--- /dev/null
+From f08a964f6ad136189737f0c4dc04c2d2a45b2607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 19:53:13 -0700
+Subject: ACPI / SBS: Fix rare oops when removing modules
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ronald Tschalär <ronald@innovation.ch>
+
+[ Upstream commit 757c968c442397f1249bb775a7c8c03842e3e0c7 ]
+
+There was a small race when removing the sbshc module where
+smbus_alarm() had queued acpi_smbus_callback() for deferred execution
+but it hadn't been run yet, so that when it did run hc had been freed
+and the module unloaded, resulting in an invalid paging request.
+
+A similar race existed when removing the sbs module with regards to
+acpi_sbs_callback() (which is called from acpi_smbus_callback()).
+
+We therefore need to ensure no callbacks are pending or executing before
+the cleanups are done and the modules are removed.
+
+Signed-off-by: Ronald Tschalär <ronald@innovation.ch>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/osl.c | 1 +
+ drivers/acpi/sbshc.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index a000ecb995e66..e59f50576f2ae 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -1186,6 +1186,7 @@ void acpi_os_wait_events_complete(void)
+ flush_workqueue(kacpid_wq);
+ flush_workqueue(kacpi_notify_wq);
+ }
++EXPORT_SYMBOL(acpi_os_wait_events_complete);
+
+ struct acpi_hp_work {
+ struct work_struct work;
+diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c
+index 7a3431018e0ab..5008ead4609a4 100644
+--- a/drivers/acpi/sbshc.c
++++ b/drivers/acpi/sbshc.c
+@@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc)
+ hc->callback = NULL;
+ hc->context = NULL;
+ mutex_unlock(&hc->lock);
++ acpi_os_wait_events_complete();
+ return 0;
+ }
+
+@@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device)
+
+ hc = acpi_driver_data(device);
+ acpi_ec_remove_query_handler(hc->ec, hc->query_bit);
++ acpi_os_wait_events_complete();
+ kfree(hc);
+ device->driver_data = NULL;
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 4e2e3c8359ad2506edc6968bef4ba928973c3e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 14:58:21 -0400
+Subject: ALSA: hda/sigmatel - Disable automute for Elo VuPoint
+
+From: Michael Pobega <mpobega@neverware.com>
+
+[ Upstream commit d153135e93a50cdb6f1b52e238909e9965b56056 ]
+
+The Elo VuPoint 15MX has two headphone jacks of which neither work by
+default. Disabling automute allows ALSA to work normally with the
+speakers & left headphone jack.
+
+Future pin configuration changes may be required in the future to get
+the right headphone jack working in tandem.
+
+Signed-off-by: Michael Pobega <mpobega@neverware.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_sigmatel.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 0abab7926dca3..d1a6d20ace0da 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -77,6 +77,7 @@ enum {
+ STAC_DELL_M6_BOTH,
+ STAC_DELL_EQ,
+ STAC_ALIENWARE_M17X,
++ STAC_ELO_VUPOINT_15MX,
+ STAC_92HD89XX_HP_FRONT_JACK,
+ STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK,
+ STAC_92HD73XX_ASUS_MOBO,
+@@ -1875,6 +1876,18 @@ static void stac92hd73xx_fixup_no_jd(struct hda_codec *codec,
+ codec->no_jack_detect = 1;
+ }
+
++
++static void stac92hd73xx_disable_automute(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct sigmatel_spec *spec = codec->spec;
++
++ if (action != HDA_FIXUP_ACT_PRE_PROBE)
++ return;
++
++ spec->gen.suppress_auto_mute = 1;
++}
++
+ static const struct hda_fixup stac92hd73xx_fixups[] = {
+ [STAC_92HD73XX_REF] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -1900,6 +1913,10 @@ static const struct hda_fixup stac92hd73xx_fixups[] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = stac92hd73xx_fixup_alienware_m17x,
+ },
++ [STAC_ELO_VUPOINT_15MX] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = stac92hd73xx_disable_automute,
++ },
+ [STAC_92HD73XX_INTEL] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = intel_dg45id_pin_configs,
+@@ -1938,6 +1955,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = {
+ { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" },
+ { .id = STAC_DELL_EQ, .name = "dell-eq" },
+ { .id = STAC_ALIENWARE_M17X, .name = "alienware" },
++ { .id = STAC_ELO_VUPOINT_15MX, .name = "elo-vupoint-15mx" },
+ { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" },
+ {}
+ };
+@@ -1987,6 +2005,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = {
+ "Alienware M17x", STAC_ALIENWARE_M17X),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490,
+ "Alienware M17x R3", STAC_DELL_EQ),
++ SND_PCI_QUIRK(0x1059, 0x1011,
++ "ELO VuPoint 15MX", STAC_ELO_VUPOINT_15MX),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1927,
+ "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17,
+--
+2.20.1
+
--- /dev/null
+From df09f5426f7d5626102129353870e82a40295de5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 19:26:48 +0100
+Subject: ARM: 8802/1: Call syscall_trace_exit even when system call skipped
+
+From: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
+
+[ Upstream commit f18aef742c8fbd68e280dff0a63ba0ca6ee8ad85 ]
+
+On at least x86 and ARM64, and as documented in the ptrace man page
+a skipped system call will still cause a syscall exit ptrace stop.
+
+Previous to this commit 32-bit ARM did not, resulting in strace
+being confused when seccomp skips system calls.
+
+This change also impacts programs that use ptrace to skip system calls.
+
+Fixes: ad75b51459ae ("ARM: 7579/1: arch/allow a scno of -1 to not cause a SIGILL")
+Signed-off-by: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
+Signed-off-by: Eugene Syromyatnikov <evgsyr@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Tested-by: Kees Cook <keescook@chromium.org>
+Tested-by: Eugene Syromyatnikov <evgsyr@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/entry-common.S | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
+index e969b18d9ff93..d31f0300d2c98 100644
+--- a/arch/arm/kernel/entry-common.S
++++ b/arch/arm/kernel/entry-common.S
+@@ -261,16 +261,15 @@ __sys_trace:
+ cmp scno, #-1 @ skip the syscall?
+ bne 2b
+ add sp, sp, #S_OFF @ restore stack
+- b ret_slow_syscall
+
+-__sys_trace_return:
+- str r0, [sp, #S_R0 + S_OFF]! @ save returned r0
++__sys_trace_return_nosave:
++ enable_irq_notrace
+ mov r0, sp
+ bl syscall_trace_exit
+ b ret_slow_syscall
+
+-__sys_trace_return_nosave:
+- enable_irq_notrace
++__sys_trace_return:
++ str r0, [sp, #S_R0 + S_OFF]! @ save returned r0
+ mov r0, sp
+ bl syscall_trace_exit
+ b ret_slow_syscall
+--
+2.20.1
+
--- /dev/null
+From 8760aec3e11ad97c384a06ff41d31e12c846f0fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Sep 2018 17:54:00 +0200
+Subject: ARM: dts: omap5: enable OTG role for DWC3 controller
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 656c1a65ab555ee5c7cd0d6aee8ab82ca3c1795f ]
+
+Since SMPS10 and OTG cable detection extcon are described here, and
+work to enable OTG power when an OTG cable is plugged in, we can
+define OTG mode in the controller (which is disabled by default in
+omap5.dtsi).
+
+Tested on OMAP5EVM and Pyra.
+
+Suggested-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap5-board-common.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
+index 41e80e7f20bea..d2398d2a0c08c 100644
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -633,6 +633,10 @@
+ vbus-supply = <&smps10_out1_reg>;
+ };
+
++&dwc3 {
++ dr_mode = "otg";
++};
++
+ &mcspi1 {
+
+ };
+--
+2.20.1
+
--- /dev/null
+From cf6a7f6eb38eabe0adafdc9195d78d5e29ce5be6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 19:27:44 +0200
+Subject: ARM: dts: omap5: Fix dual-role mode on Super-Speed port
+
+From: Roger Quadros <rogerq@ti.com>
+
+[ Upstream commit a763ecc15d0e37c3a15ff6825183061209832685 ]
+
+OMAP5's Super-Speed USB port has a software mailbox register
+that needs to be fed with VBUS and ID events from an external
+VBUS/ID comparator.
+
+Without this, Host role will not work correctly.
+
+Fixes: 656c1a65ab55 ("ARM: dts: omap5: enable OTG role for DWC3 controller")
+Reported-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap5-board-common.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi
+index d2398d2a0c08c..4ea4cf6c5b471 100644
+--- a/arch/arm/boot/dts/omap5-board-common.dtsi
++++ b/arch/arm/boot/dts/omap5-board-common.dtsi
+@@ -634,6 +634,7 @@
+ };
+
+ &dwc3 {
++ extcon = <&extcon_usb3>;
+ dr_mode = "otg";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 54b9475935912e9642a7f0d383fdb0947183bef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 19:37:54 -0700
+Subject: ata: ep93xx: Use proper enums for directions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 6adde4a36f1b6a562a1057fbb1065007851050e7 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/ata/pata_ep93xx.c:662:36: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ drv_data->dma_rx_data.direction = DMA_FROM_DEVICE;
+ ~ ^~~~~~~~~~~~~~~
+drivers/ata/pata_ep93xx.c:670:36: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ drv_data->dma_tx_data.direction = DMA_TO_DEVICE;
+ ~ ^~~~~~~~~~~~~
+drivers/ata/pata_ep93xx.c:681:19: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ conf.direction = DMA_FROM_DEVICE;
+ ~ ^~~~~~~~~~~~~~~
+drivers/ata/pata_ep93xx.c:692:19: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ conf.direction = DMA_TO_DEVICE;
+ ~ ^~~~~~~~~~~~~
+
+Use the equivalent valued enums from the expected type so that Clang no
+longer warns about a conversion.
+
+DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1
+DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2
+
+Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_ep93xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c
+index bd6b089c67a3a..634c814cbeda4 100644
+--- a/drivers/ata/pata_ep93xx.c
++++ b/drivers/ata/pata_ep93xx.c
+@@ -659,7 +659,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+ * start of new transfer.
+ */
+ drv_data->dma_rx_data.port = EP93XX_DMA_IDE;
+- drv_data->dma_rx_data.direction = DMA_FROM_DEVICE;
++ drv_data->dma_rx_data.direction = DMA_DEV_TO_MEM;
+ drv_data->dma_rx_data.name = "ep93xx-pata-rx";
+ drv_data->dma_rx_channel = dma_request_channel(mask,
+ ep93xx_pata_dma_filter, &drv_data->dma_rx_data);
+@@ -667,7 +667,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+ return;
+
+ drv_data->dma_tx_data.port = EP93XX_DMA_IDE;
+- drv_data->dma_tx_data.direction = DMA_TO_DEVICE;
++ drv_data->dma_tx_data.direction = DMA_MEM_TO_DEV;
+ drv_data->dma_tx_data.name = "ep93xx-pata-tx";
+ drv_data->dma_tx_channel = dma_request_channel(mask,
+ ep93xx_pata_dma_filter, &drv_data->dma_tx_data);
+@@ -678,7 +678,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+
+ /* Configure receive channel direction and source address */
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = DMA_FROM_DEVICE;
++ conf.direction = DMA_DEV_TO_MEM;
+ conf.src_addr = drv_data->udma_in_phys;
+ conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ if (dmaengine_slave_config(drv_data->dma_rx_channel, &conf)) {
+@@ -689,7 +689,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data)
+
+ /* Configure transmit channel direction and destination address */
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = DMA_TO_DEVICE;
++ conf.direction = DMA_MEM_TO_DEV;
+ conf.dst_addr = drv_data->udma_out_phys;
+ conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ if (dmaengine_slave_config(drv_data->dma_tx_channel, &conf)) {
+--
+2.20.1
+
--- /dev/null
+From 19bff8eaf683eb67f731c7c8511a8925aacece7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 19:46:20 +0300
+Subject: ath10k: fix vdev-start timeout on error
+
+From: Ben Greear <greearb@candelatech.com>
+
+[ Upstream commit 833fd34d743c728afe6d127ef7bee67e7d9199a8 ]
+
+The vdev-start-response message should cause the
+completion to fire, even in the error case. Otherwise,
+the user still gets no useful information and everything
+is blocked until the timeout period.
