--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Vinod Koul <vinod.koul@intel.com>
+Date: Mon, 27 Feb 2017 21:19:44 +0530
+Subject: ALSA: hda: Add Geminilake HDMI codec ID
+
+From: Vinod Koul <vinod.koul@intel.com>
+
+
+[ Upstream commit 126cfa2f5e15ae2ca7f70be71b07e6cd8d2b44d1 ]
+
+Geminilake HDMI codec 0x280d is similar to previous platforms, so add it with
+similar ops as previous.
+
+Signed-off-by: Senthilnathan Veppur <senthilnathanx.veppur@intel.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3685,6 +3685,7 @@ HDA_CODEC_ENTRY(0x80862808, "Broadwell H
+ HDA_CODEC_ENTRY(0x80862809, "Skylake HDMI", patch_i915_hsw_hdmi),
+ HDA_CODEC_ENTRY(0x8086280a, "Broxton HDMI", patch_i915_hsw_hdmi),
+ HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI", patch_i915_hsw_hdmi),
++HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_hsw_hdmi),
+ HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi),
+ HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi),
+ HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI", patch_i915_byt_hdmi),
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 21 Feb 2017 23:00:46 +0100
+Subject: ASoC: mediatek: add I2C dependency for CS42XX8
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 72cedf599fcebfd6cd2550274d7855838068d28c ]
+
+We should not select drivers that depend on I2C when that is disabled,
+as it results in a build error:
+
+warning: (SND_SOC_MT2701_CS42448) selects SND_SOC_CS42XX8_I2C which has unmet direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && I2C)
+sound/soc/codecs/cs42xx8-i2c.c:60:1: warning: data definition has no type or storage class
+ module_i2c_driver(cs42xx8_i2c_driver);
+sound/soc/codecs/cs42xx8-i2c.c:60:1: error: type defaults to 'int' in declaration of 'module_i2c_driver' [-Werror=implicit-int]
+
+Fixes: 1f458d53f76c ("ASoC: mediatek: Add mt2701-cs42448 driver and config option.")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/mediatek/Kconfig
++++ b/sound/soc/mediatek/Kconfig
+@@ -13,7 +13,7 @@ config SND_SOC_MT2701
+
+ config SND_SOC_MT2701_CS42448
+ tristate "ASoc Audio driver for MT2701 with CS42448 codec"
+- depends on SND_SOC_MT2701
++ depends on SND_SOC_MT2701 && I2C
+ select SND_SOC_CS42XX8_I2C
+ select SND_SOC_BT_SCO
+ help
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Jeffy Chen <jeffy.chen@rock-chips.com>
+Date: Mon, 23 Jan 2017 12:18:51 +0800
+Subject: btmrvl: avoid double-disable_irq() race
+
+From: Jeffy Chen <jeffy.chen@rock-chips.com>
+
+
+[ Upstream commit 9af02d86e11dc409e5c3de46e81c0a492ba58905 ]
+
+It's much the same as what we did for mwifiex in:
+b9da4d2 mwifiex: avoid double-disable_irq() race
+
+"We have a race where the wakeup IRQ might be in flight while we're
+calling mwifiex_disable_wake() from resume(). This can leave us
+disabling the IRQ twice.
+
+Let's disable the IRQ and enable it in case if we have double-disabled
+it."
+
+Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btmrvl_sdio.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/bluetooth/btmrvl_sdio.c
++++ b/drivers/bluetooth/btmrvl_sdio.c
+@@ -1682,8 +1682,12 @@ static int btmrvl_sdio_resume(struct dev
+ /* Disable platform specific wakeup interrupt */
+ if (card->plt_wake_cfg && card->plt_wake_cfg->irq_bt >= 0) {
+ disable_irq_wake(card->plt_wake_cfg->irq_bt);
+- if (!card->plt_wake_cfg->wake_by_bt)
+- disable_irq(card->plt_wake_cfg->irq_bt);
++ disable_irq(card->plt_wake_cfg->irq_bt);
++ if (card->plt_wake_cfg->wake_by_bt)
++ /* Undo our disable, since interrupt handler already
++ * did this.
++ */
++ enable_irq(card->plt_wake_cfg->irq_bt);
+ }
+
+ return 0;
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Robbie Ko <robbieko@synology.com>
+Date: Thu, 5 Jan 2017 16:24:55 +0800
+Subject: Btrfs: send, fix failure to rename top level inode due to name collision
+
+From: Robbie Ko <robbieko@synology.com>
+
+
+[ Upstream commit 4dd9920d991745c4a16f53a8f615f706fbe4b3f7 ]
+
+Under certain situations, an incremental send operation can fail due to a
+premature attempt to create a new top level inode (a direct child of the
+subvolume/snapshot root) whose name collides with another inode that was
+removed from the send snapshot.
+
+Consider the following example scenario.
+
+Parent snapshot:
+
+ . (ino 256, gen 8)
+ |---- a1/ (ino 257, gen 9)
+ |---- a2/ (ino 258, gen 9)
+
+Send snapshot:
+
+ . (ino 256, gen 3)
+ |---- a2/ (ino 257, gen 7)
+
+In this scenario, when receiving the incremental send stream, the btrfs
+receive command fails like this (ran in verbose mode, -vv argument):
+
+ rmdir a1
+ mkfile o257-7-0
+ rename o257-7-0 -> a2
+ ERROR: rename o257-7-0 -> a2 failed: Is a directory
+
+What happens when computing the incremental send stream is:
+
+1) An operation to remove the directory with inode number 257 and
+ generation 9 is issued.
+
+2) An operation to create the inode with number 257 and generation 7 is
+ issued. This creates the inode with an orphanized name of "o257-7-0".
+
+3) An operation rename the new inode 257 to its final name, "a2", is
+ issued. This is incorrect because inode 258, which has the same name
+ and it's a child of the same parent (root inode 256), was not yet
+ processed and therefore no rmdir operation for it was yet issued.
+ The rename operation is issued because we fail to detect that the
+ name of the new inode 257 collides with inode 258, because their
+ parent, a subvolume/snapshot root (inode 256) has a different
+ generation in both snapshots.
+
+So fix this by ignoring the generation value of a parent directory that
+matches a root inode (number 256) when we are checking if the name of the
+inode currently being processed collides with the name of some other
+inode that was not yet processed.
+
+We can achieve this scenario of different inodes with the same number but
+different generation values either by mounting a filesystem with the inode
+cache option (-o inode_cache) or by creating and sending snapshots across
+different filesystems, like in the following example:
+
+ $ mkfs.btrfs -f /dev/sdb
+ $ mount /dev/sdb /mnt
+ $ mkdir /mnt/a1
+ $ mkdir /mnt/a2
+ $ btrfs subvolume snapshot -r /mnt /mnt/snap1
+ $ btrfs send /mnt/snap1 -f /tmp/1.snap
+ $ umount /mnt
+
+ $ mkfs.btrfs -f /dev/sdc
+ $ mount /dev/sdc /mnt
+ $ touch /mnt/a2
+ $ btrfs subvolume snapshot -r /mnt /mnt/snap2
+ $ btrfs receive /mnt -f /tmp/1.snap
+ # Take note that once the filesystem is created, its current
+ # generation has value 7 so the inode from the second snapshot has
+ # a generation value of 7. And after receiving the first snapshot
+ # the filesystem is at a generation value of 10, because the call to
+ # create the second snapshot bumps the generation to 8 (the snapshot
+ # creation ioctl does a transaction commit), the receive command calls
+ # the snapshot creation ioctl to create the first snapshot, which bumps
+ # the filesystem's generation to 9, and finally when the receive
+ # operation finishes it calls an ioctl to transition the first snapshot
+ # (snap1) from RW mode to RO mode, which does another transaction commit
+ # and bumps the filesystem's generation to 10.
+ $ rm -f /tmp/1.snap
+ $ btrfs send /mnt/snap1 -f /tmp/1.snap
+ $ btrfs send -p /mnt/snap1 /mnt/snap2 -f /tmp/2.snap
+ $ umount /mnt
+
+ $ mkfs.btrfs -f /dev/sdd
+ $ mount /dev/sdd /mnt
+ $ btrfs receive /mnt /tmp/1.snap
+ # Receive of snapshot snap2 used to fail.
+ $ btrfs receive /mnt /tmp/2.snap
+
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+[Rewrote changelog to be more precise and clear]
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/send.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -1680,6 +1680,9 @@ static int is_inode_existent(struct send
+ {
+ int ret;
+
++ if (ino == BTRFS_FIRST_FREE_OBJECTID)
++ return 1;
++
+ ret = get_cur_inode_state(sctx, ino, gen);
+ if (ret < 0)
+ goto out;
+@@ -1865,7 +1868,7 @@ static int will_overwrite_ref(struct sen
+ * not deleted and then re-created, if it was then we have no overwrite
+ * and we can just unlink this entry.
+ */
+- if (sctx->parent_root) {
++ if (sctx->parent_root && dir != BTRFS_FIRST_FREE_OBJECTID) {
+ ret = get_inode_info(sctx->parent_root, dir, NULL, &gen, NULL,
+ NULL, NULL, NULL);
+ if (ret < 0 && ret != -ENOENT)
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 15 Dec 2016 08:37:57 -0500
+Subject: ceph: clean up unsafe d_parent accesses in build_dentry_path
+
+From: Jeff Layton <jlayton@redhat.com>
+
+
+[ Upstream commit c6b0b656ca24ede6657abb4a2cd910fa9c1879ba ]
+
+While we hold a reference to the dentry when build_dentry_path is
+called, we could end up racing with a rename that changes d_parent.
+Handle that situation correctly, by using the rcu_read_lock to
+ensure that the parent dentry and inode stick around long enough
+to safely check ceph_snap and ceph_ino.
+
+Link: http://tracker.ceph.com/issues/18148
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Reviewed-by: Yan, Zheng <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/mds_client.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1782,13 +1782,18 @@ static int build_dentry_path(struct dent
+ int *pfreepath)
+ {
+ char *path;
++ struct inode *dir;
+
+- if (ceph_snap(d_inode(dentry->d_parent)) == CEPH_NOSNAP) {
+- *pino = ceph_ino(d_inode(dentry->d_parent));
++ rcu_read_lock();
++ dir = d_inode_rcu(dentry->d_parent);
++ if (dir && ceph_snap(dir) == CEPH_NOSNAP) {
++ *pino = ceph_ino(dir);
++ rcu_read_unlock();
+ *ppath = dentry->d_name.name;
+ *ppathlen = dentry->d_name.len;
+ return 0;
+ }
++ rcu_read_unlock();
+ path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1);
+ if (IS_ERR(path))
+ return PTR_ERR(path);
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 26 Jan 2017 16:14:18 -0500
+Subject: ceph: don't update_dentry_lease unless we actually got one
+
+From: Jeff Layton <jlayton@redhat.com>
+
+
+[ Upstream commit 80d025ffede88969f6adf7266fbdedfd5641148a ]
+
+This if block updates the dentry lease even in the case where
+the MDS didn't grant one.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Reviewed-by: Yan, Zheng <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1323,8 +1323,8 @@ retry_lookup:
+ ceph_dir_clear_ordered(dir);
+ dout("d_delete %p\n", dn);
+ d_delete(dn);
+- } else {
+- if (have_lease && d_unhashed(dn))
++ } else if (have_lease) {
++ if (d_unhashed(dn))
+ d_add(dn, NULL);
+ update_dentry_lease(dn, rinfo->dlease,
+ session,
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Jeff Layton <jlayton@redhat.com>
+Date: Thu, 12 Jan 2017 14:42:40 -0500
+Subject: ceph: fix bogus endianness change in ceph_ioctl_set_layout
+
+From: Jeff Layton <jlayton@redhat.com>
+
+
+[ Upstream commit 24c149ad6914d349d8b64749f20f3f8ea5031fe0 ]
+
+sparse says:
+
+ fs/ceph/ioctl.c:100:28: warning: cast to restricted __le64
+
+preferred_osd is a __s64 so we don't need to do any conversion. Also,
+just remove the cast in ceph_ioctl_get_layout as it's not needed.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Reviewed-by: Sage Weil <sage@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ceph/ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ceph/ioctl.c
++++ b/fs/ceph/ioctl.c
+@@ -25,7 +25,7 @@ static long ceph_ioctl_get_layout(struct
+ l.stripe_count = ci->i_layout.stripe_count;
+ l.object_size = ci->i_layout.object_size;
+ l.data_pool = ci->i_layout.pool_id;
+- l.preferred_osd = (s32)-1;
++ l.preferred_osd = -1;
+ if (copy_to_user(arg, &l, sizeof(l)))
+ return -EFAULT;
+ }
+@@ -97,7 +97,7 @@ static long ceph_ioctl_set_layout(struct
+ nl.data_pool = ci->i_layout.pool_id;
+
+ /* this is obsolete, and always -1 */
+- nl.preferred_osd = le64_to_cpu(-1);
++ nl.preferred_osd = -1;
+
+ err = __validate_layout(mdsc, &nl);
+ if (err)
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 14 Feb 2017 22:19:18 +0100
+Subject: cpufreq: CPPC: add ACPI_PROCESSOR dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit a578884fa0d2768f13d37c6591a9e1ed600482d3 ]
+
+Without the Kconfig dependency, we can get this warning:
+
+warning: ACPI_CPPC_CPUFREQ selects ACPI_CPPC_LIB which has unmet direct dependencies (ACPI && ACPI_PROCESSOR)
+
+Fixes: 5477fb3bd1e8 (ACPI / CPPC: Add a CPUFreq driver for use with CPPC)
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/Kconfig.arm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/Kconfig.arm
++++ b/drivers/cpufreq/Kconfig.arm
+@@ -244,7 +244,7 @@ config ARM_PXA2xx_CPUFREQ
+
+ config ACPI_CPPC_CPUFREQ
+ tristate "CPUFreq driver based on the ACPI CPPC spec"
+- depends on ACPI
++ depends on ACPI_PROCESSOR
+ select ACPI_CPPC_LIB
+ default n
+ help
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Milan Broz <gmazyland@gmail.com>
+Date: Thu, 23 Feb 2017 08:38:26 +0100
+Subject: crypto: xts - Add ECB dependency
+
+From: Milan Broz <gmazyland@gmail.com>
+
+
+[ Upstream commit 12cb3a1c4184f891d965d1f39f8cfcc9ef617647 ]
+
+Since the
+ commit f1c131b45410a202eb45cc55980a7a9e4e4b4f40
+ crypto: xts - Convert to skcipher
+the XTS mode is based on ECB, so the mode must select
+ECB otherwise it can fail to initialize.
