--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Sat, 7 Oct 2017 22:36:56 +0000
+Subject: ASoC: Intel: boards: remove .pm_ops in all Atom/DPCM machine drivers
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+
+[ Upstream commit 3639ac1cd5177685a5c8abb7230096b680e1d497 ]
+
+This patch corrects an omission in bytcr_rt5640 and bytcr_rt5651.
+All existing machine drivers shall not use .pm_ops to avoid a double
+suspend, as initially implemented by 3f2dcbeaeb2b
+("ASoC: Intel: Remove soc pm handling to allow platform driver handle it").
+
+Reported-by: Shrirang Bagul <shrirang.bagul@canonical.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 1 -
+ sound/soc/intel/boards/bytcr_rt5651.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -807,7 +807,6 @@ static int snd_byt_rt5640_mc_probe(struc
+ static struct platform_driver snd_byt_rt5640_mc_driver = {
+ .driver = {
+ .name = "bytcr_rt5640",
+- .pm = &snd_soc_pm_ops,
+ },
+ .probe = snd_byt_rt5640_mc_probe,
+ };
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -317,7 +317,6 @@ static int snd_byt_rt5651_mc_probe(struc
+ static struct platform_driver snd_byt_rt5651_mc_driver = {
+ .driver = {
+ .name = "bytcr_rt5651",
+- .pm = &snd_soc_pm_ops,
+ },
+ .probe = snd_byt_rt5651_mc_probe,
+ };
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>
+Date: Sat, 7 Oct 2017 22:36:52 +0000
+Subject: ath10k: fix reading sram contents for QCA4019
+
+From: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>
+
+
+[ Upstream commit 7f622593cc5add77a99cd39404e8a851be9de792 ]
+
+With QCA4019 platform, SRAM address can be accessed directly from host but
+currently, we are assuming sram addresses cannot be accessed directly and
+hence we convert the addresses.
+
+While there, clean up growing hw checks during conversion of target CPU
+address to CE address. Now we have function pointer pertaining to different
+chips.
+
+Signed-off-by: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/ahb.c | 23 +++++++++++++++
+ drivers/net/wireless/ath/ath10k/pci.c | 51 +++++++++++++++++++++-------------
+ drivers/net/wireless/ath/ath10k/pci.h | 5 +++
+ 3 files changed, 60 insertions(+), 19 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/ahb.c
++++ b/drivers/net/wireless/ath/ath10k/ahb.c
+@@ -33,6 +33,9 @@ static const struct of_device_id ath10k_
+
+ MODULE_DEVICE_TABLE(of, ath10k_ahb_of_match);
+
++#define QCA4019_SRAM_ADDR 0x000C0000
++#define QCA4019_SRAM_LEN 0x00040000 /* 256 kb */
++
+ static inline struct ath10k_ahb *ath10k_ahb_priv(struct ath10k *ar)
+ {
+ return &((struct ath10k_pci *)ar->drv_priv)->ahb[0];
+@@ -699,6 +702,25 @@ out:
+ return ret;
+ }
+
++static u32 ath10k_ahb_qca4019_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
++{
++ u32 val = 0, region = addr & 0xfffff;
++
++ val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS);
++
++ if (region >= QCA4019_SRAM_ADDR && region <=
++ (QCA4019_SRAM_ADDR + QCA4019_SRAM_LEN)) {
++ /* SRAM contents for QCA4019 can be directly accessed and
++ * no conversions are required
++ */
++ val |= region;
++ } else {
++ val |= 0x100000 | region;
++ }
++
++ return val;
++}
++
+ static const struct ath10k_hif_ops ath10k_ahb_hif_ops = {
+ .tx_sg = ath10k_pci_hif_tx_sg,
+ .diag_read = ath10k_pci_hif_diag_read,
+@@ -766,6 +788,7 @@ static int ath10k_ahb_probe(struct platf
+ ar_pci->mem_len = ar_ahb->mem_len;
+ ar_pci->ar = ar;
+ ar_pci->bus_ops = &ath10k_ahb_bus_ops;
++ ar_pci->targ_cpu_to_ce_addr = ath10k_ahb_qca4019_targ_cpu_to_ce_addr;
+
+ ret = ath10k_pci_setup_resource(ar);
+ if (ret) {
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -840,31 +840,35 @@ void ath10k_pci_rx_replenish_retry(unsig
+ ath10k_pci_rx_post(ar);
+ }
+
+-static u32 ath10k_pci_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
++static u32 ath10k_pci_qca988x_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
+ {
+- u32 val = 0;
++ u32 val = 0, region = addr & 0xfffff;
+
+- switch (ar->hw_rev) {
+- case ATH10K_HW_QCA988X:
+- case ATH10K_HW_QCA9887:
+- case ATH10K_HW_QCA6174:
+- case ATH10K_HW_QCA9377:
+- val = (ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
+- CORE_CTRL_ADDRESS) &
+- 0x7ff) << 21;
+- break;
+- case ATH10K_HW_QCA9888:
+- case ATH10K_HW_QCA99X0:
+- case ATH10K_HW_QCA9984:
+- case ATH10K_HW_QCA4019:
+- val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS);
+- break;
+- }
++ val = (ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS)
++ & 0x7ff) << 21;
++ val |= 0x100000 | region;
++ return val;
++}
++
++static u32 ath10k_pci_qca99x0_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
++{
++ u32 val = 0, region = addr & 0xfffff;
+
+- val |= 0x100000 | (addr & 0xfffff);
++ val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS);
++ val |= 0x100000 | region;
+ return val;
+ }
+
++static u32 ath10k_pci_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr)
++{
++ struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
++
++ if (WARN_ON_ONCE(!ar_pci->targ_cpu_to_ce_addr))
++ return -ENOTSUPP;
++
++ return ar_pci->targ_cpu_to_ce_addr(ar, addr);
++}
++
+ /*
+ * Diagnostic read/write access is provided for startup/config/debug usage.
+ * Caller must guarantee proper alignment, when applicable, and single user
+@@ -3171,6 +3175,7 @@ static int ath10k_pci_probe(struct pci_d
+ bool pci_ps;
+ int (*pci_soft_reset)(struct ath10k *ar);
+ int (*pci_hard_reset)(struct ath10k *ar);
++ u32 (*targ_cpu_to_ce_addr)(struct ath10k *ar, u32 addr);
+
+ switch (pci_dev->device) {
+ case QCA988X_2_0_DEVICE_ID:
+@@ -3178,12 +3183,14 @@ static int ath10k_pci_probe(struct pci_d
+ pci_ps = false;
+ pci_soft_reset = ath10k_pci_warm_reset;
+ pci_hard_reset = ath10k_pci_qca988x_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr;
+ break;
+ case QCA9887_1_0_DEVICE_ID:
+ hw_rev = ATH10K_HW_QCA9887;
+ pci_ps = false;
+ pci_soft_reset = ath10k_pci_warm_reset;
+ pci_hard_reset = ath10k_pci_qca988x_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr;
+ break;
+ case QCA6164_2_1_DEVICE_ID:
+ case QCA6174_2_1_DEVICE_ID:
+@@ -3191,30 +3198,35 @@ static int ath10k_pci_probe(struct pci_d
+ pci_ps = true;
+ pci_soft_reset = ath10k_pci_warm_reset;
+ pci_hard_reset = ath10k_pci_qca6174_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr;
+ break;
+ case QCA99X0_2_0_DEVICE_ID:
+ hw_rev = ATH10K_HW_QCA99X0;
+ pci_ps = false;
+ pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset;
+ pci_hard_reset = ath10k_pci_qca99x0_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr;
+ break;
+ case QCA9984_1_0_DEVICE_ID:
+ hw_rev = ATH10K_HW_QCA9984;
+ pci_ps = false;
+ pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset;
+ pci_hard_reset = ath10k_pci_qca99x0_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr;
+ break;
+ case QCA9888_2_0_DEVICE_ID:
+ hw_rev = ATH10K_HW_QCA9888;
+ pci_ps = false;
+ pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset;
+ pci_hard_reset = ath10k_pci_qca99x0_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr;
+ break;
+ case QCA9377_1_0_DEVICE_ID:
+ hw_rev = ATH10K_HW_QCA9377;
+ pci_ps = true;
+ pci_soft_reset = NULL;
+ pci_hard_reset = ath10k_pci_qca6174_chip_reset;
++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr;
+ break;
+ default:
+ WARN_ON(1);
+@@ -3241,6 +3253,7 @@ static int ath10k_pci_probe(struct pci_d
+ ar_pci->bus_ops = &ath10k_pci_bus_ops;
+ ar_pci->pci_soft_reset = pci_soft_reset;
+ ar_pci->pci_hard_reset = pci_hard_reset;
++ ar_pci->targ_cpu_to_ce_addr = targ_cpu_to_ce_addr;
+
+ ar->id.vendor = pdev->vendor;
+ ar->id.device = pdev->device;
+--- a/drivers/net/wireless/ath/ath10k/pci.h
++++ b/drivers/net/wireless/ath/ath10k/pci.h
+@@ -238,6 +238,11 @@ struct ath10k_pci {
+ /* Chip specific pci full reset function */
+ int (*pci_hard_reset)(struct ath10k *ar);
+
++ /* chip specific methods for converting target CPU virtual address
++ * space to CE address space
++ */
++ u32 (*targ_cpu_to_ce_addr)(struct ath10k *ar, u32 addr);
++
+ /* Keep this entry in the last, memory for struct ath10k_ahb is
+ * allocated (ahb support enabled case) in the continuation of
+ * this struct.
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Deepak Khungar <deepak.khungar@broadcom.com>
+Date: Sat, 7 Oct 2017 22:36:48 +0000
+Subject: bnxt_en: Added PCI IDs for BCM57452 and BCM57454 ASICs
+
+From: Deepak Khungar <deepak.khungar@broadcom.com>
+
+
+[ Upstream commit 32b40798c1b40343641f04cdfd09652af70ea0e9 ]
+
+Signed-off-by: Deepak Khungar <deepak.khungar@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -97,6 +97,8 @@ enum board_idx {
+ BCM57407_NPAR,
+ BCM57414_NPAR,
+ BCM57416_NPAR,
++ BCM57452,
++ BCM57454,
+ NETXTREME_E_VF,
+ NETXTREME_C_VF,
+ };
+@@ -131,6 +133,8 @@ static const struct {
+ { "Broadcom BCM57407 NetXtreme-E Ethernet Partition" },
+ { "Broadcom BCM57414 NetXtreme-E Ethernet Partition" },
+ { "Broadcom BCM57416 NetXtreme-E Ethernet Partition" },
++ { "Broadcom BCM57452 NetXtreme-E 10Gb/25Gb/40Gb/50Gb Ethernet" },
++ { "Broadcom BCM57454 NetXtreme-E 10Gb/25Gb/40Gb/50Gb/100Gb Ethernet" },
+ { "Broadcom NetXtreme-E Ethernet Virtual Function" },
+ { "Broadcom NetXtreme-C Ethernet Virtual Function" },
+ };
+@@ -166,6 +170,8 @@ static const struct pci_device_id bnxt_p
+ { PCI_VDEVICE(BROADCOM, 0x16ed), .driver_data = BCM57414_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0x16ee), .driver_data = BCM57416_NPAR },
+ { PCI_VDEVICE(BROADCOM, 0x16ef), .driver_data = BCM57416_NPAR },
++ { PCI_VDEVICE(BROADCOM, 0x16f1), .driver_data = BCM57452 },
++ { PCI_VDEVICE(BROADCOM, 0x1614), .driver_data = BCM57454 },
+ #ifdef CONFIG_BNXT_SRIOV
+ { PCI_VDEVICE(BROADCOM, 0x16c1), .driver_data = NETXTREME_E_VF },
+ { PCI_VDEVICE(BROADCOM, 0x16cb), .driver_data = NETXTREME_C_VF },
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Rafał Miłecki <rafal@milecki.pl>
+Date: Sat, 7 Oct 2017 22:36:55 +0000
+Subject: brcmfmac: check brcmf_bus_get_memdump result for error
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+
+[ Upstream commit f4737a62033d7f3e0db740c449fc62119da7ab8a ]
+
+This method may be unsupported (see: USB bus) or may just fail (see:
+SDIO bus).
+While at it rework logic in brcmf_sdio_bus_get_memdump function to avoid
+too many conditional code nesting levels.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 23 ++++++++++-----
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c
+@@ -32,16 +32,25 @@ static int brcmf_debug_create_memdump(st
+ {
+ void *dump;
+ size_t ramsize;
++ int err;
+
+ ramsize = brcmf_bus_get_ramsize(bus);
+- if (ramsize) {
+- dump = vzalloc(len + ramsize);
+- if (!dump)
+- return -ENOMEM;
+- memcpy(dump, data, len);
+- brcmf_bus_get_memdump(bus, dump + len, ramsize);
+- dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL);
++ if (!ramsize)
++ return -ENOTSUPP;
++
++ dump = vzalloc(len + ramsize);
++ if (!dump)
++ return -ENOMEM;
++
++ memcpy(dump, data, len);
++ err = brcmf_bus_get_memdump(bus, dump + len, ramsize);
++ if (err) {
++ vfree(dump);
++ return err;
+ }
++
++ dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL);
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Sat, 7 Oct 2017 22:36:57 +0000
+Subject: bt8xx: fix memory leak
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+
+[ Upstream commit 6792eb0cf9310ec240b7e7c9bfa86dff4c758c68 ]
+
+If dvb_attach() fails then we were just printing an error message and
+exiting but the memory allocated to state was not released.
+
+Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/pci/bt8xx/dvb-bt8xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/pci/bt8xx/dvb-bt8xx.c
++++ b/drivers/media/pci/bt8xx/dvb-bt8xx.c
+@@ -680,6 +680,7 @@ static void frontend_init(struct dvb_bt8
+ /* DST is not a frontend, attaching the ASIC */
+ if (dvb_attach(dst_attach, state, &card->dvb_adapter) == NULL) {
+ pr_err("%s: Could not find a Twinhan DST\n", __func__);
++ kfree(state);
+ break;
+ }
+ /* Attach other DST peripherals if any */
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Sat, 7 Oct 2017 22:36:52 +0000
+Subject: clk: sunxi-ng: Check kzalloc() for errors and cleanup error path
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+
+[ Upstream commit 5d806f9fc8e63d7a44e0fd1ef26a7c27efae0e51 ]
+
+This kzalloc() could fail. Let's bail out with -ENOMEM here
+instead of NULL dereferencing. That silences static checkers. We
+should also cleanup on the error path even though this function
+returning an error probably means the system won't boot.
