--- /dev/null
+From 9b8136a0dd0f07032c0cecb5f4e64b9ae65d8015 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jul 2019 20:38:15 +0100
+Subject: ARM: 8875/1: Kconfig: default to AEABI w/ Clang
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit a05b9608456e0d4464c6f7ca8572324ace57a3f4 ]
+
+Clang produces references to __aeabi_uidivmod and __aeabi_idivmod for
+arm-linux-gnueabi and arm-linux-gnueabihf targets incorrectly when AEABI
+is not selected (such as when OABI_COMPAT is selected).
+
+While this means that OABI userspaces wont be able to upgraded to
+kernels built with Clang, it means that boards that don't enable AEABI
+like s3c2410_defconfig will stop failing to link in KernelCI when built
+with Clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/482
+Link: https://groups.google.com/forum/#!msg/clang-built-linux/yydsAAux5hk/GxjqJSW-AQAJ
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 8869742a85df1..3539be8700558 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1545,8 +1545,9 @@ config ARM_PATCH_IDIV
+ code to do integer division.
+
+ config AEABI
+- bool "Use the ARM EABI to compile the kernel" if !CPU_V7 && !CPU_V7M && !CPU_V6 && !CPU_V6K
+- default CPU_V7 || CPU_V7M || CPU_V6 || CPU_V6K
++ bool "Use the ARM EABI to compile the kernel" if !CPU_V7 && \
++ !CPU_V7M && !CPU_V6 && !CPU_V6K && !CC_IS_CLANG
++ default CPU_V7 || CPU_V7M || CPU_V6 || CPU_V6K || CC_IS_CLANG
+ help
+ This option allows for the kernel to be compiled using the latest
+ ARM ABI (aka EABI). This is only useful if you are using a user
+--
+2.20.1
+
--- /dev/null
+From faf72d76f47fa1195711597340e47a1daadb477a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 16:51:00 +0100
+Subject: ARM: 8898/1: mm: Don't treat faults reported from cache maintenance
+ as writes
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 834020366da9ab3fb87d1eb9a3160eb22dbed63a ]
+
+Translation faults arising from cache maintenance instructions are
+rather unhelpfully reported with an FSR value where the WnR field is set
+to 1, indicating that the faulting access was a write. Since cache
+maintenance instructions on 32-bit ARM do not require any particular
+permissions, this can cause our private 'cacheflush' system call to fail
+spuriously if a translation fault is generated due to page aging when
+targetting a read-only VMA.
+
+In this situation, we will return -EFAULT to userspace, although this is
+unfortunately suppressed by the popular '__builtin___clear_cache()'
+intrinsic provided by GCC, which returns void.
+
+Although it's tempting to write this off as a userspace issue, we can
+actually do a little bit better on CPUs that support LPAE, even if the
+short-descriptor format is in use. On these CPUs, cache maintenance
+faults additionally set the CM field in the FSR, which we can use to
+suppress the write permission checks in the page fault handler and
+succeed in performing cache maintenance to read-only areas even in the
+presence of a translation fault.
+
+Reported-by: Orion Hodson <oth@google.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/fault.c | 4 ++--
+ arch/arm/mm/fault.h | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index 0048eadd0681a..e76155d5840bd 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -211,7 +211,7 @@ static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
+ {
+ unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
+
+- if (fsr & FSR_WRITE)
++ if ((fsr & FSR_WRITE) && !(fsr & FSR_CM))
+ mask = VM_WRITE;
+ if (fsr & FSR_LNX_PF)
+ mask = VM_EXEC;
+@@ -282,7 +282,7 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ if (user_mode(regs))
+ flags |= FAULT_FLAG_USER;
+- if (fsr & FSR_WRITE)
++ if ((fsr & FSR_WRITE) && !(fsr & FSR_CM))
+ flags |= FAULT_FLAG_WRITE;
+
+ /*
+diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
+index c063708fa5032..9ecc2097a87a0 100644
+--- a/arch/arm/mm/fault.h
++++ b/arch/arm/mm/fault.h
+@@ -6,6 +6,7 @@
+ * Fault status register encodings. We steal bit 31 for our own purposes.
+ */
+ #define FSR_LNX_PF (1 << 31)
++#define FSR_CM (1 << 13)
+ #define FSR_WRITE (1 << 11)
+ #define FSR_FS4 (1 << 10)
+ #define FSR_FS3_0 (15)
+--
+2.20.1
+
--- /dev/null
+From a3cdce4cd24ce7a19f71be5a8abbfcd6bd4f5311 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 14:27:56 +0100
+Subject: ARM: 8903/1: ensure that usable memory in bank 0 starts from a
+ PMD-aligned address
+
+From: Mike Rapoport <mike.rapoport@gmail.com>
+
+[ Upstream commit 00d2ec1e6bd82c0538e6dd3e4a4040de93ba4fef ]
+
+The calculation of memblock_limit in adjust_lowmem_bounds() assumes that
+bank 0 starts from a PMD-aligned address. However, the beginning of the
+first bank may be NOMAP memory and the start of usable memory
+will be not aligned to PMD boundary. In such case the memblock_limit will
+be set to the end of the NOMAP region, which will prevent any memblock
+allocations.
+
+Mark the region between the end of the NOMAP area and the next PMD-aligned
+address as NOMAP as well, so that the usable memory will start at
+PMD-aligned address.
+
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/mmu.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
+index 1aa2586fa597b..13233c7917fe7 100644
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -1177,6 +1177,22 @@ void __init adjust_lowmem_bounds(void)
+ */
+ vmalloc_limit = (u64)(uintptr_t)vmalloc_min - PAGE_OFFSET + PHYS_OFFSET;
+
++ /*
++ * The first usable region must be PMD aligned. Mark its start
++ * as MEMBLOCK_NOMAP if it isn't
++ */
++ for_each_memblock(memory, reg) {
++ if (!memblock_is_nomap(reg)) {
++ if (!IS_ALIGNED(reg->base, PMD_SIZE)) {
++ phys_addr_t len;
++
++ len = round_up(reg->base, PMD_SIZE) - reg->base;
++ memblock_mark_nomap(reg->base, len);
++ }
++ break;
++ }
++ }
++
+ for_each_memblock(memory, reg) {
+ phys_addr_t block_start = reg->base;
+ phys_addr_t block_end = reg->base + reg->size;
+--
+2.20.1
+
--- /dev/null
+From bf4086fc44dc3dfb5f4b28ff8613de33e5125212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 01:13:15 +0100
+Subject: ARM: 8905/1: Emit __gnu_mcount_nc when using Clang 10.0.0 or newer
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b0fe66cf095016e0b238374c10ae366e1f087d11 ]
+
+Currently, multi_v7_defconfig + CONFIG_FUNCTION_TRACER fails to build
+with clang:
+
+arm-linux-gnueabi-ld: kernel/softirq.o: in function `_local_bh_enable':
+softirq.c:(.text+0x504): undefined reference to `mcount'
+arm-linux-gnueabi-ld: kernel/softirq.o: in function `__local_bh_enable_ip':
+softirq.c:(.text+0x58c): undefined reference to `mcount'
+arm-linux-gnueabi-ld: kernel/softirq.o: in function `do_softirq':
+softirq.c:(.text+0x6c8): undefined reference to `mcount'
+arm-linux-gnueabi-ld: kernel/softirq.o: in function `irq_enter':
+softirq.c:(.text+0x75c): undefined reference to `mcount'
+arm-linux-gnueabi-ld: kernel/softirq.o: in function `irq_exit':
+softirq.c:(.text+0x840): undefined reference to `mcount'
+arm-linux-gnueabi-ld: kernel/softirq.o:softirq.c:(.text+0xa50): more undefined references to `mcount' follow
+
+clang can emit a working mcount symbol, __gnu_mcount_nc, when
+'-meabi gnu' is passed to it. Until r369147 in LLVM, this was
+broken and caused the kernel not to boot with '-pg' because the
+calling convention was not correct. Always build with '-meabi gnu'
+when using clang but ensure that '-pg' (which is added with
+CONFIG_FUNCTION_TRACER and its prereq CONFIG_HAVE_FUNCTION_TRACER)
+cannot be added with it unless this is fixed (which means using
+clang 10.0.0 and newer).
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/35
+Link: https://bugs.llvm.org/show_bug.cgi?id=33845
+Link: https://github.com/llvm/llvm-project/commit/16fa8b09702378bacfa3d07081afe6b353b99e60
+
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ arch/arm/Makefile | 4 ++++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 3539be8700558..6029d324911cf 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -75,7 +75,7 @@ config ARM
+ select HAVE_EXIT_THREAD
+ select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL
+ select HAVE_FUNCTION_GRAPH_TRACER if !THUMB2_KERNEL && !CC_IS_CLANG
+- select HAVE_FUNCTION_TRACER if !XIP_KERNEL
++ select HAVE_FUNCTION_TRACER if !XIP_KERNEL && (CC_IS_GCC || CLANG_VERSION >= 100000)
+ select HAVE_GCC_PLUGINS
+ select HAVE_HW_BREAKPOINT if PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7)
+ select HAVE_IDE if PCI || ISA || PCMCIA
+diff --git a/arch/arm/Makefile b/arch/arm/Makefile
+index f863c6935d0e5..c0b2783583016 100644
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -112,6 +112,10 @@ ifeq ($(CONFIG_ARM_UNWIND),y)
+ CFLAGS_ABI +=-funwind-tables
+ endif
+
++ifeq ($(CONFIG_CC_IS_CLANG),y)
++CFLAGS_ABI += -meabi gnu
++endif
++
+ # Accept old syntax despite ".syntax unified"
+ AFLAGS_NOWARN :=$(call as-option,-Wa$(comma)-mno-warn-deprecated,-Wa$(comma)-W)
+
+--
+2.20.1
+
--- /dev/null
+From 4a9f12b9cf0101b2350f702b1df64d961737c2a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:38:54 -0700
+Subject: arm: properly account for stack randomization and stack guard gap
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit af0f4297286f13a75edf93677b1fb2fc16c412a7 ]
+
+This commit takes care of stack randomization and stack guard gap when
+computing mmap base address and checks if the task asked for
+randomization. This fixes the problem uncovered and not fixed for arm
+here: https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com
+
+Link: http://lkml.kernel.org/r/20190730055113.23635-7-alex@ghiti.fr
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Acked-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Palmer Dabbelt <palmer@sifive.com>
+Cc: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/mmap.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
+index f866870db749c..bff3d00bda5be 100644
+--- a/arch/arm/mm/mmap.c
++++ b/arch/arm/mm/mmap.c
+@@ -18,8 +18,9 @@
+ (((pgoff)<<PAGE_SHIFT) & (SHMLBA-1)))
+
+ /* gap between mmap and stack */
+-#define MIN_GAP (128*1024*1024UL)
+-#define MAX_GAP ((TASK_SIZE)/6*5)
++#define MIN_GAP (128*1024*1024UL)
++#define MAX_GAP ((TASK_SIZE)/6*5)
++#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
+
+ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ {
+@@ -35,6 +36,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ {
+ unsigned long gap = rlim_stack->rlim_cur;
++ unsigned long pad = stack_guard_gap;
++
++ /* Account for stack randomization if necessary */
++ if (current->flags & PF_RANDOMIZE)
++ pad += (STACK_RND_MASK << PAGE_SHIFT);
++
++ /* Values close to RLIM_INFINITY can overflow. */
++ if (gap + pad > gap)
++ gap += pad;
+
+ if (gap < MIN_GAP)
+ gap = MIN_GAP;
+--
+2.20.1
+
--- /dev/null
+From 57d6853b216e442052aa5feb2ea68a43cc0d40f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:38:57 -0700
+Subject: arm: use STACK_TOP when computing mmap base address
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit 86e568e9c0525fc40e76d827212d5e9721cf7504 ]
+
+mmap base address must be computed wrt stack top address, using TASK_SIZE
+is wrong since STACK_TOP and TASK_SIZE are not equivalent.
+
+Link: http://lkml.kernel.org/r/20190730055113.23635-8-alex@ghiti.fr
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Acked-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Palmer Dabbelt <palmer@sifive.com>
+Cc: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/mmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
+index bff3d00bda5be..0b94b674aa91f 100644
+--- a/arch/arm/mm/mmap.c
++++ b/arch/arm/mm/mmap.c
+@@ -19,7 +19,7 @@
+
+ /* gap between mmap and stack */
+ #define MIN_GAP (128*1024*1024UL)
+-#define MAX_GAP ((TASK_SIZE)/6*5)
++#define MAX_GAP ((STACK_TOP)/6*5)
+ #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
+
+ static int mmap_is_legacy(struct rlimit *rlim_stack)
+@@ -51,7 +51,7 @@ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ else if (gap > MAX_GAP)
+ gap = MAX_GAP;
+
+- return PAGE_ALIGN(TASK_SIZE - gap - rnd);
++ return PAGE_ALIGN(STACK_TOP - gap - rnd);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From eefaadc154ff99160c977bb9c42fad0150534d55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:38:43 -0700
+Subject: arm64: consider stack randomization for mmap base only when necessary
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit e8d54b62c55ab6201de6d195fc2c276294c1f6ae ]
+
+Do not offset mmap base address because of stack randomization if current
+task does not want randomization. Note that x86 already implements this
+behaviour.
+
+Link: http://lkml.kernel.org/r/20190730055113.23635-4-alex@ghiti.fr
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Palmer Dabbelt <palmer@sifive.com>
+Cc: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/mm/mmap.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
+index b050641b51392..8dac7110f0cb5 100644
+--- a/arch/arm64/mm/mmap.c
++++ b/arch/arm64/mm/mmap.c
+@@ -54,7 +54,11 @@ unsigned long arch_mmap_rnd(void)
+ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ {
+ unsigned long gap = rlim_stack->rlim_cur;
+- unsigned long pad = (STACK_RND_MASK << PAGE_SHIFT) + stack_guard_gap;
++ unsigned long pad = stack_guard_gap;
++
++ /* Account for stack randomization if necessary */
++ if (current->flags & PF_RANDOMIZE)
++ pad += (STACK_RND_MASK << PAGE_SHIFT);
+
+ /* Values close to RLIM_INFINITY can overflow. */
+ if (gap + pad > gap)
+--
+2.20.1
+
--- /dev/null
+From e4f0c152aea7201ebad8ab923298752fdeaab6f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 13:56:22 +0200
+Subject: arm64: fix unreachable code issue with cmpxchg
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 920fdab7b3ce98c14c840261e364f490f3679a62 ]
+
+On arm64 build with clang, sometimes the __cmpxchg_mb is not inlined
+when CONFIG_OPTIMIZE_INLINING is set.
+Clang then fails a compile-time assertion, because it cannot tell at
+compile time what the size of the argument is:
+
+mm/memcontrol.o: In function `__cmpxchg_mb':
+memcontrol.c:(.text+0x1a4c): undefined reference to `__compiletime_assert_175'
+memcontrol.c:(.text+0x1a4c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__compiletime_assert_175'
+
+Mark all of the cmpxchg() style functions as __always_inline to
+ensure that the compiler can see the result.
+
+Acked-by: Nick Desaulniers <ndesaulniers@google.com>
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/648
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Tested-by: Andrew Murray <andrew.murray@arm.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/cmpxchg.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
+index 7a299a20f6dcc..7a8b8bc69e8d1 100644
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -63,7 +63,7 @@ __XCHG_CASE( , , mb_, 64, dmb ish, nop, , a, l, "memory")
+ #undef __XCHG_CASE
+
+ #define __XCHG_GEN(sfx) \
+-static inline unsigned long __xchg##sfx(unsigned long x, \
++static __always_inline unsigned long __xchg##sfx(unsigned long x, \
+ volatile void *ptr, \
+ int size) \
+ { \
+@@ -105,7 +105,7 @@ __XCHG_GEN(_mb)
+ #define arch_xchg(...) __xchg_wrapper( _mb, __VA_ARGS__)
+
+ #define __CMPXCHG_GEN(sfx) \
+-static inline unsigned long __cmpxchg##sfx(volatile void *ptr, \
++static __always_inline unsigned long __cmpxchg##sfx(volatile void *ptr, \
+ unsigned long old, \
+ unsigned long new, \
+ int size) \
+@@ -212,7 +212,7 @@ __CMPWAIT_CASE( , , 64);
+ #undef __CMPWAIT_CASE
+
+ #define __CMPWAIT_GEN(sfx) \
+-static inline void __cmpwait##sfx(volatile void *ptr, \
++static __always_inline void __cmpwait##sfx(volatile void *ptr, \
+ unsigned long val, \
+ int size) \
+ { \
+--
+2.20.1
+
--- /dev/null
+From 66477ccb6afcfa583f35ef0b306237b99200d333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 12:35:09 -0700
+Subject: clk: actions: Don't reference clk_init_data after registration
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit cf9ec1fc6d7cceb73e7f1efd079d2eae173fdf57 ]
+
+A future patch is going to change semantics of clk_register() so that
+clk_hw::init is guaranteed to be NULL after a clk is registered. Avoid
+referencing this member here so that we don't run into NULL pointer
+exceptions.
+
+Cc: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20190731193517.237136-2-sboyd@kernel.org
+[sboyd@kernel.org: Move name to after checking for error or NULL hw]
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/actions/owl-common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/actions/owl-common.c b/drivers/clk/actions/owl-common.c
+index 32dd29e0a37e1..4de97cc7cb54d 100644
+--- a/drivers/clk/actions/owl-common.c
++++ b/drivers/clk/actions/owl-common.c
+@@ -68,16 +68,17 @@ int owl_clk_probe(struct device *dev, struct clk_hw_onecell_data *hw_clks)
+ struct clk_hw *hw;
+
+ for (i = 0; i < hw_clks->num; i++) {
++ const char *name;
+
+ hw = hw_clks->hws[i];
+-
+ if (IS_ERR_OR_NULL(hw))
+ continue;
+
++ name = hw->init->name;
+ ret = devm_clk_hw_register(dev, hw);
+ if (ret) {
+ dev_err(dev, "Couldn't register clock %d - %s\n",
+- i, hw->init->name);
++ i, name);
+ return ret;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 680cee3b1c83f59f6d15501bfcd26ddc924eecb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 15:30:34 +0000
+Subject: clk: at91: select parent if main oscillator or bypass is enabled
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 69a6bcde7fd3fe6f3268ce26f31d9d9378384c98 ]
+
+Selecting the right parent for the main clock is done using only
+main oscillator enabled bit.
+In case we have this oscillator bypassed by an external signal (no driving
+on the XOUT line), we still use external clock, but with BYPASS bit set.
+So, in this case we must select the same parent as before.
+Create a macro that will select the right parent considering both bits from
+the MOR register.
+Use this macro when looking for the right parent.
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Link: https://lkml.kernel.org/r/1568042692-11784-2-git-send-email-eugen.hristev@microchip.com
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-main.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index f607ee702c838..311cea0c3ae2b 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -21,6 +21,10 @@
+
+ #define MOR_KEY_MASK (0xff << 16)
+
++#define clk_main_parent_select(s) (((s) & \
++ (AT91_PMC_MOSCEN | \
++ AT91_PMC_OSCBYPASS)) ? 1 : 0)
++
+ struct clk_main_osc {
+ struct clk_hw hw;
+ struct regmap *regmap;
+@@ -113,7 +117,7 @@ static int clk_main_osc_is_prepared(struct clk_hw *hw)
+
+ regmap_read(regmap, AT91_PMC_SR, &status);
+
+- return (status & AT91_PMC_MOSCS) && (tmp & AT91_PMC_MOSCEN);
++ return (status & AT91_PMC_MOSCS) && clk_main_parent_select(tmp);
+ }
+
+ static const struct clk_ops main_osc_ops = {
+@@ -450,7 +454,7 @@ static u8 clk_sam9x5_main_get_parent(struct clk_hw *hw)
+
+ regmap_read(clkmain->regmap, AT91_CKGR_MOR, &status);
+
+- return status & AT91_PMC_MOSCEN ? 1 : 0;
++ return clk_main_parent_select(status);
+ }
+
+ static const struct clk_ops sam9x5_main_ops = {
+@@ -492,7 +496,7 @@ at91_clk_register_sam9x5_main(struct regmap *regmap,
+ clkmain->hw.init = &init;
+ clkmain->regmap = regmap;
+ regmap_read(clkmain->regmap, AT91_CKGR_MOR, &status);
+- clkmain->parent = status & AT91_PMC_MOSCEN ? 1 : 0;
++ clkmain->parent = clk_main_parent_select(status);
+
+ hw = &clkmain->hw;
+ ret = clk_hw_register(NULL, &clkmain->hw);
+--
+2.20.1
+
--- /dev/null
+From 7ca5ebb5fd31dca54abc2032fe49f447333cae82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 03:39:39 +0000
+Subject: clk: imx: clk-pll14xx: unbypass PLL by default
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit a9aa8306074d9519dd6e5fdf07240b01bac72e04 ]
+
+When registering the PLL, unbypass the PLL.
+The PLL has two bypass control bit, BYPASS and EXT_BYPASS.
+we will expose EXT_BYPASS to clk driver for mux usage, and keep
+BYPASS inside pll14xx usage. The PLL has a restriction that
+when M/P change, need to RESET/BYPASS pll to avoid glitch, so
+we could not expose BYPASS.
+
+To make it easy for clk driver usage, unbypass PLL which does
+not hurt current function.
+
+Fixes: 8646d4dcc7fb ("clk: imx: Add PLLs driver for imx8mm soc")
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lkml.kernel.org/r/1568043491-20680-3-git-send-email-peng.fan@nxp.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-pll14xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c
+index 656f48b002dd3..7a815ec76aa5c 100644
+--- a/drivers/clk/imx/clk-pll14xx.c
++++ b/drivers/clk/imx/clk-pll14xx.c
+@@ -368,6 +368,7 @@ struct clk *imx_clk_pll14xx(const char *name, const char *parent_name,
+ struct clk_pll14xx *pll;
+ struct clk *clk;
+ struct clk_init_data init;
++ u32 val;
+
+ pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ if (!pll)
+@@ -399,6 +400,10 @@ struct clk *imx_clk_pll14xx(const char *name, const char *parent_name,
+ pll->rate_table = pll_clk->rate_table;
+ pll->rate_count = pll_clk->rate_count;
+
++ val = readl_relaxed(pll->base + GNRL_CTL);
++ val &= ~BYPASS_MASK;
++ writel_relaxed(val, pll->base + GNRL_CTL);
++
+ clk = clk_register(NULL, &pll->hw);
+ if (IS_ERR(clk)) {
+ pr_err("%s: failed to register pll %s %lu\n",
+--
+2.20.1
+
--- /dev/null
+From cfc03b15f37bd9f334085c0cb48d3bd44b6b3ff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 03:39:34 +0000
+Subject: clk: imx: pll14xx: avoid glitch when set rate
+
+From: Peng Fan <peng.fan@nxp.com>
+
+[ Upstream commit dee1bc9c23cd41fe32549c0adbe6cb57cab02282 ]
+
+According to PLL1443XA and PLL1416X spec,
+"When BYPASS is 0 and RESETB is changed from 0 to 1, FOUT starts to
+output unstable clock until lock time passes. PLL1416X/PLL1443XA may
+generate a glitch at FOUT."
+
+So set BYPASS when RESETB is changed from 0 to 1 to avoid glitch.
+In the end of set rate, BYPASS will be cleared.
+
+When prepare clock, also need to take care to avoid glitch. So
+we also follow Spec to set BYPASS before RESETB changed from 0 to 1.
+And add a check if the RESETB is already 0, directly return 0;
+
+Fixes: 8646d4dcc7fb ("clk: imx: Add PLLs driver for imx8mm soc")
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lkml.kernel.org/r/1568043491-20680-2-git-send-email-peng.fan@nxp.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-pll14xx.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c
+index b7213023b238f..656f48b002dd3 100644
+--- a/drivers/clk/imx/clk-pll14xx.c
++++ b/drivers/clk/imx/clk-pll14xx.c
+@@ -191,6 +191,10 @@ static int clk_pll1416x_set_rate(struct clk_hw *hw, unsigned long drate,
+ tmp &= ~RST_MASK;
+ writel_relaxed(tmp, pll->base);
+
++ /* Enable BYPASS */
++ tmp |= BYPASS_MASK;
++ writel(tmp, pll->base);
++
+ div_val = (rate->mdiv << MDIV_SHIFT) | (rate->pdiv << PDIV_SHIFT) |
+ (rate->sdiv << SDIV_SHIFT);
+ writel_relaxed(div_val, pll->base + 0x4);
+@@ -250,6 +254,10 @@ static int clk_pll1443x_set_rate(struct clk_hw *hw, unsigned long drate,
+ tmp &= ~RST_MASK;
+ writel_relaxed(tmp, pll->base);
+
++ /* Enable BYPASS */
++ tmp |= BYPASS_MASK;
++ writel_relaxed(tmp, pll->base);
++
+ div_val = (rate->mdiv << MDIV_SHIFT) | (rate->pdiv << PDIV_SHIFT) |
+ (rate->sdiv << SDIV_SHIFT);
+ writel_relaxed(div_val, pll->base + 0x4);
+@@ -283,16 +291,28 @@ static int clk_pll14xx_prepare(struct clk_hw *hw)
+ {
+ struct clk_pll14xx *pll = to_clk_pll14xx(hw);
+ u32 val;
++ int ret;
+
+ /*
+ * RESETB = 1 from 0, PLL starts its normal
+ * operation after lock time
+ */
+ val = readl_relaxed(pll->base + GNRL_CTL);
++ if (val & RST_MASK)
++ return 0;
++ val |= BYPASS_MASK;
++ writel_relaxed(val, pll->base + GNRL_CTL);
+ val |= RST_MASK;
+ writel_relaxed(val, pll->base + GNRL_CTL);
+
+- return clk_pll14xx_wait_lock(pll);
++ ret = clk_pll14xx_wait_lock(pll);
++ if (ret)
++ return ret;
++
++ val &= ~BYPASS_MASK;
++ writel_relaxed(val, pll->base + GNRL_CTL);
++
++ return 0;
+ }
+
+ static int clk_pll14xx_is_prepared(struct clk_hw *hw)
+--
+2.20.1
+
--- /dev/null
+From 0c1c821ee69dd55c67cefe63e24ae79d38e06ddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2019 10:22:55 +0300
+Subject: clk: imx8mq: Mark AHB clock as critical
+
+From: Abel Vesa <abel.vesa@nxp.com>
+
+[ Upstream commit 9b9c60bed562c3718ae324a86f3f30a4ff983cf8 ]
+
+Initially, the TMU_ROOT clock was marked as critical, which automatically
+made the AHB clock to stay always on. Since the TMU_ROOT clock is not
+marked as critical anymore, following commit:
+
+"clk: imx8mq: Remove CLK_IS_CRITICAL flag for IMX8MQ_CLK_TMU_ROOT"
+
+all the clocks that derive from ipg_root clock (and implicitly ahb clock)
+would also have to enable, along with their own gate, the AHB clock.
+
+But considering that AHB is actually a bus that has to be always on, we mark
+it as critical in the clock provider driver and then all the clocks that
+derive from it can be controlled through the dedicated per IP gate which
+follows after the ipg_root clock.
+
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Tested-by: Daniel Baluta <daniel.baluta@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c
+index daf1841b2adb0..f29025c99c53b 100644
+--- a/drivers/clk/imx/clk-imx8mq.c
++++ b/drivers/clk/imx/clk-imx8mq.c
+@@ -396,7 +396,8 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
+ clks[IMX8MQ_CLK_NOC_APB] = imx8m_clk_composite_critical("noc_apb", imx8mq_noc_apb_sels, base + 0x8d80);
+
+ /* AHB */
+- clks[IMX8MQ_CLK_AHB] = imx8m_clk_composite("ahb", imx8mq_ahb_sels, base + 0x9000);
++ /* AHB clock is used by the AHB bus therefore marked as critical */
++ clks[IMX8MQ_CLK_AHB] = imx8m_clk_composite_critical("ahb", imx8mq_ahb_sels, base + 0x9000);
+ clks[IMX8MQ_CLK_AUDIO_AHB] = imx8m_clk_composite("audio_ahb", imx8mq_audio_ahb_sels, base + 0x9100);
+
+ /* IPG */
+--
+2.20.1
+
--- /dev/null
+From c4f1b3151af7913f89538d977949ddfc762f708d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 13:16:10 -0400
+Subject: clk: jz4740: Add TCU clock
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 73dd11dc1a883d4c994d729dc9984f4890001157 ]
+
+Add the missing TCU clock to the list of clocks supplied by the CGU for
+the JZ4740 SoC.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Tested-by: Artur Rojek <contact@artur-rojek.eu>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Lee Jones <lee.jones@linaro.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Michael Turquette <mturquette@baylibre.com>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: devicetree@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-doc@vger.kernel.org
+Cc: linux-mips@vger.kernel.org
+Cc: linux-clk@vger.kernel.org
+Cc: od@zcrc.me
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ingenic/jz4740-cgu.c | 6 ++++++
+ include/dt-bindings/clock/jz4740-cgu.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+diff --git a/drivers/clk/ingenic/jz4740-cgu.c b/drivers/clk/ingenic/jz4740-cgu.c
+index c77f4e1506dc0..176d911b58397 100644
+--- a/drivers/clk/ingenic/jz4740-cgu.c
++++ b/drivers/clk/ingenic/jz4740-cgu.c
+@@ -203,6 +203,12 @@ static const struct ingenic_cgu_clk_info jz4740_cgu_clocks[] = {
+ .parents = { JZ4740_CLK_EXT, -1, -1, -1 },
+ .gate = { CGU_REG_CLKGR, 5 },
+ },
++
++ [JZ4740_CLK_TCU] = {
++ "tcu", CGU_CLK_GATE,
++ .parents = { JZ4740_CLK_EXT, -1, -1, -1 },
++ .gate = { CGU_REG_CLKGR, 1 },
++ },
+ };
+
+ static void __init jz4740_cgu_init(struct device_node *np)
+diff --git a/include/dt-bindings/clock/jz4740-cgu.h b/include/dt-bindings/clock/jz4740-cgu.h
+index 6ed83f926ae71..e82d77028581a 100644
+--- a/include/dt-bindings/clock/jz4740-cgu.h
++++ b/include/dt-bindings/clock/jz4740-cgu.h
+@@ -34,5 +34,6 @@
+ #define JZ4740_CLK_ADC 19
+ #define JZ4740_CLK_I2C 20
+ #define JZ4740_CLK_AIC 21
++#define JZ4740_CLK_TCU 22
+
+ #endif /* __DT_BINDINGS_CLOCK_JZ4740_CGU_H__ */
+--
+2.20.1
+
--- /dev/null
+From 6a7d9f9f908becf516b1ddd6480af92d1049449d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 19:40:29 -0700
+Subject: clk: Make clk_bulk_get_all() return a valid "id"
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 7f81c2426587b34bf73e643c1a6d080dfa14cf8a ]
+
+The adreno driver expects the "id" field of the returned clk_bulk_data
+to be filled in with strings from the clock-names property.
+
+But due to the use of kmalloc_array() in of_clk_bulk_get_all() it
+receives a list of bogus pointers instead.
+
+Zero-initialize the "id" field and attempt to populate with strings from
+the clock-names property to resolve both these issues.
+
+Fixes: 616e45df7c4a ("clk: add new APIs to operate on all available clocks")
+Fixes: 8e3e791d20d2 ("drm/msm: Use generic bulk clock function")
+Cc: Dong Aisheng <aisheng.dong@nxp.com>
+Cc: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lkml.kernel.org/r/20190913024029.2640-1-bjorn.andersson@linaro.org
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-bulk.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-bulk.c b/drivers/clk/clk-bulk.c
+index 06499568cf076..db5096fa9a170 100644
+--- a/drivers/clk/clk-bulk.c
++++ b/drivers/clk/clk-bulk.c
+@@ -18,10 +18,13 @@ static int __must_check of_clk_bulk_get(struct device_node *np, int num_clks,
+ int ret;
+ int i;
+
+- for (i = 0; i < num_clks; i++)
++ for (i = 0; i < num_clks; i++) {
++ clks[i].id = NULL;
+ clks[i].clk = NULL;
++ }
+
+ for (i = 0; i < num_clks; i++) {
++ of_property_read_string_index(np, "clock-names", i, &clks[i].id);
+ clks[i].clk = of_clk_get(np, i);
+ if (IS_ERR(clks[i].clk)) {
+ ret = PTR_ERR(clks[i].clk);
+--
+2.20.1
+
--- /dev/null
+From 8cd4912d51292fc009396df58918754e3c776489 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 12:35:11 -0700
+Subject: clk: meson: axg-audio: Don't reference clk_init_data after
+ registration
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 1610dd79d0f6202c5c1a91122255fa598679c13a ]
+
+A future patch is going to change semantics of clk_register() so that
+clk_hw::init is guaranteed to be NULL after a clk is registered. Avoid
+referencing this member here so that we don't run into NULL pointer
+exceptions.
+
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20190731193517.237136-4-sboyd@kernel.org
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/axg-audio.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/meson/axg-audio.c b/drivers/clk/meson/axg-audio.c
+index 8028ff6f66107..db0b73d53551d 100644
+--- a/drivers/clk/meson/axg-audio.c
++++ b/drivers/clk/meson/axg-audio.c
+@@ -992,15 +992,18 @@ static int axg_audio_clkc_probe(struct platform_device *pdev)
+
+ /* Take care to skip the registered input clocks */
+ for (i = AUD_CLKID_DDR_ARB; i < data->hw_onecell_data->num; i++) {
++ const char *name;
++
+ hw = data->hw_onecell_data->hws[i];
+ /* array might be sparse */
+ if (!hw)
+ continue;
+
++ name = hw->init->name;
++
+ ret = devm_clk_hw_register(dev, hw);
+ if (ret) {
+- dev_err(dev, "failed to register clock %s\n",
+- hw->init->name);
++ dev_err(dev, "failed to register clock %s\n", name);
+ return ret;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 0891b257994781bcd15f524f85af04e4f13d2f8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 12:51:42 -0700
+Subject: clk: qcom: gcc-sdm845: Use floor ops for sdcc clks
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 5e4b7e82d497580bc430576c4c9bce157dd72512 ]
+
+Some MMC cards fail to enumerate properly when inserted into an MMC slot
+on sdm845 devices. This is because the clk ops for qcom clks round the
+frequency up to the nearest rate instead of down to the nearest rate.
+For example, the MMC driver requests a frequency of 52MHz from
+clk_set_rate() but the qcom implementation for these clks rounds 52MHz
+up to the next supported frequency of 100MHz. The MMC driver could be
+modified to request clk rate ranges but for now we can fix this in the
+clk driver by changing the rounding policy for this clk to be round down
+instead of round up.
+
+Fixes: 06391eddb60a ("clk: qcom: Add Global Clock controller (GCC) driver for SDM845")
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Cc: Taniya Das <tdas@codeaurora.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lkml.kernel.org/r/20190830195142.103564-1-swboyd@chromium.org
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sdm845.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sdm845.c b/drivers/clk/qcom/gcc-sdm845.c
+index 7131dcf9b0603..95be125c3bddf 100644
+--- a/drivers/clk/qcom/gcc-sdm845.c
++++ b/drivers/clk/qcom/gcc-sdm845.c
+@@ -685,7 +685,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ .name = "gcc_sdcc2_apps_clk_src",
+ .parent_names = gcc_parent_names_10,
+ .num_parents = 5,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+@@ -709,7 +709,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
+ .name = "gcc_sdcc4_apps_clk_src",
+ .parent_names = gcc_parent_names_0,
+ .num_parents = 4,
+- .ops = &clk_rcg2_ops,
++ .ops = &clk_rcg2_floor_ops,
+ },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 5a0715c8b18dae098233ec3c7a42ffd69472a49d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Jun 2019 15:06:42 -0700
+Subject: clk: qoriq: Fix -Wunused-const-variable
+
+From: Nathan Huckleberry <nhuck@google.com>
+
+[ Upstream commit a95fb581b144b5e73da382eaedb2e32027610597 ]
+
+drivers/clk/clk-qoriq.c:138:38: warning: unused variable
+'p5020_cmux_grp1' [-Wunused-const-variable] static const struct
+clockgen_muxinfo p5020_cmux_grp1
+
+drivers/clk/clk-qoriq.c:146:38: warning: unused variable
+'p5020_cmux_grp2' [-Wunused-const-variable] static const struct
+clockgen_muxinfo p5020_cmux_grp2
+
+In the definition of the p5020 chip, the p2041 chip's info was used
+instead. The p5020 and p2041 chips have different info. This is most
+likely a typo.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/525
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Nathan Huckleberry <nhuck@google.com>
+Link: https://lkml.kernel.org/r/20190627220642.78575-1-nhuck@google.com
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Acked-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-qoriq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index dd93d3acc67d8..8724ef6c469ab 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -675,7 +675,7 @@ static const struct clockgen_chipinfo chipinfo[] = {
+ .guts_compat = "fsl,qoriq-device-config-1.0",
+ .init_periph = p5020_init_periph,
+ .cmux_groups = {
+- &p2041_cmux_grp1, &p2041_cmux_grp2
++ &p5020_cmux_grp1, &p5020_cmux_grp2
+ },
+ .cmux_to_group = {
+ 0, 1, -1
+--
+2.20.1
+
--- /dev/null
+From aab84d0393a2af2aefd39832ec1e4936f05a18d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 15:44:51 +0200
+Subject: clk: renesas: cpg-mssr: Set GENPD_FLAG_ALWAYS_ON for clock domain
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit f787216f33ce5b5a2567766398f44ab62157114c ]
+
+The CPG/MSSR Clock Domain driver does not implement the
+generic_pm_domain.power_{on,off}() callbacks, as the domain itself
+cannot be powered down. Hence the domain should be marked as always-on
+by setting the GENPD_FLAG_ALWAYS_ON flag, to prevent the core PM Domain
+code from considering it for power-off, and doing unnessary processing.
