--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Sat, 5 May 2018 21:54:05 +0200
+Subject: agp: uninorth: make two functions static
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit dec60f3a9b7251f2657d743d96ba9a83dca02351 ]
+
+Both ‘uninorth_remove_memory’ and ‘null_cache_flush’ can be made
+static. So make them.
+
+Silence the following gcc warning (W=1):
+
+ drivers/char/agp/uninorth-agp.c:198:5: warning: no previous prototype for ‘uninorth_remove_memory’ [-Wmissing-prototypes]
+
+and
+
+ drivers/char/agp/uninorth-agp.c:473:6: warning: no previous prototype for ‘null_cache_flush’ [-Wmissing-prototypes]
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/agp/uninorth-agp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/agp/uninorth-agp.c
++++ b/drivers/char/agp/uninorth-agp.c
+@@ -196,7 +196,7 @@ static int uninorth_insert_memory(struct
+ return 0;
+ }
+
+-int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
++static int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
+ {
+ size_t i;
+ u32 *gp;
+@@ -467,7 +467,7 @@ static int uninorth_free_gatt_table(stru
+ return 0;
+ }
+
+-void null_cache_flush(void)
++static void null_cache_flush(void)
+ {
+ mb();
+ }
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: "Łukasz Stelmach" <l.stelmach@samsung.com>
+Date: Tue, 3 Apr 2018 09:04:57 +0100
+Subject: ARM: 8753/1: decompressor: add a missing parameter to the addruart macro
+
+From: "Łukasz Stelmach" <l.stelmach@samsung.com>
+
+[ Upstream commit e07e3c33b9c0b5751ade624f44325c9bf2487ea6 ]
+
+In commit 639da5ee374b ("ARM: add an extra temp register to the low
+level debugging addruart macro") an additional temporary register was
+added to the addruart macro, but the decompressor code wasn't updated.
+
+Fixes: 639da5ee374b ("ARM: add an extra temp register to the low level debugging addruart macro")
+Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/compressed/head.S | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -24,19 +24,19 @@
+ #if defined(CONFIG_DEBUG_ICEDCC)
+
+ #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_V6K) || defined(CONFIG_CPU_V7)
+- .macro loadsp, rb, tmp
++ .macro loadsp, rb, tmp1, tmp2
+ .endm
+ .macro writeb, ch, rb
+ mcr p14, 0, \ch, c0, c5, 0
+ .endm
+ #elif defined(CONFIG_CPU_XSCALE)
+- .macro loadsp, rb, tmp
++ .macro loadsp, rb, tmp1, tmp2
+ .endm
+ .macro writeb, ch, rb
+ mcr p14, 0, \ch, c8, c0, 0
+ .endm
+ #else
+- .macro loadsp, rb, tmp
++ .macro loadsp, rb, tmp1, tmp2
+ .endm
+ .macro writeb, ch, rb
+ mcr p14, 0, \ch, c1, c0, 0
+@@ -52,7 +52,7 @@
+ .endm
+
+ #if defined(CONFIG_ARCH_SA1100)
+- .macro loadsp, rb, tmp
++ .macro loadsp, rb, tmp1, tmp2
+ mov \rb, #0x80000000 @ physical base address
+ #ifdef CONFIG_DEBUG_LL_SER3
+ add \rb, \rb, #0x00050000 @ Ser3
+@@ -61,8 +61,8 @@
+ #endif
+ .endm
+ #else
+- .macro loadsp, rb, tmp
+- addruart \rb, \tmp
++ .macro loadsp, rb, tmp1, tmp2
++ addruart \rb, \tmp1, \tmp2
+ .endm
+ #endif
+ #endif
+@@ -1221,7 +1221,7 @@ phex: adr r3, phexbuf
+ b 1b
+
+ @ puts corrupts {r0, r1, r2, r3}
+-puts: loadsp r3, r1
++puts: loadsp r3, r2, r1
+ 1: ldrb r2, [r0], #1
+ teq r2, #0
+ moveq pc, lr
+@@ -1238,8 +1238,8 @@ puts: loadsp r3, r1
+ @ putc corrupts {r0, r1, r2, r3}
+ putc:
+ mov r2, r0
++ loadsp r3, r1, r0
+ mov r0, #0
+- loadsp r3, r1
+ b 2b
+
+ @ memdump corrupts {r0, r1, r2, r3, r10, r11, r12, lr}
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Wed, 25 Apr 2018 14:53:23 +0530
+Subject: ARM: davinci: board-dm355-evm: fix broken networking
+
+From: Sekhar Nori <nsekhar@ti.com>
+
+[ Upstream commit 5c054de228dd6d97bf8e38962bd118953b66e5a0 ]
+
+Since commit 09f3756bb9a8 ("dm9000: Return an ERR_PTR() in all
+error conditions of dm9000_parse_dt()"), passing either non-NULL
+platform data or device-tree for dm9000 driver to probe is
+mandatory.
+
+DM335 board was using none, so networking failed to initialize.
+Fix it by passing non-NULL (but empty) platform data.
+
+Fixes: 09f3756bb9a8 ("dm9000: Return an ERR_PTR() in all error conditions of dm9000_parse_dt()")
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-davinci/board-dm355-evm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/arm/mach-davinci/board-dm355-evm.c
++++ b/arch/arm/mach-davinci/board-dm355-evm.c
+@@ -18,6 +18,7 @@
+ #include <linux/i2c.h>
+ #include <linux/gpio.h>
+ #include <linux/clk.h>
++#include <linux/dm9000.h>
+ #include <linux/videodev2.h>
+ #include <media/tvp514x.h>
+ #include <linux/spi/spi.h>
+@@ -170,11 +171,16 @@ static struct resource dm355evm_dm9000_r
+ },
+ };
+
++static struct dm9000_plat_data dm335evm_dm9000_platdata;
++
+ static struct platform_device dm355evm_dm9000 = {
+ .name = "dm9000",
+ .id = -1,
+ .resource = dm355evm_dm9000_rsrc,
+ .num_resources = ARRAY_SIZE(dm355evm_dm9000_rsrc),
++ .dev = {
++ .platform_data = &dm335evm_dm9000_platdata,
++ },
+ };
+
+ static struct tvp514x_platform_data tvp5146_pdata = {
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Fri, 11 May 2018 20:51:36 +0530
+Subject: ARM: davinci: board-dm646x-evm: set VPIF capture card name
+
+From: Sekhar Nori <nsekhar@ti.com>
+
+[ Upstream commit bb7298a7e87cf3430eb62be8746e5d7a07ca9d7c ]
+
+VPIF capture driver expects card name to be set since it
+uses it without checking for NULL. The commit which
+introduced VPIF display and capture support added card
+name only for display, not for capture.
+
+Set it in platform data to probe driver successfully.
+
+While at it, also fix the display card name to something more
+appropriate.
+
+Fixes: 85609c1ccda6 ("DaVinci: DM646x - platform changes for vpif capture and display drivers")
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-davinci/board-dm646x-evm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-davinci/board-dm646x-evm.c
++++ b/arch/arm/mach-davinci/board-dm646x-evm.c
+@@ -538,7 +538,7 @@ static struct vpif_display_config dm646x
+ .outputs = dm6467_ch0_outputs,
+ .output_count = ARRAY_SIZE(dm6467_ch0_outputs),
+ },
+- .card_name = "DM646x EVM",
++ .card_name = "DM646x EVM Video Display",
+ };
+
+ /**
+@@ -696,6 +696,7 @@ static struct vpif_capture_config dm646x
+ .fid_pol = 0,
+ },
+ },
++ .card_name = "DM646x EVM Video Capture",
+ };
+
+ static void __init evm_init_video(void)
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 10 May 2018 14:24:20 +0100
+Subject: ARM: keystone: fix platform_domain_notifier array overrun
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 9954b80b8c0e8abc98e17bba0fccd9876211ceaa ]
+
+platform_domain_notifier contains a variable sized array, which the
+pm_clk_notify() notifier treats as a NULL terminated array:
+
+ for (con_id = clknb->con_ids; *con_id; con_id++)
+ pm_clk_add(dev, *con_id);
+
+Omitting the initialiser for con_ids means that the array is zero
+sized, and there is no NULL terminator. This leads to pm_clk_notify()
+overrunning into what ever structure follows, which may not be NULL.