+
+Cc: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clk/sunxi-ng/ccu_common.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/clk/sunxi-ng/ccu_common.c
++++ b/drivers/clk/sunxi-ng/ccu_common.c
+@@ -70,6 +70,11 @@ int sunxi_ccu_probe(struct device_node *
+ goto err_clk_unreg;
+
+ reset = kzalloc(sizeof(*reset), GFP_KERNEL);
++ if (!reset) {
++ ret = -ENOMEM;
++ goto err_alloc_reset;
++ }
++
+ reset->rcdev.of_node = node;
+ reset->rcdev.ops = &ccu_reset_ops;
+ reset->rcdev.owner = THIS_MODULE;
+@@ -85,6 +90,16 @@ int sunxi_ccu_probe(struct device_node *
+ return 0;
+
+ err_of_clk_unreg:
++ kfree(reset);
++err_alloc_reset:
++ of_clk_del_provider(node);
+ err_clk_unreg:
++ while (--i >= 0) {
++ struct clk_hw *hw = desc->hw_clks->hws[i];
++
++ if (!hw)
++ continue;
++ clk_hw_unregister(hw);
++ }
+ return ret;
+ }
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Ding Tianhong <dingtianhong@huawei.com>
+Date: Sat, 7 Oct 2017 22:36:51 +0000
+Subject: clocksource/drivers/arm_arch_timer: Add dt binding for hisilicon-161010101 erratum
+
+From: Ding Tianhong <dingtianhong@huawei.com>
+
+
+[ Upstream commit 729e55225b1f6225ee7a2a358d5141a3264627c4 ]
+
+This erratum describes a bug in logic outside the core, so MIDR can't be
+used to identify its presence, and reading an SoC-specific revision
+register from common arch timer code would be awkward. So, describe it
+in the device tree.
+
+Signed-off-by: Ding Tianhong <dingtianhong@huawei.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/arm/arch_timer.txt | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/Documentation/devicetree/bindings/arm/arch_timer.txt
++++ b/Documentation/devicetree/bindings/arm/arch_timer.txt
+@@ -31,6 +31,12 @@ to deliver its interrupts via SPIs.
+ This also affects writes to the tval register, due to the implicit
+ counter read.
+
++- hisilicon,erratum-161010101 : A boolean property. Indicates the
++ presence of Hisilicon erratum 161010101, which says that reading the
++ counters is unreliable in some cases, and reads may return a value 32
++ beyond the correct value. This also affects writes to the tval
++ registers, due to the implicit counter read.
++
+ ** Optional properties:
+
+ - arm,cpu-registers-not-fw-configured : Firmware does not initialize
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Sat, 7 Oct 2017 22:36:46 +0000
+Subject: cpufreq: Do not clear real_cpus mask on policy init
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+
+[ Upstream commit f451014692ae34e587b00de6745e16661cf734d8 ]
+
+If new_policy is set in cpufreq_online(), the policy object has just
+been created and its real_cpus mask has been zeroed on allocation,
+and the driver's ->init() callback should not touch it.
+
+It doesn't need to be cleared again, so don't do that.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/cpufreq.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1172,8 +1172,6 @@ static int cpufreq_online(unsigned int c
+ if (new_policy) {
+ /* related_cpus should at least include policy->cpus. */
+ cpumask_copy(policy->related_cpus, policy->cpus);
+- /* Clear mask of registered CPUs */
+- cpumask_clear(policy->real_cpus);
+ }
+
+ /*
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Gary R Hook <gary.hook@amd.com>
+Date: Sat, 7 Oct 2017 22:36:46 +0000
+Subject: crypto: ccp - Set the AES size field for all modes
+
+From: Gary R Hook <gary.hook@amd.com>
+
+
+[ Upstream commit f7cc02b3c3a33a10dd5bb9e5dfd22e47e09503a2 ]
+
+Ensure that the size field is correctly populated for
+all AES modes.
+
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/ccp/ccp-dev-v5.c | 3 +--
+ drivers/crypto/ccp/ccp-dev.h | 1 +
+ drivers/crypto/ccp/ccp-ops.c | 8 ++++++++
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/ccp/ccp-dev-v5.c
++++ b/drivers/crypto/ccp/ccp-dev-v5.c
+@@ -278,8 +278,7 @@ static int ccp5_perform_aes(struct ccp_o
+ CCP_AES_ENCRYPT(&function) = op->u.aes.action;
+ CCP_AES_MODE(&function) = op->u.aes.mode;
+ CCP_AES_TYPE(&function) = op->u.aes.type;
+- if (op->u.aes.mode == CCP_AES_MODE_CFB)
+- CCP_AES_SIZE(&function) = 0x7f;
++ CCP_AES_SIZE(&function) = op->u.aes.size;
+
+ CCP5_CMD_FUNCTION(&desc) = function.raw;
+
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -470,6 +470,7 @@ struct ccp_aes_op {
+ enum ccp_aes_type type;
+ enum ccp_aes_mode mode;
+ enum ccp_aes_action action;
++ unsigned int size;
+ };
+
+ struct ccp_xts_aes_op {
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -692,6 +692,14 @@ static int ccp_run_aes_cmd(struct ccp_cm
+ goto e_ctx;
+ }
+ }
++ switch (aes->mode) {
++ case CCP_AES_MODE_CFB: /* CFB128 only */
++ case CCP_AES_MODE_CTR:
++ op.u.aes.size = AES_BLOCK_SIZE * BITS_PER_BYTE - 1;
++ break;
++ default:
++ op.u.aes.size = 0;
++ }
+
+ /* Prepare the input and output data workareas. For in-place
+ * operations we need to set the dma direction to BIDIRECTIONAL
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Oleh Kravchenko <oleg@kaa.org.ua>
+Date: Sat, 7 Oct 2017 22:36:52 +0000
+Subject: cx231xx: Fix I2C on Internal Master 3 Bus
+
+From: Oleh Kravchenko <oleg@kaa.org.ua>
+
+
+[ Upstream commit 6c5da8031a3abfad259190d35f83d89568b72ee2 ]
+
+Internal Master 3 Bus can send and receive only 4 bytes per time.
+
+Signed-off-by: Oleh Kravchenko <oleg@kaa.org.ua>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/usb/cx231xx/cx231xx-core.c
++++ b/drivers/media/usb/cx231xx/cx231xx-core.c
+@@ -356,7 +356,12 @@ int cx231xx_send_vendor_cmd(struct cx231
+ */
+ if ((ven_req->wLength > 4) && ((ven_req->bRequest == 0x4) ||
+ (ven_req->bRequest == 0x5) ||
+- (ven_req->bRequest == 0x6))) {
++ (ven_req->bRequest == 0x6) ||
++
++ /* Internal Master 3 Bus can send
++ * and receive only 4 bytes per time
++ */
++ (ven_req->bRequest == 0x2))) {
+ unsend_size = 0;
+ pdata = ven_req->pBuff;
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Rex Zhu <Rex.Zhu@amd.com>
+Date: Sat, 7 Oct 2017 22:36:50 +0000
+Subject: drm/amdgpu: when dpm disabled, also need to stop/start vce.
+
+From: Rex Zhu <Rex.Zhu@amd.com>
+
+
+[ Upstream commit 28ed5504ab4b211a4e589e648e5ebd1e0caa7a6a ]
+
+Signed-off-by: Rex Zhu <Rex.Zhu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -315,6 +315,10 @@ static void amdgpu_vce_idle_work_handler
+ amdgpu_dpm_enable_vce(adev, false);
+ } else {
+ amdgpu_asic_set_vce_clocks(adev, 0, 0);
++ amdgpu_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
++ AMD_PG_STATE_GATE);
++ amdgpu_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
++ AMD_CG_STATE_GATE);
+ }
+ } else {
+ schedule_delayed_work(&adev->vce.idle_work, VCE_IDLE_TIMEOUT);
+@@ -340,6 +344,11 @@ void amdgpu_vce_ring_begin_use(struct am
+ amdgpu_dpm_enable_vce(adev, true);
+ } else {
+ amdgpu_asic_set_vce_clocks(adev, 53300, 40000);
++ amdgpu_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
++ AMD_CG_STATE_UNGATE);
++ amdgpu_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE,
++ AMD_PG_STATE_UNGATE);
++
+ }
+ }
+ mutex_unlock(&adev->vce.idle_mutex);
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+Date: Sat, 7 Oct 2017 22:37:34 +0000
+Subject: drm/exynos: g2d: prevent integer overflow in
+
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+
+
+[ Upstream commit e41456bfc811f12b5dcda6f2d6849bdff68f6c0a ]
+
+The size computations done in the ioctl function use an integer.
+If userspace submits a request with req->cmd_nr or req->cmd_buf_nr
+set to INT_MAX, the integer computations overflow later, leading
+to potential (kernel) memory corruption.
+
+Prevent this issue by enforcing a limit on the number of submitted
+commands, so that we have enough headroom later for the size
+computations.
+
+Note that this change has no impact on the currently available
+users in userspace, like e.g. libdrm/exynos.
+
+While at it, also make a comment about the size computation more
+detailed.
+
+Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_g2d.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+@@ -1193,6 +1193,17 @@ int exynos_g2d_set_cmdlist_ioctl(struct
+ if (!node)
+ return -ENOMEM;
+
++ /*
++ * To avoid an integer overflow for the later size computations, we
++ * enforce a maximum number of submitted commands here. This limit is
++ * sufficient for all conceivable usage cases of the G2D.
++ */
++ if (req->cmd_nr > G2D_CMDLIST_DATA_NUM ||
++ req->cmd_buf_nr > G2D_CMDLIST_DATA_NUM) {
++ dev_err(dev, "number of submitted G2D commands exceeds limit\n");
++ return -EINVAL;
++ }
++
+ node->event = NULL;
+
+ if (req->event_type != G2D_EVENT_NOT) {
+@@ -1250,7 +1261,11 @@ int exynos_g2d_set_cmdlist_ioctl(struct
+ cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF;
+ }
+
+- /* Check size of cmdlist: last 2 is about G2D_BITBLT_START */
++ /*
++ * Check the size of cmdlist. The 2 that is added last comes from
++ * the implicit G2D_BITBLT_START that is appended once we have
++ * checked all the submitted commands.
++ */
+ size = cmdlist->last + req->cmd_nr * 2 + req->cmd_buf_nr * 2 + 2;
+ if (size > G2D_CMDLIST_DATA_NUM) {
+ dev_err(dev, "cmdlist size is too big\n");
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Sat, 7 Oct 2017 22:36:51 +0000
+Subject: drm/fsl-dcu: check for clk_prepare_enable() error
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+
+[ Upstream commit ef15d36154cc741d7ded4ae4fa0cf7987354e313 ]
+
+clk_prepare_enable() may fail, so we should better check its return
+value.
+
+Also place the of_node_put() function right after clk_prepare_enable(),
+in order to avoid calling of_node_put() twice in case clk_prepare_enable()
+fails.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/fsl-dcu/fsl_tcon.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/fsl-dcu/fsl_tcon.c
++++ b/drivers/gpu/drm/fsl-dcu/fsl_tcon.c
+@@ -89,9 +89,13 @@ struct fsl_tcon *fsl_tcon_init(struct de
+ goto err_node_put;
+ }
+
+- of_node_put(np);
+- clk_prepare_enable(tcon->ipg_clk);
++ ret = clk_prepare_enable(tcon->ipg_clk);
++ if (ret) {
++ dev_err(dev, "Couldn't enable the TCON clock\n");
++ goto err_node_put;
++ }
+
++ of_node_put(np);
+ dev_info(dev, "Using TCON in bypass mode\n");
+
+ return tcon;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Archit Taneja <architt@codeaurora.org>
+Date: Sat, 7 Oct 2017 22:36:52 +0000
+Subject: drm/msm/dsi: Set msm_dsi->encoders before initializing bridge
+
+From: Archit Taneja <architt@codeaurora.org>
+
+
+[ Upstream commit 0bb70b82c2f91e4667f3c617505235efd6d77e46 ]
+
+The commit "drm: bridge: Link encoder and bridge in core code" updated
+the drm_bridge_attach() API to also include the drm_encoder pointer
+the bridge attaches to.
+
+The func msm_dsi_manager_bridge_init() now relies on the drm_encoder
+pointer stored in msm_dsi->encoders to pass the encoder to the bridge
+API.
+
+msm_dsi->encoders is unfortunately set after this function is called,
+resulting in us passing a NULL pointer to drm_brigde_attach. This
+results in an error and the DSI driver probe fails.
+
+Move the initialization of msm_dsi->encoders[] a bit up. Also, don't
+try to set the encoder's bridge. That's now managed by the bridge
+API.
+
+Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Archit Taneja <architt@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -205,6 +205,9 @@ int msm_dsi_modeset_init(struct msm_dsi
+ goto fail;
+ }
+
++ for (i = 0; i < MSM_DSI_ENCODER_NUM; i++)
++ msm_dsi->encoders[i] = encoders[i];
++
+ msm_dsi->bridge = msm_dsi_manager_bridge_init(msm_dsi->id);
+ if (IS_ERR(msm_dsi->bridge)) {
+ ret = PTR_ERR(msm_dsi->bridge);
+@@ -213,11 +216,6 @@ int msm_dsi_modeset_init(struct msm_dsi
+ goto fail;
+ }
+
+- for (i = 0; i < MSM_DSI_ENCODER_NUM; i++) {
+- encoders[i]->bridge = msm_dsi->bridge;
+- msm_dsi->encoders[i] = encoders[i];
+- }
+-
+ /*
+ * check if the dsi encoder output is connected to a panel or an
+ * external bridge. We create a connector only if we're connected to a
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 7 Oct 2017 22:36:49 +0000
+Subject: ext4: do not use stripe_width if it is not set
+
+From: Jan Kara <jack@suse.cz>
+
+
+[ Upstream commit 5469d7c3087ecaf760f54b447f11af6061b7c897 ]
+
+Avoid using stripe_width for sbi->s_stripe value if it is not actually
+set. It prevents using the stride for sbi->s_stripe.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/super.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2628,9 +2628,9 @@ static unsigned long ext4_get_stripe_siz
+
+ if (sbi->s_stripe && sbi->s_stripe <= sbi->s_blocks_per_group)
+ ret = sbi->s_stripe;
+- else if (stripe_width <= sbi->s_blocks_per_group)
++ else if (stripe_width && stripe_width <= sbi->s_blocks_per_group)
+ ret = stripe_width;
+- else if (stride <= sbi->s_blocks_per_group)
++ else if (stride && stride <= sbi->s_blocks_per_group)
+ ret = stride;
+ else
+ ret = 0;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 7 Oct 2017 22:36:49 +0000
+Subject: ext4: fix stripe-unaligned allocations
+
+From: Jan Kara <jack@suse.cz>
+
+
+[ Upstream commit d9b22cf9f5466a057f2a4f1e642b469fa9d73117 ]
+
+When a filesystem is created using:
+
+ mkfs.ext4 -b 4096 -E stride=512 <dev>
+
+and we try to allocate 64MB extent, we will end up directly in
+ext4_mb_complex_scan_group(). This is because the request is detected
+as power-of-two allocation (so we start in ext4_mb_regular_allocator()
+with ac_criteria == 0) however the check before
+ext4_mb_simple_scan_group() refuses the direct buddy scan because the
+allocation request is too large. Since cr == 0, the check whether we
+should use ext4_mb_scan_aligned() fails as well and we fall back to
+ext4_mb_complex_scan_group().
