--- /dev/null
+From 7212da1f270e87c265c92e34f4667c7e3b4b4238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 20:08:13 +0200
+Subject: ACPI / LPSS: Exclude I2C busses shared with PUNIT from
+ pmc_atom_d3_mask
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 86b62e5cd8965d3056f9e9ccdec51631c37add81 ]
+
+lpss_iosf_enter_d3_state() checks if all hw-blocks using the DMA
+controllers are in d3 before powering down the DMA controllers.
+
+But on devices, where the I2C bus connected to the PMIC is shared by
+the PUNIT, the controller for that bus will never reach d3 since it has
+an effectively empty _PS3 method. Instead it appears to automatically
+power-down during S0i3 and we never see it as being in d3.
+
+This causes the DMA controllers to never be powered-down on these devices,
+causing them to never reach S0i3. This commit uses the ACPI _SEM method
+to detect if an I2C bus is shared with the PUNIT and if it is, it removes
+it from the mask of devices which lpss_iosf_enter_d3_state() checks for.
+
+This fixes these devices never reaching any S0ix states.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 51592dd45b066..1ab8d7223b252 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -98,6 +98,9 @@ struct lpss_private_data {
+ u32 prv_reg_ctx[LPSS_PRV_REG_COUNT];
+ };
+
++/* Devices which need to be in D3 before lpss_iosf_enter_d3_state() proceeds */
++static u32 pmc_atom_d3_mask = 0xfe000ffe;
++
+ /* LPSS run time quirks */
+ static unsigned int lpss_quirks;
+
+@@ -174,6 +177,21 @@ static void byt_pwm_setup(struct lpss_private_data *pdata)
+
+ static void byt_i2c_setup(struct lpss_private_data *pdata)
+ {
++ const char *uid_str = acpi_device_uid(pdata->adev);
++ acpi_handle handle = pdata->adev->handle;
++ unsigned long long shared_host = 0;
++ acpi_status status;
++ long uid = 0;
++
++ /* Expected to always be true, but better safe then sorry */
++ if (uid_str)
++ uid = simple_strtol(uid_str, NULL, 10);
++
++ /* Detect I2C bus shared with PUNIT and ignore its d3 status */
++ status = acpi_evaluate_integer(handle, "_SEM", NULL, &shared_host);
++ if (ACPI_SUCCESS(status) && shared_host && uid)
++ pmc_atom_d3_mask &= ~(BIT_LPSS2_F1_I2C1 << (uid - 1));
++
+ lpss_deassert_reset(pdata);
+
+ if (readl(pdata->mmio_base + pdata->dev_desc->prv_offset))
+@@ -789,7 +807,7 @@ static void lpss_iosf_enter_d3_state(void)
+ * Here we read the values related to LPSS power island, i.e. LPSS
+ * devices, excluding both LPSS DMA controllers, along with SCC domain.
+ */
+- u32 func_dis, d3_sts_0, pmc_status, pmc_mask = 0xfe000ffe;
++ u32 func_dis, d3_sts_0, pmc_status;
+ int ret;
+
+ ret = pmc_atom_read(PMC_FUNC_DIS, &func_dis);
+@@ -807,7 +825,7 @@ static void lpss_iosf_enter_d3_state(void)
+ * Shutdown both LPSS DMA controllers if and only if all other devices
+ * are already in D3hot.
+ */
+- pmc_status = (~(d3_sts_0 | func_dis)) & pmc_mask;
++ pmc_status = (~(d3_sts_0 | func_dis)) & pmc_atom_d3_mask;
+ if (pmc_status)
+ goto exit;
+
+--
+2.20.1
+
--- /dev/null
+From 45166deff31811dccae0fb58fb7784cc481af634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 16:39:10 +0200
+Subject: ALSA: intel8x0m: Register irq handler after register initializations
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7064f376d4a10686f51c879401a569bb4babf9c6 ]
+
+The interrupt handler has to be acquired after the other resource
+initialization when allocated with IRQF_SHARED. Otherwise it's
+triggered before the resource gets ready, and may lead to unpleasant
+behavior.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/intel8x0m.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
+index 3a4769a97d290..a626ee18628ea 100644
+--- a/sound/pci/intel8x0m.c
++++ b/sound/pci/intel8x0m.c
+@@ -1171,16 +1171,6 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ }
+
+ port_inited:
+- if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
+- KBUILD_MODNAME, chip)) {
+- dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
+- snd_intel8x0m_free(chip);
+- return -EBUSY;
+- }
+- chip->irq = pci->irq;
+- pci_set_master(pci);
+- synchronize_irq(chip->irq);
+-
+ /* initialize offsets */
+ chip->bdbars_count = 2;
+ tbl = intel_regs;
+@@ -1224,11 +1214,21 @@ static int snd_intel8x0m_create(struct snd_card *card,
+ chip->int_sta_reg = ICH_REG_GLOB_STA;
+ chip->int_sta_mask = int_sta_masks;
+
++ pci_set_master(pci);
++
+ if ((err = snd_intel8x0m_chip_init(chip, 1)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+ }
+
++ if (request_irq(pci->irq, snd_intel8x0m_interrupt, IRQF_SHARED,
++ KBUILD_MODNAME, chip)) {
++ dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
++ snd_intel8x0m_free(chip);
++ return -EBUSY;
++ }
++ chip->irq = pci->irq;
++
+ if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+ snd_intel8x0m_free(chip);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From cc5273807fe31645fb9ec70f3856d8f972eeb585 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 12:21:45 +0300
+Subject: ALSA: pcm: signedness bug in snd_pcm_plug_alloc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6f128fa41f310e1f39ebcea9621d2905549ecf52 ]
+
+The "frames" variable is unsigned so the error handling doesn't work
+properly.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/pcm_plugin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 617845d4a811b..b8ab46b8298de 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->next) {
+ if (plugin->dst_frames)
+ frames = plugin->dst_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->next;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+@@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t frames)
+ while (plugin->prev) {
+ if (plugin->src_frames)
+ frames = plugin->src_frames(plugin, frames);
+- if (snd_BUG_ON(frames <= 0))
++ if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0))
+ return -ENXIO;
+ plugin = plugin->prev;
+ err = snd_pcm_plugin_alloc(plugin, frames);
+--
+2.20.1
+
--- /dev/null
+From 2e2758b9c4faa01f259bf3c0501af56491eab0fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 12:49:43 +0200
+Subject: ALSA: seq: Do error checks at creating system ports
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b8e131542b47b81236ecf6768c923128e1f5db6e ]
+
+snd_seq_system_client_init() doesn't check the errors returned from
+its port creations. Let's do it properly and handle the error paths.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_system.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/sound/core/seq/seq_system.c b/sound/core/seq/seq_system.c
+index 8ce1d0b40dce1..ce1f1e4727ab1 100644
+--- a/sound/core/seq/seq_system.c
++++ b/sound/core/seq/seq_system.c
+@@ -123,6 +123,7 @@ int __init snd_seq_system_client_init(void)
+ {
+ struct snd_seq_port_callback pcallbacks;
+ struct snd_seq_port_info *port;
++ int err;
+
+ port = kzalloc(sizeof(*port), GFP_KERNEL);
+ if (!port)
+@@ -144,7 +145,10 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_TIMER;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+
+ /* register announcement port */
+ strcpy(port->name, "Announce");
+@@ -154,16 +158,24 @@ int __init snd_seq_system_client_init(void)
+ port->flags = SNDRV_SEQ_PORT_FLG_GIVEN_PORT;
+ port->addr.client = sysclient;
+ port->addr.port = SNDRV_SEQ_PORT_SYSTEM_ANNOUNCE;
+- snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT, port);
++ err = snd_seq_kernel_client_ctl(sysclient, SNDRV_SEQ_IOCTL_CREATE_PORT,
++ port);
++ if (err < 0)
++ goto error_port;
+ announce_port = port->addr.port;
+
+ kfree(port);
+ return 0;
++
++ error_port:
++ snd_seq_system_client_done();
++ kfree(port);
++ return err;
+ }
+
+
+ /* unregister our internal client */
+-void __exit snd_seq_system_client_done(void)
++void snd_seq_system_client_done(void)
+ {
+ int oldsysclient = sysclient;
+
+--
+2.20.1
+
--- /dev/null
+From a3bb27bbe7d30320dee440bb0ba3914227b787c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 17:33:40 -0500
+Subject: ARM: dts: am335x-evm: fix number of cpsw
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit dcbf6b18d81bcdc51390ca1b258c17e2e13b7d0c ]
+
+am335x-evm has only one CPSW external port physically wired, but DT defines
+2 ext. ports. As result, PHY connection failure reported for the second
+ext. port.
+
+Update DT to reflect am335x-evm board HW configuration, and, while here,
+switch to use phy-handle instead of phy_id.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-evm.dts | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am335x-evm.dts b/arch/arm/boot/dts/am335x-evm.dts
+index 478434ebff92d..27ff3e689e96e 100644
+--- a/arch/arm/boot/dts/am335x-evm.dts
++++ b/arch/arm/boot/dts/am335x-evm.dts
+@@ -724,6 +724,7 @@
+ pinctrl-0 = <&cpsw_default>;
+ pinctrl-1 = <&cpsw_sleep>;
+ status = "okay";
++ slaves = <1>;
+ };
+
+ &davinci_mdio {
+@@ -731,15 +732,14 @@
+ pinctrl-0 = <&davinci_mdio_default>;
+ pinctrl-1 = <&davinci_mdio_sleep>;
+ status = "okay";
+-};
+
+-&cpsw_emac0 {
+- phy_id = <&davinci_mdio>, <0>;
+- phy-mode = "rgmii-txid";
++ ethphy0: ethernet-phy@0 {
++ reg = <0>;
++ };
+ };
+
+-&cpsw_emac1 {
+- phy_id = <&davinci_mdio>, <1>;
++&cpsw_emac0 {
++ phy-handle = <ðphy0>;
+ phy-mode = "rgmii-txid";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From cb7c22257cda527f6d751550eac10dee8a7b678f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:42:01 +0200
+Subject: ARM: dts: at91/trivial: Fix USART1 definition for at91sam9g45
+
+From: Jay Foster <jayfoster@ieee.org>
+
+[ Upstream commit 10af10db8c76fa5b9bf1f52a895c1cb2c0ac24da ]
+
+Fix a typo. No functional change made by this patch.
+
+Signed-off-by: Jay Foster <jayfoster@ieee.org>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9g45.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
+index 64fa3f9a39d33..db0921e7a6138 100644
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -566,7 +566,7 @@
+ };
+ };
+
+- uart1 {
++ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP /* PB4 periph A with pullup */
+--
+2.20.1
+
--- /dev/null
+From 77b5ab5afcebcdd602fa90594f5e3cff7ea5449e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 22:12:33 +0300
+Subject: ARM: dts: clearfog: fix sdhci supply property name
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit e807f0298144c06740022a2f900d86b7f115595e ]
+
+The vmmc phandle, like all power supply property names, must have the
+'-supply' suffix.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-388-clearfog.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/armada-388-clearfog.dtsi b/arch/arm/boot/dts/armada-388-clearfog.dtsi
+index 68acfc9687069..8a3bbb7d6cc10 100644
+--- a/arch/arm/boot/dts/armada-388-clearfog.dtsi
++++ b/arch/arm/boot/dts/armada-388-clearfog.dtsi
+@@ -89,7 +89,7 @@
+ &clearfog_sdhci_cd_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+- vmmc = <®_3p3v>;
++ vmmc-supply = <®_3p3v>;
+ wp-inverted;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 49b921974c4a51bba77d6f8b5c299e60ef13e513 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:41:35 +0200
+Subject: ARM: dts: exynos: Disable pull control for S5M8767 PMIC
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ef2ecab9af5feae97c47b7f61cdd96f7f49b2c23 ]
+
+S5M8767 PMIC interrupt line on Exynos5250-based Arndale board has
+external pull-up resistors, so disable any pull control for it in
+in controller node. This fixes support for S5M8767 interrupts and
+enables operation of wakeup from S5M8767 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-arndale.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-arndale.dts b/arch/arm/boot/dts/exynos5250-arndale.dts
+index 18a7f396ac5f7..abd1705635f9b 100644
+--- a/arch/arm/boot/dts/exynos5250-arndale.dts
++++ b/arch/arm/boot/dts/exynos5250-arndale.dts
+@@ -169,6 +169,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&s5m8767_irq>;
+
+ vinb1-supply = <&main_dc_reg>;
+ vinb2-supply = <&main_dc_reg>;
+@@ -544,6 +546,13 @@
+ cap-sd-highspeed;
+ };
+
++&pinctrl_0 {
++ s5m8767_irq: s5m8767-irq {
++ samsung,pins = "gpx3-2";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &rtc {
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From 74e356a3e57bcb7dd0bf872496fba147aa0ab011 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 10:04:25 +0200
+Subject: ARM: dts: exynos: Fix regulators configuration on Peach Pi/Pit
+ Chromebooks
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit f8f3b7fc21b1cb59385b780acd9b9a26d04cb7b2 ]
+
+Regulators, which are marked as 'on-in-suspend' seems to be critical for
+board operation, thus they must not be disabled anytime. This can be
+only assured by marking them as 'always-on', because otherwise some
+actions of their clients might result in turning them off. This patch
+restores suspend/resume operation on Peach-Pit Chromebook board. It
+partially reverts 'always-on' property removal done by the commit
+mentioned in the Fixes tag.
+
+Fixes: 665c441eea3d ("ARM: dts: exynos: Remove unneded always-on for regulators on Peach boards")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-peach-pit.dts | 3 +++
+ arch/arm/boot/dts/exynos5800-peach-pi.dts | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5420-peach-pit.dts b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+index 7ccee2cfe4812..442161d2acd57 100644
+--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
+@@ -301,6 +301,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -322,6 +323,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -332,6 +334,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+diff --git a/arch/arm/boot/dts/exynos5800-peach-pi.dts b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+index 0900b38f60b4f..58af2254e5212 100644
+--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
+@@ -301,6 +301,7 @@
+ regulator-name = "vdd_1v35";
+ regulator-min-microvolt = <1350000>;
+ regulator-max-microvolt = <1350000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -322,6 +323,7 @@
+ regulator-name = "vdd_2v";
+ regulator-min-microvolt = <2000000>;
+ regulator-max-microvolt = <2000000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+@@ -332,6 +334,7 @@
+ regulator-name = "vdd_1v8";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
++ regulator-always-on;
+ regulator-boot-on;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+--
+2.20.1
+
--- /dev/null
+From 5facad88f5e575637982c4be545ee06cfd4d1b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Aug 2018 12:55:32 +0200
+Subject: ARM: dts: exynos: Fix sound in Snow-rev5 Chromebook
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 64858773d78e820003a94e5a7179d368213655d6 ]
+
+This patch adds missing properties to the CODEC and sound nodes, so the
+audio will work also on Snow rev5 Chromebook. This patch is an extension
+to the commit e9eefc3f8ce0 ("ARM: dts: exynos: Add missing clock and
+DAI properties to the max98095 node in Snow Chromebook")
+and commit 6ab569936d60 ("ARM: dts: exynos: Enable HDMI audio on Snow
+Chromebook"). It has been reported that such changes work fine on the
+rev5 board too.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+[krzk: Fixed typo in phandle to &max98090]
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-snow-rev5.dts | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5250-snow-rev5.dts b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+index 90560c316f644..cb986175b69b4 100644
+--- a/arch/arm/boot/dts/exynos5250-snow-rev5.dts
++++ b/arch/arm/boot/dts/exynos5250-snow-rev5.dts
+@@ -23,6 +23,14 @@
+
+ samsung,model = "Snow-I2S-MAX98090";
+ samsung,audio-codec = <&max98090>;
++
++ cpu {
++ sound-dai = <&i2s0 0>;
++ };
++
++ codec {
++ sound-dai = <&max98090 0>, <&hdmi>;
++ };
+ };
+ };
+
+@@ -34,6 +42,9 @@
+ interrupt-parent = <&gpx0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&max98090_irq>;
++ clocks = <&pmu_system_controller 0>;
++ clock-names = "mclk";
++ #sound-dai-cells = <1>;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 40cd60fdf2a8601ecdf970ee63d914de24e3a165 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:33 -0500
+Subject: ARM: dts: lpc32xx: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 11236ef582b8d66290bb3b3710e03ca1d85d8ad8 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Vladimir Zapolskiy <vz@mleia.com>
+Cc: Sylvain Lemieux <slemieux.tyco@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index f22a33a018199..d077bd2b9583e 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -179,7 +179,7 @@
+ * ssp0 and spi1 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp0: ssp@20084000 {
++ ssp0: spi@20084000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x20084000 0x1000>;
+ interrupts = <20 IRQ_TYPE_LEVEL_HIGH>;
+@@ -199,7 +199,7 @@
+ * ssp1 and spi2 are shared pins;
+ * enable one in your board dts, as needed.
+ */
+- ssp1: ssp@2008c000 {
++ ssp1: spi@2008c000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x2008c000 0x1000>;
+ interrupts = <21 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From 8fa075aaf556b10f6a1f1f6ae1d5da221fac83d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:31 -0500
+Subject: ARM: dts: marvell: Fix SPI and I2C bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit cf680cc5251487b9a39919c3cda31a108af19cf8 ]
+
+dtc has new checks for I2C and SPI buses. Fix the warnings in node names
+and unit-addresses.
+
+arch/arm/boot/dts/dove-cubox.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60"
+arch/arm/boot/dts/dove-cubox-es.dtb: Warning (i2c_bus_reg): /i2c-mux/i2c@0/clock-generator: I2C bus unit address format error, expected "60"
+arch/arm/boot/dts/dove-cubox.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-cubox-es.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-dove-db.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@10600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/dove-sbc-a510.dtb: Warning (spi_bus_bridge): /mbus/internal-regs/spi-ctrl@14600: node name for SPI buses should be 'spi'
+arch/arm/boot/dts/orion5x-kuroboxpro.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lschl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lsgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+arch/arm/boot/dts/orion5x-linkstation-lswtgl.dtb: Warning (i2c_bus_reg): /soc/internal-regs/i2c@11000/rtc: I2C bus unit address format error, expected "32"
+
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+Cc: Gregory Clement <gregory.clement@bootlin.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dove-cubox.dts | 2 +-
+ arch/arm/boot/dts/dove.dtsi | 6 +++---
+ arch/arm/boot/dts/orion5x-linkstation.dtsi | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/dove-cubox.dts b/arch/arm/boot/dts/dove-cubox.dts
+index 580e3cbcfbf7c..3e1584e787aec 100644
+--- a/arch/arm/boot/dts/dove-cubox.dts
++++ b/arch/arm/boot/dts/dove-cubox.dts
+@@ -87,7 +87,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- si5351: clock-generator {
++ si5351: clock-generator@60 {
+ compatible = "silabs,si5351a-msop";
+ reg = <0x60>;
+ #address-cells = <1>;
+diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi
+index f4a07bb7c3a29..c78471b05ab46 100644
+--- a/arch/arm/boot/dts/dove.dtsi
++++ b/arch/arm/boot/dts/dove.dtsi
+@@ -155,7 +155,7 @@
+ 0xffffe000 MBUS_ID(0x03, 0x01) 0 0x0000800 /* CESA SRAM 2k */
+ 0xfffff000 MBUS_ID(0x0d, 0x00) 0 0x0000800>; /* PMU SRAM 2k */
+
+- spi0: spi-ctrl@10600 {
++ spi0: spi@10600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -168,7 +168,7 @@
+ status = "disabled";
+ };
+
+- i2c: i2c-ctrl@11000 {
++ i2c: i2c@11000 {
+ compatible = "marvell,mv64xxx-i2c";
+ reg = <0x11000 0x20>;
+ #address-cells = <1>;
+@@ -218,7 +218,7 @@
+ status = "disabled";
+ };
+
+- spi1: spi-ctrl@14600 {
++ spi1: spi@14600 {
+ compatible = "marvell,orion-spi";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/orion5x-linkstation.dtsi b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+index e9991c83d7b70..117d71546ed0f 100644
+--- a/arch/arm/boot/dts/orion5x-linkstation.dtsi
++++ b/arch/arm/boot/dts/orion5x-linkstation.dtsi
+@@ -156,7 +156,7 @@
+ &i2c {
+ status = "okay";
+
+- rtc {
++ rtc@32 {
+ compatible = "ricoh,rs5c372a";
+ reg = <0x32>;
+ };
+--
+2.20.1
+
--- /dev/null
+From c44e2c9cc46986ec9f4d7f9b89ce27b2278532c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jul 2018 21:05:52 +0200
+Subject: ARM: dts: meson8: fix the clock controller register size
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f7f9da89bc4f61e33f7b9f5c75c4efdc1f0455d8 ]
+
+The clock controller registers are not 0x460 wide because the reset
+controller starts at CBUS 0x4404. This currently overlaps with the
+clock controller (which is at CBUS 0x4000).
+
+There is no public documentation available on the actual size of the
+clock controller's register area (also called "HHI"). However, in
+Amlogic's GPL kernel sources the last "HHI" register is
+HHI_HDMI_PHY_CNTL2 at CBUS + 0x43a8. 0x400 was chosen because that size
+doesn't seem unlikely.
+
+Fixes: 2c323c43a3d619 ("ARM: dts: meson8: add and use the real clock controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
+index b98d44fde6b60..e3ae85d65b39b 100644
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -170,7 +170,7 @@
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ compatible = "amlogic,meson8-clkc";
+- reg = <0x8000 0x4>, <0x4000 0x460>;
++ reg = <0x8000 0x4>, <0x4000 0x400>;
+ };
+
+ pwm_ef: pwm@86c0 {
+--
+2.20.1
+
--- /dev/null
+From e8dbfdd6c26bd4db46f9a467bbf5633f11ef22dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Jul 2018 21:05:53 +0200
+Subject: ARM: dts: meson8b: fix the clock controller register size
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit f31094fe8c16fbd2ca47921acf93b744b045aace ]
+
+The clock controller registers are not 0x460 wide because the reset
+controller starts at CBUS 0x4404. This currently overlaps with the
+clock controller (which is at CBUS 0x4000).
+
+There is no public documentation available on the actual size of the
+clock controller's register area (also called "HHI"). However, in
+Amlogic's GPL kernel sources the last "HHI" register is
+HHI_HDMI_PHY_CNTL2 at CBUS + 0x43a8. 0x400 was chosen because that size
+doesn't seem unlikely.
+
+Fixes: 4a69fcd3a10803 ("ARM: meson: Add DTS for Odroid-C1 and Tronfy MXQ boards")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
+index bc278da7df0d9..0f76da280ee76 100644
+--- a/arch/arm/boot/dts/meson8b.dtsi
++++ b/arch/arm/boot/dts/meson8b.dtsi
+@@ -121,7 +121,7 @@
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+ compatible = "amlogic,meson8b-clkc";
+- reg = <0x8000 0x4>, <0x4000 0x460>;
++ reg = <0x8000 0x4>, <0x4000 0x400>;
+ };
+
+ reset: reset-controller@4404 {
+--
+2.20.1
+
--- /dev/null
+From 7f708c7b8e3f57f521dfca95ca402349a0bf4989 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:10 +0200
+Subject: ARM: dts: omap3-gta04: fix touchscreen tsc2007
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 7384a24248eda140a234d356b6c840701ee9f055 ]
+
+we fix penirq polarity, add penirq pinmux and touchscreen
+properties.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 7e9d6c4cdbfb6..11daca2f19c32 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -275,6 +275,13 @@
+ OMAP3_CORE1_IOPAD(0x2134, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio112 */
+ >;
+ };
++
++ penirq_pins: pinmux_penirq_pins {
++ pinctrl-single,pins = <
++ /* here we could enable to wakeup the cpu from suspend by a pen touch */
++ OMAP3_CORE1_IOPAD(0x2194, PIN_INPUT_PULLUP | MUX_MODE4) /* gpio160 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
+@@ -412,10 +419,19 @@
+ tsc2007@48 {
+ compatible = "ti,tsc2007";
+ reg = <0x48>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&penirq_pins>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <0 IRQ_TYPE_EDGE_FALLING>; /* GPIO_160 */
+- gpios = <&gpio6 0 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* GPIO_160 */
+ ti,x-plate-ohms = <600>;
++ touchscreen-size-x = <480>;
++ touchscreen-size-y = <640>;
++ touchscreen-max-pressure = <1000>;
++ touchscreen-fuzz-x = <3>;
++ touchscreen-fuzz-y = <8>;
++ touchscreen-fuzz-pressure = <10>;
++ touchscreen-inverted-y;
+ };
+
+ /* RFID EEPROM */
+--
+2.20.1
+
--- /dev/null
+From aaf28759bf31dac1606d18f3795b5144afca167a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:07 +0200
+Subject: ARM: dts: omap3-gta04: fixes for tvout / venc
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit f6591391373dbff2c0200e1055d4ff86191578d2 ]
+
+* fix connector compatibility (composite)
+* add comment for gpio1 23
+* add proper #address-cells
+* we use only one venc_out channel for composite
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 0b0aa020a8d5d..5f62b2f3c6e93 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -123,7 +123,7 @@
+ };
+
+ tv0: connector {
+- compatible = "svideo-connector";
++ compatible = "composite-video-connector";
+ label = "tv";
+
+ port {
+@@ -135,7 +135,7 @@
+
+ tv_amp: opa362 {
+ compatible = "ti,opa362";
+- enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>;
++ enable-gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>; /* GPIO_23 to enable video out amplifier */
+
+ ports {
+ #address-cells = <1>;
+@@ -540,10 +540,14 @@
+
+ vdda-supply = <&vdac>;
+
++ #address-cells = <1>;
++ #size-cells = <0>;
++
+ port {
++ reg = <0>;
+ venc_out: endpoint {
+ remote-endpoint = <&opa_in>;
+- ti,channels = <2>;
++ ti,channels = <1>;
+ ti,invert-polarity;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 6c37b057c214535ed322f2941fab1e9c90fe8acc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:06 +0200
+Subject: ARM: dts: omap3-gta04: give spi_lcd node a label so that we can
+ overwrite in other DTS files
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa0d7dc355c890725b6178dab0cc11b194203afa ]
+
+needed for device variants based on GTA04 board but with
+different display panel (driver).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 4504908c23fe9..0b0aa020a8d5d 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -71,7 +71,7 @@
+ #sound-dai-cells = <0>;
+ };
+
+- spi_lcd {
++ spi_lcd: spi_lcd {
+ compatible = "spi-gpio";
+ #address-cells = <0x1>;
+ #size-cells = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From 9e5c2ad17929d1fcd0a9a5193813e374fc4e243d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:14 +0200
+Subject: ARM: dts: omap3-gta04: keep vpll2 always on
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 1ae00833e30c9b4af5cbfda65d75b1de12f74013 ]
+
+This is needed to make the display and venc work properly.