+
+Note that this only affects RZ/A2 SoCs. On R-Car Gen2 and Gen3 SoCs,
+the R-Car SYSC driver handles Clock Domain creation, and offloads only
+device attachment/detachment to the CPG/MSSR driver.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/renesas-cpg-mssr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
+index 9dfa28d6fd9f9..cbe5fb468b7f9 100644
+--- a/drivers/clk/renesas/renesas-cpg-mssr.c
++++ b/drivers/clk/renesas/renesas-cpg-mssr.c
+@@ -555,7 +555,8 @@ static int __init cpg_mssr_add_clk_domain(struct device *dev,
+
+ genpd = &pd->genpd;
+ genpd->name = np->name;
+- genpd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
++ genpd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ALWAYS_ON |
++ GENPD_FLAG_ACTIVE_WAKEUP;
+ genpd->attach_dev = cpg_mssr_attach_dev;
+ genpd->detach_dev = cpg_mssr_detach_dev;
+ pm_genpd_init(genpd, &pm_domain_always_on_gov, false);
+--
+2.20.1
+
--- /dev/null
+From 9f1f6befab60b714c4eceaa21fb8821ced541fb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Aug 2019 15:38:34 +0200
+Subject: clk: renesas: mstp: Set GENPD_FLAG_ALWAYS_ON for clock domain
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a459a184c978ca9ad538aab93aafdde873953f30 ]
+
+The CPG/MSTP Clock Domain driver does not implement the
+generic_pm_domain.power_{on,off}() callbacks, as the domain itself
+cannot be powered down. Hence the domain should be marked as always-on
+by setting the GENPD_FLAG_ALWAYS_ON flag, to prevent the core PM Domain
+code from considering it for power-off, and doing unnessary processing.
+
+This also gets rid of a boot warning when the Clock Domain contains an
+IRQ-safe device, e.g. on RZ/A1:
+
+ sh_mtu2 fcff0000.timer: PM domain cpg_clocks will not be powered off
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/clk-mstp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/clk-mstp.c b/drivers/clk/renesas/clk-mstp.c
+index 92ece221b0d44..7f156cf1d7a64 100644
+--- a/drivers/clk/renesas/clk-mstp.c
++++ b/drivers/clk/renesas/clk-mstp.c
+@@ -338,7 +338,8 @@ void __init cpg_mstp_add_clk_domain(struct device_node *np)
+ return;
+
+ pd->name = np->name;
+- pd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ACTIVE_WAKEUP;
++ pd->flags = GENPD_FLAG_PM_CLK | GENPD_FLAG_ALWAYS_ON |
++ GENPD_FLAG_ACTIVE_WAKEUP;
+ pd->attach_dev = cpg_mstp_attach_dev;
+ pd->detach_dev = cpg_mstp_detach_dev;
+ pm_genpd_init(pd, &pm_domain_always_on_gov, false);
+--
+2.20.1
+
--- /dev/null
+From 0b6ca3ab59ab76bb7f5678264b7cd1586b220317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 12:35:13 -0700
+Subject: clk: sirf: Don't reference clk_init_data after registration
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit af55dadfbce35b4f4c6247244ce3e44b2e242b84 ]
+
+A future patch is going to change semantics of clk_register() so that
+clk_hw::init is guaranteed to be NULL after a clk is registered. Avoid
+referencing this member here so that we don't run into NULL pointer
+exceptions.
+
+Cc: Guo Zeng <Guo.Zeng@csr.com>
+Cc: Barry Song <Baohua.Song@csr.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20190731193517.237136-6-sboyd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sirf/clk-common.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/sirf/clk-common.c b/drivers/clk/sirf/clk-common.c
+index ad7951b6b285e..dcf4e25a02168 100644
+--- a/drivers/clk/sirf/clk-common.c
++++ b/drivers/clk/sirf/clk-common.c
+@@ -297,9 +297,10 @@ static u8 dmn_clk_get_parent(struct clk_hw *hw)
+ {
+ struct clk_dmn *clk = to_dmnclk(hw);
+ u32 cfg = clkc_readl(clk->regofs);
++ const char *name = clk_hw_get_name(hw);
+
+ /* parent of io domain can only be pll3 */
+- if (strcmp(hw->init->name, "io") == 0)
++ if (strcmp(name, "io") == 0)
+ return 4;
+
+ WARN_ON((cfg & (BIT(3) - 1)) > 4);
+@@ -311,9 +312,10 @@ static int dmn_clk_set_parent(struct clk_hw *hw, u8 parent)
+ {
+ struct clk_dmn *clk = to_dmnclk(hw);
+ u32 cfg = clkc_readl(clk->regofs);
++ const char *name = clk_hw_get_name(hw);
+
+ /* parent of io domain can only be pll3 */
+- if (strcmp(hw->init->name, "io") == 0)
++ if (strcmp(name, "io") == 0)
+ return -EINVAL;
+
+ cfg &= ~(BIT(3) - 1);
+@@ -353,7 +355,8 @@ static long dmn_clk_round_rate(struct clk_hw *hw, unsigned long rate,
+ {
+ unsigned long fin;
+ unsigned ratio, wait, hold;
+- unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4;
++ const char *name = clk_hw_get_name(hw);
++ unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4;
+
+ fin = *parent_rate;
+ ratio = fin / rate;
+@@ -375,7 +378,8 @@ static int dmn_clk_set_rate(struct clk_hw *hw, unsigned long rate,
+ struct clk_dmn *clk = to_dmnclk(hw);
+ unsigned long fin;
+ unsigned ratio, wait, hold, reg;
+- unsigned bits = (strcmp(hw->init->name, "mem") == 0) ? 3 : 4;
++ const char *name = clk_hw_get_name(hw);
++ unsigned bits = (strcmp(name, "mem") == 0) ? 3 : 4;
+
+ fin = parent_rate;
+ ratio = fin / rate;
+--
+2.20.1
+
--- /dev/null
+From ce3a814562b8178612f8ae3338a9c0e4eeb5010d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 18:30:09 +0800
+Subject: clk: sprd: add missing kfree
+
+From: Chunyan Zhang <chunyan.zhang@unisoc.com>
+
+[ Upstream commit 5e75ea9c67433a065b0e8595ad3c91c7c0ca0d2d ]
+
+The number of config registers for different pll clocks probably are not
+same, so we have to use malloc, and should free the memory before return.
+
+Fixes: 3e37b005580b ("clk: sprd: add adjustable pll support")
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Signed-off-by: Chunyan Zhang <zhang.lyra@gmail.com>
+Link: https://lkml.kernel.org/r/20190905103009.27166-1-zhang.lyra@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sprd/pll.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/sprd/pll.c b/drivers/clk/sprd/pll.c
+index 36b4402bf09e3..640270f51aa56 100644
+--- a/drivers/clk/sprd/pll.c
++++ b/drivers/clk/sprd/pll.c
+@@ -136,6 +136,7 @@ static unsigned long _sprd_pll_recalc_rate(const struct sprd_pll *pll,
+ k2 + refin * nint * CLK_PLL_1M;
+ }
+
++ kfree(cfg);
+ return rate;
+ }
+
+@@ -222,6 +223,7 @@ static int _sprd_pll_set_rate(const struct sprd_pll *pll,
+ if (!ret)
+ udelay(pll->udelay);
+
++ kfree(cfg);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9ca4adeef89c8cb47285ffe1b4f0e37ec1fac99e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 12:35:15 -0700
+Subject: clk: sprd: Don't reference clk_init_data after registration
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit f6c90df8e7e33c3dc33d4d7471bc42c232b0510e ]
+
+A future patch is going to change semantics of clk_register() so that
+clk_hw::init is guaranteed to be NULL after a clk is registered. Avoid
+referencing this member here so that we don't run into NULL pointer
+exceptions.
+
+Cc: Chunyan Zhang <zhang.chunyan@linaro.org>
+Cc: Baolin Wang <baolin.wang@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20190731193517.237136-8-sboyd@kernel.org
+Acked-by: Baolin Wang <baolin.wang@linaro.org>
+Acked-by: Chunyan Zhang <zhang.chunyan@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sprd/common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/sprd/common.c b/drivers/clk/sprd/common.c
+index e038b04472061..8bdab1c3013b8 100644
+--- a/drivers/clk/sprd/common.c
++++ b/drivers/clk/sprd/common.c
+@@ -71,16 +71,17 @@ int sprd_clk_probe(struct device *dev, struct clk_hw_onecell_data *clkhw)
+ struct clk_hw *hw;
+
+ for (i = 0; i < clkhw->num; i++) {
++ const char *name;
+
+ hw = clkhw->hws[i];
+-
+ if (!hw)
+ continue;
+
++ name = hw->init->name;
+ ret = devm_clk_hw_register(dev, hw);
+ if (ret) {
+ dev_err(dev, "Couldn't register clock %d - %s\n",
+- i, hw->init->name);
++ i, name);
+ return ret;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From a8da6ded049271f9c4bd92f285a0beb057c30aad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jul 2019 11:12:23 +0800
+Subject: clk: sunxi-ng: v3s: add missing clock slices for MMC2 module clocks
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit 720099603d1f62e37b789366d7e89824b009ca28 ]
+
+The MMC2 clock slices are currently not defined in V3s CCU driver, which
+makes MMC2 not working.
+
+Fix this issue.
+
+Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index cbbf06d42c2c2..408a6750ddda2 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -493,6 +493,9 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
+ [CLK_MMC1] = &mmc1_clk.common.hw,
+ [CLK_MMC1_SAMPLE] = &mmc1_sample_clk.common.hw,
+ [CLK_MMC1_OUTPUT] = &mmc1_output_clk.common.hw,
++ [CLK_MMC2] = &mmc2_clk.common.hw,
++ [CLK_MMC2_SAMPLE] = &mmc2_sample_clk.common.hw,
++ [CLK_MMC2_OUTPUT] = &mmc2_output_clk.common.hw,
+ [CLK_CE] = &ce_clk.common.hw,
+ [CLK_SPI0] = &spi0_clk.common.hw,
+ [CLK_USB_PHY0] = &usb_phy0_clk.common.hw,
+--
+2.20.1
+
--- /dev/null
+From 8a8017fb9cdd1995d457df8898a63ded15b01cae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 09:00:18 -0700
+Subject: clk: zx296718: Don't reference clk_init_data after registration
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 1a4549c150e27dbc3aea762e879a88209df6d1a5 ]
+
+A future patch is going to change semantics of clk_register() so that
+clk_hw::init is guaranteed to be NULL after a clk is registered. Avoid
+referencing this member here so that we don't run into NULL pointer
+exceptions.
+
+Cc: Jun Nie <jun.nie@linaro.org>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20190815160020.183334-3-sboyd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zte/clk-zx296718.c | 109 +++++++++++++++------------------
+ 1 file changed, 49 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/clk/zte/clk-zx296718.c b/drivers/clk/zte/clk-zx296718.c
+index fd6c347bec6a7..dd7045bc48c15 100644
+--- a/drivers/clk/zte/clk-zx296718.c
++++ b/drivers/clk/zte/clk-zx296718.c
+@@ -564,6 +564,7 @@ static int __init top_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -573,11 +574,10 @@ static int __init top_clocks_init(struct device_node *np)
+
+ for (i = 0; i < ARRAY_SIZE(zx296718_pll_clk); i++) {
+ zx296718_pll_clk[i].reg_base += (uintptr_t)reg_base;
++ name = zx296718_pll_clk[i].hw.init->name;
+ ret = clk_hw_register(NULL, &zx296718_pll_clk[i].hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- zx296718_pll_clk[i].hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_ffactor_clk); i++) {
+@@ -585,11 +585,10 @@ static int __init top_clocks_init(struct device_node *np)
+ top_hw_onecell_data.hws[top_ffactor_clk[i].id] =
+ &top_ffactor_clk[i].factor.hw;
+
++ name = top_ffactor_clk[i].factor.hw.init->name;
+ ret = clk_hw_register(NULL, &top_ffactor_clk[i].factor.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_ffactor_clk[i].factor.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_mux_clk); i++) {
+@@ -598,11 +597,10 @@ static int __init top_clocks_init(struct device_node *np)
+ &top_mux_clk[i].mux.hw;
+
+ top_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = top_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &top_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_gate_clk); i++) {
+@@ -611,11 +609,10 @@ static int __init top_clocks_init(struct device_node *np)
+ &top_gate_clk[i].gate.hw;
+
+ top_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = top_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &top_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(top_div_clk); i++) {
+@@ -624,11 +621,10 @@ static int __init top_clocks_init(struct device_node *np)
+ &top_div_clk[i].div.hw;
+
+ top_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = top_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &top_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("top clk %s init error!\n",
+- top_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("top clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+@@ -754,6 +750,7 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -767,11 +764,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ &lsp0_mux_clk[i].mux.hw;
+
+ lsp0_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = lsp0_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp0_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("lsp0 clk %s init error!\n",
+- lsp0_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp0 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp0_gate_clk); i++) {
+@@ -780,11 +776,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ &lsp0_gate_clk[i].gate.hw;
+
+ lsp0_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = lsp0_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp0_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("lsp0 clk %s init error!\n",
+- lsp0_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp0 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp0_div_clk); i++) {
+@@ -793,11 +788,10 @@ static int __init lsp0_clocks_init(struct device_node *np)
+ &lsp0_div_clk[i].div.hw;
+
+ lsp0_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = lsp0_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp0_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("lsp0 clk %s init error!\n",
+- lsp0_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp0 clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+@@ -862,6 +856,7 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -875,11 +870,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ &lsp0_mux_clk[i].mux.hw;
+
+ lsp1_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = lsp1_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp1_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("lsp1 clk %s init error!\n",
+- lsp1_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp1 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp1_gate_clk); i++) {
+@@ -888,11 +882,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ &lsp1_gate_clk[i].gate.hw;
+
+ lsp1_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = lsp1_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp1_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("lsp1 clk %s init error!\n",
+- lsp1_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp1 clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(lsp1_div_clk); i++) {
+@@ -901,11 +894,10 @@ static int __init lsp1_clocks_init(struct device_node *np)
+ &lsp1_div_clk[i].div.hw;
+
+ lsp1_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = lsp1_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &lsp1_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("lsp1 clk %s init error!\n",
+- lsp1_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("lsp1 clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+@@ -979,6 +971,7 @@ static int __init audio_clocks_init(struct device_node *np)
+ {
+ void __iomem *reg_base;
+ int i, ret;
++ const char *name;
+
+ reg_base = of_iomap(np, 0);
+ if (!reg_base) {
+@@ -992,11 +985,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_mux_clk[i].mux.hw;
+
+ audio_mux_clk[i].mux.reg += (uintptr_t)reg_base;
++ name = audio_mux_clk[i].mux.hw.init->name;
+ ret = clk_hw_register(NULL, &audio_mux_clk[i].mux.hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_mux_clk[i].mux.hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(audio_adiv_clk); i++) {
+@@ -1005,11 +997,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_adiv_clk[i].hw;
+
+ audio_adiv_clk[i].reg_base += (uintptr_t)reg_base;
++ name = audio_adiv_clk[i].hw.init->name;
+ ret = clk_hw_register(NULL, &audio_adiv_clk[i].hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_adiv_clk[i].hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(audio_div_clk); i++) {
+@@ -1018,11 +1009,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_div_clk[i].div.hw;
+
+ audio_div_clk[i].div.reg += (uintptr_t)reg_base;
++ name = audio_div_clk[i].div.hw.init->name;
+ ret = clk_hw_register(NULL, &audio_div_clk[i].div.hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_div_clk[i].div.hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(audio_gate_clk); i++) {
+@@ -1031,11 +1021,10 @@ static int __init audio_clocks_init(struct device_node *np)
+ &audio_gate_clk[i].gate.hw;
+
+ audio_gate_clk[i].gate.reg += (uintptr_t)reg_base;
++ name = audio_gate_clk[i].gate.hw.init->name;
+ ret = clk_hw_register(NULL, &audio_gate_clk[i].gate.hw);
+- if (ret) {
+- pr_warn("audio clk %s init error!\n",
+- audio_gate_clk[i].gate.hw.init->name);
+- }
++ if (ret)
++ pr_warn("audio clk %s init error!\n", name);
+ }
+
+ ret = of_clk_add_hw_provider(np, of_clk_hw_onecell_get,
+--
+2.20.1
+
--- /dev/null
+From e6449043e7edb2ce4ae222917f88a9b6114f945d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Sep 2019 17:26:56 +0800
+Subject: crypto: hisilicon - Fix double free in sec_free_hw_sgl()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit 24fbf7bad888767bed952f540ac963bc57e47e15 ]
+
+There are two problems in sec_free_hw_sgl():
+
+First, when sgl_current->next is valid, @hw_sgl will be freed in the
+first loop, but it free again after the loop.
+
+Second, sgl_current and sgl_current->next_sgl is not match when
+dma_pool_free() is invoked, the third parameter should be the dma
+address of sgl_current, but sgl_current->next_sgl is the dma address
+of next chain, so use sgl_current->next_sgl is wrong.
+
+Fix this by deleting the last dma_pool_free() in sec_free_hw_sgl(),
+modifying the condition for while loop, and matching the address for
+dma_pool_free().
+
+Fixes: 915e4e8413da ("crypto: hisilicon - SEC security accelerator driver")
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec/sec_algs.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c
+index 02768af0dccdd..8c789b8671fc4 100644
+--- a/drivers/crypto/hisilicon/sec/sec_algs.c
++++ b/drivers/crypto/hisilicon/sec/sec_algs.c
+@@ -215,17 +215,18 @@ static void sec_free_hw_sgl(struct sec_hw_sgl *hw_sgl,
+ dma_addr_t psec_sgl, struct sec_dev_info *info)
+ {
+ struct sec_hw_sgl *sgl_current, *sgl_next;
++ dma_addr_t sgl_next_dma;
+
+- if (!hw_sgl)
+- return;
+ sgl_current = hw_sgl;
+- while (sgl_current->next) {
++ while (sgl_current) {
+ sgl_next = sgl_current->next;
+- dma_pool_free(info->hw_sgl_pool, sgl_current,
+- sgl_current->next_sgl);
++ sgl_next_dma = sgl_current->next_sgl;
++
++ dma_pool_free(info->hw_sgl_pool, sgl_current, psec_sgl);
++
+ sgl_current = sgl_next;
++ psec_sgl = sgl_next_dma;
+ }
+- dma_pool_free(info->hw_sgl_pool, hw_sgl, psec_sgl);
+ }
+
+ static int sec_alg_skcipher_setkey(struct crypto_skcipher *tfm,
+--
+2.20.1
+
--- /dev/null
+From 7ad9e861137cb64ece024d65fb46647d73395999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 16:42:47 +0100
+Subject: dma-buf/sw_sync: Synchronize signal vs syncpt free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+[ Upstream commit d3c6dd1fb30d3853c2012549affe75c930f4a2f9 ]
+
+During release of the syncpt, we remove it from the list of syncpt and
+the tree, but only if it is not already been removed. However, during
+signaling, we first remove the syncpt from the list. So, if we
+concurrently free and signal the syncpt, the free may decide that it is
+not part of the tree and immediately free itself -- meanwhile the
+signaler goes on to use the now freed datastructure.
+
+In particular, we get struck by commit 0e2f733addbf ("dma-buf: make
+dma_fence structure a bit smaller v2") as the cb_list is immediately
+clobbered by the kfree_rcu.
+
+v2: Avoid calling into timeline_fence_release() from under the spinlock
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111381
+Fixes: d3862e44daa7 ("dma-buf/sw-sync: Fix locking around sync_timeline lists")
+References: 0e2f733addbf ("dma-buf: make dma_fence structure a bit smaller v2")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Sean Paul <seanpaul@chromium.org>
+Cc: Gustavo Padovan <gustavo@padovan.org>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: <stable@vger.kernel.org> # v4.14+
+Acked-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma-buf/sw_sync.c | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index 051f6c2873c7a..6713cfb1995c6 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -132,17 +132,14 @@ static void timeline_fence_release(struct dma_fence *fence)
+ {
+ struct sync_pt *pt = dma_fence_to_sync_pt(fence);
+ struct sync_timeline *parent = dma_fence_parent(fence);
++ unsigned long flags;
+
++ spin_lock_irqsave(fence->lock, flags);
+ if (!list_empty(&pt->link)) {
+- unsigned long flags;
+-
+- spin_lock_irqsave(fence->lock, flags);
+- if (!list_empty(&pt->link)) {
+- list_del(&pt->link);
+- rb_erase(&pt->node, &parent->pt_tree);
+- }
+- spin_unlock_irqrestore(fence->lock, flags);
++ list_del(&pt->link);
++ rb_erase(&pt->node, &parent->pt_tree);
+ }
++ spin_unlock_irqrestore(fence->lock, flags);
+
+ sync_timeline_put(parent);
+ dma_fence_free(fence);
+@@ -265,7 +262,8 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
+ p = &parent->rb_left;
+ } else {
+ if (dma_fence_get_rcu(&other->base)) {
+- dma_fence_put(&pt->base);
++ sync_timeline_put(obj);
++ kfree(pt);
+ pt = other;
+ goto unlock;
+ }
+--
+2.20.1
+
--- /dev/null
+From 19cfe8a493d3bed729c8a210e0abf714229141e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 16:30:15 -0400
+Subject: drm/amd/display: add monitor patch to add T7 delay
+
+From: Anthony Koo <anthony.koo@amd.com>
+
+[ Upstream commit 88eac241a1fc500ce5274a09ddc4bd5fc2b5adb6 ]
+
+[Why]
+Specifically to one panel,
+TCON is able to accept active video signal quickly, but
+the Source Driver requires 2-3 frames of extra time.
+
+It is a Panel issue since TCON needs to take care of
+all Sink requirements including Source Driver. But in
+this case it does not.
+
+Customer is asking to add fixed T7 delay as panel
+workaround.
+
+[How]
+Add monitor specific patch to add T7 delay
+
+Signed-off-by: Anthony Koo <anthony.koo@amd.com>
+Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 4 ++++
+ drivers/gpu/drm/amd/display/dc/dc_types.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c
+index b0dea759cd860..8aecf044e2ae8 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c
+@@ -154,6 +154,10 @@ bool edp_receiver_ready_T7(struct dc_link *link)
+ break;
+ udelay(25); //MAx T7 is 50ms
+ } while (++tries < 300);
++
++ if (link->local_sink->edid_caps.panel_patch.extra_t7_ms > 0)
++ udelay(link->local_sink->edid_caps.panel_patch.extra_t7_ms * 1000);
++
+ return result;
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
+index 6c2a3d9a4c2e7..283082666be51 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
+@@ -202,6 +202,7 @@ struct dc_panel_patch {
+ unsigned int dppowerup_delay;
+ unsigned int extra_t12_ms;
+ unsigned int extra_delay_backlight_off;
++ unsigned int extra_t7_ms;
+ };
+
+ struct dc_edid_caps {
+--
+2.20.1
+
--- /dev/null
+From f9dff0757b0c373a91de5cef8c1c27dc25fd6516 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2019 16:00:53 -0400
+Subject: drm/amd/display: Fix frames_to_insert math
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bayan Zabihiyan <bayan.zabihiyan@amd.com>
+
+[ Upstream commit a463b263032f7c98c5912207db43be1aa34a6438 ]
+
+[Why]
+The math on deciding on how many
+"frames to insert" sometimes sent us over the max refresh rate.
+Also integer overflow can occur if we have high refresh rates.
+
+[How]
+Instead of clipping the frame duration such that it doesn’t go below the min,
+just remove a frame from the number of frames to insert. +
+Use unsigned long long for intermediate calculations to prevent
+integer overflow.
+
+Signed-off-by: Bayan Zabihiyan <bayan.zabihiyan@amd.com>
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/modules/freesync/freesync.c | 27 ++++++++++++-------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+index 19b1eaebe4840..000a9db9dad82 100644
+--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+@@ -433,6 +433,12 @@ static void apply_below_the_range(struct core_freesync *core_freesync,
+ /* Either we've calculated the number of frames to insert,
+ * or we need to insert min duration frames
+ */
++ if (last_render_time_in_us / frames_to_insert <
++ in_out_vrr->min_duration_in_us){
++ frames_to_insert -= (frames_to_insert > 1) ?
++ 1 : 0;
++ }
++
+ if (frames_to_insert > 0)
+ inserted_frame_duration_in_us = last_render_time_in_us /
+ frames_to_insert;
+@@ -885,8 +891,8 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ struct core_freesync *core_freesync = NULL;
+ unsigned long long nominal_field_rate_in_uhz = 0;
+ unsigned int refresh_range = 0;
+- unsigned int min_refresh_in_uhz = 0;
+- unsigned int max_refresh_in_uhz = 0;
++ unsigned long long min_refresh_in_uhz = 0;
++ unsigned long long max_refresh_in_uhz = 0;
+
+ if (mod_freesync == NULL)
+ return;
+@@ -913,7 +919,7 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ min_refresh_in_uhz = nominal_field_rate_in_uhz;
+
+ if (!vrr_settings_require_update(core_freesync,
+- in_config, min_refresh_in_uhz, max_refresh_in_uhz,
++ in_config, (unsigned int)min_refresh_in_uhz, (unsigned int)max_refresh_in_uhz,
+ in_out_vrr))
+ return;
+
+@@ -929,15 +935,15 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ return;
+
+ } else {
+- in_out_vrr->min_refresh_in_uhz = min_refresh_in_uhz;
++ in_out_vrr->min_refresh_in_uhz = (unsigned int)min_refresh_in_uhz;
+ in_out_vrr->max_duration_in_us =
+ calc_duration_in_us_from_refresh_in_uhz(
+- min_refresh_in_uhz);
++ (unsigned int)min_refresh_in_uhz);
+
+- in_out_vrr->max_refresh_in_uhz = max_refresh_in_uhz;
++ in_out_vrr->max_refresh_in_uhz = (unsigned int)max_refresh_in_uhz;
+ in_out_vrr->min_duration_in_us =
+ calc_duration_in_us_from_refresh_in_uhz(
+- max_refresh_in_uhz);
++ (unsigned int)max_refresh_in_uhz);
+
+ refresh_range = in_out_vrr->max_refresh_in_uhz -
+ in_out_vrr->min_refresh_in_uhz;
+@@ -948,17 +954,18 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ in_out_vrr->fixed.ramping_active = in_config->ramping;
+
+ in_out_vrr->btr.btr_enabled = in_config->btr;
++
+ if (in_out_vrr->max_refresh_in_uhz <
+ 2 * in_out_vrr->min_refresh_in_uhz)
+ in_out_vrr->btr.btr_enabled = false;
++
+ in_out_vrr->btr.btr_active = false;
+ in_out_vrr->btr.inserted_duration_in_us = 0;
+ in_out_vrr->btr.frames_to_insert = 0;
+ in_out_vrr->btr.frame_counter = 0;
+ in_out_vrr->btr.mid_point_in_us =
+- in_out_vrr->min_duration_in_us +
+- (in_out_vrr->max_duration_in_us -
+- in_out_vrr->min_duration_in_us) / 2;
++ (in_out_vrr->min_duration_in_us +
++ in_out_vrr->max_duration_in_us) / 2;
+
+ if (in_out_vrr->state == VRR_STATE_UNSUPPORTED) {
+ in_out_vrr->adjust.v_total_min = stream->timing.v_total;
+--
+2.20.1
+
--- /dev/null
+From 00ef49ac7d25515165a3bd9cac7a01584d974190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 10:52:54 -0400
+Subject: drm/amd/display: fix issue where 252-255 values are clipped
+
+From: Anthony Koo <Anthony.Koo@amd.com>
+
+[ Upstream commit 1cbcfc975164f397b449efb17f59d81a703090db ]
+
+[Why]
+When endpoint is at the boundary of a region, such as at 2^0=1
+we find that the last segment has a sharp slope and some points
+are clipped at the top.
+
+[How]
+If end point is 1, which is exactly at the 2^0 region boundary, we
+need to program an additional region beyond this point.
+
+Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+index 7469333a2c8a5..8166fdbacd732 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c
+@@ -357,9 +357,10 @@ bool cm_helper_translate_curve_to_hw_format(
+ seg_distr[7] = 4;
+ seg_distr[8] = 4;
+ seg_distr[9] = 4;
++ seg_distr[10] = 1;
+
+ region_start = -10;
+- region_end = 0;
++ region_end = 1;
+ }
+
+ for (i = region_end - region_start; i < MAX_REGIONS_NUMBER ; i++)
+--
+2.20.1
+
--- /dev/null
+From e700da0c6e08f88b33fbd96c534f5e61086c6e18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 15:23:32 -0400
+Subject: drm/amd/display: reprogram VM config when system resume
+
+From: Lewis Huang <Lewis.Huang@amd.com>
+
+[ Upstream commit e5382701c3520b3ed66169a6e4aa6ce5df8c56e0 ]
+
+[Why]
+The vm config will be clear to 0 when system enter S4. It will
+cause hubbub didn't know how to fetch data when system resume.
+The flip always pending because earliest_inuse_address and
+request_address are different.
+
+[How]
+Reprogram VM config when system resume
+
+Signed-off-by: Lewis Huang <Lewis.Huang@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Eric Yang <eric.yang2@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 0a7adc2925e35..191f5757ded1f 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2016,6 +2016,14 @@ void dc_set_power_state(
+ dc_resource_state_construct(dc, dc->current_state);
+
+ dc->hwss.init_hw(dc);
++
++#ifdef CONFIG_DRM_AMD_DC_DCN2_0
++ if (dc->hwss.init_sys_ctx != NULL &&
++ dc->vm_pa_config.valid) {
++ dc->hwss.init_sys_ctx(dc->hwseq, dc, &dc->vm_pa_config);
++ }
++#endif
++
+ break;
+ default:
+ ASSERT(dc->current_state->stream_count == 0);
+--
+2.20.1
+
--- /dev/null
+From 6cd771de278893b993ec1ee7a1e93be1f479471d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 14:49:58 -0400
+Subject: drm/amd/display: support spdif
+
+From: Charlene Liu <charlene.liu@amd.com>
+
+[ Upstream commit b5a41620bb88efb9fb31a4fa5e652e3d5bead7d4 ]
+
+[Description]
+port spdif fix to staging:
+ spdif hardwired to afmt inst 1.
+ spdif func pointer
+ spdif resource allocation (reserve last audio endpoint for spdif only)
+
+Signed-off-by: Charlene Liu <charlene.liu@amd.com>
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/core/dc_resource.c | 17 ++++++++---------
+ drivers/gpu/drm/amd/display/dc/dce/dce_audio.c | 4 ++--
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index b459ce056b609..c404b5e930f04 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -261,12 +261,10 @@ bool resource_construct(
+ DC_ERR("DC: failed to create audio!\n");
+ return false;
+ }
+-
+ if (!aud->funcs->endpoint_valid(aud)) {
+ aud->funcs->destroy(&aud);
+ break;
+ }
+-
+ pool->audios[i] = aud;
+ pool->audio_count++;
+ }
+@@ -1692,24 +1690,25 @@ static struct audio *find_first_free_audio(
+ const struct resource_pool *pool,
+ enum engine_id id)
+ {
+- int i;
+- for (i = 0; i < pool->audio_count; i++) {
++ int i, available_audio_count;
++
++ available_audio_count = pool->audio_count;
++
++ for (i = 0; i < available_audio_count; i++) {
+ if ((res_ctx->is_audio_acquired[i] == false) && (res_ctx->is_stream_enc_acquired[i] == true)) {
+ /*we have enough audio endpoint, find the matching inst*/
+ if (id != i)
+ continue;
+-
+ return pool->audios[i];
+ }
+ }
+
+- /* use engine id to find free audio */
+- if ((id < pool->audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
++ /* use engine id to find free audio */
++ if ((id < available_audio_count) && (res_ctx->is_audio_acquired[id] == false)) {
+ return pool->audios[id];
+ }
+-
+ /*not found the matching one, first come first serve*/
+- for (i = 0; i < pool->audio_count; i++) {
++ for (i = 0; i < available_audio_count; i++) {
+ if (res_ctx->is_audio_acquired[i] == false) {
+ return pool->audios[i];
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
+index 7f6d724686f1a..abb559ce64085 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_audio.c
+@@ -611,6 +611,8 @@ void dce_aud_az_configure(
+
+ AZ_REG_WRITE(AZALIA_F0_CODEC_PIN_CONTROL_SINK_INFO1,
+ value);
++ DC_LOG_HW_AUDIO("\n\tAUDIO:az_configure: index: %u data, 0x%x, displayName %s: \n",
++ audio->inst, value, audio_info->display_name);
+
+ /*
+ *write the port ID:
+@@ -922,7 +924,6 @@ static const struct audio_funcs funcs = {
+ .az_configure = dce_aud_az_configure,
+ .destroy = dce_aud_destroy,
+ };
+-
+ void dce_aud_destroy(struct audio **audio)
+ {
+ struct dce_audio *aud = DCE_AUD(*audio);
+@@ -953,7 +954,6 @@ struct audio *dce_audio_create(
+ audio->regs = reg;
+ audio->shifts = shifts;
+ audio->masks = masks;
+-
+ return &audio->base;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 33f4aed58cb8b889b35cc926271e6eca35db501b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 18:04:08 -0400
+Subject: drm/amdgpu: Fix hard hang for S/G display BOs.
+
+From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+
+[ Upstream commit e4c4073b0139d055d43a9568690fc560aab4fa5c ]
+
+HW requires for caching to be unset for scanout BO
+mappings when the BO placement is in GTT memory.
+Usually the flag to unset is passed from user mode
+but for FB mode this was missing.
+
+v2:
+Keep all BO placement logic in amdgpu_display_supported_domains
+
+Suggested-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Tested-by: Shirish S <shirish.s@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 7 +++----
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 3 ++-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+index e476092188392..bf0c61baa05c7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+@@ -137,14 +137,14 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev,
+ mode_cmd->pitches[0] = amdgpu_align_pitch(adev, mode_cmd->width, cpp,
+ fb_tiled);
+ domain = amdgpu_display_supported_domains(adev);
+-
+ height = ALIGN(mode_cmd->height, 8);
+ size = mode_cmd->pitches[0] * height;
+ aligned_size = ALIGN(size, PAGE_SIZE);
+ ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain,
+ AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
+- AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS |
+- AMDGPU_GEM_CREATE_VRAM_CLEARED,
++ AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS |
++ AMDGPU_GEM_CREATE_VRAM_CLEARED |
++ AMDGPU_GEM_CREATE_CPU_GTT_USWC,
+ ttm_bo_type_kernel, NULL, &gobj);
+ if (ret) {
+ pr_err("failed to allocate framebuffer (%d)\n", aligned_size);
+@@ -166,7 +166,6 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev,
+ dev_err(adev->dev, "FB failed to set tiling flags\n");
+ }
+
+-
+ ret = amdgpu_bo_pin(abo, domain);
+ if (ret) {
+ amdgpu_bo_unreserve(abo);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index d4fcf54754646..6fc77ac814d8e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -746,7 +746,8 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv,
+ struct amdgpu_device *adev = dev->dev_private;
+ struct drm_gem_object *gobj;
+ uint32_t handle;
+- u64 flags = AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
++ u64 flags = AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED |
++ AMDGPU_GEM_CREATE_CPU_GTT_USWC;
+ u32 domain;
+ int r;
+
+--
+2.20.1
+
--- /dev/null
+From e3264e744a3e91bc2bb066a36c4845969426d388 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 17:05:57 +0200
+Subject: drm/amdgpu/si: fix ASIC tests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jean Delvare <jdelvare@suse.de>
+
+[ Upstream commit 77efe48a729588527afb4d5811b9e0acb29f5e51 ]
+
+Comparing adev->family with CHIP constants is not correct.
