--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Roger Quadros <rogerq@ti.com>
+Date: Mon, 12 Dec 2016 11:58:05 +0200
+Subject: ARM: dts: am57xx-idk: Put USB2 port in peripheral mode
+
+From: Roger Quadros <rogerq@ti.com>
+
+
+[ Upstream commit 5acd016c88937be3667ba4e6b60f0f74455b5e80 ]
+
+USB2 port can be operated in dual-role mode but till we
+have dual-role support in dwc3 driver let's limit this
+port to peripheral mode.
+
+If we don't do so it defaults to host mode. USB1 port
+is meant for host only operation and we don't want
+both ports in host only mode.
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am57xx-idk-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi
+@@ -294,7 +294,7 @@
+ };
+
+ &usb2 {
+- dr_mode = "otg";
++ dr_mode = "peripheral";
+ };
+
+ &mmc2 {
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Pali Rohár <pali.rohar@gmail.com>
+Date: Wed, 14 Dec 2016 22:29:44 +0100
+Subject: ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags
+
+From: Pali Rohár <pali.rohar@gmail.com>
+
+
+[ Upstream commit 4cf48f1d7520a4d325af58eded4d8090e1b40be7 ]
+
+Trying to initialize eMMC slot as SDIO or SD cause failure in n900 port of
+qemu. eMMC itself is not detected and is not working.
+
+Real Nokia N900 harware does not have this problem. As eMMC is really not
+SDIO or SD based such change is harmless and will fix support for qemu.
+
+Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/omap3-n900.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -734,6 +734,8 @@
+ vmmc_aux-supply = <&vsim>;
+ bus-width = <8>;
+ non-removable;
++ no-sdio;
++ no-sd;
+ };
+
+ &mmc3 {
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Maninder Singh <maninder1.s@samsung.com>
+Date: Thu, 8 Dec 2016 09:40:30 +0530
+Subject: ARM: omap2+: fixing wrong strcat for Non-NULL terminated string
+
+From: Maninder Singh <maninder1.s@samsung.com>
+
+
+[ Upstream commit 5066d5296ff2db20625e5f46e7338872c90c649f ]
+
+Issue caught with static analysis tool:
+"Dangerous usage of 'name' (strncpy doesn't always 0-terminate it)"
+
+Use strlcpy _includes_ the NUL terminator, and strlcat() which ensures
+that it won't overflow the buffer.
+
+Reported-by: Maninder Singh <maninder1.s@samsung.com>
+Signed-off-by: Vaneet Narang <v.narang@samsung.com>
+CC: Russell King <linux@armlinux.org.uk>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -790,14 +790,14 @@ static int _init_main_clk(struct omap_hw
+ int ret = 0;
+ char name[MOD_CLK_MAX_NAME_LEN];
+ struct clk *clk;
++ static const char modck[] = "_mod_ck";
+
+- /* +7 magic comes from '_mod_ck' suffix */
+- if (strlen(oh->name) + 7 > MOD_CLK_MAX_NAME_LEN)
++ if (strlen(oh->name) >= MOD_CLK_MAX_NAME_LEN - strlen(modck))
+ pr_warn("%s: warning: cropping name for %s\n", __func__,
+ oh->name);
+
+- strncpy(name, oh->name, MOD_CLK_MAX_NAME_LEN - 7);
+- strcat(name, "_mod_ck");
++ strlcpy(name, oh->name, MOD_CLK_MAX_NAME_LEN - strlen(modck));
++ strlcat(name, modck, MOD_CLK_MAX_NAME_LEN);
+
+ clk = clk_get(NULL, name);
+ if (!IS_ERR(clk)) {
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 23 Dec 2016 11:21:10 +0200
+Subject: ASoC: tlv320aic3x: Mark the RESET register as volatile
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+
+[ Upstream commit 63c3194b82530bd71fd49db84eb7ab656b8d404a ]
+
+The RESET register only have one self clearing bit and it should not be
+cached. If it is cached, when we sync the registers back to the chip we
+will initiate a software reset as well, which is not desirable.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reviewed-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/tlv320aic3x.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -126,6 +126,16 @@ static const struct reg_default aic3x_re
+ { 108, 0x00 }, { 109, 0x00 },
+ };
+
++static bool aic3x_volatile_reg(struct device *dev, unsigned int reg)
++{
++ switch (reg) {
++ case AIC3X_RESET:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static const struct regmap_config aic3x_regmap = {
+ .reg_bits = 8,
+ .val_bits = 8,
+@@ -133,6 +143,9 @@ static const struct regmap_config aic3x_
+ .max_register = DAC_ICC_ADJ,
+ .reg_defaults = aic3x_reg,
+ .num_reg_defaults = ARRAY_SIZE(aic3x_reg),
++
++ .volatile_reg = aic3x_volatile_reg,
++
+ .cache_type = REGCACHE_RBTREE,
+ };
+
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Jordan Crouse <jcrouse@codeaurora.org>
+Date: Tue, 20 Dec 2016 08:54:29 -0700
+Subject: drm/msm: Ensure that the hardware write pointer is valid
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+
+[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ]
+
+Currently the value written to CP_RB_WPTR is calculated on the fly as
+(rb->next - rb->start). But as the code is designed rb->next is wrapped
+before writing the commands so if a series of commands happened to
+fit perfectly in the ringbuffer, rb->next would end up being equal to
+rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR.
