--- /dev/null
+From 3de372324ab5583d40e5eb111ab7134d2824d131 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 4 Apr 2019 17:27:20 +0100
+Subject: ASoC: cs35l35: Disable regulators on driver removal
+
+[ Upstream commit 47c4cc08cb5b34e93ab337b924c5ede77ca3c936 ]
+
+The chips main power supplies VA and VP are enabled during probe but
+then never disabled, this will cause warnings from the regulator
+framework on driver removal. Fix this by adding a remove callback and
+disabling the supplies, whilst doing so follow best practice and put the
+chip back into reset as well.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l35.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c
+index bd6226bde45f6..17e0101081ef6 100644
+--- a/sound/soc/codecs/cs35l35.c
++++ b/sound/soc/codecs/cs35l35.c
+@@ -1634,6 +1634,16 @@ static int cs35l35_i2c_probe(struct i2c_client *i2c_client,
+ return ret;
+ }
+
++static int cs35l35_i2c_remove(struct i2c_client *i2c_client)
++{
++ struct cs35l35_private *cs35l35 = i2c_get_clientdata(i2c_client);
++
++ regulator_bulk_disable(cs35l35->num_supplies, cs35l35->supplies);
++ gpiod_set_value_cansleep(cs35l35->reset_gpio, 0);
++
++ return 0;
++}
++
+ static const struct of_device_id cs35l35_of_match[] = {
+ {.compatible = "cirrus,cs35l35"},
+ {},
+@@ -1654,6 +1664,7 @@ static struct i2c_driver cs35l35_i2c_driver = {
+ },
+ .id_table = cs35l35_id,
+ .probe = cs35l35_i2c_probe,
++ .remove = cs35l35_i2c_remove,
+ };
+
+ module_i2c_driver(cs35l35_i2c_driver);
+--
+2.20.1
+
--- /dev/null
+From 8a17f372a218576c6e3613cbfbc5d5f65c120554 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Wed, 20 Mar 2019 22:41:56 +0100
+Subject: ASoC: cs4270: Set auto-increment bit for register writes
+
+[ Upstream commit f0f2338a9cfaf71db895fa989ea7234e8a9b471d ]
+
+The CS4270 does not by default increment the register address on
+consecutive writes. During normal operation it doesn't matter as all
+register accesses are done individually. At resume time after suspend,
+however, the regcache code gathers the biggest possible block of
+registers to sync and sends them one on one go.
+
+To fix this, set the INCR bit in all cases.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4270.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index 3c266eeb89bfb..007ce9f48e443 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
+ .reg_defaults = cs4270_reg_defaults,
+ .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults),
+ .cache_type = REGCACHE_RBTREE,
++ .write_flag_mask = CS4270_I2C_INCR,
+
+ .readable_reg = cs4270_reg_is_readable,
+ .volatile_reg = cs4270_reg_is_volatile,
+--
+2.20.1
+
--- /dev/null
+From 45f78c7c8da977c979a56cc907a191ff2479b699 Mon Sep 17 00:00:00 2001
+From: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
+Date: Fri, 22 Mar 2019 18:00:09 +0530
+Subject: ASoC: dapm: Fix NULL pointer dereference in
+ snd_soc_dapm_free_kcontrol
+
+[ Upstream commit cacea3a90e211f0c111975535508d446a4a928d2 ]
+
+w_text_param can be NULL and it is being dereferenced without checking.
+Add the missing sanity check to prevent NULL pointer dereference.
+
+Signed-off-by: Pankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 9b78fb3daa7bb..2257b1b0151c4 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3847,6 +3847,10 @@ snd_soc_dapm_free_kcontrol(struct snd_soc_card *card,
+ int count;
+
+ devm_kfree(card->dev, (void *)*private_value);
++
++ if (!w_param_text)
++ return;
++
+ for (count = 0 ; count < num_params; count++)
+ devm_kfree(card->dev, (void *)w_param_text[count]);
+ devm_kfree(card->dev, w_param_text);
+--
+2.20.1
+
--- /dev/null
+From 3518e90295abb601180fa834b1a74c3f89d4e0c8 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 28 Feb 2019 15:30:34 +0000
+Subject: ASoC: hdmi-codec: fix S/PDIF DAI
+
+[ Upstream commit 2e95f984aae4cf0608d0ba2189c756f2bd50b44a ]
+
+When using the S/PDIF DAI, there is no requirement to call
+snd_soc_dai_set_fmt() as there is no DAI format definition that defines
+S/PDIF. In any case, S/PDIF does not have separate clocks, this is
+embedded into the data stream.
+
+Consequently, when attempting to use TDA998x in S/PDIF mode, the attempt
+to configure TDA998x via the hw_params callback fails as the
+hdmi_codec_daifmt is left initialised to zero.
+
+Since the S/PDIF DAI will only be used by S/PDIF, prepare the
+hdmi_codec_daifmt structure for this format.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdmi-codec.c | 118 +++++++++++++++++-----------------
+ 1 file changed, 59 insertions(+), 59 deletions(-)
+
+diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
+index e5b6769b97977..d5f73c8372817 100644
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -529,73 +529,71 @@ static int hdmi_codec_set_fmt(struct snd_soc_dai *dai,
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
+ struct hdmi_codec_daifmt cf = { 0 };
+- int ret = 0;
+
+ dev_dbg(dai->dev, "%s()\n", __func__);
+
+- if (dai->id == DAI_ID_SPDIF) {
+- cf.fmt = HDMI_SPDIF;
+- } else {
+- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+- case SND_SOC_DAIFMT_CBM_CFM:
+- cf.bit_clk_master = 1;
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFM:
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBM_CFS:
+- cf.bit_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFS:
+- break;
+- default:
+- return -EINVAL;
+- }
++ if (dai->id == DAI_ID_SPDIF)
++ return 0;
++
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBM_CFM:
++ cf.bit_clk_master = 1;
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFM:
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBM_CFS:
++ cf.bit_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFS:
++ break;
++ default:
++ return -EINVAL;
++ }
+
+- switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+- case SND_SOC_DAIFMT_NB_NF:
+- break;
+- case SND_SOC_DAIFMT_NB_IF:
+- cf.frame_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_NF:
+- cf.bit_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_IF:
+- cf.frame_clk_inv = 1;
+- cf.bit_clk_inv = 1;
+- break;
+- }
++ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
++ case SND_SOC_DAIFMT_NB_NF:
++ break;
++ case SND_SOC_DAIFMT_NB_IF:
++ cf.frame_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_NF:
++ cf.bit_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_IF:
++ cf.frame_clk_inv = 1;
++ cf.bit_clk_inv = 1;
++ break;
++ }
+
+- switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+- case SND_SOC_DAIFMT_I2S:
+- cf.fmt = HDMI_I2S;
+- break;
+- case SND_SOC_DAIFMT_DSP_A:
+- cf.fmt = HDMI_DSP_A;
+- break;
+- case SND_SOC_DAIFMT_DSP_B:
+- cf.fmt = HDMI_DSP_B;
+- break;
+- case SND_SOC_DAIFMT_RIGHT_J:
+- cf.fmt = HDMI_RIGHT_J;
+- break;
+- case SND_SOC_DAIFMT_LEFT_J:
+- cf.fmt = HDMI_LEFT_J;
+- break;
+- case SND_SOC_DAIFMT_AC97:
+- cf.fmt = HDMI_AC97;
+- break;
+- default:
+- dev_err(dai->dev, "Invalid DAI interface format\n");
+- return -EINVAL;
+- }
++ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++ case SND_SOC_DAIFMT_I2S:
++ cf.fmt = HDMI_I2S;
++ break;
++ case SND_SOC_DAIFMT_DSP_A:
++ cf.fmt = HDMI_DSP_A;
++ break;
++ case SND_SOC_DAIFMT_DSP_B:
++ cf.fmt = HDMI_DSP_B;
++ break;
++ case SND_SOC_DAIFMT_RIGHT_J:
++ cf.fmt = HDMI_RIGHT_J;
++ break;
++ case SND_SOC_DAIFMT_LEFT_J:
++ cf.fmt = HDMI_LEFT_J;
++ break;
++ case SND_SOC_DAIFMT_AC97:
++ cf.fmt = HDMI_AC97;
++ break;
++ default:
++ dev_err(dai->dev, "Invalid DAI interface format\n");
++ return -EINVAL;
+ }
+
+ hcp->daifmt[dai->id] = cf;
+
+- return ret;
++ return 0;
+ }
+
+ static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
+@@ -792,8 +790,10 @@ static int hdmi_codec_probe(struct platform_device *pdev)
+ i++;
+ }
+
+- if (hcd->spdif)
++ if (hcd->spdif) {
+ hcp->daidrv[i] = hdmi_spdif_dai;
++ hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
++ }
+
+ dev_set_drvdata(dev, hcp);
+
+--
+2.20.1
+
--- /dev/null
+From 70384f392c10a7f81790b8e979a2d0b25807fd68 Mon Sep 17 00:00:00 2001
+From: Tzung-Bi Shih <tzungbi@google.com>
+Date: Mon, 8 Apr 2019 17:08:58 +0800
+Subject: ASoC: Intel: kbl: fix wrong number of channels
+
+[ Upstream commit d6ba3f815bc5f3c4249d15c8bc5fbb012651b4a4 ]
+
+Fix wrong setting on number of channels. The context wants to set
+constraint to 2 channels instead of 4.
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+index a892b37eab7c9..b8a03f58ac8cc 100644
+--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+@@ -406,7 +406,7 @@ static const struct snd_pcm_hw_constraint_list constraints_dmic_channels = {
+ };
+
+ static const unsigned int dmic_2ch[] = {
+- 4,
++ 2,
+ };
+
+ static const struct snd_pcm_hw_constraint_list constraints_dmic_2ch = {
+--
+2.20.1
+
--- /dev/null
+From 9f3b5dc0e4aca4c89c833008e5eca5f72e21a965 Mon Sep 17 00:00:00 2001
+From: Rander Wang <rander.wang@linux.intel.com>
+Date: Fri, 8 Mar 2019 16:38:59 +0800
+Subject: ASoC:intel:skl:fix a simultaneous playback & capture issue on hda
+ platform
+
+[ Upstream commit c899df3e9b0bf7b76e642aed1a214582ea7012d5 ]
+
+If playback and capture are enabled concurrently, when the capture stops
+the output becomes inaudile. The playback application will become stuck
+and underrun after a timeout.
+
+This is caused by mistaken use of the stream_id, which should only be
+set for playback and not for capture
+
+Tested on Apollolake and Kabylake with SST driver.