+
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -360,6 +360,7 @@ config CRYPTO_XTS
+ select CRYPTO_BLKCIPHER
+ select CRYPTO_MANAGER
+ select CRYPTO_GF128MUL
++ select CRYPTO_ECB
+ help
+ XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain,
+ key size 256, 384 or 512 bits. This implementation currently
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Nicolai Hähnle <nicolai.haehnle@amd.com>
+Date: Thu, 16 Feb 2017 23:49:12 +0100
+Subject: drm/amdgpu: refuse to reserve io mem for split VRAM buffers
+
+From: Nicolai Hähnle <nicolai.haehnle@amd.com>
+
+
+[ Upstream commit 4694335dad7357e9b3d7822ab13049014d74d8b0 ]
+
+When the fast blit path fails while attempting to move a buffer from RAM
+to VRAM, we fall back to a CPU-based memcpy that cannot handle split VRAM
+buffers. Instead of crashing, simply fail the buffer move.
+
+Ideally, we would teach TTM about split buffers so that the fallback still
+works in this case, but that is quite involved. So for now, apply the
+simplest possible fix.
+
+Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2")
+Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -491,6 +491,9 @@ static int amdgpu_ttm_io_mem_reserve(str
+ case TTM_PL_TT:
+ break;
+ case TTM_PL_VRAM:
++ if (mem->start == AMDGPU_BO_INVALID_OFFSET)
++ return -EINVAL;
++
+ mem->bus.offset = mem->start << PAGE_SHIFT;
+ /* check if it's visible */
+ if ((mem->bus.offset + mem->bus.size) > adev->mc.visible_vram_size)
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Thu, 22 Dec 2016 10:07:49 +1000
+Subject: drm/nouveau/gr/gf100-: fix ccache error logging
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+
+[ Upstream commit 1894054dc1b6e4395048b2c0f28832a3f4320fd3 ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -1129,7 +1129,7 @@ gf100_gr_trap_intr(struct gf100_gr *gr)
+ if (trap & 0x00000008) {
+ u32 stat = nvkm_rd32(device, 0x408030);
+
+- nvkm_snprintbf(error, sizeof(error), gf100_m2mf_error,
++ nvkm_snprintbf(error, sizeof(error), gf100_ccache_error,
+ stat & 0x3fffffff);
+ nvkm_error(subdev, "CCACHE %08x [%s]\n", stat, error);
+ nvkm_wr32(device, 0x408030, 0xc0000000);
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Date: Wed, 15 Feb 2017 14:56:22 -0600
+Subject: EDAC, mce_amd: Print IPID and Syndrome on a separate line
+
+From: Yazen Ghannam <Yazen.Ghannam@amd.com>
+
+
+[ Upstream commit 75bf2f6478cab9b0c1d7f5f674a765d1e2ad530e ]
+
+Currently, the IPID and Syndrome are printed on the same line as the
+Address. There are cases when we can have a valid Syndrome but not a
+valid Address.
+
+For example, the MCA_SYND register can be used to hold more detailed
+error info that the hardware folks can use. It's not just DRAM ECC
+syndromes. There are some error types that aren't related to memory that
+may have valid syndromes, like some errors related to links in the Data
+Fabric, etc.
+
+In these cases, the IPID and Syndrome are not printed at the same log
+level as the rest of the stanza, so users won't see them on the console.
+
+Console:
+ [Hardware Error]: CPU:16 (17:1:0) MC22_STATUS[Over|CE|MiscV|-|-|-|-|SyndV|-]: 0xd82000000002080b
+ [Hardware Error]: Power, Interrupts, etc. Extended Error Code: 2
+
+Dmesg:
+ [Hardware Error]: CPU:16 (17:1:0) MC22_STATUS[Over|CE|MiscV|-|-|-|-|SyndV|-]: 0xd82000000002080b
+ , Syndrome: 0x000000010b404000, IPID: 0x0001002e00000002
+ [Hardware Error]: Power, Interrupts, etc. Extended Error Code: 2
+
+Print the IPID first and on a new line. The IPID should always be
+printed on SMCA systems. The Syndrome will then be printed with the IPID
+and at the same log level when valid:
+
+ [Hardware Error]: CPU:16 (17:1:0) MC22_STATUS[Over|CE|MiscV|-|-|-|-|SyndV|-]: 0xd82000000002080b
+ [Hardware Error]: IPID: 0x0001002e00000002, Syndrome: 0x000000010b404000
+ [Hardware Error]: Power, Interrupts, etc. Extended Error Code: 2
+
+Signed-off-by: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/1487192182-2474-1-git-send-email-Yazen.Ghannam@amd.com
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/edac/mce_amd.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/edac/mce_amd.c
++++ b/drivers/edac/mce_amd.c
+@@ -981,20 +981,19 @@ int amd_decode_mce(struct notifier_block
+ pr_cont("]: 0x%016llx\n", m->status);
+
+ if (m->status & MCI_STATUS_ADDRV)
+- pr_emerg(HW_ERR "Error Addr: 0x%016llx", m->addr);
++ pr_emerg(HW_ERR "Error Addr: 0x%016llx\n", m->addr);
+
+ if (boot_cpu_has(X86_FEATURE_SMCA)) {
++ pr_emerg(HW_ERR "IPID: 0x%016llx", m->ipid);
++
+ if (m->status & MCI_STATUS_SYNDV)
+ pr_cont(", Syndrome: 0x%016llx", m->synd);
+
+- pr_cont(", IPID: 0x%016llx", m->ipid);
+-
+ pr_cont("\n");
+
+ decode_smca_errors(m);
+ goto err_code;
+- } else
+- pr_cont("\n");
++ }
+
+ if (!fam_ops)
+ goto err_code;
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Fri, 17 Feb 2017 09:55:55 -0800
+Subject: f2fs: do not wait for writeback in write_begin
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+
+[ Upstream commit 86d54795c94532075d862aa0a79f0c981dab4bdd ]
+
+Otherwise we can get livelock like below.
+
+[79880.428136] dbench D 0 18405 18404 0x00000000
+[79880.428139] Call Trace:
+[79880.428142] __schedule+0x219/0x6b0
+[79880.428144] schedule+0x36/0x80
+[79880.428147] schedule_timeout+0x243/0x2e0
+[79880.428152] ? update_sd_lb_stats+0x16b/0x5f0
+[79880.428155] ? ktime_get+0x3c/0xb0
+[79880.428157] io_schedule_timeout+0xa6/0x110
+[79880.428161] __lock_page+0xf7/0x130
+[79880.428164] ? unlock_page+0x30/0x30
+[79880.428167] pagecache_get_page+0x16b/0x250
+[79880.428171] grab_cache_page_write_begin+0x20/0x40
+[79880.428182] f2fs_write_begin+0xa2/0xdb0 [f2fs]
+[79880.428192] ? f2fs_mark_inode_dirty_sync+0x16/0x30 [f2fs]
+[79880.428197] ? kmem_cache_free+0x79/0x200
+[79880.428203] ? __mark_inode_dirty+0x17f/0x360
+[79880.428206] generic_perform_write+0xbb/0x190
+[79880.428213] ? file_update_time+0xa4/0xf0
+[79880.428217] __generic_file_write_iter+0x19b/0x1e0
+[79880.428226] f2fs_file_write_iter+0x9c/0x180 [f2fs]
+[79880.428231] __vfs_write+0xc5/0x140
+[79880.428235] vfs_write+0xb2/0x1b0
+[79880.428238] SyS_write+0x46/0xa0
+[79880.428242] entry_SYSCALL_64_fastpath+0x1e/0xad
+
+Fixes: cae96a5c8ab6 ("f2fs: check io submission more precisely")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1619,7 +1619,12 @@ static int f2fs_write_begin(struct file
+ goto fail;
+ }
+ repeat:
+- page = grab_cache_page_write_begin(mapping, index, flags);
++ /*
++ * Do not use grab_cache_page_write_begin() to avoid deadlock due to
++ * wait_for_stable_page. Will wait that below with our IO control.
++ */
++ page = pagecache_get_page(mapping, index,
++ FGP_LOCK | FGP_WRITE | FGP_CREAT, GFP_NOFS);
+ if (!page) {
+ err = -ENOMEM;
+ goto fail;
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Yunlong Song <yunlong.song@huawei.com>
+Date: Wed, 22 Feb 2017 20:50:49 +0800
+Subject: f2fs: do SSR for data when there is enough free space
+
+From: Yunlong Song <yunlong.song@huawei.com>
+
+
+[ Upstream commit 035e97adab26c1121cedaeb9bd04cf48a8e8cf51 ]
+
+In allocate_segment_by_default(), need_SSR() already detected it's time to do
+SSR. So, let's try to find victims for data segments more aggressively in time.
+
+Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/segment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1263,7 +1263,7 @@ static int get_ssr_segment(struct f2fs_s
+ struct curseg_info *curseg = CURSEG_I(sbi, type);
+ const struct victim_selection *v_ops = DIRTY_I(sbi)->v_ops;
+
+- if (IS_NODESEG(type) || !has_not_enough_free_secs(sbi, 0, 0))
++ if (IS_NODESEG(type))
+ return v_ops->get_victim(sbi,
+ &(curseg)->next_segno, BG_GC, type, SSR);
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 15 Jan 2016 17:41:09 +0000
+Subject: hrtimer: Catch invalid clockids again
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+
+[ Upstream commit 336a9cde10d641e70bac67d90ae91b3190c3edca ]
+
+commit 82e88ff1ea94 ("hrtimer: Revert CLOCK_MONOTONIC_RAW support") removed
+unfortunately a sanity check in the hrtimer code which was part of that
+MONOTONIC_RAW patch series.
+
+It would have caught the bogus usage of CLOCK_MONOTONIC_RAW in the wireless
+code. So bring it back.
+
+It is way too easy to take any random clockid and feed it to the hrtimer
+subsystem. At best, it gets mapped to a monotonic base, but it would be
+better to just catch illegal values as early as possible.
+
+Detect invalid clockids, map them to CLOCK_MONOTONIC and emit a warning.
+
+[ tglx: Replaced the BUG by a WARN and gracefully map to CLOCK_MONOTONIC ]
+
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Tomasz Nowicki <tn@semihalf.com>
+Cc: Christoffer Dall <christoffer.dall@linaro.org>
+Link: http://lkml.kernel.org/r/1452879670-16133-3-git-send-email-marc.zyngier@arm.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/hrtimer.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -94,17 +94,15 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base,
+ };
+
+ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = {
++ /* Make sure we catch unsupported clockids */
++ [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES,
++
+ [CLOCK_REALTIME] = HRTIMER_BASE_REALTIME,
+ [CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC,
+ [CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME,
+ [CLOCK_TAI] = HRTIMER_BASE_TAI,
+ };
+
+-static inline int hrtimer_clockid_to_base(clockid_t clock_id)
+-{
+- return hrtimer_clock_to_base_table[clock_id];
+-}
+-
+ /*
+ * Functions and macros which are different for UP/SMP systems are kept in a
+ * single place
+@@ -1112,6 +1110,18 @@ u64 hrtimer_get_next_event(void)
+ }
+ #endif
+
++static inline int hrtimer_clockid_to_base(clockid_t clock_id)
++{
++ if (likely(clock_id < MAX_CLOCKS)) {
++ int base = hrtimer_clock_to_base_table[clock_id];
++
++ if (likely(base != HRTIMER_MAX_CLOCK_BASES))
++ return base;
++ }
++ WARN(1, "Invalid clockid %d. Using MONOTONIC\n", clock_id);
++ return HRTIMER_BASE_MONOTONIC;
++}
++
+ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
+ enum hrtimer_mode mode)
+ {
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Thu, 16 Feb 2017 18:27:59 +0100
+Subject: i2c: at91: ensure state is restored after suspending
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+
+[ Upstream commit e3ccc921b7d8fd1fcd10a00720e09823d8078666 ]
+
+When going to suspend, the I2C registers may be lost because the power to
+VDDcore is cut. Restore them when resuming.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-at91.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -1180,6 +1180,7 @@ static int at91_twi_suspend_noirq(struct
+
+ static int at91_twi_resume_noirq(struct device *dev)
+ {
++ struct at91_twi_dev *twi_dev = dev_get_drvdata(dev);
+ int ret;
+
+ if (!pm_runtime_status_suspended(dev)) {
+@@ -1191,6 +1192,8 @@ static int at91_twi_resume_noirq(struct
+ pm_runtime_mark_last_busy(dev);
+ pm_request_autosuspend(dev);
+
++ at91_init_twi_bus(twi_dev);
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Sebastian Sanchez <sebastian.sanchez@intel.com>
+Date: Wed, 8 Feb 2017 05:26:37 -0800
+Subject: IB/hfi1: Allocate context data on memory node
+
+From: Sebastian Sanchez <sebastian.sanchez@intel.com>
+
+
+[ Upstream commit b448bf9a0df6093dbadac36979a55ce4e012a677 ]
+
+There are some memory allocation calls in hfi1_create_ctxtdata()
+that do not use the numa function parameter. This
+can cause cache lines to be filled over QPI.