+Compare to omap3-beagle.dts.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 7992489b953e8..e83d0619b3b7c 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -537,6 +537,12 @@
+ regulator-max-microvolt = <3150000>;
+ };
+
++/* Needed to power the DPI pins */
++
++&vpll2 {
++ regulator-always-on;
++};
++
+ &dss {
+ pinctrl-names = "default";
+ pinctrl-0 = < &dss_dpi_pins >;
+--
+2.20.1
+
--- /dev/null
+From f0359713038b5770e4537c3cc31c89e26909e0c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:12 +0200
+Subject: ARM: dts: omap3-gta04: make NAND partitions compatible with recent
+ U-Boot
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit fa99c21ecb3cd4021a60d0e8bf880e78b5bd0729 ]
+
+Vendor defined U-Boot has changed the partition scheme a while ago:
+
+* kernel partition 6MB
+* file system partition uses the remainder up to end of the NAND
+* increased size of the environment partition (to get an OneNAND compatible base address)
+* shrink the U-Boot partition
+
+Let's be compatible (e.g. Debian kernel built from upstream).
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 11daca2f19c32..7992489b953e8 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -608,22 +608,22 @@
+
+ bootloaders@80000 {
+ label = "U-Boot";
+- reg = <0x80000 0x1e0000>;
++ reg = <0x80000 0x1c0000>;
+ };
+
+- bootloaders_env@260000 {
++ bootloaders_env@240000 {
+ label = "U-Boot Env";
+- reg = <0x260000 0x20000>;
++ reg = <0x240000 0x40000>;
+ };
+
+ kernel@280000 {
+ label = "Kernel";
+- reg = <0x280000 0x400000>;
++ reg = <0x280000 0x600000>;
+ };
+
+- filesystem@680000 {
++ filesystem@880000 {
+ label = "File System";
+- reg = <0x680000 0xf980000>;
++ reg = <0x880000 0>; /* 0 = MTDPART_SIZ_FULL */
+ };
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 5e76d62562da5afe934722fd95838b08e3ba7dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jul 2018 09:11:09 +0200
+Subject: ARM: dts: omap3-gta04: tvout: enable as display1 alias
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 8905592b6e50cec905e6c6035bbd36201a3bfac1 ]
+
+The omap dss susbystem takes the display aliases to find
+out which displays exist. To enable tv-out we must define
+an alias.
+
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-gta04.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
+index 5f62b2f3c6e93..7e9d6c4cdbfb6 100644
+--- a/arch/arm/boot/dts/omap3-gta04.dtsi
++++ b/arch/arm/boot/dts/omap3-gta04.dtsi
+@@ -28,6 +28,7 @@
+
+ aliases {
+ display0 = &lcd;
++ display1 = &tv0;
+ };
+
+ gpio-keys {
+--
+2.20.1
+
--- /dev/null
+From ec13b95fb54d53cc951d37babc76cdaf6761b990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 10:45:40 +0200
+Subject: ARM: dts: paz00: fix wakeup gpio keycode
+
+From: Marc Dietrich <marvin24@gmx.de>
+
+[ Upstream commit ebea2a43fdafdbce918bd7e200b709d6c33b9f3b ]
+
+The power key is controlled solely by the EC, which only tiggeres this
+gpio after wakeup.
+Fixes immediately return to suspend after wake from LP1.
+
+Signed-off-by: Marc Dietrich <marvin24@gmx.de>
+Tested-by: Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra20-paz00.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts
+index 30436969adc0e..1b8db91277b1c 100644
+--- a/arch/arm/boot/dts/tegra20-paz00.dts
++++ b/arch/arm/boot/dts/tegra20-paz00.dts
+@@ -524,10 +524,10 @@
+ gpio-keys {
+ compatible = "gpio-keys";
+
+- power {
+- label = "Power";
++ wakeup {
++ label = "Wakeup";
+ gpios = <&gpio TEGRA_GPIO(J, 7) GPIO_ACTIVE_LOW>;
+- linux,code = <KEY_POWER>;
++ linux,code = <KEY_WAKEUP>;
+ wakeup-source;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From acebd501a51e373558f80f9a3d4bf91a953bcbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:03:09 +0200
+Subject: ARM: dts: pxa: fix power i2c base address
+
+From: Marcel Ziswiler <marcel@ziswiler.com>
+
+[ Upstream commit 8a1ecc01a473b75ab97be9b36f623e4551a6e9ae ]
+
+There is one too many zeroes in the Power I2C base address. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel@ziswiler.com>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 2ab6986433c82..3228ad5fb725f 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -71,7 +71,7 @@
+ clocks = <&clks CLK_PWM1>;
+ };
+
+- pwri2c: i2c@40f000180 {
++ pwri2c: i2c@40f00180 {
+ compatible = "mrvl,pxa-i2c";
+ reg = <0x40f00180 0x24>;
+ interrupts = <6>;
+--
+2.20.1
+
--- /dev/null
+From 21b69bdd5046f9a332f153adbd4a31eeb57d654d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jun 2018 18:44:01 +0200
+Subject: ARM: dts: pxa: fix the rtc controller
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+[ Upstream commit 24a610eba32a80ed778ea79680b600c3fe73d7de ]
+
+The RTC controller is fed by an external fixed 32kHz clock. Yet the
+driver wants to acquire this clock, even though it doesn't make any use
+of it, ie. doesn't get the rate to make calculation.
+
+Therefore, use the exported 32.768kHz clock in the PXA clock tree to
+make the driver happy and working.
+
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa25x.dtsi | 4 ++++
+ arch/arm/boot/dts/pxa27x.dtsi | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/pxa25x.dtsi b/arch/arm/boot/dts/pxa25x.dtsi
+index 95d59be97213e..8494b57871709 100644
+--- a/arch/arm/boot/dts/pxa25x.dtsi
++++ b/arch/arm/boot/dts/pxa25x.dtsi
+@@ -80,6 +80,10 @@
+ #pwm-cells = <1>;
+ clocks = <&clks CLK_PWM1>;
+ };
++
++ rtc@40900000 {
++ clocks = <&clks CLK_OSC32k768>;
++ };
+ };
+
+ timer@40a00000 {
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 747f750f675d9..2ab6986433c82 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -113,6 +113,10 @@
+
+ status = "disabled";
+ };
++
++ rtc@40900000 {
++ clocks = <&clks CLK_OSC32k768>;
++ };
+ };
+
+ clocks {
+--
+2.20.1
+
--- /dev/null
+From 675662a1f0f4ec3986acf3c9f4cdf451aaf5bc4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jul 2018 10:37:47 +0200
+Subject: ARM: dts: qcom: ipq4019: fix cpu0's qcom,saw2 reg value
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit bd73a3dd257fb838bd456a18eeee0ef0224b7a40 ]
+
+while compiling an ipq4019 target, dtc will complain:
+regulator@b089000 unit address format error, expected "2089000"
+
+The saw0 regulator reg value seems to be
+copied and pasted from qcom-ipq8064.dtsi.
+
+This patch fixes the reg value to match that of the
+unit address which in turn silences the warning.
+(There is no driver for qcom,saw2 right now.
+So this went unnoticed)
+
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: John Crispin <john@phrozen.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 10d112a4078ec..19156cbb60034 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -234,7 +234,7 @@
+
+ saw0: regulator@b089000 {
+ compatible = "qcom,saw2";
+- reg = <0x02089000 0x1000>, <0x0b009000 0x1000>;
++ reg = <0x0b089000 0x1000>, <0x0b009000 0x1000>;
+ regulator;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 3928d1859d2aefb36876a1852e627caf58bb6910 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:26 -0500
+Subject: ARM: dts: realview: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 016add12977bcc30f77d7e48fc9a3a024cb46645 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-eb.dtsi | 2 +-
+ arch/arm/boot/dts/arm-realview-pb1176.dts | 2 +-
+ arch/arm/boot/dts/arm-realview-pb11mp.dts | 2 +-
+ arch/arm/boot/dts/arm-realview-pbx.dtsi | 2 +-
+ arch/arm/boot/dts/versatile-ab.dts | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-eb.dtsi b/arch/arm/boot/dts/arm-realview-eb.dtsi
+index e2e9599596e25..05379b6c1c13b 100644
+--- a/arch/arm/boot/dts/arm-realview-eb.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
+@@ -334,7 +334,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index c789564f28033..c1fd5615ddfe3 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -343,7 +343,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- pb1176_ssp: ssp@1010b000 {
++ pb1176_ssp: spi@1010b000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1010b000 0x1000>;
+ interrupt-parent = <&intc_dc1176>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index 3944765ac4b06..e306f1cceb4ec 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -480,7 +480,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp@1000d000 {
++ spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ interrupt-parent = <&intc_pb11mp>;
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index aeb49c4bd773f..2bf3958b2e6b9 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -318,7 +318,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- ssp: ssp@1000d000 {
++ ssp: spi@1000d000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x1000d000 0x1000>;
+ clocks = <&sspclk>, <&pclk>;
+diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
+index 4a51612996bc2..a9000d22b2c00 100644
+--- a/arch/arm/boot/dts/versatile-ab.dts
++++ b/arch/arm/boot/dts/versatile-ab.dts
+@@ -304,7 +304,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- ssp@101f4000 {
++ spi@101f4000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x101f4000 0x1000>;
+ interrupts = <11>;
+--
+2.20.1
+
--- /dev/null
+From 7af57cda9706ad53b3ef33dbfa3ff72c22e86a56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 11:34:36 +0200
+Subject: ARM: dts: rockchip: explicitly set vcc_sd0 pin to gpio on
+ rk3188-radxarock
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit a2df0984e73fd9e1dad5fc3f1c307ec3de395e30 ]
+
+It is good practice to make the setting of gpio-pinctrls explicitly in the
+devicetree, and in this case even necessary.
+Rockchip boards start with iomux settings set to gpio for most pins and
+while the linux pinctrl driver also implicitly sets the gpio function if
+a pin is requested as gpio that is not necessarily true for other drivers.
+
+The issue in question stems from uboot, where the sdmmc_pwr pin is set
+to function 1 (sdmmc-power) by the bootrom when reading the 1st-stage
+loader. The regulator controlled by the pin is active-low though, so
+when the dwmmc hw-block sets its enabled bit, it actually disables the
+regulator. By changing the pin back to gpio we fix that behaviour.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-radxarock.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/rk3188-radxarock.dts b/arch/arm/boot/dts/rk3188-radxarock.dts
+index 53d6fc2fdbce8..541a798d3d202 100644
+--- a/arch/arm/boot/dts/rk3188-radxarock.dts
++++ b/arch/arm/boot/dts/rk3188-radxarock.dts
+@@ -130,6 +130,8 @@
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_LOW>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdmmc_pwr>;
+ startup-delay-us = <100000>;
+ vin-supply = <&vcc_io>;
+ };
+@@ -348,6 +350,12 @@
+ };
+ };
+
++ sd0 {
++ sdmmc_pwr: sdmmc-pwr {
++ rockchip,pins = <RK_GPIO3 1 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb {
+ host_vbus_drv: host-vbus-drv {
+ rockchip,pins = <0 3 RK_FUNC_GPIO &pcfg_pull_none>;
+--
+2.20.1
+
--- /dev/null
+From 26084d5eac5355f8b3f45a4aed84a41a946f13df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:36 -0500
+Subject: ARM: dts: rockchip: Fix erroneous SPI bus dtc warnings on rk3036
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 131c3eb428ccd5f0c784b9edb4f72ec296a045d2 ]
+
+dtc has new checks for SPI buses. The rk3036 dts file has a node named
+spi' which causes false positive warnings. As the node is a pinctrl child
+node, change the node name to be 'spi-pins' to fix the warnings.
+
+arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus
+arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #address-cells for SPI bus
+arch/arm/boot/dts/rk3036-evb.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus
+arch/arm/boot/dts/rk3036-kylin.dtb: Warning (spi_bus_bridge): /pinctrl/spi: incorrect #size-cells for SPI bus
+
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: linux-rockchip@lists.infradead.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3036.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi
+index 5c0a76493d22a..03cf0c84ac0aa 100644
+--- a/arch/arm/boot/dts/rk3036.dtsi
++++ b/arch/arm/boot/dts/rk3036.dtsi
+@@ -750,7 +750,7 @@
+ /* no rts / cts for uart2 */
+ };
+
+- spi {
++ spi-pins {
+ spi_txd:spi-txd {
+ rockchip,pins = <1 29 RK_FUNC_3 &pcfg_pull_default>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 8767813cb0230ef861dfbb2648b4d6e0aec88490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 23:52:49 -0500
+Subject: ARM: dts: socfpga: Fix I2C bus unit-address error
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit cbbc488ed85061a765cf370c3e41f383c1e0add6 ]
+
+dtc has new checks for I2C buses. Fix the warnings in unit-addresses.
+
+arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dtb: Warning (i2c_bus_reg): /soc/i2c@ffc04000/adxl345@0: I2C bus unit address format error, expected "53"
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+index b280e64941938..31b01a998b2ed 100644
+--- a/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
++++ b/arch/arm/boot/dts/socfpga_cyclone5_de0_sockit.dts
+@@ -88,7 +88,7 @@
+ status = "okay";
+ clock-frequency = <100000>;
+
+- adxl345: adxl345@0 {
++ adxl345: adxl345@53 {
+ compatible = "adi,adxl345";
+ reg = <0x53>;
+
+--
+2.20.1
+
--- /dev/null
+From 975800f41048a7564be20d8d104099238ab6c93f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:34 -0500
+Subject: ARM: dts: ste: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 2f967f9e9fa076affb711da1a8389b5d33814fc6 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 4 ++--
+ arch/arm/boot/dts/ste-hrefprev60.dtsi | 2 +-
+ arch/arm/boot/dts/ste-snowball.dts | 2 +-
+ arch/arm/boot/dts/ste-u300.dts | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 3dc0028e108b3..986767735e249 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -878,7 +878,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80002000 0x1000>;
+ interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
+@@ -892,7 +892,7 @@
+ power-domains = <&pm_domains DOMAIN_VAPE>;
+ };
+
+- ssp@80003000 {
++ spi@80003000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x80003000 0x1000>;
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm/boot/dts/ste-hrefprev60.dtsi b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+index 3f14b4df69b4e..94eeb7f1c9478 100644
+--- a/arch/arm/boot/dts/ste-hrefprev60.dtsi
++++ b/arch/arm/boot/dts/ste-hrefprev60.dtsi
+@@ -57,7 +57,7 @@
+ };
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ /*
+ * On the first generation boards, this SSP/SPI port was connected
+ * to the AB8500.
+diff --git a/arch/arm/boot/dts/ste-snowball.dts b/arch/arm/boot/dts/ste-snowball.dts
+index ade1d0d4e5f45..1bf4358f8fa71 100644
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -376,7 +376,7 @@
+ pinctrl-1 = <&i2c3_sleep_mode>;
+ };
+
+- ssp@80002000 {
++ spi@80002000 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ssp0_snowball_mode>;
+ };
+diff --git a/arch/arm/boot/dts/ste-u300.dts b/arch/arm/boot/dts/ste-u300.dts
+index 62ecb6a2fa39e..1bd1aba3322f1 100644
+--- a/arch/arm/boot/dts/ste-u300.dts
++++ b/arch/arm/boot/dts/ste-u300.dts
+@@ -442,7 +442,7 @@
+ dma-names = "rx";
+ };
+
+- spi: ssp@c0006000 {
++ spi: spi@c0006000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0xc0006000 0x1000>;
+ interrupt-parent = <&vica>;
+--
+2.20.1
+
--- /dev/null
+From 5eae2eb3f87d5ac505c964fa3c88b170a74dd2e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 14:42:33 +0200
+Subject: ARM: dts: tegra30: fix xcvr-setup-use-fuses
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 564706f65cda3de52b09e51feb423a43940fe661 ]
+
+There was a dot instead of a comma. Fix this.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
+index c3e9f1e847db8..cb5b76e958131 100644
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -840,7 +840,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <1>;
+ nvidia,xcvr-lsrslew = <1>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -877,7 +877,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+@@ -913,7 +913,7 @@
+ nvidia,elastic-limit = <16>;
+ nvidia,term-range-adj = <6>;
+ nvidia,xcvr-setup = <51>;
+- nvidia.xcvr-setup-use-fuses;
++ nvidia,xcvr-setup-use-fuses;
+ nvidia,xcvr-lsfslew = <2>;
+ nvidia,xcvr-lsrslew = <2>;
+ nvidia,xcvr-hsslew = <32>;
+--
+2.20.1
+
--- /dev/null
+From 85f52fb9e01d4712635a75938c7b5866cfb0c9e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jun 2018 09:50:09 +0200
+Subject: ARM: dts: ux500: Correct SCU unit address
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2f217d24ecaec2012e628d21e244eef0608656a4 ]
+
+The unit address of the Cortex-A9 SCU device node contains one zero too
+many. Remove it.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-dbx5x0.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ste-dbx5x0.dtsi b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+index 2310a4e97768c..3dc0028e108b3 100644
+--- a/arch/arm/boot/dts/ste-dbx5x0.dtsi
++++ b/arch/arm/boot/dts/ste-dbx5x0.dtsi
+@@ -197,7 +197,7 @@
+ <0xa0410100 0x100>;
+ };
+
+- scu@a04100000 {
++ scu@a0410000 {
+ compatible = "arm,cortex-a9-scu";
+ reg = <0xa0410000 0x100>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 81e25fb40be157babe84e53ca8b70ca12558c529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Jul 2018 10:30:03 +0200
+Subject: ARM: dts: ux500: Fix LCDA clock line muxing
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ecde29569e3484e1d0a032bf4074449bce4d4a03 ]
+
+The "lcdaclk_b_1" group is muxed with the function "lcd"
+but needs a separate entry to be muxed in with "lcda"
+rather than "lcd".
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-href-family-pinctrl.dtsi | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+index 5c5cea232743d..1ec193b0c5065 100644
+--- a/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
++++ b/arch/arm/boot/dts/ste-href-family-pinctrl.dtsi
+@@ -607,16 +607,20 @@
+
+ mcde {
+ lcd_default_mode: lcd_default {
+- default_mux {
++ default_mux1 {
+ /* Mux in VSI0 and all the data lines */
+ function = "lcd";
+ groups =
+ "lcdvsi0_a_1", /* VSI0 for LCD */
+ "lcd_d0_d7_a_1", /* Data lines */
+ "lcd_d8_d11_a_1", /* TV-out */
+- "lcdaclk_b_1", /* Clock line for TV-out */
+ "lcdvsi1_a_1"; /* VSI1 for HDMI */
+ };
++ default_mux2 {
++ function = "lcda";
++ groups =
++ "lcdaclk_b_1"; /* Clock line for TV-out */
++ };
+ default_cfg1 {
+ pins =
+ "GPIO68_E1", /* VSI0 */
+--
+2.20.1
+
--- /dev/null
+From ea9fd02e7a9e134ac16d6d7b523228a11f650250 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 12:34:21 +0200
+Subject: ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff"
+ is set
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 8148d2136002da2e2887caf6a07bbd9c033f14f3 ]
+
+One of the Freescale recommended sequences for power off with external
+PMIC is the following:
+...
+3. SoC is programming PMIC for power off when standby is asserted.
+4. In CCM STOP mode, Standby is asserted, PMIC gates SoC supplies.
+
+See:
+http://www.nxp.com/assets/documents/data/en/reference-manuals/IMX6DQRM.pdf
+page 5083
+
+This patch implements step 4. of this sequence.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/pm-imx6.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index ecdf071653d4d..6078bcc9f594a 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -604,6 +604,28 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
+ IMX6Q_GPR1_GINT);
+ }
+
++static void imx6_pm_stby_poweroff(void)
++{
++ imx6_set_lpm(STOP_POWER_OFF);
++ imx6q_suspend_finish(0);
++
++ mdelay(1000);
++
++ pr_emerg("Unable to poweroff system\n");
++}
++
++static int imx6_pm_stby_poweroff_probe(void)
++{
++ if (pm_power_off) {
++ pr_warn("%s: pm_power_off already claimed %p %pf!\n",
++ __func__, pm_power_off, pm_power_off);
++ return -EBUSY;
++ }
++
++ pm_power_off = imx6_pm_stby_poweroff;
++ return 0;
++}
++
+ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ {
+ struct device_node *np;
+@@ -620,6 +642,9 @@ void __init imx6_pm_ccm_init(const char *ccm_compat)
+ val = readl_relaxed(ccm_base + CLPCR);
+ val &= ~BM_CLPCR_LPM;
+ writel_relaxed(val, ccm_base + CLPCR);
++
++ if (of_property_read_bool(np, "fsl,pmic-stby-poweroff"))
++ imx6_pm_stby_poweroff_probe();
+ }
+
+ void __init imx6q_pm_init(void)
+--
+2.20.1
+
--- /dev/null
+From 52f1963df076ebf4f4fae39ccdbaf345b741394a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 18:37:43 +0200
+Subject: ARM: tegra: apalis_t30: fix mmc1 cmd pull-up
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit 1c997fe4becdc6fcbc06e23982ceb65621e6572a ]
+
+Fix MMC1 cmd pin pull-up causing issues on carrier boards without
+external pull-up.
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-apalis.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-apalis.dtsi b/arch/arm/boot/dts/tegra30-apalis.dtsi
+index faa8cd2914e8b..b9368d40bc6fb 100644
+--- a/arch/arm/boot/dts/tegra30-apalis.dtsi
++++ b/arch/arm/boot/dts/tegra30-apalis.dtsi
+@@ -166,14 +166,14 @@
+
+ /* Apalis MMC1 */
+ sdmmc3_clk_pa6 {
+- nvidia,pins = "sdmmc3_clk_pa6",
+- "sdmmc3_cmd_pa7";
++ nvidia,pins = "sdmmc3_clk_pa6";
+ nvidia,function = "sdmmc3";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+ nvidia,tristate = <TEGRA_PIN_DISABLE>;
+ };
+ sdmmc3_dat0_pb7 {
+- nvidia,pins = "sdmmc3_dat0_pb7",
++ nvidia,pins = "sdmmc3_cmd_pa7",
++ "sdmmc3_dat0_pb7",
+ "sdmmc3_dat1_pb6",
+ "sdmmc3_dat2_pb5",
+ "sdmmc3_dat3_pb4",
+--
+2.20.1
+
--- /dev/null
+From a078e6fd74cd2419f4377402c02cb015e256519a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jul 2018 13:31:34 +0100
+Subject: arm64: dts: allwinner: a64: NanoPi-A64: Fix DCDC1 voltage
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 480f58cdbe392d4387a2193b6131a277e0111dd0 ]
+
+According to the NanoPi-A64 schematics, DCDC1 is connected to a voltage
+rail named "VDD_SYS_3.3V". All users seem to expect 3.3V here: the
+Ethernet PHY, the uSD card slot, the camera interface and the GPIO pins
+on the headers.
+Fix up the voltage on the regulator to lift it up to 3.3V.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
+index 2beef9e6cb885..aa0b3844ad63e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-nanopi-a64.dts
+@@ -126,9 +126,9 @@
+
+ ®_dcdc1 {
+ regulator-always-on;
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+- regulator-name = "vcc-3v";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ regulator-name = "vcc-3v3";
+ };
+
+ ®_dcdc2 {
+--
+2.20.1
+
--- /dev/null
+From df278f007b9fb802f280d69131aa8374bb178550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Jul 2018 13:31:31 +0100
+Subject: arm64: dts: allwinner: a64: Olinuxino: fix DRAM voltage
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 93366b49a35f3a190052734b3f32c8fe2535b53f ]
+
+The Olinuxino board uses DDR3L chips which are supposed to be driven
+with 1.35V. The reset default of the AXP is properly set to 1.36V.
+
+While technically the chips can also run at 1.5 volts, changing the
+voltage on the fly while booting Linux is asking for trouble. Also
+running at a lower voltage saves power.
+
+So fix the DCDC5 value to match the actual board design.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Tested-by: Martin Lucina <martin@lucina.net>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+index 338e786155b1f..2ef779b027572 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-olinuxino.dts
+@@ -120,10 +120,14 @@
+
+ /* DCDC3 is polyphased with DCDC2 */
+
++/*
++ * The board uses DDR3L DRAM chips. 1.36V is the closest to the nominal
++ * 1.35V that the PMIC can drive.
++ */
+ ®_dcdc5 {
+ regulator-always-on;
+- regulator-min-microvolt = <1500000>;
+- regulator-max-microvolt = <1500000>;
++ regulator-min-microvolt = <1360000>;
++ regulator-max-microvolt = <1360000>;
+ regulator-name = "vcc-ddr3";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 0d102a97adfafb2b38fbf87765af422d05bfe6b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:40 -0500
+Subject: arm64: dts: amd: Fix SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit e9f0878c4b2004ac19581274c1ae4c61ae3ca70e ]
+
+dtc has new checks for SPI buses. Fix the warnings in node names.
+
+arch/arm64/boot/dts/amd/amd-overdrive.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b0.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+arch/arm64/boot/dts/amd/amd-overdrive-rev-b1.dtb: Warning (spi_bus_bridge): /smb/ssp@e1030000: node name for SPI buses should be 'spi'
+
+Cc: Brijesh Singh <brijeshkumar.singh@amd.com>
+Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+index 125f4deb52fe9..b664e7af74eb3 100644
+--- a/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
++++ b/arch/arm64/boot/dts/amd/amd-seattle-soc.dtsi
+@@ -107,7 +107,7 @@
+ clock-names = "uartclk", "apb_pclk";
+ };
+
+- spi0: ssp@e1020000 {
++ spi0: spi@e1020000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1020000 0 0x1000>;
+@@ -117,7 +117,7 @@
+ clock-names = "apb_pclk";
+ };
+
+- spi1: ssp@e1030000 {
++ spi1: spi@e1030000 {
+ status = "disabled";
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0 0xe1030000 0 0x1000>;
+--
+2.20.1
+
--- /dev/null
+From 5f10652ae92ccc7060ad2de1ef02682e05771c81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:44 -0500
+Subject: arm64: dts: lg: Fix SPI controller node names
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 09bae3b64cb580c95329bd8d16f08f0a5cb81ec9 ]
+
+SPI controller nodes should be named 'spi' rather than 'ssp'. Fixing the
+name enables dtc SPI bus checks.