+This leads to an oops:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000008c
+pgd = c0003000
+[0000008c] *pgd=80000800004003c, *pmd=00000000c
+Internal error: Oops: 206 [#1] PREEMPT SMP ARM
+Modules linked in:c
+CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.16.0+ #9
+Hardware name: Keystone
+PC is at strlen+0x0/0x34
+LR is at kstrdup+0x18/0x54
+pc : [<c0623340>] lr : [<c0111d6c>] psr: 20000013
+sp : eec73dc0 ip : eed780c0 fp : 00000001
+r10: 00000000 r9 : 00000000 r8 : eed71e10
+r7 : 0000008c r6 : 0000008c r5 : 014000c0 r4 : c03a6ff4
+r3 : c09445d0 r2 : 00000000 r1 : 014000c0 r0 : 0000008c
+Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 30c5387d Table: 00003000 DAC: fffffffd
+Process swapper/0 (pid: 1, stack limit = 0xeec72210)
+Stack: (0xeec73dc0 to 0xeec74000)
+...
+[<c0623340>] (strlen) from [<c0111d6c>] (kstrdup+0x18/0x54)
+[<c0111d6c>] (kstrdup) from [<c03a6ff4>] (__pm_clk_add+0x58/0x120)
+[<c03a6ff4>] (__pm_clk_add) from [<c03a731c>] (pm_clk_notify+0x64/0xa8)
+[<c03a731c>] (pm_clk_notify) from [<c004614c>] (notifier_call_chain+0x44/0x84)
+[<c004614c>] (notifier_call_chain) from [<c0046320>] (__blocking_notifier_call_chain+0x48/0x60)
+[<c0046320>] (__blocking_notifier_call_chain) from [<c0046350>] (blocking_notifier_call_chain+0x18/0x20)
+[<c0046350>] (blocking_notifier_call_chain) from [<c0390234>] (device_add+0x36c/0x534)
+[<c0390234>] (device_add) from [<c047fc00>] (of_platform_device_create_pdata+0x70/0xa4)
+[<c047fc00>] (of_platform_device_create_pdata) from [<c047fea0>] (of_platform_bus_create+0xf0/0x1ec)
+[<c047fea0>] (of_platform_bus_create) from [<c047fff8>] (of_platform_populate+0x5c/0xac)
+[<c047fff8>] (of_platform_populate) from [<c08b1f04>] (of_platform_default_populate_init+0x8c/0xa8)
+[<c08b1f04>] (of_platform_default_populate_init) from [<c000a78c>] (do_one_initcall+0x3c/0x164)
+[<c000a78c>] (do_one_initcall) from [<c087bd9c>] (kernel_init_freeable+0x10c/0x1d0)
+[<c087bd9c>] (kernel_init_freeable) from [<c0628db0>] (kernel_init+0x8/0xf0)
+[<c0628db0>] (kernel_init) from [<c00090d8>] (ret_from_fork+0x14/0x3c)
+Exception stack(0xeec73fb0 to 0xeec73ff8)
+3fa0: 00000000 00000000 00000000 00000000
+3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+3fe0: 00000000 00000000 00000000 00000000 00000013 00000000
+Code: e3520000 1afffff7 e12fff1e c0801730 (e5d02000)
+---[ end trace cafa8f148e262e80 ]---
+
+Fix this by adding the necessary initialiser.
+
+Fixes: fc20ffe1213b ("ARM: keystone: add PM domain support for clock management")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-keystone/pm_domain.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-keystone/pm_domain.c
++++ b/arch/arm/mach-keystone/pm_domain.c
+@@ -59,6 +59,7 @@ static struct dev_pm_domain keystone_pm_
+
+ static struct pm_clk_notifier_block platform_domain_notifier = {
+ .pm_domain = &keystone_pm_domain,
++ .con_ids = { NULL },
+ };
+
+ static struct of_device_id of_keystone_table[] = {
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 24 Apr 2018 13:11:22 +0100
+Subject: arm64: ptrace: remove addr_limit manipulation
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 59275a0c037ed6fabd6354730f1e3104264ab719 ]
+
+We transiently switch to KERNEL_DS in compat_ptrace_gethbpregs() and
+compat_ptrace_sethbpregs(), but in either case this is pointless as we
+don't perform any uaccess during this window.
+
+let's rip out the redundant addr_limit manipulation.
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/ptrace.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -945,9 +945,7 @@ static int compat_ptrace_gethbpregs(stru
+ {
+ int ret;
+ u32 kdata;
+- mm_segment_t old_fs = get_fs();
+
+- set_fs(KERNEL_DS);
+ /* Watchpoint */
+ if (num < 0) {
+ ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata);
+@@ -958,7 +956,6 @@ static int compat_ptrace_gethbpregs(stru
+ } else {
+ ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata);
+ }
+- set_fs(old_fs);
+
+ if (!ret)
+ ret = put_user(kdata, data);
+@@ -971,7 +968,6 @@ static int compat_ptrace_sethbpregs(stru
+ {
+ int ret;
+ u32 kdata = 0;
+- mm_segment_t old_fs = get_fs();
+
+ if (num == 0)
+ return 0;
+@@ -980,12 +976,10 @@ static int compat_ptrace_sethbpregs(stru
+ if (ret)
+ return ret;
+
+- set_fs(KERNEL_DS);
+ if (num < 0)
+ ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata);
+ else
+ ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata);
+- set_fs(old_fs);
+
+ return ret;
+ }
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Wed, 25 Apr 2018 15:08:53 -0700
+Subject: bpf: fix uninitialized variable in bpf tools
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 815425567dea6c54494e85050631d6bdda907c5d ]
+
+Here the variable cont is used as the saved_pointer for a call to
+strtok_r(). It is safe to use the value uninitialized in this
+context however and the later reference is only ever used if
+the strtok_r is successful. But, 'gcc-5' at least doesn't have all
+this knowledge so initialize cont to NULL. Additionally, do the
+natural NULL check before accessing just for completness.
+
+The warning is the following:
+
+./bpf/tools/bpf/bpf_dbg.c: In function ‘cmd_load’:
+./bpf/tools/bpf/bpf_dbg.c:1077:13: warning: ‘cont’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+ } else if (matches(subcmd, "pcap") == 0) {
+
+Fixes: fd981e3c321a "filter: bpf_dbg: add minimal bpf debugger"
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/net/bpf_dbg.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/tools/net/bpf_dbg.c
++++ b/tools/net/bpf_dbg.c
+@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file)
+
+ static int cmd_load(char *arg)
+ {
+- char *subcmd, *cont, *tmp = strdup(arg);
++ char *subcmd, *cont = NULL, *tmp = strdup(arg);
+ int ret = CMD_OK;
+
+ subcmd = strtok_r(tmp, " ", &cont);
+@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg)
+ bpf_reset();
+ bpf_reset_breakpoints();
+
+- ret = cmd_load_bpf(cont);
++ if (!cont)
++ ret = CMD_ERR;
++ else
++ ret = cmd_load_bpf(cont);
+ } else if (matches(subcmd, "pcap") == 0) {
+ ret = cmd_load_pcap(cont);
+ } else {
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Jakob Unterwurzacher <jakob.unterwurzacher@theobroma-systems.com>
+Date: Wed, 18 Apr 2018 16:10:03 +0200
+Subject: can: dev: increase bus-off message severity
+
+From: Jakob Unterwurzacher <jakob.unterwurzacher@theobroma-systems.com>
+
+[ Upstream commit 71c23a821c6bcacba71a094efe49ee689605906b ]
+
+bus-off is usually caused by hardware malfunction or configuration error
+(baud rate mismatch) and causes a complete loss of communication.
+
+Increase the "bus-off" message's severity from netdev_dbg() to
+netdev_info() to make it visible to the user.
+
+A can interface going into bus-off is similar in severity to ethernet's
+"Link is Down" message, which is also printed at info level.
+
+It is debatable whether the the "restarted" message should also be
+changed to netdev_info() to make the interface state changes
+comprehensible from the kernel log. I have chosen to keep the
+"restarted" message at dbg for now as the "bus-off" message should be
+enough for the user to notice and investigate the problem.