+
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Sebastian Sanchez <sebastian.sanchez@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hfi1/init.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -297,14 +297,15 @@ struct hfi1_ctxtdata *hfi1_create_ctxtda
+ * The resulting value will be rounded down to the closest
+ * multiple of dd->rcv_entries.group_size.
+ */
+- rcd->egrbufs.buffers = kcalloc(rcd->egrbufs.count,
+- sizeof(*rcd->egrbufs.buffers),
+- GFP_KERNEL);
++ rcd->egrbufs.buffers = kzalloc_node(
++ rcd->egrbufs.count * sizeof(*rcd->egrbufs.buffers),
++ GFP_KERNEL, numa);
+ if (!rcd->egrbufs.buffers)
+ goto bail;
+- rcd->egrbufs.rcvtids = kcalloc(rcd->egrbufs.count,
+- sizeof(*rcd->egrbufs.rcvtids),
+- GFP_KERNEL);
++ rcd->egrbufs.rcvtids = kzalloc_node(
++ rcd->egrbufs.count *
++ sizeof(*rcd->egrbufs.rcvtids),
++ GFP_KERNEL, numa);
+ if (!rcd->egrbufs.rcvtids)
+ goto bail;
+ rcd->egrbufs.size = eager_buffer_size;
+@@ -322,8 +323,8 @@ struct hfi1_ctxtdata *hfi1_create_ctxtda
+ rcd->egrbufs.rcvtid_size = HFI1_MAX_EAGER_BUFFER_SIZE;
+
+ if (ctxt < dd->first_user_ctxt) { /* N/A for PSM contexts */
+- rcd->opstats = kzalloc(sizeof(*rcd->opstats),
+- GFP_KERNEL);
++ rcd->opstats = kzalloc_node(sizeof(*rcd->opstats),
++ GFP_KERNEL, numa);
+ if (!rcd->opstats)
+ goto bail;
+ }
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Easwar Hariharan <easwar.hariharan@intel.com>
+Date: Wed, 8 Feb 2017 05:26:14 -0800
+Subject: IB/hfi1: Use static CTLE with Preset 6 for integrated HFIs
+
+From: Easwar Hariharan <easwar.hariharan@intel.com>
+
+
+[ Upstream commit 39e2afa8d042a53d855137d4c5a689a6f5492b39 ]
+
+After extended testing, it was found that the previous PCIe Gen
+3 recipe, which used adaptive CTLE with Preset 4, could cause an
+NMI/Surprise Link Down in about 1 in 100 to 1 in 1000 power cycles on
+some platforms. New EV data combined with extensive empirical data
+indicates that the new recipe should use static CTLE with Preset 6 for
+all integrated silicon SKUs.
+
+Fixes: c3f8de0b334c ("IB/hfi1: Add static PCIe Gen3 CTLE tuning")
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Easwar Hariharan <easwar.hariharan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hfi1/pcie.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/pcie.c
++++ b/drivers/infiniband/hw/hfi1/pcie.c
+@@ -673,12 +673,12 @@ MODULE_PARM_DESC(pcie_retry, "Driver wil
+
+ #define UNSET_PSET 255
+ #define DEFAULT_DISCRETE_PSET 2 /* discrete HFI */
+-#define DEFAULT_MCP_PSET 4 /* MCP HFI */
++#define DEFAULT_MCP_PSET 6 /* MCP HFI */
+ static uint pcie_pset = UNSET_PSET;
+ module_param(pcie_pset, uint, S_IRUGO);
+ MODULE_PARM_DESC(pcie_pset, "PCIe Eq Pset value to use, range is 0-10");
+
+-static uint pcie_ctle = 1; /* discrete on, integrated off */
++static uint pcie_ctle = 3; /* discrete on, integrated on */
+ module_param(pcie_ctle, uint, S_IRUGO);
+ MODULE_PARM_DESC(pcie_ctle, "PCIe static CTLE mode, bit 0 - discrete on/off, bit 1 - integrated on/off");
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Tue, 21 Feb 2017 07:34:00 +0100
+Subject: iio: adc: xilinx: Fix error handling
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit ca1c39ef76376b67303d01f94fe98bb68bb3861a ]
+
+Reorder error handling labels in order to match the way resources have
+been allocated.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/xilinx-xadc-core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/adc/xilinx-xadc-core.c
++++ b/drivers/iio/adc/xilinx-xadc-core.c
+@@ -1208,7 +1208,7 @@ static int xadc_probe(struct platform_de
+
+ ret = xadc->ops->setup(pdev, indio_dev, irq);
+ if (ret)
+- goto err_free_samplerate_trigger;
++ goto err_clk_disable_unprepare;
+
+ ret = request_irq(irq, xadc->ops->interrupt_handler, 0,
+ dev_name(&pdev->dev), indio_dev);
+@@ -1268,6 +1268,8 @@ static int xadc_probe(struct platform_de
+
+ err_free_irq:
+ free_irq(irq, indio_dev);
++err_clk_disable_unprepare:
++ clk_disable_unprepare(xadc->clk);
+ err_free_samplerate_trigger:
+ if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
+ iio_trigger_free(xadc->samplerate_trigger);
+@@ -1277,8 +1279,6 @@ err_free_convst_trigger:
+ err_triggered_buffer_cleanup:
+ if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
+ iio_triggered_buffer_cleanup(indio_dev);
+-err_clk_disable_unprepare:
+- clk_disable_unprepare(xadc->clk);
+ err_device_free:
+ kfree(indio_dev->channels);
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Lokesh Vutla <lokeshvutla@ti.com>
+Date: Mon, 27 Feb 2017 14:28:12 -0800
+Subject: initramfs: finish fput() before accessing any binary from initramfs
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+
+[ Upstream commit 08865514805d2de8e7002fa8149c5de3e391f412 ]
+
+Commit 4a9d4b024a31 ("switch fput to task_work_add") implements a
+schedule_work() for completing fput(), but did not guarantee calling
+__fput() after unpacking initramfs. Because of this, there is a
+possibility that during boot a driver can see ETXTBSY when it tries to
+load a binary from initramfs as fput() is still pending on that binary.
+
+This patch makes sure that fput() is completed after unpacking initramfs
+and removes the call to flush_delayed_fput() in kernel_init() which
+happens very late after unpacking initramfs.
+
+Link: http://lkml.kernel.org/r/20170201140540.22051-1-lokeshvutla@ti.com
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Reported-by: Murali Karicheri <m-karicheri2@ti.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Tero Kristo <t-kristo@ti.com>
+Cc: Sekhar Nori <nsekhar@ti.com>
+Cc: Nishanth Menon <nm@ti.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ init/initramfs.c | 2 ++
+ init/main.c | 3 ---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+--- a/init/initramfs.c
++++ b/init/initramfs.c
+@@ -18,6 +18,7 @@
+ #include <linux/dirent.h>
+ #include <linux/syscalls.h>
+ #include <linux/utime.h>
++#include <linux/file.h>
+
+ static ssize_t __init xwrite(int fd, const char *p, size_t count)
+ {
+@@ -647,6 +648,7 @@ static int __init populate_rootfs(void)
+ printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err);
+ free_initrd();
+ #endif
++ flush_delayed_fput();
+ /*
+ * Try loading default modules from initramfs. This gives
+ * us a chance to load before device_initcalls.
+--- a/init/main.c
++++ b/init/main.c
+@@ -70,7 +70,6 @@
+ #include <linux/shmem_fs.h>
+ #include <linux/slab.h>
+ #include <linux/perf_event.h>
+-#include <linux/file.h>
+ #include <linux/ptrace.h>
+ #include <linux/blkdev.h>
+ #include <linux/elevator.h>
+@@ -947,8 +946,6 @@ static int __ref kernel_init(void *unuse
+ system_state = SYSTEM_RUNNING;
+ numa_default_policy();
+
+- flush_delayed_fput();
+-
+ rcu_end_inkernel_boot();
+
+ if (ramdisk_execute_command) {
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Franck Demathieu <fdemathieu@gmail.com>
+Date: Thu, 23 Feb 2017 10:48:55 +0100
+Subject: irqchip/crossbar: Fix incorrect type of local variables
+
+From: Franck Demathieu <fdemathieu@gmail.com>
+
+
+[ Upstream commit b28ace12661fbcfd90959c1e84ff5a85113a82a1 ]
+
+The max and entry variables are unsigned according to the dt-bindings.
+Fix following 3 sparse issues (-Wtypesign):
+
+ drivers/irqchip/irq-crossbar.c:222:52: warning: incorrect type in argument 3 (different signedness)
+ drivers/irqchip/irq-crossbar.c:222:52: expected unsigned int [usertype] *out_value
+ drivers/irqchip/irq-crossbar.c:222:52: got int *<noident>
+
+ drivers/irqchip/irq-crossbar.c:245:56: warning: incorrect type in argument 4 (different signedness)
+ drivers/irqchip/irq-crossbar.c:245:56: expected unsigned int [usertype] *out_value
+ drivers/irqchip/irq-crossbar.c:245:56: got int *<noident>
+
+ drivers/irqchip/irq-crossbar.c:263:56: warning: incorrect type in argument 4 (different signedness)
+ drivers/irqchip/irq-crossbar.c:263:56: expected unsigned int [usertype] *out_value
+ drivers/irqchip/irq-crossbar.c:263:56: got int *<noident>
+
+Signed-off-by: Franck Demathieu <fdemathieu@gmail.com>
+Cc: marc.zyngier@arm.com
+Cc: jason@lakedaemon.net
+Link: http://lkml.kernel.org/r/20170223094855.6546-1-fdemathieu@gmail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-crossbar.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-crossbar.c
++++ b/drivers/irqchip/irq-crossbar.c
+@@ -198,7 +198,8 @@ static const struct irq_domain_ops cross
+
+ static int __init crossbar_of_init(struct device_node *node)
+ {
+- int i, size, max = 0, reserved = 0, entry;
++ int i, size, reserved = 0;
++ u32 max = 0, entry;
+ const __be32 *irqsr;
+ int ret = -ENOMEM;
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 1 Mar 2017 16:23:30 +0100
+Subject: locking/lockdep: Add nest_lock integrity test
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+
+[ Upstream commit 7fb4a2cea6b18dab56d609530d077f168169ed6b ]
+
+Boqun reported that hlock->references can overflow. Add a debug test
+for that to generate a clear error when this happens.
+
+Without this, lockdep is likely to report a mysterious failure on
+unlock.
+
+Reported-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Nicolai Hähnle <Nicolai.Haehnle@amd.com>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3260,10 +3260,17 @@ static int __lock_acquire(struct lockdep
+ if (depth) {
+ hlock = curr->held_locks + depth - 1;
+ if (hlock->class_idx == class_idx && nest_lock) {
+- if (hlock->references)
++ if (hlock->references) {
++ /*
++ * Check: unsigned int references:12, overflow.
++ */
++ if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
++ return 0;
++
+ hlock->references++;
+- else
++ } else {
+ hlock->references = 2;
++ }
+
+ return 1;
+ }
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 20 Feb 2017 14:24:36 +0100
+Subject: mac80211: fix power saving clients handling in iwlwifi
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+
+[ Upstream commit d98937f4ea713d21e0fcc345919f86c877dd8d6f ]
+
+iwlwifi now supports RSS and can't let mac80211 track the
+PS state based on the Rx frames since they can come out of
+order. iwlwifi is now advertising AP_LINK_PS, and uses
+explicit notifications to teach mac80211 about the PS state
+of the stations and the PS poll / uAPSD trigger frames
+coming our way from the peers.
+
+Because of that, the TIM stopped being maintained in
+mac80211. I tried to fix this in commit c68df2e7be0c
+("mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE")
+but that was later reverted by Felix in commit 6c18a6b4e799
+("Revert "mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE")
+since it broke drivers that do not implement set_tim.
+
+Since none of the drivers that set AP_LINK_PS have the
+set_tim() handler set besides iwlwifi, I can bail out in
+__sta_info_recalc_tim if AP_LINK_PS AND .set_tim is not
+implemented.
+
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/sta_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -688,7 +688,7 @@ static void __sta_info_recalc_tim(struct
+ }
+
+ /* No need to do anything if the driver does all */
+- if (ieee80211_hw_check(&local->hw, AP_LINK_PS))
++ if (ieee80211_hw_check(&local->hw, AP_LINK_PS) && !local->ops->set_tim)
+ return;
+
+ if (sta->dead)
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 27 Feb 2017 17:15:28 +0100
+Subject: mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+
+[ Upstream commit ff4dd73dd2b4806419f8ff65cbce11d5019548d0 ]
+
+Unfortunately, the nla policy was defined to have HWSIM_ATTR_RADIO_NAME
+as an NLA_STRING, rather than NLA_NUL_STRING, so we can't use it as a
+NUL-terminated string in the kernel.
+
+Rather than break the API, kasprintf() the string to a new buffer to
+guarantee NUL termination.