+
+The easiest way to fix this is to mask WPTR when writing it to the
+hardware; it makes the hardware happy and the rest of the ringbuffer
+math appears to work and there isn't any point in upsetting anything.
+
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+[squash in is_power_of_2() check]
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 ++++++++-
+ drivers/gpu/drm/msm/msm_ringbuffer.c | 3 ++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -210,7 +210,14 @@ void adreno_submit(struct msm_gpu *gpu,
+ void adreno_flush(struct msm_gpu *gpu)
+ {
+ struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+- uint32_t wptr = get_wptr(gpu->rb);
++ uint32_t wptr;
++
++ /*
++ * Mask wptr value that we calculate to fit in the HW range. This is
++ * to account for the possibility that the last command fit exactly into
++ * the ringbuffer and rb->next hasn't wrapped to zero yet
++ */
++ wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1);
+
+ /* ensure writes to ringbuffer have hit system memory: */
+ mb();
+--- a/drivers/gpu/drm/msm/msm_ringbuffer.c
++++ b/drivers/gpu/drm/msm/msm_ringbuffer.c
+@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_ne
+ struct msm_ringbuffer *ring;
+ int ret;
+
+- size = ALIGN(size, 4); /* size should be dword aligned */
++ if (WARN_ON(!is_power_of_2(size)))
++ return ERR_PTR(-EINVAL);
+
+ ring = kzalloc(sizeof(*ring), GFP_KERNEL);
+ if (!ring) {
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Jordan Crouse <jcrouse@codeaurora.org>
+Date: Tue, 20 Dec 2016 08:54:30 -0700
+Subject: drm/msm: Put back the vaddr in submit_reloc()
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+
+[ Upstream commit 6490abc4bc35fa4f3bdb9c7e49096943c50e29ea ]
+
+The error cases in submit_reloc() need to put back the virtual
+address of the bo before failling. Add a single failure path
+for the function.
+
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/msm_gem_submit.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -290,7 +290,7 @@ static int submit_reloc(struct msm_gem_s
+ {
+ uint32_t i, last_offset = 0;
+ uint32_t *ptr;
+- int ret;
++ int ret = 0;
+
+ if (offset % 4) {
+ DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset);
+@@ -317,12 +317,13 @@ static int submit_reloc(struct msm_gem_s
+
+ ret = copy_from_user(&submit_reloc, userptr, sizeof(submit_reloc));
+ if (ret)
+- return -EFAULT;
++ goto out;
+
+ if (submit_reloc.submit_offset % 4) {
+ DRM_ERROR("non-aligned reloc offset: %u\n",
+ submit_reloc.submit_offset);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+ /* offset in dwords: */
+@@ -331,12 +332,13 @@ static int submit_reloc(struct msm_gem_s
+ if ((off >= (obj->base.size / 4)) ||
+ (off < last_offset)) {
+ DRM_ERROR("invalid offset %u at reloc %u\n", off, i);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+ ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova, &valid);
+ if (ret)
+- return ret;
++ goto out;
+
+ if (valid)
+ continue;
+@@ -353,9 +355,10 @@ static int submit_reloc(struct msm_gem_s
+ last_offset = off;
+ }
+
++out:
+ msm_gem_put_vaddr_locked(&obj->base);
+
+- return 0;
++ return ret;
+ }
+
+ static void submit_cleanup(struct msm_gem_submit *submit)
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Jordan Crouse <jcrouse@codeaurora.org>
+Date: Tue, 20 Dec 2016 08:54:31 -0700
+Subject: drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+
+[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ]
+
+For every submission buffer object one of MSM_SUBMIT_BO_WRITE
+and MSM_SUBMIT_BO_READ must be set (and nothing else). If we
+allowed zero then the buffer object would never get queued to
+be unreferenced.