+
+Fix the problem by checking for upper limit on power-of-two requests
+directly when detecting them.
+
+Reported-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/mballoc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2136,8 +2136,10 @@ ext4_mb_regular_allocator(struct ext4_al
+ * We search using buddy data only if the order of the request
+ * is greater than equal to the sbi_s_mb_order2_reqs
+ * You can tune it via /sys/fs/ext4/<partition>/mb_order2_req
++ * We also support searching for power-of-two requests only for
++ * requests upto maximum buddy size we have constructed.
+ */
+- if (i >= sbi->s_mb_order2_reqs) {
++ if (i >= sbi->s_mb_order2_reqs && i <= sb->s_blocksize_bits + 2) {
+ /*
+ * This should tell if fe_len is exactly power of 2
+ */
+@@ -2207,7 +2209,7 @@ repeat:
+ }
+
+ ac->ac_groups_scanned++;
+- if (cr == 0 && ac->ac_2order < sb->s_blocksize_bits+2)
++ if (cr == 0)
+ ext4_mb_simple_scan_group(ac, &e4b);
+ else if (cr == 1 && sbi->s_stripe &&
+ !(ac->ac_g_ex.fe_len % sbi->s_stripe))
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Sat, 7 Oct 2017 22:36:56 +0000
+Subject: exynos4-is: fimc-is: Unmap region obtained by of_iomap()
+
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+
+
+[ Upstream commit 4742575cde1f3cee0ea6b41af42781672315b04b ]
+
+Free memory mapping, if fimc_is_probe is not successful.
+
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/exynos4-is/fimc-is.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/exynos4-is/fimc-is.c
++++ b/drivers/media/platform/exynos4-is/fimc-is.c
+@@ -825,12 +825,13 @@ static int fimc_is_probe(struct platform
+ is->irq = irq_of_parse_and_map(dev->of_node, 0);
+ if (!is->irq) {
+ dev_err(dev, "no irq found\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_iounmap;
+ }
+
+ ret = fimc_is_get_clocks(is);
+ if (ret < 0)
+- return ret;
++ goto err_iounmap;
+
+ platform_set_drvdata(pdev, is);
+
+@@ -891,6 +892,8 @@ err_irq:
+ free_irq(is->irq, is);
+ err_clk:
+ fimc_is_put_clocks(is);
++err_iounmap:
++ iounmap(is->pmu_regs);
+ return ret;
+ }
+
+@@ -947,6 +950,7 @@ static int fimc_is_remove(struct platfor
+ fimc_is_unregister_subdevs(is);
+ vb2_dma_contig_clear_max_seg_size(dev);
+ fimc_is_put_clocks(is);
++ iounmap(is->pmu_regs);
+ fimc_is_debugfs_remove(is);
+ release_firmware(is->fw.f_w);
+ fimc_is_free_cpu_memory(is);
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Axel Lin <axel.lin@ingics.com>
+Date: Sat, 7 Oct 2017 22:36:53 +0000
+Subject: gpio: mcp23s08: Select REGMAP/REGMAP_I2C to fix build error
+
+From: Axel Lin <axel.lin@ingics.com>
+
+
+[ Upstream commit e8e1a5b5679b1ae1ff03a3883b011b84e7226171 ]
+
+This driver now using devm_regmap_init/devm_regmap_init_i2c, so it needs
+to select REGMAP/REGMAP_I2C accordingly.
+
+Fixes: ("3d84fdb3f0b5 gpio: mcp23s08: use regmap")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-By: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -1187,6 +1187,8 @@ config GPIO_MCP23S08
+ tristate "Microchip MCP23xxx I/O expander"
+ depends on OF_GPIO
+ select GPIOLIB_IRQCHIP
++ select REGMAP_I2C if I2C
++ select REGMAP if SPI_MASTER
+ help
+ SPI/I2C driver for Microchip MCP23S08/MCP23S17/MCP23008/MCP23017
+ I/O expanders.
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Sat, 7 Oct 2017 22:36:50 +0000
+Subject: i2c: riic: correctly finish transfers
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+
+[ Upstream commit 71ccea095ea1d4efd004dab971be6d599e06fc3f ]
+
+This fixes the condition where the controller has not fully completed its
+final transfer and leaves the bus and controller in a undesirable state.
+
+At the end of the last transmitted byte, the existing driver would just
+signal for a STOP condition to be transmitted then immediately signal
+completion. However, the full STOP procedure might not have fully taken
+place by the time the runtime PM shuts off the peripheral clock, leaving
+the bus in a suspended state.
+
+Alternatively, the STOP condition on the bus may have completed, but when
+the next transaction is requested by the upper layer, not all the
+necessary register cleanup was finished from the last transfer which made
+the driver return BUS BUSY when it really wasn't.
+
+This patch now makes all transmit and receive transactions wait for the
+STOP condition to fully complete before signaling a completed transaction.
+With this new method, runtime PM no longer seems to be an issue.
+
+Fixes: 310c18a41450 ("i2c: riic: add driver")
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-riic.c | 30 +++++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-riic.c
++++ b/drivers/i2c/busses/i2c-riic.c
+@@ -80,6 +80,7 @@
+ #define ICIER_TEIE 0x40
+ #define ICIER_RIE 0x20
+ #define ICIER_NAKIE 0x10
++#define ICIER_SPIE 0x08
+
+ #define ICSR2_NACKF 0x10
+
+@@ -216,11 +217,10 @@ static irqreturn_t riic_tend_isr(int irq
+ return IRQ_NONE;
+ }
+
+- if (riic->is_last || riic->err)
++ if (riic->is_last || riic->err) {
++ riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
+ writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
+-
+- writeb(0, riic->base + RIIC_ICIER);
+- complete(&riic->msg_done);
++ }
+
+ return IRQ_HANDLED;
+ }
+@@ -240,13 +240,13 @@ static irqreturn_t riic_rdrf_isr(int irq
+
+ if (riic->bytes_left == 1) {
+ /* STOP must come before we set ACKBT! */
+- if (riic->is_last)
++ if (riic->is_last) {
++ riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
+ writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
++ }
+
+ riic_clear_set_bit(riic, 0, ICMR3_ACKBT, RIIC_ICMR3);
+
+- writeb(0, riic->base + RIIC_ICIER);
+- complete(&riic->msg_done);
+ } else {
+ riic_clear_set_bit(riic, ICMR3_ACKBT, 0, RIIC_ICMR3);
+ }
+@@ -259,6 +259,21 @@ static irqreturn_t riic_rdrf_isr(int irq
+ return IRQ_HANDLED;
+ }
+
++static irqreturn_t riic_stop_isr(int irq, void *data)
++{
++ struct riic_dev *riic = data;
++
++ /* read back registers to confirm writes have fully propagated */
++ writeb(0, riic->base + RIIC_ICSR2);
++ readb(riic->base + RIIC_ICSR2);
++ writeb(0, riic->base + RIIC_ICIER);
++ readb(riic->base + RIIC_ICIER);
++
++ complete(&riic->msg_done);
++
++ return IRQ_HANDLED;
++}
++
+ static u32 riic_func(struct i2c_adapter *adap)
+ {
+ return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+@@ -326,6 +341,7 @@ static struct riic_irq_desc riic_irqs[]
+ { .res_num = 0, .isr = riic_tend_isr, .name = "riic-tend" },
+ { .res_num = 1, .isr = riic_rdrf_isr, .name = "riic-rdrf" },
+ { .res_num = 2, .isr = riic_tdre_isr, .name = "riic-tdre" },
++ { .res_num = 3, .isr = riic_stop_isr, .name = "riic-stop" },
+ { .res_num = 5, .isr = riic_tend_isr, .name = "riic-nack" },
+ };
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Majd Dibbiny <majd@mellanox.com>
+Date: Sat, 7 Oct 2017 22:36:47 +0000
+Subject: IB/mlx5: Assign DSCP for R-RoCE QPs Address Path
+
+From: Majd Dibbiny <majd@mellanox.com>
+
+
+[ Upstream commit ed88451e1f2d400fd6a743d0a481631cf9f97550 ]
+
+For Routable RoCE QPs, the DSCP should be set in the QP's
+address path.
+
+The DSCP's value is derived from the traffic class.
+
+Fixes: 2811ba51b049 ("IB/mlx5: Add RoCE fields to Address Vector")
+Cc: Achiad Shochat <achiad@mellanox.com>
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Reviewed-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 21 +++++++++++++++++++++
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 ++
+ drivers/infiniband/hw/mlx5/qp.c | 7 +++++++
+ 3 files changed, 30 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -325,6 +325,27 @@ __be16 mlx5_get_roce_udp_sport(struct ml
+ return cpu_to_be16(MLX5_CAP_ROCE(dev->mdev, r_roce_min_src_udp_port));
+ }
+
++int mlx5_get_roce_gid_type(struct mlx5_ib_dev *dev, u8 port_num,
++ int index, enum ib_gid_type *gid_type)
++{
++ struct ib_gid_attr attr;
++ union ib_gid gid;
++ int ret;
++
++ ret = ib_get_cached_gid(&dev->ib_dev, port_num, index, &gid, &attr);
++ if (ret)
++ return ret;
++
++ if (!attr.ndev)
++ return -ENODEV;
++
++ dev_put(attr.ndev);
++
++ *gid_type = attr.gid_type;
++
++ return 0;
++}
++
+ static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
+ {
+ if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -892,6 +892,8 @@ int mlx5_ib_set_vf_guid(struct ib_device
+
+ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
+ int index);
++int mlx5_get_roce_gid_type(struct mlx5_ib_dev *dev, u8 port_num,
++ int index, enum ib_gid_type *gid_type);
+
+ /* GSI QP helper functions */
+ struct ib_qp *mlx5_ib_gsi_create_qp(struct ib_pd *pd,
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2226,6 +2226,7 @@ static int mlx5_set_path(struct mlx5_ib_
+ {
+ enum rdma_link_layer ll = rdma_port_get_link_layer(&dev->ib_dev, port);
+ int err;
++ enum ib_gid_type gid_type;
+
+ if (attr_mask & IB_QP_PKEY_INDEX)
+ path->pkey_index = cpu_to_be16(alt ? attr->alt_pkey_index :
+@@ -2244,10 +2245,16 @@ static int mlx5_set_path(struct mlx5_ib_
+ if (ll == IB_LINK_LAYER_ETHERNET) {
+ if (!(ah->ah_flags & IB_AH_GRH))
+ return -EINVAL;
++ err = mlx5_get_roce_gid_type(dev, port, ah->grh.sgid_index,
++ &gid_type);
++ if (err)
++ return err;
+ memcpy(path->rmac, ah->dmac, sizeof(ah->dmac));
+ path->udp_sport = mlx5_get_roce_udp_sport(dev, port,
+ ah->grh.sgid_index);
+ path->dci_cfi_prio_sl = (ah->sl & 0x7) << 4;
++ if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP)
++ path->ecn_dscp = (ah->grh.traffic_class >> 2) & 0x3f;
+ } else {
+ path->fl_free_ar = (path_flags & MLX5_PATH_FLAG_FL) ? 0x80 : 0;
+ path->fl_free_ar |=
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sat, 7 Oct 2017 22:36:51 +0000
+Subject: iwlwifi: mvm: use the PROBE_RESP_QUEUE to send deauth to unknown station
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+
+[ Upstream commit d45cb20e123c5d7d6cd56301bc98f0bfd725cd77 ]
+
+When we send a deauth to a station we don't know about, we
+need to use the PROBE_RESP queue. This can happen when we
+send a deauth to a station that is not associated to us.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -499,15 +499,17 @@ static int iwl_mvm_get_ctrl_vif_queue(st
+ switch (info->control.vif->type) {
+ case NL80211_IFTYPE_AP:
+ /*
+- * handle legacy hostapd as well, where station may be added
+- * only after assoc.
++ * Handle legacy hostapd as well, where station may be added
++ * only after assoc. Take care of the case where we send a
++ * deauth to a station that we don't have.
+ */
+- if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc))
++ if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc) ||
++ ieee80211_is_deauth(fc))
+ return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
+ if (info->hw_queue == info->control.vif->cab_queue)
+ return info->hw_queue;
+
+- WARN_ON_ONCE(1);
++ WARN_ONCE(1, "fc=0x%02x", le16_to_cpu(fc));
+ return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
+ case NL80211_IFTYPE_P2P_DEVICE:
+ if (ieee80211_is_mgmt(fc))
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Sat, 7 Oct 2017 22:36:56 +0000
+Subject: mei: return error on notification request to a disconnected client
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+
+[ Upstream commit 7c47d2ca0feca767479329da23523ed798acb854 ]
+
+Request for a notification from a disconnected client will be ignored
+silently by the FW but the caller should know that the operation hasn't
+succeeded.
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/client.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -1320,6 +1320,9 @@ int mei_cl_notify_request(struct mei_cl
+ return -EOPNOTSUPP;
+ }
+
++ if (!mei_cl_is_connected(cl))
++ return -ENODEV;
++
+ rets = pm_runtime_get(dev->dev);
+ if (rets < 0 && rets != -EINPROGRESS) {
+ pm_runtime_put_noidle(dev->dev);
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sat, 7 Oct 2017 22:36:48 +0000
+Subject: mfd: ab8500-sysctrl: Handle probe deferral
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+
+[ Upstream commit 7e9c40c63933a643908d686bd89dfc2315e8c70a ]
+
+In the current boot, clients making use of the AB8500 sysctrl
+may be probed before the ab8500-sysctrl driver. This gives them
+-EINVAL, but should rather give -EPROBE_DEFER.
+
+Before this, the abx500 clock driver didn't probe properly,
+and as a result the codec driver in turn using the clocks did
+not probe properly. After this patch, everything probes
+properly.