+
+Reported-by: Andrew Zaborowski <andrew.zaborowski@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3046,6 +3046,7 @@ static int hwsim_register_received_nl(st
+ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ {
+ struct hwsim_new_radio_params param = { 0 };
++ const char *hwname = NULL;
+
+ param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
+ param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
+@@ -3059,8 +3060,14 @@ static int hwsim_new_radio_nl(struct sk_
+ if (info->attrs[HWSIM_ATTR_NO_VIF])
+ param.no_vif = true;
+
+- if (info->attrs[HWSIM_ATTR_RADIO_NAME])
+- param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
++ if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
++ hwname = kasprintf(GFP_KERNEL, "%.*s",
++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
++ (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
++ if (!hwname)
++ return -ENOMEM;
++ param.hwname = hwname;
++ }
+
+ if (info->attrs[HWSIM_ATTR_USE_CHANCTX])
+ param.use_chanctx = true;
+@@ -3088,11 +3095,15 @@ static int hwsim_del_radio_nl(struct sk_
+ s64 idx = -1;
+ const char *hwname = NULL;
+
+- if (info->attrs[HWSIM_ATTR_RADIO_ID])
++ if (info->attrs[HWSIM_ATTR_RADIO_ID]) {
+ idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+- else if (info->attrs[HWSIM_ATTR_RADIO_NAME])
+- hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]);
+- else
++ } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) {
++ hwname = kasprintf(GFP_KERNEL, "%.*s",
++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]),
++ (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]));
++ if (!hwname)
++ return -ENOMEM;
++ } else
+ return -EINVAL;
+
+ spin_lock_bh(&hwsim_radio_lock);
+@@ -3101,7 +3112,8 @@ static int hwsim_del_radio_nl(struct sk_
+ if (data->idx != idx)
+ continue;
+ } else {
+- if (strcmp(hwname, wiphy_name(data->hw->wiphy)))
++ if (!hwname ||
++ strcmp(hwname, wiphy_name(data->hw->wiphy)))
+ continue;
+ }
+
+@@ -3112,10 +3124,12 @@ static int hwsim_del_radio_nl(struct sk_
+ spin_unlock_bh(&hwsim_radio_lock);
+ mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
+ info);
++ kfree(hwname);
+ return 0;
+ }
+ spin_unlock_bh(&hwsim_radio_lock);
+
++ kfree(hwname);
+ return -ENODEV;
+ }
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Shaohua Li <shli@fb.com>
+Date: Tue, 21 Feb 2017 11:57:01 -0800
+Subject: md/linear: shutup lockdep warnning
+
+From: Shaohua Li <shli@fb.com>
+
+
+[ Upstream commit d939cdfde34f50b95254b375f498447c82190b3e ]
+
+Commit 03a9e24(md linear: fix a race between linear_add() and
+linear_congested()) introduces the warnning.
+
+Acked-by: Coly Li <colyli@suse.de>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/linear.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/linear.c
++++ b/drivers/md/linear.c
+@@ -223,7 +223,8 @@ static int linear_add(struct mddev *mdde
+ * oldconf until no one uses it anymore.
+ */
+ mddev_suspend(mddev);
+- oldconf = rcu_dereference(mddev->private);
++ oldconf = rcu_dereference_protected(mddev->private,
++ lockdep_is_held(&mddev->reconfig_mutex));
+ mddev->raid_disks++;
+ WARN_ONCE(mddev->raid_disks != newconf->raid_disks,
+ "copied raid_disks doesn't match mddev->raid_disks");
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Yasuaki Ishimatsu <yasu.isimatu@gmail.com>
+Date: Wed, 22 Feb 2017 15:45:13 -0800
+Subject: mm/memory_hotplug: set magic number to page->freelist instead of page->lru.next
+
+From: Yasuaki Ishimatsu <yasu.isimatu@gmail.com>
+
+
+[ Upstream commit ddffe98d166f4a93d996d5aa628fd745311fc1e7 ]
+
+To identify that pages of page table are allocated from bootmem
+allocator, magic number sets to page->lru.next.
+
+But page->lru list is initialized in reserve_bootmem_region(). So when
+calling free_pagetable(), the function cannot find the magic number of
+pages. And free_pagetable() frees the pages by free_reserved_page() not
+put_page_bootmem().
+
+But if the pages are allocated from bootmem allocator and used as page
+table, the pages have private flag. So before freeing the pages, we
+should clear the private flag by put_page_bootmem().
+
+Before applying the commit 7bfec6f47bb0 ("mm, page_alloc: check multiple
+page fields with a single branch"), we could find the following visible
+issue:
+
+ BUG: Bad page state in process kworker/u1024:1
+ page:ffffea103cfd8040 count:0 mapcount:0 mappi
+ flags: 0x6fffff80000800(private)
+ page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
+ bad because of flags: 0x800(private)
+ <snip>
+ Call Trace:
+ [...] dump_stack+0x63/0x87
+ [...] bad_page+0x114/0x130
+ [...] free_pages_prepare+0x299/0x2d0
+ [...] free_hot_cold_page+0x31/0x150
+ [...] __free_pages+0x25/0x30
+ [...] free_pagetable+0x6f/0xb4
+ [...] remove_pagetable+0x379/0x7ff
+ [...] vmemmap_free+0x10/0x20
+ [...] sparse_remove_one_section+0x149/0x180
+ [...] __remove_pages+0x2e9/0x4f0
+ [...] arch_remove_memory+0x63/0xc0
+ [...] remove_memory+0x8c/0xc0
+ [...] acpi_memory_device_remove+0x79/0xa5
+ [...] acpi_bus_trim+0x5a/0x8d
+ [...] acpi_bus_trim+0x38/0x8d
+ [...] acpi_device_hotplug+0x1b7/0x418
+ [...] acpi_hotplug_work_fn+0x1e/0x29
+ [...] process_one_work+0x152/0x400
+ [...] worker_thread+0x125/0x4b0
+ [...] kthread+0xd8/0xf0
+ [...] ret_from_fork+0x22/0x40
+
+And the issue still silently occurs.
+
+Until freeing the pages of page table allocated from bootmem allocator,
+the page->freelist is never used. So the patch sets magic number to
+page->freelist instead of page->lru.next.
+
+[isimatu.yasuaki@jp.fujitsu.com: fix merge issue]
+ Link: http://lkml.kernel.org/r/722b1cc4-93ac-dd8b-2be2-7a7e313b3b0b@gmail.com
+Link: http://lkml.kernel.org/r/2c29bd9f-5b67-02d0-18a3-8828e78bbb6f@gmail.com
+Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Xishi Qiu <qiuxishi@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/init_64.c | 2 +-
+ mm/memory_hotplug.c | 5 +++--
+ mm/sparse.c | 2 +-
+ 3 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/mm/init_64.c
++++ b/arch/x86/mm/init_64.c
+@@ -689,7 +689,7 @@ static void __meminit free_pagetable(str
+ if (PageReserved(page)) {
+ __ClearPageReserved(page);
+
+- magic = (unsigned long)page->lru.next;
++ magic = (unsigned long)page->freelist;
+ if (magic == SECTION_INFO || magic == MIX_SECTION_INFO) {
+ while (nr_pages--)
+ put_page_bootmem(page++);
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -179,7 +179,7 @@ static void release_memory_resource(stru
+ void get_page_bootmem(unsigned long info, struct page *page,
+ unsigned long type)
+ {
+- page->lru.next = (struct list_head *) type;
++ page->freelist = (void *)type;
+ SetPagePrivate(page);
+ set_page_private(page, info);
+ page_ref_inc(page);
+@@ -189,11 +189,12 @@ void put_page_bootmem(struct page *page)
+ {
+ unsigned long type;
+
+- type = (unsigned long) page->lru.next;
++ type = (unsigned long) page->freelist;
+ BUG_ON(type < MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE ||
+ type > MEMORY_HOTPLUG_MAX_BOOTMEM_TYPE);
+
+ if (page_ref_dec_return(page) == 1) {
++ page->freelist = NULL;
+ ClearPagePrivate(page);
+ set_page_private(page, 0);
+ INIT_LIST_HEAD(&page->lru);
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -662,7 +662,7 @@ static void free_map_bootmem(struct page
+ >> PAGE_SHIFT;
+
+ for (i = 0; i < nr_pages; i++, page++) {
+- magic = (unsigned long) page->lru.next;
++ magic = (unsigned long) page->freelist;
+
+ BUG_ON(magic == NODE_INFO);
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Majd Dibbiny <majd@mellanox.com>
+Date: Thu, 23 Feb 2017 12:02:43 +0200
+Subject: net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs
+
+From: Majd Dibbiny <majd@mellanox.com>
+
+
+[ Upstream commit 95f1ba9a24af9769f6e20dfe9a77c863f253f311 ]
+
+In the VF driver, module parameter mlx4_log_num_mgm_entry_size was
+mistakenly overwritten -- and in a manner which overrode the
+device-managed flow steering option encoded in the parameter.
+
+log_num_mgm_entry_size is a global module parameter which
+affects all ConnectX-3 PFs installed on that host.
+If a VF changes log_num_mgm_entry_size, this will affect all PFs
+which are probed subsequent to the change (by disabling DMFS for
+those PFs).
+
+Fixes: 3c439b5586e9 ("mlx4_core: Allow choosing flow steering mode")
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Reviewed-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/main.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -841,8 +841,6 @@ static int mlx4_slave_cap(struct mlx4_de
+ return -ENOSYS;
+ }
+
+- mlx4_log_num_mgm_entry_size = hca_param.log_mc_entry_sz;
+-
+ dev->caps.hca_core_clock = hca_param.hca_core_clock;
+
+ memset(&dev_cap, 0, sizeof(dev_cap));
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 23 Feb 2017 15:22:43 -0800
+Subject: net/mlx4_en: fix overflow in mlx4_en_init_timestamp()
+
+From: Eric Dumazet <edumazet@google.com>
+
+
+[ Upstream commit 47d3a07528ecbbccf53bc4390d70b4e3d1c04fcf ]
+
+The cited commit makes a great job of finding optimal shift/multiplier
+values assuming a 10 seconds wrap around, but forgot to change the
+overflow_period computation.
+
+It overflows in cyclecounter_cyc2ns(), and the final result is 804 ms,
+which is silly.
+
+Lets simply use 5 seconds, no need to recompute this, given how it is
+supposed to work.
+
+Later, we will use a timer instead of a work queue, since the new RX
+allocation schem will no longer need mlx4_en_recover_from_oom() and the
+service_task firing every 250 ms.
+
+Fixes: 31c128b66e5b ("net/mlx4_en: Choose time-stamping shift value according to HW frequency")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Tariq Toukan <tariqt@mellanox.com>
+Cc: Eugenia Emantayev <eugenia@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_clock.c | 18 ++++++++----------
+ drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 -
+ 2 files changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c
+@@ -88,10 +88,17 @@ void mlx4_en_remove_timestamp(struct mlx
+ }
+ }
+
++#define MLX4_EN_WRAP_AROUND_SEC 10UL
++/* By scheduling the overflow check every 5 seconds, we have a reasonably
++ * good chance we wont miss a wrap around.
++ * TOTO: Use a timer instead of a work queue to increase the guarantee.
++ */
++#define MLX4_EN_OVERFLOW_PERIOD (MLX4_EN_WRAP_AROUND_SEC * HZ / 2)
++
+ void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev)
+ {
+ bool timeout = time_is_before_jiffies(mdev->last_overflow_check +
+- mdev->overflow_period);
++ MLX4_EN_OVERFLOW_PERIOD);
+ unsigned long flags;
+
+ if (timeout) {
+@@ -236,7 +243,6 @@ static const struct ptp_clock_info mlx4_
+ .enable = mlx4_en_phc_enable,
+ };
+
+-#define MLX4_EN_WRAP_AROUND_SEC 10ULL
+
+ /* This function calculates the max shift that enables the user range
+ * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register.
+@@ -261,7 +267,6 @@ void mlx4_en_init_timestamp(struct mlx4_
+ {
+ struct mlx4_dev *dev = mdev->dev;
+ unsigned long flags;
+- u64 ns, zero = 0;
+
+ /* mlx4_en_init_timestamp is called for each netdev.
+ * mdev->ptp_clock is common for all ports, skip initialization if
+@@ -285,13 +290,6 @@ void mlx4_en_init_timestamp(struct mlx4_
+ ktime_to_ns(ktime_get_real()));
+ write_unlock_irqrestore(&mdev->clock_lock, flags);
+
+- /* Calculate period in seconds to call the overflow watchdog - to make
+- * sure counter is checked at least once every wrap around.
+- */
+- ns = cyclecounter_cyc2ns(&mdev->cycles, mdev->cycles.mask, zero, &zero);
+- do_div(ns, NSEC_PER_SEC / 2 / HZ);
+- mdev->overflow_period = ns;
+-
+ /* Configure the PHC */
+ mdev->ptp_clock_info = mlx4_en_ptp_clock_info;
+ snprintf(mdev->ptp_clock_info.name, 16, "mlx4 ptp");
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -419,7 +419,6 @@ struct mlx4_en_dev {
+ struct cyclecounter cycles;
+ struct timecounter clock;
+ unsigned long last_overflow_check;
+- unsigned long overflow_period;
+ struct ptp_clock *ptp_clock;
+ struct ptp_clock_info ptp_clock_info;
+ struct notifier_block nb;
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Tue, 21 Feb 2017 11:28:05 +0100
+Subject: net: mvpp2: release reference to txq_cpu[] entry after unmapping
+
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+
+
+[ Upstream commit 36fb7435b6ac4d288a2d4deea8934f9456ab46b6 ]
+
+The mvpp2_txq_bufs_free() function is called upon TX completion to DMA
+unmap TX buffers, and free the corresponding SKBs. It gets the
+references to the SKB to free and the DMA buffer to unmap from a per-CPU
+txq_pcpu data structure.
