_print_task_exp_stall(struct rcu_node *rnp)
+ */
+ void synchronize_rcu_expedited(void)
+ {
++ bool boottime = (rcu_scheduler_active == RCU_SCHEDULER_INIT);
+ struct rcu_exp_work rew;
+ struct rcu_node *rnp;
+ unsigned long s;
+@@ -817,7 +818,7 @@ void synchronize_rcu_expedited(void)
+ return; /* Someone else did our work for us. */
+
+ /* Ensure that load happens before action based on it. */
+- if (unlikely(rcu_scheduler_active == RCU_SCHEDULER_INIT)) {
++ if (unlikely(boottime)) {
+ /* Direct call during scheduler init and early_initcalls(). */
+ rcu_exp_sel_wait_wake(s);
+ } else {
+@@ -835,5 +836,8 @@ void synchronize_rcu_expedited(void)
+
+ /* Let the next expedited grace period start. */
+ mutex_unlock(&rcu_state.exp_mutex);
++
++ if (likely(!boottime))
++ destroy_work_on_stack(&rew.rew_work);
+ }
+ EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+--
+2.20.1
+
--- /dev/null
+From dbd599b8bc1757a51d76813fbfc3c8ad0aed963c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 15:59:59 +0200
+Subject: rcu/tree: Call setschedule() gp ktread to SCHED_FIFO outside of
+ atomic region
+
+From: Juri Lelli <juri.lelli@redhat.com>
+
+[ Upstream commit 1a763fd7c6335e3122c1cc09576ef6c99ada4267 ]
+
+sched_setscheduler() needs to acquire cpuset_rwsem, but it is currently
+called from an invalid (atomic) context by rcu_spawn_gp_kthread().
+
+Fix that by simply moving sched_setscheduler_nocheck() call outside of
+the atomic region, as it doesn't actually require to be guarded by
+rcu_node lock.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: bristot@redhat.com
+Cc: claudio@evidence.eu.com
+Cc: lizefan@huawei.com
+Cc: longman@redhat.com
+Cc: luca.abeni@santannapisa.it
+Cc: mathieu.poirier@linaro.org
+Cc: rostedt@goodmis.org
+Cc: tj@kernel.org
+Cc: tommaso.cucinotta@santannapisa.it
+Link: https://lkml.kernel.org/r/20190719140000.31694-8-juri.lelli@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index a14e5fbbea467..eb764c24bc4d4 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -3234,13 +3234,13 @@ static int __init rcu_spawn_gp_kthread(void)
+ t = kthread_create(rcu_gp_kthread, NULL, "%s", rcu_state.name);
+ if (WARN_ONCE(IS_ERR(t), "%s: Could not start grace-period kthread, OOM is now expected behavior\n", __func__))
+ return 0;
++ if (kthread_prio)
++ sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+ rnp = rcu_get_root();
+ raw_spin_lock_irqsave_rcu_node(rnp, flags);
+ rcu_state.gp_kthread = t;
+- if (kthread_prio) {
++ if (kthread_prio)
+ sp.sched_priority = kthread_prio;
+- sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+- }
+ raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+ wake_up_process(t);
+ rcu_spawn_nocb_kthreads();
+--
+2.20.1
+
--- /dev/null
+From ed3803f6017a1f62539fb896bd4e63d8034c6f4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 21:26:32 +0800
+Subject: regulator: lm363x: Fix n_voltages setting for lm36274
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 962f170d9344e5d9edb3903971c591f42d55e226 ]
+
+According to the datasheet http://www.ti.com/lit/ds/symlink/lm36274.pdf:
+Table 23. VPOS Bias Register Field Descriptions VPOS[5:0]:
+VPOS voltage (50-mV steps): VPOS = 4 V + (Code × 50 mV), 6.5 V max
+000000 = 4 V
+000001 = 4.05 V
+:
+011110 = 5.5 V (Default)
+:
+110010 = 6.5 V
+110011 to 111111 map to 6.5 V
+
+So the LM36274_LDO_VSEL_MAX should be 0b110010 (0x32).
+The valid selectors are 0 ... LM36274_LDO_VSEL_MAX, n_voltages should be
+LM36274_LDO_VSEL_MAX + 1. Similarly, the n_voltages should be
+LM36274_BOOST_VSEL_MAX + 1 for LM36274_BOOST.
+
+Fixes: bff5e8071533 ("regulator: lm363x: Add support for LM36274")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Link: https://lore.kernel.org/r/20190626132632.32629-2-axel.lin@ingics.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/lm363x-regulator.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/lm363x-regulator.c b/drivers/regulator/lm363x-regulator.c
+index e4a27d63bf901..4b9f618b07e97 100644
+--- a/drivers/regulator/lm363x-regulator.c
++++ b/drivers/regulator/lm363x-regulator.c
+@@ -36,7 +36,7 @@
+
+ /* LM36274 */
+ #define LM36274_BOOST_VSEL_MAX 0x3f
+-#define LM36274_LDO_VSEL_MAX 0x34
++#define LM36274_LDO_VSEL_MAX 0x32
+ #define LM36274_VOLTAGE_MIN 4000000
+
+ /* Common */
+@@ -226,7 +226,7 @@ static const struct regulator_desc lm363x_regulator_desc[] = {
+ .of_match = "vboost",
+ .id = LM36274_BOOST,
+ .ops = &lm363x_boost_voltage_table_ops,
+- .n_voltages = LM36274_BOOST_VSEL_MAX,
++ .n_voltages = LM36274_BOOST_VSEL_MAX + 1,
+ .min_uV = LM36274_VOLTAGE_MIN,
+ .uV_step = LM363X_STEP_50mV,
+ .type = REGULATOR_VOLTAGE,
+@@ -239,7 +239,7 @@ static const struct regulator_desc lm363x_regulator_desc[] = {
+ .of_match = "vpos",
+ .id = LM36274_LDO_POS,
+ .ops = &lm363x_regulator_voltage_table_ops,
+- .n_voltages = LM36274_LDO_VSEL_MAX,
++ .n_voltages = LM36274_LDO_VSEL_MAX + 1,
+ .min_uV = LM36274_VOLTAGE_MIN,
+ .uV_step = LM363X_STEP_50mV,
+ .type = REGULATOR_VOLTAGE,
+@@ -254,7 +254,7 @@ static const struct regulator_desc lm363x_regulator_desc[] = {
+ .of_match = "vneg",
+ .id = LM36274_LDO_NEG,
+ .ops = &lm363x_regulator_voltage_table_ops,
+- .n_voltages = LM36274_LDO_VSEL_MAX,
++ .n_voltages = LM36274_LDO_VSEL_MAX + 1,
+ .min_uV = LM36274_VOLTAGE_MIN,
+ .uV_step = LM363X_STEP_50mV,
+ .type = REGULATOR_VOLTAGE,
+--
+2.20.1
+
--- /dev/null
+From 4cf4cf27acd0f897bb95c650c1ec57bbf0b12663 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 21:26:31 +0800
+Subject: regulator: lm363x: Fix off-by-one n_voltages for lm3632
+ ldo_vpos/ldo_vneg
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 1e2cc8c5e0745b545d4974788dc606d678b6e564 ]
+
+According to the datasheet https://www.ti.com/lit/ds/symlink/lm3632a.pdf
+Table 20. VPOS Bias Register Field Descriptions VPOS[5:0]
+Sets the Positive Display Bias (LDO) Voltage (50 mV per step)
+000000: 4 V
+000001: 4.05 V
+000010: 4.1 V
+....................
+011101: 5.45 V
+011110: 5.5 V (Default)
+011111: 5.55 V
+....................
+100111: 5.95 V
+101000: 6 V
+Note: Codes 101001 to 111111 map to 6 V
+
+The LM3632_LDO_VSEL_MAX should be 0b101000 (0x28), so the maximum voltage
+can match the datasheet.
+
+Fixes: 3a8d1a73a037 ("regulator: add LM363X driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Link: https://lore.kernel.org/r/20190626132632.32629-1-axel.lin@ingics.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/lm363x-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/lm363x-regulator.c b/drivers/regulator/lm363x-regulator.c
+index 5647e2f97ff8d..e4a27d63bf901 100644
+--- a/drivers/regulator/lm363x-regulator.c
++++ b/drivers/regulator/lm363x-regulator.c
+@@ -30,7 +30,7 @@
+
+ /* LM3632 */
+ #define LM3632_BOOST_VSEL_MAX 0x26
+-#define LM3632_LDO_VSEL_MAX 0x29
++#define LM3632_LDO_VSEL_MAX 0x28
+ #define LM3632_VBOOST_MIN 4500000
+ #define LM3632_VLDO_MIN 4000000
+
+--
+2.20.1
+
--- /dev/null
+From 856b52ed5718eb3ec3769d9bbf791a4ab4ae2b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 09:38:17 +0200
+Subject: s390/crypto: xts-aes-s390 fix extra run-time crypto self tests
+ finding
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 9e323d45ba94262620a073a3f9945ca927c07c71 ]
+
+With 'extra run-time crypto self tests' enabled, the selftest
+for s390-xts fails with
+
+ alg: skcipher: xts-aes-s390 encryption unexpectedly succeeded on
+ test vector "random: len=0 klen=64"; expected_error=-22,
+ cfg="random: inplace use_digest nosimd src_divs=[2.61%@+4006,
+ 84.44%@+21, 1.55%@+13, 4.50%@+344, 4.26%@+21, 2.64%@+27]"
+
+This special case with nbytes=0 is not handled correctly and this
+fix now makes sure that -EINVAL is returned when there is en/decrypt
+called with 0 bytes to en/decrypt.
+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/crypto/aes_s390.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index d00f84add5f4c..6d2dbb5089d5c 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -586,6 +586,9 @@ static int xts_aes_encrypt(struct blkcipher_desc *desc,
+ struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm);
+ struct blkcipher_walk walk;
+
++ if (!nbytes)
++ return -EINVAL;
++
+ if (unlikely(!xts_ctx->fc))
+ return xts_fallback_encrypt(desc, dst, src, nbytes);
+
+@@ -600,6 +603,9 @@ static int xts_aes_decrypt(struct blkcipher_desc *desc,
+ struct s390_xts_ctx *xts_ctx = crypto_blkcipher_ctx(desc->tfm);
+ struct blkcipher_walk walk;
+
++ if (!nbytes)
++ return -EINVAL;
++
+ if (unlikely(!xts_ctx->fc))
+ return xts_fallback_decrypt(desc, dst, src, nbytes);
+
+--
+2.20.1
+
--- /dev/null
+From cedc61cf269b769ca835d92bfc50e2e1cc593c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 15:52:07 +0200
+Subject: s390/kasan: provide uninstrumented __strlen
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit f45f7b5bdaa4828ce871cf03f7c01599a0de57a5 ]
+
+s390 kasan code uses sclp_early_printk to report initialization
+failures. The code doing that should not be instrumented, because kasan
+shadow memory has not been set up yet. Even though sclp_early_core.c is
+compiled with instrumentation disabled it uses strlen function, which
+is instrumented and would produce shadow memory access if used. To
+avoid that, introduce uninstrumented __strlen function to be used
+instead.
+
+Before commit 7e0d92f00246 ("s390/kasan: improve string/memory functions
+checks") few string functions (including strlen) were escaping kasan
+instrumentation due to usage of platform specific versions which are
+implemented in inline assembly.
+
+Fixes: 7e0d92f00246 ("s390/kasan: improve string/memory functions checks")
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/string.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/include/asm/string.h b/arch/s390/include/asm/string.h
+index 70d87db54e627..4c0690fc5167e 100644
+--- a/arch/s390/include/asm/string.h
++++ b/arch/s390/include/asm/string.h
+@@ -71,11 +71,16 @@ extern void *__memmove(void *dest, const void *src, size_t n);
+ #define memcpy(dst, src, len) __memcpy(dst, src, len)
+ #define memmove(dst, src, len) __memmove(dst, src, len)
+ #define memset(s, c, n) __memset(s, c, n)
++#define strlen(s) __strlen(s)
++
++#define __no_sanitize_prefix_strfunc(x) __##x
+
+ #ifndef __NO_FORTIFY
+ #define __NO_FORTIFY /* FORTIFY_SOURCE uses __builtin_memcpy, etc. */
+ #endif
+
++#else
++#define __no_sanitize_prefix_strfunc(x) x
+ #endif /* defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__) */
+
+ void *__memset16(uint16_t *s, uint16_t v, size_t count);
+@@ -163,8 +168,8 @@ static inline char *strcpy(char *dst, const char *src)
+ }
+ #endif
+
+-#ifdef __HAVE_ARCH_STRLEN
+-static inline size_t strlen(const char *s)
++#if defined(__HAVE_ARCH_STRLEN) || (defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__))
++static inline size_t __no_sanitize_prefix_strfunc(strlen)(const char *s)
+ {
+ register unsigned long r0 asm("0") = 0;
+ const char *tmp = s;
+--
+2.20.1
+
--- /dev/null
+From ec9e3af2c6188dc8d71a06db7b7f117bf1fa2a92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 08:34:55 +0200
+Subject: sched/core: Fix CPU controller for !RT_GROUP_SCHED
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juri Lelli <juri.lelli@redhat.com>
+
+[ Upstream commit a07db5c0865799ebed1f88be0df50c581fb65029 ]
+
+On !CONFIG_RT_GROUP_SCHED configurations it is currently not possible to
+move RT tasks between cgroups to which CPU controller has been attached;
+but it is oddly possible to first move tasks around and then make them
+RT (setschedule to FIFO/RR).
+
+E.g.:
+
+ # mkdir /sys/fs/cgroup/cpu,cpuacct/group1
+ # chrt -fp 10 $$
+ # echo $$ > /sys/fs/cgroup/cpu,cpuacct/group1/tasks
+ bash: echo: write error: Invalid argument
+ # chrt -op 0 $$
+ # echo $$ > /sys/fs/cgroup/cpu,cpuacct/group1/tasks
+ # chrt -fp 10 $$
+ # cat /sys/fs/cgroup/cpu,cpuacct/group1/tasks
+ 2345
+ 2598
+ # chrt -p 2345
+ pid 2345's current scheduling policy: SCHED_FIFO
+ pid 2345's current scheduling priority: 10
+
+Also, as Michal noted, it is currently not possible to enable CPU
+controller on unified hierarchy with !CONFIG_RT_GROUP_SCHED (if there
+are any kernel RT threads in root cgroup, they can't be migrated to the
+newly created CPU controller's root in cgroup_update_dfl_csses()).
+
+Existing code comes with a comment saying the "we don't support RT-tasks
+being in separate groups". Such comment is however stale and belongs to
+pre-RT_GROUP_SCHED times. Also, it doesn't make much sense for
+!RT_GROUP_ SCHED configurations, since checks related to RT bandwidth
+are not performed at all in these cases.
+
+Make moving RT tasks between CPU controller groups viable by removing
+special case check for RT (and DEADLINE) tasks.