+
+Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@theobroma-systems.com>
+Cc: linux-can@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -471,7 +471,7 @@ void can_bus_off(struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+
+- netdev_dbg(dev, "bus-off\n");
++ netdev_info(dev, "bus-off\n");
+
+ netif_carrier_off(dev);
+ priv->can_stats.bus_off++;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Sat, 5 May 2018 22:00:37 +0200
+Subject: driver core: add __printf verification to __ata_ehi_pushv_desc
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit 0d74d872c3f8b9cb3d096fb932a063b43b37f188 ]
+
+__printf is useful to verify format and arguments. Remove the following
+warning (with W=1):
+
+ drivers/ata/libata-eh.c:183:10: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-eh.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -174,8 +174,8 @@ static void ata_eh_handle_port_resume(st
+ { }
+ #endif /* CONFIG_PM */
+
+-static void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, const char *fmt,
+- va_list args)
++static __printf(2, 0) void __ata_ehi_pushv_desc(struct ata_eh_info *ehi,
++ const char *fmt, va_list args)
+ {
+ ehi->desc_len += vscnprintf(ehi->desc + ehi->desc_len,
+ ATA_EH_DESC_LEN - ehi->desc_len,
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Tue, 3 Apr 2018 23:38:45 +0100
+Subject: drm/msm: Fix possible null dereference on failure of get_pages()
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+[ Upstream commit 3976626ea3d2011f8fd3f3a47070a8b792018253 ]
+
+Commit 62e3a3e342af changed get_pages() to initialise
+msm_gem_object::pages before trying to initialise msm_gem_object::sgt,
+so that put_pages() would properly clean up pages in the failure
+case.
+
+However, this means that put_pages() now needs to check that
+msm_gem_object::sgt is not null before trying to clean it up, and
+this check was only applied to part of the cleanup code. Move
+it all into the conditional block. (Strictly speaking we don't
+need to make the kfree() conditional, but since we can't avoid
+checking for null ourselves we may as well do so.)
+
+Fixes: 62e3a3e342af ("drm/msm: fix leak in failed get_pages")
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/msm_gem.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -110,17 +110,19 @@ static void put_pages(struct drm_gem_obj
+ struct msm_gem_object *msm_obj = to_msm_bo(obj);
+
+ if (msm_obj->pages) {
+- /* For non-cached buffers, ensure the new pages are clean
+- * because display controller, GPU, etc. are not coherent:
+- */
+- if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
+- dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
+- msm_obj->sgt->nents, DMA_BIDIRECTIONAL);
++ if (msm_obj->sgt) {
++ /* For non-cached buffers, ensure the new
++ * pages are clean because display controller,
++ * GPU, etc. are not coherent:
++ */
++ if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED))
++ dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl,
++ msm_obj->sgt->nents,
++ DMA_BIDIRECTIONAL);
+
+- if (msm_obj->sgt)
+ sg_free_table(msm_obj->sgt);
+-
+- kfree(msm_obj->sgt);
++ kfree(msm_obj->sgt);
++ }
+
+ if (iommu_present(&platform_bus_type))
+ drm_gem_put_pages(obj, msm_obj->pages, true, false);
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 29 Mar 2018 13:40:37 +0300
+Subject: drm/omap: fix possible NULL ref issue in tiler_reserve_2d
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+[ Upstream commit 6a0f0c55619f0b82a677cab72e77c3444a5eee58 ]
+
+tiler_reserve_2d allocates memory but does not check if it got the
+memory. Add the check and return ENOMEM on failure.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180329104038.29154-2-tomi.valkeinen@ti.com
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -356,11 +356,15 @@ int tiler_unpin(struct tiler_block *bloc
+ struct tiler_block *tiler_reserve_2d(enum tiler_fmt fmt, uint16_t w,
+ uint16_t h, uint16_t align)
+ {
+- struct tiler_block *block = kzalloc(sizeof(*block), GFP_KERNEL);
++ struct tiler_block *block;
+ u32 min_align = 128;
+ int ret;
+ unsigned long flags;
+
++ block = kzalloc(sizeof(*block), GFP_KERNEL);
++ if (!block)
++ return ERR_PTR(-ENOMEM);
++
+ BUG_ON(!validfmt(fmt));
+
+ /* convert width/height to slots */
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Thu, 5 Apr 2018 16:18:03 +0300
+Subject: fsnotify: fix ignore mask logic in send_to_group()
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 92183a42898dc400b89da35685d1814ac6acd3d8 ]
+
+The ignore mask logic in send_to_group() does not match the logic
+in fanotify_should_send_event(). In the latter, a vfsmount mark ignore
+mask precedes an inode mark mask and in the former, it does not.
+
+That difference may cause events to be sent to fanotify backend for no
+reason. Fix the logic in send_to_group() to match that of
+fanotify_should_send_event().
+
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/notify/fsnotify.c | 25 +++++++++++--------------
+ 1 file changed, 11 insertions(+), 14 deletions(-)
+
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -135,8 +135,9 @@ static int send_to_group(struct inode *t
+ const unsigned char *file_name)
+ {
+ struct fsnotify_group *group = NULL;
+- __u32 inode_test_mask = 0;
+- __u32 vfsmount_test_mask = 0;
++ __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
++ __u32 marks_mask = 0;
++ __u32 marks_ignored_mask = 0;
+
+ if (unlikely(!inode_mark && !vfsmount_mark)) {
+ BUG();
+@@ -156,29 +157,25 @@ static int send_to_group(struct inode *t
+ /* does the inode mark tell us to do something? */
+ if (inode_mark) {
+ group = inode_mark->group;
+- inode_test_mask = (mask & ~FS_EVENT_ON_CHILD);
+- inode_test_mask &= inode_mark->mask;
+- inode_test_mask &= ~inode_mark->ignored_mask;
++ marks_mask |= inode_mark->mask;
++ marks_ignored_mask |= inode_mark->ignored_mask;
+ }
+
+ /* does the vfsmount_mark tell us to do something? */
+ if (vfsmount_mark) {
+- vfsmount_test_mask = (mask & ~FS_EVENT_ON_CHILD);
+ group = vfsmount_mark->group;
+- vfsmount_test_mask &= vfsmount_mark->mask;
+- vfsmount_test_mask &= ~vfsmount_mark->ignored_mask;
+- if (inode_mark)
+- vfsmount_test_mask &= ~inode_mark->ignored_mask;
++ marks_mask |= vfsmount_mark->mask;
++ marks_ignored_mask |= vfsmount_mark->ignored_mask;
+ }
+
+ pr_debug("%s: group=%p to_tell=%p mask=%x inode_mark=%p"
+- " inode_test_mask=%x vfsmount_mark=%p vfsmount_test_mask=%x"
++ " vfsmount_mark=%p marks_mask=%x marks_ignored_mask=%x"
+ " data=%p data_is=%d cookie=%d\n",
+- __func__, group, to_tell, mask, inode_mark,
+- inode_test_mask, vfsmount_mark, vfsmount_test_mask, data,
++ __func__, group, to_tell, mask, inode_mark, vfsmount_mark,
++ marks_mask, marks_ignored_mask, data,
+ data_is, cookie);
+
+- if (!inode_test_mask && !vfsmount_test_mask)
++ if (!(test_mask & marks_mask & ~marks_ignored_mask))
+ return 0;
+
+ return group->ops->handle_event(group, to_tell, inode_mark,
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 6 Apr 2018 16:28:22 +0200
+Subject: hexagon: add memset_io() helper
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a57ab96ef9dde231d4d46edba4d5f73720edc16a ]
+
+We already have memcpy_toio(), but not memset_io(), so let's
+add the obvious version to allow building an allmodconfig kernel
+without errors like
+
+drivers/gpu/drm/ttm/ttm_bo_util.c: In function 'ttm_bo_move_memcpy':
+drivers/gpu/drm/ttm/ttm_bo_util.c:390:3: error: implicit declaration of function 'memset_io' [-Werror=implicit-function-declaration]
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Richard Kuo <rkuo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/hexagon/include/asm/io.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/hexagon/include/asm/io.h
++++ b/arch/hexagon/include/asm/io.h
+@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatile
+ memcpy((void *) dst, src, count);
+ }
+
++static inline void memset_io(volatile void __iomem *addr, int value,
++ size_t size)
++{
++ memset((void __force *)addr, value, size);
++}
++
+ #define PCI_IO_ADDR (volatile void __iomem *)
+
+ /*
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 6 Apr 2018 16:28:23 +0200
+Subject: hexagon: export csum_partial_copy_nocheck
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 330e261c35dfb969c48f996dbbc8b334b5ee8d9d ]
+
+This is needed to link ipv6 as a loadable module, which in turn happens
+in allmodconfig.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Richard Kuo <rkuo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/hexagon/lib/checksum.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/hexagon/lib/checksum.c
++++ b/arch/hexagon/lib/checksum.c
+@@ -201,3 +201,4 @@ csum_partial_copy_nocheck(const void *sr
+ memcpy(dst, src, len);
+ return csum_partial(dst, len, sum);
+ }
++EXPORT_SYMBOL(csum_partial_copy_nocheck);
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 9 May 2018 21:46:30 +0200
+Subject: i2c: pmcmsp: fix error return from master_xfer
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 12d9bbc5a7f347eaa65ff2a9d34995cadc05eb1b ]
+
+Returning -1 (-EPERM) is not appropriate here, go with -EIO.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: 1b144df1d7d6 ("i2c: New PMC MSP71xx TWI bus driver")
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-pmcmsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-pmcmsp.c
++++ b/drivers/i2c/busses/i2c-pmcmsp.c
+@@ -592,7 +592,7 @@ static int pmcmsptwi_master_xfer(struct
+ * TODO: We could potentially loop and retry in the case
+ * of MSP_TWI_XFER_TIMEOUT.