+
+However, the code currently increments the pointer to the next entry
+before doing the DMA unmap and freeing the SKB. It does not cause any
+visible problem because for a given SKB the TX completion is guaranteed
+to take place on the CPU where the TX was started. However, it is much
+more logical to increment the pointer to the next entry once the current
+entry has been completely unmapped/released.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/mvpp2.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -4413,13 +4413,12 @@ static void mvpp2_txq_bufs_free(struct m
+ struct mvpp2_txq_pcpu_buf *tx_buf =
+ txq_pcpu->buffs + txq_pcpu->txq_get_index;
+
+- mvpp2_txq_inc_get(txq_pcpu);
+-
+ dma_unmap_single(port->dev->dev.parent, tx_buf->phys,
+ tx_buf->size, DMA_TO_DEVICE);
+- if (!tx_buf->skb)
+- continue;
+- dev_kfree_skb_any(tx_buf->skb);
++ if (tx_buf->skb)
++ dev_kfree_skb_any(tx_buf->skb);
++
++ mvpp2_txq_inc_get(txq_pcpu);
+ }
+ }
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Jarno Rajahalme <jarno@ovn.org>
+Date: Thu, 23 Feb 2017 17:08:54 -0800
+Subject: netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.
+
+From: Jarno Rajahalme <jarno@ovn.org>
+
+
+[ Upstream commit 4b86c459c7bee3acaf92f0e2b4c6ac803eaa1a58 ]
+
+Commit 4dee62b1b9b4 ("netfilter: nf_ct_expect: nf_ct_expect_insert()
+returns void") inadvertently changed the successful return value of
+nf_ct_expect_related_report() from 0 to 1 due to
+__nf_ct_expect_check() returning 1 on success. Prevent this
+regression in the future by changing the return value of
+__nf_ct_expect_check() to 0 on success.
+
+Signed-off-by: Jarno Rajahalme <jarno@ovn.org>
+Acked-by: Joe Stringer <joe@ovn.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_conntrack_expect.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/nf_conntrack_expect.c
++++ b/net/netfilter/nf_conntrack_expect.c
+@@ -411,7 +411,7 @@ static inline int __nf_ct_expect_check(s
+ struct net *net = nf_ct_exp_net(expect);
+ struct hlist_node *next;
+ unsigned int h;
+- int ret = 1;
++ int ret = 0;
+
+ if (!master_help) {
+ ret = -ESHUTDOWN;
+@@ -461,7 +461,7 @@ int nf_ct_expect_related_report(struct n
+
+ spin_lock_bh(&nf_conntrack_expect_lock);
+ ret = __nf_ct_expect_check(expect);
+- if (ret <= 0)
++ if (ret < 0)
+ goto out;
+
+ ret = nf_ct_expect_insert(expect);
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Kinglong Mee <kinglongmee@gmail.com>
+Date: Sun, 5 Feb 2017 09:57:07 +0800
+Subject: nfsd/callback: Cleanup callback cred on shutdown
+
+From: Kinglong Mee <kinglongmee@gmail.com>
+
+
+[ Upstream commit f7d1ddbe7648af7460d23688c8c131342eb43b3a ]
+
+The rpccred gotten from rpc_lookup_machine_cred() should be put when
+state is shutdown.
+
+Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/nfs4callback.c | 8 ++++++++
+ fs/nfsd/nfs4state.c | 10 ++++++----
+ fs/nfsd/state.h | 1 +
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -753,6 +753,14 @@ int set_callback_cred(void)
+ return 0;
+ }
+
++void cleanup_callback_cred(void)
++{
++ if (callback_cred) {
++ put_rpccred(callback_cred);
++ callback_cred = NULL;
++ }
++}
++
+ static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc_clnt *client, struct nfsd4_session *ses)
+ {
+ if (clp->cl_minorversion == 0) {
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -7012,23 +7012,24 @@ nfs4_state_start(void)
+
+ ret = set_callback_cred();
+ if (ret)
+- return -ENOMEM;
++ return ret;
++
+ laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4");
+ if (laundry_wq == NULL) {
+ ret = -ENOMEM;
+- goto out_recovery;
++ goto out_cleanup_cred;
+ }
+ ret = nfsd4_create_callback_queue();
+ if (ret)
+ goto out_free_laundry;
+
+ set_max_delegations();
+-
+ return 0;
+
+ out_free_laundry:
+ destroy_workqueue(laundry_wq);
+-out_recovery:
++out_cleanup_cred:
++ cleanup_callback_cred();
+ return ret;
+ }
+
+@@ -7086,6 +7087,7 @@ nfs4_state_shutdown(void)
+ {
+ destroy_workqueue(laundry_wq);
+ nfsd4_destroy_callback_queue();
++ cleanup_callback_cred();
+ }
+
+ static void
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -615,6 +615,7 @@ extern struct nfs4_client_reclaim *nfsd4
+ extern __be32 nfs4_check_open_reclaim(clientid_t *clid,
+ struct nfsd4_compound_state *cstate, struct nfsd_net *nn);
+ extern int set_callback_cred(void);
++extern void cleanup_callback_cred(void);
+ extern void nfsd4_probe_callback(struct nfs4_client *clp);
+ extern void nfsd4_probe_callback_sync(struct nfs4_client *clp);
+ extern void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *);
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Eric Ren <zren@suse.com>
+Date: Wed, 22 Feb 2017 15:40:41 -0800
+Subject: ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock
+
+From: Eric Ren <zren@suse.com>
+
+
+[ Upstream commit 439a36b8ef38657f765b80b775e2885338d72451 ]
+
+We are in the situation that we have to avoid recursive cluster locking,
+but there is no way to check if a cluster lock has been taken by a precess
+already.
+
+Mostly, we can avoid recursive locking by writing code carefully.
+However, we found that it's very hard to handle the routines that are
+invoked directly by vfs code. For instance:
+
+ const struct inode_operations ocfs2_file_iops = {
+ .permission = ocfs2_permission,
+ .get_acl = ocfs2_iop_get_acl,
+ .set_acl = ocfs2_iop_set_acl,
+ };
+
+Both ocfs2_permission() and ocfs2_iop_get_acl() call ocfs2_inode_lock(PR):
+
+ do_sys_open
+ may_open
+ inode_permission
+ ocfs2_permission
+ ocfs2_inode_lock() <=== first time
+ generic_permission
+ get_acl
+ ocfs2_iop_get_acl
+ ocfs2_inode_lock() <=== recursive one
+
+A deadlock will occur if a remote EX request comes in between two of
+ocfs2_inode_lock(). Briefly describe how the deadlock is formed:
+
+On one hand, OCFS2_LOCK_BLOCKED flag of this lockres is set in
+BAST(ocfs2_generic_handle_bast) when downconvert is started on behalf of
+the remote EX lock request. Another hand, the recursive cluster lock
+(the second one) will be blocked in in __ocfs2_cluster_lock() because of
+OCFS2_LOCK_BLOCKED. But, the downconvert never complete, why? because
+there is no chance for the first cluster lock on this node to be
+unlocked - we block ourselves in the code path.
+
+The idea to fix this issue is mostly taken from gfs2 code.
+
+1. introduce a new field: struct ocfs2_lock_res.l_holders, to keep track
+ of the processes' pid who has taken the cluster lock of this lock
+ resource;
+
+2. introduce a new flag for ocfs2_inode_lock_full:
+ OCFS2_META_LOCK_GETBH; it means just getting back disk inode bh for
+ us if we've got cluster lock.
+
+3. export a helper: ocfs2_is_locked_by_me() is used to check if we have
+ got the cluster lock in the upper code path.
+
+The tracking logic should be used by some of the ocfs2 vfs's callbacks,
+to solve the recursive locking issue cuased by the fact that vfs
+routines can call into each other.
+
+The performance penalty of processing the holder list should only be
+seen at a few cases where the tracking logic is used, such as get/set
+acl.
+
+You may ask what if the first time we got a PR lock, and the second time
+we want a EX lock? fortunately, this case never happens in the real
+world, as far as I can see, including permission check,
+(get|set)_(acl|attr), and the gfs2 code also do so.
+
+[sfr@canb.auug.org.au remove some inlines]
+Link: http://lkml.kernel.org/r/20170117100948.11657-2-zren@suse.com
+Signed-off-by: Eric Ren <zren@suse.com>
+Reviewed-by: Junxiao Bi <junxiao.bi@oracle.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ocfs2/dlmglue.c | 105 +++++++++++++++++++++++++++++++++++++++++++++++++++--
+ fs/ocfs2/dlmglue.h | 18 +++++++++
+ fs/ocfs2/ocfs2.h | 1
+ 3 files changed, 121 insertions(+), 3 deletions(-)
+
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -532,6 +532,7 @@ void ocfs2_lock_res_init_once(struct ocf
+ init_waitqueue_head(&res->l_event);
+ INIT_LIST_HEAD(&res->l_blocked_list);
+ INIT_LIST_HEAD(&res->l_mask_waiters);
++ INIT_LIST_HEAD(&res->l_holders);
+ }
+
+ void ocfs2_inode_lock_res_init(struct ocfs2_lock_res *res,
+@@ -749,6 +750,50 @@ void ocfs2_lock_res_free(struct ocfs2_lo
+ res->l_flags = 0UL;
+ }
+
++/*
++ * Keep a list of processes who have interest in a lockres.
++ * Note: this is now only uesed for check recursive cluster locking.
++ */
++static inline void ocfs2_add_holder(struct ocfs2_lock_res *lockres,
++ struct ocfs2_lock_holder *oh)
++{
++ INIT_LIST_HEAD(&oh->oh_list);
++ oh->oh_owner_pid = get_pid(task_pid(current));
++
++ spin_lock(&lockres->l_lock);
++ list_add_tail(&oh->oh_list, &lockres->l_holders);
++ spin_unlock(&lockres->l_lock);
++}
++
++static inline void ocfs2_remove_holder(struct ocfs2_lock_res *lockres,
++ struct ocfs2_lock_holder *oh)
++{
++ spin_lock(&lockres->l_lock);
++ list_del(&oh->oh_list);
++ spin_unlock(&lockres->l_lock);
++
++ put_pid(oh->oh_owner_pid);
++}
++
++static inline int ocfs2_is_locked_by_me(struct ocfs2_lock_res *lockres)
++{
++ struct ocfs2_lock_holder *oh;
++ struct pid *pid;
++
++ /* look in the list of holders for one with the current task as owner */
++ spin_lock(&lockres->l_lock);
++ pid = task_pid(current);
++ list_for_each_entry(oh, &lockres->l_holders, oh_list) {
++ if (oh->oh_owner_pid == pid) {
++ spin_unlock(&lockres->l_lock);
++ return 1;
++ }
++ }
++ spin_unlock(&lockres->l_lock);
++
++ return 0;
++}
++
+ static inline void ocfs2_inc_holders(struct ocfs2_lock_res *lockres,
+ int level)
+ {
+@@ -2333,8 +2378,9 @@ int ocfs2_inode_lock_full_nested(struct
+ goto getbh;
+ }
+
+- if (ocfs2_mount_local(osb))
+- goto local;
++ if ((arg_flags & OCFS2_META_LOCK_GETBH) ||
++ ocfs2_mount_local(osb))
++ goto update;
+
+ if (!(arg_flags & OCFS2_META_LOCK_RECOVERY))
+ ocfs2_wait_for_recovery(osb);
+@@ -2363,7 +2409,7 @@ int ocfs2_inode_lock_full_nested(struct
+ if (!(arg_flags & OCFS2_META_LOCK_RECOVERY))
+ ocfs2_wait_for_recovery(osb);
+
+-local:
++update:
+ /*
+ * We only see this flag if we're being called from
+ * ocfs2_read_locked_inode(). It means we're locking an inode
+@@ -2497,6 +2543,59 @@ void ocfs2_inode_unlock(struct inode *in
+ ocfs2_cluster_unlock(OCFS2_SB(inode->i_sb), lockres, level);
+ }
+
++/*
++ * This _tracker variantes are introduced to deal with the recursive cluster
++ * locking issue. The idea is to keep track of a lock holder on the stack of
++ * the current process. If there's a lock holder on the stack, we know the
++ * task context is already protected by cluster locking. Currently, they're
++ * used in some VFS entry routines.
++ *
++ * return < 0 on error, return == 0 if there's no lock holder on the stack
++ * before this call, return == 1 if this call would be a recursive locking.
