--- /dev/null
+From 93f244bf886481ba21f2eb10e8408c68d784bd10 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Fri, 11 Jan 2019 14:46:37 -0800
+Subject: acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id()
+
+[ Upstream commit 0919871ac37fdcf46c7657da0f1742efe096b399 ]
+
+Possible race accessing memdev structures after dropping the
+mutex. Dan Williams says this could race against another thread
+that is doing:
+
+ # echo "ACPI0012:00" > /sys/bus/acpi/drivers/nfit/unbind
+
+Reported-by: Jane Chu <jane.chu@oracle.com>
+Fixes: 23222f8f8dce ("acpi, nfit: Add function to look up nvdimm...")
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/nfit/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index ea59c01ce8db0..f530d35412428 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -719,6 +719,7 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
+ struct acpi_nfit_memory_map *memdev;
+ struct acpi_nfit_desc *acpi_desc;
+ struct nfit_mem *nfit_mem;
++ u16 physical_id;
+
+ mutex_lock(&acpi_desc_lock);
+ list_for_each_entry(acpi_desc, &acpi_descs, list) {
+@@ -726,10 +727,11 @@ int nfit_get_smbios_id(u32 device_handle, u16 *flags)
+ list_for_each_entry(nfit_mem, &acpi_desc->dimms, list) {
+ memdev = __to_nfit_memdev(nfit_mem);
+ if (memdev->device_handle == device_handle) {
++ *flags = memdev->flags;
++ physical_id = memdev->physical_id;
+ mutex_unlock(&acpi_desc->init_mutex);
+ mutex_unlock(&acpi_desc_lock);
+- *flags = memdev->flags;
+- return memdev->physical_id;
++ return physical_id;
+ }
+ }
+ mutex_unlock(&acpi_desc->init_mutex);
+--
+2.19.1
+
--- /dev/null
+From 8bffc3f379ae0748d5b9301dc22ef7f70313dec7 Mon Sep 17 00:00:00 2001
+From: Marc Dionne <marc.dionne@auristor.com>
+Date: Wed, 9 Jan 2019 17:23:54 +0000
+Subject: afs: Don't set vnode->cb_s_break in afs_validate()
+
+[ Upstream commit 4882a27cec24319d10f95e978ecc80050e3e3e15 ]
+
+A cb_interest record is not necessarily attached to the vnode on entry to
+afs_validate(), which can cause an oops when we try to bring the vnode's
+cb_s_break up to date in the default case (ie. no current callback promise
+and the vnode has not been deleted).
+
+Fix this by simply removing the line, as vnode->cb_s_break will be set when
+needed by afs_register_server_cb_interest() when we next get a callback
+promise from RPC call.
+
+The oops looks something like:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
+ ...
+ RIP: 0010:afs_validate+0x66/0x250 [kafs]
+ ...
+ Call Trace:
+ afs_d_revalidate+0x8d/0x340 [kafs]
+ ? __d_lookup+0x61/0x150
+ lookup_dcache+0x44/0x70
+ ? lookup_dcache+0x44/0x70
+ __lookup_hash+0x24/0xa0
+ do_unlinkat+0x11d/0x2c0
+ __x64_sys_unlink+0x23/0x30
+ do_syscall_64+0x4d/0xf0
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: ae3b7361dc0e ("afs: Fix validation/callback interaction")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 071075d775a95..26aa2d111a28f 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -411,7 +411,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ } else if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
+ valid = true;
+ } else {
+- vnode->cb_s_break = vnode->cb_interest->server->cb_s_break;
+ vnode->cb_v_break = vnode->volume->cb_v_break;
+ valid = false;
+ }
+--
+2.19.1
+
--- /dev/null
+From a216a521a4fbaf05f8ceea73f059cf9b7bfc875b Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 9 Jan 2019 17:23:54 +0000
+Subject: afs: Fix key refcounting in file locking code
+
+[ Upstream commit 59d49076ae3e6912e6d7df2fd68e2337f3d02036 ]
+
+Fix the refcounting of the authentication keys in the file locking code.
+The vnode->lock_key member points to a key on which it expects to be
+holding a ref, but it isn't always given an extra ref, however.
+
+Fixes: 0fafdc9f888b ("afs: Fix file locking")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/flock.c | 4 ++--
+ fs/afs/inode.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/flock.c b/fs/afs/flock.c
+index dc62d15a964b8..1bb300ef362b0 100644
+--- a/fs/afs/flock.c
++++ b/fs/afs/flock.c
+@@ -208,7 +208,7 @@ void afs_lock_work(struct work_struct *work)
+ /* The new front of the queue now owns the state variables. */
+ next = list_entry(vnode->pending_locks.next,
+ struct file_lock, fl_u.afs.link);
+- vnode->lock_key = afs_file_key(next->fl_file);
++ vnode->lock_key = key_get(afs_file_key(next->fl_file));
+ vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+ vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+ goto again;
+@@ -413,7 +413,7 @@ static void afs_dequeue_lock(struct afs_vnode *vnode, struct file_lock *fl)
+ /* The new front of the queue now owns the state variables. */
+ next = list_entry(vnode->pending_locks.next,
+ struct file_lock, fl_u.afs.link);
+- vnode->lock_key = afs_file_key(next->fl_file);
++ vnode->lock_key = key_get(afs_file_key(next->fl_file));
+ vnode->lock_type = (next->fl_type == F_RDLCK) ? AFS_LOCK_READ : AFS_LOCK_WRITE;
+ vnode->lock_state = AFS_VNODE_LOCK_WAITING_FOR_CB;
+ afs_lock_may_be_available(vnode);
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 26aa2d111a28f..0726e40db0f8b 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -542,6 +542,8 @@ void afs_evict_inode(struct inode *inode)
+ #endif
+
+ afs_put_permits(rcu_access_pointer(vnode->permit_cache));
++ key_put(vnode->lock_key);
++ vnode->lock_key = NULL;
+ _leave("");
+ }
+
+--
+2.19.1
+
--- /dev/null
+From e6a55811aeebb4ad18f8414bf41d6aaf06e0d492 Mon Sep 17 00:00:00 2001
+From: Talons Lee <xin.li@citrix.com>
+Date: Mon, 10 Dec 2018 18:03:00 +0800
+Subject: always clear the X2APIC_ENABLE bit for PV guest
+
+[ Upstream commit 5268c8f39e0efef81af2aaed160272d9eb507beb ]
+
+Commit e657fcc clears cpu capability bit instead of using fake cpuid
+value, the EXTD should always be off for PV guest without depending
+on cpuid value. So remove the cpuid check in xen_read_msr_safe() to
+always clear the X2APIC_ENABLE bit.
+
+Signed-off-by: Talons Lee <xin.li@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/enlighten_pv.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 52a7c3faee0cc..782f98b332f05 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -899,10 +899,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
+ val = native_read_msr_safe(msr, err);
+ switch (msr) {
+ case MSR_IA32_APICBASE:
+-#ifdef CONFIG_X86_X2APIC
+- if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+-#endif
+- val &= ~X2APIC_ENABLE;
++ val &= ~X2APIC_ENABLE;
+ break;
+ }
+ return val;
+--
+2.19.1
+
--- /dev/null
+From 5a49feb4e7ac54ad3a7bac942809d06d99ab3903 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 15 Jan 2019 18:03:38 +0000
+Subject: atm: he: fix sign-extension overflow on large shift
+
+[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ]
+
+Shifting the 1 by exp by an int can lead to sign-extension overlow when
+exp is 31 since 1 is an signed int and sign-extending this result to an
+unsigned long long will set the upper 32 bits. Fix this by shifting an
+unsigned long.
+
+Detected by cppcheck:
+(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/he.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/atm/he.c b/drivers/atm/he.c
+index 29f102dcfec49..329ce9072ee9f 100644
+--- a/drivers/atm/he.c
++++ b/drivers/atm/he.c
+@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
+ instead of '/ 512', use '>> 9' to prevent a call
+ to divdu3 on x86 platforms
+ */
+- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
+
+ if (rate_cps < 10)
+ rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */
+--
+2.19.1
+
--- /dev/null
+From e89279979aedf444a2c2034075693b763630d645 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko.stuebner@bq.com>
+Date: Mon, 12 Nov 2018 10:02:57 +0100
+Subject: backlight: pwm_bl: Fix devicetree parsing with auto-generated
+ brightness tables
+
+[ Upstream commit 61170ee9386888f1e6f7e9cc58e8d9a8c2a3c1dd ]
+
+Commit 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly
+to human eye") made the parse-dt function return early when using an auto-
+generated brightness-table, but didn't take into account that some more
+settings were handled below the brightness handling, like power-on-delays
+and also setting the pdata enable-gpio to -EINVAL.
+
+This surfaces for example in the case of a backlight without any
+enable-gpio which then tries to use gpio-0 in error.
+
+Fix this by simply moving the trailing settings above the brightness
+handling.
+
+Fixes: 88ba95bedb79 ("backlight: pwm_bl: Compute brightness of LED linearly to human eye")
+Signed-off-by: Heiko Stuebner <heiko.stuebner@bq.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/pwm_bl.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c
+index bdfcc0a71db14..6bde543452f25 100644
+--- a/drivers/video/backlight/pwm_bl.c
++++ b/drivers/video/backlight/pwm_bl.c
+@@ -262,6 +262,16 @@ static int pwm_backlight_parse_dt(struct device *dev,
+
+ memset(data, 0, sizeof(*data));
+
++ /*
++ * These values are optional and set as 0 by default, the out values
++ * are modified only if a valid u32 value can be decoded.
++ */
++ of_property_read_u32(node, "post-pwm-on-delay-ms",
++ &data->post_pwm_on_delay);
++ of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
++
++ data->enable_gpio = -EINVAL;
++
+ /*
+ * Determine the number of brightness levels, if this property is not
+ * set a default table of brightness levels will be used.
+@@ -374,15 +384,6 @@ static int pwm_backlight_parse_dt(struct device *dev,
+ data->max_brightness--;
+ }
+
+- /*
+- * These values are optional and set as 0 by default, the out values
+- * are modified only if a valid u32 value can be decoded.
+- */
+- of_property_read_u32(node, "post-pwm-on-delay-ms",
+- &data->post_pwm_on_delay);
+- of_property_read_u32(node, "pwm-off-delay-ms", &data->pwm_off_delay);
+-
+- data->enable_gpio = -EINVAL;
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 0f1764e6318e4a25755a0d8c750ea6068f285de7 Mon Sep 17 00:00:00 2001
+From: Peter Oskolkov <posk@google.com>
+Date: Wed, 16 Jan 2019 08:47:54 -0800
+Subject: bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit f4924f24da8c7ef64195096817f3cde324091d97 ]
+
+In sock_setsockopt() (net/core/sock.h), when SO_MARK option is used
+to change sk_mark, sk_dst_reset(sk) is called. The same should be
+done in bpf_setsockopt().
+
+Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf")
+Reported-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Peter Oskolkov <posk@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Reviewed-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 3400c7abda135..fb0080e84bd43 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3930,7 +3930,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ sk->sk_rcvlowat = val ? : 1;
+ break;
+ case SO_MARK:
+- sk->sk_mark = val;
++ if (sk->sk_mark != val) {
++ sk->sk_mark = val;
++ sk_dst_reset(sk);
++ }
+ break;
+ default:
+ ret = -EINVAL;
+--
+2.19.1
+
--- /dev/null
+From 8df4a9c1a6bcea88ccf67c28c1309bec1ce5eaa6 Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Tue, 8 Jan 2019 18:12:24 -0800
+Subject: bpf: correctly set initial window on active Fast Open sender
+
+[ Upstream commit 31aa6503a15ba00182ea6dbbf51afb63bf9e851d ]
+
+The existing BPF TCP initial congestion window (TCP_BPF_IW) does not
+to work on (active) Fast Open sender. This is because it changes the
+(initial) window only if data_segs_out is zero -- but data_segs_out
+is also incremented on SYN-data. This patch fixes the issue by
+proerly accounting for SYN-data additionally.
+
+Fixes: fc7478103c84 ("bpf: Adds support for setting initial cwnd")
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Lawrence Brakmo <brakmo@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 8c2411fb25090..3400c7abda135 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -4001,7 +4001,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ /* Only some options are supported */
+ switch (optname) {
+ case TCP_BPF_IW:
+- if (val <= 0 || tp->data_segs_out > 0)
++ if (val <= 0 || tp->data_segs_out > tp->syn_data)
+ ret = -EINVAL;
+ else
+ tp->snd_cwnd = val;
+--
+2.19.1
+
--- /dev/null
+From 1a8669751d37804b60ac94eaf45f2a64e0259250 Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 16 Jan 2019 14:03:15 -0800
+Subject: bpf: don't assume build-id length is always 20 bytes
+
+[ Upstream commit 0b698005a9d11c0e91141ec11a2c4918a129f703 ]
+
+Build-id length is not fixed to 20, it can be (`man ld` /--build-id):
+ * 128-bit (uuid)
+ * 160-bit (sha1)
+ * any length specified in ld --build-id=0xhexstring
+
+To fix the issue of missing BPF_STACK_BUILD_ID_VALID for shorter build-ids,
+assume that build-id is somewhere in the range of 1 .. 20.
+Set the remaining bytes to zero.
+
+v2:
+* don't introduce new "len = min(BPF_BUILD_ID_SIZE, nhdr->n_descsz)",
+ we already know that nhdr->n_descsz <= BPF_BUILD_ID_SIZE if we enter
+ this 'if' condition
+
+Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address")
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index e50ef5bca4213..98ad9dc3587aa 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -180,11 +180,14 @@ static inline int stack_map_parse_build_id(void *page_addr,
+
+ if (nhdr->n_type == BPF_BUILD_ID &&
+ nhdr->n_namesz == sizeof("GNU") &&
+- nhdr->n_descsz == BPF_BUILD_ID_SIZE) {
++ nhdr->n_descsz > 0 &&
++ nhdr->n_descsz <= BPF_BUILD_ID_SIZE) {
+ memcpy(build_id,
+ note_start + note_offs +
+ ALIGN(sizeof("GNU"), 4) + sizeof(Elf32_Nhdr),
+- BPF_BUILD_ID_SIZE);
++ nhdr->n_descsz);
++ memset(build_id + nhdr->n_descsz, 0,
++ BPF_BUILD_ID_SIZE - nhdr->n_descsz);
+ return 0;
+ }
+ new_offs = note_offs + sizeof(Elf32_Nhdr) +
+--
+2.19.1
+
--- /dev/null
+From 5751034dc1a557f6e10575b9ad4d291488c3ab71 Mon Sep 17 00:00:00 2001
+From: Andrey Ignatov <rdna@fb.com>
+Date: Fri, 4 Jan 2019 01:07:07 -0800
+Subject: bpf: Fix [::] -> [::1] rewrite in sys_sendmsg
+
+[ Upstream commit e8e36984080b55ac5e57bdb09a5b570f2fc8e963 ]
+
+sys_sendmsg has supported unspecified destination IPv6 (wildcard) for
+unconnected UDP sockets since 876c7f41. When [::] is passed by user as
+destination, sys_sendmsg rewrites it with [::1] to be consistent with
+BSD (see "BSD'ism" comment in the code).
+
+This didn't work when cgroup-bpf was enabled though since the rewrite
+[::] -> [::1] happened before passing control to cgroup-bpf block where
+fl6.daddr was updated with passed by user sockaddr_in6.sin6_addr (that
+might or might not be changed by BPF program). That way if user passed
+[::] as dst IPv6 it was first rewritten with [::1] by original code from
+876c7f41, but then rewritten back with [::] by cgroup-bpf block.
+
+It happened even when BPF_CGROUP_UDP6_SENDMSG program was not present
+(CONFIG_CGROUP_BPF=y was enough).
+
+The fix is to apply BSD'ism after cgroup-bpf block so that [::] is
+replaced with [::1] no matter where it came from: passed by user to
+sys_sendmsg or set by BPF_CGROUP_UDP6_SENDMSG program.
+
+Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
+Reported-by: Nitin Rawat <nitin.rawat@intel.com>
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/udp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 76ba2f34ef6b1..cab8b2b647f96 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1322,10 +1322,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ ipc6.opt = opt;
+
+ fl6.flowi6_proto = sk->sk_protocol;
+- if (!ipv6_addr_any(daddr))
+- fl6.daddr = *daddr;
+- else
+- fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
++ fl6.daddr = *daddr;
+ if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
+ fl6.saddr = np->saddr;
+ fl6.fl6_sport = inet->inet_sport;
+@@ -1353,6 +1350,9 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
+ }
+ }
+
++ if (ipv6_addr_any(&fl6.daddr))
++ fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
++
+ final_p = fl6_update_dst(&fl6, opt, &final);
+ if (final_p)
+ connected = false;
+--
+2.19.1
+
--- /dev/null
+From ba1d248070c44619302d1c81351900ba73a66a2b Mon Sep 17 00:00:00 2001
+From: Song Liu <songliubraving@fb.com>
+Date: Tue, 8 Jan 2019 14:20:44 -0800
+Subject: bpf: fix panic in stack_map_get_build_id() on i386 and arm32
+
+[ Upstream commit beaf3d1901f4ea46fbd5c9d857227d99751de469 ]
+
+As Naresh reported, test_stacktrace_build_id() causes panic on i386 and
+arm32 systems. This is caused by page_address() returns NULL in certain
+cases.
+
+This patch fixes this error by using kmap_atomic/kunmap_atomic instead
+of page_address.
+
+Fixes: 615755a77b24 (" bpf: extend stackmap to save binary_build_id+offset instead of address")
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 8061a439ef18c..e50ef5bca4213 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -260,7 +260,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
+ return -EFAULT; /* page not mapped */
+
+ ret = -EINVAL;
+- page_addr = page_address(page);
++ page_addr = kmap_atomic(page);
+ ehdr = (Elf32_Ehdr *)page_addr;
+
+ /* compare magic x7f "ELF" */
+@@ -276,6 +276,7 @@ static int stack_map_get_build_id(struct vm_area_struct *vma,
+ else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64)
+ ret = stack_map_get_build_id_64(page_addr, build_id);
+ out:
++ kunmap_atomic(page_addr);
+ put_page(page);
+ return ret;
+ }
+--
+2.19.1
+
--- /dev/null
+From db8362d9769b99502f8087f88dcef13cee35889e Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 16 Jan 2019 14:03:16 -0800
+Subject: bpf: zero out build_id for BPF_STACK_BUILD_ID_IP
+
+[ Upstream commit 4af396ae4836c4ecab61e975b8e61270c551894d ]
+
+When returning BPF_STACK_BUILD_ID_IP from stack_map_get_build_id_offset,
+make sure that build_id field is empty. Since we are using percpu
+free list, there is a possibility that we might reuse some previous
+bpf_stack_build_id with non-zero build_id.
+
+Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address")
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index 98ad9dc3587aa..6a32933cae4ff 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -314,6 +314,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ for (i = 0; i < trace_nr; i++) {
+ id_offs[i].status = BPF_STACK_BUILD_ID_IP;
+ id_offs[i].ip = ips[i];
++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
+ }
+ return;
+ }
+@@ -324,6 +325,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
+ /* per entry fall back to ips */
+ id_offs[i].status = BPF_STACK_BUILD_ID_IP;
+ id_offs[i].ip = ips[i];
++ memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
+ continue;
+ }
+ id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i]
+--
+2.19.1
+
--- /dev/null
+From c69eb8583025f95a8ea24c69bcf3dd2cf82f2e62 Mon Sep 17 00:00:00 2001
+From: Madalin Bucur <madalin.bucur@nxp.com>
+Date: Thu, 17 Jan 2019 11:42:27 +0200
+Subject: dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start
+
+[ Upstream commit c6ddfb9a963f0cac0f7365acfc87f3f3b33a3b69 ]
+
+As txq_trans_update() only updates trans_start when the lock is held,
+trans_start does not get updated if NETIF_F_LLTX is declared.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 65a22cd9aef26..029730bbe7db1 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2052,6 +2052,7 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ bool nonlinear = skb_is_nonlinear(skb);
+ struct rtnl_link_stats64 *percpu_stats;
+ struct dpaa_percpu_priv *percpu_priv;
++ struct netdev_queue *txq;
+ struct dpaa_priv *priv;
+ struct qm_fd fd;
+ int offset = 0;
+@@ -2101,6 +2102,11 @@ static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ if (unlikely(err < 0))
+ goto skb_to_fd_failed;
+
++ txq = netdev_get_tx_queue(net_dev, queue_mapping);
++
++ /* LLTX requires to do our own update of trans_start */
++ txq->trans_start = jiffies;
++
+ if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+ fd.cmd |= cpu_to_be32(FM_FD_CMD_UPD);
+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS;
+--
+2.19.1
+
--- /dev/null
+From eac4c053d6dc01c1837368d366fd3dadea18f422 Mon Sep 17 00:00:00 2001
+From: Charlene Liu <charlene.liu@amd.com>
+Date: Wed, 12 Dec 2018 18:09:16 -0500
+Subject: drm/amd/display: fix PME notification not working in RV desktop
+
+[ Upstream commit 20300db4aec5ba5edf6f0ad6f7111a51fbea7e10 ]
+
+[Why]
+PPLIB not receive the PME when unplug.
+
+Signed-off-by: Charlene Liu <charlene.liu@amd.com>
+Reviewed-by: Chris Park <Chris.Park@amd.com>
+Acked-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index 580e7e82034fa..53ccacf99eca4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1000,7 +1000,7 @@ void dce110_enable_audio_stream(struct pipe_ctx *pipe_ctx)
+
+ pipe_ctx->stream_res.audio->funcs->az_enable(pipe_ctx->stream_res.audio);
+
+- if (num_audio == 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
++ if (num_audio >= 1 && pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
+ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
+ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
+ /* un-mute audio */
+@@ -1017,6 +1017,8 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
+ pipe_ctx->stream_res.stream_enc->funcs->audio_mute_control(
+ pipe_ctx->stream_res.stream_enc, true);
+ if (pipe_ctx->stream_res.audio) {
++ struct pp_smu_funcs_rv *pp_smu = dc->res_pool->pp_smu;
++
+ if (option != KEEP_ACQUIRED_RESOURCE ||
+ !dc->debug.az_endpoint_mute_only) {
+ /*only disalbe az_endpoint if power down or free*/
+@@ -1036,6 +1038,9 @@ void dce110_disable_audio_stream(struct pipe_ctx *pipe_ctx, int option)
+ update_audio_usage(&dc->current_state->res_ctx, dc->res_pool, pipe_ctx->stream_res.audio, false);
+ pipe_ctx->stream_res.audio = NULL;
+ }
++ if (pp_smu != NULL && pp_smu->set_pme_wa_enable != NULL)
++ /*this is the first audio. apply the PME w/a in order to wake AZ from D3*/
++ pp_smu->set_pme_wa_enable(&pp_smu->pp_smu);
+
+ /* TODO: notify audio driver for if audio modes list changed
+ * add audio mode list change flag */
+--
+2.19.1
+
--- /dev/null
+From 7d0c6a2f552796a1f03c24c79e7759afd65c15a4 Mon Sep 17 00:00:00 2001
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Wed, 2 Jan 2019 17:47:39 -0500
+Subject: drm/amdkfd: Don't assign dGPUs to APU topology devices
+
+[ Upstream commit bbdf514fe5648566b0754476cbcb92ac3422dde2 ]
+
+dGPUs need their own topology devices. Don't assign them to APU topology
+devices with CPU cores.