+
+Add some warning text to print out the invalid status
+code to aid debugging, and propagate failure code.
+
+Signed-off-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/core.h | 1 +
+ drivers/net/wireless/ath/ath10k/mac.c | 2 +-
+ drivers/net/wireless/ath/ath10k/wmi.c | 19 ++++++++++++++++---
+ drivers/net/wireless/ath/ath10k/wmi.h | 8 +++++++-
+ 4 files changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
+index 257836a0cfbc0..a7fab3b0a443f 100644
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -755,6 +755,7 @@ struct ath10k {
+
+ struct completion install_key_done;
+
++ int last_wmi_vdev_start_status;
+ struct completion vdev_setup_done;
+
+ struct workqueue_struct *workqueue;
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 5a0138c1c0455..7fbf2abcfc433 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -850,7 +850,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
+ if (time_left == 0)
+ return -ETIMEDOUT;
+
+- return 0;
++ return ar->last_wmi_vdev_start_status;
+ }
+
+ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index f7ce99f67b5c5..4d8cdbfc9d422 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -2945,18 +2945,31 @@ void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb)
+ {
+ struct wmi_vdev_start_ev_arg arg = {};
+ int ret;
++ u32 status;
+
+ ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n");
+
++ ar->last_wmi_vdev_start_status = 0;
++
+ ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg);
+ if (ret) {
+ ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret);
+- return;
++ ar->last_wmi_vdev_start_status = ret;
++ goto out;
+ }
+
+- if (WARN_ON(__le32_to_cpu(arg.status)))
+- return;
++ status = __le32_to_cpu(arg.status);
++ if (WARN_ON_ONCE(status)) {
++ ath10k_warn(ar, "vdev-start-response reports status error: %d (%s)\n",
++ status, (status == WMI_VDEV_START_CHAN_INVALID) ?
++ "chan-invalid" : "unknown");
++ /* Setup is done one way or another though, so we should still
++ * do the completion, so don't return here.
++ */
++ ar->last_wmi_vdev_start_status = -EINVAL;
++ }
+
++out:
+ complete(&ar->vdev_setup_done);
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index a8b2553e8988a..66148a82ad25a 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -5969,11 +5969,17 @@ struct wmi_ch_info_ev_arg {
+ __le32 rx_frame_count;
+ };
+
++/* From 10.4 firmware, not sure all have the same values. */
++enum wmi_vdev_start_status {
++ WMI_VDEV_START_OK = 0,
++ WMI_VDEV_START_CHAN_INVALID,
++};
++
+ struct wmi_vdev_start_ev_arg {
+ __le32 vdev_id;
+ __le32 req_id;
+ __le32 resp_type; /* %WMI_VDEV_RESP_ */
+- __le32 status;
++ __le32 status; /* See wmi_vdev_start_status enum above */
+ };
+
+ struct wmi_peer_kick_ev_arg {
+--
+2.20.1
+
--- /dev/null
+From 66114d5d899df6daf29dacaed8cda5ecc7a3c313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 17:26:59 +0300
+Subject: ath9k: fix reporting calculated new FFT upper max
+
+From: Simon Wunderlich <sw@simonwunderlich.de>
+
+[ Upstream commit 4fb5837ac2bd46a85620b297002c704e9958f64d ]
+
+Since the debug print code is outside of the loop, it shouldn't use the loop
+iterator anymore but instead print the found maximum index.
+
+Cc: Nick Kossifidis <mickflemm@gmail.com>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/common-spectral.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
+index 03945731eb65a..ec805fe6dddbb 100644
+--- a/drivers/net/wireless/ath/ath9k/common-spectral.c
++++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
+@@ -411,7 +411,7 @@ ath_cmn_process_ht20_40_fft(struct ath_rx_status *rs,
+
+ ath_dbg(common, SPECTRAL_SCAN,
+ "Calculated new upper max 0x%X at %i\n",
+- tmp_mag, i);
++ tmp_mag, fft_sample_40.upper_max_index);
+ } else
+ for (i = dc_pos; i < SPECTRAL_HT20_40_NUM_BINS; i++) {
+ if (fft_sample_40.data[i] == (upper_mag >> max_exp))
+--
+2.20.1
+
--- /dev/null
+From cdd17c9fd47ec4d6b64e85ff1f68a6c6611d50a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 13:21:31 -0700
+Subject: backlight: lm3639: Unconditionally call led_classdev_unregister
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 7cea645ae9c5a54aa7904fddb2cdf250acd63a6c ]
+
+Clang warns that the address of a pointer will always evaluated as true
+in a boolean context.
+
+drivers/video/backlight/lm3639_bl.c:403:14: warning: address of
+'pchip->cdev_torch' will always evaluate to 'true'
+[-Wpointer-bool-conversion]
+ if (&pchip->cdev_torch)
+ ~~ ~~~~~~~^~~~~~~~~~
+drivers/video/backlight/lm3639_bl.c:405:14: warning: address of
+'pchip->cdev_flash' will always evaluate to 'true'
+[-Wpointer-bool-conversion]
+ if (&pchip->cdev_flash)
+ ~~ ~~~~~~~^~~~~~~~~~
+2 warnings generated.
+
+These statements have been present since 2012, introduced by
+commit 0f59858d5119 ("backlight: add new lm3639 backlight
+driver"). Given that they have been called unconditionally since
+then presumably without any issues, removing the always true if
+statements to fix the warnings without any real world changes.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/119
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3639_bl.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c
+index cd50df5807ead..086611c7bc03c 100644
+--- a/drivers/video/backlight/lm3639_bl.c
++++ b/drivers/video/backlight/lm3639_bl.c
+@@ -400,10 +400,8 @@ static int lm3639_remove(struct i2c_client *client)
+
+ regmap_write(pchip->regmap, REG_ENABLE, 0x00);
+
+- if (&pchip->cdev_torch)
+- led_classdev_unregister(&pchip->cdev_torch);
+- if (&pchip->cdev_flash)
+- led_classdev_unregister(&pchip->cdev_flash);
++ led_classdev_unregister(&pchip->cdev_torch);
++ led_classdev_unregister(&pchip->cdev_flash);
+ if (pchip->bled)
+ device_remove_file(&(pchip->bled->dev), &dev_attr_bled_mode);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 9158e2ede5e428432ce03255fe637a448dbce687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 20:41:15 +0800
+Subject: bcache: recal cached_dev_sectors on detach
+
+From: Shenghui Wang <shhuiw@foxmail.com>
+
+[ Upstream commit 46010141da6677b81cc77f9b47f8ac62bd1cbfd3 ]
+
+Recal cached_dev_sectors on cached_dev detached, as recal done on
+cached_dev attached.
+
+Update the cached_dev_sectors before bcache_device_detach called
+as bcache_device_detach will set bcache_device->c to NULL.
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index e420921460836..df8f1e69077f6 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -902,6 +902,7 @@ static void cached_dev_detach_finish(struct work_struct *w)
+ bch_write_bdev_super(dc, &cl);
+ closure_sync(&cl);
+
++ calc_cached_dev_sectors(dc->disk.c);
+ bcache_device_detach(&dc->disk);
+ list_move(&dc->list, &uncached_devices);
+
+--
+2.20.1
+
--- /dev/null
+From 580c1530f2b2e339ab2f82732d945e640721cd22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 14:59:49 +0000
+Subject: brcmfmac: fix full timeout waiting for action frame on-channel tx
+
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+
+[ Upstream commit fbf07000960d9c8a13fdc17c6de0230d681c7543 ]
+
+The driver sends an action frame down and waits for a completion signal
+triggered by the received BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE event
+to continue the process. However, the action frame could be transmitted
+either on the current channel or on an off channel. For the on-channel
+case, only BRCMF_E_ACTION_FRAME_COMPLETE event will be received when
+the frame is transmitted, which make the driver always wait a full
+timeout duration. This patch has the completion signal be triggered by
+receiving the BRCMF_E_ACTION_FRAME_COMPLETE event for the on-channel
+case.
+
+This change fixes WFA p2p certification 5.1.19 failure.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/brcm80211/brcmfmac/p2p.c | 17 +++++++++++++++--
+ drivers/net/wireless/brcm80211/brcmfmac/p2p.h | 2 ++
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+index e6c8b0d5afe06..7dae935701a72 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+@@ -1469,10 +1469,12 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
+ return 0;
+
+ if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) {
+- if (e->status == BRCMF_E_STATUS_SUCCESS)
++ if (e->status == BRCMF_E_STATUS_SUCCESS) {
+ set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
+ &p2p->status);
+- else {
++ if (!p2p->wait_for_offchan_complete)
++ complete(&p2p->send_af_done);
++ } else {
+ set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+ /* If there is no ack, we don't need to wait for
+ * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event
+@@ -1523,6 +1525,17 @@ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+ p2p->af_sent_channel = le32_to_cpu(af_params->channel);
+ p2p->af_tx_sent_jiffies = jiffies;
+
++ if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) &&
++ p2p->af_sent_channel ==
++ ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq))
++ p2p->wait_for_offchan_complete = false;
++ else
++ p2p->wait_for_offchan_complete = true;
++
++ brcmf_dbg(TRACE, "Waiting for %s tx completion event\n",
++ (p2p->wait_for_offchan_complete) ?
++ "off-channel" : "on-channel");
++
+ timeout = wait_for_completion_timeout(&p2p->send_af_done,
+ msecs_to_jiffies(P2P_AF_MAX_WAIT_TIME));
+
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
+index 5d49059021a9f..59e902adfc087 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
++++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
+@@ -125,6 +125,7 @@ struct afx_hdl {
+ * @gon_req_action: about to send go negotiation requets frame.
+ * @block_gon_req_tx: drop tx go negotiation requets frame.
+ * @p2pdev_dynamically: is p2p device if created by module param or supplicant.
++ * @wait_for_offchan_complete: wait for off-channel tx completion event.
+ */
+ struct brcmf_p2p_info {
+ struct brcmf_cfg80211_info *cfg;
+@@ -146,6 +147,7 @@ struct brcmf_p2p_info {
+ bool gon_req_action;
+ bool block_gon_req_tx;
+ bool p2pdev_dynamically;
++ bool wait_for_offchan_complete;
+ };
+
+ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced);
+--
+2.20.1
+
--- /dev/null
+From 67088a95040c0acd3ab6f751e7c4a66413afd90e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Oct 2018 19:01:52 +0000
+Subject: crypto: mxs-dcp - Fix AES issues
+
+From: Radu Solea <radu.solea@nxp.com>
+
+[ Upstream commit fadd7a6e616b89c7f4f7bfa7b824f290bab32c3c ]
+
+The DCP driver does not obey cryptlen, when doing android CTS this
+results in passing to hardware input stream lengths which are not
+multiple of block size.
+
+Add a check to prevent future erroneous stream lengths from reaching the
+hardware and adjust the scatterlist walking code to obey cryptlen.
+
+Also properly copy-out the IV for chaining.