++ */
++int ocfs2_inode_lock_tracker(struct inode *inode,
++ struct buffer_head **ret_bh,
++ int ex,
++ struct ocfs2_lock_holder *oh)
++{
++ int status;
++ int arg_flags = 0, has_locked;
++ struct ocfs2_lock_res *lockres;
++
++ lockres = &OCFS2_I(inode)->ip_inode_lockres;
++ has_locked = ocfs2_is_locked_by_me(lockres);
++ /* Just get buffer head if the cluster lock has been taken */
++ if (has_locked)
++ arg_flags = OCFS2_META_LOCK_GETBH;
++
++ if (likely(!has_locked || ret_bh)) {
++ status = ocfs2_inode_lock_full(inode, ret_bh, ex, arg_flags);
++ if (status < 0) {
++ if (status != -ENOENT)
++ mlog_errno(status);
++ return status;
++ }
++ }
++ if (!has_locked)
++ ocfs2_add_holder(lockres, oh);
++
++ return has_locked;
++}
++
++void ocfs2_inode_unlock_tracker(struct inode *inode,
++ int ex,
++ struct ocfs2_lock_holder *oh,
++ int had_lock)
++{
++ struct ocfs2_lock_res *lockres;
++
++ lockres = &OCFS2_I(inode)->ip_inode_lockres;
++ if (!had_lock) {
++ ocfs2_remove_holder(lockres, oh);
++ ocfs2_inode_unlock(inode, ex);
++ }
++}
++
+ int ocfs2_orphan_scan_lock(struct ocfs2_super *osb, u32 *seqno)
+ {
+ struct ocfs2_lock_res *lockres;
+--- a/fs/ocfs2/dlmglue.h
++++ b/fs/ocfs2/dlmglue.h
+@@ -70,6 +70,11 @@ struct ocfs2_orphan_scan_lvb {
+ __be32 lvb_os_seqno;
+ };
+
++struct ocfs2_lock_holder {
++ struct list_head oh_list;
++ struct pid *oh_owner_pid;
++};
++
+ /* ocfs2_inode_lock_full() 'arg_flags' flags */
+ /* don't wait on recovery. */
+ #define OCFS2_META_LOCK_RECOVERY (0x01)
+@@ -77,6 +82,8 @@ struct ocfs2_orphan_scan_lvb {
+ #define OCFS2_META_LOCK_NOQUEUE (0x02)
+ /* don't block waiting for the downconvert thread, instead return -EAGAIN */
+ #define OCFS2_LOCK_NONBLOCK (0x04)
++/* just get back disk inode bh if we've got cluster lock. */
++#define OCFS2_META_LOCK_GETBH (0x08)
+
+ /* Locking subclasses of inode cluster lock */
+ enum {
+@@ -170,4 +177,15 @@ void ocfs2_put_dlm_debug(struct ocfs2_dl
+
+ /* To set the locking protocol on module initialization */
+ void ocfs2_set_locking_protocol(void);
++
++/* The _tracker pair is used to avoid cluster recursive locking */
++int ocfs2_inode_lock_tracker(struct inode *inode,
++ struct buffer_head **ret_bh,
++ int ex,
++ struct ocfs2_lock_holder *oh);
++void ocfs2_inode_unlock_tracker(struct inode *inode,
++ int ex,
++ struct ocfs2_lock_holder *oh,
++ int had_lock);
++
+ #endif /* DLMGLUE_H */
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -172,6 +172,7 @@ struct ocfs2_lock_res {
+
+ struct list_head l_blocked_list;
+ struct list_head l_mask_waiters;
++ struct list_head l_holders;
+
+ unsigned long l_flags;
+ char l_name[OCFS2_LOCK_ID_MAX_LEN];
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Sun, 12 Feb 2017 22:33:15 +0530
+Subject: powerpc/perf: Add restrictions to PMC5 in power9 DD1
+
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+
+
+[ Upstream commit 8d911904f3ce412b20874a9c95f82009dcbb007c ]
+
+PMC5 on POWER9 DD1 may not provide right counts in all
+sampling scenarios, hence use PM_INST_DISP event instead
+in PMC2 or PMC3 in preference.
+
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/perf/isa207-common.h | 4 ++++
+ arch/powerpc/perf/power9-pmu.c | 2 +-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -201,6 +201,10 @@
+ CNST_PMC_VAL(1) | CNST_PMC_VAL(2) | CNST_PMC_VAL(3) | \
+ CNST_PMC_VAL(4) | CNST_PMC_VAL(5) | CNST_PMC_VAL(6) | CNST_NC_VAL
+
++/*
++ * Lets restrict use of PMC5 for instruction counting.
++ */
++#define P9_DD1_TEST_ADDER (ISA207_TEST_ADDER | CNST_PMC_VAL(5))
+
+ /* Bits in MMCR1 for PowerISA v2.07 */
+ #define MMCR1_UNIT_SHIFT(pmc) (60 - (4 * ((pmc) - 1)))
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -295,7 +295,7 @@ static struct power_pmu power9_pmu = {
+ .name = "POWER9",
+ .n_counter = MAX_PMU_COUNTERS,
+ .add_fields = ISA207_ADD_FIELDS,
+- .test_adder = ISA207_TEST_ADDER,
++ .test_adder = P9_DD1_TEST_ADDER,
+ .compute_mmcr = isa207_compute_mmcr,
+ .config_bhrb = power9_config_bhrb,
+ .bhrb_filter_map = power9_bhrb_filter_map,
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+Date: Mon, 27 Feb 2017 11:06:33 +0200
+Subject: qed: Don't use attention PTT for configuring BW
+
+From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
+
+
+[ Upstream commit 6f437d431930ff86e4a971d29321951faadb97c7 ]
+
+Commit 653d2ffd6405 ("qed*: Fix link indication race") introduced another
+race - one of the inner functions called from the link-change flow is
+explicitly using the slowpath context dedicated PTT instead of gaining
+that PTT from the caller. Since this flow can now be called from
+a different context as well, we're in risk of the PTT breaking.
+
+Fixes: 653d2ffd6405 ("qed*: Fix link indication race")
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed.h | 4 +++-
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 6 +++---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 3 ++-
+ 3 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed.h
++++ b/drivers/net/ethernet/qlogic/qed/qed.h
+@@ -642,7 +642,9 @@ static inline u8 qed_concrete_to_sw_fid(
+ #define OOO_LB_TC 9
+
+ int qed_configure_vport_wfq(struct qed_dev *cdev, u16 vp_id, u32 rate);
+-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate);
++void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev,
++ struct qed_ptt *p_ptt,
++ u32 min_pf_rate);
+
+ void qed_clean_wfq_db(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
+ #define QED_LEADING_HWFN(dev) (&dev->hwfns[0])
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -2732,7 +2732,8 @@ int qed_configure_vport_wfq(struct qed_d
+ }
+
+ /* API to configure WFQ from mcp link change */
+-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate)
++void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev,
++ struct qed_ptt *p_ptt, u32 min_pf_rate)
+ {
+ int i;
+
+@@ -2746,8 +2747,7 @@ void qed_configure_vp_wfq_on_link_change
+ for_each_hwfn(cdev, i) {
+ struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
+
+- __qed_configure_vp_wfq_on_link_change(p_hwfn,
+- p_hwfn->p_dpc_ptt,
++ __qed_configure_vp_wfq_on_link_change(p_hwfn, p_ptt,
+ min_pf_rate);
+ }
+ }
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -628,7 +628,8 @@ static void qed_mcp_handle_link_change(s
+
+ /* Min bandwidth configuration */
+ __qed_configure_pf_min_bandwidth(p_hwfn, p_ptt, p_link, min_bw);
+- qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_link->min_pf_rate);
++ qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_ptt,
++ p_link->min_pf_rate);
+
+ p_link->an = !!(status & LINK_STATUS_AUTO_NEGOTIATE_ENABLED);
+ p_link->an_complete = !!(status &
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Ram Amrani <Ram.Amrani@cavium.com>
+Date: Mon, 20 Feb 2017 22:43:31 +0200
+Subject: qed: Read queue state before releasing buffer
+
+From: Ram Amrani <Ram.Amrani@cavium.com>
+
+
+[ Upstream commit c5212b943d4b52a7d9e0d9f747e7ad59c50d31f1 ]
+
+Currently the state is read only after the buffers are relesed.
+
+Signed-off-by: Ram Amrani <Ram.Amrani@cavium.com>
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_roce.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
+@@ -1766,13 +1766,13 @@ static int qed_roce_query_qp(struct qed_
+ if (rc)
+ goto err_resp;
+
+- dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_resp_ramrod_res),
+- p_resp_ramrod_res, resp_ramrod_res_phys);
+-
+ out_params->rq_psn = le32_to_cpu(p_resp_ramrod_res->psn);
+ rq_err_state = GET_FIELD(le32_to_cpu(p_resp_ramrod_res->err_flag),
+ ROCE_QUERY_QP_RESP_OUTPUT_PARAMS_ERROR_FLG);
+
++ dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_resp_ramrod_res),
++ p_resp_ramrod_res, resp_ramrod_res_phys);
++
+ if (!(qp->req_offloaded)) {
+ /* Don't send query qp for the requester */
+ out_params->sq_psn = qp->sq_psn;
+@@ -1813,9 +1813,6 @@ static int qed_roce_query_qp(struct qed_
+ if (rc)
+ goto err_req;
+
+- dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_req_ramrod_res),
+- p_req_ramrod_res, req_ramrod_res_phys);
+-
+ out_params->sq_psn = le32_to_cpu(p_req_ramrod_res->psn);
+ sq_err_state = GET_FIELD(le32_to_cpu(p_req_ramrod_res->flags),
+ ROCE_QUERY_QP_REQ_OUTPUT_PARAMS_ERR_FLG);
+@@ -1823,6 +1820,9 @@ static int qed_roce_query_qp(struct qed_
+ GET_FIELD(le32_to_cpu(p_req_ramrod_res->flags),
+ ROCE_QUERY_QP_REQ_OUTPUT_PARAMS_SQ_DRAINING_FLG);
+
++ dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_req_ramrod_res),
++ p_req_ramrod_res, req_ramrod_res_phys);
++
+ out_params->draining = false;
+
+ if (rq_err_state)
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Ram Amrani <Ram.Amrani@cavium.com>
+Date: Mon, 20 Feb 2017 22:43:33 +0200
+Subject: qed: Reserve doorbell BAR space for present CPUs
+
+From: Ram Amrani <Ram.Amrani@cavium.com>
+
+
+[ Upstream commit c2dedf8773e873474535bd4a158609b9eda5403d ]
+
+Reserving doorbell BAR space according to the currently active CPUs
+may result in a bug if disabled CPUs are later enabled but no
+doorbell space was reserved for them.
+
+Signed-off-by: Ram Amrani <Ram.Amrani@cavium.com>
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -877,7 +877,7 @@ qed_hw_init_pf_doorbell_bar(struct qed_h
+ /* Either EDPM is mandatory, or we are attempting to allocate a
+ * WID per CPU.
+ */
+- n_cpus = num_active_cpus();
++ n_cpus = num_present_cpus();
+ rc = qed_hw_init_dpi_size(p_hwfn, p_ptt, pwm_regsize, n_cpus);
+ }
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Date: Mon, 20 Feb 2017 22:43:37 +0200
+Subject: qede: Prevent index problems in loopback test
+
+From: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+
+
+[ Upstream commit afe981d664aeeebc8d1bcbd7d2070b5432edaecb ]
+
+Driver currently utilizes the same loop variable in two
+nested loops.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+@@ -1221,7 +1221,7 @@ static int qede_selftest_receive_traffic
+ struct qede_rx_queue *rxq = NULL;
+ struct sw_rx_data *sw_rx_data;
+ union eth_rx_cqe *cqe;
+- int i, rc = 0;
++ int i, iter, rc = 0;
+ u8 *data_ptr;
+
+ for_each_queue(i) {
+@@ -1240,7 +1240,7 @@ static int qede_selftest_receive_traffic
+ * enabled. This is because the queue 0 is configured as the default
+ * queue and that the loopback traffic is not IP.
+ */
+- for (i = 0; i < QEDE_SELFTEST_POLL_COUNT; i++) {
++ for (iter = 0; iter < QEDE_SELFTEST_POLL_COUNT; iter++) {
+ if (!qede_has_rx_work(rxq)) {
+ usleep_range(100, 200);
+ continue;
+@@ -1287,7 +1287,7 @@ static int qede_selftest_receive_traffic
+ qed_chain_recycle_consumed(&rxq->rx_comp_ring);
+ }
+
+- if (i == QEDE_SELFTEST_POLL_COUNT) {
++ if (iter == QEDE_SELFTEST_POLL_COUNT) {
+ DP_NOTICE(edev, "Failed to receive the traffic\n");
+ return -1;
+ }
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Thu, 16 Feb 2017 14:30:02 -0300
+Subject: regulator: core: Resolve supplies before disabling unused regulators
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+
+[ Upstream commit 3827b64dba27ebadb4faf51f2c91143e01ba1f6d ]
+
+After commit 66d228a2bf03 ("regulator: core: Don't use regulators as
+supplies until the parent is bound"), input supplies aren't resolved
+if the input supplies parent device has not been bound. This prevent
+regulators to hold an invalid reference if its supply parent device
+driver probe is deferred.
+
+But this causes issues on some boards where a PMIC's regulator use as
+input supply a regulator from another PMIC whose driver is registered
+after the driver for the former.
+
+In this case the regulators for the first PMIC will fail to resolve
+input supplies on regulators registration (since the other PMIC wasn't
+probed yet). And when the core attempts to resolve again latter when
+the other PMIC registers its own regulators, it will fail again since
+the parent device isn't bound yet.
+
+This will cause some parent supplies to never be resolved and wrongly
+be disabled on boot due taking them as unused.
+
+To solve this problem, also attempt to resolve the pending regulators
+input supplies before disabling the unused regulators.
+
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4507,6 +4507,16 @@ static int __init regulator_init_complet
+ if (of_have_populated_dt())
+ has_full_constraints = true;
+
++ /*
++ * Regulators may had failed to resolve their input supplies
++ * when were registered, either because the input supply was
++ * not registered yet or because its parent device was not
++ * bound yet. So attempt to resolve the input supplies for
++ * pending regulators before trying to disable unused ones.
++ */
++ class_for_each_device(®ulator_class, NULL, NULL,
++ regulator_register_resolve_supply);
++
+ /* If we have a full configuration then disable any regulators
+ * we have permission to change the status for and which are
+ * not in use or always_on. This is effectively the default
--- /dev/null
+From 42fbb07e2e3a338154ee747bf28dc688bc599b81 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 19 Oct 2017 14:55:29 +0200
+Subject: [PATCH] Revert "bsg-lib: don't free job in bsg_prepare_job"
+
+This reverts commit eb4375e1969c48d454998b2a284c2e6a5dc9eb68 which was
+commit f507b54dccfd8000c517d740bc45f20c74532d18 upstream.
+
+Ben reports:
+ That function doesn't exist here (it was introduced in 4.13).
+ Instead, this backport has modified bsg_create_job(), creating a
+ leak. Please revert this on the 3.18, 4.4 and 4.9 stable
+ branches.