+ */
+- return -1;
++ return -EIO;
+ }
+
+ return num;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 9 May 2018 21:46:29 +0200
+Subject: i2c: pmcmsp: return message count on master_xfer success
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit de9a8634f1cb4560a35696d472cc7f1383d9b866 ]
+
+Returning zero is wrong in this case.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: 1b144df1d7d6 ("i2c: New PMC MSP71xx TWI bus driver")
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-pmcmsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-pmcmsp.c
++++ b/drivers/i2c/busses/i2c-pmcmsp.c
+@@ -595,7 +595,7 @@ static int pmcmsptwi_master_xfer(struct
+ return -1;
+ }
+
+- return 0;
++ return num;
+ }
+
+ static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter)
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Peter Rosin <peda@axentia.se>
+Date: Wed, 9 May 2018 21:47:48 +0200
+Subject: i2c: viperboard: return message count on master_xfer success
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 35cd67a0caf767aba472452865dcb4471fcce2b1 ]
+
+Returning zero is wrong in this case.
+
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: 174a13aa8669 ("i2c: Add viperboard i2c master driver")
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-viperboard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-viperboard.c
++++ b/drivers/i2c/busses/i2c-viperboard.c
+@@ -341,7 +341,7 @@ static int vprbrd_i2c_xfer(struct i2c_ad
+ }
+ mutex_unlock(&vb->lock);
+ }
+- return 0;
++ return num;
+ error:
+ mutex_unlock(&vb->lock);
+ return error;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: "Håkon Bugge" <haakon.bugge@oracle.com>
+Date: Wed, 18 Apr 2018 16:24:50 +0200
+Subject: IB/core: Make ib_mad_client_id atomic
+
+From: "Håkon Bugge" <haakon.bugge@oracle.com>
+
+[ Upstream commit db82476f37413eaeff5f836a9d8b022d6544accf ]
+
+Currently, the kernel protects access to the agent ID allocator on a per
+port basis using a spinlock, so it is impossible for two apps/threads on
+the same port to get the same TID, but it is entirely possible for two
+threads on different ports to end up with the same TID.
+
+As this can be confusing (regardless of it being legal according to the
+IB Spec 1.3, C13-18.1.1, in section 13.4.6.4 - TransactionID usage),
+and as the rdma-core user space API for /dev/umad devices implies unique
+TIDs even across ports, make the TID an atomic type so that no two
+allocations, regardless of port number, will be the same.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Reviewed-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/mad.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -62,7 +62,7 @@ MODULE_PARM_DESC(recv_queue_size, "Size
+ static struct kmem_cache *ib_mad_cache;
+
+ static struct list_head ib_mad_port_list;
+-static u32 ib_mad_client_id = 0;
++static atomic_t ib_mad_client_id = ATOMIC_INIT(0);
+
+ /* Port list lock */
+ static DEFINE_SPINLOCK(ib_mad_port_list_lock);
+@@ -376,7 +376,7 @@ struct ib_mad_agent *ib_register_mad_age
+ init_completion(&mad_agent_priv->comp);
+
+ spin_lock_irqsave(&port_priv->reg_lock, flags);
+- mad_agent_priv->agent.hi_tid = ++ib_mad_client_id;
++ mad_agent_priv->agent.hi_tid = atomic_inc_return(&ib_mad_client_id);
+
+ /*
+ * Make sure MAD registration (if supplied)
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Greg Thelen <gthelen@google.com>
+Date: Thu, 26 Apr 2018 11:19:35 -0700
+Subject: IB: make INFINIBAND_ADDR_TRANS configurable
+
+From: Greg Thelen <gthelen@google.com>
+
+[ Upstream commit f7cb7b85be55a4906b4b4b30596db1043dae6335 ]
+
+Allow INFINIBAND without INFINIBAND_ADDR_TRANS because fuzzing has been
+finding fair number of CM bugs. So provide option to disable it.
+
+Signed-off-by: Greg Thelen <gthelen@google.com>
+Cc: Tarick Bedeir <tarick@google.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/Kconfig | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/Kconfig
++++ b/drivers/infiniband/Kconfig
+@@ -39,9 +39,12 @@ config INFINIBAND_USER_MEM
+ default y
+
+ config INFINIBAND_ADDR_TRANS
+- bool
++ bool "RDMA/CM"
+ depends on INFINIBAND
+ default y
++ ---help---
++ Support for RDMA communication manager (CM).
++ This allows for a generic connection abstraction over RDMA.
+
+ source "drivers/infiniband/hw/mthca/Kconfig"
+ source "drivers/infiniband/hw/ipath/Kconfig"
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Greg Thelen <gthelen@google.com>
+Date: Thu, 26 Apr 2018 11:19:34 -0700
+Subject: ib_srp: depend on INFINIBAND_ADDR_TRANS
+
+From: Greg Thelen <gthelen@google.com>
+
+[ Upstream commit 5a3bc8a4abbd2d553430218d3a320400dce811b7 ]
+
+INFINIBAND_SRP code depends on INFINIBAND_ADDR_TRANS provided symbols.
+So declare the kconfig dependency. This is necessary to allow for
+enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
+
+Signed-off-by: Greg Thelen <gthelen@google.com>
+Cc: Tarick Bedeir <tarick@google.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/srp/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/srp/Kconfig
++++ b/drivers/infiniband/ulp/srp/Kconfig
+@@ -1,6 +1,6 @@
+ config INFINIBAND_SRP
+ tristate "InfiniBand SCSI RDMA Protocol"
+- depends on SCSI
++ depends on SCSI && INFINIBAND_ADDR_TRANS
+ select SCSI_SRP_ATTRS
+ ---help---
+ Support for the SCSI RDMA Protocol over InfiniBand. This
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Greg Thelen <gthelen@google.com>
+Date: Thu, 26 Apr 2018 11:19:32 -0700
+Subject: ib_srpt: depend on INFINIBAND_ADDR_TRANS
+
+From: Greg Thelen <gthelen@google.com>
+
+[ Upstream commit 346a47b65d10e450778ec0d21e4a9409f25daaa8 ]
+
+INFINIBAND_SRPT code depends on INFINIBAND_ADDR_TRANS provided symbols.
+So declare the kconfig dependency. This is necessary to allow for
+enabling INFINIBAND without INFINIBAND_ADDR_TRANS.
+
+Signed-off-by: Greg Thelen <gthelen@google.com>
+Cc: Tarick Bedeir <tarick@google.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/srpt/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/srpt/Kconfig
++++ b/drivers/infiniband/ulp/srpt/Kconfig
+@@ -1,6 +1,6 @@
+ config INFINIBAND_SRPT
+ tristate "InfiniBand SCSI RDMA Protocol target support"
+- depends on INFINIBAND && TARGET_CORE
++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE
+ ---help---
+
+ Support for the SCSI RDMA Protocol (SRP) Target driver. The
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Chengguang Xu <cgxu519@gmx.com>
+Date: Sat, 14 Apr 2018 20:16:06 +0800
+Subject: isofs: fix potential memory leak in mount option parsing
+
+From: Chengguang Xu <cgxu519@gmx.com>
+
+[ Upstream commit 4f34a5130a471f32f2fe7750769ab4057dc3eaa0 ]
+
+When specifying string type mount option (e.g., iocharset)
+several times in a mount, current option parsing may
+cause memory leak. Hence, call kfree for previous one
+in this case. Meanwhile, check memory allocation result
+for it.