+
+Also add OF compatible-string probing. This driver is all
+device tree, so let's just make a drive-by-fix of that as
+well.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/ab8500-sysctrl.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/mfd/ab8500-sysctrl.c
++++ b/drivers/mfd/ab8500-sysctrl.c
+@@ -98,7 +98,7 @@ int ab8500_sysctrl_read(u16 reg, u8 *val
+ u8 bank;
+
+ if (sysctrl_dev == NULL)
+- return -EINVAL;
++ return -EPROBE_DEFER;
+
+ bank = (reg >> 8);
+ if (!valid_bank(bank))
+@@ -114,11 +114,13 @@ int ab8500_sysctrl_write(u16 reg, u8 mas
+ u8 bank;
+
+ if (sysctrl_dev == NULL)
+- return -EINVAL;
++ return -EPROBE_DEFER;
+
+ bank = (reg >> 8);
+- if (!valid_bank(bank))
++ if (!valid_bank(bank)) {
++ pr_err("invalid bank\n");
+ return -EINVAL;
++ }
+
+ return abx500_mask_and_set_register_interruptible(sysctrl_dev, bank,
+ (u8)(reg & 0xFF), mask, value);
+@@ -145,9 +147,15 @@ static int ab8500_sysctrl_remove(struct
+ return 0;
+ }
+
++static const struct of_device_id ab8500_sysctrl_match[] = {
++ { .compatible = "stericsson,ab8500-sysctrl", },
++ {}
++};
++
+ static struct platform_driver ab8500_sysctrl_driver = {
+ .driver = {
+ .name = "ab8500-sysctrl",
++ .of_match_table = ab8500_sysctrl_match,
+ },
+ .probe = ab8500_sysctrl_probe,
+ .remove = ab8500_sysctrl_remove,
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 7 Oct 2017 22:36:48 +0000
+Subject: mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+
+[ Upstream commit 1af468ebe45591651ec3bafc2e9ddc6fdef70ae0 ]
+
+The R in PEK_DBR stands for rising, so it should be mapped to
+AXP288_IRQ_POKP where the last P stands for positive edge.
+
+Likewise PEK_DBF should be mapped to the falling edge, aka the
+_N_egative edge, so it should be mapped to AXP288_IRQ_POKN.
+
+This fixes the inverted powerbutton status reporting by the
+axp20x-pek driver.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/axp20x.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -205,14 +205,14 @@ static struct resource axp22x_pek_resour
+ static struct resource axp288_power_button_resources[] = {
+ {
+ .name = "PEK_DBR",
+- .start = AXP288_IRQ_POKN,
+- .end = AXP288_IRQ_POKN,
++ .start = AXP288_IRQ_POKP,
++ .end = AXP288_IRQ_POKP,
+ .flags = IORESOURCE_IRQ,
+ },
+ {
+ .name = "PEK_DBF",
+- .start = AXP288_IRQ_POKP,
+- .end = AXP288_IRQ_POKP,
++ .start = AXP288_IRQ_POKN,
++ .end = AXP288_IRQ_POKN,
+ .flags = IORESOURCE_IRQ,
+ },
+ };
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Sat, 7 Oct 2017 22:36:47 +0000
+Subject: mmc: s3cmci: include linux/interrupt.h for tasklet_struct
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit e1c6ec26b853e9062f0b3daaf695c546d0702953 ]
+
+I got this new build error on today's linux-next
+
+drivers/mmc/host/s3cmci.h:69:24: error: field 'pio_tasklet' has incomplete type
+ struct tasklet_struct pio_tasklet;
+drivers/mmc/host/s3cmci.c: In function 's3cmci_enable_irq':
+drivers/mmc/host/s3cmci.c:390:4: error: implicit declaration of function 'enable_irq';did you mean 'enable_imask'? [-Werror=implicit-function-declaration]
+
+While I haven't found out why this happened now and not earlier, the
+solution is obvious, we should include the header that defines
+the structure.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/s3cmci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/host/s3cmci.c
++++ b/drivers/mmc/host/s3cmci.c
+@@ -21,6 +21,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/seq_file.h>
+ #include <linux/gpio.h>
++#include <linux/interrupt.h>
+ #include <linux/irq.h>
+ #include <linux/io.h>
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Sat, 7 Oct 2017 22:36:52 +0000
+Subject: mtd: nand: sunxi: Fix the non-polling case in sunxi_nfc_wait_events()
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+
+[ Upstream commit 19649e2c16fbc94b664f7074ec4fa9f15292fdce ]
+
+wait_for_completion_timeout() returns 0 if a timeout occurred, 1
+otherwise. Fix the sunxi_nfc_wait_events() accordingly.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/sunxi_nand.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/nand/sunxi_nand.c
++++ b/drivers/mtd/nand/sunxi_nand.c
+@@ -320,6 +320,10 @@ static int sunxi_nfc_wait_events(struct
+
+ ret = wait_for_completion_timeout(&nfc->complete,
+ msecs_to_jiffies(timeout_ms));
++ if (!ret)
++ ret = -ETIMEDOUT;
++ else
++ ret = 0;
+
+ writel(0, nfc->regs + NFC_REG_INT);
+ } else {
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Netanel Belgazal <netanel@annapurnalabs.com>
+Date: Sat, 7 Oct 2017 22:36:50 +0000
+Subject: net/ena: change driver's default timeouts
+
+From: Netanel Belgazal <netanel@annapurnalabs.com>
+
+
+[ Upstream commit 7102a18ac3f323805e3cd8f3dc64907644608c1e ]
+
+The timeouts were too agressive and sometimes cause false alarms.
+
+Signed-off-by: Netanel Belgazal <netanel@annapurnalabs.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 4 ++--
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -36,9 +36,9 @@
+ /*****************************************************************************/
+
+ /* Timeout in micro-sec */
+-#define ADMIN_CMD_TIMEOUT_US (1000000)
++#define ADMIN_CMD_TIMEOUT_US (3000000)
+
+-#define ENA_ASYNC_QUEUE_DEPTH 4
++#define ENA_ASYNC_QUEUE_DEPTH 16
+ #define ENA_ADMIN_QUEUE_DEPTH 32
+
+ #define MIN_ENA_VER (((ENA_COMMON_SPEC_VERSION_MAJOR) << \
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -100,7 +100,7 @@
+ /* Number of queues to check for missing queues per timer service */
+ #define ENA_MONITORED_TX_QUEUES 4
+ /* Max timeout packets before device reset */
+-#define MAX_NUM_OF_TIMEOUTED_PACKETS 32
++#define MAX_NUM_OF_TIMEOUTED_PACKETS 128
+
+ #define ENA_TX_RING_IDX_NEXT(idx, ring_size) (((idx) + 1) & ((ring_size) - 1))
+
+@@ -116,9 +116,9 @@
+ #define ENA_IO_IRQ_IDX(q) (ENA_IO_IRQ_FIRST_IDX + (q))
+
+ /* ENA device should send keep alive msg every 1 sec.
+- * We wait for 3 sec just to be on the safe side.
++ * We wait for 6 sec just to be on the safe side.
+ */
+-#define ENA_DEVICE_KALIVE_TIMEOUT (3 * HZ)
++#define ENA_DEVICE_KALIVE_TIMEOUT (6 * HZ)
+
+ #define ENA_MMIO_DISABLE_REG_READ BIT(0)
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sat, 7 Oct 2017 22:36:49 +0000
+Subject: net: mvneta: fix build errors when linux/phy*.h is removed from net/dsa.h
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 9303ab2b3402b60f6c39abfdbfa4ce00fce8bee4 ]
+
+drivers/net/ethernet/marvell/mvneta.c:2694:26: error: storage size of 'status' isn't known
+drivers/net/ethernet/marvell/mvneta.c:2695:26: error: storage size of 'changed' isn't known
+drivers/net/ethernet/marvell/mvneta.c:2695:9: error: variable 'changed' has initializer but incomplete type
+drivers/net/ethernet/marvell/mvneta.c:2709:2: error: implicit declaration of function 'fixed_phy_update_state' [-Werror=implicit-function-declaration]
+
+Add linux/phy_fixed.h to mvneta.c
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -28,6 +28,7 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/phy.h>
++#include <linux/phy_fixed.h>
+ #include <linux/platform_device.h>
+ #include <linux/skbuff.h>
+ #include <net/hwbm.h>
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Lukasz Majewski <lukma@denx.de>
+Date: Sat, 7 Oct 2017 22:36:51 +0000
+Subject: net: phy: dp83867: Recover from "port mirroring" N/A MODE4
+
+From: Lukasz Majewski <lukma@denx.de>
+
+
+[ Upstream commit ac6e058b75be71208e98a5808453aae9a17be480 ]
+
+The DP83867 when not properly bootstrapped - especially with LED_0 pin -
+can enter N/A MODE4 for "port mirroring" feature.
+
+To provide normal operation of the PHY, one needs not only to explicitly
+disable the port mirroring feature, but as well stop some IC internal
+testing (which disables RGMII communication).
+
+To do that the STRAP_STS1 (0x006E) register must be read and RESERVED bit
+11 examined. When it is set, the another RESERVED bit (11) at PHYCR
+(0x0010) register must be clear to disable testing mode and enable RGMII
+communication.
+
+Thorough explanation of the problem can be found at following e2e thread:
+"DP83867IR: Problem with RESERVED bits in PHY Control Register (PHYCR) -
+Linux driver"
+
+https://e2e.ti.com/support/interface/ethernet/f/903/p/571313/2096954#2096954
+
+Signed-off-by: Lukasz Majewski <lukma@denx.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/dp83867.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -33,6 +33,7 @@
+
+ /* Extended Registers */
+ #define DP83867_RGMIICTL 0x0032
++#define DP83867_STRAP_STS1 0x006E
+ #define DP83867_RGMIIDCTL 0x0086
+
+ #define DP83867_SW_RESET BIT(15)
+@@ -56,9 +57,13 @@
+ #define DP83867_RGMII_TX_CLK_DELAY_EN BIT(1)
+ #define DP83867_RGMII_RX_CLK_DELAY_EN BIT(0)
+
++/* STRAP_STS1 bits */
++#define DP83867_STRAP_STS1_RESERVED BIT(11)
++
+ /* PHY CTRL bits */
+ #define DP83867_PHYCR_FIFO_DEPTH_SHIFT 14
+ #define DP83867_PHYCR_FIFO_DEPTH_MASK (3 << 14)
++#define DP83867_PHYCR_RESERVED_MASK BIT(11)
+
+ /* RGMIIDCTL bits */
+ #define DP83867_RGMII_TX_CLK_DELAY_SHIFT 4
+@@ -141,7 +146,7 @@ static int dp83867_of_init(struct phy_de
+ static int dp83867_config_init(struct phy_device *phydev)
+ {
+ struct dp83867_private *dp83867;
+- int ret, val;
++ int ret, val, bs;
+ u16 delay;
+
+ if (!phydev->priv) {
+@@ -164,6 +169,22 @@ static int dp83867_config_init(struct ph
+ return val;
+ val &= ~DP83867_PHYCR_FIFO_DEPTH_MASK;
+ val |= (dp83867->fifo_depth << DP83867_PHYCR_FIFO_DEPTH_SHIFT);
++
++ /* The code below checks if "port mirroring" N/A MODE4 has been
++ * enabled during power on bootstrap.
++ *
++ * Such N/A mode enabled by mistake can put PHY IC in some
++ * internal testing mode and disable RGMII transmission.
++ *
++ * In this particular case one needs to check STRAP_STS1
++ * register's bit 11 (marked as RESERVED).
++ */
++
++ bs = phy_read_mmd_indirect(phydev, DP83867_STRAP_STS1,
++ DP83867_DEVADDR);
++ if (bs & DP83867_STRAP_STS1_RESERVED)
++ val &= ~DP83867_PHYCR_RESERVED_MASK;
++
+ ret = phy_write(phydev, MII_DP83867_PHYCTRL, val);
+ if (ret)
+ return ret;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Sat, 7 Oct 2017 22:37:34 +0000
+Subject: PCI: Avoid possible deadlock on pci_lock and p->pi_lock
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+
+[ Upstream commit cdcb33f9824429a926b971bf041a6cec238f91ff ]
+
+pci_lock is an IRQ-safe spinlock that protects all accesses to PCI
+configuration space (see PCI_OP_READ() and PCI_OP_WRITE() in pci/access.c).
+
+The pci_cfg_access_unlock() path acquires pci_lock, then p->pi_lock (inside
+wake_up_all()). According to lockdep, there is a possible path involving
+snbep_uncore_pci_read_counter() that could acquire them in the reverse
+order: acquiring p->pi_lock, then pci_lock, which could result in a
+deadlock. Lockdep details are in the bugzilla below.
+
+Avoid the possible deadlock by dropping pci_lock before waking up any
+config access waiters.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=192901
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/access.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -672,8 +672,9 @@ void pci_cfg_access_unlock(struct pci_de
+ WARN_ON(!dev->block_cfg_access);
+
+ dev->block_cfg_access = 0;
+- wake_up_all(&pci_cfg_wait);
+ raw_spin_unlock_irqrestore(&pci_lock, flags);
++
++ wake_up_all(&pci_cfg_wait);
+ }
+ EXPORT_SYMBOL_GPL(pci_cfg_access_unlock);
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 7 Oct 2017 22:36:49 +0000
+Subject: PCI/MSI: Return failure when msix_setup_entries() fails
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 3adfb572f2978a980b250a9e1a56f84f3a031001 ]
+
+If alloc_msi_entry() fails, we free resources and set ret = -ENOMEM.
+
+However, msix_setup_entries() returns 0 unconditionally. Return the error
+code instead.
+
+Fixes: e75eafb9b039 ("genirq/msi: Switch to new irq spreading infrastructure")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/msi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -730,7 +730,7 @@ static int msix_setup_entries(struct pci
+ ret = 0;
+ out:
+ kfree(masks);
+- return 0;
++ return ret;
+ }
+
+ static void msix_program_entries(struct pci_dev *dev,
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Taeung Song <treeze.taeung@gmail.com>
+Date: Sat, 7 Oct 2017 22:36:50 +0000
+Subject: perf tools: Only increase index if perf_evsel__new_idx() succeeds
+
+From: Taeung Song <treeze.taeung@gmail.com>
+
+
+[ Upstream commit 75fc5ae5cc53fff71041ecadeb3354a2b4c9fe42 ]
+
+Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Link: http://lkml.kernel.org/r/1485952447-7013-2-git-send-email-treeze.taeung@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/parse-events.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -309,10 +309,11 @@ __add_event(struct list_head *list, int
+
+ event_attr_init(attr);
+
+- evsel = perf_evsel__new_idx(attr, (*idx)++);
++ evsel = perf_evsel__new_idx(attr, *idx);
+ if (!evsel)
+ return NULL;
+
++ (*idx)++;
+ evsel->cpus = cpu_map__get(cpus);
+ evsel->own_cpus = cpu_map__get(cpus);
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Sat, 7 Oct 2017 22:36:54 +0000
+Subject: platform/x86: intel_mid_thermal: Fix module autoload
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+
+[ Upstream commit a93151a72061e944a4915458b1b1d6d505c03bbf ]
+
+If the driver is built as a module, autoload won't work because the module
+alias information is not filled. So user-space can't match the registered
+device with the corresponding module.
+
+Export the module alias information using the MODULE_DEVICE_TABLE() macro.