+
+So I'm dropping it from here.
+
+Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
+---
+ block/bsg-lib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/block/bsg-lib.c
++++ b/block/bsg-lib.c
+@@ -147,6 +147,7 @@ static int bsg_create_job(struct device
+ failjob_rls_rqst_payload:
+ kfree(job->request_payload.sg_list);
+ failjob_rls_job:
++ kfree(job);
+ return -ENOMEM;
+ }
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Wanpeng Li <wanpeng.li@hotmail.com>
+Date: Tue, 21 Feb 2017 23:52:55 -0800
+Subject: sched/fair: Update rq clock before changing a task's CPU affinity
+
+From: Wanpeng Li <wanpeng.li@hotmail.com>
+
+
+[ Upstream commit a499c3ead88ccf147fc50689e85a530ad923ce36 ]
+
+This is triggered during boot when CONFIG_SCHED_DEBUG is enabled:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 6 PID: 81 at kernel/sched/sched.h:812 set_next_entity+0x11d/0x380
+ rq->clock_update_flags < RQCF_ACT_SKIP
+ CPU: 6 PID: 81 Comm: torture_shuffle Not tainted 4.10.0+ #1
+ Hardware name: LENOVO ThinkCentre M8500t-N000/SHARKBAY, BIOS FBKTC1AUS 02/16/2016
+ Call Trace:
+ dump_stack+0x85/0xc2
+ __warn+0xcb/0xf0
+ warn_slowpath_fmt+0x5f/0x80
+ set_next_entity+0x11d/0x380
+ set_curr_task_fair+0x2b/0x60
+ do_set_cpus_allowed+0x139/0x180
+ __set_cpus_allowed_ptr+0x113/0x260
+ set_cpus_allowed_ptr+0x10/0x20
+ torture_shuffle+0xfd/0x180
+ kthread+0x10f/0x150
+ ? torture_shutdown_init+0x60/0x60
+ ? kthread_create_on_node+0x60/0x60
+ ret_from_fork+0x31/0x40
+ ---[ end trace dd94d92344cea9c6 ]---
+
+The task is running && !queued, so there is no rq clock update before calling
+set_curr_task().
+
+This patch fixes it by updating rq clock after holding rq->lock/pi_lock
+just as what other dequeue + put_prev + enqueue + set_curr story does.
+
+Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/1487749975-5994-1-git-send-email-wanpeng.li@hotmail.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1141,6 +1141,7 @@ static int __set_cpus_allowed_ptr(struct
+ int ret = 0;
+
+ rq = task_rq_lock(p, &rf);
++ update_rq_clock(rq);
+
+ if (p->flags & PF_KTHREAD) {
+ /*
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 21 Feb 2017 21:46:37 +0300
+Subject: scsi: scsi_dh_emc: return success in clariion_std_inquiry()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+
+[ Upstream commit 4d7d39a18b8b81511f0b893b7d2203790bf8a58b ]
+
+We accidentally return an uninitialized variable on success.
+
+Fixes: b6ff1b14cdf4 ("[SCSI] scsi_dh: Update EMC handler")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/device_handler/scsi_dh_emc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/device_handler/scsi_dh_emc.c
++++ b/drivers/scsi/device_handler/scsi_dh_emc.c
+@@ -461,7 +461,7 @@ static int clariion_prep_fn(struct scsi_
+ static int clariion_std_inquiry(struct scsi_device *sdev,
+ struct clariion_dh_data *csdev)
+ {
+- int err;
++ int err = SCSI_DH_OK;
+ char *sp_model;
+
+ err = send_inquiry_cmd(sdev, 0, csdev);
mips-fix-minimum-alignment-requirement-of-irq-stack.patch
+revert-bsg-lib-don-t-free-job-in-bsg_prepare_job.patch
+xen-netback-use-gfp_atomic-to-allocate-hash.patch
+locking-lockdep-add-nest_lock-integrity-test.patch
+watchdog-kempld-fix-gcc-4.3-build.patch
+irqchip-crossbar-fix-incorrect-type-of-local-variables.patch
+initramfs-finish-fput-before-accessing-any-binary-from-initramfs.patch
+mac80211_hwsim-check-hwsim_attr_radio_name-length.patch
+alsa-hda-add-geminilake-hdmi-codec-id.patch
+qed-don-t-use-attention-ptt-for-configuring-bw.patch
+mac80211-fix-power-saving-clients-handling-in-iwlwifi.patch
+net-mlx4_en-fix-overflow-in-mlx4_en_init_timestamp.patch
+staging-vchiq_2835_arm-make-cache-line-size-a-required-dt-property.patch
+netfilter-nf_ct_expect-change-__nf_ct_expect_check-return-value.patch
+iio-adc-xilinx-fix-error-handling.patch
+f2fs-do-ssr-for-data-when-there-is-enough-free-space.patch
+sched-fair-update-rq-clock-before-changing-a-task-s-cpu-affinity.patch
+btrfs-send-fix-failure-to-rename-top-level-inode-due-to-name-collision.patch
+f2fs-do-not-wait-for-writeback-in-write_begin.patch
+md-linear-shutup-lockdep-warnning.patch
+sparc64-migrate-hvcons-irq-to-panicked-cpu.patch
+net-mlx4_core-fix-vf-overwrite-of-module-param-which-disables-dmfs-on-new-probed-pfs.patch
+crypto-xts-add-ecb-dependency.patch
+mm-memory_hotplug-set-magic-number-to-page-freelist-instead-of-page-lru.next.patch
+ocfs2-dlmglue-prepare-tracking-logic-to-avoid-recursive-cluster-lock.patch
+slub-do-not-merge-cache-if-slub_debug-contains-a-never-merge-flag.patch
+scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch
+asoc-mediatek-add-i2c-dependency-for-cs42xx8.patch
+drm-amdgpu-refuse-to-reserve-io-mem-for-split-vram-buffers.patch
+net-mvpp2-release-reference-to-txq_cpu-entry-after-unmapping.patch
+qede-prevent-index-problems-in-loopback-test.patch
+qed-reserve-doorbell-bar-space-for-present-cpus.patch
+qed-read-queue-state-before-releasing-buffer.patch
+i2c-at91-ensure-state-is-restored-after-suspending.patch
+ceph-don-t-update_dentry_lease-unless-we-actually-got-one.patch
+ceph-fix-bogus-endianness-change-in-ceph_ioctl_set_layout.patch
+ceph-clean-up-unsafe-d_parent-accesses-in-build_dentry_path.patch
+uapi-fix-linux-rds.h-userspace-compilation-errors.patch
+uapi-fix-linux-mroute6.h-userspace-compilation-errors.patch
+ib-hfi1-use-static-ctle-with-preset-6-for-integrated-hfis.patch
+ib-hfi1-allocate-context-data-on-memory-node.patch
+target-iscsi-fix-unsolicited-data-seq_end_offset-calculation.patch
+hrtimer-catch-invalid-clockids-again.patch
+nfsd-callback-cleanup-callback-cred-on-shutdown.patch
+powerpc-perf-add-restrictions-to-pmc5-in-power9-dd1.patch
+drm-nouveau-gr-gf100-fix-ccache-error-logging.patch
+regulator-core-resolve-supplies-before-disabling-unused-regulators.patch
+btmrvl-avoid-double-disable_irq-race.patch
+edac-mce_amd-print-ipid-and-syndrome-on-a-separate-line.patch
+cpufreq-cppc-add-acpi_processor-dependency.patch
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Grygorii Maistrenko <grygoriimkd@gmail.com>
+Date: Wed, 22 Feb 2017 15:40:59 -0800
+Subject: slub: do not merge cache if slub_debug contains a never-merge flag
+
+From: Grygorii Maistrenko <grygoriimkd@gmail.com>
+
+
+[ Upstream commit c6e28895a4372992961888ffaadc9efc643b5bfe ]
+
+In case CONFIG_SLUB_DEBUG_ON=n, find_mergeable() gets debug features from
+commandline but never checks if there are features from the
+SLAB_NEVER_MERGE set.
+
+As a result selected by slub_debug caches are always mergeable if they
+have been created without a custom constructor set or without one of the
+SLAB_* debug features on.
+
+This moves the SLAB_NEVER_MERGE check below the flags update from
+commandline to make sure it won't merge the slab cache if one of the debug
+features is on.
+
+Link: http://lkml.kernel.org/r/20170101124451.GA4740@lp-laptop-d
+Signed-off-by: Grygorii Maistrenko <grygoriimkd@gmail.com>
+Reviewed-by: Pekka Enberg <penberg@kernel.org>
+Acked-by: David Rientjes <rientjes@google.com>
+Acked-by: Christoph Lameter <cl@linux.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/slab_common.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -255,7 +255,7 @@ struct kmem_cache *find_mergeable(size_t
+ {
+ struct kmem_cache *s;
+
+- if (slab_nomerge || (flags & SLAB_NEVER_MERGE))
++ if (slab_nomerge)
+ return NULL;
+
+ if (ctor)
+@@ -266,6 +266,9 @@ struct kmem_cache *find_mergeable(size_t
+ size = ALIGN(size, align);
+ flags = kmem_cache_flags(size, flags, name, NULL);
+
++ if (flags & SLAB_NEVER_MERGE)
++ return NULL;
++
+ list_for_each_entry_reverse(s, &slab_caches, list) {
+ if (slab_unmergeable(s))
+ continue;
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Vijay Kumar <vijay.ac.kumar@oracle.com>
+Date: Wed, 1 Feb 2017 11:34:38 -0800
+Subject: sparc64: Migrate hvcons irq to panicked cpu
+
+From: Vijay Kumar <vijay.ac.kumar@oracle.com>
+
+
+[ Upstream commit 7dd4fcf5b70694dc961eb6b954673e4fc9730dbd ]
+
+On panic, all other CPUs are stopped except the one which had
+hit panic. To keep console alive, we need to migrate hvcons irq
+to panicked CPU.
+
+Signed-off-by: Vijay Kumar <vijay.ac.kumar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sparc/include/asm/setup.h | 5 ++++-
+ arch/sparc/kernel/smp_64.c | 6 +++++-
+ drivers/tty/serial/sunhv.c | 6 ++++++
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/include/asm/setup.h
++++ b/arch/sparc/include/asm/setup.h
+@@ -59,8 +59,11 @@ extern atomic_t dcpage_flushes;
+ extern atomic_t dcpage_flushes_xcall;
+
+ extern int sysctl_tsb_ratio;
+-#endif
+
++#ifdef CONFIG_SERIAL_SUNHV
++void sunhv_migrate_hvcons_irq(int cpu);
++#endif
++#endif
+ void sun_do_break(void);
+ extern int stop_a_enabled;
+ extern int scons_pwroff;
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -1465,8 +1465,12 @@ void smp_send_stop(void)
+ int cpu;
+
+ if (tlb_type == hypervisor) {
++ int this_cpu = smp_processor_id();
++#ifdef CONFIG_SERIAL_SUNHV
++ sunhv_migrate_hvcons_irq(this_cpu);
++#endif
+ for_each_online_cpu(cpu) {
+- if (cpu == smp_processor_id())
++ if (cpu == this_cpu)
+ continue;
+ #ifdef CONFIG_SUN_LDOMS
+ if (ldom_domaining_enabled) {
+--- a/drivers/tty/serial/sunhv.c
++++ b/drivers/tty/serial/sunhv.c
+@@ -398,6 +398,12 @@ static struct uart_driver sunhv_reg = {
+
+ static struct uart_port *sunhv_port;
+
++void sunhv_migrate_hvcons_irq(int cpu)
++{
++ /* Migrate hvcons irq to param cpu */
++ irq_force_affinity(sunhv_port->irq, cpumask_of(cpu));
++}
++
+ /* Copy 's' into the con_write_page, decoding "\n" into
+ * "\r\n" along the way. We have to return two lengths
+ * because the caller needs to know how much to advance
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Michael Zoran <mzoran@crowfest.net>
+Date: Sat, 18 Feb 2017 03:22:01 -0800
+Subject: staging: vchiq_2835_arm: Make cache-line-size a required DT property
+
+From: Michael Zoran <mzoran@crowfest.net>
+
+
+[ Upstream commit 6cf1bf636a067eb308cb3a8322b9d6b1844a075d ]
+
+The original github source allowed for the cache-line-size property
+to be missing. Since recent firmwares also require this property,
+it makes sense to always require it in the driver as well.
+
+If the cache-line-size property is missing, then the driver probe
+should fail as no dev since the kernel and dt may be out of sync.
+The fix is to add a check for the return value of of_property_read_u32.
+
+Changes V2:
+ 1. Add error message if cache-line-size is missing.
+ 2. Simple check for non-zero return value from
+ of_property_read_u32.
+
+Signed-off-by: Michael Zoran <mzoran@crowfest.net>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+@@ -106,8 +106,14 @@ int vchiq_platform_init(struct platform_
+
+ g_virt_to_bus_offset = virt_to_dma(dev, (void *)0);
+
+- (void)of_property_read_u32(dev->of_node, "cache-line-size",
++ err = of_property_read_u32(dev->of_node, "cache-line-size",
+ &g_cache_line_size);
++
++ if (err) {
++ dev_err(dev, "Missing cache-line-size property\n");
++ return -ENODEV;
++ }
++
+ g_fragments_size = 2 * g_cache_line_size;
+
+ /* Allocate space for the channels in coherent memory */
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Varun Prakash <varun@chelsio.com>
+Date: Fri, 20 Jan 2017 16:44:33 +0530
+Subject: target/iscsi: Fix unsolicited data seq_end_offset calculation
+
+From: Varun Prakash <varun@chelsio.com>
+
+
+[ Upstream commit 4d65491c269729a1e3b375c45e73213f49103d33 ]
+
+In case of unsolicited data for the first sequence
+seq_end_offset must be set to minimum of total data length
+and FirstBurstLength, so do not add cmd->write_data_done
+to the min of total data length and FirstBurstLength.
