--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Emily Deng <Emily.Deng@amd.com>
+Date: Wed, 22 Aug 2018 20:18:25 +0800
+Subject: amdgpu: fix multi-process hang issue
+
+From: Emily Deng <Emily.Deng@amd.com>
+
+[ Upstream commit 2f40c6eac74a2a60921cdec9e9a8a57e88e31434 ]
+
+SWDEV-146499: hang during multi vulkan process testing
+
+cause:
+the second frame's PREAMBLE_IB have clear-state
+and LOAD actions, those actions ruin the pipeline
+that is still doing process in the previous frame's
+work-load IB.
+
+fix:
+need insert pipeline sync if have context switch for
+SRIOV (because only SRIOV will report PREEMPTION flag
+to UMD)
+
+Signed-off-by: Monk Liu <Monk.Liu@amd.com>
+Signed-off-by: Emily Deng <Emily.Deng@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+@@ -164,8 +164,10 @@ int amdgpu_ib_schedule(struct amdgpu_rin
+ return r;
+ }
+
++ need_ctx_switch = ring->current_ctx != fence_ctx;
+ if (ring->funcs->emit_pipeline_sync && job &&
+ ((tmp = amdgpu_sync_get_fence(&job->sched_sync, NULL)) ||
++ (amdgpu_sriov_vf(adev) && need_ctx_switch) ||
+ amdgpu_vm_need_pipeline_sync(ring, job))) {
+ need_pipe_sync = true;
+ dma_fence_put(tmp);
+@@ -196,7 +198,6 @@ int amdgpu_ib_schedule(struct amdgpu_rin
+ }
+
+ skip_preamble = ring->current_ctx == fence_ctx;
+- need_ctx_switch = ring->current_ctx != fence_ctx;
+ if (job && ring->funcs->emit_cntxcntl) {
+ if (need_ctx_switch)
+ status |= AMDGPU_HAVE_CTX_SWITCH;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 24 Aug 2018 15:08:30 +0100
+Subject: arm/arm64: smccc-1.1: Handle function result as parameters
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit 755a8bf5579d22eb5636685c516d8dede799e27b ]
+
+If someone has the silly idea to write something along those lines:
+
+ extern u64 foo(void);
+
+ void bar(struct arm_smccc_res *res)
+ {
+ arm_smccc_1_1_smc(0xbad, foo(), res);
+ }
+
+they are in for a surprise, as this gets compiled as:
+
+ 0000000000000588 <bar>:
+ 588: a9be7bfd stp x29, x30, [sp, #-32]!
+ 58c: 910003fd mov x29, sp
+ 590: f9000bf3 str x19, [sp, #16]
+ 594: aa0003f3 mov x19, x0
+ 598: aa1e03e0 mov x0, x30
+ 59c: 94000000 bl 0 <_mcount>
+ 5a0: 94000000 bl 0 <foo>
+ 5a4: aa0003e1 mov x1, x0
+ 5a8: d4000003 smc #0x0
+ 5ac: b4000073 cbz x19, 5b8 <bar+0x30>
+ 5b0: a9000660 stp x0, x1, [x19]
+ 5b4: a9010e62 stp x2, x3, [x19, #16]
+ 5b8: f9400bf3 ldr x19, [sp, #16]
+ 5bc: a8c27bfd ldp x29, x30, [sp], #32
+ 5c0: d65f03c0 ret
+ 5c4: d503201f nop
+
+The call to foo "overwrites" the x0 register for the return value,
+and we end up calling the wrong secure service.
+
+A solution is to evaluate all the parameters before assigning
+anything to specific registers, leading to the expected result:
+
+ 0000000000000588 <bar>:
+ 588: a9be7bfd stp x29, x30, [sp, #-32]!
+ 58c: 910003fd mov x29, sp
+ 590: f9000bf3 str x19, [sp, #16]
+ 594: aa0003f3 mov x19, x0
+ 598: aa1e03e0 mov x0, x30
+ 59c: 94000000 bl 0 <_mcount>
+ 5a0: 94000000 bl 0 <foo>
+ 5a4: aa0003e1 mov x1, x0
+ 5a8: d28175a0 mov x0, #0xbad
+ 5ac: d4000003 smc #0x0
+ 5b0: b4000073 cbz x19, 5bc <bar+0x34>
+ 5b4: a9000660 stp x0, x1, [x19]
+ 5b8: a9010e62 stp x2, x3, [x19, #16]
+ 5bc: f9400bf3 ldr x19, [sp, #16]
+ 5c0: a8c27bfd ldp x29, x30, [sp], #32
+ 5c4: d65f03c0 ret
+
+Reported-by: Julien Grall <julien.grall@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/arm-smccc.h | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/include/linux/arm-smccc.h
++++ b/include/linux/arm-smccc.h
+@@ -205,41 +205,51 @@ asmlinkage void __arm_smccc_hvc(unsigned
+ register unsigned long r3 asm("r3")
+
+ #define __declare_arg_1(a0, a1, res) \
++ typeof(a1) __a1 = a1; \
+ struct arm_smccc_res *___res = res; \
+ register unsigned long r0 asm("r0") = (u32)a0; \
+- register unsigned long r1 asm("r1") = a1; \
++ register unsigned long r1 asm("r1") = __a1; \
+ register unsigned long r2 asm("r2"); \
+ register unsigned long r3 asm("r3")
+
+ #define __declare_arg_2(a0, a1, a2, res) \
++ typeof(a1) __a1 = a1; \
++ typeof(a2) __a2 = a2; \
+ struct arm_smccc_res *___res = res; \
+ register unsigned long r0 asm("r0") = (u32)a0; \
+- register unsigned long r1 asm("r1") = a1; \
+- register unsigned long r2 asm("r2") = a2; \
++ register unsigned long r1 asm("r1") = __a1; \
++ register unsigned long r2 asm("r2") = __a2; \
+ register unsigned long r3 asm("r3")
+
+ #define __declare_arg_3(a0, a1, a2, a3, res) \
++ typeof(a1) __a1 = a1; \
++ typeof(a2) __a2 = a2; \
++ typeof(a3) __a3 = a3; \
+ struct arm_smccc_res *___res = res; \
+ register unsigned long r0 asm("r0") = (u32)a0; \
+- register unsigned long r1 asm("r1") = a1; \
+- register unsigned long r2 asm("r2") = a2; \
+- register unsigned long r3 asm("r3") = a3
++ register unsigned long r1 asm("r1") = __a1; \
++ register unsigned long r2 asm("r2") = __a2; \
++ register unsigned long r3 asm("r3") = __a3
+
+ #define __declare_arg_4(a0, a1, a2, a3, a4, res) \
++ typeof(a4) __a4 = a4; \
+ __declare_arg_3(a0, a1, a2, a3, res); \
+- register typeof(a4) r4 asm("r4") = a4
++ register unsigned long r4 asm("r4") = __a4
+
+ #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \
++ typeof(a5) __a5 = a5; \
+ __declare_arg_4(a0, a1, a2, a3, a4, res); \
+- register typeof(a5) r5 asm("r5") = a5
++ register unsigned long r5 asm("r5") = __a5
+
+ #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \
++ typeof(a6) __a6 = a6; \
+ __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \
+- register typeof(a6) r6 asm("r6") = a6
++ register unsigned long r6 asm("r6") = __a6
+
+ #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \
++ typeof(a7) __a7 = a7; \
+ __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \
+- register typeof(a7) r7 asm("r7") = a7
++ register unsigned long r7 asm("r7") = __a7
+
+ #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
+ #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__)
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 24 Aug 2018 15:08:29 +0100
+Subject: arm/arm64: smccc-1.1: Make return values unsigned long
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+[ Upstream commit 1d8f574708a3fb6f18c85486d0c5217df893c0cf ]
+
+An unfortunate consequence of having a strong typing for the input
+values to the SMC call is that it also affects the type of the
+return values, limiting r0 to 32 bits and r{1,2,3} to whatever
+was passed as an input.
+
+Let's turn everything into "unsigned long", which satisfies the
+requirements of both architectures, and allows for the full
+range of return values.
+
+Reported-by: Julien Grall <julien.grall@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/arm-smccc.h | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/include/linux/arm-smccc.h
++++ b/include/linux/arm-smccc.h
+@@ -199,31 +199,31 @@ asmlinkage void __arm_smccc_hvc(unsigned
+
+ #define __declare_arg_0(a0, res) \
+ struct arm_smccc_res *___res = res; \
+- register u32 r0 asm("r0") = a0; \
++ register unsigned long r0 asm("r0") = (u32)a0; \
+ register unsigned long r1 asm("r1"); \
+ register unsigned long r2 asm("r2"); \
+ register unsigned long r3 asm("r3")
+
+ #define __declare_arg_1(a0, a1, res) \
+ struct arm_smccc_res *___res = res; \
+- register u32 r0 asm("r0") = a0; \
+- register typeof(a1) r1 asm("r1") = a1; \
++ register unsigned long r0 asm("r0") = (u32)a0; \
++ register unsigned long r1 asm("r1") = a1; \
+ register unsigned long r2 asm("r2"); \
+ register unsigned long r3 asm("r3")
+
+ #define __declare_arg_2(a0, a1, a2, res) \
+ struct arm_smccc_res *___res = res; \
+- register u32 r0 asm("r0") = a0; \
+- register typeof(a1) r1 asm("r1") = a1; \
+- register typeof(a2) r2 asm("r2") = a2; \
++ register unsigned long r0 asm("r0") = (u32)a0; \
++ register unsigned long r1 asm("r1") = a1; \
++ register unsigned long r2 asm("r2") = a2; \
+ register unsigned long r3 asm("r3")
+
+ #define __declare_arg_3(a0, a1, a2, a3, res) \
+ struct arm_smccc_res *___res = res; \
+- register u32 r0 asm("r0") = a0; \
+- register typeof(a1) r1 asm("r1") = a1; \
+- register typeof(a2) r2 asm("r2") = a2; \
+- register typeof(a3) r3 asm("r3") = a3
++ register unsigned long r0 asm("r0") = (u32)a0; \
++ register unsigned long r1 asm("r1") = a1; \
++ register unsigned long r2 asm("r2") = a2; \
++ register unsigned long r3 asm("r3") = a3
+
+ #define __declare_arg_4(a0, a1, a2, a3, a4, res) \
+ __declare_arg_3(a0, a1, a2, a3, res); \
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 27 Aug 2018 19:18:21 -0700
+Subject: ARM: dts: omap4-droid4: Fix emmc errors seen on some devices
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 2d59bb602314a4b2593fde267734266b5e872dd0 ]
+
+Otherwise we can get the following errors occasionally on some devices:
+
+mmc1: tried to HW reset card, got error -110
+mmcblk1: error -110 requesting status
+mmcblk1: recovery failed!
+print_req_error: I/O error, dev mmcblk1, sector 14329
+...
+
+I have one device that hits this error almost on every boot, and another
+one that hits it only rarely with the other ones I've used behave without
+problems. I'm not sure if the issue is related to a particular eMMC card
+model, but in case it is, both of the machines with issues have:
+
+# cat /sys/class/mmc_host/mmc1/mmc1:0001/manfid \
+/sys/class/mmc_host/mmc1/mmc1:0001/oemid \
+/sys/class/mmc_host/mmc1/mmc1:0001/name
+0x000045
+0x0100
+SEM16G
+
+and the working ones have:
+
+0x000011
+0x0100
+016G92
+
+Note that "ti,non-removable" is different as omap_hsmmc_reg_get() does not
+call omap_hsmmc_disable_boot_regulators() if no_regulator_off_init is set.
+And currently we set no_regulator_off_init only for "ti,non-removable" and
+not for "non-removable". It seems that we should have "non-removable" with
+some other mmc generic property behave in the same way instead of having to
+use a non-generic property. But let's fix the issue first.
+
+Fixes: 7e2f8c0ae670 ("ARM: dts: Add minimal support for motorola droid 4
+xt894")
+Cc: Marcel Partap <mpartap@gmx.net>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Michael Scott <hashcode0f@gmail.com>
+Cc: NeKit <nekit1000@gmail.com>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4-droid4-xt894.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+@@ -351,7 +351,7 @@
+ &mmc2 {
+ vmmc-supply = <&vsdio>;
+ bus-width = <8>;
+- non-removable;
++ ti,non-removable;
+ };
+
+ &mmc3 {
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Pavel Machek <pavel@ucw.cz>
+Date: Wed, 1 Aug 2018 22:28:21 +0200
+Subject: ARM: dts: omap4-droid4: fix vibrations on Droid 4
+
+From: Pavel Machek <pavel@ucw.cz>
+
+[ Upstream commit f4efa74c09a7eddcc12cd13208f78743763f6e7a ]
+
+Vibration GPIOs don't have anything to do with wakeup. Move it to
+normal section; this fixes vibrations on Droid 4.
+
+Fixes: a5effd968301 ("ARM: dts: omap4-droid4: Add vibrator")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap4-droid4-xt894.dts | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/boot/dts/omap4-droid4-xt894.dts
++++ b/arch/arm/boot/dts/omap4-droid4-xt894.dts
+@@ -618,15 +618,6 @@
+ OMAP4_IOPAD(0x10c, PIN_INPUT | MUX_MODE1) /* abe_mcbsp3_fsx */
+ >;
+ };
+-};
+-
+-&omap4_pmx_wkup {
+- usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins {
+- /* gpio_wk0 */
+- pinctrl-single,pins = <
+- OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
+- >;
+- };
+
+ vibrator_direction_pin: pinmux_vibrator_direction_pin {
+ pinctrl-single,pins = <
+@@ -640,6 +631,15 @@
+ >;
+ };
+ };
++
++&omap4_pmx_wkup {
++ usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins {
++ /* gpio_wk0 */
++ pinctrl-single,pins = <
++ OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
++ >;
++ };
++};
+
+ /*
+ * As uart1 is wired to mdm6600 with rts and cts, we can use the cts pin for
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 8 Aug 2018 01:07:04 -0700
+Subject: ARM: OMAP2+: Fix module address for modules using mpu_rt_idx
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 1dbcb97c656eed1a244c960b8b3a469c3d20ce7b ]
+
+If we use device tree data for a module interconnect target we want
+to map the control registers from the module start. Legacy hwmod platform
+data however is using child IP offsets for cpsw module with mpu_rt_idx.
+
+In cases where we have the interconnect target module already using device
+tree data with legacy hwmod platform data still around, the sysc register
+area is not adjusted for mpu_rt_idx causing wrong registers being accessed.
+
+Let's fix the issue for mixed dts and platform data mode by ioremapping
+the module registers using child IP offset if mpu_rt_idx is set. For
+device tree only data there's no reason to use mpu_rt_idx.
+
+Fixes: 6c72b3550672 ("ARM: OMAP2+: Parse module IO range from dts for legacy
+"ti,hwmods" support")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2161,6 +2161,37 @@ static int of_dev_hwmod_lookup(struct de
+ }
+
+ /**
++ * omap_hwmod_fix_mpu_rt_idx - fix up mpu_rt_idx register offsets
++ *
++ * @oh: struct omap_hwmod *
++ * @np: struct device_node *
++ *
++ * Fix up module register offsets for modules with mpu_rt_idx.
++ * Only needed for cpsw with interconnect target module defined
++ * in device tree while still using legacy hwmod platform data
++ * for rev, sysc and syss registers.
++ *
++ * Can be removed when all cpsw hwmod platform data has been
++ * dropped.
++ */
++static void omap_hwmod_fix_mpu_rt_idx(struct omap_hwmod *oh,
++ struct device_node *np,
++ struct resource *res)
++{
++ struct device_node *child = NULL;
++ int error;
++
++ child = of_get_next_child(np, child);
++ if (!child)
++ return;
++
++ error = of_address_to_resource(child, oh->mpu_rt_idx, res);
++ if (error)
++ pr_err("%s: error mapping mpu_rt_idx: %i\n",
++ __func__, error);
++}
++
++/**
+ * omap_hwmod_parse_module_range - map module IO range from device tree
+ * @oh: struct omap_hwmod *
+ * @np: struct device_node *
+@@ -2222,6 +2253,12 @@ int omap_hwmod_parse_module_range(struct
+ pr_debug("omap_hwmod: %s %s at 0x%llx size 0x%llx\n",
+ oh ? oh->name : "", np->name, base, size);
+
++ if (oh && oh->mpu_rt_idx) {
++ omap_hwmod_fix_mpu_rt_idx(oh, np, res);
++
++ return 0;
++ }
++
+ res->start = base;
+ res->end = base + size - 1;
+ res->flags = IORESOURCE_MEM;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 8 Aug 2018 01:07:03 -0700
+Subject: ARM: OMAP2+: Fix null hwmod for ti-sysc debug
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4769c003e0fcff0ee001a9102e2605bdaa5880f0 ]
+
+We may call omap_hwmod_parse_module_range() with no hwmod allocated yet
+and may have debug enabled. Let's fix this by checking for hwmod before
+trying to use it's name.
+
+Fixes: 6c72b3550672 ("ARM: OMAP2+: Parse module IO range from dts for legacy
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2220,7 +2220,7 @@ int omap_hwmod_parse_module_range(struct
+ size = be32_to_cpup(ranges);
+
+ pr_debug("omap_hwmod: %s %s at 0x%llx size 0x%llx\n",
+- oh->name, np->name, base, size);
++ oh ? oh->name : "", np->name, base, size);
+
+ res->start = base;
+ res->end = base + size - 1;
--- /dev/null
+From d26c25a9d19b5976b319af528886f89cf455692d Mon Sep 17 00:00:00 2001
+From: Dave Martin <Dave.Martin@arm.com>
+Date: Thu, 27 Sep 2018 16:53:21 +0100
+Subject: arm64: KVM: Tighten guest core register access from userspace
+
+From: Dave Martin <Dave.Martin@arm.com>
+
+commit d26c25a9d19b5976b319af528886f89cf455692d upstream.
+
+We currently allow userspace to access the core register file
+in about any possible way, including straddling multiple
+registers and doing unaligned accesses.