+
+Signed-off-by: Radu Solea <radu.solea@nxp.com>
+Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxs-dcp.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index 38c5dd8891138..4b82cf9da0ba7 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -225,6 +225,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+ dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
+ DCP_BUF_SZ, DMA_FROM_DEVICE);
+
++ if (actx->fill % AES_BLOCK_SIZE) {
++ dev_err(sdcp->dev, "Invalid block size!\n");
++ ret = -EINVAL;
++ goto aes_done_run;
++ }
++
+ /* Fill in the DMA descriptor. */
+ desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE |
+ MXS_DCP_CONTROL0_INTERRUPT |
+@@ -254,6 +260,7 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+
+ ret = mxs_dcp_start_dma(actx);
+
++aes_done_run:
+ dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128,
+ DMA_TO_DEVICE);
+ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+@@ -280,13 +287,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+
+ uint8_t *out_tmp, *src_buf, *dst_buf = NULL;
+ uint32_t dst_off = 0;
++ uint32_t last_out_len = 0;
+
+ uint8_t *key = sdcp->coh->aes_key;
+
+ int ret = 0;
+ int split = 0;
+- unsigned int i, len, clen, rem = 0;
++ unsigned int i, len, clen, rem = 0, tlen = 0;
+ int init = 0;
++ bool limit_hit = false;
+
+ actx->fill = 0;
+
+@@ -305,6 +314,11 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ for_each_sg(req->src, src, nents, i) {
+ src_buf = sg_virt(src);
+ len = sg_dma_len(src);
++ tlen += len;
++ limit_hit = tlen > req->nbytes;
++
++ if (limit_hit)
++ len = req->nbytes - (tlen - len);
+
+ do {
+ if (actx->fill + len > out_off)
+@@ -321,13 +335,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ * If we filled the buffer or this is the last SG,
+ * submit the buffer.
+ */
+- if (actx->fill == out_off || sg_is_last(src)) {
++ if (actx->fill == out_off || sg_is_last(src) ||
++ limit_hit) {
+ ret = mxs_dcp_run_aes(actx, req, init);
+ if (ret)
+ return ret;
+ init = 0;
+
+ out_tmp = out_buf;
++ last_out_len = actx->fill;
+ while (dst && actx->fill) {
+ if (!split) {
+ dst_buf = sg_virt(dst);
+@@ -350,6 +366,19 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
+ }
+ }
+ } while (len);
++
++ if (limit_hit)
++ break;
++ }
++
++ /* Copy the IV for CBC for chaining */
++ if (!rctx->ecb) {
++ if (rctx->enc)
++ memcpy(req->info, out_buf+(last_out_len-AES_BLOCK_SIZE),
++ AES_BLOCK_SIZE);
++ else
++ memcpy(req->info, in_buf+(last_out_len-AES_BLOCK_SIZE),
++ AES_BLOCK_SIZE);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From fa53b9f05c1729955bce858b92466c78d50911ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Oct 2018 19:01:50 +0000
+Subject: crypto: mxs-dcp - Fix SHA null hashes and output length
+
+From: Radu Solea <radu.solea@nxp.com>
+
+[ Upstream commit c709eebaf5c5faa8a0f140355f9cfe67e8f7afb1 ]
+
+DCP writes at least 32 bytes in the output buffer instead of hash length
+as documented. Add intermediate buffer to prevent write out of bounds.
+
+When requested to produce null hashes DCP fails to produce valid output.
+Add software workaround to bypass hardware and return valid output.
+
+Signed-off-by: Radu Solea <radu.solea@nxp.com>
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxs-dcp.c | 47 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 37 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index fe8cfe24c518f..38c5dd8891138 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -28,9 +28,24 @@
+
+ #define DCP_MAX_CHANS 4
+ #define DCP_BUF_SZ PAGE_SIZE
++#define DCP_SHA_PAY_SZ 64
+
+ #define DCP_ALIGNMENT 64
+
++/*
++ * Null hashes to align with hw behavior on imx6sl and ull
++ * these are flipped for consistency with hw output
++ */
++const uint8_t sha1_null_hash[] =
++ "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf"
++ "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda";
++
++const uint8_t sha256_null_hash[] =
++ "\x55\xb8\x52\x78\x1b\x99\x95\xa4"
++ "\x4c\x93\x9b\x64\xe4\x41\xae\x27"
++ "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a"
++ "\x14\x1c\xfc\x98\x42\xc4\xb0\xe3";
++
+ /* DCP DMA descriptor. */
+ struct dcp_dma_desc {
+ uint32_t next_cmd_addr;
+@@ -48,6 +63,7 @@ struct dcp_coherent_block {
+ uint8_t aes_in_buf[DCP_BUF_SZ];
+ uint8_t aes_out_buf[DCP_BUF_SZ];
+ uint8_t sha_in_buf[DCP_BUF_SZ];
++ uint8_t sha_out_buf[DCP_SHA_PAY_SZ];
+
+ uint8_t aes_key[2 * AES_KEYSIZE_128];
+
+@@ -518,8 +534,6 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+ struct dcp_async_ctx *actx = crypto_ahash_ctx(tfm);
+ struct dcp_sha_req_ctx *rctx = ahash_request_ctx(req);
+- struct hash_alg_common *halg = crypto_hash_alg_common(tfm);
+-
+ struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
+
+ dma_addr_t digest_phys = 0;
+@@ -541,10 +555,23 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ desc->payload = 0;
+ desc->status = 0;
+
++ /*
++ * Align driver with hw behavior when generating null hashes
++ */
++ if (rctx->init && rctx->fini && desc->size == 0) {
++ struct hash_alg_common *halg = crypto_hash_alg_common(tfm);
++ const uint8_t *sha_buf =
++ (actx->alg == MXS_DCP_CONTROL1_HASH_SELECT_SHA1) ?
++ sha1_null_hash : sha256_null_hash;
++ memcpy(sdcp->coh->sha_out_buf, sha_buf, halg->digestsize);
++ ret = 0;
++ goto done_run;
++ }
++
+ /* Set HASH_TERM bit for last transfer block. */
+ if (rctx->fini) {
+- digest_phys = dma_map_single(sdcp->dev, req->result,
+- halg->digestsize, DMA_FROM_DEVICE);
++ digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf,
++ DCP_SHA_PAY_SZ, DMA_FROM_DEVICE);
+ desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM;
+ desc->payload = digest_phys;
+ }
+@@ -552,9 +579,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ ret = mxs_dcp_start_dma(actx);
+
+ if (rctx->fini)
+- dma_unmap_single(sdcp->dev, digest_phys, halg->digestsize,
++ dma_unmap_single(sdcp->dev, digest_phys, DCP_SHA_PAY_SZ,
+ DMA_FROM_DEVICE);
+
++done_run:
+ dma_unmap_single(sdcp->dev, buf_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+
+ return ret;
+@@ -572,6 +600,7 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq)
+ const int nents = sg_nents(req->src);
+
+ uint8_t *in_buf = sdcp->coh->sha_in_buf;
++ uint8_t *out_buf = sdcp->coh->sha_out_buf;
+
+ uint8_t *src_buf;
+
+@@ -626,11 +655,9 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq)
+
+ actx->fill = 0;
+
+- /* For some reason, the result is flipped. */
+- for (i = 0; i < halg->digestsize / 2; i++) {
+- swap(req->result[i],
+- req->result[halg->digestsize - i - 1]);
+- }
++ /* For some reason the result is flipped */
++ for (i = 0; i < halg->digestsize; i++)
++ req->result[i] = out_buf[halg->digestsize - i - 1];
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 0c42bc67144e87c71b76835efcf8d886dca2af48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 20:51:43 -0700
+Subject: cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 3b0b8f0d9a259f6a428af63e7a77547325f8e081 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c:303:7: warning: implicit
+conversion from enumeration type 'enum cxgb4_dcb_state' to different
+enumeration type 'enum cxgb4_dcb_state_input' [-Wenum-conversion]
+ ? CXGB4_DCB_STATE_FW_ALLSYNCED
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c:304:7: warning: implicit
+conversion from enumeration type 'enum cxgb4_dcb_state' to different
+enumeration type 'enum cxgb4_dcb_state_input' [-Wenum-conversion]
+ : CXGB4_DCB_STATE_FW_INCOMPLETE);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+2 warnings generated.
+
+Use the equivalent value of the expected type to silence Clang while
+resulting in no functional change.
+
+CXGB4_DCB_STATE_FW_INCOMPLETE = CXGB4_DCB_INPUT_FW_INCOMPLETE = 2
+CXGB4_DCB_STATE_FW_ALLSYNCED = CXGB4_DCB_INPUT_FW_ALLSYNCED = 3
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+index 052c660aca80a..658609c1bdabe 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+@@ -266,8 +266,8 @@ void cxgb4_dcb_handle_fw_update(struct adapter *adap,
+ enum cxgb4_dcb_state_input input =
+ ((pcmd->u.dcb.control.all_syncd_pkd &
+ FW_PORT_CMD_ALL_SYNCD_F)
+- ? CXGB4_DCB_STATE_FW_ALLSYNCED
+- : CXGB4_DCB_STATE_FW_INCOMPLETE);
++ ? CXGB4_DCB_INPUT_FW_ALLSYNCED
++ : CXGB4_DCB_INPUT_FW_INCOMPLETE);
+
+ if (dcb->dcb_version != FW_PORT_DCB_VER_UNKNOWN) {
+ dcb_running_version = FW_PORT_CMD_DCB_VERSION_G(
+--
+2.20.1
+
--- /dev/null
+From 7c6391d63a318fbf10828afcfed4eb5d03c29eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 20:47:38 -0700
+Subject: cxgb4: Use proper enum in IEEE_FAUX_SYNC
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 258b6d141878530ba1f8fc44db683822389de914 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c:390:4: warning: implicit
+conversion from enumeration type 'enum cxgb4_dcb_state' to different
+enumeration type 'enum cxgb4_dcb_state_input' [-Wenum-conversion]
+ IEEE_FAUX_SYNC(dev, dcb);
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h:70:10: note: expanded
+from macro 'IEEE_FAUX_SYNC'
+ CXGB4_DCB_STATE_FW_ALLSYNCED);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Use the equivalent value of the expected type to silence Clang while
+resulting in no functional change.
+
+CXGB4_DCB_STATE_FW_ALLSYNCED = CXGB4_DCB_INPUT_FW_ALLSYNCED = 3
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h
+index ccf24d3dc9824..2c418c405c508 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h
+@@ -67,7 +67,7 @@
+ do { \
+ if ((__dcb)->dcb_version == FW_PORT_DCB_VER_IEEE) \
+ cxgb4_dcb_state_fsm((__dev), \
+- CXGB4_DCB_STATE_FW_ALLSYNCED); \
++ CXGB4_DCB_INPUT_FW_ALLSYNCED); \
+ } while (0)
+
+ /* States we can be in for a port's Data Center Bridging.
+--
+2.20.1
+
--- /dev/null
+From a38a710155b7dc5da9090bf7f8762e6e0109b931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 16:40:20 -0700
+Subject: dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 9524d6b265f9b2b9a61fceb2ee2ce1c2a83e39ca ]
+
+Clang warns when implicitly converting from one enumerated type to
+another. Avoid this by using the equivalent value from the expected
+type.