+
+Before this patch:
+
+$ modinfo drivers/platform/x86/intel_mid_thermal.ko | grep alias
+$
+
+After this patch:
+
+$ modinfo drivers/platform/x86/intel_mid_thermal.ko | grep alias
+alias: platform:msic_thermal
+
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel_mid_thermal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/platform/x86/intel_mid_thermal.c
++++ b/drivers/platform/x86/intel_mid_thermal.c
+@@ -550,6 +550,7 @@ static const struct platform_device_id t
+ { "msic_thermal", 1 },
+ { }
+ };
++MODULE_DEVICE_TABLE(platform, therm_id_table);
+
+ static struct platform_driver mid_thermal_driver = {
+ .driver = {
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Sat, 7 Oct 2017 22:36:47 +0000
+Subject: PM / wakeirq: report a wakeup_event on dedicated wekup irq
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+
+[ Upstream commit 09bb6e93956ae5175b96905b723ec879c3ca0765 ]
+
+There are two reasons for reporting wakeup event when dedicated wakeup
+IRQ is triggered:
+
+- wakeup events accounting, so proper statistical data will be
+ displayed in sysfs and debugfs;
+
+- there are small window when System is entering suspend during which
+ dedicated wakeup IRQ can be lost:
+
+dpm_suspend_noirq()
+ |- device_wakeup_arm_wake_irqs()
+ |- dev_pm_arm_wake_irq(X)
+ |- IRQ is enabled and marked as wakeup source
+[1]...
+ |- suspend_device_irqs()
+ |- suspend_device_irq(X)
+ |- irqd_set(X, IRQD_WAKEUP_ARMED);
+ |- wakup IRQ armed
+
+The wakeup IRQ can be lost if it's triggered at point [1]
+and not armed yet.
+
+Hence, fix above cases by adding simple pm_wakeup_event() call in
+handle_threaded_wake_irq().
+
+Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling)
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Tested-by: Keerthy <j-keerthy@ti.com>
+[ tony@atomide.com: added missing return to avoid warnings ]
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/power/wakeirq.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/base/power/wakeirq.c
++++ b/drivers/base/power/wakeirq.c
+@@ -141,6 +141,13 @@ static irqreturn_t handle_threaded_wake_
+ struct wake_irq *wirq = _wirq;
+ int res;
+
++ /* Maybe abort suspend? */
++ if (irqd_is_wakeup_set(irq_get_irq_data(irq))) {
++ pm_wakeup_event(wirq->dev, 0);
++
++ return IRQ_HANDLED;
++ }
++
+ /* We don't want RPM_ASYNC or RPM_NOWAIT here */
+ res = pm_runtime_resume(wirq->dev);
+ if (res < 0)
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 30 Jan 2017 21:21:34 +1100
+Subject: powerpc/64: Don't try to use radix MMU under a hypervisor
+
+From: Paul Mackerras <paulus@ozlabs.org>
+
+
+[ Upstream commit 18569c1f134e1c5c88228f043c09678ae6052b7c ]
+
+Currently, if the kernel is running on a POWER9 processor under a
+hypervisor, it will try to use the radix MMU even though it doesn't have
+the necessary code to use radix under a hypervisor (it doesn't negotiate
+use of radix, and it doesn't do the H_REGISTER_PROC_TBL hcall). The
+result is that the guest kernel will crash when it tries to turn on the
+MMU.
+
+This fixes it by looking for the /chosen/ibm,architecture-vec-5
+property, and if it exists, clears the radix MMU feature bit, before we
+decide whether to initialize for radix or HPT. This property is created
+by the hypervisor as a result of the guest calling the
+ibm,client-architecture-support method to indicate its capabilities, so
+it will indicate whether the hypervisor agreed to us using radix.
+
+Systems without a hypervisor may have this property also (for example,
+skiboot creates it), so we check the HV bit in the MSR to see whether we
+are running as a guest or not. If we are in hypervisor mode, then we can
+do whatever we like including using the radix MMU.
+
+The reason for using this property is that in future, when we have
+support for using radix under a hypervisor, we will need to check this
+property to see whether the hypervisor agreed to us using radix.
+
+Fixes: 2bfd65e45e87 ("powerpc/mm/radix: Add radix callbacks for early init routines")
+Cc: stable@vger.kernel.org # v4.7+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/init_64.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/arch/powerpc/mm/init_64.c
++++ b/arch/powerpc/mm/init_64.c
+@@ -42,6 +42,8 @@
+ #include <linux/memblock.h>
+ #include <linux/hugetlb.h>
+ #include <linux/slab.h>
++#include <linux/of_fdt.h>
++#include <linux/libfdt.h>
+
+ #include <asm/pgalloc.h>
+ #include <asm/page.h>
+@@ -421,6 +423,28 @@ static int __init parse_disable_radix(ch
+ }
+ early_param("disable_radix", parse_disable_radix);
+
++/*
++ * If we're running under a hypervisor, we currently can't do radix
++ * since we don't have the code to do the H_REGISTER_PROC_TBL hcall.
++ * We tell that we're running under a hypervisor by looking for the
++ * /chosen/ibm,architecture-vec-5 property.
++ */
++static void early_check_vec5(void)
++{
++ unsigned long root, chosen;
++ int size;
++ const u8 *vec5;
++
++ root = of_get_flat_dt_root();
++ chosen = of_get_flat_dt_subnode_by_name(root, "chosen");
++ if (chosen == -FDT_ERR_NOTFOUND)
++ return;
++ vec5 = of_get_flat_dt_prop(chosen, "ibm,architecture-vec-5", &size);
++ if (!vec5)
++ return;
++ cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
++}
++
+ void __init mmu_early_init_devtree(void)
+ {
+ /* Disable radix mode based on kernel command line. */
+@@ -428,6 +452,15 @@ void __init mmu_early_init_devtree(void)
+ if (disable_radix || !(mfmsr() & MSR_HV))
+ cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX;
+
++ /*
++ * Check /chosen/ibm,architecture-vec-5 if running as a guest.
++ * When running bare-metal, we can use radix if we like
++ * even though the ibm,architecture-vec-5 property created by
++ * skiboot doesn't have the necessary bits set.
++ */
++ if (early_radix_enabled() && !(mfmsr() & MSR_HV))
++ early_check_vec5();
++
+ if (early_radix_enabled())
+ radix__early_init_devtree();
+ else
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Harald Freudenberger <freude@linux.vnet.ibm.com>
+Date: Sat, 7 Oct 2017 22:36:57 +0000
+Subject: s390/crypto: Extend key length check for AES-XTS in fips mode.
+
+From: Harald Freudenberger <freude@linux.vnet.ibm.com>
+
+
+[ Upstream commit a4f2779ecf2f42b0997fedef6fd20a931c40a3e3 ]
+
+In fips mode only xts keys with 128 bit or 125 bit are allowed.
+This fix extends the xts_aes_set_key function to check for these
+valid key lengths in fips mode.
+
+Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/crypto/aes_s390.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -28,6 +28,7 @@
+ #include <linux/cpufeature.h>
+ #include <linux/init.h>
+ #include <linux/spinlock.h>
++#include <linux/fips.h>
+ #include <crypto/xts.h>
+ #include <asm/cpacf.h>
+
+@@ -501,6 +502,12 @@ static int xts_aes_set_key(struct crypto
+ if (err)
+ return err;
+
++ /* In fips mode only 128 bit or 256 bit keys are valid */
++ if (fips_enabled && key_len != 32 && key_len != 64) {
++ tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
++ return -EINVAL;
++ }
++
+ /* Pick the correct function code based on the key length */
+ fc = (key_len == 32) ? CPACF_KM_XTS_128 :
+ (key_len == 64) ? CPACF_KM_XTS_256 : 0;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Sat, 7 Oct 2017 22:36:56 +0000
+Subject: s390/dasd: check for device error pointer within state change interrupts
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+
+[ Upstream commit 2202134e48a3b50320aeb9e3dd1186833e9d7e66 ]
+
+Check if the device pointer is valid. Just a sanity check since we already
+are in the int handler of the device.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -1704,8 +1704,11 @@ void dasd_int_handler(struct ccw_device
+ /* check for for attention message */
+ if (scsw_dstat(&irb->scsw) & DEV_STAT_ATTENTION) {
+ device = dasd_device_from_cdev_locked(cdev);
+- device->discipline->check_attention(device, irb->esw.esw1.lpum);
+- dasd_put_device(device);
++ if (!IS_ERR(device)) {
++ device->discipline->check_attention(device,
++ irb->esw.esw1.lpum);
++ dasd_put_device(device);
++ }
+ }
+
+ if (!cqr)
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Harald Freudenberger <freude@linux.vnet.ibm.com>
+Date: Sat, 7 Oct 2017 22:36:57 +0000
+Subject: s390/prng: Adjust generation of entropy to produce real 256 bits.
+
+From: Harald Freudenberger <freude@linux.vnet.ibm.com>
+
+
+[ Upstream commit d34b1acb78af41b8b8d5c60972b6555ea19f7564 ]
+
+The generate_entropy function used a sha256 for compacting
+together 256 bits of entropy into 32 bytes hash. However, it
+is questionable if a sha256 can really be used here, as
+potential collisions may reduce the max entropy fitting into
+a 32 byte hash value. So this batch introduces the use of
+sha512 instead and the required buffer adjustments for the
+calling functions.
+
+Further more the working buffer for the generate_entropy
+function has been widened from one page to two pages. So now
+1024 stckf invocations are used to gather 256 bits of
+entropy. This has been done to be on the save side if the
+jitters of stckf values isn't as good as supposed.
+
+Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/crypto/prng.c | 40 ++++++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+--- a/arch/s390/crypto/prng.c
++++ b/arch/s390/crypto/prng.c
+@@ -110,22 +110,30 @@ static const u8 initial_parm_block[32] _
+
+ /*** helper functions ***/
+
++/*
++ * generate_entropy:
++ * This algorithm produces 64 bytes of entropy data based on 1024
++ * individual stckf() invocations assuming that each stckf() value
++ * contributes 0.25 bits of entropy. So the caller gets 256 bit
++ * entropy per 64 byte or 4 bits entropy per byte.
++ */
+ static int generate_entropy(u8 *ebuf, size_t nbytes)
+ {
+ int n, ret = 0;
+- u8 *pg, *h, hash[32];
++ u8 *pg, *h, hash[64];
+
+- pg = (u8 *) __get_free_page(GFP_KERNEL);
++ /* allocate 2 pages */
++ pg = (u8 *) __get_free_pages(GFP_KERNEL, 1);
+ if (!pg) {
+ prng_errorflag = PRNG_GEN_ENTROPY_FAILED;
+ return -ENOMEM;
+ }
+
+ while (nbytes) {
+- /* fill page with urandom bytes */
+- get_random_bytes(pg, PAGE_SIZE);
+- /* exor page with stckf values */
+- for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) {
++ /* fill pages with urandom bytes */
++ get_random_bytes(pg, 2*PAGE_SIZE);
++ /* exor pages with 1024 stckf values */
++ for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) {
+ u64 *p = ((u64 *)pg) + n;
+ *p ^= get_tod_clock_fast();
+ }
+@@ -134,8 +142,8 @@ static int generate_entropy(u8 *ebuf, si
+ h = hash;
+ else
+ h = ebuf;
+- /* generate sha256 from this page */
+- cpacf_kimd(CPACF_KIMD_SHA_256, h, pg, PAGE_SIZE);
++ /* hash over the filled pages */
++ cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE);
+ if (n < sizeof(hash))
+ memcpy(ebuf, hash, n);
+ ret += n;
+@@ -143,7 +151,7 @@ static int generate_entropy(u8 *ebuf, si
+ nbytes -= n;
+ }
+
+- free_page((unsigned long)pg);
++ free_pages((unsigned long)pg, 1);
+ return ret;
+ }
+
+@@ -334,7 +342,7 @@ static int __init prng_sha512_selftest(v
+ static int __init prng_sha512_instantiate(void)
+ {
+ int ret, datalen;
+- u8 seed[64];
++ u8 seed[64 + 32 + 16];
+
+ pr_debug("prng runs in SHA-512 mode "
+ "with chunksize=%d and reseed_limit=%u\n",
+@@ -357,12 +365,12 @@ static int __init prng_sha512_instantiat
+ if (ret)
+ goto outfree;
+
+- /* generate initial seed bytestring, first 48 bytes of entropy */
+- ret = generate_entropy(seed, 48);
+- if (ret != 48)
++ /* generate initial seed bytestring, with 256 + 128 bits entropy */
++ ret = generate_entropy(seed, 64 + 32);
++ if (ret != 64 + 32)
+ goto outfree;
+ /* followed by 16 bytes of unique nonce */
+- get_tod_clock_ext(seed + 48);
++ get_tod_clock_ext(seed + 64 + 32);
+
+ /* initial seed of the ppno drng */
+ cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED,
+@@ -395,9 +403,9 @@ static void prng_sha512_deinstantiate(vo
+ static int prng_sha512_reseed(void)
+ {
+ int ret;
+- u8 seed[32];
++ u8 seed[64];
+
+- /* generate 32 bytes of fresh entropy */
++ /* fetch 256 bits of fresh entropy */
+ ret = generate_entropy(seed, sizeof(seed));
+ if (ret != sizeof(seed))
+ return ret;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+Date: Sat, 7 Oct 2017 22:36:53 +0000
+Subject: scsi: aacraid: Process Error for response I/O
+
+From: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+
+
+[ Upstream commit 4ec57fb4edaec523f0f78a0449a3b063749ac58b ]
+
+Make sure that the driver processes error conditions even in the fast
+response path for response from the adapter.