+
+Bug: https://github.com/RadeonOpenCompute/ROCK-Kernel-Driver/issues/66
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Tested-by: Elias Konstantinidis <ekondis@gmail.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 80f5db4ef75fd..0805c423a5ce0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1072,8 +1072,6 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu)
+ * the GPU device is not already present in the topology device
+ * list then return NULL. This means a new topology device has to
+ * be created for this GPU.
+- * TODO: Rather than assiging @gpu to first topology device withtout
+- * gpu attached, it will better to have more stringent check.
+ */
+ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
+ {
+@@ -1081,12 +1079,20 @@ static struct kfd_topology_device *kfd_assign_gpu(struct kfd_dev *gpu)
+ struct kfd_topology_device *out_dev = NULL;
+
+ down_write(&topology_lock);
+- list_for_each_entry(dev, &topology_device_list, list)
++ list_for_each_entry(dev, &topology_device_list, list) {
++ /* Discrete GPUs need their own topology device list
++ * entries. Don't assign them to CPU/APU nodes.
++ */
++ if (!gpu->device_info->needs_iommu_device &&
++ dev->node_props.cpu_cores_count)
++ continue;
++
+ if (!dev->gpu && (dev->node_props.simd_count > 0)) {
+ dev->gpu = gpu;
+ out_dev = dev;
+ break;
+ }
++ }
+ up_write(&topology_lock);
+ return out_dev;
+ }
+--
+2.19.1
+
--- /dev/null
+From 6666ae93a8872a4772ba168db0a1dd94b7a4ce03 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 13 Jan 2019 10:44:51 +0100
+Subject: drm/meson: add missing of_node_put
+
+[ Upstream commit f672b93e4a0a4947d2e1103ed8780e01e13eadb6 ]
+
+Add an of_node_put when the result of of_graph_get_remote_port_parent is
+not available.
+
+An of_node_put is also needed when meson_probe_remote completes. This was
+present at the recursive call, but not in the call from meson_drv_probe.
+
+The semantic match that finds this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@r exists@
+local idexpression e;
+expression x;
+@@
+e = of_graph_get_remote_port_parent(...);
+... when != x = e
+ when != true e == NULL
+ when != of_node_put(e)
+ when != of_fwnode_handle(e)
+(
+return e;
+|
+*return ...;
+)
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1547372691-28324-4-git-send-email-Julia.Lawall@lip6.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index bf5f294f172fa..611ac340fb289 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -368,8 +368,10 @@ static int meson_probe_remote(struct platform_device *pdev,
+ remote_node = of_graph_get_remote_port_parent(ep);
+ if (!remote_node ||
+ remote_node == parent || /* Ignore parent endpoint */
+- !of_device_is_available(remote_node))
++ !of_device_is_available(remote_node)) {
++ of_node_put(remote_node);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, match, remote, remote_node);
+
+@@ -388,10 +390,13 @@ static int meson_drv_probe(struct platform_device *pdev)
+
+ for_each_endpoint_of_node(np, ep) {
+ remote = of_graph_get_remote_port_parent(ep);
+- if (!remote || !of_device_is_available(remote))
++ if (!remote || !of_device_is_available(remote)) {
++ of_node_put(remote);
+ continue;
++ }
+
+ count += meson_probe_remote(pdev, &match, np, remote);
++ of_node_put(remote);
+ }
+
+ if (count && !match)
+--
+2.19.1
+
--- /dev/null
+From d3a0a9408a2c25986f04a5a967b5f4f1c272d662 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 13 Jan 2019 09:47:44 +0100
+Subject: drm/sun4i: backend: add missing of_node_puts
+
+[ Upstream commit 4bb0e6d7258213d4893c2c876712fbba40e712fe ]
+
+The device node iterators perform an of_node_get on each
+iteration, so a jump out of the loop requires an of_node_put.
+
+Remote and port also have augmented reference counts, so drop them
+on each iteration and at the end of the function, respectively.
+Remote is only used for the address it contains, not for the
+contents of that address, so the reference count can be dropped
+immediately.
+
+The semantic patch that fixes the first part of this problem is
+as follows (http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+expression root,e;
+local idexpression child;
+iterator name for_each_child_of_node;
+@@
+
+ for_each_available_child_of_node(root, child) {
+ ... when != of_node_put(child)
+ when != e = child
++ of_node_put(child);
+? break;
+ ...
+}
+... when != child
+// </smpl>
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1547369264-24831-5-git-send-email-Julia.Lawall@lip6.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index d7950b52a1fd9..e30b1f5b9d91a 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -717,17 +717,18 @@ static struct sun4i_frontend *sun4i_backend_find_frontend(struct sun4i_drv *drv,
+ remote = of_graph_get_remote_port_parent(ep);
+ if (!remote)
+ continue;
++ of_node_put(remote);
+
+ /* does this node match any registered engines? */
+ list_for_each_entry(frontend, &drv->frontend_list, list) {
+ if (remote == frontend->node) {
+- of_node_put(remote);
+ of_node_put(port);
++ of_node_put(ep);
+ return frontend;
+ }
+ }
+ }
+-
++ of_node_put(port);
+ return ERR_PTR(-EINVAL);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From d2a7ef07c82e273bc7b2765de9f80e308b8c643b Mon Sep 17 00:00:00 2001
+From: Cheng-Min Ao <tony_ao@wiwynn.com>
+Date: Mon, 7 Jan 2019 14:29:32 +0800
+Subject: hwmon: (tmp421) Correct the misspelling of the tmp442 compatible
+ attribute in OF device ID table
+
+[ Upstream commit f422449b58548a41e98fc97b259a283718e527db ]
+
+Correct a typo in OF device ID table
+The last one should be 'ti,tmp442'
+
+Signed-off-by: Cheng-Min Ao <tony_ao@wiwynn.com>
+Signed-off-by: Yu-Hsiang Chen <matt_chen@wiwynn.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/tmp421.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
+index e36399213324d..ceb3db6f3fdda 100644
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
+ .data = (void *)2
+ },
+ {
+- .compatible = "ti,tmp422",
++ .compatible = "ti,tmp442",
+ .data = (void *)3
+ },
+ { },
+--
+2.19.1
+
--- /dev/null
+From f1deb5e13c592ca6e0239b051820f7781691bfbb Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Wed, 2 Jan 2019 15:57:49 -0500
+Subject: include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR
+
+[ Upstream commit 3e2ffd655cc6a694608d997738989ff5572a8266 ]
+
+Since commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
+mutually exclusive") clang no longer reuses the OPTIMIZER_HIDE_VAR macro
+from compiler-gcc - instead it gets the version in
+include/linux/compiler.h. Unfortunately that version doesn't actually
+prevent compiler from optimizing out the variable.
+
+Fix up by moving the macro out from compiler-gcc.h to compiler.h.
+Compilers without incline asm support will keep working
+since it's protected by an ifdef.
+
+Also fix up comments to match reality since we are no longer overriding
+any macros.
+
+Build-tested with gcc and clang.
+
+Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
+Cc: Eli Friedman <efriedma@codeaurora.org>
+Cc: Joe Perches <joe@perches.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler-clang.h | 5 ++---
+ include/linux/compiler-gcc.h | 4 ----
+ include/linux/compiler-intel.h | 4 +---
+ include/linux/compiler.h | 4 +++-
+ 4 files changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
+index b1ce500fe8b3d..d756f2318efe0 100644
+--- a/include/linux/compiler-clang.h
++++ b/include/linux/compiler-clang.h
+@@ -3,9 +3,8 @@
+ #error "Please don't include <linux/compiler-clang.h> directly, include <linux/compiler.h> instead."
+ #endif
+
+-/* Some compiler specific definitions are overwritten here
+- * for Clang compiler
+- */
++/* Compiler specific definitions for Clang compiler */
++
+ #define uninitialized_var(x) x = *(&(x))
+
+ /* same as gcc, this was present in clang-2.6 so we can assume it works
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 0242f6eec4eaf..a8ff0ca0c3213 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -58,10 +58,6 @@
+ (typeof(ptr)) (__ptr + (off)); \
+ })
+
+-/* Make the optimizer believe the variable can be manipulated arbitrarily. */
+-#define OPTIMIZER_HIDE_VAR(var) \
+- __asm__ ("" : "=r" (var) : "0" (var))
+-
+ /*
+ * A trick to suppress uninitialized variable warning without generating any
+ * code
+diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
+index 4c7f9befa9f6c..f1fc60f103176 100644
+--- a/include/linux/compiler-intel.h
++++ b/include/linux/compiler-intel.h
+@@ -5,9 +5,7 @@
+
+ #ifdef __ECC
+
+-/* Some compiler specific definitions are overwritten here
+- * for Intel ECC compiler
+- */
++/* Compiler specific definitions for Intel ECC compiler */
+
+ #include <asm/intrinsics.h>
+
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 681d866efb1eb..269d376f5a119 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -158,7 +158,9 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
+ #endif
+
+ #ifndef OPTIMIZER_HIDE_VAR
+-#define OPTIMIZER_HIDE_VAR(var) barrier()
++/* Make the optimizer believe the variable can be manipulated arbitrarily. */
++#define OPTIMIZER_HIDE_VAR(var) \
++ __asm__ ("" : "=r" (var) : "0" (var))
+ #endif
+
+ /* Not-quite-unique ID. */
+--
+2.19.1
+
--- /dev/null
+From e960b78c80da4b62e60c38b37c37c97b2971a22b Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 9 Jan 2019 22:41:08 -0700
+Subject: isdn: avm: Fix string plus integer warning from Clang
+
+[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ]
+
+A recent commit in Clang expanded the -Wstring-plus-int warning, showing
+some odd behavior in this file.
+
+drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
+ cinfo->version[j] = "\0\0" + 1;
+ ~~~~~~~^~~
+drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
+ cinfo->version[j] = "\0\0" + 1;
+ ^
+ & [ ]
+1 warning generated.
+
+This is equivalent to just "\0". Nick pointed out that it is smarter to
+use "" instead of "\0" because "" is used elsewhere in the kernel and
+can be deduplicated at the linking stage.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/309
+Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/avm/b1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index 4ac378e489023..40ca1e8fa09fc 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
+ int i, j;
+
+ for (j = 0; j < AVM_MAXVERSION; j++)
+- cinfo->version[j] = "\0\0" + 1;
++ cinfo->version[j] = "";
+ for (i = 0, j = 0;
+ j < AVM_MAXVERSION && i < cinfo->versionlen;
+ j++, i += cinfo->versionbuf[i] + 1)
+--
+2.19.1
+
--- /dev/null
+From 1c455ba5c118f788774c724e6dc6c599709e364d Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 8 Jan 2019 21:04:48 +0800
+Subject: isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
+
+[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]
+
+The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
+concurrently executed.
+
+isdn_tty_tiocmset
+ isdn_tty_modem_hup
+ line 719: kfree(info->dtmf_state);
+ line 721: kfree(info->silence_state);
+ line 723: kfree(info->adpcms);
+ line 725: kfree(info->adpcmr);
+
+isdn_tty_set_termios
+ isdn_tty_modem_hup
+ line 719: kfree(info->dtmf_state);
+ line 721: kfree(info->silence_state);
+ line 723: kfree(info->adpcms);
+ line 725: kfree(info->adpcmr);
+
+Thus, some concurrency double-free bugs may occur.
+
+These possible bugs are found by a static tool written by myself and
+my manual code review.
+
+To fix these possible bugs, the mutex lock "modem_info_mutex" used in
+isdn_tty_tiocmset() is added in isdn_tty_set_termios().
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/i4l/isdn_tty.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
+index b730037a0e2d3..9cff667b2d245 100644
+--- a/drivers/isdn/i4l/isdn_tty.c
++++ b/drivers/isdn/i4l/isdn_tty.c
+@@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ {
+ modem_info *info = (modem_info *) tty->driver_data;
+
++ mutex_lock(&modem_info_mutex);
+ if (!old_termios)
+ isdn_tty_change_speed(info);
+ else {
+ if (tty->termios.c_cflag == old_termios->c_cflag &&
+ tty->termios.c_ispeed == old_termios->c_ispeed &&
+- tty->termios.c_ospeed == old_termios->c_ospeed)
++ tty->termios.c_ospeed == old_termios->c_ospeed) {
++ mutex_unlock(&modem_info_mutex);
+ return;
++ }
+ isdn_tty_change_speed(info);
+ }
++ mutex_unlock(&modem_info_mutex);
+ }
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From 18a629e072d9094e3282028d6672346ca61a5231 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Tue, 25 Dec 2018 22:18:23 -0600
+Subject: leds: lp5523: fix a missing check of return value of lp55xx_read
+
+[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]
+
+When lp55xx_read() fails, "status" is an uninitialized variable and thus
+may contain random value; using it leads to undefined behaviors.
+
+The fix inserts a check for the return value of lp55xx_read: if it
+fails, returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lp5523.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
+index a2e74feee2b2f..fd64df5a57a5e 100644
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
+
+ /* Let the programs run for couple of ms and check the engine status */
+ usleep_range(3000, 6000);
+- lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
++ if (ret)
++ return ret;
+ status &= LP5523_ENG_STATUS_MASK;
+
+ if (status != LP5523_ENG_STATUS_MASK) {
+--
+2.19.1
+
--- /dev/null
+From 10410dd82c31d89e002adada2dcb0dc822f3a800 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 25 Oct 2018 15:43:44 +0300
+Subject: mfd: ab8500-core: Return zero in get_register_interruptible()
+
+[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ]
+
+This function is supposed to return zero on success or negative error
+codes on error. Unfortunately, there is a bug so it sometimes returns
+non-zero, positive numbers on success.
+
+I noticed this bug during review and I can't test it. It does appear
+that the return is sometimes propogated back to _regmap_read() where all
+non-zero returns are treated as failure so this may affect run time.
+
+Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ab8500-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index 30d09d1771717..11ab17f64c649 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
+ mutex_unlock(&ab8500->lock);
+ dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
+
+- return ret;
++ return (ret < 0) ? ret : 0;
+ }
+
+ static int ab8500_get_register(struct device *dev, u8 bank,
+--
+2.19.1
+
--- /dev/null
+From 78f6b287c0892d2eb46d78547d2685f7d066df34 Mon Sep 17 00:00:00 2001
+From: Oskari Lemmela <oskari@lemmela.net>
+Date: Tue, 20 Nov 2018 19:52:10 +0200
+Subject: mfd: axp20x: Add AC power supply cell for AXP813
+
+[ Upstream commit 4a19f9a65375ca9781b3ca9e810ece92edfc3e78 ]
+
+As axp20x-ac-power-supply now supports AXP813, add a cell for it.
+
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+Reviewed-by: Quentin Schulz <quentin.schulz@bootlin.com>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index 0be511dd93d01..dfc3cff1d08b4 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -778,6 +778,11 @@ static const struct mfd_cell axp813_cells[] = {
+ }, {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp813-battery-power-supply",
++ }, {
++ .name = "axp20x-ac-power-supply",
++ .of_compatible = "x-powers,axp813-ac-power-supply",
++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources),
++ .resources = axp20x_ac_power_supply_resources,
+ },
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 36c655f0c5b334a6a1d97c06e2628e103320d517 Mon Sep 17 00:00:00 2001
+From: Oskari Lemmela <oskari@lemmela.net>
+Date: Sat, 8 Dec 2018 19:58:47 +0200
+Subject: mfd: axp20x: Add supported cells for AXP803
+
+[ Upstream commit ea90e7b47f0a8bd2fe14e9a88f523de7c67db90a ]
+
+Parts of the AXP803 are compatible with their counterparts on the AXP813.
+These include the GPIO, ADC, AC and battery power supplies.
+
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index 8037b4e01ed67..f8e0fa97bb31e 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -726,6 +726,20 @@ static const struct mfd_cell axp803_cells[] = {
+ .name = "axp221-pek",
+ .num_resources = ARRAY_SIZE(axp803_pek_resources),
+ .resources = axp803_pek_resources,
++ }, {
++ .name = "axp20x-gpio",
++ .of_compatible = "x-powers,axp813-gpio",
++ }, {
++ .name = "axp813-adc",
++ .of_compatible = "x-powers,axp813-adc",
++ }, {
++ .name = "axp20x-battery-power-supply",
++ .of_compatible = "x-powers,axp813-battery-power-supply",
++ }, {
++ .name = "axp20x-ac-power-supply",
++ .of_compatible = "x-powers,axp813-ac-power-supply",
++ .num_resources = ARRAY_SIZE(axp20x_ac_power_supply_resources),
++ .resources = axp20x_ac_power_supply_resources,
+ },
+ { .name = "axp20x-regulator" },
+ };
+--
+2.19.1
+
--- /dev/null
+From 3c9832d51408631bb6e1d2e7766786d3007e3d4a Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Sat, 8 Dec 2018 19:58:46 +0200
+Subject: mfd: axp20x: Re-align MFD cell entries
+
+[ Upstream commit 753a8d083e085c6f552c7982749de4cc7c40e2ac ]
+
+In the axp20x driver, the various mfd_cell lists had varying amounts
+of indentation, sometimes even within the same list. For the axp288,
+there's no alignment at all.
+
+Re-align the right hand side of the assignments with the least amount
+of tabs possible. Also collapse the closing bracket and the opening
+bracket of the next entry onto the same line for the axp288, to be
+consistent with all the other mfd_cell lists.
+
+This patch is whitespace change only. No functionality is modified.
+
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Oskari Lemmela <oskari@lemmela.net>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 107 +++++++++++++++++++++----------------------
+ 1 file changed, 51 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index dfc3cff1d08b4..8037b4e01ed67 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -640,9 +640,9 @@ static const struct mfd_cell axp221_cells[] = {
+
+ static const struct mfd_cell axp223_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp22x_pek_resources),
+- .resources = axp22x_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp22x_pek_resources),
++ .resources = axp22x_pek_resources,
+ }, {
+ .name = "axp22x-adc",
+ .of_compatible = "x-powers,axp221-adc",
+@@ -650,7 +650,7 @@ static const struct mfd_cell axp223_cells[] = {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp221-battery-power-supply",
+ }, {
+- .name = "axp20x-regulator",
++ .name = "axp20x-regulator",
+ }, {
+ .name = "axp20x-ac-power-supply",
+ .of_compatible = "x-powers,axp221-ac-power-supply",
+@@ -666,9 +666,9 @@ static const struct mfd_cell axp223_cells[] = {
+
+ static const struct mfd_cell axp152_cells[] = {
+ {
+- .name = "axp20x-pek",
+- .num_resources = ARRAY_SIZE(axp152_pek_resources),
+- .resources = axp152_pek_resources,
++ .name = "axp20x-pek",
++ .num_resources = ARRAY_SIZE(axp152_pek_resources),
++ .resources = axp152_pek_resources,
+ },
+ };
+
+@@ -697,84 +697,79 @@ static const struct resource axp288_charger_resources[] = {
+
+ static const struct mfd_cell axp288_cells[] = {
+ {
+- .name = "axp288_adc",
+- .num_resources = ARRAY_SIZE(axp288_adc_resources),
+- .resources = axp288_adc_resources,
+- },
+- {
+- .name = "axp288_extcon",
+- .num_resources = ARRAY_SIZE(axp288_extcon_resources),
+- .resources = axp288_extcon_resources,
+- },
+- {
+- .name = "axp288_charger",
+- .num_resources = ARRAY_SIZE(axp288_charger_resources),
+- .resources = axp288_charger_resources,
+- },
+- {
+- .name = "axp288_fuel_gauge",
+- .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
+- .resources = axp288_fuel_gauge_resources,
+- },
+- {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp288_power_button_resources),
+- .resources = axp288_power_button_resources,
+- },
+- {
+- .name = "axp288_pmic_acpi",
++ .name = "axp288_adc",
++ .num_resources = ARRAY_SIZE(axp288_adc_resources),
++ .resources = axp288_adc_resources,
++ }, {
++ .name = "axp288_extcon",
++ .num_resources = ARRAY_SIZE(axp288_extcon_resources),
++ .resources = axp288_extcon_resources,
++ }, {
++ .name = "axp288_charger",
++ .num_resources = ARRAY_SIZE(axp288_charger_resources),
++ .resources = axp288_charger_resources,
++ }, {
++ .name = "axp288_fuel_gauge",
++ .num_resources = ARRAY_SIZE(axp288_fuel_gauge_resources),
++ .resources = axp288_fuel_gauge_resources,
++ }, {
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp288_power_button_resources),
++ .resources = axp288_power_button_resources,
++ }, {
++ .name = "axp288_pmic_acpi",
+ },
+ };
+
+ static const struct mfd_cell axp803_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp803_pek_resources),
+- .resources = axp803_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp803_pek_resources),
++ .resources = axp803_pek_resources,
+ },
+- { .name = "axp20x-regulator" },
++ { .name = "axp20x-regulator" },
+ };
+
+ static const struct mfd_cell axp806_self_working_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp806_pek_resources),
+- .resources = axp806_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp806_pek_resources),
++ .resources = axp806_pek_resources,
+ },
+- { .name = "axp20x-regulator" },
++ { .name = "axp20x-regulator" },
+ };
+
+ static const struct mfd_cell axp806_cells[] = {
+ {
+- .id = 2,
+- .name = "axp20x-regulator",
++ .id = 2,
++ .name = "axp20x-regulator",
+ },
+ };
+
+ static const struct mfd_cell axp809_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp809_pek_resources),
+- .resources = axp809_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp809_pek_resources),
++ .resources = axp809_pek_resources,
+ }, {
+- .id = 1,
+- .name = "axp20x-regulator",
++ .id = 1,
++ .name = "axp20x-regulator",
+ },
+ };
+
+ static const struct mfd_cell axp813_cells[] = {
+ {
+- .name = "axp221-pek",
+- .num_resources = ARRAY_SIZE(axp803_pek_resources),
+- .resources = axp803_pek_resources,
++ .name = "axp221-pek",
++ .num_resources = ARRAY_SIZE(axp803_pek_resources),
++ .resources = axp803_pek_resources,
+ }, {
+- .name = "axp20x-regulator",
++ .name = "axp20x-regulator",
+ }, {
+- .name = "axp20x-gpio",
+- .of_compatible = "x-powers,axp813-gpio",
++ .name = "axp20x-gpio",
++ .of_compatible = "x-powers,axp813-gpio",
+ }, {
+- .name = "axp813-adc",
+- .of_compatible = "x-powers,axp813-adc",
++ .name = "axp813-adc",
++ .of_compatible = "x-powers,axp813-adc",
+ }, {
+ .name = "axp20x-battery-power-supply",
+ .of_compatible = "x-powers,axp813-battery-power-supply",
+--
+2.19.1
+
--- /dev/null
+From 9e64e44d9d8388a3dd344b3f9ba404426fa139fb Mon Sep 17 00:00:00 2001
+From: Dien Pham <dien.pham.ry@renesas.com>
+Date: Wed, 3 Oct 2018 15:58:41 +0200
+Subject: mfd: bd9571mwv: Add volatile register to make DVFS work
+
+[ Upstream commit b0aff01e7aa6ad2d6998ef1323843212d1db8b04 ]
+
+Because BD9571MWV_DVFS_MONIVDAC is not defined in the volatile table,
+the physical register value is not updated by regmap and DVFS doesn't
+work as expected. Fix it!