+
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/msm_gem_submit.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -106,7 +106,8 @@ static int submit_lookup_objects(struct
+ pagefault_disable();
+ }
+
+- if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
++ if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) ||
++ !(submit_bo.flags & MSM_SUBMIT_BO_FLAGS)) {
+ DRM_ERROR("invalid flags: %x\n", submit_bo.flags);
+ ret = -EINVAL;
+ goto out_unlock;
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Milo Kim <woogyom.kim@gmail.com>
+Date: Fri, 9 Dec 2016 15:28:33 +0900
+Subject: dt-bindings: input: Specify the interrupt number of TPS65217 power button
+
+From: Milo Kim <woogyom.kim@gmail.com>
+
+
+[ Upstream commit 820381572fc015baa4f5744f5d4583ec0c0f1b82 ]
+
+Specify the power button interrupt number which is from the datasheet.
+
+Signed-off-by: Milo Kim <woogyom.kim@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/input/tps65218-pwrbutton.txt | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/input/tps65218-pwrbutton.txt
++++ b/Documentation/devicetree/bindings/input/tps65218-pwrbutton.txt
+@@ -8,8 +8,9 @@ This driver provides a simple power butt
+ Required properties:
+ - compatible: should be "ti,tps65217-pwrbutton" or "ti,tps65218-pwrbutton"
+
+-Required properties for TPS65218:
++Required properties:
+ - interrupts: should be one of the following
++ - <2>: For controllers compatible with tps65217
+ - <3 IRQ_TYPE_EDGE_BOTH>: For controllers compatible with tps65218
+
+ Examples:
+@@ -17,6 +18,7 @@ Examples:
+ &tps {
+ tps65217-pwrbutton {
+ compatible = "ti,tps65217-pwrbutton";
++ interrupts = <2>;
+ };
+ };
+
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Milo Kim <woogyom.kim@gmail.com>
+Date: Fri, 9 Dec 2016 15:28:32 +0900
+Subject: dt-bindings: power/supply: Update TPS65217 properties
+
+From: Milo Kim <woogyom.kim@gmail.com>
+
+
+[ Upstream commit 81d7358d7038dd1001547950087e5b0641732f3f ]
+
+Add interrupt specifiers for USB and AC charger input. Interrupt numbers
+are from the datasheet.
+Fix wrong property for compatible string.
+
+Signed-off-by: Milo Kim <woogyom.kim@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/power/supply/tps65217_charger.txt | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/power/supply/tps65217_charger.txt
++++ b/Documentation/devicetree/bindings/power/supply/tps65217_charger.txt
+@@ -2,11 +2,16 @@ TPS65217 Charger
+
+ Required Properties:
+ -compatible: "ti,tps65217-charger"
++-interrupts: TPS65217 interrupt numbers for the AC and USB charger input change.
++ Should be <0> for the USB charger and <1> for the AC adapter.
++-interrupt-names: Should be "USB" and "AC"
+
+ This node is a subnode of the tps65217 PMIC.
+
+ Example:
+
+ tps65217-charger {
+- compatible = "ti,tps65090-charger";
++ compatible = "ti,tps65217-charger";
++ interrupts = <0>, <1>;
++ interrupt-names = "USB", "AC";
+ };
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Zheng Li <james.z.li@ericsson.com>
+Date: Wed, 28 Dec 2016 23:23:46 +0800
+Subject: ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
+
+From: Zheng Li <james.z.li@ericsson.com>
+
+
+[ Upstream commit e4c5e13aa45c23692e4acf56f0b3533f328199b2 ]
+
+There is an inconsistent conditional judgement between __ip6_append_data
+and ip6_finish_output functions, the variable length in __ip6_append_data
+just include the length of application's payload and udp6 header, don't
+include the length of ipv6 header, but in ip6_finish_output use
+(skb->len > ip6_skb_dst_mtu(skb)) as judgement, and skb->len include the
+length of ipv6 header.
+
+That causes some particular application's udp6 payloads whose length are
+between (MTU - IPv6 Header) and MTU were fragmented by ip6_fragment even
+though the rst->dev support UFO feature.
+
+Add the length of ipv6 header to length in __ip6_append_data to keep
+consistent conditional judgement as ip6_finish_output for ip6 fragment.