+
+Signed-off-by: Rander Wang <rander.wang@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-pcm.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
+index 823e39103edd3..6b2c8c6e7a00f 100644
+--- a/sound/soc/intel/skylake/skl-pcm.c
++++ b/sound/soc/intel/skylake/skl-pcm.c
+@@ -180,6 +180,7 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
+ struct hdac_stream *hstream;
+ struct hdac_ext_stream *stream;
+ struct hdac_ext_link *link;
++ unsigned char stream_tag;
+
+ hstream = snd_hdac_get_stream(bus, params->stream,
+ params->link_dma_id + 1);
+@@ -198,10 +199,13 @@ int skl_pcm_link_dma_prepare(struct device *dev, struct skl_pipe_params *params)
+
+ snd_hdac_ext_link_stream_setup(stream, format_val);
+
+- list_for_each_entry(link, &bus->hlink_list, list) {
+- if (link->index == params->link_index)
+- snd_hdac_ext_link_set_stream_id(link,
+- hstream->stream_tag);
++ stream_tag = hstream->stream_tag;
++ if (stream->hstream.direction == SNDRV_PCM_STREAM_PLAYBACK) {
++ list_for_each_entry(link, &bus->hlink_list, list) {
++ if (link->index == params->link_index)
++ snd_hdac_ext_link_set_stream_id(link,
++ stream_tag);
++ }
+ }
+
+ stream->link_prepared = 1;
+@@ -640,6 +644,7 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
+ struct hdac_ext_stream *link_dev =
+ snd_soc_dai_get_dma_data(dai, substream);
+ struct hdac_ext_link *link;
++ unsigned char stream_tag;
+
+ dev_dbg(dai->dev, "%s: %s\n", __func__, dai->name);
+
+@@ -649,7 +654,11 @@ static int skl_link_hw_free(struct snd_pcm_substream *substream,
+ if (!link)
+ return -EINVAL;
+
+- snd_hdac_ext_link_clear_stream_id(link, hdac_stream(link_dev)->stream_tag);
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++ stream_tag = hdac_stream(link_dev)->stream_tag;
++ snd_hdac_ext_link_clear_stream_id(link, stream_tag);
++ }
++
+ snd_hdac_ext_stream_release(link_dev, HDAC_EXT_STREAM_TYPE_LINK);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 86672667fbdae834faafc94cd8907109ed7bb316 Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Wed, 13 Mar 2019 16:23:44 +0800
+Subject: ASoC: nau8810: fix the issue of widget with prefixed name
+
+[ Upstream commit 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a ]
+
+The driver changes the stream name of DAC and ADC to avoid the issue of
+widget with prefixed name. When the machine adds prefixed name for codec,
+the stream name of DAI may not find the widgets.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8810.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
+index bfd74b86c9d2f..645aa07941237 100644
+--- a/sound/soc/codecs/nau8810.c
++++ b/sound/soc/codecs/nau8810.c
+@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
+ SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
+ NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
+ ARRAY_SIZE(nau8810_mono_mixer_controls)),
+- SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
++ SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
+ NAU8810_DAC_EN_SFT, 0),
+- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
++ SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
+ NAU8810_ADC_EN_SFT, 0),
+ SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
+ NAU8810_NSPK_EN_SFT, 0, NULL, 0),
+--
+2.20.1
+
--- /dev/null
+From 1dd6a1914216dd76535b49ee0196bd20d0d862be Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Mon, 11 Mar 2019 09:36:45 +0800
+Subject: ASoC: nau8824: fix the issue of the widget with prefix name
+
+[ Upstream commit 844a4a362dbec166b44d6b9b3dd45b08cb273703 ]
+
+The driver has two issues when machine add prefix name for codec.
+(1)The stream name of DAI can't find the AIF widgets.
+(2)The drivr can enable/disalbe the MICBIAS and SAR widgets.
+
+The patch will fix these issues caused by prefixed name added.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8824.c | 46 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 468d5143e2c4f..663a208c2f784 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+ SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+ NAU8824_ADCR_EN_SFT, 0),
+
+- SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+- SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+ NAU8824_DACL_EN_SFT, 0),
+@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
+ }
+ }
+
++static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_disable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_disable_pin(dapm, pin);
++ }
++}
++
++static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_force_enable_pin(dapm, pin);
++ }
++}
++
+ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ {
+ struct snd_soc_dapm_context *dapm = nau8824->dapm;
+@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ /* Clear all interruption status */
+ nau8824_int_status_clear_all(regmap);
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+
+ /* Enable the insertion interruption, disable the ejection
+@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ struct regmap *regmap = nau8824->regmap;
+ int adc_value, event = 0, event_mask = 0;
+
+- snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+- snd_soc_dapm_force_enable_pin(dapm, "SAR");
++ nau8824_dapm_enable_pin(nau8824, "MICBIAS");
++ nau8824_dapm_enable_pin(nau8824, "SAR");
+ snd_soc_dapm_sync(dapm);
+
+ msleep(100);
+@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ if (adc_value < HEADSET_SARADC_THD) {
+ event |= SND_JACK_HEADPHONE;
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+ } else {
+ event |= SND_JACK_HEADSET;
+--
+2.20.1
+
--- /dev/null
+From f15246223f4b1cfa8f84e645703e2e47c2461b30 Mon Sep 17 00:00:00 2001
+From: Sugar Zhang <sugar.zhang@rock-chips.com>
+Date: Wed, 3 Apr 2019 21:40:45 +0800
+Subject: ASoC: rockchip: pdm: fix regmap_ops hang issue
+
+[ Upstream commit c85064435fe7a216ec0f0238ef2b8f7cd850a450 ]
+
+This is because set_fmt ops maybe called when PD is off,
+and in such case, regmap_ops will lead system hang.
+enale PD before doing regmap_ops.
+
+Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_pdm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/rockchip/rockchip_pdm.c b/sound/soc/rockchip/rockchip_pdm.c
+index 400e29edb1c9c..8a2e3bbce3a16 100644
+--- a/sound/soc/rockchip/rockchip_pdm.c
++++ b/sound/soc/rockchip/rockchip_pdm.c
+@@ -208,7 +208,9 @@ static int rockchip_pdm_set_fmt(struct snd_soc_dai *cpu_dai,
+ return -EINVAL;
+ }
+
++ pm_runtime_get_sync(cpu_dai->dev);
+ regmap_update_bits(pdm->regmap, PDM_CLK_CTRL, mask, val);
++ pm_runtime_put(cpu_dai->dev);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From f2a465219dc6dd2224441b3bf02e0ebe15517343 Mon Sep 17 00:00:00 2001
+From: Shuming Fan <shumingf@realtek.com>
+Date: Mon, 18 Mar 2019 15:17:42 +0800
+Subject: ASoC: rt5682: recording has no sound after booting
+
+[ Upstream commit 1c5b6a27e432e4fe170a924c8b41012271496a4c ]
+
+If ASRC turns on, HW will use clk_dac as the reference clock
+whether recording or playback.
+Both of clk_dac and clk_adc should set proper clock while using ASRC.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 79ebcc2397865..6f5dac09ceded 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -1196,7 +1196,7 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
+ struct snd_soc_component *component =
+ snd_soc_dapm_to_component(w->dapm);
+ struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
+- int ref, val, reg, sft, mask, idx = -EINVAL;
++ int ref, val, reg, idx = -EINVAL;
+ static const int div_f[] = {1, 2, 3, 4, 6, 8, 12, 16, 24, 32, 48};
+ static const int div_o[] = {1, 2, 4, 6, 8, 12, 16, 24, 32, 48};
+
+@@ -1210,15 +1210,10 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
+
+ idx = rt5682_div_sel(rt5682, ref, div_f, ARRAY_SIZE(div_f));
+
+- if (w->shift == RT5682_PWR_ADC_S1F_BIT) {
++ if (w->shift == RT5682_PWR_ADC_S1F_BIT)
+ reg = RT5682_PLL_TRACK_3;
+- sft = RT5682_ADC_OSR_SFT;
+- mask = RT5682_ADC_OSR_MASK;
+- } else {
++ else
+ reg = RT5682_PLL_TRACK_2;
+- sft = RT5682_DAC_OSR_SFT;
+- mask = RT5682_DAC_OSR_MASK;
+- }
+
+ snd_soc_component_update_bits(component, reg,
+ RT5682_FILTER_CLK_DIV_MASK, idx << RT5682_FILTER_CLK_DIV_SFT);
+@@ -1230,7 +1225,8 @@ static int set_filter_clk(struct snd_soc_dapm_widget *w,
+ }
+
+ snd_soc_component_update_bits(component, RT5682_ADDA_CLK_1,
+- mask, idx << sft);
++ RT5682_ADC_OSR_MASK | RT5682_DAC_OSR_MASK,
++ (idx << RT5682_ADC_OSR_SFT) | (idx << RT5682_DAC_OSR_SFT));
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 460d4582cc5cd7f19009b8900eb2b41106d4410e Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Tue, 12 Mar 2019 18:40:06 +0100
+Subject: ASoC: samsung: odroid: Fix clock configuration for 44100 sample rate
+
+[ Upstream commit 2b13bee3884926cba22061efa75bd315e871de24 ]
+
+After commit fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate
+handling") the audio root clock frequency is configured improperly for
+44100 sample rate. Due to clock rate rounding it's 20070401 Hz instead
+of 22579000 Hz. This results in a too low value of the PSR clock divider
+in the CPU DAI driver and too fast actual sample rate for fs=44100. E.g.
+1 kHz tone has actual 1780 Hz frequency (1 kHz * 20070401/22579000 * 2).
+
+Fix this by increasing the correction passed to clk_set_rate() to take
+into account inaccuracy of the EPLL frequency properly.
+
+Fixes: fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate handling")
+Reported-by: JaeChul Lee <jcsing.lee@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/samsung/odroid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index e7b371b072304..45c6d73967852 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -64,11 +64,11 @@ static int odroid_card_hw_params(struct snd_pcm_substream *substream,
+ return ret;
+
+ /*
+- * We add 1 to the rclk_freq value in order to avoid too low clock
++ * We add 2 to the rclk_freq value in order to avoid too low clock
+ * frequency values due to the EPLL output frequency not being exact
+ * multiple of the audio sampling rate.
+ */
+- rclk_freq = params_rate(params) * rfs + 1;
++ rclk_freq = params_rate(params) * rfs + 2;
+
+ ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
+ if (ret < 0)
+--
+2.20.1
+
--- /dev/null
+From e3e7826394efc7fd10b99f7854a3b663d49e57ec Mon Sep 17 00:00:00 2001
+From: Rander Wang <rander.wang@linux.intel.com>
+Date: Fri, 8 Mar 2019 16:38:57 +0800
+Subject: ASoC:soc-pcm:fix a codec fixup issue in TDM case
+
+[ Upstream commit 570f18b6a8d1f0e60e8caf30e66161b6438dcc91 ]
+
+On HDaudio platforms, if playback is started when capture is working,
+there is no audible output.
+
+This can be root-caused to the use of the rx|tx_mask to store an HDaudio
+stream tag.
+
+If capture is stared before playback, rx_mask would be non-zero on HDaudio
+platform, then the channel number of playback, which is in the same codec
+dai with the capture, would be changed by soc_pcm_codec_params_fixup based
+on the tx_mask at first, then overwritten by this function based on rx_mask
+at last.
+
+According to the author of tx|rx_mask, tx_mask is for playback and rx_mask
+is for capture. And stream direction is checked at all other references of
+tx|rx_mask in ASoC, so here should be an error. This patch checks stream
+direction for tx|rx_mask for fixup function.
+
+This issue would affect not only HDaudio+ASoC, but also I2S codecs if the
+channel number based on rx_mask is not equal to the one for tx_mask. It could
+be rarely reproduecd because most drivers in kernel set the same channel number
+to tx|rx_mask or rx_mask is zero.