+
+In file included from drivers/dma/ep93xx_dma.c:30:
+./include/linux/platform_data/dma-ep93xx.h:88:10: warning: implicit
+conversion from enumeration type 'enum dma_data_direction' to different
+enumeration type 'enum dma_transfer_direction' [-Wenum-conversion]
+ return DMA_NONE;
+ ~~~~~~ ^~~~~~~~
+1 warning generated.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/platform_data/dma-ep93xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/platform_data/dma-ep93xx.h b/include/linux/platform_data/dma-ep93xx.h
+index e82c642fa53cd..5913be0793a26 100644
+--- a/include/linux/platform_data/dma-ep93xx.h
++++ b/include/linux/platform_data/dma-ep93xx.h
+@@ -84,7 +84,7 @@ static inline enum dma_transfer_direction
+ ep93xx_dma_chan_direction(struct dma_chan *chan)
+ {
+ if (!ep93xx_dma_chan_is_m2p(chan))
+- return DMA_NONE;
++ return DMA_TRANS_NONE;
+
+ /* even channels are for TX, odd for RX */
+ return (chan->chan_id % 2 == 0) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
+--
+2.20.1
+
--- /dev/null
+From 5aa81b5797d5b832655b6b70304f8daf45b97fe4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Oct 2018 00:03:10 +0300
+Subject: dmaengine: ioat: fix prototype of ioat_enumerate_channels
+
+From: Rami Rosen <ramirose@gmail.com>
+
+[ Upstream commit f4d34aa8c887a8a2d23ef546da0efa10e3f77241 ]
+
+Signed-off-by: Rami Rosen <ramirose@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ioat/init.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 106fa9b327d92..92b0a7a042ee0 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -128,7 +128,7 @@ static void
+ ioat_init_channel(struct ioatdma_device *ioat_dma,
+ struct ioatdma_chan *ioat_chan, int idx);
+ static void ioat_intr_quirk(struct ioatdma_device *ioat_dma);
+-static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma);
++static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma);
+ static int ioat3_dma_self_test(struct ioatdma_device *ioat_dma);
+
+ static int ioat_dca_enabled = 1;
+@@ -593,7 +593,7 @@ static void ioat_dma_remove(struct ioatdma_device *ioat_dma)
+ * ioat_enumerate_channels - find and initialize the device's channels
+ * @ioat_dma: the ioat dma device to be enumerated
+ */
+-static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
++static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
+ {
+ struct ioatdma_chan *ioat_chan;
+ struct device *dev = &ioat_dma->pdev->dev;
+@@ -612,7 +612,7 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
+ xfercap_log = readb(ioat_dma->reg_base + IOAT_XFERCAP_OFFSET);
+ xfercap_log &= 0x1f; /* bits [4:0] valid */
+ if (xfercap_log == 0)
+- return 0;
++ return;
+ dev_dbg(dev, "%s: xfercap = %d\n", __func__, 1 << xfercap_log);
+
+ for (i = 0; i < dma->chancnt; i++) {
+@@ -629,7 +629,6 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma)
+ }
+ }
+ dma->chancnt = i;
+- return i;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 45732a1f137b707d7f15ab4725bf090e30da943e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 16:20:25 -0700
+Subject: dmaengine: timb_dma: Use proper enum in td_prep_slave_sg
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 5e621f5d538985f010035c6f3e28c22829d36db1 ]
+
+Clang warns when implicitly converting from one enumerated type to
+another. Avoid this by using the equivalent value from the expected
+type.
+
+drivers/dma/timb_dma.c:548:27: warning: implicit conversion from
+enumeration type 'enum dma_transfer_direction' to different enumeration
+type 'enum dma_data_direction' [-Wenum-conversion]
+ td_desc->desc_list_len, DMA_MEM_TO_DEV);
+ ^~~~~~~~~~~~~~
+1 warning generated.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/timb_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c
+index 559cd4073698c..cf741187c9bb6 100644
+--- a/drivers/dma/timb_dma.c
++++ b/drivers/dma/timb_dma.c
+@@ -552,7 +552,7 @@ static struct dma_async_tx_descriptor *td_prep_slave_sg(struct dma_chan *chan,
+ }
+
+ dma_sync_single_for_device(chan2dmadev(chan), td_desc->txd.phys,
+- td_desc->desc_list_len, DMA_MEM_TO_DEV);
++ td_desc->desc_list_len, DMA_TO_DEVICE);
+
+ return &td_desc->txd;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7c6de88fbedebbe10c5d2a3a3441c4021ecc0a11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 15:25:21 -0700
+Subject: f2fs: return correct errno in f2fs_gc
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 61f7725aa148ee870436a29d3a24d5c00ab7e9af ]
+
+This fixes overriding error number in f2fs_gc.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 928b9e046d8a8..de32dfaaa492d 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -880,7 +880,7 @@ int f2fs_gc(struct f2fs_sb_info *sbi, bool sync)
+
+ put_gc_inode(&gc_list);
+
+- if (sync)
++ if (sync && !ret)
+ ret = sec_freed ? 0 : -EAGAIN;
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From f7de8ee0d51c5a684ca0f813dcd9ebeaf3764f1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 12:57:36 +0200
+Subject: fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e5017716adb8aa5c01c52386c1b7470101ffe9c5 ]
+
+The "index + count" addition can overflow. Both come directly from the
+user. This bug leads to an information leak.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Peter Malone <peter.malone@gmail.com>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sbuslib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
+index b425718925c01..52e161dbd2047 100644
+--- a/drivers/video/fbdev/sbuslib.c
++++ b/drivers/video/fbdev/sbuslib.c
+@@ -170,7 +170,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ get_user(ublue, &c->blue))
+ return -EFAULT;
+
+- if (index + count > cmap->len)
++ if (index > cmap->len || count > cmap->len - index)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+--
+2.20.1
+
--- /dev/null
+From 2b765c5428d5075cb35496bef1dbbcb3e1efd456 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 12:57:36 +0200
+Subject: fbdev: sbuslib: use checked version of put_user()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d8bad911e5e55e228d59c0606ff7e6b8131ca7bf ]
+
+I'm not sure why the code assumes that only the first put_user() needs
+an access_ok() check. I have made all the put_user() and get_user()
+calls checked.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Mathieu Malaterre <malat@debian.org>
+Cc: Peter Malone <peter.malone@gmail.com>,
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sbuslib.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
+index 31c301d6be621..b425718925c01 100644
+--- a/drivers/video/fbdev/sbuslib.c
++++ b/drivers/video/fbdev/sbuslib.c
+@@ -105,11 +105,11 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ struct fbtype __user *f = (struct fbtype __user *) arg;
+
+ if (put_user(type, &f->fb_type) ||
+- __put_user(info->var.yres, &f->fb_height) ||
+- __put_user(info->var.xres, &f->fb_width) ||
+- __put_user(fb_depth, &f->fb_depth) ||
+- __put_user(0, &f->fb_cmsize) ||
+- __put_user(fb_size, &f->fb_cmsize))
++ put_user(info->var.yres, &f->fb_height) ||
++ put_user(info->var.xres, &f->fb_width) ||
++ put_user(fb_depth, &f->fb_depth) ||
++ put_user(0, &f->fb_cmsize) ||
++ put_user(fb_size, &f->fb_cmsize))
+ return -EFAULT;
+ return 0;
+ }
+@@ -124,10 +124,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ unsigned int index, count, i;
+
+ if (get_user(index, &c->index) ||
+- __get_user(count, &c->count) ||
+- __get_user(ured, &c->red) ||
+- __get_user(ugreen, &c->green) ||
+- __get_user(ublue, &c->blue))
++ get_user(count, &c->count) ||
++ get_user(ured, &c->red) ||
++ get_user(ugreen, &c->green) ||
++ get_user(ublue, &c->blue))
+ return -EFAULT;
+
+ cmap.len = 1;
+@@ -164,10 +164,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
+ u8 red, green, blue;
+
+ if (get_user(index, &c->index) ||
+- __get_user(count, &c->count) ||
+- __get_user(ured, &c->red) ||
+- __get_user(ugreen, &c->green) ||
+- __get_user(ublue, &c->blue))
++ get_user(count, &c->count) ||
++ get_user(ured, &c->red) ||
++ get_user(ugreen, &c->green) ||
++ get_user(ublue, &c->blue))
+ return -EFAULT;
+
+ if (index + count > cmap->len)
+--
+2.20.1
+
--- /dev/null
+From 68c80140a46846a1609277e045f4e572db467173 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 12:15:40 -0500
+Subject: GFS2: Flush the GFS2 delete workqueue before stopping the kernel
+ threads
+
+From: Tim Smith <tim.smith@citrix.com>
+
+[ Upstream commit 1eb8d7387908022951792a46fa040ad3942b3b08 ]
+
+Flushing the workqueue can cause operations to happen which might
+call gfs2_log_reserve(), or get stuck waiting for locks taken by such
+operations. gfs2_log_reserve() can io_schedule(). If this happens, it
+will never wake because the only thing which can wake it is gfs2_logd()
+which was already stopped.
+
+This causes umount of a gfs2 filesystem to wedge permanently if, for
+example, the umount immediately follows a large delete operation.
+
+When this occured, the following stack trace was obtained from the
+umount command
+
+[<ffffffff81087968>] flush_workqueue+0x1c8/0x520
+[<ffffffffa0666e29>] gfs2_make_fs_ro+0x69/0x160 [gfs2]
+[<ffffffffa0667279>] gfs2_put_super+0xa9/0x1c0 [gfs2]
+[<ffffffff811b7edf>] generic_shutdown_super+0x6f/0x100
+[<ffffffff811b7ff7>] kill_block_super+0x27/0x70
+[<ffffffffa0656a71>] gfs2_kill_sb+0x71/0x80 [gfs2]
+[<ffffffff811b792b>] deactivate_locked_super+0x3b/0x70
+[<ffffffff811b79b9>] deactivate_super+0x59/0x60
+[<ffffffff811d2998>] cleanup_mnt+0x58/0x80
+[<ffffffff811d2a12>] __cleanup_mnt+0x12/0x20
+[<ffffffff8108c87d>] task_work_run+0x7d/0xa0
+[<ffffffff8106d7d9>] exit_to_usermode_loop+0x73/0x98
+[<ffffffff81003961>] syscall_return_slowpath+0x41/0x50
+[<ffffffff815a594c>] int_ret_from_sys_call+0x25/0x8f
+[<ffffffffffffffff>] 0xffffffffffffffff
+
+Signed-off-by: Tim Smith <tim.smith@citrix.com>
+Signed-off-by: Mark Syms <mark.syms@citrix.com>
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 894fb01a91dab..a4eb38c1f5548 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -835,10 +835,10 @@ static int gfs2_make_fs_ro(struct gfs2_sbd *sdp)
+ if (error && !test_bit(SDF_SHUTDOWN, &sdp->sd_flags))
+ return error;
+
++ flush_workqueue(gfs2_delete_workqueue);
+ kthread_stop(sdp->sd_quotad_process);
+ kthread_stop(sdp->sd_logd_process);
+
+- flush_workqueue(gfs2_delete_workqueue);
+ gfs2_quota_sync(sdp->sd_vfs, 0);
+ gfs2_statfs_sync(sdp->sd_vfs, 0);
+
+--
+2.20.1
+
--- /dev/null
+From efe8ed81431ea5edda23d98d4ae5b644bc102d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 00:52:52 +0200
+Subject: gpio: syscon: Fix possible NULL ptr usage
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 70728c29465bc4bfa7a8c14304771eab77e923c7 ]
+
+The priv->data->set can be NULL while flags contains GPIO_SYSCON_FEAT_OUT
+and chip->set is valid pointer. This happens in case the controller uses
+the default GPIO setter. Always use chip->set to access the setter to avoid
+possible NULL pointer dereferencing.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-syscon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
+index 7b25fdf648023..f579938552cc5 100644
+--- a/drivers/gpio/gpio-syscon.c
++++ b/drivers/gpio/gpio-syscon.c
+@@ -127,7 +127,7 @@ static int syscon_gpio_dir_out(struct gpio_chip *chip, unsigned offset, int val)
+ BIT(offs % SYSCON_REG_BITS));
+ }
+
+- priv->data->set(chip, offset, val);
++ chip->set(chip, offset, val);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From b16db27587ec727f90474cdae02bafd8baf83187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 12:10:47 +0200
+Subject: hwmon: (pwm-fan) Silence error on probe deferral
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 9f67f7583e77fe5dc57aab3a6159c2642544eaad ]
+
+Probe deferrals aren't actual errors, so silence the error message in
+case the PWM cannot yet be acquired.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pwm-fan.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 3e23003f78b01..993c61e95d30c 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -227,8 +227,12 @@ static int pwm_fan_probe(struct platform_device *pdev)
+
+ ctx->pwm = devm_of_pwm_get(&pdev->dev, pdev->dev.of_node, NULL);
+ if (IS_ERR(ctx->pwm)) {
+- dev_err(&pdev->dev, "Could not get PWM\n");
+- return PTR_ERR(ctx->pwm);
++ ret = PTR_ERR(ctx->pwm);
++
++ if (ret != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "Could not get PWM: %d\n", ret);
++
++ return ret;
+ }
+
+ platform_set_drvdata(pdev, ctx);
+--
+2.20.1
+
--- /dev/null
+From 2a88729dc25737a9343002acb2e9cb61244f3d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Sep 2018 03:55:16 +0000
+Subject: IB/mthca: Fix error return code in __mthca_init_one()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 39f2495618c5e980d2873ea3f2d1877dd253e07a ]
+
+Fix to return a negative error code from the mthca_cmd_init() error
+handling case instead of 0, as done elsewhere in this function.