+
+This is not the expected use of the ABI, and nobody is actually
+using it that way. Let's tighten it by explicitly checking
+the size and alignment for each field of the register file.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 2f4a07c5f9fe ("arm64: KVM: guest one-reg interface")
+Reviewed-by: Christoffer Dall <christoffer.dall@arm.com>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Dave Martin <Dave.Martin@arm.com>
+[maz: rewrote Dave's initial patch to be more easily backported]
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kvm/guest.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 i
+ return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
+ }
+
++static int validate_core_offset(const struct kvm_one_reg *reg)
++{
++ u64 off = core_reg_offset_from_id(reg->id);
++ int size;
++
++ switch (off) {
++ case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
++ KVM_REG_ARM_CORE_REG(regs.regs[30]):
++ case KVM_REG_ARM_CORE_REG(regs.sp):
++ case KVM_REG_ARM_CORE_REG(regs.pc):
++ case KVM_REG_ARM_CORE_REG(regs.pstate):
++ case KVM_REG_ARM_CORE_REG(sp_el1):
++ case KVM_REG_ARM_CORE_REG(elr_el1):
++ case KVM_REG_ARM_CORE_REG(spsr[0]) ...
++ KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
++ size = sizeof(__u64);
++ break;
++
++ case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
++ KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
++ size = sizeof(__uint128_t);
++ break;
++
++ case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
++ case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
++ size = sizeof(__u32);
++ break;
++
++ default:
++ return -EINVAL;
++ }
++
++ if (KVM_REG_SIZE(reg->id) == size &&
++ IS_ALIGNED(off, size / sizeof(__u32)))
++ return 0;
++
++ return -EINVAL;
++}
++
+ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ {
+ /*
+@@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu
+ (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
+ return -ENOENT;
+
++ if (validate_core_offset(reg))
++ return -EINVAL;
++
+ if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
+ return -EFAULT;
+
+@@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu
+ (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
+ return -ENOENT;
+
++ if (validate_core_offset(reg))
++ return -EINVAL;
++
+ if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
+ return -EINVAL;
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 15 Jul 2018 22:09:29 +0200
+Subject: ata: ftide010: Add a quirk for SQ201
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 46cb52ad414ac829680d0bb8cc7090ac2b577ca7 ]
+
+The DMA is broken on this specific device for some unknown
+reason (probably badly designed or plain broken interface
+electronics) and will only work with PIO. Other users of
+the same hardware does not have this problem.
+
+Add a specific quirk so that this Gemini device gets
+DMA turned off. Also fix up some code around passing the
+port information around in probe while we're at it.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/pata_ftide010.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/ata/pata_ftide010.c
++++ b/drivers/ata/pata_ftide010.c
+@@ -256,14 +256,12 @@ static struct ata_port_operations pata_f
+ .qc_issue = ftide010_qc_issue,
+ };
+
+-static struct ata_port_info ftide010_port_info[] = {
+- {
+- .flags = ATA_FLAG_SLAVE_POSS,
+- .mwdma_mask = ATA_MWDMA2,
+- .udma_mask = ATA_UDMA6,
+- .pio_mask = ATA_PIO4,
+- .port_ops = &pata_ftide010_port_ops,
+- },
++static struct ata_port_info ftide010_port_info = {
++ .flags = ATA_FLAG_SLAVE_POSS,
++ .mwdma_mask = ATA_MWDMA2,
++ .udma_mask = ATA_UDMA6,
++ .pio_mask = ATA_PIO4,
++ .port_ops = &pata_ftide010_port_ops,
+ };
+
+ #if IS_ENABLED(CONFIG_SATA_GEMINI)
+@@ -349,6 +347,7 @@ static int pata_ftide010_gemini_cable_de
+ }
+
+ static int pata_ftide010_gemini_init(struct ftide010 *ftide,
++ struct ata_port_info *pi,
+ bool is_ata1)
+ {
+ struct device *dev = ftide->dev;
+@@ -373,7 +372,13 @@ static int pata_ftide010_gemini_init(str
+
+ /* Flag port as SATA-capable */
+ if (gemini_sata_bridge_enabled(sg, is_ata1))
+- ftide010_port_info[0].flags |= ATA_FLAG_SATA;
++ pi->flags |= ATA_FLAG_SATA;
++
++ /* This device has broken DMA, only PIO works */
++ if (of_machine_is_compatible("itian,sq201")) {
++ pi->mwdma_mask = 0;
++ pi->udma_mask = 0;
++ }
+
+ /*
+ * We assume that a simple 40-wire cable is used in the PATA mode.
+@@ -435,6 +440,7 @@ static int pata_ftide010_gemini_init(str
+ }
+ #else
+ static int pata_ftide010_gemini_init(struct ftide010 *ftide,
++ struct ata_port_info *pi,
+ bool is_ata1)
+ {
+ return -ENOTSUPP;
+@@ -446,7 +452,7 @@ static int pata_ftide010_probe(struct pl
+ {
+ struct device *dev = &pdev->dev;
+ struct device_node *np = dev->of_node;
+- const struct ata_port_info pi = ftide010_port_info[0];
++ struct ata_port_info pi = ftide010_port_info;
+ const struct ata_port_info *ppi[] = { &pi, NULL };
+ struct ftide010 *ftide;
+ struct resource *res;
+@@ -490,6 +496,7 @@ static int pata_ftide010_probe(struct pl
+ * are ATA0. This will also set up the cable types.
+ */
+ ret = pata_ftide010_gemini_init(ftide,
++ &pi,
+ (res->start == 0x63400000));
+ if (ret)
+ goto err_dis_clk;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Wed, 22 Aug 2018 18:09:17 +0200
+Subject: bpf, sockmap: fix sock hash count in alloc_sock_hash_elem
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit eb29429d81e31b191f3b2bd19cf820279cec6463 ]
+
+When we try to allocate a new sock hash entry and the allocation
+fails, then sock hash map fails to reduce the map element counter,
+meaning we keep accounting this element although it was never used.
+Fix it by dropping the element counter on error.
+
+Fixes: 81110384441a ("bpf: sockmap, add hash map support")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/sockmap.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/bpf/sockmap.c
++++ b/kernel/bpf/sockmap.c
+@@ -2272,8 +2272,10 @@ static struct htab_elem *alloc_sock_hash
+ }
+ l_new = kmalloc_node(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN,
+ htab->map.numa_node);
+- if (!l_new)
++ if (!l_new) {
++ atomic_dec(&htab->count);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ memcpy(l_new->key, key, key_size);
+ l_new->sk = sk;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Tue, 21 Aug 2018 15:55:00 +0200
+Subject: bpf, sockmap: fix sock_hash_alloc and reject zero-sized keys
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit b845c898b2f1ea458d5453f0fa1da6e2dfce3bb4 ]
+
+Currently, it is possible to create a sock hash map with key size
+of 0 and have the kernel return a fd back to user space. This is
+invalid for hash maps (and kernel also hasn't been tested for zero
+key size support in general at this point). Thus, reject such
+configuration.
+
+Fixes: 81110384441a ("bpf: sockmap, add hash map support")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/sockmap.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/bpf/sockmap.c
++++ b/kernel/bpf/sockmap.c
+@@ -2143,7 +2143,9 @@ static struct bpf_map *sock_hash_alloc(u
+ return ERR_PTR(-EPERM);
+
+ /* check sanity of attributes */
+- if (attr->max_entries == 0 || attr->value_size != 4 ||
++ if (attr->max_entries == 0 ||
++ attr->key_size == 0 ||
++ attr->value_size != 4 ||
+ attr->map_flags & ~SOCK_CREATE_FLAG_MASK)
+ return ERR_PTR(-EINVAL);
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Wed, 22 Aug 2018 08:37:37 -0700
+Subject: bpf: sockmap: write_space events need to be passed to TCP handler
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 9b2e0388bec8ec5427403e23faff3b58dd1c3200 ]
+
+When sockmap code is using the stream parser it also handles the write
+space events in order to handle the case where (a) verdict redirects
+skb to another socket and (b) the sockmap then sends the skb but due
+to memory constraints (or other EAGAIN errors) needs to do a retry.
+
+But the initial code missed a third case where the
+skb_send_sock_locked() triggers an sk_wait_event(). A typically case
+would be when sndbuf size is exceeded. If this happens because we
+do not pass the write_space event to the lower layers we never wake
+up the event and it will wait for sndtimeo. Which as noted in ktls
+fix may be rather large and look like a hang to the user.
+
+To reproduce the best test is to reduce the sndbuf size and send
+1B data chunks to stress the memory handling. To fix this pass the
+event from the upper layer to the lower layer.
+
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/sockmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/bpf/sockmap.c
++++ b/kernel/bpf/sockmap.c
+@@ -1430,12 +1430,15 @@ out:
+ static void smap_write_space(struct sock *sk)
+ {
+ struct smap_psock *psock;
++ void (*write_space)(struct sock *sk);
+
+ rcu_read_lock();
+ psock = smap_psock_sk(sk);
+ if (likely(psock && test_bit(SMAP_TX_RUNNING, &psock->state)))
+ schedule_work(&psock->tx_work);
++ write_space = psock->save_write_space;
+ rcu_read_unlock();
++ write_space(sk);
+ }
+
+ static void smap_stop_sock(struct smap_psock *psock, struct sock *sk)
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 8 Aug 2018 01:07:05 -0700
+Subject: bus: ti-sysc: Fix module register ioremap for larger offsets
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 0ef8e3bb974af56346b34393e643d491d9141c66 ]
+
+We can have the interconnect target module control registers pretty
+much anywhere within the module range. The current code attempts an
+incomplete optimization of the ioremap size but does it wrong and
+it only works for registers at the beginning of the module.
+
+Let's just use the largest control register to calculate the ioremap
+size. The ioremapped range is for most part cached anyways so there
+is no need for size optimization. Let's also update the comments
+accordingly.
+
+Fixes: 0eecc636e5a2 ("bus: ti-sysc: Add minimal TI sysc interconnect
+target driver")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/ti-sysc.c | 29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -490,32 +490,29 @@ static int sysc_check_registers(struct s
+
+ /**
+ * syc_ioremap - ioremap register space for the interconnect target module
+- * @ddata: deviec driver data
++ * @ddata: device driver data
+ *
+ * Note that the interconnect target module registers can be anywhere
+- * within the first child device address space. For example, SGX has
+- * them at offset 0x1fc00 in the 32MB module address space. We just
+- * what we need around the interconnect target module registers.
++ * within the interconnect target module range. For example, SGX has
++ * them at offset 0x1fc00 in the 32MB module address space. And cpsw
++ * has them at offset 0x1200 in the CPSW_WR child. Usually the
++ * the interconnect target module registers are at the beginning of
++ * the module range though.
+ */
+ static int sysc_ioremap(struct sysc *ddata)
+ {
+- u32 size = 0;
++ int size;
+
+- if (ddata->offsets[SYSC_SYSSTATUS] >= 0)
+- size = ddata->offsets[SYSC_SYSSTATUS];
+- else if (ddata->offsets[SYSC_SYSCONFIG] >= 0)
+- size = ddata->offsets[SYSC_SYSCONFIG];
+- else if (ddata->offsets[SYSC_REVISION] >= 0)
+- size = ddata->offsets[SYSC_REVISION];
+- else
+- return -EINVAL;
++ size = max3(ddata->offsets[SYSC_REVISION],
++ ddata->offsets[SYSC_SYSCONFIG],
++ ddata->offsets[SYSC_SYSSTATUS]);
+
+- size &= 0xfff00;
+- size += SZ_256;
++ if (size < 0 || (size + sizeof(u32)) > ddata->module_size)
++ return -EINVAL;
+
+ ddata->module_va = devm_ioremap(ddata->dev,
+ ddata->module_pa,
+- size);
++ size + sizeof(u32));
+ if (!ddata->module_va)
+ return -EIO;
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 8 Aug 2018 01:07:06 -0700
+Subject: bus: ti-sysc: Fix no_console_suspend handling
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4f3530f4a41d49c41015020cd9a5ed5c95b5d2db ]
+
+If no_console_suspend is set, we should keep console enabled during suspend.
+Lets fix this by only producing a warning if we can't idle hardware during
+suspend.
+
+Fixes: ef55f8215a78 ("bus: ti-sysc: Improve suspend and resume handling")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/ti-sysc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1175,10 +1175,10 @@ static int sysc_child_suspend_noirq(stru
+ if (!pm_runtime_status_suspended(dev)) {
+ error = pm_generic_runtime_suspend(dev);
+ if (error) {
+- dev_err(dev, "%s error at %i: %i\n",
+- __func__, __LINE__, error);
++ dev_warn(dev, "%s busy at %i: %i\n",
++ __func__, __LINE__, error);
+
+- return error;
++ return 0;
+ }
+
+ error = sysc_runtime_suspend(ddata->dev);
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+Date: Tue, 21 Aug 2018 12:21:57 +0530
+Subject: clk: x86: Set default parent to 48Mhz
+
+From: Akshu Agrawal <akshu.agrawal@amd.com>
+
+[ Upstream commit bded6c03e398dc6e862dc8301fb9a60175740653 ]
+
+System clk provided in ST soc can be set to:
+48Mhz, non-spread
+25Mhz, spread
+To get accurate rate, we need it to set it at non-spread
+option which is 48Mhz.
+
+Signed-off-by: Akshu Agrawal <akshu.agrawal@amd.com>
+Reviewed-by: Daniel Kurtz <djkurtz@chromium.org>
+Fixes: 421bf6a1f061 ("clk: x86: Add ST oscout platform clock")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/x86/clk-st.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/x86/clk-st.c
++++ b/drivers/clk/x86/clk-st.c
+@@ -46,7 +46,7 @@ static int st_clk_probe(struct platform_
+ clk_oscout1_parents, ARRAY_SIZE(clk_oscout1_parents),
+ 0, st_data->base + CLKDRVSTR2, OSCOUT1CLK25MHZ, 3, 0, NULL);
+
+- clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_25M]->clk);
++ clk_set_parent(hws[ST_CLK_MUX]->clk, hws[ST_CLK_48M]->clk);
+
+ hws[ST_CLK_GATE] = clk_hw_register_gate(NULL, "oscout1", "oscout1_mux",
+ 0, st_data->base + MISCCLKCNTL1, OSCCLKENB,
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Srikanth Jampala <Jampala.Srikanth@cavium.com>
+Date: Wed, 22 Aug 2018 12:40:52 +0530
+Subject: crypto: cavium/nitrox - fix for command corruption in queue full case with backlog submissions.
+
+From: Srikanth Jampala <Jampala.Srikanth@cavium.com>
+
+[ Upstream commit 3d7c82060d1fe65bde4023aac41a0b1bd7718e07 ]
+
+Earlier used to post the current command without checking queue full
+ after backlog submissions. So, post the current command only after
+ confirming the space in queue after backlog submissions.
+
+ Maintain host write index instead of reading device registers
+ to get the next free slot to post the command.
+
+ Return -ENOSPC in queue full case.
+
+Signed-off-by: Srikanth Jampala <Jampala.Srikanth@cavium.com>
+Reviewed-by: Gadam Sreerama <sgadam@cavium.com>
+Tested-by: Jha, Chandan <Chandan.Jha@cavium.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/cavium/nitrox/nitrox_dev.h | 3 -
+ drivers/crypto/cavium/nitrox/nitrox_lib.c | 1
+ drivers/crypto/cavium/nitrox/nitrox_reqmgr.c | 57 +++++++++++++++------------
+ 3 files changed, 35 insertions(+), 26 deletions(-)
+
+--- a/drivers/crypto/cavium/nitrox/nitrox_dev.h
++++ b/drivers/crypto/cavium/nitrox/nitrox_dev.h
+@@ -35,6 +35,7 @@ struct nitrox_cmdq {
+ /* requests in backlog queues */
+ atomic_t backlog_count;
+
++ int write_idx;
+ /* command size 32B/64B */
+ u8 instr_size;
+ u8 qno;
+@@ -87,7 +88,7 @@ struct nitrox_bh {
+ struct bh_data *slc;
+ };
+
+-/* NITROX-5 driver state */
++/* NITROX-V driver state */
+ #define NITROX_UCODE_LOADED 0
+ #define NITROX_READY 1
+
+--- a/drivers/crypto/cavium/nitrox/nitrox_lib.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_lib.c
+@@ -36,6 +36,7 @@ static int cmdq_common_init(struct nitro
+ cmdq->head = PTR_ALIGN(cmdq->head_unaligned, PKT_IN_ALIGN);
+ cmdq->dma = PTR_ALIGN(cmdq->dma_unaligned, PKT_IN_ALIGN);
+ cmdq->qsize = (qsize + PKT_IN_ALIGN);
++ cmdq->write_idx = 0;
+
+ spin_lock_init(&cmdq->response_lock);
+ spin_lock_init(&cmdq->cmdq_lock);
+--- a/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
++++ b/drivers/crypto/cavium/nitrox/nitrox_reqmgr.c
+@@ -42,6 +42,16 @@
+ * Invalid flag options in AES-CCM IV.
+ */
+
++static inline int incr_index(int index, int count, int max)
++{
++ if ((index + count) >= max)
++ index = index + count - max;
++ else
++ index += count;
++
++ return index;
++}
++
+ /**
+ * dma_free_sglist - unmap and free the sg lists.