+
+This patch avoids that with ImmediateData=Yes, InitialR2T=No,
+MaxXmitDataSegmentLength < FirstBurstLength that a WRITE command
+with IO size above FirstBurstLength triggers sequence error
+messages, for example
+
+Set following parameters on target (linux-4.8.12)
+ImmediateData = Yes
+InitialR2T = No
+MaxXmitDataSegmentLength = 8k
+FirstBurstLength = 64k
+
+Log in from Open iSCSI initiator and execute
+dd if=/dev/zero of=/dev/sdb bs=128k count=1 oflag=direct
+
+Error messages on target
+Command ITT: 0x00000035 with Offset: 65536, Length: 8192 outside
+of Sequence 73728:131072 while DataSequenceInOrder=Yes.
+Command ITT: 0x00000035, received DataSN: 0x00000001 higher than
+expected 0x00000000.
+Unable to perform within-command recovery while ERL=0.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+[ bvanassche: Use min() instead of open-coding it / edited patch description ]
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/target/iscsi/iscsi_target_erl0.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target_erl0.c
++++ b/drivers/target/iscsi/iscsi_target_erl0.c
+@@ -44,10 +44,8 @@ void iscsit_set_dataout_sequence_values(
+ */
+ if (cmd->unsolicited_data) {
+ cmd->seq_start_offset = cmd->write_data_done;
+- cmd->seq_end_offset = (cmd->write_data_done +
+- ((cmd->se_cmd.data_length >
+- conn->sess->sess_ops->FirstBurstLength) ?
+- conn->sess->sess_ops->FirstBurstLength : cmd->se_cmd.data_length));
++ cmd->seq_end_offset = min(cmd->se_cmd.data_length,
++ conn->sess->sess_ops->FirstBurstLength);
+ return;
+ }
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+Date: Thu, 16 Feb 2017 18:04:29 +0300
+Subject: uapi: fix linux/mroute6.h userspace compilation errors
+
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+
+
+[ Upstream commit 72aa107df6a275cf03359934ca5799a2be7a1bf7 ]
+
+Include <linux/in6.h> to fix the following linux/mroute6.h userspace
+compilation errors:
+
+/usr/include/linux/mroute6.h:80:22: error: field 'mf6cc_origin' has incomplete type
+ struct sockaddr_in6 mf6cc_origin; /* Origin of mcast */
+/usr/include/linux/mroute6.h:81:22: error: field 'mf6cc_mcastgrp' has incomplete type
+ struct sockaddr_in6 mf6cc_mcastgrp; /* Group in question */
+/usr/include/linux/mroute6.h:91:22: error: field 'src' has incomplete type
+ struct sockaddr_in6 src;
+/usr/include/linux/mroute6.h:92:22: error: field 'grp' has incomplete type
+ struct sockaddr_in6 grp;
+/usr/include/linux/mroute6.h:132:18: error: field 'im6_src' has incomplete type
+ struct in6_addr im6_src, im6_dst;
+/usr/include/linux/mroute6.h:132:27: error: field 'im6_dst' has incomplete type
+ struct in6_addr im6_src, im6_dst;
+
+Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/mroute6.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/uapi/linux/mroute6.h
++++ b/include/uapi/linux/mroute6.h
+@@ -4,6 +4,7 @@
+ #include <linux/kernel.h>
+ #include <linux/types.h>
+ #include <linux/sockios.h>
++#include <linux/in6.h> /* For struct sockaddr_in6. */
+
+ /*
+ * Based on the MROUTING 3.5 defines primarily to keep
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+Date: Thu, 16 Feb 2017 18:05:45 +0300
+Subject: uapi: fix linux/rds.h userspace compilation errors
+
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+
+
+[ Upstream commit feb0869d90e51ce8b6fd8a46588465b1b5a26d09 ]
+
+Consistently use types from linux/types.h to fix the following
+linux/rds.h userspace compilation errors:
+
+/usr/include/linux/rds.h:106:2: error: unknown type name 'uint8_t'
+ uint8_t name[32];
+/usr/include/linux/rds.h:107:2: error: unknown type name 'uint64_t'
+ uint64_t value;
+/usr/include/linux/rds.h:117:2: error: unknown type name 'uint64_t'
+ uint64_t next_tx_seq;
+/usr/include/linux/rds.h:118:2: error: unknown type name 'uint64_t'
+ uint64_t next_rx_seq;
+/usr/include/linux/rds.h:121:2: error: unknown type name 'uint8_t'
+ uint8_t transport[TRANSNAMSIZ]; /* null term ascii */
+/usr/include/linux/rds.h:122:2: error: unknown type name 'uint8_t'
+ uint8_t flags;
+/usr/include/linux/rds.h:129:2: error: unknown type name 'uint64_t'
+ uint64_t seq;
+/usr/include/linux/rds.h:130:2: error: unknown type name 'uint32_t'
+ uint32_t len;
+/usr/include/linux/rds.h:135:2: error: unknown type name 'uint8_t'
+ uint8_t flags;
+/usr/include/linux/rds.h:139:2: error: unknown type name 'uint32_t'
+ uint32_t sndbuf;
+/usr/include/linux/rds.h:144:2: error: unknown type name 'uint32_t'
+ uint32_t rcvbuf;
+/usr/include/linux/rds.h:145:2: error: unknown type name 'uint64_t'
+ uint64_t inum;
+/usr/include/linux/rds.h:153:2: error: unknown type name 'uint64_t'
+ uint64_t hdr_rem;
+/usr/include/linux/rds.h:154:2: error: unknown type name 'uint64_t'
+ uint64_t data_rem;
+/usr/include/linux/rds.h:155:2: error: unknown type name 'uint32_t'
+ uint32_t last_sent_nxt;
+/usr/include/linux/rds.h:156:2: error: unknown type name 'uint32_t'
+ uint32_t last_expected_una;
+/usr/include/linux/rds.h:157:2: error: unknown type name 'uint32_t'
+ uint32_t last_seen_una;
+/usr/include/linux/rds.h:164:2: error: unknown type name 'uint8_t'
+ uint8_t src_gid[RDS_IB_GID_LEN];
+/usr/include/linux/rds.h:165:2: error: unknown type name 'uint8_t'
+ uint8_t dst_gid[RDS_IB_GID_LEN];
+/usr/include/linux/rds.h:167:2: error: unknown type name 'uint32_t'
+ uint32_t max_send_wr;
+/usr/include/linux/rds.h:168:2: error: unknown type name 'uint32_t'
+ uint32_t max_recv_wr;
+/usr/include/linux/rds.h:169:2: error: unknown type name 'uint32_t'
+ uint32_t max_send_sge;
+/usr/include/linux/rds.h:170:2: error: unknown type name 'uint32_t'
+ uint32_t rdma_mr_max;
+/usr/include/linux/rds.h:171:2: error: unknown type name 'uint32_t'
+ uint32_t rdma_mr_size;
+/usr/include/linux/rds.h:212:9: error: unknown type name 'uint64_t'
+ typedef uint64_t rds_rdma_cookie_t;
+/usr/include/linux/rds.h:215:2: error: unknown type name 'uint64_t'
+ uint64_t addr;
+/usr/include/linux/rds.h:216:2: error: unknown type name 'uint64_t'
+ uint64_t bytes;
+/usr/include/linux/rds.h:221:2: error: unknown type name 'uint64_t'
+ uint64_t cookie_addr;
+/usr/include/linux/rds.h:222:2: error: unknown type name 'uint64_t'
+ uint64_t flags;
+/usr/include/linux/rds.h:228:2: error: unknown type name 'uint64_t'
+ uint64_t cookie_addr;
+/usr/include/linux/rds.h:229:2: error: unknown type name 'uint64_t'
+ uint64_t flags;
+/usr/include/linux/rds.h:234:2: error: unknown type name 'uint64_t'
+ uint64_t flags;
+/usr/include/linux/rds.h:240:2: error: unknown type name 'uint64_t'
+ uint64_t local_vec_addr;
+/usr/include/linux/rds.h:241:2: error: unknown type name 'uint64_t'
+ uint64_t nr_local;
+/usr/include/linux/rds.h:242:2: error: unknown type name 'uint64_t'
+ uint64_t flags;
+/usr/include/linux/rds.h:243:2: error: unknown type name 'uint64_t'
+ uint64_t user_token;
+/usr/include/linux/rds.h:248:2: error: unknown type name 'uint64_t'
+ uint64_t local_addr;
+/usr/include/linux/rds.h:249:2: error: unknown type name 'uint64_t'
+ uint64_t remote_addr;
+/usr/include/linux/rds.h:252:4: error: unknown type name 'uint64_t'
+ uint64_t compare;
+/usr/include/linux/rds.h:253:4: error: unknown type name 'uint64_t'
+ uint64_t swap;
+/usr/include/linux/rds.h:256:4: error: unknown type name 'uint64_t'
+ uint64_t add;
+/usr/include/linux/rds.h:259:4: error: unknown type name 'uint64_t'
+ uint64_t compare;
+/usr/include/linux/rds.h:260:4: error: unknown type name 'uint64_t'
+ uint64_t swap;
+/usr/include/linux/rds.h:261:4: error: unknown type name 'uint64_t'
+ uint64_t compare_mask;
+/usr/include/linux/rds.h:262:4: error: unknown type name 'uint64_t'
+ uint64_t swap_mask;
+/usr/include/linux/rds.h:265:4: error: unknown type name 'uint64_t'
+ uint64_t add;
+/usr/include/linux/rds.h:266:4: error: unknown type name 'uint64_t'
+ uint64_t nocarry_mask;
+/usr/include/linux/rds.h:269:2: error: unknown type name 'uint64_t'
+ uint64_t flags;
+/usr/include/linux/rds.h:270:2: error: unknown type name 'uint64_t'
+ uint64_t user_token;
+/usr/include/linux/rds.h:274:2: error: unknown type name 'uint64_t'
+ uint64_t user_token;
+/usr/include/linux/rds.h:275:2: error: unknown type name 'int32_t'
+ int32_t status;
+
+Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/rds.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/uapi/linux/rds.h
++++ b/include/uapi/linux/rds.h
+@@ -35,6 +35,7 @@
+ #define _LINUX_RDS_H
+
+ #include <linux/types.h>
++#include <linux/socket.h> /* For __kernel_sockaddr_storage. */
+
+ #define RDS_IB_ABI_VERSION 0x301
+
+@@ -223,7 +224,7 @@ struct rds_get_mr_args {
+ };
+
+ struct rds_get_mr_for_dest_args {
+- struct sockaddr_storage dest_addr;
++ struct __kernel_sockaddr_storage dest_addr;
+ struct rds_iovec vec;
+ uint64_t cookie_addr;
+ uint64_t flags;
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 1 Mar 2017 10:15:29 +0100
+Subject: watchdog: kempld: fix gcc-4.3 build
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 3736d4eb6af37492aeded7fec0072dedd959c842 ]
+
+gcc-4.3 can't decide whether the constant value in
+kempld_prescaler[PRESCALER_21] is built-time constant or
+not, and gets confused by the logic in do_div():
+
+drivers/watchdog/kempld_wdt.o: In function `kempld_wdt_set_stage_timeout':
+kempld_wdt.c:(.text.kempld_wdt_set_stage_timeout+0x130): undefined reference to `__aeabi_uldivmod'
+
+This adds a call to ACCESS_ONCE() to force it to not consider
+it to be constant, and leaves the more efficient normal case
+in place for modern compilers, using an #ifdef to annotate
+why we do this hack.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/watchdog/kempld_wdt.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/watchdog/kempld_wdt.c
++++ b/drivers/watchdog/kempld_wdt.c
+@@ -140,12 +140,19 @@ static int kempld_wdt_set_stage_timeout(
+ unsigned int timeout)
+ {
+ struct kempld_device_data *pld = wdt_data->pld;
+- u32 prescaler = kempld_prescaler[PRESCALER_21];
++ u32 prescaler;
+ u64 stage_timeout64;
+ u32 stage_timeout;
+ u32 remainder;
+ u8 stage_cfg;
+
++#if GCC_VERSION < 40400
++ /* work around a bug compiling do_div() */
++ prescaler = READ_ONCE(kempld_prescaler[PRESCALER_21]);
++#else
++ prescaler = kempld_prescaler[PRESCALER_21];
++#endif
++
+ if (!stage)
+ return -EINVAL;
+
--- /dev/null
+From foo@baz Thu Oct 19 15:04:02 CEST 2017
+From: Anoob Soman <anoob.soman@citrix.com>
+Date: Thu, 2 Mar 2017 10:50:20 +0000
+Subject: xen-netback: Use GFP_ATOMIC to allocate hash
+
+From: Anoob Soman <anoob.soman@citrix.com>
+
+
+[ Upstream commit 9f674e48c13dcbc31ac903433727837795b81efe ]
+
+Allocation of new_hash, inside xenvif_new_hash(), always happen
+in softirq context, so use GFP_ATOMIC instead of GFP_KERNEL for new
+hash allocation.
+
+Signed-off-by: Anoob Soman <anoob.soman@citrix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netback/hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/xen-netback/hash.c
++++ b/drivers/net/xen-netback/hash.c
+@@ -39,7 +39,7 @@ static void xenvif_add_hash(struct xenvi
+ unsigned long flags;
+ bool found;
+
+- new = kmalloc(sizeof(*entry), GFP_KERNEL);
++ new = kmalloc(sizeof(*entry), GFP_ATOMIC);
+ if (!new)
+ return;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