+
+Tested on all platforms using stream_tag & HDaudio and intel I2S platforms.
+
+Signed-off-by: Rander Wang <rander.wang@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index e8b98bfd4cf13..33060af18b5a4 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -957,10 +957,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ codec_params = *params;
+
+ /* fixup params based on TDM slot masks */
+- if (codec_dai->tx_mask)
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++ codec_dai->tx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->tx_mask);
+- if (codec_dai->rx_mask)
++
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
++ codec_dai->rx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->rx_mask);
+
+--
+2.20.1
+
--- /dev/null
+From 2c51c9ac1cda44e3c54e8633b1e4050e079ef6f8 Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Mon, 4 Mar 2019 15:52:44 +0100
+Subject: ASoC: stm32: dfsdm: fix debugfs warnings on entry creation
+
+[ Upstream commit c47255b61129857b74b0d86eaf59335348be05e0 ]
+
+Register platform component with a prefix, to avoid warnings
+on debugfs entries creation, due to component name
+redundancy.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_adfsdm.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c
+index 71d341b732a4d..24948b95eb19f 100644
+--- a/sound/soc/stm/stm32_adfsdm.c
++++ b/sound/soc/stm/stm32_adfsdm.c
+@@ -304,6 +304,7 @@ MODULE_DEVICE_TABLE(of, stm32_adfsdm_of_match);
+ static int stm32_adfsdm_probe(struct platform_device *pdev)
+ {
+ struct stm32_adfsdm_priv *priv;
++ struct snd_soc_component *component;
+ int ret;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+@@ -331,9 +332,15 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
+ if (IS_ERR(priv->iio_cb))
+ return PTR_ERR(priv->iio_cb);
+
+- ret = devm_snd_soc_register_component(&pdev->dev,
+- &stm32_adfsdm_soc_platform,
+- NULL, 0);
++ component = devm_kzalloc(&pdev->dev, sizeof(*component), GFP_KERNEL);
++ if (!component)
++ return -ENOMEM;
++#ifdef CONFIG_DEBUG_FS
++ component->debugfs_prefix = "pcm";
++#endif
++
++ ret = snd_soc_add_component(&pdev->dev, component,
++ &stm32_adfsdm_soc_platform, NULL, 0);
+ if (ret < 0)
+ dev_err(&pdev->dev, "%s: Failed to register PCM platform\n",
+ __func__);
+@@ -341,12 +348,20 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++static int stm32_adfsdm_remove(struct platform_device *pdev)
++{
++ snd_soc_unregister_component(&pdev->dev);
++
++ return 0;
++}
++
+ static struct platform_driver stm32_adfsdm_driver = {
+ .driver = {
+ .name = STM32_ADFSDM_DRV_NAME,
+ .of_match_table = stm32_adfsdm_of_match,
+ },
+ .probe = stm32_adfsdm_probe,
++ .remove = stm32_adfsdm_remove,
+ };
+
+ module_platform_driver(stm32_adfsdm_driver);
+--
+2.20.1
+
--- /dev/null
+From d6c3ab267c315ce9bd36e434c610b93de2684211 Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Mon, 4 Mar 2019 15:52:43 +0100
+Subject: ASoC: stm32: dfsdm: manage multiple prepare
+
+[ Upstream commit 19441e35a43b616ea6afad91ed0d9e77268d8f6a ]
+
+The DFSDM must be stopped when a new setting is applied.
+restart systematically DFSDM on multiple prepare calls,
+to apply changes.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_adfsdm.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/stm/stm32_adfsdm.c b/sound/soc/stm/stm32_adfsdm.c
+index 706ff005234f3..71d341b732a4d 100644
+--- a/sound/soc/stm/stm32_adfsdm.c
++++ b/sound/soc/stm/stm32_adfsdm.c
+@@ -9,6 +9,7 @@
+
+ #include <linux/clk.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+
+@@ -37,6 +38,8 @@ struct stm32_adfsdm_priv {
+ /* PCM buffer */
+ unsigned char *pcm_buff;
+ unsigned int pos;
++
++ struct mutex lock; /* protect against race condition on iio state */
+ };
+
+ static const struct snd_pcm_hardware stm32_adfsdm_pcm_hw = {
+@@ -62,10 +65,12 @@ static void stm32_adfsdm_shutdown(struct snd_pcm_substream *substream,
+ {
+ struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
+
++ mutex_lock(&priv->lock);
+ if (priv->iio_active) {
+ iio_channel_stop_all_cb(priv->iio_cb);
+ priv->iio_active = false;
+ }
++ mutex_unlock(&priv->lock);
+ }
+
+ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
+@@ -74,13 +79,19 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
+ struct stm32_adfsdm_priv *priv = snd_soc_dai_get_drvdata(dai);
+ int ret;
+
++ mutex_lock(&priv->lock);
++ if (priv->iio_active) {
++ iio_channel_stop_all_cb(priv->iio_cb);
++ priv->iio_active = false;
++ }
++
+ ret = iio_write_channel_attribute(priv->iio_ch,
+ substream->runtime->rate, 0,
+ IIO_CHAN_INFO_SAMP_FREQ);
+ if (ret < 0) {
+ dev_err(dai->dev, "%s: Failed to set %d sampling rate\n",
+ __func__, substream->runtime->rate);
+- return ret;
++ goto out;
+ }
+
+ if (!priv->iio_active) {
+@@ -92,6 +103,9 @@ static int stm32_adfsdm_dai_prepare(struct snd_pcm_substream *substream,
+ __func__, ret);
+ }
+
++out:
++ mutex_unlock(&priv->lock);
++
+ return ret;
+ }
+
+@@ -298,6 +312,7 @@ static int stm32_adfsdm_probe(struct platform_device *pdev)
+
+ priv->dev = &pdev->dev;
+ priv->dai_drv = stm32_adfsdm_dai;
++ mutex_init(&priv->lock);
+
+ dev_set_drvdata(&pdev->dev, priv);
+
+--
+2.20.1
+
--- /dev/null
+From d3ce649fca238eed706471f2c8d7f9d388ff00b9 Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Thu, 28 Feb 2019 14:19:22 +0100
+Subject: ASoC: stm32: sai: fix exposed capabilities in spdif mode
+
+[ Upstream commit b8468192971807c43a80d6e2c41f83141cb7b211 ]
+
+Change capabilities exposed in SAI S/PDIF mode, to match
+actually supported formats.
+In S/PDIF mode only 32 bits stereo is supported.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index e8df3cc341b5e..2fb2b914e78b4 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -498,6 +498,14 @@ static int stm32_sai_startup(struct snd_pcm_substream *substream,
+
+ sai->substream = substream;
+
++ if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
++ snd_pcm_hw_constraint_mask64(substream->runtime,
++ SNDRV_PCM_HW_PARAM_FORMAT,
++ SNDRV_PCM_FMTBIT_S32_LE);
++ snd_pcm_hw_constraint_single(substream->runtime,
++ SNDRV_PCM_HW_PARAM_CHANNELS, 2);
++ }
++
+ ret = clk_prepare_enable(sai->sai_ck);
+ if (ret < 0) {
+ dev_err(cpu_dai->dev, "Failed to enable clock: %d\n", ret);
+--
+2.20.1
+
--- /dev/null
+From 6b00122a6c2e236efc67f6ce2639816750c4b47f Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Thu, 28 Feb 2019 14:19:21 +0100
+Subject: ASoC: stm32: sai: fix iec958 controls indexation
+
+[ Upstream commit 5f8a1000c3e630c3ac06f1d664eeaa755bce8823 ]
+
+Allow indexation of sai iec958 controls according
+to device id.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 85c4b6d8e89db..e8df3cc341b5e 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -96,7 +96,7 @@
+ * @slot_mask: rx or tx active slots mask. set at init or at runtime
+ * @data_size: PCM data width. corresponds to PCM substream width.
+ * @spdif_frm_cnt: S/PDIF playback frame counter
+- * @snd_aes_iec958: iec958 data
++ * @iec958: iec958 data
+ * @ctrl_lock: control lock
+ */
+ struct stm32_sai_sub_data {
+@@ -888,11 +888,12 @@ static int stm32_sai_pcm_new(struct snd_soc_pcm_runtime *rtd,
+ struct snd_soc_dai *cpu_dai)
+ {
+ struct stm32_sai_sub_data *sai = dev_get_drvdata(cpu_dai->dev);
++ struct snd_kcontrol_new knew = iec958_ctls;
+
+ if (STM_SAI_PROTOCOL_IS_SPDIF(sai)) {
+ dev_dbg(&sai->pdev->dev, "%s: register iec controls", __func__);
+- return snd_ctl_add(rtd->pcm->card,
+- snd_ctl_new1(&iec958_ctls, sai));
++ knew.device = rtd->pcm->device;
++ return snd_ctl_add(rtd->pcm->card, snd_ctl_new1(&knew, sai));
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 0e53bf4ee2f08d1ef3c3fcae9c3b41d11ee67871 Mon Sep 17 00:00:00 2001
+From: Annaliese McDermond <nh6z@nh6z.net>
+Date: Sat, 30 Mar 2019 09:02:02 -0700
+Subject: ASoC: tlv320aic32x4: Fix Common Pins
+
+[ Upstream commit c63adb28f6d913310430f14c69f0a2ea55eed0cc ]
+
+The common pins were mistakenly not added to the DAPM graph.
+Adding these pins will allow valid graphs to be created.
+
+Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic32x4.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index f03195d2ab2ea..45d9f4a090441 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -462,6 +462,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("IN2_R"),
+ SND_SOC_DAPM_INPUT("IN3_L"),
+ SND_SOC_DAPM_INPUT("IN3_R"),
++ SND_SOC_DAPM_INPUT("CM_L"),
++ SND_SOC_DAPM_INPUT("CM_R"),
+ };
+
+ static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
+--
+2.20.1
+
--- /dev/null
+From 23d45d7fda72844e2c5971f12fe399bab9377c73 Mon Sep 17 00:00:00 2001
+From: Philipp Puschmann <philipp.puschmann@emlix.com>
+Date: Wed, 27 Feb 2019 16:17:33 +0100
+Subject: ASoC: tlv320aic3x: fix reset gpio reference counting
+
+[ Upstream commit 82ad759143ed77673db0d93d53c1cde7b99917ee ]
+
+This patch fixes a bug that prevents freeing the reset gpio on unloading
+the module.
+
+aic3x_i2c_probe is called when loading the module and it calls list_add
+with a probably uninitialized list entry aic3x->list (next = prev = NULL)).
+So even if list_del is called it does nothing and in the end the gpio_reset
+is not freed. Then a repeated module probing fails silently because
+gpio_request fails.
+
+When moving INIT_LIST_HEAD to aic3x_i2c_probe we also have to move
+list_del to aic3x_i2c_remove because aic3x_remove may be called
+multiple times without aic3x_i2c_remove being called which leads to
+a NULL pointer dereference.