+
+Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Michal Koutný <mkoutny@suse.com>
+Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: lizefan@huawei.com
+Cc: longman@redhat.com
+Cc: luca.abeni@santannapisa.it
+Cc: rostedt@goodmis.org
+Link: https://lkml.kernel.org/r/20190719063455.27328-1-juri.lelli@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 7fa8e74ad2ab4..d38f007afea74 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6980,10 +6980,6 @@ static int cpu_cgroup_can_attach(struct cgroup_taskset *tset)
+ #ifdef CONFIG_RT_GROUP_SCHED
+ if (!sched_rt_can_attach(css_tg(css), task))
+ return -EINVAL;
+-#else
+- /* We don't support RT-tasks being in separate groups */
+- if (task->sched_class != &fair_sched_class)
+- return -EINVAL;
+ #endif
+ /*
+ * Serialize against wake_up_new_task() such that if its
+--
+2.20.1
+
--- /dev/null
+From 90ee26967bc6da790e8bae141a48a19f3c7b00ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Aug 2019 16:33:40 +0100
+Subject: sched/cpufreq: Align trace event behavior of fast switching
+
+From: Douglas RAILLARD <douglas.raillard@arm.com>
+
+[ Upstream commit 77c84dd1881d0f0176cb678d770bfbda26c54390 ]
+
+Fast switching path only emits an event for the CPU of interest, whereas the
+regular path emits an event for all the CPUs that had their frequency changed,
+i.e. all the CPUs sharing the same policy.
+
+With the current behavior, looking at cpu_frequency event for a given CPU that
+is using the fast switching path will not give the correct frequency signal.
+
+Signed-off-by: Douglas RAILLARD <douglas.raillard@arm.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cpufreq_schedutil.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 867b4bb6d4beb..b03ca2f73713d 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -117,6 +117,7 @@ static void sugov_fast_switch(struct sugov_policy *sg_policy, u64 time,
+ unsigned int next_freq)
+ {
+ struct cpufreq_policy *policy = sg_policy->policy;
++ int cpu;
+
+ if (!sugov_update_next_freq(sg_policy, time, next_freq))
+ return;
+@@ -126,7 +127,11 @@ static void sugov_fast_switch(struct sugov_policy *sg_policy, u64 time,
+ return;
+
+ policy->cur = next_freq;
+- trace_cpu_frequency(next_freq, smp_processor_id());
++
++ if (trace_cpu_frequency_enabled()) {
++ for_each_cpu(cpu, policy->cpus)
++ trace_cpu_frequency(next_freq, cpu);
++ }
+ }
+
+ static void sugov_deferred_update(struct sugov_policy *sg_policy, u64 time,
+--
+2.20.1
+
--- /dev/null
+From e1dc2c0fc172e70040b6d315a16c2fe9d4c67ccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 15:59:56 +0200
+Subject: sched/deadline: Fix bandwidth accounting at all levels after offline
+ migration
+
+From: Juri Lelli <juri.lelli@redhat.com>
+
+[ Upstream commit 59d06cea1198d665ba11f7e8c5f45b00ff2e4812 ]
+
+If a task happens to be throttled while the CPU it was running on gets
+hotplugged off, the bandwidth associated with the task is not correctly
+migrated with it when the replenishment timer fires (offline_migration).
+
+Fix things up, for this_bw, running_bw and total_bw, when replenishment
+timer fires and task is migrated (dl_task_offline_migration()).
+
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: bristot@redhat.com
+Cc: claudio@evidence.eu.com
+Cc: lizefan@huawei.com
+Cc: longman@redhat.com
+Cc: luca.abeni@santannapisa.it
+Cc: mathieu.poirier@linaro.org
+Cc: rostedt@goodmis.org
+Cc: tj@kernel.org
+Cc: tommaso.cucinotta@santannapisa.it
+Link: https://lkml.kernel.org/r/20190719140000.31694-5-juri.lelli@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 46122edd8552c..20951112b6cdd 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -529,6 +529,7 @@ static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq);
+ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p)
+ {
+ struct rq *later_rq = NULL;
++ struct dl_bw *dl_b;
+
+ later_rq = find_lock_later_rq(p, rq);
+ if (!later_rq) {
+@@ -557,6 +558,38 @@ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p
+ double_lock_balance(rq, later_rq);
+ }
+
++ if (p->dl.dl_non_contending || p->dl.dl_throttled) {
++ /*
++ * Inactive timer is armed (or callback is running, but
++ * waiting for us to release rq locks). In any case, when it
++ * will fire (or continue), it will see running_bw of this
++ * task migrated to later_rq (and correctly handle it).
++ */
++ sub_running_bw(&p->dl, &rq->dl);
++ sub_rq_bw(&p->dl, &rq->dl);
++
++ add_rq_bw(&p->dl, &later_rq->dl);
++ add_running_bw(&p->dl, &later_rq->dl);
++ } else {
++ sub_rq_bw(&p->dl, &rq->dl);
++ add_rq_bw(&p->dl, &later_rq->dl);
++ }
++
++ /*
++ * And we finally need to fixup root_domain(s) bandwidth accounting,
++ * since p is still hanging out in the old (now moved to default) root
++ * domain.
++ */
++ dl_b = &rq->rd->dl_bw;
++ raw_spin_lock(&dl_b->lock);
++ __dl_sub(dl_b, p->dl.dl_bw, cpumask_weight(rq->rd->span));
++ raw_spin_unlock(&dl_b->lock);
++
++ dl_b = &later_rq->rd->dl_bw;
++ raw_spin_lock(&dl_b->lock);
++ __dl_add(dl_b, p->dl.dl_bw, cpumask_weight(later_rq->rd->span));
++ raw_spin_unlock(&dl_b->lock);
++
+ set_task_cpu(p, later_rq->cpu);
+ double_unlock_balance(later_rq, rq);
+
+--
+2.20.1
+
--- /dev/null
+From 3bb09a2bec0e90f7ca81ac72fcfdd90a60623788 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2019 17:47:02 +0200
+Subject: sched/fair: Fix imbalance due to CPU affinity
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit f6cad8df6b30a5d2bbbd2e698f74b4cafb9fb82b ]
+
+The load_balance() has a dedicated mecanism to detect when an imbalance
+is due to CPU affinity and must be handled at parent level. In this case,
+the imbalance field of the parent's sched_group is set.
+
+The description of sg_imbalanced() gives a typical example of two groups
+of 4 CPUs each and 4 tasks each with a cpumask covering 1 CPU of the first
+group and 3 CPUs of the second group. Something like:
+
+ { 0 1 2 3 } { 4 5 6 7 }
+ * * * *
+
+But the load_balance fails to fix this UC on my octo cores system
+made of 2 clusters of quad cores.
+
+Whereas the load_balance is able to detect that the imbalanced is due to
+CPU affinity, it fails to fix it because the imbalance field is cleared
+before letting parent level a chance to run. In fact, when the imbalance is
+detected, the load_balance reruns without the CPU with pinned tasks. But
+there is no other running tasks in the situation described above and
+everything looks balanced this time so the imbalance field is immediately
+cleared.
+
+The imbalance field should not be cleared if there is no other task to move
+when the imbalance is detected.
+
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/1561996022-28829-1-git-send-email-vincent.guittot@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 500f5db0de0ba..105b1aead0c3a 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9052,9 +9052,10 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ out_balanced:
+ /*
+ * We reach balance although we may have faced some affinity
+- * constraints. Clear the imbalance flag if it was set.
++ * constraints. Clear the imbalance flag only if other tasks got
++ * a chance to move and fix the imbalance.
+ */
+- if (sd_parent) {
++ if (sd_parent && !(env.flags & LBF_ALL_PINNED)) {
+ int *group_imbalance = &sd_parent->groups->sgc->imbalance;
+
+ if (*group_imbalance)
+--
+2.20.1
+
--- /dev/null
+From 1e98e61551cb2c331f47d10f34294f0524378999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 09:37:49 -0400
+Subject: sched/fair: Use rq_lock/unlock in online_fair_sched_group
+
+From: Phil Auld <pauld@redhat.com>
+
+[ Upstream commit a46d14eca7b75fffe35603aa8b81df654353d80f ]
+
+Enabling WARN_DOUBLE_CLOCK in /sys/kernel/debug/sched_features causes
+warning to fire in update_rq_clock. This seems to be caused by onlining
+a new fair sched group not using the rq lock wrappers.
+
+ [] rq->clock_update_flags & RQCF_UPDATED
+ [] WARNING: CPU: 5 PID: 54385 at kernel/sched/core.c:210 update_rq_clock+0xec/0x150
+
+ [] Call Trace:
+ [] online_fair_sched_group+0x53/0x100
+ [] cpu_cgroup_css_online+0x16/0x20
+ [] online_css+0x1c/0x60
+ [] cgroup_apply_control_enable+0x231/0x3b0
+ [] cgroup_mkdir+0x41b/0x530
+ [] kernfs_iop_mkdir+0x61/0xa0
+ [] vfs_mkdir+0x108/0x1a0
+ [] do_mkdirat+0x77/0xe0
+ [] do_syscall_64+0x55/0x1d0
+ [] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Using the wrappers in online_fair_sched_group instead of the raw locking
+removes this warning.
+
+[ tglx: Use rq_*lock_irq() ]
+
+Signed-off-by: Phil Auld <pauld@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20190801133749.11033-1-pauld@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 105b1aead0c3a..86cfc5d5129ce 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -10301,18 +10301,18 @@ int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent)
+ void online_fair_sched_group(struct task_group *tg)
+ {
+ struct sched_entity *se;
++ struct rq_flags rf;
+ struct rq *rq;
+ int i;
+
+ for_each_possible_cpu(i) {
+ rq = cpu_rq(i);
+ se = tg->se[i];
+-
+- raw_spin_lock_irq(&rq->lock);
++ rq_lock_irq(rq, &rf);
+ update_rq_clock(rq);
+ attach_entity_cfs_rq(se);
+ sync_throttle(tg, i);
+- raw_spin_unlock_irq(&rq->lock);
++ rq_unlock_irq(rq, &rf);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 742847ba935ca70ad746c373e92582becd145b72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 18:34:52 +0800
+Subject: sched/psi: Correct overly pessimistic size calculation
+
+From: Miles Chen <miles.chen@mediatek.com>
+
+[ Upstream commit 4adcdcea717cb2d8436bef00dd689aa5bc76f11b ]
+
+When passing a equal or more then 32 bytes long string to psi_write(),
+psi_write() copies 31 bytes to its buf and overwrites buf[30]
+with '\0'. Which makes the input string 1 byte shorter than
+it should be.
+
+Fix it by copying sizeof(buf) bytes when nbytes >= sizeof(buf).
+
+This does not cause problems in normal use case like:
+"some 500000 10000000" or "full 500000 10000000" because they
+are less than 32 bytes in length.
+
+ /* assuming nbytes == 35 */
+ char buf[32];
+
+ buf_size = min(nbytes, (sizeof(buf) - 1)); /* buf_size = 31 */
+ if (copy_from_user(buf, user_buf, buf_size))
+ return -EFAULT;
+
+ buf[buf_size - 1] = '\0'; /* buf[30] = '\0' */
+
+Before:
+
+ %cd /proc/pressure/
+ %echo "123456789|123456789|123456789|1234" > memory
+ [ 22.473497] nbytes=35,buf_size=31
+ [ 22.473775] 123456789|123456789|123456789| (print 30 chars)
+ %sh: write error: Invalid argument
+
+ %echo "123456789|123456789|123456789|1" > memory
+ [ 64.916162] nbytes=32,buf_size=31
+ [ 64.916331] 123456789|123456789|123456789| (print 30 chars)
+ %sh: write error: Invalid argument
+
+After:
+
+ %cd /proc/pressure/
+ %echo "123456789|123456789|123456789|1234" > memory
+ [ 254.837863] nbytes=35,buf_size=32
+ [ 254.838541] 123456789|123456789|123456789|1 (print 31 chars)
+ %sh: write error: Invalid argument
+
+ %echo "123456789|123456789|123456789|1" > memory
+ [ 9965.714935] nbytes=32,buf_size=32
+ [ 9965.715096] 123456789|123456789|123456789|1 (print 31 chars)
+ %sh: write error: Invalid argument
+
+Also remove the superfluous parentheses.