+ * @ndev: N5 device
+@@ -426,30 +436,29 @@ static void post_se_instr(struct nitrox_
+ struct nitrox_cmdq *cmdq)
+ {
+ struct nitrox_device *ndev = sr->ndev;
+- union nps_pkt_in_instr_baoff_dbell pkt_in_baoff_dbell;
+- u64 offset;
++ int idx;
+ u8 *ent;
+
+ spin_lock_bh(&cmdq->cmdq_lock);
+
+- /* get the next write offset */
+- offset = NPS_PKT_IN_INSTR_BAOFF_DBELLX(cmdq->qno);
+- pkt_in_baoff_dbell.value = nitrox_read_csr(ndev, offset);
++ idx = cmdq->write_idx;
+ /* copy the instruction */
+- ent = cmdq->head + pkt_in_baoff_dbell.s.aoff;
++ ent = cmdq->head + (idx * cmdq->instr_size);
+ memcpy(ent, &sr->instr, cmdq->instr_size);
+- /* flush the command queue updates */
+- dma_wmb();
+
+- sr->tstamp = jiffies;
+ atomic_set(&sr->status, REQ_POSTED);
+ response_list_add(sr, cmdq);
++ sr->tstamp = jiffies;
++ /* flush the command queue updates */
++ dma_wmb();
+
+ /* Ring doorbell with count 1 */
+ writeq(1, cmdq->dbell_csr_addr);
+ /* orders the doorbell rings */
+ mmiowb();
+
++ cmdq->write_idx = incr_index(idx, 1, ndev->qlen);
++
+ spin_unlock_bh(&cmdq->cmdq_lock);
+ }
+
+@@ -459,6 +468,9 @@ static int post_backlog_cmds(struct nitr
+ struct nitrox_softreq *sr, *tmp;
+ int ret = 0;
+
++ if (!atomic_read(&cmdq->backlog_count))
++ return 0;
++
+ spin_lock_bh(&cmdq->backlog_lock);
+
+ list_for_each_entry_safe(sr, tmp, &cmdq->backlog_head, backlog) {
+@@ -466,7 +478,7 @@ static int post_backlog_cmds(struct nitr
+
+ /* submit until space available */
+ if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
+- ret = -EBUSY;
++ ret = -ENOSPC;
+ break;
+ }
+ /* delete from backlog list */
+@@ -491,23 +503,20 @@ static int nitrox_enqueue_request(struct
+ {
+ struct nitrox_cmdq *cmdq = sr->cmdq;
+ struct nitrox_device *ndev = sr->ndev;
+- int ret = -EBUSY;
++
++ /* try to post backlog requests */
++ post_backlog_cmds(cmdq);
+
+ if (unlikely(cmdq_full(cmdq, ndev->qlen))) {
+ if (!(sr->flags & CRYPTO_TFM_REQ_MAY_BACKLOG))
+- return -EAGAIN;
+-
++ return -ENOSPC;
++ /* add to backlog list */
+ backlog_list_add(sr, cmdq);
+- } else {
+- ret = post_backlog_cmds(cmdq);
+- if (ret) {
+- backlog_list_add(sr, cmdq);
+- return ret;
+- }
+- post_se_instr(sr, cmdq);
+- ret = -EINPROGRESS;
++ return -EBUSY;
+ }
+- return ret;
++ post_se_instr(sr, cmdq);
++
++ return -EINPROGRESS;
+ }
+
+ /**
+@@ -624,11 +633,9 @@ int nitrox_process_se_request(struct nit
+ */
+ sr->instr.fdata[0] = *((u64 *)&req->gph);
+ sr->instr.fdata[1] = 0;
+- /* flush the soft_req changes before posting the cmd */
+- wmb();
+
+ ret = nitrox_enqueue_request(sr);
+- if (ret == -EAGAIN)
++ if (ret == -ENOSPC)
+ goto send_fail;
+
+ return ret;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+Date: Fri, 10 Aug 2018 18:27:41 +0530
+Subject: crypto: chtls - fix null dereference chtls_free_uld()
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 65b2c12dcdb883fc015c0ec65d6c2f857e0456ac ]
+
+call chtls_free_uld() only for the initialized cdev,
+this fixes NULL dereference in chtls_free_uld()
+
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: Atul Gupta <atul.gupta@chelsio.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/chelsio/chtls/chtls.h | 5 +++++
+ drivers/crypto/chelsio/chtls/chtls_main.c | 7 +++++--
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/chelsio/chtls/chtls.h
++++ b/drivers/crypto/chelsio/chtls/chtls.h
+@@ -96,6 +96,10 @@ enum csk_flags {
+ CSK_CONN_INLINE, /* Connection on HW */
+ };
+
++enum chtls_cdev_state {
++ CHTLS_CDEV_STATE_UP = 1
++};
++
+ struct listen_ctx {
+ struct sock *lsk;
+ struct chtls_dev *cdev;
+@@ -146,6 +150,7 @@ struct chtls_dev {
+ unsigned int send_page_order;
+ int max_host_sndbuf;
+ struct key_map kmap;
++ unsigned int cdev_state;
+ };
+
+ struct chtls_hws {
+--- a/drivers/crypto/chelsio/chtls/chtls_main.c
++++ b/drivers/crypto/chelsio/chtls/chtls_main.c
+@@ -160,6 +160,7 @@ static void chtls_register_dev(struct ch
+ tlsdev->hash = chtls_create_hash;
+ tlsdev->unhash = chtls_destroy_hash;
+ tls_register_device(&cdev->tlsdev);
++ cdev->cdev_state = CHTLS_CDEV_STATE_UP;
+ }
+
+ static void chtls_unregister_dev(struct chtls_dev *cdev)
+@@ -281,8 +282,10 @@ static void chtls_free_all_uld(void)
+ struct chtls_dev *cdev, *tmp;
+
+ mutex_lock(&cdev_mutex);
+- list_for_each_entry_safe(cdev, tmp, &cdev_list, list)
+- chtls_free_uld(cdev);
++ list_for_each_entry_safe(cdev, tmp, &cdev_list, list) {
++ if (cdev->cdev_state == CHTLS_CDEV_STATE_UP)
++ chtls_free_uld(cdev);
++ }
+ mutex_unlock(&cdev_mutex);
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Rex Zhu <Rex.Zhu@amd.com>
+Date: Fri, 24 Aug 2018 17:26:23 +0800
+Subject: drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode
+
+From: Rex Zhu <Rex.Zhu@amd.com>
+
+[ Upstream commit 8ef23364b654d44244400d79988e677e504b21ba ]
+
+This is required by gfx hw and can fix the rlc hang when
+do s3 stree test on Cz/St.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Hang Zhou <hang.zhou@amd.com>
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -5614,6 +5614,11 @@ static int gfx_v8_0_set_powergating_stat
+ if (amdgpu_sriov_vf(adev))
+ return 0;
+
++ if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
++ AMD_PG_SUPPORT_RLC_SMU_HS |
++ AMD_PG_SUPPORT_CP |
++ AMD_PG_SUPPORT_GFX_DMG))
++ adev->gfx.rlc.funcs->enter_safe_mode(adev);
+ switch (adev->asic_type) {
+ case CHIP_CARRIZO:
+ case CHIP_STONEY:
+@@ -5663,7 +5668,11 @@ static int gfx_v8_0_set_powergating_stat
+ default:
+ break;
+ }
+-
++ if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
++ AMD_PG_SUPPORT_RLC_SMU_HS |
++ AMD_PG_SUPPORT_CP |
++ AMD_PG_SUPPORT_GFX_DMG))
++ adev->gfx.rlc.funcs->exit_safe_mode(adev);
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: "Christian König" <christian.koenig@amd.com>
+Date: Tue, 21 Aug 2018 15:09:39 +0200
+Subject: drm/amdgpu: fix preamble handling
+
+From: "Christian König" <christian.koenig@amd.com>
+
+[ Upstream commit d98ff24e8e9be3329eea7c84d5e244d0c1cd0ab3 ]
+
+At this point the command submission can still be interrupted.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -975,13 +975,9 @@ static int amdgpu_cs_ib_fill(struct amdg
+ if (r)
+ return r;
+
+- if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE) {
+- parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT;
+- if (!parser->ctx->preamble_presented) {
+- parser->job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
+- parser->ctx->preamble_presented = true;
+- }
+- }
++ if (chunk_ib->flags & AMDGPU_IB_FLAG_PREAMBLE)
++ parser->job->preamble_status |=
++ AMDGPU_PREAMBLE_IB_PRESENT;
+
+ if (parser->job->ring && parser->job->ring != ring)
+ return -EINVAL;
+@@ -1206,6 +1202,12 @@ static int amdgpu_cs_submit(struct amdgp
+
+ amdgpu_cs_post_dependencies(p);
+
++ if ((job->preamble_status & AMDGPU_PREAMBLE_IB_PRESENT) &&
++ !p->ctx->preamble_presented) {
++ job->preamble_status |= AMDGPU_PREAMBLE_IB_PRESENT_FIRST;
++ p->ctx->preamble_presented = true;
++ }
++
+ cs->out.handle = seq;
+ job->uf_sequence = seq;
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: "Christian König" <christian.koenig@amd.com>
+Date: Thu, 16 Aug 2018 12:01:03 +0200
+Subject: drm/amdgpu: fix VM clearing for the root PD
+
+From: "Christian König" <christian.koenig@amd.com>
+
+[ Upstream commit 8604ffcbf04f8f4f3f55a9e46e5ff948b2ed4290 ]
+
+We need to figure out the address after validating the BO, not before.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -303,7 +303,6 @@ static int amdgpu_vm_clear_bo(struct amd
+ uint64_t addr;
+ int r;
+
+- addr = amdgpu_bo_gpu_offset(bo);
+ entries = amdgpu_bo_size(bo) / 8;
+
+ if (pte_support_ats) {
+@@ -335,6 +334,7 @@ static int amdgpu_vm_clear_bo(struct amd
+ if (r)
+ goto error;
+
++ addr = amdgpu_bo_gpu_offset(bo);
+ if (ats_entries) {
+ uint64_t ats_value;
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Emily Deng <Emily.Deng@amd.com>
+Date: Tue, 28 Aug 2018 20:52:40 +0800
+Subject: drm/amdgpu: Need to set moved to true when evict bo
+
+From: Emily Deng <Emily.Deng@amd.com>
+
+[ Upstream commit 6ddd9769db4fc11a98bd7e58be1764e47fdb8384 ]
+
+Fix the VMC page fault when the running sequence is as below:
+1.amdgpu_gem_create_ioctl
+2.ttm_bo_swapout->amdgpu_vm_bo_invalidate, as not called
+amdgpu_vm_bo_base_init, so won't called
+list_add_tail(&base->bo_list, &bo->va). Even the bo was evicted,
+it won't set the bo_base->moved.
+3.drm_gem_open_ioctl->amdgpu_vm_bo_base_init, here only called
+list_move_tail(&base->vm_status, &vm->evicted), but not set the
+bo_base->moved.
+4.amdgpu_vm_bo_map->amdgpu_vm_bo_insert_map, as the bo_base->moved is
+not set true, the function amdgpu_vm_bo_insert_map will call
+list_move(&bo_va->base.vm_status, &vm->moved)
+5.amdgpu_cs_ioctl won't validate the swapout bo, as it is only in the
+moved list, not in the evict list. So VMC page fault occurs.
+
+Signed-off-by: Emily Deng <Emily.Deng@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -123,6 +123,7 @@ static void amdgpu_vm_bo_base_init(struc
+ * is validated on next vm use to avoid fault.
+ * */
+ list_move_tail(&base->vm_status, &vm->evicted);
++ base->moved = true;
+ }
+
+ /**
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Rex Zhu <Rex.Zhu@amd.com>
+Date: Fri, 24 Aug 2018 16:17:54 +0800
+Subject: drm/amdgpu: Update power state at the end of smu hw_init.
+
+From: Rex Zhu <Rex.Zhu@amd.com>
+
+[ Upstream commit 2ab4d0e74256fc49b7b270f63c1d1e47c2455abc ]
+
+For SI/Kv, the power state is managed by function
+amdgpu_pm_compute_clocks.
+
+when dpm enabled, we should call amdgpu_pm_compute_clocks
+to update current power state instand of set boot state.
+
+this change can fix the oops when kfd driver was enabled on Kv.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Tested-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +---
+ drivers/gpu/drm/amd/amdgpu/si_dpm.c | 3 +--
+ 2 files changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+@@ -1354,8 +1354,6 @@ static int kv_dpm_enable(struct amdgpu_d
+ return ret;
+ }
+
+- kv_update_current_ps(adev, adev->pm.dpm.boot_ps);
+-
+ if (adev->irq.installed &&
+ amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) {
+ ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX);
+@@ -3061,7 +3059,7 @@ static int kv_dpm_hw_init(void *handle)
+ else
+ adev->pm.dpm_enabled = true;
+ mutex_unlock(&adev->pm.mutex);
+-
++ amdgpu_pm_compute_clocks(adev);
+ return ret;
+ }
+
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -6887,7 +6887,6 @@ static int si_dpm_enable(struct amdgpu_d
+
+ si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
+ si_thermal_start_thermal_controller(adev);
+- ni_update_current_ps(adev, boot_ps);
+
+ return 0;
+ }
+@@ -7764,7 +7763,7 @@ static int si_dpm_hw_init(void *handle)
+ else
+ adev->pm.dpm_enabled = true;
+ mutex_unlock(&adev->pm.mutex);
+-
++ amdgpu_pm_compute_clocks(adev);
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Bo Chen <chenbo@pdx.edu>
+Date: Mon, 23 Jul 2018 09:01:29 -0700
+Subject: e1000: check on netif_running() before calling e1000_up()
+
+From: Bo Chen <chenbo@pdx.edu>
+
+[ Upstream commit cf1acec008f8d7761aa3fd7c4bca7e17b2d2512d ]
+
+When the device is not up, the call to 'e1000_up()' from the error handling path
+of 'e1000_set_ringparam()' causes a kernel oops with a null-pointer
+dereference. The null-pointer dereference is triggered in function
+'e1000_alloc_rx_buffers()' at line 'buffer_info = &rx_ring->buffer_info[i]'.
+
+This bug was reported by COD, a tool for testing kernel module binaries I am
+building. This bug was also detected by KFI from Dr. Kai Cong.
+
+This patch fixes the bug by checking on 'netif_running()' before calling
+'e1000_up()' in 'e1000_set_ringparam()'.
+
+Signed-off-by: Bo Chen <chenbo@pdx.edu>
+Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+@@ -644,7 +644,8 @@ err_setup_rx:
+ err_alloc_rx:
+ kfree(txdr);
+ err_alloc_tx:
+- e1000_up(adapter);
++ if (netif_running(adapter->netdev))
++ e1000_up(adapter);
+ err_setup:
+ clear_bit(__E1000_RESETTING, &adapter->flags);
+ return err;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Bo Chen <chenbo@pdx.edu>
+Date: Mon, 23 Jul 2018 09:01:30 -0700
+Subject: e1000: ensure to free old tx/rx rings in set_ringparam()
+
+From: Bo Chen <chenbo@pdx.edu>
+
+[ Upstream commit ee400a3f1bfe7004a3e14b81c38ccc5583c26295 ]
+
+In 'e1000_set_ringparam()', the tx_ring and rx_ring are updated with new value
+and the old tx/rx rings are freed only when the device is up. There are resource
+leaks on old tx/rx rings when the device is not up. This bug is reported by COD,
+a tool for testing kernel module binaries I am building.
+
+This patch fixes the bug by always calling 'kfree()' on old tx/rx rings in
+'e1000_set_ringparam()'.
+
+Signed-off-by: Bo Chen <chenbo@pdx.edu>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+@@ -624,14 +624,14 @@ static int e1000_set_ringparam(struct ne
+ adapter->tx_ring = tx_old;
+ e1000_free_all_rx_resources(adapter);
+ e1000_free_all_tx_resources(adapter);
+- kfree(tx_old);
+- kfree(rx_old);
+ adapter->rx_ring = rxdr;
+ adapter->tx_ring = txdr;
+ err = e1000_up(adapter);
+ if (err)
+ goto err_setup;
+ }
++ kfree(tx_old);
++ kfree(rx_old);
+
+ clear_bit(__E1000_RESETTING, &adapter->flags);
+ return 0;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 14 Aug 2018 13:07:47 +0300
+Subject: hwmon: (adt7475) Make adt7475_read_word() return errors
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f196dec6d50abb2e65fb54a0621b2f1b4d922995 ]
+
+The adt7475_read_word() function was meant to return negative error
+codes on failure.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Tokunori Ikegami <ikegami@allied-telesis.co.jp>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/adt7475.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -303,14 +303,18 @@ static inline u16 volt2reg(int channel,
+ return clamp_val(reg, 0, 1023) & (0xff << 2);
+ }
+
+-static u16 adt7475_read_word(struct i2c_client *client, int reg)
++static int adt7475_read_word(struct i2c_client *client, int reg)
+ {
+- u16 val;
++ int val1, val2;
+
+- val = i2c_smbus_read_byte_data(client, reg);
+- val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
++ val1 = i2c_smbus_read_byte_data(client, reg);
++ if (val1 < 0)
++ return val1;
++ val2 = i2c_smbus_read_byte_data(client, reg + 1);
++ if (val2 < 0)
++ return val2;
+
+- return val;
++ return val1 | (val2 << 8);
+ }
+
+ static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Lothar Felten <lothar.felten@gmail.com>
+Date: Tue, 14 Aug 2018 09:09:37 +0200
+Subject: hwmon: (ina2xx) fix sysfs shunt resistor read access
+
+From: Lothar Felten <lothar.felten@gmail.com>
+
+[ Upstream commit 3ad867001c91657c46dcf6656d52eb6080286fd5 ]
+
+fix the sysfs shunt resistor read access: return the shunt resistor
+value, not the calibration register contents.
+
+update email address
+
+Signed-off-by: Lothar Felten <lothar.felten@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/hwmon/ina2xx | 2 +-
+ drivers/hwmon/ina2xx.c | 13 +++++++++++--
+ include/linux/platform_data/ina2xx.h | 2 +-
+ 3 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/Documentation/hwmon/ina2xx
++++ b/Documentation/hwmon/ina2xx
+@@ -32,7 +32,7 @@ Supported chips:
+ Datasheet: Publicly available at the Texas Instruments website
+ http://www.ti.com/
+
+-Author: Lothar Felten <l-felten@ti.com>
++Author: Lothar Felten <lothar.felten@gmail.com>
+
+ Description
+ -----------
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -17,7 +17,7 @@
+ * Bi-directional Current/Power Monitor with I2C Interface
+ * Datasheet: http://www.ti.com/product/ina230
+ *
+- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
++ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
+ * Thanks to Jan Volkering
+ *
+ * This program is free software; you can redistribute it and/or modify
+@@ -329,6 +329,15 @@ static int ina2xx_set_shunt(struct ina2x
+ return 0;
+ }
+
++static ssize_t ina2xx_show_shunt(struct device *dev,
++ struct device_attribute *da,
++ char *buf)
++{
++ struct ina2xx_data *data = dev_get_drvdata(dev);
++
++ return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
++}
++
+ static ssize_t ina2xx_store_shunt(struct device *dev,
+ struct device_attribute *da,
+ const char *buf, size_t count)
+@@ -403,7 +412,7 @@ static SENSOR_DEVICE_ATTR(power1_input,
+
+ /* shunt resistance */
+ static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
+- ina2xx_show_value, ina2xx_store_shunt,
++ ina2xx_show_shunt, ina2xx_store_shunt,
+ INA2XX_CALIBRATION);
+
+ /* update interval (ina226 only) */
+--- a/include/linux/platform_data/ina2xx.h
++++ b/include/linux/platform_data/ina2xx.h
+@@ -1,7 +1,7 @@
+ /*
+ * Driver for Texas Instruments INA219, INA226 power monitor chips
+ *
+- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
++ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Thu, 30 Aug 2018 11:50:13 +0300
+Subject: i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 7fd6d98b89f382d414e1db528e29a67bbd749457 ]
+
+Commit 7ae81952cda ("i2c: i801: Allow ACPI SystemIO OpRegion to conflict
+with PCI BAR") made it possible for AML code to access SMBus I/O ports
+by installing custom SystemIO OpRegion handler and blocking i80i driver
+access upon first AML read/write to this OpRegion.