+
+Signed-off-by: Philipp Puschmann <philipp.puschmann@emlix.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic3x.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index 6a271e6e6b8fc..6c0a3dad44b89 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -1599,7 +1599,6 @@ static int aic3x_probe(struct snd_soc_component *component)
+ struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
+ int ret, i;
+
+- INIT_LIST_HEAD(&aic3x->list);
+ aic3x->component = component;
+
+ for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++) {
+@@ -1682,7 +1681,6 @@ static void aic3x_remove(struct snd_soc_component *component)
+ struct aic3x_priv *aic3x = snd_soc_component_get_drvdata(component);
+ int i;
+
+- list_del(&aic3x->list);
+ for (i = 0; i < ARRAY_SIZE(aic3x->supplies); i++)
+ regulator_unregister_notifier(aic3x->supplies[i].consumer,
+ &aic3x->disable_nb[i].nb);
+@@ -1880,6 +1878,7 @@ static int aic3x_i2c_probe(struct i2c_client *i2c,
+ if (ret != 0)
+ goto err_gpio;
+
++ INIT_LIST_HEAD(&aic3x->list);
+ list_add(&aic3x->list, &reset_list);
+
+ return 0;
+@@ -1896,6 +1895,8 @@ static int aic3x_i2c_remove(struct i2c_client *client)
+ {
+ struct aic3x_priv *aic3x = i2c_get_clientdata(client);
+
++ list_del(&aic3x->list);
++
+ if (gpio_is_valid(aic3x->gpio_reset) &&
+ !aic3x_is_shared_reset(aic3x)) {
+ gpio_set_value(aic3x->gpio_reset, 0);
+--
+2.20.1
+
--- /dev/null
+From c36add181da5b4ea2f4d96b7976df9abebd3501a Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Tue, 19 Mar 2019 11:52:06 +0000
+Subject: ASoC: wm_adsp: Add locking to wm_adsp2_bus_error
+
+[ Upstream commit a2225a6d155fcb247fe4c6d87f7c91807462966d ]
+
+Best to lock across handling the bus error to ensure the DSP doesn't
+change power state as we are reading the status registers.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index a651fed62a27d..ee85056a85774 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -3819,11 +3819,13 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ struct regmap *regmap = dsp->regmap;
+ int ret = 0;
+
++ mutex_lock(&dsp->pwr_lock);
++
+ ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+ if (ret) {
+ adsp_err(dsp,
+ "Failed to read Region Lock Ctrl register: %d\n", ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+@@ -3842,7 +3844,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Bus Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "bus error address = 0x%x\n",
+@@ -3855,7 +3857,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Pmem Xmem Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "xmem error address = 0x%x\n",
+@@ -3868,6 +3870,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+ ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
++error:
++ mutex_unlock(&dsp->pwr_lock);
++
+ return IRQ_HANDLED;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+--
+2.20.1
+
--- /dev/null
+From e7fdade12497265520560ce7dfa8e7db594f9b9d Mon Sep 17 00:00:00 2001
+From: Maxime Jourdan <mjourdan@baylibre.com>
+Date: Tue, 19 Mar 2019 11:25:37 +0100
+Subject: clk: meson-gxbb: round the vdec dividers to closest
+
+[ Upstream commit 9b70c697e87286ade406e6a02091757307dd4b7c ]
+
+We want the video decoder clocks to always round to closest. While the
+muxes are already using CLK_MUX_ROUND_CLOSEST, the corresponding
+CLK_DIVIDER_ROUND_CLOSEST was forgotten for the dividers.
+
+Fix this by adding the flag to the two vdec dividers.
+
+Fixes: a565242eb9fc ("clk: meson: gxbb: add the video decoder clocks")
+Signed-off-by: Maxime Jourdan <mjourdan@baylibre.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lkml.kernel.org/r/20190319102537.2043-1-mjourdan@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 6628ffa31383a..4d4f6d842c31c 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -1571,6 +1571,7 @@ static struct clk_regmap gxbb_vdec_1_div = {
+ .offset = HHI_VDEC_CLK_CNTL,
+ .shift = 0,
+ .width = 7,
++ .flags = CLK_DIVIDER_ROUND_CLOSEST,
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "vdec_1_div",
+@@ -1616,6 +1617,7 @@ static struct clk_regmap gxbb_vdec_hevc_div = {
+ .offset = HHI_VDEC2_CLK_CNTL,
+ .shift = 16,
+ .width = 7,
++ .flags = CLK_DIVIDER_ROUND_CLOSEST,
+ },
+ .hw.init = &(struct clk_init_data){
+ .name = "vdec_hevc_div",
+--
+2.20.1
+
--- /dev/null
+From 55e1ac0f8dc4bae584f7bbcbca9de37abed2de38 Mon Sep 17 00:00:00 2001
+From: tiancyin <tianci.yin@amd.com>
+Date: Mon, 1 Apr 2019 10:15:31 +0800
+Subject: drm/amd/display: fix cursor black issue
+
+[ Upstream commit c1cefe115d1cdc460014483319d440b2f0d07c68 ]
+
+[Why]
+the member sdr_white_level of struct dc_cursor_attributes was not
+initialized, then the random value result that
+dcn10_set_cursor_sdr_white_level() set error hw_scale value 0x20D9(normal
+value is 0x3c00), this cause the black cursor issue.
+
+[how]
+just initilize the obj of struct dc_cursor_attributes to zero to avoid
+the random value.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Tianci Yin <tianci.yin@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 2b8b892eb846f..76ee2de43ea66 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4028,6 +4028,7 @@ static void handle_cursor_update(struct drm_plane *plane,
+ amdgpu_crtc->cursor_width = plane->state->crtc_w;
+ amdgpu_crtc->cursor_height = plane->state->crtc_h;
+
++ memset(&attributes, 0, sizeof(attributes));
+ attributes.address.high_part = upper_32_bits(address);
+ attributes.address.low_part = lower_32_bits(address);
+ attributes.width = plane->state->crtc_w;
+--
+2.20.1
+
--- /dev/null
+From a642ceaa6e1fc82a59026730dda33625a078da28 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 28 Mar 2019 17:31:30 +0300
+Subject: drm/mediatek: Fix an error code in mtk_hdmi_dt_parse_pdata()
+
+[ Upstream commit 2d85978341e6a32e7443d9f28639da254d53f400 ]
+
+We don't want to overwrite "ret", it already holds the correct error
+code. The "regmap" variable might be a valid pointer as this point.
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 643f5edd68fe3..c7a77d6f612b2 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1473,7 +1473,6 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ if (IS_ERR(regmap))
+ ret = PTR_ERR(regmap);
+ if (ret) {
+- ret = PTR_ERR(regmap);
+ dev_err(dev,
+ "Failed to get system configuration registers: %d\n",
+ ret);
+--
+2.20.1
+
--- /dev/null
+From c12a30e4ddb07538caf2ead9d3062d0096337932 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 4 Apr 2019 00:04:09 +0800
+Subject: drm/mediatek: fix possible object reference leak
+
+[ Upstream commit 2ae2c3316fb77dcf64275d011596b60104c45426 ]
+
+The call to of_parse_phandle returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+drivers/gpu/drm/mediatek/mtk_hdmi.c:1521:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function.
+drivers/gpu/drm/mediatek/mtk_hdmi.c:1524:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-mediatek@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index c7a77d6f612b2..62444a3a5742a 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1508,6 +1508,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ of_node_put(remote);
+
+ hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
++ of_node_put(i2c_np);
+ if (!hdmi->ddc_adpt) {
+ dev_err(dev, "Failed to get ddc i2c adapter by node\n");
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From ab478ee0c3f290c40dac5d1e42be49223a54a6c2 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 26 Mar 2019 08:14:37 -0700
+Subject: drm/omap: hdmi4_cec: Fix CEC clock handling for PM
+
+[ Upstream commit 36a1da15b5df493241b0011d2185fdd724ac1ed1 ]
+
+If CONFIG_OMAP4_DSS_HDMI_CEC is enabled in .config, deeper SoC idle
+states are blocked because the CEC clock gets always enabled on init.
+
+Let's fix the issue by moving the CEC clock handling to happen later in
+hdmi_cec_adap_enable() as suggested by Hans Verkuil <hverkuil@xs4all.nl>.
+This way the CEC clock gets only enabled when needed. This can be tested
+by doing cec-ctl --playback to enable the CEC, and doing cec-ctl --clear
+to disable it.
+
+Let's also fix the typo for "divider" in the comments while at it.
+
+Fixes: 8d7f934df8d8 ("omapdrm: hdmi4_cec: add OMAP4 HDMI CEC support")
+Suggested-by: Hans Verkuil <hverkuil@xs4all.nl>
+Cc: Hans Verkuil <hverkuil@xs4all.nl>
+Cc: Jyri Sarha <jsarha@ti.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190326151438.32414-1-tony@atomide.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c | 26 ++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+index 340383150fb98..ebf9c96d43eee 100644
+--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_cec.c
+@@ -175,6 +175,7 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ REG_FLD_MOD(core->base, HDMI_CORE_SYS_INTR_UNMASK4, 0, 3, 3);
+ hdmi_wp_clear_irqenable(core->wp, HDMI_IRQ_CORE);
+ hdmi_wp_set_irqstatus(core->wp, HDMI_IRQ_CORE);
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
+ hdmi4_core_disable(core);
+ return 0;
+ }
+@@ -182,16 +183,24 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ if (err)
+ return err;
+
++ /*
++ * Initialize CEC clock divider: CEC needs 2MHz clock hence
++ * set the divider to 24 to get 48/24=2MHz clock
++ */
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
++
+ /* Clear TX FIFO */
+ if (!hdmi_cec_clear_tx_fifo(adap)) {
+ pr_err("cec-%s: could not clear TX FIFO\n", adap->name);
+- return -EIO;
++ err = -EIO;
++ goto err_disable_clk;
+ }
+
+ /* Clear RX FIFO */
+ if (!hdmi_cec_clear_rx_fifo(adap)) {
+ pr_err("cec-%s: could not clear RX FIFO\n", adap->name);
+- return -EIO;
++ err = -EIO;
++ goto err_disable_clk;
+ }
+
+ /* Clear CEC interrupts */
+@@ -236,6 +245,12 @@ static int hdmi_cec_adap_enable(struct cec_adapter *adap, bool enable)
+ hdmi_write_reg(core->base, HDMI_CEC_INT_STATUS_1, temp);
+ }
+ return 0;
++
++err_disable_clk:
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
++ hdmi4_core_disable(core);
++
++ return err;
+ }
+
+ static int hdmi_cec_adap_log_addr(struct cec_adapter *adap, u8 log_addr)
+@@ -333,11 +348,8 @@ int hdmi4_cec_init(struct platform_device *pdev, struct hdmi_core_data *core,
+ return ret;
+ core->wp = wp;
+
+- /*
+- * Initialize CEC clock divider: CEC needs 2MHz clock hence
+- * set the devider to 24 to get 48/24=2MHz clock
+- */
+- REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0x18, 5, 0);
++ /* Disable clock initially, hdmi_cec_adap_enable() manages it */
++ REG_FLD_MOD(core->wp->base, HDMI_WP_CLK, 0, 5, 0);
+
+ ret = cec_register_adapter(core->adap, &pdev->dev);
+ if (ret < 0) {
+--
+2.20.1
+
--- /dev/null
+From 2350a6603b5c564196dfc6844efbbd76b6b25209 Mon Sep 17 00:00:00 2001
+From: Ondrej Jirman <megous@megous.com>
+Date: Sat, 6 Apr 2019 01:30:48 +0200
+Subject: drm/sun4i: tcon top: Fix NULL/invalid pointer dereference in
+ sun8i_tcon_top_un/bind
+
+[ Upstream commit 1a07a94b47b1f528f39c3e6187b5eaf02efe44ea ]
+
+There are two problems here:
+
+1. Not all clk_data->hws[] need to be initialized, depending on various
+ configured quirks. This leads to NULL ptr deref in
+ clk_hw_unregister_gate() in sun8i_tcon_top_unbind()
+2. If there is error when registering the clk_data->hws[],
+ err_unregister_gates error path will try to unregister
+ IS_ERR()=true (invalid) pointer.