+
+Signed-off-by: Miles Chen <miles.chen@mediatek.com>
+Cc: <linux-mediatek@lists.infradead.org>
+Cc: <wsd_upstream@mediatek.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20190912103452.13281-1-miles.chen@mediatek.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/psi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 6e52b67b420e7..517e3719027e6 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -1198,7 +1198,7 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,
+ if (static_branch_likely(&psi_disabled))
+ return -EOPNOTSUPP;
+
+- buf_size = min(nbytes, (sizeof(buf) - 1));
++ buf_size = min(nbytes, sizeof(buf));
+ if (copy_from_user(buf, user_buf, buf_size))
+ return -EFAULT;
+
+--
+2.20.1
+
ax25-enforce-cap_net_raw-for-raw-sockets.patch
ieee802154-enforce-cap_net_raw-for-raw-sockets.patch
nfc-enforce-cap_net_raw-for-raw-sockets.patch
+alsa-hda-flush-interrupts-on-disabling.patch
+asoc-sof-intel-hda-make-hdac_device-device-managed.patch
+cpufreq-ap806-add-null-check-after-kcalloc.patch
+alsa-hda-hdmi-don-t-report-spurious-jack-state-chang.patch
+regulator-lm363x-fix-off-by-one-n_voltages-for-lm363.patch
+regulator-lm363x-fix-n_voltages-setting-for-lm36274.patch
+spi-dw-mmio-clock-should-be-shut-when-error-occurs.patch
+asoc-tlv320aic31xx-suppress-error-message-for-eprobe.patch
+asoc-sgtl5000-fix-of-unmute-outputs-on-probe.patch
+asoc-sgtl5000-fix-charge-pump-source-assignment.patch
+firmware-qcom_scm-use-proper-types-for-dma-mappings.patch
+dmaengine-bcm2835-print-error-in-case-setting-dma-ma.patch
+leds-leds-lp5562-allow-firmware-files-up-to-the-maxi.patch
+asoc-sof-reset-dma-state-in-prepare.patch
+media-dib0700-fix-link-error-for-dibx000_i2c_set_spe.patch
+media-mtk-cir-lower-de-glitch-counter-for-rc-mm-prot.patch
+asoc-sof-pci-mark-last_busy-value-at-runtime-pm-init.patch
+media-exynos4-is-fix-leaked-of_node-references.patch
+media-vivid-add-sanity-check-to-avoid-divide-error-a.patch
+media-vb2-reorder-checks-in-vb2_poll.patch
+media-vivid-work-around-high-stack-usage-with-clang.patch
+media-hdpvr-add-device-num-check-and-handling.patch
+media-i2c-ov5640-check-for-devm_gpiod_get_optional-e.patch
+time-tick-broadcast-fix-tick_broadcast_offline-lockd.patch
+sched-fair-fix-imbalance-due-to-cpu-affinity.patch
+sched-core-fix-cpu-controller-for-rt_group_sched.patch
+x86-apic-make-apic_pending_intr_clear-more-robust.patch
+sched-deadline-fix-bandwidth-accounting-at-all-level.patch
+x86-reboot-always-use-nmi-fallback-when-shutdown-via.patch
+rcu-tree-call-setschedule-gp-ktread-to-sched_fifo-ou.patch
+x86-apic-soft-disable-apic-before-initializing-it.patch
+alsa-hda-show-the-fatal-corb-rirb-error-more-clearly.patch
+alsa-i2c-ak4xxx-adda-fix-a-possible-null-pointer-der.patch
+rcu-add-destroy_work_on_stack-to-match-init_work_ons.patch
+edac-mc-fix-grain_bits-calculation.patch
+arm64-dts-imx8mq-correct-opp-table-according-to-late.patch
+media-iguanair-add-sanity-checks.patch
+cpuidle-teo-allow-tick-to-be-stopped-if-pm-qos-is-us.patch
+gpio-madera-add-support-for-cirrus-logic-cs47l15.patch
+gpio-madera-add-support-for-cirrus-logic-cs47l92.patch
+arm64-mm-free-the-initrd-reserved-memblock-in-a-alig.patch
+soc-amlogic-meson-clk-measure-protect-measure-with-a.patch
+base-soc-export-soc_device_register-unregister-apis.patch
+alsa-usb-audio-skip-bsynchaddress-endpoint-check-if-.patch
+ia64-unwind-fix-double-free-for-mod-arch.init_unw_ta.patch
+edac-altera-use-the-proper-type-for-the-irq-status-b.patch
+asoc-rsnd-don-t-call-clk_get_rate-under-atomic-conte.patch
+arm64-prefetch-fix-a-wtype-limits-warning.patch
+md-raid1-end-bio-when-the-device-faulty.patch
+md-don-t-call-spare_active-in-md_reap_sync_thread-if.patch
+md-don-t-set-in_sync-if-array-is-frozen.patch
+media-media-platform-fsl-viu.c-fix-build-for-microbl.patch
+media-staging-tegra-vde-fix-build-error.patch
+ras-fix-prototype-warnings.patch
+ras-build-debugfs.o-only-when-enabled-in-kconfig.patch
+asoc-hdac_hda-fix-page-fault-issue-by-removing-race.patch
+acpi-processor-don-t-print-errors-for-processorids-0.patch
+loop-add-loop_set_direct_io-to-compat-ioctl.patch
+perf-tools-fix-paths-in-include-statements.patch
+edac-pnd2-fix-ioremap-size-in-dnv_rd_reg.patch
+efi-cper-print-aer-info-of-pcie-fatal-error.patch
+firmware-arm_scmi-check-if-platform-has-released-shm.patch
+sched-fair-use-rq_lock-unlock-in-online_fair_sched_g.patch
+idle-prevent-late-arriving-interrupts-from-disruptin.patch
+blk-mq-fix-memory-leak-in-blk_mq_init_allocated_queu.patch
+media-gspca-zero-usb_buf-on-error.patch
+perf-config-honour-perf_config-env-var-to-specify-al.patch
+perf-test-vfs_getname-disable-.perfconfig-to-get-def.patch
+media-mtk-mdp-fix-reference-count-on-old-device-tree.patch
+media-i2c-tda1997x-prevent-potential-null-pointer-ac.patch
+media-fdp1-reduce-fcp-not-found-message-level-to-deb.patch
+media-em28xx-modules-workqueue-not-inited-for-2nd-de.patch
+arm64-efi-move-variable-assignments-after-sections.patch
+perf-unwind-fix-libunwind-when-tid-pid.patch
+media-rc-imon-allow-imon-rc-protocol-for-ffdc-7e-dev.patch
+dmaengine-iop-adma-use-correct-printk-format-strings.patch
+arm-xscale-fix-multi-cpu-compilation.patch
+perf-ftrace-use-cap_sys_admin-instead-of-euid-0.patch
+perf-record-support-aarch64-random-socket_id-assignm.patch
+media-vsp1-fix-memory-leak-of-dl-on-error-return-pat.patch
+media-i2c-ov5645-fix-power-sequence.patch
+media-omap3isp-don-t-set-streaming-state-on-random-s.patch
+media-imx-mipi-csi-2-don-t-fail-if-initial-state-tim.patch
+kasan-arm64-fix-config_kasan_sw_tags-kasan_inline.patch
+net-lpc-enet-fix-printk-format-strings.patch
+m68k-prevent-some-compiler-warnings-in-coldfire-buil.patch
+arm-dts-imx7d-cl-som-imx7-make-ethernet-work-again.patch
+arm64-dts-qcom-qcs404-evb-mark-wcss-clocks-protected.patch
+arm-dts-imx7-colibri-disable-hs400.patch
+x86-platform-intel-iosf_mbi-rewrite-locking.patch
+media-radio-si470x-kill-urb-on-error.patch
+media-hdpvr-add-terminating-0-at-end-of-string.patch
+asoc-uniphier-fix-double-reset-assersion-when-transi.patch
+powerpc-makefile-always-pass-synthetic-to-nm-if-supp.patch
+tools-headers-fixup-bitsperlong-per-arch-includes.patch
+asoc-sun4i-i2s-don-t-use-the-oversample-to-calculate.patch
+asoc-mchp-i2s-mcc-wait-for-rx-tx-rdy-only-if-control.patch
+led-triggers-fix-a-memory-leak-bug.patch
+asoc-mchp-i2s-mcc-fix-unprepare-of-gclk.patch
+nbd-add-missing-config-put.patch
+acpi-apei-release-resources-if-gen_pool_add-fails.patch
+arm64-entry-move-ct_user_exit-before-any-other-excep.patch
+s390-kasan-provide-uninstrumented-__strlen.patch
+media-mceusb-fix-eliminate-tx-ir-signal-length-limit.patch
+media-dvb-frontends-use-ida-for-pll-number.patch
+posix-cpu-timers-sanitize-bogus-warnons.patch
+media-dvb-core-fix-a-memory-leak-bug.patch
+edac-amd64-support-more-than-two-controllers-for-chi.patch
+cpufreq-imx-cpufreq-dt-add-i.mx8mn-support.patch
+libperf-fix-alignment-trap-with-xyarray-contents-in-.patch
+edac-amd64-recognize-dram-device-type-ecc-capability.patch
+edac-amd64-decode-syndrome-before-translating-addres.patch
+arm-at91-move-platform-specific-asm-offset.h-to-arch.patch
+soc-renesas-rmobile-sysc-set-genpd_flag_always_on-fo.patch
+soc-renesas-enable-arm_errata_754322-for-affected-co.patch
+pm-devfreq-fix-kernel-oops-on-governor-module-load.patch
+arm-omap2-move-platform-specific-asm-offset.h-to-arc.patch
+pm-devfreq-passive-use-non-devm-notifiers.patch
+pm-devfreq-exynos-bus-correct-clock-enable-sequence.patch
+media-cec-notifier-clear-cec_adap-in-cec_notifier_un.patch
+media-saa7146-add-cleanup-in-hexium_attach.patch
+media-cpia2_usb-fix-memory-leaks.patch
+media-saa7134-fix-terminology-around-saa7134_i2c_eep.patch
+perf-trace-beauty-ioctl-fix-off-by-one-error-in-cmd-.patch
+perf-report-fix-ns-time-sort-key-output.patch
+perf-script-fix-memory-leaks-in-list_scripts.patch
+media-aspeed-video-address-a-protential-usage-of-an-.patch
+media-ov9650-add-a-sanity-check.patch
+leds-lm3532-fixes-for-the-driver-for-stability.patch
+asoc-es8316-fix-headphone-mixer-volume-table.patch
+acpi-cppc-do-not-require-the-_psd-method.patch
+sched-cpufreq-align-trace-event-behavior-of-fast-swi.patch
+arm64-dts-meson-fix-boards-regulators-states-format.patch
+x86-apic-vector-warn-when-vector-space-exhaustion-br.patch
+arm64-kpti-ensure-patched-kernel-text-is-fetched-fro.patch
+perf-evlist-use-unshare-clone_fs-in-sb-threads-to-le.patch
+arm64-use-correct-ll-sc-atomic-constraints.patch
+jump_label-don-t-warn-on-__exit-jump-entries.patch
+x86-mm-pti-do-not-invoke-pti-functions-when-pti-is-d.patch
+asoc-fsl_ssi-fix-clock-control-issue-in-master-mode.patch
+x86-mm-pti-handle-unaligned-address-gracefully-in-pt.patch
+nvmet-fix-data-units-read-and-written-counters-in-sm.patch
+nvme-multipath-fix-ana-log-nsid-lookup-when-nsid-is-.patch
+alsa-firewire-motu-add-support-for-motu-4pre.patch
+arm64-lse-make-arm64_lse_atomics-depend-on-jump_labe.patch
+iommu-amd-silence-warnings-under-memory-pressure.patch
+asoc-intel-haswell-adjust-machine-device-private-con.patch
+libata-ahci-drop-pcs-quirk-for-denverton-and-beyond.patch
+iommu-iova-avoid-false-sharing-on-fq_timer_on.patch
+libtraceevent-change-users-plugin-directory.patch
+asoc-dt-bindings-sun4i-spdif-fix-dma-names-warning.patch
+arm-dts-exynos-mark-ldo10-as-always-on-on-peach-pit-.patch
+x86-amd_nb-add-pci-device-ids-for-family-17h-model-7.patch
+acpi-custom_method-fix-memory-leaks.patch
+acpi-pci-fix-acpi_pci_irq_enable-memory-leak.patch
+closures-fix-a-race-on-wakeup-from-closure_sync.patch
+hwmon-k10temp-add-support-for-amd-family-17h-model-7.patch
+hwmon-acpi_power_meter-change-log-level-for-unsafe-s.patch
+md-raid1-fail-run-raid1-array-when-active-disk-less-.patch
+dmaengine-ti-edma-do-not-reset-reserved-param-slots.patch
+kprobes-prohibit-probing-on-bug-and-warn-address.patch
+x86-mm-fix-cpumask_of_node-error-condition.patch
+irqchip-sifive-plic-set-max-threshold-for-ignored-ha.patch
+s390-crypto-xts-aes-s390-fix-extra-run-time-crypto-s.patch
+irqchip-gic-v3-its-fix-lpi-release-for-multi-msi-dev.patch
+x86-cpu-add-tiger-lake-to-intel-family.patch
+platform-x86-intel_pmc_core-do-not-ioremap-ram.patch
+platform-x86-intel_pmc_core_pltdrv-module-removal-wa.patch
+soc-simple-card-utils-set-0hz-to-sysclk-when-shutdow.patch
+asoc-dmaengine-make-the-pcm-name-equal-to-pcm-id-if-.patch
+tools-power-x86-intel-speed-select-fix-memory-leak.patch
+spi-bcm2835-work-around-done-bit-erratum.patch
+io_uring-fix-wrong-sequence-setting-logic.patch
+block-make-rq-sector-size-accessible-for-block-stats.patch
+raid5-don-t-set-stripe_handle-to-stripe-which-is-in-.patch
+mmc-core-clarify-sdio_irq_pending-flag-for-mmc_cap2_.patch
+sched-psi-correct-overly-pessimistic-size-calculatio.patch
+mmc-sdhci-fix-incorrect-switch-to-hs-mode.patch
+mmc-core-add-helper-function-to-indicate-if-sdio-irq.patch
+mmc-dw_mmc-re-store-sdio-irqs-mask-at-system-resume.patch
+raid5-don-t-increment-read_errors-on-eilseq-return.patch
+mmc-mtk-sd-re-store-sdio-irqs-mask-at-system-resume.patch
+libertas-add-missing-sentinel-at-end-of-if_usb.c-fw_.patch
+e1000e-add-workaround-for-possible-stalled-packet.patch
+alsa-hda-add-a-quirk-model-for-fixing-huawei-mateboo.patch
+alsa-hda-drop-unsol-event-handler-for-intel-hdmi-cod.patch
+drm-amd-powerplay-smu7-enforce-minimal-vbitimeout-v2.patch
+media-ttusb-dec-fix-info-leak-in-ttusb_dec_send_comm.patch
+drm-fix-module-name-in-edid_firmware-log-message.patch
+alsa-hda-realtek-blacklist-pc-beep-for-lenovo-thinkc.patch
+iommu-amd-override-wrong-ivrs-ioapic-on-raven-ridge-.patch
+zd1211rw-remove-false-assertion-from-zd_mac_clear.patch
+btrfs-delayed-inode-kill-the-bug_on-in-btrfs_delete_.patch
+btrfs-extent-tree-make-sure-we-only-allocate-extents.patch
+btrfs-tree-checker-add-root_item-check.patch
+btrfs-detect-unbalanced-tree-with-empty-leaf-before-.patch
+kvm-nested-kvm-mmus-need-pae-root-too.patch
+media-omap3isp-set-device-on-omap3isp-subdevs.patch
+pm-devfreq-passive-fix-compiler-warning.patch
--- /dev/null
+From 63ea0b3b3630f0381f0105cb2eb719a748cbc24f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 15:02:17 +0200
+Subject: soc: amlogic: meson-clk-measure: protect measure with a mutex
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 3a760d986568b67d1f8411dab64608075817b90d ]
+
+In order to protect clock measuring when multiple process asks for
+a measure, protect the main measure function with mutexes.
+
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/amlogic/meson-clk-measure.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/amlogic/meson-clk-measure.c b/drivers/soc/amlogic/meson-clk-measure.c
+index 19d4cbc93a17a..c470e24f1dfa6 100644
+--- a/drivers/soc/amlogic/meson-clk-measure.c
++++ b/drivers/soc/amlogic/meson-clk-measure.c
+@@ -11,6 +11,8 @@
+ #include <linux/debugfs.h>
+ #include <linux/regmap.h>
+
++static DEFINE_MUTEX(measure_lock);
++
+ #define MSR_CLK_DUTY 0x0
+ #define MSR_CLK_REG0 0x4
+ #define MSR_CLK_REG1 0x8
+@@ -360,6 +362,10 @@ static int meson_measure_id(struct meson_msr_id *clk_msr_id,
+ unsigned int val;
+ int ret;
+
++ ret = mutex_lock_interruptible(&measure_lock);
++ if (ret)
++ return ret;
++
+ regmap_write(priv->regmap, MSR_CLK_REG0, 0);
+
+ /* Set measurement duration */
+@@ -377,8 +383,10 @@ static int meson_measure_id(struct meson_msr_id *clk_msr_id,
+
+ ret = regmap_read_poll_timeout(priv->regmap, MSR_CLK_REG0,
+ val, !(val & MSR_BUSY), 10, 10000);
+- if (ret)
++ if (ret) {
++ mutex_unlock(&measure_lock);
+ return ret;
++ }
+
+ /* Disable */
+ regmap_update_bits(priv->regmap, MSR_CLK_REG0, MSR_ENABLE, 0);
+@@ -386,6 +394,8 @@ static int meson_measure_id(struct meson_msr_id *clk_msr_id,
+ /* Get the value in multiple of gate time counts */
+ regmap_read(priv->regmap, MSR_CLK_REG2, &val);
+
++ mutex_unlock(&measure_lock);
++
+ if (val >= MSR_VAL_MASK)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 81474c9a33c1bba799db7e55c1609123a2394c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 18:54:02 +0200
+Subject: soc: renesas: Enable ARM_ERRATA_754322 for affected Cortex-A9
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2eced4607a1e6f51f928ae3e521fe02be5cb7d23 ]
+
+ARM Erratum 754322 affects Cortex-A9 revisions r2p* and r3p*.