+
+Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver")
+Signed-off-by: Dien Pham <dien.pham.ry@renesas.com>
+[wsa: rebase, add 'Fixes', reword commit message]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/bd9571mwv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index 503979c81dae1..fab3cdc27ed64 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -59,6 +59,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = {
+ };
+
+ static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = {
++ regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC),
+ regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN),
+ regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT),
+ regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ),
+--
+2.19.1
+
--- /dev/null
+From ff5a6c0eb7d28f61a95c4fcbc3785cb6f7902dec Mon Sep 17 00:00:00 2001
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Date: Mon, 10 Dec 2018 19:00:02 +0100
+Subject: mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove
+
+[ Upstream commit 18e294ddafaeb80a1e2e10c9bd750a6cb8388d5b ]
+
+The driver adds different MFD child devices via mfd_add_devices() and
+hence it is required to call mfd_remove_devices() to remove MFD child
+devices.
+
+Fixes: 5e0115581bbc ("cros_ec: Move cros_ec_dev module to drivers/mfd")
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cros_ec_dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
+index 6b22d54a540d1..bccde3eac92ca 100644
+--- a/drivers/mfd/cros_ec_dev.c
++++ b/drivers/mfd/cros_ec_dev.c
+@@ -499,6 +499,7 @@ static int ec_device_remove(struct platform_device *pdev)
+
+ cros_ec_debugfs_remove(ec);
+
++ mfd_remove_devices(ec->dev);
+ cdev_del(&ec->cdev);
+ device_unregister(&ec->class_dev);
+ return 0;
+--
+2.19.1
+
--- /dev/null
+From 45e74cdae435cf79700e3d6ae423fce7c62ead67 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 17 Oct 2018 17:56:28 -0700
+Subject: mfd: db8500-prcmu: Fix some section annotations
+
+[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ]
+
+When building the kernel with Clang, the following section mismatch
+warnings appear:
+
+WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from
+the function db8500_prcmu_probe() to the function
+.init.text:init_prcm_registers()
+The function db8500_prcmu_probe() references
+the function __init init_prcm_registers().
+This is often because db8500_prcmu_probe lacks a __init
+annotation or the annotation of init_prcm_registers is wrong.
+
+WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from
+the function db8500_prcmu_probe() to the function
+.init.text:fw_project_name()
+The function db8500_prcmu_probe() references
+the function __init fw_project_name().
+This is often because db8500_prcmu_probe lacks a __init
+annotation or the annotation of fw_project_name is wrong.
+
+db8500_prcmu_probe should not be marked as __init so remove the __init
+annotation from fw_project_name and init_prcm_registers.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/db8500-prcmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
+index 5970b8def5487..aec20e1c7d3d5 100644
+--- a/drivers/mfd/db8500-prcmu.c
++++ b/drivers/mfd/db8500-prcmu.c
+@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = {
+ .irq_unmask = prcmu_irq_unmask,
+ };
+
+-static __init char *fw_project_name(u32 project)
++static char *fw_project_name(u32 project)
+ {
+ switch (project) {
+ case PRCMU_FW_PROJECT_U8500:
+@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
+ INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
+ }
+
+-static void __init init_prcm_registers(void)
++static void init_prcm_registers(void)
+ {
+ u32 val;
+
+--
+2.19.1
+
--- /dev/null
+From 4bafbaf1a89782bab39fad5b8c0fe6bd775d2a39 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Thu, 20 Dec 2018 15:12:11 -0600
+Subject: mfd: mc13xxx: Fix a missing check of a register-read failure
+
+[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ]
+
+When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will
+contain random value. Further execution uses "old_adc0" even when
+mc13xxx_reg_read() fails.
+The fix checks the return value of mc13xxx_reg_read(), and exits
+the execution when it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mc13xxx-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index c63e331738c17..234febfe6398b 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+
+ mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
+
+- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++ if (ret)
++ goto out;
+
+ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
+ adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
+--
+2.19.1
+
--- /dev/null
+From 5ce98b90a5748a16e457976a4270fbde86051c6b Mon Sep 17 00:00:00 2001
+From: Nicolas Boichat <drinkcat@chromium.org>
+Date: Mon, 22 Oct 2018 10:55:06 +0800
+Subject: mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
+
+[ Upstream commit a177276aa098aa47a100d51a13eaaef029604b6d ]
+
+If the PMIC ID is unknown, the current code would call
+irq_domain_remove and panic, as pmic->irq_domain is only
+initialized by mt6397_irq_init.
+
+Return immediately with an error, if the chip ID is unsupported.
+
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mt6397-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
+index 77b64bd64df36..ab24e176ef448 100644
+--- a/drivers/mfd/mt6397-core.c
++++ b/drivers/mfd/mt6397-core.c
+@@ -329,8 +329,7 @@ static int mt6397_probe(struct platform_device *pdev)
+
+ default:
+ dev_err(&pdev->dev, "unsupported chip: %d\n", id);
+- ret = -ENODEV;
+- break;
++ return -ENODEV;
+ }
+
+ if (ret) {
+--
+2.19.1
+
--- /dev/null
+From eb2c764feafd017a1395cabdfdce835c0f5f2d35 Mon Sep 17 00:00:00 2001
+From: Jonathan Marek <jonathan@marek.ca>
+Date: Mon, 19 Nov 2018 14:53:17 -0500
+Subject: mfd: qcom_rpm: write fw_version to CTRL_REG
+
+[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ]
+
+This is required as part of the initialization sequence on certain SoCs.
+
+If these registers are not initialized, the hardware can be unresponsive.
+This fixes the driver on apq8060 (HP TouchPad device).
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/qcom_rpm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
+index 52fafea06067e..8d420c37b2a61 100644
+--- a/drivers/mfd/qcom_rpm.c
++++ b/drivers/mfd/qcom_rpm.c
+@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
+ return -EFAULT;
+ }
+
++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
++
+ dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
+ fw_version[1],
+ fw_version[2]);
+--
+2.19.1
+
--- /dev/null
+From 217238efc10a451970d633b120c15b95f36435e8 Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Mon, 3 Dec 2018 13:31:17 +0530
+Subject: mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd
+ cells
+
+[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ]
+
+Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that
+different instances are uniquely identified. This is required in order
+to support registering of multiple instances of same ti_am335x_tscadc IP.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ti_am335x_tscadc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index 7a30546880a42..fe8d335a4d74d 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -264,8 +264,9 @@ static int ti_tscadc_probe(struct platform_device *pdev)
+ cell->pdata_size = sizeof(tscadc);
+ }
+
+- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells,
+- tscadc->used_cells, NULL, 0, NULL);
++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
++ tscadc->cells, tscadc->used_cells, NULL,
++ 0, NULL);
+ if (err < 0)
+ goto err_disable_clk;
+
+--
+2.19.1
+
--- /dev/null
+From a412eb518363bfa746be8eb5bbddec904809607b Mon Sep 17 00:00:00 2001
+From: Keerthy <j-keerthy@ti.com>
+Date: Sun, 9 Dec 2018 19:29:31 +0530
+Subject: mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path
+ in probe()
+
+[ Upstream commit 75d4c5e03c2ae9902ab521024b10291f6fc9515b ]
+
+Use devm_regmap_add_irq_chip and clean up error path in probe
+and also the remove function.
+
+Reported-by: Christian Hohnstaedt <Christian.Hohnstaedt@wago.com>
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tps65218.c | 24 +++---------------------
+ 1 file changed, 3 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
+index 910f569ff77c1..8bcdecf494d05 100644
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -235,9 +235,9 @@ static int tps65218_probe(struct i2c_client *client,
+
+ mutex_init(&tps->tps_lock);
+
+- ret = regmap_add_irq_chip(tps->regmap, tps->irq,
+- IRQF_ONESHOT, 0, &tps65218_irq_chip,
+- &tps->irq_data);
++ ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq,
++ IRQF_ONESHOT, 0, &tps65218_irq_chip,
++ &tps->irq_data);
+ if (ret < 0)
+ return ret;
+
+@@ -253,26 +253,9 @@ static int tps65218_probe(struct i2c_client *client,
+ ARRAY_SIZE(tps65218_cells), NULL, 0,
+ regmap_irq_get_domain(tps->irq_data));
+
+- if (ret < 0)
+- goto err_irq;
+-
+- return 0;
+-
+-err_irq:
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+ return ret;
+ }
+
+-static int tps65218_remove(struct i2c_client *client)
+-{
+- struct tps65218 *tps = i2c_get_clientdata(client);
+-
+- regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id tps65218_id_table[] = {
+ { "tps65218", TPS65218 },
+ { },
+@@ -285,7 +268,6 @@ static struct i2c_driver tps65218_driver = {
+ .of_match_table = of_tps65218_match_table,
+ },
+ .probe = tps65218_probe,
+- .remove = tps65218_remove,
+ .id_table = tps65218_id_table,
+ };
+
+--
+2.19.1
+
--- /dev/null
+From 662720a04ef173b691e029556ca7005986e4a232 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 17 Oct 2018 10:13:23 -0700
+Subject: mfd: twl-core: Fix section annotations on {,un}protect_pm_master
+
+[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ]
+
+When building the kernel with Clang, the following section mismatch
+warning appears:
+
+WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from
+the function twl_probe() to the function
+.init.text:unprotect_pm_master()
+The function twl_probe() references
+the function __init unprotect_pm_master().
+This is often because twl_probe lacks a __init
+annotation or the annotation of unprotect_pm_master is wrong.
+
+Remove the __init annotation on the *protect_pm_master functions so
+there is no more mismatch.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/twl-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
+index 4be3d239da9ec..299016bc46d90 100644
+--- a/drivers/mfd/twl-core.c
++++ b/drivers/mfd/twl-core.c
+@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
+ * letting it generate the right frequencies for USB, MADC, and
+ * other purposes.
+ */
+-static inline int __init protect_pm_master(void)
++static inline int protect_pm_master(void)
+ {
+ int e = 0;
+
+@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
+ return e;
+ }
+
+-static inline int __init unprotect_pm_master(void)
++static inline int unprotect_pm_master(void)
+ {
+ int e = 0;
+
+--
+2.19.1
+
--- /dev/null
+From 65aa8bdf4abdce0d03cfb265a36c852ae50316ae Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Wed, 28 Nov 2018 10:04:22 +0000
+Subject: mfd: wm5110: Add missing ASRC rate register
+
+[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ]
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wm5110-tables.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
+index 1ee68bd440fbc..16c6e2accfaa5 100644
+--- a/drivers/mfd/wm5110-tables.c
++++ b/drivers/mfd/wm5110-tables.c
+@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
+ { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */
+ { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */
+ { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */
++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */
+ { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */
+ { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */
+ { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
+@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
+ case ARIZONA_ASRC_ENABLE:
+ case ARIZONA_ASRC_STATUS:
+ case ARIZONA_ASRC_RATE1:
++ case ARIZONA_ASRC_RATE2:
+ case ARIZONA_ISRC_1_CTRL_1:
+ case ARIZONA_ISRC_1_CTRL_2:
+ case ARIZONA_ISRC_1_CTRL_3:
+--
+2.19.1
+
--- /dev/null
+From 2c9360871b9ba46b2a10ddcffeb8ffa95334376a Mon Sep 17 00:00:00 2001
+From: Alban Bedel <albeu@free.fr>
+Date: Mon, 7 Jan 2019 20:45:15 +0100
+Subject: MIPS: ath79: Enable OF serial ports in the default config
+
+[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ]
+
+CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF
+boards, enable it in the default config to get a working setup out of
+the box.
+
+Signed-off-by: Alban Bedel <albeu@free.fr>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@vger.kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/configs/ath79_defconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
+index 951c4231bdb85..4c47b3fd958b6 100644
+--- a/arch/mips/configs/ath79_defconfig
++++ b/arch/mips/configs/ath79_defconfig
+@@ -71,6 +71,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
+ # CONFIG_SERIAL_8250_PCI is not set
+ CONFIG_SERIAL_8250_NR_UARTS=1
+ CONFIG_SERIAL_8250_RUNTIME_UARTS=1
++CONFIG_SERIAL_OF_PLATFORM=y
+ CONFIG_SERIAL_AR933X=y
+ CONFIG_SERIAL_AR933X_CONSOLE=y
+ # CONFIG_HW_RANDOM is not set
+--
+2.19.1
+
--- /dev/null
+From e488a674d9dcbdd8616f3a26838f0a27688c87e6 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Wed, 9 Jan 2019 18:12:16 +0100
+Subject: MIPS: jazz: fix 64bit build
+
+[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ]
+
+64bit JAZZ builds failed with
+
+ linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`:
+ /linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration
+ of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`?
+ [-Werror=implicit-function-declaration]
+ pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ ^~~~~~~~~
+ CKSEG1ADDR
+ /linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from
+ integer of different size [-Werror=int-to-pointer-cast]
+ pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
+ ^
+ In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0,
+ from /linux-next/include/linux/compiler.h:248,
+ from /linux-next/include/linux/kernel.h:10,
+ from /linux-next/arch/mips/jazz/jazzdma.c:11:
+ /linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from
+ pointer to integer of different size [-Werror=pointer-to-int-cast]
+ #define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */
+ ^
+ /linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in
+ expansion of macro `_ACAST32_`
+ #define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff)
+ ^~~~~~~~~
+ /linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of
+ macro `CPHYSADDR`
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
+
+Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup
+fixes this.
+
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/jazz/jazzdma.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
+index d31bc2f012088..fb2b6d0b77c36 100644
+--- a/arch/mips/jazz/jazzdma.c
++++ b/arch/mips/jazz/jazzdma.c
+@@ -74,14 +74,15 @@ static int __init vdma_init(void)
+ get_order(VDMA_PGTBL_SIZE));
+ BUG_ON(!pgtbl);
+ dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
+- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
+
+ /*
+ * Clear the R4030 translation table
+ */
+ vdma_pgtbl_init();
+
+- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
++ CPHYSADDR((unsigned long)pgtbl));
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
+ r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+
+--
+2.19.1
+
--- /dev/null
+From c4dd758aeb23871b27eaabb773dc4e3c0e71a6a9 Mon Sep 17 00:00:00 2001
+From: Nir Dotan <nird@mellanox.com>
+Date: Fri, 18 Jan 2019 15:57:57 +0000
+Subject: mlxsw: pci: Return error on PCI reset timeout
+
+[ Upstream commit 67c14cc9b35055264fc0efed00159a7de1819f1b ]
+
+Return an appropriate error in the case when the driver timeouts on waiting
+for firmware to go out of PCI reset.
+
+Fixes: 233fa44bd67a ("mlxsw: pci: Implement reset done check")
+Signed-off-by: Nir Dotan <nird@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+index c7901a3f2a794..a903e97793f9a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -1367,10 +1367,10 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci,
+ u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
+
+ if ((val & MLXSW_PCI_FW_READY_MASK) == MLXSW_PCI_FW_READY_MAGIC)
+- break;
++ return 0;
+ cond_resched();
+ } while (time_before(jiffies, end));
+- return 0;
++ return -EBUSY;
+ }
+
+ static int mlxsw_pci_alloc_irq_vectors(struct mlxsw_pci *mlxsw_pci)
+--
+2.19.1
+
--- /dev/null
+From c823c4dfb49658af2822509b657020e1a56fe25c Mon Sep 17 00:00:00 2001
+From: Nir Dotan <nird@mellanox.com>
+Date: Tue, 8 Jan 2019 16:48:03 +0000
+Subject: mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition
+
+[ Upstream commit ff0db43cd6c530ff944773ccf48ece55d32d0c22 ]
+
+When writing to C-TCAM, mlxsw driver uses cregion->ops->entry_insert().
+In case of C-TCAM HW insertion error, the opposite action should take
+place.
+Add error handling case in which the C-TCAM region entry is removed, by
+calling cregion->ops->entry_remove().
+
+Fixes: a0a777b9409f ("mlxsw: spectrum_acl: Start using A-TCAM")
+Signed-off-by: Nir Dotan <nird@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+index e3c6fe8b1d406..1dcf152b28138 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c
+@@ -75,7 +75,15 @@ mlxsw_sp_acl_ctcam_region_entry_insert(struct mlxsw_sp *mlxsw_sp,
+ act_set = mlxsw_afa_block_first_set(rulei->act_block);
+ mlxsw_reg_ptce2_flex_action_set_memcpy_to(ptce2_pl, act_set);
+
+- return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
++ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(ptce2), ptce2_pl);
++ if (err)
++ goto err_ptce2_write;
++
++ return 0;
++
++err_ptce2_write:
++ cregion->ops->entry_remove(cregion, centry);
++ return err;
+ }
+
+ static void
+--
+2.19.1
+
--- /dev/null
+From ce0602891f1578fa50ed2f77544d601779d26a9d Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:01 +0000
+Subject: mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
+
+[ Upstream commit 64254a2054611205798e6bde634639bc704573ac ]
+
+The driver currently treats static FDB entries as both static and
+sticky. This is incorrect and prevents such entries from being roamed to
+a different port via learning.
+
+Fix this by configuring static entries with ageing disabled and roaming
+enabled.
+
+In net-next we can add proper support for the newly introduced 'sticky'
+flag.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index cdec48bcc6ad5..af673abdb4823 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1209,7 +1209,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp,
+ static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
+ {
+ return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
+- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
+ }
+
+ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+@@ -1221,7 +1221,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ const char *mac, u16 fid, bool adding,
+ enum mlxsw_reg_sfd_rec_action action,
+- bool dynamic)
++ enum mlxsw_reg_sfd_rec_policy policy)
+ {
+ char *sfd_pl;
+ u8 num_rec;
+@@ -1232,8 +1232,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ return -ENOMEM;
+
+ mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
+- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
+- mac, fid, action, local_port);
++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
+ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
+ err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
+ if (err)
+@@ -1252,7 +1251,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ bool dynamic)
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
+- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
++ MLXSW_REG_SFD_REC_ACTION_NOP,
++ mlxsw_sp_sfd_rec_policy(dynamic));
+ }
+
+ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+@@ -1260,7 +1260,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+ {
+ return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
+ MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
+- false);
++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
+ }
+
+ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
+--
+2.19.1
+
--- /dev/null
+From cfa52f8771e2d873ea9ab12674e6267e0440d376 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:00 +0000
+Subject: net: bridge: Mark FDB entries that were added by user as such
+
+[ Upstream commit 710ae72877378e7cde611efd30fe90502a6e5b30 ]
+
+Externally learned entries can be added by a user or by a switch driver
+that is notifying the bridge driver about entries that were learned in
+hardware.
+
+In the first case, the entries are not marked with the 'added_by_user'
+flag, which causes switch drivers to ignore them and not offload them.
+
+The 'added_by_user' flag can be set on externally learned FDB entries
+based on the 'swdev_notify' parameter in br_fdb_external_learn_add(),
+which effectively means if the created / updated FDB entry was added by
+a user or not.
+
+Fixes: 816a3bed9549 ("switchdev: Add fdb.added_by_user to switchdev notifications")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
+Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Cc: bridge@lists.linux-foundation.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_fdb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
+index 502f663495308..4d4b9b5ea1c17 100644
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -1088,6 +1088,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ err = -ENOMEM;
+ goto err_unlock;
+ }
++ if (swdev_notify)
++ fdb->added_by_user = 1;
+ fdb->added_by_external_learn = 1;
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ } else {
+@@ -1107,6 +1109,9 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
+ modified = true;
+ }
+
++ if (swdev_notify)
++ fdb->added_by_user = 1;
++
+ if (modified)
+ fdb_notify(br, fdb, RTM_NEWNEIGH, swdev_notify);
+ }
+--
+2.19.1
+
--- /dev/null
+From 5441ea9b0f38993c85dfeea48b08efbd5960d519 Mon Sep 17 00:00:00 2001
+From: Yonglong Liu <liuyonglong@huawei.com>
+Date: Fri, 4 Jan 2019 20:18:11 +0800
+Subject: net: hns: Fix use after free identified by SLUB debug
+
+[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ]
+
+When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will
+identify a use after free bug:
+
+[134.189505] Unable to handle kernel paging request at virtual address
+ 006b6b6b6b6b6b6b
+[134.197553] Mem abort info:
+[134.200381] ESR = 0x96000004
+[134.203487] Exception class = DABT (current EL), IL = 32 bits
+[134.209497] SET = 0, FnV = 0
+[134.212596] EA = 0, S1PTW = 0
+[134.215777] Data abort info:
+[134.218701] ISV = 0, ISS = 0x00000004
+[134.222596] CM = 0, WnR = 0
+[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges
+[134.232851] Internal error: Oops: 96000004 [#1] SMP
+[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G
+ OE 4.19.5-1.2.34.aarch64 #1
+[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018
+[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO)
+[134.260044] pc : hns_ae_put_handle+0x38/0x60
+[134.264372] lr : hns_ae_put_handle+0x24/0x60
+[134.268700] sp : ffff00001be93c50
+[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040
+[134.277442] x27: 0000000000000000 x26: 0000000000000000
+[134.282830] x25: 0000000056000000 x24: 0000000000000015
+[134.288284] x23: ffff0000096fe098 x22: ffff000001050070
+[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098
+[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000
+[134.312945] x17: 0000000000000000 x16: 0000000000000000
+[134.322517] x15: 0000000000000002 x14: 0000000000000000
+[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988
+[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000
+[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000
+[134.360569] x7 : dead000000000100 x6 : ffff000009579748
+[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000
+[134.379550] x3 : 0000000000000001 x2 : 0000000000000000
+[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000
+[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd)
+[134.408498] Call trace:
+[134.414611] hns_ae_put_handle+0x38/0x60
+[134.422208] hnae_put_handle+0xd4/0x108
+[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv]
+[134.438342] platform_drv_remove+0x2c/0x70
+[134.445958] device_release_driver_internal+0x174/0x208
+[134.454810] driver_detach+0x70/0xd8
+[134.461913] bus_remove_driver+0x64/0xe8
+[134.469396] driver_unregister+0x34/0x60
+[134.476822] platform_driver_unregister+0x20/0x30
+[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv]
+[134.494634] __arm64_sys_delete_module+0x238/0x290
+
+struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is
+freed, than use hnae_handle will cause use after free panic.