+
+For problem (1) I have this stack trace:
+
+Unable to handle kernel NULL pointer dereference at virtual
+ address 0000000000000008
+Call trace:
+ clk_hw_unregister+0x8/0x18
+ clk_hw_unregister_gate+0x14/0x28
+ sun8i_tcon_top_unbind+0x2c/0x60
+ component_unbind.isra.4+0x2c/0x50
+ component_bind_all+0x1d4/0x230
+ sun4i_drv_bind+0xc4/0x1a0
+ try_to_bring_up_master+0x164/0x1c0
+ __component_add+0xa0/0x168
+ component_add+0x10/0x18
+ sun8i_dw_hdmi_probe+0x18/0x20
+ platform_drv_probe+0x3c/0x70
+ really_probe+0xcc/0x278
+ driver_probe_device+0x34/0xa8
+
+Problem (2) was identified by head scratching.
+
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190405233048.3823-1-megous@megous.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+index adcdf946c365d..dfbcd1ad81a54 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+@@ -217,7 +217,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
+
+ err_unregister_gates:
+ for (i = 0; i < CLK_NUM; i++)
+- if (clk_data->hws[i])
++ if (!IS_ERR_OR_NULL(clk_data->hws[i]))
+ clk_hw_unregister_gate(clk_data->hws[i]);
+ clk_disable_unprepare(tcon_top->bus);
+ err_assert_reset:
+@@ -235,7 +235,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master,
+
+ of_clk_del_provider(dev->of_node);
+ for (i = 0; i < CLK_NUM; i++)
+- clk_hw_unregister_gate(clk_data->hws[i]);
++ if (clk_data->hws[i])
++ clk_hw_unregister_gate(clk_data->hws[i]);
+
+ clk_disable_unprepare(tcon_top->bus);
+ reset_control_assert(tcon_top->rst);
+--
+2.20.1
+
--- /dev/null
+From 45b2f726129885a1e1ab78b4fc89958532026f72 Mon Sep 17 00:00:00 2001
+From: Kaike Wan <kaike.wan@intel.com>
+Date: Mon, 18 Mar 2019 09:55:39 -0700
+Subject: IB/hfi1: Eliminate opcode tests on mr deref
+
+[ Upstream commit a8639a79e85c18c16c10089edd589c7948f19bbd ]
+
+When an old ack_queue entry is used to store an incoming request, it may
+need to clean up the old entry if it is still referencing the
+MR. Originally only RDMA READ request needed to reference MR on the
+responder side and therefore the opcode was tested when cleaning up the
+old entry. The introduction of tid rdma specific operations in the
+ack_queue makes the specific opcode tests wrong. Multiple opcodes (RDMA
+READ, TID RDMA READ, and TID RDMA WRITE) may need MR ref cleanup.
+
+Remove the opcode specific tests associated with the ack_queue.
+
+Fixes: f48ad614c100 ("IB/hfi1: Move driver out of staging")
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/rc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index 6f013a565353f..770c78c657306 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -2303,7 +2303,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ update_ack_queue(qp, next);
+ }
+ e = &qp->s_ack_queue[qp->r_head_ack_queue];
+- if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
++ if (e->rdma_sge.mr) {
+ rvt_put_mr(e->rdma_sge.mr);
+ e->rdma_sge.mr = NULL;
+ }
+@@ -2377,7 +2377,7 @@ void hfi1_rc_rcv(struct hfi1_packet *packet)
+ update_ack_queue(qp, next);
+ }
+ e = &qp->s_ack_queue[qp->r_head_ack_queue];
+- if (e->opcode == OP(RDMA_READ_REQUEST) && e->rdma_sge.mr) {
++ if (e->rdma_sge.mr) {
+ rvt_put_mr(e->rdma_sge.mr);
+ e->rdma_sge.mr = NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From cbca3091c6a0589acf261d3278364254d92af6fc Mon Sep 17 00:00:00 2001
+From: Kaike Wan <kaike.wan@intel.com>
+Date: Mon, 18 Mar 2019 09:55:49 -0700
+Subject: IB/hfi1: Fix the allocation of RSM table
+
+[ Upstream commit d0294344470e6b52d097aa7369173f32d11f2f52 ]
+
+The receive side mapping (RSM) on hfi1 hardware is a special
+matching mechanism to direct an incoming packet to a given
+hardware receive context. It has 4 instances of matching capabilities
+(RSM0 - RSM3) that share the same RSM table (RMT). The RMT has a total of
+256 entries, each of which points to a receive context.
+
+Currently, three instances of RSM have been used:
+1. RSM0 by QOS;
+2. RSM1 by PSM FECN;
+3. RSM2 by VNIC.
+
+Each RSM instance should reserve enough entries in RMT to function
+properly. Since both PSM and VNIC could allocate any receive context
+between dd->first_dyn_alloc_ctxt and dd->num_rcv_contexts, PSM FECN must
+reserve enough RMT entries to cover the entire receive context index
+range (dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt) instead of only
+the user receive contexts allocated for PSM
+(dd->num_user_contexts). Consequently, the sizing of
+dd->num_user_contexts in set_up_context_variables is incorrect.
+
+Fixes: 2280740f01ae ("IB/hfi1: Virtual Network Interface Controller (VNIC) HW support")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 902d12d6d88b0..b12c8ff8ed666 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -13388,7 +13388,7 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ int total_contexts;
+ int ret;
+ unsigned ngroups;
+- int qos_rmt_count;
++ int rmt_count;
+ int user_rmt_reduced;
+ u32 n_usr_ctxts;
+ u32 send_contexts = chip_send_contexts(dd);
+@@ -13450,10 +13450,20 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
+ n_usr_ctxts = rcv_contexts - total_contexts;
+ }
+
+- /* each user context requires an entry in the RMT */
+- qos_rmt_count = qos_rmt_entries(dd, NULL, NULL);
+- if (qos_rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
+- user_rmt_reduced = NUM_MAP_ENTRIES - qos_rmt_count;
++ /*
++ * The RMT entries are currently allocated as shown below:
++ * 1. QOS (0 to 128 entries);
++ * 2. FECN for PSM (num_user_contexts + num_vnic_contexts);
++ * 3. VNIC (num_vnic_contexts).
++ * It should be noted that PSM FECN oversubscribe num_vnic_contexts
++ * entries of RMT because both VNIC and PSM could allocate any receive
++ * context between dd->first_dyn_alloc_text and dd->num_rcv_contexts,
++ * and PSM FECN must reserve an RMT entry for each possible PSM receive
++ * context.
++ */
++ rmt_count = qos_rmt_entries(dd, NULL, NULL) + (num_vnic_contexts * 2);
++ if (rmt_count + n_usr_ctxts > NUM_MAP_ENTRIES) {
++ user_rmt_reduced = NUM_MAP_ENTRIES - rmt_count;
+ dd_dev_err(dd,
+ "RMT size is reducing the number of user receive contexts from %u to %d\n",
+ n_usr_ctxts,
+@@ -14441,9 +14451,11 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
+ u64 reg;
+ int i, idx, regoff, regidx;
+ u8 offset;
++ u32 total_cnt;
+
+ /* there needs to be enough room in the map table */
+- if (rmt->used + dd->num_user_contexts >= NUM_MAP_ENTRIES) {
++ total_cnt = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt;
++ if (rmt->used + total_cnt >= NUM_MAP_ENTRIES) {
+ dd_dev_err(dd, "User FECN handling disabled - too many user contexts allocated\n");
+ return;
+ }
+@@ -14497,7 +14509,7 @@ static void init_user_fecn_handling(struct hfi1_devdata *dd,
+ /* add rule 1 */
+ add_rsm_rule(dd, RSM_INS_FECN, &rrd);
+
+- rmt->used += dd->num_user_contexts;
++ rmt->used += total_cnt;
+ }
+
+ /* Initialize RSM for VNIC */
+--
+2.20.1
+
--- /dev/null
+From 2ed49ebbe02beb07462ba0910287539f2ebd30b7 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 12 Apr 2019 12:50:31 +0200
+Subject: iommu/amd: Set exclusion range correctly
+
+[ Upstream commit 3c677d206210f53a4be972211066c0f1cd47fe12 ]
+
+The exlcusion range limit register needs to contain the
+base-address of the last page that is part of the range, as
+bits 0-11 of this register are treated as 0xfff by the
+hardware for comparisons.
+
+So correctly set the exclusion range in the hardware to the
+last page which is _in_ the range.
+
+Fixes: b2026aa2dce44 ('x86, AMD IOMMU: add functions for programming IOMMU MMIO space')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index be3801d43d48b..3a1d30304f7e9 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -356,7 +356,7 @@ static void iommu_write_l2(struct amd_iommu *iommu, u8 address, u32 val)
+ static void iommu_set_exclusion_range(struct amd_iommu *iommu)
+ {
+ u64 start = iommu->exclusion_start & PAGE_MASK;
+- u64 limit = (start + iommu->exclusion_length) & PAGE_MASK;
++ u64 limit = (start + iommu->exclusion_length - 1) & PAGE_MASK;
+ u64 entry;
+
+ if (!iommu->exclusion_start)
+--
+2.20.1
+
--- /dev/null
+From 064453197ac12024f16cfeef27687790e32c50e9 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Fri, 29 Mar 2019 22:46:49 +0100
+Subject: linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
+
+[ Upstream commit a0fe2c6479aab5723239b315ef1b552673f434a3 ]
+
+Use parentheses around uses of the argument in u64_to_user_ptr() to
+ensure that the cast doesn't apply to part of the argument.
+
+There are existing uses of the macro of the form
+
+ u64_to_user_ptr(A + B)
+
+which expands to
+
+ (void __user *)(uintptr_t)A + B
+
+(the cast applies to the first operand of the addition, the addition
+is a pointer addition). This happens to still work as intended, the
+semantic difference doesn't cause a difference in behavior.
+
+But I want to use u64_to_user_ptr() with a ternary operator in the
+argument, like so:
+
+ u64_to_user_ptr(A ? B : C)
+
+This currently doesn't work as intended.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Cc: Andrei Vagin <avagin@openvz.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qiaowei Ren <qiaowei.ren@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20190329214652.258477-1-jannh@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kernel.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index d6aac75b51baa..3d83ebb302cfd 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -73,8 +73,8 @@
+
+ #define u64_to_user_ptr(x) ( \
+ { \
+- typecheck(u64, x); \
+- (void __user *)(uintptr_t)x; \
++ typecheck(u64, (x)); \
++ (void __user *)(uintptr_t)(x); \
+ } \
+ )
+
+--
+2.20.1
+
--- /dev/null
+From 379ddf102e732cc58f90a149a9153754624d415d Mon Sep 17 00:00:00 2001
+From: Chong Qiao <qiaochong@loongson.cn>
+Date: Thu, 28 Mar 2019 07:08:01 +0800
+Subject: MIPS: KGDB: fix kgdb support for SMP platforms.