+
+Cc: Chanho Min <chanho.min@lge.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/lg/lg1312.dtsi | 4 ++--
+ arch/arm64/boot/dts/lg/lg1313.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/lg/lg1312.dtsi b/arch/arm64/boot/dts/lg/lg1312.dtsi
+index 860c8fb107950..4bde7b6f2b113 100644
+--- a/arch/arm64/boot/dts/lg/lg1312.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1312.dtsi
+@@ -168,14 +168,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+diff --git a/arch/arm64/boot/dts/lg/lg1313.dtsi b/arch/arm64/boot/dts/lg/lg1313.dtsi
+index 1887af654a7db..16ced1ff1ad36 100644
+--- a/arch/arm64/boot/dts/lg/lg1313.dtsi
++++ b/arch/arm64/boot/dts/lg/lg1313.dtsi
+@@ -168,14 +168,14 @@
+ clock-names = "apb_pclk";
+ status="disabled";
+ };
+- spi0: ssp@fe800000 {
++ spi0: spi@fe800000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe800000 0x1000>;
+ interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_bus>;
+ clock-names = "apb_pclk";
+ };
+- spi1: ssp@fe900000 {
++ spi1: spi@fe900000 {
+ compatible = "arm,pl022", "arm,primecell";
+ reg = <0x0 0xfe900000 0x1000>;
+ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From f5b1e56c519515865f03026081cc9b4c83cef6cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 13:12:41 -0500
+Subject: arm64: dts: meson: Fix erroneous SPI bus warnings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 68ecb5c1920c5b98b1e717fd2349fba2ee5d4031 ]
+
+dtc has new checks for SPI buses. The meson dts files have a node named
+spi' which causes false positive warnings. As the node is a pinctrl child
+node, change the node name to be 'spi-pins' to fix the warnings.
+
+arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dtb: Warning (spi_bus_bridge): /soc/periphs@c8834000/pinctrl@4b0/spi: incorrect #address-cells for SPI bus
+
+Cc: Carlo Caione <carlo@caione.org>
+Cc: Kevin Hilman <khilman@baylibre.com>
+Cc: linux-amlogic@lists.infradead.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi | 2 +-
+ arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+index af834cdbba791..250b5c11c0e25 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+@@ -413,7 +413,7 @@
+ };
+ };
+
+- spi_pins: spi {
++ spi_pins: spi-pins {
+ mux {
+ groups = "spi_miso",
+ "spi_mosi",
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+index fb8d76a17bc5d..3c30579449608 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi
+@@ -310,7 +310,7 @@
+ };
+ };
+
+- spi_pins: spi {
++ spi_pins: spi-pins {
+ mux {
+ groups = "spi_miso",
+ "spi_mosi",
+--
+2.20.1
+
--- /dev/null
+From 20423032f94c169f5a1bd176938ad3bda250cb39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 12:53:17 +0200
+Subject: arm64: dts: meson: libretech: update board model
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit b7eb0e26cc4a212fde09144cd49d4103170d2b9e ]
+
+There is actually several different libretech board with the CC suffix
+so the model name is not appropriate here. Update to something more
+specific
+
+Reported-by: Da Xue <da@lessconfused.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index d71cbf596d1f7..0814b6b29b86a 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -14,7 +14,7 @@
+
+ / {
+ compatible = "libretech,cc", "amlogic,s905x", "amlogic,meson-gxl";
+- model = "Libre Technology CC";
++ model = "Libre Computer Board AML-S905X-CC";
+
+ aliases {
+ serial0 = &uart_AO;
+--
+2.20.1
+
--- /dev/null
+From 6e641a2767c349964a22f19ff9acea87cfac71aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2017 00:11:45 +0100
+Subject: arm64: dts: rockchip: enable display nodes on rk3328-rock64
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit e78d53c7b2873e0724eb765a88ccde42560b0e05 ]
+
+Enable necessary nodes to get output on the hdmi port of the board.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+index 3f8f528099a80..19c086f1bf6db 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -146,6 +146,14 @@
+ status = "okay";
+ };
+
++&hdmi {
++ status = "okay";
++};
++
++&hdmiphy {
++ status = "okay";
++};
++
+ &i2c1 {
+ status = "okay";
+
+@@ -333,3 +341,11 @@
+ &usb_host0_ohci {
+ status = "okay";
+ };
++
++&vop {
++ status = "okay";
++};
++
++&vop_mmu {
++ status = "okay";
++};
+--
+2.20.1
+
--- /dev/null
+From 8da022bab1a9ad7ae22b6c6571313eb634e9aafe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 15:47:14 +0200
+Subject: arm64: dts: rockchip: Fix microSD in rk3399 sapphire board
+
+From: Vicente Bergas <vicencb@gmail.com>
+
+[ Upstream commit 88a20edf76091ee7f1bb459b89d714d53f0f8940 ]
+
+The microSD card slot in the Sapphire board is not working because of
+several issues:
+ 1.- The vmmc power supply is missing in the DTS. It is capable of 3.0V
+ and has a GPIO-based enable control.
+ 2.- The vqmmc power supply can provide up to 3.3V, but it is capped in
+ the DTS to just 3.0V because of the vmmc capability. This results in a
+ conflict from the mmc driver requesting an unsupportable voltage range
+ from 3.3V to 3.0V (min > max) as reported in dmesg. So, extend the
+ range up to 3.3V. The hw should be able to stand this 0.3V tolerance.
+ See mmc_regulator_set_vqmmc in drivers/mmc/core/core.c.
+ 3.- The card detect signal is non-working. There is a known conflict
+ with jtag, but the workaround in drivers/soc/rockchip/grf.c does not
+ work. Adding the broken-cd attribute to the DTS fixes the issue.
+
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3399-sapphire.dtsi | 24 ++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+index 82576011b959b..0756598477911 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+@@ -113,6 +113,19 @@
+ vin-supply = <&vcc_1v8>;
+ };
+
++ vcc3v0_sd: vcc3v0-sd {
++ compatible = "regulator-fixed";
++ enable-active-high;
++ gpio = <&gpio0 RK_PA1 GPIO_ACTIVE_HIGH>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdmmc0_pwr_h>;
++ regulator-always-on;
++ regulator-max-microvolt = <3000000>;
++ regulator-min-microvolt = <3000000>;
++ regulator-name = "vcc3v0_sd";
++ vin-supply = <&vcc3v3_sys>;
++ };
++
+ vcc3v3_sys: vcc3v3-sys {
+ compatible = "regulator-fixed";
+ regulator-name = "vcc3v3_sys";
+@@ -315,7 +328,7 @@
+ regulator-always-on;
+ regulator-boot-on;
+ regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <3000000>;
++ regulator-max-microvolt = <3300000>;
+ regulator-state-mem {
+ regulator-on-in-suspend;
+ regulator-suspend-microvolt = <3000000>;
+@@ -490,6 +503,13 @@
+ };
+ };
+
++ sd {
++ sdmmc0_pwr_h: sdmmc0-pwr-h {
++ rockchip,pins =
++ <RK_GPIO0 RK_PA1 RK_FUNC_GPIO &pcfg_pull_none>;
++ };
++ };
++
+ usb2 {
+ vcc5v0_host_en: vcc5v0-host-en {
+ rockchip,pins =
+@@ -537,6 +557,7 @@
+ };
+
+ &sdmmc {
++ broken-cd;
+ bus-width = <4>;
+ cap-mmc-highspeed;
+ cap-sd-highspeed;
+@@ -545,6 +566,7 @@
+ max-frequency = <150000000>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_cd &sdmmc_bus4>;
++ vmmc-supply = <&vcc3v0_sd>;
+ vqmmc-supply = <&vcc_sdio>;
+ status = "okay";
+ };
+--
+2.20.1
+
--- /dev/null
+From 6e14c4b73e76f5bda684d377921af16c6819fb34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Sep 2018 21:00:46 +0200
+Subject: arm64: dts: rockchip: Fix VCC5V0_HOST_EN on rk3399-sapphire
+
+From: Vicente Bergas <vicencb@gmail.com>
+
+[ Upstream commit bcdb578a5f5b4aea79441606ab7f0a2e076b4474 ]
+
+The pin is GPIO4-D1 not GPIO1-D1, see schematic, page 15 for reference.
+
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+index ce592a4c0c4cd..82576011b959b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi
+@@ -136,7 +136,7 @@
+ vcc5v0_host: vcc5v0-host-regulator {
+ compatible = "regulator-fixed";
+ enable-active-high;
+- gpio = <&gpio1 RK_PD1 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio4 RK_PD1 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&vcc5v0_host_en>;
+ regulator-name = "vcc5v0_host";
+--
+2.20.1
+
--- /dev/null
+From 1dba651e79cbb0d7c34abe3092657257c4eb9971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 21:08:35 +0300
+Subject: arm64: dts: tegra210-p2180: Correct sdmmc4 vqmmc-supply
+
+From: Aapo Vienamo <avienamo@nvidia.com>
+
+[ Upstream commit 6ff7705da8806de45ca1490194f0b4eb07725804 ]
+
+On p2180 sdmmc4 is powered from a fixed 1.8 V regulator.
+
+Signed-off-by: Aapo Vienamo <avienamo@nvidia.com>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index f6e6f1e83ba89..be91873c08782 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -282,6 +282,7 @@
+ status = "okay";
+ bus-width = <8>;
+ non-removable;
++ vqmmc-supply = <&vdd_1v8>;
+ };
+
+ clocks {
+--
+2.20.1
+
--- /dev/null
+From 966756b253dcd37ffc51701f45b6a484f7ba174a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 14:26:47 +0100
+Subject: ASoC: dpcm: Properly initialise hw->rate_max
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit e33ffbd9cd39da09831ce62c11025d830bf78d9e ]
+
+If the CPU DAI does not initialise rate_max, say if using
+using KNOT or CONTINUOUS, then the rate_max field will be
+initialised to 0. A value of zero in the rate_max field of
+the hardware runtime will cause the sound card to support no
+sample rates at all. Obviously this is not desired, just a
+different mechanism is being used to apply the constraints. As
+such update the setting of rate_max in dpcm_init_runtime_hw
+to be consistent with the non-DPCM cases and set rate_max to
+UINT_MAX if nothing is defined on the CPU DAI.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 052b6294a4283..24047375c2fbb 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -1578,7 +1578,7 @@ static void dpcm_init_runtime_hw(struct snd_pcm_runtime *runtime,
+ u64 formats)
+ {
+ runtime->hw.rate_min = stream->rate_min;
+- runtime->hw.rate_max = stream->rate_max;
++ runtime->hw.rate_max = min_not_zero(stream->rate_max, UINT_MAX);
+ runtime->hw.channels_min = stream->channels_min;
+ runtime->hw.channels_max = stream->channels_max;
+ if (runtime->hw.formats)
+--
+2.20.1
+
--- /dev/null
+From 1a711b82561b69a0c0eabe45cf1cab2835fd3175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 12:19:16 -0500
+Subject: ASoC: Intel: hdac_hdmi: Limit sampling rates at dai creation
+
+From: Yong Zhi <yong.zhi@intel.com>
+
+[ Upstream commit 3b857472f34faa7d11001afa5e158833812c98d7 ]
+
+Playback of 44.1Khz contents with HDMI plugged returns
+"Invalid pipe config" because HDMI paths in the FW
+topology are configured to operate at 48Khz.
+
+This patch filters out sampling rates not supported
+at hdac_hdmi_create_dais() to let user space SRC
+to do the converting.
+
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hdmi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
+index e824d47cc22b0..1c3626347e12b 100644
+--- a/sound/soc/codecs/hdac_hdmi.c
++++ b/sound/soc/codecs/hdac_hdmi.c
+@@ -1408,6 +1408,12 @@ static int hdac_hdmi_create_dais(struct hdac_device *hdac,
+ if (ret)
+ return ret;
+
++ /* Filter out 44.1, 88.2 and 176.4Khz */
++ rates &= ~(SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_88200 |
++ SNDRV_PCM_RATE_176400);
++ if (!rates)
++ return -EINVAL;
++
+ sprintf(dai_name, "intel-hdmi-hifi%d", i+1);
+ hdmi_dais[i].name = devm_kstrdup(&hdac->dev,
+ dai_name, GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 0fa33cde608466906c75c838eda56a964aae2a5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 07:07:07 +0000
+Subject: ASoC: rsnd: ssi: Fix issue in dma data address assignment
+
+From: Jiada Wang <jiada_wang@mentor.com>
+
+[ Upstream commit 0e289012b47a2de1f029a6b61c75998e2f159dd9 ]
+
+Same SSI device may be used in different dai links,
+by only having one dma struct in rsnd_ssi, after the first
+instance's dma config be initilized, the following instances
+can no longer configure dma, this causes issue, when their
+dma data address are different from the first instance.
+
+Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
+Signed-off-by: Timo Wischer <twischer@de.adit-jv.com>
+[Kuninori: tidyup for upstream]
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/rsnd.h | 1 +
+ sound/soc/sh/rcar/ssi.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
+index 1768a0ae469d0..c68b31483c7be 100644
+--- a/sound/soc/sh/rcar/rsnd.h
++++ b/sound/soc/sh/rcar/rsnd.h
+@@ -432,6 +432,7 @@ struct rsnd_dai_stream {
+ char name[RSND_DAI_NAME_SIZE];
+ struct snd_pcm_substream *substream;
+ struct rsnd_mod *mod[RSND_MOD_MAX];
++ struct rsnd_mod *dma;
+ struct rsnd_dai *rdai;
+ u32 parent_ssi_status;
+ };
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 60cc550c5a4ca..cae9ed6a0cdb9 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -66,7 +66,6 @@
+
+ struct rsnd_ssi {
+ struct rsnd_mod mod;
+- struct rsnd_mod *dma;
+
+ u32 flags;
+ u32 cr_own;
+@@ -868,7 +867,6 @@ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+ struct rsnd_dai_stream *io,
+ struct rsnd_priv *priv)
+ {
+- struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+ int ret;
+
+ /*
+@@ -883,7 +881,7 @@ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+ return ret;
+
+ /* SSI probe might be called many times in MUX multi path */
+- ret = rsnd_dma_attach(io, mod, &ssi->dma);
++ ret = rsnd_dma_attach(io, mod, &io->dma);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From debe44b3b80af1e86647f26a86624fb51e7622ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 11:41:52 +0100
+Subject: ASoC: sgtl5000: avoid division by zero if lo_vag is zero
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ab708aef61f5620113269a9d1bdb1543d1207d0 ]
+
+In the case where lo_vag <= SGTL5000_LINE_OUT_GND_BASE, lo_vag
+is set to zero and later vol_quot is computed by dividing by
+lo_vag causing a division by zero error. Fix this by avoiding
+a zero division and set vol_quot to zero in this specific case
+so that the lowest setting for i is correctly set.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sgtl5000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 10764c1e854e2..ca8a70ab22a82 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1314,7 +1314,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ * Searching for a suitable index solving this formula:
+ * idx = 40 * log10(vag_val / lo_cagcntrl) + 15
+ */
+- vol_quot = (vag * 100) / lo_vag;
++ vol_quot = lo_vag ? (vag * 100) / lo_vag : 0;
+ lo_vol = 0;
+ for (i = 0; i < ARRAY_SIZE(vol_quot_table); i++) {
+ if (vol_quot >= vol_quot_table[i])
+--
+2.20.1
+
--- /dev/null
+From 8a8d32207ee0a24fa8e94730d2daad74ec0b8a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 12:39:01 +0300
+Subject: ath10k: fix kernel panic by moving pci flush after napi_disable
+
+From: Tamizh chelvam <tamizhr@codeaurora.org>
+
+[ Upstream commit bd1d395070cca4f42a93e520b0597274789274a4 ]
+
+When continuously running wifi up/down sequence, the napi poll
+can be scheduled after the CE buffers being freed by ath10k_pci_flush
+
+Steps:
+ In a certain condition, during wifi down below scenario might occur.
+
+ath10k_stop->ath10k_hif_stop->napi_schedule->ath10k_pci_flush->napi_poll(napi_synchronize).
+
+In the above scenario, CE buffer entries will be freed up and become NULL in
+ath10k_pci_flush. And the napi_poll has been invoked after the flush process
+and it will try to get the skb from the CE buffer entry and perform some action on that.
+Since the CE buffer already cleaned by pci flush this action will create NULL
+pointer dereference and trigger below kernel panic.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000005c
+PC is at ath10k_pci_htt_rx_cb+0x64/0x3ec [ath10k_pci]
+ath10k_pci_htt_rx_cb [ath10k_pci]
+ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci]
+ath10k_ce_per_engine_service [ath10k_pci]
+ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci]
+ath10k_ce_per_engine_service_any [ath10k_pci]
+ath10k_pci_napi_poll+0x48/0xec [ath10k_pci]
+ath10k_pci_napi_poll [ath10k_pci]
+net_rx_action+0xac/0x160
+net_rx_action
+__do_softirq+0xdc/0x208
+__do_softirq
+irq_exit+0x84/0xe0
+irq_exit
+__handle_domain_irq+0x80/0xa0
+__handle_domain_irq
+gic_handle_irq+0x38/0x5c
+gic_handle_irq
+__irq_usr+0x44/0x60
+
+Tested on QCA4019 and firmware version 10.4.3.2.1.1-00010
+
+Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/ahb.c | 4 ++--
+ drivers/net/wireless/ath/ath10k/pci.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/ahb.c b/drivers/net/wireless/ath/ath10k/ahb.c
+index ff6815e956848..1404ec9f56be9 100644
+--- a/drivers/net/wireless/ath/ath10k/ahb.c
++++ b/drivers/net/wireless/ath/ath10k/ahb.c
+@@ -663,10 +663,10 @@ static void ath10k_ahb_hif_stop(struct ath10k *ar)
+ ath10k_ahb_irq_disable(ar);
+ synchronize_irq(ar_ahb->irq);
+
+- ath10k_pci_flush(ar);
+-
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++
++ ath10k_pci_flush(ar);
+ }
+
+ static int ath10k_ahb_hif_power_up(struct ath10k *ar)
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index d790ea20b95d9..27ab3eb47534f 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1787,9 +1787,9 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+
+ ath10k_pci_irq_disable(ar);
+ ath10k_pci_irq_sync(ar);
+- ath10k_pci_flush(ar);
+ napi_synchronize(&ar->napi);
+ napi_disable(&ar->napi);
++ ath10k_pci_flush(ar);
+
+ spin_lock_irqsave(&ar_pci->ps_lock, flags);
+ WARN_ON(ar_pci->ps_wake_refcount > 0);
+--
+2.20.1
+
--- /dev/null
+From 6fd28137117f7c73cca574b804989984b55a1e9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Aug 2018 15:04:59 +0300
+Subject: ath10k: limit available channels via DT ieee80211-freq-limit
+
+From: Sven Eckelmann <sven.eckelmann@openmesh.com>
+
+[ Upstream commit 34d5629d2ca89d847b7040762b87964c696c14da ]
+
+Tri-band devices (1x 2.4GHz + 2x 5GHz) often incorporate special filters in
+the RX and TX path. These filtered channel can in theory still be used by
+the hardware but the signal strength is reduced so much that it makes no
+sense.
+
+There is already a DT property to limit the available channels but ath10k
+has to manually call this functionality to limit the currrently set wiphy
+channels further.
+
+Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 58a3c42c4aedb..8c4bb56c262f6 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -17,6 +17,7 @@
+
+ #include "mac.h"
+
++#include <net/cfg80211.h>
+ #include <net/mac80211.h>
+ #include <linux/etherdevice.h>
+ #include <linux/acpi.h>
+@@ -8174,6 +8175,7 @@ int ath10k_mac_register(struct ath10k *ar)
+ ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
+ }
+
++ wiphy_read_of_freq_limits(ar->hw->wiphy);
+ ath10k_mac_setup_ht_vht_cap(ar);
+
+ ar->hw->wiphy->interface_modes =
+--
+2.20.1
+
--- /dev/null
+From 68de44aa39adf0f0bc3ea92472d4946ce4596592 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 15:07:07 +0300
+Subject: ath10k: wmi: disable softirq's while calling ieee80211_rx
+
+From: Erik Stromdahl <erik.stromdahl@gmail.com>
+
+[ Upstream commit 37f62c0d5822f631b786b29a1b1069ab714d1a28 ]
+
+This is done in order not to trig the below warning in
+ieee80211_rx_napi:
+
+WARN_ON_ONCE(softirq_count() == 0);
+
+ieee80211_rx_napi requires that softirq's are disabled during
+execution.
+
+The High latency bus drivers (SDIO and USB) sometimes call the wmi
+ep_rx_complete callback from non softirq context, resulting in a trigger
+of the above warning.
+
+Calling ieee80211_rx_ni with softirq's already disabled (e.g., from
+softirq context) should be safe as the local_bh_disable and
+local_bh_enable functions (called from ieee80211_rx_ni) are fully
+reentrant.
+
+Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index ab8eb9cdfda0f..4d6c2986c40dd 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -2414,7 +2414,8 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+ status->freq, status->band, status->signal,
+ status->rate_idx);
+
+- ieee80211_rx(ar->hw, skb);
++ ieee80211_rx_ni(ar->hw, skb);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 283afa7cfeb88a40e7e924bda68a5296287f4b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 18:49:05 +0200
+Subject: ath9k: add back support for using active monitor interfaces for tx99
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 6df0580be8bc30803c4d8b2ed9c2230a2740c795 ]
+
+Various documented examples on how to set up tx99 with ath9k rely
+on setting up a regular monitor interface for setting the channel.
+My previous patch "ath9k: fix tx99 with monitor mode interface" made
+it possible to set it up this way again. However, it was removing support
+for using an active monitor interface, which is required for controlling
+the bitrate as well, since the bitrate is not passed down with a regular
+monitor interface.
+
+This patch partially reverts the previous one, but keeps support for using
+a regular monitor interface to keep documented steps working in cases
+where the bitrate does not matter
+
+Fixes: d9c52fd17cb48 ("ath9k: fix tx99 with monitor mode interface")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 10 ++++++++--
+ drivers/net/wireless/ath/ath9k/tx99.c | 7 +++++++
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 4 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index db2b119199d7b..f9339b5c3624b 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,6 +1074,7 @@ struct ath_softc {
+
+ struct ath_spec_scan_priv spec_priv;
+
++ struct ieee80211_vif *tx99_vif;
+ struct sk_buff *tx99_skb;
+ bool tx99_state;
+ s16 tx99_power;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 055f869516804..3589f1f3e744d 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1250,8 +1250,13 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
+- if (IS_ENABLED(CONFIG_ATH9K_TX99))
+- return -EOPNOTSUPP;
++ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
++ if (sc->cur_chan->nvifs >= 1) {
++ mutex_unlock(&sc->mutex);
++ return -EOPNOTSUPP;
++ }
++ sc->tx99_vif = vif;
++ }
+
+ mutex_lock(&sc->mutex);
+
+@@ -1336,6 +1341,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ ath9k_p2p_remove_vif(sc, vif);
+
+ sc->cur_chan->nvifs--;
++ sc->tx99_vif = NULL;
+ if (!ath9k_is_chanctx_enabled())
+ list_del(&avp->list);
+
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index 311547f532bc3..87d09d1e74aa0 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,6 +54,7 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_tx_info *tx_info;
+ struct sk_buff *skb;
++ struct ath_vif *avp;
+
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+@@ -71,11 +72,17 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
++ if (sc->tx99_vif) {
++ avp = (struct ath_vif *) sc->tx99_vif->drv_priv;
++ hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
++ }
++
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+ rate = &tx_info->control.rates[0];
+ tx_info->band = sc->cur_chan->chandef.chan->band;
+ tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
++ tx_info->control.vif = sc->tx99_vif;
+ rate->count = 1;
+ if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index a743e3535d0a8..458c4f53ba5d1 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2952,7 +2952,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- ath_set_rates(NULL, NULL, bf);
++ ath_set_rates(sc->tx99_vif, NULL, bf);
+
+ ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
+--
+2.20.1
+
--- /dev/null
+From ab9350671d158d427e5cffae67e4cea30f92c0cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 23:08:43 +0300
+Subject: ath9k: Fix a locking bug in ath9k_add_interface()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 461cf036057477805a8a391e5fd0f5264a5e56a8 ]
+
+We tried to revert commit d9c52fd17cb4 ("ath9k: fix tx99 with monitor
+mode interface") but accidentally missed part of the locking change.
+
+The lock has to be held earlier so that we're holding it when we do
+"sc->tx99_vif = vif;" and also there in the current code there is a
+stray unlock before we have taken the lock.
+
+Fixes: 6df0580be8bc ("ath9k: add back support for using active monitor interfaces for tx99")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 3589f1f3e744d..72ad84fde5c18 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1250,6 +1250,7 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
++ mutex_lock(&sc->mutex);
+ if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+ if (sc->cur_chan->nvifs >= 1) {
+ mutex_unlock(&sc->mutex);
+@@ -1258,8 +1259,6 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ sc->tx99_vif = vif;
+ }
+
+- mutex_lock(&sc->mutex);
+-
+ ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ sc->cur_chan->nvifs++;
+
+--
+2.20.1
+
--- /dev/null
+From 579fc0999dd2f45ae093fc0fe0257a140d23bc1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 11:37:51 +0200
+Subject: ath9k: fix tx99 with monitor mode interface
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit d9c52fd17cb483bd8a470398afcb79f86c1b77c8 ]
+
+Tx99 is typically configured via a monitor mode interface, which does
+not get added to the driver as a vif. Since the code currently expects
+a configured virtual interface for tx99, enabling tx99 via debugfs fails.