+
+This patch frees vf_cb after hnae_handle used.
+
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index ad1779fc410e6..a78bfafd212c8 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
+ struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
+ int i;
+
+- vf_cb->mac_cb = NULL;
+-
+- kfree(vf_cb);
+-
+ for (i = 0; i < handle->q_num; i++)
+ hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
++
++ kfree(vf_cb);
+ }
+
+ static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+--
+2.19.1
+
--- /dev/null
+From bcafeccdea8ae6a80c9e8754cedb287b47bad74e Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Thu, 3 Jan 2019 10:23:23 -0700
+Subject: net/mlx4: Get rid of page operation after dma_alloc_coherent
+
+[ Upstream commit f65e192af35058e5c82da9e90871b472d24912bc ]
+
+This patch solves a crash at the time of mlx4 driver unload or system
+shutdown. The crash occurs because dma_alloc_coherent() returns one
+value in mlx4_alloc_icm_coherent(), but a different value is passed to
+dma_free_coherent() in mlx4_free_icm_coherent(). In turn this is because
+when allocated, that pointer is passed to sg_set_buf() to record it,
+then when freed it is re-calculated by calling
+lowmem_page_address(sg_page()) which returns a different value. Solve
+this by recording the value that dma_alloc_coherent() returns, and
+passing this to dma_free_coherent().
+
+This patch is roughly equivalent to commit 378efe798ecf ("RDMA/hns: Get
+rid of page operation after dma_alloc_coherent").
+
+Based-on-code-from: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/icm.c | 92 ++++++++++++++----------
+ drivers/net/ethernet/mellanox/mlx4/icm.h | 22 +++++-
+ 2 files changed, 75 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
+index 7262c6310650e..288fca826a55c 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
+@@ -57,12 +57,12 @@ static void mlx4_free_icm_pages(struct mlx4_dev *dev, struct mlx4_icm_chunk *chu
+ int i;
+
+ if (chunk->nsg > 0)
+- pci_unmap_sg(dev->persist->pdev, chunk->mem, chunk->npages,
++ pci_unmap_sg(dev->persist->pdev, chunk->sg, chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+ for (i = 0; i < chunk->npages; ++i)
+- __free_pages(sg_page(&chunk->mem[i]),
+- get_order(chunk->mem[i].length));
++ __free_pages(sg_page(&chunk->sg[i]),
++ get_order(chunk->sg[i].length));
+ }
+
+ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *chunk)
+@@ -71,9 +71,9 @@ static void mlx4_free_icm_coherent(struct mlx4_dev *dev, struct mlx4_icm_chunk *
+
+ for (i = 0; i < chunk->npages; ++i)
+ dma_free_coherent(&dev->persist->pdev->dev,
+- chunk->mem[i].length,
+- lowmem_page_address(sg_page(&chunk->mem[i])),
+- sg_dma_address(&chunk->mem[i]));
++ chunk->buf[i].size,
++ chunk->buf[i].addr,
++ chunk->buf[i].dma_addr);
+ }
+
+ void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent)
+@@ -111,22 +111,21 @@ static int mlx4_alloc_icm_pages(struct scatterlist *mem, int order,
+ return 0;
+ }
+
+-static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
+- int order, gfp_t gfp_mask)
++static int mlx4_alloc_icm_coherent(struct device *dev, struct mlx4_icm_buf *buf,
++ int order, gfp_t gfp_mask)
+ {
+- void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order,
+- &sg_dma_address(mem), gfp_mask);
+- if (!buf)
++ buf->addr = dma_alloc_coherent(dev, PAGE_SIZE << order,
++ &buf->dma_addr, gfp_mask);
++ if (!buf->addr)
+ return -ENOMEM;
+
+- if (offset_in_page(buf)) {
+- dma_free_coherent(dev, PAGE_SIZE << order,
+- buf, sg_dma_address(mem));
++ if (offset_in_page(buf->addr)) {
++ dma_free_coherent(dev, PAGE_SIZE << order, buf->addr,
++ buf->dma_addr);
+ return -ENOMEM;
+ }
+
+- sg_set_buf(mem, buf, PAGE_SIZE << order);
+- sg_dma_len(mem) = PAGE_SIZE << order;
++ buf->size = PAGE_SIZE << order;
+ return 0;
+ }
+
+@@ -159,21 +158,21 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+
+ while (npages > 0) {
+ if (!chunk) {
+- chunk = kmalloc_node(sizeof(*chunk),
++ chunk = kzalloc_node(sizeof(*chunk),
+ gfp_mask & ~(__GFP_HIGHMEM |
+ __GFP_NOWARN),
+ dev->numa_node);
+ if (!chunk) {
+- chunk = kmalloc(sizeof(*chunk),
++ chunk = kzalloc(sizeof(*chunk),
+ gfp_mask & ~(__GFP_HIGHMEM |
+ __GFP_NOWARN));
+ if (!chunk)
+ goto fail;
+ }
++ chunk->coherent = coherent;
+
+- sg_init_table(chunk->mem, MLX4_ICM_CHUNK_LEN);
+- chunk->npages = 0;
+- chunk->nsg = 0;
++ if (!coherent)
++ sg_init_table(chunk->sg, MLX4_ICM_CHUNK_LEN);
+ list_add_tail(&chunk->list, &icm->chunk_list);
+ }
+
+@@ -186,10 +185,10 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+
+ if (coherent)
+ ret = mlx4_alloc_icm_coherent(&dev->persist->pdev->dev,
+- &chunk->mem[chunk->npages],
+- cur_order, mask);
++ &chunk->buf[chunk->npages],
++ cur_order, mask);
+ else
+- ret = mlx4_alloc_icm_pages(&chunk->mem[chunk->npages],
++ ret = mlx4_alloc_icm_pages(&chunk->sg[chunk->npages],
+ cur_order, mask,
+ dev->numa_node);
+
+@@ -205,7 +204,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ if (coherent)
+ ++chunk->nsg;
+ else if (chunk->npages == MLX4_ICM_CHUNK_LEN) {
+- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg,
+ chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+@@ -220,7 +219,7 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
+ }
+
+ if (!coherent && chunk) {
+- chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->mem,
++ chunk->nsg = pci_map_sg(dev->persist->pdev, chunk->sg,
+ chunk->npages,
+ PCI_DMA_BIDIRECTIONAL);
+
+@@ -320,7 +319,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+ u64 idx;
+ struct mlx4_icm_chunk *chunk;
+ struct mlx4_icm *icm;
+- struct page *page = NULL;
++ void *addr = NULL;
+
+ if (!table->lowmem)
+ return NULL;
+@@ -336,28 +335,49 @@ void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+
+ list_for_each_entry(chunk, &icm->chunk_list, list) {
+ for (i = 0; i < chunk->npages; ++i) {
++ dma_addr_t dma_addr;
++ size_t len;
++
++ if (table->coherent) {
++ len = chunk->buf[i].size;
++ dma_addr = chunk->buf[i].dma_addr;
++ addr = chunk->buf[i].addr;
++ } else {
++ struct page *page;
++
++ len = sg_dma_len(&chunk->sg[i]);
++ dma_addr = sg_dma_address(&chunk->sg[i]);
++
++ /* XXX: we should never do this for highmem
++ * allocation. This function either needs
++ * to be split, or the kernel virtual address
++ * return needs to be made optional.
++ */
++ page = sg_page(&chunk->sg[i]);
++ addr = lowmem_page_address(page);
++ }
++
+ if (dma_handle && dma_offset >= 0) {
+- if (sg_dma_len(&chunk->mem[i]) > dma_offset)
+- *dma_handle = sg_dma_address(&chunk->mem[i]) +
+- dma_offset;
+- dma_offset -= sg_dma_len(&chunk->mem[i]);
++ if (len > dma_offset)
++ *dma_handle = dma_addr + dma_offset;
++ dma_offset -= len;
+ }
++
+ /*
+ * DMA mapping can merge pages but not split them,
+ * so if we found the page, dma_handle has already
+ * been assigned to.
+ */
+- if (chunk->mem[i].length > offset) {
+- page = sg_page(&chunk->mem[i]);
++ if (len > offset)
+ goto out;
+- }
+- offset -= chunk->mem[i].length;
++ offset -= len;
+ }
+ }
+
++ addr = NULL;
+ out:
+ mutex_unlock(&table->mutex);
+- return page ? lowmem_page_address(page) + offset : NULL;
++ return addr ? addr + offset : NULL;
+ }
+
+ int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
+diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
+index c9169a490557c..d199874b1c074 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
+@@ -47,11 +47,21 @@ enum {
+ MLX4_ICM_PAGE_SIZE = 1 << MLX4_ICM_PAGE_SHIFT,
+ };
+
++struct mlx4_icm_buf {
++ void *addr;
++ size_t size;
++ dma_addr_t dma_addr;
++};
++
+ struct mlx4_icm_chunk {
+ struct list_head list;
+ int npages;
+ int nsg;
+- struct scatterlist mem[MLX4_ICM_CHUNK_LEN];
++ bool coherent;
++ union {
++ struct scatterlist sg[MLX4_ICM_CHUNK_LEN];
++ struct mlx4_icm_buf buf[MLX4_ICM_CHUNK_LEN];
++ };
+ };
+
+ struct mlx4_icm {
+@@ -114,12 +124,18 @@ static inline void mlx4_icm_next(struct mlx4_icm_iter *iter)
+
+ static inline dma_addr_t mlx4_icm_addr(struct mlx4_icm_iter *iter)
+ {
+- return sg_dma_address(&iter->chunk->mem[iter->page_idx]);
++ if (iter->chunk->coherent)
++ return iter->chunk->buf[iter->page_idx].dma_addr;
++ else
++ return sg_dma_address(&iter->chunk->sg[iter->page_idx]);
+ }
+
+ static inline unsigned long mlx4_icm_size(struct mlx4_icm_iter *iter)
+ {
+- return sg_dma_len(&iter->chunk->mem[iter->page_idx]);
++ if (iter->chunk->coherent)
++ return iter->chunk->buf[iter->page_idx].size;
++ else
++ return sg_dma_len(&iter->chunk->sg[iter->page_idx]);
+ }
+
+ int mlx4_MAP_ICM_AUX(struct mlx4_dev *dev, struct mlx4_icm *icm);
+--
+2.19.1
+
--- /dev/null
+From 3d045ca9fe7d8653aae2364827a4bb5894c717d2 Mon Sep 17 00:00:00 2001
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Thu, 8 Nov 2018 12:06:53 +0200
+Subject: net/mlx5e: Fix wrong (zero) TX drop counter indication for
+ representor
+
+[ Upstream commit 7fdc1adc52d3975740547a78c2df329bb207f15d ]
+
+For representors, the TX dropped counter is not folded from the
+per-ring counters. Fix it.
+
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index c9cc9747d21d1..701624a63d2f4 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -144,6 +144,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv)
+
+ s->tx_packets += sq_stats->packets;
+ s->tx_bytes += sq_stats->bytes;
++ s->tx_queue_dropped += sq_stats->dropped;
+ }
+ }
+ }
+--
+2.19.1
+
--- /dev/null
+From 8d0349603374782237f07b924e0a871393579e83 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:58 +0100
+Subject: net: stmmac: Check if CBS is supported before configuring
+
+[ Upstream commit 0650d4017f4d2eee67230a02285a7ae5204240c2 ]
+
+Check if CBS is currently supported before trying to configure it in HW.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 531294f4978bc..58ea18af9813a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -301,6 +301,8 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+ /* Queue 0 is not AVB capable */
+ if (queue <= 0 || queue >= tx_queues_count)
+ return -EINVAL;
++ if (!priv->dma_cap.av)
++ return -EOPNOTSUPP;
+ if (priv->speed != SPEED_100 && priv->speed != SPEED_1000)
+ return -EOPNOTSUPP;
+
+--
+2.19.1
+
--- /dev/null
+From 5c109d50b9714a357ff18fbac266c41b1acae249 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:57 +0100
+Subject: net: stmmac: dwxgmac2: Only clear interrupts that are active
+
+[ Upstream commit fcc509eb10ff4794641e6ad3082118287a750d0a ]
+
+In DMA interrupt handler we were clearing all interrupts status, even
+the ones that were not active. Fix this and only clear the active
+interrupts.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+index 20909036e0028..1c39305274440 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+@@ -260,6 +260,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ struct stmmac_extra_stats *x, u32 chan)
+ {
+ u32 intr_status = readl(ioaddr + XGMAC_DMA_CH_STATUS(chan));
++ u32 intr_en = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+ int ret = 0;
+
+ /* ABNORMAL interrupts */
+@@ -279,8 +280,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ x->normal_irq_n++;
+
+ if (likely(intr_status & XGMAC_RI)) {
+- u32 value = readl(ioaddr + XGMAC_DMA_CH_INT_EN(chan));
+- if (likely(value & XGMAC_RIE)) {
++ if (likely(intr_en & XGMAC_RIE)) {
+ x->rx_normal_irq_n++;
+ ret |= handle_rx;
+ }
+@@ -292,7 +292,7 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
+ }
+
+ /* Clear interrupts */
+- writel(~0x0, ioaddr + XGMAC_DMA_CH_STATUS(chan));
++ writel(intr_en & intr_status, ioaddr + XGMAC_DMA_CH_STATUS(chan));
+
+ return ret;
+ }
+--
+2.19.1
+
--- /dev/null
+From 0905b6c70d9d03d54eb451305963334fc490b45f Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:56 +0100
+Subject: net: stmmac: Fix PCI module removal leak
+
+[ Upstream commit 6dea7e1881fd86b80da64e476ac398008daed857 ]
+
+Since commit b7d0f08e9129, the enable / disable of PCI device is not
+managed which will result in IO regions not being automatically unmapped.
+As regions continue mapped it is currently not possible to remove and
+then probe again the PCI module of stmmac.
+
+Fix this by manually unmapping regions on remove callback.
+
+Changes from v1:
+- Fix build error
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups")
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index c54a50dbd5ac2..d819e8eaba122 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+ */
+ static void stmmac_pci_remove(struct pci_dev *pdev)
+ {
++ int i;
++
+ stmmac_dvr_remove(&pdev->dev);
++
++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
++ if (pci_resource_len(pdev, i) == 0)
++ continue;
++ pcim_iounmap_regions(pdev, BIT(i));
++ break;
++ }
++
+ pci_disable_device(pdev);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From a2178def0bcb883497a505b853ff632e9782f2e0 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:05:59 +0100
+Subject: net: stmmac: Fix the logic of checking if RX Watchdog must be enabled
+
+[ Upstream commit 3b5094665e273c4a2a99f7f5f16977c0f1e19095 ]
+
+RX Watchdog can be disabled by platform definitions but currently we are
+initializing the descriptors before checking if Watchdog must be
+disabled or not.
+
+Fix this by checking earlier if user wants Watchdog disabled or not.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 2103b865726ac..24ae244c2ee33 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4191,6 +4191,18 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
+ return ret;
+ }
+
++ /* Rx Watchdog is available in the COREs newer than the 3.40.
++ * In some case, for example on bugged HW this feature
++ * has to be disable and this can be done by passing the
++ * riwt_off field from the platform.
++ */
++ if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
++ (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
++ priv->use_riwt = 1;
++ dev_info(priv->device,
++ "Enable RX Mitigation via HW Watchdog Timer\n");
++ }
++
+ return 0;
+ }
+
+@@ -4323,18 +4335,6 @@ int stmmac_dvr_probe(struct device *device,
+ if (flow_ctrl)
+ priv->flow_ctrl = FLOW_AUTO; /* RX/TX pause on */
+
+- /* Rx Watchdog is available in the COREs newer than the 3.40.
+- * In some case, for example on bugged HW this feature
+- * has to be disable and this can be done by passing the
+- * riwt_off field from the platform.
+- */
+- if (((priv->synopsys_id >= DWMAC_CORE_3_50) ||
+- (priv->plat->has_xgmac)) && (!priv->plat->riwt_off)) {
+- priv->use_riwt = 1;
+- dev_info(priv->device,
+- "Enable RX Mitigation via HW Watchdog Timer\n");
+- }
+-
+ /* Setup channels NAPI */
+ maxq = max(priv->plat->rx_queues_to_use, priv->plat->tx_queues_to_use);
+
+--
+2.19.1
+
--- /dev/null
+From 3cef9a1d02bf84b86a6edf42e26adfaad3a600da Mon Sep 17 00:00:00 2001
+From: Jose Abreu <jose.abreu@synopsys.com>
+Date: Wed, 9 Jan 2019 10:06:00 +0100
+Subject: net: stmmac: Prevent RX starvation in stmmac_napi_poll()
+
+[ Upstream commit fa0be0a43f101888ac677dba31b590963eafeaa1 ]
+
+Currently, TX is given a budget which is consumed by stmmac_tx_clean()
+and stmmac_rx() is given the remaining non-consumed budget.
+
+This is wrong and in case we are sending a large number of packets this
+can starve RX because remaining budget will be low.
+
+Let's give always the same budget for RX and TX clean.
+
+While at it, check if we missed any interrupts while we were in NAPI
+callback by looking at DMA interrupt status.
+
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 27 ++++++++++---------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 24ae244c2ee33..123b74e25ed81 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3522,27 +3522,28 @@ static int stmmac_napi_poll(struct napi_struct *napi, int budget)
+ struct stmmac_channel *ch =
+ container_of(napi, struct stmmac_channel, napi);
+ struct stmmac_priv *priv = ch->priv_data;
+- int work_done = 0, work_rem = budget;
++ int work_done, rx_done = 0, tx_done = 0;
+ u32 chan = ch->index;
+
+ priv->xstats.napi_poll++;
+
+- if (ch->has_tx) {
+- int done = stmmac_tx_clean(priv, work_rem, chan);
++ if (ch->has_tx)
++ tx_done = stmmac_tx_clean(priv, budget, chan);
++ if (ch->has_rx)
++ rx_done = stmmac_rx(priv, budget, chan);
+
+- work_done += done;
+- work_rem -= done;
+- }
+-
+- if (ch->has_rx) {
+- int done = stmmac_rx(priv, work_rem, chan);
++ work_done = max(rx_done, tx_done);
++ work_done = min(work_done, budget);
+
+- work_done += done;
+- work_rem -= done;
+- }
++ if (work_done < budget && napi_complete_done(napi, work_done)) {
++ int stat;
+
+- if (work_done < budget && napi_complete_done(napi, work_done))
+ stmmac_enable_dma_irq(priv, priv->ioaddr, chan);
++ stat = stmmac_dma_interrupt_status(priv, priv->ioaddr,
++ &priv->xstats, chan);
++ if (stat && napi_reschedule(napi))
++ stmmac_disable_dma_irq(priv, priv->ioaddr, chan);
++ }
+
+ return work_done;
+ }
+--
+2.19.1
+
--- /dev/null
+From 9deb3ca915755afb97b3348e308f2d84d080b783 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Fri, 4 Jan 2019 17:56:16 +0900
+Subject: netfilter: nf_tables: fix leaking object reference count
+
+[ Upstream commit b91d9036883793122cf6575ca4dfbfbdd201a83d ]
+
+There is no code that decreases the reference count of stateful objects
+in error path of the nft_add_set_elem(). this causes a leak of reference
+count of stateful objects.
+
+Test commands:
+ $nft add table ip filter
+ $nft add counter ip filter c1
+ $nft add map ip filter m1 { type ipv4_addr : counter \;}
+ $nft add element ip filter m1 { 1 : c1 }
+ $nft add element ip filter m1 { 1 : c1 }
+ $nft delete element ip filter m1 { 1 }
+ $nft delete counter ip filter c1
+
+Result:
+ Error: Could not process rule: Device or resource busy
+ delete counter ip filter c1
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+At the second 'nft add element ip filter m1 { 1 : c1 }', the reference
+count of the 'c1' is increased then it tries to insert into the 'm1'. but
+the 'm1' already has same element so it returns -EEXIST.
+But it doesn't decrease the reference count of the 'c1' in the error path.
+Due to a leak of the reference count of the 'c1', the 'c1' can't be
+removed by 'nft delete counter ip filter c1'.
+
+Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ed9af46720e14..38654730230b2 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4439,6 +4439,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ err5:
+ kfree(trans);
+ err4:
++ if (obj)
++ obj->use--;
+ kfree(elem.priv);
+ err3:
+ if (nla[NFTA_SET_ELEM_DATA] != NULL)
+--
+2.19.1
+
--- /dev/null
+From a1d7ac3c3003e4eae90c9a4113623b5bf00ca7db Mon Sep 17 00:00:00 2001
+From: Henry Yen <henry.yen@mediatek.com>
+Date: Mon, 14 Jan 2019 17:59:43 +0800
+Subject: netfilter: nft_flow_offload: fix checking method of conntrack helper
+
+[ Upstream commit 2314e879747e82896f51cce4488f6a00f3e1af7b ]
+
+This patch uses nfct_help() to detect whether an established connection
+needs conntrack helper instead of using test_bit(IPS_HELPER_BIT,
+&ct->status).
+
+The reason is that IPS_HELPER_BIT is only set when using explicit CT
+target.
+
+However, in the case that a device enables conntrack helper via command
+"echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper", the status of
+IPS_HELPER_BIT will not present any change, and consequently it loses
+the checking ability in the context.
+
+Signed-off-by: Henry Yen <henry.yen@mediatek.com>
+Reviewed-by: Ryder Lee <ryder.lee@mediatek.com>
+Tested-by: John Crispin <john@phrozen.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 4d7cf943fff2c..436cc14cfc59b 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -12,6 +12,7 @@
+ #include <net/netfilter/nf_conntrack_core.h>
+ #include <linux/netfilter/nf_conntrack_common.h>
+ #include <net/netfilter/nf_flow_table.h>
++#include <net/netfilter/nf_conntrack_helper.h>
+
+ struct nft_flow_offload {
+ struct nft_flowtable *flowtable;
+@@ -66,6 +67,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ {
+ struct nft_flow_offload *priv = nft_expr_priv(expr);
+ struct nf_flowtable *flowtable = &priv->flowtable->data;
++ const struct nf_conn_help *help;
+ enum ip_conntrack_info ctinfo;
+ struct nf_flow_route route;
+ struct flow_offload *flow;
+@@ -88,7 +90,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
+ goto out;
+ }
+
+- if (test_bit(IPS_HELPER_BIT, &ct->status))
++ help = nfct_help(ct);
++ if (help)
+ goto out;
+
+ if (ctinfo == IP_CT_NEW ||
+--
+2.19.1
+
--- /dev/null
+From 04cb8830b33ac4d6157abb8d645411fa266de25f Mon Sep 17 00:00:00 2001
+From: wenxu <wenxu@ucloud.cn>
+Date: Thu, 10 Jan 2019 14:51:35 +0800
+Subject: netfilter: nft_flow_offload: fix interaction with vrf slave device
+
+[ Upstream commit 10f4e765879e514e1ce7f52ed26603047af196e2 ]
+
+In the forward chain, the iif is changed from slave device to master vrf
+device. Thus, flow offload does not find a match on the lower slave
+device.