+
+However, while ThinkPad T560 does have SystemIO OpRegion declared under
+the SMBus device, it does not access any of the SMBus registers:
+
+ Device (SMBU)
+ {
+ ...
+
+ OperationRegion (SMBP, PCI_Config, 0x50, 0x04)
+ Field (SMBP, DWordAcc, NoLock, Preserve)
+ {
+ , 5,
+ TCOB, 11,
+ Offset (0x04)
+ }
+
+ Name (TCBV, 0x00)
+ Method (TCBS, 0, NotSerialized)
+ {
+ If ((TCBV == 0x00))
+ {
+ TCBV = (\_SB.PCI0.SMBU.TCOB << 0x05)
+ }
+
+ Return (TCBV) /* \_SB_.PCI0.SMBU.TCBV */
+ }
+
+ OperationRegion (TCBA, SystemIO, TCBS (), 0x10)
+ Field (TCBA, ByteAcc, NoLock, Preserve)
+ {
+ Offset (0x04),
+ , 9,
+ CPSC, 1
+ }
+ }
+
+Problem with the current approach is that it blocks all I/O port access
+and because this system has touchpad connected to the SMBus controller
+after first AML access (happens during suspend/resume cycle) the
+touchpad fails to work anymore.
+
+Fix this so that we allow ACPI AML I/O port access if it does not touch
+the region reserved for the SMBus.
+
+Fixes: 7ae81952cda ("i2c: i801: Allow ACPI SystemIO OpRegion to conflict with PCI BAR")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=200737
+Reported-by: Yussuf Khalil <dev@pp3345.net>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-i801.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1417,6 +1417,13 @@ static void i801_add_tco(struct i801_pri
+ }
+
+ #ifdef CONFIG_ACPI
++static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
++ acpi_physical_address address)
++{
++ return address >= priv->smba &&
++ address <= pci_resource_end(priv->pci_dev, SMBBAR);
++}
++
+ static acpi_status
+ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
+ u64 *value, void *handler_context, void *region_context)
+@@ -1432,7 +1439,7 @@ i801_acpi_io_handler(u32 function, acpi_
+ */
+ mutex_lock(&priv->acpi_lock);
+
+- if (!priv->acpi_reserved) {
++ if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
+ priv->acpi_reserved = true;
+
+ dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Mon, 20 Aug 2018 08:12:27 -0700
+Subject: i40e: fix condition of WARN_ONCE for stat strings
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit 07f3701387dcab3a4fb0166098fb2754a1b927e1 ]
+
+Commit 9b10df596bd4 ("i40e: use WARN_ONCE to replace the commented
+BUG_ON size check") introduced a warning check to make sure
+that the size of the stat strings was always the expected value. This
+code accidentally inverted the check of the data pointer. Fix this so
+that we accurately count the size of the stats we copied in.
+
+This fixes an erroneous WARN kernel splat that occurs when requesting
+ethtool statistics.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Tested-by: Mauro S M Rodrigues <maurosr@linux.vnet.ibm.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -1903,7 +1903,7 @@ static void i40e_get_stat_strings(struct
+ data += ETH_GSTRING_LEN;
+ }
+
+- WARN_ONCE(p - data != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
++ WARN_ONCE(data - p != i40e_get_stats_count(netdev) * ETH_GSTRING_LEN,
+ "stat strings count mismatch!");
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Martyna Szapar <martyna.szapar@intel.com>
+Date: Tue, 7 Aug 2018 17:11:23 -0700
+Subject: i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled
+
+From: Martyna Szapar <martyna.szapar@intel.com>
+
+[ Upstream commit fa38e30ac73fbb01d7e5d0fd1b12d412fa3ac3ee ]
+
+If interface is connected to switch port configured for DCB there are
+TX timeouts when bringing up interface. Problem started appearing after
+adding in i40e driver code mqprio hardware offload mode. In function
+i40e_vsi_configure_bw_alloc was added resetting BW rate which should
+be executing when mqprio qdisc is removed but was also when there was
+no mqprio qdisc added and DCB was enabled. In this patch was added
+additional check for DCB flag so now when DCB is enabled the correct
+DCB configs from before mqprio patch are restored.
+
+Signed-off-by: Martyna Szapar <martyna.szapar@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -5121,15 +5121,17 @@ static int i40e_vsi_configure_bw_alloc(s
+ u8 *bw_share)
+ {
+ struct i40e_aqc_configure_vsi_tc_bw_data bw_data;
++ struct i40e_pf *pf = vsi->back;
+ i40e_status ret;
+ int i;
+
+- if (vsi->back->flags & I40E_FLAG_TC_MQPRIO)
++ /* There is no need to reset BW when mqprio mode is on. */
++ if (pf->flags & I40E_FLAG_TC_MQPRIO)
+ return 0;
+- if (!vsi->mqprio_qopt.qopt.hw) {
++ if (!vsi->mqprio_qopt.qopt.hw && !(pf->flags & I40E_FLAG_DCB_ENABLED)) {
+ ret = i40e_set_bw_limit(vsi, vsi->seid, 0);
+ if (ret)
+- dev_info(&vsi->back->pdev->dev,
++ dev_info(&pf->pdev->dev,
+ "Failed to reset tx rate for vsi->seid %u\n",
+ vsi->seid);
+ return ret;
+@@ -5138,12 +5140,11 @@ static int i40e_vsi_configure_bw_alloc(s
+ for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++)
+ bw_data.tc_bw_credits[i] = bw_share[i];
+
+- ret = i40e_aq_config_vsi_tc_bw(&vsi->back->hw, vsi->seid, &bw_data,
+- NULL);
++ ret = i40e_aq_config_vsi_tc_bw(&pf->hw, vsi->seid, &bw_data, NULL);
+ if (ret) {
+- dev_info(&vsi->back->pdev->dev,
++ dev_info(&pf->pdev->dev,
+ "AQ command Config VSI BW allocation per TC failed = %d\n",
+- vsi->back->hw.aq.asq_last_status);
++ pf->hw.aq.asq_last_status);
+ return -EINVAL;
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Preethi Banala <preethi.banala@intel.com>
+Date: Thu, 9 Aug 2018 06:28:55 -0700
+Subject: ice: Clean control queues only when they are initialized
+
+From: Preethi Banala <preethi.banala@intel.com>
+
+[ Upstream commit b29bc220e2c7bd494a4605defcd93b18d5a8cf86 ]
+
+Clean control queues only when they are initialized. One of the ways to
+validate if the basic initialization is done is by checking value of
+cq->sq.head and cq->rq.head variables that specify the register address.
+This patch adds a check to avoid NULL pointer dereference crash when tried
+to shutdown uninitialized control queue.
+
+Signed-off-by: Preethi Banala <preethi.banala@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_controlq.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -597,10 +597,14 @@ static enum ice_status ice_init_check_ad
+ return 0;
+
+ init_ctrlq_free_rq:
+- ice_shutdown_rq(hw, cq);
+- ice_shutdown_sq(hw, cq);
+- mutex_destroy(&cq->sq_lock);
+- mutex_destroy(&cq->rq_lock);
++ if (cq->rq.head) {
++ ice_shutdown_rq(hw, cq);
++ mutex_destroy(&cq->rq_lock);
++ }
++ if (cq->sq.head) {
++ ice_shutdown_sq(hw, cq);
++ mutex_destroy(&cq->sq_lock);
++ }
+ return status;
+ }
+
+@@ -706,10 +710,14 @@ static void ice_shutdown_ctrlq(struct ic
+ return;
+ }
+
+- ice_shutdown_sq(hw, cq);
+- ice_shutdown_rq(hw, cq);
+- mutex_destroy(&cq->sq_lock);
+- mutex_destroy(&cq->rq_lock);
++ if (cq->sq.head) {
++ ice_shutdown_sq(hw, cq);
++ mutex_destroy(&cq->sq_lock);
++ }
++ if (cq->rq.head) {
++ ice_shutdown_rq(hw, cq);
++ mutex_destroy(&cq->rq_lock);
++ }
+ }
+
+ /**
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Date: Thu, 9 Aug 2018 06:29:00 -0700
+Subject: ice: Fix a few null pointer dereference issues
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit c7f2c42b80ed6009f44e355aefc1e40db9485a9d ]
+
+1) When ice_ena_msix_range() fails to reserve vectors, a devm_kfree()
+ warning was seen in the error flow path. So check pf->irq_tracker
+ before use in ice_clear_interrupt_scheme().
+
+2) In ice_vsi_cfg(), check vsi->netdev before use.
+
+3) In ice_get_link_status, check link_up before use.
+
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_common.c | 2 +-
+ drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++++-------
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_common.c
++++ b/drivers/net/ethernet/intel/ice/ice_common.c
+@@ -1483,7 +1483,7 @@ enum ice_status ice_get_link_status(stru
+ struct ice_phy_info *phy_info;
+ enum ice_status status = 0;
+
+- if (!pi)
++ if (!pi || !link_up)
+ return ICE_ERR_PARAM;
+
+ phy_info = &pi->phy;
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -3260,8 +3260,10 @@ static void ice_clear_interrupt_scheme(s
+ if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
+ ice_dis_msix(pf);
+
+- devm_kfree(&pf->pdev->dev, pf->irq_tracker);
+- pf->irq_tracker = NULL;
++ if (pf->irq_tracker) {
++ devm_kfree(&pf->pdev->dev, pf->irq_tracker);
++ pf->irq_tracker = NULL;
++ }
+ }
+
+ /**
+@@ -4115,11 +4117,12 @@ static int ice_vsi_cfg(struct ice_vsi *v
+ {
+ int err;
+
+- ice_set_rx_mode(vsi->netdev);
+-
+- err = ice_restore_vlan(vsi);
+- if (err)
+- return err;
++ if (vsi->netdev) {
++ ice_set_rx_mode(vsi->netdev);
++ err = ice_restore_vlan(vsi);
++ if (err)
++ return err;
++ }
+
+ err = ice_vsi_cfg_txqs(vsi);
+ if (!err)
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Date: Thu, 9 Aug 2018 06:28:56 -0700
+Subject: ice: Fix bugs in control queue processing
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit 3d6b640efcc1b07709b42dd2e9609401c6f88633 ]
+
+This patch is a consolidation of multiple bug fixes for control queue
+processing.
+
+1) In ice_clean_adminq_subtask() remove unnecessary reads/writes to
+ registers. The bits PFINT_FW_CTL, PFINT_MBX_CTL and PFINT_SB_CTL
+ are not set when an interrupt arrives, which means that clearing them
+ again can be omitted.
+
+2) Get an accurate value in "pending" by re-reading the control queue
+ head register from the hardware.
+
+3) Fix a corner case involving lost control queue messages by checking
+ for new control messages (using ice_ctrlq_pending) before exiting the
+ cleanup routine.
+
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_controlq.c | 5 ++++-
+ drivers/net/ethernet/intel/ice/ice_main.c | 26 ++++++++++++++++++++++----
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -1065,8 +1065,11 @@ ice_clean_rq_elem(struct ice_hw *hw, str
+
+ clean_rq_elem_out:
+ /* Set pending if needed, unlock and return */
+- if (pending)
++ if (pending) {
++ /* re-read HW head to calculate actual pending messages */
++ ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
+ *pending = (u16)((ntc > ntu ? cq->rq.count : 0) + (ntu - ntc));
++ }
+ clean_rq_elem_err:
+ mutex_unlock(&cq->rq_lock);
+
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -917,13 +917,27 @@ static int __ice_clean_ctrlq(struct ice_
+ }
+
+ /**
++ * ice_ctrlq_pending - check if there is a difference between ntc and ntu
++ * @hw: pointer to hardware info
++ * @cq: control queue information
++ *
++ * returns true if there are pending messages in a queue, false if there aren't
++ */
++static bool ice_ctrlq_pending(struct ice_hw *hw, struct ice_ctl_q_info *cq)
++{
++ u16 ntu;
++
++ ntu = (u16)(rd32(hw, cq->rq.head) & cq->rq.head_mask);
++ return cq->rq.next_to_clean != ntu;
++}
++
++/**
+ * ice_clean_adminq_subtask - clean the AdminQ rings
+ * @pf: board private structure
+ */
+ static void ice_clean_adminq_subtask(struct ice_pf *pf)
+ {
+ struct ice_hw *hw = &pf->hw;
+- u32 val;
+
+ if (!test_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state))
+ return;
+@@ -933,9 +947,13 @@ static void ice_clean_adminq_subtask(str
+
+ clear_bit(__ICE_ADMINQ_EVENT_PENDING, pf->state);
+
+- /* re-enable Admin queue interrupt causes */
+- val = rd32(hw, PFINT_FW_CTL);
+- wr32(hw, PFINT_FW_CTL, (val | PFINT_FW_CTL_CAUSE_ENA_M));
++ /* There might be a situation where new messages arrive to a control
++ * queue between processing the last message and clearing the
++ * EVENT_PENDING bit. So before exiting, check queue head again (using
++ * ice_ctrlq_pending) and process new messages if any.
++ */
++ if (ice_ctrlq_pending(hw, &hw->adminq))
++ __ice_clean_ctrlq(pf, ICE_CTL_Q_ADMIN);
+
+ ice_flush(hw);
+ }
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Date: Thu, 9 Aug 2018 06:28:51 -0700
+Subject: ice: Fix multiple static analyser warnings
+
+From: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+
+[ Upstream commit 4381147df9098706caa5cf9fda37e53b2fe4871f ]
+
+This patch fixes the following smatch errors:
+
+1) Fix "odd binop '0x0 & 0xc'" when performing the bitwise-and with a
+ constant value of zero (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG).
+ Remove a similar bitwise-and with 0 in ice_add_marker_act() and use the
+ right mask ICE_LG_ACT_GENERIC_OFFSET_M in the expression.
+
+2) Fix a similar issue "odd binop '0x0 & 0x1800' in ice_req_irq_msix_misc.
+
+3) Fix "odd binop '0x380000 & 0x7fff8'" in ice_add_marker_act(). Also, use
+ a new define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX instead of magic
+ number '7'.
+
+4) Fix warn: odd binop '0x0 & 0x18' in ice_set_dflt_vsi_ctx() by removing
+ unnecessary logic to explicitly unset bits 3 and 4 in port_vlan_bits.
+ These bits are unset already by the memset on ctxt->info.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 1
+ drivers/net/ethernet/intel/ice/ice_common.c | 25 +++++++++++++-----------
+ drivers/net/ethernet/intel/ice/ice_main.c | 19 +++++++-----------
+ drivers/net/ethernet/intel/ice/ice_switch.c | 4 +--
+ 4 files changed, 25 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -594,6 +594,7 @@ struct ice_sw_rule_lg_act {
+ #define ICE_LG_ACT_GENERIC_OFFSET_M (0x7 << ICE_LG_ACT_GENERIC_OFFSET_S)
+ #define ICE_LG_ACT_GENERIC_PRIORITY_S 22
+ #define ICE_LG_ACT_GENERIC_PRIORITY_M (0x7 << ICE_LG_ACT_GENERIC_PRIORITY_S)
++#define ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX 7
+
+ /* Action = 7 - Set Stat count */
+ #define ICE_LG_ACT_STAT_COUNT 0x7
+--- a/drivers/net/ethernet/intel/ice/ice_common.c
++++ b/drivers/net/ethernet/intel/ice/ice_common.c
+@@ -1619,20 +1619,23 @@ __ice_aq_get_set_rss_lut(struct ice_hw *
+ }
+
+ /* LUT size is only valid for Global and PF table types */
+- if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128) {
+- flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128_FLAG <<
+- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+- } else if (lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512) {
++ switch (lut_size) {
++ case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_128:
++ break;
++ case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512:
+ flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_512_FLAG <<
+ ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+ ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+- } else if ((lut_size == ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K) &&
+- (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF)) {
+- flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
+- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
+- ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
+- } else {
++ break;
++ case ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K:
++ if (lut_type == ICE_AQC_GSET_RSS_LUT_TABLE_TYPE_PF) {
++ flags |= (ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_2K_FLAG <<
++ ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_S) &
++ ICE_AQC_GSET_RSS_LUT_TABLE_SIZE_M;
++ break;
++ }
++ /* fall-through */
++ default:
+ status = ICE_ERR_PARAM;
+ goto ice_aq_get_set_rss_lut_exit;
+ }
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -1352,14 +1352,13 @@ static void ice_set_dflt_vsi_ctx(struct
+ ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE;
+ /* Traffic from VSI can be sent to LAN */
+ ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA;
+- /* Allow all packets untagged/tagged */
++ /* By default bits 3 and 4 in port_vlan_flags are 0's which results in
++ * legacy behavior (show VLAN, DEI, and UP) in descriptor. Also, allow
++ * all packets untagged/tagged.