+adev->family can only be compared with AMDGPU_FAMILY constants and
+adev->asic_type is the struct member to compare with CHIP constants.
+They are separate identification spaces.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10")
+Cc: Ken Wang <Qingqing.Wang@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: "David (ChunMing) Zhou" <David1.Zhou@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/si.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index 9d8df68893b9d..1e34dfc143556 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1867,7 +1867,7 @@ static void si_program_aspm(struct amdgpu_device *adev)
+ if (orig != data)
+ si_pif_phy1_wreg(adev,PB1_PIF_PWRDOWN_1, data);
+
+- if ((adev->family != CHIP_OLAND) && (adev->family != CHIP_HAINAN)) {
++ if ((adev->asic_type != CHIP_OLAND) && (adev->asic_type != CHIP_HAINAN)) {
+ orig = data = si_pif_phy0_rreg(adev,PB0_PIF_PWRDOWN_0);
+ data &= ~PLL_RAMP_UP_TIME_0_MASK;
+ if (orig != data)
+@@ -1916,14 +1916,14 @@ static void si_program_aspm(struct amdgpu_device *adev)
+
+ orig = data = si_pif_phy0_rreg(adev,PB0_PIF_CNTL);
+ data &= ~LS2_EXIT_TIME_MASK;
+- if ((adev->family == CHIP_OLAND) || (adev->family == CHIP_HAINAN))
++ if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type == CHIP_HAINAN))
+ data |= LS2_EXIT_TIME(5);
+ if (orig != data)
+ si_pif_phy0_wreg(adev,PB0_PIF_CNTL, data);
+
+ orig = data = si_pif_phy1_rreg(adev,PB1_PIF_CNTL);
+ data &= ~LS2_EXIT_TIME_MASK;
+- if ((adev->family == CHIP_OLAND) || (adev->family == CHIP_HAINAN))
++ if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type == CHIP_HAINAN))
+ data |= LS2_EXIT_TIME(5);
+ if (orig != data)
+ si_pif_phy1_wreg(adev,PB1_PIF_CNTL, data);
+--
+2.20.1
+
--- /dev/null
+From 320bf5790c82cd83c8fbdf15b50f7aa3b3c56dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 22:27:09 -0700
+Subject: drm/bridge: tc358767: Increase AUX transfer length limit
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit e0655feaec62d5139b6b13a7b1bbb1ab8f1c2d83 ]
+
+According to the datasheet tc358767 can transfer up to 16 bytes via
+its AUX channel, so the artificial limit of 8 appears to be too
+low. However only up to 15-bytes seem to be actually supported and
+trying to use 16-byte transfers results in transfers failing
+sporadically (with bogus status in case of I2C transfers), so limit it
+to 15.
+
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Laurent Pinchart <Laurent.pinchart@ideasonboard.com>
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: Cory Tusar <cory.tusar@zii.aero>
+Cc: Chris Healy <cphealy@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190619052716.16831-9-andrew.smirnov@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index f59a51e19dab0..d515c7cebb9c4 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -293,7 +293,7 @@ static ssize_t tc_aux_transfer(struct drm_dp_aux *aux,
+ struct drm_dp_aux_msg *msg)
+ {
+ struct tc_data *tc = aux_to_tc(aux);
+- size_t size = min_t(size_t, 8, msg->size);
++ size_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES - 1, msg->size);
+ u8 request = msg->request & ~DP_AUX_I2C_MOT;
+ u8 *buf = msg->buffer;
+ u32 tmp = 0;
+--
+2.20.1
+
--- /dev/null
+From e77640f72918e4d5ee9c6eeec166a52fad7e272e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 May 2019 15:44:57 +1000
+Subject: drm/nouveau/kms/tu102-: disable input lut when input is already FP16
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 1e339ab2ac3c769c1b06b9fb7d532f8495ebc56d ]
+
+On Turing, an input LUT is required to transform inputs in fixed-point
+formats to FP16 for the internal display pipe. We provide an identity
+mapping whenever a window is enabled for this reason.
+
+HW has error checks to ensure when the input is already FP16, that the
+input LUT is also disabled.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/wndw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/wndw.c b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+index 283ff690350ea..50303ec194bbc 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -320,7 +320,9 @@ nv50_wndw_atomic_check_lut(struct nv50_wndw *wndw,
+ asyh->wndw.olut &= ~BIT(wndw->id);
+ }
+
+- if (!ilut && wndw->func->ilut_identity) {
++ if (!ilut && wndw->func->ilut_identity &&
++ asyw->state.fb->format->format != DRM_FORMAT_XBGR16161616F &&
++ asyw->state.fb->format->format != DRM_FORMAT_ABGR16161616F) {
+ static struct drm_property_blob dummy = {};
+ ilut = &dummy;
+ }
+--
+2.20.1
+
--- /dev/null
+From b2b873fb38beb494eb4ba61f170bf3c13426f865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 11:21:00 +0200
+Subject: drm/nouveau/volt: Fix for some cards having 0 maximum voltage
+
+From: Mark Menzynski <mmenzyns@redhat.com>
+
+[ Upstream commit a1af2afbd244089560794c260b2d4326a86e39b6 ]
+
+Some, mostly Fermi, vbioses appear to have zero max voltage. That causes Nouveau to not parse voltage entries, thus users not being able to set higher clocks.
+
+When changing this value Nvidia driver still appeared to ignore it, and I wasn't able to find out why, thus the code is ignoring the value if it is zero.
+
+CC: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Mark Menzynski <mmenzyns@redhat.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
+index 7143ea4611aa3..33a9fb5ac5585 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/volt.c
+@@ -96,6 +96,8 @@ nvbios_volt_parse(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len,
+ info->min = min(info->base,
+ info->base + info->step * info->vidmask);
+ info->max = nvbios_rd32(bios, volt + 0x0e);
++ if (!info->max)
++ info->max = max(info->base, info->base + info->step * info->vidmask);
+ break;
+ case 0x50:
+ info->min = nvbios_rd32(bios, volt + 0x0a);
+--
+2.20.1
+
--- /dev/null
+From dda9a1533376ae3c6c87bb94a3eccca4c34a4639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 14:55:34 -0500
+Subject: drm/panel: check failure cases in the probe func
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit afd6d4f5a52c16e1483328ac074abb1cde92c29f ]
+
+The following function calls may fail and return NULL, so the null check
+is added.
+of_graph_get_next_endpoint
+of_graph_get_remote_port_parent
+of_graph_get_remote_port
+
+Update: Thanks to Sam Ravnborg, for suggession on the use of goto to avoid
+leaking endpoint.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190724195534.9303-1-navid.emamdoost@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/panel/panel-raspberrypi-touchscreen.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+index 2c9c9722734f5..9a2cb8aeab3a4 100644
+--- a/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
++++ b/drivers/gpu/drm/panel/panel-raspberrypi-touchscreen.c
+@@ -400,7 +400,13 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+
+ /* Look up the DSI host. It needs to probe before we do. */
+ endpoint = of_graph_get_next_endpoint(dev->of_node, NULL);
++ if (!endpoint)
++ return -ENODEV;
++
+ dsi_host_node = of_graph_get_remote_port_parent(endpoint);
++ if (!dsi_host_node)
++ goto error;
++
+ host = of_find_mipi_dsi_host_by_node(dsi_host_node);
+ of_node_put(dsi_host_node);
+ if (!host) {
+@@ -409,6 +415,9 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+ }
+
+ info.node = of_graph_get_remote_port(endpoint);
++ if (!info.node)
++ goto error;
++
+ of_node_put(endpoint);
+
+ ts->dsi = mipi_dsi_device_register_full(host, &info);
+@@ -429,6 +438,10 @@ static int rpi_touchscreen_probe(struct i2c_client *i2c,
+ return ret;
+
+ return 0;
++
++error:
++ of_node_put(endpoint);
++ return -ENODEV;
+ }
+
+ static int rpi_touchscreen_remove(struct i2c_client *i2c)
+--
+2.20.1
+
--- /dev/null
+From 1a9c1202be5c39563572d13cca10484bb8aab439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jul 2019 15:07:40 +0200
+Subject: drm/panel: simple: fix AUO g185han01 horizontal blanking
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit f8c6bfc612b56f02e1b8fae699dff12738aaf889 ]
+
+The horizontal blanking periods are too short, as the values are
+specified for a single LVDS channel. Since this panel is dual LVDS
+they need to be doubled. With this change the panel reaches its
+nominal vrefresh rate of 60Fps, instead of the 64Fps with the
+current wrong blanking.
+
+Philipp Zabel added:
+The datasheet specifies 960 active clocks + 40/128/160 clocks blanking
+on each of the two LVDS channels (min/typical/max), so doubled this is
+now correct.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/1562764060.23869.12.camel@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 397a3086eac8a..95e430f9fea43 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -723,9 +723,9 @@ static const struct panel_desc auo_g133han01 = {
+ static const struct display_timing auo_g185han01_timings = {
+ .pixelclock = { 120000000, 144000000, 175000000 },
+ .hactive = { 1920, 1920, 1920 },
+- .hfront_porch = { 18, 60, 74 },
+- .hback_porch = { 12, 44, 54 },
+- .hsync_len = { 10, 24, 32 },
++ .hfront_porch = { 36, 120, 148 },
++ .hback_porch = { 24, 88, 108 },
++ .hsync_len = { 20, 48, 64 },
+ .vactive = { 1080, 1080, 1080 },
+ .vfront_porch = { 6, 10, 40 },
+ .vback_porch = { 2, 5, 20 },
+--
+2.20.1
+
--- /dev/null
+From 8a34b2e11cb85e9f6397c7b4d3c63a58660476f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 17:10:14 -0500
+Subject: drm/radeon: Fix EEH during kexec
+
+From: KyleMahlkuch <kmahlkuc@linux.vnet.ibm.com>
+
+[ Upstream commit 6f7fe9a93e6c09bf988c5059403f5f88e17e21e6 ]
+
+During kexec some adapters hit an EEH since they are not properly
+shut down in the radeon_pci_shutdown() function. Adding
+radeon_suspend_kms() fixes this issue.
+
+Signed-off-by: KyleMahlkuch <kmahlkuc@linux.vnet.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_drv.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
+index 2e96c886392bd..60ee51edd7823 100644
+--- a/drivers/gpu/drm/radeon/radeon_drv.c
++++ b/drivers/gpu/drm/radeon/radeon_drv.c
+@@ -344,11 +344,19 @@ radeon_pci_remove(struct pci_dev *pdev)
+ static void
+ radeon_pci_shutdown(struct pci_dev *pdev)
+ {
++ struct drm_device *ddev = pci_get_drvdata(pdev);
++
+ /* if we are running in a VM, make sure the device
+ * torn down properly on reboot/shutdown
+ */
+ if (radeon_device_is_virtual())
+ radeon_pci_remove(pdev);
++
++ /* Some adapters need to be suspended before a
++ * shutdown occurs in order to prevent an error
++ * during kexec.
++ */
++ radeon_suspend_kms(ddev, true, true, false);
+ }
+
+ static int radeon_pmops_suspend(struct device *dev)
+--
+2.20.1
+
--- /dev/null
+From 3a5486d7248d278406b25d4bf5d5dcb63ae566d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 12:08:21 -0400
+Subject: drm/rockchip: Check for fast link training before enabling psr
+
+From: Sean Paul <seanpaul@chromium.org>
+
+[ Upstream commit ad309284a52be47c8b3126c9376358bf381861bc ]
+
+Once we start shutting off the link during PSR, we're going to want fast
+training to work. If the display doesn't support fast training, don't
+enable psr.
+
+Changes in v2:
+- None
+Changes in v3:
+- None
+Changes in v4:
+- None
+Changes in v5:
+- None
+
+Link to v1: https://patchwork.freedesktop.org/patch/msgid/20190228210939.83386-3-sean@poorly.run
+Link to v2: https://patchwork.freedesktop.org/patch/msgid/20190326204509.96515-2-sean@poorly.run
+Link to v3: https://patchwork.freedesktop.org/patch/msgid/20190502194956.218441-9-sean@poorly.run
+Link to v4: https://patchwork.freedesktop.org/patch/msgid/20190508160920.144739-8-sean@poorly.run
+
+Cc: Zain Wang <wzz@rock-chips.com>
+Cc: Tomasz Figa <tfiga@chromium.org>
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190611160844.257498-8-sean@poorly.run
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+index 3666c308c34a6..53676b5fec684 100644
+--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c
+@@ -1036,16 +1036,17 @@ static int analogix_dp_commit(struct analogix_dp_device *dp)
+ if (ret)
+ return ret;
+
++ /* Check whether panel supports fast training */
++ ret = analogix_dp_fast_link_train_detection(dp);
++ if (ret)
++ dp->psr_enable = false;
++
+ if (dp->psr_enable) {
+ ret = analogix_dp_enable_sink_psr(dp);
+ if (ret)
+ return ret;
+ }
+
+- /* Check whether panel supports fast training */
+- ret = analogix_dp_fast_link_train_detection(dp);
+- if (ret)
+- dp->psr_enable = false;
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1afdc141c623cb9c2f2b796ef91c033a9a92c22f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 10:42:28 +0200
+Subject: drm/stm: attach gem fence to atomic state
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit 8fabc9c3109a71b3577959a05408153ae69ccd8d ]
+
+To properly synchronize with other devices the fence from the GEM
+object backing the framebuffer needs to be attached to the atomic
+state, so the commit work can wait on fence signaling.
+
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Philippe Cornu <philippe.cornu@st.com>
+Tested-by: Philippe Cornu <philippe.cornu@st.com>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190712084228.8338-1-l.stach@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/stm/ltdc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c
+index 32fd6a3b37fb1..6f1fef76671c8 100644
+--- a/drivers/gpu/drm/stm/ltdc.c
++++ b/drivers/gpu/drm/stm/ltdc.c
+@@ -25,6 +25,7 @@
+ #include <drm/drm_fb_cma_helper.h>
+ #include <drm/drm_fourcc.h>
+ #include <drm/drm_gem_cma_helper.h>
++#include <drm/drm_gem_framebuffer_helper.h>
+ #include <drm/drm_of.h>
+ #include <drm/drm_plane_helper.h>
+ #include <drm/drm_probe_helper.h>
+@@ -875,6 +876,7 @@ static const struct drm_plane_funcs ltdc_plane_funcs = {
+ };
+
+ static const struct drm_plane_helper_funcs ltdc_plane_helper_funcs = {
++ .prepare_fb = drm_gem_fb_prepare_fb,
+ .atomic_check = ltdc_plane_atomic_check,
+ .atomic_update = ltdc_plane_atomic_update,
+ .atomic_disable = ltdc_plane_atomic_disable,
+--
+2.20.1
+
--- /dev/null
+From ce10110f69a3841358a55251d92040b3d872a374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 12:43:09 +0200
+Subject: drm/tinydrm/Kconfig: drivers: Select BACKLIGHT_CLASS_DEVICE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Noralf Trønnes <noralf@tronnes.org>
+
+[ Upstream commit 3389669ac5ea598562673c04971d7bb0fab0e9f1 ]
+
+The mipi_dbi helper is missing a dependency on DRM_KMS_HELPER and putting
+that in revealed this problem:
+
+drivers/video/fbdev/Kconfig:12:error: recursive dependency detected!
+drivers/video/fbdev/Kconfig:12: symbol FB is selected by DRM_KMS_FB_HELPER
+drivers/gpu/drm/Kconfig:75: symbol DRM_KMS_FB_HELPER depends on DRM_KMS_HELPER
+drivers/gpu/drm/Kconfig:69: symbol DRM_KMS_HELPER is selected by TINYDRM_MIPI_DBI
+drivers/gpu/drm/tinydrm/Kconfig:11: symbol TINYDRM_MIPI_DBI is selected by TINYDRM_HX8357D
+drivers/gpu/drm/tinydrm/Kconfig:15: symbol TINYDRM_HX8357D depends on BACKLIGHT_CLASS_DEVICE
+drivers/video/backlight/Kconfig:144: symbol BACKLIGHT_CLASS_DEVICE is selected by FB_BACKLIGHT
+drivers/video/fbdev/Kconfig:187: symbol FB_BACKLIGHT depends on FB
+
+A symbol that selects DRM_KMS_HELPER can not depend on
+BACKLIGHT_CLASS_DEVICE. The reason for this is that DRM_KMS_FB_HELPER
+selects FB instead of depending on it.
+
+The tinydrm drivers have somehow gotten away with depending on
+BACKLIGHT_CLASS_DEVICE because DRM_TINYDRM selects DRM_KMS_HELPER and the
+drivers depend on that symbol.
+
+An audit shows that all DRM drivers that select DRM_KMS_HELPER and use
+BACKLIGHT_CLASS_DEVICE, selects it:
+ DRM_TILCDC, DRM_GMA500, DRM_SHMOBILE, DRM_NOUVEAU, DRM_FSL_DCU,
+ DRM_I915, DRM_RADEON, DRM_AMDGPU, DRM_PARADE_PS8622
+
+Documentation/kbuild/kconfig-language.txt has a note regarding select:
+1. 'select should be used with care since it doesn't visit dependencies.'
+ This is not a problem since BACKLIGHT_CLASS_DEVICE doesn't have any
+ dependencies.
+2. 'In general use select only for non-visible symbols'
+ BACKLIGHT_CLASS_DEVICE is user visible.
+
+The real solution to this would be to have DRM_KMS_FB_HELPER depend on the
+user visible symbol FB. That is a can of worms I'm not willing to tackle.
+I fear that such a change will result in me handling difficult fallouts
+for the next weeks. So I'm following DRM suite here.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: David Lechner <david@lechnology.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190722104312.16184-7-noralf@tronnes.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tinydrm/Kconfig | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tinydrm/Kconfig b/drivers/gpu/drm/tinydrm/Kconfig
+index 87819c82bcce8..f2f0739d1035d 100644
+--- a/drivers/gpu/drm/tinydrm/Kconfig
++++ b/drivers/gpu/drm/tinydrm/Kconfig
+@@ -14,8 +14,8 @@ config TINYDRM_MIPI_DBI
+ config TINYDRM_HX8357D
+ tristate "DRM support for HX8357D display panels"
+ depends on DRM_TINYDRM && SPI
+- depends on BACKLIGHT_CLASS_DEVICE
+ select TINYDRM_MIPI_DBI
++ select BACKLIGHT_CLASS_DEVICE
+ help
+ DRM driver for the following HX8357D panels:
+ * YX350HV15-T 3.5" 340x350 TFT (Adafruit 3.5")
+@@ -35,8 +35,8 @@ config TINYDRM_ILI9225
+ config TINYDRM_ILI9341
+ tristate "DRM support for ILI9341 display panels"
+ depends on DRM_TINYDRM && SPI
+- depends on BACKLIGHT_CLASS_DEVICE
+ select TINYDRM_MIPI_DBI
++ select BACKLIGHT_CLASS_DEVICE
+ help
+ DRM driver for the following Ilitek ILI9341 panels:
+ * YX240QV29-T 2.4" 240x320 TFT (Adafruit 2.4")
+@@ -46,8 +46,8 @@ config TINYDRM_ILI9341
+ config TINYDRM_MI0283QT
+ tristate "DRM support for MI0283QT"
+ depends on DRM_TINYDRM && SPI
+- depends on BACKLIGHT_CLASS_DEVICE
+ select TINYDRM_MIPI_DBI
++ select BACKLIGHT_CLASS_DEVICE
+ help
+ DRM driver for the Multi-Inno MI0283QT display panel
+ If M is selected the module will be called mi0283qt.
+@@ -78,8 +78,8 @@ config TINYDRM_ST7586
+ config TINYDRM_ST7735R
+ tristate "DRM support for Sitronix ST7735R display panels"
+ depends on DRM_TINYDRM && SPI
+- depends on BACKLIGHT_CLASS_DEVICE
+ select TINYDRM_MIPI_DBI
++ select BACKLIGHT_CLASS_DEVICE
+ help
+ DRM driver Sitronix ST7735R with one of the following LCDs:
+ * JD-T18003-T01 1.8" 128x160 TFT
+--
+2.20.1
+
--- /dev/null
+From 6142915819ade9730ef556dfd9c811c3229fc085 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Jun 2019 22:36:18 -0300
+Subject: drm/vkms: Avoid assigning 0 for possible_crtc
+
+From: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+
+[ Upstream commit e9d85f731de06a35d2ae6cdcf7d0e037c98ef41a ]
+
+When vkms invoke drm_universal_plane_init(), it sets 0 for
+possible_crtcs parameter which means that planes can't be attached to
+any CRTC. It currently works due to some safeguard in the drm_crtc file;
+however, it is possible to identify the problem by trying to append a
+second connector. This patch fixes this issue by modifying
+vkms_plane_init() to accept an index parameter which makes the code a
+little bit more flexible and avoid set zero to possible_crtcs.
+
+Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/d67849c62a8d8ace1a0af455998b588798a4c45f.1561491964.git.rodrigosiqueiramelo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_drv.c | 2 +-
+ drivers/gpu/drm/vkms/vkms_drv.h | 4 ++--
+ drivers/gpu/drm/vkms/vkms_output.c | 6 +++---
+ drivers/gpu/drm/vkms/vkms_plane.c | 4 ++--
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
+index 738dd6206d85b..92296bd8f6233 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.c
++++ b/drivers/gpu/drm/vkms/vkms_drv.c
+@@ -92,7 +92,7 @@ static int vkms_modeset_init(struct vkms_device *vkmsdev)
+ dev->mode_config.max_height = YRES_MAX;
+ dev->mode_config.preferred_depth = 24;
+
+- return vkms_output_init(vkmsdev);
++ return vkms_output_init(vkmsdev, 0);
+ }
+
+ static int __init vkms_init(void)
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
+index 3c7e06b19efd5..a0adcc86079f5 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.h
++++ b/drivers/gpu/drm/vkms/vkms_drv.h
+@@ -115,10 +115,10 @@ bool vkms_get_vblank_timestamp(struct drm_device *dev, unsigned int pipe,
+ int *max_error, ktime_t *vblank_time,
+ bool in_vblank_irq);
+
+-int vkms_output_init(struct vkms_device *vkmsdev);
++int vkms_output_init(struct vkms_device *vkmsdev, int index);
+
+ struct drm_plane *vkms_plane_init(struct vkms_device *vkmsdev,
+- enum drm_plane_type type);
++ enum drm_plane_type type, int index);
+
+ /* Gem stuff */
+ struct drm_gem_object *vkms_gem_create(struct drm_device *dev,
+diff --git a/drivers/gpu/drm/vkms/vkms_output.c b/drivers/gpu/drm/vkms/vkms_output.c
+index 3b162b25312ec..1442b447c7070 100644
+--- a/drivers/gpu/drm/vkms/vkms_output.c
++++ b/drivers/gpu/drm/vkms/vkms_output.c
+@@ -36,7 +36,7 @@ static const struct drm_connector_helper_funcs vkms_conn_helper_funcs = {
+ .get_modes = vkms_conn_get_modes,
+ };
+
+-int vkms_output_init(struct vkms_device *vkmsdev)
++int vkms_output_init(struct vkms_device *vkmsdev, int index)
+ {
+ struct vkms_output *output = &vkmsdev->output;
+ struct drm_device *dev = &vkmsdev->drm;
+@@ -46,12 +46,12 @@ int vkms_output_init(struct vkms_device *vkmsdev)
+ struct drm_plane *primary, *cursor = NULL;
+ int ret;
+
+- primary = vkms_plane_init(vkmsdev, DRM_PLANE_TYPE_PRIMARY);
++ primary = vkms_plane_init(vkmsdev, DRM_PLANE_TYPE_PRIMARY, index);
+ if (IS_ERR(primary))
+ return PTR_ERR(primary);
+
+ if (enable_cursor) {
+- cursor = vkms_plane_init(vkmsdev, DRM_PLANE_TYPE_CURSOR);
++ cursor = vkms_plane_init(vkmsdev, DRM_PLANE_TYPE_CURSOR, index);
+ if (IS_ERR(cursor)) {
+ ret = PTR_ERR(cursor);
+ goto err_cursor;
+diff --git a/drivers/gpu/drm/vkms/vkms_plane.c b/drivers/gpu/drm/vkms/vkms_plane.c
+index 0e67d2d42f0cc..20ffc52f91940 100644
+--- a/drivers/gpu/drm/vkms/vkms_plane.c
++++ b/drivers/gpu/drm/vkms/vkms_plane.c
+@@ -168,7 +168,7 @@ static const struct drm_plane_helper_funcs vkms_primary_helper_funcs = {
+ };
+
+ struct drm_plane *vkms_plane_init(struct vkms_device *vkmsdev,
+- enum drm_plane_type type)
++ enum drm_plane_type type, int index)
+ {
+ struct drm_device *dev = &vkmsdev->drm;
+ const struct drm_plane_helper_funcs *funcs;
+@@ -190,7 +190,7 @@ struct drm_plane *vkms_plane_init(struct vkms_device *vkmsdev,
+ funcs = &vkms_primary_helper_funcs;
+ }
+
+- ret = drm_universal_plane_init(dev, plane, 0,
++ ret = drm_universal_plane_init(dev, plane, 1 << index,
+ &vkms_plane_funcs,
+ formats, nformats,
+ NULL, type, NULL);
+--
+2.20.1
+
--- /dev/null
+From ed08412ad4d534c738c7c9ad4a5c06d5c59ad242 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2019 00:27:42 +0200
+Subject: drm/vkms: Fix crc worker races
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit 18d0952a838ba559655b0cd9cf85097ad63d9bca ]
+
+The issue we have is that the crc worker might fall behind. We've
+tried to handle this by tracking both the earliest frame for which it
+still needs to compute a crc, and the last one. Plus when the
+crtc_state changes, we have a new work item, which are all run in
+order due to the ordered workqueue we allocate for each vkms crtc.
+
+Trouble is there's been a few small issues in the current code:
+- we need to capture frame_end in the vblank hrtimer, not in the
+ worker. The worker might run much later, and then we generate a lot
+ of crc for which there's already a different worker queued up.
+- frame number might be 0, so create a new crc_pending boolean to
+ track this without confusion.
+- we need to atomically grab frame_start/end and clear it, so do that
+ all in one go. This is not going to create a new race, because if we
+ race with the hrtimer then our work will be re-run.
+- only race that can happen is the following:
+ 1. worker starts
+ 2. hrtimer runs and updates frame_end
+ 3. worker grabs frame_start/end, already reading the new frame_end,
+ and clears crc_pending
+ 4. hrtimer calls queue_work()
+ 5. worker completes
+ 6. worker gets re-run, crc_pending is false
+ Explain this case a bit better by rewording the comment.
+
+v2: Demote warning level output to debug when we fail to requeue, this
+is expected under high load when the crc worker can't quite keep up.
+
+Cc: Shayenne Moura <shayenneluzmoura@gmail.com>
+Cc: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Cc: Haneen Mohammed <hamohammed.sa@gmail.com>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Reviewed-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Tested-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190606222751.32567-2-daniel.vetter@ffwll.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_crc.c | 27 +++++++++++++--------------
+ drivers/gpu/drm/vkms/vkms_crtc.c | 9 +++++++--
+ drivers/gpu/drm/vkms/vkms_drv.h | 2 ++
+ 3 files changed, 22 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_crc.c b/drivers/gpu/drm/vkms/vkms_crc.c
+index d7b409a3c0f8c..66603da634fe3 100644
+--- a/drivers/gpu/drm/vkms/vkms_crc.c
++++ b/drivers/gpu/drm/vkms/vkms_crc.c
+@@ -166,16 +166,24 @@ void vkms_crc_work_handle(struct work_struct *work)
+ struct drm_plane *plane;
+ u32 crc32 = 0;
+ u64 frame_start, frame_end;
++ bool crc_pending;
+ unsigned long flags;
+
+ spin_lock_irqsave(&out->state_lock, flags);
+ frame_start = crtc_state->frame_start;
+ frame_end = crtc_state->frame_end;
++ crc_pending = crtc_state->crc_pending;
++ crtc_state->frame_start = 0;
++ crtc_state->frame_end = 0;
++ crtc_state->crc_pending = false;
+ spin_unlock_irqrestore(&out->state_lock, flags);
+
+- /* _vblank_handle() hasn't updated frame_start yet */
+- if (!frame_start || frame_start == frame_end)
+- goto out;
++ /*
++ * We raced with the vblank hrtimer and previous work already computed
++ * the crc, nothing to do.
++ */
++ if (!crc_pending)
++ return;
+
+ drm_for_each_plane(plane, &vdev->drm) {
+ struct vkms_plane_state *vplane_state;
+@@ -196,20 +204,11 @@ void vkms_crc_work_handle(struct work_struct *work)
+ if (primary_crc)
+ crc32 = _vkms_get_crc(primary_crc, cursor_crc);
+
+- frame_end = drm_crtc_accurate_vblank_count(crtc);
+-
+- /* queue_work can fail to schedule crc_work; add crc for
+- * missing frames
++ /*
++ * The worker can fall behind the vblank hrtimer, make sure we catch up.
+ */
+ while (frame_start <= frame_end)
+ drm_crtc_add_crc_entry(crtc, true, frame_start++, &crc32);
+-
+-out:
+- /* to avoid using the same value for frame number again */
+- spin_lock_irqsave(&out->state_lock, flags);
+- crtc_state->frame_end = frame_end;
+- crtc_state->frame_start = 0;
+- spin_unlock_irqrestore(&out->state_lock, flags);
+ }
+
+ static int vkms_crc_parse_source(const char *src_name, bool *enabled)
+diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
+index e447b7588d06e..77a1f5fa5d5c8 100644
+--- a/drivers/gpu/drm/vkms/vkms_crtc.c
++++ b/drivers/gpu/drm/vkms/vkms_crtc.c
+@@ -30,13 +30,18 @@ static enum hrtimer_restart vkms_vblank_simulate(struct hrtimer *timer)
+ * has read the data
+ */
+ spin_lock(&output->state_lock);
+- if (!state->frame_start)
++ if (!state->crc_pending)
+ state->frame_start = frame;
++ else
++ DRM_DEBUG_DRIVER("crc worker falling behind, frame_start: %llu, frame_end: %llu\n",
++ state->frame_start, frame);
++ state->frame_end = frame;
++ state->crc_pending = true;
+ spin_unlock(&output->state_lock);
+
+ ret = queue_work(output->crc_workq, &state->crc_work);
+ if (!ret)
+- DRM_WARN("failed to queue vkms_crc_work_handle");
++ DRM_DEBUG_DRIVER("vkms_crc_work_handle already queued\n");
+ }
+
+ spin_unlock(&output->lock);
+diff --git a/drivers/gpu/drm/vkms/vkms_drv.h b/drivers/gpu/drm/vkms/vkms_drv.h
+index 81f1cfbeb9362..3c7e06b19efd5 100644
+--- a/drivers/gpu/drm/vkms/vkms_drv.h
++++ b/drivers/gpu/drm/vkms/vkms_drv.h
+@@ -56,6 +56,8 @@ struct vkms_plane_state {
+ struct vkms_crtc_state {
+ struct drm_crtc_state base;
+ struct work_struct crc_work;
++
++ bool crc_pending;
+ u64 frame_start;
+ u64 frame_end;
+ };
+--
+2.20.1
+
--- /dev/null
+From 7c20c21dad2f851da61fc917d14daae2315bc17c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 11:13:24 -0400
+Subject: ext4: fix potential use after free after remounting with
+ noblock_validity
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 7727ae52975d4f4ef7ff69ed8e6e25f6a4168158 ]
+
+Remount process will release system zone which was allocated before if
+"noblock_validity" is specified. If we mount an ext4 file system to two
+mountpoints with default mount options, and then remount one of them
+with "noblock_validity", it may trigger a use after free problem when
+someone accessing the other one.
+
+ # mount /dev/sda foo
+ # mount /dev/sda bar
+
+User access mountpoint "foo" | Remount mountpoint "bar"
+ |
+ext4_map_blocks() | ext4_remount()
+check_block_validity() | ext4_setup_system_zone()
+ext4_data_block_valid() | ext4_release_system_zone()
+ | free system_blks rb nodes
+access system_blks rb nodes |
+trigger use after free |
+
+This problem can also be reproduced by one mountpint, At the same time,
+add_system_zone() can get called during remount as well so there can be
+racing ext4_data_block_valid() reading the rbtree at the same time.
+
+This patch add RCU to protect system zone from releasing or building
+when doing a remount which inverse current "noblock_validity" mount
+option. It assign the rbtree after the whole tree was complete and
+do actual freeing after rcu grace period, avoid any intermediate state.
+
+Reported-by: syzbot+1e470567330b7ad711d5@syzkaller.appspotmail.com
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/block_validity.c | 189 ++++++++++++++++++++++++++++-----------
+ fs/ext4/ext4.h | 10 ++-
+ 2 files changed, 147 insertions(+), 52 deletions(-)
+
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index 8e83741b02e03..d4d4fdfac1a65 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -38,6 +38,7 @@ int __init ext4_init_system_zone(void)
+
+ void ext4_exit_system_zone(void)
+ {
++ rcu_barrier();
+ kmem_cache_destroy(ext4_system_zone_cachep);
+ }
+
+@@ -49,17 +50,26 @@ static inline int can_merge(struct ext4_system_zone *entry1,
+ return 0;
+ }
+
++static void release_system_zone(struct ext4_system_blocks *system_blks)
++{
++ struct ext4_system_zone *entry, *n;
++
++ rbtree_postorder_for_each_entry_safe(entry, n,
++ &system_blks->root, node)
++ kmem_cache_free(ext4_system_zone_cachep, entry);
++}
++
+ /*
+ * Mark a range of blocks as belonging to the "system zone" --- that
+ * is, filesystem metadata blocks which should never be used by
+ * inodes.
+ */
+-static int add_system_zone(struct ext4_sb_info *sbi,
++static int add_system_zone(struct ext4_system_blocks *system_blks,
+ ext4_fsblk_t start_blk,
+ unsigned int count)
+ {
+ struct ext4_system_zone *new_entry = NULL, *entry;
+- struct rb_node **n = &sbi->system_blks.rb_node, *node;
++ struct rb_node **n = &system_blks->root.rb_node, *node;
+ struct rb_node *parent = NULL, *new_node = NULL;
+
+ while (*n) {
+@@ -91,7 +101,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
+ new_node = &new_entry->node;
+
+ rb_link_node(new_node, parent, n);
+- rb_insert_color(new_node, &sbi->system_blks);
++ rb_insert_color(new_node, &system_blks->root);
+ }
+
+ /* Can we merge to the left? */
+@@ -101,7 +111,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
+ if (can_merge(entry, new_entry)) {
+ new_entry->start_blk = entry->start_blk;
+ new_entry->count += entry->count;
+- rb_erase(node, &sbi->system_blks);
++ rb_erase(node, &system_blks->root);
+ kmem_cache_free(ext4_system_zone_cachep, entry);
+ }
+ }
+@@ -112,7 +122,7 @@ static int add_system_zone(struct ext4_sb_info *sbi,
+ entry = rb_entry(node, struct ext4_system_zone, node);
+ if (can_merge(new_entry, entry)) {
+ new_entry->count += entry->count;
+- rb_erase(node, &sbi->system_blks);
++ rb_erase(node, &system_blks->root);
+ kmem_cache_free(ext4_system_zone_cachep, entry);
+ }
+ }
+@@ -126,7 +136,7 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ int first = 1;
+
+ printk(KERN_INFO "System zones: ");
+- node = rb_first(&sbi->system_blks);
++ node = rb_first(&sbi->system_blks->root);
+ while (node) {
+ entry = rb_entry(node, struct ext4_system_zone, node);
+ printk(KERN_CONT "%s%llu-%llu", first ? "" : ", ",
+@@ -137,7 +147,47 @@ static void debug_print_tree(struct ext4_sb_info *sbi)
+ printk(KERN_CONT "\n");
+ }
+
+-static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
++/*
++ * Returns 1 if the passed-in block region (start_blk,
++ * start_blk+count) is valid; 0 if some part of the block region
++ * overlaps with filesystem metadata blocks.