+
+Automatically enable support code to mitigate the erratum when compiling
+a kernel for any of the affected Renesas SoCs:
+ - RZ/A1: r3p0,
+ - R-Mobile A1: r2p4,
+ - R-Car M1A: r2p2-00rel0,
+ - R-Car H1: r3p0,
+ - SH-Mobile AG5: r2p2.
+
+EMMA Mobile EV2 (r1p3) and RZ/A2 (r4p1) are not affected.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/Kconfig | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/soc/renesas/Kconfig b/drivers/soc/renesas/Kconfig
+index 2bbf49e5d4418..9583c542c47f7 100644
+--- a/drivers/soc/renesas/Kconfig
++++ b/drivers/soc/renesas/Kconfig
+@@ -55,6 +55,7 @@ config ARCH_EMEV2
+
+ config ARCH_R7S72100
+ bool "RZ/A1H (R7S72100)"
++ select ARM_ERRATA_754322
+ select PM
+ select PM_GENERIC_DOMAINS
+ select RENESAS_OSTM
+@@ -78,6 +79,7 @@ config ARCH_R8A73A4
+ config ARCH_R8A7740
+ bool "R-Mobile A1 (R8A77400)"
+ select ARCH_RMOBILE
++ select ARM_ERRATA_754322
+ select RENESAS_INTC_IRQPIN
+
+ config ARCH_R8A7743
+@@ -105,10 +107,12 @@ config ARCH_R8A77470
+ config ARCH_R8A7778
+ bool "R-Car M1A (R8A77781)"
+ select ARCH_RCAR_GEN1
++ select ARM_ERRATA_754322
+
+ config ARCH_R8A7779
+ bool "R-Car H1 (R8A77790)"
+ select ARCH_RCAR_GEN1
++ select ARM_ERRATA_754322
+ select HAVE_ARM_SCU if SMP
+ select HAVE_ARM_TWD if SMP
+ select SYSC_R8A7779
+@@ -152,6 +156,7 @@ config ARCH_R9A06G032
+ config ARCH_SH73A0
+ bool "SH-Mobile AG5 (R8A73A00)"
+ select ARCH_RMOBILE
++ select ARM_ERRATA_754322
+ select HAVE_ARM_SCU if SMP
+ select HAVE_ARM_TWD if SMP
+ select RENESAS_INTC_IRQPIN
+--
+2.20.1
+
--- /dev/null
+From 7c241b240f72ee9f082c2af7206cbc80e28eb031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 15:43:07 +0200
+Subject: soc: renesas: rmobile-sysc: Set GENPD_FLAG_ALWAYS_ON for always-on
+ domain
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit af0bc634728c0bc6a3f66f911f227d5c6396db88 ]
+
+Currently the R-Mobile "always-on" PM Domain is implemented by returning
+-EBUSY from the generic_pm_domain.power_off() callback, and doing
+nothing in the generic_pm_domain.power_on() callback. However, this
+means the PM Domain core code is not aware of the semantics of this
+special domain, leading to boot warnings like the following on
+SH/R-Mobile SoCs:
+
+ sh_cmt e6130000.timer: PM domain c5 will not be powered off
+
+Fix this by making the always-on nature of the domain explicit instead,
+by setting the GENPD_FLAG_ALWAYS_ON flag. This removes the need for the
+domain to provide power control callbacks.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/rmobile-sysc.c | 31 +++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/soc/renesas/rmobile-sysc.c b/drivers/soc/renesas/rmobile-sysc.c
+index 421ae1c887d82..54b616ad4a62a 100644
+--- a/drivers/soc/renesas/rmobile-sysc.c
++++ b/drivers/soc/renesas/rmobile-sysc.c
+@@ -48,12 +48,8 @@ struct rmobile_pm_domain *to_rmobile_pd(struct generic_pm_domain *d)
+ static int rmobile_pd_power_down(struct generic_pm_domain *genpd)
+ {
+ struct rmobile_pm_domain *rmobile_pd = to_rmobile_pd(genpd);
+- unsigned int mask;
++ unsigned int mask = BIT(rmobile_pd->bit_shift);
+
+- if (rmobile_pd->bit_shift == ~0)
+- return -EBUSY;
+-
+- mask = BIT(rmobile_pd->bit_shift);
+ if (rmobile_pd->suspend) {
+ int ret = rmobile_pd->suspend();
+
+@@ -80,14 +76,10 @@ static int rmobile_pd_power_down(struct generic_pm_domain *genpd)
+
+ static int __rmobile_pd_power_up(struct rmobile_pm_domain *rmobile_pd)
+ {
+- unsigned int mask;
++ unsigned int mask = BIT(rmobile_pd->bit_shift);
+ unsigned int retry_count;
+ int ret = 0;
+
+- if (rmobile_pd->bit_shift == ~0)
+- return 0;
+-
+- mask = BIT(rmobile_pd->bit_shift);
+ if (__raw_readl(rmobile_pd->base + PSTR) & mask)
+ return ret;
+
+@@ -122,11 +114,15 @@ static void rmobile_init_pm_domain(struct rmobile_pm_domain *rmobile_pd)
+ struct dev_power_governor *gov = rmobile_pd->gov;
+
+ genpd->flags |= GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
+- genpd->power_off = rmobile_pd_power_down;
+- genpd->power_on = rmobile_pd_power_up;
+- genpd->attach_dev = cpg_mstp_attach_dev;
+- genpd->detach_dev = cpg_mstp_detach_dev;
+- __rmobile_pd_power_up(rmobile_pd);
++ genpd->attach_dev = cpg_mstp_attach_dev;
++ genpd->detach_dev = cpg_mstp_detach_dev;
++
++ if (!(genpd->flags & GENPD_FLAG_ALWAYS_ON)) {
++ genpd->power_off = rmobile_pd_power_down;
++ genpd->power_on = rmobile_pd_power_up;
++ __rmobile_pd_power_up(rmobile_pd);
++ }
++
+ pm_genpd_init(genpd, gov ? : &simple_qos_governor, false);
+ }
+
+@@ -270,6 +266,11 @@ static void __init rmobile_setup_pm_domain(struct device_node *np,
+ break;
+
+ case PD_NORMAL:
++ if (pd->bit_shift == ~0) {
++ /* Top-level always-on domain */
++ pr_debug("PM domain %s is always-on domain\n", name);
++ pd->genpd.flags |= GENPD_FLAG_ALWAYS_ON;
++ }
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4c8a6792f8e7955caa33fe44868df43cf782805d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2019 02:45:01 +0900
+Subject: SoC: simple-card-utils: set 0Hz to sysclk when shutdown
+
+From: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+
+[ Upstream commit 2458adb8f92ad4d07ef7ab27c5bafa1d3f4678d6 ]
+
+This patch set 0Hz to sysclk when shutdown the card.
+
+Some codecs set rate constraints that derives from sysclk. This
+mechanism works correctly if machine drivers give fixed frequency.
+
+But simple-audio and audio-graph card set variable clock rate if
+'mclk-fs' property exists. In this case, rate constraints will go
+bad scenario. For example a codec accepts three limited rates
+(mclk / 256, mclk / 384, mclk / 512).
+
+Bad scenario as follows (mclk-fs = 256):
+ - Initialize sysclk by correct value (Ex. 12.288MHz)
+ - Codec set constraints of PCM rate by sysclk
+ 48kHz (1/256), 32kHz (1/384), 24kHz (1/512)
+ - Play 48kHz sound, it's acceptable
+ - Sysclk is not changed
+
+ - Play 32kHz sound, it's acceptable
+ - Set sysclk to 8.192MHz (= fs * mclk-fs = 32k * 256)
+ - Codec set constraints of PCM rate by sysclk
+ 32kHz (1/256), 21.33kHz (1/384), 16kHz (1/512)
+
+ - Play 48kHz again, but it's NOT acceptable because constraints
+ do not allow 48kHz
+
+So codecs treat 0Hz sysclk as signal of applying no constraints to
+avoid this problem.
+
+Signed-off-by: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+Link: https://lore.kernel.org/r/20190907174501.19833-1-katsuhiro@katsuster.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card-utils.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
+index 556b1a789629d..9b794775df537 100644
+--- a/sound/soc/generic/simple-card-utils.c
++++ b/sound/soc/generic/simple-card-utils.c
+@@ -213,10 +213,17 @@ EXPORT_SYMBOL_GPL(asoc_simple_startup);
+ void asoc_simple_shutdown(struct snd_pcm_substream *substream)
+ {
+ struct snd_soc_pcm_runtime *rtd = substream->private_data;
++ struct snd_soc_dai *codec_dai = rtd->codec_dai;
++ struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+ struct asoc_simple_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+ struct simple_dai_props *dai_props =
+ simple_priv_to_props(priv, rtd->num);
+
++ if (dai_props->mclk_fs) {
++ snd_soc_dai_set_sysclk(codec_dai, 0, 0, SND_SOC_CLOCK_IN);
++ snd_soc_dai_set_sysclk(cpu_dai, 0, 0, SND_SOC_CLOCK_OUT);
++ }
++
+ asoc_simple_clk_disable(dai_props->cpu_dai);
+
+ asoc_simple_clk_disable(dai_props->codec_dai);
+--
+2.20.1
+
--- /dev/null
+From d642561133c609972540f2aad872074433792f9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Aug 2019 12:10:00 +0200
+Subject: spi: bcm2835: Work around DONE bit erratum
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 4c524191c0a21d758b519087c64f84348095e940 ]
+
+Commit 3bd7f6589f67 ("spi: bcm2835: Overcome sglist entry length
+limitation") amended the BCM2835 SPI driver with support for DMA
+transfers whose buffers are not aligned to 4 bytes and require more than
+one sglist entry.
+
+When testing this feature with upcoming commits to speed up TX-only and
+RX-only transfers, I noticed that SPI transmission sometimes breaks.
+A function introduced by the commit, bcm2835_spi_transfer_prologue(),
+performs one or two PIO transmissions as a prologue to the actual DMA
+transmission. It turns out that the breakage goes away if the DONE bit
+in the CS register is set when ending such a PIO transmission.
+
+The DONE bit signifies emptiness of the TX FIFO. According to the spec,
+the bit is of type RO, so writing it should never have any effect.
+Perhaps the spec is wrong and the bit is actually of type RW1C.
+E.g. the I2C controller on the BCM2835 does have an RW1C DONE bit which
+needs to be cleared by the driver. Another, possibly more likely
+explanation is that it's a hardware erratum since the issue does not
+occur consistently.
+
+Either way, amend bcm2835_spi_transfer_prologue() to always write the
+DONE bit.
+
+Usually a transmission is ended by bcm2835_spi_reset_hw(). If the
+transmission was successful, the TX FIFO is empty and thus the DONE bit
+is set when bcm2835_spi_reset_hw() reads the CS register. The bit is
+then written back to the register, so we happen to do the right thing.
+
+However if DONE is not set, e.g. because transmission is aborted with
+a non-empty TX FIFO, the bit won't be written by bcm2835_spi_reset_hw()
+and it seems possible that transmission might subsequently break. To be
+on the safe side, likewise amend bcm2835_spi_reset_hw() to always write
+the bit.
+
+Tested-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Stefan Wahren <wahrenst@gmx.net>
+Acked-by: Martin Sperl <kernel@martin.sperl.org>
+Link: https://lore.kernel.org/r/edb004dff4af6106f6bfcb89e1a96391e96eb857.1564825752.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm2835.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 840b1b8ff3dcb..dfdcebb38830a 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -319,6 +319,13 @@ static void bcm2835_spi_reset_hw(struct spi_controller *ctlr)
+ BCM2835_SPI_CS_INTD |
+ BCM2835_SPI_CS_DMAEN |
+ BCM2835_SPI_CS_TA);
++ /*
++ * Transmission sometimes breaks unless the DONE bit is written at the
++ * end of every transfer. The spec says it's a RO bit. Either the
++ * spec is wrong and the bit is actually of type RW1C, or it's a
++ * hardware erratum.
++ */
++ cs |= BCM2835_SPI_CS_DONE;
+ /* and reset RX/TX FIFOS */
+ cs |= BCM2835_SPI_CS_CLEAR_RX | BCM2835_SPI_CS_CLEAR_TX;
+
+@@ -477,7 +484,9 @@ static void bcm2835_spi_transfer_prologue(struct spi_controller *ctlr,
+ bcm2835_wr_fifo_count(bs, bs->rx_prologue);
+ bcm2835_wait_tx_fifo_empty(bs);
+ bcm2835_rd_fifo_count(bs, bs->rx_prologue);
+- bcm2835_spi_reset_hw(ctlr);
++ bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_CLEAR_RX
++ | BCM2835_SPI_CS_CLEAR_TX
++ | BCM2835_SPI_CS_DONE);
+
+ dma_sync_single_for_device(ctlr->dma_rx->device->dev,
+ sg_dma_address(&tfr->rx_sg.sgl[0]),
+@@ -498,7 +507,8 @@ static void bcm2835_spi_transfer_prologue(struct spi_controller *ctlr,
+ | BCM2835_SPI_CS_DMAEN);
+ bcm2835_wr_fifo_count(bs, tx_remaining);
+ bcm2835_wait_tx_fifo_empty(bs);
+- bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_CLEAR_TX);
++ bcm2835_wr(bs, BCM2835_SPI_CS, cs | BCM2835_SPI_CS_CLEAR_TX
++ | BCM2835_SPI_CS_DONE);
+ }
+
+ if (likely(!bs->tx_spillover)) {
+--
+2.20.1
+
--- /dev/null
+From e81a825b5052c85f31a1b851a8f97f70f6f442f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2019 14:42:43 +0300
+Subject: spi: dw-mmio: Clock should be shut when error occurs
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3da9834d9381dd99273f2ad4e6d096c9187dc4f2 ]
+
+When optional clock requesting fails, the main clock is still up and running,
+we should shut it down in such caee.