+
+This patch uses the cached route, ie. dst->dev, to update the iif and
+oif fields in the flow entry.
+
+After this patch, the following example works fine:
+
+ # ip addr add dev eth0 1.1.1.1/24
+ # ip addr add dev eth1 10.0.0.1/24
+ # ip link add user1 type vrf table 1
+ # ip l set user1 up
+ # ip l set dev eth0 master user1
+ # ip l set dev eth1 master user1
+
+ # nft add table firewall
+ # nft add flowtable f fb1 { hook ingress priority 0 \; devices = { eth0, eth1 } \; }
+ # nft add chain f ftb-all {type filter hook forward priority 0 \; policy accept \; }
+ # nft add rule f ftb-all ct zone 1 ip protocol tcp flow offload @fb1
+ # nft add rule f ftb-all ct zone 1 ip protocol udp flow offload @fb1
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_flow_table.h | 1 -
+ net/netfilter/nf_flow_table_core.c | 5 +++--
+ net/netfilter/nft_flow_offload.c | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
+index 0e355f4a3d763..0a3de10c6dece 100644
+--- a/include/net/netfilter/nf_flow_table.h
++++ b/include/net/netfilter/nf_flow_table.h
+@@ -84,7 +84,6 @@ struct flow_offload {
+ struct nf_flow_route {
+ struct {
+ struct dst_entry *dst;
+- int ifindex;
+ } tuple[FLOW_OFFLOAD_DIR_MAX];
+ };
+
+diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
+index d8125616edc79..e1537ace2b90c 100644
+--- a/net/netfilter/nf_flow_table_core.c
++++ b/net/netfilter/nf_flow_table_core.c
+@@ -28,6 +28,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+ {
+ struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple;
+ struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple;
++ struct dst_entry *other_dst = route->tuple[!dir].dst;
+ struct dst_entry *dst = route->tuple[dir].dst;
+
+ ft->dir = dir;
+@@ -50,8 +51,8 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct,
+ ft->src_port = ctt->src.u.tcp.port;
+ ft->dst_port = ctt->dst.u.tcp.port;
+
+- ft->iifidx = route->tuple[dir].ifindex;
+- ft->oifidx = route->tuple[!dir].ifindex;
++ ft->iifidx = other_dst->dev->ifindex;
++ ft->oifidx = dst->dev->ifindex;
+ ft->dst_cache = dst;
+ }
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index e0c04851a3493..4d7cf943fff2c 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -30,9 +30,11 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ switch (nft_pf(pkt)) {
+ case NFPROTO_IPV4:
+ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
++ fl.u.ip4.flowi4_oif = nft_in(pkt)->ifindex;
+ break;
+ case NFPROTO_IPV6:
+ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
++ fl.u.ip6.flowi6_oif = nft_in(pkt)->ifindex;
+ break;
+ }
+
+@@ -41,9 +43,7 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ return -ENOENT;
+
+ route->tuple[dir].dst = this_dst;
+- route->tuple[dir].ifindex = nft_in(pkt)->ifindex;
+ route->tuple[!dir].dst = other_dst;
+- route->tuple[!dir].ifindex = nft_out(pkt)->ifindex;
+
+ return 0;
+ }
+--
+2.19.1
+
--- /dev/null
+From fb5ac0d850a34ff3da110f008984f7a2b3ee195a Mon Sep 17 00:00:00 2001
+From: wenxu <wenxu@ucloud.cn>
+Date: Wed, 9 Jan 2019 10:40:11 +0800
+Subject: netfilter: nft_flow_offload: Fix reverse route lookup
+
+[ Upstream commit a799aea0988ea0d1b1f263e996fdad2f6133c680 ]
+
+Using the following example:
+
+ client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server
+
+The first reply packet (ie. syn+ack) uses an incorrect destination
+address for the reverse route lookup since it uses:
+
+ daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
+
+which is 2.2.2.7 in the scenario that is described above, while this
+should be:
+
+ daddr = ct->tuplehash[dir].tuple.src.u3.ip;
+
+that is 10.0.0.7.
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_flow_offload.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
+index 5fd4c57c79cc9..e0c04851a3493 100644
+--- a/net/netfilter/nft_flow_offload.c
++++ b/net/netfilter/nft_flow_offload.c
+@@ -29,10 +29,10 @@ static int nft_flow_route(const struct nft_pktinfo *pkt,
+ memset(&fl, 0, sizeof(fl));
+ switch (nft_pf(pkt)) {
+ case NFPROTO_IPV4:
+- fl.u.ip4.daddr = ct->tuplehash[!dir].tuple.dst.u3.ip;
++ fl.u.ip4.daddr = ct->tuplehash[dir].tuple.src.u3.ip;
+ break;
+ case NFPROTO_IPV6:
+- fl.u.ip6.daddr = ct->tuplehash[!dir].tuple.dst.u3.in6;
++ fl.u.ip6.daddr = ct->tuplehash[dir].tuple.src.u3.in6;
+ break;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 80db45ef0b512107e0cfdd9e3d43ac65d07424f4 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Wed, 9 Jan 2019 20:30:07 +0000
+Subject: powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool.
+
+[ Upstream commit fb0bdec51a4901b7dd088de0a1e365e1b9f5cd21 ]
+
+Commit 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer
+dereference") moved the loading of r6 earlier in the code. As some
+functions are called inbetween, r6 needs to be loaded again with the
+address of swapper_pg_dir in order to set PTE pointers for
+the Abatron BDI.
+
+Fixes: 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer dereference")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 81d4574d1f377..9fd2ff28b8ff2 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -919,11 +919,12 @@ start_here:
+
+ /* set up the PTE pointers for the Abatron bdiGDB.
+ */
+- tovirt(r6,r6)
+ lis r5, abatron_pteptrs@h
+ ori r5, r5, abatron_pteptrs@l
+ stw r5, 0xf0(0) /* Must match your Abatron config file */
+ tophys(r5,r5)
++ lis r6, swapper_pg_dir@h
++ ori r6, r6, swapper_pg_dir@l
+ stw r6, 0(r5)
+
+ /* Now turn on the MMU for real! */
+--
+2.19.1
+
--- /dev/null
+From 943636be302f882fc6f1c15068bfb8c6fd740899 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:33 -0800
+Subject: pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
+
+[ Upstream commit e6587cdbd732eacb4c7ce592ed46f7bbcefb655f ]
+
+When a connection is closing we receive on pvcalls_sk_state_change
+notification. Instead of setting the connection as closed immediately
+(-ENOTCONN), let's read one more time from it: pvcalls_conn_back_read
+will set the connection as closed when necessary.
+
+That way, we avoid races between pvcalls_sk_state_change and
+pvcalls_back_ioworker.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index b1092fbefa630..e8b3ff8e7868b 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -160,9 +160,10 @@ static void pvcalls_conn_back_read(void *opaque)
+
+ /* write the data, then modify the indexes */
+ virt_wmb();
+- if (ret < 0)
++ if (ret < 0) {
++ atomic_set(&map->read, 0);
+ intf->in_error = ret;
+- else
++ } else
+ intf->in_prod = prod + ret;
+ /* update the indexes, then notify the other end */
+ virt_wmb();
+@@ -288,7 +289,7 @@ static void pvcalls_sk_state_change(struct sock *sock)
+ return;
+
+ intf = map->ring;
+- intf->in_error = -ENOTCONN;
++ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 067166af2f8674507f271a419543cc51b5e43dd8 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Wed, 5 Dec 2018 10:35:50 +0800
+Subject: pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock
+
+[ Upstream commit 9f51c05dc41a6d69423e3d03d18eb7ab22f9ec19 ]
+
+The problem is that we call this with a spin lock held.
+The call tree is:
+pvcalls_front_accept() holds bedata->socket_lock.
+ -> create_active()
+ -> __get_free_pages() uses GFP_KERNEL
+
+The create_active() function is only called from pvcalls_front_accept()
+with a spin_lock held, The allocation is not allowed to sleep and
+GFP_KERNEL is not sufficient.
+
+This issue was detected by using the Coccinelle software.
+
+v2: Add a function doing the allocations which is called
+ outside the lock and passing the allocated data to
+ create_active().
+
+v3: Use the matching deallocators i.e., free_page()
+ and free_pages(), respectively.
+
+v4: It would be better to pre-populate map (struct sock_mapping),
+ rather than introducing one more new struct.
+
+v5: Since allocating the data outside of this call it should also
+ be freed outside, when create_active() fails.
+ Move kzalloc(sizeof(*map2), GFP_ATOMIC) outside spinlock and
+ use GFP_KERNEL instead.
+
+v6: Drop the superfluous calls.
+
+Suggested-by: Juergen Gross <jgross@suse.com>
+Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Suggested-by: Stefano Stabellini <sstabellini@kernel.org>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Acked-by: Stefano Stabellini <sstabellini@kernel.org>
+CC: Julia Lawall <julia.lawall@lip6.fr>
+CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+CC: Juergen Gross <jgross@suse.com>
+CC: Stefano Stabellini <sstabellini@kernel.org>
+CC: xen-devel@lists.xenproject.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 81 +++++++++++++++++++++++++++----------
+ 1 file changed, 59 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 01588582ae663..6357160d466ab 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -341,6 +341,39 @@ int pvcalls_front_socket(struct socket *sock)
+ return ret;
+ }
+
++static void free_active_ring(struct sock_mapping *map)
++{
++ free_pages((unsigned long)map->active.data.in,
++ map->active.ring->ring_order);
++ free_page((unsigned long)map->active.ring);
++}
++
++static int alloc_active_ring(struct sock_mapping *map)
++{
++ void *bytes;
++
++ map->active.ring = (struct pvcalls_data_intf *)
++ get_zeroed_page(GFP_KERNEL);
++ if (!map->active.ring)
++ goto out;
++
++ map->active.ring->ring_order = PVCALLS_RING_ORDER;
++ bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
++ PVCALLS_RING_ORDER);
++ if (!bytes)
++ goto out;
++
++ map->active.data.in = bytes;
++ map->active.data.out = bytes +
++ XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
++
++ return 0;
++
++out:
++ free_active_ring(map);
++ return -ENOMEM;
++}
++
+ static int create_active(struct sock_mapping *map, int *evtchn)
+ {
+ void *bytes;
+@@ -349,15 +382,7 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ *evtchn = -1;
+ init_waitqueue_head(&map->active.inflight_conn_req);
+
+- map->active.ring = (struct pvcalls_data_intf *)
+- __get_free_page(GFP_KERNEL | __GFP_ZERO);
+- if (map->active.ring == NULL)
+- goto out_error;
+- map->active.ring->ring_order = PVCALLS_RING_ORDER;
+- bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+- PVCALLS_RING_ORDER);
+- if (bytes == NULL)
+- goto out_error;
++ bytes = map->active.data.in;
+ for (i = 0; i < (1 << PVCALLS_RING_ORDER); i++)
+ map->active.ring->ref[i] = gnttab_grant_foreign_access(
+ pvcalls_front_dev->otherend_id,
+@@ -367,10 +392,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ pvcalls_front_dev->otherend_id,
+ pfn_to_gfn(virt_to_pfn((void *)map->active.ring)), 0);
+
+- map->active.data.in = bytes;
+- map->active.data.out = bytes +
+- XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+-
+ ret = xenbus_alloc_evtchn(pvcalls_front_dev, evtchn);
+ if (ret)
+ goto out_error;
+@@ -391,8 +412,6 @@ static int create_active(struct sock_mapping *map, int *evtchn)
+ out_error:
+ if (*evtchn >= 0)
+ xenbus_free_evtchn(pvcalls_front_dev, *evtchn);
+- free_pages((unsigned long)map->active.data.in, PVCALLS_RING_ORDER);
+- free_page((unsigned long)map->active.ring);
+ return ret;
+ }
+
+@@ -412,17 +431,24 @@ int pvcalls_front_connect(struct socket *sock, struct sockaddr *addr,
+ return PTR_ERR(map);
+
+ bedata = dev_get_drvdata(&pvcalls_front_dev->dev);
++ ret = alloc_active_ring(map);
++ if (ret < 0) {
++ pvcalls_exit_sock(sock);
++ return ret;
++ }
+
+ spin_lock(&bedata->socket_lock);
+ ret = get_request(bedata, &req_id);
+ if (ret < 0) {
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+ ret = create_active(map, &evtchn);
+ if (ret < 0) {
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+@@ -784,25 +810,36 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
+ }
+ }
+
+- spin_lock(&bedata->socket_lock);
+- ret = get_request(bedata, &req_id);
+- if (ret < 0) {
++ map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
++ if (map2 == NULL) {
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+- spin_unlock(&bedata->socket_lock);
++ pvcalls_exit_sock(sock);
++ return -ENOMEM;
++ }
++ ret = alloc_active_ring(map2);
++ if (ret < 0) {
++ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
++ (void *)&map->passive.flags);
++ kfree(map2);
+ pvcalls_exit_sock(sock);
+ return ret;
+ }
+- map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
+- if (map2 == NULL) {
++ spin_lock(&bedata->socket_lock);
++ ret = get_request(bedata, &req_id);
++ if (ret < 0) {
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+ spin_unlock(&bedata->socket_lock);
++ free_active_ring(map2);
++ kfree(map2);
+ pvcalls_exit_sock(sock);
+- return -ENOMEM;
++ return ret;
+ }
++
+ ret = create_active(map2, &evtchn);
+ if (ret < 0) {
++ free_active_ring(map2);
+ kfree(map2);
+ clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
+ (void *)&map->passive.flags);
+--
+2.19.1
+
--- /dev/null
+From a976aa05b9a9a7c661bb9eade30c579173d6689c Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:30 -0800
+Subject: pvcalls-front: don't try to free unallocated rings
+
+[ Upstream commit 96283f9a084e23d7cda2d3c5d1ffa6df6cf1ecec ]
+
+inflight_req_id is 0 when initialized. If inflight_req_id is 0, there is
+no accept_map to free. Fix the check in pvcalls_front_release.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index e5d95aab2cb80..4f3d664b3f39e 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -1030,8 +1030,8 @@ int pvcalls_front_release(struct socket *sock)
+ spin_lock(&bedata->socket_lock);
+ list_del(&map->list);
+ spin_unlock(&bedata->socket_lock);
+- if (READ_ONCE(map->passive.inflight_req_id) !=
+- PVCALLS_INVALID_ID) {
++ if (READ_ONCE(map->passive.inflight_req_id) != PVCALLS_INVALID_ID &&
++ READ_ONCE(map->passive.inflight_req_id) != 0) {
+ pvcalls_front_free_map(bedata,
+ map->passive.accept_map);
+ }
+--
+2.19.1
+
--- /dev/null
+From a81a10e6cab4cd726910827150e94acbc8ab5a06 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Tue, 15 Jan 2019 10:31:27 +0800
+Subject: pvcalls-front: fix potential null dereference
+
+[ Upstream commit b4711098066f1cf808d4dc11a1a842860a3292fe ]
+
+ static checker warning:
+ drivers/xen/pvcalls-front.c:373 alloc_active_ring()
+ error: we previously assumed 'map->active.ring' could be null
+ (see line 357)
+
+drivers/xen/pvcalls-front.c
+ 351 static int alloc_active_ring(struct sock_mapping *map)
+ 352 {
+ 353 void *bytes;
+ 354
+ 355 map->active.ring = (struct pvcalls_data_intf *)
+ 356 get_zeroed_page(GFP_KERNEL);
+ 357 if (!map->active.ring)
+ ^^^^^^^^^^^^^^^^^
+Check
+
+ 358 goto out;
+ 359
+ 360 map->active.ring->ring_order = PVCALLS_RING_ORDER;
+ 361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+ 362 PVCALLS_RING_ORDER);
+ 363 if (!bytes)
+ 364 goto out;
+ 365
+ 366 map->active.data.in = bytes;
+ 367 map->active.data.out = bytes +
+ 368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER);
+ 369
+ 370 return 0;
+ 371
+ 372 out:
+--> 373 free_active_ring(map);
+ ^^^
+Add null check on map->active.ring before dereferencing it to avoid
+any NULL pointer dereferences.
+
+Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Suggested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+CC: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+CC: Juergen Gross <jgross@suse.com>
+CC: Stefano Stabellini <sstabellini@kernel.org>
+CC: Dan Carpenter <dan.carpenter@oracle.com>
+CC: xen-devel@lists.xenproject.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 6357160d466ab..91da7e44d5d4f 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -343,6 +343,9 @@ int pvcalls_front_socket(struct socket *sock)
+
+ static void free_active_ring(struct sock_mapping *map)
+ {
++ if (!map->active.ring)
++ return;
++
+ free_pages((unsigned long)map->active.data.in,
+ map->active.ring->ring_order);
+ free_page((unsigned long)map->active.ring);
+--
+2.19.1
+
--- /dev/null
+From bb1e1e70c2e720dbb6a67f9247fc1d03cbe39101 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:31 -0800
+Subject: pvcalls-front: properly allocate sk
+
+[ Upstream commit beee1fbe8f7d57d6ebaa5188f9f4db89c2077196 ]
+
+Don't use kzalloc: it ends up leaving sk->sk_prot not properly
+initialized. Use sk_alloc instead and define our own trivial struct
+proto.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 4f3d664b3f39e..01588582ae663 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -31,6 +31,12 @@
+ #define PVCALLS_NR_RSP_PER_RING __CONST_RING_SIZE(xen_pvcalls, XEN_PAGE_SIZE)
+ #define PVCALLS_FRONT_MAX_SPIN 5000
+
++static struct proto pvcalls_proto = {
++ .name = "PVCalls",
++ .owner = THIS_MODULE,
++ .obj_size = sizeof(struct sock),
++};
++
+ struct pvcalls_bedata {
+ struct xen_pvcalls_front_ring ring;
+ grant_ref_t ref;
+@@ -837,7 +843,7 @@ int pvcalls_front_accept(struct socket *sock, struct socket *newsock, int flags)
+
+ received:
+ map2->sock = newsock;
+- newsock->sk = kzalloc(sizeof(*newsock->sk), GFP_KERNEL);
++ newsock->sk = sk_alloc(sock_net(sock->sk), PF_INET, GFP_KERNEL, &pvcalls_proto, false);
+ if (!newsock->sk) {
+ bedata->rsp[req_id].req_id = PVCALLS_INVALID_ID;
+ map->passive.inflight_req_id = PVCALLS_INVALID_ID;
+--
+2.19.1
+
--- /dev/null
+From 2ba2ec520f2f0b775a8bcdbaa05e1ac820ea53da Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <sstabellini@kernel.org>
+Date: Fri, 21 Dec 2018 15:06:29 -0800
+Subject: pvcalls-front: read all data before closing the connection
+
+[ Upstream commit b79470b64fa9266948d1ce8d825ced94c4f63293 ]
+
+When a connection is closing in_error is set to ENOTCONN. There could
+still be outstanding data on the ring left by the backend. Before
+closing the connection on the frontend side, drain the ring.
+
+Signed-off-by: Stefano Stabellini <stefanos@xilinx.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-front.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
+index 77224d8f3e6fe..e5d95aab2cb80 100644
+--- a/drivers/xen/pvcalls-front.c
++++ b/drivers/xen/pvcalls-front.c
+@@ -560,15 +560,13 @@ static int __read_ring(struct pvcalls_data_intf *intf,
+ error = intf->in_error;
+ /* get pointers before reading from the ring */
+ virt_rmb();
+- if (error < 0)
+- return error;
+
+ size = pvcalls_queued(prod, cons, array_size);
+ masked_prod = pvcalls_mask(prod, array_size);
+ masked_cons = pvcalls_mask(cons, array_size);
+
+ if (size == 0)
+- return 0;
++ return error ?: size;
+
+ if (len > size)
+ len = size;
+--
+2.19.1
+
--- /dev/null
+From 4f3274a4081139c2de7eb48b283d4dd4a1276c95 Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:39 +0200
+Subject: qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page
+ count
+
+[ Upstream commit 2d533a9287f2011632977e87ce2783f4c689c984 ]
+
+In PBL chains with non power of 2 page count, the producer is not at the
+beginning of the chain when index is 0 after a wrap. Therefore, after the
+producer index wrap around, page index should be calculated more carefully.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/qed/qed_chain.h | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 59ddf9af909e4..2dd0a9ed5b361 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -663,6 +663,37 @@ static inline void *qed_chain_get_last_elem(struct qed_chain *p_chain)
+ static inline void qed_chain_set_prod(struct qed_chain *p_chain,
+ u32 prod_idx, void *p_prod_elem)
+ {
++ if (p_chain->mode == QED_CHAIN_MODE_PBL) {
++ u32 cur_prod, page_mask, page_cnt, page_diff;
++
++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
++ p_chain->u.chain32.prod_idx;
++
++ /* Assume that number of elements in a page is power of 2 */
++ page_mask = ~p_chain->elem_per_page_mask;
++
++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index
++ * reaches the first element of next page before the page index
++ * is incremented. See qed_chain_produce().
++ * Index wrap around is not a problem because the difference
++ * between current and given producer indices is always
++ * positive and lower than the chain's capacity.
++ */
++ page_diff = (((cur_prod - 1) & page_mask) -
++ ((prod_idx - 1) & page_mask)) /
++ p_chain->elem_per_page;
++
++ page_cnt = qed_chain_get_page_cnt(p_chain);
++ if (is_chain_u16(p_chain))
++ p_chain->pbl.c.u16.prod_page_idx =
++ (p_chain->pbl.c.u16.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ else
++ p_chain->pbl.c.u32.prod_page_idx =
++ (p_chain->pbl.c.u32.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ }
++
+ if (is_chain_u16(p_chain))
+ p_chain->u.chain16.prod_idx = (u16) prod_idx;
+ else
+--
+2.19.1
+
--- /dev/null
+From 440d1358dae79bf9a49fd92136cca2fb50a0daec Mon Sep 17 00:00:00 2001
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:40 +0200
+Subject: qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory
+ barrier
+
+[ Upstream commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb ]
+
+Make sure chain element is updated before ringing the doorbell.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 2fa1c050a14b4..92cd8abeb41d7 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1592,6 +1592,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
+ cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
+ rx_prod.bd_prod = cpu_to_le16(bd_prod);
+ rx_prod.cqe_prod = cpu_to_le16(cq_prod);
++
++ /* Make sure chain element is updated before ringing the doorbell */
++ dma_wmb();
++
+ DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 45d09ff9389ab8248681b23df03772839a81fd5a Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Thu, 10 Jan 2019 08:15:45 +0200
+Subject: RDMA/mthca: Clear QP objects during their allocation
+
+[ Upstream commit 9d9f59b4204bc41896c866b3e5856e5b416aa199 ]
+
+As part of audit process to update drivers to use rdma_restrack_add()
+ensure that QP objects is cleared before access. Such change fixes the
+crash observed with uninitialized non zero sgid attr accessed by
+ib_destroy_qp().