+
+Signed-off-by: Zheng Li <james.z.li@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1376,7 +1376,7 @@ emsgsize:
+ */
+
+ cork->length += length;
+- if (((length > mtu) ||
++ if ((((length + fragheaderlen) > mtu) ||
+ (skb && skb_is_gso(skb))) &&
+ (sk->sk_protocol == IPPROTO_UDP) &&
+ (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: "Strashko, Grygorii" <grygorii.strashko@ti.com>
+Date: Thu, 8 Dec 2016 17:33:10 -0600
+Subject: irqchip/keystone: Fix "scheduling while atomic" on rt
+
+From: "Strashko, Grygorii" <grygorii.strashko@ti.com>
+
+
+[ Upstream commit 2f884e6e688a0deb69e6c9552e51aef8b7e3f5f1 ]
+
+The below call chain generates "scheduling while atomic" backtrace and
+causes system crash when Keystone 2 IRQ chip driver is used with RT-kernel:
+
+gic_handle_irq()
+ |-__handle_domain_irq()
+ |-generic_handle_irq()
+ |-keystone_irq_handler()
+ |-regmap_read()
+ |-regmap_lock_spinlock()
+ |-rt_spin_lock()
+
+The reason is that Keystone driver dispatches IRQ using chained IRQ handler
+and accesses I/O memory through syscon->regmap(mmio) which is implemented
+as fast_io regmap and uses regular spinlocks for synchronization, but
+spinlocks transformed to rt_mutexes on RT.
+
+Hence, convert Keystone 2 IRQ driver to use generic irq handler instead of
+chained IRQ handler. This way it will be compatible with RT kernel where it
+will be forced thread IRQ handler while in non-RT kernel it still will be
+executed in HW IRQ context.
+
+Cc: Suman Anna <s-anna@ti.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Tested-by: Suman Anna <s-anna@ti.com>
+Link: https://lkml.kernel.org/r/20161208233310.10329-1-grygorii.strashko@ti.com
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/irq-keystone.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/irqchip/irq-keystone.c
++++ b/drivers/irqchip/irq-keystone.c
+@@ -19,9 +19,9 @@
+ #include <linux/bitops.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
++#include <linux/interrupt.h>
+ #include <linux/irqdomain.h>
+ #include <linux/irqchip.h>
+-#include <linux/irqchip/chained_irq.h>
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/mfd/syscon.h>
+@@ -39,6 +39,7 @@ struct keystone_irq_device {
+ struct irq_domain *irqd;
+ struct regmap *devctrl_regs;
+ u32 devctrl_offset;
++ raw_spinlock_t wa_lock;
+ };
+
+ static inline u32 keystone_irq_readl(struct keystone_irq_device *kirq)
+@@ -83,17 +84,15 @@ static void keystone_irq_ack(struct irq_
+ /* nothing to do here */
+ }
+
+-static void keystone_irq_handler(struct irq_desc *desc)
++static irqreturn_t keystone_irq_handler(int irq, void *keystone_irq)
+ {
+- unsigned int irq = irq_desc_get_irq(desc);
+- struct keystone_irq_device *kirq = irq_desc_get_handler_data(desc);
++ struct keystone_irq_device *kirq = keystone_irq;
++ unsigned long wa_lock_flags;
+ unsigned long pending;
+ int src, virq;
+
+ dev_dbg(kirq->dev, "start irq %d\n", irq);
+
+- chained_irq_enter(irq_desc_get_chip(desc), desc);
+-
+ pending = keystone_irq_readl(kirq);
+ keystone_irq_writel(kirq, pending);
+
+@@ -111,13 +110,15 @@ static void keystone_irq_handler(struct
+ if (!virq)
+ dev_warn(kirq->dev, "spurious irq detected hwirq %d, virq %d\n",
+ src, virq);
++ raw_spin_lock_irqsave(&kirq->wa_lock, wa_lock_flags);
+ generic_handle_irq(virq);
++ raw_spin_unlock_irqrestore(&kirq->wa_lock,
++ wa_lock_flags);
+ }
+ }
+
+- chained_irq_exit(irq_desc_get_chip(desc), desc);
+-
+ dev_dbg(kirq->dev, "end irq %d\n", irq);
++ return IRQ_HANDLED;
+ }
+
+ static int keystone_irq_map(struct irq_domain *h, unsigned int virq,
+@@ -182,9 +183,16 @@ static int keystone_irq_probe(struct pla
+ return -ENODEV;
+ }
+
++ raw_spin_lock_init(&kirq->wa_lock);
++
+ platform_set_drvdata(pdev, kirq);
+
+- irq_set_chained_handler_and_data(kirq->irq, keystone_irq_handler, kirq);
++ ret = request_irq(kirq->irq, keystone_irq_handler,
++ 0, dev_name(dev), kirq);
++ if (ret) {
++ irq_domain_remove(kirq->irqd);
++ return ret;
++ }
+
+ /* clear all source bits */
+ keystone_irq_writel(kirq, ~0x0);
+@@ -199,6 +207,8 @@ static int keystone_irq_remove(struct pl
+ struct keystone_irq_device *kirq = platform_get_drvdata(pdev);
+ int hwirq;
+
++ free_irq(kirq->irq, kirq);
++
+ for (hwirq = 0; hwirq < KEYSTONE_N_IRQ; hwirq++)
+ irq_dispose_mapping(irq_find_mapping(kirq->irqd, hwirq));
+
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Thu, 29 Dec 2016 18:37:11 +0200
+Subject: net/mlx4: Remove BUG_ON from ICM allocation routine
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+
+[ Upstream commit c1d5f8ff80ea84768f5fae1ca9d1abfbb5e6bbaa ]
+
+This patch removes BUG_ON() macro from mlx4_alloc_icm_coherent()
+by checking DMA address alignment in advance and performing proper
+folding in case of error.