+
+Signed-off-by: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+Signed-off-by: Dave Carroll <David.Carroll@microsemi.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/aacraid/aachba.c | 291 +++++++++++++++++++++---------------------
+ 1 file changed, 152 insertions(+), 139 deletions(-)
+
+--- a/drivers/scsi/aacraid/aachba.c
++++ b/drivers/scsi/aacraid/aachba.c
+@@ -2954,16 +2954,11 @@ static void aac_srb_callback(void *conte
+ return;
+
+ BUG_ON(fibptr == NULL);
+- dev = fibptr->dev;
+-
+- scsi_dma_unmap(scsicmd);
+
+- /* expose physical device if expose_physicald flag is on */
+- if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01)
+- && expose_physicals > 0)
+- aac_expose_phy_device(scsicmd);
++ dev = fibptr->dev;
+
+ srbreply = (struct aac_srb_reply *) fib_data(fibptr);
++
+ scsicmd->sense_buffer[0] = '\0'; /* Initialize sense valid flag to false */
+
+ if (fibptr->flags & FIB_CONTEXT_FLAG_FASTRESP) {
+@@ -2976,158 +2971,176 @@ static void aac_srb_callback(void *conte
+ */
+ scsi_set_resid(scsicmd, scsi_bufflen(scsicmd)
+ - le32_to_cpu(srbreply->data_xfer_length));
+- /*
+- * First check the fib status
+- */
++ }
+
+- if (le32_to_cpu(srbreply->status) != ST_OK) {
+- int len;
+
+- printk(KERN_WARNING "aac_srb_callback: srb failed, status = %d\n", le32_to_cpu(srbreply->status));
+- len = min_t(u32, le32_to_cpu(srbreply->sense_data_size),
+- SCSI_SENSE_BUFFERSIZE);
+- scsicmd->result = DID_ERROR << 16
+- | COMMAND_COMPLETE << 8
+- | SAM_STAT_CHECK_CONDITION;
+- memcpy(scsicmd->sense_buffer,
+- srbreply->sense_data, len);
+- }
++ scsi_dma_unmap(scsicmd);
+
+- /*
+- * Next check the srb status
+- */
+- switch ((le32_to_cpu(srbreply->srb_status))&0x3f) {
+- case SRB_STATUS_ERROR_RECOVERY:
+- case SRB_STATUS_PENDING:
+- case SRB_STATUS_SUCCESS:
+- scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
+- break;
+- case SRB_STATUS_DATA_OVERRUN:
+- switch (scsicmd->cmnd[0]) {
+- case READ_6:
+- case WRITE_6:
+- case READ_10:
+- case WRITE_10:
+- case READ_12:
+- case WRITE_12:
+- case READ_16:
+- case WRITE_16:
+- if (le32_to_cpu(srbreply->data_xfer_length)
+- < scsicmd->underflow)
+- printk(KERN_WARNING"aacraid: SCSI CMD underflow\n");
+- else
+- printk(KERN_WARNING"aacraid: SCSI CMD Data Overrun\n");
+- scsicmd->result = DID_ERROR << 16
+- | COMMAND_COMPLETE << 8;
+- break;
+- case INQUIRY: {
+- scsicmd->result = DID_OK << 16
+- | COMMAND_COMPLETE << 8;
+- break;
+- }
+- default:
+- scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
+- break;
+- }
+- break;
+- case SRB_STATUS_ABORTED:
+- scsicmd->result = DID_ABORT << 16 | ABORT << 8;
+- break;
+- case SRB_STATUS_ABORT_FAILED:
+- /*
+- * Not sure about this one - but assuming the
+- * hba was trying to abort for some reason
+- */
+- scsicmd->result = DID_ERROR << 16 | ABORT << 8;
+- break;
+- case SRB_STATUS_PARITY_ERROR:
+- scsicmd->result = DID_PARITY << 16
+- | MSG_PARITY_ERROR << 8;
+- break;
+- case SRB_STATUS_NO_DEVICE:
+- case SRB_STATUS_INVALID_PATH_ID:
+- case SRB_STATUS_INVALID_TARGET_ID:
+- case SRB_STATUS_INVALID_LUN:
+- case SRB_STATUS_SELECTION_TIMEOUT:
+- scsicmd->result = DID_NO_CONNECT << 16
+- | COMMAND_COMPLETE << 8;
+- break;
++ /* expose physical device if expose_physicald flag is on */
++ if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01)
++ && expose_physicals > 0)
++ aac_expose_phy_device(scsicmd);
+
+- case SRB_STATUS_COMMAND_TIMEOUT:
+- case SRB_STATUS_TIMEOUT:
+- scsicmd->result = DID_TIME_OUT << 16
+- | COMMAND_COMPLETE << 8;
+- break;
++ /*
++ * First check the fib status
++ */
+
+- case SRB_STATUS_BUSY:
+- scsicmd->result = DID_BUS_BUSY << 16
+- | COMMAND_COMPLETE << 8;
+- break;
++ if (le32_to_cpu(srbreply->status) != ST_OK) {
++ int len;
+
+- case SRB_STATUS_BUS_RESET:
+- scsicmd->result = DID_RESET << 16
+- | COMMAND_COMPLETE << 8;
+- break;
++ pr_warn("aac_srb_callback: srb failed, status = %d\n",
++ le32_to_cpu(srbreply->status));
++ len = min_t(u32, le32_to_cpu(srbreply->sense_data_size),
++ SCSI_SENSE_BUFFERSIZE);
++ scsicmd->result = DID_ERROR << 16
++ | COMMAND_COMPLETE << 8
++ | SAM_STAT_CHECK_CONDITION;
++ memcpy(scsicmd->sense_buffer,
++ srbreply->sense_data, len);
++ }
+
+- case SRB_STATUS_MESSAGE_REJECTED:
++ /*
++ * Next check the srb status
++ */
++ switch ((le32_to_cpu(srbreply->srb_status))&0x3f) {
++ case SRB_STATUS_ERROR_RECOVERY:
++ case SRB_STATUS_PENDING:
++ case SRB_STATUS_SUCCESS:
++ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
++ break;
++ case SRB_STATUS_DATA_OVERRUN:
++ switch (scsicmd->cmnd[0]) {
++ case READ_6:
++ case WRITE_6:
++ case READ_10:
++ case WRITE_10:
++ case READ_12:
++ case WRITE_12:
++ case READ_16:
++ case WRITE_16:
++ if (le32_to_cpu(srbreply->data_xfer_length)
++ < scsicmd->underflow)
++ pr_warn("aacraid: SCSI CMD underflow\n");
++ else
++ pr_warn("aacraid: SCSI CMD Data Overrun\n");
+ scsicmd->result = DID_ERROR << 16
+- | MESSAGE_REJECT << 8;
++ | COMMAND_COMPLETE << 8;
++ break;
++ case INQUIRY:
++ scsicmd->result = DID_OK << 16
++ | COMMAND_COMPLETE << 8;
+ break;
+- case SRB_STATUS_REQUEST_FLUSHED:
+- case SRB_STATUS_ERROR:
+- case SRB_STATUS_INVALID_REQUEST:
+- case SRB_STATUS_REQUEST_SENSE_FAILED:
+- case SRB_STATUS_NO_HBA:
+- case SRB_STATUS_UNEXPECTED_BUS_FREE:
+- case SRB_STATUS_PHASE_SEQUENCE_FAILURE:
+- case SRB_STATUS_BAD_SRB_BLOCK_LENGTH:
+- case SRB_STATUS_DELAYED_RETRY:
+- case SRB_STATUS_BAD_FUNCTION:
+- case SRB_STATUS_NOT_STARTED:
+- case SRB_STATUS_NOT_IN_USE:
+- case SRB_STATUS_FORCE_ABORT:
+- case SRB_STATUS_DOMAIN_VALIDATION_FAIL:
+ default:
++ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
++ break;
++ }
++ break;
++ case SRB_STATUS_ABORTED:
++ scsicmd->result = DID_ABORT << 16 | ABORT << 8;
++ break;
++ case SRB_STATUS_ABORT_FAILED:
++ /*
++ * Not sure about this one - but assuming the
++ * hba was trying to abort for some reason
++ */
++ scsicmd->result = DID_ERROR << 16 | ABORT << 8;
++ break;
++ case SRB_STATUS_PARITY_ERROR:
++ scsicmd->result = DID_PARITY << 16
++ | MSG_PARITY_ERROR << 8;
++ break;
++ case SRB_STATUS_NO_DEVICE:
++ case SRB_STATUS_INVALID_PATH_ID:
++ case SRB_STATUS_INVALID_TARGET_ID:
++ case SRB_STATUS_INVALID_LUN:
++ case SRB_STATUS_SELECTION_TIMEOUT:
++ scsicmd->result = DID_NO_CONNECT << 16
++ | COMMAND_COMPLETE << 8;
++ break;
++
++ case SRB_STATUS_COMMAND_TIMEOUT:
++ case SRB_STATUS_TIMEOUT:
++ scsicmd->result = DID_TIME_OUT << 16
++ | COMMAND_COMPLETE << 8;
++ break;
++
++ case SRB_STATUS_BUSY:
++ scsicmd->result = DID_BUS_BUSY << 16
++ | COMMAND_COMPLETE << 8;
++ break;
++
++ case SRB_STATUS_BUS_RESET:
++ scsicmd->result = DID_RESET << 16
++ | COMMAND_COMPLETE << 8;
++ break;
++
++ case SRB_STATUS_MESSAGE_REJECTED:
++ scsicmd->result = DID_ERROR << 16
++ | MESSAGE_REJECT << 8;
++ break;
++ case SRB_STATUS_REQUEST_FLUSHED:
++ case SRB_STATUS_ERROR:
++ case SRB_STATUS_INVALID_REQUEST:
++ case SRB_STATUS_REQUEST_SENSE_FAILED:
++ case SRB_STATUS_NO_HBA:
++ case SRB_STATUS_UNEXPECTED_BUS_FREE:
++ case SRB_STATUS_PHASE_SEQUENCE_FAILURE:
++ case SRB_STATUS_BAD_SRB_BLOCK_LENGTH:
++ case SRB_STATUS_DELAYED_RETRY:
++ case SRB_STATUS_BAD_FUNCTION:
++ case SRB_STATUS_NOT_STARTED:
++ case SRB_STATUS_NOT_IN_USE:
++ case SRB_STATUS_FORCE_ABORT:
++ case SRB_STATUS_DOMAIN_VALIDATION_FAIL:
++ default:
+ #ifdef AAC_DETAILED_STATUS_INFO
+- printk(KERN_INFO "aacraid: SRB ERROR(%u) %s scsi cmd 0x%x - scsi status 0x%x\n",
+- le32_to_cpu(srbreply->srb_status) & 0x3F,
+- aac_get_status_string(
+- le32_to_cpu(srbreply->srb_status) & 0x3F),
+- scsicmd->cmnd[0],
+- le32_to_cpu(srbreply->scsi_status));
++ pr_info("aacraid: SRB ERROR(%u) %s scsi cmd 0x%x -scsi status 0x%x\n",
++ le32_to_cpu(srbreply->srb_status) & 0x3F,
++ aac_get_status_string(
++ le32_to_cpu(srbreply->srb_status) & 0x3F),
++ scsicmd->cmnd[0],
++ le32_to_cpu(srbreply->scsi_status));
+ #endif
+- if ((scsicmd->cmnd[0] == ATA_12)
+- || (scsicmd->cmnd[0] == ATA_16)) {
+- if (scsicmd->cmnd[2] & (0x01 << 5)) {
+- scsicmd->result = DID_OK << 16
+- | COMMAND_COMPLETE << 8;
+- break;
+- } else {
+- scsicmd->result = DID_ERROR << 16
+- | COMMAND_COMPLETE << 8;
+- break;
+- }
++ /*
++ * When the CC bit is SET by the host in ATA pass thru CDB,
++ * driver is supposed to return DID_OK
++ *
++ * When the CC bit is RESET by the host, driver should
++ * return DID_ERROR
++ */
++ if ((scsicmd->cmnd[0] == ATA_12)
++ || (scsicmd->cmnd[0] == ATA_16)) {
++
++ if (scsicmd->cmnd[2] & (0x01 << 5)) {
++ scsicmd->result = DID_OK << 16
++ | COMMAND_COMPLETE << 8;
++ break;
+ } else {
+ scsicmd->result = DID_ERROR << 16
+ | COMMAND_COMPLETE << 8;
+- break;
++ break;
+ }
++ } else {
++ scsicmd->result = DID_ERROR << 16
++ | COMMAND_COMPLETE << 8;
++ break;
+ }
+- if (le32_to_cpu(srbreply->scsi_status)
+- == SAM_STAT_CHECK_CONDITION) {
+- int len;
+-
+- scsicmd->result |= SAM_STAT_CHECK_CONDITION;
+- len = min_t(u32, le32_to_cpu(srbreply->sense_data_size),
+- SCSI_SENSE_BUFFERSIZE);
++ }
++ if (le32_to_cpu(srbreply->scsi_status)
++ == SAM_STAT_CHECK_CONDITION) {
++ int len;
++
++ scsicmd->result |= SAM_STAT_CHECK_CONDITION;
++ len = min_t(u32, le32_to_cpu(srbreply->sense_data_size),
++ SCSI_SENSE_BUFFERSIZE);
+ #ifdef AAC_DETAILED_STATUS_INFO
+- printk(KERN_WARNING "aac_srb_callback: check condition, status = %d len=%d\n",
+- le32_to_cpu(srbreply->status), len);
++ pr_warn("aac_srb_callback: check condition, status = %d len=%d\n",
++ le32_to_cpu(srbreply->status), len);
+ #endif
+- memcpy(scsicmd->sense_buffer,
+- srbreply->sense_data, len);
+- }
++ memcpy(scsicmd->sense_buffer,
++ srbreply->sense_data, len);
+ }
++
+ /*
+ * OR in the scsi status (already shifted up a bit)
+ */
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Date: Sat, 7 Oct 2017 22:36:47 +0000
+Subject: scsi: megaraid_sas: Do not set fp_possible if TM capable for non-RW syspdIO, change fp_possible to bool
+
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+
+
+[ Upstream commit 1d6dbd1752fb4347a4a5db06c8f5cd35dd1919f4 ]
+
+FIX - firmware wants non-RW SYS PD IOs to avoid FastPath for better
+tracking and other functionalities if the device is task management
+capable.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1960,7 +1960,8 @@ static void megasas_build_ld_nonrw_fusio
+ */
+ static void
+ megasas_build_syspd_fusion(struct megasas_instance *instance,
+- struct scsi_cmnd *scmd, struct megasas_cmd_fusion *cmd, u8 fp_possible)
++ struct scsi_cmnd *scmd, struct megasas_cmd_fusion *cmd,
++ bool fp_possible)
+ {
+ u32 device_id;
+ struct MPI2_RAID_SCSI_IO_REQUEST *io_request;
+@@ -2064,6 +2065,8 @@ megasas_build_io_fusion(struct megasas_i
+ u16 sge_count;
+ u8 cmd_type;
+ struct MPI2_RAID_SCSI_IO_REQUEST *io_request = cmd->io_request;
++ struct MR_PRIV_DEVICE *mr_device_priv_data;
++ mr_device_priv_data = scp->device->hostdata;
+
+ /* Zero out some fields so they don't get reused */
+ memset(io_request->LUN, 0x0, 8);
+@@ -2092,12 +2095,14 @@ megasas_build_io_fusion(struct megasas_i
+ megasas_build_ld_nonrw_fusion(instance, scp, cmd);
+ break;
+ case READ_WRITE_SYSPDIO:
++ megasas_build_syspd_fusion(instance, scp, cmd, true);
++ break;
+ case NON_READ_WRITE_SYSPDIO:
+- if (instance->secure_jbod_support &&
+- (cmd_type == NON_READ_WRITE_SYSPDIO))
+- megasas_build_syspd_fusion(instance, scp, cmd, 0);
++ if (instance->secure_jbod_support ||
++ mr_device_priv_data->is_tm_capable)
++ megasas_build_syspd_fusion(instance, scp, cmd, false);
+ else
+- megasas_build_syspd_fusion(instance, scp, cmd, 1);
++ megasas_build_syspd_fusion(instance, scp, cmd, true);
+ break;
+ default:
+ break;
drm-msm-fix-an-integer-overflow-test.patch
tracing-samples-fix-creation-and-deletion-of-simple_thread_fn-creation.patch
fix-tracing-sample-code-warning.patch
+cpufreq-do-not-clear-real_cpus-mask-on-policy-init.patch
+crypto-ccp-set-the-aes-size-field-for-all-modes.patch