+
+CPU: 3 PID: 74 Comm: kworker/u16:1 Not tainted 4.19.10-300.fc29.x86_64
+Workqueue: ipoib_wq ipoib_cm_tx_reap [ib_ipoib]
+RIP: 0010:rdma_put_gid_attr+0x9/0x30 [ib_core]
+RSP: 0018:ffffb7ad819dbde8 EFLAGS: 00010202
+RAX: 0000000000000000 RBX: ffff8d1bdf5a2e00 RCX: 0000000000002699
+RDX: 206c656e72656af8 RSI: ffff8d1bf7ae6160 RDI: 206c656e72656b20
+RBP: 0000000000000000 R08: 0000000000026160 R09: ffffffffc06b45bf
+R10: ffffe849887da000 R11: 0000000000000002 R12: ffff8d1be30cb400
+R13: ffff8d1bdf681800 R14: ffff8d1be2272400 R15: ffff8d1be30ca000
+FS: 0000000000000000(0000) GS:ffff8d1bf7ac0000(0000)
+knlGS:0000000000000000
+Trace:
+ ib_destroy_qp+0xc9/0x240 [ib_core]
+ ipoib_cm_tx_reap+0x1f9/0x4e0 [ib_ipoib]
+ process_one_work+0x1a1/0x3a0
+ worker_thread+0x30/0x380
+ ? pwq_unbound_release_workfn+0xd0/0xd0
+ kthread+0x112/0x130
+ ? kthread_create_worker_on_cpu+0x70/0x70
+ ret_from_fork+0x22/0x40
+
+Reported-by: Alexander Murashkin <AlexanderMurashkin@msn.com>
+Tested-by: Alexander Murashkin <AlexanderMurashkin@msn.com>
+Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_provider.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
+index 0d3473b4596e1..21f4239022c7a 100644
+--- a/drivers/infiniband/hw/mthca/mthca_provider.c
++++ b/drivers/infiniband/hw/mthca/mthca_provider.c
+@@ -533,7 +533,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
+ {
+ struct mthca_ucontext *context;
+
+- qp = kmalloc(sizeof *qp, GFP_KERNEL);
++ qp = kzalloc(sizeof(*qp), GFP_KERNEL);
+ if (!qp)
+ return ERR_PTR(-ENOMEM);
+
+@@ -599,7 +599,7 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
+ if (pd->uobject)
+ return ERR_PTR(-EINVAL);
+
+- qp = kmalloc(sizeof (struct mthca_sqp), GFP_KERNEL);
++ qp = kzalloc(sizeof(struct mthca_sqp), GFP_KERNEL);
+ if (!qp)
+ return ERR_PTR(-ENOMEM);
+
+--
+2.19.1
+
--- /dev/null
+From a98f59e2648587cbdcade965894291ae8dc972a7 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Thu, 10 Jan 2019 23:29:28 +0530
+Subject: scsi: cxgb4i: add wait_for_completion()
+
+[ Upstream commit 9e8f1c79831424d30c0e3df068be7f4a244157c9 ]
+
+In case of ->set_param() and ->bind_conn() cxgb4i driver does not wait for
+cmd completion, this can create race conditions, to avoid this add
+wait_for_completion().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 9 ++++-----
+ drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 28 ++++++++++++++++++++--------
+ drivers/scsi/cxgbi/libcxgbi.c | 7 ++++---
+ drivers/scsi/cxgbi/libcxgbi.h | 5 +++--
+ 4 files changed, 31 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+index bf07735275a49..0fc382cb977bf 100644
+--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+@@ -1144,7 +1144,7 @@ static void ddp_clear_map(struct cxgbi_device *cdev, struct cxgbi_ppm *ppm,
+ }
+
+ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+- unsigned int tid, int pg_idx, bool reply)
++ unsigned int tid, int pg_idx)
+ {
+ struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
+ GFP_KERNEL);
+@@ -1160,7 +1160,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply = V_NO_REPLY(reply ? 0 : 1);
++ req->reply = V_NO_REPLY(1);
+ req->cpu_idx = 0;
+ req->word = htons(31);
+ req->mask = cpu_to_be64(0xF0000000);
+@@ -1177,11 +1177,10 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk,
+ * @tid: connection id
+ * @hcrc: header digest enabled
+ * @dcrc: data digest enabled
+- * @reply: request reply from h/w
+ * set up the iscsi digest settings for a connection identified by tid
+ */
+ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+- int hcrc, int dcrc, int reply)
++ int hcrc, int dcrc)
+ {
+ struct sk_buff *skb = alloc_wr(sizeof(struct cpl_set_tcb_field), 0,
+ GFP_KERNEL);
+@@ -1197,7 +1196,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply = V_NO_REPLY(reply ? 0 : 1);
++ req->reply = V_NO_REPLY(1);
+ req->cpu_idx = 0;
+ req->word = htons(31);
+ req->mask = cpu_to_be64(0x0F000000);
+diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+index 211da1d5a8699..689d6c813a50d 100644
+--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+@@ -1517,16 +1517,22 @@ static void do_set_tcb_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
+ struct cxgbi_sock *csk;
+
+ csk = lookup_tid(t, tid);
+- if (!csk)
++ if (!csk) {
+ pr_err("can't find conn. for tid %u.\n", tid);
++ return;
++ }
+
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p,%u,%lx,%u, status 0x%x.\n",
+ csk, csk->state, csk->flags, csk->tid, rpl->status);
+
+- if (rpl->status != CPL_ERR_NONE)
++ if (rpl->status != CPL_ERR_NONE) {
+ pr_err("csk 0x%p,%u, SET_TCB_RPL status %u.\n",
+ csk, tid, rpl->status);
++ csk->err = -EINVAL;
++ }
++
++ complete(&csk->cmpl);
+
+ __kfree_skb(skb);
+ }
+@@ -1903,7 +1909,7 @@ static int ddp_set_map(struct cxgbi_ppm *ppm, struct cxgbi_sock *csk,
+ }
+
+ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+- int pg_idx, bool reply)
++ int pg_idx)
+ {
+ struct sk_buff *skb;
+ struct cpl_set_tcb_field *req;
+@@ -1919,7 +1925,7 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ INIT_TP_WR(req, csk->tid);
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, csk->tid));
+- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
+ req->word_cookie = htons(0);
+ req->mask = cpu_to_be64(0x3 << 8);
+ req->val = cpu_to_be64(pg_idx << 8);
+@@ -1928,12 +1934,15 @@ static int ddp_setup_conn_pgidx(struct cxgbi_sock *csk, unsigned int tid,
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p, tid 0x%x, pg_idx %u.\n", csk, csk->tid, pg_idx);
+
++ reinit_completion(&csk->cmpl);
+ cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
+- return 0;
++ wait_for_completion(&csk->cmpl);
++
++ return csk->err;
+ }
+
+ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+- int hcrc, int dcrc, int reply)
++ int hcrc, int dcrc)
+ {
+ struct sk_buff *skb;
+ struct cpl_set_tcb_field *req;
+@@ -1951,7 +1960,7 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ req = (struct cpl_set_tcb_field *)skb->head;
+ INIT_TP_WR(req, tid);
+ OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, tid));
+- req->reply_ctrl = htons(NO_REPLY_V(reply) | QUEUENO_V(csk->rss_qid));
++ req->reply_ctrl = htons(NO_REPLY_V(0) | QUEUENO_V(csk->rss_qid));
+ req->word_cookie = htons(0);
+ req->mask = cpu_to_be64(0x3 << 4);
+ req->val = cpu_to_be64(((hcrc ? ULP_CRC_HEADER : 0) |
+@@ -1961,8 +1970,11 @@ static int ddp_setup_conn_digest(struct cxgbi_sock *csk, unsigned int tid,
+ log_debug(1 << CXGBI_DBG_TOE | 1 << CXGBI_DBG_SOCK,
+ "csk 0x%p, tid 0x%x, crc %d,%d.\n", csk, csk->tid, hcrc, dcrc);
+
++ reinit_completion(&csk->cmpl);
+ cxgb4_ofld_send(csk->cdev->ports[csk->port_id], skb);
+- return 0;
++ wait_for_completion(&csk->cmpl);
++
++ return csk->err;
+ }
+
+ static struct cxgbi_ppm *cdev2ppm(struct cxgbi_device *cdev)
+diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
+index 3f3af5e74a07d..f2c561ca731a3 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -573,6 +573,7 @@ static struct cxgbi_sock *cxgbi_sock_create(struct cxgbi_device *cdev)
+ skb_queue_head_init(&csk->receive_queue);
+ skb_queue_head_init(&csk->write_queue);
+ timer_setup(&csk->retry_timer, NULL, 0);
++ init_completion(&csk->cmpl);
+ rwlock_init(&csk->callback_lock);
+ csk->cdev = cdev;
+ csk->flags = 0;
+@@ -2252,14 +2253,14 @@ int cxgbi_set_conn_param(struct iscsi_cls_conn *cls_conn,
+ if (!err && conn->hdrdgst_en)
+ err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
+ conn->hdrdgst_en,
+- conn->datadgst_en, 0);
++ conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_DATADGST_EN:
+ err = iscsi_set_param(cls_conn, param, buf, buflen);
+ if (!err && conn->datadgst_en)
+ err = csk->cdev->csk_ddp_setup_digest(csk, csk->tid,
+ conn->hdrdgst_en,
+- conn->datadgst_en, 0);
++ conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_MAX_R2T:
+ return iscsi_tcp_set_max_r2t(conn, buf);
+@@ -2385,7 +2386,7 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session,
+
+ ppm = csk->cdev->cdev2ppm(csk->cdev);
+ err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid,
+- ppm->tformat.pgsz_idx_dflt, 0);
++ ppm->tformat.pgsz_idx_dflt);
+ if (err < 0)
+ return err;
+
+diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
+index dcb190e753434..3bf7414a75e5e 100644
+--- a/drivers/scsi/cxgbi/libcxgbi.h
++++ b/drivers/scsi/cxgbi/libcxgbi.h
+@@ -146,6 +146,7 @@ struct cxgbi_sock {
+ struct sk_buff_head receive_queue;
+ struct sk_buff_head write_queue;
+ struct timer_list retry_timer;
++ struct completion cmpl;
+ int err;
+ rwlock_t callback_lock;
+ void *user_data;
+@@ -487,9 +488,9 @@ struct cxgbi_device {
+ struct cxgbi_ppm *,
+ struct cxgbi_task_tag_info *);
+ int (*csk_ddp_setup_digest)(struct cxgbi_sock *,
+- unsigned int, int, int, int);
++ unsigned int, int, int);
+ int (*csk_ddp_setup_pgidx)(struct cxgbi_sock *,
+- unsigned int, int, bool);
++ unsigned int, int);
+
+ void (*csk_release_offload_resources)(struct cxgbi_sock *);
+ int (*csk_rx_pdu_ready)(struct cxgbi_sock *, struct sk_buff *);
+--
+2.19.1
+
--- /dev/null
+From 582d4b055849bc44431e71cafb97586e7d6467ee Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Tue, 8 Jan 2019 13:50:43 -0700
+Subject: scsi: isci: initialize shost fully before calling scsi_add_host()
+
+[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
+
+scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the
+command size to allocate based on the prot_capabilities. In the isci
+driver, scsi_host_set_prot() is called after scsi_add_host() so the command
+size gets calculated to be smaller than it needs to be. Eventually,
+scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it
+was sized correctly and a buffer overrun may occur.
+
+However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line
+size, the mistake can go unnoticed.
+
+The bug was noticed after the struct request size was reduced by commit
+9d037ad707ed ("block: remove req->timeout_list")
+
+Which likely reduced the allocated space for the request by an entire cache
+line, enough that the overflow could be hit and it caused a panic, on boot,
+at:
+
+ RIP: 0010:t10_pi_complete+0x77/0x1c0
+ Call Trace:
+ <IRQ>
+ sd_done+0xf5/0x340
+ scsi_finish_command+0xc3/0x120
+ blk_done_softirq+0x83/0xb0
+ __do_softirq+0xa1/0x2e6
+ irq_exit+0xbc/0xd0
+ call_function_single_interrupt+0xf/0x20
+ </IRQ>
+
+sd_done() would call scsi_prot_sg_count() which reads the number of
+entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of
+the allocated space it reads a garbage number and erroneously calls
+t10_pi_complete().
+
+To prevent this, the calls to scsi_host_set_prot() are moved into
+isci_host_alloc() before the call to scsi_add_host(). Out of caution, also
+move the similar call to scsi_host_set_guard().
+
+Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support")
+Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Intel SCU Linux support <intel-linux-scu@intel.com>
+Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/init.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index 08c7b1e25fe48..dde84f7443136 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -588,6 +588,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
+ shost->max_lun = ~0;
+ shost->max_cmd_len = MAX_COMMAND_SIZE;
+
++ /* turn on DIF support */
++ scsi_host_set_prot(shost,
++ SHOST_DIF_TYPE1_PROTECTION |
++ SHOST_DIF_TYPE2_PROTECTION |
++ SHOST_DIF_TYPE3_PROTECTION);
++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
++
+ err = scsi_add_host(shost, &pdev->dev);
+ if (err)
+ goto err_shost;
+@@ -675,13 +682,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err_host_alloc;
+ }
+ pci_info->hosts[i] = h;
+-
+- /* turn on DIF support */
+- scsi_host_set_prot(to_shost(h),
+- SHOST_DIF_TYPE1_PROTECTION |
+- SHOST_DIF_TYPE2_PROTECTION |
+- SHOST_DIF_TYPE3_PROTECTION);
+- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
+ }
+
+ err = isci_setup_interrupts(pdev);
+--
+2.19.1
+
--- /dev/null
+From 876fb45fb94d89d3e55c73fa4ee5122f169f268a Mon Sep 17 00:00:00 2001
+From: Manish Rangankar <mrangankar@marvell.com>
+Date: Wed, 9 Jan 2019 01:39:07 -0800
+Subject: scsi: qedi: Add ep_state for login completion on un-reachable targets
+
+[ Upstream commit 34a2ce887668db9dda4b56e6f155c49ac13f3e54 ]
+
+When the driver finds invalid destination MAC for the first un-reachable
+target, and before completes the PATH_REQ operation, set new ep_state to
+OFFLDCONN_NONE so that as part of driver ep_poll mechanism, the upper
+open-iscsi layer is notified to complete the login process on the first
+un-reachable target and thus proceed login to other reachable targets.
+
+Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_iscsi.c | 3 +++
+ drivers/scsi/qedi/qedi_iscsi.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 2f0a4f2c5ff80..d4821b9dea45d 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -954,6 +954,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+
+ qedi_ep = ep->dd_data;
+ if (qedi_ep->state == EP_STATE_IDLE ||
++ qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
+ qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
+ return -1;
+
+@@ -1036,6 +1037,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+
+ switch (qedi_ep->state) {
+ case EP_STATE_OFLDCONN_START:
++ case EP_STATE_OFLDCONN_NONE:
+ goto ep_release_conn;
+ case EP_STATE_OFLDCONN_FAILED:
+ break;
+@@ -1226,6 +1228,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+
+ if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
+ QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
++ qedi_ep->state = EP_STATE_OFLDCONN_NONE;
+ ret = -EIO;
+ goto set_path_exit;
+ }
+diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
+index 11260776212fa..892d70d545537 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.h
++++ b/drivers/scsi/qedi/qedi_iscsi.h
+@@ -59,6 +59,7 @@ enum {
+ EP_STATE_OFLDCONN_FAILED = 0x2000,
+ EP_STATE_CONNECT_FAILED = 0x4000,
+ EP_STATE_DISCONN_TIMEDOUT = 0x8000,
++ EP_STATE_OFLDCONN_NONE = 0x10000,
+ };
+
+ struct qedi_conn;
+--
+2.19.1
+
--- /dev/null
+From 694478e775b6860a3a1f490f9cc64ad4bb5ab449 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 20 Dec 2018 11:16:07 +0800
+Subject: scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
+
+[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ]
+
+The return code should be check while qla4xxx_copy_from_fwddb_param fails.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla4xxx/ql4_os.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 0e13349dce570..575445c761b48 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -7237,6 +7237,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
+
+ rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
+ fw_ddb_entry);
++ if (rc)
++ goto free_sess;
+
+ ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
+ __func__, fnode_sess->dev.kobj.name);
+--
+2.19.1
+
--- /dev/null
+From e3f455665f868bf30b7dc823bd0a4983fd9334b4 Mon Sep 17 00:00:00 2001
+From: Xiubo Li <xiubli@redhat.com>
+Date: Fri, 23 Nov 2018 09:15:30 +0800
+Subject: scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes
+
+[ Upstream commit a94a2572b97744d3a35a1996df0e5cf6b2461a4a ]
+
+Currently there is one cmd timeout timer and one qfull timer for each udev,
+and whenever any new command is coming in we will update the cmd timer or
+qfull timer. For some corner cases the timers are always working only for
+the ringbuffer's and full queue's newest cmd. That's to say the timer won't
+be fired even if one cmd has been stuck for a very long time and the
+deadline is reached.
+
+This fix will keep the cmd/qfull timers to be pended for the oldest cmd in
+ringbuffer and full queue, and will update them with the next cmd's
+deadline only when the old cmd's deadline is reached or removed from the
+ringbuffer and full queue.
+
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Acked-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_user.c | 88 +++++++++++++++++++++----------
+ 1 file changed, 61 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 9cd404acdb82b..ac7620120491b 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -148,7 +148,7 @@ struct tcmu_dev {
+ size_t ring_size;
+
+ struct mutex cmdr_lock;
+- struct list_head cmdr_queue;
++ struct list_head qfull_queue;
+
+ uint32_t dbi_max;
+ uint32_t dbi_thresh;
+@@ -159,6 +159,7 @@ struct tcmu_dev {
+
+ struct timer_list cmd_timer;
+ unsigned int cmd_time_out;
++ struct list_head inflight_queue;
+
+ struct timer_list qfull_timer;
+ int qfull_time_out;
+@@ -179,7 +180,7 @@ struct tcmu_dev {
+ struct tcmu_cmd {
+ struct se_cmd *se_cmd;
+ struct tcmu_dev *tcmu_dev;
+- struct list_head cmdr_queue_entry;
++ struct list_head queue_entry;
+
+ uint16_t cmd_id;
+
+@@ -192,6 +193,7 @@ struct tcmu_cmd {
+ unsigned long deadline;
+
+ #define TCMU_CMD_BIT_EXPIRED 0
++#define TCMU_CMD_BIT_INFLIGHT 1
+ unsigned long flags;
+ };
+ /*
+@@ -586,7 +588,7 @@ static struct tcmu_cmd *tcmu_alloc_cmd(struct se_cmd *se_cmd)
+ if (!tcmu_cmd)
+ return NULL;
+
+- INIT_LIST_HEAD(&tcmu_cmd->cmdr_queue_entry);
++ INIT_LIST_HEAD(&tcmu_cmd->queue_entry);
+ tcmu_cmd->se_cmd = se_cmd;
+ tcmu_cmd->tcmu_dev = udev;
+
+@@ -915,11 +917,13 @@ static int tcmu_setup_cmd_timer(struct tcmu_cmd *tcmu_cmd, unsigned int tmo,
+ return 0;
+
+ tcmu_cmd->deadline = round_jiffies_up(jiffies + msecs_to_jiffies(tmo));
+- mod_timer(timer, tcmu_cmd->deadline);
++ if (!timer_pending(timer))
++ mod_timer(timer, tcmu_cmd->deadline);
++
+ return 0;
+ }
+
+-static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
++static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ {
+ struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ unsigned int tmo;
+@@ -942,7 +946,7 @@ static int add_to_cmdr_queue(struct tcmu_cmd *tcmu_cmd)
+ if (ret)
+ return ret;
+
+- list_add_tail(&tcmu_cmd->cmdr_queue_entry, &udev->cmdr_queue);
++ list_add_tail(&tcmu_cmd->queue_entry, &udev->qfull_queue);
+ pr_debug("adding cmd %u on dev %s to ring space wait queue\n",
+ tcmu_cmd->cmd_id, udev->name);
+ return 0;
+@@ -999,7 +1003,7 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
+ base_command_size = tcmu_cmd_get_base_cmd_size(tcmu_cmd->dbi_cnt);
+ command_size = tcmu_cmd_get_cmd_size(tcmu_cmd, base_command_size);
+
+- if (!list_empty(&udev->cmdr_queue))
++ if (!list_empty(&udev->qfull_queue))
+ goto queue;
+
+ mb = udev->mb_addr;
+@@ -1096,13 +1100,16 @@ static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
+ UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size);
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
+
++ list_add_tail(&tcmu_cmd->queue_entry, &udev->inflight_queue);
++ set_bit(TCMU_CMD_BIT_INFLIGHT, &tcmu_cmd->flags);
++
+ /* TODO: only if FLUSH and FUA? */
+ uio_event_notify(&udev->uio_info);
+
+ return 0;
+
+ queue:
+- if (add_to_cmdr_queue(tcmu_cmd)) {
++ if (add_to_qfull_queue(tcmu_cmd)) {
+ *scsi_err = TCM_OUT_OF_RESOURCES;
+ return -1;
+ }
+@@ -1145,6 +1152,8 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ if (test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags))
+ goto out;
+
++ list_del_init(&cmd->queue_entry);
++
+ tcmu_cmd_reset_dbi_cur(cmd);
+
+ if (entry->hdr.uflags & TCMU_UFLAG_UNKNOWN_OP) {
+@@ -1194,9 +1203,29 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ tcmu_free_cmd(cmd);
+ }
+
++static void tcmu_set_next_deadline(struct list_head *queue,
++ struct timer_list *timer)
++{
++ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
++ unsigned long deadline = 0;
++
++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, queue, queue_entry) {
++ if (!time_after(jiffies, tcmu_cmd->deadline)) {
++ deadline = tcmu_cmd->deadline;
++ break;
++ }
++ }
++
++ if (deadline)
++ mod_timer(timer, deadline);
++ else
++ del_timer(timer);
++}
++
+ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ {
+ struct tcmu_mailbox *mb;
++ struct tcmu_cmd *cmd;
+ int handled = 0;
+
+ if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags)) {
+@@ -1210,7 +1239,6 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ while (udev->cmdr_last_cleaned != READ_ONCE(mb->cmd_tail)) {
+
+ struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
+- struct tcmu_cmd *cmd;
+
+ tcmu_flush_dcache_range(entry, sizeof(*entry));
+
+@@ -1243,7 +1271,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ /* no more pending commands */
+ del_timer(&udev->cmd_timer);
+
+- if (list_empty(&udev->cmdr_queue)) {
++ if (list_empty(&udev->qfull_queue)) {
+ /*
+ * no more pending or waiting commands so try to
+ * reclaim blocks if needed.