++ */
++static int ext4_data_block_valid_rcu(struct ext4_sb_info *sbi,
++ struct ext4_system_blocks *system_blks,
++ ext4_fsblk_t start_blk,
++ unsigned int count)
++{
++ struct ext4_system_zone *entry;
++ struct rb_node *n;
++
++ if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
++ (start_blk + count < start_blk) ||
++ (start_blk + count > ext4_blocks_count(sbi->s_es))) {
++ sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
++ return 0;
++ }
++
++ if (system_blks == NULL)
++ return 1;
++
++ n = system_blks->root.rb_node;
++ while (n) {
++ entry = rb_entry(n, struct ext4_system_zone, node);
++ if (start_blk + count - 1 < entry->start_blk)
++ n = n->rb_left;
++ else if (start_blk >= (entry->start_blk + entry->count))
++ n = n->rb_right;
++ else {
++ sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
++ return 0;
++ }
++ }
++ return 1;
++}
++
++static int ext4_protect_reserved_inode(struct super_block *sb,
++ struct ext4_system_blocks *system_blks,
++ u32 ino)
+ {
+ struct inode *inode;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+@@ -163,14 +213,15 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
+ if (n == 0) {
+ i++;
+ } else {
+- if (!ext4_data_block_valid(sbi, map.m_pblk, n)) {
++ if (!ext4_data_block_valid_rcu(sbi, system_blks,
++ map.m_pblk, n)) {
+ ext4_error(sb, "blocks %llu-%llu from inode %u "
+ "overlap system zone", map.m_pblk,
+ map.m_pblk + map.m_len - 1, ino);
+ err = -EFSCORRUPTED;
+ break;
+ }
+- err = add_system_zone(sbi, map.m_pblk, n);
++ err = add_system_zone(system_blks, map.m_pblk, n);
+ if (err < 0)
+ break;
+ i += n;
+@@ -180,94 +231,130 @@ static int ext4_protect_reserved_inode(struct super_block *sb, u32 ino)
+ return err;
+ }
+
++static void ext4_destroy_system_zone(struct rcu_head *rcu)
++{
++ struct ext4_system_blocks *system_blks;
++
++ system_blks = container_of(rcu, struct ext4_system_blocks, rcu);
++ release_system_zone(system_blks);
++ kfree(system_blks);
++}
++
++/*
++ * Build system zone rbtree which is used for block validity checking.
++ *
++ * The update of system_blks pointer in this function is protected by
++ * sb->s_umount semaphore. However we have to be careful as we can be
++ * racing with ext4_data_block_valid() calls reading system_blks rbtree
++ * protected only by RCU. That's why we first build the rbtree and then
++ * swap it in place.
++ */
+ int ext4_setup_system_zone(struct super_block *sb)
+ {
+ ext4_group_t ngroups = ext4_get_groups_count(sb);
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ struct ext4_system_blocks *system_blks;
+ struct ext4_group_desc *gdp;
+ ext4_group_t i;
+ int flex_size = ext4_flex_bg_size(sbi);
+ int ret;
+
+ if (!test_opt(sb, BLOCK_VALIDITY)) {
+- if (sbi->system_blks.rb_node)
++ if (sbi->system_blks)
+ ext4_release_system_zone(sb);
+ return 0;
+ }
+- if (sbi->system_blks.rb_node)
++ if (sbi->system_blks)
+ return 0;
+
++ system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
++ if (!system_blks)
++ return -ENOMEM;
++
+ for (i=0; i < ngroups; i++) {
+ cond_resched();
+ if (ext4_bg_has_super(sb, i) &&
+ ((i < 5) || ((i % flex_size) == 0)))
+- add_system_zone(sbi, ext4_group_first_block_no(sb, i),
++ add_system_zone(system_blks,
++ ext4_group_first_block_no(sb, i),
+ ext4_bg_num_gdb(sb, i) + 1);
+ gdp = ext4_get_group_desc(sb, i, NULL);
+- ret = add_system_zone(sbi, ext4_block_bitmap(sb, gdp), 1);
++ ret = add_system_zone(system_blks,
++ ext4_block_bitmap(sb, gdp), 1);
+ if (ret)
+- return ret;
+- ret = add_system_zone(sbi, ext4_inode_bitmap(sb, gdp), 1);
++ goto err;
++ ret = add_system_zone(system_blks,
++ ext4_inode_bitmap(sb, gdp), 1);
+ if (ret)
+- return ret;
+- ret = add_system_zone(sbi, ext4_inode_table(sb, gdp),
++ goto err;
++ ret = add_system_zone(system_blks,
++ ext4_inode_table(sb, gdp),
+ sbi->s_itb_per_group);
+ if (ret)
+- return ret;
++ goto err;
+ }
+ if (ext4_has_feature_journal(sb) && sbi->s_es->s_journal_inum) {
+- ret = ext4_protect_reserved_inode(sb,
++ ret = ext4_protect_reserved_inode(sb, system_blks,
+ le32_to_cpu(sbi->s_es->s_journal_inum));
+ if (ret)
+- return ret;
++ goto err;
+ }
+
++ /*
++ * System blks rbtree complete, announce it once to prevent racing
++ * with ext4_data_block_valid() accessing the rbtree at the same
++ * time.
++ */
++ rcu_assign_pointer(sbi->system_blks, system_blks);
++
+ if (test_opt(sb, DEBUG))
+ debug_print_tree(sbi);
+ return 0;
++err:
++ release_system_zone(system_blks);
++ kfree(system_blks);
++ return ret;
+ }
+
+-/* Called when the filesystem is unmounted */
++/*
++ * Called when the filesystem is unmounted or when remounting it with
++ * noblock_validity specified.
++ *
++ * The update of system_blks pointer in this function is protected by
++ * sb->s_umount semaphore. However we have to be careful as we can be
++ * racing with ext4_data_block_valid() calls reading system_blks rbtree
++ * protected only by RCU. So we first clear the system_blks pointer and
++ * then free the rbtree only after RCU grace period expires.
++ */
+ void ext4_release_system_zone(struct super_block *sb)
+ {
+- struct ext4_system_zone *entry, *n;
++ struct ext4_system_blocks *system_blks;
+
+- rbtree_postorder_for_each_entry_safe(entry, n,
+- &EXT4_SB(sb)->system_blks, node)
+- kmem_cache_free(ext4_system_zone_cachep, entry);
++ system_blks = rcu_dereference_protected(EXT4_SB(sb)->system_blks,
++ lockdep_is_held(&sb->s_umount));
++ rcu_assign_pointer(EXT4_SB(sb)->system_blks, NULL);
+
+- EXT4_SB(sb)->system_blks = RB_ROOT;
++ if (system_blks)
++ call_rcu(&system_blks->rcu, ext4_destroy_system_zone);
+ }
+
+-/*
+- * Returns 1 if the passed-in block region (start_blk,
+- * start_blk+count) is valid; 0 if some part of the block region
+- * overlaps with filesystem metadata blocks.
+- */
+ int ext4_data_block_valid(struct ext4_sb_info *sbi, ext4_fsblk_t start_blk,
+ unsigned int count)
+ {
+- struct ext4_system_zone *entry;
+- struct rb_node *n = sbi->system_blks.rb_node;
++ struct ext4_system_blocks *system_blks;
++ int ret;
+
+- if ((start_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
+- (start_blk + count < start_blk) ||
+- (start_blk + count > ext4_blocks_count(sbi->s_es))) {
+- sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+- return 0;
+- }
+- while (n) {
+- entry = rb_entry(n, struct ext4_system_zone, node);
+- if (start_blk + count - 1 < entry->start_blk)
+- n = n->rb_left;
+- else if (start_blk >= (entry->start_blk + entry->count))
+- n = n->rb_right;
+- else {
+- sbi->s_es->s_last_error_block = cpu_to_le64(start_blk);
+- return 0;
+- }
+- }
+- return 1;
++ /*
++ * Lock the system zone to prevent it being released concurrently
++ * when doing a remount which inverse current "[no]block_validity"
++ * mount option.
++ */
++ rcu_read_lock();
++ system_blks = rcu_dereference(sbi->system_blks);
++ ret = ext4_data_block_valid_rcu(sbi, system_blks, start_blk,
++ count);
++ rcu_read_unlock();
++ return ret;
+ }
+
+ int ext4_check_blockref(const char *function, unsigned int line,
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 1cb67859e0518..0014b1c5e6be1 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -184,6 +184,14 @@ struct ext4_map_blocks {
+ unsigned int m_flags;
+ };
+
++/*
++ * Block validity checking, system zone rbtree.
++ */
++struct ext4_system_blocks {
++ struct rb_root root;
++ struct rcu_head rcu;
++};
++
+ /*
+ * Flags for ext4_io_end->flags
+ */
+@@ -1420,7 +1428,7 @@ struct ext4_sb_info {
+ int s_jquota_fmt; /* Format of quota to use */
+ #endif
+ unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
+- struct rb_root system_blks;
++ struct ext4_system_blocks __rcu *system_blks;
+
+ #ifdef EXTENTS_STATS
+ /* ext4 extents stats */
+--
+2.20.1
+
--- /dev/null
+From 66e2cb03268472b92949ec4a472d1f84e2d91081 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2019 16:39:59 +0800
+Subject: f2fs: fix to drop meta/node pages during umount
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit a8933b6b68f775b5774e7b075447fae13f4d01fe ]
+
+As reported in bugzilla:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=204193
+
+A null pointer dereference bug is triggered in f2fs under kernel-5.1.3.
+
+ kasan_report.cold+0x5/0x32
+ f2fs_write_end_io+0x215/0x650
+ bio_endio+0x26e/0x320
+ blk_update_request+0x209/0x5d0
+ blk_mq_end_request+0x2e/0x230
+ lo_complete_rq+0x12c/0x190
+ blk_done_softirq+0x14a/0x1a0
+ __do_softirq+0x119/0x3e5
+ irq_exit+0x94/0xe0
+ call_function_single_interrupt+0xf/0x20
+
+During umount, we will access NULL sbi->node_inode pointer in
+f2fs_write_end_io():
+
+ f2fs_bug_on(sbi, page->mapping == NODE_MAPPING(sbi) &&
+ page->index != nid_of_node(page));
+
+The reason is if disable_checkpoint mount option is on, meta dirty
+pages can remain during umount, and then be flushed by iput() of
+meta_inode, however node_inode has been iput()ed before
+meta_inode's iput().
+
+Since checkpoint is disabled, all meta/node datas are useless and
+should be dropped in next mount, so in umount, let's adjust
+drop_inode() to give a hint to iput_final() to drop all those dirty
+datas correctly.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 973f1e8187706..01038aff5d8e0 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -894,7 +894,21 @@ static struct inode *f2fs_alloc_inode(struct super_block *sb)
+
+ static int f2fs_drop_inode(struct inode *inode)
+ {
++ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ int ret;
++
++ /*
++ * during filesystem shutdown, if checkpoint is disabled,
++ * drop useless meta/node dirty pages.
++ */
++ if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) {
++ if (inode->i_ino == F2FS_NODE_INO(sbi) ||
++ inode->i_ino == F2FS_META_INO(sbi)) {
++ trace_f2fs_drop_inode(inode, 1);
++ return 1;
++ }
++ }
++
+ /*
+ * This is to avoid a deadlock condition like below.
+ * writeback_single_inode(inode)
+--
+2.20.1
+
--- /dev/null
+From 015c212a3cf0ff80989bb12fe2af20f4f96193be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:32:53 -0700
+Subject: fat: work around race with userspace's read via blockdev while
+ mounting
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+[ Upstream commit 07bfa4415ab607e459b69bd86aa7e7602ce10b4f ]
+
+If userspace reads the buffer via blockdev while mounting,
+sb_getblk()+modify can race with buffer read via blockdev.
+
+For example,
+
+ FS userspace
+ bh = sb_getblk()
+ modify bh->b_data
+ read
+ ll_rw_block(bh)
+ fill bh->b_data by on-disk data
+ /* lost modified data by FS */
+ set_buffer_uptodate(bh)
+ set_buffer_uptodate(bh)
+
+Userspace should not use the blockdev while mounting though, the udev
+seems to be already doing this. Although I think the udev should try to
+avoid this, workaround the race by small overhead.
+
+Link: http://lkml.kernel.org/r/87pnk7l3sw.fsf_-_@mail.parknet.co.jp
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Reported-by: Jan Stancek <jstancek@redhat.com>
+Tested-by: Jan Stancek <jstancek@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fat/dir.c | 13 +++++++++++--
+ fs/fat/fatent.c | 3 +++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fat/dir.c b/fs/fat/dir.c
+index 1bda2ab6745ba..814ad2c2ba808 100644
+--- a/fs/fat/dir.c
++++ b/fs/fat/dir.c
+@@ -1100,8 +1100,11 @@ static int fat_zeroed_cluster(struct inode *dir, sector_t blknr, int nr_used,
+ err = -ENOMEM;
+ goto error;
+ }
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(bhs[n]);
+ memset(bhs[n]->b_data, 0, sb->s_blocksize);
+ set_buffer_uptodate(bhs[n]);
++ unlock_buffer(bhs[n]);
+ mark_buffer_dirty_inode(bhs[n], dir);
+
+ n++;
+@@ -1158,6 +1161,8 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec64 *ts)
+ fat_time_unix2fat(sbi, ts, &time, &date, &time_cs);
+
+ de = (struct msdos_dir_entry *)bhs[0]->b_data;
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(bhs[0]);
+ /* filling the new directory slots ("." and ".." entries) */
+ memcpy(de[0].name, MSDOS_DOT, MSDOS_NAME);
+ memcpy(de[1].name, MSDOS_DOTDOT, MSDOS_NAME);
+@@ -1180,6 +1185,7 @@ int fat_alloc_new_dir(struct inode *dir, struct timespec64 *ts)
+ de[0].size = de[1].size = 0;
+ memset(de + 2, 0, sb->s_blocksize - 2 * sizeof(*de));
+ set_buffer_uptodate(bhs[0]);
++ unlock_buffer(bhs[0]);
+ mark_buffer_dirty_inode(bhs[0], dir);
+
+ err = fat_zeroed_cluster(dir, blknr, 1, bhs, MAX_BUF_PER_PAGE);
+@@ -1237,11 +1243,14 @@ static int fat_add_new_entries(struct inode *dir, void *slots, int nr_slots,
+
+ /* fill the directory entry */
+ copy = min(size, sb->s_blocksize);
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(bhs[n]);
+ memcpy(bhs[n]->b_data, slots, copy);
+- slots += copy;
+- size -= copy;
+ set_buffer_uptodate(bhs[n]);
++ unlock_buffer(bhs[n]);
+ mark_buffer_dirty_inode(bhs[n], dir);
++ slots += copy;
++ size -= copy;
+ if (!size)
+ break;
+ n++;
+diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
+index 265983635f2be..3647c65a0f482 100644
+--- a/fs/fat/fatent.c
++++ b/fs/fat/fatent.c
+@@ -388,8 +388,11 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs,
+ err = -ENOMEM;
+ goto error;
+ }
++ /* Avoid race with userspace read via bdev */
++ lock_buffer(c_bh);
+ memcpy(c_bh->b_data, bhs[n]->b_data, sb->s_blocksize);
+ set_buffer_uptodate(c_bh);
++ unlock_buffer(c_bh);
+ mark_buffer_dirty_inode(c_bh, sbi->fat_inode);
+ if (sb->s_flags & SB_SYNCHRONOUS)
+ err = sync_dirty_buffer(c_bh);
+--
+2.20.1
+
--- /dev/null
+From 004b0d26c51e122a8d8f10bf754513dc51c4f07c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 16:36:44 +0800
+Subject: gpu: drm: radeon: Fix a possible null-pointer dereference in
+ radeon_connector_set_property()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit f3eb9b8f67bc28783eddc142ad805ebdc53d6339 ]
+
+In radeon_connector_set_property(), there is an if statement on line 743
+to check whether connector->encoder is NULL:
+ if (connector->encoder)
+
+When connector->encoder is NULL, it is used on line 755:
+ if (connector->encoder->crtc)
+
+Thus, a possible null-pointer dereference may occur.
+
+To fix this bug, connector->encoder is checked before being used.
+
+This bug is found by a static analysis tool STCheck written by us.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index de1745adccccb..c7f2e073a82fd 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -752,7 +752,7 @@ static int radeon_connector_set_property(struct drm_connector *connector, struct
+
+ radeon_encoder->output_csc = val;
+
+- if (connector->encoder->crtc) {
++ if (connector->encoder && connector->encoder->crtc) {
+ struct drm_crtc *crtc = connector->encoder->crtc;
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+
+--
+2.20.1
+
--- /dev/null
+From dad4604023c8c78e73bc03bbbbe48e391a499157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 16:46:32 +0200
+Subject: HID: apple: Fix stuck function keys when using FN
+
+From: Joao Moreno <mail@joaomoreno.com>
+
+[ Upstream commit aec256d0ecd561036f188dbc8fa7924c47a9edfd ]
+
+This fixes an issue in which key down events for function keys would be
+repeatedly emitted even after the user has raised the physical key. For
+example, the driver fails to emit the F5 key up event when going through
+the following steps:
+- fnmode=1: hold FN, hold F5, release FN, release F5
+- fnmode=2: hold F5, hold FN, release F5, release FN
+
+The repeated F5 key down events can be easily verified using xev.
+
+Signed-off-by: Joao Moreno <mail@joaomoreno.com>
+Co-developed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 49 +++++++++++++++++++++++------------------
+ 1 file changed, 28 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index 81df62f48c4c3..6ac8becc2372e 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -54,7 +54,6 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
+ struct apple_sc {
+ unsigned long quirks;
+ unsigned int fn_on;
+- DECLARE_BITMAP(pressed_fn, KEY_CNT);
+ DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+
+@@ -181,6 +180,8 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ {
+ struct apple_sc *asc = hid_get_drvdata(hid);
+ const struct apple_key_translation *trans, *table;
++ bool do_translate;
++ u16 code = 0;
+
+ if (usage->code == KEY_FN) {
+ asc->fn_on = !!value;
+@@ -189,8 +190,6 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ }
+
+ if (fnmode) {
+- int do_translate;
+-
+ if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
+ hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS)
+ table = macbookair_fn_keys;
+@@ -202,25 +201,33 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
+ trans = apple_find_translation (table, usage->code);
+
+ if (trans) {
+- if (test_bit(usage->code, asc->pressed_fn))
+- do_translate = 1;
+- else if (trans->flags & APPLE_FLAG_FKEY)
+- do_translate = (fnmode == 2 && asc->fn_on) ||
+- (fnmode == 1 && !asc->fn_on);
+- else
+- do_translate = asc->fn_on;
+-
+- if (do_translate) {
+- if (value)
+- set_bit(usage->code, asc->pressed_fn);
+- else
+- clear_bit(usage->code, asc->pressed_fn);
+-
+- input_event(input, usage->type, trans->to,
+- value);
+-
+- return 1;
++ if (test_bit(trans->from, input->key))
++ code = trans->from;
++ else if (test_bit(trans->to, input->key))
++ code = trans->to;
++
++ if (!code) {
++ if (trans->flags & APPLE_FLAG_FKEY) {
++ switch (fnmode) {
++ case 1:
++ do_translate = !asc->fn_on;
++ break;
++ case 2:
++ do_translate = asc->fn_on;
++ break;
++ default:
++ /* should never happen */
++ do_translate = false;
++ }
++ } else {
++ do_translate = asc->fn_on;
++ }
++
++ code = do_translate ? trans->to : trans->from;
+ }
++
++ input_event(input, usage->type, code, value);
++ return 1;
+ }
+
+ if (asc->quirks & APPLE_NUMLOCK_EMULATION &&
+--
+2.20.1
+
--- /dev/null
+From 83eb9e3e5242241cb4aa32065bec7fced649fe69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 11:54:26 -0700
+Subject: HID: wacom: Fix several minor compiler warnings
+
+From: Jason Gerecke <killertofu@gmail.com>
+
+[ Upstream commit 073b50bccbbf99a3b79a1913604c656d0e1a56c9 ]
+
+Addresses a few issues that were noticed when compiling with non-default
+warnings enabled. The trimmed-down warnings in the order they are fixed
+below are:
+
+* declaration of 'size' shadows a parameter
+
+* '%s' directive output may be truncated writing up to 5 bytes into a
+ region of size between 1 and 64
+
+* pointer targets in initialization of 'char *' from 'unsigned char *'
+ differ in signedness
+
+* left shift of negative value
+
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Reviewed-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/wacom_sys.c | 7 ++++---
+ drivers/hid/wacom_wac.c | 4 ++--
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 53bddb50aebaf..602219a8710d0 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -88,7 +88,7 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
+ }
+
+ static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
+- struct hid_report *report, u8 *raw_data, int size)
++ struct hid_report *report, u8 *raw_data, int report_size)
+ {
+ struct wacom *wacom = hid_get_drvdata(hdev);
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+@@ -149,7 +149,8 @@ static int wacom_wac_pen_serial_enforce(struct hid_device *hdev,
+ if (flush)
+ wacom_wac_queue_flush(hdev, &wacom_wac->pen_fifo);
+ else if (insert)
+- wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo, raw_data, size);
++ wacom_wac_queue_insert(hdev, &wacom_wac->pen_fifo,
++ raw_data, report_size);
+
+ return insert && !flush;
+ }
+@@ -2176,7 +2177,7 @@ static void wacom_update_name(struct wacom *wacom, const char *suffix)
+ {
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct wacom_features *features = &wacom_wac->features;
+- char name[WACOM_NAME_MAX];
++ char name[WACOM_NAME_MAX - 20]; /* Leave some room for suffixes */
+
+ /* Generic devices name unspecified */
+ if ((features->type == HID_GENERIC) && !strcmp("Wacom HID", features->name)) {
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 58719461850de..6be98851edca4 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -251,7 +251,7 @@ static int wacom_dtu_irq(struct wacom_wac *wacom)
+
+ static int wacom_dtus_irq(struct wacom_wac *wacom)
+ {
+- char *data = wacom->data;
++ unsigned char *data = wacom->data;
+ struct input_dev *input = wacom->pen_input;
+ unsigned short prox, pressure = 0;
+
+@@ -572,7 +572,7 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
+ strip2 = ((data[3] & 0x1f) << 8) | data[4];
+ }
+
+- prox = (buttons & ~(~0 << nbuttons)) | (keys & ~(~0 << nkeys)) |
++ prox = (buttons & ~(~0U << nbuttons)) | (keys & ~(~0U << nkeys)) |
+ (ring1 & 0x80) | (ring2 & 0x80) | strip1 | strip2;
+
+ wacom_report_numbered_buttons(input, nbuttons, buttons);
+--
+2.20.1
+
--- /dev/null
+From 424e1e92bb4c2c174b3785148a7bd68e84ef2418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2019 10:08:08 +0000
+Subject: hypfs: Fix error number left in struct pointer member
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b54c64f7adeb241423cd46598f458b5486b0375e ]
+
+In hypfs_fill_super(), if hypfs_create_update_file() fails,
+sbi->update_file is left holding an error number. This is passed to
+hypfs_kill_super() which doesn't check for this.
+
+Fix this by not setting sbi->update_value until after we've checked for
+error.
+
+Fixes: 24bbb1faf3f0 ("[PATCH] s390_hypfs filesystem")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+cc: linux-s390@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/hypfs/inode.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
+index ccad1398abd40..b5cfcad953c2e 100644
+--- a/arch/s390/hypfs/inode.c
++++ b/arch/s390/hypfs/inode.c
+@@ -269,7 +269,7 @@ static int hypfs_show_options(struct seq_file *s, struct dentry *root)
+ static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
+ {
+ struct inode *root_inode;
+- struct dentry *root_dentry;
++ struct dentry *root_dentry, *update_file;
+ int rc = 0;
+ struct hypfs_sb_info *sbi;
+
+@@ -300,9 +300,10 @@ static int hypfs_fill_super(struct super_block *sb, void *data, int silent)
+ rc = hypfs_diag_create_files(root_dentry);
+ if (rc)
+ return rc;
+- sbi->update_file = hypfs_create_update_file(root_dentry);
+- if (IS_ERR(sbi->update_file))
+- return PTR_ERR(sbi->update_file);
++ update_file = hypfs_create_update_file(root_dentry);
++ if (IS_ERR(update_file))
++ return PTR_ERR(update_file);
++ sbi->update_file = update_file;
+ hypfs_update_update(sb);
+ pr_info("Hypervisor filesystem mounted\n");
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From a4b295d2a113ab1efab84f3769b644ba80090f25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Aug 2019 12:03:01 +0200
+Subject: i2c-cht-wc: Fix lockdep warning
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 232219b9a464c2479c98aa589acb1bd3383ae9d6 ]
+
+When the kernel is build with lockdep support and the i2c-cht-wc driver is
+used, the following warning is shown:
+
+[ 66.674334] ======================================================
+[ 66.674337] WARNING: possible circular locking dependency detected
+[ 66.674340] 5.3.0-rc4+ #83 Not tainted
+[ 66.674342] ------------------------------------------------------
+[ 66.674345] systemd-udevd/1232 is trying to acquire lock:
+[ 66.674349] 00000000a74dab07 (intel_soc_pmic_chtwc:167:(&cht_wc_regmap_cfg)->lock){+.+.}, at: regmap_write+0x31/0x70
+[ 66.674360]
+ but task is already holding lock:
+[ 66.674362] 00000000d44a85b7 (i2c_register_adapter){+.+.}, at: i2c_smbus_xfer+0x49/0xf0
+[ 66.674370]
+ which lock already depends on the new lock.
+
+[ 66.674371]
+ the existing dependency chain (in reverse order) is:
+[ 66.674374]
+ -> #1 (i2c_register_adapter){+.+.}:
+[ 66.674381] rt_mutex_lock_nested+0x46/0x60
+[ 66.674384] i2c_smbus_xfer+0x49/0xf0
+[ 66.674387] i2c_smbus_read_byte_data+0x45/0x70
+[ 66.674391] cht_wc_byte_reg_read+0x35/0x50
+[ 66.674394] _regmap_read+0x63/0x1a0
+[ 66.674396] _regmap_update_bits+0xa8/0xe0
+[ 66.674399] regmap_update_bits_base+0x63/0xa0
+[ 66.674403] regmap_irq_update_bits.isra.0+0x3b/0x50
+[ 66.674406] regmap_add_irq_chip+0x592/0x7a0
+[ 66.674409] devm_regmap_add_irq_chip+0x89/0xed
+[ 66.674412] cht_wc_probe+0x102/0x158
+[ 66.674415] i2c_device_probe+0x95/0x250
+[ 66.674419] really_probe+0xf3/0x380
+[ 66.674422] driver_probe_device+0x59/0xd0
+[ 66.674425] device_driver_attach+0x53/0x60
+[ 66.674428] __driver_attach+0x92/0x150
+[ 66.674431] bus_for_each_dev+0x7d/0xc0
+[ 66.674434] bus_add_driver+0x14d/0x1f0
+[ 66.674437] driver_register+0x6d/0xb0
+[ 66.674440] i2c_register_driver+0x45/0x80
+[ 66.674445] do_one_initcall+0x60/0x2f4
+[ 66.674450] kernel_init_freeable+0x20d/0x2b4
+[ 66.674453] kernel_init+0xa/0x10c
+[ 66.674457] ret_from_fork+0x3a/0x50
+[ 66.674459]
+ -> #0 (intel_soc_pmic_chtwc:167:(&cht_wc_regmap_cfg)->lock){+.+.}:
+[ 66.674465] __lock_acquire+0xe07/0x1930
+[ 66.674468] lock_acquire+0x9d/0x1a0
+[ 66.674472] __mutex_lock+0xa8/0x9a0
+[ 66.674474] regmap_write+0x31/0x70
+[ 66.674480] cht_wc_i2c_adap_smbus_xfer+0x72/0x240 [i2c_cht_wc]
+[ 66.674483] __i2c_smbus_xfer+0x1a3/0x640
+[ 66.674486] i2c_smbus_xfer+0x67/0xf0
+[ 66.674489] i2c_smbus_read_byte_data+0x45/0x70
+[ 66.674494] bq24190_probe+0x26b/0x410 [bq24190_charger]
+[ 66.674497] i2c_device_probe+0x189/0x250
+[ 66.674500] really_probe+0xf3/0x380
+[ 66.674503] driver_probe_device+0x59/0xd0
+[ 66.674506] device_driver_attach+0x53/0x60
+[ 66.674509] __driver_attach+0x92/0x150
+[ 66.674512] bus_for_each_dev+0x7d/0xc0
+[ 66.674515] bus_add_driver+0x14d/0x1f0
+[ 66.674518] driver_register+0x6d/0xb0
+[ 66.674521] i2c_register_driver+0x45/0x80
+[ 66.674524] do_one_initcall+0x60/0x2f4
+[ 66.674528] do_init_module+0x5c/0x230
+[ 66.674531] load_module+0x2707/0x2a20
+[ 66.674534] __do_sys_init_module+0x188/0x1b0
+[ 66.674537] do_syscall_64+0x5c/0xb0
+[ 66.674541] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 66.674543]
+ other info that might help us debug this:
+
+[ 66.674545] Possible unsafe locking scenario:
+
+[ 66.674547] CPU0 CPU1
+[ 66.674548] ---- ----
+[ 66.674550] lock(i2c_register_adapter);
+[ 66.674553] lock(intel_soc_pmic_chtwc:167:(&cht_wc_regmap_cfg)->lock);
+[ 66.674556] lock(i2c_register_adapter);
+[ 66.674559] lock(intel_soc_pmic_chtwc:167:(&cht_wc_regmap_cfg)->lock);
+[ 66.674561]
+ *** DEADLOCK ***
+
+The problem is that the CHT Whiskey Cove PMIC's builtin i2c-adapter is
+itself a part of an i2c-client (the PMIC). This means that transfers done
+through it take adapter->bus_lock twice, once for the parent i2c-adapter
+and once for its own bus_lock. Lockdep does not like this nested locking.
+
+To make lockdep happy in the case of busses with muxes, the i2c-core's
+i2c_adapter_lock_bus function calls:
+
+ rt_mutex_lock_nested(&adapter->bus_lock, i2c_adapter_depth(adapter));
+
+But i2c_adapter_depth only works when the direct parent of the adapter is
+another adapter, as it is only meant for muxes. In this case there is an
+i2c-client and MFD instantiated platform_device in the parent->child chain
+between the 2 devices.
+
+This commit overrides the default i2c_lock_operations, passing a hardcoded
+depth of 1 to rt_mutex_lock_nested, making lockdep happy.
+
+Note that if there were to be a mux attached to the i2c-wc-cht adapter,
+this would break things again since the i2c-mux code expects the
+root-adapter to have a locking depth of 0. But the i2c-wc-cht adapter
+always has only 1 client directly attached in the form of the charger IC
+paired with the CHT Whiskey Cove PMIC.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cht-wc.c | 46 +++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-cht-wc.c b/drivers/i2c/busses/i2c-cht-wc.c
+index 66af44bfa67d5..f6546de66fbc8 100644
+--- a/drivers/i2c/busses/i2c-cht-wc.c
++++ b/drivers/i2c/busses/i2c-cht-wc.c
+@@ -178,6 +178,51 @@ static const struct i2c_algorithm cht_wc_i2c_adap_algo = {
+ .smbus_xfer = cht_wc_i2c_adap_smbus_xfer,
+ };
+
++/*
++ * We are an i2c-adapter which itself is part of an i2c-client. This means that
++ * transfers done through us take adapter->bus_lock twice, once for our parent
++ * i2c-adapter and once to take our own bus_lock. Lockdep does not like this
++ * nested locking, to make lockdep happy in the case of busses with muxes, the
++ * i2c-core's i2c_adapter_lock_bus function calls:
++ * rt_mutex_lock_nested(&adapter->bus_lock, i2c_adapter_depth(adapter));
++ *
++ * But i2c_adapter_depth only works when the direct parent of the adapter is
++ * another adapter, as it is only meant for muxes. In our case there is an
++ * i2c-client and MFD instantiated platform_device in the parent->child chain
++ * between the 2 devices.
++ *
++ * So we override the default i2c_lock_operations and pass a hardcoded
++ * depth of 1 to rt_mutex_lock_nested, to make lockdep happy.
++ *
++ * Note that if there were to be a mux attached to our adapter, this would
++ * break things again since the i2c-mux code expects the root-adapter to have
++ * a locking depth of 0. But we always have only 1 client directly attached
++ * in the form of the Charger IC paired with the CHT Whiskey Cove PMIC.
++ */
++static void cht_wc_i2c_adap_lock_bus(struct i2c_adapter *adapter,
++ unsigned int flags)
++{
++ rt_mutex_lock_nested(&adapter->bus_lock, 1);
++}
++
++static int cht_wc_i2c_adap_trylock_bus(struct i2c_adapter *adapter,
++ unsigned int flags)
++{
++ return rt_mutex_trylock(&adapter->bus_lock);
++}
++
++static void cht_wc_i2c_adap_unlock_bus(struct i2c_adapter *adapter,
++ unsigned int flags)
++{
++ rt_mutex_unlock(&adapter->bus_lock);
++}
++
++static const struct i2c_lock_operations cht_wc_i2c_adap_lock_ops = {
++ .lock_bus = cht_wc_i2c_adap_lock_bus,
++ .trylock_bus = cht_wc_i2c_adap_trylock_bus,
++ .unlock_bus = cht_wc_i2c_adap_unlock_bus,
++};
++
+ /**** irqchip for the client connected to the extchgr i2c adapter ****/
+ static void cht_wc_i2c_irq_lock(struct irq_data *data)
+ {
+@@ -286,6 +331,7 @@ static int cht_wc_i2c_adap_i2c_probe(struct platform_device *pdev)
+ adap->adapter.owner = THIS_MODULE;
+ adap->adapter.class = I2C_CLASS_HWMON;
+ adap->adapter.algo = &cht_wc_i2c_adap_algo;
++ adap->adapter.lock_ops = &cht_wc_i2c_adap_lock_ops;
+ strlcpy(adap->adapter.name, "PMIC I2C Adapter",
+ sizeof(adap->adapter.name));
+ adap->adapter.dev.parent = &pdev->dev;
+--
+2.20.1
+
--- /dev/null
+From b5c271a14987e3b47c99648ffb3364af02e5aed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 07:31:36 -0500
+Subject: ipmi_si: Only schedule continuously in the thread in maintenance mode
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 340ff31ab00bca5c15915e70ad9ada3030c98cf8 ]
+
+ipmi_thread() uses back-to-back schedule() to poll for command
+completion which, on some machines, can push up CPU consumption and
+heavily tax the scheduler locks leading to noticeable overall
+performance degradation.
+
+This was originally added so firmware updates through IPMI would
+complete in a timely manner. But we can't kill the scheduler
+locks for that one use case.
+
+Instead, only run schedule() continuously in maintenance mode,
+where firmware updates should run.
+
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_si_intf.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index f124a2d2bb9f5..92a89c8290aa4 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -221,6 +221,9 @@ struct smi_info {
+ */
+ bool irq_enable_broken;
+
++ /* Is the driver in maintenance mode? */
++ bool in_maintenance_mode;
++
+ /*
+ * Did we get an attention that we did not handle?
+ */
+@@ -1007,11 +1010,20 @@ static int ipmi_thread(void *data)
+ spin_unlock_irqrestore(&(smi_info->si_lock), flags);
+ busy_wait = ipmi_thread_busy_wait(smi_result, smi_info,
+ &busy_until);
+- if (smi_result == SI_SM_CALL_WITHOUT_DELAY)
++ if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
+ ; /* do nothing */
+- else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait)
+- schedule();
+- else if (smi_result == SI_SM_IDLE) {
++ } else if (smi_result == SI_SM_CALL_WITH_DELAY && busy_wait) {
++ /*
++ * In maintenance mode we run as fast as
++ * possible to allow firmware updates to
++ * complete as fast as possible, but normally
++ * don't bang on the scheduler.