+
+Signed-off-by: Chengguang Xu <cgxu519@gmx.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/isofs/inode.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -394,7 +394,10 @@ static int parse_options(char *options,
+ break;
+ #ifdef CONFIG_JOLIET
+ case Opt_iocharset:
++ kfree(popt->iocharset);
+ popt->iocharset = match_strdup(&args[0]);
++ if (!popt->iocharset)
++ return 0;
+ break;
+ #endif
+ case Opt_map_a:
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 30 Apr 2018 14:50:22 +0200
+Subject: kthread, sched/wait: Fix kthread_parkme() wait-loop
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 741a76b350897604c48fb12beff1c9b77724dc96 ]
+
+Gaurav reported a problem with __kthread_parkme() where a concurrent
+try_to_wake_up() could result in competing stores to ->state which,
+when the TASK_PARKED store got lost bad things would happen.
+
+The comment near set_current_state() actually mentions this competing
+store, but only mentions the case against TASK_RUNNING. This same
+store, with different timing, can happen against a subsequent !RUNNING
+store.
+
+This normally is not a problem, because as per that same comment, the
+!RUNNING state store is inside a condition based wait-loop:
+
+ for (;;) {
+ set_current_state(TASK_UNINTERRUPTIBLE);
+ if (!need_sleep)
+ break;
+ schedule();
+ }
+ __set_current_state(TASK_RUNNING);
+
+If we loose the (first) TASK_UNINTERRUPTIBLE store to a previous
+(concurrent) wakeup, the schedule() will NO-OP and we'll go around the
+loop once more.
+
+The problem here is that the TASK_PARKED store is not inside the
+KTHREAD_SHOULD_PARK condition wait-loop.
+
+There is a genuine issue with sleeps that do not have a condition;
+this is addressed in a subsequent patch.
+
+Reported-by: Gaurav Kohli <gkohli@codeaurora.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kthread.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -156,12 +156,13 @@ void *probe_kthread_data(struct task_str
+
+ static void __kthread_parkme(struct kthread *self)
+ {
+- __set_current_state(TASK_PARKED);
+- while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
++ for (;;) {
++ set_current_state(TASK_PARKED);
++ if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags))
++ break;
+ if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
+ complete(&self->parked);
+ schedule();
+- __set_current_state(TASK_PARKED);
+ }
+ clear_bit(KTHREAD_IS_PARKED, &self->flags);
+ __set_current_state(TASK_RUNNING);
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Ilan Peer <ilan.peer@intel.com>
+Date: Fri, 20 Apr 2018 13:49:20 +0300
+Subject: mac80211: Adjust SAE authentication timeout
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 407879b690ba3a6bf29be896d02dad63463bd1c0 ]
+
+The IEEE P802.11-REVmd D1.0 specification updated the SAE authentication
+timeout to be 2000 milliseconds (see dot11RSNASAERetransPeriod). Update
+the SAE timeout setting accordingly.
+
+While at it, reduce some code duplication in the timeout configuration.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/mlme.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -34,6 +34,7 @@
+ #define IEEE80211_AUTH_TIMEOUT (HZ / 5)
+ #define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2)
+ #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10)
++#define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2)
+ #define IEEE80211_AUTH_MAX_TRIES 3
+ #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
+ #define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
+@@ -3464,16 +3465,19 @@ static int ieee80211_probe_auth(struct i
+ }
+
+ if (tx_flags == 0) {
+- auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+- auth_data->timeout_started = true;
+- run_again(sdata, auth_data->timeout);
++ if (auth_data->algorithm == WLAN_AUTH_SAE)
++ auth_data->timeout = jiffies +
++ IEEE80211_AUTH_TIMEOUT_SAE;
++ else
++ auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+ } else {
+ auth_data->timeout =
+ round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
+- auth_data->timeout_started = true;
+- run_again(sdata, auth_data->timeout);
+ }
+
++ auth_data->timeout_started = true;
++ run_again(sdata, auth_data->timeout);
++
+ return 0;
+ }
+
+@@ -3545,8 +3549,15 @@ void ieee80211_sta_work(struct ieee80211
+ if (ifmgd->auth_data &&
+ (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
+ if (status_acked) {
+- ifmgd->auth_data->timeout =
+- jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
++ if (ifmgd->auth_data->algorithm ==
++ WLAN_AUTH_SAE)
++ ifmgd->auth_data->timeout =
++ jiffies +
++ IEEE80211_AUTH_TIMEOUT_SAE;
++ else
++ ifmgd->auth_data->timeout =
++ jiffies +
++ IEEE80211_AUTH_TIMEOUT_SHORT;
+ run_again(sdata, ifmgd->auth_data->timeout);
+ } else {
+ ifmgd->auth_data->timeout = jiffies - 1;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Sinan Kaya <okaya@codeaurora.org>
+Date: Thu, 12 Apr 2018 22:30:44 -0400
+Subject: MIPS: io: Add barrier after register read in readX()
+
+From: Sinan Kaya <okaya@codeaurora.org>
+
+[ Upstream commit a1cc7034e33d12dc17d13fbcd7d597d552889097 ]
+
+While a barrier is present in the writeX() functions before the register
+write, a similar barrier is missing in the readX() functions after the
+register read. This could allow memory accesses following readX() to
+observe stale data.
+
+Signed-off-by: Sinan Kaya <okaya@codeaurora.org>
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/19069/
+[jhogan@kernel.org: Tidy commit message]
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/include/asm/io.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -375,6 +375,8 @@ static inline type pfx##read##bwlq(const
+ BUG(); \
+ } \
+ \
++ /* prevent prefetching of coherent DMA data prematurely */ \
++ rmb(); \
+ return pfx##ioswab##bwlq(__mem, __val); \
+ }
+
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Jingju Hou <Jingju.Hou@synaptics.com>
+Date: Mon, 23 Apr 2018 15:22:49 +0800
+Subject: net: phy: marvell: clear wol event before setting it
+
+From: Jingju Hou <Jingju.Hou@synaptics.com>
+
+[ Upstream commit b6a930fa88083b41d26ddf1cab95cbd740936c22 ]
+
+If WOL event happened once, the LED[2] interrupt pin will not be
+cleared unless we read the CSISR register. If interrupts are in use,
+the normal interrupt handling will clear the WOL event. Let's clear the
+WOL event before enabling it if !phy_interrupt_is_valid().
+
+Signed-off-by: Jingju Hou <Jingju.Hou@synaptics.com>
+Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/marvell.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -828,6 +828,15 @@ static int m88e1318_set_wol(struct phy_d
+ if (err < 0)
+ return err;
+
++ /* If WOL event happened once, the LED[2] interrupt pin
++ * will not be cleared unless we reading the interrupt status
++ * register. If interrupts are in use, the normal interrupt
++ * handling will clear the WOL event. Clear the WOL event
++ * before enabling it if !phy_interrupt_is_valid()
++ */
++ if (!phy_interrupt_is_valid(phydev))
++ phy_read(phydev, MII_M1011_IEVENT);
++
+ /* Enable the WOL interrupt */
+ temp = phy_read(phydev, MII_88E1318S_PHY_CSIER);
+ temp |= MII_88E1318S_PHY_CSIER_WOL_EIE;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 20 Apr 2018 23:19:17 +0200
+Subject: parisc: drivers.c: Fix section mismatches
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit b819439fea305a0bfd6ca23a7994fd1a8847c0d8 ]
+
+Fix two section mismatches in drivers.c:
+1) Section mismatch in reference from the function alloc_tree_node() to
+ the function .init.text:create_tree_node().
+2) Section mismatch in reference from the function walk_native_bus() to
+ the function .init.text:alloc_pa_dev().
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/kernel/drivers.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -448,7 +448,8 @@ static int match_by_id(struct device * d
+ * Checks all the children of @parent for a matching @id. If none
+ * found, it allocates a new device and returns it.
+ */
+-static struct parisc_device * alloc_tree_node(struct device *parent, char id)
++static struct parisc_device * __init alloc_tree_node(
++ struct device *parent, char id)
+ {
+ struct match_id_data d = {
+ .id = id,
+@@ -822,8 +823,8 @@ void walk_lower_bus(struct parisc_device
+ * devices which are not physically connected (such as extra serial &
+ * keyboard ports). This problem is not yet solved.