+
+Fixes: 560ee7e91009 ("spi: dw: Add support for an optional interface clock")
+Cc: Phil Edworthy <phil.edworthy@renesas.com>
+Cc: Gareth Williams <gareth.williams.jx@renesas.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Gareth Williams <gareth.williams.jx@renesas.com>
+Link: https://lore.kernel.org/r/20190710114243.30101-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-dw-mmio.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c
+index 18c06568805e7..86789dbaf5771 100644
+--- a/drivers/spi/spi-dw-mmio.c
++++ b/drivers/spi/spi-dw-mmio.c
+@@ -172,8 +172,10 @@ static int dw_spi_mmio_probe(struct platform_device *pdev)
+
+ /* Optional clock needed to access the registers */
+ dwsmmio->pclk = devm_clk_get_optional(&pdev->dev, "pclk");
+- if (IS_ERR(dwsmmio->pclk))
+- return PTR_ERR(dwsmmio->pclk);
++ if (IS_ERR(dwsmmio->pclk)) {
++ ret = PTR_ERR(dwsmmio->pclk);
++ goto out_clk;
++ }
+ ret = clk_prepare_enable(dwsmmio->pclk);
+ if (ret)
+ goto out_clk;
+--
+2.20.1
+
--- /dev/null
+From 58a5d1ed9011ef084717414642ecce32baeb7ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jun 2019 09:52:38 -0700
+Subject: time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint
+
+From: Paul E. McKenney <paulmck@linux.ibm.com>
+
+[ Upstream commit 84ec3a0787086fcd25f284f59b3aa01fd6fc0a5d ]
+
+time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint
+
+The TASKS03 and TREE04 rcutorture scenarios produce the following
+lockdep complaint:
+
+ WARNING: inconsistent lock state
+ 5.2.0-rc1+ #513 Not tainted
+ --------------------------------
+ inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
+ migration/1/14 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ (____ptrval____) (tick_broadcast_lock){?...}, at: tick_broadcast_offline+0xf/0x70
+ {IN-HARDIRQ-W} state was registered at:
+ lock_acquire+0xb0/0x1c0
+ _raw_spin_lock_irqsave+0x3c/0x50
+ tick_broadcast_switch_to_oneshot+0xd/0x40
+ tick_switch_to_oneshot+0x4f/0xd0
+ hrtimer_run_queues+0xf3/0x130
+ run_local_timers+0x1c/0x50
+ update_process_times+0x1c/0x50
+ tick_periodic+0x26/0xc0
+ tick_handle_periodic+0x1a/0x60
+ smp_apic_timer_interrupt+0x80/0x2a0
+ apic_timer_interrupt+0xf/0x20
+ _raw_spin_unlock_irqrestore+0x4e/0x60
+ rcu_nocb_gp_kthread+0x15d/0x590
+ kthread+0xf3/0x130
+ ret_from_fork+0x3a/0x50
+ irq event stamp: 171
+ hardirqs last enabled at (171): [<ffffffff8a201a37>] trace_hardirqs_on_thunk+0x1a/0x1c
+ hardirqs last disabled at (170): [<ffffffff8a201a53>] trace_hardirqs_off_thunk+0x1a/0x1c
+ softirqs last enabled at (0): [<ffffffff8a264ee0>] copy_process.part.56+0x650/0x1cb0
+ softirqs last disabled at (0): [<0000000000000000>] 0x0
+
+ [...]
+
+To reproduce, run the following rcutorture test:
+
+ $ tools/testing/selftests/rcutorture/bin/kvm.sh --duration 5 --kconfig "CONFIG_DEBUG_LOCK_ALLOC=y CONFIG_PROVE_LOCKING=y" --configs "TASKS03 TREE04"
+
+It turns out that tick_broadcast_offline() was an innocent bystander.
+After all, interrupts are supposed to be disabled throughout
+take_cpu_down(), and therefore should have been disabled upon entry to
+tick_offline_cpu() and thus to tick_broadcast_offline(). This suggests
+that one of the CPU-hotplug notifiers was incorrectly enabling interrupts,
+and leaving them enabled on return.
+
+Some debugging code showed that the culprit was sched_cpu_dying().
+It had irqs enabled after return from sched_tick_stop(). Which in turn
+had irqs enabled after return from cancel_delayed_work_sync(). Which is a
+wrapper around __cancel_work_timer(). Which can sleep in the case where
+something else is concurrently trying to cancel the same delayed work,
+and as Thomas Gleixner pointed out on IRC, sleeping is a decidedly bad
+idea when you are invoked from take_cpu_down(), regardless of the state
+you leave interrupts in upon return.
+
+Code inspection located no reason why the delayed work absolutely
+needed to be canceled from sched_tick_stop(): The work is not
+bound to the outgoing CPU by design, given that the whole point is
+to collect statistics without disturbing the outgoing CPU.
+
+This commit therefore simply drops the cancel_delayed_work_sync() from
+sched_tick_stop(). Instead, a new ->state field is added to the tick_work
+structure so that the delayed-work handler function sched_tick_remote()
+can avoid reposting itself. A cpu_is_offline() check is also added to
+sched_tick_remote() to avoid mucking with the state of an offlined CPU
+(though it does appear safe to do so). The sched_tick_start() and
+sched_tick_stop() functions also update ->state, and sched_tick_start()
+also schedules the delayed work if ->state indicates that it is not
+already in flight.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.ibm.com>
+[ paulmck: Apply Peter Zijlstra and Frederic Weisbecker atomics feedback. ]
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20190625165238.GJ26519@linux.ibm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 57 ++++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 49 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index df9f1fe5689b0..7fa8e74ad2ab4 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3486,8 +3486,36 @@ void scheduler_tick(void)
+
+ struct tick_work {
+ int cpu;
++ atomic_t state;
+ struct delayed_work work;
+ };
++/* Values for ->state, see diagram below. */
++#define TICK_SCHED_REMOTE_OFFLINE 0
++#define TICK_SCHED_REMOTE_OFFLINING 1
++#define TICK_SCHED_REMOTE_RUNNING 2
++
++/*
++ * State diagram for ->state:
++ *
++ *
++ * TICK_SCHED_REMOTE_OFFLINE
++ * | ^
++ * | |
++ * | | sched_tick_remote()
++ * | |
++ * | |
++ * +--TICK_SCHED_REMOTE_OFFLINING
++ * | ^
++ * | |
++ * sched_tick_start() | | sched_tick_stop()
++ * | |
++ * V |
++ * TICK_SCHED_REMOTE_RUNNING
++ *
++ *
++ * Other transitions get WARN_ON_ONCE(), except that sched_tick_remote()
++ * and sched_tick_start() are happy to leave the state in RUNNING.
++ */
+
+ static struct tick_work __percpu *tick_work_cpu;
+
+@@ -3500,6 +3528,7 @@ static void sched_tick_remote(struct work_struct *work)
+ struct task_struct *curr;
+ struct rq_flags rf;
+ u64 delta;
++ int os;
+
+ /*
+ * Handle the tick only if it appears the remote CPU is running in full
+@@ -3513,7 +3542,7 @@ static void sched_tick_remote(struct work_struct *work)
+
+ rq_lock_irq(rq, &rf);
+ curr = rq->curr;
+- if (is_idle_task(curr))
++ if (is_idle_task(curr) || cpu_is_offline(cpu))
+ goto out_unlock;
+
+ update_rq_clock(rq);
+@@ -3533,13 +3562,18 @@ static void sched_tick_remote(struct work_struct *work)
+ /*
+ * Run the remote tick once per second (1Hz). This arbitrary
+ * frequency is large enough to avoid overload but short enough
+- * to keep scheduler internal stats reasonably up to date.
++ * to keep scheduler internal stats reasonably up to date. But
++ * first update state to reflect hotplug activity if required.
+ */
+- queue_delayed_work(system_unbound_wq, dwork, HZ);
++ os = atomic_fetch_add_unless(&twork->state, -1, TICK_SCHED_REMOTE_RUNNING);
++ WARN_ON_ONCE(os == TICK_SCHED_REMOTE_OFFLINE);
++ if (os == TICK_SCHED_REMOTE_RUNNING)
++ queue_delayed_work(system_unbound_wq, dwork, HZ);
+ }
+
+ static void sched_tick_start(int cpu)
+ {
++ int os;
+ struct tick_work *twork;
+
+ if (housekeeping_cpu(cpu, HK_FLAG_TICK))
+@@ -3548,15 +3582,20 @@ static void sched_tick_start(int cpu)
+ WARN_ON_ONCE(!tick_work_cpu);
+
+ twork = per_cpu_ptr(tick_work_cpu, cpu);
+- twork->cpu = cpu;
+- INIT_DELAYED_WORK(&twork->work, sched_tick_remote);
+- queue_delayed_work(system_unbound_wq, &twork->work, HZ);
++ os = atomic_xchg(&twork->state, TICK_SCHED_REMOTE_RUNNING);
++ WARN_ON_ONCE(os == TICK_SCHED_REMOTE_RUNNING);
++ if (os == TICK_SCHED_REMOTE_OFFLINE) {
++ twork->cpu = cpu;
++ INIT_DELAYED_WORK(&twork->work, sched_tick_remote);
++ queue_delayed_work(system_unbound_wq, &twork->work, HZ);
++ }
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
+ static void sched_tick_stop(int cpu)
+ {
+ struct tick_work *twork;
++ int os;
+
+ if (housekeeping_cpu(cpu, HK_FLAG_TICK))
+ return;
+@@ -3564,7 +3603,10 @@ static void sched_tick_stop(int cpu)
+ WARN_ON_ONCE(!tick_work_cpu);
+
+ twork = per_cpu_ptr(tick_work_cpu, cpu);
+- cancel_delayed_work_sync(&twork->work);
++ /* There cannot be competing actions, but don't rely on stop-machine. */
++ os = atomic_xchg(&twork->state, TICK_SCHED_REMOTE_OFFLINING);
++ WARN_ON_ONCE(os != TICK_SCHED_REMOTE_RUNNING);
++ /* Don't cancel, as this would mess up the state machine. */
+ }
+ #endif /* CONFIG_HOTPLUG_CPU */
+
+@@ -3572,7 +3614,6 @@ int __init sched_tick_offload_init(void)
+ {
+ tick_work_cpu = alloc_percpu(struct tick_work);
+ BUG_ON(!tick_work_cpu);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 331e62ea13a4f85a19a348db95ec0460789f5dce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 11:45:17 -0300
+Subject: tools headers: Fixup bitsperlong per arch includes
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 42fc2e9ef9603a7948aaa4ffd8dfb94b30294ad8 ]
+
+We were getting the file by luck, from one of the paths in -I, fix it to
+get it from the proper place:
+
+ $ cd tools/include/uapi/asm/
+ [acme@quaco asm]$ grep include bitsperlong.h
+ #include "../../arch/x86/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/arm64/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/powerpc/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/s390/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/sparc/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/mips/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
+ #include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
+ #include <asm-generic/bitsperlong.h>
+ $ ls -la ../../arch/x86/include/uapi/asm/bitsperlong.h
+ ls: cannot access '../../arch/x86/include/uapi/asm/bitsperlong.h': No such file or directory
+ $ ls -la ../../../arch/*/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 237 ../../../arch/alpha/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 841 ../../../arch/arm64/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 966 ../../../arch/hexagon/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 234 ../../../arch/ia64/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 100 ../../../arch/microblaze/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 244 ../../../arch/mips/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 352 ../../../arch/parisc/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 312 ../../../arch/powerpc/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 353 ../../../arch/riscv/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 292 ../../../arch/s390/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 323 ../../../arch/sparc/include/uapi/asm/bitsperlong.h
+ -rw-rw-r--. 1 320 ../../../arch/x86/include/uapi/asm/bitsperlong.h
+ $
+
+Found while fixing some other problem, before it was escaping the
+tools/ chroot and using stuff in the kernel sources:
+
+ CC /tmp/build/perf/util/find_bit.o
+In file included from /git/linux/tools/include/../../arch/x86/include/uapi/asm/bitsperlong.h:11,
+ from /git/linux/tools/include/uapi/asm/bitsperlong.h:3,
+ from /git/linux/tools/include/linux/bits.h:6,
+ from /git/linux/tools/include/linux/bitops.h:13,
+ from ../lib/find_bit.c:17:
+
+ # cd /git/linux/tools/include/../../arch/x86/include/uapi/asm/
+ # pwd
+ /git/linux/arch/x86/include/uapi/asm
+ #
+
+Now it is getting the one we want it to, i.e. the one inside tools/:
+
+ CC /tmp/build/perf/util/find_bit.o
+ In file included from /git/linux/tools/arch/x86/include/uapi/asm/bitsperlong.h:11,
+ from /git/linux/tools/include/linux/bits.h:6,
+ from /git/linux/tools/include/linux/bitops.h:13,
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lkml.kernel.org/n/tip-8f8cfqywmf6jk8a3ucr0ixhu@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/include/uapi/asm/bitsperlong.h | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tools/include/uapi/asm/bitsperlong.h b/tools/include/uapi/asm/bitsperlong.h
+index 57aaeaf8e1920..edba4d93e9e6a 100644
+--- a/tools/include/uapi/asm/bitsperlong.h
++++ b/tools/include/uapi/asm/bitsperlong.h
+@@ -1,22 +1,22 @@
+ /* SPDX-License-Identifier: GPL-2.0 */
+ #if defined(__i386__) || defined(__x86_64__)
+-#include "../../arch/x86/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/x86/include/uapi/asm/bitsperlong.h"
+ #elif defined(__aarch64__)
+-#include "../../arch/arm64/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/arm64/include/uapi/asm/bitsperlong.h"
+ #elif defined(__powerpc__)
+-#include "../../arch/powerpc/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/powerpc/include/uapi/asm/bitsperlong.h"
+ #elif defined(__s390__)
+-#include "../../arch/s390/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/s390/include/uapi/asm/bitsperlong.h"
+ #elif defined(__sparc__)
+-#include "../../arch/sparc/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/sparc/include/uapi/asm/bitsperlong.h"
+ #elif defined(__mips__)
+-#include "../../arch/mips/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/mips/include/uapi/asm/bitsperlong.h"
+ #elif defined(__ia64__)
+-#include "../../arch/ia64/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/ia64/include/uapi/asm/bitsperlong.h"
+ #elif defined(__riscv)
+-#include "../../arch/riscv/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/riscv/include/uapi/asm/bitsperlong.h"
+ #elif defined(__alpha__)
+-#include "../../arch/alpha/include/uapi/asm/bitsperlong.h"
++#include "../../../arch/alpha/include/uapi/asm/bitsperlong.h"
+ #else
+ #include <asm-generic/bitsperlong.h>
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 2b57e9c5ba8c6b368456a612978c3df860eebbdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 08:03:11 -0400
+Subject: tools/power/x86/intel-speed-select: Fix memory leak
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit 3bc3d30ca324bfc3045a1a7fe1f5fe5ad5d92fd9 ]
+
+cpumasks are allocated by calling the alloc_cpu_mask() function and are
+never free'd. They should be free'd after the commands have run.
+
+Fix the memory leaks by calling free_cpu_set().