++ */
++ if (smi_info->in_maintenance_mode)
++ schedule();
++ else
++ usleep_range(100, 200);
++ } else if (smi_result == SI_SM_IDLE) {
+ if (atomic_read(&smi_info->need_watch)) {
+ schedule_timeout_interruptible(100);
+ } else {
+@@ -1019,8 +1031,9 @@ static int ipmi_thread(void *data)
+ __set_current_state(TASK_INTERRUPTIBLE);
+ schedule();
+ }
+- } else
++ } else {
+ schedule_timeout_interruptible(1);
++ }
+ }
+ return 0;
+ }
+@@ -1198,6 +1211,7 @@ static void set_maintenance_mode(void *send_info, bool enable)
+
+ if (!enable)
+ atomic_set(&smi_info->req_events, 0);
++ smi_info->in_maintenance_mode = enable;
+ }
+
+ static void shutdown_smi(void *send_info);
+--
+2.20.1
+
--- /dev/null
+From 02ee0d195cd8257e9f5e82a70959c2e82557b875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:33:05 -0700
+Subject: kbuild: clean compressed initramfs image
+
+From: Greg Thelen <gthelen@google.com>
+
+[ Upstream commit 6279eb3dd7946c69346a3b98473ed13d3a44adb5 ]
+
+Since 9e3596b0c653 ("kbuild: initramfs cleanup, set target from Kconfig")
+"make clean" leaves behind compressed initramfs images. Example:
+
+ $ make defconfig
+ $ sed -i 's|CONFIG_INITRAMFS_SOURCE=""|CONFIG_INITRAMFS_SOURCE="/tmp/ir.cpio"|' .config
+ $ make olddefconfig
+ $ make -s
+ $ make -s clean
+ $ git clean -ndxf | grep initramfs
+ Would remove usr/initramfs_data.cpio.gz
+
+clean rules do not have CONFIG_* context so they do not know which
+compression format was used. Thus they don't know which files to delete.
+
+Tell clean to delete all possible compression formats.
+
+Once patched usr/initramfs_data.cpio.gz and friends are deleted by
+"make clean".
+
+Link: http://lkml.kernel.org/r/20190722063251.55541-1-gthelen@google.com
+Fixes: 9e3596b0c653 ("kbuild: initramfs cleanup, set target from Kconfig")
+Signed-off-by: Greg Thelen <gthelen@google.com>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ usr/Makefile | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/usr/Makefile b/usr/Makefile
+index 4a70ae43c9cb5..bdb3f52fadc44 100644
+--- a/usr/Makefile
++++ b/usr/Makefile
+@@ -11,6 +11,9 @@ datafile_y = initramfs_data.cpio$(suffix_y)
+ datafile_d_y = .$(datafile_y).d
+ AFLAGS_initramfs_data.o += -DINITRAMFS_IMAGE="usr/$(datafile_y)"
+
++# clean rules do not have CONFIG_INITRAMFS_COMPRESSION. So clean up after all
++# possible compression formats.
++clean-files += initramfs_data.cpio*
+
+ # Generate builtin.o based on initramfs_data.o
+ obj-$(CONFIG_BLK_DEV_INITRD) := initramfs_data.o
+--
+2.20.1
+
--- /dev/null
+From f6d8fa7a00da5bb8d5500e7466571d0f8538bc53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:33:55 -0700
+Subject: kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit b751c52bb587ae66f773b15204ef7a147467f4c7 ]
+
+The current default value (400) is too low on many systems (e.g. some
+ARM64 platform takes up 1000+ entries).
+
+syzbot uses 16000 as default value, and has proved to be enough on beefy
+configurations, so let's pick that value.
+
+This consumes more RAM on boot (each entry is 160 bytes, so in total
+~2.5MB of RAM), but the memory would later be freed (early_log is
+__initdata).
+
+Link: http://lkml.kernel.org/r/20190730154027.101525-1-drinkcat@chromium.org
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Suggested-by: Dmitry Vyukov <dvyukov@google.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Dmitry Vyukov <dvyukov@google.com>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Cc: Uladzislau Rezki <urezki@gmail.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index cbdfae3798965..120ec6f64bbc3 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -599,7 +599,7 @@ config DEBUG_KMEMLEAK_EARLY_LOG_SIZE
+ int "Maximum kmemleak early log entries"
+ depends on DEBUG_KMEMLEAK
+ range 200 40000
+- default 400
++ default 16000
+ help
+ Kmemleak must track all the memory allocations to avoid
+ reporting false positives. Since memory may be allocated or
+--
+2.20.1
+
--- /dev/null
+From 6ba51fedd97ebfabf000e53492bd07f827330eb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jul 2019 14:28:39 +0200
+Subject: livepatch: Nullify obj->mod in klp_module_coming()'s error path
+
+From: Miroslav Benes <mbenes@suse.cz>
+
+[ Upstream commit 4ff96fb52c6964ad42e0a878be8f86a2e8052ddd ]
+
+klp_module_coming() is called for every module appearing in the system.
+It sets obj->mod to a patched module for klp_object obj. Unfortunately
+it leaves it set even if an error happens later in the function and the
+patched module is not allowed to be loaded.
+
+klp_is_object_loaded() uses obj->mod variable and could currently give a
+wrong return value. The bug is probably harmless as of now.
+
+Signed-off-by: Miroslav Benes <mbenes@suse.cz>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/livepatch/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
+index c4ce08f43bd63..ab4a4606d19b7 100644
+--- a/kernel/livepatch/core.c
++++ b/kernel/livepatch/core.c
+@@ -1175,6 +1175,7 @@ err:
+ pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
+ patch->mod->name, obj->mod->name, obj->mod->name);
+ mod->klp_alive = false;
++ obj->mod = NULL;
+ klp_cleanup_module_patches_limited(mod, patch);
+ mutex_unlock(&klp_mutex);
+
+--
+2.20.1
+
--- /dev/null
+From d32263e1336d42342acb4a31c8d39a820d93fd24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 09:48:12 +0800
+Subject: mailbox: mediatek: cmdq: clear the event in cmdq initial flow
+
+From: Bibby Hsieh <bibby.hsieh@mediatek.com>
+
+[ Upstream commit 6058f11870b8e6d4f5cc7b591097c00bf69a000d ]
+
+GCE hardware stored event information in own internal sysram,
+if the initial value in those sysram is not zero value
+it will cause a situation that gce can wait the event immediately
+after client ask gce to wait event but not really trigger the
+corresponding hardware.
+
+In order to make sure that the wait event function is
+exactly correct, we need to clear the sysram value in
+cmdq initial flow.
+
+Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver")
+
+Signed-off-by: Bibby Hsieh <bibby.hsieh@mediatek.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/mtk-cmdq-mailbox.c | 5 +++++
+ include/linux/mailbox/mtk-cmdq-mailbox.h | 3 +++
+ include/linux/soc/mediatek/mtk-cmdq.h | 3 ---
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
+index 00d5219094e5d..48bba49139523 100644
+--- a/drivers/mailbox/mtk-cmdq-mailbox.c
++++ b/drivers/mailbox/mtk-cmdq-mailbox.c
+@@ -22,6 +22,7 @@
+ #define CMDQ_NUM_CMD(t) (t->cmd_buf_size / CMDQ_INST_SIZE)
+
+ #define CMDQ_CURR_IRQ_STATUS 0x10
++#define CMDQ_SYNC_TOKEN_UPDATE 0x68
+ #define CMDQ_THR_SLOT_CYCLES 0x30
+ #define CMDQ_THR_BASE 0x100
+ #define CMDQ_THR_SIZE 0x80
+@@ -104,8 +105,12 @@ static void cmdq_thread_resume(struct cmdq_thread *thread)
+
+ static void cmdq_init(struct cmdq *cmdq)
+ {
++ int i;
++
+ WARN_ON(clk_enable(cmdq->clock) < 0);
+ writel(CMDQ_THR_ACTIVE_SLOT_CYCLES, cmdq->base + CMDQ_THR_SLOT_CYCLES);
++ for (i = 0; i <= CMDQ_MAX_EVENT; i++)
++ writel(i, cmdq->base + CMDQ_SYNC_TOKEN_UPDATE);
+ clk_disable(cmdq->clock);
+ }
+
+diff --git a/include/linux/mailbox/mtk-cmdq-mailbox.h b/include/linux/mailbox/mtk-cmdq-mailbox.h
+index ccb73422c2fa2..e6f54ef6698b1 100644
+--- a/include/linux/mailbox/mtk-cmdq-mailbox.h
++++ b/include/linux/mailbox/mtk-cmdq-mailbox.h
+@@ -20,6 +20,9 @@
+ #define CMDQ_WFE_WAIT BIT(15)
+ #define CMDQ_WFE_WAIT_VALUE 0x1
+
++/** cmdq event maximum */
++#define CMDQ_MAX_EVENT 0x3ff
++
+ /*
+ * CMDQ_CODE_MASK:
+ * set write mask
+diff --git a/include/linux/soc/mediatek/mtk-cmdq.h b/include/linux/soc/mediatek/mtk-cmdq.h
+index 54ade13a9b157..4e8899972db4d 100644
+--- a/include/linux/soc/mediatek/mtk-cmdq.h
++++ b/include/linux/soc/mediatek/mtk-cmdq.h
+@@ -13,9 +13,6 @@
+
+ #define CMDQ_NO_TIMEOUT 0xffffffffu
+
+-/** cmdq event maximum */
+-#define CMDQ_MAX_EVENT 0x3ff
+-
+ struct cmdq_pkt;
+
+ struct cmdq_client {
+--
+2.20.1
+
--- /dev/null
+From 1c56f1a783c58d6d1d5be0e8126a9f2b99d286c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 10:27:58 +0200
+Subject: mbox: qcom: add APCS child device for QCS404
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+
+[ Upstream commit 78c86458a440ff356073c21b568cb58ddb67b82b ]
+
+There is clock controller functionality in the APCS hardware block of
+qcs404 devices similar to msm8916.
+
+Co-developed-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/qcom-apcs-ipc-mailbox.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+index 705e17a5479cc..d3676fd3cf945 100644
+--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c
++++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c
+@@ -47,7 +47,6 @@ static const struct mbox_chan_ops qcom_apcs_ipc_ops = {
+
+ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
+ struct qcom_apcs_ipc *apcs;
+ struct regmap *regmap;
+ struct resource *res;
+@@ -55,6 +54,11 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
+ void __iomem *base;
+ unsigned long i;
+ int ret;
++ const struct of_device_id apcs_clk_match_table[] = {
++ { .compatible = "qcom,msm8916-apcs-kpss-global", },
++ { .compatible = "qcom,qcs404-apcs-apps-global", },
++ {}
++ };
+
+ apcs = devm_kzalloc(&pdev->dev, sizeof(*apcs), GFP_KERNEL);
+ if (!apcs)
+@@ -89,7 +93,7 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- if (of_device_is_compatible(np, "qcom,msm8916-apcs-kpss-global")) {
++ if (of_match_device(apcs_clk_match_table, &pdev->dev)) {
+ apcs->clk = platform_device_register_data(&pdev->dev,
+ "qcom-apcs-msm8916-clk",
+ -1, NULL, 0);
+--
+2.20.1
+
--- /dev/null
+From 2d835a48612b68f8d456827aed15f00e0d217160 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jul 2019 12:55:03 +0800
+Subject: mfd: intel-lpss: Remove D3cold delay
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 76380a607ba0b28627c9b4b55cd47a079a59624b ]
+
+Goodix touchpad may drop its first couple input events when
+i2c-designware-platdrv and intel-lpss it connects to took too long to
+runtime resume from runtime suspended state.
+
+This issue happens becuase the touchpad has a rather small buffer to
+store up to 13 input events, so if the host doesn't read those events in
+time (i.e. runtime resume takes too long), events are dropped from the
+touchpad's buffer.
+
+The bottleneck is D3cold delay it waits when transitioning from D3cold
+to D0, hence remove the delay to make the resume faster. I've tested
+some systems with intel-lpss and haven't seen any regression.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202683
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss-pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index aed2c04479663..3c271b14e7c6c 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -35,6 +35,8 @@ static int intel_lpss_pci_probe(struct pci_dev *pdev,
+ info->mem = &pdev->resource[0];
+ info->irq = pdev->irq;
+
++ pdev->d3cold_delay = 0;
++
+ /* Probably it is enough to set this for iDMA capable devices only */
+ pci_set_master(pdev);
+ pci_try_set_mwi(pdev);
+--
+2.20.1
+
--- /dev/null
+From 97783529ac67c741c01cd3df4436f7ee20b13f5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 15:43:19 +0200
+Subject: mips/atomic: Fix loongson_llsc_mb() wreckage
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1c6c1ca318585f1096d4d04bc722297c85e9fb8a ]
+
+The comment describing the loongson_llsc_mb() reorder case doesn't
+make any sense what so ever. Instruction re-ordering is not an SMP
+artifact, but rather a CPU local phenomenon. Clarify the comment by
+explaining that these issue cause a coherence fail.
+
+For the branch speculation case; if futex_atomic_cmpxchg_inatomic()
+needs one at the bne branch target, then surely the normal
+__cmpxch_asm() implementation does too. We cannot rely on the
+barriers from cmpxchg() because cmpxchg_local() is implemented with
+the same macro, and branch prediction and speculation are, too, CPU
+local.
+
+Fixes: e02e07e3127d ("MIPS: Loongson: Introduce and use loongson_llsc_mb()")
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Huang Pei <huangpei@loongson.cn>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/atomic.h | 5 +++--
+ arch/mips/include/asm/barrier.h | 32 ++++++++++++++++++--------------
+ arch/mips/include/asm/bitops.h | 5 +++++
+ arch/mips/include/asm/cmpxchg.h | 5 +++++
+ arch/mips/kernel/syscall.c | 1 +
+ 5 files changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index 94096299fc569..c85405afba5ed 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -193,6 +193,7 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
+ if (kernel_uses_llsc) {
+ int temp;
+
++ loongson_llsc_mb();
+ __asm__ __volatile__(
+ " .set push \n"
+ " .set "MIPS_ISA_LEVEL" \n"
+@@ -200,12 +201,12 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
+ " .set pop \n"
+ " subu %0, %1, %3 \n"
+ " move %1, %0 \n"
+- " bltz %0, 1f \n"
++ " bltz %0, 2f \n"
+ " .set push \n"
+ " .set "MIPS_ISA_LEVEL" \n"
+ " sc %1, %2 \n"
+ "\t" __scbeqz " %1, 1b \n"
+- "1: \n"
++ "2: \n"
+ " .set pop \n"
+ : "=&r" (result), "=&r" (temp),
+ "+" GCC_OFF_SMALL_ASM() (v->counter)
+diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
+index b865e317a14f7..f9a6da96aae12 100644
+--- a/arch/mips/include/asm/barrier.h
++++ b/arch/mips/include/asm/barrier.h
+@@ -238,36 +238,40 @@
+
+ /*
+ * Some Loongson 3 CPUs have a bug wherein execution of a memory access (load,
+- * store or pref) in between an ll & sc can cause the sc instruction to
++ * store or prefetch) in between an LL & SC can cause the SC instruction to
+ * erroneously succeed, breaking atomicity. Whilst it's unusual to write code
+ * containing such sequences, this bug bites harder than we might otherwise
+ * expect due to reordering & speculation:
+ *
+- * 1) A memory access appearing prior to the ll in program order may actually
+- * be executed after the ll - this is the reordering case.
++ * 1) A memory access appearing prior to the LL in program order may actually
++ * be executed after the LL - this is the reordering case.
+ *
+- * In order to avoid this we need to place a memory barrier (ie. a sync
+- * instruction) prior to every ll instruction, in between it & any earlier
+- * memory access instructions. Many of these cases are already covered by
+- * smp_mb__before_llsc() but for the remaining cases, typically ones in
+- * which multiple CPUs may operate on a memory location but ordering is not
+- * usually guaranteed, we use loongson_llsc_mb() below.
++ * In order to avoid this we need to place a memory barrier (ie. a SYNC
++ * instruction) prior to every LL instruction, in between it and any earlier
++ * memory access instructions.
+ *
+ * This reordering case is fixed by 3A R2 CPUs, ie. 3A2000 models and later.
+ *
+- * 2) If a conditional branch exists between an ll & sc with a target outside
+- * of the ll-sc loop, for example an exit upon value mismatch in cmpxchg()
++ * 2) If a conditional branch exists between an LL & SC with a target outside
++ * of the LL-SC loop, for example an exit upon value mismatch in cmpxchg()
+ * or similar, then misprediction of the branch may allow speculative
+- * execution of memory accesses from outside of the ll-sc loop.
++ * execution of memory accesses from outside of the LL-SC loop.
+ *
+- * In order to avoid this we need a memory barrier (ie. a sync instruction)
++ * In order to avoid this we need a memory barrier (ie. a SYNC instruction)
+ * at each affected branch target, for which we also use loongson_llsc_mb()
+ * defined below.
+ *
+ * This case affects all current Loongson 3 CPUs.
++ *
++ * The above described cases cause an error in the cache coherence protocol;
++ * such that the Invalidate of a competing LL-SC goes 'missing' and SC
++ * erroneously observes its core still has Exclusive state and lets the SC
++ * proceed.
++ *
++ * Therefore the error only occurs on SMP systems.
+ */
+ #ifdef CONFIG_CPU_LOONGSON3_WORKAROUNDS /* Loongson-3's LLSC workaround */
+-#define loongson_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory")
++#define loongson_llsc_mb() __asm__ __volatile__("sync" : : :"memory")
+ #else
+ #define loongson_llsc_mb() do { } while (0)
+ #endif
+diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
+index 9a466dde9b96a..7bd35e5e2a9e4 100644
+--- a/arch/mips/include/asm/bitops.h
++++ b/arch/mips/include/asm/bitops.h
+@@ -249,6 +249,7 @@ static inline int test_and_set_bit(unsigned long nr,
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+
++ loongson_llsc_mb();
+ do {
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -305,6 +306,7 @@ static inline int test_and_set_bit_lock(unsigned long nr,
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+
++ loongson_llsc_mb();
+ do {
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -364,6 +366,7 @@ static inline int test_and_clear_bit(unsigned long nr,
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+
++ loongson_llsc_mb();
+ do {
+ __asm__ __volatile__(
+ " " __LL "%0, %1 # test_and_clear_bit \n"
+@@ -379,6 +382,7 @@ static inline int test_and_clear_bit(unsigned long nr,
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+
++ loongson_llsc_mb();
+ do {
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -438,6 +442,7 @@ static inline int test_and_change_bit(unsigned long nr,
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+
++ loongson_llsc_mb();
+ do {
+ __asm__ __volatile__(
+ " .set push \n"
+diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
+index f345a873742d9..f5994a332673b 100644
+--- a/arch/mips/include/asm/cmpxchg.h
++++ b/arch/mips/include/asm/cmpxchg.h
+@@ -46,6 +46,7 @@ extern unsigned long __xchg_called_with_bad_pointer(void)
+ __typeof(*(m)) __ret; \
+ \
+ if (kernel_uses_llsc) { \
++ loongson_llsc_mb(); \
+ __asm__ __volatile__( \
+ " .set push \n" \
+ " .set noat \n" \
+@@ -117,6 +118,7 @@ static inline unsigned long __xchg(volatile void *ptr, unsigned long x,
+ __typeof(*(m)) __ret; \
+ \
+ if (kernel_uses_llsc) { \
++ loongson_llsc_mb(); \
+ __asm__ __volatile__( \
+ " .set push \n" \
+ " .set noat \n" \
+@@ -134,6 +136,7 @@ static inline unsigned long __xchg(volatile void *ptr, unsigned long x,
+ : "=&r" (__ret), "=" GCC_OFF_SMALL_ASM() (*m) \
+ : GCC_OFF_SMALL_ASM() (*m), "Jr" (old), "Jr" (new) \
+ : "memory"); \
++ loongson_llsc_mb(); \
+ } else { \
+ unsigned long __flags; \
+ \
+@@ -229,6 +232,7 @@ static inline unsigned long __cmpxchg64(volatile void *ptr,
+ */
+ local_irq_save(flags);
+
++ loongson_llsc_mb();
+ asm volatile(
+ " .set push \n"
+ " .set " MIPS_ISA_ARCH_LEVEL " \n"
+@@ -274,6 +278,7 @@ static inline unsigned long __cmpxchg64(volatile void *ptr,
+ "r" (old),
+ "r" (new)
+ : "memory");
++ loongson_llsc_mb();
+
+ local_irq_restore(flags);
+ return ret;
+diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
+index b6dc78ad5d8c0..b0e25e913bdb9 100644
+--- a/arch/mips/kernel/syscall.c
++++ b/arch/mips/kernel/syscall.c
+@@ -132,6 +132,7 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new)
+ [efault] "i" (-EFAULT)
+ : "memory");
+ } else if (cpu_has_llsc) {
++ loongson_llsc_mb();
+ __asm__ __volatile__ (
+ " .set push \n"
+ " .set "MIPS_ISA_ARCH_LEVEL" \n"
+--
+2.20.1
+
--- /dev/null
+From 211d6f0d9a1720fb7f12d7d6635b483427a9a8ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 15:43:20 +0200
+Subject: mips/atomic: Fix smp_mb__{before,after}_atomic()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 42344113ba7a1ed7b5654cd5270af0d5698d8521 ]
+
+Recent probing at the Linux Kernel Memory Model uncovered a
+'surprise'. Strongly ordered architectures where the atomic RmW
+primitive implies full memory ordering and
+smp_mb__{before,after}_atomic() are a simple barrier() (such as MIPS
+without WEAK_REORDERING_BEYOND_LLSC) fail for:
+
+ *x = 1;
+ atomic_inc(u);
+ smp_mb__after_atomic();
+ r0 = *y;
+
+Because, while the atomic_inc() implies memory order, it
+(surprisingly) does not provide a compiler barrier. This then allows
+the compiler to re-order like so:
+
+ atomic_inc(u);
+ *x = 1;
+ smp_mb__after_atomic();
+ r0 = *y;
+
+Which the CPU is then allowed to re-order (under TSO rules) like:
+
+ atomic_inc(u);
+ r0 = *y;
+ *x = 1;
+
+And this very much was not intended. Therefore strengthen the atomic
+RmW ops to include a compiler barrier.
+
+Reported-by: Andrea Parri <andrea.parri@amarulasolutions.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/atomic.h | 14 +++++------
+ arch/mips/include/asm/barrier.h | 12 ++++++++--
+ arch/mips/include/asm/bitops.h | 42 ++++++++++++++++++++-------------
+ arch/mips/include/asm/cmpxchg.h | 6 ++---
+ 4 files changed, 45 insertions(+), 29 deletions(-)
+
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index c85405afba5ed..50cc2f0962e56 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -68,7 +68,7 @@ static __inline__ void atomic_##op(int i, atomic_t * v) \
+ "\t" __scbeqz " %0, 1b \n" \
+ " .set pop \n" \
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "Ir" (i)); \
++ : "Ir" (i) : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long flags; \
+ \
+@@ -98,7 +98,7 @@ static __inline__ int atomic_##op##_return_relaxed(int i, atomic_t * v) \
+ " .set pop \n" \
+ : "=&r" (result), "=&r" (temp), \
+ "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "Ir" (i)); \
++ : "Ir" (i) : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long flags; \
+ \
+@@ -132,7 +132,7 @@ static __inline__ int atomic_fetch_##op##_relaxed(int i, atomic_t * v) \
+ " move %0, %1 \n" \
+ : "=&r" (result), "=&r" (temp), \
+ "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "Ir" (i)); \
++ : "Ir" (i) : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long flags; \
+ \
+@@ -210,7 +210,7 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
+ " .set pop \n"
+ : "=&r" (result), "=&r" (temp),
+ "+" GCC_OFF_SMALL_ASM() (v->counter)
+- : "Ir" (i));
++ : "Ir" (i) : __LLSC_CLOBBER);
+ } else {
+ unsigned long flags;
+
+@@ -270,7 +270,7 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v) \
+ "\t" __scbeqz " %0, 1b \n" \
+ " .set pop \n" \
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "Ir" (i)); \
++ : "Ir" (i) : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long flags; \
+ \
+@@ -300,7 +300,7 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
+ " .set pop \n" \
+ : "=&r" (result), "=&r" (temp), \
+ "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "Ir" (i)); \
++ : "Ir" (i) : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long flags; \
+ \
+@@ -334,7 +334,7 @@ static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v) \
+ " .set pop \n" \
+ : "=&r" (result), "=&r" (temp), \
+ "+" GCC_OFF_SMALL_ASM() (v->counter) \
+- : "Ir" (i)); \
++ : "Ir" (i) : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long flags; \
+ \
+diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
+index f9a6da96aae12..9228f73862205 100644
+--- a/arch/mips/include/asm/barrier.h
++++ b/arch/mips/include/asm/barrier.h
+@@ -211,14 +211,22 @@
+ #define __smp_wmb() barrier()
+ #endif
+
++/*
++ * When LL/SC does imply order, it must also be a compiler barrier to avoid the
++ * compiler from reordering where the CPU will not. When it does not imply
++ * order, the compiler is also free to reorder across the LL/SC loop and
++ * ordering will be done by smp_llsc_mb() and friends.
++ */
+ #if defined(CONFIG_WEAK_REORDERING_BEYOND_LLSC) && defined(CONFIG_SMP)
+ #define __WEAK_LLSC_MB " sync \n"
++#define smp_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory")
++#define __LLSC_CLOBBER
+ #else
+ #define __WEAK_LLSC_MB " \n"
++#define smp_llsc_mb() do { } while (0)
++#define __LLSC_CLOBBER "memory"
+ #endif
+
+-#define smp_llsc_mb() __asm__ __volatile__(__WEAK_LLSC_MB : : :"memory")
+-
+ #ifdef CONFIG_CPU_CAVIUM_OCTEON
+ #define smp_mb__before_llsc() smp_wmb()
+ #define __smp_mb__before_llsc() __smp_wmb()
+diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
+index 7bd35e5e2a9e4..985d6a02f9ea1 100644
+--- a/arch/mips/include/asm/bitops.h
++++ b/arch/mips/include/asm/bitops.h
+@@ -66,7 +66,8 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
+ " beqzl %0, 1b \n"
+ " .set pop \n"
+ : "=&r" (temp), "=" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (1UL << bit), GCC_OFF_SMALL_ASM() (*m));
++ : "ir" (1UL << bit), GCC_OFF_SMALL_ASM() (*m)
++ : __LLSC_CLOBBER);
+ #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
+ loongson_llsc_mb();
+@@ -76,7 +77,8 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
+ " " __INS "%0, %3, %2, 1 \n"
+ " " __SC "%0, %1 \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (bit), "r" (~0));
++ : "ir" (bit), "r" (~0)
++ : __LLSC_CLOBBER);
+ } while (unlikely(!temp));
+ #endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */
+ } else if (kernel_uses_llsc) {
+@@ -90,7 +92,8 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
+ " " __SC "%0, %1 \n"
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (1UL << bit));
++ : "ir" (1UL << bit)
++ : __LLSC_CLOBBER);
+ } while (unlikely(!temp));
+ } else
+ __mips_set_bit(nr, addr);
+@@ -122,7 +125,8 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
+ " beqzl %0, 1b \n"
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (~(1UL << bit)));
++ : "ir" (~(1UL << bit))
++ : __LLSC_CLOBBER);
+ #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ } else if (kernel_uses_llsc && __builtin_constant_p(bit)) {
+ loongson_llsc_mb();
+@@ -132,7 +136,8 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
+ " " __INS "%0, $0, %2, 1 \n"
+ " " __SC "%0, %1 \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (bit));
++ : "ir" (bit)
++ : __LLSC_CLOBBER);
+ } while (unlikely(!temp));
+ #endif /* CONFIG_CPU_MIPSR2 || CONFIG_CPU_MIPSR6 */
+ } else if (kernel_uses_llsc) {
+@@ -146,7 +151,8 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
+ " " __SC "%0, %1 \n"
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (~(1UL << bit)));
++ : "ir" (~(1UL << bit))
++ : __LLSC_CLOBBER);
+ } while (unlikely(!temp));
+ } else
+ __mips_clear_bit(nr, addr);
+@@ -192,7 +198,8 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
+ " beqzl %0, 1b \n"
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (1UL << bit));
++ : "ir" (1UL << bit)
++ : __LLSC_CLOBBER);
+ } else if (kernel_uses_llsc) {
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+@@ -207,7 +214,8 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
+ " " __SC "%0, %1 \n"
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m)
+- : "ir" (1UL << bit));
++ : "ir" (1UL << bit)
++ : __LLSC_CLOBBER);
+ } while (unlikely(!temp));
+ } else
+ __mips_change_bit(nr, addr);
+@@ -244,7 +252,7 @@ static inline int test_and_set_bit(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } else if (kernel_uses_llsc) {
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+@@ -260,7 +268,7 @@ static inline int test_and_set_bit(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } while (unlikely(!res));
+
+ res = temp & (1UL << bit);
+@@ -301,7 +309,7 @@ static inline int test_and_set_bit_lock(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+m" (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } else if (kernel_uses_llsc) {
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+@@ -317,7 +325,7 @@ static inline int test_and_set_bit_lock(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } while (unlikely(!res));
+
+ res = temp & (1UL << bit);
+@@ -360,7 +368,7 @@ static inline int test_and_clear_bit(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ } else if (kernel_uses_llsc && __builtin_constant_p(nr)) {
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+@@ -375,7 +383,7 @@ static inline int test_and_clear_bit(unsigned long nr,
+ " " __SC "%0, %1 \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "ir" (bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } while (unlikely(!temp));
+ #endif
+ } else if (kernel_uses_llsc) {
+@@ -394,7 +402,7 @@ static inline int test_and_clear_bit(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } while (unlikely(!res));
+
+ res = temp & (1UL << bit);
+@@ -437,7 +445,7 @@ static inline int test_and_change_bit(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } else if (kernel_uses_llsc) {
+ unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
+ unsigned long temp;
+@@ -453,7 +461,7 @@ static inline int test_and_change_bit(unsigned long nr,
+ " .set pop \n"
+ : "=&r" (temp), "+" GCC_OFF_SMALL_ASM() (*m), "=&r" (res)
+ : "r" (1UL << bit)
+- : "memory");
++ : __LLSC_CLOBBER);
+ } while (unlikely(!res));
+
+ res = temp & (1UL << bit);
+diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
+index f5994a332673b..c8a47d18f6288 100644
+--- a/arch/mips/include/asm/cmpxchg.h
++++ b/arch/mips/include/asm/cmpxchg.h
+@@ -61,7 +61,7 @@ extern unsigned long __xchg_called_with_bad_pointer(void)
+ " .set pop \n" \
+ : "=&r" (__ret), "=" GCC_OFF_SMALL_ASM() (*m) \
+ : GCC_OFF_SMALL_ASM() (*m), "Jr" (val) \
+- : "memory"); \
++ : __LLSC_CLOBBER); \
+ } else { \
+ unsigned long __flags; \
+ \
+@@ -134,8 +134,8 @@ static inline unsigned long __xchg(volatile void *ptr, unsigned long x,
+ " .set pop \n" \
+ "2: \n" \
+ : "=&r" (__ret), "=" GCC_OFF_SMALL_ASM() (*m) \
+- : GCC_OFF_SMALL_ASM() (*m), "Jr" (old), "Jr" (new) \
+- : "memory"); \
++ : GCC_OFF_SMALL_ASM() (*m), "Jr" (old), "Jr" (new) \
++ : __LLSC_CLOBBER); \
+ loongson_llsc_mb(); \
+ } else { \
+ unsigned long __flags; \
+--
+2.20.1
+
--- /dev/null
+From 3ce90734d50a26a1feb2449ecbc2480c3ccf39e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2019 20:31:16 -0700
+Subject: MIPS: Don't use bc_false uninitialized in __mm_isBranchInstr
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit c2869aafe7191d366d74c55cb8a93c6d0baba317 ]
+
+clang warns:
+
+arch/mips/kernel/branch.c:148:8: error: variable 'bc_false' is used
+uninitialized whenever switch case is taken
+[-Werror,-Wsometimes-uninitialized]
+ case mm_bc2t_op:
+ ^~~~~~~~~~
+arch/mips/kernel/branch.c:157:8: note: uninitialized use occurs here
+ if (bc_false)
+ ^~~~~~~~
+arch/mips/kernel/branch.c:149:8: error: variable 'bc_false' is used
+uninitialized whenever switch case is taken
+[-Werror,-Wsometimes-uninitialized]
+ case mm_bc1t_op:
+ ^~~~~~~~~~
+arch/mips/kernel/branch.c:157:8: note: uninitialized use occurs here
+ if (bc_false)
+ ^~~~~~~~
+arch/mips/kernel/branch.c:142:4: note: variable 'bc_false' is declared
+here
+ int bc_false = 0;
+ ^
+2 errors generated.
+
+When mm_bc1t_op and mm_bc2t_op are taken, the bc_false initialization
+does not happen, which leads to a garbage value upon use, as illustrated
+below with a small sample program.
+
+$ mipsel-linux-gnu-gcc --version | head -n1
+mipsel-linux-gnu-gcc (Debian 8.3.0-2) 8.3.0
+
+$ clang --version | head -n1
+ClangBuiltLinux clang version 9.0.0 (git://github.com/llvm/llvm-project
+544315b4197034a3be8acd12cba56a75fb1f08dc) (based on LLVM 9.0.0svn)
+
+$ cat test.c
+ #include <stdio.h>
+
+ static void switch_scoped(int opcode)
+ {
+ switch (opcode) {
+ case 1:
+ case 2: {
+ int bc_false = 0;
+
+ bc_false = 4;
+ case 3:
+ case 4:
+ printf("\t* switch scoped bc_false = %d\n", bc_false);
+ }
+ }
+ }
+
+ static void function_scoped(int opcode)
+ {
+ int bc_false = 0;
+
+ switch (opcode) {
+ case 1:
+ case 2: {
+ bc_false = 4;
+ case 3:
+ case 4:
+ printf("\t* function scoped bc_false = %d\n", bc_false);
+ }
+ }
+ }
+
+ int main(void)
+ {
+ int opcode;
+
+ for (opcode = 1; opcode < 5; opcode++) {
+ printf("opcode = %d:\n", opcode);
+ switch_scoped(opcode);
+ function_scoped(opcode);
+ printf("\n");
+ }
+
+ return 0;
+ }
+
+$ mipsel-linux-gnu-gcc -std=gnu89 -static test.c && \
+ qemu-mipsel a.out
+opcode = 1:
+ * switch scoped bc_false = 4
+ * function scoped bc_false = 4
+
+opcode = 2:
+ * switch scoped bc_false = 4
+ * function scoped bc_false = 4
+
+opcode = 3:
+ * switch scoped bc_false = 2147483004
+ * function scoped bc_false = 0
+
+opcode = 4:
+ * switch scoped bc_false = 2147483004
+ * function scoped bc_false = 0
+
+$ clang -std=gnu89 --target=mipsel-linux-gnu -m32 -static test.c && \
+ qemu-mipsel a.out
+opcode = 1:
+ * switch scoped bc_false = 4
+ * function scoped bc_false = 4
+
+opcode = 2:
+ * switch scoped bc_false = 4
+ * function scoped bc_false = 4
+
+opcode = 3:
+ * switch scoped bc_false = 2147483004
+ * function scoped bc_false = 0
+
+opcode = 4:
+ * switch scoped bc_false = 2147483004
+ * function scoped bc_false = 0
+
+Move the definition up so that we get the right behavior and mark it
+__maybe_unused as it will not be used when CONFIG_MIPS_FP_SUPPORT
+isn't enabled.
+
+Fixes: 6a1cc218b9cc ("MIPS: branch: Remove FP branch handling when CONFIG_MIPS_FP_SUPPORT=n")
+Link: https://github.com/ClangBuiltLinux/linux/issues/603
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/branch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c
+index 180ad081afcf9..c2d88c1dcc0f8 100644
+--- a/arch/mips/kernel/branch.c
++++ b/arch/mips/kernel/branch.c
+@@ -58,6 +58,7 @@ int __mm_isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
+ unsigned long *contpc)
+ {
+ union mips_instruction insn = (union mips_instruction)dec_insn.insn;
++ int __maybe_unused bc_false = 0;
+
+ if (!cpu_has_mmips)
+ return 0;
+@@ -139,7 +140,6 @@ int __mm_isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
+ #ifdef CONFIG_MIPS_FP_SUPPORT
+ case mm_bc2f_op:
+ case mm_bc1f_op: {
+- int bc_false = 0;
+ unsigned int fcr31;
+ unsigned int bit;
+
+--
+2.20.1
+
--- /dev/null
+From 4a8098373ddca0f2488bc97d62b4936c542e1939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 16:27:37 +0800
+Subject: MIPS: Ingenic: Disable broken BTB lookup optimization.