+ */
+-static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high,
+- struct device *parent)
++static void __init walk_native_bus(unsigned long io_io_low,
++ unsigned long io_io_high, struct device *parent)
+ {
+ int i, devices_found = 0;
+ unsigned long hpa = io_io_low;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 18 May 2018 16:12:12 +0200
+Subject: parisc: Move setup_profiling_timer() out of init section
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 01f56832cfb6fcc204e7203f46841b6185ebd574 ]
+
+No other architecture has setup_profiling_timer() in the init section,
+thus on parisc we face this section mismatch warning:
+ Reference from the function devm_device_add_group() to the function .init.text:setup_profiling_timer()
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/kernel/smp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/parisc/kernel/smp.c
++++ b/arch/parisc/kernel/smp.c
+@@ -422,8 +422,7 @@ int __cpu_up(unsigned int cpu, struct ta
+ }
+
+ #ifdef CONFIG_PROC_FS
+-int __init
+-setup_profiling_timer(unsigned int multiplier)
++int setup_profiling_timer(unsigned int multiplier)
+ {
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Baolin Wang <baolin.wang@linaro.org>
+Date: Thu, 19 Apr 2018 14:51:03 +0800
+Subject: parisc: time: Convert read_persistent_clock() to read_persistent_clock64()
+
+From: Baolin Wang <baolin.wang@linaro.org>
+
+[ Upstream commit f76cdd00ef0e39d880139b074e3b247594dff95a ]
+
+The read_persistent_clock() uses a timespec, which is not year 2038 safe
+on 32bit systems. On parisc architecture, we have implemented generic
+RTC drivers that can be used to compensate the system suspend time, but
+the RTC time can not represent the nanosecond resolution, so this patch
+just converts to read_persistent_clock64() with timespec64.
+
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/kernel/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/parisc/kernel/time.c
++++ b/arch/parisc/kernel/time.c
+@@ -246,7 +246,7 @@ static int __init rtc_init(void)
+ }
+ module_init(rtc_init);
+
+-void read_persistent_clock(struct timespec *ts)
++void read_persistent_clock64(struct timespec64 *ts)
+ {
+ static struct pdc_tod tod_data;
+ if (pdc_tod_read(&tod_data) == 0) {
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Fri, 4 May 2018 18:44:24 +0530
+Subject: powerpc/trace/syscalls: Update syscall name matching logic
+
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit 0b7758aaf6543b9a10c8671db559e9d374a3fd95 ]
+
+On powerpc64 ABIv1, we are enabling syscall tracing for only ~20
+syscalls. This is due to commit e145242ea0df6 ("syscalls/core,
+syscalls/x86: Clean up syscall stub naming convention") which has
+changed the syscall entry wrapper prefix from "SyS" to "__se_sys".
+
+Update the logic for ABIv1 to not just skip the initial dot, but also
+the "__se_sys" prefix.
+
+Fixes: commit e145242ea0df6 ("syscalls/core, syscalls/x86: Clean up syscall stub naming convention")
+Reported-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/ftrace.h | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/arch/powerpc/include/asm/ftrace.h
++++ b/arch/powerpc/include/asm/ftrace.h
+@@ -65,13 +65,9 @@ struct dyn_arch_ftrace {
+ #define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
+ static inline bool arch_syscall_match_sym_name(const char *sym, const char *name)
+ {
+- /*
+- * Compare the symbol name with the system call name. Skip the .sys or .SyS
+- * prefix from the symbol name and the sys prefix from the system call name and
+- * just match the rest. This is only needed on ppc64 since symbol names on
+- * 32bit do not start with a period so the generic function will work.
+- */
+- return !strcmp(sym + 4, name + 3);
++ /* We need to skip past the initial dot, and the __se_sys alias */
++ return !strcmp(sym + 1, name) ||
++ (!strncmp(sym, ".__se_sys", 9) && !strcmp(sym + 6, name));
+ }
+ #endif
+ #endif /* CONFIG_FTRACE_SYSCALLS && CONFIG_PPC64 && !__ASSEMBLY__ */
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Dag Moxnes <dag.moxnes@oracle.com>
+Date: Wed, 25 Apr 2018 13:22:01 +0200
+Subject: rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
+
+From: Dag Moxnes <dag.moxnes@oracle.com>
+
+[ Upstream commit 91a825290ca4eae88603bc811bf74a45f94a3f46 ]
+
+The function rds_ib_setup_qp is calling rds_ib_get_client_data and
+should correspondingly call rds_ib_dev_put. This call was lost in
+the non-error path with the introduction of error handling done in
+commit 3b12f73a5c29 ("rds: ib: add error handle")
+
+Signed-off-by: Dag Moxnes <dag.moxnes@oracle.com>
+Reviewed-by: Håkon Bugge <haakon.bugge@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rds/ib_cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/rds/ib_cm.c
++++ b/net/rds/ib_cm.c
+@@ -396,7 +396,7 @@ static int rds_ib_setup_qp(struct rds_co
+ rdsdebug("conn %p pd %p mr %p cq %p %p\n", conn, ic->i_pd, ic->i_mr,
+ ic->i_send_cq, ic->i_recv_cq);
+
+- return ret;
++ goto out;
+
+ sends_out:
+ vfree(ic->i_sends);
+@@ -421,6 +421,7 @@ send_cq_out:
+ ic->i_send_cq = NULL;
+ rds_ibdev_out:
+ rds_ib_remove_conn(rds_ibdev, conn);
++out:
+ rds_ib_dev_put(rds_ibdev);
+
+ return ret;
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Tue, 3 Apr 2018 11:08:52 +0200
+Subject: s390/smsgiucv: disable SMSG on module unload
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+[ Upstream commit 760dd0eeaec1689430243ead14e5a429613d8c52 ]
+
+The module exit function of the smsgiucv module uses the incorrect CP
+command to disable SMSG messages. The correct command is "SET SMSG OFF".
+Use it.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/net/smsgiucv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/net/smsgiucv.c
++++ b/drivers/s390/net/smsgiucv.c
+@@ -190,7 +190,7 @@ static struct device_driver smsg_driver
+
+ static void __exit smsg_exit(void)
+ {
+- cpcmd("SET SMSG IUCV", NULL, 0, NULL);
++ cpcmd("SET SMSG OFF", NULL, 0, NULL);
+ device_unregister(smsg_dev);
+ iucv_unregister(&smsg_handler, 1);
+ driver_unregister(&smsg_driver);
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 20 Apr 2018 10:57:16 +0100
+Subject: scsi: isci: Fix infinite loop in while loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 4bc83b3f272fe8f36450f9c003df49cf07ffe5fd ]
+
+In the case when the phy_mask is bitwise anded with the phy_index bit is
+zero the continue statement currently jumps to the next iteration of the
+while loop and phy_index is never actually incremented, potentially
+causing an infinite loop if phy_index is less than SCI_MAX_PHS. Fix this
+by turning the while loop into a for loop.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/isci/port_config.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/isci/port_config.c
++++ b/drivers/scsi/isci/port_config.c
+@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration
+ * Note: We have not moved the current phy_index so we will actually
+ * compare the startting phy with itself.
+ * This is expected and required to add the phy to the port. */
+- while (phy_index < SCI_MAX_PHYS) {
++ for (; phy_index < SCI_MAX_PHYS; phy_index++) {
+ if ((phy_mask & (1 << phy_index)) == 0)
+ continue;
+ sci_phy_get_sas_address(&ihost->phys[phy_index],
+@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration
+ &ihost->phys[phy_index]);
+
+ assigned_phy_mask |= (1 << phy_index);
+- phy_index++;
+ }
+
+ }
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Chris Leech <cleech@redhat.com>
+Date: Mon, 9 Apr 2018 15:15:28 -0700
+Subject: scsi: iscsi: respond to netlink with unicast when appropriate
+
+From: Chris Leech <cleech@redhat.com>
+
+[ Upstream commit af17092810a887178195276255b7b31f8fbe7dbe ]
+
+Instead of always multicasting responses, send a unicast netlink message
+directed at the correct pid. This will be needed if we ever want to
+support multiple userspace processes interacting with the kernel over
+iSCSI netlink simultaneously. Limitations can currently be seen if you
+attempt to run multiple iscsistart commands in parallel.