+Since the vif is not needed anyway, remove all checks for it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+[kvalo@codeaurora.org: s/CPTCFG/CONFIG/]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 1 -
+ drivers/net/wireless/ath/ath9k/main.c | 12 +++---------
+ drivers/net/wireless/ath/ath9k/tx99.c | 9 ---------
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 4 files changed, 4 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
+index f9339b5c3624b..db2b119199d7b 100644
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -1074,7 +1074,6 @@ struct ath_softc {
+
+ struct ath_spec_scan_priv spec_priv;
+
+- struct ieee80211_vif *tx99_vif;
+ struct sk_buff *tx99_skb;
+ bool tx99_state;
+ s16 tx99_power;
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 8b4ac7f0a09b7..055f869516804 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1250,15 +1250,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
+ struct ath_vif *avp = (void *)vif->drv_priv;
+ struct ath_node *an = &avp->mcast_node;
+
+- mutex_lock(&sc->mutex);
++ if (IS_ENABLED(CONFIG_ATH9K_TX99))
++ return -EOPNOTSUPP;
+
+- if (IS_ENABLED(CONFIG_ATH9K_TX99)) {
+- if (sc->cur_chan->nvifs >= 1) {
+- mutex_unlock(&sc->mutex);
+- return -EOPNOTSUPP;
+- }
+- sc->tx99_vif = vif;
+- }
++ mutex_lock(&sc->mutex);
+
+ ath_dbg(common, CONFIG, "Attach a VIF of type: %d\n", vif->type);
+ sc->cur_chan->nvifs++;
+@@ -1341,7 +1336,6 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
+ ath9k_p2p_remove_vif(sc, vif);
+
+ sc->cur_chan->nvifs--;
+- sc->tx99_vif = NULL;
+ if (!ath9k_is_chanctx_enabled())
+ list_del(&avp->list);
+
+diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
+index fe3a8263b2241..311547f532bc3 100644
+--- a/drivers/net/wireless/ath/ath9k/tx99.c
++++ b/drivers/net/wireless/ath/ath9k/tx99.c
+@@ -54,12 +54,6 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_tx_info *tx_info;
+ struct sk_buff *skb;
+- struct ath_vif *avp;
+-
+- if (!sc->tx99_vif)
+- return NULL;
+-
+- avp = (struct ath_vif *)sc->tx99_vif->drv_priv;
+
+ skb = alloc_skb(len, GFP_KERNEL);
+ if (!skb)
+@@ -77,14 +71,11 @@ static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+ memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+ memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+- hdr->seq_ctrl |= cpu_to_le16(avp->seq_no);
+-
+ tx_info = IEEE80211_SKB_CB(skb);
+ memset(tx_info, 0, sizeof(*tx_info));
+ rate = &tx_info->control.rates[0];
+ tx_info->band = sc->cur_chan->chandef.chan->band;
+ tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
+- tx_info->control.vif = sc->tx99_vif;
+ rate->count = 1;
+ if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+ rate->flags |= IEEE80211_TX_RC_MCS;
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 458c4f53ba5d1..a743e3535d0a8 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2952,7 +2952,7 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+ return -EINVAL;
+ }
+
+- ath_set_rates(sc->tx99_vif, NULL, bf);
++ ath_set_rates(NULL, NULL, bf);
+
+ ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, bf->bf_daddr);
+ ath9k_hw_tx99_start(sc->sc_ah, txctl->txq->axq_qnum);
+--
+2.20.1
+
--- /dev/null
+From 3762d9fc9582b2de0ea11623fb1c1ed9a8924b24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 16:23:09 +0200
+Subject: blok, bfq: do not plug I/O if all queues are weight-raised
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit c8765de0adfcaaf4ffb2d951e07444f00ffa9453 ]
+
+To reduce latency for interactive and soft real-time applications, bfq
+privileges the bfq_queues containing the I/O of these
+applications. These privileged queues, referred-to as weight-raised
+queues, get a much higher share of the device throughput
+w.r.t. non-privileged queues. To preserve this higher share, the I/O
+of any non-weight-raised queue must be plugged whenever a sync
+weight-raised queue, while being served, remains temporarily empty. To
+attain this goal, bfq simply plugs any I/O (from any queue), if a sync
+weight-raised queue remains empty while in service.
+
+Unfortunately, this plugging typically lowers throughput with random
+I/O, on devices with internal queueing (because it reduces the filling
+level of the internal queues of the device).
+
+This commit addresses this issue by restricting the cases where
+plugging is performed: if a sync weight-raised queue remains empty
+while in service, then I/O plugging is performed only if some of the
+active bfq_queues are *not* weight-raised (which is actually the only
+circumstance where plugging is needed to preserve the higher share of
+the throughput of weight-raised queues). This restriction proved able
+to boost throughput in really many use cases needing only maximum
+throughput.
+
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index e65b0da1007b4..93863c6173e66 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3314,7 +3314,12 @@ static bool bfq_bfqq_may_idle(struct bfq_queue *bfqq)
+ * whether bfqq is being weight-raised, because
+ * bfq_symmetric_scenario() does not take into account also
+ * weight-raised queues (see comments on
+- * bfq_weights_tree_add()).
++ * bfq_weights_tree_add()). In particular, if bfqq is being
++ * weight-raised, it is important to idle only if there are
++ * other, non-weight-raised queues that may steal throughput
++ * to bfqq. Actually, we should be even more precise, and
++ * differentiate between interactive weight raising and
++ * soft real-time weight raising.
+ *
+ * As a side note, it is worth considering that the above
+ * device-idling countermeasures may however fail in the
+@@ -3326,7 +3331,8 @@ static bool bfq_bfqq_may_idle(struct bfq_queue *bfqq)
+ * to let requests be served in the desired order until all
+ * the requests already queued in the device have been served.
+ */
+- asymmetric_scenario = bfqq->wr_coeff > 1 ||
++ asymmetric_scenario = (bfqq->wr_coeff > 1 &&
++ bfqd->wr_busy_queues < bfqd->busy_queues) ||
+ !bfq_symmetric_scenario(bfqd);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 6ea11b6c46c673616750ea19023919d47de8f6b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Aug 2018 17:34:11 +0530
+Subject: Bluetooth: hci_serdev: clear HCI_UART_PROTO_READY to avoid closing
+ proto races
+
+From: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+
+[ Upstream commit 7cf7846d27bfc9731e449857db3eec5e0e9701ba ]
+
+Clearing HCI_UART_PROTO_READY will avoid usage of proto function pointers
+before running the proto close function pointer. There is chance of kernel
+crash, due to usage of non proto close function pointers after proto close.
+
+Signed-off-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_serdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 52e6d4d1608e3..69c00a3db5382 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -360,6 +360,7 @@ void hci_uart_unregister_device(struct hci_uart *hu)
+ {
+ struct hci_dev *hdev = hu->hdev;
+
++ clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+ hci_unregister_dev(hdev);
+ hci_free_dev(hdev);
+
+--
+2.20.1
+
--- /dev/null
+From 13bbd21a48eaf775474dd0027192aac82a4435ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 13:39:22 +0300
+Subject: Bluetooth: L2CAP: Detect if remote is not able to use the whole MPS
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a5c3021bb62b970713550db3f7fd08aa70665d7e ]
+
+If the remote is not able to fully utilize the MPS choosen recalculate
+the credits based on the actual amount it is sending that way it can
+still send packets of MTU size without credits dropping to 0.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/l2cap_core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 0c2219f483d70..f63d9918b15ad 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -6819,6 +6819,16 @@ static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
+ chan->sdu_len = sdu_len;
+ chan->sdu_last_frag = skb;
+
++ /* Detect if remote is not able to use the selected MPS */
++ if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
++ u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
++
++ /* Adjust the number of credits */
++ BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
++ chan->mps = mps_len;
++ l2cap_chan_le_send_credits(chan);
++ }
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4a34ed52d6b3d5eeec75df43dee8f198523b9fb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 11:22:51 -0700
+Subject: bnx2x: Ignore bandwidth attention in single function mode
+
+From: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+
+[ Upstream commit 75a110a1783ef8324ffd763b24f4ac268253cbca ]
+
+This is a workaround for FW bug -
+MFW generates bandwidth attention in single function mode, which
+is only expected to be generated in multi function mode.
+This undesired attention in SF mode results in incorrect HW
+configuration and resulting into Tx timeout.
+
+Signed-off-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 8f0c9f6de893d..dbe8feec456c2 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -3540,6 +3540,16 @@ static void bnx2x_drv_info_iscsi_stat(struct bnx2x *bp)
+ */
+ static void bnx2x_config_mf_bw(struct bnx2x *bp)
+ {
++ /* Workaround for MFW bug.
++ * MFW is not supposed to generate BW attention in
++ * single function mode.
++ */
++ if (!IS_MF(bp)) {
++ DP(BNX2X_MSG_MCP,
++ "Ignoring MF BW config in single function mode\n");
++ return;
++ }
++
+ if (bp->link_vars.link_up) {
+ bnx2x_cmng_fns_init(bp, true, CMNG_FNS_MINMAX);
+ bnx2x_link_sync_notify(bp);
+--
+2.20.1
+
--- /dev/null
+From 70018d2812b807462c85d10069f4fa9e0a80e074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jul 2018 18:46:13 +0530
+Subject: cfg80211: Avoid regulatory restore when COUNTRY_IE_IGNORE is set
+
+From: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
+
+[ Upstream commit 7417844b63d4b0dc8ab23f88259bf95de7d09b57 ]
+
+When REGULATORY_COUNTRY_IE_IGNORE is set, __reg_process_hint_country_ie()
+ignores the country code change request from __cfg80211_connect_result()
+via regulatory_hint_country_ie().
+
+After Disconnect, similar to above, country code should not be reset to
+world when country IE ignore is set. But this is violated and restore of
+regulatory settings is invoked by cfg80211_disconnect_work via
+regulatory_hint_disconnect().
+
+To address this, avoid regulatory restore from regulatory_hint_disconnect()
+when COUNTRY_IE_IGNORE is set.
+
+Note: Currently, restore_regulatory_settings() takes care of clearing
+beacon hints. But in the proposed change, regulatory restore is avoided.
+Therefore, explicitly clear beacon hints when DISABLE_BEACON_HINTS
+is not set.
+
+Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index b940d5c2003b0..804eac073b6b9 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2703,8 +2703,54 @@ static void restore_regulatory_settings(bool reset_user)
+ schedule_work(®_work);
+ }
+
++static bool is_wiphy_all_set_reg_flag(enum ieee80211_regulatory_flags flag)
++{
++ struct cfg80211_registered_device *rdev;
++ struct wireless_dev *wdev;
++
++ list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ wdev_lock(wdev);
++ if (!(wdev->wiphy->regulatory_flags & flag)) {
++ wdev_unlock(wdev);
++ return false;
++ }
++ wdev_unlock(wdev);
++ }
++ }
++
++ return true;
++}
++
+ void regulatory_hint_disconnect(void)
+ {
++ /* Restore of regulatory settings is not required when wiphy(s)
++ * ignore IE from connected access point but clearance of beacon hints
++ * is required when wiphy(s) supports beacon hints.
++ */
++ if (is_wiphy_all_set_reg_flag(REGULATORY_COUNTRY_IE_IGNORE)) {
++ struct reg_beacon *reg_beacon, *btmp;
++
++ if (is_wiphy_all_set_reg_flag(REGULATORY_DISABLE_BEACON_HINTS))
++ return;
++
++ spin_lock_bh(®_pending_beacons_lock);
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_pending_beacons, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++ spin_unlock_bh(®_pending_beacons_lock);
++
++ list_for_each_entry_safe(reg_beacon, btmp,
++ ®_beacon_list, list) {
++ list_del(®_beacon->list);
++ kfree(reg_beacon);
++ }
++
++ return;
++ }
++
+ pr_debug("All devices are disconnected, going to restore regulatory settings\n");
+ restore_regulatory_settings(false);
+ }
+--
+2.20.1
+
--- /dev/null
+From 7d1a8d54c05074a72cea6e7899c812c11b0067e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 21:15:39 -0700
+Subject: component: fix loop condition to call unbind() if bind() fails
+
+From: Banajit Goswami <bgoswami@codeaurora.org>
+
+[ Upstream commit bdae566d5d9733b6e32b378668b84eadf28a94d4 ]
+
+During component_bind_all(), if bind() fails for any
+particular component associated with a master, unbind()
+should be called for all previous components in that
+master's match array, whose bind() might have completed
+successfully. As per the current logic, if bind() fails
+for the component at position 'n' in the master's match
+array, it would start calling unbind() from component in
+'n'th position itself and work backwards, and will always
+skip calling unbind() for component in 0th position in the
+master's match array.
+Fix this by updating the loop condition, and the logic to
+refer to the components in master's match array, so that
+unbind() is called for all components starting from 'n-1'st
+position in the array, until (and including) component in
+0th position.
+
+Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/component.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/component.c b/drivers/base/component.c
+index 89b032f2ffd22..08da6160e94dd 100644
+--- a/drivers/base/component.c
++++ b/drivers/base/component.c
+@@ -461,9 +461,9 @@ int component_bind_all(struct device *master_dev, void *data)
+ }
+
+ if (ret != 0) {
+- for (; i--; )
+- if (!master->match->compare[i].duplicate) {
+- c = master->match->compare[i].component;
++ for (; i > 0; i--)
++ if (!master->match->compare[i - 1].duplicate) {
++ c = master->match->compare[i - 1].component;
+ component_unbind(c, master, data);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From a76252585995c87505b42152efdab2e651a84ee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:00 -0600
+Subject: coresight: etm4x: Configure EL2 exception level when kernel is
+ running in HYP
+
+From: Tomasz Nowicki <tnowicki@caviumnetworks.com>
+
+[ Upstream commit b860801e3237ec4c74cf8de0be4816996757ae5c ]
+
+For non-VHE systems host kernel runs at EL1 and jumps to EL2 whenever
+hypervisor code should be executed. In this case ETM4x driver must
+restrict configuration to EL1 when it setups kernel tracing.
+However, there is no separate hypervisor privilege level when VHE
+is enabled, the host kernel runs at EL2.
+
+This patch fixes configuration of TRCACATRn register for VHE systems
+so that ETM_EXLEVEL_NS_HYP bit is used instead of ETM_EXLEVEL_NS_OS
+to on/off kernel tracing. At the same time, it moves common code
+to new helper.
+
+Signed-off-by: Tomasz Nowicki <tnowicki@caviumnetworks.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.c | 40 +++++++++----------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
+index b0141ba7b7414..fb392688281b5 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x.c
+@@ -35,6 +35,7 @@
+ #include <linux/pm_runtime.h>
+ #include <asm/sections.h>
+ #include <asm/local.h>
++#include <asm/virt.h>
+
+ #include "coresight-etm4x.h"
+ #include "coresight-etm-perf.h"
+@@ -623,7 +624,7 @@ static void etm4_set_default_config(struct etmv4_config *config)
+ config->vinst_ctrl |= BIT(0);
+ }
+
+-static u64 etm4_get_access_type(struct etmv4_config *config)
++static u64 etm4_get_ns_access_type(struct etmv4_config *config)
+ {
+ u64 access_type = 0;
+
+@@ -634,17 +635,26 @@ static u64 etm4_get_access_type(struct etmv4_config *config)
+ * Bit[13] Exception level 1 - OS
+ * Bit[14] Exception level 2 - Hypervisor
+ * Bit[15] Never implemented
+- *
+- * Always stay away from hypervisor mode.
+ */
+- access_type = ETM_EXLEVEL_NS_HYP;
+-
+- if (config->mode & ETM_MODE_EXCL_KERN)
+- access_type |= ETM_EXLEVEL_NS_OS;
++ if (!is_kernel_in_hyp_mode()) {
++ /* Stay away from hypervisor mode for non-VHE */
++ access_type = ETM_EXLEVEL_NS_HYP;
++ if (config->mode & ETM_MODE_EXCL_KERN)
++ access_type |= ETM_EXLEVEL_NS_OS;
++ } else if (config->mode & ETM_MODE_EXCL_KERN) {
++ access_type = ETM_EXLEVEL_NS_HYP;
++ }
+
+ if (config->mode & ETM_MODE_EXCL_USER)
+ access_type |= ETM_EXLEVEL_NS_APP;
+
++ return access_type;
++}
++
++static u64 etm4_get_access_type(struct etmv4_config *config)
++{
++ u64 access_type = etm4_get_ns_access_type(config);
++
+ /*
+ * EXLEVEL_S, bits[11:8], don't trace anything happening
+ * in secure state.
+@@ -898,20 +908,10 @@ void etm4_config_trace_mode(struct etmv4_config *config)
+
+ addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP];
+ /* clear default config */
+- addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS);
++ addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS |
++ ETM_EXLEVEL_NS_HYP);
+
+- /*
+- * EXLEVEL_NS, bits[15:12]
+- * The Exception levels are:
+- * Bit[12] Exception level 0 - Application
+- * Bit[13] Exception level 1 - OS
+- * Bit[14] Exception level 2 - Hypervisor
+- * Bit[15] Never implemented
+- */
+- if (mode & ETM_MODE_EXCL_KERN)
+- addr_acc |= ETM_EXLEVEL_NS_OS;
+- else
+- addr_acc |= ETM_EXLEVEL_NS_APP;
++ addr_acc |= etm4_get_ns_access_type(config);
+
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc;
+ config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc;
+--
+2.20.1
+
--- /dev/null
+From 83303078bb7476925c0bcabae2dca10c5791ea60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:45 -0600
+Subject: coresight: Fix handling of sinks
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit c71369de02b285d9da526a526d8f2affc7b17c59 ]
+
+The coresight components could be operated either in sysfs mode or in perf
+mode. For some of the components, the mode of operation doesn't matter as
+they simply relay the data to the next component in the trace path. But for
+sinks, they need to be able to provide the trace data back to the user.
+Thus we need to make sure that "mode" is handled appropriately. e.g,
+the sysfs mode could have multiple sources driving the trace data, while
+perf mode doesn't allow sharing the sink.
+
+The coresight_enable_sink() however doesn't really allow this check to
+trigger as it skips the "enable_sink" callback if the component is
+already enabled, irrespective of the mode. This could cause mixing
+of data from different modes or even same mode (in perf), if the
+sources are different. Also, if we fail to enable the sink while
+enabling a path (where sink is the first component enabled),
+we could end up in disabling the components in the "entire"
+path which were not enabled in this trial, causing disruptions
+in the existing trace paths.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index e571e4010dff0..366c1d493af35 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -140,12 +140,14 @@ static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+ {
+ int ret;
+
+- if (!csdev->enable) {
+- if (sink_ops(csdev)->enable) {
+- ret = sink_ops(csdev)->enable(csdev, mode);
+- if (ret)
+- return ret;
+- }
++ /*
++ * We need to make sure the "new" session is compatible with the
++ * existing "mode" of operation.
++ */
++ if (sink_ops(csdev)->enable) {
++ ret = sink_ops(csdev)->enable(csdev, mode);
++ if (ret)
++ return ret;
+ csdev->enable = true;
+ }
+
+@@ -347,8 +349,14 @@ int coresight_enable_path(struct list_head *path, u32 mode)
+ switch (type) {
+ case CORESIGHT_DEV_TYPE_SINK:
+ ret = coresight_enable_sink(csdev, mode);
++ /*
++ * Sink is the first component turned on. If we
++ * failed to enable the sink, there are no components
++ * that need disabling. Disabling the path here
++ * would mean we could disrupt an existing session.
++ */
+ if (ret)
+- goto err;
++ goto out;
+ break;
+ case CORESIGHT_DEV_TYPE_SOURCE:
+ /* sources are enabled from either sysFS or Perf */
+--
+2.20.1
+
--- /dev/null
+From 2c40d91a76412642825cd01a2ed3731e44fc7b2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:50 -0600
+Subject: coresight: perf: Disable trace path upon source error
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 4f8ef21007531c3d7cb5b826e7b2c8999b65ecae ]
+
+We enable the trace path, before activating the source.
+If we fail to enable the source, we must disable the path
+to make sure it is available for another session.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm-perf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index 99cbf5d5d1c1f..69349b93e8741 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -317,11 +317,13 @@ static void etm_event_start(struct perf_event *event, int flags)
+
+ /* Finally enable the tracer */
+ if (source_ops(csdev)->enable(csdev, event, CS_MODE_PERF))
+- goto fail_end_stop;
++ goto fail_disable_path;
+
+ out:
+ return;
+
++fail_disable_path:
++ coresight_disable_path(path);
+ fail_end_stop:
+ perf_aux_output_flag(handle, PERF_AUX_FLAG_TRUNCATED);
+ perf_aux_output_end(handle, 0);
+--
+2.20.1
+
--- /dev/null
+From 48e2ca41d0d18280da5a0c05913cf7a2fce8d1c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:17:47 -0600
+Subject: coresight: perf: Fix per cpu path management
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 5ecabe4a76e8cdb61fa3e24862d9ca240a1c4ddf ]
+
+We create a coresight trace path for each online CPU when
+we start the event. We rely on the number of online CPUs
+and then go on to allocate an array matching the "number of
+online CPUs" for holding the path and then uses normal
+CPU id as the index to the array. This is problematic as
+we could have some offline CPUs causing us to access beyond
+the actual array size (e.g, on a dual SMP system, if CPU0 is
+offline, CPU1 could be really accessing beyond the array).
+The solution is to switch to per-cpu array for holding the path.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hwtracing/coresight/coresight-etm-perf.c | 55 ++++++++++++++-----
+ 1 file changed, 40 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
+index 8a0ad77574e73..99cbf5d5d1c1f 100644
+--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
+@@ -23,6 +23,7 @@
+ #include <linux/mm.h>
+ #include <linux/init.h>
+ #include <linux/perf_event.h>
++#include <linux/percpu-defs.h>
+ #include <linux/slab.h>
+ #include <linux/types.h>
+ #include <linux/workqueue.h>
+@@ -44,7 +45,7 @@ struct etm_event_data {
+ struct work_struct work;
+ cpumask_t mask;
+ void *snk_config;
+- struct list_head **path;
++ struct list_head * __percpu *path;
+ };
+
+ static DEFINE_PER_CPU(struct perf_output_handle, ctx_handle);
+@@ -72,6 +73,18 @@ static const struct attribute_group *etm_pmu_attr_groups[] = {
+ NULL,
+ };
+
++static inline struct list_head **
++etm_event_cpu_path_ptr(struct etm_event_data *data, int cpu)
++{
++ return per_cpu_ptr(data->path, cpu);
++}
++
++static inline struct list_head *
++etm_event_cpu_path(struct etm_event_data *data, int cpu)
++{
++ return *etm_event_cpu_path_ptr(data, cpu);
++}
++
+ static void etm_event_read(struct perf_event *event) {}
+
+ static int etm_addr_filters_alloc(struct perf_event *event)
+@@ -131,23 +144,26 @@ static void free_event_data(struct work_struct *work)
+ */
+ if (event_data->snk_config) {
+ cpu = cpumask_first(mask);
+- sink = coresight_get_sink(event_data->path[cpu]);
++ sink = coresight_get_sink(etm_event_cpu_path(event_data, cpu));
+ if (sink_ops(sink)->free_buffer)
+ sink_ops(sink)->free_buffer(event_data->snk_config);
+ }
+
+ for_each_cpu(cpu, mask) {
+- if (!(IS_ERR_OR_NULL(event_data->path[cpu])))
+- coresight_release_path(event_data->path[cpu]);
++ struct list_head **ppath;
++
++ ppath = etm_event_cpu_path_ptr(event_data, cpu);
++ if (!(IS_ERR_OR_NULL(*ppath)))
++ coresight_release_path(*ppath);
++ *ppath = NULL;
+ }
+
+- kfree(event_data->path);
++ free_percpu(event_data->path);
+ kfree(event_data);
+ }
+
+ static void *alloc_event_data(int cpu)
+ {
+- int size;
+ cpumask_t *mask;
+ struct etm_event_data *event_data;
+
+@@ -158,7 +174,6 @@ static void *alloc_event_data(int cpu)
+
+ /* Make sure nothing disappears under us */
+ get_online_cpus();
+- size = num_online_cpus();
+
+ mask = &event_data->mask;
+ if (cpu != -1)
+@@ -175,8 +190,8 @@ static void *alloc_event_data(int cpu)
+ * unused memory when dealing with single CPU trace scenarios is small
+ * compared to the cost of searching through an optimized array.
+ */
+- event_data->path = kcalloc(size,
+- sizeof(struct list_head *), GFP_KERNEL);
++ event_data->path = alloc_percpu(struct list_head *);
++
+ if (!event_data->path) {
+ kfree(event_data);
+ return NULL;
+@@ -224,6 +239,7 @@ static void *etm_setup_aux(int event_cpu, void **pages,
+
+ /* Setup the path for each CPU in a trace session */
+ for_each_cpu(cpu, mask) {
++ struct list_head *path;
+ struct coresight_device *csdev;
+
+ csdev = per_cpu(csdev_src, cpu);
+@@ -235,9 +251,11 @@ static void *etm_setup_aux(int event_cpu, void **pages,
+ * list of devices from source to sink that can be
+ * referenced later when the path is actually needed.