+
+From: Zhou Yanjie <zhouyanjie@zoho.com>
+
+[ Upstream commit 053951dda71ecb4b554a2cdbe26f5f6f9bee9dd2 ]
+
+In order to further reduce power consumption, the XBurst core
+by default attempts to avoid branch target buffer lookups by
+detecting & special casing loops. This feature will cause
+BogoMIPS and lpj calculate in error. Set cp0 config7 bit 4 to
+disable this feature.
+
+Signed-off-by: Zhou Yanjie <zhouyanjie@zoho.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: ralf@linux-mips.org
+Cc: paul@crapouillou.net
+Cc: jhogan@kernel.org
+Cc: malat@debian.org
+Cc: gregkh@linuxfoundation.org
+Cc: tglx@linutronix.de
+Cc: allison@lohutok.net
+Cc: syq@debian.org
+Cc: chenhc@lemote.com
+Cc: jiaxun.yang@flygoat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mipsregs.h | 4 ++++
+ arch/mips/kernel/cpu-probe.c | 7 +++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h
+index 1e6966e8527e9..bdbdc19a2b8f8 100644
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -689,6 +689,9 @@
+ #define MIPS_CONF7_IAR (_ULCAST_(1) << 10)
+ #define MIPS_CONF7_AR (_ULCAST_(1) << 16)
+
++/* Ingenic Config7 bits */
++#define MIPS_CONF7_BTB_LOOP_EN (_ULCAST_(1) << 4)
++
+ /* Config7 Bits specific to MIPS Technologies. */
+
+ /* Performance counters implemented Per TC */
+@@ -2813,6 +2816,7 @@ __BUILD_SET_C0(status)
+ __BUILD_SET_C0(cause)
+ __BUILD_SET_C0(config)
+ __BUILD_SET_C0(config5)
++__BUILD_SET_C0(config7)
+ __BUILD_SET_C0(intcontrol)
+ __BUILD_SET_C0(intctl)
+ __BUILD_SET_C0(srsmap)
+diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
+index 9635c1db3ae6a..e654ffc1c8a0d 100644
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1964,6 +1964,13 @@ static inline void cpu_probe_ingenic(struct cpuinfo_mips *c, unsigned int cpu)
+ c->cputype = CPU_JZRISC;
+ c->writecombine = _CACHE_UNCACHED_ACCELERATED;
+ __cpu_name[cpu] = "Ingenic JZRISC";
++ /*
++ * The XBurst core by default attempts to avoid branch target
++ * buffer lookups by detecting & special casing loops. This
++ * feature will cause BogoMIPS and lpj calculate in error.
++ * Set cp0 config7 bit 4 to disable this feature.
++ */
++ set_c0_config7(MIPS_CONF7_BTB_LOOP_EN);
+ break;
+ default:
+ panic("Unknown Ingenic Processor ID!");
+--
+2.20.1
+
--- /dev/null
+From 1271cbc9e42285996aecc01ea1233312a219abd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:39:04 -0700
+Subject: mips: properly account for stack randomization and stack guard gap
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit b1f61b5bde3a1f50392c97b4c8513d1b8efb1cf2 ]
+
+This commit takes care of stack randomization and stack guard gap when
+computing mmap base address and checks if the task asked for
+randomization. This fixes the problem uncovered and not fixed for arm
+here: https://lkml.kernel.org/r/20170622200033.25714-1-riel@redhat.com
+
+Link: http://lkml.kernel.org/r/20190730055113.23635-10-alex@ghiti.fr
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Paul Burton <paul.burton@mips.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Albert Ou <aou@eecs.berkeley.edu>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Palmer Dabbelt <palmer@sifive.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/mmap.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
+index d79f2b4323187..f5c778113384b 100644
+--- a/arch/mips/mm/mmap.c
++++ b/arch/mips/mm/mmap.c
+@@ -21,8 +21,9 @@ unsigned long shm_align_mask = PAGE_SIZE - 1; /* Sane caches */
+ EXPORT_SYMBOL(shm_align_mask);
+
+ /* gap between mmap and stack */
+-#define MIN_GAP (128*1024*1024UL)
+-#define MAX_GAP ((TASK_SIZE)/6*5)
++#define MIN_GAP (128*1024*1024UL)
++#define MAX_GAP ((TASK_SIZE)/6*5)
++#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12))
+
+ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ {
+@@ -38,6 +39,15 @@ static int mmap_is_legacy(struct rlimit *rlim_stack)
+ static unsigned long mmap_base(unsigned long rnd, struct rlimit *rlim_stack)
+ {
+ unsigned long gap = rlim_stack->rlim_cur;
++ unsigned long pad = stack_guard_gap;
++
++ /* Account for stack randomization if necessary */
++ if (current->flags & PF_RANDOMIZE)
++ pad += (STACK_RND_MASK << PAGE_SHIFT);
++
++ /* Values close to RLIM_INFINITY can overflow. */
++ if (gap + pad > gap)
++ gap += pad;
+
+ if (gap < MIN_GAP)
+ gap = MIN_GAP;
+--
+2.20.1
+
--- /dev/null
+From 0087fede55a06b579f32240caeed9daa99ceb45c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Aug 2019 20:31:20 -0700
+Subject: MIPS: tlbex: Explicitly cast _PAGE_NO_EXEC to a boolean
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit c59ae0a1055127dd3828a88e111a0db59b254104 ]
+
+clang warns:
+
+arch/mips/mm/tlbex.c:634:19: error: use of logical '&&' with constant
+operand [-Werror,-Wconstant-logical-operand]
+ if (cpu_has_rixi && _PAGE_NO_EXEC) {
+ ^ ~~~~~~~~~~~~~
+arch/mips/mm/tlbex.c:634:19: note: use '&' for a bitwise operation
+ if (cpu_has_rixi && _PAGE_NO_EXEC) {
+ ^~
+ &
+arch/mips/mm/tlbex.c:634:19: note: remove constant to silence this
+warning
+ if (cpu_has_rixi && _PAGE_NO_EXEC) {
+ ~^~~~~~~~~~~~~~~~
+1 error generated.
+
+Explicitly cast this value to a boolean so that clang understands we
+intend for this to be a non-zero value.
+
+Fixes: 00bf1c691d08 ("MIPS: tlbex: Avoid placing software PTE bits in Entry* PFN fields")
+Link: https://github.com/ClangBuiltLinux/linux/issues/609
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlbex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 144ceb0fba88f..bece1264d1c5a 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -631,7 +631,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
+ return;
+ }
+
+- if (cpu_has_rixi && _PAGE_NO_EXEC) {
++ if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
+ if (fill_includes_sw_bits) {
+ UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 35741ac7db989e9f7686dbd92d7d7f64b0dc1a5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 15:33:37 -0700
+Subject: ocfs2: wait for recovering done after direct unlock request
+
+From: Changwei Ge <gechangwei@live.cn>
+
+[ Upstream commit 0a3775e4f883912944481cf2ef36eb6383a9cc74 ]
+
+There is a scenario causing ocfs2 umount hang when multiple hosts are
+rebooting at the same time.
+
+NODE1 NODE2 NODE3
+send unlock requset to NODE2
+ dies
+ become recovery master
+ recover NODE2
+find NODE2 dead
+mark resource RECOVERING
+directly remove lock from grant list
+calculate usage but RECOVERING marked
+**miss the window of purging
+clear RECOVERING
+
+To reproduce this issue, crash a host and then umount ocfs2
+from another node.
+
+To solve this, just let unlock progress wait for recovery done.
+
+Link: http://lkml.kernel.org/r/1550124866-20367-1-git-send-email-gechangwei@live.cn
+Signed-off-by: Changwei Ge <gechangwei@live.cn>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/dlm/dlmunlock.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
+index e78657742bd89..3883633e82eb9 100644
+--- a/fs/ocfs2/dlm/dlmunlock.c
++++ b/fs/ocfs2/dlm/dlmunlock.c
+@@ -90,7 +90,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
+ enum dlm_status status;
+ int actions = 0;
+ int in_use;
+- u8 owner;
++ u8 owner;
++ int recovery_wait = 0;
+
+ mlog(0, "master_node = %d, valblk = %d\n", master_node,
+ flags & LKM_VALBLK);
+@@ -193,9 +194,12 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
+ }
+ if (flags & LKM_CANCEL)
+ lock->cancel_pending = 0;
+- else
+- lock->unlock_pending = 0;
+-
++ else {
++ if (!lock->unlock_pending)
++ recovery_wait = 1;
++ else
++ lock->unlock_pending = 0;
++ }
+ }
+
+ /* get an extra ref on lock. if we are just switching
+@@ -229,6 +233,17 @@ leave:
+ spin_unlock(&res->spinlock);
+ wake_up(&res->wq);
+
++ if (recovery_wait) {
++ spin_lock(&res->spinlock);
++ /* Unlock request will directly succeed after owner dies,
++ * and the lock is already removed from grant list. We have to
++ * wait for RECOVERING done or we miss the chance to purge it
++ * since the removement is much faster than RECOVERING proc.
++ */
++ __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_RECOVERING);
++ spin_unlock(&res->spinlock);
++ }
++
+ /* let the caller's final dlm_lock_put handle the actual kfree */
+ if (actions & DLM_UNLOCK_FREE_LOCK) {
+ /* this should always be coupled with list removal */
+--
+2.20.1
+
--- /dev/null
+From ab962f6b12f2c0a00fd1ebc9957589887df94d44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2019 00:46:16 +0200
+Subject: PCI: Add pci_info_ratelimited() to ratelimit PCI separately
+
+From: Krzysztof Wilczynski <kw@linux.com>
+
+[ Upstream commit 7f1c62c443a453deb6eb3515e3c05650ffe0dcf0 ]
+
+Do not use printk_ratelimit() in drivers/pci/pci.c as it shares the rate
+limiting state with all other callers to the printk_ratelimit().
+
+Add pci_info_ratelimited() (similar to pci_notice_ratelimited() added in
+the commit a88a7b3eb076 ("vfio: Use dev_printk() when possible")) and use
+it instead of printk_ratelimit() + pci_info().
+
+Link: https://lore.kernel.org/r/20190825224616.8021-1-kw@linux.com
+Signed-off-by: Krzysztof Wilczynski <kw@linux.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 4 ++--
+ include/linux/pci.h | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 088fcdc8d2b4d..f2ab112c0a71f 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -884,8 +884,8 @@ static int pci_raw_set_power_state(struct pci_dev *dev, pci_power_t state)
+
+ pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+ dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
+- if (dev->current_state != state && printk_ratelimit())
+- pci_info(dev, "Refused to change power state, currently in D%d\n",
++ if (dev->current_state != state)
++ pci_info_ratelimited(dev, "Refused to change power state, currently in D%d\n",
+ dev->current_state);
+
+ /*
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index dd436da7eccc1..9feb59ac85507 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2375,4 +2375,7 @@ void pci_uevent_ers(struct pci_dev *pdev, enum pci_ers_result err_type);
+ #define pci_notice_ratelimited(pdev, fmt, arg...) \
+ dev_notice_ratelimited(&(pdev)->dev, fmt, ##arg)
+
++#define pci_info_ratelimited(pdev, fmt, arg...) \
++ dev_info_ratelimited(&(pdev)->dev, fmt, ##arg)
++
+ #endif /* LINUX_PCI_H */
+--
+2.20.1
+
--- /dev/null
+From 2c09a3d3c8f7c6b405ea1ae0c09cae8012d01e13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 12:53:15 +0200
+Subject: PCI: exynos: Propagate errors for optional PHYs
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit ddd6960087d4b45759434146d681a94bbb1c54ad ]
+
+devm_of_phy_get() can fail for a number of reasons besides probe
+deferral. It can for example return -ENOMEM if it runs out of memory as
+it tries to allocate devres structures. Propagating only -EPROBE_DEFER
+is problematic because it results in these legitimately fatal errors
+being treated as "PHY not specified in DT".
+
+What we really want is to ignore the optional PHYs only if they have not
+been specified in DT. devm_of_phy_get() returns -ENODEV in this case, so
+that's the special case that we need to handle. So we propagate all
+errors, except -ENODEV, so that real failures will still cause the
+driver to fail probe.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Cc: Jingoo Han <jingoohan1@gmail.com>
+Cc: Kukjin Kim <kgene@kernel.org>
+Cc: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-exynos.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pci-exynos.c b/drivers/pci/controller/dwc/pci-exynos.c
+index cee5f2f590e2d..14a6ba4067fbe 100644
+--- a/drivers/pci/controller/dwc/pci-exynos.c
++++ b/drivers/pci/controller/dwc/pci-exynos.c
+@@ -465,7 +465,7 @@ static int __init exynos_pcie_probe(struct platform_device *pdev)
+
+ ep->phy = devm_of_phy_get(dev, np, NULL);
+ if (IS_ERR(ep->phy)) {
+- if (PTR_ERR(ep->phy) == -EPROBE_DEFER)
++ if (PTR_ERR(ep->phy) != -ENODEV)
+ return PTR_ERR(ep->phy);
+
+ ep->phy = NULL;
+--
+2.20.1
+
--- /dev/null
+From c270b54c53d84037f9fa786f40464c9715981935 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 12:53:18 +0200
+Subject: PCI: histb: Propagate errors for optional regulators
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 8f9e1641ba445437095411d9fda2324121110d5d ]
+
+regulator_get_optional() can fail for a number of reasons besides probe
+deferral. It can for example return -ENOMEM if it runs out of memory as
+it tries to allocate data structures. Propagating only -EPROBE_DEFER is
+problematic because it results in these legitimately fatal errors being
+treated as "regulator not specified in DT".
+
+What we really want is to ignore the optional regulators only if they
+have not been specified in DT. regulator_get_optional() returns -ENODEV
+in this case, so that's the special case that we need to handle. So we
+propagate all errors, except -ENODEV, so that real failures will still
+cause the driver to fail probe.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Cc: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-histb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-histb.c b/drivers/pci/controller/dwc/pcie-histb.c
+index 954bc2b74bbcd..811b5c6d62eae 100644
+--- a/drivers/pci/controller/dwc/pcie-histb.c
++++ b/drivers/pci/controller/dwc/pcie-histb.c
+@@ -340,8 +340,8 @@ static int histb_pcie_probe(struct platform_device *pdev)
+
+ hipcie->vpcie = devm_regulator_get_optional(dev, "vpcie");
+ if (IS_ERR(hipcie->vpcie)) {
+- if (PTR_ERR(hipcie->vpcie) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(hipcie->vpcie) != -ENODEV)
++ return PTR_ERR(hipcie->vpcie);
+ hipcie->vpcie = NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ac7815e98f33aab5df66e7769ac8cc2f4c8fd36f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 12:53:16 +0200
+Subject: PCI: imx6: Propagate errors for optional regulators
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 2170a09fb4b0f66e06e5bcdcbc98c9ccbf353650 ]
+
+regulator_get_optional() can fail for a number of reasons besides probe
+deferral. It can for example return -ENOMEM if it runs out of memory as
+it tries to allocate data structures. Propagating only -EPROBE_DEFER is
+problematic because it results in these legitimately fatal errors being
+treated as "regulator not specified in DT".
+
+What we really want is to ignore the optional regulators only if they
+have not been specified in DT. regulator_get_optional() returns -ENODEV
+in this case, so that's the special case that we need to handle. So we
+propagate all errors, except -ENODEV, so that real failures will still
+cause the driver to fail probe.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Cc: Richard Zhu <hongxing.zhu@nxp.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: kernel@pengutronix.de
+Cc: linux-imx@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 9b5cb5b703890..aabf22eaa6b91 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1173,8 +1173,8 @@ static int imx6_pcie_probe(struct platform_device *pdev)
+
+ imx6_pcie->vpcie = devm_regulator_get_optional(&pdev->dev, "vpcie");
+ if (IS_ERR(imx6_pcie->vpcie)) {
+- if (PTR_ERR(imx6_pcie->vpcie) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(imx6_pcie->vpcie) != -ENODEV)
++ return PTR_ERR(imx6_pcie->vpcie);
+ imx6_pcie->vpcie = NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c6a514bf939f4bd10d720da8448012fa2430906f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2019 10:03:29 +0800
+Subject: PCI: layerscape: Add the bar_fixed_64bit property to the endpoint
+ driver
+
+From: Xiaowei Bao <xiaowei.bao@nxp.com>
+
+[ Upstream commit fd5d16531a39322c3d7433d9f8a36203c9aaeddc ]
+
+The layerscape PCIe controller have 4 BARs.
+
+ BAR0 and BAR1 are 32bit, BAR2 and BAR4 are 64bit and that's a
+fixed hardware configuration.
+
+Set the bar_fixed_64bit variable accordingly.
+
+Signed-off-by: Xiaowei Bao <xiaowei.bao@nxp.com>
+[lorenzo.pieralisi@arm.com: commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-layerscape-ep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-layerscape-ep.c b/drivers/pci/controller/dwc/pci-layerscape-ep.c
+index be61d96cc95ed..ca9aa4501e7e9 100644
+--- a/drivers/pci/controller/dwc/pci-layerscape-ep.c
++++ b/drivers/pci/controller/dwc/pci-layerscape-ep.c
+@@ -44,6 +44,7 @@ static const struct pci_epc_features ls_pcie_epc_features = {
+ .linkup_notifier = false,
+ .msi_capable = true,
+ .msix_capable = false,
++ .bar_fixed_64bit = (1 << BAR_2) | (1 << BAR_4),
+ };
+
+ static const struct pci_epc_features*
+--
+2.20.1
+
--- /dev/null
+From 56b88277988851c2122ecfe0f063c2aa8f22c60b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 08:53:19 -0700
+Subject: PCI: pci-hyperv: Fix build errors on non-SYSFS config
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f58ba5e3f6863ea4486952698898848a6db726c2 ]
+
+Fix build errors when building almost-allmodconfig but with SYSFS
+not set (not enabled). Fixes these build errors:
+
+ERROR: "pci_destroy_slot" [drivers/pci/controller/pci-hyperv.ko] undefined!
+ERROR: "pci_create_slot" [drivers/pci/controller/pci-hyperv.ko] undefined!
+
+drivers/pci/slot.o is only built when SYSFS is enabled, so
+pci-hyperv.o has an implicit dependency on SYSFS.
+Make that explicit.
+
+Also, depending on X86 && X86_64 is not needed, so just change that
+to depend on X86_64.
+
+Fixes: a15f2c08c708 ("PCI: hv: support reporting serial number as slot information")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Jake Oshins <jakeo@microsoft.com>
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: Stephen Hemminger <stephen@networkplumber.org>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: linux-pci@vger.kernel.org
+Cc: linux-hyperv@vger.kernel.org
+Cc: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
+index 2ab92409210af..297bf928d6522 100644
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -181,7 +181,7 @@ config PCI_LABEL
+
+ config PCI_HYPERV
+ tristate "Hyper-V PCI Frontend"
+- depends on X86 && HYPERV && PCI_MSI && PCI_MSI_IRQ_DOMAIN && X86_64
++ depends on X86_64 && HYPERV && PCI_MSI && PCI_MSI_IRQ_DOMAIN && SYSFS
+ help
+ The PCI device frontend driver allows the kernel to import arbitrary
+ PCI devices from a PCI backend to support PCI driver domains.
+--
+2.20.1
+
--- /dev/null
+From 9bf320a5fb3268ba47c4ed791e776bb4411b3515 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 12:53:14 +0200
+Subject: PCI: rockchip: Propagate errors for optional regulators
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 0e3ff0ac5f71bdb6be2a698de0ed0c7e6e738269 ]
+
+regulator_get_optional() can fail for a number of reasons besides probe
+deferral. It can for example return -ENOMEM if it runs out of memory as
+it tries to allocate data structures. Propagating only -EPROBE_DEFER is
+problematic because it results in these legitimately fatal errors being
+treated as "regulator not specified in DT".
+
+What we really want is to ignore the optional regulators only if they
+have not been specified in DT. regulator_get_optional() returns -ENODEV
+in this case, so that's the special case that we need to handle. So we
+propagate all errors, except -ENODEV, so that real failures will still
+cause the driver to fail probe.
+
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
+Cc: Shawn Lin <shawn.lin@rock-chips.com>
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: linux-rockchip@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rockchip-host.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
+index 8d20f1793a618..ef8e677ce9d11 100644
+--- a/drivers/pci/controller/pcie-rockchip-host.c
++++ b/drivers/pci/controller/pcie-rockchip-host.c
+@@ -608,29 +608,29 @@ static int rockchip_pcie_parse_host_dt(struct rockchip_pcie *rockchip)
+
+ rockchip->vpcie12v = devm_regulator_get_optional(dev, "vpcie12v");
+ if (IS_ERR(rockchip->vpcie12v)) {
+- if (PTR_ERR(rockchip->vpcie12v) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie12v) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie12v);
+ dev_info(dev, "no vpcie12v regulator found\n");
+ }
+
+ rockchip->vpcie3v3 = devm_regulator_get_optional(dev, "vpcie3v3");
+ if (IS_ERR(rockchip->vpcie3v3)) {
+- if (PTR_ERR(rockchip->vpcie3v3) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie3v3) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie3v3);
+ dev_info(dev, "no vpcie3v3 regulator found\n");
+ }
+
+ rockchip->vpcie1v8 = devm_regulator_get_optional(dev, "vpcie1v8");
+ if (IS_ERR(rockchip->vpcie1v8)) {
+- if (PTR_ERR(rockchip->vpcie1v8) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie1v8) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie1v8);
+ dev_info(dev, "no vpcie1v8 regulator found\n");
+ }
+
+ rockchip->vpcie0v9 = devm_regulator_get_optional(dev, "vpcie0v9");
+ if (IS_ERR(rockchip->vpcie0v9)) {
+- if (PTR_ERR(rockchip->vpcie0v9) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(rockchip->vpcie0v9) != -ENODEV)
++ return PTR_ERR(rockchip->vpcie0v9);
+ dev_info(dev, "no vpcie0v9 regulator found\n");
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e09f0e240a3578c05066d5937c43e7163eb81df2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2019 15:11:58 -0700
+Subject: PCI: rpaphp: Avoid a sometimes-uninitialized warning
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 0df3e42167caaf9f8c7b64de3da40a459979afe8 ]
+
+When building with -Wsometimes-uninitialized, clang warns:
+
+drivers/pci/hotplug/rpaphp_core.c:243:14: warning: variable 'fndit' is
+used uninitialized whenever 'for' loop exits because its condition is
+false [-Wsometimes-uninitialized]
+ for (j = 0; j < entries; j++) {
+ ^~~~~~~~~~~
+drivers/pci/hotplug/rpaphp_core.c:256:6: note: uninitialized use occurs
+here
+ if (fndit)
+ ^~~~~
+drivers/pci/hotplug/rpaphp_core.c:243:14: note: remove the condition if
+it is always true
+ for (j = 0; j < entries; j++) {
+ ^~~~~~~~~~~
+drivers/pci/hotplug/rpaphp_core.c:233:14: note: initialize the variable
+'fndit' to silence this warning
+ int j, fndit;
+ ^
+ = 0
+
+fndit is only used to gate a sprintf call, which can be moved into the
+loop to simplify the code and eliminate the local variable, which will
+fix this warning.
+
+Fixes: 2fcf3ae508c2 ("hotplug/drc-info: Add code to search ibm,drc-info property")
+Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Acked-by: Joel Savitz <jsavitz@redhat.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/504
+Link: https://lore.kernel.org/r/20190603221157.58502-1-natechancellor@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/rpaphp_core.c | 18 +++++++-----------
+ 1 file changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
+index bcd5d357ca238..c3899ee1db995 100644
+--- a/drivers/pci/hotplug/rpaphp_core.c
++++ b/drivers/pci/hotplug/rpaphp_core.c
+@@ -230,7 +230,7 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+ struct of_drc_info drc;
+ const __be32 *value;
+ char cell_drc_name[MAX_DRC_NAME_LEN];
+- int j, fndit;
++ int j;
+
+ info = of_find_property(dn->parent, "ibm,drc-info", NULL);
+ if (info == NULL)
+@@ -245,17 +245,13 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name,
+
+ /* Should now know end of current entry */
+
+- if (my_index > drc.last_drc_index)
+- continue;
+-
+- fndit = 1;
+- break;
++ /* Found it */
++ if (my_index <= drc.last_drc_index) {
++ sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
++ my_index);
++ break;
++ }
+ }
+- /* Found it */
+-
+- if (fndit)
+- sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
+- my_index);
+
+ if (((drc_name == NULL) ||
+ (drc_name && !strcmp(drc_name, cell_drc_name))) &&
+--
+2.20.1
+
--- /dev/null
+From 5776ad3b5eab8227f194c0192d3027c957036bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 13:54:12 +0530
+Subject: PCI: tegra: Fix OF node reference leak
+
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+
+[ Upstream commit 9e38e690ace3e7a22a81fc02652fc101efb340cf ]
+
+Each iteration of for_each_child_of_node() executes of_node_put() on the
+previous node, but in some return paths in the middle of the loop
+of_node_put() is missing thus causing a reference leak.
+
+Hence stash these mid-loop return values in a variable 'err' and add a
+new label err_node_put which executes of_node_put() on the previous node
+and returns 'err' on failure.
+
+Change mid-loop return statements to point to jump to this label to
+fix the reference leak.
+
+Issue found with Coccinelle.
+
+Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
+[lorenzo.pieralisi@arm.com: rewrote commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 464ba2538d526..03c42e8684f6d 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1994,14 +1994,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ err = of_pci_get_devfn(port);
+ if (err < 0) {
+ dev_err(dev, "failed to parse address: %d\n", err);
+- return err;
++ goto err_node_put;
+ }
+
+ index = PCI_SLOT(err);
+
+ if (index < 1 || index > soc->num_ports) {
+ dev_err(dev, "invalid port number: %d\n", index);
+- return -EINVAL;
++ err = -EINVAL;
++ goto err_node_put;
+ }
+
+ index--;
+@@ -2010,12 +2011,13 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ if (err < 0) {
+ dev_err(dev, "failed to parse # of lanes: %d\n",
+ err);
+- return err;
++ goto err_node_put;
+ }
+
+ if (value > 16) {
+ dev_err(dev, "invalid # of lanes: %u\n", value);
+- return -EINVAL;
++ err = -EINVAL;
++ goto err_node_put;
+ }
+
+ lanes |= value << (index << 3);
+@@ -2029,13 +2031,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ lane += value;
+
+ rp = devm_kzalloc(dev, sizeof(*rp), GFP_KERNEL);
+- if (!rp)
+- return -ENOMEM;
++ if (!rp) {
++ err = -ENOMEM;
++ goto err_node_put;
++ }
+
+ err = of_address_to_resource(port, 0, &rp->regs);
+ if (err < 0) {
+ dev_err(dev, "failed to parse address: %d\n", err);
+- return err;
++ goto err_node_put;
+ }
+
+ INIT_LIST_HEAD(&rp->list);
+@@ -2062,6 +2066,10 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ return err;
+
+ return 0;
++
++err_node_put:
++ of_node_put(port);
++ return err;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 4e3bbd5ba8dfccb165f259c98afaf5ac8644bd46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2019 17:14:36 +0200
+Subject: PCI: Use static const struct, not const static struct
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczynski <kw@linux.com>
+
+[ Upstream commit 8050f3f6645ae0f7e4c1304593f6f7eb2ee7d85c ]
+
+Move the static keyword to the front of declarations of pci_regs_behavior[]
+and pcie_cap_regs_behavior[], which resolves compiler warnings when
+building with "W=1":
+
+ drivers/pci/pci-bridge-emul.c:41:1: warning: ‘static’ is not at beginning of
+ declaration [-Wold-style-declaration]
+ const static struct pci_bridge_reg_behavior pci_regs_behavior[] = {
+ ^
+ drivers/pci/pci-bridge-emul.c:176:1: warning: ‘static’ is not at beginning of
+ declaration [-Wold-style-declaration]
+ const static struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = {
+ ^
+
+Link: https://lore.kernel.org/r/20190826151436.4672-1-kw@linux.com
+Link: https://lore.kernel.org/r/20190828131733.5817-1-kw@linux.com
+Signed-off-by: Krzysztof Wilczynski <kw@linux.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-bridge-emul.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c
+index 83fb077d0b41f..702966e4fcaa4 100644
+--- a/drivers/pci/pci-bridge-emul.c
++++ b/drivers/pci/pci-bridge-emul.c
+@@ -38,7 +38,7 @@ struct pci_bridge_reg_behavior {
+ u32 rsvd;
+ };
+
+-const static struct pci_bridge_reg_behavior pci_regs_behavior[] = {
++static const struct pci_bridge_reg_behavior pci_regs_behavior[] = {
+ [PCI_VENDOR_ID / 4] = { .ro = ~0 },
+ [PCI_COMMAND / 4] = {
+ .rw = (PCI_COMMAND_IO | PCI_COMMAND_MEMORY |
+@@ -173,7 +173,7 @@ const static struct pci_bridge_reg_behavior pci_regs_behavior[] = {
+ },
+ };
+
+-const static struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = {
++static const struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = {
+ [PCI_CAP_LIST_ID / 4] = {
+ /*
+ * Capability ID, Next Capability Pointer and
+--
+2.20.1
+
--- /dev/null
+From 3197ea664d0a6c3d5d523d260739fd23dcfc9c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2019 17:05:40 +0800
+Subject: pinctrl: amd: disable spurious-firing GPIO IRQs
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit d21b8adbd475dba19ac2086d3306327b4a297418 ]
+
+When cold-booting Asus X434DA, GPIO 7 is found to be already configured
+as an interrupt, and the GPIO level is found to be in a state that
+causes the interrupt to fire.
+
+As soon as pinctrl-amd probes, this interrupt fires and invokes
+amd_gpio_irq_handler(). The IRQ is acked, but no GPIO-IRQ handler was
+invoked, so the GPIO level being unchanged just causes another interrupt
+to fire again immediately after.
+
+This results in an interrupt storm causing this platform to hang
+during boot, right after pinctrl-amd is probed.
+
+Detect this situation and disable the GPIO interrupt when this happens.
+This enables the affected platform to boot as normal. GPIO 7 actually is
+the I2C touchpad interrupt line, and later on, i2c-multitouch loads and
+re-enables this interrupt when it is ready to handle it.
+
+Instead of this approach, I considered disabling all GPIO interrupts at
+probe time, however that seems a little risky, and I also confirmed that
+Windows does not seem to have this behaviour: the same 41 GPIO IRQs are
+enabled under both Linux and Windows, which is a far larger collection
+than the GPIOs referenced by the DSDT on this platform.
+
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Link: https://lore.kernel.org/r/20190814090540.7152-1-drake@endlessm.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-amd.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
+index 9b9c61e3f0652..977792654e017 100644
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -565,15 +565,25 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id)
+ !(regval & BIT(INTERRUPT_MASK_OFF)))
+ continue;
+ irq = irq_find_mapping(gc->irq.domain, irqnr + i);
+- generic_handle_irq(irq);
++ if (irq != 0)
++ generic_handle_irq(irq);
+
+ /* Clear interrupt.
+ * We must read the pin register again, in case the
+ * value was changed while executing
+ * generic_handle_irq() above.
++ * If we didn't find a mapping for the interrupt,
++ * disable it in order to avoid a system hang caused
++ * by an interrupt storm.
+ */
+ raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+ regval = readl(regs + i);
++ if (irq == 0) {
++ regval &= ~BIT(INTERRUPT_ENABLE_OFF);
++ dev_dbg(&gpio_dev->pdev->dev,
++ "Disabling spurious GPIO IRQ %d\n",
++ irqnr + i);
++ }
+ writel(regval, regs + i);
+ raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+ ret = IRQ_HANDLED;
+--
+2.20.1
+
--- /dev/null
+From 82618332acecf110de05ae86872c73302ea14de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 18:01:41 +0200
+Subject: pinctrl: meson-gxbb: Fix wrong pinning definition for uart_c
+
+From: Otto Meier <gf435@gmx.net>
+
+[ Upstream commit cb0438e4436085d89706b5ccfce4d5da531253de ]
+
+Hi i tried to use the uart_C of the the odroid-c2.
+
+I enabled it in the dts file. During boot it crashed when the
+the sdcard slot is addressed.
+
+After long search in the net i found this:
+
+https://forum.odroid.com/viewtopic.php?f=139&t=25371&p=194370&hilit=uart_C#p177856
+
+After changing the pin definitions accordingly erverything works.
+Uart_c is functioning and sdcard ist working.
+
+Fixes: 6db0f3a8a04e46 ("pinctrl: amlogic: gxbb: add more UART pins")
+Signed-off-by: Otto Meier <gf435@gmx.net>
+Link: https://lore.kernel.org/r/1cc32a18-464d-5531-7a1c-084390e2ecb1@gmx.net
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxbb.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+index 6c640837073ef..5bfa56f3847ef 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+@@ -192,8 +192,8 @@ static const unsigned int uart_rts_b_pins[] = { GPIODV_27 };
+
+ static const unsigned int uart_tx_c_pins[] = { GPIOY_13 };
+ static const unsigned int uart_rx_c_pins[] = { GPIOY_14 };
+-static const unsigned int uart_cts_c_pins[] = { GPIOX_11 };
+-static const unsigned int uart_rts_c_pins[] = { GPIOX_12 };
++static const unsigned int uart_cts_c_pins[] = { GPIOY_11 };
++static const unsigned int uart_rts_c_pins[] = { GPIOY_12 };
+
+ static const unsigned int i2c_sck_a_pins[] = { GPIODV_25 };
+ static const unsigned int i2c_sda_a_pins[] = { GPIODV_24 };
+@@ -439,10 +439,10 @@ static struct meson_pmx_group meson_gxbb_periphs_groups[] = {
+ GROUP(pwm_f_x, 3, 18),
+
+ /* Bank Y */
+- GROUP(uart_cts_c, 1, 19),
+- GROUP(uart_rts_c, 1, 18),
+- GROUP(uart_tx_c, 1, 17),
+- GROUP(uart_rx_c, 1, 16),
++ GROUP(uart_cts_c, 1, 17),
++ GROUP(uart_rts_c, 1, 16),
++ GROUP(uart_tx_c, 1, 19),
++ GROUP(uart_rx_c, 1, 18),
+ GROUP(pwm_a_y, 1, 21),
+ GROUP(pwm_f_y, 1, 20),
+ GROUP(i2s_out_ch23_y, 1, 5),
+--
+2.20.1
+
--- /dev/null
+From e53fe57da75dfc9f175897bfb7c5af08dcb16eef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jul 2019 13:16:56 +0200
+Subject: pinctrl: stmfx: update pinconf settings
+
+From: Alexandre Torgue <alexandre.torgue@st.com>
+
+[ Upstream commit a502b343ebd0eab38f3cb33fbb84011847cf5aac ]
+
+According to the following tab (coming from STMFX datasheet), updates
+have to done in stmfx_pinconf_set function:
+
+-"type" has to be set when "bias" is configured as "pull-up or pull-down"
+-PIN_CONFIG_DRIVE_PUSH_PULL should only be used when gpio is configured as
+ output. There is so no need to check direction.