+
+We've fixed up the userspace issues in iscsistart that prevented
+multiple instances from running, so now attempts to speed up booting by
+bringing up multiple iscsi sessions at once in the initramfs are just
+running into misrouted responses that this fixes.
+
+Signed-off-by: Chris Leech <cleech@redhat.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 29 ++++++++++++++++++-----------
+ 1 file changed, 18 insertions(+), 11 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2343,6 +2343,12 @@ iscsi_multicast_skb(struct sk_buff *skb,
+ return nlmsg_multicast(nls, skb, 0, group, gfp);
+ }
+
++static int
++iscsi_unicast_skb(struct sk_buff *skb, u32 portid)
++{
++ return nlmsg_unicast(nls, skb, portid);
++}
++
+ int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
+ char *data, uint32_t data_size)
+ {
+@@ -2545,14 +2551,11 @@ void iscsi_ping_comp_event(uint32_t host
+ EXPORT_SYMBOL_GPL(iscsi_ping_comp_event);
+
+ static int
+-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi,
+- void *payload, int size)
++iscsi_if_send_reply(u32 portid, int type, void *payload, int size)
+ {
+ struct sk_buff *skb;
+ struct nlmsghdr *nlh;
+ int len = nlmsg_total_size(size);
+- int flags = multi ? NLM_F_MULTI : 0;
+- int t = done ? NLMSG_DONE : type;
+
+ skb = alloc_skb(len, GFP_ATOMIC);
+ if (!skb) {
+@@ -2560,10 +2563,9 @@ iscsi_if_send_reply(uint32_t group, int
+ return -ENOMEM;
+ }
+
+- nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0);
+- nlh->nlmsg_flags = flags;
++ nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0);
+ memcpy(nlmsg_data(nlh), payload, size);
+- return iscsi_multicast_skb(skb, group, GFP_ATOMIC);
++ return iscsi_unicast_skb(skb, portid);
+ }
+
+ static int
+@@ -3490,6 +3492,7 @@ static int
+ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ {
+ int err = 0;
++ u32 portid;
+ struct iscsi_uevent *ev = nlmsg_data(nlh);
+ struct iscsi_transport *transport = NULL;
+ struct iscsi_internal *priv;
+@@ -3510,10 +3513,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
+ if (!try_module_get(transport->owner))
+ return -EINVAL;
+
++ portid = NETLINK_CB(skb).portid;
++
+ switch (nlh->nlmsg_type) {
+ case ISCSI_UEVENT_CREATE_SESSION:
+ err = iscsi_if_create_session(priv, ep, ev,
+- NETLINK_CB(skb).portid,
++ portid,
+ ev->u.c_session.initial_cmdsn,
+ ev->u.c_session.cmds_max,
+ ev->u.c_session.queue_depth);
+@@ -3526,7 +3531,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
+ }
+
+ err = iscsi_if_create_session(priv, ep, ev,
+- NETLINK_CB(skb).portid,
++ portid,
+ ev->u.c_bound_session.initial_cmdsn,
+ ev->u.c_bound_session.cmds_max,
+ ev->u.c_bound_session.queue_depth);
+@@ -3684,6 +3689,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
+ static void
+ iscsi_if_rx(struct sk_buff *skb)
+ {
++ u32 portid = NETLINK_CB(skb).portid;
++
+ mutex_lock(&rx_queue_mutex);
+ while (skb->len >= NLMSG_HDRLEN) {
+ int err;
+@@ -3719,8 +3726,8 @@ iscsi_if_rx(struct sk_buff *skb)
+ break;
+ if (ev->type == ISCSI_UEVENT_GET_CHAP && !err)
+ break;
+- err = iscsi_if_send_reply(group, nlh->nlmsg_seq,
+- nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
++ err = iscsi_if_send_reply(portid, nlh->nlmsg_type,
++ ev, sizeof(*ev));
+ } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH);
+ skb_pull(skb, rlen);
+ }
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Jim Gill <jgill@vmware.com>
+Date: Fri, 20 Apr 2018 19:04:47 -0700
+Subject: scsi: vmw-pvscsi: return DID_BUS_BUSY for adapter-initated aborts
+
+From: Jim Gill <jgill@vmware.com>
+
+[ Upstream commit f4b024271ae3e9786e5d6f1c05b01b57a74e1d6d ]
+
+The vmw_pvscsi driver returns DID_ABORT for commands aborted internally
+by the adapter, leading to the filesystem going read-only. Change the
+result to DID_BUS_BUSY, causing the kernel to retry the command.
+
+Signed-off-by: Jim Gill <jgill@vmware.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/vmw_pvscsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -615,7 +615,7 @@ static void pvscsi_complete_request(stru
+ break;
+
+ case BTSTAT_ABORTQUEUE:
+- cmd->result = (DID_ABORT << 16);
++ cmd->result = (DID_BUS_BUSY << 16);
+ break;
+
+ case BTSTAT_SCSIPARITY:
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Thu, 5 Apr 2018 18:29:12 +0900
+Subject: selftests: ftrace: Add a testcase for multiple actions on trigger
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 25aa50e0ca397a5e5d4d6fcecefa8107877d1dd0 ]
+
+Add a testcase for multiple actions with different
+parameters on an event trigger, which has been fixed
+by commit 192c283e93bd ("tracing: Add action comparisons
+ when testing matching hist triggers").
+
+Link: http://lkml.kernel.org/r/152292055227.15769.6327959816123227152.stgit@devbox
+
+Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Tested-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc | 44 ++++++++++
+ 1 file changed, 44 insertions(+)
+ create mode 100644 tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
+
+--- /dev/null
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc
+@@ -0,0 +1,44 @@
++#!/bin/sh
++# description: event trigger - test multiple actions on hist trigger
++
++
++do_reset() {
++ reset_trigger
++ echo > set_event
++ clear_trace
++}
++
++fail() { #msg
++ do_reset
++ echo $1
++ exit_fail
++}
++
++if [ ! -f set_event ]; then
++ echo "event tracing is not supported"
++ exit_unsupported
++fi
++
++if [ ! -f synthetic_events ]; then
++ echo "synthetic event is not supported"
++ exit_unsupported
++fi
++
++clear_synthetic_events
++reset_tracer
++do_reset
++
++echo "Test multiple actions on hist trigger"
++echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events
++TRIGGER1=events/sched/sched_wakeup/trigger
++TRIGGER2=events/sched/sched_switch/trigger
++
++echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1
++echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2
++echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2
++echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2
++echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2
++
++do_reset
++
++exit 0
tools-build-no-need-to-make-libapi-for-perf-explicitly.patch
tools-build-fix-makefile-s-to-properly-invoke-tools-build.patch
af_key-always-verify-length-of-provided-sadb_key.patch
+fsnotify-fix-ignore-mask-logic-in-send_to_group.patch
+mips-io-add-barrier-after-register-read-in-readx.patch
+s390-smsgiucv-disable-smsg-on-module-unload.patch
+isofs-fix-potential-memory-leak-in-mount-option-parsing.patch
+scsi-iscsi-respond-to-netlink-with-unicast-when-appropriate.patch
+drm-msm-fix-possible-null-dereference-on-failure-of-get_pages.patch
+parisc-time-convert-read_persistent_clock-to-read_persistent_clock64.patch
+scsi-isci-fix-infinite-loop-in-while-loop.patch
+net-phy-marvell-clear-wol-event-before-setting-it.patch
+arm64-ptrace-remove-addr_limit-manipulation.patch
+selftests-ftrace-add-a-testcase-for-multiple-actions-on-trigger.patch
+rds-ib-fix-missing-call-to-rds_ib_dev_put-in-rds_ib_setup_qp.patch
+x86-cpu-intel-add-missing-tlb-cpuid-values.patch
+bpf-fix-uninitialized-variable-in-bpf-tools.patch
+ib_srpt-depend-on-infiniband_addr_trans.patch
+ib_srp-depend-on-infiniband_addr_trans.patch
+ib-make-infiniband_addr_trans-configurable.patch
+ib-core-make-ib_mad_client_id-atomic.patch
+arm-davinci-board-dm355-evm-fix-broken-networking.patch
+hexagon-add-memset_io-helper.patch
+hexagon-export-csum_partial_copy_nocheck.patch
+scsi-vmw-pvscsi-return-did_bus_busy-for-adapter-initated-aborts.patch
+parisc-drivers.c-fix-section-mismatches.patch
+kthread-sched-wait-fix-kthread_parkme-wait-loop.patch
+powerpc-trace-syscalls-update-syscall-name-matching-logic.patch
+mac80211-adjust-sae-authentication-timeout.patch
+drm-omap-fix-possible-null-ref-issue-in-tiler_reserve_2d.patch
+driver-core-add-__printf-verification-to-__ata_ehi_pushv_desc.patch
+can-dev-increase-bus-off-message-severity.patch
+agp-uninorth-make-two-functions-static.patch
+usb-musb-fix-remote-wakeup-racing-with-suspend.patch
+arm-keystone-fix-platform_domain_notifier-array-overrun.patch
+i2c-pmcmsp-return-message-count-on-master_xfer-success.patch
+i2c-pmcmsp-fix-error-return-from-master_xfer.patch
+i2c-viperboard-return-message-count-on-master_xfer-success.patch
+arm-davinci-board-dm646x-evm-set-vpif-capture-card-name.patch
+parisc-move-setup_profiling_timer-out-of-init-section.patch
+arm-8753-1-decompressor-add-a-missing-parameter-to-the-addruart-macro.patch
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: "Daniel Glöckner" <dg@emlix.com>
+Date: Mon, 14 May 2018 09:40:05 -0500
+Subject: usb: musb: fix remote wakeup racing with suspend
+
+From: "Daniel Glöckner" <dg@emlix.com>
+
+[ Upstream commit ebc3dd688cd988754a304147753b13e58de1b5a1 ]
+
+It has been observed that writing 0xF2 to the power register while it
+reads as 0xF4 results in the register having the value 0xF0, i.e. clearing
+RESUME and setting SUSPENDM in one go does not work. It might also violate
+the USB spec to transition directly from resume to suspend, especially
+when not taking T_DRSMDN into account. But this is what happens when a
+remote wakeup occurs between SetPortFeature USB_PORT_FEAT_SUSPEND on the
+root hub and musb_bus_suspend being called.