+ */
+- event_data->path[cpu] = coresight_build_path(csdev, sink);
+- if (IS_ERR(event_data->path[cpu]))
++ path = coresight_build_path(csdev, sink);
++ if (IS_ERR(path))
+ goto err;
++
++ *etm_event_cpu_path_ptr(event_data, cpu) = path;
+ }
+
+ if (!sink_ops(sink)->alloc_buffer)
+@@ -266,6 +284,7 @@ static void etm_event_start(struct perf_event *event, int flags)
+ struct etm_event_data *event_data;
+ struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+ struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
++ struct list_head *path;
+
+ if (!csdev)
+ goto fail;
+@@ -278,8 +297,9 @@ static void etm_event_start(struct perf_event *event, int flags)
+ if (!event_data)
+ goto fail;
+
++ path = etm_event_cpu_path(event_data, cpu);
+ /* We need a sink, no need to continue without one */
+- sink = coresight_get_sink(event_data->path[cpu]);
++ sink = coresight_get_sink(path);
+ if (WARN_ON_ONCE(!sink || !sink_ops(sink)->set_buffer))
+ goto fail_end_stop;
+
+@@ -289,7 +309,7 @@ static void etm_event_start(struct perf_event *event, int flags)
+ goto fail_end_stop;
+
+ /* Nothing will happen without a path */
+- if (coresight_enable_path(event_data->path[cpu], CS_MODE_PERF))
++ if (coresight_enable_path(path, CS_MODE_PERF))
+ goto fail_end_stop;
+
+ /* Tell the perf core the event is alive */
+@@ -317,6 +337,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
+ struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+ struct etm_event_data *event_data = perf_get_aux(handle);
++ struct list_head *path;
+
+ if (event->hw.state == PERF_HES_STOPPED)
+ return;
+@@ -324,7 +345,11 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ if (!csdev)
+ return;
+
+- sink = coresight_get_sink(event_data->path[cpu]);
++ path = etm_event_cpu_path(event_data, cpu);
++ if (!path)
++ return;
++
++ sink = coresight_get_sink(path);
+ if (!sink)
+ return;
+
+@@ -355,7 +380,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
+ }
+
+ /* Disabling the path make its elements available to other sessions */
+- coresight_disable_path(event_data->path[cpu]);
++ coresight_disable_path(path);
+ }
+
+ static int etm_event_add(struct perf_event *event, int mode)
+--
+2.20.1
+
--- /dev/null
+From 0eb9f972fe0ea482bd2a359c530dfbb5e5113df8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 13:18:02 -0600
+Subject: coresight: tmc: Fix byte-address alignment for RRP
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit e7753f3937610633a540f2be81be87531f96ff04 ]
+
+>From the comment in the code, it claims the requirement for byte-address
+alignment for RRP register: 'for 32-bit, 64-bit and 128-bit wide trace
+memory, the four LSBs must be 0s. For 256-bit wide trace memory, the
+five LSBs must be 0s'. This isn't consistent with the program, the
+program sets five LSBs as zeros for 32/64/128-bit wide trace memory and
+set six LSBs zeros for 256-bit wide trace memory.
+
+After checking with the CoreSight Trace Memory Controller technical
+reference manual (ARM DDI 0461B, section 3.3.4 RAM Read Pointer
+Register), it proves the comment is right and the program does wrong
+setting.
+
+This patch fixes byte-address alignment for RRP by following correct
+definition in the technical reference manual.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+index e2513b7862427..336194d059fed 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
+@@ -442,10 +442,10 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
+ case TMC_MEM_INTF_WIDTH_32BITS:
+ case TMC_MEM_INTF_WIDTH_64BITS:
+ case TMC_MEM_INTF_WIDTH_128BITS:
+- mask = GENMASK(31, 5);
++ mask = GENMASK(31, 4);
+ break;
+ case TMC_MEM_INTF_WIDTH_256BITS:
+- mask = GENMASK(31, 6);
++ mask = GENMASK(31, 5);
+ break;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0fd5cd07104fba1b35a72c46843ff698d5de43d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 21:38:24 -0700
+Subject: cpufeature: avoid warning when compiling with clang
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c785896b21dd8e156326ff660050b0074d3431df ]
+
+The table id (second) argument to MODULE_DEVICE_TABLE is often
+referenced otherwise. This is not the case for CPU features. This
+leads to warnings when building the kernel with Clang:
+ arch/arm/crypto/aes-ce-glue.c:450:1: warning: variable
+ 'cpu_feature_match_AES' is not needed and will not be emitted
+ [-Wunneeded-internal-declaration]
+ module_cpu_feature_match(AES, aes_init);
+ ^
+
+Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf
+("modules: mark __inittest/__exittest as __maybe_unused").
+
+Fixes: 67bad2fdb754 ("cpu: add generic support for CPU feature based module autoloading")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cpufeature.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/cpufeature.h b/include/linux/cpufeature.h
+index 986c06c88d814..84d3c81b59781 100644
+--- a/include/linux/cpufeature.h
++++ b/include/linux/cpufeature.h
+@@ -45,7 +45,7 @@
+ * 'asm/cpufeature.h' of your favorite architecture.
+ */
+ #define module_cpu_feature_match(x, __initfunc) \
+-static struct cpu_feature const cpu_feature_match_ ## x[] = \
++static struct cpu_feature const __maybe_unused cpu_feature_match_ ## x[] = \
+ { { .feature = cpu_feature(x) }, { } }; \
+ MODULE_DEVICE_TABLE(cpu, cpu_feature_match_ ## x); \
+ \
+--
+2.20.1
+
--- /dev/null
+From 4d638b68829c70f14ec8c00b350a31dbbcbd8e01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 21:38:25 -0700
+Subject: crypto: arm/crc32 - avoid warning when compiling with Clang
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit cd560235d8f9ddd94aa51e1c4dabdf3212b9b241 ]
+
+The table id (second) argument to MODULE_DEVICE_TABLE is often
+referenced otherwise. This is not the case for CPU features. This
+leads to a warning when building the kernel with Clang:
+ arch/arm/crypto/crc32-ce-glue.c:239:33: warning: variable
+ 'crc32_cpu_feature' is not needed and will not be emitted
+ [-Wunneeded-internal-declaration]
+ static const struct cpu_feature crc32_cpu_feature[] = {
+ ^
+
+Avoid warnings by using __maybe_unused, similar to commit 1f318a8bafcf
+("modules: mark __inittest/__exittest as __maybe_unused").
+
+Fixes: 2a9faf8b7e43 ("crypto: arm/crc32 - enable module autoloading based on CPU feature bits")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/crc32-ce-glue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/crypto/crc32-ce-glue.c b/arch/arm/crypto/crc32-ce-glue.c
+index 96e62ec105d06..cd9e93b46c2dd 100644
+--- a/arch/arm/crypto/crc32-ce-glue.c
++++ b/arch/arm/crypto/crc32-ce-glue.c
+@@ -236,7 +236,7 @@ static void __exit crc32_pmull_mod_exit(void)
+ ARRAY_SIZE(crc32_pmull_algs));
+ }
+
+-static const struct cpu_feature crc32_cpu_feature[] = {
++static const struct cpu_feature __maybe_unused crc32_cpu_feature[] = {
+ { cpu_feature(CRC32) }, { cpu_feature(PMULL) }, { }
+ };
+ MODULE_DEVICE_TABLE(cpu, crc32_cpu_feature);
+--
+2.20.1
+
--- /dev/null
+From abdca8c37756d26ccad10823d743656b0462b20f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 20:24:32 +0300
+Subject: crypto: fix a memory leak in rsa-kcs1pad's encryption mode
+
+From: Dan Aloni <dan@kernelim.com>
+
+[ Upstream commit 3944f139d5592790b70bc64f197162e643a8512b ]
+
+The encryption mode of pkcs1pad never uses out_sg and out_buf, so
+there's no need to allocate the buffer, which presently is not even
+being freed.
+
+CC: Herbert Xu <herbert@gondor.apana.org.au>
+CC: linux-crypto@vger.kernel.org
+CC: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Dan Aloni <dan@kernelim.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/rsa-pkcs1pad.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
+index 407c64bdcdd9a..3279b457c4ede 100644
+--- a/crypto/rsa-pkcs1pad.c
++++ b/crypto/rsa-pkcs1pad.c
+@@ -261,15 +261,6 @@ static int pkcs1pad_encrypt(struct akcipher_request *req)
+ pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
+ ctx->key_size - 1 - req->src_len, req->src);
+
+- req_ctx->out_buf = kmalloc(ctx->key_size, GFP_KERNEL);
+- if (!req_ctx->out_buf) {
+- kfree(req_ctx->in_buf);
+- return -ENOMEM;
+- }
+-
+- pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
+- ctx->key_size, NULL);
+-
+ akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
+ akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
+ pkcs1pad_encrypt_sign_complete_cb, req);
+--
+2.20.1
+
--- /dev/null
+From 7cd3956885e4932e19f85fe1e367b0d0716fe187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:09:28 +0200
+Subject: crypto: s5p-sss: Fix Fix argument list alignment
+
+From: Christoph Manszewski <c.manszewski@samsung.com>
+
+[ Upstream commit 6c12b6ba45490eeb820fdceccf5a53f42a26799c ]
+
+Fix misalignment of continued argument list.
+
+Signed-off-by: Christoph Manszewski <c.manszewski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Kamil Konieczny <k.konieczny@partner.samsung.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/s5p-sss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index aec66159566dd..9a5213cbcbe18 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -323,7 +323,7 @@ static void s5p_unset_indata(struct s5p_aes_dev *dev)
+ }
+
+ static int s5p_make_sg_cpy(struct s5p_aes_dev *dev, struct scatterlist *src,
+- struct scatterlist **dst)
++ struct scatterlist **dst)
+ {
+ void *pages;
+ int len;
+@@ -569,7 +569,7 @@ static int s5p_set_indata_start(struct s5p_aes_dev *dev,
+ }
+
+ static int s5p_set_outdata_start(struct s5p_aes_dev *dev,
+- struct ablkcipher_request *req)
++ struct ablkcipher_request *req)
+ {
+ struct scatterlist *sg;
+ int err;
+--
+2.20.1
+
--- /dev/null
+From 43bc49f6cc19c081a0a96a691e17ab35af1b7afc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 14:36:27 +0530
+Subject: cxgb4: Fix endianness issue in t4_fwcache()
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 0dc235afc59a226d951352b0adf4a89b532a9d13 ]
+
+Do not put host-endian 0 or 1 into big endian feild.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 1802debbd3c7e..39bcf27902e4b 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3750,7 +3750,7 @@ int t4_fwcache(struct adapter *adap, enum fw_params_param_dev_fwcache op)
+ c.param[0].mnem =
+ cpu_to_be32(FW_PARAMS_MNEM_V(FW_PARAMS_MNEM_DEV) |
+ FW_PARAMS_PARAM_X_V(FW_PARAMS_PARAM_DEV_FWCACHE));
+- c.param[0].val = (__force __be32)op;
++ c.param[0].val = cpu_to_be32(op);
+
+ return t4_wr_mbox(adap, adap->mbox, &c, sizeof(c), NULL);
+ }
+--
+2.20.1
+
--- /dev/null
+From 1480c39b295048ba7e3a1e137e0a97c5e83036b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:48 +0200
+Subject: dmaengine: dma-jz4780: Don't depend on MACH_JZ4780
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit c558ecd21c852c97ff98dc6c61f715ba420ec251 ]
+
+If we make this driver depend on MACH_JZ4780, that means it can be
+enabled only if we're building a kernel specially crafted for a
+JZ4780-based board, while most GNU/Linux distributions will want one
+generic MIPS kernel that works on multiple boards.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index fadc4d8783bd8..79b809dbfda01 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -143,7 +143,7 @@ config DMA_JZ4740
+
+ config DMA_JZ4780
+ tristate "JZ4780 DMA support"
+- depends on MACH_JZ4780 || COMPILE_TEST
++ depends on MIPS || COMPILE_TEST
+ select DMA_ENGINE
+ select DMA_VIRTUAL_CHANNELS
+ help
+--
+2.20.1
+
--- /dev/null
+From 5a36c42565eb8234b1ee4862cd04469f6c6c1877 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:32:56 +0200
+Subject: dmaengine: dma-jz4780: Further residue status fix
+
+From: Daniel Silsby <dansilsby@gmail.com>
+
+[ Upstream commit 83ef4fb7556b6a673f755da670cbacab7e2c7f1b ]
+
+Func jz4780_dma_desc_residue() expects the index to the next hw
+descriptor as its last parameter. Caller func jz4780_dma_tx_status(),
+however, applied modulus before passing it. When the current hw
+descriptor was last in the list, the index passed became zero.
+
+The resulting excess of reported residue especially caused problems
+with cyclic DMA transfer clients, i.e. ALSA AIC audio output, which
+rely on this for determining current DMA location within buffer.
+
+Combined with the recent and related residue-reporting fixes, spurious
+ALSA audio underruns on jz4770 hardware are now fixed.
+
+Signed-off-by: Daniel Silsby <dansilsby@gmail.com>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 803cfb4523b08..aca2d6fd92d56 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -580,7 +580,7 @@ static enum dma_status jz4780_dma_tx_status(struct dma_chan *chan,
+ to_jz4780_dma_desc(vdesc), 0);
+ } else if (cookie == jzchan->desc->vdesc.tx.cookie) {
+ txstate->residue = jz4780_dma_desc_residue(jzchan, jzchan->desc,
+- (jzchan->curr_hwdesc + 1) % jzchan->desc->count);
++ jzchan->curr_hwdesc + 1);
+ } else
+ txstate->residue = 0;
+
+--
+2.20.1
+
--- /dev/null
+From a9b552a4f105b842498bdb103aaaa93ffe1cab95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 23:06:11 +0000
+Subject: Drivers: hv: vmbus: Fix synic per-cpu context initialization
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit f25a7ece08bdb1f2b3c4bbeae942682fc3a99dde ]
+
+If hv_synic_alloc() errors out, the state of the per-cpu context
+for some CPUs is unknown since the zero'ing is done as each
+CPU is iterated over. In such case, hv_synic_cleanup() may try to
+free memory based on uninitialized values. Fix this by zero'ing
+the per-cpu context for all CPUs before doing any memory
+allocations that might fail.
+
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/hv.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
+index fe041f22521da..23f312b4c6aa2 100644
+--- a/drivers/hv/hv.c
++++ b/drivers/hv/hv.c
+@@ -148,6 +148,17 @@ static void hv_init_clockevent_device(struct clock_event_device *dev, int cpu)
+ int hv_synic_alloc(void)
+ {
+ int cpu;
++ struct hv_per_cpu_context *hv_cpu;
++
++ /*
++ * First, zero all per-cpu memory areas so hv_synic_free() can
++ * detect what memory has been allocated and cleanup properly
++ * after any failures.
++ */
++ for_each_present_cpu(cpu) {
++ hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
++ memset(hv_cpu, 0, sizeof(*hv_cpu));
++ }
+
+ hv_context.hv_numa_map = kzalloc(sizeof(struct cpumask) * nr_node_ids,
+ GFP_ATOMIC);
+@@ -157,10 +168,8 @@ int hv_synic_alloc(void)
+ }
+
+ for_each_present_cpu(cpu) {
+- struct hv_per_cpu_context *hv_cpu
+- = per_cpu_ptr(hv_context.cpu_context, cpu);
++ hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
+
+- memset(hv_cpu, 0, sizeof(*hv_cpu));
+ tasklet_init(&hv_cpu->msg_dpc,
+ vmbus_on_msg_dpc, (unsigned long) hv_cpu);
+
+--
+2.20.1
+
--- /dev/null
+From 20ee4a3d3a7a42a4e54319d0c6710709019e3c0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 09:34:49 -0500
+Subject: EDAC: Raise the maximum number of memory controllers
+
+From: Justin Ernst <justin.ernst@hpe.com>
+
+[ Upstream commit 6b58859419554fb824e09cfdd73151a195473cbc ]
+
+We observe an oops in the skx_edac module during boot:
+
+ EDAC MC0: Giving out device to module skx_edac controller Skylake Socket#0 IMC#0
+ EDAC MC1: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC2: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ ...
+ EDAC MC13: Giving out device to module skx_edac controller Skylake Socket#0 IMC#1
+ EDAC MC14: Giving out device to module skx_edac controller Skylake Socket#1 IMC#0
+ EDAC MC15: Giving out device to module skx_edac controller Skylake Socket#1 IMC#1
+ Too many memory controllers: 16
+ EDAC MC: Removed device 0 for skx_edac Skylake Socket#0 IMC#0
+
+We observe there are two memory controllers per socket, with a limit
+of 16. Raise the maximum number of memory controllers from 16 to 2 *
+MAX_NUMNODES (1024).
+
+[ bp: This is just a band-aid fix until we've sorted out the whole issue
+ with the bus_type association and handling in EDAC and can get rid of
+ this arbitrary limit. ]
+
+Signed-off-by: Justin Ernst <justin.ernst@hpe.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Russ Anderson <russ.anderson@hpe.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: linux-edac@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180925143449.284634-1-justin.ernst@hpe.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/edac.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/edac.h b/include/linux/edac.h
+index cd75c173fd00b..90f72336aea66 100644
+--- a/include/linux/edac.h
++++ b/include/linux/edac.h
+@@ -17,6 +17,7 @@
+ #include <linux/completion.h>
+ #include <linux/workqueue.h>
+ #include <linux/debugfs.h>
++#include <linux/numa.h>
+
+ #define EDAC_DEVICE_NAME_LEN 31
+
+@@ -667,6 +668,6 @@ struct mem_ctl_info {
+ /*
+ * Maximum number of memory controllers in the coherent fabric.
+ */
+-#define EDAC_MAX_MCS 16
++#define EDAC_MAX_MCS 2 * MAX_NUMNODES
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From a22897ff046458002f9f1d99692991955b27f634 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:08:27 -0700
+Subject: EDAC, sb_edac: Return early on ADDRV bit and address type test
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit dcc960b225ceb2bd66c45e0845d03e577f7010f9 ]
+
+Users of the mce_register_decode_chain() are called for every logged
+error. EDAC drivers should check:
+
+1) Is this a memory error? [bit 7 in status register]
+2) Is there a valid address? [bit 58 in status register]
+3) Is the address a system address? [bitfield 8:6 in misc register]
+
+The sb_edac driver performed test "1" twice. Waited far too long to
+perform check "2". Didn't do check "3" at all.
+
+Fix it by moving the test for valid address from
+sbridge_mce_output_error() into sbridge_mce_check_error() and add a test
+for the type immediately after. Delete the redundant check for the type
+of the error from sbridge_mce_output_error().
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Cc: Aristeu Rozanski <aris@redhat.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20180907230828.13901-2-tony.luck@intel.com
+[ Re-word commit message. ]
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/sb_edac.c | 68 ++++++++++++++++++++++--------------------
+ 1 file changed, 35 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index b0b390a1da154..ddd5990211f8a 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2915,35 +2915,27 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ * cccc = channel
+ * If the mask doesn't match, report an error to the parsing logic
+ */
+- if (! ((errcode & 0xef80) == 0x80)) {
+- optype = "Can't parse: it is not a mem";
+- } else {
+- switch (optypenum) {
+- case 0:
+- optype = "generic undef request error";
+- break;
+- case 1:
+- optype = "memory read error";
+- break;
+- case 2:
+- optype = "memory write error";
+- break;
+- case 3:
+- optype = "addr/cmd error";
+- break;
+- case 4:
+- optype = "memory scrubbing error";
+- break;
+- default:
+- optype = "reserved";
+- break;
+- }
++ switch (optypenum) {
++ case 0:
++ optype = "generic undef request error";
++ break;
++ case 1:
++ optype = "memory read error";
++ break;
++ case 2:
++ optype = "memory write error";
++ break;
++ case 3:
++ optype = "addr/cmd error";
++ break;
++ case 4:
++ optype = "memory scrubbing error";
++ break;
++ default:
++ optype = "reserved";
++ break;
+ }
+
+- /* Only decode errors with an valid address (ADDRV) */
+- if (!GET_BITFIELD(m->status, 58, 58))
+- return;
+-
+ if (pvt->info.type == KNIGHTS_LANDING) {
+ if (channel == 14) {
+ edac_dbg(0, "%s%s err_code:%04x:%04x EDRAM bank %d\n",
+@@ -3049,17 +3041,11 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ {
+ struct mce *mce = (struct mce *)data;
+ struct mem_ctl_info *mci;
+- struct sbridge_pvt *pvt;
+ char *type;
+
+ if (edac_get_report_status() == EDAC_REPORTING_DISABLED)
+ return NOTIFY_DONE;
+
+- mci = get_mci_for_node_id(mce->socketid, IMC0);
+- if (!mci)
+- return NOTIFY_DONE;
+- pvt = mci->pvt_info;
+-
+ /*
+ * Just let mcelog handle it if the error is
+ * outside the memory controller. A memory error
+@@ -3069,6 +3055,22 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
+ if ((mce->status & 0xefff) >> 7 != 1)
+ return NOTIFY_DONE;
+
++ /* Check ADDRV bit in STATUS */
++ if (!GET_BITFIELD(mce->status, 58, 58))
++ return NOTIFY_DONE;
++
++ /* Check MISCV bit in STATUS */
++ if (!GET_BITFIELD(mce->status, 59, 59))
++ return NOTIFY_DONE;
++
++ /* Check address type in MISC (physical address only) */
++ if (GET_BITFIELD(mce->misc, 6, 8) != 2)
++ return NOTIFY_DONE;
++
++ mci = get_mci_for_node_id(mce->socketid, IMC0);
++ if (!mci)
++ return NOTIFY_DONE;
++
+ if (mce->mcgstatus & MCG_STATUS_MCIP)
+ type = "Exception";
+ else
+--
+2.20.1
+
--- /dev/null
+From 2d89308329e3704c868b87c4afeb56e537396ca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 18:35:53 +0300
+Subject: extcon: cht-wc: Return from default case to avoid warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 962341b54b99965ebec5f70c8d39f1c382eea833 ]
+
+When we have first case to fall through it's not enough to put
+single comment there to satisfy compiler. Instead of doing that,
+return fall back value directly from default case.
+
+This to avoid following warnings:
+
+drivers/extcon/extcon-intel-cht-wc.c: In function ‘cht_wc_extcon_get_charger’:
+include/linux/device.h:1420:2: warning: this statement may fall through [-Wimplicit-fallthrough=]
+ _dev_warn(dev, dev_fmt(fmt), ##__VA_ARGS__)
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/extcon/extcon-intel-cht-wc.c:148:3: note: in expansion of macro ‘dev_warn’
+ dev_warn(ext->dev,
+ ^~~~~~~~
+drivers/extcon/extcon-intel-cht-wc.c:152:2: note: here
+ case CHT_WC_USBSRC_TYPE_SDP:
+ ^~~~
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-intel-cht-wc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/extcon/extcon-intel-cht-wc.c b/drivers/extcon/extcon-intel-cht-wc.c
+index 60baaf6931032..c562d9d69ae39 100644
+--- a/drivers/extcon/extcon-intel-cht-wc.c
++++ b/drivers/extcon/extcon-intel-cht-wc.c
+@@ -155,7 +155,7 @@ static int cht_wc_extcon_get_charger(struct cht_wc_extcon_data *ext,
+ dev_warn(ext->dev,
+ "Unhandled charger type %d, defaulting to SDP\n",
+ ret);
+- /* Fall through, treat as SDP */
++ return EXTCON_CHG_USB_SDP;
+ case CHT_WC_USBSRC_TYPE_SDP:
+ case CHT_WC_USBSRC_TYPE_FLOAT_DP_DN:
+ case CHT_WC_USBSRC_TYPE_OTHER:
+--
+2.20.1
+
--- /dev/null
+From b45c1bc3a0a8eb0f3b61bb015f6e18d780907ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 14:54:02 +0800
+Subject: f2fs: fix memory leak of percpu counter in fill_super()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 4a70e255449c9a13eed7a6eeecc85a1ea63cef76 ]
+
+In fill_super -> init_percpu_info, we should destroy percpu counter
+in error path, otherwise memory allcoated for percpu counter will
+leak.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 0f3209b23c940..e4aabfc21bd43 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2123,8 +2123,12 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
+ if (err)
+ return err;
+
+- return percpu_counter_init(&sbi->total_valid_inode_count, 0,
++ err = percpu_counter_init(&sbi->total_valid_inode_count, 0,
+ GFP_KERNEL);
++ if (err)
++ percpu_counter_destroy(&sbi->alloc_valid_block_count);
++
++ return err;
+ }
+
+ #ifdef CONFIG_BLK_DEV_ZONED
+--
+2.20.1
+
--- /dev/null
+From fd0f242c7e931fac0f196b81a7fb5b70fcbd9ed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 15:35:58 +0800
+Subject: f2fs: fix to recover inode's project id during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit f4474aa6e5e901ee4af21f39f1b9115aaaaec503 ]
+
+Testcase to reproduce this bug:
+1. mkfs.f2fs -O extra_attr -O project_quota /dev/sdd
+2. mount -t f2fs /dev/sdd /mnt/f2fs
+3. touch /mnt/f2fs/file
+4. sync
+5. chattr -p 1 /mnt/f2fs/file
+6. xfs_io -f /mnt/f2fs/file -c "fsync"
+7. godown /mnt/f2fs
+8. umount /mnt/f2fs
+9. mount -t f2fs /dev/sdd /mnt/f2fs
+10. lsattr -p /mnt/f2fs/file
+
+ 0 -----------------N- /mnt/f2fs/file
+
+But actually, we expect the correct result is:
+
+ 1 -----------------N- /mnt/f2fs/file
+
+The reason is we didn't recover inode.i_projid field during mount,
+fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index adbf2600c0908..87942cf2afe1f 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -203,6 +203,19 @@ static void recover_inode(struct inode *inode, struct page *page)
+ inode->i_mode = le16_to_cpu(raw->i_mode);
+ i_uid_write(inode, le32_to_cpu(raw->i_uid));
+ i_gid_write(inode, le32_to_cpu(raw->i_gid));
++
++ if (raw->i_inline & F2FS_EXTRA_ATTR) {
++ if (f2fs_sb_has_project_quota(F2FS_I_SB(inode)->sb) &&
++ F2FS_FITS_IN_INODE(raw, le16_to_cpu(raw->i_extra_isize),
++ i_projid)) {
++ projid_t i_projid;
++
++ i_projid = (projid_t)le32_to_cpu(raw->i_projid);
++ F2FS_I(inode)->i_projid =
++ make_kprojid(&init_user_ns, i_projid);
++ }
++ }
++
+ f2fs_i_size_write(inode, le64_to_cpu(raw->i_size));
+ inode->i_atime.tv_sec = le64_to_cpu(raw->i_atime);
+ inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime);
+--
+2.20.1
+
--- /dev/null
+From 873f69f52a625b7cf4be10c1bcffd2c6decbbe49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 17:41:30 +0800
+Subject: f2fs: fix to recover inode's uid/gid during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit dc4cd1257c86451cec3e8e352cc376348e4f4af4 ]
+
+Step to reproduce this bug:
+1. logon as root
+2. mount -t f2fs /dev/sdd /mnt;
+3. touch /mnt/file;
+4. chown system /mnt/file; chgrp system /mnt/file;
+5. xfs_io -f /mnt/file -c "fsync";
+6. godown /mnt;
+7. umount /mnt;
+8. mount -t f2fs /dev/sdd /mnt;
+
+After step 8) we will expect file's uid/gid are all system, but during
+recovery, these two fields were not been recovered, fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index db357e9ad5990..adbf2600c0908 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -201,6 +201,8 @@ static void recover_inode(struct inode *inode, struct page *page)
+ char *name;
+
+ inode->i_mode = le16_to_cpu(raw->i_mode);
++ i_uid_write(inode, le32_to_cpu(raw->i_uid));
++ i_gid_write(inode, le32_to_cpu(raw->i_gid));
+ f2fs_i_size_write(inode, le64_to_cpu(raw->i_size));
+ inode->i_atime.tv_sec = le64_to_cpu(raw->i_atime);
+ inode->i_ctime.tv_sec = le64_to_cpu(raw->i_ctime);
+--
+2.20.1
+
--- /dev/null
+From edf8650231fafa14d1429982c3a3b0d3397e8c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 15:36:03 +0800
+Subject: f2fs: mark inode dirty explicitly in recover_inode()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 4a1728cad6340bfbe17bd17fd158b2165cd99508 ]
+
+Mark inode dirty explicitly in the end of recover_inode() to make sure
+that all recoverable fields can be persisted later.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/recovery.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 87942cf2afe1f..2eef266b656b5 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -227,6 +227,8 @@ static void recover_inode(struct inode *inode, struct page *page)
+ F2FS_I(inode)->i_advise = raw->i_advise;
+ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags);
+
++ f2fs_mark_inode_dirty_sync(inode, true);
++
+ if (file_enc_name(inode))
+ name = "<encrypted>";
+ else
+--
+2.20.1
+
--- /dev/null
+From 5742e619361ef5cd206959b1eb28ce0cfda1aa60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 16:50:17 -0500
+Subject: firmware: dell_rbu: Make payload memory uncachable
+
+From: Stuart Hayes <stuart.w.hayes@gmail.com>
+
+[ Upstream commit 6aecee6ad41cf97c0270f72da032c10eef025bf0 ]
+
+The dell_rbu driver takes firmware update payloads and puts them in memory so
+the system BIOS can find them after a reboot. This sometimes fails (though
+rarely), because the memory containing the payload is in the CPU cache but
+never gets written back to main memory before the system is rebooted (CPU
+cache contents are lost on reboot).