+
+DIR | TYPE | PUPD | MFX GPIO configuration
+----|------|------|---------------------------------------------------
+1 | 1 | 1 | OUTPUT open drain with internal pull-up resistor
+----|------|------|---------------------------------------------------
+1 | 1 | 0 | OUTPUT open drain with internal pull-down resistor
+----|------|------|---------------------------------------------------
+1 | 0 | 0/1 | OUTPUT push pull no pull
+----|------|------|---------------------------------------------------
+0 | 1 | 1 | INPUT with internal pull-up resistor
+----|------|------|---------------------------------------------------
+0 | 1 | 0 | INPUT with internal pull-down resistor
+----|------|------|---------------------------------------------------
+0 | 0 | 1 | INPUT floating
+----|------|------|---------------------------------------------------
+0 | 0 | 0 | analog (GPIO not used, default setting)
+
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
+Link: https://lore.kernel.org/r/1564053416-32192-1-git-send-email-amelie.delaunay@st.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-stmfx.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-stmfx.c b/drivers/pinctrl/pinctrl-stmfx.c
+index eba872ce4a7cb..c82ad4b629e3e 100644
+--- a/drivers/pinctrl/pinctrl-stmfx.c
++++ b/drivers/pinctrl/pinctrl-stmfx.c
+@@ -296,29 +296,29 @@ static int stmfx_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ switch (param) {
+ case PIN_CONFIG_BIAS_PULL_PIN_DEFAULT:
+ case PIN_CONFIG_BIAS_DISABLE:
++ case PIN_CONFIG_DRIVE_PUSH_PULL:
++ ret = stmfx_pinconf_set_type(pctl, pin, 0);
++ if (ret)
++ return ret;
++ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
++ ret = stmfx_pinconf_set_type(pctl, pin, 1);
++ if (ret)
++ return ret;
+ ret = stmfx_pinconf_set_pupd(pctl, pin, 0);
+ if (ret)
+ return ret;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+- ret = stmfx_pinconf_set_pupd(pctl, pin, 1);
++ ret = stmfx_pinconf_set_type(pctl, pin, 1);
+ if (ret)
+ return ret;
+- break;
+- case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- if (!dir)
+- ret = stmfx_pinconf_set_type(pctl, pin, 1);
+- else
+- ret = stmfx_pinconf_set_type(pctl, pin, 0);
++ ret = stmfx_pinconf_set_pupd(pctl, pin, 1);
+ if (ret)
+ return ret;
+ break;
+- case PIN_CONFIG_DRIVE_PUSH_PULL:
+- if (!dir)
+- ret = stmfx_pinconf_set_type(pctl, pin, 0);
+- else
+- ret = stmfx_pinconf_set_type(pctl, pin, 1);
++ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
++ ret = stmfx_pinconf_set_type(pctl, pin, 1);
+ if (ret)
+ return ret;
+ break;
+--
+2.20.1
+
--- /dev/null
+From 7c8d2ae0544d87efb2389982a5c42be34272cca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 12:41:46 -0700
+Subject: pinctrl: tegra: Fix write barrier placement in pmx_writel
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit c2cf351eba2ff6002ce8eb178452219d2521e38e ]
+
+pmx_writel uses writel which inserts write barrier before the
+register write.
+
+This patch has fix to replace writel with writel_relaxed followed
+by a readback and memory barrier to ensure write operation is
+completed for successful pinctrl change.
+
+Acked-by: Thierry Reding <treding@nvidia.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Link: https://lore.kernel.org/r/1565984527-5272-2-git-send-email-skomatineni@nvidia.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/tegra/pinctrl-tegra.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/tegra/pinctrl-tegra.c b/drivers/pinctrl/tegra/pinctrl-tegra.c
+index abcfbad94f00e..849c3b34e887c 100644
+--- a/drivers/pinctrl/tegra/pinctrl-tegra.c
++++ b/drivers/pinctrl/tegra/pinctrl-tegra.c
+@@ -32,7 +32,9 @@ static inline u32 pmx_readl(struct tegra_pmx *pmx, u32 bank, u32 reg)
+
+ static inline void pmx_writel(struct tegra_pmx *pmx, u32 val, u32 bank, u32 reg)
+ {
+- writel(val, pmx->regs[bank] + reg);
++ writel_relaxed(val, pmx->regs[bank] + reg);
++ /* make sure pinmux register write completed */
++ pmx_readl(pmx, bank, reg);
+ }
+
+ static int tegra_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
+--
+2.20.1
+
--- /dev/null
+From 673bdeef35a5b84034454680cd65c4f915eda7d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Sep 2019 10:01:05 -0600
+Subject: pktcdvd: remove warning on attempting to register non-passthrough dev
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit eb09b3cc464d2c3bbde9a6648603c8d599ea8582 ]
+
+Anatoly reports that he gets the below warning when booting -git on
+a sparc64 box on debian unstable:
+
+...
+[ 13.352975] aes_sparc64: Using sparc64 aes opcodes optimized AES
+implementation
+[ 13.428002] ------------[ cut here ]------------
+[ 13.428081] WARNING: CPU: 21 PID: 586 at
+drivers/block/pktcdvd.c:2597 pkt_setup_dev+0x2e4/0x5a0 [pktcdvd]
+[ 13.428147] Attempt to register a non-SCSI queue
+[ 13.428184] Modules linked in: pktcdvd libdes cdrom aes_sparc64
+n2_rng md5_sparc64 sha512_sparc64 rng_core sha256_sparc64 flash
+sha1_sparc64 ip_tables x_tables ipv6 crc_ccitt nf_defrag_ipv6 autofs4
+ext4 crc16 mbcache jbd2 raid10 raid456 async_raid6_recov async_memcpy
+async_pq async_xor xor async_tx raid6_pq raid1 raid0 multipath linear
+md_mod crc32c_sparc64
+[ 13.428452] CPU: 21 PID: 586 Comm: pktsetup Not tainted
+5.3.0-10169-g574cc4539762 #1234
+[ 13.428507] Call Trace:
+[ 13.428542] [00000000004635c0] __warn+0xc0/0x100
+[ 13.428582] [0000000000463634] warn_slowpath_fmt+0x34/0x60
+[ 13.428626] [000000001045b244] pkt_setup_dev+0x2e4/0x5a0 [pktcdvd]
+[ 13.428674] [000000001045ccf4] pkt_ctl_ioctl+0x94/0x220 [pktcdvd]
+[ 13.428724] [00000000006b95c8] do_vfs_ioctl+0x628/0x6e0
+[ 13.428764] [00000000006b96c8] ksys_ioctl+0x48/0x80
+[ 13.428803] [00000000006b9714] sys_ioctl+0x14/0x40
+[ 13.428847] [0000000000406294] linux_sparc_syscall+0x34/0x44
+[ 13.428890] irq event stamp: 4181
+[ 13.428924] hardirqs last enabled at (4189): [<00000000004e0a74>]
+console_unlock+0x634/0x6c0
+[ 13.428984] hardirqs last disabled at (4196): [<00000000004e0540>]
+console_unlock+0x100/0x6c0
+[ 13.429048] softirqs last enabled at (3978): [<0000000000b2e2d8>]
+__do_softirq+0x498/0x520
+[ 13.429110] softirqs last disabled at (3967): [<000000000042cfb4>]
+do_softirq_own_stack+0x34/0x60
+[ 13.429172] ---[ end trace 2220ca468f32967d ]---
+[ 13.430018] pktcdvd: setup of pktcdvd device failed
+[ 13.455589] des_sparc64: Using sparc64 des opcodes optimized DES
+implementation
+[ 13.515334] camellia_sparc64: Using sparc64 camellia opcodes
+optimized CAMELLIA implementation
+[ 13.522856] pktcdvd: setup of pktcdvd device failed
+[ 13.529327] pktcdvd: setup of pktcdvd device failed
+[ 13.532932] pktcdvd: setup of pktcdvd device failed
+[ 13.536165] pktcdvd: setup of pktcdvd device failed
+[ 13.539372] pktcdvd: setup of pktcdvd device failed
+[ 13.542834] pktcdvd: setup of pktcdvd device failed
+[ 13.546536] pktcdvd: setup of pktcdvd device failed
+[ 15.431071] XFS (dm-0): Mounting V5 Filesystem
+...
+
+Apparently debian auto-attaches any cdrom like device to pktcdvd, which
+can lead to the above warning. There's really no reason to warn for this
+situation, kill it.
+
+Reported-by: Anatoly Pugachev <matorola@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/pktcdvd.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
+index 024060165afa7..76457003f1406 100644
+--- a/drivers/block/pktcdvd.c
++++ b/drivers/block/pktcdvd.c
+@@ -2594,7 +2594,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
+ if (ret)
+ return ret;
+ if (!blk_queue_scsi_passthrough(bdev_get_queue(bdev))) {
+- WARN_ONCE(true, "Attempt to register a non-SCSI queue\n");
+ blkdev_put(bdev, FMODE_READ | FMODE_NDELAY);
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 48ed38183c6b302b7908a3fa54560ec140a8876a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 20:56:32 +1000
+Subject: powerpc/64s/exception: machine check use correct cfar for late
+ handler
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 0b66370c61fcf5fcc1d6901013e110284da6e2bb ]
+
+Bare metal machine checks run an "early" handler in real mode before
+running the main handler which reports the event.
+
+The main handler runs exactly as a normal interrupt handler, after the
+"windup" which sets registers back as they were at interrupt entry.
+CFAR does not get restored by the windup code, so that will be wrong
+when the handler is run.
+
+Restore the CFAR to the saved value before running the late handler.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190802105709.27696-8-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/exceptions-64s.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 6c51aa845bcee..3e564536a237f 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -556,6 +556,10 @@ FTR_SECTION_ELSE
+ ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE)
+ 9:
+ /* Deliver the machine check to host kernel in V mode. */
++BEGIN_FTR_SECTION
++ ld r10,ORIG_GPR3(r1)
++ mtspr SPRN_CFAR,r10
++END_FTR_SECTION_IFSET(CPU_FTR_CFAR)
+ MACHINE_CHECK_HANDLER_WINDUP
+ SET_SCRATCH0(r13) /* save r13 */
+ EXCEPTION_PROLOG_0(PACA_EXMC)
+--
+2.20.1
+
--- /dev/null
+From 9d706d1c646c4d2d2149f91342d0dd5a8332e9b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 18:46:34 +1000
+Subject: powerpc/64s/radix: Fix memory hotplug section page table creation
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 8f51e3929470942e6a8744061254fdeef646cd36 ]
+
+create_physical_mapping expects physical addresses, but creating and
+splitting these mappings after boot is supplying virtual (effective)
+addresses. This can be irritated by booting with mem= to limit memory
+then probing an unused physical memory range:
+
+ echo <addr> > /sys/devices/system/memory/probe
+
+This mostly works by accident, firstly because __va(__va(x)) == __va(x)
+so the virtual address does not get corrupted. Secondly because pfn_pte
+masks out the upper bits of the pfn beyond the physical address limit,
+so a pfn constructed with a 0xc000000000000000 virtual linear address
+will be masked back to the correct physical address in the pte.
+
+Fixes: 6cc27341b21a8 ("powerpc/mm: add radix__create_section_mapping()")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190724084638.24982-1-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/radix_pgtable.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c
+index 8deb432c29754..2b6cc823046a3 100644
+--- a/arch/powerpc/mm/book3s64/radix_pgtable.c
++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c
+@@ -901,7 +901,7 @@ int __meminit radix__create_section_mapping(unsigned long start, unsigned long e
+ return -1;
+ }
+
+- return create_physical_mapping(start, end, nid);
++ return create_physical_mapping(__pa(start), __pa(end), nid);
+ }
+
+ int __meminit radix__remove_section_mapping(unsigned long start, unsigned long end)
+--
+2.20.1
+
--- /dev/null
+From 015c0acc8c9b906759814158bbe26dfd061b10a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 13:29:49 +0530
+Subject: powerpc: dump kernel log before carrying out fadump or kdump
+
+From: Ganesh Goudar <ganeshgr@linux.ibm.com>
+
+[ Upstream commit e7ca44ed3ba77fc26cf32650bb71584896662474 ]
+
+Since commit 4388c9b3a6ee ("powerpc: Do not send system reset request
+through the oops path"), pstore dmesg file is not updated when dump is
+triggered from HMC. This commit modified system reset (sreset) handler
+to invoke fadump or kdump (if configured), without pushing dmesg to
+pstore. This leaves pstore to have old dmesg data which won't be much
+of a help if kdump fails to capture the dump. This patch fixes that by
+calling kmsg_dump() before heading to fadump ot kdump.
+
+Fixes: 4388c9b3a6ee ("powerpc: Do not send system reset request through the oops path")
+Reviewed-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190904075949.15607-1-ganeshgr@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/traps.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 47df30982de1b..c8ea3a253b815 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -472,6 +472,7 @@ void system_reset_exception(struct pt_regs *regs)
+ if (debugger(regs))
+ goto out;
+
++ kmsg_dump(KMSG_DUMP_OOPS);
+ /*
+ * A system reset is a request to dump, so we always send
+ * it through the crashdump code (if fadump or kdump are
+--
+2.20.1
+
--- /dev/null
+From 44050b57c2c451e7eaad5c9b61f29ca8226337b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 20:15:52 +1000
+Subject: powerpc/eeh: Clean up EEH PEs after recovery finishes
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 799abe283e5103d48e079149579b4f167c95ea0e ]
+
+When the last device in an eeh_pe is removed the eeh_pe structure itself
+(and any empty parents) are freed since they are no longer needed. This
+results in a crash when a hotplug driver is involved since the following
+may occur:
+
+1. Device is suprise removed.
+2. Driver performs an MMIO, which fails and queues and eeh_event.
+3. Hotplug driver receives a hotplug interrupt and removes any
+ pci_devs that were under the slot.
+4. pci_dev is torn down and the eeh_pe is freed.
+5. The EEH event handler thread processes the eeh_event and crashes
+ since the eeh_pe pointer in the eeh_event structure is no
+ longer valid.
+
+Crashing is generally considered poor form. Instead of doing that use
+the fact PEs are marked as EEH_PE_INVALID to keep them around until the
+end of the recovery cycle, at which point we can safely prune any empty
+PEs.
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190903101605.2890-2-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 36 ++++++++++++++++++++++++++++++--
+ arch/powerpc/kernel/eeh_event.c | 8 +++++++
+ arch/powerpc/kernel/eeh_pe.c | 23 +++++++++++++++++++-
+ 3 files changed, 64 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 1fbe541856f5e..fe0c32fb9f96f 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -744,6 +744,33 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus,
+ */
+ #define MAX_WAIT_FOR_RECOVERY 300
+
++
++/* Walks the PE tree after processing an event to remove any stale PEs.
++ *
++ * NB: This needs to be recursive to ensure the leaf PEs get removed
++ * before their parents do. Although this is possible to do recursively
++ * we don't since this is easier to read and we need to garantee
++ * the leaf nodes will be handled first.
++ */
++static void eeh_pe_cleanup(struct eeh_pe *pe)
++{
++ struct eeh_pe *child_pe, *tmp;
++
++ list_for_each_entry_safe(child_pe, tmp, &pe->child_list, child)
++ eeh_pe_cleanup(child_pe);
++
++ if (pe->state & EEH_PE_KEEP)
++ return;
++
++ if (!(pe->state & EEH_PE_INVALID))
++ return;
++
++ if (list_empty(&pe->edevs) && list_empty(&pe->child_list)) {
++ list_del(&pe->child);
++ kfree(pe);
++ }
++}
++
+ /**
+ * eeh_handle_normal_event - Handle EEH events on a specific PE
+ * @pe: EEH PE - which should not be used after we return, as it may
+@@ -782,8 +809,6 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
+ return;
+ }
+
+- eeh_pe_state_mark(pe, EEH_PE_RECOVERING);
+-
+ eeh_pe_update_time_stamp(pe);
+ pe->freeze_count++;
+ if (pe->freeze_count > eeh_max_freezes) {
+@@ -973,6 +998,12 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
+ return;
+ }
+ }
++
++ /*
++ * Clean up any PEs without devices. While marked as EEH_PE_RECOVERYING
++ * we don't want to modify the PE tree structure so we do it here.
++ */
++ eeh_pe_cleanup(pe);
+ eeh_pe_state_clear(pe, EEH_PE_RECOVERING, true);
+ }
+
+@@ -1045,6 +1076,7 @@ void eeh_handle_special_event(void)
+ */
+ if (rc == EEH_NEXT_ERR_FROZEN_PE ||
+ rc == EEH_NEXT_ERR_FENCED_PHB) {
++ eeh_pe_state_mark(pe, EEH_PE_RECOVERING);
+ eeh_handle_normal_event(pe);
+ } else {
+ pci_lock_rescan_remove();
+diff --git a/arch/powerpc/kernel/eeh_event.c b/arch/powerpc/kernel/eeh_event.c
+index 64cfbe41174b2..e36653e5f76b3 100644
+--- a/arch/powerpc/kernel/eeh_event.c
++++ b/arch/powerpc/kernel/eeh_event.c
+@@ -121,6 +121,14 @@ int __eeh_send_failure_event(struct eeh_pe *pe)
+ }
+ event->pe = pe;
+
++ /*
++ * Mark the PE as recovering before inserting it in the queue.
++ * This prevents the PE from being free()ed by a hotplug driver
++ * while the PE is sitting in the event queue.
++ */
++ if (pe)
++ eeh_pe_state_mark(pe, EEH_PE_RECOVERING);
++
+ /* We may or may not be called in an interrupt context */
+ spin_lock_irqsave(&eeh_eventlist_lock, flags);
+ list_add(&event->list, &eeh_eventlist);
+diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
+index 854cef7b18f4d..f0813d50e0b1c 100644
+--- a/arch/powerpc/kernel/eeh_pe.c
++++ b/arch/powerpc/kernel/eeh_pe.c
+@@ -491,6 +491,7 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
+ int eeh_rmv_from_parent_pe(struct eeh_dev *edev)
+ {
+ struct eeh_pe *pe, *parent, *child;
++ bool keep, recover;
+ int cnt;
+ struct pci_dn *pdn = eeh_dev_to_pdn(edev);
+
+@@ -516,10 +517,21 @@ int eeh_rmv_from_parent_pe(struct eeh_dev *edev)
+ */
+ while (1) {
+ parent = pe->parent;
++
++ /* PHB PEs should never be removed */
+ if (pe->type & EEH_PE_PHB)
+ break;
+
+- if (!(pe->state & EEH_PE_KEEP)) {
++ /*
++ * XXX: KEEP is set while resetting a PE. I don't think it's
++ * ever set without RECOVERING also being set. I could
++ * be wrong though so catch that with a WARN.
++ */
++ keep = !!(pe->state & EEH_PE_KEEP);
++ recover = !!(pe->state & EEH_PE_RECOVERING);
++ WARN_ON(keep && !recover);
++
++ if (!keep && !recover) {
+ if (list_empty(&pe->edevs) &&
+ list_empty(&pe->child_list)) {
+ list_del(&pe->child);
+@@ -528,6 +540,15 @@ int eeh_rmv_from_parent_pe(struct eeh_dev *edev)
+ break;
+ }
+ } else {
++ /*
++ * Mark the PE as invalid. At the end of the recovery
++ * process any invalid PEs will be garbage collected.
++ *
++ * We need to delay the free()ing of them since we can
++ * remove edev's while traversing the PE tree which
++ * might trigger the removal of a PE and we can't
++ * deal with that (yet).
++ */
+ if (list_empty(&pe->edevs)) {
+ cnt = 0;
+ list_for_each_entry(child, &pe->child_list, child) {
+--
+2.20.1
+
--- /dev/null
+From 7a63b817f22bf07bcd67a531b1a5f0a90bfbd38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 14:48:06 +1000
+Subject: powerpc/eeh: Clear stale EEH_DEV_NO_HANDLER flag
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit aa06e3d60e245284d1e55497eb3108828092818d ]
+
+The EEH_DEV_NO_HANDLER flag is used by the EEH system to prevent the
+use of driver callbacks in drivers that have been bound part way
+through the recovery process. This is necessary to prevent later stage
+handlers from being called when the earlier stage handlers haven't,
+which can be confusing for drivers.
+
+However, the flag is set for all devices that are added after boot
+time and only cleared at the end of the EEH recovery process. This
+results in hot plugged devices erroneously having the flag set during
+the first recovery after they are added (causing their driver's
+handlers to be incorrectly ignored).
+
+To remedy this, clear the flag at the beginning of recovery
+processing. The flag is still cleared at the end of recovery
+processing, although it is no longer really necessary.
+
+Also clear the flag during eeh_handle_special_event(), for the same
+reasons.
+
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/b8ca5629d27de74c957d4f4b250177d1b6fc4bbd.1565930772.git.sbobroff@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 89623962c7275..1fbe541856f5e 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -793,6 +793,10 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
+ result = PCI_ERS_RESULT_DISCONNECT;
+ }
+
++ eeh_for_each_pe(pe, tmp_pe)
++ eeh_pe_for_each_dev(tmp_pe, edev, tmp)
++ edev->mode &= ~EEH_DEV_NO_HANDLER;
++
+ /* Walk the various device drivers attached to this slot through
+ * a reset sequence, giving each an opportunity to do what it needs
+ * to accomplish the reset. Each child gets a report of the
+@@ -981,7 +985,8 @@ void eeh_handle_normal_event(struct eeh_pe *pe)
+ */
+ void eeh_handle_special_event(void)
+ {
+- struct eeh_pe *pe, *phb_pe;
++ struct eeh_pe *pe, *phb_pe, *tmp_pe;
++ struct eeh_dev *edev, *tmp_edev;
+ struct pci_bus *bus;
+ struct pci_controller *hose;
+ unsigned long flags;
+@@ -1050,6 +1055,10 @@ void eeh_handle_special_event(void)
+ (phb_pe->state & EEH_PE_RECOVERING))
+ continue;
+
++ eeh_for_each_pe(pe, tmp_pe)
++ eeh_pe_for_each_dev(tmp_pe, edev, tmp_edev)
++ edev->mode &= ~EEH_DEV_NO_HANDLER;
++
+ /* Notify all devices to be down */
+ eeh_pe_state_clear(pe, EEH_PE_PRI_BUS, true);
+ eeh_set_channel_state(pe, pci_channel_io_perm_failure);
+--
+2.20.1
+
--- /dev/null
+From ca2aec6a3fdf1a3b8b023f4d01e889430d3228dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2019 09:25:52 +0000
+Subject: powerpc/futex: Fix warning: 'oldval' may be used uninitialized in
+ this function
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 38a0d0cdb46d3f91534e5b9839ec2d67be14c59d ]
+
+We see warnings such as:
+ kernel/futex.c: In function 'do_futex':
+ kernel/futex.c:1676:17: warning: 'oldval' may be used uninitialized in this function [-Wmaybe-uninitialized]
+ return oldval == cmparg;
+ ^
+ kernel/futex.c:1651:6: note: 'oldval' was declared here
+ int oldval, ret;
+ ^
+
+This is because arch_futex_atomic_op_inuser() only sets *oval if ret
+is 0 and GCC doesn't see that it will only use it when ret is 0.
+
+Anyway, the non-zero ret path is an error path that won't suffer from
+setting *oval, and as *oval is a local var in futex_atomic_op_inuser()
+it will have no impact.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: reword change log slightly]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/86b72f0c134367b214910b27b9a6dd3321af93bb.1565774657.git.christophe.leroy@c-s.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/futex.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
+index 3a6aa57b9d901..eea28ca679dbb 100644
+--- a/arch/powerpc/include/asm/futex.h
++++ b/arch/powerpc/include/asm/futex.h
+@@ -60,8 +60,7 @@ static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
+
+ pagefault_enable();
+
+- if (!ret)
+- *oval = oldval;
++ *oval = oldval;
+
+ prevent_write_to_user(uaddr, sizeof(*uaddr));
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 2ec2c76a68db3839a2eeeeddb75084c8c50a0df9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jul 2019 18:46:36 +1000
+Subject: powerpc/perf: fix imc allocation failure handling
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 10c4bd7cd28e77aeb8cfa65b23cb3c632ede2a49 ]
+
+The alloc_pages_node return value should be tested for failure
+before being passed to page_address.
+
+Tested-by: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190724084638.24982-3-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index 3bdfc1e320964..2231959c56331 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -570,6 +570,7 @@ static int core_imc_mem_init(int cpu, int size)
+ {
+ int nid, rc = 0, core_id = (cpu / threads_per_core);
+ struct imc_mem_info *mem_info;
++ struct page *page;
+
+ /*
+ * alloc_pages_node() will allocate memory for core in the
+@@ -580,11 +581,12 @@ static int core_imc_mem_init(int cpu, int size)
+ mem_info->id = core_id;
+
+ /* We need only vbase for core counters */
+- mem_info->vbase = page_address(alloc_pages_node(nid,
+- GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+- __GFP_NOWARN, get_order(size)));
+- if (!mem_info->vbase)
++ page = alloc_pages_node(nid,
++ GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
++ __GFP_NOWARN, get_order(size));
++ if (!page)
+ return -ENOMEM;
++ mem_info->vbase = page_address(page);
+
+ /* Init the mutex */
+ core_imc_refc[core_id].id = core_id;
+@@ -839,15 +841,17 @@ static int thread_imc_mem_alloc(int cpu_id, int size)
+ int nid = cpu_to_node(cpu_id);
+
+ if (!local_mem) {
++ struct page *page;
+ /*
+ * This case could happen only once at start, since we dont
+ * free the memory in cpu offline path.
+ */
+- local_mem = page_address(alloc_pages_node(nid,
++ page = alloc_pages_node(nid,
+ GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+- __GFP_NOWARN, get_order(size)));
+- if (!local_mem)
++ __GFP_NOWARN, get_order(size));
++ if (!page)
+ return -ENOMEM;
++ local_mem = page_address(page);
+
+ per_cpu(thread_imc_mem, cpu_id) = local_mem;
+ }
+@@ -1085,11 +1089,14 @@ static int trace_imc_mem_alloc(int cpu_id, int size)
+ int core_id = (cpu_id / threads_per_core);
+
+ if (!local_mem) {
+- local_mem = page_address(alloc_pages_node(phys_id,
+- GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+- __GFP_NOWARN, get_order(size)));
+- if (!local_mem)
++ struct page *page;
++
++ page = alloc_pages_node(phys_id,
++ GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
++ __GFP_NOWARN, get_order(size));
++ if (!page)
+ return -ENOMEM;
++ local_mem = page_address(page);
+ per_cpu(trace_imc_mem, cpu_id) = local_mem;
+
+ /* Initialise the counters for trace mode */
+--
+2.20.1
+
--- /dev/null
+From 1768939bbaa1e7ce0ff24b32524c06e12bc375f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jul 2019 15:11:38 +1000
+Subject: powerpc/powernv/ioda2: Allocate TCE table levels on demand for
+ default DMA window
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit c37c792dec0929dbb6360a609fb00fa20bb16fc2 ]
+
+We allocate only the first level of multilevel TCE tables for KVM
+already (alloc_userspace_copy==true), and the rest is allocated on demand.
+This is not enabled though for bare metal.
+
+This removes the KVM limitation (implicit, via the alloc_userspace_copy
+parameter) and always allocates just the first level. The on-demand
+allocation of missing levels is already implemented.
+
+As from now on DMA map might happen with disabled interrupts, this
+allocates TCEs with GFP_ATOMIC; otherwise lockdep reports errors 1].
+In practice just a single page is allocated there so chances for failure
+are quite low.
+
+To save time when creating a new clean table, this skips non-allocated
+indirect TCE entries in pnv_tce_free just like we already do in
+the VFIO IOMMU TCE driver.
+
+This changes the default level number from 1 to 2 to reduce the amount
+of memory required for the default 32bit DMA window at the boot time.
+The default window size is up to 2GB which requires 4MB of TCEs which is
+unlikely to be used entirely or at all as most devices these days are
+64bit capable so by switching to 2 levels by default we save 4032KB of
+RAM per a device.
+
+While at this, add __GFP_NOWARN to alloc_pages_node() as the userspace
+can trigger this path via VFIO, see the failure and try creating a table
+again with different parameters which might succeed.
+
+[1]:
+===
+BUG: sleeping function called from invalid context at mm/page_alloc.c:4596
+in_atomic(): 1, irqs_disabled(): 1, pid: 1038, name: scsi_eh_1
+2 locks held by scsi_eh_1/1038:
+ #0: 000000005efd659a (&host->eh_mutex){+.+.}, at: ata_eh_acquire+0x34/0x80
+ #1: 0000000006cf56a6 (&(&host->lock)->rlock){....}, at: ata_exec_internal_sg+0xb0/0x5c0
+irq event stamp: 500
+hardirqs last enabled at (499): [<c000000000cb8a74>] _raw_spin_unlock_irqrestore+0x94/0xd0
+hardirqs last disabled at (500): [<c000000000cb85c4>] _raw_spin_lock_irqsave+0x44/0x120
+softirqs last enabled at (0): [<c000000000101120>] copy_process.isra.4.part.5+0x640/0x1a80
+softirqs last disabled at (0): [<0000000000000000>] 0x0
+CPU: 73 PID: 1038 Comm: scsi_eh_1 Not tainted 5.2.0-rc6-le_nv2_aikATfstn1-p1 #634
+Call Trace:
+[c000003d064cef50] [c000000000c8e6c4] dump_stack+0xe8/0x164 (unreliable)
+[c000003d064cefa0] [c00000000014ed78] ___might_sleep+0x2f8/0x310
+[c000003d064cf020] [c0000000003ca084] __alloc_pages_nodemask+0x2a4/0x1560
+[c000003d064cf220] [c0000000000c2530] pnv_alloc_tce_level.isra.0+0x90/0x130
+[c000003d064cf290] [c0000000000c2888] pnv_tce+0x128/0x3b0
+[c000003d064cf360] [c0000000000c2c00] pnv_tce_build+0xb0/0xf0
+[c000003d064cf3c0] [c0000000000bbd9c] pnv_ioda2_tce_build+0x3c/0xb0
+[c000003d064cf400] [c00000000004cfe0] ppc_iommu_map_sg+0x210/0x550
+[c000003d064cf510] [c00000000004b7a4] dma_iommu_map_sg+0x74/0xb0
+[c000003d064cf530] [c000000000863944] ata_qc_issue+0x134/0x470
+[c000003d064cf5b0] [c000000000863ec4] ata_exec_internal_sg+0x244/0x5c0
+[c000003d064cf700] [c0000000008642d0] ata_exec_internal+0x90/0xe0
+[c000003d064cf780] [c0000000008650ac] ata_dev_read_id+0x2ec/0x640
+[c000003d064cf8d0] [c000000000878e28] ata_eh_recover+0x948/0x16d0
+[c000003d064cfa10] [c00000000087d760] sata_pmp_error_handler+0x480/0xbf0
+[c000003d064cfbc0] [c000000000884624] ahci_error_handler+0x74/0xe0
+[c000003d064cfbf0] [c000000000879fa8] ata_scsi_port_error_handler+0x2d8/0x7c0
+[c000003d064cfca0] [c00000000087a544] ata_scsi_error+0xb4/0x100
+[c000003d064cfd00] [c000000000802450] scsi_error_handler+0x120/0x510
+[c000003d064cfdb0] [c000000000140c48] kthread+0x1b8/0x1c0
+[c000003d064cfe20] [c00000000000bd8c] ret_from_kernel_thread+0x5c/0x70
+ata1: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
+irq event stamp: 2305
+
+========================================================
+hardirqs last enabled at (2305): [<c00000000000e4c8>] fast_exc_return_irq+0x28/0x34
+hardirqs last disabled at (2303): [<c000000000cb9fd0>] __do_softirq+0x4a0/0x654
+WARNING: possible irq lock inversion dependency detected
+5.2.0-rc6-le_nv2_aikATfstn1-p1 #634 Tainted: G W
+softirqs last enabled at (2304): [<c000000000cba054>] __do_softirq+0x524/0x654
+softirqs last disabled at (2297): [<c00000000010f278>] irq_exit+0x128/0x180
+--------------------------------------------------------
+swapper/0/0 just changed the state of lock:
+0000000006cf56a6 (&(&host->lock)->rlock){-...}, at: ahci_single_level_irq_intr+0xac/0x120
+but this lock took another, HARDIRQ-unsafe lock in the past:
+ (fs_reclaim){+.+.}
+
+and interrupts could create inverse lock ordering between them.
+
+other info that might help us debug this:
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(fs_reclaim);
+ local_irq_disable();
+ lock(&(&host->lock)->rlock);
+ lock(fs_reclaim);
+ <Interrupt>
+ lock(&(&host->lock)->rlock);
+
+ *** DEADLOCK ***
+
+no locks held by swapper/0/0.
+
+the shortest dependencies between 2nd lock and 1st lock:
+ -> (fs_reclaim){+.+.} ops: 167579 {
+ HARDIRQ-ON-W at:
+ lock_acquire+0xf8/0x2a0
+ fs_reclaim_acquire.part.23+0x44/0x60
+ kmem_cache_alloc_node_trace+0x80/0x590
+ alloc_desc+0x64/0x270
+ __irq_alloc_descs+0x2e4/0x3a0
+ irq_domain_alloc_descs+0xb0/0x150
+ irq_create_mapping+0x168/0x2c0
+ xics_smp_probe+0x2c/0x98
+ pnv_smp_probe+0x40/0x9c
+ smp_prepare_cpus+0x524/0x6c4
+ kernel_init_freeable+0x1b4/0x650
+ kernel_init+0x2c/0x148
+ ret_from_kernel_thread+0x5c/0x70
+ SOFTIRQ-ON-W at:
+ lock_acquire+0xf8/0x2a0
+ fs_reclaim_acquire.part.23+0x44/0x60
+ kmem_cache_alloc_node_trace+0x80/0x590
+ alloc_desc+0x64/0x270
+ __irq_alloc_descs+0x2e4/0x3a0
+ irq_domain_alloc_descs+0xb0/0x150
+ irq_create_mapping+0x168/0x2c0
+ xics_smp_probe+0x2c/0x98
+ pnv_smp_probe+0x40/0x9c
+ smp_prepare_cpus+0x524/0x6c4
+ kernel_init_freeable+0x1b4/0x650
+ kernel_init+0x2c/0x148
+ ret_from_kernel_thread+0x5c/0x70
+ INITIAL USE at:
+ lock_acquire+0xf8/0x2a0
+ fs_reclaim_acquire.part.23+0x44/0x60
+ kmem_cache_alloc_node_trace+0x80/0x590
+ alloc_desc+0x64/0x270
+ __irq_alloc_descs+0x2e4/0x3a0
+ irq_domain_alloc_descs+0xb0/0x150
+ irq_create_mapping+0x168/0x2c0
+ xics_smp_probe+0x2c/0x98
+ pnv_smp_probe+0x40/0x9c
+ smp_prepare_cpus+0x524/0x6c4
+ kernel_init_freeable+0x1b4/0x650
+ kernel_init+0x2c/0x148
+ ret_from_kernel_thread+0x5c/0x70
+ }
+===
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Alistair Popple <alistair@popple.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190718051139.74787-4-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-ioda-tce.c | 20 +++++++++----------
+ arch/powerpc/platforms/powernv/pci.h | 2 +-
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+index e28f03e1eb5eb..c75ec37bf0cda 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c
+@@ -36,7 +36,8 @@ static __be64 *pnv_alloc_tce_level(int nid, unsigned int shift)
+ struct page *tce_mem = NULL;
+ __be64 *addr;
+
+- tce_mem = alloc_pages_node(nid, GFP_KERNEL, shift - PAGE_SHIFT);
++ tce_mem = alloc_pages_node(nid, GFP_ATOMIC | __GFP_NOWARN,
++ shift - PAGE_SHIFT);
+ if (!tce_mem) {
+ pr_err("Failed to allocate a TCE memory, level shift=%d\n",
+ shift);
+@@ -161,6 +162,9 @@ void pnv_tce_free(struct iommu_table *tbl, long index, long npages)
+
+ if (ptce)
+ *ptce = cpu_to_be64(0);
++ else
++ /* Skip the rest of the level */
++ i |= tbl->it_level_size - 1;
+ }
+ }
+
+@@ -260,7 +264,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ unsigned int table_shift = max_t(unsigned int, entries_shift + 3,
+ PAGE_SHIFT);
+ const unsigned long tce_table_size = 1UL << table_shift;
+- unsigned int tmplevels = levels;
+
+ if (!levels || (levels > POWERNV_IOMMU_MAX_LEVELS))
+ return -EINVAL;
+@@ -268,9 +271,6 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ if (!is_power_of_2(window_size))
+ return -EINVAL;
+
+- if (alloc_userspace_copy && (window_size > (1ULL << 32)))
+- tmplevels = 1;
+-
+ /* Adjust direct table size from window_size and levels */
+ entries_shift = (entries_shift + levels - 1) / levels;
+ level_shift = entries_shift + 3;
+@@ -281,7 +281,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+
+ /* Allocate TCE table */
+ addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
+- tmplevels, tce_table_size, &offset, &total_allocated);
++ 1, tce_table_size, &offset, &total_allocated);
+
+ /* addr==NULL means that the first level allocation failed */
+ if (!addr)
+@@ -292,18 +292,18 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ * we did not allocate as much as we wanted,
+ * release partially allocated table.