+staging-fsl-mc-add-missing-header.patch
+ib-mlx5-assign-dscp-for-r-roce-qps-address-path.patch
+pm-wakeirq-report-a-wakeup_event-on-dedicated-wekup-irq.patch
+scsi-megaraid_sas-do-not-set-fp_possible-if-tm-capable-for-non-rw-syspdio-change-fp_possible-to-bool.patch
+mmc-s3cmci-include-linux-interrupt.h-for-tasklet_struct.patch
+mfd-ab8500-sysctrl-handle-probe-deferral.patch
+mfd-axp20x-fix-axp288-pek_dbr-and-pek_dbf-irqs-being-swapped.patch
+bnxt_en-added-pci-ids-for-bcm57452-and-bcm57454-asics.patch
+staging-rtl8712u-fix-endian-settings-for-structs-describing-network-packets.patch
+pci-msi-return-failure-when-msix_setup_entries-fails.patch
+net-mvneta-fix-build-errors-when-linux-phy-.h-is-removed-from-net-dsa.h.patch
+ext4-fix-stripe-unaligned-allocations.patch
+ext4-do-not-use-stripe_width-if-it-is-not-set.patch
+net-ena-change-driver-s-default-timeouts.patch
+i2c-riic-correctly-finish-transfers.patch
+drm-amdgpu-when-dpm-disabled-also-need-to-stop-start-vce.patch
+perf-tools-only-increase-index-if-perf_evsel__new_idx-succeeds.patch
+iwlwifi-mvm-use-the-probe_resp_queue-to-send-deauth-to-unknown-station.patch
+drm-fsl-dcu-check-for-clk_prepare_enable-error.patch
+clocksource-drivers-arm_arch_timer-add-dt-binding-for-hisilicon-161010101-erratum.patch
+net-phy-dp83867-recover-from-port-mirroring-n-a-mode4.patch
+cx231xx-fix-i2c-on-internal-master-3-bus.patch
+ath10k-fix-reading-sram-contents-for-qca4019.patch
+clk-sunxi-ng-check-kzalloc-for-errors-and-cleanup-error-path.patch
+drm-msm-dsi-set-msm_dsi-encoders-before-initializing-bridge.patch
+mtd-nand-sunxi-fix-the-non-polling-case-in-sunxi_nfc_wait_events.patch
+gpio-mcp23s08-select-regmap-regmap_i2c-to-fix-build-error.patch
+xen-manage-correct-return-value-check-on-xenbus_scanf.patch
+scsi-aacraid-process-error-for-response-i-o.patch
+platform-x86-intel_mid_thermal-fix-module-autoload.patch
+staging-lustre-llite-don-t-invoke-direct_io-for-the-eof-case.patch
+staging-lustre-hsm-stack-overrun-in-hai_dump_data_field.patch
+staging-lustre-ptlrpc-skip-lock-if-export-failed.patch
+staging-lustre-lmv-error-not-handled-for-lmv_find_target.patch
+brcmfmac-check-brcmf_bus_get_memdump-result-for-error.patch
+vfs-open-with-o_creat-should-not-create-inodes-with-unknown-ids.patch
+asoc-intel-boards-remove-.pm_ops-in-all-atom-dpcm-machine-drivers.patch
+exynos4-is-fimc-is-unmap-region-obtained-by-of_iomap.patch
+mei-return-error-on-notification-request-to-a-disconnected-client.patch
+s390-dasd-check-for-device-error-pointer-within-state-change-interrupts.patch
+s390-prng-adjust-generation-of-entropy-to-produce-real-256-bits.patch
+s390-crypto-extend-key-length-check-for-aes-xts-in-fips-mode.patch
+bt8xx-fix-memory-leak.patch
+drm-exynos-g2d-prevent-integer-overflow-in.patch
+pci-avoid-possible-deadlock-on-pci_lock-and-p-pi_lock.patch
+powerpc-64-don-t-try-to-use-radix-mmu-under-a-hypervisor.patch
+xen-don-t-print-error-message-in-case-of-missing-xenstore-entry.patch
+staging-r8712u-fix-sparse-warning-in-rtl871x_xmit.c.patch
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Bogdan Purcareata <bogdan.purcareata@gmail.com>
+Date: Sat, 7 Oct 2017 22:36:46 +0000
+Subject: staging: fsl-mc: Add missing header
+
+From: Bogdan Purcareata <bogdan.purcareata@gmail.com>
+
+
+[ Upstream commit 07e9ef146071adf316312b3dd4abfe41c9a45a7d ]
+
+Compiling the fsl-mc bus driver will yield a couple of static analysis
+errors:
+warning: symbol 'fsl_mc_msi_domain_alloc_irqs' was not declared
+warning: symbol 'fsl_mc_msi_domain_free_irqs' was not declared.
+warning: symbol 'its_fsl_mc_msi_init' was not declared.
+warning: symbol 'its_fsl_mc_msi_cleanup' was not declared.
+
+Since these are properly declared, but the header is not included, add
+it in the source files. This way the symbol is properly exported.
+
+Signed-off-by: Bogdan Purcareata <bogdan.purcareata@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/fsl-mc/bus/fsl-mc-msi.c | 1 +
+ drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/staging/fsl-mc/bus/fsl-mc-msi.c
++++ b/drivers/staging/fsl-mc/bus/fsl-mc-msi.c
+@@ -17,6 +17,7 @@
+ #include <linux/irqdomain.h>
+ #include <linux/msi.h>
+ #include "../include/mc-bus.h"
++#include "fsl-mc-private.h"
+
+ /*
+ * Generate a unique ID identifying the interrupt (only used within the MSI
+--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
++++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
+@@ -17,6 +17,7 @@
+ #include <linux/of.h>
+ #include <linux/of_irq.h>
+ #include "../include/mc-bus.h"
++#include "fsl-mc-private.h"
+
+ static struct irq_chip its_msi_irq_chip = {
+ .name = "fsl-mc-bus-msi",
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: frank zago <fzago@cray.com>
+Date: Sat, 7 Oct 2017 22:36:54 +0000
+Subject: staging: lustre: hsm: stack overrun in hai_dump_data_field
+
+From: frank zago <fzago@cray.com>
+
+
+[ Upstream commit 22aadb91c0a0055935109c175f5446abfb130702 ]
+
+The function hai_dump_data_field will do a stack buffer
+overrun when cat'ing /sys/fs/lustre/.../hsm/actions if an action has
+some data in it.
+
+hai_dump_data_field uses snprintf. But there is no check for
+truncation, and the value returned by snprintf is used as-is. The
+coordinator code calls hai_dump_data_field with 12 bytes in the
+buffer. The 6th byte of data is printed incompletely to make room for
+the terminating NUL. However snprintf still returns 2, so when
+hai_dump_data_field writes the final NUL, it does it outside the
+reserved buffer, in the 13th byte of the buffer. This stack buffer
+overrun hangs my VM.
+
+Fix by checking that there is enough room for the next 2 characters
+plus the NUL terminator. Don't print half bytes. Change the format to
+02X instead of .2X, which makes more sense.
+
+Signed-off-by: frank zago <fzago@cray.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8171
+Reviewed-on: http://review.whamcloud.com/20338
+Reviewed-by: John L. Hammond <john.hammond@intel.com>
+Reviewed-by: Jean-Baptiste Riaux <riaux.jb@intel.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/include/lustre/lustre_user.h | 18 +++++--------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
++++ b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h
+@@ -1213,23 +1213,21 @@ struct hsm_action_item {
+ * \retval buffer
+ */
+ static inline char *hai_dump_data_field(struct hsm_action_item *hai,
+- char *buffer, int len)
++ char *buffer, size_t len)
+ {
+- int i, sz, data_len;
++ int i, data_len;
+ char *ptr;
+
+ ptr = buffer;
+- sz = len;
+ data_len = hai->hai_len - sizeof(*hai);
+- for (i = 0 ; (i < data_len) && (sz > 0) ; i++) {
+- int cnt;
+-
+- cnt = snprintf(ptr, sz, "%.2X",
+- (unsigned char)hai->hai_data[i]);
+- ptr += cnt;
+- sz -= cnt;
++ for (i = 0; (i < data_len) && (len > 2); i++) {
++ snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]);
++ ptr += 2;
++ len -= 2;
+ }
++
+ *ptr = '\0';
++
+ return buffer;
+ }
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Yang Sheng <yang.sheng@intel.com>
+Date: Sat, 7 Oct 2017 22:36:54 +0000
+Subject: staging: lustre: llite: don't invoke direct_IO for the EOF case
+
+From: Yang Sheng <yang.sheng@intel.com>
+
+
+[ Upstream commit 77759771fb95420d23876cb104ab65c022613325 ]
+
+The function generic_file_read_iter() does not check EOF
+before invoke direct_IO callback. So we have to check it
+ourselves.
+
+Signed-off-by: Yang Sheng <yang.sheng@intel.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8969
+Reviewed-on: https://review.whamcloud.com/24552
+Reviewed-by: Bob Glossman <bob.glossman@intel.com>
+Reviewed-by: Bobi Jam <bobijam@hotmail.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/llite/rw26.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/staging/lustre/lustre/llite/rw26.c
++++ b/drivers/staging/lustre/lustre/llite/rw26.c
+@@ -354,6 +354,10 @@ static ssize_t ll_direct_IO_26(struct ki
+ if (!lli->lli_has_smd)
+ return -EBADF;
+
++ /* Check EOF by ourselves */
++ if (iov_iter_rw(iter) == READ && file_offset >= i_size_read(inode))
++ return 0;
++
+ /* FIXME: io smaller than PAGE_SIZE is broken on ia64 ??? */
+ if ((file_offset & ~PAGE_MASK) || (count & ~PAGE_MASK))
+ return -EINVAL;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Ulka Vaze <ulka.vaze@yahoo.in>
+Date: Sat, 7 Oct 2017 22:36:55 +0000
+Subject: staging: lustre: lmv: Error not handled for lmv_find_target
+
+From: Ulka Vaze <ulka.vaze@yahoo.in>
+
+
+[ Upstream commit 30af99db7ab3483f5ce83ccb890533c9378c2ced ]
+
+This issue is found by smatch; has been reported as-
+Unchecked usage of potential ERR_PTR result in lmv_hsm_req_count
+and lmv_hsm_req_build. Added ERR_PTR in both functions and also
+return value check added.
+
+Signed-off-by: Ulka Vaze <ulka.vaze@yahoo.in>
+Signed-off-by: Aditya Pandit <panditadityashreesh@yahoo.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-6523
+Reviewed-on: http://review.whamcloud.com/14918
+Reviewed-by: Dmitry Eremin <dmitry.eremin@intel.com>
+Reviewed-by: Andreas Dilger <andreas.dilger@intel.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/lmv/lmv_obd.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c
++++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
+@@ -744,16 +744,18 @@ static int lmv_hsm_req_count(struct lmv_
+ /* count how many requests must be sent to the given target */
+ for (i = 0; i < hur->hur_request.hr_itemcount; i++) {
+ curr_tgt = lmv_find_target(lmv, &hur->hur_user_item[i].hui_fid);
++ if (IS_ERR(curr_tgt))
++ return PTR_ERR(curr_tgt);
+ if (obd_uuid_equals(&curr_tgt->ltd_uuid, &tgt_mds->ltd_uuid))
+ nr++;
+ }
+ return nr;
+ }
+
+-static void lmv_hsm_req_build(struct lmv_obd *lmv,
+- struct hsm_user_request *hur_in,
+- const struct lmv_tgt_desc *tgt_mds,
+- struct hsm_user_request *hur_out)
++static int lmv_hsm_req_build(struct lmv_obd *lmv,
++ struct hsm_user_request *hur_in,
++ const struct lmv_tgt_desc *tgt_mds,
++ struct hsm_user_request *hur_out)
+ {
+ int i, nr_out;
+ struct lmv_tgt_desc *curr_tgt;
+@@ -764,6 +766,8 @@ static void lmv_hsm_req_build(struct lmv
+ for (i = 0; i < hur_in->hur_request.hr_itemcount; i++) {
+ curr_tgt = lmv_find_target(lmv,
+ &hur_in->hur_user_item[i].hui_fid);
++ if (IS_ERR(curr_tgt))
++ return PTR_ERR(curr_tgt);
+ if (obd_uuid_equals(&curr_tgt->ltd_uuid, &tgt_mds->ltd_uuid)) {
+ hur_out->hur_user_item[nr_out] =
+ hur_in->hur_user_item[i];
+@@ -773,6 +777,8 @@ static void lmv_hsm_req_build(struct lmv
+ hur_out->hur_request.hr_itemcount = nr_out;
+ memcpy(hur_data(hur_out), hur_data(hur_in),
+ hur_in->hur_request.hr_data_len);
++
++ return 0;
+ }
+
+ static int lmv_hsm_ct_unregister(struct lmv_obd *lmv, unsigned int cmd, int len,
+@@ -1052,15 +1058,17 @@ static int lmv_iocontrol(unsigned int cm
+ } else {
+ /* split fid list to their respective MDS */
+ for (i = 0; i < count; i++) {
+- unsigned int nr, reqlen;
+- int rc1;
+ struct hsm_user_request *req;
++ size_t reqlen;
++ int nr, rc1;
+
+ tgt = lmv->tgts[i];
+ if (!tgt || !tgt->ltd_exp)
+ continue;
+
+ nr = lmv_hsm_req_count(lmv, hur, tgt);
++ if (nr < 0)
++ return nr;
+ if (nr == 0) /* nothing for this MDS */
+ continue;
+
+@@ -1072,10 +1080,13 @@ static int lmv_iocontrol(unsigned int cm
+ if (!req)
+ return -ENOMEM;
+
+- lmv_hsm_req_build(lmv, hur, tgt, req);
++ rc1 = lmv_hsm_req_build(lmv, hur, tgt, req);
++ if (rc1 < 0)
++ goto hsm_req_err;
+
+ rc1 = obd_iocontrol(cmd, tgt->ltd_exp, reqlen,
+ req, uarg);
++hsm_req_err:
+ if (rc1 != 0 && rc == 0)
+ rc = rc1;
+ kvfree(req);
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Alexander Boyko <alexander.boyko@seagate.com>
+Date: Sat, 7 Oct 2017 22:36:54 +0000
+Subject: staging: lustre: ptlrpc: skip lock if export failed
+
+From: Alexander Boyko <alexander.boyko@seagate.com>
+
+
+[ Upstream commit 4c43c27ddc461d8473cedd70f2549614641dfbc7 ]
+
+This patch resolves IO vs eviction race.