++ */
+ ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL &
+ ICE_AQ_VSI_PVLAN_MODE_M) >>
+ ICE_AQ_VSI_PVLAN_MODE_S);
+- /* Show VLAN/UP from packets in Rx descriptors */
+- ctxt->info.port_vlan_flags |= ((ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH &
+- ICE_AQ_VSI_PVLAN_EMOD_M) >>
+- ICE_AQ_VSI_PVLAN_EMOD_S);
+ /* Have 1:1 UP mapping for both ingress/egress tables */
+ table |= ICE_UP_TABLE_TRANSLATE(0, 0);
+ table |= ICE_UP_TABLE_TRANSLATE(1, 1);
+@@ -2058,15 +2057,13 @@ static int ice_req_irq_msix_misc(struct
+ skip_req_irq:
+ ice_ena_misc_vector(pf);
+
+- val = (pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
+- (ICE_RX_ITR & PFINT_OICR_CTL_ITR_INDX_M) |
+- PFINT_OICR_CTL_CAUSE_ENA_M;
++ val = ((pf->oicr_idx & PFINT_OICR_CTL_MSIX_INDX_M) |
++ PFINT_OICR_CTL_CAUSE_ENA_M);
+ wr32(hw, PFINT_OICR_CTL, val);
+
+ /* This enables Admin queue Interrupt causes */
+- val = (pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
+- (ICE_RX_ITR & PFINT_FW_CTL_ITR_INDX_M) |
+- PFINT_FW_CTL_CAUSE_ENA_M;
++ val = ((pf->oicr_idx & PFINT_FW_CTL_MSIX_INDX_M) |
++ PFINT_FW_CTL_CAUSE_ENA_M);
+ wr32(hw, PFINT_FW_CTL, val);
+
+ itr_gran = hw->itr_gran_200;
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -645,14 +645,14 @@ ice_add_marker_act(struct ice_hw *hw, st
+ act |= (1 << ICE_LG_ACT_GENERIC_VALUE_S) & ICE_LG_ACT_GENERIC_VALUE_M;
+ lg_act->pdata.lg_act.act[1] = cpu_to_le32(act);
+
+- act = (7 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
++ act = (ICE_LG_ACT_GENERIC_OFF_RX_DESC_PROF_IDX <<
++ ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_OFFSET_M;
+
+ /* Third action Marker value */
+ act |= ICE_LG_ACT_GENERIC;
+ act |= (sw_marker << ICE_LG_ACT_GENERIC_VALUE_S) &
+ ICE_LG_ACT_GENERIC_VALUE_M;
+
+- act |= (0 << ICE_LG_ACT_GENERIC_OFFSET_S) & ICE_LG_ACT_GENERIC_VALUE_M;
+ lg_act->pdata.lg_act.act[2] = cpu_to_le32(act);
+
+ /* call the fill switch rule to fill the lookup tx rx structure */
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Date: Thu, 9 Aug 2018 06:29:01 -0700
+Subject: ice: Fix potential return of uninitialized value
+
+From: Jesse Brandeburg <jesse.brandeburg@intel.com>
+
+[ Upstream commit dab0588fb616c1774bbf108eab1749dda4ac6942 ]
+
+In ice_vsi_setup_[tx|rx]_rings, err is uninitialized which can result in
+a garbage value return to the caller. Fix that.
+
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4888,7 +4888,7 @@ int ice_down(struct ice_vsi *vsi)
+ */
+ static int ice_vsi_setup_tx_rings(struct ice_vsi *vsi)
+ {
+- int i, err;
++ int i, err = 0;
+
+ if (!vsi->num_txq) {
+ dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Tx queues\n",
+@@ -4913,7 +4913,7 @@ static int ice_vsi_setup_tx_rings(struct
+ */
+ static int ice_vsi_setup_rx_rings(struct ice_vsi *vsi)
+ {
+- int i, err;
++ int i, err = 0;
+
+ if (!vsi->num_rxq) {
+ dev_err(&vsi->back->pdev->dev, "VSI %d has 0 Rx queues\n",
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Thu, 9 Aug 2018 06:28:54 -0700
+Subject: ice: Report stats for allocated queues via ethtool stats
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit f8ba7db850350319348b6d3c276f8ba19bc098ef ]
+
+It is not safe to have the string table for statistics change order or
+size over the lifetime of a given netdevice. This is because of the
+nature of the 3-step process for obtaining stats. First, user space
+performs a request for the size of the strings table. Second it performs
+a separate request for the strings themselves, after allocating space
+for the table. Third, it requests the stats themselves, also allocating
+space for the table.
+
+If the size decreased, there is potential to see garbage data or stats
+values. In the worst case, we could potentially see stats values become
+mis-aligned with their strings, so that it looks like a statistic is
+being reported differently than it actually is.
+
+Even worse, if the size increased, there is potential that the strings
+table or stats table was not allocated large enough and the stats code
+could access and write to memory it should not, potentially resulting in
+undefined behavior and system crashes.
+
+It isn't even safe if the size always changes under the RTNL lock. This
+is because the calls take place over multiple user space commands, so it
+is not possible to hold the RTNL lock for the entire duration of
+obtaining strings and stats. Further, not all consumers of the ethtool
+API are the user space ethtool program, and it is possible that one
+assumes the strings will not change (valid under the current contract),
+and thus only requests the stats values when requesting stats in a loop.
+
+Finally, it's not possible in the general case to detect when the size
+changes, because it is quite possible that one value which could impact
+the stat size increased, while another decreased. This would result in
+the same total number of stats, but reordering them so that stats no
+longer line up with the strings they belong to. Since only size changes
+aren't enough, we would need some sort of hash or token to determine
+when the strings no longer match. This would require extending the
+ethtool stats commands, but there is no more space in the relevant
+structures.
+
+The real solution to resolve this would be to add a completely new API
+for stats, probably over netlink.
+
+In the ice driver, the only thing impacting the stats that is not
+constant is the number of queues. Instead of reporting stats for each
+used queue, report stats for each allocated queue. We do not change the
+number of queues allocated for a given netdevice, as we pass this into
+the alloc_etherdev_mq() function to set the num_tx_queues and
+num_rx_queues.
+
+This resolves the potential bugs at the slight cost of displaying many
+queue statistics which will not be activated.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 7 +++
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 52 ++++++++++++++++++++-------
+ 2 files changed, 46 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -89,6 +89,13 @@ extern const char ice_drv_ver[];
+ #define ice_for_each_rxq(vsi, i) \
+ for ((i) = 0; (i) < (vsi)->num_rxq; (i)++)
+
++/* Macros for each allocated tx/rx ring whether used or not in a VSI */
++#define ice_for_each_alloc_txq(vsi, i) \
++ for ((i) = 0; (i) < (vsi)->alloc_txq; (i)++)
++
++#define ice_for_each_alloc_rxq(vsi, i) \
++ for ((i) = 0; (i) < (vsi)->alloc_rxq; (i)++)
++
+ struct ice_tc_info {
+ u16 qoffset;
+ u16 qcount;
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -26,7 +26,7 @@ static int ice_q_stats_len(struct net_de
+ {
+ struct ice_netdev_priv *np = netdev_priv(netdev);
+
+- return ((np->vsi->num_txq + np->vsi->num_rxq) *
++ return ((np->vsi->alloc_txq + np->vsi->alloc_rxq) *
+ (sizeof(struct ice_q_stats) / sizeof(u64)));
+ }
+
+@@ -218,7 +218,7 @@ static void ice_get_strings(struct net_d
+ p += ETH_GSTRING_LEN;
+ }
+
+- ice_for_each_txq(vsi, i) {
++ ice_for_each_alloc_txq(vsi, i) {
+ snprintf(p, ETH_GSTRING_LEN,
+ "tx-queue-%u.tx_packets", i);
+ p += ETH_GSTRING_LEN;
+@@ -226,7 +226,7 @@ static void ice_get_strings(struct net_d
+ p += ETH_GSTRING_LEN;
+ }
+
+- ice_for_each_rxq(vsi, i) {
++ ice_for_each_alloc_rxq(vsi, i) {
+ snprintf(p, ETH_GSTRING_LEN,
+ "rx-queue-%u.rx_packets", i);
+ p += ETH_GSTRING_LEN;
+@@ -253,6 +253,24 @@ static int ice_get_sset_count(struct net
+ {
+ switch (sset) {
+ case ETH_SS_STATS:
++ /* The number (and order) of strings reported *must* remain
++ * constant for a given netdevice. This function must not
++ * report a different number based on run time parameters
++ * (such as the number of queues in use, or the setting of
++ * a private ethtool flag). This is due to the nature of the
++ * ethtool stats API.
++ *
++ * User space programs such as ethtool must make 3 separate
++ * ioctl requests, one for size, one for the strings, and
++ * finally one for the stats. Since these cross into
++ * user space, changes to the number or size could result in
++ * undefined memory access or incorrect string<->value
++ * correlations for statistics.
++ *
++ * Even if it appears to be safe, changes to the size or
++ * order of strings will suffer from race conditions and are
++ * not safe.
++ */
+ return ICE_ALL_STATS_LEN(netdev);
+ default:
+ return -EOPNOTSUPP;
+@@ -280,18 +298,26 @@ ice_get_ethtool_stats(struct net_device
+ /* populate per queue stats */
+ rcu_read_lock();
+
+- ice_for_each_txq(vsi, j) {
++ ice_for_each_alloc_txq(vsi, j) {
+ ring = READ_ONCE(vsi->tx_rings[j]);
+- if (!ring)
+- continue;
+- data[i++] = ring->stats.pkts;
+- data[i++] = ring->stats.bytes;
++ if (ring) {
++ data[i++] = ring->stats.pkts;
++ data[i++] = ring->stats.bytes;
++ } else {
++ data[i++] = 0;
++ data[i++] = 0;
++ }
+ }
+
+- ice_for_each_rxq(vsi, j) {
++ ice_for_each_alloc_rxq(vsi, j) {
+ ring = READ_ONCE(vsi->rx_rings[j]);
+- data[i++] = ring->stats.pkts;
+- data[i++] = ring->stats.bytes;
++ if (ring) {
++ data[i++] = ring->stats.pkts;
++ data[i++] = ring->stats.bytes;
++ } else {
++ data[i++] = 0;
++ data[i++] = 0;
++ }
+ }
+
+ rcu_read_unlock();
+@@ -519,7 +545,7 @@ ice_set_ringparam(struct net_device *net
+ goto done;
+ }
+
+- for (i = 0; i < vsi->num_txq; i++) {
++ for (i = 0; i < vsi->alloc_txq; i++) {
+ /* clone ring and setup updated count */
+ tx_rings[i] = *vsi->tx_rings[i];
+ tx_rings[i].count = new_tx_cnt;
+@@ -551,7 +577,7 @@ process_rx:
+ goto done;
+ }
+
+- for (i = 0; i < vsi->num_rxq; i++) {
++ for (i = 0; i < vsi->alloc_rxq; i++) {
+ /* clone ring and setup updated count */
+ rx_rings[i] = *vsi->rx_rings[i];
+ rx_rings[i].count = new_rx_cnt;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Brett Creeley <brett.creeley@intel.com>
+Date: Thu, 9 Aug 2018 06:28:58 -0700
+Subject: ice: Set VLAN flags correctly
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit 5d8778d803e21f235e9bc727b5bd619f02abb88b ]
+
+In the struct ice_aqc_vsi_props the field port_vlan_flags is an
+overloaded term because it is used for both port VLANs (PVLANs) and
+regular VLANs. This is an issue and is very confusing especially when
+dealing with VFs because normal VLANs and port VLANs are not the same.
+To fix this the field was renamed to vlan_flags and all of the #define's
+labeled *_PVLAN_* were renamed to *_VLAN_* if they are not specific to
+port VLANs.
+
+Also in ice_vsi_manage_vlan_stripping, set the ICE_AQ_VSI_VLAN_MODE_ALL
+bit to allow the driver to add a VLAN tag to all packets it sends.
+
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 24 +++++++++---------
+ drivers/net/ethernet/intel/ice/ice_main.c | 31 +++++++++++++-----------
+ 2 files changed, 30 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -329,19 +329,19 @@ struct ice_aqc_vsi_props {
+ /* VLAN section */
+ __le16 pvid; /* VLANS include priority bits */
+ u8 pvlan_reserved[2];
+- u8 port_vlan_flags;
+-#define ICE_AQ_VSI_PVLAN_MODE_S 0
+-#define ICE_AQ_VSI_PVLAN_MODE_M (0x3 << ICE_AQ_VSI_PVLAN_MODE_S)
+-#define ICE_AQ_VSI_PVLAN_MODE_UNTAGGED 0x1
+-#define ICE_AQ_VSI_PVLAN_MODE_TAGGED 0x2
+-#define ICE_AQ_VSI_PVLAN_MODE_ALL 0x3
++ u8 vlan_flags;
++#define ICE_AQ_VSI_VLAN_MODE_S 0
++#define ICE_AQ_VSI_VLAN_MODE_M (0x3 << ICE_AQ_VSI_VLAN_MODE_S)
++#define ICE_AQ_VSI_VLAN_MODE_UNTAGGED 0x1
++#define ICE_AQ_VSI_VLAN_MODE_TAGGED 0x2
++#define ICE_AQ_VSI_VLAN_MODE_ALL 0x3
+ #define ICE_AQ_VSI_PVLAN_INSERT_PVID BIT(2)
+-#define ICE_AQ_VSI_PVLAN_EMOD_S 3
+-#define ICE_AQ_VSI_PVLAN_EMOD_M (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
+-#define ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH (0x0 << ICE_AQ_VSI_PVLAN_EMOD_S)
+-#define ICE_AQ_VSI_PVLAN_EMOD_STR_UP (0x1 << ICE_AQ_VSI_PVLAN_EMOD_S)
+-#define ICE_AQ_VSI_PVLAN_EMOD_STR (0x2 << ICE_AQ_VSI_PVLAN_EMOD_S)
+-#define ICE_AQ_VSI_PVLAN_EMOD_NOTHING (0x3 << ICE_AQ_VSI_PVLAN_EMOD_S)
++#define ICE_AQ_VSI_VLAN_EMOD_S 3
++#define ICE_AQ_VSI_VLAN_EMOD_M (0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
++#define ICE_AQ_VSI_VLAN_EMOD_STR_BOTH (0x0 << ICE_AQ_VSI_VLAN_EMOD_S)
++#define ICE_AQ_VSI_VLAN_EMOD_STR_UP (0x1 << ICE_AQ_VSI_VLAN_EMOD_S)
++#define ICE_AQ_VSI_VLAN_EMOD_STR (0x2 << ICE_AQ_VSI_VLAN_EMOD_S)
++#define ICE_AQ_VSI_VLAN_EMOD_NOTHING (0x3 << ICE_AQ_VSI_VLAN_EMOD_S)
+ u8 pvlan_reserved2[3];
+ /* ingress egress up sections */
+ __le32 ingress_table; /* bitmap, 3 bits per up */
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -1367,13 +1367,15 @@ static void ice_set_dflt_vsi_ctx(struct
+ ctxt->info.sw_flags = ICE_AQ_VSI_SW_FLAG_SRC_PRUNE;
+ /* Traffic from VSI can be sent to LAN */
+ ctxt->info.sw_flags2 = ICE_AQ_VSI_SW_FLAG_LAN_ENA;
+- /* By default bits 3 and 4 in port_vlan_flags are 0's which results in
+- * legacy behavior (show VLAN, DEI, and UP) in descriptor. Also, allow
+- * all packets untagged/tagged.
++
++ /* By default bits 3 and 4 in vlan_flags are 0's which results in legacy
++ * behavior (show VLAN, DEI, and UP) in descriptor. Also, allow all
++ * packets untagged/tagged.
+ */
+- ctxt->info.port_vlan_flags = ((ICE_AQ_VSI_PVLAN_MODE_ALL &
+- ICE_AQ_VSI_PVLAN_MODE_M) >>
+- ICE_AQ_VSI_PVLAN_MODE_S);
++ ctxt->info.vlan_flags = ((ICE_AQ_VSI_VLAN_MODE_ALL &
++ ICE_AQ_VSI_VLAN_MODE_M) >>
++ ICE_AQ_VSI_VLAN_MODE_S);
++
+ /* Have 1:1 UP mapping for both ingress/egress tables */
+ table |= ICE_UP_TABLE_TRANSLATE(0, 0);
+ table |= ICE_UP_TABLE_TRANSLATE(1, 1);
+@@ -3732,10 +3734,10 @@ static int ice_vsi_manage_vlan_insertion
+ enum ice_status status;
+
+ /* Here we are configuring the VSI to let the driver add VLAN tags by
+- * setting port_vlan_flags to ICE_AQ_VSI_PVLAN_MODE_ALL. The actual VLAN
+- * tag insertion happens in the Tx hot path, in ice_tx_map.
++ * setting vlan_flags to ICE_AQ_VSI_VLAN_MODE_ALL. The actual VLAN tag
++ * insertion happens in the Tx hot path, in ice_tx_map.
+ */
+- ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_MODE_ALL;
++ ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_MODE_ALL;
+
+ ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
+ ctxt.vsi_num = vsi->vsi_num;
+@@ -3747,7 +3749,7 @@ static int ice_vsi_manage_vlan_insertion
+ return -EIO;
+ }
+
+- vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
++ vsi->info.vlan_flags = ctxt.info.vlan_flags;
+ return 0;
+ }
+
+@@ -3769,12 +3771,15 @@ static int ice_vsi_manage_vlan_stripping
+ */
+ if (ena) {
+ /* Strip VLAN tag from Rx packet and put it in the desc */
+- ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_STR_BOTH;
++ ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_STR_BOTH;
+ } else {
+ /* Disable stripping. Leave tag in packet */
+- ctxt.info.port_vlan_flags = ICE_AQ_VSI_PVLAN_EMOD_NOTHING;
++ ctxt.info.vlan_flags = ICE_AQ_VSI_VLAN_EMOD_NOTHING;
+ }
+
++ /* Allow all packets untagged/tagged */
++ ctxt.info.vlan_flags |= ICE_AQ_VSI_VLAN_MODE_ALL;
++
+ ctxt.info.valid_sections = cpu_to_le16(ICE_AQ_VSI_PROP_VLAN_VALID);
+ ctxt.vsi_num = vsi->vsi_num;
+
+@@ -3785,7 +3790,7 @@ static int ice_vsi_manage_vlan_stripping
+ return -EIO;
+ }
+
+- vsi->info.port_vlan_flags = ctxt.info.port_vlan_flags;
++ vsi->info.vlan_flags = ctxt.info.vlan_flags;
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Thu, 9 Aug 2018 06:28:57 -0700
+Subject: ice: Use order_base_2 to calculate higher power of 2
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit 1eb43fc754485d772b1165118a8fb80c385f0492 ]
+
+Currently, we use a combination of ilog2 and is_power_of_2() to
+calculate the next power of 2 for the qcount. This appears to be causing
+a warning on some combinations of GCC and the Linux kernel:
+
+MODPOST 1 modules
+WARNING: "____ilog2_NaN" [ice.ko] undefined!