+@@ -1252,6 +1280,8 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+ tcmu_global_max_blocks)
+ schedule_delayed_work(&tcmu_unmap_work, 0);
+ }
++ } else if (udev->cmd_time_out) {
++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
+ }
+
+ return handled;
+@@ -1271,7 +1301,7 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ if (!time_after(jiffies, cmd->deadline))
+ return 0;
+
+- is_running = list_empty(&cmd->cmdr_queue_entry);
++ is_running = test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags);
+ se_cmd = cmd->se_cmd;
+
+ if (is_running) {
+@@ -1288,12 +1318,11 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ */
+ scsi_status = SAM_STAT_CHECK_CONDITION;
+ } else {
+- list_del_init(&cmd->cmdr_queue_entry);
+-
+ idr_remove(&udev->commands, id);
+ tcmu_free_cmd(cmd);
+ scsi_status = SAM_STAT_TASK_SET_FULL;
+ }
++ list_del_init(&cmd->queue_entry);
+
+ pr_debug("Timing out cmd %u on dev %s that is %s.\n",
+ id, udev->name, is_running ? "inflight" : "queued");
+@@ -1372,7 +1401,8 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+
+ INIT_LIST_HEAD(&udev->node);
+ INIT_LIST_HEAD(&udev->timedout_entry);
+- INIT_LIST_HEAD(&udev->cmdr_queue);
++ INIT_LIST_HEAD(&udev->qfull_queue);
++ INIT_LIST_HEAD(&udev->inflight_queue);
+ idr_init(&udev->commands);
+
+ timer_setup(&udev->qfull_timer, tcmu_qfull_timedout, 0);
+@@ -1383,7 +1413,7 @@ static struct se_device *tcmu_alloc_device(struct se_hba *hba, const char *name)
+ return &udev->se_dev;
+ }
+
+-static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
++static bool run_qfull_queue(struct tcmu_dev *udev, bool fail)
+ {
+ struct tcmu_cmd *tcmu_cmd, *tmp_cmd;
+ LIST_HEAD(cmds);
+@@ -1391,15 +1421,15 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+ sense_reason_t scsi_ret;
+ int ret;
+
+- if (list_empty(&udev->cmdr_queue))
++ if (list_empty(&udev->qfull_queue))
+ return true;
+
+ pr_debug("running %s's cmdr queue forcefail %d\n", udev->name, fail);
+
+- list_splice_init(&udev->cmdr_queue, &cmds);
++ list_splice_init(&udev->qfull_queue, &cmds);
+
+- list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, cmdr_queue_entry) {
+- list_del_init(&tcmu_cmd->cmdr_queue_entry);
++ list_for_each_entry_safe(tcmu_cmd, tmp_cmd, &cmds, queue_entry) {
++ list_del_init(&tcmu_cmd->queue_entry);
+
+ pr_debug("removing cmd %u on dev %s from queue\n",
+ tcmu_cmd->cmd_id, udev->name);
+@@ -1437,14 +1467,13 @@ static bool run_cmdr_queue(struct tcmu_dev *udev, bool fail)
+ * cmd was requeued, so just put all cmds back in
+ * the queue
+ */
+- list_splice_tail(&cmds, &udev->cmdr_queue);
++ list_splice_tail(&cmds, &udev->qfull_queue);
+ drained = false;
+- goto done;
++ break;
+ }
+ }
+- if (list_empty(&udev->cmdr_queue))
+- del_timer(&udev->qfull_timer);
+-done:
++
++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
+ return drained;
+ }
+
+@@ -1454,7 +1483,7 @@ static int tcmu_irqcontrol(struct uio_info *info, s32 irq_on)
+
+ mutex_lock(&udev->cmdr_lock);
+ tcmu_handle_completions(udev);
+- run_cmdr_queue(udev, false);
++ run_qfull_queue(udev, false);
+ mutex_unlock(&udev->cmdr_lock);
+
+ return 0;
+@@ -1982,7 +2011,7 @@ static void tcmu_block_dev(struct tcmu_dev *udev)
+ /* complete IO that has executed successfully */
+ tcmu_handle_completions(udev);
+ /* fail IO waiting to be queued */
+- run_cmdr_queue(udev, true);
++ run_qfull_queue(udev, true);
+
+ unlock:
+ mutex_unlock(&udev->cmdr_lock);
+@@ -1997,7 +2026,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+ mutex_lock(&udev->cmdr_lock);
+
+ idr_for_each_entry(&udev->commands, cmd, i) {
+- if (!list_empty(&cmd->cmdr_queue_entry))
++ if (!test_bit(TCMU_CMD_BIT_INFLIGHT, &cmd->flags))
+ continue;
+
+ pr_debug("removing cmd %u on dev %s from ring (is expired %d)\n",
+@@ -2006,6 +2035,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+
+ idr_remove(&udev->commands, i);
+ if (!test_bit(TCMU_CMD_BIT_EXPIRED, &cmd->flags)) {
++ list_del_init(&cmd->queue_entry);
+ if (err_level == 1) {
+ /*
+ * Userspace was not able to start the
+@@ -2666,6 +2696,10 @@ static void check_timedout_devices(void)
+
+ mutex_lock(&udev->cmdr_lock);
+ idr_for_each(&udev->commands, tcmu_check_expired_cmd, NULL);
++
++ tcmu_set_next_deadline(&udev->inflight_queue, &udev->cmd_timer);
++ tcmu_set_next_deadline(&udev->qfull_queue, &udev->qfull_timer);
++
+ mutex_unlock(&udev->cmdr_lock);
+
+ spin_lock_bh(&timed_out_udevs_lock);
+--
+2.19.1
+
--- /dev/null
+From 4805af988458ac0a151c6375086ed5794b479a56 Mon Sep 17 00:00:00 2001
+From: Avri Altman <avri.altman@wdc.com>
+Date: Thu, 10 Jan 2019 13:31:26 +0200
+Subject: scsi: ufs: Fix geometry descriptor size
+
+[ Upstream commit 9be9db9f78f52ef03ee90063730cb9d730e7032b ]
+
+Albeit we no longer rely on those hard-coded descriptor sizes, we still use
+them as our defaults, so better get it right. While adding its sysfs
+entries, we forgot to update the geometry descriptor size. It is 0x48
+according to UFS2.1, and wasn't changed in UFS3.0.
+
+[mkp: typo]
+
+Fixes: c720c091222e (scsi: ufs: sysfs: geometry descriptor)
+Signed-off-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
+index 14e5bf7af0bb1..c3bcaaec0fc5c 100644
+--- a/drivers/scsi/ufs/ufs.h
++++ b/drivers/scsi/ufs/ufs.h
+@@ -195,7 +195,7 @@ enum ufs_desc_def_size {
+ QUERY_DESC_CONFIGURATION_DEF_SIZE = 0x90,
+ QUERY_DESC_UNIT_DEF_SIZE = 0x23,
+ QUERY_DESC_INTERCONNECT_DEF_SIZE = 0x06,
+- QUERY_DESC_GEOMETRY_DEF_SIZE = 0x44,
++ QUERY_DESC_GEOMETRY_DEF_SIZE = 0x48,
+ QUERY_DESC_POWER_DEF_SIZE = 0x62,
+ QUERY_DESC_HEALTH_DEF_SIZE = 0x25,
+ };
+--
+2.19.1
+
--- /dev/null
+From 18dc5238f319825a31a266fabdb04dd7b5d1e3fe Mon Sep 17 00:00:00 2001
+From: Stanley Chu <stanley.chu@mediatek.com>
+Date: Mon, 7 Jan 2019 22:19:34 +0800
+Subject: scsi: ufs: Fix system suspend status
+
+[ Upstream commit ce9e7bce43526626f7cffe2e657953997870197e ]
+
+hba->is_sys_suspended is set after successful system suspend but
+not clear after successful system resume.
+
+According to current behavior, hba->is_sys_suspended will not be set if
+host is runtime-suspended but not system-suspended. Thus we shall aligh the
+same policy: clear this flag even if host remains runtime-suspended after
+ufshcd_system_resume is successfully returned.
+
+Simply fix this flag to correct host status logs.
+
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 12ddb5928a738..6e80dfe4fa979 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7768,6 +7768,8 @@ int ufshcd_system_resume(struct ufs_hba *hba)
+ trace_ufshcd_system_resume(dev_name(hba->dev), ret,
+ ktime_to_us(ktime_sub(ktime_get(), start)),
+ hba->curr_dev_pwr_mode, hba->uic_link_state);
++ if (!ret)
++ hba->is_sys_suspended = false;
+ return ret;
+ }
+ EXPORT_SYMBOL(ufshcd_system_resume);
+--
+2.19.1
+
--- /dev/null
+From d3b2ed293a5d5cd9f34ddae5396f735636f5ac49 Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 16 Jan 2019 14:03:17 -0800
+Subject: selftests/bpf: retry tests that expect build-id
+
+[ Upstream commit f67ad87ab3120e82845521b18a2b99273a340308 ]
+
+While running test_progs in a loop I found out that I'm sometimes hitting
+"Didn't find expected build ID from the map" error.
+
+Looking at stack_map_get_build_id_offset() it seems that it is racy (by
+design) and can sometimes return BPF_STACK_BUILD_ID_IP (i.e. can't trylock
+current->mm->mmap_sem).
+
+Let's retry this test a single time.
+
+Fixes: 13790d1cc72c ("bpf: add selftest for stackmap with build_id in NMI context")
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 30 ++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index d029cad08cbd8..89f8b0dae7ef0 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -1136,7 +1136,9 @@ static void test_stacktrace_build_id(void)
+ int i, j;
+ struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ int build_id_matches = 0;
++ int retry = 1;
+
++retry:
+ err = bpf_prog_load(file, BPF_PROG_TYPE_TRACEPOINT, &obj, &prog_fd);
+ if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+ goto out;
+@@ -1249,6 +1251,19 @@ static void test_stacktrace_build_id(void)
+ previous_key = key;
+ } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
++ /* stack_map_get_build_id_offset() is racy and sometimes can return
++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
++ * try it one more time.
++ */
++ if (build_id_matches < 1 && retry--) {
++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
++ close(pmu_fd);
++ bpf_object__close(obj);
++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
++ __func__);
++ goto retry;
++ }
++
+ if (CHECK(build_id_matches < 1, "build id match",
+ "Didn't find expected build ID from the map\n"))
+ goto disable_pmu;
+@@ -1289,7 +1304,9 @@ static void test_stacktrace_build_id_nmi(void)
+ int i, j;
+ struct bpf_stack_build_id id_offs[PERF_MAX_STACK_DEPTH];
+ int build_id_matches = 0;
++ int retry = 1;
+
++retry:
+ err = bpf_prog_load(file, BPF_PROG_TYPE_PERF_EVENT, &obj, &prog_fd);
+ if (CHECK(err, "prog_load", "err %d errno %d\n", err, errno))
+ return;
+@@ -1384,6 +1401,19 @@ static void test_stacktrace_build_id_nmi(void)
+ previous_key = key;
+ } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
+
++ /* stack_map_get_build_id_offset() is racy and sometimes can return
++ * BPF_STACK_BUILD_ID_IP instead of BPF_STACK_BUILD_ID_VALID;
++ * try it one more time.
++ */
++ if (build_id_matches < 1 && retry--) {
++ ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
++ close(pmu_fd);
++ bpf_object__close(obj);
++ printf("%s:WARN:Didn't find expected build ID from the map, retrying\n",
++ __func__);
++ goto retry;
++ }
++
+ if (CHECK(build_id_matches < 1, "build id match",
+ "Didn't find expected build ID from the map\n"))
+ goto disable_pmu;
+--
+2.19.1
+
--- /dev/null
+From 08feabe7f2e031eee5a1f08d89478588978602b4 Mon Sep 17 00:00:00 2001
+From: Andrey Ignatov <rdna@fb.com>
+Date: Fri, 4 Jan 2019 01:07:08 -0800
+Subject: selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in
+ test_sock_addr
+
+[ Upstream commit 976b4f3a4646fbf0d189caca25f91f82e4be4b5a ]
+
+Test that sys_sendmsg BPF hook doesn't break sys_sendmsg behaviour to
+rewrite destination IPv6 = [::] with [::1] (BSD'ism).
+
+Two test cases are added:
+
+1) User passes dst IPv6 = [::] and BPF_CGROUP_UDP6_SENDMSG program
+ doesn't touch it.
+
+2) User passes dst IPv6 != [::], but BPF_CGROUP_UDP6_SENDMSG program
+ rewrites it with [::].
+
+In both cases [::1] is used by sys_sendmsg code eventually and datagram
+is sent successfully for unconnected UDP socket.
+
+Example of relevant output:
+ Test case: sendmsg6: set dst IP = [::] (BSD'ism) .. [PASS]
+ Test case: sendmsg6: preserve dst IP = [::] (BSD'ism) .. [PASS]
+
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_sock_addr.c | 53 ++++++++++++++++++--
+ 1 file changed, 50 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_sock_addr.c b/tools/testing/selftests/bpf/test_sock_addr.c
+index aeeb76a54d633..e38f1cb7089d3 100644
+--- a/tools/testing/selftests/bpf/test_sock_addr.c
++++ b/tools/testing/selftests/bpf/test_sock_addr.c
+@@ -44,6 +44,7 @@
+ #define SERV6_V4MAPPED_IP "::ffff:192.168.0.4"
+ #define SRC6_IP "::1"
+ #define SRC6_REWRITE_IP "::6"
++#define WILDCARD6_IP "::"
+ #define SERV6_PORT 6060
+ #define SERV6_REWRITE_PORT 6666
+
+@@ -85,12 +86,14 @@ static int bind4_prog_load(const struct sock_addr_test *test);
+ static int bind6_prog_load(const struct sock_addr_test *test);
+ static int connect4_prog_load(const struct sock_addr_test *test);
+ static int connect6_prog_load(const struct sock_addr_test *test);
++static int sendmsg_allow_prog_load(const struct sock_addr_test *test);
+ static int sendmsg_deny_prog_load(const struct sock_addr_test *test);
+ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test);
+ static int sendmsg4_rw_c_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_asm_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test);
+ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test);
++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test);
+
+ static struct sock_addr_test tests[] = {
+ /* bind */
+@@ -462,6 +465,34 @@ static struct sock_addr_test tests[] = {
+ SRC6_REWRITE_IP,
+ SYSCALL_ENOTSUPP,
+ },
++ {
++ "sendmsg6: set dst IP = [::] (BSD'ism)",
++ sendmsg6_rw_wildcard_prog_load,
++ BPF_CGROUP_UDP6_SENDMSG,
++ BPF_CGROUP_UDP6_SENDMSG,
++ AF_INET6,
++ SOCK_DGRAM,
++ SERV6_IP,
++ SERV6_PORT,
++ SERV6_REWRITE_IP,
++ SERV6_REWRITE_PORT,
++ SRC6_REWRITE_IP,
++ SUCCESS,
++ },
++ {
++ "sendmsg6: preserve dst IP = [::] (BSD'ism)",
++ sendmsg_allow_prog_load,
++ BPF_CGROUP_UDP6_SENDMSG,
++ BPF_CGROUP_UDP6_SENDMSG,
++ AF_INET6,
++ SOCK_DGRAM,
++ WILDCARD6_IP,
++ SERV6_PORT,
++ SERV6_REWRITE_IP,
++ SERV6_PORT,
++ SRC6_IP,
++ SUCCESS,
++ },
+ {
+ "sendmsg6: deny call",
+ sendmsg_deny_prog_load,
+@@ -714,16 +745,27 @@ static int connect6_prog_load(const struct sock_addr_test *test)
+ return load_path(test, CONNECT6_PROG_PATH);
+ }
+
+-static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
++static int sendmsg_ret_only_prog_load(const struct sock_addr_test *test,
++ int32_t rc)
+ {
+ struct bpf_insn insns[] = {
+- /* return 0 */
+- BPF_MOV64_IMM(BPF_REG_0, 0),
++ /* return rc */
++ BPF_MOV64_IMM(BPF_REG_0, rc),
+ BPF_EXIT_INSN(),
+ };
+ return load_insns(test, insns, sizeof(insns) / sizeof(struct bpf_insn));
+ }
+
++static int sendmsg_allow_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg_ret_only_prog_load(test, /*rc*/ 1);
++}
++
++static int sendmsg_deny_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg_ret_only_prog_load(test, /*rc*/ 0);
++}
++
+ static int sendmsg4_rw_asm_prog_load(const struct sock_addr_test *test)
+ {
+ struct sockaddr_in dst4_rw_addr;
+@@ -844,6 +886,11 @@ static int sendmsg6_rw_v4mapped_prog_load(const struct sock_addr_test *test)
+ return sendmsg6_rw_dst_asm_prog_load(test, SERV6_V4MAPPED_IP);
+ }
+
++static int sendmsg6_rw_wildcard_prog_load(const struct sock_addr_test *test)
++{
++ return sendmsg6_rw_dst_asm_prog_load(test, WILDCARD6_IP);
++}
++
+ static int sendmsg6_rw_c_prog_load(const struct sock_addr_test *test)
+ {
+ return load_path(test, SENDMSG6_PROG_PATH);
+--
+2.19.1
+
--- /dev/null
+From 66372cc576724dc012a74a534d23e8b0c5aed277 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 18 Jan 2019 15:58:03 +0000
+Subject: selftests: forwarding: Add a test case for externally learned FDB
+ entries
+
+[ Upstream commit 479a2b761d61c04e2ae97325aa391a8a8c99c23e ]
+
+Test that externally learned FDB entries can roam, but not age out.
+
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reviewed-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/forwarding/bridge_vlan_aware.sh | 34 ++++++++++++++++++-
+ 1 file changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+index 04c6431b2bd8c..b90dff8d3a94b 100755
+--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ # SPDX-License-Identifier: GPL-2.0
+
+-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion"
++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion extern_learn"
+ NUM_NETIFS=4
+ CHECK_TC="yes"
+ source lib.sh
+@@ -109,6 +109,38 @@ vlan_deletion()
+ ping_ipv6
+ }
+
++extern_learn()
++{
++ local mac=de:ad:be:ef:13:37
++ local ageing_time
++
++ # Test that externally learned FDB entries can roam, but not age out
++ RET=0
++
++ bridge fdb add de:ad:be:ef:13:37 dev $swp1 master extern_learn vlan 1
++
++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
++ check_err $? "Did not find FDB entry when should"
++
++ # Wait for 10 seconds after the ageing time to make sure the FDB entry
++ # was not aged out
++ ageing_time=$(bridge_ageing_time_get br0)
++ sleep $((ageing_time + 10))
++
++ bridge fdb show brport $swp1 | grep -q de:ad:be:ef:13:37
++ check_err $? "FDB entry was aged out when should not"
++
++ $MZ $h2 -c 1 -p 64 -a $mac -t ip -q
++
++ bridge fdb show brport $swp2 | grep -q de:ad:be:ef:13:37
++ check_err $? "FDB entry did not roam when should"
++
++ log_test "Externally learned FDB entry - ageing & roaming"
++
++ bridge fdb del de:ad:be:ef:13:37 dev $swp2 master vlan 1 &> /dev/null
++ bridge fdb del de:ad:be:ef:13:37 dev $swp1 master vlan 1 &> /dev/null
++}
++
+ trap cleanup EXIT
+
+ setup_prepare
+--
+2.19.1
+
--- /dev/null
+From 86ad912b01682921a429eb37f1cf9bd6a2cab17f Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Tue, 8 Jan 2019 16:48:14 +0000
+Subject: selftests: forwarding: Add a test for VLAN deletion
+
+[ Upstream commit 4fabf3bf93a194c7fa5288da3e0af37e4b943cf3 ]
+
+Add a VLAN on a bridge port, delete it and make sure the PVID VLAN is
+not affected.
+
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/bridge_vlan_aware.sh | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+index d8313d0438b74..04c6431b2bd8c 100755
+--- a/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
++++ b/tools/testing/selftests/net/forwarding/bridge_vlan_aware.sh
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ # SPDX-License-Identifier: GPL-2.0
+
+-ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding"
++ALL_TESTS="ping_ipv4 ping_ipv6 learning flooding vlan_deletion"
+ NUM_NETIFS=4
+ CHECK_TC="yes"
+ source lib.sh
+@@ -96,6 +96,19 @@ flooding()
+ flood_test $swp2 $h1 $h2
+ }
+
++vlan_deletion()
++{
++ # Test that the deletion of a VLAN on a bridge port does not affect
++ # the PVID VLAN
++ log_info "Add and delete a VLAN on bridge port $swp1"
++
++ bridge vlan add vid 10 dev $swp1
++ bridge vlan del vid 10 dev $swp1
++
++ ping_ipv4
++ ping_ipv6
++}
++
+ trap cleanup EXIT
+
+ setup_prepare
+--
+2.19.1
+
--- /dev/null
+From 2c86aa76e6a5d4fce2f6636c6a83945dd7a1bac7 Mon Sep 17 00:00:00 2001
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Fri, 11 Jan 2019 11:49:58 +0100
+Subject: selftests: tc-testing: drop test on missing tunnel key id
+
+[ Upstream commit e413615502a3324daba038f529932ba9a5248af0 ]
+
+After merge of commit 80ef0f22ceda ("net/sched: act_tunnel_key: Allow
+key-less tunnels"), act_tunnel_key does not reject anymore requests to
+install 'set' rules where the key id is missing. Therefore, drop the
+following TDC testcase:
+
+ ba4e - Add tunnel_key set action with missing mandatory id parameter
+
+because it's going to become a systematic fail as soon as userspace
+iproute2 will start supporting key-less tunnels.