+
+With this patch, the payload memory will be changed to uncachable to ensure
+that the payload is actually in main memory before the system is rebooted.
+
+Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/dell_rbu.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
+index 2f452f1f7c8a0..53f27a6e2d761 100644
+--- a/drivers/firmware/dell_rbu.c
++++ b/drivers/firmware/dell_rbu.c
+@@ -45,6 +45,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/firmware.h>
+ #include <linux/dma-mapping.h>
++#include <asm/set_memory.h>
+
+ MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
+ MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
+@@ -181,6 +182,11 @@ static int create_packet(void *data, size_t length)
+ packet_data_temp_buf = NULL;
+ }
+ }
++ /*
++ * set to uncachable or it may never get written back before reboot
++ */
++ set_memory_uc((unsigned long)packet_data_temp_buf, 1 << ordernum);
++
+ spin_lock(&rbu_data.lock);
+
+ newpacket->data = packet_data_temp_buf;
+@@ -349,6 +355,8 @@ static void packet_empty_list(void)
+ * to make sure there are no stale RBU packets left in memory
+ */
+ memset(newpacket->data, 0, rbu_data.packetsize);
++ set_memory_wb((unsigned long)newpacket->data,
++ 1 << newpacket->ordernum);
+ free_pages((unsigned long) newpacket->data,
+ newpacket->ordernum);
+ kfree(newpacket);
+--
+2.20.1
+
--- /dev/null
+From 7bc5af21ccec9502892e0fee680053a8d91ec290 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 18:29:29 +0300
+Subject: fuse: use READ_ONCE on congestion_threshold and max_background
+
+From: Kirill Tkhai <ktkhai@virtuozzo.com>
+
+[ Upstream commit 2a23f2b8adbe4bd584f936f7ac17a99750eed9d7 ]
+
+Since they are of unsigned int type, it's allowed to read them
+unlocked during reporting to userspace. Let's underline this fact
+with READ_ONCE() macroses.
+
+Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/control.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fuse/control.c b/fs/fuse/control.c
+index 5be0339dcceb2..42bed87dd5ea9 100644
+--- a/fs/fuse/control.c
++++ b/fs/fuse/control.c
+@@ -107,7 +107,7 @@ static ssize_t fuse_conn_max_background_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->max_background;
++ val = READ_ONCE(fc->max_background);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+@@ -144,7 +144,7 @@ static ssize_t fuse_conn_congestion_threshold_read(struct file *file,
+ if (!fc)
+ return 0;
+
+- val = fc->congestion_threshold;
++ val = READ_ONCE(fc->congestion_threshold);
+ fuse_conn_put(fc);
+
+ return fuse_conn_limit_read(file, buf, len, ppos, val);
+--
+2.20.1
+
--- /dev/null
+From 5cf4a7a7a6143fb60e7ba2ff1d0510f70a33c6d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 10:32:13 -0500
+Subject: gfs2: Don't set GFS2_RDF_UPTODATE when the lvb is updated
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 4f36cb36c9d14340bb200d2ad9117b03ce992cfe ]
+
+The GFS2_RDF_UPTODATE flag in the rgrp is used to determine when
+a rgrp buffer is valid. It's cleared when the glock is invalidated,
+signifying that the buffer data is now invalid. But before this
+patch, function update_rgrp_lvb was setting the flag when it
+determined it had a valid lvb. But that's an invalid assumption:
+just because you have a valid lvb doesn't mean you have valid
+buffers. After all, another node may have made the lvb valid,
+and this node just fetched it from the glock via dlm.
+
+Consider this scenario:
+1. The file system is mounted with RGRPLVB option.
+2. In gfs2_inplace_reserve it locks the rgrp glock EX, but thanks
+ to GL_SKIP, it skips the gfs2_rgrp_bh_get.
+3. Since loops == 0 and the allocation target (ap->target) is
+ bigger than the largest known chunk of blocks in the rgrp
+ (rs->rs_rbm.rgd->rd_extfail_pt) it skips that rgrp and bypasses
+ the call to gfs2_rgrp_bh_get there as well.
+4. update_rgrp_lvb sees the lvb MAGIC number is valid, so bypasses
+ gfs2_rgrp_bh_get, but it still sets sets GFS2_RDF_UPTODATE due
+ to this invalid assumption.
+5. The next time update_rgrp_lvb is called, it sees the bit is set
+ and just returns 0, assuming both the lvb and rgrp are both
+ uptodate. But since this is a smaller allocation, or space has
+ been freed by another node, thus adjusting the lvb values,
+ it decides to use the rgrp for allocations, with invalid rd_free
+ due to the fact it was never updated.
+
+This patch changes update_rgrp_lvb so it doesn't set the UPTODATE
+flag anymore. That way, it has no choice but to fetch the latest
+values.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index b0eee90738ff4..0d72baae51509 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1201,7 +1201,7 @@ static int update_rgrp_lvb(struct gfs2_rgrpd *rgd)
+ rl_flags = be32_to_cpu(rgd->rd_rgl->rl_flags);
+ rl_flags &= ~GFS2_RDF_MASK;
+ rgd->rd_flags &= GFS2_RDF_MASK;
+- rgd->rd_flags |= (rl_flags | GFS2_RDF_UPTODATE | GFS2_RDF_CHECK);
++ rgd->rd_flags |= (rl_flags | GFS2_RDF_CHECK);
+ if (rgd->rd_rgl->rl_unlinked == 0)
+ rgd->rd_flags &= ~GFS2_RDF_CHECK;
+ rgd->rd_free = be32_to_cpu(rgd->rd_rgl->rl_free);
+--
+2.20.1
+
--- /dev/null
+From 6cf781858fc64246d2048277f0db01182bb39656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 16:30:50 -0700
+Subject: i2c: aspeed: fix invalid clock parameters for very large divisors
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 17ccba67109cd0631f206cf49e17986218b47854 ]
+
+The function that computes clock parameters from divisors did not
+respect the maximum size of the bitfields that the parameters were
+written to. This fixes the bug.
+
+This bug can be reproduced with (and this fix verified with) the test
+at: https://kunit-review.googlesource.com/c/linux/+/1035/
+
+Discovered-by-KUnit: https://kunit-review.googlesource.com/c/linux/+/1035/
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Reviewed-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-aspeed.c | 65 +++++++++++++++++++++++----------
+ 1 file changed, 45 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
+index a074735456bc7..29574b9075fd7 100644
+--- a/drivers/i2c/busses/i2c-aspeed.c
++++ b/drivers/i2c/busses/i2c-aspeed.c
+@@ -135,7 +135,8 @@ struct aspeed_i2c_bus {
+ /* Synchronizes I/O mem access to base. */
+ spinlock_t lock;
+ struct completion cmd_complete;
+- u32 (*get_clk_reg_val)(u32 divisor);
++ u32 (*get_clk_reg_val)(struct device *dev,
++ u32 divisor);
+ unsigned long parent_clk_frequency;
+ u32 bus_frequency;
+ /* Transaction state. */
+@@ -679,16 +680,27 @@ static const struct i2c_algorithm aspeed_i2c_algo = {
+ #endif /* CONFIG_I2C_SLAVE */
+ };
+
+-static u32 aspeed_i2c_get_clk_reg_val(u32 clk_high_low_max, u32 divisor)
++static u32 aspeed_i2c_get_clk_reg_val(struct device *dev,
++ u32 clk_high_low_mask,
++ u32 divisor)
+ {
+- u32 base_clk, clk_high, clk_low, tmp;
++ u32 base_clk_divisor, clk_high_low_max, clk_high, clk_low, tmp;
++
++ /*
++ * SCL_high and SCL_low represent a value 1 greater than what is stored
++ * since a zero divider is meaningless. Thus, the max value each can
++ * store is every bit set + 1. Since SCL_high and SCL_low are added
++ * together (see below), the max value of both is the max value of one
++ * them times two.
++ */
++ clk_high_low_max = (clk_high_low_mask + 1) * 2;
+
+ /*
+ * The actual clock frequency of SCL is:
+ * SCL_freq = APB_freq / (base_freq * (SCL_high + SCL_low))
+ * = APB_freq / divisor
+ * where base_freq is a programmable clock divider; its value is
+- * base_freq = 1 << base_clk
++ * base_freq = 1 << base_clk_divisor
+ * SCL_high is the number of base_freq clock cycles that SCL stays high
+ * and SCL_low is the number of base_freq clock cycles that SCL stays
+ * low for a period of SCL.
+@@ -698,47 +710,59 @@ static u32 aspeed_i2c_get_clk_reg_val(u32 clk_high_low_max, u32 divisor)
+ * SCL_low = clk_low + 1
+ * Thus,
+ * SCL_freq = APB_freq /
+- * ((1 << base_clk) * (clk_high + 1 + clk_low + 1))
++ * ((1 << base_clk_divisor) * (clk_high + 1 + clk_low + 1))
+ * The documentation recommends clk_high >= clk_high_max / 2 and
+ * clk_low >= clk_low_max / 2 - 1 when possible; this last constraint
+ * gives us the following solution:
+ */
+- base_clk = divisor > clk_high_low_max ?
++ base_clk_divisor = divisor > clk_high_low_max ?
+ ilog2((divisor - 1) / clk_high_low_max) + 1 : 0;
+- tmp = (divisor + (1 << base_clk) - 1) >> base_clk;
+- clk_low = tmp / 2;
+- clk_high = tmp - clk_low;
+
+- if (clk_high)
+- clk_high--;
++ if (base_clk_divisor > ASPEED_I2CD_TIME_BASE_DIVISOR_MASK) {
++ base_clk_divisor = ASPEED_I2CD_TIME_BASE_DIVISOR_MASK;
++ clk_low = clk_high_low_mask;
++ clk_high = clk_high_low_mask;
++ dev_err(dev,
++ "clamping clock divider: divider requested, %u, is greater than largest possible divider, %u.\n",
++ divisor, (1 << base_clk_divisor) * clk_high_low_max);
++ } else {
++ tmp = (divisor + (1 << base_clk_divisor) - 1)
++ >> base_clk_divisor;
++ clk_low = tmp / 2;
++ clk_high = tmp - clk_low;
++
++ if (clk_high)
++ clk_high--;
+
+- if (clk_low)
+- clk_low--;
++ if (clk_low)
++ clk_low--;
++ }
+
+
+ return ((clk_high << ASPEED_I2CD_TIME_SCL_HIGH_SHIFT)
+ & ASPEED_I2CD_TIME_SCL_HIGH_MASK)
+ | ((clk_low << ASPEED_I2CD_TIME_SCL_LOW_SHIFT)
+ & ASPEED_I2CD_TIME_SCL_LOW_MASK)
+- | (base_clk & ASPEED_I2CD_TIME_BASE_DIVISOR_MASK);
++ | (base_clk_divisor
++ & ASPEED_I2CD_TIME_BASE_DIVISOR_MASK);
+ }
+
+-static u32 aspeed_i2c_24xx_get_clk_reg_val(u32 divisor)
++static u32 aspeed_i2c_24xx_get_clk_reg_val(struct device *dev, u32 divisor)
+ {
+ /*
+ * clk_high and clk_low are each 3 bits wide, so each can hold a max
+ * value of 8 giving a clk_high_low_max of 16.
+ */
+- return aspeed_i2c_get_clk_reg_val(16, divisor);
++ return aspeed_i2c_get_clk_reg_val(dev, GENMASK(2, 0), divisor);
+ }
+
+-static u32 aspeed_i2c_25xx_get_clk_reg_val(u32 divisor)
++static u32 aspeed_i2c_25xx_get_clk_reg_val(struct device *dev, u32 divisor)
+ {
+ /*
+ * clk_high and clk_low are each 4 bits wide, so each can hold a max
+ * value of 16 giving a clk_high_low_max of 32.
+ */
+- return aspeed_i2c_get_clk_reg_val(32, divisor);
++ return aspeed_i2c_get_clk_reg_val(dev, GENMASK(3, 0), divisor);
+ }
+
+ /* precondition: bus.lock has been acquired. */
+@@ -751,7 +775,7 @@ static int aspeed_i2c_init_clk(struct aspeed_i2c_bus *bus)
+ clk_reg_val &= (ASPEED_I2CD_TIME_TBUF_MASK |
+ ASPEED_I2CD_TIME_THDSTA_MASK |
+ ASPEED_I2CD_TIME_TACST_MASK);
+- clk_reg_val |= bus->get_clk_reg_val(divisor);
++ clk_reg_val |= bus->get_clk_reg_val(bus->dev, divisor);
+ writel(clk_reg_val, bus->base + ASPEED_I2C_AC_TIMING_REG1);
+ writel(ASPEED_NO_TIMEOUT_CTRL, bus->base + ASPEED_I2C_AC_TIMING_REG2);
+
+@@ -859,7 +883,8 @@ static int aspeed_i2c_probe_bus(struct platform_device *pdev)
+ if (!match)
+ bus->get_clk_reg_val = aspeed_i2c_24xx_get_clk_reg_val;
+ else
+- bus->get_clk_reg_val = (u32 (*)(u32))match->data;
++ bus->get_clk_reg_val = (u32 (*)(struct device *, u32))
++ match->data;
+
+ /* Initialize the I2C adapter */
+ spin_lock_init(&bus->lock);
+--
+2.20.1
+
--- /dev/null
+From 9b3aa2072328f3ae8deedc03eae6b6a0f322a265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:03 -0700
+Subject: i40e: hold the rtnl lock on clearing interrupt scheme
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5cba17b14182696d6bb0ec83a1d087933f252241 ]
+
+Hold the rtnl lock when we're clearing interrupt scheme
+in i40e_shutdown and in i40e_remove.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 39029a12a2337..aa2b446d6ad0f 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -11885,6 +11885,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ mutex_destroy(&hw->aq.asq_mutex);
+
+ /* Clear all dynamic memory lists of rings, q_vectors, and VSIs */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i]) {
+@@ -11893,6 +11894,7 @@ static void i40e_remove(struct pci_dev *pdev)
+ pf->vsi[i] = NULL;
+ }
+ }
++ rtnl_unlock();
+
+ for (i = 0; i < I40E_MAX_VEB; i++) {
+ kfree(pf->veb[i]);
+@@ -12086,7 +12088,13 @@ static void i40e_shutdown(struct pci_dev *pdev)
+ wr32(hw, I40E_PFPM_WUFC,
+ (pf->wol_en ? I40E_PFPM_WUFC_MAG_MASK : 0));
+
++ /* Since we're going to destroy queues during the
++ * i40e_clear_interrupt_scheme() we should hold the RTNL lock for this
++ * whole section
++ */
++ rtnl_lock();
+ i40e_clear_interrupt_scheme(pf);
++ rtnl_unlock();
+
+ if (system_state == SYSTEM_POWER_OFF) {
+ pci_wake_from_d3(pdev, pf->wol_en);
+--
+2.20.1
+
--- /dev/null
+From af053dd2e2666fcf0c63d620d47ccbfb1438cf2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:16:09 -0700
+Subject: i40e: Prevent deleting MAC address from VF when set by PF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Patryk Małek <patryk.malek@intel.com>
+
+[ Upstream commit 5907cf6c5bbe78be2ed18b875b316c6028b20634 ]
+
+To prevent VF from deleting MAC address that was assigned by the
+PF we need to check for that scenario when we try to delete a MAC
+address from a VF.
+
+Signed-off-by: Patryk Małek <patryk.malek@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index bdb7523216000..b3307b1b3aac1 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2177,6 +2177,16 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen)
+ ret = I40E_ERR_INVALID_MAC_ADDR;
+ goto error_param;
+ }
++
++ if (vf->pf_set_mac &&
++ ether_addr_equal(al->list[i].addr,
++ vf->default_lan_addr.addr)) {
++ dev_err(&pf->pdev->dev,
++ "MAC addr %pM has been set by PF, cannot delete it for VF %d, reset VF to change MAC addr\n",
++ vf->default_lan_addr.addr, vf->vf_id);
++ ret = I40E_ERR_PARAM;
++ goto error_param;
++ }
+ }
+ vsi = pf->vsi[vf->lan_vsi_idx];
+
+--
+2.20.1
+
--- /dev/null
+From d0133e2b3887b27f886513da91333bd3a02021c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 08:12:30 -0700
+Subject: i40e: use correct length for strncpy
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 7eb74ff891b4e94b8bac48f648a21e4b94ddee64 ]
+
+Caught by GCC 8. When we provide a length for strncpy, we should not
+include the terminating null. So we must tell it one less than the size
+of the destination buffer.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ptp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+index ef242dbae116b..5fc8707574809 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+@@ -704,7 +704,8 @@ static long i40e_ptp_create_clock(struct i40e_pf *pf)
+ if (!IS_ERR_OR_NULL(pf->ptp_clock))
+ return 0;
+
+- strncpy(pf->ptp_caps.name, i40e_driver_name, sizeof(pf->ptp_caps.name));
++ strncpy(pf->ptp_caps.name, i40e_driver_name,
++ sizeof(pf->ptp_caps.name) - 1);
+ pf->ptp_caps.owner = THIS_MODULE;
+ pf->ptp_caps.max_adj = 999999999;
+ pf->ptp_caps.n_ext_ts = 0;
+--
+2.20.1
+
--- /dev/null
+From 1d8ec1ef21b4b5b1eb76029f350dd28fb271b125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 09:39:28 -0700
+Subject: IB/hfi1: Missing return value in error path for user sdma
+
+From: Michael J. Ruhl <michael.j.ruhl@intel.com>
+
+[ Upstream commit 2bf4b33f83dfe521c4c7c407b6b150aeec04d69c ]
+
+If the set_txreq_header_agh() function returns an error, the exit path
+is chosen.
+
+In this path, the code fails to set the return value. This will cause
+the caller to not realize an error has occurred.
+
+Set the return value correctly in the error path.
+
+Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 75275f9e363de..4854a4a453b5f 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -856,8 +856,10 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
+
+ changes = set_txreq_header_ahg(req, tx,
+ datalen);
+- if (changes < 0)
++ if (changes < 0) {
++ ret = changes;
+ goto free_tx;
++ }
+ }
+ } else {
+ ret = sdma_txinit(&tx->txreq, 0, sizeof(req->hdr) +
+--
+2.20.1
+
--- /dev/null
+From 2c9289a530663aa7a00ca9f8429e00d842bb9da1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:45:30 +0300
+Subject: IB/ipoib: Ensure that MTU isn't less than minimum permitted
+
+From: Muhammad Sammar <muhammads@mellanox.com>
+
+[ Upstream commit 142a9c287613560edf5a03c8d142c8b6ebc1995b ]
+
+It is illegal to change MTU to a value lower than the minimum MTU
+stated in ethernet spec. In addition to that we need to add 4 bytes
+for encapsulation header (IPOIB_ENCAP_LEN).
+
+Before "ifconfig ib0 mtu 0" command, succeeds while it obviously shouldn't.
+
+Signed-off-by: Muhammad Sammar <muhammads@mellanox.com>
+Reviewed-by: Feras Daoud <ferasda@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 1a93d3d58c8a4..caae4bfab950d 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -249,7 +249,8 @@ static int ipoib_change_mtu(struct net_device *dev, int new_mtu)
+ return 0;
+ }
+
+- if (new_mtu > IPOIB_UD_MTU(priv->max_ib_mtu))
++ if (new_mtu < (ETH_MIN_MTU + IPOIB_ENCAP_LEN) ||
++ new_mtu > IPOIB_UD_MTU(priv->max_ib_mtu))
+ return -EINVAL;
+
+ priv->admin_mtu = new_mtu;
+--
+2.20.1
+
--- /dev/null
+From 4165b3d92eee002856938c47eb9073feb239009d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 09:44:18 +0000
+Subject: IB/iser: Fix possible NULL deref at iser_inv_desc()
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit 65f07f5a09dacf3b60619f196f096ea3671a5eda ]
+
+In case target remote invalidates bogus rkey and signature is not used,
+pi_ctx is NULL deref.
+
+The commit also fails the connection on bogus remote invalidation.
+
+Fixes: 59caaed7a72a ("IB/iser: Support the remote invalidation exception")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iser_initiator.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 2a07692007bdd..a126750b65a92 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -592,13 +592,19 @@ void iser_login_rsp(struct ib_cq *cq, struct ib_wc *wc)
+ ib_conn->post_recv_buf_count--;
+ }
+
+-static inline void
++static inline int
+ iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
+ {
+- if (likely(rkey == desc->rsc.mr->rkey))
++ if (likely(rkey == desc->rsc.mr->rkey)) {
+ desc->rsc.mr_valid = 0;
+- else if (likely(rkey == desc->pi_ctx->sig_mr->rkey))
++ } else if (likely(desc->pi_ctx && rkey == desc->pi_ctx->sig_mr->rkey)) {
+ desc->pi_ctx->sig_mr_valid = 0;
++ } else {
++ iser_err("Bogus remote invalidation for rkey %#x\n", rkey);
++ return -EINVAL;
++ }
++
++ return 0;
+ }
+
+ static int
+@@ -626,12 +632,14 @@ iser_check_remote_inv(struct iser_conn *iser_conn,
+
+ if (iser_task->dir[ISER_DIR_IN]) {
+ desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+
+ if (iser_task->dir[ISER_DIR_OUT]) {
+ desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h;
+- iser_inv_desc(desc, rkey);
++ if (unlikely(iser_inv_desc(desc, rkey)))
++ return -EINVAL;
+ }
+ } else {
+ iser_err("failed to get task for itt=%d\n", hdr->itt);
+--
+2.20.1
+
--- /dev/null
+From 7e742cb33392d74211f533107274154081dcf704 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jun 2018 18:48:07 -0700
+Subject: IB/rxe: fixes for rdma read retry
+
+From: Vijay Immanuel <vijayi@attalasystems.com>
+
+[ Upstream commit 030e46e495af855a13964a0aab9753ea82a96edc ]
+
+When a read request is retried for the remaining partial
+data, the response may restart from read response first
+or read response only. So support those cases.
+
+Do not advance the comp psn beyond the current wqe's last_psn
+as that could skip over an entire read wqe and will cause the
+req_retry() logic to set an incorrect req psn.
+An example sequence is as follows:
+Write PSN 40 -- this is the current WQE.
+Read request PSN 41
+Write PSN 42
+Receive ACK PSN 42 -- this will complete the current WQE
+for PSN 40, and set the comp psn to 42 which is a problem
+because the read request at PSN 41 has been skipped over.
+So when req_retry() tries to retransmit the read request,
+it sets the req psn to 42 which is incorrect.
+
+When retrying a read request, calculate the number of psns
+completed based on the dma resid instead of the wqe first_psn.
+The wqe first_psn could have moved if the read request was
+retried multiple times.
+
+Set the reth length to the dma resid to handle read retries for
+the remaining partial data.
+
+Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_comp.c | 21 ++++++++++++++++-----
+ drivers/infiniband/sw/rxe/rxe_req.c | 15 +++++++++------
+ 2 files changed, 25 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
+index 83cfe44f070ec..fd9ce03dbd292 100644
+--- a/drivers/infiniband/sw/rxe/rxe_comp.c
++++ b/drivers/infiniband/sw/rxe/rxe_comp.c
+@@ -253,6 +253,17 @@ static inline enum comp_state check_ack(struct rxe_qp *qp,
+ case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE:
+ if (pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE &&
+ pkt->opcode != IB_OPCODE_RC_RDMA_READ_RESPONSE_LAST) {
++ /* read retries of partial data may restart from
++ * read response first or response only.