+
+[ Upstream commit ab8a6d821179ab9bea1a9179f535ccba6330c1ed ]
+
+KGDB_call_nmi_hook is called by other cpu through smp call.
+MIPS smp call is processed in ipi irq handler and regs is saved in
+ handle_int.
+So kgdb_call_nmi_hook get regs by get_irq_regs and regs will be passed
+ to kgdb_cpu_enter.
+
+Signed-off-by: Chong Qiao <qiaochong@loongson.cn>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: QiaoChong <qiaochong@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/kgdb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
+index eb6c0d582626b..2c1e30ca7ee4e 100644
+--- a/arch/mips/kernel/kgdb.c
++++ b/arch/mips/kernel/kgdb.c
+@@ -33,6 +33,7 @@
+ #include <asm/processor.h>
+ #include <asm/sigcontext.h>
+ #include <linux/uaccess.h>
++#include <asm/irq_regs.h>
+
+ static struct hard_trap_info {
+ unsigned char tt; /* Trap type code for MIPS R3xxx and R4xxx */
+@@ -214,7 +215,7 @@ static void kgdb_call_nmi_hook(void *ignored)
+ old_fs = get_fs();
+ set_fs(get_ds());
+
+- kgdb_nmicallback(raw_smp_processor_id(), NULL);
++ kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
+
+ set_fs(old_fs);
+ }
+--
+2.20.1
+
--- /dev/null
+From 6e762ddd44112bf469460e40a18a9ee6a9c677d0 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Mon, 8 Apr 2019 11:15:19 -0700
+Subject: nvme-fc: correct csn initialization and increments on error
+
+[ Upstream commit 67f471b6ed3b09033c4ac77ea03f92afdb1989fe ]
+
+This patch fixes a long-standing bug that initialized the FC-NVME
+cmnd iu CSN value to 1. Early FC-NVME specs had the connection starting
+with CSN=1. By the time the spec reached approval, the language had
+changed to state a connection should start with CSN=0. This patch
+corrects the initialization value for FC-NVME connections.
+
+Additionally, in reviewing the transport, the CSN value is assigned to
+the new IU early in the start routine. It's possible that a later dma
+map request may fail, causing the command to never be sent to the
+controller. Change the location of the assignment so that it is
+immediately prior to calling the lldd. Add a comment block to explain
+the impacts if the lldd were to additionally fail sending the command.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 9375fa705d829..67dec8860bf3c 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1844,7 +1844,7 @@ nvme_fc_init_queue(struct nvme_fc_ctrl *ctrl, int idx)
+ memset(queue, 0, sizeof(*queue));
+ queue->ctrl = ctrl;
+ queue->qnum = idx;
+- atomic_set(&queue->csn, 1);
++ atomic_set(&queue->csn, 0);
+ queue->dev = ctrl->dev;
+
+ if (idx > 0)
+@@ -1886,7 +1886,7 @@ nvme_fc_free_queue(struct nvme_fc_queue *queue)
+ */
+
+ queue->connection_id = 0;
+- atomic_set(&queue->csn, 1);
++ atomic_set(&queue->csn, 0);
+ }
+
+ static void
+@@ -2182,7 +2182,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
+ {
+ struct nvme_fc_cmd_iu *cmdiu = &op->cmd_iu;
+ struct nvme_command *sqe = &cmdiu->sqe;
+- u32 csn;
+ int ret, opstate;
+
+ /*
+@@ -2197,8 +2196,6 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
+
+ /* format the FC-NVME CMD IU and fcp_req */
+ cmdiu->connection_id = cpu_to_be64(queue->connection_id);
+- csn = atomic_inc_return(&queue->csn);
+- cmdiu->csn = cpu_to_be32(csn);
+ cmdiu->data_len = cpu_to_be32(data_len);
+ switch (io_dir) {
+ case NVMEFC_FCP_WRITE:
+@@ -2256,11 +2253,24 @@ nvme_fc_start_fcp_op(struct nvme_fc_ctrl *ctrl, struct nvme_fc_queue *queue,
+ if (!(op->flags & FCOP_FLAGS_AEN))
+ blk_mq_start_request(op->rq);
+
++ cmdiu->csn = cpu_to_be32(atomic_inc_return(&queue->csn));
+ ret = ctrl->lport->ops->fcp_io(&ctrl->lport->localport,
+ &ctrl->rport->remoteport,
+ queue->lldd_handle, &op->fcp_req);
+
+ if (ret) {
++ /*
++ * If the lld fails to send the command is there an issue with
++ * the csn value? If the command that fails is the Connect,
++ * no - as the connection won't be live. If it is a command
++ * post-connect, it's possible a gap in csn may be created.
++ * Does this matter? As Linux initiators don't send fused
++ * commands, no. The gap would exist, but as there's nothing
++ * that depends on csn order to be delivered on the target
++ * side, it shouldn't hurt. It would be difficult for a
++ * target to even detect the csn gap as it has no idea when the
++ * cmd with the csn was supposed to arrive.
++ */
+ opstate = atomic_xchg(&op->state, FCPOP_STATE_COMPLETE);
+ __nvme_fc_fcpop_chk_teardowns(ctrl, op, opstate);
+
+--
+2.20.1
+
--- /dev/null
+From fdfb7e5a85784134ebc515cde517d8fbe2831887 Mon Sep 17 00:00:00 2001
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 4 Apr 2019 12:17:35 -0500
+Subject: objtool: Add rewind_stack_do_exit() to the noreturn list
+
+[ Upstream commit 4fa5ecda2bf96be7464eb406df8aba9d89260227 ]
+
+This fixes the following warning seen on GCC 7.3:
+
+ arch/x86/kernel/dumpstack.o: warning: objtool: oops_end() falls through to next function show_regs()
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/3418ebf5a5a9f6ed7e80954c741c0b904b67b5dc.1554398240.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 550f17611bd75..ef152daccc333 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -165,6 +165,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
+ "fortify_panic",
+ "usercopy_abort",
+ "machine_real_restart",
++ "rewind_stack_do_exit",
+ };
+
+ if (func->bind == STB_WEAK)
+--
+2.20.1
+
--- /dev/null
+From 402f48b5b20808a80bfd5b69876889a61b5de87c Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 4 Apr 2019 15:03:00 +0200
+Subject: perf/core: Fix perf_event_disable_inatomic() race
+
+[ Upstream commit 1d54ad944074010609562da5c89e4f5df2f4e5db ]
+
+Thomas-Mich Richter reported he triggered a WARN()ing from event_function_local()
+on his s390. The problem boils down to:
+
+ CPU-A CPU-B
+
+ perf_event_overflow()
+ perf_event_disable_inatomic()
+ @pending_disable = 1
+ irq_work_queue();
+
+ sched-out
+ event_sched_out()
+ @pending_disable = 0
+
+ sched-in
+ perf_event_overflow()
+ perf_event_disable_inatomic()
+ @pending_disable = 1;
+ irq_work_queue(); // FAILS
+
+ irq_work_run()
+ perf_pending_event()
+ if (@pending_disable)
+ perf_event_disable_local(); // WHOOPS
+
+The problem exists in generic, but s390 is particularly sensitive
+because it doesn't implement arch_irq_work_raise(), nor does it call
+irq_work_run() from it's PMU interrupt handler (nor would that be
+sufficient in this case, because s390 also generates
+perf_event_overflow() from pmu::stop). Add to that the fact that s390
+is a virtual architecture and (virtual) CPU-A can stall long enough
+for the above race to happen, even if it would self-IPI.
+
+Adding a irq_work_sync() to event_sched_in() would work for all hardare
+PMUs that properly use irq_work_run() but fails for software PMUs.
+
+Instead encode the CPU number in @pending_disable, such that we can
+tell which CPU requested the disable. This then allows us to detect
+the above scenario and even redirect the IPI to make up for the failed
+queue.
+
+Reported-by: Thomas-Mich Richter <tmricht@linux.ibm.com>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Hendrik Brueckner <brueckner@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 52 ++++++++++++++++++++++++++++++-------
+ kernel/events/ring_buffer.c | 4 +--
+ 2 files changed, 45 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 87bd96399d1ce..171b83ebed4a3 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2007,8 +2007,8 @@ event_sched_out(struct perf_event *event,
+ event->pmu->del(event, 0);
+ event->oncpu = -1;
+
+- if (event->pending_disable) {
+- event->pending_disable = 0;
++ if (READ_ONCE(event->pending_disable) >= 0) {
++ WRITE_ONCE(event->pending_disable, -1);
+ state = PERF_EVENT_STATE_OFF;
+ }
+ perf_event_set_state(event, state);
+@@ -2196,7 +2196,8 @@ EXPORT_SYMBOL_GPL(perf_event_disable);
+
+ void perf_event_disable_inatomic(struct perf_event *event)
+ {
+- event->pending_disable = 1;
++ WRITE_ONCE(event->pending_disable, smp_processor_id());
++ /* can fail, see perf_pending_event_disable() */
+ irq_work_queue(&event->pending);
+ }
+
+@@ -5803,10 +5804,45 @@ void perf_event_wakeup(struct perf_event *event)
+ }
+ }
+
++static void perf_pending_event_disable(struct perf_event *event)
++{
++ int cpu = READ_ONCE(event->pending_disable);
++
++ if (cpu < 0)
++ return;
++
++ if (cpu == smp_processor_id()) {
++ WRITE_ONCE(event->pending_disable, -1);
++ perf_event_disable_local(event);
++ return;
++ }
++
++ /*
++ * CPU-A CPU-B
++ *
++ * perf_event_disable_inatomic()
++ * @pending_disable = CPU-A;
++ * irq_work_queue();
++ *
++ * sched-out
++ * @pending_disable = -1;
++ *
++ * sched-in
++ * perf_event_disable_inatomic()
++ * @pending_disable = CPU-B;
++ * irq_work_queue(); // FAILS
++ *
++ * irq_work_run()
++ * perf_pending_event()
++ *
++ * But the event runs on CPU-B and wants disabling there.
++ */
++ irq_work_queue_on(&event->pending, cpu);
++}
++
+ static void perf_pending_event(struct irq_work *entry)
+ {
+- struct perf_event *event = container_of(entry,
+- struct perf_event, pending);
++ struct perf_event *event = container_of(entry, struct perf_event, pending);
+ int rctx;
+
+ rctx = perf_swevent_get_recursion_context();
+@@ -5815,10 +5851,7 @@ static void perf_pending_event(struct irq_work *entry)
+ * and we won't recurse 'further'.