+After eviction failed export stayed at stale list,
+a client had IO processing and reconnected during it.
+A client sent brw rpc with last lock cookie and new connection.
+The lock with failed export was found and assert was happened.
+ (ost_handler.c:1812:ost_prolong_lock_one())
+ ASSERTION( lock->l_export == opd->opd_exp ) failed:
+
+ 1. Skip the lock at ldlm_handle2lock if lock export failed.
+ 2. Validation of lock for IO was added at hpreq_check(). The lock
+ searching is based on granted interval tree. If server doesn`t
+ have a valid lock, it reply to client with ESTALE.
+
+Signed-off-by: Alexander Boyko <alexander.boyko@seagate.com>
+Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-7702
+Seagate-bug-id: MRP-2787
+Reviewed-on: http://review.whamcloud.com/18120
+Reviewed-by: Fan Yong <fan.yong@intel.com>
+Reviewed-by: Vitaly Fertman <vitaly.fertman@seagate.com>
+Reviewed-by: Oleg Drokin <oleg.drokin@intel.com>
+Signed-off-by: James Simmons <jsimmons@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/lustre/lustre/ldlm/ldlm_lock.c | 7 +++++++
+ drivers/staging/lustre/lustre/ptlrpc/service.c | 21 ++++++++-------------
+ 2 files changed, 15 insertions(+), 13 deletions(-)
+
+--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c
+@@ -546,6 +546,13 @@ struct ldlm_lock *__ldlm_handle2lock(con
+ if (!lock)
+ return NULL;
+
++ if (lock->l_export && lock->l_export->exp_failed) {
++ CDEBUG(D_INFO, "lock export failed: lock %p, exp %p\n",
++ lock, lock->l_export);
++ LDLM_LOCK_PUT(lock);
++ return NULL;
++ }
++
+ /* It's unlikely but possible that someone marked the lock as
+ * destroyed after we did handle2object on it
+ */
+--- a/drivers/staging/lustre/lustre/ptlrpc/service.c
++++ b/drivers/staging/lustre/lustre/ptlrpc/service.c
+@@ -1264,20 +1264,15 @@ static int ptlrpc_server_hpreq_init(stru
+ */
+ if (req->rq_ops->hpreq_check) {
+ rc = req->rq_ops->hpreq_check(req);
+- /**
+- * XXX: Out of all current
+- * ptlrpc_hpreq_ops::hpreq_check(), only
+- * ldlm_cancel_hpreq_check() can return an error code;
+- * other functions assert in similar places, which seems
+- * odd. What also does not seem right is that handlers
+- * for those RPCs do not assert on the same checks, but
+- * rather handle the error cases. e.g. see
+- * ost_rw_hpreq_check(), and ost_brw_read(),
+- * ost_brw_write().
++ if (rc == -ESTALE) {
++ req->rq_status = rc;
++ ptlrpc_error(req);
++ }
++ /** can only return error,
++ * 0 for normal request,
++ * or 1 for high priority request
+ */
+- if (rc < 0)
+- return rc;
+- LASSERT(rc == 0 || rc == 1);
++ LASSERT(rc <= 1);
+ }
+
+ spin_lock_bh(&req->rq_export->exp_rpc_lock);
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 10 Feb 2017 21:30:27 -0600
+Subject: staging: r8712u: Fix Sparse warning in rtl871x_xmit.c
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+
+[ Upstream commit 07222e535831b916221dd2a48a3047ec7e45dc72 ]
+
+Sparse reports the following:
+ CHECK drivers/staging/rtl8712/rtl871x_xmit.c
+drivers/staging/rtl8712/rtl871x_xmit.c:350:44: warning: restricted __le32 degrades to integer
+drivers/staging/rtl8712/rtl871x_xmit.c:491:23: warning: incorrect type in initializer (different base types)
+drivers/staging/rtl8712/rtl871x_xmit.c:491:23: expected unsigned short [usertype] *fctrl
+drivers/staging/rtl8712/rtl871x_xmit.c:491:23: got restricted __le16 *<noident>
+drivers/staging/rtl8712/rtl871x_xmit.c:580:36: warning: incorrect type in assignment (different base types)
+drivers/staging/rtl8712/rtl871x_xmit.c:580:36: expected unsigned short [unsigned] [short] [usertype] <noident>
+drivers/staging/rtl8712/rtl871x_xmit.c:580:36: got restricted __be16 [usertype] <noident>
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8712/rtl871x_xmit.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/rtl8712/rtl871x_xmit.c
++++ b/drivers/staging/rtl8712/rtl871x_xmit.c
+@@ -344,7 +344,8 @@ sint r8712_update_attrib(struct _adapter
+ * some settings above.
+ */
+ if (check_fwstate(pmlmepriv, WIFI_MP_STATE))
+- pattrib->priority = (txdesc.txdw1 >> QSEL_SHT) & 0x1f;
++ pattrib->priority =
++ (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f;
+ return _SUCCESS;
+ }
+
+@@ -485,7 +486,7 @@ static sint make_wlanhdr(struct _adapter
+ struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr;
+ struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+ struct qos_priv *pqospriv = &pmlmepriv->qospriv;
+- u16 *fctrl = &pwlanhdr->frame_ctl;
++ __le16 *fctrl = &pwlanhdr->frame_ctl;
+
+ memset(hdr, 0, WLANHDR_OFFSET);
+ SetFrameSubType(fctrl, pattrib->subtype);
+@@ -574,7 +575,7 @@ static sint r8712_put_snap(u8 *data, u16
+ snap->oui[0] = oui[0];
+ snap->oui[1] = oui[1];
+ snap->oui[2] = oui[2];
+- *(u16 *)(data + SNAP_SIZE) = htons(h_proto);
++ *(__be16 *)(data + SNAP_SIZE) = htons(h_proto);
+ return SNAP_SIZE + sizeof(u16);
+ }
+
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 7 Oct 2017 22:36:48 +0000
+Subject: staging: rtl8712u: Fix endian settings for structs describing network packets
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+
+[ Upstream commit 221c46d28957bd6e2158abc2179ce4a8c9ce07d3 ]
+
+The headers describing a number of network packets do not have the
+correct endian settings for several types of data.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8712/ieee80211.h | 84 ++++++++++++++++++------------------
+ 1 file changed, 42 insertions(+), 42 deletions(-)
+
+--- a/drivers/staging/rtl8712/ieee80211.h
++++ b/drivers/staging/rtl8712/ieee80211.h
+@@ -138,51 +138,51 @@ struct ieee_ibss_seq {
+ };
+
+ struct ieee80211_hdr {
+- u16 frame_ctl;
+- u16 duration_id;
++ __le16 frame_ctl;
++ __le16 duration_id;
+ u8 addr1[ETH_ALEN];
+ u8 addr2[ETH_ALEN];
+ u8 addr3[ETH_ALEN];
+- u16 seq_ctl;
++ __le16 seq_ctl;
+ u8 addr4[ETH_ALEN];
+-} __packed;
++} __packed __aligned(2);
+
+ struct ieee80211_hdr_3addr {
+- u16 frame_ctl;
+- u16 duration_id;
++ __le16 frame_ctl;
++ __le16 duration_id;
+ u8 addr1[ETH_ALEN];
+ u8 addr2[ETH_ALEN];
+ u8 addr3[ETH_ALEN];
+- u16 seq_ctl;
+-} __packed;
++ __le16 seq_ctl;
++} __packed __aligned(2);
+
+ struct ieee80211_hdr_qos {
+- u16 frame_ctl;
+- u16 duration_id;
++ __le16 frame_ctl;
++ __le16 duration_id;
+ u8 addr1[ETH_ALEN];
+ u8 addr2[ETH_ALEN];
+ u8 addr3[ETH_ALEN];
+- u16 seq_ctl;
++ __le16 seq_ctl;
+ u8 addr4[ETH_ALEN];
+- u16 qc;
+-} __packed;
++ __le16 qc;
++} __packed __aligned(2);
+
+ struct ieee80211_hdr_3addr_qos {
+- u16 frame_ctl;
+- u16 duration_id;
++ __le16 frame_ctl;
++ __le16 duration_id;
+ u8 addr1[ETH_ALEN];
+ u8 addr2[ETH_ALEN];
+ u8 addr3[ETH_ALEN];
+- u16 seq_ctl;
+- u16 qc;
++ __le16 seq_ctl;
++ __le16 qc;
+ } __packed;
+
+ struct eapol {
+ u8 snap[6];
+- u16 ethertype;
++ __be16 ethertype;
+ u8 version;
+ u8 type;
+- u16 length;
++ __le16 length;
+ } __packed;
+
+ enum eap_type {
+@@ -514,13 +514,13 @@ struct ieee80211_security {
+ */
+
+ struct ieee80211_header_data {
+- u16 frame_ctl;
+- u16 duration_id;
++ __le16 frame_ctl;
++ __le16 duration_id;
+ u8 addr1[6];
+ u8 addr2[6];
+ u8 addr3[6];
+- u16 seq_ctrl;
+-};
++ __le16 seq_ctrl;
++} __packed __aligned(2);
+
+ #define BEACON_PROBE_SSID_ID_POSITION 12
+
+@@ -552,18 +552,18 @@ struct ieee80211_info_element {
+ /*
+ * These are the data types that can make up management packets
+ *
+- u16 auth_algorithm;
+- u16 auth_sequence;
+- u16 beacon_interval;
+- u16 capability;
++ __le16 auth_algorithm;
++ __le16 auth_sequence;
++ __le16 beacon_interval;
++ __le16 capability;
+ u8 current_ap[ETH_ALEN];
+- u16 listen_interval;
++ __le16 listen_interval;
+ struct {
+ u16 association_id:14, reserved:2;
+ } __packed;
+- u32 time_stamp[2];
+- u16 reason;
+- u16 status;
++ __le32 time_stamp[2];
++ __le16 reason;
++ __le16 status;
+ */
+
+ #define IEEE80211_DEFAULT_TX_ESSID "Penguin"
+@@ -571,16 +571,16 @@ struct ieee80211_info_element {
+
+ struct ieee80211_authentication {
+ struct ieee80211_header_data header;
+- u16 algorithm;
+- u16 transaction;
+- u16 status;
++ __le16 algorithm;
++ __le16 transaction;
++ __le16 status;
+ } __packed;
+
+ struct ieee80211_probe_response {
+ struct ieee80211_header_data header;
+- u32 time_stamp[2];
+- u16 beacon_interval;
+- u16 capability;
++ __le32 time_stamp[2];
++ __le16 beacon_interval;
++ __le16 capability;
+ struct ieee80211_info_element info_element;
+ } __packed;
+
+@@ -590,16 +590,16 @@ struct ieee80211_probe_request {
+
+ struct ieee80211_assoc_request_frame {
+ struct ieee80211_hdr_3addr header;
+- u16 capability;
+- u16 listen_interval;
++ __le16 capability;
++ __le16 listen_interval;
+ struct ieee80211_info_element_hdr info_element;
+ } __packed;
+
+ struct ieee80211_assoc_response_frame {
+ struct ieee80211_hdr_3addr header;
+- u16 capability;
+- u16 status;
+- u16 aid;
++ __le16 capability;
++ __le16 status;
++ __le16 aid;
+ } __packed;
+
+ struct ieee80211_txb {
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Sat, 7 Oct 2017 22:36:55 +0000
+Subject: vfs: open() with O_CREAT should not create inodes with unknown ids
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+
+[ Upstream commit 1328c727004d432bbdfba0ffa02a166df04c7305 ]
+
+may_create() rejects creation of inodes with ids which lack a
+mapping into s_user_ns. However for O_CREAT may_o_create() is
+is used instead. Add a similar check there.
+
+Fixes: 036d523641c6 ("vfs: Don't create inodes with a uid or gid unknown to the vfs")
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/namei.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -2971,10 +2971,16 @@ static inline int open_to_namei_flags(in
+
+ static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)
+ {
++ struct user_namespace *s_user_ns;
+ int error = security_path_mknod(dir, dentry, mode, 0);
+ if (error)
+ return error;
+
++ s_user_ns = dir->dentry->d_sb->s_user_ns;
++ if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||
++ !kgid_has_mapping(s_user_ns, current_fsgid()))
++ return -EOVERFLOW;
++
+ error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);
+ if (error)
+ return error;
--- /dev/null
+From foo@baz Mon Nov 6 10:07:36 CET 2017
+From: Juergen Gross <jgross@suse.com>
+Date: Tue, 30 May 2017 20:52:26 +0200
+Subject: xen: don't print error message in case of missing Xenstore entry
+
+From: Juergen Gross <jgross@suse.com>
+
+
+[ Upstream commit 4e93b6481c87ea5afde944a32b4908357ec58992 ]
+
+When registering for the Xenstore watch of the node control/sysrq the
+handler will be called at once. Don't issue an error message if the
+Xenstore node isn't there, as it will be created only when an event
+is being triggered.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/manage.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -277,8 +277,16 @@ static void sysrq_handler(struct xenbus_
+ err = xenbus_transaction_start(&xbt);
+ if (err)
+ return;
+- if (xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key) < 0) {
+- pr_err("Unable to read sysrq code in control/sysrq\n");
++ err = xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key);
++ if (err < 0) {
++ /*
++ * The Xenstore watch fires directly after registering it and
++ * after a suspend/resume cycle. So ENOENT is no error but
++ * might happen in those cases.
++ */
++ if (err != -ENOENT)
++ pr_err("Error %d reading sysrq code in control/sysrq\n",
++ err);
+ xenbus_transaction_end(xbt, 1);
+ return;
+ }
--- /dev/null
+From foo@baz Mon Nov 6 10:07:35 CET 2017
+From: Jan Beulich <JBeulich@suse.com>
+Date: Sat, 7 Oct 2017 22:36:53 +0000
+Subject: xen/manage: correct return value check on xenbus_scanf()
+
+From: Jan Beulich <JBeulich@suse.com>
+
+
+[ Upstream commit 4fed1b125eb6252bde478665fc05d4819f774fa8 ]
+
+A negative return value indicates an error; in fact the function at
+present won't ever return zero.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/manage.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -277,7 +277,7 @@ static void sysrq_handler(struct xenbus_
+ err = xenbus_transaction_start(&xbt);
+ if (err)
+ return;
+- if (!xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key)) {
++ if (xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key) < 0) {
+ pr_err("Unable to read sysrq code in control/sysrq\n");
+ xenbus_transaction_end(xbt, 1);
+ return;
projects / thirdparty / kernel / stable-queue.git / commitdiff