+
+This appears to because because GCC realizes that qcount could be zero
+in some circumstances and thus attempts to link against the
+intentionally undefined ___ilog2_NaN function.
+
+The order_base_2 function is intentionally defined to return 0 when
+passed 0 as an argument, and thus will be safe to use here.
+
+This not only fixes the warning but makes the resulting code slightly
+cleaner, and is really what we should have used originally.
+
+Also update the comment to make it more clear that we are rounding up,
+not just incrementing the ilog2 of qcount unconditionally.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -1313,11 +1313,8 @@ static void ice_vsi_setup_q_map(struct i
+ qcount = numq_tc;
+ }
+
+- /* find higher power-of-2 of qcount */
+- pow = ilog2(qcount);
+-
+- if (!is_power_of_2(qcount))
+- pow++;
++ /* find the (rounded up) power-of-2 of qcount */
++ pow = order_base_2(qcount);
+
+ for (i = 0; i < ICE_MAX_TRAFFIC_CLASS; i++) {
+ if (!(vsi->tc_cfg.ena_tc & BIT(i))) {
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Eric Sandeen <sandeen@redhat.com>
+Date: Thu, 16 Aug 2018 21:44:02 -0500
+Subject: isofs: reject hardware sector size > 2048 bytes
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+[ Upstream commit 09a4e0be5826aa66c4ce9954841f110ffe63ef4f ]
+
+The largest block size supported by isofs is ISOFS_BLOCK_SIZE (2048), but
+isofs_fill_super calls sb_min_blocksize and sets the blocksize to the
+device's logical block size if it's larger than what we ended up with after
+option parsing.
+
+If for some reason we try to mount a hard 4k device as an isofs filesystem,
+we'll set opt.blocksize to 4096, and when we try to read the superblock
+we found via:
+
+ block = iso_blknum << (ISOFS_BLOCK_BITS - s->s_blocksize_bits)
+
+with s_blocksize_bits greater than ISOFS_BLOCK_BITS, we'll have a negative
+shift and the bread will fail somewhat cryptically:
+
+ isofs_fill_super: bread failed, dev=sda, iso_blknum=17, block=-2147483648
+
+It seems best to just catch and clearly reject mounts of such a device.
+
+Reported-by: Bryan Gurney <bgurney@redhat.com>
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/isofs/inode.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -24,6 +24,7 @@
+ #include <linux/mpage.h>
+ #include <linux/user_namespace.h>
+ #include <linux/seq_file.h>
++#include <linux/blkdev.h>
+
+ #include "isofs.h"
+ #include "zisofs.h"
+@@ -653,6 +654,12 @@ static int isofs_fill_super(struct super
+ /*
+ * What if bugger tells us to go beyond page size?
+ */
++ if (bdev_logical_block_size(s->s_bdev) > 2048) {
++ printk(KERN_WARNING
++ "ISOFS: unsupported/invalid hardware sector size %d\n",
++ bdev_logical_block_size(s->s_bdev));
++ goto out_freesbi;
++ }
+ opt.blocksize = sb_min_blocksize(s, opt.blocksize);
+
+ sbi->s_high_sierra = 0; /* default is iso9660 */
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Sebastian Basierski <sebastianx.basierski@intel.com>
+Date: Tue, 31 Jul 2018 18:16:00 +0200
+Subject: ixgbe: fix driver behaviour after issuing VFLR
+
+From: Sebastian Basierski <sebastianx.basierski@intel.com>
+
+[ Upstream commit 939b701ad63314f5aa90dcd3d866f73954945209 ]
+
+Since VFLR doesn't clear VFMBMEM (VF Mailbox Memory)
+and is not re-enabling queues correctly we should fix
+this behavior.
+
+Signed-off-by: Sebastian Basierski <sebastianx.basierski@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 26 +++++++++++++++++++++++++
+ drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 1
+ 2 files changed, 27 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+@@ -688,8 +688,13 @@ static int ixgbe_set_vf_macvlan(struct i
+ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
+ {
+ struct ixgbe_hw *hw = &adapter->hw;
++ struct ixgbe_ring_feature *vmdq = &adapter->ring_feature[RING_F_VMDQ];
+ struct vf_data_storage *vfinfo = &adapter->vfinfo[vf];
++ u32 q_per_pool = __ALIGN_MASK(1, ~vmdq->mask);
+ u8 num_tcs = adapter->hw_tcs;
++ u32 reg_val;
++ u32 queue;
++ u32 word;
+
+ /* remove VLAN filters beloning to this VF */
+ ixgbe_clear_vf_vlans(adapter, vf);
+@@ -726,6 +731,27 @@ static inline void ixgbe_vf_reset_event(
+
+ /* reset VF api back to unknown */
+ adapter->vfinfo[vf].vf_api = ixgbe_mbox_api_10;
++
++ /* Restart each queue for given VF */
++ for (queue = 0; queue < q_per_pool; queue++) {
++ unsigned int reg_idx = (vf * q_per_pool) + queue;
++
++ reg_val = IXGBE_READ_REG(hw, IXGBE_PVFTXDCTL(reg_idx));
++
++ /* Re-enabling only configured queues */
++ if (reg_val) {
++ reg_val |= IXGBE_TXDCTL_ENABLE;
++ IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
++ reg_val &= ~IXGBE_TXDCTL_ENABLE;
++ IXGBE_WRITE_REG(hw, IXGBE_PVFTXDCTL(reg_idx), reg_val);
++ }
++ }
++
++ /* Clear VF's mailbox memory */
++ for (word = 0; word < IXGBE_VFMAILBOX_SIZE; word++)
++ IXGBE_WRITE_REG_ARRAY(hw, IXGBE_PFMBMEM(vf), word, 0);
++
++ IXGBE_WRITE_FLUSH(hw);
+ }
+
+ static int ixgbe_set_vf_mac(struct ixgbe_adapter *adapter,
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
+@@ -2518,6 +2518,7 @@ enum {
+ /* Translated register #defines */
+ #define IXGBE_PVFTDH(P) (0x06010 + (0x40 * (P)))
+ #define IXGBE_PVFTDT(P) (0x06018 + (0x40 * (P)))
++#define IXGBE_PVFTXDCTL(P) (0x06028 + (0x40 * (P)))
+ #define IXGBE_PVFTDWBAL(P) (0x06038 + (0x40 * (P)))
+ #define IXGBE_PVFTDWBAH(P) (0x0603C + (0x40 * (P)))
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+Date: Mon, 20 Aug 2018 10:54:45 +0200
+Subject: mmc: android-goldfish: fix bad logic of sg_copy_{from,to}_buffer conversion
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 17e96d8516e31c3cb52cb8e2ee79d1d2e6948c11 ]
+
+The conversion to sg_copy_{from,to}_buffer has been done in the wrong
+way. sg_copy_to_buffer is a copy from an SG list to a linear buffer so
+it can't replace memcpy(dest, host->virt_base, data->sg->length) where
+dest is the virtual address of the SG. Same for sg_copy_from_buffer
+but in the opposite way.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Suggested-by: Douglas Gilbert <dgilbert@interlog.com>
+Fixes: 53d7e098ba08 ("mmc: android-goldfish: use sg_copy_{from,to}_buffer")
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/android-goldfish.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/android-goldfish.c
++++ b/drivers/mmc/host/android-goldfish.c
+@@ -217,7 +217,7 @@ static void goldfish_mmc_xfer_done(struc
+ * We don't really have DMA, so we need
+ * to copy from our platform driver buffer
+ */
+- sg_copy_to_buffer(data->sg, 1, host->virt_base,
++ sg_copy_from_buffer(data->sg, 1, host->virt_base,
+ data->sg->length);
+ }
+ host->data->bytes_xfered += data->sg->length;
+@@ -393,7 +393,7 @@ static void goldfish_mmc_prepare_data(st
+ * We don't really have DMA, so we need to copy to our
+ * platform driver buffer
+ */
+- sg_copy_from_buffer(data->sg, 1, host->virt_base,
++ sg_copy_to_buffer(data->sg, 1, host->virt_base,
+ data->sg->length);
+ }
+ }
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+Date: Mon, 20 Aug 2018 10:54:44 +0200
+Subject: mmc: atmel-mci: fix bad logic of sg_copy_{from,to}_buffer conversion
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 19f5e9e015675fcdbf2c20e804b2e84e80201454 ]
+
+The conversion to sg_copy_{from,to}_buffer has been done in the wrong
+way. sg_copy_to_buffer is a copy from an SG list to a linear buffer so
+it can't replace memcpy(buf + offset, &value, remaining) where buf is
+the virtual address of the SG. Same for sg_copy_to_buffer but in the
+opposite way.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Suggested-by: Douglas Gilbert <dgilbert@interlog.com>
+Fixes: 5b4277814e3f ("mmc: atmel-mci: use sg_copy_{from,to}_buffer")
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/atmel-mci.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1976,7 +1976,7 @@ static void atmci_read_data_pio(struct a
+ do {
+ value = atmci_readl(host, ATMCI_RDR);
+ if (likely(offset + 4 <= sg->length)) {
+- sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
++ sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
+
+ offset += 4;
+ nbytes += 4;
+@@ -1993,7 +1993,7 @@ static void atmci_read_data_pio(struct a
+ } else {
+ unsigned int remaining = sg->length - offset;
+
+- sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
++ sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
+ nbytes += remaining;
+
+ flush_dcache_page(sg_page(sg));
+@@ -2003,7 +2003,7 @@ static void atmci_read_data_pio(struct a
+ goto done;
+
+ offset = 4 - remaining;
+- sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
++ sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
+ offset, 0);
+ nbytes += offset;
+ }
+@@ -2042,7 +2042,7 @@ static void atmci_write_data_pio(struct
+
+ do {
+ if (likely(offset + 4 <= sg->length)) {
+- sg_pcopy_from_buffer(sg, 1, &value, sizeof(u32), offset);
++ sg_pcopy_to_buffer(sg, 1, &value, sizeof(u32), offset);
+ atmci_writel(host, ATMCI_TDR, value);
+
+ offset += 4;
+@@ -2059,7 +2059,7 @@ static void atmci_write_data_pio(struct
+ unsigned int remaining = sg->length - offset;
+
+ value = 0;
+- sg_pcopy_from_buffer(sg, 1, &value, remaining, offset);
++ sg_pcopy_to_buffer(sg, 1, &value, remaining, offset);
+ nbytes += remaining;
+
+ host->sg = sg = sg_next(sg);
+@@ -2070,7 +2070,7 @@ static void atmci_write_data_pio(struct
+ }
+
+ offset = 4 - remaining;
+- sg_pcopy_from_buffer(sg, 1, (u8 *)&value + remaining,
++ sg_pcopy_to_buffer(sg, 1, (u8 *)&value + remaining,
+ offset, 0);
+ atmci_writel(host, ATMCI_TDR, value);
+ nbytes += offset;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Thu, 23 Aug 2018 11:10:10 +0800
+Subject: net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 3ed614dce3ca9912d22be215ff0f11104b69fe62 ]
+
+When enable the config item "CONFIG_ARM64_64K_PAGES", the size of PAGE_SIZE
+is 65536(64K). But the type of length and page_offset are u16, they will
+overflow. So change them to u32.
+
+Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem hnae framework support")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hnae.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
+@@ -220,10 +220,10 @@ struct hnae_desc_cb {
+
+ /* priv data for the desc, e.g. skb when use with ip stack*/
+ void *priv;
+- u16 page_offset;
+- u16 reuse_flag;
++ u32 page_offset;
++ u32 length; /* length of the buffer */
+
+- u16 length; /* length of the buffer */
++ u16 reuse_flag;
+
+ /* desc type, used by the ring user to mark the type of the priv data */
+ u16 type;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Thu, 23 Aug 2018 11:10:12 +0800
+Subject: net: hns: fix skb->truesize underestimation
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit b1ccd4c0ab6ef499f47dd84ed4920502a7147bba ]
+
+skb->truesize is not meant to be tracking amount of used bytes in a skb,
+but amount of reserved/consumed bytes in memory.
+
+For instance, if we use a single byte in last page fragment, we have to
+account the full size of the fragment.
+
+So skb_add_rx_frag needs to calculate the length of the entire buffer into
+turesize.
+
+Fixes: 9cbe9fd5214e ("net: hns: optimize XGE capability by reducing cpu usage")
+Signed-off-by: Huazhong tan <tanhuazhong@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -530,7 +530,7 @@ static void hns_nic_reuse_page(struct sk
+ }
+
+ skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len,
+- size - pull_len, truesize - pull_len);
++ size - pull_len, truesize);
+
+ /* avoid re-using remote pages,flag default unreuse */
+ if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id()))
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Huazhong Tan <tanhuazhong@huawei.com>
+Date: Thu, 23 Aug 2018 11:37:15 +0800
+Subject: net: hns3: fix page_offset overflow when CONFIG_ARM64_64K_PAGES
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 27a5959308559fa6afcaa4e6cd81d25bcb2dda7c ]
+
+When enable the config item "CONFIG_ARM64_64K_PAGES", the size of
+PAGE_SIZE is 65536(64K). But the type of page_offset is u16, it will
+overflow. So change it to u32, when "CONFIG_ARM64_64K_PAGES" enabled.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+@@ -290,11 +290,11 @@ struct hns3_desc_cb {
+
+ /* priv data for the desc, e.g. skb when use with ip stack*/
+ void *priv;
+- u16 page_offset;
+- u16 reuse_flag;
+-
++ u32 page_offset;
+ u32 length; /* length of the buffer */
+
++ u16 reuse_flag;
++
+ /* desc type, used by the ring user to mark the type of the priv data */
+ u16 type;
+ };
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Date: Wed, 22 Aug 2018 14:57:44 +1000
+Subject: net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
+
+From: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+
+[ Upstream commit 3d0371b313b84ba7c16ebf2526a7a34f1c57b19e ]
+
+The ncsi_pkg_info_all_nl() .dumpit handler is missing the NLM_F_MULTI
+flag, causing additional package information after the first to be lost.
+Also fixup a sanity check in ncsi_write_package_info() to reject out of
+range package IDs.
+
+Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ncsi/ncsi-netlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ncsi/ncsi-netlink.c
++++ b/net/ncsi/ncsi-netlink.c
+@@ -100,7 +100,7 @@ static int ncsi_write_package_info(struc
+ bool found;
+ int rc;
+
+- if (id > ndp->package_num) {
++ if (id > ndp->package_num - 1) {
+ netdev_info(ndp->ndev.dev, "NCSI: No package with id %u\n", id);
+ return -ENODEV;
+ }
+@@ -240,7 +240,7 @@ static int ncsi_pkg_info_all_nl(struct s
+ return 0; /* done */
+
+ hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
+- &ncsi_genl_family, 0, NCSI_CMD_PKG_INFO);
++ &ncsi_genl_family, NLM_F_MULTI, NCSI_CMD_PKG_INFO);
+ if (!hdr) {
+ rc = -EMSGSIZE;
+ goto err;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 9 Aug 2018 16:00:14 -0700
+Subject: nvme-fcloop: Fix dropped LS's to removed target port
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit afd299ca996929f4f98ac20da0044c0cdc124879 ]
+
+When a targetport is removed from the config, fcloop will avoid calling
+the LS done() routine thinking the targetport is gone. This leaves the
+initiator reset/reconnect hanging as it waits for a status on the
+Create_Association LS for the reconnect.
+
+Change the filter in the LS callback path. If tport null (set when
+failed validation before "sending to remote port"), be sure to call
+done. This was the main bug. But, continue the logic that only calls
+done if tport was set but there is no remoteport (e.g. case where
+remoteport has been removed, thus host doesn't expect a completion).
+
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/fcloop.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -311,7 +311,7 @@ fcloop_tgt_lsrqst_done_work(struct work_
+ struct fcloop_tport *tport = tls_req->tport;
+ struct nvmefc_ls_req *lsreq = tls_req->lsreq;
+
+- if (tport->remoteport)
++ if (!tport || tport->remoteport)
+ lsreq->done(lsreq, tls_req->status);
+ }
+
+@@ -329,6 +329,7 @@ fcloop_ls_req(struct nvme_fc_local_port
+
+ if (!rport->targetport) {
+ tls_req->status = -ECONNREFUSED;
++ tls_req->tport = NULL;
+ schedule_work(&tls_req->work);
+ return ret;
+ }
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+Date: Mon, 20 Aug 2018 00:01:45 +0300
+Subject: qed: Avoid sending mailbox commands when MFW is not responsive
+
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+
+[ Upstream commit b310974e041913231b6e3d5d475d4df55c312301 ]
+
+Keep sending mailbox commands to the MFW when it is not responsive ends up
+with a redundant amount of timeout expiries.
+This patch prints the MCP status on the first command which is not
+responded, and blocks the following commands.
+Since the (un)load request commands might be not responded due to other
+PFs, the patch also adds the option to skip the blocking upon a failure.