+
+Fixes: 5b0bf5e25efe ("mlx4_core: Support ICM tables in coherent memory")
+Reported-by: Ozgur Karatas <okaratas@member.fsf.org>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/icm.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
+@@ -118,8 +118,13 @@ static int mlx4_alloc_icm_coherent(struc
+ if (!buf)
+ return -ENOMEM;
+
++ if (offset_in_page(buf)) {
++ dma_free_coherent(dev, PAGE_SIZE << order,
++ buf, sg_dma_address(mem));
++ return -ENOMEM;
++ }
++
+ sg_set_buf(mem, buf, PAGE_SIZE << order);
+- BUG_ON(mem->offset);
+ sg_dma_len(mem) = PAGE_SIZE << order;
+ return 0;
+ }
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Thu, 29 Dec 2016 18:37:13 +0200
+Subject: net/mlx4_core: Fix raw qp flow steering rules under SRIOV
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+
+[ Upstream commit 10b1c04e92229ebeb38ccd0dcf2b6d3ec73c0575 ]
+
+Demoting simple flow steering rule priority (for DPDK) was achieved by
+wrapping FW commands MLX4_QP_FLOW_STEERING_ATTACH/DETACH for the PF
+as well, and forcing the priority to MLX4_DOMAIN_NIC in the wrapper
+function for the PF and all VFs.
+
+In function mlx4_ib_create_flow(), this change caused the main rule
+creation for the PF to be wrapped, while it left the associated
+tunnel steering rule creation unwrapped for the PF.
+
+This mismatch caused rule deletion failures in mlx4_ib_destroy_flow()
+for the PF when the detach wrapper function did not find the associated
+tunnel-steering rule (since creation of that rule for the PF did not
+go through the wrapper function).
+
+Fix this by setting MLX4_QP_FLOW_STEERING_ATTACH/DETACH to be "native"
+(so that the PF invocation does not go through the wrapper), and perform
+the required priority demotion for the PF in the mlx4_ib_create_flow()
+code path.
+
+Fixes: 48564135cba8 ("net/mlx4_core: Demote simple multicast and broadcast flow steering rules")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/main.c | 14 +++++++++--
+ drivers/net/ethernet/mellanox/mlx4/main.c | 18 ++++++++++++++
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 22 ------------------
+ include/linux/mlx4/device.h | 2 +
+ 4 files changed, 33 insertions(+), 23 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -1680,9 +1680,19 @@ static int __mlx4_ib_create_flow(struct
+ size += ret;
+ }
+
++ if (mlx4_is_master(mdev->dev) && flow_type == MLX4_FS_REGULAR &&
++ flow_attr->num_of_specs == 1) {
++ struct _rule_hw *rule_header = (struct _rule_hw *)(ctrl + 1);
++ enum ib_flow_spec_type header_spec =
++ ((union ib_flow_spec *)(flow_attr + 1))->type;
++
++ if (header_spec == IB_FLOW_SPEC_ETH)
++ mlx4_handle_eth_header_mcast_prio(ctrl, rule_header);
++ }
++
+ ret = mlx4_cmd_imm(mdev->dev, mailbox->dma, reg_id, size >> 2, 0,
+ MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A,
+- MLX4_CMD_WRAPPED);
++ MLX4_CMD_NATIVE);
+ if (ret == -ENOMEM)
+ pr_err("mcg table is full. Fail to register network rule.\n");
+ else if (ret == -ENXIO)
+@@ -1699,7 +1709,7 @@ static int __mlx4_ib_destroy_flow(struct
+ int err;
+ err = mlx4_cmd(dev, reg_id, 0, 0,
+ MLX4_QP_FLOW_STEERING_DETACH, MLX4_CMD_TIME_CLASS_A,
+- MLX4_CMD_WRAPPED);
++ MLX4_CMD_NATIVE);
+ if (err)
+ pr_err("Fail to detach network rule. registration id = 0x%llx\n",
+ reg_id);
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -42,6 +42,7 @@
+ #include <linux/io-mapping.h>
+ #include <linux/delay.h>
+ #include <linux/kmod.h>
++#include <linux/etherdevice.h>
+ #include <net/devlink.h>
+
+ #include <linux/mlx4/device.h>
+@@ -782,6 +783,23 @@ int mlx4_is_slave_active(struct mlx4_dev
+ }