+
+Fixes: 80fd8238734c ("[PATCH] IB/mthca: Encapsulate command interface init")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
+index ded76c101dde3..834b06aacc2bf 100644
+--- a/drivers/infiniband/hw/mthca/mthca_main.c
++++ b/drivers/infiniband/hw/mthca/mthca_main.c
+@@ -989,7 +989,8 @@ static int __mthca_init_one(struct pci_dev *pdev, int hca_type)
+ goto err_free_dev;
+ }
+
+- if (mthca_cmd_init(mdev)) {
++ err = mthca_cmd_init(mdev);
++ if (err) {
+ mthca_err(mdev, "Failed to init command interface, aborting.\n");
+ goto err_free_dev;
+ }
+--
+2.20.1
+
--- /dev/null
+From af9517fcf06cd7ab8b2f0b55630f8c820d379074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Oct 2018 11:44:45 -0700
+Subject: Input: st1232 - set INPUT_PROP_DIRECT property
+
+From: Martin Kepplinger <martink@posteo.de>
+
+[ Upstream commit 20bbb312079494a406c10c90932e3c80837c9d94 ]
+
+This is how userspace checks for touchscreen devices most reliably.
+
+Signed-off-by: Martin Kepplinger <martink@posteo.de>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/st1232.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
+index e943678ce54cd..f1c574d6be17f 100644
+--- a/drivers/input/touchscreen/st1232.c
++++ b/drivers/input/touchscreen/st1232.c
+@@ -203,6 +203,7 @@ static int st1232_ts_probe(struct i2c_client *client,
+ input_dev->id.bustype = BUS_I2C;
+ input_dev->dev.parent = &client->dev;
+
++ __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
+ __set_bit(EV_SYN, input_dev->evbit);
+ __set_bit(EV_KEY, input_dev->evbit);
+ __set_bit(EV_ABS, input_dev->evbit);
+--
+2.20.1
+
--- /dev/null
+From 30ad5ac469d5031fd184efaf9b34605eac59eb05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Sep 2018 09:24:20 +0200
+Subject: ixgbe: Fix crash with VFs and flow director on interface flap
+
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+
+[ Upstream commit 5d826d209164b0752c883607be4cdbbcf7cab494 ]
+
+This patch fix crash when we have restore flow director filters after reset
+adapter. In ixgbe_fdir_filter_restore() filter->action is outside of the
+rx_ring array, as it has a VF identifier in the upper 32 bits.
+
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index a5b443171b8bd..4521181aa0ed9 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -4532,6 +4532,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct hlist_node *node2;
+ struct ixgbe_fdir_filter *filter;
++ u64 action;
+
+ spin_lock(&adapter->fdir_perfect_lock);
+
+@@ -4540,12 +4541,17 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+
+ hlist_for_each_entry_safe(filter, node2,
+ &adapter->fdir_filter_list, fdir_node) {
++ action = filter->action;
++ if (action != IXGBE_FDIR_DROP_QUEUE && action != 0)
++ action =
++ (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1;
++
+ ixgbe_fdir_write_perfect_filter_82599(hw,
+ &filter->filter,
+ filter->sw_idx,
+- (filter->action == IXGBE_FDIR_DROP_QUEUE) ?
++ (action == IXGBE_FDIR_DROP_QUEUE) ?
+ IXGBE_FDIR_DROP_QUEUE :
+- adapter->rx_ring[filter->action]->reg_idx);
++ adapter->rx_ring[action]->reg_idx);
+ }
+
+ spin_unlock(&adapter->fdir_perfect_lock);
+--
+2.20.1
+
--- /dev/null
+From 3ad292d1b43c2b4f0a317c0beb5e95cef7a26c95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 07:39:21 -0700
+Subject: KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC
+ and LR
+
+From: Cameron Kaiser <spectre@floodgap.com>
+
+[ Upstream commit 1006284c5e411872333967b1970c2ca46a9e225f ]
+
+When an OS (currently only classic Mac OS) is running in KVM-PR and makes a
+linked jump from code with split hack addressing enabled into code that does
+not, LR is not correctly updated and reflects the previously munged PC.
+
+To fix this, this patch undoes the address munge when exiting split
+hack mode so that code relying on LR being a proper address will now
+execute. This does not affect OS X or other operating systems running
+on KVM-PR.
+
+Signed-off-by: Cameron Kaiser <spectre@floodgap.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c
+index 4aab1c9c83e1a..41ac54bfdfdd9 100644
+--- a/arch/powerpc/kvm/book3s.c
++++ b/arch/powerpc/kvm/book3s.c
+@@ -70,8 +70,11 @@ void kvmppc_unfixup_split_real(struct kvm_vcpu *vcpu)
+ {
+ if (vcpu->arch.hflags & BOOK3S_HFLAG_SPLIT_HACK) {
+ ulong pc = kvmppc_get_pc(vcpu);
++ ulong lr = kvmppc_get_lr(vcpu);
+ if ((pc & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS)
+ kvmppc_set_pc(vcpu, pc & ~SPLIT_HACK_MASK);
++ if ((lr & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS)
++ kvmppc_set_lr(vcpu, lr & ~SPLIT_HACK_MASK);
+ vcpu->arch.hflags &= ~BOOK3S_HFLAG_SPLIT_HACK;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From f48e20f5ef5a2b8a37e87f9ea77c7a65da6912ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Oct 2018 19:35:04 +0200
+Subject: mac80211: minstrel: fix CCK rate group streams value
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 80df9be67c44cb636bbc92caeddad8caf334c53c ]
+
+Fixes a harmless underflow issue when CCK rates are actively being used
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rc80211_minstrel_ht.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index 239ed6e92b89d..ff3b28e7dbce8 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -128,7 +128,7 @@
+
+ #define CCK_GROUP \
+ [MINSTREL_CCK_GROUP] = { \
+- .streams = 0, \
++ .streams = 1, \
+ .flags = 0, \
+ .duration = { \
+ CCK_DURATION_LIST(false), \
+--
+2.20.1
+
--- /dev/null
+From 4a343a1ac57fb8298d9f965114e7f3fc32a90d98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Oct 2018 14:01:42 -0400
+Subject: media: cx231xx: fix potential sign-extension overflow on large shift
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 32ae592036d7aeaabcccb2b1715373a68639a768 ]
+
+Shifting the u8 value[3] by an int can lead to sign-extension
+overflow. For example, if value[3] is 0xff and the shift is 24 then it
+is promoted to int and then the top bit is sign-extended so that all
+upper 32 bits are set. Fix this by casting value[3] to a u32 before
+the shift.
+
+Detected by CoverityScan, CID#1016522 ("Unintended sign extension")
+
+Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c
+index d0d8f08e37c87..de80925ee4cbd 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-video.c
++++ b/drivers/media/usb/cx231xx/cx231xx-video.c
+@@ -1346,7 +1346,7 @@ int cx231xx_g_register(struct file *file, void *priv,
+ ret = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER,
+ (u16)reg->reg, value, 4);
+ reg->val = value[0] | value[1] << 8 |
+- value[2] << 16 | value[3] << 24;
++ value[2] << 16 | (u32)value[3] << 24;
+ reg->size = 4;
+ break;
+ case 1: /* AFE - read byte */
+--
+2.20.1
+
--- /dev/null
+From b0c5ec1b6255e03a98ae429e229f402d6ea899a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 11:44:02 -0400
+Subject: media: isif: fix a NULL pointer dereference bug
+
+From: Wenwen Wang <wang6495@umn.edu>
+
+[ Upstream commit a26ac6c1bed951b2066cc4b2257facd919e35c0b ]
+
+In isif_probe(), there is a while loop to get the ISIF base address and
+linearization table0 and table1 address. In the loop body, the function
+platform_get_resource() is called to get the resource. If
+platform_get_resource() returns NULL, the loop is terminated and the
+execution goes to 'fail_nobase_res'. Suppose the loop is terminated at the
+first iteration because platform_get_resource() returns NULL and the
+execution goes to 'fail_nobase_res'. Given that there is another while loop
+at 'fail_nobase_res' and i equals to 0, one iteration of the second while
+loop will be executed. However, the second while loop does not check the
+return value of platform_get_resource(). This can cause a NULL pointer
+dereference bug if the return value is a NULL pointer.
+
+This patch avoids the above issue by adding a check in the second while
+loop after the call to platform_get_resource().
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/isif.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 99faea2e84c6b..78e37cf3470f2 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -1106,7 +1106,8 @@ static int isif_probe(struct platform_device *pdev)
+
+ while (i >= 0) {
+ res = platform_get_resource(pdev, IORESOURCE_MEM, i);
+- release_mem_region(res->start, resource_size(res));
++ if (res)
++ release_mem_region(res->start, resource_size(res));
+ i--;
+ }
+ vpfe_unregister_ccdc_device(&isif_hw_dev);
+--
+2.20.1
+
--- /dev/null
+From 0e774728cdde927d9a78952a6dbd1af302546e71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 19:44:41 +0300
+Subject: mei: samples: fix a signedness bug in amt_host_if_call()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 185647813cac080453cb73a2e034a8821049f2a7 ]
+
+"out_buf_sz" needs to be signed for the error handling to work.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/misc-devices/mei/mei-amt-version.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/misc-devices/mei/mei-amt-version.c b/Documentation/misc-devices/mei/mei-amt-version.c
+index 57d0d871dcf71..33e67bd1dc343 100644
+--- a/Documentation/misc-devices/mei/mei-amt-version.c
++++ b/Documentation/misc-devices/mei/mei-amt-version.c
+@@ -370,7 +370,7 @@ static uint32_t amt_host_if_call(struct amt_host_if *acmd,
+ unsigned int expected_sz)
+ {
+ uint32_t in_buf_sz;
+- uint32_t out_buf_sz;
++ ssize_t out_buf_sz;
+ ssize_t written;
+ uint32_t status;
+ struct amt_host_if_resp_header *msg_hdr;
+--
+2.20.1
+
--- /dev/null
+From cc261069f559a87d0d53129521fcda2accafdcc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 15:34:45 +0200
+Subject: mtd: physmap_of: Release resources on error
+
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+
+[ Upstream commit ef0de747f7ad179c7698a5b0e28db05f18ecbf57 ]
+
+During probe, if there was an error the memory region and the memory
+map were not properly released.This can lead a system unusable if
+deferred probe is in use.