+ */
+
+- if (event->pending_disable) {
+- event->pending_disable = 0;
+- perf_event_disable_local(event);
+- }
++ perf_pending_event_disable(event);
+
+ if (event->pending_wakeup) {
+ event->pending_wakeup = 0;
+@@ -9969,6 +10002,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+
+
+ init_waitqueue_head(&event->waitq);
++ event->pending_disable = -1;
+ init_irq_work(&event->pending, perf_pending_event);
+
+ mutex_init(&event->mmap_mutex);
+diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
+index 474b2ccdbe69e..99c7f199f2d4e 100644
+--- a/kernel/events/ring_buffer.c
++++ b/kernel/events/ring_buffer.c
+@@ -393,7 +393,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
+ * store that will be enabled on successful return
+ */
+ if (!handle->size) { /* A, matches D */
+- event->pending_disable = 1;
++ event->pending_disable = smp_processor_id();
+ perf_output_wakeup(handle);
+ local_set(&rb->aux_nest, 0);
+ goto err_put;
+@@ -471,7 +471,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size)
+
+ if (wakeup) {
+ if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED)
+- handle->event->pending_disable = 1;
++ handle->event->pending_disable = smp_processor_id();
+ perf_output_wakeup(handle);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 38ee2243aff928af588b2c25995b006f533d3963 Mon Sep 17 00:00:00 2001
+From: Stephane Eranian <eranian@google.com>
+Date: Wed, 6 Mar 2019 11:50:48 -0800
+Subject: perf/x86/intel: Fix handling of wakeup_events for multi-entry PEBS
+
+[ Upstream commit 583feb08e7f7ac9d533b446882eb3a54737a6dbb ]
+
+When an event is programmed with attr.wakeup_events=N (N>0), it means
+the caller is interested in getting a user level notification after
+N samples have been recorded in the kernel sampling buffer.
+
+With precise events on Intel processors, the kernel uses PEBS.
+The kernel tries minimize sampling overhead by verifying
+if the event configuration is compatible with multi-entry PEBS mode.
+If so, the kernel is notified only when the buffer has reached its threshold.
+Other PEBS operates in single-entry mode, the kenrel is notified for each
+PEBS sample.
+
+The problem is that the current implementation look at frequency
+mode and event sample_type but ignores the wakeup_events field. Thus,
+it may not be possible to receive a notification after each precise event.
+
+This patch fixes this problem by disabling multi-entry PEBS if wakeup_events
+is non-zero.
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: kan.liang@intel.com
+Link: https://lkml.kernel.org/r/20190306195048.189514-1-eranian@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 3dd204d1dd194..26432ee4590e3 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3068,7 +3068,7 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ return ret;
+
+ if (event->attr.precise_ip) {
+- if (!event->attr.freq) {
++ if (!(event->attr.freq || event->attr.wakeup_events)) {
+ event->hw.flags |= PERF_X86_EVENT_AUTO_RELOAD;
+ if (!(event->attr.sample_type &
+ ~intel_pmu_large_pebs_flags(event)))
+--
+2.20.1
+
--- /dev/null
+From a305a02b5b0a9f45b7670fa77b1197812a7e6468 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 21 Mar 2019 13:38:49 +0100
+Subject: perf/x86/intel: Initialize TFA MSR
+
+[ Upstream commit d7262457e35dbe239659e62654e56f8ddb814bed ]
+
+Stephane reported that the TFA MSR is not initialized by the kernel,
+but the TFA bit could set by firmware or as a leftover from a kexec,
+which makes the state inconsistent.
+
+Reported-by: Stephane Eranian <eranian@google.com>
+Tested-by: Nelson DSouza <nelson.dsouza@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: tonyj@suse.com
+Link: https://lkml.kernel.org/r/20190321123849.GN6521@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 26432ee4590e3..f9958ad4d3353 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3447,6 +3447,12 @@ static void intel_pmu_cpu_starting(int cpu)
+
+ cpuc->lbr_sel = NULL;
+
++ if (x86_pmu.flags & PMU_FL_TFA) {
++ WARN_ON_ONCE(cpuc->tfa_shadow);
++ cpuc->tfa_shadow = ~0ULL;
++ intel_set_tfa(cpuc, false);
++ }
++
+ if (x86_pmu.version > 1)
+ flip_smm_bit(&x86_pmu.attr_freeze_on_smi);
+
+--
+2.20.1
+
--- /dev/null
+From 929e7636ddc662bab8f73dd77912ef7e33de5a6b Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@kernel.org>
+Date: Thu, 11 Apr 2019 10:22:43 -0700
+Subject: platform/x86: pmc_atom: Drop __initconst on dmi table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit b995dcca7cf12f208cfd95fd9d5768dca7cccec7 ]
+
+It's used by probe and that isn't an init function. Drop this so that we
+don't get a section mismatch.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Cc: David Müller <dave.mueller@gmx.ch>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Fixes: 7c2e07130090 ("clk: x86: Add system specific quirk to mark clocks as critical")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/pmc_atom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index eaec2d306481c..c7039f52ad518 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -396,7 +396,7 @@ static int pmc_dbgfs_register(struct pmc_dev *pmc)
+ * Some systems need one or more of their pmc_plt_clks to be
+ * marked as critical.
+ */
+-static const struct dmi_system_id critclk_systems[] __initconst = {
++static const struct dmi_system_id critclk_systems[] = {
+ {
+ .ident = "MPL CEC1x",
+ .matches = {
+--
+2.20.1
+
--- /dev/null
+From 7e7d0318ecdd65f91bfbbe02391bd731832e0c26 Mon Sep 17 00:00:00 2001
+From: Lijun Ou <oulijun@huawei.com>
+Date: Sun, 7 Apr 2019 13:23:38 +0800
+Subject: RDMA/hns: Fix bug that caused srq creation to fail
+
+[ Upstream commit 4772e03d239484f3461e33c79d721c8ea03f7416 ]
+
+Due to the incorrect use of the seg and obj information, the position of
+the mtt is calculated incorrectly, and the free space of the page is not
+enough to store the entire mtt, resulting in access to the next page. This
+patch fixes this problem.
+
+ Unable to handle kernel paging request at virtual address ffff00006e3cd000
+ ...
+ Call trace:
+ hns_roce_write_mtt+0x154/0x2f0 [hns_roce]
+ hns_roce_buf_write_mtt+0xa8/0xd8 [hns_roce]
+ hns_roce_create_srq+0x74c/0x808 [hns_roce]
+ ib_create_srq+0x28/0xc8
+
+Fixes: 0203b14c4f32 ("RDMA/hns: Unify the calculation for hem index in hip08")
+Signed-off-by: chenglang <chenglang@huawei.com>
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 6 ++++--
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index f6faefed96e8b..a73d388b70930 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -745,6 +745,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
+ idx_offset = (obj & (table->num_obj - 1)) % obj_per_chunk;
+ dma_offset = offset = idx_offset * table->obj_size;
+ } else {
++ u32 seg_size = 64; /* 8 bytes per BA and 8 BA per segment */
++
+ hns_roce_calc_hem_mhop(hr_dev, table, &mhop_obj, &mhop);
+ /* mtt mhop */
+ i = mhop.l0_idx;
+@@ -756,8 +758,8 @@ void *hns_roce_table_find(struct hns_roce_dev *hr_dev,
+ hem_idx = i;
+
+ hem = table->hem[hem_idx];
+- dma_offset = offset = (obj & (table->num_obj - 1)) *
+- table->obj_size % mhop.bt_chunk_size;
++ dma_offset = offset = (obj & (table->num_obj - 1)) * seg_size %
++ mhop.bt_chunk_size;
+ if (mhop.hop_num == 2)
+ dma_offset = offset = 0;
+ }
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index eb26a5f6fc58c..41a538d23b802 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -707,7 +707,6 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
+ struct hns_roce_hem_table *table;
+ dma_addr_t dma_handle;
+ __le64 *mtts;
+- u32 s = start_index * sizeof(u64);
+ u32 bt_page_size;
+ u32 i;
+
+@@ -730,7 +729,8 @@ static int hns_roce_write_mtt_chunk(struct hns_roce_dev *hr_dev,
+ table = &hr_dev->mr_table.mtt_cqe_table;
+
+ mtts = hns_roce_table_find(hr_dev, table,
+- mtt->first_seg + s / hr_dev->caps.mtt_entry_sz,
++ mtt->first_seg +
++ start_index / HNS_ROCE_MTT_ENTRY_PER_SEG,
+ &dma_handle);
+ if (!mtts)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 4704bfc0643b890b0e75eb38a5a682d65d166931 Mon Sep 17 00:00:00 2001
+From: Kamal Heib <kamalheib1@gmail.com>
+Date: Wed, 3 Apr 2019 16:52:54 +0300
+Subject: RDMA/vmw_pvrdma: Fix memory leak on pvrdma_pci_remove
+
+[ Upstream commit ea7a5c706fa49273cf6d1d9def053ecb50db2076 ]
+
+Make sure to free the DSR on pvrdma_pci_remove() to avoid the memory leak.