+ EXPORT_SYMBOL(mlx4_is_slave_active);
+
++void mlx4_handle_eth_header_mcast_prio(struct mlx4_net_trans_rule_hw_ctrl *ctrl,
++ struct _rule_hw *eth_header)
++{
++ if (is_multicast_ether_addr(eth_header->eth.dst_mac) ||
++ is_broadcast_ether_addr(eth_header->eth.dst_mac)) {
++ struct mlx4_net_trans_rule_hw_eth *eth =
++ (struct mlx4_net_trans_rule_hw_eth *)eth_header;
++ struct _rule_hw *next_rule = (struct _rule_hw *)(eth + 1);
++ bool last_rule = next_rule->size == 0 && next_rule->id == 0 &&
++ next_rule->rsvd == 0;
++
++ if (last_rule)
++ ctrl->prio = cpu_to_be16(MLX4_DOMAIN_NIC);
++ }
++}
++EXPORT_SYMBOL(mlx4_handle_eth_header_mcast_prio);
++
+ static void slave_adjust_steering_mode(struct mlx4_dev *dev,
+ struct mlx4_dev_cap *dev_cap,
+ struct mlx4_init_hca_param *hca_param)
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -4165,22 +4165,6 @@ static int validate_eth_header_mac(int s
+ return 0;
+ }
+
+-static void handle_eth_header_mcast_prio(struct mlx4_net_trans_rule_hw_ctrl *ctrl,
+- struct _rule_hw *eth_header)
+-{
+- if (is_multicast_ether_addr(eth_header->eth.dst_mac) ||
+- is_broadcast_ether_addr(eth_header->eth.dst_mac)) {
+- struct mlx4_net_trans_rule_hw_eth *eth =
+- (struct mlx4_net_trans_rule_hw_eth *)eth_header;
+- struct _rule_hw *next_rule = (struct _rule_hw *)(eth + 1);
+- bool last_rule = next_rule->size == 0 && next_rule->id == 0 &&
+- next_rule->rsvd == 0;
+-
+- if (last_rule)
+- ctrl->prio = cpu_to_be16(MLX4_DOMAIN_NIC);
+- }
+-}
+-
+ /*
+ * In case of missing eth header, append eth header with a MAC address
+ * assigned to the VF.
+@@ -4364,10 +4348,7 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper
+ header_id = map_hw_to_sw_id(be16_to_cpu(rule_header->id));
+
+ if (header_id == MLX4_NET_TRANS_RULE_ID_ETH)
+- handle_eth_header_mcast_prio(ctrl, rule_header);
+-
+- if (slave == dev->caps.function)
+- goto execute;
++ mlx4_handle_eth_header_mcast_prio(ctrl, rule_header);
+
+ switch (header_id) {
+ case MLX4_NET_TRANS_RULE_ID_ETH:
+@@ -4395,7 +4376,6 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper
+ goto err_put_qp;
+ }
+
+-execute:
+ err = mlx4_cmd_imm(dev, inbox->dma, &vhcr->out_param,
+ vhcr->in_modifier, 0,
+ MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A,
+--- a/include/linux/mlx4/device.h
++++ b/include/linux/mlx4/device.h
+@@ -1384,6 +1384,8 @@ int set_phv_bit(struct mlx4_dev *dev, u8
+ int get_phv_bit(struct mlx4_dev *dev, u8 port, int *phv);
+ int mlx4_get_is_vlan_offload_disabled(struct mlx4_dev *dev, u8 port,
+ bool *vlan_offload_disabled);
++void mlx4_handle_eth_header_mcast_prio(struct mlx4_net_trans_rule_hw_ctrl *ctrl,
++ struct _rule_hw *eth_header);
+ int mlx4_find_cached_mac(struct mlx4_dev *dev, u8 port, u64 mac, int *idx);
+ int mlx4_find_cached_vlan(struct mlx4_dev *dev, u8 port, u16 vid, int *idx);
+ int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index);
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Thu, 29 Dec 2016 18:37:09 +0200
+Subject: net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+
+[ Upstream commit 3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8 ]
+
+mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
+rule (which results in freeing the rule structure), and then
+references a field in this struct (the qp number) when releasing the
+busy-status on the rule's qp.
+
+Since this memory was freed, it could reallocated and changed.
+Therefore, the qp number in the struct may be incorrect,
+so that we are releasing the incorrect qp. This leaves the rule's qp
+in the busy state (and could possibly release an incorrect qp as well).