+
+Replace mem_request and map with devm_ioremap_resource
+
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/maps/physmap_of.c | 27 +++++----------------------
+ 1 file changed, 5 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
+index e46b4e9836668..77e7542fa8e42 100644
+--- a/drivers/mtd/maps/physmap_of.c
++++ b/drivers/mtd/maps/physmap_of.c
+@@ -28,7 +28,6 @@
+ struct of_flash_list {
+ struct mtd_info *mtd;
+ struct map_info map;
+- struct resource *res;
+ };
+
+ struct of_flash {
+@@ -53,18 +52,10 @@ static int of_flash_remove(struct platform_device *dev)
+ mtd_concat_destroy(info->cmtd);
+ }
+
+- for (i = 0; i < info->list_size; i++) {
++ for (i = 0; i < info->list_size; i++)
+ if (info->list[i].mtd)
+ map_destroy(info->list[i].mtd);
+
+- if (info->list[i].map.virt)
+- iounmap(info->list[i].map.virt);
+-
+- if (info->list[i].res) {
+- release_resource(info->list[i].res);
+- kfree(info->list[i].res);
+- }
+- }
+ return 0;
+ }
+
+@@ -223,10 +214,11 @@ static int of_flash_probe(struct platform_device *dev)
+
+ err = -EBUSY;
+ res_size = resource_size(&res);
+- info->list[i].res = request_mem_region(res.start, res_size,
+- dev_name(&dev->dev));
+- if (!info->list[i].res)
++ info->list[i].map.virt = devm_ioremap_resource(&dev->dev, &res);
++ if (IS_ERR(info->list[i].map.virt)) {
++ err = PTR_ERR(info->list[i].map.virt);
+ goto err_out;
++ }
+
+ err = -ENXIO;
+ width = of_get_property(dp, "bank-width", NULL);
+@@ -242,15 +234,6 @@ static int of_flash_probe(struct platform_device *dev)
+ info->list[i].map.bankwidth = be32_to_cpup(width);
+ info->list[i].map.device_node = dp;
+
+- err = -ENOMEM;
+- info->list[i].map.virt = ioremap(info->list[i].map.phys,
+- info->list[i].map.size);
+- if (!info->list[i].map.virt) {
+- dev_err(&dev->dev, "Failed to ioremap() flash"
+- " region\n");
+- goto err_out;
+- }
+-
+ simple_map_init(&info->list[i].map);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 04c023b44d1214d508b94016a7f541d39a3cdac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:30:25 -0700
+Subject: mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit e2bfa4ca23d9b5a7bdfcf21319fad9b59e38a05c ]
+
+Clang warns when one enumerated type is converted implicitly to another:
+
+drivers/mtd/nand/raw/sh_flctl.c:483:46: warning: implicit conversion
+from enumeration type 'enum dma_transfer_direction' to different
+enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_DEV_TO_MEM) > 0)
+ ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
+drivers/mtd/nand/raw/sh_flctl.c:542:46: warning: implicit conversion
+from enumeration type 'enum dma_transfer_direction' to different
+enumeration type 'enum dma_data_direction' [-Wenum-conversion]
+ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_MEM_TO_DEV) > 0)
+ ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
+2 warnings generated.
+
+Use the proper enums from dma_data_direction to satisfy Clang.
+
+DMA_MEM_TO_DEV = DMA_TO_DEVICE = 1
+DMA_DEV_TO_MEM = DMA_FROM_DEVICE = 2
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/sh_flctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c
+index 1f2785ee909fe..c00a180306e50 100644
+--- a/drivers/mtd/nand/sh_flctl.c
++++ b/drivers/mtd/nand/sh_flctl.c
+@@ -428,7 +428,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset)
+
+ /* initiate DMA transfer */
+ if (flctl->chan_fifo0_rx && rlen >= 32 &&
+- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_DEV_TO_MEM) > 0)
++ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0)
+ goto convert; /* DMA success */
+
+ /* do polling transfer */
+@@ -487,7 +487,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen,
+
+ /* initiate DMA transfer */
+ if (flctl->chan_fifo0_tx && rlen >= 32 &&
+- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_MEM_TO_DEV) > 0)
++ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0)
+ return; /* DMA success */
+
+ /* do polling transfer */
+--
+2.20.1
+
--- /dev/null
+From 9313518f1c166ba07db92c0c433b2b8a051c10dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:15:38 +0800
+Subject: net: ovs: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit eddf11e18dff0e8671e06ce54e64cfc843303ab9 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/vport-internal_dev.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
+index ec76398a792fb..12ec61b259b9f 100644
+--- a/net/openvswitch/vport-internal_dev.c
++++ b/net/openvswitch/vport-internal_dev.c
+@@ -44,7 +44,8 @@ static struct internal_dev *internal_dev_priv(struct net_device *netdev)
+ }
+
+ /* Called with rcu_read_lock_bh. */
+-static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int len, err;
+
+@@ -63,7 +64,7 @@ static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev)
+ } else {
+ netdev->stats.tx_errors++;
+ }
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ static int internal_dev_open(struct net_device *netdev)
+--
+2.20.1
+
--- /dev/null
+From 7a0541f4943c90a3106d2828f2f424b6dbd4f7e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 14:45:00 -0400
+Subject: NFSv4.x: fix lock recovery during delegation recall
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 44f411c353bf6d98d5a34f8f1b8605d43b2e50b8 ]
+
+Running "./nfstest_delegation --runtest recall26" uncovers that
+client doesn't recover the lock when we have an appending open,
+where the initial open got a write delegation.
+
+Instead of checking for the passed in open context against
+the file lock's open context. Check that the state is the same.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 5dac3382405ce..b50315ad0391a 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -101,7 +101,7 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags)
+ return nfs4_do_check_delegation(inode, flags, false);
+ }
+
+-static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
++static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_stateid *stateid)
+ {
+ struct inode *inode = state->inode;
+ struct file_lock *fl;
+@@ -116,7 +116,7 @@ static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_
+ spin_lock(&flctx->flc_lock);
+ restart:
+ list_for_each_entry(fl, list, fl_list) {
+- if (nfs_file_open_context(fl->fl_file) != ctx)
++ if (nfs_file_open_context(fl->fl_file)->state != state)
+ continue;
+ spin_unlock(&flctx->flc_lock);
+ status = nfs4_lock_delegation_recall(fl, state, stateid);
+@@ -163,7 +163,7 @@ static int nfs_delegation_claim_opens(struct inode *inode,
+ seq = raw_seqcount_begin(&sp->so_reclaim_seqcount);
+ err = nfs4_open_delegation_recall(ctx, state, stateid, type);
+ if (!err)
+- err = nfs_delegation_claim_locks(ctx, state, stateid);
++ err = nfs_delegation_claim_locks(state, stateid);
+ if (!err && read_seqcount_retry(&sp->so_reclaim_seqcount, seq))
+ err = -EAGAIN;
+ mutex_unlock(&sp->so_delegreturn_mutex);
+--
+2.20.1
+
--- /dev/null
+From 88e12558c707985b8194401c6b484dd47a03c44c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Sep 2018 18:10:22 +0200
+Subject: nl80211: Fix a GET_KEY reply attribute
+
+From: Andrew Zaborowski <andrew.zaborowski@intel.com>
+
+[ Upstream commit efdfce7270de85a8706d1ea051bef3a7486809ff ]
+
+Use the NL80211_KEY_IDX attribute inside the NL80211_ATTR_KEY in
+NL80211_CMD_GET_KEY responses to comply with nl80211_key_policy.
+This is unlikely to affect existing userspace.
+
+Signed-off-by: Andrew Zaborowski <andrew.zaborowski@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 4de66dbd5bb60..fd0bf278067ef 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2879,7 +2879,7 @@ static void get_key_callback(void *c, struct key_params *params)
+ params->cipher)))
+ goto nla_put_failure;
+
+- if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
++ if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
+ goto nla_put_failure;
+
+ nla_nest_end(cookie->msg, key);
+--
+2.20.1
+
--- /dev/null
+From f2289f8aa91214b6047039a9dcc353935f9657d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 13:40:57 +0530
+Subject: powerpc/pseries: Fix DTL buffer registration
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit db787af1b8a6b4be428ee2ea7d409dafcaa4a43c ]
+
+When CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set, we register the DTL
+buffer for a cpu when the associated file under powerpc/dtl in debugfs
+is opened. When doing so, we need to set the size of the buffer being
+registered in the second u32 word of the buffer. This needs to be in big
+endian, but we are not doing the conversion resulting in the below error
+showing up in dmesg:
+
+ dtl_start: DTL registration for cpu 0 (hw 0) failed with -4
+
+Fix this in the obvious manner.
+
+Fixes: 7c105b63bd98 ("powerpc: Add CONFIG_CPU_LITTLE_ENDIAN kernel config option.")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dtl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
+index 39049e4884fbd..37de83c5ef172 100644
+--- a/arch/powerpc/platforms/pseries/dtl.c
++++ b/arch/powerpc/platforms/pseries/dtl.c
+@@ -150,7 +150,7 @@ static int dtl_start(struct dtl *dtl)
+
+ /* Register our dtl buffer with the hypervisor. The HV expects the
+ * buffer size to be passed in the second word of the buffer */
+- ((u32 *)dtl->buf)[1] = DISPATCH_LOG_BYTES;
++ ((u32 *)dtl->buf)[1] = cpu_to_be32(DISPATCH_LOG_BYTES);
+
+ hwcpu = get_hard_smp_processor_id(dtl->cpu);
+ addr = __pa(dtl->buf);
+--
+2.20.1
+
--- /dev/null
+From c320277f27a8f85a464d7e9a7355e1b24950ff4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 13:40:58 +0530
+Subject: powerpc/pseries: Fix how we iterate over the DTL entries
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit 9258227e9dd1da8feddb07ad9702845546a581c9 ]
+
+When CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set, we look up dtl_idx in
+the lppaca to determine the number of entries in the buffer. Since
+lppaca is in big endian, we need to do an endian conversion before using
+this in our calculation to determine the number of entries in the
+buffer. Without this, we do not iterate over the existing entries in the
+DTL buffer properly.
+
+Fixes: 7c105b63bd98 ("powerpc: Add CONFIG_CPU_LITTLE_ENDIAN kernel config option.")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dtl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c
+index 37de83c5ef172..7a4d172c93765 100644
+--- a/arch/powerpc/platforms/pseries/dtl.c
++++ b/arch/powerpc/platforms/pseries/dtl.c
+@@ -185,7 +185,7 @@ static void dtl_stop(struct dtl *dtl)
+
+ static u64 dtl_current_index(struct dtl *dtl)
+ {
+- return lppaca_of(dtl->cpu).dtl_idx;
++ return be64_to_cpu(lppaca_of(dtl->cpu).dtl_idx);
+ }
+ #endif /* CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */
+
+--
+2.20.1
+
--- /dev/null
+From bc35608bed48217270dddea2bbb766e3438ad630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 00:45:53 +0800
+Subject: printk: Give error on attempt to set log buffer length to over 2G
+
+From: He Zhe <zhe.he@windriver.com>
+
+[ Upstream commit e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e ]
+
+The current printk() is ready to handle log buffer size up to 2G.
+Give an explicit error for users who want to use larger log buffer.
+
+Also fix printk formatting to show the 2G as a positive number.
+
+Link: http://lkml.kernel.org/r/20181008135916.gg4kkmoki5bgtco5@pathway.suse.cz
+Cc: rostedt@goodmis.org
+Cc: linux-kernel@vger.kernel.org
+Suggested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+[pmladek: Fixed to the really safe limit 2GB.]
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 5a1b2a914b4e5..699c18c9d7633 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -279,6 +279,7 @@ static u32 clear_idx;
+ #define LOG_ALIGN __alignof__(struct printk_log)
+ #endif
+ #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT)
++#define LOG_BUF_LEN_MAX (u32)(1 << 31)
+ static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN);
+ static char *log_buf = __log_buf;
+ static u32 log_buf_len = __LOG_BUF_LEN;
+@@ -870,18 +871,23 @@ void log_buf_kexec_setup(void)
+ static unsigned long __initdata new_log_buf_len;
+
+ /* we practice scaling the ring buffer by powers of 2 */
+-static void __init log_buf_len_update(unsigned size)
++static void __init log_buf_len_update(u64 size)
+ {
++ if (size > (u64)LOG_BUF_LEN_MAX) {
++ size = (u64)LOG_BUF_LEN_MAX;
++ pr_err("log_buf over 2G is not supported.\n");
++ }
++
+ if (size)
+ size = roundup_pow_of_two(size);
+ if (size > log_buf_len)
+- new_log_buf_len = size;
++ new_log_buf_len = (unsigned long)size;
+ }
+
+ /* save requested log_buf_len since it's too early to process it */
+ static int __init log_buf_len_setup(char *str)
+ {
+- unsigned int size;
++ u64 size;
+
+ if (!str)
+ return -EINVAL;
+@@ -951,7 +957,7 @@ void __init setup_log_buf(int early)
+ }
+
+ if (unlikely(!new_log_buf)) {
+- pr_err("log_buf_len: %ld bytes not available\n",
++ pr_err("log_buf_len: %lu bytes not available\n",
+ new_log_buf_len);
+ return;
+ }
+@@ -964,8 +970,8 @@ void __init setup_log_buf(int early)
+ memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
+ raw_spin_unlock_irqrestore(&logbuf_lock, flags);
+
+- pr_info("log_buf_len: %d bytes\n", log_buf_len);
+- pr_info("early log buf free: %d(%d%%)\n",
++ pr_info("log_buf_len: %u bytes\n", log_buf_len);
++ pr_info("early log buf free: %u(%u%%)\n",
+ free, (free * 100) / __LOG_BUF_LEN);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8c25446d296e73fff05eef008c6d718f24a06f95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 10:05:20 +0200
+Subject: proc/vmcore: Fix i386 build error of missing
+ copy_oldmem_page_encrypted()
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit cf089611f4c446285046fcd426d90c18f37d2905 ]
+
+Lianbo reported a build error with a particular 32-bit config, see Link
+below for details.