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: David Arcari <darcari@redhat.com>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/intel-speed-select/isst-config.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c
+index 91c5ad1685a15..6a10dea01eefc 100644
+--- a/tools/power/x86/intel-speed-select/isst-config.c
++++ b/tools/power/x86/intel-speed-select/isst-config.c
+@@ -603,6 +603,10 @@ static int isst_fill_platform_info(void)
+
+ close(fd);
+
++ if (isst_platform_info.api_version > supported_api_ver) {
++ printf("Incompatible API versions; Upgrade of tool is required\n");
++ return -1;
++ }
+ return 0;
+ }
+
+@@ -1529,6 +1533,7 @@ static void cmdline(int argc, char **argv)
+ {
+ int opt;
+ int option_index = 0;
++ int ret;
+
+ static struct option long_options[] = {
+ { "cpu", required_argument, 0, 'c' },
+@@ -1590,13 +1595,14 @@ static void cmdline(int argc, char **argv)
+ set_max_cpu_num();
+ set_cpu_present_cpu_mask();
+ set_cpu_target_cpu_mask();
+- isst_fill_platform_info();
+- if (isst_platform_info.api_version > supported_api_ver) {
+- printf("Incompatible API versions; Upgrade of tool is required\n");
+- exit(0);
+- }
++ ret = isst_fill_platform_info();
++ if (ret)
++ goto out;
+
+ process_command(argc, argv);
++out:
++ free_cpu_set(present_cpumask);
++ free_cpu_set(target_cpumask);
+ }
+
+ int main(int argc, char **argv)
+--
+2.20.1
+
--- /dev/null
+From cc8c7d3b38c93cb1964a8345fb989b902392a7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:45:10 +0300
+Subject: x86/amd_nb: Add PCI device IDs for family 17h, model 70h
+
+From: Marcel Bocu <marcel.p.bocu@gmail.com>
+
+[ Upstream commit af4e1c5eca95bed1192d8dc45c8ed63aea2209e8 ]
+
+The AMD Ryzen gen 3 processors came with a different PCI IDs for the
+function 3 & 4 which are used to access the SMN interface. The root
+PCI address however remained at the same address as the model 30h.
+
+Adding the F3/F4 PCI IDs respectively to the misc and link ids appear
+to be sufficient for k10temp, so let's add them and follow up on the
+patch if other functions need more tweaking.
+
+Vicki Pfau sent an identical patch after I checked that no-one had
+written this patch. I would have been happy about dropping my patch but
+unlike for his patch series, I had already Cc:ed the x86 people and
+they already reviewed the changes. Since Vicki has not answered to
+any email after his initial series, let's assume she is on vacation
+and let's avoid duplication of reviews from the maintainers and merge
+my series. To acknowledge Vicki's anteriority, I added her S-o-b to
+the patch.
+
+v2, suggested by Guenter Roeck and Brian Woods:
+ - rename from 71h to 70h
+
+Signed-off-by: Vicki Pfau <vi@endrift.com>
+Signed-off-by: Marcel Bocu <marcel.p.bocu@gmail.com>
+Tested-by: Marcel Bocu <marcel.p.bocu@gmail.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Brian Woods <brian.woods@amd.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com> # pci_ids.h
+
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: x86@kernel.org
+Cc: "Woods, Brian" <Brian.Woods@amd.com>
+Cc: Clemens Ladisch <clemens@ladisch.de>
+Cc: Jean Delvare <jdelvare@suse.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: linux-hwmon@vger.kernel.org
+Link: https://lore.kernel.org/r/20190722174510.2179-1-marcel.p.bocu@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/amd_nb.c | 3 +++
+ include/linux/pci_ids.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index d63e63b7d1d95..251c795b4eb3c 100644
+--- a/arch/x86/kernel/amd_nb.c
++++ b/arch/x86/kernel/amd_nb.c
+@@ -21,6 +21,7 @@
+ #define PCI_DEVICE_ID_AMD_17H_DF_F4 0x1464
+ #define PCI_DEVICE_ID_AMD_17H_M10H_DF_F4 0x15ec
+ #define PCI_DEVICE_ID_AMD_17H_M30H_DF_F4 0x1494
++#define PCI_DEVICE_ID_AMD_17H_M70H_DF_F4 0x1444
+
+ /* Protect the PCI config register pairs used for SMN and DF indirect access. */
+ static DEFINE_MUTEX(smn_mutex);
+@@ -50,6 +51,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F3) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F3) },
+ {}
+ };
+ EXPORT_SYMBOL_GPL(amd_nb_misc_ids);
+@@ -63,6 +65,7 @@ static const struct pci_device_id amd_nb_link_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M30H_DF_F4) },
++ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M70H_DF_F4) },
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) },
+ {}
+ };
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index c842735a4f45a..4b97f427cc929 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -548,6 +548,7 @@
+ #define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
+ #define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb
+ #define PCI_DEVICE_ID_AMD_17H_M30H_DF_F3 0x1493
++#define PCI_DEVICE_ID_AMD_17H_M70H_DF_F3 0x1443
+ #define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703
+ #define PCI_DEVICE_ID_AMD_LANCE 0x2000
+ #define PCI_DEVICE_ID_AMD_LANCE_HOME 0x2001
+--
+2.20.1
+
--- /dev/null
+From 2bb269cd86f2c9067b6f2c51c699d0801c1e64d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:47:09 +0200
+Subject: x86/apic: Make apic_pending_intr_clear() more robust
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit cc8bf191378c1da8ad2b99cf470ee70193ace84e ]
+
+In course of developing shorthand based IPI support issues with the
+function which tries to clear eventually pending ISR bits in the local APIC
+were observed.
+
+ 1) O-day testing triggered the WARN_ON() in apic_pending_intr_clear().
+
+ This warning is emitted when the function fails to clear pending ISR
+ bits or observes pending IRR bits which are not delivered to the CPU
+ after the stale ISR bit(s) are ACK'ed.
+
+ Unfortunately the function only emits a WARN_ON() and fails to dump
+ the IRR/ISR content. That's useless for debugging.
+
+ Feng added spot on debug printk's which revealed that the stale IRR
+ bit belonged to the APIC timer interrupt vector, but adding ad hoc
+ debug code does not help with sporadic failures in the field.
+
+ Rework the loop so the full IRR/ISR contents are saved and on failure
+ dumped.
+
+ 2) The loop termination logic is interesting at best.
+
+ If the machine has no TSC or cpu_khz is not known yet it tries 1
+ million times to ack stale IRR/ISR bits. What?
+
+ With TSC it uses the TSC to calculate the loop termination. It takes a
+ timestamp at entry and terminates the loop when:
+
+ (rdtsc() - start_timestamp) >= (cpu_hkz << 10)
+
+ That's roughly one second.
+
+ Both methods are problematic. The APIC has 256 vectors, which means
+ that in theory max. 256 IRR/ISR bits can be set. In practice this is
+ impossible and the chance that more than a few bits are set is close
+ to zero.
+
+ With the pure loop based approach the 1 million retries are complete
+ overkill.
+
+ With TSC this can terminate too early in a guest which is running on a
+ heavily loaded host even with only a couple of IRR/ISR bits set. The
+ reason is that after acknowledging the highest priority ISR bit,
+ pending IRRs must get serviced first before the next round of
+ acknowledge can take place as the APIC (real and virtualized) does not
+ honour EOI without a preceeding interrupt on the CPU. And every APIC
+ read/write takes a VMEXIT if the APIC is virtualized. While trying to
+ reproduce the issue 0-day reported it was observed that the guest was
+ scheduled out long enough under heavy load that it terminated after 8
+ iterations.
+
+ Make the loop terminate after 512 iterations. That's plenty enough
+ in any case and does not take endless time to complete.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190722105219.158847694@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 107 +++++++++++++++++++++---------------
+ 1 file changed, 63 insertions(+), 44 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 08fb79f377936..436d462dde715 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1495,54 +1495,72 @@ static void lapic_setup_esr(void)
+ oldvalue, value);
+ }
+
+-static void apic_pending_intr_clear(void)
++#define APIC_IR_REGS APIC_ISR_NR
++#define APIC_IR_BITS (APIC_IR_REGS * 32)
++#define APIC_IR_MAPSIZE (APIC_IR_BITS / BITS_PER_LONG)
++
++union apic_ir {
++ unsigned long map[APIC_IR_MAPSIZE];
++ u32 regs[APIC_IR_REGS];
++};
++
++static bool apic_check_and_ack(union apic_ir *irr, union apic_ir *isr)
+ {
+- long long max_loops = cpu_khz ? cpu_khz : 1000000;
+- unsigned long long tsc = 0, ntsc;
+- unsigned int queued;
+- unsigned long value;
+- int i, j, acked = 0;
++ int i, bit;
++
++ /* Read the IRRs */
++ for (i = 0; i < APIC_IR_REGS; i++)
++ irr->regs[i] = apic_read(APIC_IRR + i * 0x10);
++
++ /* Read the ISRs */
++ for (i = 0; i < APIC_IR_REGS; i++)
++ isr->regs[i] = apic_read(APIC_ISR + i * 0x10);
+
+- if (boot_cpu_has(X86_FEATURE_TSC))
+- tsc = rdtsc();
+ /*
+- * After a crash, we no longer service the interrupts and a pending
+- * interrupt from previous kernel might still have ISR bit set.
+- *
+- * Most probably by now CPU has serviced that pending interrupt and
+- * it might not have done the ack_APIC_irq() because it thought,
+- * interrupt came from i8259 as ExtInt. LAPIC did not get EOI so it
+- * does not clear the ISR bit and cpu thinks it has already serivced
+- * the interrupt. Hence a vector might get locked. It was noticed
+- * for timer irq (vector 0x31). Issue an extra EOI to clear ISR.
++ * If the ISR map is not empty. ACK the APIC and run another round
++ * to verify whether a pending IRR has been unblocked and turned
++ * into a ISR.
+ */
+- do {
+- queued = 0;
+- for (i = APIC_ISR_NR - 1; i >= 0; i--)
+- queued |= apic_read(APIC_IRR + i*0x10);
+-
+- for (i = APIC_ISR_NR - 1; i >= 0; i--) {
+- value = apic_read(APIC_ISR + i*0x10);
+- for_each_set_bit(j, &value, 32) {
+- ack_APIC_irq();
+- acked++;
+- }
+- }
+- if (acked > 256) {
+- pr_err("LAPIC pending interrupts after %d EOI\n", acked);
+- break;
+- }
+- if (queued) {
+- if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
+- ntsc = rdtsc();
+- max_loops = (long long)cpu_khz << 10;
+- max_loops -= ntsc - tsc;
+- } else {
+- max_loops--;
+- }
+- }
+- } while (queued && max_loops > 0);
+- WARN_ON(max_loops <= 0);
++ if (!bitmap_empty(isr->map, APIC_IR_BITS)) {
++ /*
++ * There can be multiple ISR bits set when a high priority
++ * interrupt preempted a lower priority one. Issue an ACK
++ * per set bit.
++ */
++ for_each_set_bit(bit, isr->map, APIC_IR_BITS)
++ ack_APIC_irq();
++ return true;
++ }
++
++ return !bitmap_empty(irr->map, APIC_IR_BITS);
++}
++
++/*
++ * After a crash, we no longer service the interrupts and a pending
++ * interrupt from previous kernel might still have ISR bit set.
++ *
++ * Most probably by now the CPU has serviced that pending interrupt and it
++ * might not have done the ack_APIC_irq() because it thought, interrupt
++ * came from i8259 as ExtInt. LAPIC did not get EOI so it does not clear
++ * the ISR bit and cpu thinks it has already serivced the interrupt. Hence
++ * a vector might get locked. It was noticed for timer irq (vector
++ * 0x31). Issue an extra EOI to clear ISR.
++ *
++ * If there are pending IRR bits they turn into ISR bits after a higher
++ * priority ISR bit has been acked.
++ */
++static void apic_pending_intr_clear(void)
++{
++ union apic_ir irr, isr;
++ unsigned int i;
++
++ /* 512 loops are way oversized and give the APIC a chance to obey. */
++ for (i = 0; i < 512; i++) {
++ if (!apic_check_and_ack(&irr, &isr))
++ return;
++ }
++ /* Dump the IRR/ISR content if that failed */
++ pr_warn("APIC: Stale IRR: %256pb ISR: %256pb\n", irr.map, isr.map);
+ }
+
+ /**
+@@ -1610,6 +1628,7 @@ static void setup_local_APIC(void)
+ value &= ~APIC_TPRI_MASK;
+ apic_write(APIC_TASKPRI, value);
+
++ /* Clear eventually stale ISR/IRR bits */
+ apic_pending_intr_clear();
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 1427efab7af665cf9d769376d92b63c86343d9b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:47:08 +0200
+Subject: x86/apic: Soft disable APIC before initializing it
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 2640da4cccf5cc613bf26f0998b9e340f4b5f69c ]
+
+If the APIC was already enabled on entry of setup_local_APIC() then
+disabling it soft via the SPIV register makes a lot of sense.
+
+That masks all LVT entries and brings it into a well defined state.
+
+Otherwise previously enabled LVTs which are not touched in the setup
+function stay unmasked and might surprise the just booting kernel.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190722105219.068290579@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 436d462dde715..ad0d5ced82b30 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1583,6 +1583,14 @@ static void setup_local_APIC(void)
+ return;
+ }
+
++ /*
++ * If this comes from kexec/kcrash the APIC might be enabled in
++ * SPIV. Soft disable it before doing further initialization.
++ */
++ value = apic_read(APIC_SPIV);
++ value &= ~APIC_SPIV_APIC_ENABLED;
++ apic_write(APIC_SPIV, value);
++
+ #ifdef CONFIG_X86_32
+ /* Pound the ESR really hard over the head with a big hammer - mbligh */
+ if (lapic_is_integrated() && apic->disable_esr) {
+--
+2.20.1
+
--- /dev/null
+From 1e5f72a6cec84b16fd2b137f56b802f4def8f970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 10:34:21 -0400
+Subject: x86/apic/vector: Warn when vector space exhaustion breaks affinity
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit 743dac494d61d991967ebcfab92e4f80dc7583b3 ]
+
+On x86, CPUs are limited in the number of interrupts they can have affined
+to them as they only support 256 interrupt vectors per CPU. 32 vectors are
+reserved for the CPU and the kernel reserves another 22 for internal
+purposes. That leaves 202 vectors for assignement to devices.
+
+When an interrupt is set up or the affinity is changed by the kernel or the
+administrator, the vector assignment code attempts to honor the requested
+affinity mask. If the vector space on the CPUs in that affinity mask is
+exhausted the code falls back to a wider set of CPUs and assigns a vector
+on a CPU outside of the requested affinity mask silently.
+
+While the effective affinity is reflected in the corresponding
+/proc/irq/$N/effective_affinity* files the silent breakage of the requested
+affinity can lead to unexpected behaviour for administrators.
+
+Add a pr_warn() when this happens so that adminstrators get at least
+informed about it in the syslog.
+
+[ tglx: Massaged changelog and made the pr_warn() more informative ]
+
+Reported-by: djuran@redhat.com
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: djuran@redhat.com
+Link: https://lkml.kernel.org/r/20190822143421.9535-1-nhorman@tuxdriver.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/vector.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index fdacb864c3dd4..2c5676b0a6e7f 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -398,6 +398,17 @@ static int activate_reserved(struct irq_data *irqd)
+ if (!irqd_can_reserve(irqd))
+ apicd->can_reserve = false;
+ }
++
++ /*
++ * Check to ensure that the effective affinity mask is a subset
++ * the user supplied affinity mask, and warn the user if it is not
++ */
++ if (!cpumask_subset(irq_data_get_effective_affinity_mask(irqd),
++ irq_data_get_affinity_mask(irqd))) {
++ pr_warn("irq %u: Affinity broken due to vector space exhaustion.\n",
++ irqd->irq);
++ }
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1bca5295c66984f62684b7a19d55c5337ded6d8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 12:30:17 -0700
+Subject: x86/cpu: Add Tiger Lake to Intel family
+
+From: Gayatri Kammela <gayatri.kammela@intel.com>
+
+[ Upstream commit 6e1c32c5dbb4b90eea8f964c2869d0bde050dbe0 ]
+
+Add the model numbers/CPUIDs of Tiger Lake mobile and desktop to the
+Intel family.