+
+Fix this by saving the qp number in a local variable, for use after
+removing the steering rule.
+
+Fixes: 2c473ae7e582 ("net/mlx4_core: Disallow releasing VF QPs which have steering rules")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -4474,6 +4474,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper
+ struct res_qp *rqp;
+ struct res_fs_rule *rrule;
+ u64 mirr_reg_id;
++ int qpn;
+
+ if (dev->caps.steering_mode !=
+ MLX4_STEERING_MODE_DEVICE_MANAGED)
+@@ -4490,10 +4491,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper
+ }
+ mirr_reg_id = rrule->mirr_rule_id;
+ kfree(rrule->mirr_mbox);
++ qpn = rrule->qpn;
+
+ /* Release the rule form busy state before removal */
+ put_res(dev, slave, vhcr->in_param, RES_FS_RULE);
+- err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp);
++ err = get_res(dev, slave, qpn, RES_QP, &rqp);
+ if (err)
+ return err;
+
+@@ -4518,7 +4520,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper
+ if (!err)
+ atomic_dec(&rqp->ref_count);
+ out:
+- put_res(dev, slave, rrule->qpn, RES_QP);
++ put_res(dev, slave, qpn, RES_QP);
+ return err;
+ }
+
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Or Gerlitz <ogerlitz@mellanox.com>
+Date: Wed, 28 Dec 2016 14:58:31 +0200
+Subject: net/mlx5: Disable RoCE on the e-switch management port under switchdev mode
+
+From: Or Gerlitz <ogerlitz@mellanox.com>
+
+
+[ Upstream commit 9da34cd34e85aacc55af8774b81b1f23e86014f9 ]
+
+Under the switchdev/offloads mode, packets that don't match any
+e-switch steering rule are sent towards the e-switch management
+port. We use a NIC HW steering rule set per vport (uplink and VFs)
+to make them be received into the host OS through the respective
+vport representor netdevice.
+
+Currnetly such missed RoCE packets will not get to this NIC steering
+rule, and hence VF RoCE will not work over the slow path of the offloads
+mode. This is b/c these packets will be matched by a steering rule added
+by the firmware that serves RoCE traffic set on the PF NIC vport which
+is also the e-switch management port under SRIOV.
+
+Disabling RoCE on the e-switch management vport when we are in the offloads
+mode, will signal to the firmware to remove their RoCE rule, and then the
+missed RoCE packets will be matched by the representor NIC steering rule
+as any other missed packets.
+
+To achieve that, we disable RoCE on the PF vport. We do that by removing
+(hot-unplugging) the IB device instance associated with the PF. This is
+also required by our current model where the PF serves as the uplink
+representor and hence only SW switching (TC, bridge, OVS) applications
+and slow path vport mlx5e net-device should be running over that vport.
+
+Fixes: c930a3ad7453 ('net/mlx5e: Add devlink based SRIOV mode changes')
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Reviewed-by: Hadar Hen Zion <hadarh@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -672,6 +672,12 @@ int esw_offloads_init(struct mlx5_eswitc
+ if (err)
+ goto err_reps;
+ }
++
++ /* disable PF RoCE so missed packets don't go through RoCE steering */
++ mlx5_dev_list_lock();
++ mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
++ mlx5_dev_list_unlock();
++
+ return 0;
+
+ err_reps:
+@@ -695,6 +701,11 @@ static int esw_offloads_stop(struct mlx5
+ {
+ int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
+
++ /* enable back PF RoCE */
++ mlx5_dev_list_lock();
++ mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
++ mlx5_dev_list_unlock();
++
+ mlx5_eswitch_disable_sriov(esw);
+ err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
+ if (err) {
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Chun-Hao Lin <hau@realtek.com>
+Date: Tue, 27 Dec 2016 16:29:43 +0800
+Subject: r8169: add support for RTL8168 series add-on card.
+
+From: Chun-Hao Lin <hau@realtek.com>
+
+
+[ Upstream commit 610c908773d30907c950ca3b2ee8ac4b2813537b ]
+
+This chip is the same as RTL8168, but its device id is 0x8161.