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Acked-by: Adit Ranadive <aditr@vmware.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index a5719899f49ad..ed99f0a08dc4e 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -1123,6 +1123,8 @@ static void pvrdma_pci_remove(struct pci_dev *pdev)
+ pvrdma_page_dir_cleanup(dev, &dev->cq_pdir);
+ pvrdma_page_dir_cleanup(dev, &dev->async_pdir);
+ pvrdma_free_slots(dev);
++ dma_free_coherent(&pdev->dev, sizeof(*dev->dsr), dev->dsr,
++ dev->dsrbase);
+
+ iounmap(dev->regs);
+ kfree(dev->sgid_tbl);
+--
+2.20.1
+
--- /dev/null
+From 1679a11063c1d4f39820ace0e182c16ac0862cd6 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 5 Apr 2019 20:39:13 +0530
+Subject: scsi: csiostor: fix missing data copy in csio_scsi_err_handler()
+
+[ Upstream commit 5c2442fd78998af60e13aba506d103f7f43f8701 ]
+
+If scsi cmd sglist is not suitable for DDP then csiostor driver uses
+preallocated buffers for DDP, because of this data copy is required from
+DDP buffer to scsi cmd sglist before calling ->scsi_done().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_scsi.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_scsi.c b/drivers/scsi/csiostor/csio_scsi.c
+index dab0d3f9bee13..e09c7f360dbde 100644
+--- a/drivers/scsi/csiostor/csio_scsi.c
++++ b/drivers/scsi/csiostor/csio_scsi.c
+@@ -1713,8 +1713,11 @@ csio_scsi_err_handler(struct csio_hw *hw, struct csio_ioreq *req)
+ }
+
+ out:
+- if (req->nsge > 0)
++ if (req->nsge > 0) {
+ scsi_dma_unmap(cmnd);
++ if (req->dcopy && (host_status == DID_OK))
++ host_status = csio_scsi_copy_to_sgl(hw, req);
++ }
+
+ cmnd->result = (((host_status) << 16) | scsi_status);
+ cmnd->scsi_done(cmnd);
+--
+2.20.1
+
ubsan-fix-nasty-wbuiltin-declaration-mismatch-gcc-9-warnings.patch
staging-greybus-power_supply-fix-prop-descriptor-request-size.patch
staging-most-cdev-fix-chrdev_region-leak-in-mod_exit.patch
+asoc-tlv320aic3x-fix-reset-gpio-reference-counting.patch
+asoc-hdmi-codec-fix-s-pdif-dai.patch
+asoc-stm32-sai-fix-iec958-controls-indexation.patch
+asoc-stm32-sai-fix-exposed-capabilities-in-spdif-mod.patch
+asoc-soc-pcm-fix-a-codec-fixup-issue-in-tdm-case.patch
+asoc-intel-skl-fix-a-simultaneous-playback-capture-i.patch
+asoc-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
+asoc-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
+asoc-samsung-odroid-fix-clock-configuration-for-4410.patch
+asoc-rt5682-recording-has-no-sound-after-booting.patch
+asoc-wm_adsp-add-locking-to-wm_adsp2_bus_error.patch
+clk-meson-gxbb-round-the-vdec-dividers-to-closest.patch
+asoc-stm32-dfsdm-manage-multiple-prepare.patch
+asoc-stm32-dfsdm-fix-debugfs-warnings-on-entry-creat.patch
+asoc-cs4270-set-auto-increment-bit-for-register-writ.patch
+asoc-dapm-fix-null-pointer-dereference-in-snd_soc_da.patch
+drm-omap-hdmi4_cec-fix-cec-clock-handling-for-pm.patch
+ib-hfi1-eliminate-opcode-tests-on-mr-deref.patch
+ib-hfi1-fix-the-allocation-of-rsm-table.patch
+mips-kgdb-fix-kgdb-support-for-smp-platforms.patch
+asoc-tlv320aic32x4-fix-common-pins.patch
+drm-mediatek-fix-an-error-code-in-mtk_hdmi_dt_parse_.patch
+perf-x86-intel-fix-handling-of-wakeup_events-for-mul.patch
+perf-x86-intel-initialize-tfa-msr.patch
+linux-kernel.h-use-parentheses-around-argument-in-u6.patch
+xtensa-fix-initialization-of-pt_regs-syscall-in-star.patch
+asoc-rockchip-pdm-fix-regmap_ops-hang-issue.patch
+drm-amd-display-fix-cursor-black-issue.patch
+asoc-cs35l35-disable-regulators-on-driver-removal.patch
+objtool-add-rewind_stack_do_exit-to-the-noreturn-lis.patch
+slab-fix-a-crash-by-reading-proc-slab_allocators.patch
+drm-sun4i-tcon-top-fix-null-invalid-pointer-derefere.patch
+virtio_pci-fix-a-null-pointer-reference-in-vp_del_vq.patch
+rdma-vmw_pvrdma-fix-memory-leak-on-pvrdma_pci_remove.patch
+rdma-hns-fix-bug-that-caused-srq-creation-to-fail.patch
+scsi-csiostor-fix-missing-data-copy-in-csio_scsi_err.patch
+drm-mediatek-fix-possible-object-reference-leak.patch
+asoc-intel-kbl-fix-wrong-number-of-channels.patch
+virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch
+nvme-fc-correct-csn-initialization-and-increments-on.patch
+platform-x86-pmc_atom-drop-__initconst-on-dmi-table.patch
+perf-core-fix-perf_event_disable_inatomic-race.patch
+iommu-amd-set-exclusion-range-correctly.patch
--- /dev/null
+From 34ec98605c366701b19aed8fbc5de84b880bd4bf Mon Sep 17 00:00:00 2001
+From: Qian Cai <cai@lca.pw>
+Date: Sat, 6 Apr 2019 18:59:01 -0400
+Subject: slab: fix a crash by reading /proc/slab_allocators
+
+[ Upstream commit fcf88917dd435c6a4cb2830cb086ee58605a1d85 ]
+
+The commit 510ded33e075 ("slab: implement slab_root_caches list")
+changes the name of the list node within "struct kmem_cache" from "list"
+to "root_caches_node", but leaks_show() still use the "list" which
+causes a crash when reading /proc/slab_allocators.
+
+You need to have CONFIG_SLAB=y and CONFIG_MEMCG=y to see the problem,
+because without MEMCG all slab caches are root caches, and the "list"
+node happens to be the right one.
+
+Fixes: 510ded33e075 ("slab: implement slab_root_caches list")
+Signed-off-by: Qian Cai <cai@lca.pw>
+Reviewed-by: Tobin C. Harding <tobin@kernel.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/slab.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/mm/slab.c b/mm/slab.c
+index b8e0ec74330f3..018d32496e8d1 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -4305,7 +4305,8 @@ static void show_symbol(struct seq_file *m, unsigned long address)
+
+ static int leaks_show(struct seq_file *m, void *p)
+ {
+- struct kmem_cache *cachep = list_entry(p, struct kmem_cache, list);
++ struct kmem_cache *cachep = list_entry(p, struct kmem_cache,
++ root_caches_node);
+ struct page *page;
+ struct kmem_cache_node *n;
+ const char *name;
+--
+2.20.1
+
--- /dev/null
+From 24ca25647f542d987e27df551901e4ada72c6400 Mon Sep 17 00:00:00 2001
+From: Dongli Zhang <dongli.zhang@oracle.com>
+Date: Wed, 27 Mar 2019 18:36:34 +0800
+Subject: virtio-blk: limit number of hw queues by nr_cpu_ids
+
+[ Upstream commit bf348f9b78d413e75bb079462751a1d86b6de36c ]
+
+When tag_set->nr_maps is 1, the block layer limits the number of hw queues
+by nr_cpu_ids. No matter how many hw queues are used by virtio-blk, as it
+has (tag_set->nr_maps == 1), it can use at most nr_cpu_ids hw queues.
+
+In addition, specifically for pci scenario, when the 'num-queues' specified
+by qemu is more than maxcpus, virtio-blk would not be able to allocate more
+than maxcpus vectors in order to have a vector for each queue. As a result,
+it falls back into MSI-X with one vector for config and one shared for
+queues.
+
+Considering above reasons, this patch limits the number of hw queues used
+by virtio-blk by nr_cpu_ids.
+
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 23752dc99b008..dd64f586679e1 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -446,6 +446,8 @@ static int init_vq(struct virtio_blk *vblk)
+ if (err)
+ num_vqs = 1;
+
++ num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
++
+ vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
+ if (!vblk->vqs)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 9c97b03462499e871671ac5b06cd96086928a0d3 Mon Sep 17 00:00:00 2001
+From: Longpeng <longpeng2@huawei.com>
+Date: Sat, 9 Mar 2019 15:17:40 +0800
+Subject: virtio_pci: fix a NULL pointer reference in vp_del_vqs
+
+[ Upstream commit 6a8aae68c87349dbbcd46eac380bc43cdb98a13b ]
+
+If the msix_affinity_masks is alloced failed, then we'll
+try to free some resources in vp_free_vectors() that may
+access it directly.
+
+We met the following stack in our production:
+[ 29.296767] BUG: unable to handle kernel NULL pointer dereference at (null)
+[ 29.311151] IP: [<ffffffffc04fe35a>] vp_free_vectors+0x6a/0x150 [virtio_pci]
+[ 29.324787] PGD 0
+[ 29.333224] Oops: 0000 [#1] SMP
+[...]
+[ 29.425175] RIP: 0010:[<ffffffffc04fe35a>] [<ffffffffc04fe35a>] vp_free_vectors+0x6a/0x150 [virtio_pci]
+[ 29.441405] RSP: 0018:ffff9a55c2dcfa10 EFLAGS: 00010206
+[ 29.453491] RAX: 0000000000000000 RBX: ffff9a55c322c400 RCX: 0000000000000000
+[ 29.467488] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9a55c322c400
+[ 29.481461] RBP: ffff9a55c2dcfa20 R08: 0000000000000000 R09: ffffc1b6806ff020
+[ 29.495427] R10: 0000000000000e95 R11: 0000000000aaaaaa R12: 0000000000000000
+[ 29.509414] R13: 0000000000010000 R14: ffff9a55bd2d9e98 R15: ffff9a55c322c400
+[ 29.523407] FS: 00007fdcba69f8c0(0000) GS:ffff9a55c2840000(0000) knlGS:0000000000000000
+[ 29.538472] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 29.551621] CR2: 0000000000000000 CR3: 000000003ce52000 CR4: 00000000003607a0
+[ 29.565886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 29.580055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 29.594122] Call Trace:
+[ 29.603446] [<ffffffffc04fe8a2>] vp_request_msix_vectors+0xe2/0x260 [virtio_pci]
+[ 29.618017] [<ffffffffc04fedc5>] vp_try_to_find_vqs+0x95/0x3b0 [virtio_pci]
+[ 29.632152] [<ffffffffc04ff117>] vp_find_vqs+0x37/0xb0 [virtio_pci]
+[ 29.645582] [<ffffffffc057bf63>] init_vq+0x153/0x260 [virtio_blk]
+[ 29.658831] [<ffffffffc057c1e8>] virtblk_probe+0xe8/0x87f [virtio_blk]
+[...]
+
+Cc: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Longpeng <longpeng2@huawei.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_pci_common.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index 465a6f5142cc5..45b04bc91f248 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev)
+ for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+ free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+- for (i = 0; i < vp_dev->msix_vectors; i++)
+- if (vp_dev->msix_affinity_masks[i])
+- free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ if (vp_dev->msix_affinity_masks) {
++ for (i = 0; i < vp_dev->msix_vectors; i++)
++ if (vp_dev->msix_affinity_masks[i])
++ free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ }
+
+ if (vp_dev->msix_enabled) {
+ /* Disable the vector used for configuration */
+--
+2.20.1
+
--- /dev/null
+From 0008f3f34df5efc48bcedfae9f77017c12498673 Mon Sep 17 00:00:00 2001
+From: Max Filippov <jcmvbkbc@gmail.com>
+Date: Wed, 3 Apr 2019 20:22:42 -0700
+Subject: xtensa: fix initialization of pt_regs::syscall in start_thread
+
+[ Upstream commit 2663147dc7465cb29040a05cc4286fdd839978b5 ]
+
+New pt_regs should indicate that there's no syscall, not that there's
+syscall #0. While at it wrap macro body in do/while and parenthesize
+macro arguments.
+
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/include/asm/processor.h | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
+index 677bc76c1d707..6e709fb562831 100644
+--- a/arch/xtensa/include/asm/processor.h
++++ b/arch/xtensa/include/asm/processor.h
+@@ -194,15 +194,18 @@ struct thread_struct {
+
+ /* Clearing a0 terminates the backtrace. */
+ #define start_thread(regs, new_pc, new_sp) \
+- memset(regs, 0, sizeof(*regs)); \
+- regs->pc = new_pc; \
+- regs->ps = USER_PS_VALUE; \
+- regs->areg[1] = new_sp; \
+- regs->areg[0] = 0; \
+- regs->wmask = 1; \
+- regs->depc = 0; \
+- regs->windowbase = 0; \
+- regs->windowstart = 1;
++ do { \
++ memset((regs), 0, sizeof(*(regs))); \
++ (regs)->pc = (new_pc); \
++ (regs)->ps = USER_PS_VALUE; \
++ (regs)->areg[1] = (new_sp); \
++ (regs)->areg[0] = 0; \
++ (regs)->wmask = 1; \
++ (regs)->depc = 0; \
++ (regs)->windowbase = 0; \
++ (regs)->windowstart = 1; \
++ (regs)->syscall = NO_SYSCALL; \
++ } while (0)
+
+ /* Forward declaration */
+ struct task_struct;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