+
+This commit returns -EBUSY when musb_bus_suspend is called while remote
+wakeup is signalled and thus avoids to reset the RESUME bit. Ignoring
+this error when musb_port_suspend is called from musb_hub_control is ok.
+
+Signed-off-by: Daniel Glöckner <dg@emlix.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/musb_host.c | 5 ++++-
+ drivers/usb/musb/musb_host.h | 7 +++++--
+ drivers/usb/musb/musb_virthub.c | 25 +++++++++++++++----------
+ 3 files changed, 24 insertions(+), 13 deletions(-)
+
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -2464,8 +2464,11 @@ static int musb_bus_suspend(struct usb_h
+ {
+ struct musb *musb = hcd_to_musb(hcd);
+ u8 devctl;
++ int ret;
+
+- musb_port_suspend(musb, true);
++ ret = musb_port_suspend(musb, true);
++ if (ret)
++ return ret;
+
+ if (!is_host_active(musb))
+ return 0;
+--- a/drivers/usb/musb/musb_host.h
++++ b/drivers/usb/musb/musb_host.h
+@@ -92,7 +92,7 @@ extern void musb_host_rx(struct musb *,
+ extern void musb_root_disconnect(struct musb *musb);
+ extern void musb_host_resume_root_hub(struct musb *musb);
+ extern void musb_host_poke_root_hub(struct musb *musb);
+-extern void musb_port_suspend(struct musb *musb, bool do_suspend);
++extern int musb_port_suspend(struct musb *musb, bool do_suspend);
+ extern void musb_port_reset(struct musb *musb, bool do_reset);
+ extern void musb_host_finish_resume(struct work_struct *work);
+ #else
+@@ -124,7 +124,10 @@ static inline void musb_root_disconnect(
+ static inline void musb_host_resume_root_hub(struct musb *musb) {}
+ static inline void musb_host_poll_rh_status(struct musb *musb) {}
+ static inline void musb_host_poke_root_hub(struct musb *musb) {}
+-static inline void musb_port_suspend(struct musb *musb, bool do_suspend) {}
++static inline int musb_port_suspend(struct musb *musb, bool do_suspend)
++{
++ return 0;
++}
+ static inline void musb_port_reset(struct musb *musb, bool do_reset) {}
+ static inline void musb_host_finish_resume(struct work_struct *work) {}
+ #endif
+--- a/drivers/usb/musb/musb_virthub.c
++++ b/drivers/usb/musb/musb_virthub.c
+@@ -74,14 +74,14 @@ void musb_host_finish_resume(struct work
+ spin_unlock_irqrestore(&musb->lock, flags);
+ }
+
+-void musb_port_suspend(struct musb *musb, bool do_suspend)
++int musb_port_suspend(struct musb *musb, bool do_suspend)
+ {
+ struct usb_otg *otg = musb->xceiv->otg;
+ u8 power;
+ void __iomem *mbase = musb->mregs;
+
+ if (!is_host_active(musb))
+- return;
++ return 0;
+
+ /* NOTE: this doesn't necessarily put PHY into low power mode,
+ * turning off its clock; that's a function of PHY integration and
+@@ -92,16 +92,20 @@ void musb_port_suspend(struct musb *musb
+ if (do_suspend) {
+ int retries = 10000;
+
+- power &= ~MUSB_POWER_RESUME;
+- power |= MUSB_POWER_SUSPENDM;
+- musb_writeb(mbase, MUSB_POWER, power);
++ if (power & MUSB_POWER_RESUME)
++ return -EBUSY;
++
++ if (!(power & MUSB_POWER_SUSPENDM)) {
++ power |= MUSB_POWER_SUSPENDM;
++ musb_writeb(mbase, MUSB_POWER, power);
+
+- /* Needed for OPT A tests */
+- power = musb_readb(mbase, MUSB_POWER);
+- while (power & MUSB_POWER_SUSPENDM) {
++ /* Needed for OPT A tests */
+ power = musb_readb(mbase, MUSB_POWER);
+- if (retries-- < 1)
+- break;
++ while (power & MUSB_POWER_SUSPENDM) {
++ power = musb_readb(mbase, MUSB_POWER);
++ if (retries-- < 1)
++ break;
++ }
+ }
+
+ dev_dbg(musb->controller, "Root port suspended, power %02x\n", power);
+@@ -138,6 +142,7 @@ void musb_port_suspend(struct musb *musb
+ schedule_delayed_work(&musb->finish_resume_work,
+ msecs_to_jiffies(USB_RESUME_TIMEOUT));
+ }
++ return 0;
+ }
+
+ void musb_port_reset(struct musb *musb, bool do_reset)
--- /dev/null
+From foo@baz Sun Jun 17 13:19:44 CEST 2018
+From: "jacek.tomaka@poczta.fm" <jacek.tomaka@poczta.fm>
+Date: Tue, 24 Apr 2018 00:14:25 +0800
+Subject: x86/cpu/intel: Add missing TLB cpuid values
+
+From: "jacek.tomaka@poczta.fm" <jacek.tomaka@poczta.fm>
+
+[ Upstream commit b837913fc2d9061bf9b8c0dd6bf2d24e2f98b84a ]
+
+Make kernel print the correct number of TLB entries on Intel Xeon Phi 7210
+(and others)
+
+Before:
+[ 0.320005] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
+After:
+[ 0.320005] Last level dTLB entries: 4KB 256, 2MB 128, 4MB 128, 1GB 16
+
+The entries do exist in the official Intel SMD but the type column there is
+incorrect (states "Cache" where it should read "TLB"), but the entries for
+the values 0x6B, 0x6C and 0x6D are correctly described as 'Data TLB'.
+
+Signed-off-by: Jacek Tomaka <jacek.tomaka@poczta.fm>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20180423161425.24366-1-jacekt@dugeo.com
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/intel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -561,6 +561,9 @@ static const struct _tlb_table intel_tlb
+ { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" },
+ { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" },
+ { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" },
++ { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" },
++ { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" },
++ { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" },
+ { 0x76, TLB_INST_2M_4M, 8, " TLB_INST 2-MByte or 4-MByte pages, fully associative" },
+ { 0xb0, TLB_INST_4K, 128, " TLB_INST 4 KByte pages, 4-way set associative" },
+ { 0xb1, TLB_INST_2M_4M, 4, " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" },
projects / thirdparty / kernel / stable-queue.git / commitdiff