+
+Signed-off-by: Chun-Hao Lin <hau@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -326,6 +326,7 @@ enum cfg_version {
+ static const struct pci_device_id rtl8169_pci_tbl[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8129), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8136), 0, 0, RTL_CFG_2 },
++ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 },
+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 },
pstore-use-dynamic-spinlock-initializer.patch
net-skb_needs_check-accepts-checksum_none-for-tx.patch
device-dax-fix-sysfs-duplicate-warnings.patch
+x86-mce-amd-make-the-init-code-more-robust.patch
+r8169-add-support-for-rtl8168-series-add-on-card.patch
+arm-omap2-fixing-wrong-strcat-for-non-null-terminated-string.patch
+dt-bindings-power-supply-update-tps65217-properties.patch
+dt-bindings-input-specify-the-interrupt-number-of-tps65217-power-button.patch
+arm-dts-am57xx-idk-put-usb2-port-in-peripheral-mode.patch
+arm-dts-n900-mark-emmc-slot-with-no-sdio-and-no-sd-flags.patch
+net-mlx5-disable-roce-on-the-e-switch-management-port-under-switchdev-mode.patch
+ipv6-should-use-consistent-conditional-judgement-for-ip6-fragment-between-__ip6_append_data-and-ip6_finish_output.patch
+net-mlx4_core-use-after-free-causes-a-resource-leak-in-flow-steering-detach.patch
+net-mlx4-remove-bug_on-from-icm-allocation-routine.patch
+net-mlx4_core-fix-raw-qp-flow-steering-rules-under-sriov.patch
+drm-msm-ensure-that-the-hardware-write-pointer-is-valid.patch
+drm-msm-put-back-the-vaddr-in-submit_reloc.patch
+drm-msm-verify-that-msm_submit_bo_flags-are-set.patch
+vfio-pci-use-32-bit-comparisons-for-register-address-for-gcc-4.5.patch
+irqchip-keystone-fix-scheduling-while-atomic-on-rt.patch
+asoc-tlv320aic3x-mark-the-reset-register-as-volatile.patch
+spi-dw-make-debugfs-name-unique-between-instances.patch
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Phil Reid <preid@electromag.com.au>
+Date: Thu, 22 Dec 2016 17:18:12 +0800
+Subject: spi: dw: Make debugfs name unique between instances
+
+From: Phil Reid <preid@electromag.com.au>
+
+
+[ Upstream commit 13288bdf4adbaa6bd1267f10044c1bc25d90ce7f ]
+
+Some system have multiple dw devices. Currently the driver uses a
+fixed name for the debugfs dir. Append dev name to the debugfs dir
+name to make it unique.
+
+Signed-off-by: Phil Reid <preid@electromag.com.au>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-dw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -107,7 +107,10 @@ static const struct file_operations dw_s
+
+ static int dw_spi_debugfs_init(struct dw_spi *dws)
+ {
+- dws->debugfs = debugfs_create_dir("dw_spi", NULL);
++ char name[128];
++
++ snprintf(name, 128, "dw_spi-%s", dev_name(&dws->master->dev));
++ dws->debugfs = debugfs_create_dir(name, NULL);
+ if (!dws->debugfs)
+ return -ENOMEM;
+
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 30 Dec 2016 08:13:47 -0700
+Subject: vfio-pci: use 32-bit comparisons for register address for gcc-4.5
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 45e869714489431625c569d21fc952428d761476 ]
+
+Using ancient compilers (gcc-4.5 or older) on ARM, we get a link
+failure with the vfio-pci driver:
+
+ERROR: "__aeabi_lcmp" [drivers/vfio/pci/vfio-pci.ko] undefined!
+
+The reason is that the compiler tries to do a comparison of
+a 64-bit range. This changes it to convert to a 32-bit number
+explicitly first, as newer compilers do for themselves.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/vfio/pci/vfio_pci_rdwr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/vfio/pci/vfio_pci_rdwr.c
++++ b/drivers/vfio/pci/vfio_pci_rdwr.c
+@@ -193,7 +193,10 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_
+ if (!vdev->has_vga)
+ return -EINVAL;
+
+- switch (pos) {
++ if (pos > 0xbfffful)
++ return -EINVAL;
++
++ switch ((u32)pos) {
+ case 0xa0000 ... 0xbffff:
+ count = min(count, (size_t)(0xc0000 - pos));
+ iomem = ioremap_nocache(0xa0000, 0xbffff - 0xa0000 + 1);
--- /dev/null
+From foo@baz Fri Aug 4 13:32:40 PDT 2017
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 26 Dec 2016 22:58:20 +0100
+Subject: x86/mce/AMD: Make the init code more robust
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+
+[ Upstream commit 0dad3a3014a0b9e72521ff44f17e0054f43dcdea ]
+
+If mce_device_init() fails then the mce device pointer is NULL and the
+AMD mce code happily dereferences it.
+
+Add a sanity check.
+
+Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Reported-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce_amd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -955,6 +955,9 @@ static int threshold_create_bank(unsigne
+ const char *name = get_name(bank, NULL);
+ int err = 0;
+
++ if (!dev)
++ return -ENODEV;
++
+ if (is_shared_bank(bank)) {
+ nb = node_to_amd_nb(amd_get_nb_id(cpu));
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