++ */
++ if ((pkt->psn == wqe->first_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_FIRST) ||
++ (wqe->first_psn == wqe->last_psn &&
++ pkt->opcode ==
++ IB_OPCODE_RC_RDMA_READ_RESPONSE_ONLY))
++ break;
++
+ return COMPST_ERROR;
+ }
+ break;
+@@ -501,11 +512,11 @@ static inline enum comp_state complete_wqe(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt,
+ struct rxe_send_wqe *wqe)
+ {
+- qp->comp.opcode = -1;
+-
+- if (pkt) {
+- if (psn_compare(pkt->psn, qp->comp.psn) >= 0)
+- qp->comp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ if (pkt && wqe->state == wqe_state_pending) {
++ if (psn_compare(wqe->last_psn, qp->comp.psn) >= 0) {
++ qp->comp.psn = (wqe->last_psn + 1) & BTH_PSN_MASK;
++ qp->comp.opcode = -1;
++ }
+
+ if (qp->req.wait_psn) {
+ qp->req.wait_psn = 0;
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 08ae4f3a6a379..9fd4f04df3b33 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -73,9 +73,6 @@ static void req_retry(struct rxe_qp *qp)
+ int npsn;
+ int first = 1;
+
+- wqe = queue_head(qp->sq.queue);
+- npsn = (qp->comp.psn - wqe->first_psn) & BTH_PSN_MASK;
+-
+ qp->req.wqe_index = consumer_index(qp->sq.queue);
+ qp->req.psn = qp->comp.psn;
+ qp->req.opcode = -1;
+@@ -107,11 +104,17 @@ static void req_retry(struct rxe_qp *qp)
+ if (first) {
+ first = 0;
+
+- if (mask & WR_WRITE_OR_SEND_MASK)
++ if (mask & WR_WRITE_OR_SEND_MASK) {
++ npsn = (qp->comp.psn - wqe->first_psn) &
++ BTH_PSN_MASK;
+ retry_first_write_send(qp, wqe, mask, npsn);
++ }
+
+- if (mask & WR_READ_MASK)
++ if (mask & WR_READ_MASK) {
++ npsn = (wqe->dma.length - wqe->dma.resid) /
++ qp->mtu;
+ wqe->iova += npsn * qp->mtu;
++ }
+ }
+
+ wqe->state = wqe_state_posted;
+@@ -435,7 +438,7 @@ static struct sk_buff *init_req_packet(struct rxe_qp *qp,
+ if (pkt->mask & RXE_RETH_MASK) {
+ reth_set_rkey(pkt, ibwr->wr.rdma.rkey);
+ reth_set_va(pkt, wqe->iova);
+- reth_set_len(pkt, wqe->dma.length);
++ reth_set_len(pkt, wqe->dma.resid);
+ }
+
+ if (pkt->mask & RXE_IMMDT_MASK)
+--
+2.20.1
+
--- /dev/null
+From 0fd8088f6448561a2493bfa573a6ce60f2ddab9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Aug 2018 11:12:19 +0200
+Subject: iio: adc: max9611: explicitly cast gain_selectors
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit b1ec0802503820ccbc894aadfd2a44da20232f5e ]
+
+After finding a reasonable gain, the function converts the configured
+gain to a gain configuration option selector enum max9611_csa_gain.
+Make the conversion clearly visible by using an explicit cast. This
+also avoids a warning seen with clang:
+ drivers/iio/adc/max9611.c:292:16: warning: implicit conversion from
+ enumeration type 'enum max9611_conf_ids' to different enumeration
+ type 'enum max9611_csa_gain' [-Wenum-conversion]
+ *csa_gain = gain_selectors[i];
+ ~ ^~~~~~~~~~~~~~~~~
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/max9611.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index c61fbf5602718..33be07c78b96f 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -289,7 +289,7 @@ static int max9611_read_csa_voltage(struct max9611_dev *max9611,
+ return ret;
+
+ if (*adc_raw > 0) {
+- *csa_gain = gain_selectors[i];
++ *csa_gain = (enum max9611_csa_gain)gain_selectors[i];
+ return 0;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 62830f8f7e6bd20a24114004facc6d5dda4a15d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Aug 2018 22:24:40 +0200
+Subject: iio: dac: mcp4922: fix error handling in mcp4922_write_raw
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit 0833627fc3f757a0dca11e2a9c46c96335a900ee ]
+
+Do not try to write negative values and make sure that the write goes well.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/mcp4922.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/dac/mcp4922.c b/drivers/iio/dac/mcp4922.c
+index 3854d201a5d6c..68dd0be1ac076 100644
+--- a/drivers/iio/dac/mcp4922.c
++++ b/drivers/iio/dac/mcp4922.c
+@@ -94,17 +94,22 @@ static int mcp4922_write_raw(struct iio_dev *indio_dev,
+ long mask)
+ {
+ struct mcp4922_state *state = iio_priv(indio_dev);
++ int ret;
+
+ if (val2 != 0)
+ return -EINVAL;
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (val > GENMASK(chan->scan_type.realbits-1, 0))
++ if (val < 0 || val > GENMASK(chan->scan_type.realbits - 1, 0))
+ return -EINVAL;
+ val <<= chan->scan_type.shift;
+- state->value[chan->channel] = val;
+- return mcp4922_spi_write(state, chan->channel, val);
++
++ ret = mcp4922_spi_write(state, chan->channel, val);
++ if (!ret)
++ state->value[chan->channel] = val;
++ return ret;
++
+ default:
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From ae71bab614b7893f4434e99ec0562591aaf8fcd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 12:26:47 +0800
+Subject: ip_gre: fix parsing gre header in ipgre_err
+
+From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+
+[ Upstream commit b0350d51f001e6edc13ee4f253b98b50b05dd401 ]
+
+gre_parse_header stops parsing when csum_err is encountered, which means
+tpi->key is undefined and ip_tunnel_lookup will return NULL improperly.
+
+This patch introduce a NULL pointer as csum_err parameter. Even when
+csum_err is encountered, it won't return error and continue parsing gre
+header as expected.
+
+Fixes: 9f57c67c379d ("gre: Remove support for sharing GRE protocol hook.")
+Reported-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/gre_demux.c | 7 ++++---
+ net/ipv4/ip_gre.c | 9 +++------
+ 2 files changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
+index b798862b6be5d..7efe740c06ebf 100644
+--- a/net/ipv4/gre_demux.c
++++ b/net/ipv4/gre_demux.c
+@@ -86,13 +86,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
+
+ options = (__be32 *)(greh + 1);
+ if (greh->flags & GRE_CSUM) {
+- if (skb_checksum_simple_validate(skb)) {
++ if (!skb_checksum_simple_validate(skb)) {
++ skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
++ null_compute_pseudo);
++ } else if (csum_err) {
+ *csum_err = true;
+ return -EINVAL;
+ }
+
+- skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
+- null_compute_pseudo);
+ options++;
+ }
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 71ff2531d973c..9940a59306b51 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -230,13 +230,10 @@ static void gre_err(struct sk_buff *skb, u32 info)
+ const int type = icmp_hdr(skb)->type;
+ const int code = icmp_hdr(skb)->code;
+ struct tnl_ptk_info tpi;
+- bool csum_err = false;
+
+- if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
+- iph->ihl * 4) < 0) {
+- if (!csum_err) /* ignore csum errors. */
+- return;
+- }
++ if (gre_parse_header(skb, &tpi, NULL, htons(ETH_P_IP),
++ iph->ihl * 4) < 0)
++ return;
+
+ if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+ ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+--
+2.20.1
+
--- /dev/null
+From be417bd399583007e1c725debc5c3448783ddcf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jun 2018 15:32:48 -0500
+Subject: ipmi:dmi: Ignore IPMI SMBIOS entries with a zero base address
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 1574608f5f4204440d6d9f52b971aba967664764 ]
+
+Looking at logs from systems all over the place, it looks like tons
+of broken systems exist that set the base address to zero. I can
+only guess that is some sort of non-standard idea to mark the
+interface as not being present. It can't be zero, anyway, so just
+complain and ignore it.
+
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_dmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c
+index c3a23ec3e76f7..a37d9794170cc 100644
+--- a/drivers/char/ipmi/ipmi_dmi.c
++++ b/drivers/char/ipmi/ipmi_dmi.c
+@@ -197,6 +197,10 @@ static void __init dmi_decode_ipmi(const struct dmi_header *dm)
+ slave_addr = data[DMI_IPMI_SLAVEADDR];
+
+ memcpy(&base_addr, data + DMI_IPMI_ADDR, sizeof(unsigned long));
++ if (!base_addr) {
++ pr_err("Base address is zero, assuming no IPMI interface\n");
++ return;
++ }
+ if (len >= DMI_IPMI_VER2_LENGTH) {
+ if (type == IPMI_DMI_TYPE_SSIF) {
+ offset = 0;
+--
+2.20.1
+
--- /dev/null
+From 66f67f063331f394c1159b24a80b2909de9e3384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 May 2018 14:13:18 +0200
+Subject: iwlwifi: api: annotate compressed BA notif array sizes
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6f68cc367ab6578a33cca21b6056804165621f00 ]
+
+Annotate the compressed BA notification array sizes and
+make both of them 0-length since the length of 1 is just
+confusing - it may be different than that and the offset
+to the second one needs to be calculated in the C code
+anyhow.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/api/tx.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+index 14ad9fb895f93..a9c8352a76418 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/tx.h
+@@ -722,9 +722,9 @@ enum iwl_mvm_ba_resp_flags {
+ * @tfd_cnt: number of TFD-Q elements
+ * @ra_tid_cnt: number of RATID-Q elements
+ * @tfd: array of TFD queue status updates. See &iwl_mvm_compressed_ba_tfd
+- * for details.
++ * for details. Length in @tfd_cnt.
+ * @ra_tid: array of RA-TID queue status updates. For debug purposes only. See
+- * &iwl_mvm_compressed_ba_ratid for more details.
++ * &iwl_mvm_compressed_ba_ratid for more details. Length in @ra_tid_cnt.
+ */
+ struct iwl_mvm_compressed_ba_notif {
+ __le32 flags;
+@@ -741,7 +741,7 @@ struct iwl_mvm_compressed_ba_notif {
+ __le32 tx_rate;
+ __le16 tfd_cnt;
+ __le16 ra_tid_cnt;
+- struct iwl_mvm_compressed_ba_tfd tfd[1];
++ struct iwl_mvm_compressed_ba_tfd tfd[0];
+ struct iwl_mvm_compressed_ba_ratid ra_tid[0];
+ } __packed; /* COMPRESSED_BA_RES_API_S_VER_4 */
+
+--
+2.20.1
+
--- /dev/null
+From 9b718550e1e1b63ace7dfeee5c912ea674ec430f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 May 2018 10:04:16 +0300
+Subject: iwlwifi: dbg: don't crash if the firmware crashes in the middle of a
+ debug dump
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 79f25b10c9da3dbc953e47033d0494e51580ac3b ]
+
+We can dump data from the firmware either when it crashes,
+or when the firmware is alive.
+Not all the data is available if the firmware is running
+(like the Tx / Rx FIFOs which are available only when the
+firmware is halted), so we first check that the firmware
+is alive to compute the required size for the dump and then
+fill the buffer with the data.
+
+When we allocate the buffer, we test the STATUS_FW_ERROR
+bit to check if the firmware is alive or not. This bit
+can be changed during the course of the dump since it is
+modified in the interrupt handler.
+
+We hit a case where we allocate the buffer while the
+firmware is sill working, and while we start to fill the
+buffer, the firmware crashes. Then we test STATUS_FW_ERROR
+again and decide to fill the buffer with data like the
+FIFOs even if no room was allocated for this data in the
+buffer. This means that we overflow the buffer that was
+allocated leading to memory corruption.
+
+To fix this, test the STATUS_FW_ERROR bit only once and
+rely on local variables to check if we should dump fifos
+or other firmware components.
+
+Fixes: 04fd2c28226f ("iwlwifi: mvm: add rxf and txf to dump data")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index e72c0b825420c..4650b9e5da2bc 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -775,7 +775,7 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt)
+ dump_data = iwl_fw_error_next_data(dump_data);
+
+ /* We only dump the FIFOs if the FW is in error state */
+- if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status)) {
++ if (fifo_data_len) {
+ iwl_fw_dump_fifos(fwrt, &dump_data);
+ if (radio_len)
+ iwl_read_radio_regs(fwrt, &dump_data);
+--
+2.20.1
+
--- /dev/null
+From c093d9c56a339dd70e74ce914777967bf2237ddf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Apr 2018 10:57:08 +0200
+Subject: iwlwifi: don't WARN on trying to dump dead firmware
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 84f260251ed8153e84c64eb2c5278ab18d3ddef6 ]
+
+There's no point in warning here, the user will just get an
+error back to the debugfs file write, and warning just makes
+it seem like there's an internal consistency problem when in
+reality the user just happened to hit this at a bad time.
+Remove the warning.
+
+Fixes: f45f979dc208 ("iwlwifi: mvm: disable dbg data collect when fw isn't alive")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 8390104172410..e72c0b825420c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -954,7 +954,7 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
+ * If the loading of the FW completed successfully, the next step is to
+ * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
+ * zero, the FW was already loaded successully. If the state is "NO_FW"
+- * in such a case - WARN and exit, since FW may be dead. Otherwise, we
++ * in such a case - exit, since FW may be dead. Otherwise, we
+ * can try to collect the data, since FW might just not be fully
+ * loaded (no "ALIVE" yet), and the debug data is accessible.
+ *
+@@ -962,9 +962,8 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
+ * config. In such a case, due to HW access problems, we might
+ * collect garbage.
+ */
+- if (WARN((fwrt->trans->state == IWL_TRANS_NO_FW) &&
+- fwrt->smem_cfg.num_lmacs,
+- "Can't collect dbg data when FW isn't alive\n"))
++ if (fwrt->trans->state == IWL_TRANS_NO_FW &&
++ fwrt->smem_cfg.num_lmacs)
+ return -EIO;
+
+ if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status))
+--
+2.20.1
+
--- /dev/null
+From c36e64e7514102f77eb00c7fc85cf2f7d5246a1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jun 2018 14:05:11 +0300
+Subject: iwlwifi: mvm: Allow TKIP for AP mode
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 6f3df8c1192c873a6ad9a76328920f6f85af90a8 ]
+
+Support for setting keys for TKIP cipher suite was mistakenly removed
+for AP mode. Fix this.
+
+Fixes: 85aeb58cec1a ("iwlwifi: mvm: Enable security on new TX API")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index d31d84eebc5d0..d16e2ed4419fe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -3067,10 +3067,6 @@ static int __iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
+
+ switch (keyconf->cipher) {
+ case WLAN_CIPHER_SUITE_TKIP:
+- if (vif->type == NL80211_IFTYPE_AP) {
+- ret = -EINVAL;
+- break;
+- }
+ addr = iwl_mvm_get_mac_addr(mvm, vif, sta);
+ /* get phase 1 key from mac80211 */
+ ieee80211_get_key_rx_seq(keyconf, 0, &seq);
+--
+2.20.1
+
--- /dev/null
+From 76a49a349aa1ad57f98082c4fb323d5b17efe8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 May 2018 15:12:08 +0300
+Subject: iwlwifi: mvm: avoid sending too many BARs
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 1a19c139be18ed4d6d681049cc48586fae070120 ]
+
+When we receive TX response, we may release a few packets
+due to a hole that was closed in the transmission window.
+
+However, if that frame failed, we will mark all the released
+frames as failed and will send multiple BARs.
+
+This affects statistics badly, and cause unnecessary frames
+transmission.
+
+Instead, mark all the following packets as success, with the
+desired result of sending a bar for the failed frame only.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index efef28012a6b9..ac1e05b93a9ad 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1378,6 +1378,14 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ break;
+ }
+
++ /*
++ * If we are freeing multiple frames, mark all the frames
++ * but the first one as acked, since they were acknowledged
++ * before
++ * */
++ if (skb_freed > 1)
++ info->flags |= IEEE80211_TX_STAT_ACK;
++
+ iwl_mvm_tx_status_check_trigger(mvm, status);
+
+ info->status.rates[0].count = tx_resp->failure_frame + 1;
+--
+2.20.1
+
--- /dev/null
+From 48cc2fab06117afa0e62cd3ae33b6b94d9aaa817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Jul 2018 17:52:47 +0000
+Subject: kernfs: Fix range checks in kernfs_get_target_path
+
+From: Bernd Edlinger <bernd.edlinger@hotmail.de>
+
+[ Upstream commit a75e78f21f9ad4b810868c89dbbabcc3931591ca ]
+
+The terminating NUL byte is only there because the buffer is
+allocated with kzalloc(PAGE_SIZE, GFP_KERNEL), but since the
+range-check is off-by-one, and PAGE_SIZE==PATH_MAX, the
+returned string may not be zero-terminated if it is exactly
+PATH_MAX characters long. Furthermore also the initial loop
+may theoretically exceed PATH_MAX and cause a fault.
+
+Signed-off-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/kernfs/symlink.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index 5145ae2f0572e..d273e3accade6 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -63,6 +63,9 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (base == kn)
+ break;
+
++ if ((s - path) + 3 >= PATH_MAX)
++ return -ENAMETOOLONG;
++
+ strcpy(s, "../");
+ s += 3;
+ base = base->parent;
+@@ -79,7 +82,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ if (len < 2)
+ return -EINVAL;
+ len--;
+- if ((s - path) + len > PATH_MAX)
++ if ((s - path) + len >= PATH_MAX)
+ return -ENAMETOOLONG;
+
+ /* reverse fillup of target string from target to base */
+--
+2.20.1
+
--- /dev/null
+From 61f6187396f100c842ee222ac2372435d1f2c887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 19:21:09 +0900
+Subject: kprobes: Don't call BUG_ON() if there is a kprobe in use on free list
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit cbdd96f5586151e48317d90a403941ec23f12660 ]
+
+Instead of calling BUG_ON(), if we find a kprobe in use on free kprobe
+list, just remove it from the list and keep it on kprobe hash list
+as same as other in-use kprobes.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/153666126882.21306.10738207224288507996.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kprobes.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index f7a4602a76f98..d0fe20a5475f7 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -544,8 +544,14 @@ static void do_free_cleaned_kprobes(void)
+ struct optimized_kprobe *op, *tmp;
+
+ list_for_each_entry_safe(op, tmp, &freeing_list, list) {
+- BUG_ON(!kprobe_unused(&op->kp));
+ list_del_init(&op->list);
++ if (WARN_ON_ONCE(!kprobe_unused(&op->kp))) {
++ /*
++ * This must not happen, but if there is a kprobe
++ * still in use, keep it on kprobes hash list.
++ */
++ continue;
++ }
+ free_aggr_kprobe(&op->kp);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From deee6063078440f3728f71d1498a69b4bcd3299c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 15:16:22 -0500
+Subject: libfdt: Ensure INT_MAX is defined in libfdt_env.h
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 53dd9dce6979bc54d64a3a09a2fb20187a025be7 ]
+
+The next update of libfdt has a new dependency on INT_MAX. Update the
+instances of libfdt_env.h in the kernel to either include the necessary
+header with the definition or define it locally.
+
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/libfdt_env.h | 2 ++
+ arch/powerpc/boot/libfdt_env.h | 2 ++
+ include/linux/libfdt_env.h | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/compressed/libfdt_env.h b/arch/arm/boot/compressed/libfdt_env.h
+index 07437816e0986..b36c0289a308e 100644
+--- a/arch/arm/boot/compressed/libfdt_env.h
++++ b/arch/arm/boot/compressed/libfdt_env.h
+@@ -6,6 +6,8 @@
+ #include <linux/string.h>
+ #include <asm/byteorder.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ typedef __be16 fdt16_t;
+ typedef __be32 fdt32_t;
+ typedef __be64 fdt64_t;
+diff --git a/arch/powerpc/boot/libfdt_env.h b/arch/powerpc/boot/libfdt_env.h
+index f52c31b1f48fa..39155d3b2cefa 100644
+--- a/arch/powerpc/boot/libfdt_env.h
++++ b/arch/powerpc/boot/libfdt_env.h
+@@ -5,6 +5,8 @@
+ #include <types.h>
+ #include <string.h>
+
++#define INT_MAX ((int)(~0U>>1))
++
+ #include "of.h"
+
+ typedef u32 uint32_t;
+diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h
+index 14997285e53d3..1aa707ab19bbf 100644
+--- a/include/linux/libfdt_env.h
++++ b/include/linux/libfdt_env.h
+@@ -2,6 +2,7 @@
+ #ifndef _LIBFDT_ENV_H
+ #define _LIBFDT_ENV_H
+
++#include <linux/kernel.h> /* For INT_MAX */
+ #include <linux/string.h>
+
+ #include <asm/byteorder.h>
+--
+2.20.1
+
--- /dev/null
+From 3b79605506ec06c06f7958f48c2118720d3f8dfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 11:32:55 -0700
+Subject: liquidio: fix race condition in instruction completion processing
+
+From: Rick Farrington <ricardo.farrington@cavium.com>
+
+[ Upstream commit b943f17e06493fd2c7fd00743093ad5dcdb90e7f ]
+
+In lio_enable_irq, the pkt_in_done count register was being cleared to
+zero. However, there could be some completed instructions which were not
+yet processed due to budget and limit constraints.
+So, only write this register with the number of actual completions
+that were processed.
+
+Signed-off-by: Rick Farrington <ricardo.farrington@cavium.com>
+Signed-off-by: Felix Manlunas <felix.manlunas@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cavium/liquidio/octeon_device.c | 5 +++--
+ drivers/net/ethernet/cavium/liquidio/octeon_iq.h | 2 ++
+ drivers/net/ethernet/cavium/liquidio/request_manager.c | 2 ++
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_device.c b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+index 29d53b1763a72..2a9c925376cc1 100644
+--- a/drivers/net/ethernet/cavium/liquidio/octeon_device.c
++++ b/drivers/net/ethernet/cavium/liquidio/octeon_device.c
+@@ -1444,8 +1444,9 @@ void lio_enable_irq(struct octeon_droq *droq, struct octeon_instr_queue *iq)
+ }
+ if (iq) {
+ spin_lock_bh(&iq->lock);
+- writel(iq->pkt_in_done, iq->inst_cnt_reg);
+- iq->pkt_in_done = 0;
++ writel(iq->pkts_processed, iq->inst_cnt_reg);
++ iq->pkt_in_done -= iq->pkts_processed;
++ iq->pkts_processed = 0;
+ /* this write needs to be flushed before we release the lock */
+ mmiowb();
+ spin_unlock_bh(&iq->lock);
+diff --git a/drivers/net/ethernet/cavium/liquidio/octeon_iq.h b/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
+index 5c3c8da976f73..1860603452ee7 100644
+--- a/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
++++ b/drivers/net/ethernet/cavium/liquidio/octeon_iq.h
+@@ -84,6 +84,8 @@ struct octeon_instr_queue {
+
+ u32 pkt_in_done;
+
++ u32 pkts_processed;
++
+ /** A spinlock to protect access to the input ring.*/
+ spinlock_t iq_flush_running_lock;
+
+diff --git a/drivers/net/ethernet/cavium/liquidio/request_manager.c b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+index 55e8731264634..0ea623768783e 100644
+--- a/drivers/net/ethernet/cavium/liquidio/request_manager.c
++++ b/drivers/net/ethernet/cavium/liquidio/request_manager.c
+@@ -122,6 +122,7 @@ int octeon_init_instr_queue(struct octeon_device *oct,
+ iq->do_auto_flush = 1;
+ iq->db_timeout = (u32)conf->db_timeout;
+ atomic_set(&iq->instr_pending, 0);
++ iq->pkts_processed = 0;
+
+ /* Initialize the spinlock for this instruction queue */
+ spin_lock_init(&iq->lock);
+@@ -474,6 +475,7 @@ octeon_flush_iq(struct octeon_device *oct, struct octeon_instr_queue *iq,
+ lio_process_iq_request_list(oct, iq, 0);
+
+ if (inst_processed) {
++ iq->pkts_processed += inst_processed;
+ atomic_sub(inst_processed, &iq->instr_pending);
+ iq->stats.instr_processed += inst_processed;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7092b142b874f161ab8ca3bb22cf69bb7c91fa0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 11:42:06 -0700
+Subject: llc: avoid blocking in llc_sap_close()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 9708d2b5b7c648e8e0a40d11e8cea12f6277f33c ]
+
+llc_sap_close() is called by llc_sap_put() which
+could be called in BH context in llc_rcv(). We can't
+block in BH.
+
+There is no reason to block it here, kfree_rcu() should
+be sufficient.
+
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/llc.h | 1 +
+ net/llc/llc_core.c | 4 +---
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/llc.h b/include/net/llc.h
+index 890a87318014d..df282d9b40170 100644
+--- a/include/net/llc.h
++++ b/include/net/llc.h
+@@ -66,6 +66,7 @@ struct llc_sap {
+ int sk_count;
+ struct hlist_nulls_head sk_laddr_hash[LLC_SK_LADDR_HASH_ENTRIES];
+ struct hlist_head sk_dev_hash[LLC_SK_DEV_HASH_ENTRIES];
++ struct rcu_head rcu;
+ };
+
+ static inline
+diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
+index 260b3dc1b4a2a..64d4bef04e730 100644
+--- a/net/llc/llc_core.c
++++ b/net/llc/llc_core.c
+@@ -127,9 +127,7 @@ void llc_sap_close(struct llc_sap *sap)
+ list_del_rcu(&sap->node);
+ spin_unlock_bh(&llc_sap_list_lock);
+
+- synchronize_rcu();
+-
+- kfree(sap);
++ kfree_rcu(sap, rcu);
+ }
+
+ static struct packet_type llc_packet_type __read_mostly = {
+--
+2.20.1
+
--- /dev/null
+From e7811da077f126b3c122c6ec735cf7c316f766ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 17:07:49 -0400
+Subject: media: au0828: Fix incorrect error messages
+
+From: Brad Love <brad@nextdimension.cc>
+
+[ Upstream commit f347596f2bf114a3af3d80201c6e6bef538d884f ]
+
+Correcting red herring error messages.
+
+Where appropriate, replaces au0282_dev_register with:
+- au0828_analog_register
+- au0828_dvb_register
+
+Signed-off-by: Brad Love <brad@nextdimension.cc>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/au0828/au0828-core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index e3f63299f85c0..07e3322bb1827 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -632,7 +632,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Analog TV */
+ retval = au0828_analog_register(dev, interface);
+ if (retval) {
+- pr_err("%s() au0282_dev_register failed to register on V4L2\n",
++ pr_err("%s() au0828_analog_register failed to register on V4L2\n",
+ __func__);
+ mutex_unlock(&dev->lock);
+ goto done;
+@@ -641,7 +641,7 @@ static int au0828_usb_probe(struct usb_interface *interface,
+ /* Digital TV */
+ retval = au0828_dvb_register(dev);
+ if (retval)
+- pr_err("%s() au0282_dev_register failed\n",
++ pr_err("%s() au0828_dvb_register failed\n",
+ __func__);
+
+ /* Remote controller */
+--
+2.20.1
+
--- /dev/null
+From 9d25092db846a54497a76cba07439a265bcc1576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 02:16:15 -0400
+Subject: media: davinci: Fix implicit enum conversion warning
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4158757395b300b6eb308fc20b96d1d231484413 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/media/platform/davinci/vpbe_display.c:524:24: warning: implicit
+conversion from enumeration type 'enum osd_v_exp_ratio' to different
+enumeration type 'enum osd_h_exp_ratio' [-Wenum-conversion]
+ layer_info->h_exp = V_EXP_6_OVER_5;
+ ~ ^~~~~~~~~~~~~~
+1 warning generated.