+
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 52 ++++++++++++++++++++++++-
+ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 6 ++
+ drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 1
+ 3 files changed, 56 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -320,6 +320,12 @@ int qed_mcp_reset(struct qed_hwfn *p_hwf
+ u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0;
+ int rc = 0;
+
++ if (p_hwfn->mcp_info->b_block_cmd) {
++ DP_NOTICE(p_hwfn,
++ "The MFW is not responsive. Avoid sending MCP_RESET mailbox command.\n");
++ return -EBUSY;
++ }
++
+ /* Ensure that only a single thread is accessing the mailbox */
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+@@ -445,6 +451,33 @@ static void __qed_mcp_cmd_and_union(stru
+ (p_mb_params->cmd | seq_num), p_mb_params->param);
+ }
+
++static void qed_mcp_cmd_set_blocking(struct qed_hwfn *p_hwfn, bool block_cmd)
++{
++ p_hwfn->mcp_info->b_block_cmd = block_cmd;
++
++ DP_INFO(p_hwfn, "%s sending of mailbox commands to the MFW\n",
++ block_cmd ? "Block" : "Unblock");
++}
++
++static void qed_mcp_print_cpu_info(struct qed_hwfn *p_hwfn,
++ struct qed_ptt *p_ptt)
++{
++ u32 cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2;
++ u32 delay = QED_MCP_RESP_ITER_US;
++
++ cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
++ cpu_pc_0 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
++ udelay(delay);
++ cpu_pc_1 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
++ udelay(delay);
++ cpu_pc_2 = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_PROGRAM_COUNTER);
++
++ DP_NOTICE(p_hwfn,
++ "MCP CPU info: mode 0x%08x, state 0x%08x, pc {0x%08x, 0x%08x, 0x%08x}\n",
++ cpu_mode, cpu_state, cpu_pc_0, cpu_pc_1, cpu_pc_2);
++}
++
+ static int
+ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+ struct qed_ptt *p_ptt,
+@@ -531,11 +564,15 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
+ DP_NOTICE(p_hwfn,
+ "The MFW failed to respond to command 0x%08x [param 0x%08x].\n",
+ p_mb_params->cmd, p_mb_params->param);
++ qed_mcp_print_cpu_info(p_hwfn, p_ptt);
+
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+ qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+
++ if (!QED_MB_FLAGS_IS_SET(p_mb_params, AVOID_BLOCK))
++ qed_mcp_cmd_set_blocking(p_hwfn, true);
++
+ return -EAGAIN;
+ }
+
+@@ -573,6 +610,13 @@ static int qed_mcp_cmd_and_union(struct
+ return -EBUSY;
+ }
+
++ if (p_hwfn->mcp_info->b_block_cmd) {
++ DP_NOTICE(p_hwfn,
++ "The MFW is not responsive. Avoid sending mailbox command 0x%08x [param 0x%08x].\n",
++ p_mb_params->cmd, p_mb_params->param);
++ return -EBUSY;
++ }
++
+ if (p_mb_params->data_src_size > union_data_size ||
+ p_mb_params->data_dst_size > union_data_size) {
+ DP_ERR(p_hwfn,
+@@ -805,7 +849,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hw
+ mb_params.data_src_size = sizeof(load_req);
+ mb_params.p_data_dst = &load_rsp;
+ mb_params.data_dst_size = sizeof(load_rsp);
+- mb_params.flags = QED_MB_FLAG_CAN_SLEEP;
++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
+
+ DP_VERBOSE(p_hwfn, QED_MSG_SP,
+ "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n",
+@@ -1049,7 +1093,7 @@ int qed_mcp_unload_req(struct qed_hwfn *
+ memset(&mb_params, 0, sizeof(mb_params));
+ mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ;
+ mb_params.param = wol_param;
+- mb_params.flags = QED_MB_FLAG_CAN_SLEEP;
++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP | QED_MB_FLAG_AVOID_BLOCK;
+
+ return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params);
+ }
+@@ -2156,6 +2200,8 @@ int qed_mcp_halt(struct qed_hwfn *p_hwfn
+ return -EBUSY;
+ }
+
++ qed_mcp_cmd_set_blocking(p_hwfn, true);
++
+ return 0;
+ }
+
+@@ -2180,6 +2226,8 @@ int qed_mcp_resume(struct qed_hwfn *p_hw
+ return -EBUSY;
+ }
+
++ qed_mcp_cmd_set_blocking(p_hwfn, false);
++
+ return 0;
+ }
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+@@ -635,11 +635,14 @@ struct qed_mcp_info {
+ */
+ spinlock_t cmd_lock;
+
++ /* Flag to indicate whether sending a MFW mailbox command is blocked */
++ bool b_block_cmd;
++
+ /* Spinlock used for syncing SW link-changes and link-changes
+ * originating from attention context.
+ */
+ spinlock_t link_lock;
+- bool block_mb_sending;
++
+ u32 public_base;
+ u32 drv_mb_addr;
+ u32 mfw_mb_addr;
+@@ -670,6 +673,7 @@ struct qed_mcp_mb_params {
+ u32 mcp_param;
+ u32 flags;
+ #define QED_MB_FLAG_CAN_SLEEP (0x1 << 0)
++#define QED_MB_FLAG_AVOID_BLOCK (0x1 << 1)
+ #define QED_MB_FLAGS_IS_SET(params, flag) \
+ ({ typeof(params) __params = (params); \
+ (__params && (__params->flags & QED_MB_FLAG_ ## flag)); })
+--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+@@ -565,6 +565,7 @@
+ #define MCP_REG_CPU_STATE_SOFT_HALTED (0x1UL << 10)
+ #define MCP_REG_CPU_EVENT_MASK \
+ 0xe05008UL
++#define MCP_REG_CPU_PROGRAM_COUNTER 0xe0501cUL
+ #define PGLUE_B_REG_PF_BAR0_SIZE \
+ 0x2aae60UL
+ #define PGLUE_B_REG_PF_BAR1_SIZE \
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+Date: Mon, 20 Aug 2018 00:01:44 +0300
+Subject: qed: Prevent a possible deadlock during driver load and unload
+
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+
+[ Upstream commit eaa50fc59e5841910987e90b0438b2643041f508 ]
+
+The MFW manages an internal lock to prevent concurrent hardware
+(de)initialization of different PFs.
+This, together with the busy-waiting for the MFW's responses for commands,
+might lead to a deadlock during concurrent load or unload of PFs.
+This patch adds the option to sleep within the busy-waiting, and uses it
+for the (un)load requests (which are not sent from an interrupt context) to
+prevent the possible deadlock.
+
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 43 +++++++++++++++++++++---------
+ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 21 +++++++++-----
+ 2 files changed, 44 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -48,7 +48,7 @@
+ #include "qed_reg_addr.h"
+ #include "qed_sriov.h"
+
+-#define CHIP_MCP_RESP_ITER_US 10
++#define QED_MCP_RESP_ITER_US 10
+
+ #define QED_DRV_MB_MAX_RETRIES (500 * 1000) /* Account for 5 sec */
+ #define QED_MCP_RESET_RETRIES (50 * 1000) /* Account for 500 msec */
+@@ -317,7 +317,7 @@ static void qed_mcp_reread_offsets(struc
+
+ int qed_mcp_reset(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+- u32 org_mcp_reset_seq, seq, delay = CHIP_MCP_RESP_ITER_US, cnt = 0;
++ u32 org_mcp_reset_seq, seq, delay = QED_MCP_RESP_ITER_US, cnt = 0;
+ int rc = 0;
+
+ /* Ensure that only a single thread is accessing the mailbox */
+@@ -449,10 +449,10 @@ static int
+ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
+ struct qed_ptt *p_ptt,
+ struct qed_mcp_mb_params *p_mb_params,
+- u32 max_retries, u32 delay)
++ u32 max_retries, u32 usecs)
+ {
++ u32 cnt = 0, msecs = DIV_ROUND_UP(usecs, 1000);
+ struct qed_mcp_cmd_elem *p_cmd_elem;
+- u32 cnt = 0;
+ u16 seq_num;
+ int rc = 0;
+
+@@ -475,7 +475,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
+ goto err;
+
+ spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
+- udelay(delay);
++
++ if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
++ msleep(msecs);
++ else
++ udelay(usecs);
+ } while (++cnt < max_retries);
+
+ if (cnt >= max_retries) {
+@@ -504,7 +508,11 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
+ * The spinlock stays locked until the list element is removed.
+ */
+
+- udelay(delay);
++ if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP))
++ msleep(msecs);
++ else
++ udelay(usecs);
++
+ spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
+
+ if (p_cmd_elem->b_is_completed)
+@@ -539,7 +547,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *
+ "MFW mailbox: response 0x%08x param 0x%08x [after %d.%03d ms]\n",
+ p_mb_params->mcp_resp,
+ p_mb_params->mcp_param,
+- (cnt * delay) / 1000, (cnt * delay) % 1000);
++ (cnt * usecs) / 1000, (cnt * usecs) % 1000);
+
+ /* Clear the sequence number from the MFW response */
+ p_mb_params->mcp_resp &= FW_MSG_CODE_MASK;
+@@ -557,7 +565,7 @@ static int qed_mcp_cmd_and_union(struct
+ {
+ size_t union_data_size = sizeof(union drv_union_data);
+ u32 max_retries = QED_DRV_MB_MAX_RETRIES;
+- u32 delay = CHIP_MCP_RESP_ITER_US;
++ u32 usecs = QED_MCP_RESP_ITER_US;
+
+ /* MCP not initialized */
+ if (!qed_mcp_is_init(p_hwfn)) {
+@@ -574,8 +582,13 @@ static int qed_mcp_cmd_and_union(struct
+ return -EINVAL;
+ }
+
++ if (QED_MB_FLAGS_IS_SET(p_mb_params, CAN_SLEEP)) {
++ max_retries = DIV_ROUND_UP(max_retries, 1000);
++ usecs *= 1000;
++ }
++
+ return _qed_mcp_cmd_and_union(p_hwfn, p_ptt, p_mb_params, max_retries,
+- delay);
++ usecs);
+ }
+
+ int qed_mcp_cmd(struct qed_hwfn *p_hwfn,
+@@ -792,6 +805,7 @@ __qed_mcp_load_req(struct qed_hwfn *p_hw
+ mb_params.data_src_size = sizeof(load_req);
+ mb_params.p_data_dst = &load_rsp;
+ mb_params.data_dst_size = sizeof(load_rsp);
++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP;
+
+ DP_VERBOSE(p_hwfn, QED_MSG_SP,
+ "Load Request: param 0x%08x [init_hw %d, drv_type %d, hsi_ver %d, pda 0x%04x]\n",
+@@ -1013,7 +1027,8 @@ int qed_mcp_load_req(struct qed_hwfn *p_
+
+ int qed_mcp_unload_req(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+- u32 wol_param, mcp_resp, mcp_param;
++ struct qed_mcp_mb_params mb_params;
++ u32 wol_param;
+
+ switch (p_hwfn->cdev->wol_config) {
+ case QED_OV_WOL_DISABLED:
+@@ -1031,8 +1046,12 @@ int qed_mcp_unload_req(struct qed_hwfn *
+ wol_param = DRV_MB_PARAM_UNLOAD_WOL_MCP;
+ }
+
+- return qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_UNLOAD_REQ, wol_param,
+- &mcp_resp, &mcp_param);
++ memset(&mb_params, 0, sizeof(mb_params));
++ mb_params.cmd = DRV_MSG_CODE_UNLOAD_REQ;
++ mb_params.param = wol_param;
++ mb_params.flags = QED_MB_FLAG_CAN_SLEEP;
++
++ return qed_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params);
+ }
+
+ int qed_mcp_unload_done(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+@@ -660,14 +660,19 @@ struct qed_mcp_info {
+ };
+
+ struct qed_mcp_mb_params {
+- u32 cmd;
+- u32 param;
+- void *p_data_src;
+- u8 data_src_size;
+- void *p_data_dst;
+- u8 data_dst_size;
+- u32 mcp_resp;
+- u32 mcp_param;
++ u32 cmd;
++ u32 param;
++ void *p_data_src;
++ void *p_data_dst;
++ u8 data_src_size;
++ u8 data_dst_size;
++ u32 mcp_resp;
++ u32 mcp_param;
++ u32 flags;
++#define QED_MB_FLAG_CAN_SLEEP (0x1 << 0)
++#define QED_MB_FLAGS_IS_SET(params, flag) \
++ ({ typeof(params) __params = (params); \
++ (__params && (__params->flags & QED_MB_FLAG_ ## flag)); })
+ };
+
+ struct qed_drv_tlv_hdr {
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+Date: Mon, 20 Aug 2018 00:01:43 +0300
+Subject: qed: Wait for MCP halt and resume commands to take place
+
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+
+[ Upstream commit 76271809f49056f079e202bf6513d17b0d6dd34d ]
+
+Successive iterations of halting and resuming the management chip (MCP)
+might fail, since currently the driver doesn't wait for these operations to
+actually take place.
+This patch prevents the driver from moving forward before the operations
+are reflected in the state register.
+
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 46 ++++++++++++++++++++-----
+ drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 1
+ 2 files changed, 39 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -2107,31 +2107,61 @@ qed_mcp_send_drv_version(struct qed_hwfn
+ return rc;
+ }
+
++/* A maximal 100 msec waiting time for the MCP to halt */
++#define QED_MCP_HALT_SLEEP_MS 10
++#define QED_MCP_HALT_MAX_RETRIES 10
++
+ int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+- u32 resp = 0, param = 0;
++ u32 resp = 0, param = 0, cpu_state, cnt = 0;
+ int rc;
+
+ rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp,
+ ¶m);
+- if (rc)
++ if (rc) {
+ DP_ERR(p_hwfn, "MCP response failure, aborting\n");
++ return rc;
++ }
+
+- return rc;
++ do {
++ msleep(QED_MCP_HALT_SLEEP_MS);
++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
++ if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED)
++ break;
++ } while (++cnt < QED_MCP_HALT_MAX_RETRIES);
++
++ if (cnt == QED_MCP_HALT_MAX_RETRIES) {
++ DP_NOTICE(p_hwfn,
++ "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
++ qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state);
++ return -EBUSY;
++ }
++
++ return 0;
+ }
+
++#define QED_MCP_RESUME_SLEEP_MS 10
++
+ int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+- u32 value, cpu_mode;
++ u32 cpu_mode, cpu_state;
+
+ qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff);
+
+- value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+- value &= ~MCP_REG_CPU_MODE_SOFT_HALT;
+- qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value);
+ cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
++ cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT;
++ qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode);
++ msleep(QED_MCP_RESUME_SLEEP_MS);
++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
++
++ if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) {
++ DP_NOTICE(p_hwfn,
++ "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
++ cpu_mode, cpu_state);
++ return -EBUSY;
++ }
+
+- return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0;
++ return 0;
+ }
+
+ int qed_mcp_ov_update_current_config(struct qed_hwfn *p_hwfn,
+--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+@@ -562,6 +562,7 @@
+ 0
+ #define MCP_REG_CPU_STATE \
+ 0xe05004UL
++#define MCP_REG_CPU_STATE_SOFT_HALTED (0x1UL << 10)
+ #define MCP_REG_CPU_EVENT_MASK \
+ 0xe05008UL
+ #define PGLUE_B_REG_PF_BAR0_SIZE \
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+Date: Mon, 20 Aug 2018 00:01:42 +0300
+Subject: qed: Wait for ready indication before rereading the shmem
+
+From: Tomer Tayar <Tomer.Tayar@cavium.com>
+
+[ Upstream commit f00d25f3154b676fcea4502a25b94bd7f142ca74 ]
+
+The MFW might be reset and re-update its shared memory.
+Upon the detection of such a reset the driver rereads this memory, but it
+has to wait till the data is valid.
+This patch adds the missing wait for a data ready indication.
+
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 50 ++++++++++++++++++++++++------
+ 1 file changed, 41 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -183,18 +183,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn
+ return 0;
+ }
+
++/* Maximum of 1 sec to wait for the SHMEM ready indication */
++#define QED_MCP_SHMEM_RDY_MAX_RETRIES 20
++#define QED_MCP_SHMEM_RDY_ITER_MS 50
++
+ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+ struct qed_mcp_info *p_info = p_hwfn->mcp_info;
++ u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES;
++ u8 msec = QED_MCP_SHMEM_RDY_ITER_MS;
+ u32 drv_mb_offsize, mfw_mb_offsize;
+ u32 mcp_pf_id = MCP_PF_ID(p_hwfn);
+
+ p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR);
+- if (!p_info->public_base)
+- return 0;
++ if (!p_info->public_base) {
++ DP_NOTICE(p_hwfn,
++ "The address of the MCP scratch-pad is not configured\n");
++ return -EINVAL;
++ }
+
+ p_info->public_base |= GRCBASE_MCP;
+
++ /* Get the MFW MB address and number of supported messages */
++ mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
++ SECTION_OFFSIZE_ADDR(p_info->public_base,
++ PUBLIC_MFW_MB));
++ p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
++ p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt,
++ p_info->mfw_mb_addr +
++ offsetof(struct public_mfw_mb,
++ sup_msgs));
++
++ /* The driver can notify that there was an MCP reset, and might read the
++ * SHMEM values before the MFW has completed initializing them.
++ * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a
++ * data ready indication.
++ */
++ while (!p_info->mfw_mb_length && --cnt) {
++ msleep(msec);
++ p_info->mfw_mb_length =
++ (u16)qed_rd(p_hwfn, p_ptt,
++ p_info->mfw_mb_addr +
++ offsetof(struct public_mfw_mb, sup_msgs));
++ }
++
++ if (!cnt) {
++ DP_NOTICE(p_hwfn,
++ "Failed to get the SHMEM ready notification after %d msec\n",
++ QED_MCP_SHMEM_RDY_MAX_RETRIES * msec);
++ return -EBUSY;
++ }
++
+ /* Calculate the driver and MFW mailbox address */
+ drv_mb_offsize = qed_rd(p_hwfn, p_ptt,
+ SECTION_OFFSIZE_ADDR(p_info->public_base,
+@@ -204,13 +243,6 @@ static int qed_load_mcp_offsets(struct q
+ "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n",
+ drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id);
+
+- /* Set the MFW MB address */
+- mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
+- SECTION_OFFSIZE_ADDR(p_info->public_base,
+- PUBLIC_MFW_MB));
+- p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
+- p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr);
+-
+ /* Get the current driver mailbox sequence before sending
+ * the first command
+ */
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Leonard Crestez <leonard.crestez@nxp.com>
+Date: Tue, 24 Jul 2018 19:14:19 +0300
+Subject: Revert "ARM: dts: imx7d: Invert legacy PCI irq mapping"
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 538d6e9d597584e80514698e24321645debde78f ]
+
+This reverts commit 1c86c9dd82f859b474474a7fee0d5195da2c9c1d.
+
+That commit followed the reference manual but unfortunately the imx7d
+manual is incorrect.
+
+Tested with ath9k pcie card and confirmed internally.