+
+Suggested-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Gayatri Kammela <gayatri.kammela@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rahul Tanwar <rahul.tanwar@linux.intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20190905193020.14707-2-tony.luck@intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/intel-family.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
+index fe7c205233f1c..9ae1c0f05fd2d 100644
+--- a/arch/x86/include/asm/intel-family.h
++++ b/arch/x86/include/asm/intel-family.h
+@@ -73,6 +73,9 @@
+ #define INTEL_FAM6_ICELAKE_MOBILE 0x7E
+ #define INTEL_FAM6_ICELAKE_NNPI 0x9D
+
++#define INTEL_FAM6_TIGERLAKE_L 0x8C
++#define INTEL_FAM6_TIGERLAKE 0x8D
++
+ /* "Small Core" Processors (Atom) */
+
+ #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */
+--
+2.20.1
+
--- /dev/null
+From c1fce9056aa275151f15114a6c50ec2216d1ff2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 09:53:52 +0200
+Subject: x86/mm: Fix cpumask_of_node() error condition
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit bc04a049f058a472695aa22905d57e2b1f4c77d9 ]
+
+When CONFIG_DEBUG_PER_CPU_MAPS=y we validate that the @node argument of
+cpumask_of_node() is a valid node_id. It however forgets to check for
+negative numbers. Fix this by explicitly casting to unsigned int.
+
+ (unsigned)node >= nr_node_ids
+
+verifies: 0 <= node < nr_node_ids
+
+Also ammend the error message to match the condition.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Yunsheng Lin <linyunsheng@huawei.com>
+Link: https://lkml.kernel.org/r/20190903075352.GY2369@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/numa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
+index e6dad600614c2..4123100e0eafe 100644
+--- a/arch/x86/mm/numa.c
++++ b/arch/x86/mm/numa.c
+@@ -861,9 +861,9 @@ void numa_remove_cpu(int cpu)
+ */
+ const struct cpumask *cpumask_of_node(int node)
+ {
+- if (node >= nr_node_ids) {
++ if ((unsigned)node >= nr_node_ids) {
+ printk(KERN_WARNING
+- "cpumask_of_node(%d): node > nr_node_ids(%u)\n",
++ "cpumask_of_node(%d): (unsigned)node >= nr_node_ids(%u)\n",
+ node, nr_node_ids);
+ dump_stack();
+ return cpu_none_mask;
+--
+2.20.1
+
--- /dev/null
+From 9f8f5353e8cdfa657b9a839744bbea909bc04621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 16:24:47 +0200
+Subject: x86/mm/pti: Do not invoke PTI functions when PTI is disabled
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 990784b57731192b7d90c8d4049e6318d81e887d ]
+
+When PTI is disabled at boot time either because the CPU is not affected or
+PTI has been disabled on the command line, the boot code still calls into
+pti_finalize() which then unconditionally invokes:
+
+ pti_clone_entry_text()
+ pti_clone_kernel_text()
+
+pti_clone_kernel_text() was called unconditionally before the 32bit support
+was added and 32bit added the call to pti_clone_entry_text().
+
+The call has no side effects as cloning the page tables into the available
+second one, which was allocated for PTI does not create damage. But it does
+not make sense either and in case that this functionality would be extended
+later this might actually lead to hard to diagnose issues.
+
+Neither function should be called when PTI is runtime disabled. Make the
+invocation conditional.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Song Liu <songliubraving@fb.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190828143124.063353972@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pti.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index b196524759ec5..ba22b50f4eca2 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -666,6 +666,8 @@ void __init pti_init(void)
+ */
+ void pti_finalize(void)
+ {
++ if (!boot_cpu_has(X86_FEATURE_PTI))
++ return;
+ /*
+ * We need to clone everything (again) that maps parts of the
+ * kernel image.
+--
+2.20.1
+
--- /dev/null
+From 64afa61e898c9f86cd9ca4133b126b6cb618b56c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 23:54:55 +0200
+Subject: x86/mm/pti: Handle unaligned address gracefully in
+ pti_clone_pagetable()
+
+From: Song Liu <songliubraving@fb.com>
+
+[ Upstream commit 825d0b73cd7526b0bb186798583fae810091cbac ]
+
+pti_clone_pmds() assumes that the supplied address is either:
+
+ - properly PUD/PMD aligned
+or
+ - the address is actually mapped which means that independently
+ of the mapping level (PUD/PMD/PTE) the next higher mapping
+ exists.
+
+If that's not the case the unaligned address can be incremented by PUD or
+PMD size incorrectly. All callers supply mapped and/or aligned addresses,
+but for the sake of robustness it's better to handle that case properly and
+to emit a warning.
+
+[ tglx: Rewrote changelog and added WARN_ON_ONCE() ]
+
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1908282352470.1938@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pti.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
+index ba22b50f4eca2..7f2140414440d 100644
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -330,13 +330,15 @@ pti_clone_pgtable(unsigned long start, unsigned long end,
+
+ pud = pud_offset(p4d, addr);
+ if (pud_none(*pud)) {
+- addr += PUD_SIZE;
++ WARN_ON_ONCE(addr & ~PUD_MASK);
++ addr = round_up(addr + 1, PUD_SIZE);
+ continue;
+ }
+
+ pmd = pmd_offset(pud, addr);
+ if (pmd_none(*pmd)) {
+- addr += PMD_SIZE;
++ WARN_ON_ONCE(addr & ~PMD_MASK);
++ addr = round_up(addr + 1, PMD_SIZE);
+ continue;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 19580da338ad404d6c2055b4fbf1214eeb93b92b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 12:21:13 +0200
+Subject: x86/platform/intel/iosf_mbi Rewrite locking
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 00452ba9fdb5bf6fb5fea1dae5227b4bbed44fc4 ]
+
+There are 2 problems with the old iosf PMIC I2C bus arbritration code which
+need to be addressed:
+
+1. The lockdep code complains about a possible deadlock in the
+iosf_mbi_[un]block_punit_i2c_access code:
+
+[ 6.712662] ======================================================
+[ 6.712673] WARNING: possible circular locking dependency detected
+[ 6.712685] 5.3.0-rc2+ #79 Not tainted
+[ 6.712692] ------------------------------------------------------
+[ 6.712702] kworker/0:1/7 is trying to acquire lock:
+[ 6.712712] 00000000df1c5681 (iosf_mbi_block_punit_i2c_access_count_mutex){+.+.}, at: iosf_mbi_unblock_punit_i2c_access+0x13/0x90
+[ 6.712739]
+ but task is already holding lock:
+[ 6.712749] 0000000067cb23e7 (iosf_mbi_punit_mutex){+.+.}, at: iosf_mbi_block_punit_i2c_access+0x97/0x186
+[ 6.712768]
+ which lock already depends on the new lock.
+
+[ 6.712780]
+ the existing dependency chain (in reverse order) is:
+[ 6.712792]
+ -> #1 (iosf_mbi_punit_mutex){+.+.}:
+[ 6.712808] __mutex_lock+0xa8/0x9a0
+[ 6.712818] iosf_mbi_block_punit_i2c_access+0x97/0x186
+[ 6.712831] i2c_dw_acquire_lock+0x20/0x30
+[ 6.712841] i2c_dw_set_reg_access+0x15/0xb0
+[ 6.712851] i2c_dw_probe+0x57/0x473
+[ 6.712861] dw_i2c_plat_probe+0x33e/0x640
+[ 6.712874] platform_drv_probe+0x38/0x80
+[ 6.712884] really_probe+0xf3/0x380
+[ 6.712894] driver_probe_device+0x59/0xd0
+[ 6.712905] bus_for_each_drv+0x84/0xd0
+[ 6.712915] __device_attach+0xe4/0x170
+[ 6.712925] bus_probe_device+0x9f/0xb0
+[ 6.712935] deferred_probe_work_func+0x79/0xd0
+[ 6.712946] process_one_work+0x234/0x560
+[ 6.712957] worker_thread+0x50/0x3b0
+[ 6.712967] kthread+0x10a/0x140
+[ 6.712977] ret_from_fork+0x3a/0x50
+[ 6.712986]
+ -> #0 (iosf_mbi_block_punit_i2c_access_count_mutex){+.+.}:
+[ 6.713004] __lock_acquire+0xe07/0x1930
+[ 6.713015] lock_acquire+0x9d/0x1a0
+[ 6.713025] __mutex_lock+0xa8/0x9a0
+[ 6.713035] iosf_mbi_unblock_punit_i2c_access+0x13/0x90
+[ 6.713047] i2c_dw_set_reg_access+0x4d/0xb0
+[ 6.713058] i2c_dw_probe+0x57/0x473
+[ 6.713068] dw_i2c_plat_probe+0x33e/0x640
+[ 6.713079] platform_drv_probe+0x38/0x80
+[ 6.713089] really_probe+0xf3/0x380
+[ 6.713099] driver_probe_device+0x59/0xd0
+[ 6.713109] bus_for_each_drv+0x84/0xd0
+[ 6.713119] __device_attach+0xe4/0x170
+[ 6.713129] bus_probe_device+0x9f/0xb0
+[ 6.713140] deferred_probe_work_func+0x79/0xd0
+[ 6.713150] process_one_work+0x234/0x560
+[ 6.713160] worker_thread+0x50/0x3b0
+[ 6.713170] kthread+0x10a/0x140
+[ 6.713180] ret_from_fork+0x3a/0x50
+[ 6.713189]
+ other info that might help us debug this:
+
+[ 6.713202] Possible unsafe locking scenario:
+
+[ 6.713212] CPU0 CPU1
+[ 6.713221] ---- ----
+[ 6.713229] lock(iosf_mbi_punit_mutex);
+[ 6.713239] lock(iosf_mbi_block_punit_i2c_access_count_mutex);
+[ 6.713253] lock(iosf_mbi_punit_mutex);
+[ 6.713265] lock(iosf_mbi_block_punit_i2c_access_count_mutex);
+[ 6.713276]
+ *** DEADLOCK ***
+
+In practice can never happen because only the first caller which
+increments iosf_mbi_block_punit_i2c_access_count will also take
+iosf_mbi_punit_mutex, that is the whole purpose of the counter, which
+itself is protected by iosf_mbi_block_punit_i2c_access_count_mutex.
+
+But there is no way to tell the lockdep code about this and we really
+want to be able to run a kernel with lockdep enabled without these
+warnings being triggered.
+
+2. The lockdep warning also points out another real problem, if 2 threads
+both are in a block of code protected by iosf_mbi_block_punit_i2c_access
+and the first thread to acquire the block exits before the second thread
+then the second thread will call mutex_unlock on iosf_mbi_punit_mutex,
+but it is not the thread which took the mutex and unlocking by another
+thread is not allowed.
+
+Fix this by getting rid of the notion of holding a mutex for the entire
+duration of the PMIC accesses, be it either from the PUnit side, or from an
+in kernel I2C driver. In general holding a mutex after exiting a function
+is a bad idea and the above problems show this case is no different.
+
+Instead 2 counters are now used, one for PMIC accesses from the PUnit
+and one for accesses from in kernel I2C code. When access is requested
+now the code will wait (using a waitqueue) for the counter of the other
+type of access to reach 0 and on release, if the counter reaches 0 the
+wakequeue is woken.
+
+Note that the counter approach is necessary to allow nested calls.
+The main reason for this is so that a series of i2c transfers can be done
+with the punit blocked from accessing the bus the whole time. This is
+necessary to be able to safely read/modify/write a PMIC register without
+racing with the PUNIT doing the same thing.
+
+Allowing nested iosf_mbi_block_punit_i2c_access() calls also is desirable
+from a performance pov since the whole dance necessary to block the PUnit
+from accessing the PMIC I2C bus is somewhat expensive.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lkml.kernel.org/r/20190812102113.95794-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/intel/iosf_mbi.c | 100 ++++++++++++++++++-----------
+ 1 file changed, 62 insertions(+), 38 deletions(-)
+
+diff --git a/arch/x86/platform/intel/iosf_mbi.c b/arch/x86/platform/intel/iosf_mbi.c
+index 2e796b54cbde1..9e24445004282 100644
+--- a/arch/x86/platform/intel/iosf_mbi.c
++++ b/arch/x86/platform/intel/iosf_mbi.c
+@@ -17,6 +17,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/capability.h>
+ #include <linux/pm_qos.h>
++#include <linux/wait.h>
+
+ #include <asm/iosf_mbi.h>
+
+@@ -201,23 +202,45 @@ EXPORT_SYMBOL(iosf_mbi_available);
+ #define PUNIT_SEMAPHORE_BIT BIT(0)
+ #define PUNIT_SEMAPHORE_ACQUIRE BIT(1)
+
+-static DEFINE_MUTEX(iosf_mbi_punit_mutex);
+-static DEFINE_MUTEX(iosf_mbi_block_punit_i2c_access_count_mutex);
++static DEFINE_MUTEX(iosf_mbi_pmic_access_mutex);
+ static BLOCKING_NOTIFIER_HEAD(iosf_mbi_pmic_bus_access_notifier);
+-static u32 iosf_mbi_block_punit_i2c_access_count;
++static DECLARE_WAIT_QUEUE_HEAD(iosf_mbi_pmic_access_waitq);
++static u32 iosf_mbi_pmic_punit_access_count;
++static u32 iosf_mbi_pmic_i2c_access_count;
+ static u32 iosf_mbi_sem_address;
+ static unsigned long iosf_mbi_sem_acquired;
+ static struct pm_qos_request iosf_mbi_pm_qos;
+
+ void iosf_mbi_punit_acquire(void)
+ {
+- mutex_lock(&iosf_mbi_punit_mutex);
++ /* Wait for any I2C PMIC accesses from in kernel drivers to finish. */
++ mutex_lock(&iosf_mbi_pmic_access_mutex);
++ while (iosf_mbi_pmic_i2c_access_count != 0) {
++ mutex_unlock(&iosf_mbi_pmic_access_mutex);
++ wait_event(iosf_mbi_pmic_access_waitq,
++ iosf_mbi_pmic_i2c_access_count == 0);
++ mutex_lock(&iosf_mbi_pmic_access_mutex);
++ }
++ /*
++ * We do not need to do anything to allow the PUNIT to safely access
++ * the PMIC, other then block in kernel accesses to the PMIC.