+
+Provide a weak copy_oldmem_page_encrypted() function which architectures
+can override, in the same manner other functionality in that file is
+supplied.
+
+Reported-by: Lianbo Jiang <lijiang@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: x86@kernel.org
+Link: http://lkml.kernel.org/r/710b9d95-2f70-eadf-c4a1-c3dc80ee4ebb@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/vmcore.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
+index 4e61388ec03d2..08143139b65a7 100644
+--- a/fs/proc/vmcore.c
++++ b/fs/proc/vmcore.c
+@@ -164,6 +164,16 @@ int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma,
+ return remap_pfn_range(vma, from, pfn, size, prot);
+ }
+
++/*
++ * Architectures which support memory encryption override this.
++ */
++ssize_t __weak
++copy_oldmem_page_encrypted(unsigned long pfn, char *buf, size_t csize,
++ unsigned long offset, int userbuf)
++{
++ return copy_oldmem_page(pfn, buf, csize, offset, userbuf);
++}
++
+ /*
+ * Copy to either kernel or user space
+ */
+--
+2.20.1
+
fbdev-ditch-fb_edid_add_monspecs.patch
block-introduce-blk_rq_is_passthrough.patch
libata-have-ata_scsi_rw_xlat-fail-invalid-passthrough-requests.patch
+net-ovs-fix-return-type-of-ndo_start_xmit-function.patch
+arm-dts-omap5-enable-otg-role-for-dwc3-controller.patch
+f2fs-return-correct-errno-in-f2fs_gc.patch
+sunrpc-fix-priority-queue-fairness.patch
+ath10k-fix-vdev-start-timeout-on-error.patch
+ath9k-fix-reporting-calculated-new-fft-upper-max.patch
+usb-gadget-udc-fotg210-udc-fix-a-sleep-in-atomic-con.patch
+nl80211-fix-a-get_key-reply-attribute.patch
+dmaengine-ep93xx-return-proper-enum-in-ep93xx_dma_ch.patch
+dmaengine-timb_dma-use-proper-enum-in-td_prep_slave_.patch
+mei-samples-fix-a-signedness-bug-in-amt_host_if_call.patch
+cxgb4-use-proper-enum-in-cxgb4_dcb_handle_fw_update.patch
+cxgb4-use-proper-enum-in-ieee_faux_sync.patch
+powerpc-pseries-fix-dtl-buffer-registration.patch
+powerpc-pseries-fix-how-we-iterate-over-the-dtl-entr.patch
+mtd-rawnand-sh_flctl-use-proper-enum-for-flctl_dma_f.patch
+ixgbe-fix-crash-with-vfs-and-flow-director-on-interf.patch
+ib-mthca-fix-error-return-code-in-__mthca_init_one.patch
+ata-ep93xx-use-proper-enums-for-directions.patch
+alsa-hda-sigmatel-disable-automute-for-elo-vupoint.patch
+kvm-ppc-book3s-pr-exiting-split-hack-mode-needs-to-f.patch
+usb-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
+mtd-physmap_of-release-resources-on-error.patch
+brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch
+nfsv4.x-fix-lock-recovery-during-delegation-recall.patch
+dmaengine-ioat-fix-prototype-of-ioat_enumerate_chann.patch
+input-st1232-set-input_prop_direct-property.patch
+x86-olpc-fix-build-error-with-config_mfd_cs5535-m.patch
+crypto-mxs-dcp-fix-sha-null-hashes-and-output-length.patch
+crypto-mxs-dcp-fix-aes-issues.patch
+acpi-sbs-fix-rare-oops-when-removing-modules.patch
+fbdev-sbuslib-use-checked-version-of-put_user.patch
+fbdev-sbuslib-integer-overflow-in-sbusfb_ioctl_helpe.patch
+bcache-recal-cached_dev_sectors-on-detach.patch
+proc-vmcore-fix-i386-build-error-of-missing-copy_old.patch
+backlight-lm3639-unconditionally-call-led_classdev_u.patch
+printk-give-error-on-attempt-to-set-log-buffer-lengt.patch
+media-isif-fix-a-null-pointer-dereference-bug.patch
+gfs2-flush-the-gfs2-delete-workqueue-before-stopping.patch
+media-cx231xx-fix-potential-sign-extension-overflow-.patch
+x86-kexec-correct-kexec_backup_src_end-off-by-one-er.patch
+gpio-syscon-fix-possible-null-ptr-usage.patch
+spi-spidev-fix-of-tree-warning-logic.patch
+arm-8802-1-call-syscall_trace_exit-even-when-system-.patch
+hwmon-pwm-fan-silence-error-on-probe-deferral.patch
+mac80211-minstrel-fix-cck-rate-group-streams-value.patch
+spi-rockchip-initialize-dma_slave_config-properly.patch
+arm-dts-omap5-fix-dual-role-mode-on-super-speed-port.patch
--- /dev/null
+From 0d3b3359d5953c129d1ac7b5b8213e61cbae1718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 11:00:32 +0200
+Subject: spi: rockchip: initialize dma_slave_config properly
+
+From: Huibin Hong <huibin.hong@rock-chips.com>
+
+[ Upstream commit dd8fd2cbc73f8650f651da71fc61a6e4f30c1566 ]
+
+The rxconf and txconf structs are allocated on the
+stack, so make sure we zero them before filling out
+the relevant fields.
+
+Signed-off-by: Huibin Hong <huibin.hong@rock-chips.com>
+Signed-off-by: Emil Renner Berthing <kernel@esmil.dk>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rockchip.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 035767c020720..f42ae9efb255c 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -444,6 +444,9 @@ static void rockchip_spi_prepare_dma(struct rockchip_spi *rs)
+ struct dma_slave_config rxconf, txconf;
+ struct dma_async_tx_descriptor *rxdesc, *txdesc;
+
++ memset(&rxconf, 0, sizeof(rxconf));
++ memset(&txconf, 0, sizeof(txconf));
++
+ spin_lock_irqsave(&rs->lock, flags);
+ rs->state &= ~RXBUSY;
+ rs->state &= ~TXBUSY;
+--
+2.20.1
+
--- /dev/null
+From 2273b0ef17c491023f68388ad2dfa9524e597bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 19:18:34 +0000
+Subject: spi: spidev: Fix OF tree warning logic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Trent Piepho <tpiepho@impinj.com>
+
+[ Upstream commit 605b3bec73cbd74b4ac937b580cd0b47d1300484 ]
+
+spidev will make a big fuss if a device tree node binds a device by
+using "spidev" as the node's compatible property.
+
+However, the logic for this isn't looking for "spidev" in the
+compatible, but rather checking that the device is NOT compatible with
+spidev's list of devices.
+
+This causes a false positive if a device not named "rohm,dh2228fv", etc.
+binds to spidev, even if a means other than putting "spidev" in the
+device tree was used. E.g., the sysfs driver_override attribute.
+
+Signed-off-by: Trent Piepho <tpiepho@impinj.com>
+Reviewed-by: Jan Kundrát <jan.kundrat@cesnet.cz>
+Tested-by: Jan Kundrát <jan.kundrat@cesnet.cz>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index d0e7dfc647cf2..c5f1045561acc 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -713,11 +713,9 @@ static int spidev_probe(struct spi_device *spi)
+ * compatible string, it is a Linux implementation thing
+ * rather than a description of the hardware.
+ */
+- if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) {
+- dev_err(&spi->dev, "buggy DT: spidev listed directly in DT\n");
+- WARN_ON(spi->dev.of_node &&
+- !of_match_device(spidev_dt_ids, &spi->dev));
+- }
++ WARN(spi->dev.of_node &&
++ of_device_is_compatible(spi->dev.of_node, "spidev"),
++ "%pOF: buggy DT: spidev listed directly in DT\n", spi->dev.of_node);
+
+ /* Allocate driver data */
+ spidev = kzalloc(sizeof(*spidev), GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From f2d6c17bcb78a0721022f0fc84aa5163b0bffcbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 22:09:48 -0400
+Subject: SUNRPC: Fix priority queue fairness
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit f42f7c283078ce3c1e8368b140e270755b1ae313 ]
+
+Fix up the priority queue to not batch by owner, but by queue, so that
+we allow '1 << priority' elements to be dequeued before switching to
+the next priority queue.
+The owner field is still used to wake up requests in round robin order
+by owner to avoid single processes hogging the RPC layer by loading the
+queues.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/sched.h | 2 -
+ net/sunrpc/sched.c | 109 +++++++++++++++++------------------
+ 2 files changed, 54 insertions(+), 57 deletions(-)
+
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index d703f0ef37d8f..7d347e8cf944e 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -181,7 +181,6 @@ struct rpc_timer {
+ struct rpc_wait_queue {
+ spinlock_t lock;
+ struct list_head tasks[RPC_NR_PRIORITY]; /* task queue for each priority level */
+- pid_t owner; /* process id of last task serviced */
+ unsigned char maxpriority; /* maximum priority (0 if queue is not a priority queue) */
+ unsigned char priority; /* current priority */
+ unsigned char nr; /* # tasks remaining for cookie */
+@@ -197,7 +196,6 @@ struct rpc_wait_queue {
+ * from a single cookie. The aim is to improve
+ * performance of NFS operations such as read/write.
+ */
+-#define RPC_BATCH_COUNT 16
+ #define RPC_IS_PRIORITY(q) ((q)->maxpriority > 0)
+
+ /*
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 1cb35c753dcda..3eed71a2ff2bb 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -98,64 +98,78 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task)
+ list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list);
+ }
+
+-static void rpc_rotate_queue_owner(struct rpc_wait_queue *queue)
+-{
+- struct list_head *q = &queue->tasks[queue->priority];
+- struct rpc_task *task;
+-
+- if (!list_empty(q)) {
+- task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+- if (task->tk_owner == queue->owner)
+- list_move_tail(&task->u.tk_wait.list, q);
+- }
+-}
+-
+ static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
+ {
+ if (queue->priority != priority) {
+- /* Fairness: rotate the list when changing priority */
+- rpc_rotate_queue_owner(queue);
+ queue->priority = priority;
++ queue->nr = 1U << priority;
+ }
+ }
+
+-static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
+-{
+- queue->owner = pid;
+- queue->nr = RPC_BATCH_COUNT;
+-}
+-
+ static void rpc_reset_waitqueue_priority(struct rpc_wait_queue *queue)
+ {
+ rpc_set_waitqueue_priority(queue, queue->maxpriority);
+- rpc_set_waitqueue_owner(queue, 0);
+ }
+
+ /*
+- * Add new request to a priority queue.