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../tc-tests/actions/tunnel_key.json | 29 -------------------
+ 1 file changed, 29 deletions(-)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+index 10b2d894e4362..af5e99d272296 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+@@ -81,35 +81,6 @@
+ ]
+ ]
+ },
+- {
+- "id": "ba4e",
+- "name": "Add tunnel_key set action with missing mandatory id parameter",
+- "category": [
+- "actions",
+- "tunnel_key"
+- ],
+- "setup": [
+- [
+- "$TC actions flush action tunnel_key",
+- 0,
+- 1,
+- 255
+- ]
+- ],
+- "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 20.20.20.2",
+- "expExitCode": "255",
+- "verifyCmd": "$TC actions list action tunnel_key",
+- "matchPattern": "action order [0-9]+: tunnel_key set.*src_ip 10.10.10.1.*dst_ip 20.20.20.2",
+- "matchCount": "0",
+- "teardown": [
+- [
+- "$TC actions flush action tunnel_key",
+- 0,
+- 1,
+- 255
+- ]
+- ]
+- },
+ {
+ "id": "a5e0",
+ "name": "Add tunnel_key set action with invalid src_ip parameter",
+--
+2.19.1
+
--- /dev/null
+From 296555901349ac17467a972b22eec1c2611dff66 Mon Sep 17 00:00:00 2001
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Mon, 14 Jan 2019 18:16:44 +0100
+Subject: selftests: tc-testing: fix parsing of ife type
+
+[ Upstream commit 91fa038d9446b5bf5ea80822790af7dd9bcbb5a2 ]
+
+In iproute2 commit 90c5c969f0b9 ("fix print_0xhex on 32 bit"), the format
+specifier for the ife type changed from 0x%X to %#llX, causing systematic
+failures in the following TDC test cases:
+
+ 7682 - Create valid ife encode action with mark and pass control
+ ef47 - Create valid ife encode action with mark and pipe control
+ df43 - Create valid ife encode action with mark and continue control
+ e4cf - Create valid ife encode action with mark and drop control
+ ccba - Create valid ife encode action with mark and reclassify control
+ a1cf - Create valid ife encode action with mark and jump control
+ cb3d - Create valid ife encode action with mark value at 32-bit maximum
+ 95ed - Create valid ife encode action with prio and pass control
+ aa17 - Create valid ife encode action with prio and pipe control
+ 74c7 - Create valid ife encode action with prio and continue control
+ 7a97 - Create valid ife encode action with prio and drop control
+ f66b - Create valid ife encode action with prio and reclassify control
+ 3056 - Create valid ife encode action with prio and jump control
+ 7dd3 - Create valid ife encode action with prio value at 32-bit maximum
+ 05bb - Create valid ife encode action with tcindex and pass control
+ ce65 - Create valid ife encode action with tcindex and pipe control
+ 09cd - Create valid ife encode action with tcindex and continue control
+ 8eb5 - Create valid ife encode action with tcindex and continue control
+ 451a - Create valid ife encode action with tcindex and drop control
+ d76c - Create valid ife encode action with tcindex and reclassify control
+ e731 - Create valid ife encode action with tcindex and jump control
+ b7b8 - Create valid ife encode action with tcindex value at 16-bit maximum
+ 2a9c - Create valid ife encode action with mac src parameter
+ cf5c - Create valid ife encode action with mac dst parameter
+ 2353 - Create valid ife encode action with mac src and mac dst parameters
+ 552c - Create valid ife encode action with mark and type parameters
+ 0421 - Create valid ife encode action with prio and type parameters
+ 4017 - Create valid ife encode action with tcindex and type parameters
+ fac3 - Create valid ife encode action with index at 32-bit maximnum
+ 7c25 - Create valid ife decode action with pass control
+ dccb - Create valid ife decode action with pipe control
+ 7bb9 - Create valid ife decode action with continue control
+ d9ad - Create valid ife decode action with drop control
+ 219f - Create valid ife decode action with reclassify control
+ 8f44 - Create valid ife decode action with jump control
+ b330 - Create ife encode action with cookie
+
+Change 'matchPattern' values, allowing '0' and '0x0' if ife type is equal
+to 0, and accepting both '0x' and '0X' otherwise, to let these tests pass
+both with old and new tc binaries.
+While at it, fix a small typo in test case fac3 ('maximnum'->'maximum').
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Acked-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../tc-testing/tc-tests/actions/ife.json | 88 +++++++++----------
+ 1 file changed, 44 insertions(+), 44 deletions(-)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+index 637ea0219617f..0da3545cabdb6 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/ife.json
+@@ -17,7 +17,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -41,7 +41,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 10 pipe index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -65,7 +65,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark continue index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*allow mark.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*allow mark.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -89,7 +89,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 789 drop index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*use mark 789.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*use mark 789.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -113,7 +113,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 656768 reclassify index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 656768.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 656768.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -137,7 +137,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 65 jump 1 index 2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 2",
+- "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0xED3E.*use mark 65.*index 2",
++ "matchPattern": "action order [0-9]*: ife encode action jump 1.*type 0[xX]ED3E.*use mark 65.*index 2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -161,7 +161,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295 reclassify index 90",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 90",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use mark 4294967295.*index 90",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use mark 4294967295.*index 90",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -185,7 +185,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 4294967295999 pipe index 90",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 90",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use mark 4294967295999.*index 90",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use mark 4294967295999.*index 90",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -207,7 +207,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio pass index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow prio.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow prio.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -231,7 +231,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 7 pipe index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 7.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 7.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -255,7 +255,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 3 continue index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use prio 3.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use prio 3.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -279,7 +279,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio drop index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow prio.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow prio.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -303,7 +303,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 998877 reclassify index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 998877.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 998877.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -327,7 +327,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 998877 jump 10 index 9",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 9",
+- "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0xED3E.*use prio 998877.*index 9",
++ "matchPattern": "action order [0-9]*: ife encode action jump 10.*type 0[xX]ED3E.*use prio 998877.*index 9",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -351,7 +351,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 4294967295 reclassify index 99",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 99",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 4294967295.*index 99",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 4294967295.*index 99",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -375,7 +375,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 4294967298 pipe index 99",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 99",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use prio 4294967298.*index 99",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use prio 4294967298.*index 99",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -397,7 +397,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -421,7 +421,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 111 pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 111.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 111.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -445,7 +445,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -469,7 +469,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 1 continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action continue.*type 0xED3E.*use tcindex 1.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action continue.*type 0[xX]ED3E.*use tcindex 1.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -493,7 +493,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex drop index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action drop.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action drop.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -517,7 +517,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex reclassify index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -541,7 +541,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex jump 999 index 77",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 77",
+- "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0xED3E.*allow tcindex.*index 77",
++ "matchPattern": "action order [0-9]*: ife encode action jump 999.*type 0[xX]ED3E.*allow tcindex.*index 77",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -565,7 +565,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 65535 pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*use tcindex 65535.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*use tcindex 65535.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -589,7 +589,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 65539 pipe index 1",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*use tcindex 65539.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*use tcindex 65539.*index 1",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -611,7 +611,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark src 00:11:22:33:44:55 pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow mark src 00:11:22:33:44:55.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow mark src 00:11:22:33:44:55.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -635,7 +635,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 9876 dst 00:11:22:33:44:55 reclassify index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ED3E.*use prio 9876 dst 00:11:22:33:44:55.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -659,7 +659,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow tcindex src 00:aa:bb:cc:dd:ee dst 00:11:22:33:44:55 pass index 11",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 11",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow tcindex dst 00:11:22:33:44:55 src 00:aa:bb:cc:dd:ee .*index 11",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -683,7 +683,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use mark 7 type 0xfefe pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xFEFE.*use mark 7.*index 1",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]FEFE.*use mark 7.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -707,7 +707,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use prio 444 type 0xabba pipe index 21",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 21",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xABBA.*use prio 444.*index 21",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ABBA.*use prio 444.*index 21",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -731,7 +731,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode use tcindex 5000 type 0xabcd reclassify index 21",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 21",
+- "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0xABCD.*use tcindex 5000.*index 21",
++ "matchPattern": "action order [0-9]*: ife encode action reclassify.*type 0[xX]ABCD.*use tcindex 5000.*index 21",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -739,7 +739,7 @@
+ },
+ {
+ "id": "fac3",
+- "name": "Create valid ife encode action with index at 32-bit maximnum",
++ "name": "Create valid ife encode action with index at 32-bit maximum",
+ "category": [
+ "actions",
+ "ife"
+@@ -755,7 +755,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 4294967295",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -779,7 +779,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode pass index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action pass.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action pass.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -803,7 +803,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode pipe index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action pipe.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -827,7 +827,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode continue index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action continue.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action continue.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -851,7 +851,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode drop index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action drop.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action drop.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -875,7 +875,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode reclassify index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action reclassify.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -899,7 +899,7 @@
+ "cmdUnderTest": "$TC actions add action ife decode jump 10 index 1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 1",
+- "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0x0.*allow mark allow tcindex allow prio.*index 1",
++ "matchPattern": "action order [0-9]*: ife decode action jump 10.*type 0(x0)?.*allow mark allow tcindex allow prio.*index 1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -923,7 +923,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark pass index 4294967295999",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4294967295999",
+- "matchPattern": "action order [0-9]*: ife encode action pass.*type 0xED3E.*allow mark.*index 4294967295999",
++ "matchPattern": "action order [0-9]*: ife encode action pass.*type 0[xX]ED3E.*allow mark.*index 4294967295999",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -945,7 +945,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow mark kuka index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0xED3E.*allow mark.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action kuka.*type 0[xX]ED3E.*allow mark.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -967,7 +967,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio pipe index 4 cookie aabbccddeeff112233445566778800a1",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow prio.*index 4.*cookie aabbccddeeff112233445566778800a1",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action ife"
+@@ -991,7 +991,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow foo pipe index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0xED3E.*allow foo.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]ED3E.*allow foo.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+@@ -1013,7 +1013,7 @@
+ "cmdUnderTest": "$TC actions add action ife encode allow prio type 70000 pipe index 4",
+ "expExitCode": "255",
+ "verifyCmd": "$TC actions get action ife index 4",
+- "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0x11170.*allow prio.*index 4",
++ "matchPattern": "action order [0-9]*: ife encode action pipe.*type 0[xX]11170.*allow prio.*index 4",
+ "matchCount": "0",
+ "teardown": []
+ },
+--
+2.19.1
+
--- /dev/null
+From 3a13b4905d21b715a41022364efcf1db0d5b0b26 Mon Sep 17 00:00:00 2001
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Fri, 11 Jan 2019 15:08:23 +0100
+Subject: selftests: tc-testing: fix tunnel_key failure if dst_port is
+ unspecified
+
+[ Upstream commit 5216bd77798e2ed773ecd45f3f368dcaec63e5dd ]
+
+After commit 1c25324caf82 ("net/sched: act_tunnel_key: Don't dump dst port
+if it wasn't set"), act_tunnel_key doesn't dump anymore the destination
+port, unless it was explicitly configured. This caused systematic failures
+in the following TDC test case:
+
+ 7a88 - Add tunnel_key action with cookie parameter
+
+Avoid matching zero values of TCA_TUNNEL_KEY_ENC_DST_PORT to let the test
+pass again.
+
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/tc-testing/tc-tests/actions/tunnel_key.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+index af5e99d272296..e7e15a7336b6d 100644
+--- a/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
++++ b/tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json
+@@ -605,7 +605,7 @@
+ "cmdUnderTest": "$TC actions add action tunnel_key set src_ip 10.10.10.1 dst_ip 10.10.10.2 id 7 index 4 cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+ "expExitCode": "0",
+ "verifyCmd": "$TC actions get action tunnel_key index 4",
+- "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*dst_port 0.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
++ "matchPattern": "action order [0-9]+: tunnel_key.*set.*src_ip 10.10.10.1.*dst_ip 10.10.10.2.*key_id 7.*csum pipe.*index 4 ref.*cookie aa11bb22cc33dd44ee55ff66aa11b1b2",
+ "matchCount": "1",
+ "teardown": [
+ "$TC actions flush action tunnel_key"
+--
+2.19.1
+
alsa-hda-realtek-headset-microphone-and-internal-speaker-support-for-system76-oryp5.patch
alsa-hda-realtek-disable-pc-beep-in-passthrough-on-alc285.patch
keys-allow-reaching-the-keys-quotas-exactly.patch
+backlight-pwm_bl-fix-devicetree-parsing-with-auto-ge.patch
+mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch
+pvcalls-front-read-all-data-before-closing-the-conne.patch
+pvcalls-front-don-t-try-to-free-unallocated-rings.patch
+pvcalls-front-properly-allocate-sk.patch
+pvcalls-back-set-enotconn-in-pvcalls_conn_back_read.patch
+mfd-twl-core-fix-section-annotations-on-un-protect_p.patch
+mfd-db8500-prcmu-fix-some-section-annotations.patch
+mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch
+mfd-ab8500-core-return-zero-in-get_register_interrup.patch
+mfd-bd9571mwv-add-volatile-register-to-make-dvfs-wor.patch
+mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch
+mfd-wm5110-add-missing-asrc-rate-register.patch
+mfd-axp20x-add-ac-power-supply-cell-for-axp813.patch
+mfd-axp20x-re-align-mfd-cell-entries.patch
+mfd-axp20x-add-supported-cells-for-axp803.patch
+mfd-cros_ec_dev-add-missing-mfd_remove_devices-call-.patch
+mfd-tps65218-use-devm_regmap_add_irq_chip-and-clean-.patch
+mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch
+xen-pvcalls-remove-set-but-not-used-variable-intf.patch
+qed-fix-qed_chain_set_prod-for-pbl-chains-with-non-p.patch
+qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch
+net-hns-fix-use-after-free-identified-by-slub-debug.patch
+bpf-fix-1-rewrite-in-sys_sendmsg.patch
+selftests-bpf-test-1-rewrite-in-sys_sendmsg-in-test_.patch
+watchdog-mt7621_wdt-rt2880_wdt-fix-compilation-probl.patch
+net-mlx4-get-rid-of-page-operation-after-dma_alloc_c.patch
+mips-ath79-enable-of-serial-ports-in-the-default-con.patch
+xprtrdma-double-free-in-rpcrdma_sendctxs_create.patch
+mlxsw-spectrum_acl-add-cleanup-after-c-tcam-update-e.patch
+selftests-forwarding-add-a-test-for-vlan-deletion.patch
+netfilter-nf_tables-fix-leaking-object-reference-cou.patch
+scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch
+scsi-isci-initialize-shost-fully-before-calling-scsi.patch
+include-linux-compiler-.h-fix-optimizer_hide_var.patch
+mips-jazz-fix-64bit-build.patch
+netfilter-nft_flow_offload-fix-reverse-route-lookup.patch
+bpf-correctly-set-initial-window-on-active-fast-open.patch
+pvcalls-front-avoid-get_free_pages-gfp_kernel-under-.patch
+bpf-fix-panic-in-stack_map_get_build_id-on-i386-and-.patch
+netfilter-nft_flow_offload-fix-interaction-with-vrf-.patch
+rdma-mthca-clear-qp-objects-during-their-allocation.patch
+powerpc-8xx-fix-setting-of-pagetable-for-abatron-bdi.patch
+acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbi.patch
+net-stmmac-fix-pci-module-removal-leak.patch
+net-stmmac-dwxgmac2-only-clear-interrupts-that-are-a.patch
+net-stmmac-check-if-cbs-is-supported-before-configur.patch
+net-stmmac-fix-the-logic-of-checking-if-rx-watchdog-.patch
+net-stmmac-prevent-rx-starvation-in-stmmac_napi_poll.patch
+isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch
+scsi-tcmu-avoid-cmd-qfull-timers-updated-whenever-a-.patch
+scsi-ufs-fix-system-suspend-status.patch
+scsi-qedi-add-ep_state-for-login-completion-on-un-re.patch
+scsi-ufs-fix-geometry-descriptor-size.patch
+scsi-cxgb4i-add-wait_for_completion.patch
+netfilter-nft_flow_offload-fix-checking-method-of-co.patch
+always-clear-the-x2apic_enable-bit-for-pv-guest.patch
+drm-meson-add-missing-of_node_put.patch
+drm-amdkfd-don-t-assign-dgpus-to-apu-topology-device.patch
+drm-amd-display-fix-pme-notification-not-working-in-.patch
+vhost-return-einval-if-iovecs-size-does-not-match-th.patch
+drm-sun4i-backend-add-missing-of_node_puts.patch
+pvcalls-front-fix-potential-null-dereference.patch
+selftests-tc-testing-drop-test-on-missing-tunnel-key.patch
+selftests-tc-testing-fix-tunnel_key-failure-if-dst_p.patch
+selftests-tc-testing-fix-parsing-of-ife-type.patch
+afs-don-t-set-vnode-cb_s_break-in-afs_validate.patch
+afs-fix-key-refcounting-in-file-locking-code.patch
+bpf-don-t-assume-build-id-length-is-always-20-bytes.patch
+bpf-zero-out-build_id-for-bpf_stack_build_id_ip.patch
+selftests-bpf-retry-tests-that-expect-build-id.patch
+atm-he-fix-sign-extension-overflow-on-large-shift.patch
+hwmon-tmp421-correct-the-misspelling-of-the-tmp442-c.patch
+leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch
+bpf-bpf_setsockopt-reset-sock-dst-on-so_mark-changes.patch
+dpaa_eth-netif_f_lltx-requires-to-do-our-own-update-.patch
+mlxsw-pci-return-error-on-pci-reset-timeout.patch
+net-bridge-mark-fdb-entries-that-were-added-by-user-.patch
+mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch
+selftests-forwarding-add-a-test-case-for-externally-.patch
+net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch
+isdn-avm-fix-string-plus-integer-warning-from-clang.patch
--- /dev/null
+From b91fb869e84f3036e6424b88951868004928c51e Mon Sep 17 00:00:00 2001
+From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Date: Thu, 13 Dec 2018 17:53:50 +0300
+Subject: vhost: return EINVAL if iovecs size does not match the message size
+
+[ Upstream commit 74ad7419489ddade8044e3c9ab064ad656520306 ]
+
+We've failed to copy and process vhost_iotlb_msg so let userspace at
+least know about it. For instance before these patch the code below runs
+without any error:
+
+int main()
+{
+ struct vhost_msg msg;
+ struct iovec iov;
+ int fd;
+
+ fd = open("/dev/vhost-net", O_RDWR);
+ if (fd == -1) {
+ perror("open");
+ return 1;
+ }
+
+ iov.iov_base = &msg;
+ iov.iov_len = sizeof(msg)-4;
+
+ if (writev(fd, &iov,1) == -1) {
+ perror("writev");
+ return 1;
+ }
+
+ return 0;
+}
+
+Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 5eaeca805c95c..b214a72d5caad 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1035,8 +1035,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+ int type, ret;
+
+ ret = copy_from_iter(&type, sizeof(type), from);
+- if (ret != sizeof(type))
++ if (ret != sizeof(type)) {
++ ret = -EINVAL;
+ goto done;
++ }
+
+ switch (type) {
+ case VHOST_IOTLB_MSG:
+@@ -1055,8 +1057,10 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
+
+ iov_iter_advance(from, offset);
+ ret = copy_from_iter(&msg, sizeof(msg), from);
+- if (ret != sizeof(msg))
++ if (ret != sizeof(msg)) {
++ ret = -EINVAL;
+ goto done;
++ }
+ if (vhost_process_iotlb_msg(dev, &msg)) {
+ ret = -EFAULT;
+ goto done;
+--
+2.19.1
+
--- /dev/null
+From 72f17ac2c35ac906a0b09b31faa792235d484182 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neil@brown.name>
+Date: Sun, 30 Dec 2018 14:21:52 +1100
+Subject: watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem
+
+[ Upstream commit 3aa8b8bbc142eeaac89891de584535ceb7fce405 ]
+
+These files need
+ #include <linux/mod_devicetable.h>
+to compile correctly.
+
+Fixes: ac3167257b9f ("headers: separate linux/mod_devicetable.h from linux/platform_device.h")
+Signed-off-by: NeilBrown <neil@brown.name>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/mt7621_wdt.c | 1 +
+ drivers/watchdog/rt2880_wdt.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/mt7621_wdt.c b/drivers/watchdog/mt7621_wdt.c
+index 5c4a764717c4d..81208cd3f4ecb 100644
+--- a/drivers/watchdog/mt7621_wdt.c
++++ b/drivers/watchdog/mt7621_wdt.c
+@@ -17,6 +17,7 @@
+ #include <linux/watchdog.h>
+ #include <linux/moduleparam.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+
+ #include <asm/mach-ralink/ralink_regs.h>
+
+diff --git a/drivers/watchdog/rt2880_wdt.c b/drivers/watchdog/rt2880_wdt.c
+index 98967f0a7d10e..db7c57d82cfdc 100644
+--- a/drivers/watchdog/rt2880_wdt.c
++++ b/drivers/watchdog/rt2880_wdt.c
+@@ -18,6 +18,7 @@
+ #include <linux/watchdog.h>
+ #include <linux/moduleparam.h>
+ #include <linux/platform_device.h>
++#include <linux/mod_devicetable.h>
+
+ #include <asm/mach-ralink/ralink_regs.h>
+
+--
+2.19.1
+
--- /dev/null
+From 648e8c434fbde60daa1ebcdc9b4e20fe62dd20e2 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 4 Jan 2019 06:03:40 +0000
+Subject: xen/pvcalls: remove set but not used variable 'intf'
+
+[ Upstream commit 1f8ce09b36c41a026a37a24b20efa32000892a64 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/xen/pvcalls-back.c: In function 'pvcalls_sk_state_change':
+drivers/xen/pvcalls-back.c:286:28: warning:
+ variable 'intf' set but not used [-Wunused-but-set-variable]
+
+It not used since e6587cdbd732 ("pvcalls-back: set -ENOTCONN in
+pvcalls_conn_back_read")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index e8b3ff8e7868b..d4ea33581ac26 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -283,12 +283,10 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
+ static void pvcalls_sk_state_change(struct sock *sock)
+ {
+ struct sock_mapping *map = sock->sk_user_data;
+- struct pvcalls_data_intf *intf;
+
+ if (map == NULL)
+ return;
+
+- intf = map->ring;
+ atomic_inc(&map->read);
+ notify_remote_via_irq(map->irq);
+ }
+--
+2.19.1
+
--- /dev/null
+From ffc93b49d83bb12f69ca6739d976127a65350b3d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 5 Jan 2019 16:06:48 +0300
+Subject: xprtrdma: Double free in rpcrdma_sendctxs_create()
+
+[ Upstream commit 6e17f58c486d9554341f70aa5b63b8fbed07b3fa ]
+
+The clean up is handled by the caller, rpcrdma_buffer_create(), so this
+call to rpcrdma_sendctxs_destroy() leads to a double free.
+
+Fixes: ae72950abf99 ("xprtrdma: Add data structure to manage RDMA Send arguments")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/verbs.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 956a5ea47b58e..3d6bf790cf1fb 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -872,7 +872,7 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
+ for (i = 0; i <= buf->rb_sc_last; i++) {
+ sc = rpcrdma_sendctx_create(&r_xprt->rx_ia);
+ if (!sc)
+- goto out_destroy;
++ return -ENOMEM;
+
+ sc->sc_xprt = r_xprt;
+ buf->rb_sc_ctxs[i] = sc;
+@@ -880,10 +880,6 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
+ buf->rb_flags = 0;
+
+ return 0;
+-
+-out_destroy:
+- rpcrdma_sendctxs_destroy(buf);
+- return -ENOMEM;
+ }
+
+ /* The sendctx queue is not guaranteed to have a size that is a
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