+ */
+- if (tmplevels == levels && offset < tce_table_size)
++ if (levels == 1 && offset < tce_table_size)
+ goto free_tces_exit;
+
+ /* Allocate userspace view of the TCE table */
+ if (alloc_userspace_copy) {
+ offset = 0;
+ uas = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
+- tmplevels, tce_table_size, &offset,
++ 1, tce_table_size, &offset,
+ &total_allocated_uas);
+ if (!uas)
+ goto free_tces_exit;
+- if (tmplevels == levels && (offset < tce_table_size ||
++ if (levels == 1 && (offset < tce_table_size ||
+ total_allocated_uas != total_allocated))
+ goto free_uas_exit;
+ }
+@@ -318,7 +318,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+
+ pr_debug("Created TCE table: ws=%08llx ts=%lx @%08llx base=%lx uas=%p levels=%d/%d\n",
+ window_size, tce_table_size, bus_offset, tbl->it_base,
+- tbl->it_userspace, tmplevels, levels);
++ tbl->it_userspace, 1, levels);
+
+ return 0;
+
+diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
+index be26ab3d99e01..33a52114267d0 100644
+--- a/arch/powerpc/platforms/powernv/pci.h
++++ b/arch/powerpc/platforms/powernv/pci.h
+@@ -225,7 +225,7 @@ extern struct iommu_table_group *pnv_npu_compound_attach(
+ struct pnv_ioda_pe *pe);
+
+ /* pci-ioda-tce.c */
+-#define POWERNV_IOMMU_DEFAULT_LEVELS 1
++#define POWERNV_IOMMU_DEFAULT_LEVELS 2
+ #define POWERNV_IOMMU_MAX_LEVELS 5
+
+ extern int pnv_tce_build(struct iommu_table *tbl, long index, long npages,
+--
+2.20.1
+
--- /dev/null
+From cac46b0e55e95c9cb088c24fa06144b6c7846425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 17:52:44 -0500
+Subject: powerpc/pseries: correctly track irq state in default idle
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 92c94dfb69e350471473fd3075c74bc68150879e ]
+
+prep_irq_for_idle() is intended to be called before entering
+H_CEDE (and it is used by the pseries cpuidle driver). However the
+default pseries idle routine does not call it, leading to mismanaged
+lazy irq state when the cpuidle driver isn't in use. Manifestations of
+this include:
+
+* Dropped IPIs in the time immediately after a cpu comes
+ online (before it has installed the cpuidle handler), making the
+ online operation block indefinitely waiting for the new cpu to
+ respond.
+
+* Hitting this WARN_ON in arch_local_irq_restore():
+ /*
+ * We should already be hard disabled here. We had bugs
+ * where that wasn't the case so let's dbl check it and
+ * warn if we are wrong. Only do that when IRQ tracing
+ * is enabled as mfmsr() can be costly.
+ */
+ if (WARN_ON_ONCE(mfmsr() & MSR_EE))
+ __hard_irq_disable();
+
+Call prep_irq_for_idle() from pseries_lpar_idle() and honor its
+result.
+
+Fixes: 363edbe2614a ("powerpc: Default arch idle could cede processor on pseries")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190910225244.25056-1-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/setup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
+index 8fa012a65a712..cc682759feae8 100644
+--- a/arch/powerpc/platforms/pseries/setup.c
++++ b/arch/powerpc/platforms/pseries/setup.c
+@@ -344,6 +344,9 @@ static void pseries_lpar_idle(void)
+ * low power mode by ceding processor to hypervisor
+ */
+
++ if (!prep_irq_for_idle())
++ return;
++
+ /* Indicate to hypervisor that we are idle. */
+ get_lppaca()->idle = 1;
+
+--
+2.20.1
+
--- /dev/null
+From b612050327967151acff37ad7597032e0fb233b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 14:29:26 -0500
+Subject: powerpc/pseries/mobility: use cond_resched when updating device tree
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit ccfb5bd71d3d1228090a8633800ae7cdf42a94ac ]
+
+After a partition migration, pseries_devicetree_update() processes
+changes to the device tree communicated from the platform to
+Linux. This is a relatively heavyweight operation, with multiple
+device tree searches, memory allocations, and conversations with
+partition firmware.
+
+There's a few levels of nested loops which are bounded only by
+decisions made by the platform, outside of Linux's control, and indeed
+we have seen RCU stalls on large systems while executing this call
+graph. Use cond_resched() in these loops so that the cpu is yielded
+when needed.
+
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190802192926.19277-4-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/mobility.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 50e7aee3c7f37..accb732dcfac7 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -9,6 +9,7 @@
+ #include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/kobject.h>
++#include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/stat.h>
+ #include <linux/completion.h>
+@@ -206,7 +207,11 @@ static int update_dt_node(__be32 phandle, s32 scope)
+
+ prop_data += vd;
+ }
++
++ cond_resched();
+ }
++
++ cond_resched();
+ } while (rtas_rc == 1);
+
+ of_node_put(dn);
+@@ -309,8 +314,12 @@ int pseries_devicetree_update(s32 scope)
+ add_dt_node(phandle, drc_index);
+ break;
+ }
++
++ cond_resched();
+ }
+ }
++
++ cond_resched();
+ } while (rc == 1);
+
+ kfree(rtas_buf);
+--
+2.20.1
+
--- /dev/null
+From 723d79dd0cf93452bc4c70850f8ee06a3d311f94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Aug 2019 14:29:24 -0500
+Subject: powerpc/rtas: use device model APIs and serialization during LPM
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit a6717c01ddc259f6f73364779df058e2c67309f8 ]
+
+The LPAR migration implementation and userspace-initiated cpu hotplug
+can interleave their executions like so:
+
+1. Set cpu 7 offline via sysfs.
+
+2. Begin a partition migration, whose implementation requires the OS
+ to ensure all present cpus are online; cpu 7 is onlined:
+
+ rtas_ibm_suspend_me -> rtas_online_cpus_mask -> cpu_up
+
+ This sets cpu 7 online in all respects except for the cpu's
+ corresponding struct device; dev->offline remains true.
+
+3. Set cpu 7 online via sysfs. _cpu_up() determines that cpu 7 is
+ already online and returns success. The driver core (device_online)
+ sets dev->offline = false.
+
+4. The migration completes and restores cpu 7 to offline state:
+
+ rtas_ibm_suspend_me -> rtas_offline_cpus_mask -> cpu_down
+
+This leaves cpu7 in a state where the driver core considers the cpu
+device online, but in all other respects it is offline and
+unused. Attempts to online the cpu via sysfs appear to succeed but the
+driver core actually does not pass the request to the lower-level
+cpuhp support code. This makes the cpu unusable until the cpu device
+is manually set offline and then online again via sysfs.
+
+Instead of directly calling cpu_up/cpu_down, the migration code should
+use the higher-level device core APIs to maintain consistent state and
+serialize operations.
+
+Fixes: 120496ac2d2d ("powerpc: Bring all threads online prior to migration/hibernation")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190802192926.19277-2-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index fff2eb22427d0..65cd96c3b1d60 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -871,15 +871,17 @@ static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+ return 0;
+
+ for_each_cpu(cpu, cpus) {
++ struct device *dev = get_cpu_device(cpu);
++
+ switch (state) {
+ case DOWN:
+- cpuret = cpu_down(cpu);
++ cpuret = device_offline(dev);
+ break;
+ case UP:
+- cpuret = cpu_up(cpu);
++ cpuret = device_online(dev);
+ break;
+ }
+- if (cpuret) {
++ if (cpuret < 0) {
+ pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
+ __func__,
+ ((state == UP) ? "up" : "down"),
+@@ -968,6 +970,8 @@ int rtas_ibm_suspend_me(u64 handle)
+ data.token = rtas_token("ibm,suspend-me");
+ data.complete = &done;
+
++ lock_device_hotplug();
++
+ /* All present CPUs must be online */
+ cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
+ cpuret = rtas_online_cpus_mask(offline_mask);
+@@ -1007,6 +1011,7 @@ out_hotplug_enable:
+ __func__);
+
+ out:
++ unlock_device_hotplug();
+ free_cpumask_var(offline_mask);
+ return atomic_read(&data.error);
+ }
+--
+2.20.1
+
--- /dev/null
+From 9ff7ee8283a3f5755529af8c17c092edf67f9c4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Aug 2019 17:47:52 +0200
+Subject: powerpc/xmon: Check for HV mode when dumping XIVE info from OPAL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit c3e0dbd7f780a58c4695f1cd8fc8afde80376737 ]
+
+Currently, the xmon 'dx' command calls OPAL to dump the XIVE state in
+the OPAL logs and also outputs some of the fields of the internal XIVE
+structures in Linux. The OPAL calls can only be done on baremetal
+(PowerNV) and they crash a pseries machine. Fix by checking the
+hypervisor feature of the CPU.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-2-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 4a721fd624069..e15ccf19c1533 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2532,13 +2532,16 @@ static void dump_pacas(void)
+ static void dump_one_xive(int cpu)
+ {
+ unsigned int hwid = get_hard_smp_processor_id(cpu);
+-
+- opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
+- opal_xive_dump(XIVE_DUMP_VP, hwid);
+- opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ bool hv = cpu_has_feature(CPU_FTR_HVMODE);
++
++ if (hv) {
++ opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
++ opal_xive_dump(XIVE_DUMP_VP, hwid);
++ opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ }
+
+ if (setjmp(bus_error_jmp) != 0) {
+ catch_memory_errors = 0;
+--
+2.20.1
+
--- /dev/null
+From 29b8f68ffdeba2a84793a843c463c813de09968c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Jun 2019 16:00:01 -0700
+Subject: pstore: fs superblock limits
+
+From: Deepa Dinamani <deepa.kernel@gmail.com>
+
+[ Upstream commit 83b8a3fbe3aa82ac3c253b698ae6a9be2dbdd5e0 ]
+
+Leaving granularity at 1ns because it is dependent on the specific
+attached backing pstore module. ramoops has microsecond resolution.
+
+Fix the readback of ramoops fractional timestamp microseconds,
+which has incorrectly been reporting the value as nanoseconds.
+
+Fixes: 3f8f80f0cfeb ("pstore/ram: Read and write to the 'compressed' flag of pstore").
+
+Signed-off-by: Deepa Dinamani <deepa.kernel@gmail.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Jeff Layton <jlayton@kernel.org>
+Cc: anton@enomsg.org
+Cc: ccross@android.com
+Cc: keescook@chromium.org
+Cc: tony.luck@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 5b77098944151..db9f67d34af37 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -144,6 +144,7 @@ static int ramoops_read_kmsg_hdr(char *buffer, struct timespec64 *time,
+ if (sscanf(buffer, RAMOOPS_KERNMSG_HDR "%lld.%lu-%c\n%n",
+ (time64_t *)&time->tv_sec, &time->tv_nsec, &data_type,
+ &header_length) == 3) {
++ time->tv_nsec *= 1000;
+ if (data_type == 'C')
+ *compressed = true;
+ else
+@@ -151,6 +152,7 @@ static int ramoops_read_kmsg_hdr(char *buffer, struct timespec64 *time,
+ } else if (sscanf(buffer, RAMOOPS_KERNMSG_HDR "%lld.%lu\n%n",
+ (time64_t *)&time->tv_sec, &time->tv_nsec,
+ &header_length) == 2) {
++ time->tv_nsec *= 1000;
+ *compressed = false;
+ } else {
+ time->tv_sec = 0;
+--
+2.20.1
+
--- /dev/null
+From 3dd9dd5528677a8cff2977ebc5b8d8a94f59e8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 10:14:18 +0800
+Subject: rtc: pcf85363/pcf85263: fix regmap error in set_time
+
+From: Biwen Li <biwen.li@nxp.com>
+
+[ Upstream commit 7ef66122bdb3b839e9f51b76d7e600b6e21ef648 ]
+
+Issue:
+ - # hwclock -w
+ hwclock: RTC_SET_TIME: Invalid argument
+
+Why:
+ - Relative commit: 8b9f9d4dc511 ("regmap: verify if register is
+ writeable before writing operations"), this patch
+ will always check for unwritable registers, it will compare reg
+ with max_register in regmap_writeable.
+
+ - The pcf85363/pcf85263 has the capability of address wrapping
+ which means if you access an address outside the allowed range
+ (0x00-0x2f) hardware actually wraps the access to a lower address.
+ The rtc-pcf85363 driver will use this feature to configure the time
+ and execute 2 actions in the same i2c write operation (stopping the
+ clock and configure the time). However the driver has also
+ configured the `regmap maxregister` protection mechanism that will
+ block accessing addresses outside valid range (0x00-0x2f).
+
+How:
+ - Split of writing regs to two parts, first part writes control
+ registers about stop_enable and resets, second part writes
+ RTC time and date registers.
+
+Signed-off-by: Biwen Li <biwen.li@nxp.com>
+Link: https://lore.kernel.org/r/20190829021418.4607-1-biwen.li@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf85363.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf85363.c b/drivers/rtc/rtc-pcf85363.c
+index a075e77617dcb..3450d615974d5 100644
+--- a/drivers/rtc/rtc-pcf85363.c
++++ b/drivers/rtc/rtc-pcf85363.c
+@@ -166,7 +166,12 @@ static int pcf85363_rtc_set_time(struct device *dev, struct rtc_time *tm)
+ buf[DT_YEARS] = bin2bcd(tm->tm_year % 100);
+
+ ret = regmap_bulk_write(pcf85363->regmap, CTRL_STOP_EN,
+- tmp, sizeof(tmp));
++ tmp, 2);
++ if (ret)
++ return ret;
++
++ ret = regmap_bulk_write(pcf85363->regmap, DT_100THS,
++ buf, sizeof(tmp) - 2);
+ if (ret)
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From e1265400d02c799b6d473061497db729d87663d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 15:18:58 +0800
+Subject: rtc: snvs: fix possible race condition
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 6fd4fe9b496d9ba3382992ff4fde3871d1b6f63d ]
+
+The RTC IRQ is requested before the struct rtc_device is allocated,
+this may lead to a NULL pointer dereference in IRQ handler.
+
+To fix this issue, allocating the rtc_device struct before requesting
+the RTC IRQ using devm_rtc_allocate_device, and use rtc_register_device
+to register the RTC device.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Link: https://lore.kernel.org/r/20190716071858.36750-1-Anson.Huang@nxp.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-snvs.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index 7ee673a25fd0a..4f9a107a04277 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -279,6 +279,10 @@ static int snvs_rtc_probe(struct platform_device *pdev)
+ if (!data)
+ return -ENOMEM;
+
++ data->rtc = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(data->rtc))
++ return PTR_ERR(data->rtc);
++
+ data->regmap = syscon_regmap_lookup_by_phandle(pdev->dev.of_node, "regmap");
+
+ if (IS_ERR(data->regmap)) {
+@@ -343,10 +347,9 @@ static int snvs_rtc_probe(struct platform_device *pdev)
+ goto error_rtc_device_register;
+ }
+
+- data->rtc = devm_rtc_device_register(&pdev->dev, pdev->name,
+- &snvs_rtc_ops, THIS_MODULE);
+- if (IS_ERR(data->rtc)) {
+- ret = PTR_ERR(data->rtc);
++ data->rtc->ops = &snvs_rtc_ops;
++ ret = rtc_register_device(data->rtc);
++ if (ret) {
+ dev_err(&pdev->dev, "failed to register rtc: %d\n", ret);
+ goto error_rtc_device_register;
+ }
+--
+2.20.1
+
--- /dev/null
+From 6a497e9b5635f40248f8d247b28b375637ff3924 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 15:38:14 -0700
+Subject: scsi: core: Reduce memory required for SCSI logging
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit dccc96abfb21dc19d69e707c38c8ba439bba7160 ]
+
+The data structure used for log messages is so large that it can cause a
+boot failure. Since allocations from that data structure can fail anyway,
+use kmalloc() / kfree() instead of that data structure.
+
+See also https://bugzilla.kernel.org/show_bug.cgi?id=204119.
+See also commit ded85c193a39 ("scsi: Implement per-cpu logging buffer") # v4.0.
+
+Reported-by: Jan Palus <jpalus@fastmail.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Jan Palus <jpalus@fastmail.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_logging.c | 48 +++----------------------------------
+ include/scsi/scsi_dbg.h | 2 --
+ 2 files changed, 3 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/scsi/scsi_logging.c b/drivers/scsi/scsi_logging.c
+index 39b8cc4574b49..c6ed0b12e8071 100644
+--- a/drivers/scsi/scsi_logging.c
++++ b/drivers/scsi/scsi_logging.c
+@@ -15,57 +15,15 @@
+ #include <scsi/scsi_eh.h>
+ #include <scsi/scsi_dbg.h>
+
+-#define SCSI_LOG_SPOOLSIZE 4096
+-
+-#if (SCSI_LOG_SPOOLSIZE / SCSI_LOG_BUFSIZE) > BITS_PER_LONG
+-#warning SCSI logging bitmask too large
+-#endif
+-
+-struct scsi_log_buf {
+- char buffer[SCSI_LOG_SPOOLSIZE];
+- unsigned long map;
+-};
+-
+-static DEFINE_PER_CPU(struct scsi_log_buf, scsi_format_log);
+-
+ static char *scsi_log_reserve_buffer(size_t *len)
+ {
+- struct scsi_log_buf *buf;
+- unsigned long map_bits = sizeof(buf->buffer) / SCSI_LOG_BUFSIZE;
+- unsigned long idx = 0;
+-
+- preempt_disable();
+- buf = this_cpu_ptr(&scsi_format_log);
+- idx = find_first_zero_bit(&buf->map, map_bits);
+- if (likely(idx < map_bits)) {
+- while (test_and_set_bit(idx, &buf->map)) {
+- idx = find_next_zero_bit(&buf->map, map_bits, idx);
+- if (idx >= map_bits)
+- break;
+- }
+- }
+- if (WARN_ON(idx >= map_bits)) {
+- preempt_enable();
+- return NULL;
+- }
+- *len = SCSI_LOG_BUFSIZE;
+- return buf->buffer + idx * SCSI_LOG_BUFSIZE;
++ *len = 128;
++ return kmalloc(*len, GFP_ATOMIC);
+ }
+
+ static void scsi_log_release_buffer(char *bufptr)
+ {
+- struct scsi_log_buf *buf;
+- unsigned long idx;
+- int ret;
+-
+- buf = this_cpu_ptr(&scsi_format_log);
+- if (bufptr >= buf->buffer &&
+- bufptr < buf->buffer + SCSI_LOG_SPOOLSIZE) {
+- idx = (bufptr - buf->buffer) / SCSI_LOG_BUFSIZE;
+- ret = test_and_clear_bit(idx, &buf->map);
+- WARN_ON(!ret);
+- }
+- preempt_enable();
++ kfree(bufptr);
+ }
+
+ static inline const char *scmd_name(const struct scsi_cmnd *scmd)
+diff --git a/include/scsi/scsi_dbg.h b/include/scsi/scsi_dbg.h
+index e03bd9d41fa8f..7b196d2346264 100644
+--- a/include/scsi/scsi_dbg.h
++++ b/include/scsi/scsi_dbg.h
+@@ -6,8 +6,6 @@ struct scsi_cmnd;
+ struct scsi_device;
+ struct scsi_sense_hdr;
+
+-#define SCSI_LOG_BUFSIZE 128
+-
+ extern void scsi_print_command(struct scsi_cmnd *);
+ extern size_t __scsi_format_command(char *, size_t,
+ const unsigned char *, size_t);
+--
+2.20.1
+
--- /dev/null
+From 9f79ac2d90d38179df9ed711f8ea8bcb56a2315d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 18:00:15 +0800
+Subject: security: smack: Fix possible null-pointer dereferences in
+ smack_socket_sock_rcv_skb()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 3f4287e7d98a2954f20bf96c567fdffcd2b63eb9 ]
+
+In smack_socket_sock_rcv_skb(), there is an if statement
+on line 3920 to check whether skb is NULL:
+ if (skb && skb->secmark != 0)
+
+This check indicates skb can be NULL in some cases.
+
+But on lines 3931 and 3932, skb is used:
+ ad.a.u.net->netif = skb->skb_iif;
+ ipv6_skb_to_auditdata(skb, &ad.a, NULL);
+
+Thus, possible null-pointer dereferences may occur when skb is NULL.
+
+To fix these possible bugs, an if statement is added to check skb.
+
+These bugs are found by a static analysis tool STCheck written by us.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/smack/smack_lsm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 4c5e5a438f8bd..5c9fc8ba6e572 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -3925,6 +3925,8 @@ access_check:
+ skp = smack_ipv6host_label(&sadd);
+ if (skp == NULL)
+ skp = smack_net_ambient;
++ if (skb == NULL)
++ break;
+ #ifdef CONFIG_AUDIT
+ smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
+ ad.a.u.net->family = family;
+--
+2.20.1
+
--- /dev/null
+From 7e552e045bce50e6c56be80db49097a0fe1d4e1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 18:54:11 -0400
+Subject: selftests/powerpc: Retry on host facility unavailable
+
+From: Gustavo Romero <gromero@linux.vnet.ibm.com>
+
+[ Upstream commit 6652bf6408895b09d31fd4128a1589a1a0672823 ]
+
+TM test tm-unavailable must take into account aborts due to host aborting
+a transactin because of a facility unavailable exception, just like it
+already does for aborts on reschedules (TM_CAUSE_KVM_RESCHED).
+
+Reported-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
+Tested-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
+Signed-off-by: Gustavo Romero <gromero@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1566341651-19747-1-git-send-email-gromero@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/tm/tm.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/powerpc/tm/tm.h b/tools/testing/selftests/powerpc/tm/tm.h
+index 97f9f491c541a..c402464b038fc 100644
+--- a/tools/testing/selftests/powerpc/tm/tm.h
++++ b/tools/testing/selftests/powerpc/tm/tm.h
+@@ -55,7 +55,8 @@ static inline bool failure_is_unavailable(void)
+ static inline bool failure_is_reschedule(void)
+ {
+ if ((failure_code() & TM_CAUSE_RESCHED) == TM_CAUSE_RESCHED ||
+- (failure_code() & TM_CAUSE_KVM_RESCHED) == TM_CAUSE_KVM_RESCHED)
++ (failure_code() & TM_CAUSE_KVM_RESCHED) == TM_CAUSE_KVM_RESCHED ||
++ (failure_code() & TM_CAUSE_KVM_FAC_UNAV) == TM_CAUSE_KVM_FAC_UNAV)
+ return true;
+
+ return false;
+--
+2.20.1
+
--- /dev/null
+From dfcc46a2d5f4fb143b90fbc9c23f465015a087f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 10:32:48 -0400
+Subject: selinux: fix residual uses of current_security() for the SELinux blob
+
+From: Stephen Smalley <sds@tycho.nsa.gov>
+
+[ Upstream commit 169ce0c081cd85f78388bb6c1638c1ad7b81bde7 ]
+
+We need to use selinux_cred() to fetch the SELinux cred blob instead
+of directly using current->security or current_security(). There
+were a couple of lingering uses of current_security() in the SELinux code
+that were apparently missed during the earlier conversions. IIUC, this
+would only manifest as a bug if multiple security modules including
+SELinux are enabled and SELinux is not first in the lsm order. After
+this change, there appear to be no other users of current_security()
+in-tree; perhaps we should remove it altogether.
+
+Fixes: bbd3662a8348 ("Infrastructure management of the cred security blob")
+Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Reviewed-by: James Morris <jamorris@linux.microsoft.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 2 +-
+ security/selinux/include/objsec.h | 20 ++++++++++----------
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 3ec7ac70c3130..c106167423a12 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3403,7 +3403,7 @@ static int selinux_inode_copy_up_xattr(const char *name)
+ static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
+ struct kernfs_node *kn)
+ {
+- const struct task_security_struct *tsec = current_security();
++ const struct task_security_struct *tsec = selinux_cred(current_cred());
+ u32 parent_sid, newsid, clen;
+ int rc;
+ char *context;
+diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
+index 91c5395dd20c2..586b7abd0aa73 100644
+--- a/security/selinux/include/objsec.h
++++ b/security/selinux/include/objsec.h
+@@ -37,16 +37,6 @@ struct task_security_struct {
+ u32 sockcreate_sid; /* fscreate SID */
+ };
+
+-/*
+- * get the subjective security ID of the current task
+- */
+-static inline u32 current_sid(void)
+-{
+- const struct task_security_struct *tsec = current_security();
+-
+- return tsec->sid;
+-}
+-
+ enum label_initialized {
+ LABEL_INVALID, /* invalid or not initialized */
+ LABEL_INITIALIZED, /* initialized */
+@@ -185,4 +175,14 @@ static inline struct ipc_security_struct *selinux_ipc(
+ return ipc->security + selinux_blob_sizes.lbs_ipc;
+ }
+
++/*
++ * get the subjective security ID of the current task
++ */
++static inline u32 current_sid(void)
++{
++ const struct task_security_struct *tsec = selinux_cred(current_cred());
++
++ return tsec->sid;
++}
++
+ #endif /* _SELINUX_OBJSEC_H_ */
+--
+2.20.1
+
--- /dev/null
+drm-vkms-fix-crc-worker-races.patch
+drm-bridge-tc358767-increase-aux-transfer-length-lim.patch
+drm-vkms-avoid-assigning-0-for-possible_crtc.patch
+drm-panel-simple-fix-auo-g185han01-horizontal-blanki.patch
+drm-amd-display-add-monitor-patch-to-add-t7-delay.patch
+video-ssd1307fb-start-page-range-at-page_offset.patch
+drm-tinydrm-kconfig-drivers-select-backlight_class_d.patch
+drm-stm-attach-gem-fence-to-atomic-state.patch
+drm-panel-check-failure-cases-in-the-probe-func.patch
+drm-rockchip-check-for-fast-link-training-before-ena.patch
+drm-amdgpu-fix-hard-hang-for-s-g-display-bos.patch
+drm-radeon-fix-eeh-during-kexec.patch
+gpu-drm-radeon-fix-a-possible-null-pointer-dereferen.patch
+clk-imx8mq-mark-ahb-clock-as-critical.patch
+pci-rpaphp-avoid-a-sometimes-uninitialized-warning.patch
+pinctrl-stmfx-update-pinconf-settings.patch
+ipmi_si-only-schedule-continuously-in-the-thread-in-.patch
+clk-qoriq-fix-wunused-const-variable.patch
+clk-sunxi-ng-v3s-add-missing-clock-slices-for-mmc2-m.patch
+drm-amd-display-fix-issue-where-252-255-values-are-c.patch
+drm-amd-display-fix-frames_to_insert-math.patch
+drm-amd-display-reprogram-vm-config-when-system-resu.patch
+powerpc-powernv-ioda2-allocate-tce-table-levels-on-d.patch
+clk-actions-don-t-reference-clk_init_data-after-regi.patch
+clk-sirf-don-t-reference-clk_init_data-after-registr.patch
+clk-meson-axg-audio-don-t-reference-clk_init_data-af.patch
+clk-sprd-don-t-reference-clk_init_data-after-registr.patch
+clk-zx296718-don-t-reference-clk_init_data-after-reg.patch
+powerpc-xmon-check-for-hv-mode-when-dumping-xive-inf.patch
+powerpc-rtas-use-device-model-apis-and-serialization.patch
+powerpc-futex-fix-warning-oldval-may-be-used-uniniti.patch
+powerpc-64s-radix-fix-memory-hotplug-section-page-ta.patch
+powerpc-pseries-mobility-use-cond_resched-when-updat.patch
+powerpc-perf-fix-imc-allocation-failure-handling.patch
+pinctrl-tegra-fix-write-barrier-placement-in-pmx_wri.patch
+powerpc-eeh-clear-stale-eeh_dev_no_handler-flag.patch
+vfio_pci-restore-original-state-on-release.patch
+drm-nouveau-kms-tu102-disable-input-lut-when-input-i.patch
+drm-nouveau-volt-fix-for-some-cards-having-0-maximum.patch
+pinctrl-amd-disable-spurious-firing-gpio-irqs.patch
+clk-renesas-mstp-set-genpd_flag_always_on-for-clock-.patch
+clk-renesas-cpg-mssr-set-genpd_flag_always_on-for-cl.patch
+drm-amd-display-support-spdif.patch
+selftests-powerpc-retry-on-host-facility-unavailable.patch
+drm-amdgpu-si-fix-asic-tests.patch
+powerpc-64s-exception-machine-check-use-correct-cfar.patch
+pstore-fs-superblock-limits.patch
+powerpc-eeh-clean-up-eeh-pes-after-recovery-finishes.patch
+clk-qcom-gcc-sdm845-use-floor-ops-for-sdcc-clks.patch
+powerpc-pseries-correctly-track-irq-state-in-default.patch
+pinctrl-meson-gxbb-fix-wrong-pinning-definition-for-.patch
+mailbox-mediatek-cmdq-clear-the-event-in-cmdq-initia.patch
+arm64-fix-unreachable-code-issue-with-cmpxchg.patch
+clk-at91-select-parent-if-main-oscillator-or-bypass-.patch
+clk-imx-pll14xx-avoid-glitch-when-set-rate.patch
+clk-imx-clk-pll14xx-unbypass-pll-by-default.patch
+clk-make-clk_bulk_get_all-return-a-valid-id.patch
+powerpc-dump-kernel-log-before-carrying-out-fadump-o.patch
+mbox-qcom-add-apcs-child-device-for-qcs404.patch
+clk-sprd-add-missing-kfree.patch
+scsi-core-reduce-memory-required-for-scsi-logging.patch
+dma-buf-sw_sync-synchronize-signal-vs-syncpt-free.patch
+f2fs-fix-to-drop-meta-node-pages-during-umount.patch
+ext4-fix-potential-use-after-free-after-remounting-w.patch
+mips-ingenic-disable-broken-btb-lookup-optimization.patch
+clk-jz4740-add-tcu-clock.patch
+mips-don-t-use-bc_false-uninitialized-in-__mm_isbran.patch
+mips-tlbex-explicitly-cast-_page_no_exec-to-a-boolea.patch
+i2c-cht-wc-fix-lockdep-warning.patch
+mfd-intel-lpss-remove-d3cold-delay.patch
+pci-tegra-fix-of-node-reference-leak.patch
+hid-wacom-fix-several-minor-compiler-warnings.patch
+mips-atomic-fix-loongson_llsc_mb-wreckage.patch
+pci-pci-hyperv-fix-build-errors-on-non-sysfs-config.patch
+pci-layerscape-add-the-bar_fixed_64bit-property-to-t.patch
+livepatch-nullify-obj-mod-in-klp_module_coming-s-err.patch
+mips-atomic-fix-smp_mb__-before-after-_atomic.patch
+arm-8898-1-mm-don-t-treat-faults-reported-from-cache.patch
+soundwire-intel-fix-channel-number-reported-by-hardw.patch
+arm-8875-1-kconfig-default-to-aeabi-w-clang.patch
+rtc-snvs-fix-possible-race-condition.patch
+rtc-pcf85363-pcf85263-fix-regmap-error-in-set_time.patch
+selinux-fix-residual-uses-of-current_security-for-th.patch
+pci-add-pci_info_ratelimited-to-ratelimit-pci-separa.patch
+hid-apple-fix-stuck-function-keys-when-using-fn.patch
+pci-rockchip-propagate-errors-for-optional-regulator.patch
+pci-histb-propagate-errors-for-optional-regulators.patch
+pci-imx6-propagate-errors-for-optional-regulators.patch
+pci-exynos-propagate-errors-for-optional-phys.patch
+security-smack-fix-possible-null-pointer-dereference.patch
+pci-use-static-const-struct-not-const-static-struct.patch
+arm-8905-1-emit-__gnu_mcount_nc-when-using-clang-10..patch
+arm-8903-1-ensure-that-usable-memory-in-bank-0-start.patch
+fat-work-around-race-with-userspace-s-read-via-block.patch
+pktcdvd-remove-warning-on-attempting-to-register-non.patch
+hypfs-fix-error-number-left-in-struct-pointer-member.patch
+crypto-hisilicon-fix-double-free-in-sec_free_hw_sgl.patch
+kbuild-clean-compressed-initramfs-image.patch
+ocfs2-wait-for-recovering-done-after-direct-unlock-r.patch
+kmemleak-increase-debug_kmemleak_early_log_size-defa.patch
+arm64-consider-stack-randomization-for-mmap-base-onl.patch
+mips-properly-account-for-stack-randomization-and-st.patch
+arm-properly-account-for-stack-randomization-and-sta.patch
+arm-use-stack_top-when-computing-mmap-base-address.patch
--- /dev/null
+From 9d7a8a7e6eabaff50f8427ee7e5598529dce6bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Aug 2019 19:55:07 -0500
+Subject: soundwire: intel: fix channel number reported by hardware
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 18046335643de6d21327f5ae034c8fb8463f6715 ]
+
+On all released Intel controllers (CNL/CML/ICL), PDI2 reports an
+invalid count, force the correct hardware-supported value
+
+This may have to be revisited with platform-specific values if the
+hardware changes, but for now this is good enough.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190806005522.22642-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index 60293a00a14ee..8a670bc86c0ce 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -283,6 +283,16 @@ intel_pdi_get_ch_cap(struct sdw_intel *sdw, unsigned int pdi_num, bool pcm)
+
+ if (pcm) {
+ count = intel_readw(shim, SDW_SHIM_PCMSYCHC(link_id, pdi_num));
++
++ /*
++ * WORKAROUND: on all existing Intel controllers, pdi
++ * number 2 reports channel count as 1 even though it
++ * supports 8 channels. Performing hardcoding for pdi
++ * number 2.
++ */
++ if (pdi_num == 2)
++ count = 7;
++
+ } else {
+ count = intel_readw(shim, SDW_SHIM_PDMSCAP(link_id));
+ count = ((count & SDW_SHIM_PDMSCAP_CPSS) >>
+--
+2.20.1
+
--- /dev/null
+From 0617adcdb36c8bb7878380d1834b9f0b39934cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 11:35:19 +0800
+Subject: vfio_pci: Restore original state on release
+
+From: hexin <hexin.op@gmail.com>
+
+[ Upstream commit 92c8026854c25093946e0d7fe536fd9eac440f06 ]
+
+vfio_pci_enable() saves the device's initial configuration information
+with the intent that it is restored in vfio_pci_disable(). However,
+the commit referenced in Fixes: below replaced the call to
+__pci_reset_function_locked(), which is not wrapped in a state save
+and restore, with pci_try_reset_function(), which overwrites the
+restored device state with the current state before applying it to the
+device. Reinstate use of __pci_reset_function_locked() to return to
+the desired behavior.
+
+Fixes: 890ed578df82 ("vfio-pci: Use pci "try" reset interface")
+Signed-off-by: hexin <hexin15@baidu.com>
+Signed-off-by: Liu Qi <liuqi16@baidu.com>
+Signed-off-by: Zhang Yu <zhangyu31@baidu.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 703948c9fbe10..02206162eaa9e 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -438,11 +438,20 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
+ pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE);
+
+ /*
+- * Try to reset the device. The success of this is dependent on
+- * being able to lock the device, which is not always possible.
++ * Try to get the locks ourselves to prevent a deadlock. The
++ * success of this is dependent on being able to lock the device,
++ * which is not always possible.
++ * We can not use the "try" reset interface here, which will
++ * overwrite the previously restored configuration information.
+ */
+- if (vdev->reset_works && !pci_try_reset_function(pdev))
+- vdev->needs_reset = false;
++ if (vdev->reset_works && pci_cfg_access_trylock(pdev)) {
++ if (device_trylock(&pdev->dev)) {
++ if (!__pci_reset_function_locked(pdev))
++ vdev->needs_reset = false;
++ device_unlock(&pdev->dev);
++ }
++ pci_cfg_access_unlock(pdev);
++ }
+
+ pci_restore_state(pdev);
+ out:
+--
+2.20.1
+
--- /dev/null
+From bd26cea0c2dfc69c207af46417d4e44c1e5d03ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 10:41:08 +0300
+Subject: video: ssd1307fb: Start page range at page_offset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marko Kohtala <marko.kohtala@okoko.fi>
+
+[ Upstream commit dd9782834dd9dde3624ff1acea8859f3d3e792d4 ]
+
+The page_offset was only applied to the end of the page range. This caused
+the display updates to cause a scrolling effect on the display because the
+amount of data written to the display did not match the range display
+expected.
+
+Fixes: 301bc0675b67 ("video: ssd1307fb: Make use of horizontal addressing mode")
+Signed-off-by: Marko Kohtala <marko.kohtala@okoko.fi>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190618074111.9309-4-marko.kohtala@okoko.fi
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/ssd1307fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c
+index 021b727e8b5c4..6afd0d3ae5690 100644
+--- a/drivers/video/fbdev/ssd1307fb.c
++++ b/drivers/video/fbdev/ssd1307fb.c
+@@ -432,7 +432,7 @@ static int ssd1307fb_init(struct ssd1307fb_par *par)
+ if (ret < 0)
+ return ret;
+
+- ret = ssd1307fb_write_cmd(par->client, 0x0);
++ ret = ssd1307fb_write_cmd(par->client, par->page_offset);
+ if (ret < 0)
+ return ret;
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