++ */
++ iosf_mbi_pmic_punit_access_count++;
++ mutex_unlock(&iosf_mbi_pmic_access_mutex);
+ }
+ EXPORT_SYMBOL(iosf_mbi_punit_acquire);
+
+ void iosf_mbi_punit_release(void)
+ {
+- mutex_unlock(&iosf_mbi_punit_mutex);
++ bool do_wakeup;
++
++ mutex_lock(&iosf_mbi_pmic_access_mutex);
++ iosf_mbi_pmic_punit_access_count--;
++ do_wakeup = iosf_mbi_pmic_punit_access_count == 0;
++ mutex_unlock(&iosf_mbi_pmic_access_mutex);
++
++ if (do_wakeup)
++ wake_up(&iosf_mbi_pmic_access_waitq);
+ }
+ EXPORT_SYMBOL(iosf_mbi_punit_release);
+
+@@ -256,34 +279,32 @@ static void iosf_mbi_reset_semaphore(void)
+ * already blocked P-Unit accesses because it wants them blocked over multiple
+ * i2c-transfers, for e.g. read-modify-write of an I2C client register.
+ *
+- * The P-Unit accesses already being blocked is tracked through the
+- * iosf_mbi_block_punit_i2c_access_count variable which is protected by the
+- * iosf_mbi_block_punit_i2c_access_count_mutex this mutex is hold for the
+- * entire duration of the function.
+- *
+- * If access is not blocked yet, this function takes the following steps:
++ * To allow safe PMIC i2c bus accesses this function takes the following steps:
+ *
+ * 1) Some code sends request to the P-Unit which make it access the PMIC
+ * I2C bus. Testing has shown that the P-Unit does not check its internal
+ * PMIC bus semaphore for these requests. Callers of these requests call
+ * iosf_mbi_punit_acquire()/_release() around their P-Unit accesses, these
+- * functions lock/unlock the iosf_mbi_punit_mutex.
+- * As the first step we lock the iosf_mbi_punit_mutex, to wait for any in
+- * flight requests to finish and to block any new requests.
++ * functions increase/decrease iosf_mbi_pmic_punit_access_count, so first
++ * we wait for iosf_mbi_pmic_punit_access_count to become 0.
++ *
++ * 2) Check iosf_mbi_pmic_i2c_access_count, if access has already
++ * been blocked by another caller, we only need to increment
++ * iosf_mbi_pmic_i2c_access_count and we can skip the other steps.
+ *
+- * 2) Some code makes such P-Unit requests from atomic contexts where it
++ * 3) Some code makes such P-Unit requests from atomic contexts where it
+ * cannot call iosf_mbi_punit_acquire() as that may sleep.
+ * As the second step we call a notifier chain which allows any code
+ * needing P-Unit resources from atomic context to acquire them before
+ * we take control over the PMIC I2C bus.
+ *
+- * 3) When CPU cores enter C6 or C7 the P-Unit needs to talk to the PMIC
++ * 4) When CPU cores enter C6 or C7 the P-Unit needs to talk to the PMIC
+ * if this happens while the kernel itself is accessing the PMIC I2C bus
+ * the SoC hangs.
+ * As the third step we call pm_qos_update_request() to disallow the CPU
+ * to enter C6 or C7.
+ *
+- * 4) The P-Unit has a PMIC bus semaphore which we can request to stop
++ * 5) The P-Unit has a PMIC bus semaphore which we can request to stop
+ * autonomous P-Unit tasks from accessing the PMIC I2C bus while we hold it.
+ * As the fourth and final step we request this semaphore and wait for our
+ * request to be acknowledged.
+@@ -297,12 +318,18 @@ int iosf_mbi_block_punit_i2c_access(void)
+ if (WARN_ON(!mbi_pdev || !iosf_mbi_sem_address))
+ return -ENXIO;
+
+- mutex_lock(&iosf_mbi_block_punit_i2c_access_count_mutex);
++ mutex_lock(&iosf_mbi_pmic_access_mutex);
+
+- if (iosf_mbi_block_punit_i2c_access_count > 0)
++ while (iosf_mbi_pmic_punit_access_count != 0) {
++ mutex_unlock(&iosf_mbi_pmic_access_mutex);
++ wait_event(iosf_mbi_pmic_access_waitq,
++ iosf_mbi_pmic_punit_access_count == 0);
++ mutex_lock(&iosf_mbi_pmic_access_mutex);
++ }
++
++ if (iosf_mbi_pmic_i2c_access_count > 0)
+ goto success;
+
+- mutex_lock(&iosf_mbi_punit_mutex);
+ blocking_notifier_call_chain(&iosf_mbi_pmic_bus_access_notifier,
+ MBI_PMIC_BUS_ACCESS_BEGIN, NULL);
+
+@@ -330,10 +357,6 @@ int iosf_mbi_block_punit_i2c_access(void)
+ iosf_mbi_sem_acquired = jiffies;
+ dev_dbg(&mbi_pdev->dev, "P-Unit semaphore acquired after %ums\n",
+ jiffies_to_msecs(jiffies - start));
+- /*
+- * Success, keep iosf_mbi_punit_mutex locked till
+- * iosf_mbi_unblock_punit_i2c_access() gets called.
+- */
+ goto success;
+ }
+
+@@ -344,15 +367,13 @@ int iosf_mbi_block_punit_i2c_access(void)
+ dev_err(&mbi_pdev->dev, "Error P-Unit semaphore timed out, resetting\n");
+ error:
+ iosf_mbi_reset_semaphore();
+- mutex_unlock(&iosf_mbi_punit_mutex);
+-
+ if (!iosf_mbi_get_sem(&sem))
+ dev_err(&mbi_pdev->dev, "P-Unit semaphore: %d\n", sem);
+ success:
+ if (!WARN_ON(ret))
+- iosf_mbi_block_punit_i2c_access_count++;
++ iosf_mbi_pmic_i2c_access_count++;
+
+- mutex_unlock(&iosf_mbi_block_punit_i2c_access_count_mutex);
++ mutex_unlock(&iosf_mbi_pmic_access_mutex);
+
+ return ret;
+ }
+@@ -360,17 +381,20 @@ EXPORT_SYMBOL(iosf_mbi_block_punit_i2c_access);
+
+ void iosf_mbi_unblock_punit_i2c_access(void)
+ {
+- mutex_lock(&iosf_mbi_block_punit_i2c_access_count_mutex);
++ bool do_wakeup = false;
+
+- iosf_mbi_block_punit_i2c_access_count--;
+- if (iosf_mbi_block_punit_i2c_access_count == 0) {
++ mutex_lock(&iosf_mbi_pmic_access_mutex);
++ iosf_mbi_pmic_i2c_access_count--;
++ if (iosf_mbi_pmic_i2c_access_count == 0) {
+ iosf_mbi_reset_semaphore();
+- mutex_unlock(&iosf_mbi_punit_mutex);
+ dev_dbg(&mbi_pdev->dev, "punit semaphore held for %ums\n",
+ jiffies_to_msecs(jiffies - iosf_mbi_sem_acquired));
++ do_wakeup = true;
+ }
++ mutex_unlock(&iosf_mbi_pmic_access_mutex);
+
+- mutex_unlock(&iosf_mbi_block_punit_i2c_access_count_mutex);
++ if (do_wakeup)
++ wake_up(&iosf_mbi_pmic_access_waitq);
+ }
+ EXPORT_SYMBOL(iosf_mbi_unblock_punit_i2c_access);
+
+@@ -379,10 +403,10 @@ int iosf_mbi_register_pmic_bus_access_notifier(struct notifier_block *nb)
+ int ret;
+
+ /* Wait for the bus to go inactive before registering */
+- mutex_lock(&iosf_mbi_punit_mutex);
++ iosf_mbi_punit_acquire();
+ ret = blocking_notifier_chain_register(
+ &iosf_mbi_pmic_bus_access_notifier, nb);
+- mutex_unlock(&iosf_mbi_punit_mutex);
++ iosf_mbi_punit_release();
+
+ return ret;
+ }
+@@ -403,9 +427,9 @@ int iosf_mbi_unregister_pmic_bus_access_notifier(struct notifier_block *nb)
+ int ret;
+
+ /* Wait for the bus to go inactive before unregistering */
+- mutex_lock(&iosf_mbi_punit_mutex);
++ iosf_mbi_punit_acquire();
+ ret = iosf_mbi_unregister_pmic_bus_access_notifier_unlocked(nb);
+- mutex_unlock(&iosf_mbi_punit_mutex);
++ iosf_mbi_punit_release();
+
+ return ret;
+ }
+@@ -413,7 +437,7 @@ EXPORT_SYMBOL(iosf_mbi_unregister_pmic_bus_access_notifier);
+
+ void iosf_mbi_assert_punit_acquired(void)
+ {
+- WARN_ON(!mutex_is_locked(&iosf_mbi_punit_mutex));
++ WARN_ON(iosf_mbi_pmic_punit_access_count == 0);
+ }
+ EXPORT_SYMBOL(iosf_mbi_assert_punit_acquired);
+
+--
+2.20.1
+
--- /dev/null
+From 3e43db958d74f6be8d3a2090dc9296ff562d240b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 14:28:13 +0200
+Subject: x86/reboot: Always use NMI fallback when shutdown via reboot vector
+ IPI fails
+
+From: Grzegorz Halat <ghalat@redhat.com>
+
+[ Upstream commit 747d5a1bf293dcb33af755a6d285d41b8c1ea010 ]
+
+A reboot request sends an IPI via the reboot vector and waits for all other
+CPUs to stop. If one or more CPUs are in critical regions with interrupts
+disabled then the IPI is not handled on those CPUs and the shutdown hangs
+if native_stop_other_cpus() is called with the wait argument set.
+
+Such a situation can happen when one CPU was stopped within a lock held
+section and another CPU is trying to acquire that lock with interrupts
+disabled. There are other scenarios which can cause such a lockup as well.
+
+In theory the shutdown should be attempted by an NMI IPI after the timeout
+period elapsed. Though the wait loop after sending the reboot vector IPI
+prevents this. It checks the wait request argument and the timeout. If wait
+is set, which is true for sys_reboot() then it won't fall through to the
+NMI shutdown method after the timeout period has finished.
+
+This was an oversight when the NMI shutdown mechanism was added to handle
+the 'reboot IPI is not working' situation. The mechanism was added to deal
+with stuck panic shutdowns, which do not have the wait request set, so the
+'wait request' case was probably not considered.
+
+Remove the wait check from the post reboot vector IPI wait loop and enforce
+that the wait loop in the NMI fallback path is invoked even if NMI IPIs are
+disabled or the registration of the NMI handler fails. That second wait
+loop will then hang if not all CPUs shutdown and the wait argument is set.
+
+[ tglx: Avoid the hard to parse line break in the NMI fallback path,
+ add comments and massage the changelog ]
+
+Fixes: 7d007d21e539 ("x86/reboot: Use NMI to assist in shutting down if IRQ fails")
+Signed-off-by: Grzegorz Halat <ghalat@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Don Zickus <dzickus@redhat.com>
+Link: https://lkml.kernel.org/r/20190628122813.15500-1-ghalat@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/smp.c | 46 +++++++++++++++++++++++++------------------
+ 1 file changed, 27 insertions(+), 19 deletions(-)
+
+diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
+index 96421f97e75cf..231fa230ebc73 100644
+--- a/arch/x86/kernel/smp.c
++++ b/arch/x86/kernel/smp.c
+@@ -179,6 +179,12 @@ asmlinkage __visible void smp_reboot_interrupt(void)
+ irq_exit();
+ }
+
++static int register_stop_handler(void)
++{
++ return register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback,
++ NMI_FLAG_FIRST, "smp_stop");
++}
++
+ static void native_stop_other_cpus(int wait)
+ {
+ unsigned long flags;
+@@ -212,39 +218,41 @@ static void native_stop_other_cpus(int wait)
+ apic->send_IPI_allbutself(REBOOT_VECTOR);
+
+ /*
+- * Don't wait longer than a second if the caller
+- * didn't ask us to wait.
++ * Don't wait longer than a second for IPI completion. The
++ * wait request is not checked here because that would
++ * prevent an NMI shutdown attempt in case that not all
++ * CPUs reach shutdown state.
+ */
+ timeout = USEC_PER_SEC;
+- while (num_online_cpus() > 1 && (wait || timeout--))
++ while (num_online_cpus() > 1 && timeout--)
+ udelay(1);
+ }
+-
+- /* if the REBOOT_VECTOR didn't work, try with the NMI */
+- if ((num_online_cpus() > 1) && (!smp_no_nmi_ipi)) {
+- if (register_nmi_handler(NMI_LOCAL, smp_stop_nmi_callback,
+- NMI_FLAG_FIRST, "smp_stop"))
+- /* Note: we ignore failures here */
+- /* Hope the REBOOT_IRQ is good enough */
+- goto finish;
+-
+- /* sync above data before sending IRQ */
+- wmb();
+
+- pr_emerg("Shutting down cpus with NMI\n");
++ /* if the REBOOT_VECTOR didn't work, try with the NMI */
++ if (num_online_cpus() > 1) {
++ /*
++ * If NMI IPI is enabled, try to register the stop handler
++ * and send the IPI. In any case try to wait for the other
++ * CPUs to stop.
++ */
++ if (!smp_no_nmi_ipi && !register_stop_handler()) {
++ /* Sync above data before sending IRQ */
++ wmb();
+
+- apic->send_IPI_allbutself(NMI_VECTOR);
++ pr_emerg("Shutting down cpus with NMI\n");
+
++ apic->send_IPI_allbutself(NMI_VECTOR);
++ }
+ /*
+- * Don't wait longer than a 10 ms if the caller
+- * didn't ask us to wait.
++ * Don't wait longer than 10 ms if the caller didn't
++ * reqeust it. If wait is true, the machine hangs here if
++ * one or more CPUs do not reach shutdown state.
+ */
+ timeout = USEC_PER_MSEC * 10;
+ while (num_online_cpus() > 1 && (wait || timeout--))
+ udelay(1);
+ }
+
+-finish:
+ local_irq_save(flags);
+ disable_local_APIC();
+ mcheck_cpu_clear(this_cpu_ptr(&cpu_info));
+--
+2.20.1
+
--- /dev/null
+From 60b9ed1acb715a67d73c68dd20c0233c934f2564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2019 14:04:11 +0200
+Subject: zd1211rw: remove false assertion from zd_mac_clear()
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit 7a2eb7367fdea72e448d1a847aa857f6caf8ea2f ]
+
+The function is called before the lock which is asserted was ever used.
+Just remove it.
+
+Reported-by: syzbot+74c65761783d66a9c97c@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/zydas/zd1211rw/zd_mac.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+index da7e63fca9f57..a9999d10ae81f 100644
+--- a/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
++++ b/drivers/net/wireless/zydas/zd1211rw/zd_mac.c
+@@ -223,7 +223,6 @@ void zd_mac_clear(struct zd_mac *mac)
+ {
+ flush_workqueue(zd_workqueue);
+ zd_chip_clear(&mac->chip);
+- lockdep_assert_held(&mac->lock);
+ ZD_MEMCLEAR(mac, sizeof(struct zd_mac));
+ }
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