++ * Add a request to a queue list
+ */
+-static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue,
+- struct rpc_task *task,
+- unsigned char queue_priority)
++static void
++__rpc_list_enqueue_task(struct list_head *q, struct rpc_task *task)
+ {
+- struct list_head *q;
+ struct rpc_task *t;
+
+- INIT_LIST_HEAD(&task->u.tk_wait.links);
+- if (unlikely(queue_priority > queue->maxpriority))
+- queue_priority = queue->maxpriority;
+- if (queue_priority > queue->priority)
+- rpc_set_waitqueue_priority(queue, queue_priority);
+- q = &queue->tasks[queue_priority];
+ list_for_each_entry(t, q, u.tk_wait.list) {
+ if (t->tk_owner == task->tk_owner) {
+- list_add_tail(&task->u.tk_wait.list, &t->u.tk_wait.links);
++ list_add_tail(&task->u.tk_wait.links,
++ &t->u.tk_wait.links);
++ /* Cache the queue head in task->u.tk_wait.list */
++ task->u.tk_wait.list.next = q;
++ task->u.tk_wait.list.prev = NULL;
+ return;
+ }
+ }
++ INIT_LIST_HEAD(&task->u.tk_wait.links);
+ list_add_tail(&task->u.tk_wait.list, q);
+ }
+
++/*
++ * Remove request from a queue list
++ */
++static void
++__rpc_list_dequeue_task(struct rpc_task *task)
++{
++ struct list_head *q;
++ struct rpc_task *t;
++
++ if (task->u.tk_wait.list.prev == NULL) {
++ list_del(&task->u.tk_wait.links);
++ return;
++ }
++ if (!list_empty(&task->u.tk_wait.links)) {
++ t = list_first_entry(&task->u.tk_wait.links,
++ struct rpc_task,
++ u.tk_wait.links);
++ /* Assume __rpc_list_enqueue_task() cached the queue head */
++ q = t->u.tk_wait.list.next;
++ list_add_tail(&t->u.tk_wait.list, q);
++ list_del(&task->u.tk_wait.links);
++ }
++ list_del(&task->u.tk_wait.list);
++}
++
++/*
++ * Add new request to a priority queue.
++ */
++static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue,
++ struct rpc_task *task,
++ unsigned char queue_priority)
++{
++ if (unlikely(queue_priority > queue->maxpriority))
++ queue_priority = queue->maxpriority;
++ __rpc_list_enqueue_task(&queue->tasks[queue_priority], task);
++}
++
+ /*
+ * Add new request to wait queue.
+ *
+@@ -193,13 +207,7 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue,
+ */
+ static void __rpc_remove_wait_queue_priority(struct rpc_task *task)
+ {
+- struct rpc_task *t;
+-
+- if (!list_empty(&task->u.tk_wait.links)) {
+- t = list_entry(task->u.tk_wait.links.next, struct rpc_task, u.tk_wait.list);
+- list_move(&t->u.tk_wait.list, &task->u.tk_wait.list);
+- list_splice_init(&task->u.tk_wait.links, &t->u.tk_wait.links);
+- }
++ __rpc_list_dequeue_task(task);
+ }
+
+ /*
+@@ -211,7 +219,8 @@ static void __rpc_remove_wait_queue(struct rpc_wait_queue *queue, struct rpc_tas
+ __rpc_disable_timer(queue, task);
+ if (RPC_IS_PRIORITY(queue))
+ __rpc_remove_wait_queue_priority(task);
+- list_del(&task->u.tk_wait.list);
++ else
++ list_del(&task->u.tk_wait.list);
+ queue->qlen--;
+ dprintk("RPC: %5u removed from queue %p \"%s\"\n",
+ task->tk_pid, queue, rpc_qname(queue));
+@@ -467,17 +476,9 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+ * Service a batch of tasks from a single owner.
+ */
+ q = &queue->tasks[queue->priority];
+- if (!list_empty(q)) {
+- task = list_entry(q->next, struct rpc_task, u.tk_wait.list);
+- if (queue->owner == task->tk_owner) {
+- if (--queue->nr)
+- goto out;
+- list_move_tail(&task->u.tk_wait.list, q);
+- }
+- /*
+- * Check if we need to switch queues.
+- */
+- goto new_owner;
++ if (!list_empty(q) && --queue->nr) {
++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
++ goto out;
+ }
+
+ /*
+@@ -489,7 +490,7 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+ else
+ q = q - 1;
+ if (!list_empty(q)) {
+- task = list_entry(q->next, struct rpc_task, u.tk_wait.list);
++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
+ goto new_queue;
+ }
+ } while (q != &queue->tasks[queue->priority]);
+@@ -499,8 +500,6 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q
+
+ new_queue:
+ rpc_set_waitqueue_priority(queue, (unsigned int)(q - &queue->tasks[0]));
+-new_owner:
+- rpc_set_waitqueue_owner(queue, task->tk_owner);
+ out:
+ return task;
+ }
+--
+2.20.1
+
--- /dev/null
+From d969425d6da0c22a6741aa623f50e8adaf002ba7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 11:04:40 +0800
+Subject: usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in
+ fotg210_get_status()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 2337a77c1cc86bc4e504ecf3799f947659c86026 ]
+
+The driver may sleep in an interrupt handler.
+The function call path (from bottom to top) in Linux-4.17 is:
+
+[FUNC] fotg210_ep_queue(GFP_KERNEL)
+drivers/usb/gadget/udc/fotg210-udc.c, 744:
+ fotg210_ep_queue in fotg210_get_status
+drivers/usb/gadget/udc/fotg210-udc.c, 768:
+ fotg210_get_status in fotg210_setup_packet
+drivers/usb/gadget/udc/fotg210-udc.c, 949:
+ fotg210_setup_packet in fotg210_irq (interrupt handler)
+
+To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
+If possible, spin_unlock() and spin_lock() around fotg210_ep_queue()
+can be also removed.
+
+This bug is found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/fotg210-udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
+index 95df2b3bb6a1a..76e991557116a 100644
+--- a/drivers/usb/gadget/udc/fotg210-udc.c
++++ b/drivers/usb/gadget/udc/fotg210-udc.c
+@@ -744,7 +744,7 @@ static void fotg210_get_status(struct fotg210_udc *fotg210,
+ fotg210->ep0_req->length = 2;
+
+ spin_unlock(&fotg210->lock);
+- fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_KERNEL);
++ fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC);
+ spin_lock(&fotg210->lock);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 529ea154fb811d7d887e4424b54a012caaa74252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 18:03:11 +0200
+Subject: USB: serial: cypress_m8: fix interrupt-out transfer length
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 56445eef55cb5904096fed7a73cf87b755dfffc7 ]
+
+Fix interrupt-out transfer length which was being set to the
+transfer-buffer length rather than the size of the outgoing packet.
+
+Note that no slab data was leaked as the whole transfer buffer is always
+cleared before each transfer.
+
+Fixes: 9aa8dae7b1fa ("cypress_m8: use usb_fill_int_urb where appropriate")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/cypress_m8.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index 244acb1299a95..e92cd1eceefa2 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -773,7 +773,7 @@ static void cypress_send(struct usb_serial_port *port)
+
+ usb_fill_int_urb(port->interrupt_out_urb, port->serial->dev,
+ usb_sndintpipe(port->serial->dev, port->interrupt_out_endpointAddress),
+- port->interrupt_out_buffer, port->interrupt_out_size,
++ port->interrupt_out_buffer, actual_size,
+ cypress_write_int_callback, port, priv->write_urb_interval);
+ result = usb_submit_urb(port->interrupt_out_urb, GFP_ATOMIC);
+ if (result) {
+--
+2.20.1
+
--- /dev/null
+From ccc6e570d99ed065e8030eebbcac31518df028a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 09:21:55 -0500
+Subject: x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 51fbf14f2528a8c6401290e37f1c893a2412f1d3 ]
+
+The only use of KEXEC_BACKUP_SRC_END is as an argument to
+walk_system_ram_res():
+
+ int crash_load_segments(struct kimage *image)
+ {
+ ...
+ walk_system_ram_res(KEXEC_BACKUP_SRC_START, KEXEC_BACKUP_SRC_END,
+ image, determine_backup_region);
+
+walk_system_ram_res() expects "start, end" arguments that are inclusive,
+i.e., the range to be walked includes both the start and end addresses.
+
+KEXEC_BACKUP_SRC_END was previously defined as (640 * 1024UL), which is the
+first address *past* the desired 0-640KB range.
+
+Define KEXEC_BACKUP_SRC_END as (640 * 1024UL - 1) so the KEXEC_BACKUP_SRC
+region is [0-0x9ffff], not [0-0xa0000].
+
+Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: "H. Peter Anvin" <hpa@zytor.com>
+CC: Andrew Morton <akpm@linux-foundation.org>
+CC: Brijesh Singh <brijesh.singh@amd.com>
+CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+CC: Ingo Molnar <mingo@redhat.com>
+CC: Lianbo Jiang <lijiang@redhat.com>
+CC: Takashi Iwai <tiwai@suse.de>
+CC: Thomas Gleixner <tglx@linutronix.de>
+CC: Tom Lendacky <thomas.lendacky@amd.com>
+CC: Vivek Goyal <vgoyal@redhat.com>
+CC: baiyaowei@cmss.chinamobile.com
+CC: bhe@redhat.com
+CC: dan.j.williams@intel.com
+CC: dyoung@redhat.com
+CC: kexec@lists.infradead.org
+Link: http://lkml.kernel.org/r/153805811578.1157.6948388946904655969.stgit@bhelgaas-glaptop.roam.corp.google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/kexec.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
+index d2434c1cad055..414f9b52e58e6 100644
+--- a/arch/x86/include/asm/kexec.h
++++ b/arch/x86/include/asm/kexec.h
+@@ -66,7 +66,7 @@ struct kimage;
+
+ /* Memory to backup during crash kdump */
+ #define KEXEC_BACKUP_SRC_START (0UL)
+-#define KEXEC_BACKUP_SRC_END (640 * 1024UL) /* 640K */
++#define KEXEC_BACKUP_SRC_END (640 * 1024UL - 1) /* 640K */
+
+ /*
+ * CPU does not save ss and sp on stack if execution is already
+--
+2.20.1
+
--- /dev/null
+From a2667765b1a9b22f3f7bb77c50f99802026c4952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Oct 2018 15:13:07 +0200
+Subject: x86/olpc: Fix build error with CONFIG_MFD_CS5535=m
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit fa112cf1e8bc693d5a666b1c479a2859c8b6e0f1 ]
+
+When building a 32-bit config which has the above MFD item as module
+but OLPC_XO1_PM is enabled =y - which is bool, btw - the kernel fails
+building with:
+
+ ld: arch/x86/platform/olpc/olpc-xo1-pm.o: in function `xo1_pm_remove':
+ /home/boris/kernel/linux/arch/x86/platform/olpc/olpc-xo1-pm.c:159: undefined reference to `mfd_cell_disable'
+ ld: arch/x86/platform/olpc/olpc-xo1-pm.o: in function `xo1_pm_probe':
+ /home/boris/kernel/linux/arch/x86/platform/olpc/olpc-xo1-pm.c:133: undefined reference to `mfd_cell_enable'
+ make: *** [Makefile:1030: vmlinux] Error 1
+
+Force MFD_CS5535 to y if OLPC_XO1_PM is enabled.
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Lubomir Rintel <lkundrak@v3.sk>
+Cc: x86@kernel.org
+Link: http://lkml.kernel.org/r/20181005131750.GA5366@zn.tnic
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 53b429811aef0..1bee1c6a9891b 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -2526,8 +2526,7 @@ config OLPC
+
+ config OLPC_XO1_PM
+ bool "OLPC XO-1 Power Management"
+- depends on OLPC && MFD_CS5535 && PM_SLEEP
+- select MFD_CORE
++ depends on OLPC && MFD_CS5535=y && PM_SLEEP
+ ---help---
+ Add support for poweroff and suspend of the OLPC XO-1 laptop.
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