+
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Acked-by: Lucas Stach <l.stach@pengutronix.de>
+Fixes: 1c86c9dd82f8 ("ARM: dts: imx7d: Invert legacy PCI irq mapping")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/imx7d.dtsi | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/imx7d.dtsi
++++ b/arch/arm/boot/dts/imx7d.dtsi
+@@ -125,10 +125,14 @@
+ interrupt-names = "msi";
+ #interrupt-cells = <1>;
+ interrupt-map-mask = <0 0 0 0x7>;
+- interrupt-map = <0 0 0 1 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+- <0 0 0 2 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
+- <0 0 0 3 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
+- <0 0 0 4 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>;
++ /*
++ * Reference manual lists pci irqs incorrectly
++ * Real hardware ordering is same as imx6: D+MSI, C, B, A
++ */
++ interrupt-map = <0 0 0 1 &intc GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
++ <0 0 0 2 &intc GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
++ <0 0 0 3 &intc GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
++ <0 0 0 4 &intc GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clks IMX7D_PCIE_CTRL_ROOT_CLK>,
+ <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>,
+ <&clks IMX7D_PCIE_PHY_ROOT_CLK>;
ib-hfi1-fix-destroy_qp-hang-after-a-link-down.patch
acpi-hotplug-pci-don-t-scan-for-non-hotplug-bridges-if-slot-is-not-bridge.patch
rdma-uverbs-atomically-flush-and-mark-closed-the-comp-event-queue.patch
+arm64-kvm-tighten-guest-core-register-access-from-userspace.patch
+arm-omap2-fix-null-hwmod-for-ti-sysc-debug.patch
+arm-omap2-fix-module-address-for-modules-using-mpu_rt_idx.patch
+bus-ti-sysc-fix-module-register-ioremap-for-larger-offsets.patch
+qed-wait-for-ready-indication-before-rereading-the-shmem.patch
+qed-wait-for-mcp-halt-and-resume-commands-to-take-place.patch
+qed-prevent-a-possible-deadlock-during-driver-load-and-unload.patch
+qed-avoid-sending-mailbox-commands-when-mfw-is-not-responsive.patch
+thermal-of-thermal-disable-passive-polling-when-thermal-zone-is-disabled.patch
+isofs-reject-hardware-sector-size-2048-bytes.patch
+mmc-atmel-mci-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch
+mmc-android-goldfish-fix-bad-logic-of-sg_copy_-from-to-_buffer-conversion.patch
+bus-ti-sysc-fix-no_console_suspend-handling.patch
+arm-dts-omap4-droid4-fix-vibrations-on-droid-4.patch
+bpf-sockmap-fix-sock_hash_alloc-and-reject-zero-sized-keys.patch
+bpf-sockmap-fix-sock-hash-count-in-alloc_sock_hash_elem.patch
+tls-possible-hang-when-do_tcp_sendpages-hits-sndbuf-is-full-case.patch
+bpf-sockmap-write_space-events-need-to-be-passed-to-tcp-handler.patch
+drm-amdgpu-fix-vm-clearing-for-the-root-pd.patch
+drm-amdgpu-fix-preamble-handling.patch
+amdgpu-fix-multi-process-hang-issue.patch
+net-ncsi-fixup-.dumpit-message-flags-and-id-check-in-netlink-handler.patch
+tcp_bbr-add-bbr_check_probe_rtt_done-helper.patch
+tcp_bbr-in-restart-from-idle-see-if-we-should-exit-probe_rtt.patch
+net-hns-fix-length-and-page_offset-overflow-when-config_arm64_64k_pages.patch
+net-hns-fix-skb-truesize-underestimation.patch
+net-hns3-fix-page_offset-overflow-when-config_arm64_64k_pages.patch
+ice-fix-multiple-static-analyser-warnings.patch
+ice-report-stats-for-allocated-queues-via-ethtool-stats.patch
+ice-clean-control-queues-only-when-they-are-initialized.patch
+ice-fix-bugs-in-control-queue-processing.patch
+ice-use-order_base_2-to-calculate-higher-power-of-2.patch
+ice-set-vlan-flags-correctly.patch
+tools-bpftool-return-from-do_event_pipe-on-bad-arguments.patch
+ice-fix-a-few-null-pointer-dereference-issues.patch
+ice-fix-potential-return-of-uninitialized-value.patch
+e1000-check-on-netif_running-before-calling-e1000_up.patch
+e1000-ensure-to-free-old-tx-rx-rings-in-set_ringparam.patch
+ixgbe-fix-driver-behaviour-after-issuing-vflr.patch
+i40e-fix-for-tx-timeouts-when-interface-is-brought-up-if-dcb-is-enabled.patch
+i40e-fix-condition-of-warn_once-for-stat-strings.patch
+crypto-chtls-fix-null-dereference-chtls_free_uld.patch
+crypto-cavium-nitrox-fix-for-command-corruption-in-queue-full-case-with-backlog-submissions.patch
+hwmon-ina2xx-fix-sysfs-shunt-resistor-read-access.patch
+hwmon-adt7475-make-adt7475_read_word-return-errors.patch
+revert-arm-dts-imx7d-invert-legacy-pci-irq-mapping.patch
+drm-amdgpu-enable-disable-gfx-pg-feature-in-rlc-safe-mode.patch
+drm-amdgpu-update-power-state-at-the-end-of-smu-hw_init.patch
+ata-ftide010-add-a-quirk-for-sq201.patch
+nvme-fcloop-fix-dropped-ls-s-to-removed-target-port.patch
+arm-dts-omap4-droid4-fix-emmc-errors-seen-on-some-devices.patch
+drm-amdgpu-need-to-set-moved-to-true-when-evict-bo.patch
+arm-arm64-smccc-1.1-make-return-values-unsigned-long.patch
+arm-arm64-smccc-1.1-handle-function-result-as-parameters.patch
+i2c-i801-allow-acpi-aml-access-i-o-ports-not-reserved-for-smbus.patch
+clk-x86-set-default-parent-to-48mhz.patch
+x86-pti-fix-section-mismatch-warning-error.patch
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Kevin Yang <yyd@google.com>
+Date: Wed, 22 Aug 2018 17:43:14 -0400
+Subject: tcp_bbr: add bbr_check_probe_rtt_done() helper
+
+From: Kevin Yang <yyd@google.com>
+
+[ Upstream commit fb99886224294b2291d267da41395022fa4200e2 ]
+
+This patch add a helper function bbr_check_probe_rtt_done() to
+ 1. check the condition to see if bbr should exit probe_rtt mode;
+ 2. process the logic of exiting probe_rtt mode.
+
+Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control")
+Signed-off-by: Kevin Yang <yyd@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Reviewed-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_bbr.c | 34 ++++++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 16 deletions(-)
+
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -95,11 +95,10 @@ struct bbr {
+ u32 mode:3, /* current bbr_mode in state machine */
+ prev_ca_state:3, /* CA state on previous ACK */
+ packet_conservation:1, /* use packet conservation? */
+- restore_cwnd:1, /* decided to revert cwnd to old value */
+ round_start:1, /* start of packet-timed tx->ack round? */
+ idle_restart:1, /* restarting after idle? */
+ probe_rtt_round_done:1, /* a BBR_PROBE_RTT round at 4 pkts? */
+- unused:12,
++ unused:13,
+ lt_is_sampling:1, /* taking long-term ("LT") samples now? */
+ lt_rtt_cnt:7, /* round trips in long-term interval */
+ lt_use_bw:1; /* use lt_bw as our bw estimate? */
+@@ -392,17 +391,11 @@ static bool bbr_set_cwnd_to_recover_or_r
+ cwnd = tcp_packets_in_flight(tp) + acked;
+ } else if (prev_state >= TCP_CA_Recovery && state < TCP_CA_Recovery) {
+ /* Exiting loss recovery; restore cwnd saved before recovery. */
+- bbr->restore_cwnd = 1;
++ cwnd = max(cwnd, bbr->prior_cwnd);
+ bbr->packet_conservation = 0;
+ }
+ bbr->prev_ca_state = state;
+
+- if (bbr->restore_cwnd) {
+- /* Restore cwnd after exiting loss recovery or PROBE_RTT. */
+- cwnd = max(cwnd, bbr->prior_cwnd);
+- bbr->restore_cwnd = 0;
+- }
+-
+ if (bbr->packet_conservation) {
+ *new_cwnd = max(cwnd, tcp_packets_in_flight(tp) + acked);
+ return true; /* yes, using packet conservation */
+@@ -744,6 +737,20 @@ static void bbr_check_drain(struct sock
+ bbr_reset_probe_bw_mode(sk); /* we estimate queue is drained */
+ }
+
++static void bbr_check_probe_rtt_done(struct sock *sk)
++{
++ struct tcp_sock *tp = tcp_sk(sk);
++ struct bbr *bbr = inet_csk_ca(sk);
++
++ if (!(bbr->probe_rtt_done_stamp &&
++ after(tcp_jiffies32, bbr->probe_rtt_done_stamp)))
++ return;
++
++ bbr->min_rtt_stamp = tcp_jiffies32; /* wait a while until PROBE_RTT */
++ tp->snd_cwnd = max(tp->snd_cwnd, bbr->prior_cwnd);
++ bbr_reset_mode(sk);
++}
++
+ /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and
+ * periodically drain the bottleneck queue, to converge to measure the true
+ * min_rtt (unloaded propagation delay). This allows the flows to keep queues
+@@ -802,12 +809,8 @@ static void bbr_update_min_rtt(struct so
+ } else if (bbr->probe_rtt_done_stamp) {
+ if (bbr->round_start)
+ bbr->probe_rtt_round_done = 1;
+- if (bbr->probe_rtt_round_done &&
+- after(tcp_jiffies32, bbr->probe_rtt_done_stamp)) {
+- bbr->min_rtt_stamp = tcp_jiffies32;
+- bbr->restore_cwnd = 1; /* snap to prior_cwnd */
+- bbr_reset_mode(sk);
+- }
++ if (bbr->probe_rtt_round_done)
++ bbr_check_probe_rtt_done(sk);
+ }
+ }
+ /* Restart after idle ends only once we process a new S/ACK for data */
+@@ -858,7 +861,6 @@ static void bbr_init(struct sock *sk)
+ bbr->has_seen_rtt = 0;
+ bbr_init_pacing_rate_from_rtt(sk);
+
+- bbr->restore_cwnd = 0;
+ bbr->round_start = 0;
+ bbr->idle_restart = 0;
+ bbr->full_bw_reached = 0;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Kevin Yang <yyd@google.com>
+Date: Wed, 22 Aug 2018 17:43:15 -0400
+Subject: tcp_bbr: in restart from idle, see if we should exit PROBE_RTT
+
+From: Kevin Yang <yyd@google.com>
+
+[ Upstream commit 5490b32dce6932ea7ee8e3b2f76db2957c92af6e ]
+
+This patch fix the case where BBR does not exit PROBE_RTT mode when
+it restarts from idle. When BBR restarts from idle and if BBR is in
+PROBE_RTT mode, BBR should check if it's time to exit PROBE_RTT. If
+yes, then BBR should exit PROBE_RTT mode and restore the cwnd to its
+full value.
+
+Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control")
+Signed-off-by: Kevin Yang <yyd@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Yuchung Cheng <ycheng@google.com>
+Reviewed-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_bbr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -174,6 +174,8 @@ static const u32 bbr_lt_bw_diff = 4000 /
+ /* If we estimate we're policed, use lt_bw for this many round trips: */
+ static const u32 bbr_lt_bw_max_rtts = 48;
+
++static void bbr_check_probe_rtt_done(struct sock *sk);
++
+ /* Do we estimate that STARTUP filled the pipe? */
+ static bool bbr_full_bw_reached(const struct sock *sk)
+ {
+@@ -304,6 +306,8 @@ static void bbr_cwnd_event(struct sock *
+ */
+ if (bbr->mode == BBR_PROBE_BW)
+ bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT);
++ else if (bbr->mode == BBR_PROBE_RTT)
++ bbr_check_probe_rtt_done(sk);
+ }
+ }
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Tue, 31 Jul 2018 00:56:49 +0800
+Subject: thermal: of-thermal: disable passive polling when thermal zone is disabled
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 152395fd03d4ce1e535a75cdbf58105e50587611 ]
+
+When thermal zone is in passive mode, disabling its mode from
+sysfs is NOT taking effect at all, it is still polling the
+temperature of the disabled thermal zone and handling all thermal
+trips, it makes user confused. The disabling operation should
+disable the thermal zone behavior completely, for both active and
+passive mode, this patch clears the passive_delay when thermal
+zone is disabled and restores it when it is enabled.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/of-thermal.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/thermal/of-thermal.c
++++ b/drivers/thermal/of-thermal.c
+@@ -260,10 +260,13 @@ static int of_thermal_set_mode(struct th
+
+ mutex_lock(&tz->lock);
+
+- if (mode == THERMAL_DEVICE_ENABLED)
++ if (mode == THERMAL_DEVICE_ENABLED) {
+ tz->polling_delay = data->polling_delay;
+- else
++ tz->passive_delay = data->passive_delay;
++ } else {
+ tz->polling_delay = 0;
++ tz->passive_delay = 0;
++ }
+
+ mutex_unlock(&tz->lock);
+
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Wed, 22 Aug 2018 08:37:32 -0700
+Subject: tls: possible hang when do_tcp_sendpages hits sndbuf is full case
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 67db7cd249e71f64346f481b629724376d063e08 ]
+
+Currently, the lower protocols sk_write_space handler is not called if
+TLS is sending a scatterlist via tls_push_sg. However, normally
+tls_push_sg calls do_tcp_sendpage, which may be under memory pressure,
+that in turn may trigger a wait via sk_wait_event. Typically, this
+happens when the in-flight bytes exceed the sdnbuf size. In the normal
+case when enough ACKs are received sk_write_space() will be called and
+the sk_wait_event will be woken up allowing it to send more data
+and/or return to the user.
+
+But, in the TLS case because the sk_write_space() handler does not
+wake up the events the above send will wait until the sndtimeo is
+exceeded. By default this is MAX_SCHEDULE_TIMEOUT so it look like a
+hang to the user (especially this impatient user). To fix this pass
+the sk_write_space event to the lower layers sk_write_space event
+which in the TCP case will wake any pending events.
+
+I observed the above while integrating sockmap and ktls. It
+initially appeared as test_sockmap (modified to use ktls) occasionally
+hanging. To reliably reproduce this reduce the sndbuf size and stress
+the tls layer by sending many 1B sends. This results in every byte
+needing a header and each byte individually being sent to the crypto
+layer.
+
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Dave Watson <davejwatson@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tls/tls_main.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -222,9 +222,14 @@ static void tls_write_space(struct sock
+ {
+ struct tls_context *ctx = tls_get_ctx(sk);
+
+- /* We are already sending pages, ignore notification */
+- if (ctx->in_tcp_sendpages)
++ /* If in_tcp_sendpages call lower protocol write space handler
++ * to ensure we wake up any waiting operations there. For example
++ * if do_tcp_sendpages where to call sk_wait_event.
++ */
++ if (ctx->in_tcp_sendpages) {
++ ctx->sk_write_space(sk);
+ return;
++ }
+
+ if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
+ gfp_t sk_allocation = sk->sk_allocation;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Quentin Monnet <quentin.monnet@netronome.com>
+Date: Thu, 23 Aug 2018 17:46:25 +0100
+Subject: tools: bpftool: return from do_event_pipe() on bad arguments
+
+From: Quentin Monnet <quentin.monnet@netronome.com>
+
+[ Upstream commit 785e76d7a2051a9e28b9134d5388a45b16f5eb72 ]
+
+When command line parsing fails in the while loop in do_event_pipe()
+because the number of arguments is incorrect or because the keyword is
+unknown, an error message is displayed, but bpftool remains stuck in
+the loop. Make sure we exit the loop upon failure.
+
+Fixes: f412eed9dfde ("tools: bpftool: add simple perf event output reader")
+Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/bpf/bpftool/map_perf_ring.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/bpf/bpftool/map_perf_ring.c
++++ b/tools/bpf/bpftool/map_perf_ring.c
+@@ -194,8 +194,10 @@ int do_event_pipe(int argc, char **argv)
+ }
+
+ while (argc) {
+- if (argc < 2)
++ if (argc < 2) {
+ BAD_ARG();
++ goto err_close_map;
++ }
+
+ if (is_prefix(*argv, "cpu")) {
+ char *endptr;
+@@ -221,6 +223,7 @@ int do_event_pipe(int argc, char **argv)
+ NEXT_ARG();
+ } else {
+ BAD_ARG();
++ goto err_close_map;
+ }
+
+ do_all = false;
--- /dev/null
+From foo@baz Tue Oct 2 04:59:29 PDT 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Sat, 1 Sep 2018 21:01:28 -0700
+Subject: x86/pti: Fix section mismatch warning/error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit ff924c5a1ec7548825cc2d07980b03be4224ffac ]
+
+Fix the section mismatch warning in arch/x86/mm/pti.c:
+
+WARNING: vmlinux.o(.text+0x6972a): Section mismatch in reference from the function pti_clone_pgtable() to the function .init.text:pti_user_pagetable_walk_pte()
+The function pti_clone_pgtable() references
+the function __init pti_user_pagetable_walk_pte().
+This is often because pti_clone_pgtable lacks a __init
+annotation or the annotation of pti_user_pagetable_walk_pte is wrong.
+FATAL: modpost: Section mismatches detected.
+
+Fixes: 85900ea51577 ("x86/pti: Map the vsyscall page if needed")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andy Lutomirski <luto@kernel.org>
+Link: https://lkml.kernel.org/r/43a6d6a3-d69d-5eda-da09-0b1c88215a2a@infradead.org
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/pti.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/pti.c
++++ b/arch/x86/mm/pti.c
+@@ -239,7 +239,7 @@ static pmd_t *pti_user_pagetable_walk_pm
+ *
+ * Returns a pointer to a PTE on success, or NULL on failure.
+ */
+-static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
++static pte_t *pti_user_pagetable_walk_pte(unsigned long address)
+ {
+ gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
+ pmd_t *pmd;
projects / thirdparty / kernel / stable-queue.git / commitdiff