+
+This appears to be a copy and paste error judging from the couple of
+lines directly above this statement and the way that height is handled
+in the if block above this one.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe_display.c b/drivers/media/platform/davinci/vpbe_display.c
+index 13d027031ff04..82b06cc48bd16 100644
+--- a/drivers/media/platform/davinci/vpbe_display.c
++++ b/drivers/media/platform/davinci/vpbe_display.c
+@@ -518,7 +518,7 @@ vpbe_disp_calculate_scale_factor(struct vpbe_display *disp_dev,
+ else if (v_scale == 4)
+ layer_info->v_zoom = ZOOM_X4;
+ if (v_exp)
+- layer_info->h_exp = V_EXP_6_OVER_5;
++ layer_info->v_exp = V_EXP_6_OVER_5;
+ } else {
+ /* no scaling, only cropping. Set display area to crop area */
+ cfg->ysize = expected_ysize;
+--
+2.20.1
+
--- /dev/null
+From 7171b932d524571879827c743e9636c32677bc79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jun 2018 09:48:07 -0400
+Subject: media: dt-bindings: adv748x: Fix decimal unit addresses
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 27582f0ea97fe3e4a38beb98ab36cce4b6f029d5 ]
+
+With recent dtc and W=1:
+
+ Warning (graph_port): video-receiver@70/port@10: graph node unit address error, expected "a"
+ Warning (graph_port): video-receiver@70/port@11: graph node unit address error, expected "b"
+
+Unit addresses are always hexadecimal (without prefix), while the bases
+of reg property values depend on their prefixes.
+
+Fixes: e69595170b1cad85 ("media: adv748x: Add adv7481, adv7482 bindings")
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/media/i2c/adv748x.txt | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/media/i2c/adv748x.txt b/Documentation/devicetree/bindings/media/i2c/adv748x.txt
+index 21ffb5ed81830..54d1d3bc18694 100644
+--- a/Documentation/devicetree/bindings/media/i2c/adv748x.txt
++++ b/Documentation/devicetree/bindings/media/i2c/adv748x.txt
+@@ -73,7 +73,7 @@ Example:
+ };
+ };
+
+- port@10 {
++ port@a {
+ reg = <10>;
+
+ adv7482_txa: endpoint {
+@@ -83,7 +83,7 @@ Example:
+ };
+ };
+
+- port@11 {
++ port@b {
+ reg = <11>;
+
+ adv7482_txb: endpoint {
+--
+2.20.1
+
--- /dev/null
+From 913421938ae3ec043bd25e03d4575cfe2312b3b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 15:56:21 -0400
+Subject: media: dvb: fix compat ioctl translation
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24 ]
+
+The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but
+it never worked because the command number is wrong.
+
+Using the right command number means we have a better chance of them
+actually doing the right thing, though clearly nobody has ever tried
+it successfully.
+
+I noticed these while auditing the remaining users of compat_time_t
+for y2038 bugs. This one is fine in that regard, it just never did
+anything.
+
+Fixes: 6e87abd0b8cb ("[DVB]: Add compat ioctl handling.")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/compat_ioctl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index ea52b98b39fa1..033e8e6aabb77 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -161,6 +161,7 @@ struct compat_video_event {
+ unsigned int frame_rate;
+ } u;
+ };
++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event)
+
+ static int do_video_get_event(struct file *file,
+ unsigned int cmd, struct compat_video_event __user *up)
+@@ -172,7 +173,7 @@ static int do_video_get_event(struct file *file,
+ if (kevent == NULL)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long)kevent);
++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent);
+ if (!err) {
+ err = convert_in_user(&kevent->type, &up->type);
+ err |= convert_in_user(&kevent->timestamp, &up->timestamp);
+@@ -191,6 +192,7 @@ struct compat_video_still_picture {
+ compat_uptr_t iFrame;
+ int32_t size;
+ };
++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture)
+
+ static int do_video_stillpicture(struct file *file,
+ unsigned int cmd, struct compat_video_still_picture __user *up)
+@@ -213,7 +215,7 @@ static int do_video_stillpicture(struct file *file,
+ if (err)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long) up_native);
++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native);
+
+ return err;
+ }
+@@ -1476,9 +1478,9 @@ static long do_ioctl_trans(unsigned int cmd,
+ return rtc_ioctl(file, cmd, argp);
+
+ /* dvb */
+- case VIDEO_GET_EVENT:
++ case VIDEO_GET_EVENT32:
+ return do_video_get_event(file, cmd, argp);
+- case VIDEO_STILLPICTURE:
++ case VIDEO_STILLPICTURE32:
+ return do_video_stillpicture(file, cmd, argp);
+ case VIDEO_SET_SPU_PALETTE:
+ return do_video_set_spu_palette(file, cmd, argp);
+--
+2.20.1
+
--- /dev/null
+From 9c0a218a9332d8246ace849ae36201c6b85491f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jul 2018 08:15:53 -0400
+Subject: media: fix: media: pci: meye: validate offset to avoid arbitrary
+ access
+
+From: Lao Wei <zrlw@qq.com>
+
+[ Upstream commit eac7230fdb4672c2cb56f6a01a1744f562c01f80 ]
+
+Motion eye video4linux driver for Sony Vaio PictureBook desn't validate user-controlled parameter
+'vma->vm_pgoff', a malicious process might access all of kernel memory from user space by trying
+pass different arbitrary address.
+Discussion: http://www.openwall.com/lists/oss-security/2018/07/06/1
+
+Signed-off-by: Lao Wei <zrlw@qq.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/meye/meye.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/meye/meye.c b/drivers/media/pci/meye/meye.c
+index 49e047e4a81ee..926707c997acb 100644
+--- a/drivers/media/pci/meye/meye.c
++++ b/drivers/media/pci/meye/meye.c
+@@ -1460,7 +1460,7 @@ static int meye_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long page, pos;
+
+ mutex_lock(&meye.lock);
+- if (size > gbuffers * gbufsize) {
++ if (size > gbuffers * gbufsize || offset > gbuffers * gbufsize - size) {
+ mutex_unlock(&meye.lock);
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 423171050802656bd97bfc2a8f21bb093e92dbbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Sep 2018 07:44:09 -0400
+Subject: media: pci: ivtv: Fix a sleep-in-atomic-context bug in
+ ivtv_yuv_init()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 8d11eb847de7d89c2754988c944d51a4f63e219b ]
+
+The driver may sleep in a interrupt handler.
+
+The function call paths (from bottom to top) in Linux-4.16 are:
+
+[FUNC] kzalloc(GFP_KERNEL)
+drivers/media/pci/ivtv/ivtv-yuv.c, 938:
+ kzalloc in ivtv_yuv_init
+drivers/media/pci/ivtv/ivtv-yuv.c, 960:
+ ivtv_yuv_init in ivtv_yuv_next_free
+drivers/media/pci/ivtv/ivtv-yuv.c, 1126:
+ ivtv_yuv_next_free in ivtv_yuv_setup_stream_frame
+drivers/media/pci/ivtv/ivtv-irq.c, 827:
+ ivtv_yuv_setup_stream_frame in ivtv_irq_dec_data_req
+drivers/media/pci/ivtv/ivtv-irq.c, 1013:
+ ivtv_irq_dec_data_req in ivtv_irq_handler
+
+To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
+
+This bug is found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-yuv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-yuv.c b/drivers/media/pci/ivtv/ivtv-yuv.c
+index 44936d6d7c396..1380474519f2b 100644
+--- a/drivers/media/pci/ivtv/ivtv-yuv.c
++++ b/drivers/media/pci/ivtv/ivtv-yuv.c
+@@ -935,7 +935,7 @@ static void ivtv_yuv_init(struct ivtv *itv)
+ }
+
+ /* We need a buffer for blanking when Y plane is offset - non-fatal if we can't get one */
+- yi->blanking_ptr = kzalloc(720 * 16, GFP_KERNEL|__GFP_NOWARN);
++ yi->blanking_ptr = kzalloc(720 * 16, GFP_ATOMIC|__GFP_NOWARN);
+ if (yi->blanking_ptr) {
+ yi->blanking_dmaptr = pci_map_single(itv->pdev, yi->blanking_ptr, 720*16, PCI_DMA_TODEVICE);
+ } else {
+--
+2.20.1
+
--- /dev/null
+From fc6253b97d7aa014fceef4a2e2444de4d2e625b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Aug 2018 22:20:23 +0300
+Subject: MIPS: BCM47XX: Enable USB power on Netgear WNDR3400v3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+
+[ Upstream commit feef7918667b84f9d5653c501542dd8d84ae32af ]
+
+Setting GPIO 21 high seems to be required to enable power to USB ports
+on the WNDR3400v3. As there is already similar code for WNR3500L,
+make the existing USB power GPIO code generic and use that.
+
+Signed-off-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20259/
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm47xx/workarounds.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/workarounds.c b/arch/mips/bcm47xx/workarounds.c
+index 1a8a07e7a5633..46eddbec8d9fd 100644
+--- a/arch/mips/bcm47xx/workarounds.c
++++ b/arch/mips/bcm47xx/workarounds.c
+@@ -5,9 +5,8 @@
+ #include <bcm47xx_board.h>
+ #include <bcm47xx.h>
+
+-static void __init bcm47xx_workarounds_netgear_wnr3500l(void)
++static void __init bcm47xx_workarounds_enable_usb_power(int usb_power)
+ {
+- const int usb_power = 12;
+ int err;
+
+ err = gpio_request_one(usb_power, GPIOF_OUT_INIT_HIGH, "usb_power");
+@@ -23,7 +22,10 @@ void __init bcm47xx_workarounds(void)
+
+ switch (board) {
+ case BCM47XX_BOARD_NETGEAR_WNR3500L:
+- bcm47xx_workarounds_netgear_wnr3500l();
++ bcm47xx_workarounds_enable_usb_power(12);
++ break;
++ case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
++ bcm47xx_workarounds_enable_usb_power(21);
+ break;
+ default:
+ /* No workaround(s) needed */
+--
+2.20.1
+
--- /dev/null
+From 1d2da1edd3024bfa4fe1c72c363624db915b4e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:49:23 -0700
+Subject: MIPS: kexec: Relax memory restriction
+
+From: Dengcheng Zhu <dzhu@wavecomp.com>
+
+[ Upstream commit a6da4d6fdf8bd512c98d3ac7f1d16bc4bb282919 ]
+
+We can rely on the system kernel and the dump capture kernel themselves in
+memory usage.
+
+Being restrictive with 512MB limit may cause kexec tool failure on some
+platforms.
+
+Tested-by: Rachel Mozes <rachel.mozes@intel.com>
+Reported-by: Rachel Mozes <rachel.mozes@intel.com>
+Signed-off-by: Dengcheng Zhu <dzhu@wavecomp.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20568/
+Cc: pburton@wavecomp.com
+Cc: ralf@linux-mips.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/kexec.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/include/asm/kexec.h b/arch/mips/include/asm/kexec.h
+index 493a3cc7c39ad..cfdbe66575f4d 100644
+--- a/arch/mips/include/asm/kexec.h
++++ b/arch/mips/include/asm/kexec.h
+@@ -12,11 +12,11 @@
+ #include <asm/stacktrace.h>
+
+ /* Maximum physical address we can use pages from */
+-#define KEXEC_SOURCE_MEMORY_LIMIT (0x20000000)
++#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can reach in physical address mode */
+-#define KEXEC_DESTINATION_MEMORY_LIMIT (0x20000000)
++#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+ /* Maximum address we can use for the control code buffer */
+-#define KEXEC_CONTROL_MEMORY_LIMIT (0x20000000)
++#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+ /* Reserve 3*4096 bytes for board-specific info */
+ #define KEXEC_CONTROL_PAGE_SIZE (4096 + 3*4096)
+
+--
+2.20.1
+
--- /dev/null
+From 78123a79f3c0d96ebc1cd7109bfde80336ff65c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Sep 2018 22:16:42 +0200
+Subject: MIPS: lantiq: Do not enable IRQs in dma open
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+[ Upstream commit cc973aecf0b0541918c5ecabe6c90d1f709b5f89 ]
+
+When a DMA channel is opened the IRQ should not get activated
+automatically, this allows it to pull data out manually without the help
+of interrupts. This is needed for a workaround in the vrx200 Ethernet
+driver.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Acked-by: Paul Burton <paul.burton@mips.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/dma.c | 1 -
+ drivers/net/ethernet/lantiq_etop.c | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
+index 805b3a6ab2d60..dcc16d8de8c37 100644
+--- a/arch/mips/lantiq/xway/dma.c
++++ b/arch/mips/lantiq/xway/dma.c
+@@ -106,7 +106,6 @@ ltq_dma_open(struct ltq_dma_channel *ch)
+ spin_lock_irqsave(<q_dma_lock, flag);
+ ltq_dma_w32(ch->nr, LTQ_DMA_CS);
+ ltq_dma_w32_mask(0, DMA_CHAN_ON, LTQ_DMA_CCTRL);
+- ltq_dma_w32_mask(0, 1 << ch->nr, LTQ_DMA_IRNEN);
+ spin_unlock_irqrestore(<q_dma_lock, flag);
+ }
+ EXPORT_SYMBOL_GPL(ltq_dma_open);
+diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
+index afc8100694405..c978a857a25c2 100644
+--- a/drivers/net/ethernet/lantiq_etop.c
++++ b/drivers/net/ethernet/lantiq_etop.c
+@@ -438,6 +438,7 @@ ltq_etop_open(struct net_device *dev)
+ if (!IS_TX(i) && (!IS_RX(i)))
+ continue;
+ ltq_dma_open(&ch->dma);
++ ltq_dma_enable_irq(&ch->dma);
+ napi_enable(&ch->napi);
+ }
+ phy_start(dev->phydev);
+--
+2.20.1
+
--- /dev/null
+From 46ff2e6f8586f3ffdf2256b6a42ecd228d49de30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 12:19:19 +0800
+Subject: mips: txx9: fix iounmap related issue
+
+From: Ding Xiang <dingxiang@cmss.chinamobile.com>
+
+[ Upstream commit c6e1241a82e6e74d1ae5cc34581dab2ffd6022d0 ]
+
+if device_register return error, iounmap should be called, also iounmap
+need to call before put_device.
+
+Signed-off-by: Ding Xiang <dingxiang@cmss.chinamobile.com>
+Reviewed-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20476/
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/txx9/generic/setup.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/txx9/generic/setup.c b/arch/mips/txx9/generic/setup.c
+index 1791a44ee570a..20aaf77166e85 100644
+--- a/arch/mips/txx9/generic/setup.c
++++ b/arch/mips/txx9/generic/setup.c
+@@ -959,12 +959,11 @@ void __init txx9_sramc_init(struct resource *r)
+ goto exit_put;
+ err = sysfs_create_bin_file(&dev->dev.kobj, &dev->bindata_attr);
+ if (err) {
+- device_unregister(&dev->dev);
+ iounmap(dev->base);
+- kfree(dev);
++ device_unregister(&dev->dev);
+ }
+ return;
+ exit_put:
++ iounmap(dev->base);
+ put_device(&dev->dev);
+- return;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0505747f306d27f1bdaa163990481ab31638e5f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 10:29:13 +0800
+Subject: misc: genwqe: should return proper error value.
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit 02241995b004faa7d9ff628e97f24056190853f8 ]
+
+The function should return -EFAULT when copy_from_user fails. Even
+though the caller does not distinguish them. but we should keep backward
+compatibility.
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/genwqe/card_utils.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index cb12409851575..f55e6e822bea4 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -298,7 +298,7 @@ static int genwqe_sgl_size(int num_pages)
+ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ void __user *user_addr, size_t user_size)
+ {
+- int rc;
++ int ret = -ENOMEM;
+ struct pci_dev *pci_dev = cd->pci_dev;
+
+ sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
+@@ -317,7 +317,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (get_order(sgl->sgl_size) > MAX_ORDER) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: too much memory requested!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
+@@ -325,7 +325,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ if (sgl->sgl == NULL) {
+ dev_err(&pci_dev->dev,
+ "[%s] err: no memory available!\n", __func__);
+- return -ENOMEM;
++ return ret;
+ }
+
+ /* Only use buffering on incomplete pages */
+@@ -338,7 +338,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->fpage + sgl->fpage_offs,
+ user_addr, sgl->fpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out;
+ }
+ }
+@@ -351,7 +351,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ /* Sync with user memory */
+ if (copy_from_user(sgl->lpage, user_addr + user_size -
+ sgl->lpage_size, sgl->lpage_size)) {
+- rc = -EFAULT;
++ ret = -EFAULT;
+ goto err_out2;
+ }
+ }
+@@ -373,7 +373,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+ sgl->sgl = NULL;
+ sgl->sgl_dma_addr = 0;
+ sgl->sgl_size = 0;
+- return -ENOMEM;
++
++ return ret;
+ }
+
+ int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
+--
+2.20.1
+
--- /dev/null
+From ba125f7c01dadb5402111fbe314d97b06db680f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:44:03 -0700
+Subject: misc: kgdbts: Fix restrict error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laura Abbott <labbott@redhat.com>
+
+[ Upstream commit fa0218ef733e6f247a1a3986e3eb12460064ac77 ]
+
+kgdbts current fails when compiled with restrict:
+
+drivers/misc/kgdbts.c: In function ‘configure_kgdbts’:
+drivers/misc/kgdbts.c:1070:2: error: ‘strcpy’ source argument is the same as destination [-Werror=restrict]
+ strcpy(config, opt);
+ ^~~~~~~~~~~~~~~~~~~
+
+As the error says, config is being used in both the source and destination.
+Refactor the code to avoid the extra copy and put the parsing closer to
+the actual location.
+
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/kgdbts.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
+index 94cbc5c98cae6..05824ff6b9168 100644
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -981,6 +981,12 @@ static void kgdbts_run_tests(void)
+ int nmi_sleep = 0;
+ int i;
+
++ verbose = 0;
++ if (strstr(config, "V1"))
++ verbose = 1;
++ if (strstr(config, "V2"))
++ verbose = 2;
++
+ ptr = strchr(config, 'F');
+ if (ptr)
+ fork_test = simple_strtol(ptr + 1, NULL, 10);
+@@ -1064,13 +1070,6 @@ static int kgdbts_option_setup(char *opt)
+ return -ENOSPC;
+ }
+ strcpy(config, opt);
+-
+- verbose = 0;
+- if (strstr(config, "V1"))
+- verbose = 1;
+- if (strstr(config, "V2"))
+- verbose = 2;
+-
+ return 0;
+ }
+
+@@ -1082,9 +1081,6 @@ static int configure_kgdbts(void)
+
+ if (!strlen(config) || isspace(config[0]))
+ goto noconfig;
+- err = kgdbts_option_setup(config);
+- if (err)
+- goto noconfig;
+
+ final_ack = 0;
+ run_plant_and_detach_test(1);
+--
+2.20.1
+
--- /dev/null
+From 20587b3c149b2962822f6dd9b61556315f362e3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 09:21:24 +0300
+Subject: mlxsw: spectrum: Init shaper for TCs 8..15
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit a9f36656b519a9a21309793c306941a3cd0eeb8f ]
+
+With introduction of MC-aware mode to mlxsw, it became necessary to
+configure TCs above 7 as well. There is now code in mlxsw to disable ETS
+for these higher classes, but disablement of max shaper was neglected.
+
+By default, max shaper is currently disabled to begin with, so the
+problem is just cosmetic. However, for symmetry, do like we do for ETS
+configuration, and call mlxsw_sp_port_ets_maxrate_set() for both TC i
+and i + 8.
+
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+index a909aa315a92a..226187cba0e81 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2825,6 +2825,13 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
+ MLXSW_REG_QEEC_MAS_DIS);
+ if (err)
+ return err;
++
++ err = mlxsw_sp_port_ets_maxrate_set(mlxsw_sp_port,
++ MLXSW_REG_QEEC_HIERARCY_TC,
++ i + 8, i,
++ MLXSW_REG_QEEC_MAS_DIS);
++ if (err)
++ return err;
+ }
+
+ /* Map all priorities to traffic class 0. */
+--
+2.20.1
+
--- /dev/null
+From 9cdb1222f48c88797a19788ae20067b5038b5c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:50:17 +0800
+Subject: net: amd: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit fe72352e37ae8478f4c97975a9831f0c50f22e73 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/am79c961a.c | 2 +-
+ drivers/net/ethernet/amd/atarilance.c | 6 ++++--
+ drivers/net/ethernet/amd/declance.c | 2 +-
+ drivers/net/ethernet/amd/sun3lance.c | 6 ++++--
+ drivers/net/ethernet/amd/sunlance.c | 2 +-
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 4 ++--
+ 6 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/am79c961a.c b/drivers/net/ethernet/amd/am79c961a.c
+index b11e910850f7f..78d1e5385a3ee 100644
+--- a/drivers/net/ethernet/amd/am79c961a.c
++++ b/drivers/net/ethernet/amd/am79c961a.c
+@@ -440,7 +440,7 @@ static void am79c961_timeout(struct net_device *dev)
+ /*
+ * Transmit a packet
+ */
+-static int
++static netdev_tx_t
+ am79c961_sendpacket(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct dev_priv *priv = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c
+index c5b81268c2849..d3d44e07afbc0 100644
+--- a/drivers/net/ethernet/amd/atarilance.c
++++ b/drivers/net/ethernet/amd/atarilance.c
+@@ -339,7 +339,8 @@ static unsigned long lance_probe1( struct net_device *dev, struct lance_addr
+ *init_rec );
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id );
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -769,7 +770,8 @@ static void lance_tx_timeout (struct net_device *dev)
+
+ /* XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX */
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ struct lance_ioreg *IO = lp->iobase;
+diff --git a/drivers/net/ethernet/amd/declance.c b/drivers/net/ethernet/amd/declance.c
+index c7cde58feaf7a..290d070b293bf 100644
+--- a/drivers/net/ethernet/amd/declance.c
++++ b/drivers/net/ethernet/amd/declance.c
+@@ -893,7 +893,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ volatile struct lance_regs *ll = lp->ll;
+diff --git a/drivers/net/ethernet/amd/sun3lance.c b/drivers/net/ethernet/amd/sun3lance.c
+index 77b1db2677309..da7e3d4f41661 100644
+--- a/drivers/net/ethernet/amd/sun3lance.c
++++ b/drivers/net/ethernet/amd/sun3lance.c
+@@ -236,7 +236,8 @@ struct lance_private {
+ static int lance_probe( struct net_device *dev);
+ static int lance_open( struct net_device *dev );
+ static void lance_init_ring( struct net_device *dev );
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev );
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t lance_interrupt( int irq, void *dev_id);
+ static int lance_rx( struct net_device *dev );
+ static int lance_close( struct net_device *dev );
+@@ -511,7 +512,8 @@ static void lance_init_ring( struct net_device *dev )
+ }
+
+
+-static int lance_start_xmit( struct sk_buff *skb, struct net_device *dev )
++static netdev_tx_t
++lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, len;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 9845e07d40cd3..1a44c8c26b8a1 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1106,7 +1106,7 @@ static void lance_tx_timeout(struct net_device *dev)
+ netif_wake_queue(dev);
+ }
+
+-static int lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t lance_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct lance_private *lp = netdev_priv(dev);
+ int entry, skblen, len;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 75c4455e22717..c65d2cdcc7cfb 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1964,7 +1964,7 @@ static int xgbe_close(struct net_device *netdev)
+ return 0;
+ }
+
+-static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct xgbe_prv_data *pdata = netdev_priv(netdev);
+ struct xgbe_hw_if *hw_if = &pdata->hw_if;
+@@ -1973,7 +1973,7 @@ static int xgbe_xmit(struct sk_buff *skb, struct net_device *netdev)
+ struct xgbe_ring *ring;
+ struct xgbe_packet_data *packet;
+ struct netdev_queue *txq;
+- int ret;
++ netdev_tx_t ret;
+
+ DBGPR("-->xgbe_xmit: skb->len = %d\n", skb->len);
+
+--
+2.20.1
+
--- /dev/null
+From b0f15ba27dc059091f7e32fecd692a96c95afa2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:45:12 +0800
+Subject: net: broadcom: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0c13b8d1aee87c35a2fbc1d85a1f766227cf54b5 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcm63xx_enet.c | 5 +++--
+ drivers/net/ethernet/broadcom/sb1250-mac.c | 4 ++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+index 68470c7c630a8..35eb0119b0151 100644
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -571,12 +571,13 @@ static irqreturn_t bcm_enet_isr_dma(int irq, void *dev_id)
+ /*
+ * tx request callback
+ */
+-static int bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bcm_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bcm_enet_priv *priv;
+ struct bcm_enet_desc *desc;
+ u32 len_stat;
+- int ret;
++ netdev_tx_t ret;
+
+ priv = netdev_priv(dev);
+
+diff --git a/drivers/net/ethernet/broadcom/sb1250-mac.c b/drivers/net/ethernet/broadcom/sb1250-mac.c
+index ecdef42f0ae63..00230fe097d94 100644
+--- a/drivers/net/ethernet/broadcom/sb1250-mac.c
++++ b/drivers/net/ethernet/broadcom/sb1250-mac.c
+@@ -299,7 +299,7 @@ static enum sbmac_state sbmac_set_channel_state(struct sbmac_softc *,
+ static void sbmac_promiscuous_mode(struct sbmac_softc *sc, int onoff);
+ static uint64_t sbmac_addr2reg(unsigned char *ptr);
+ static irqreturn_t sbmac_intr(int irq, void *dev_instance);
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev);
+ static void sbmac_setmulti(struct sbmac_softc *sc);
+ static int sbmac_init(struct platform_device *pldev, long long base);
+ static int sbmac_set_speed(struct sbmac_softc *s, enum sbmac_speed speed);
+@@ -2028,7 +2028,7 @@ static irqreturn_t sbmac_intr(int irq,void *dev_instance)
+ * Return value:
+ * nothing
+ ********************************************************************* */
+-static int sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t sbmac_start_tx(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sbmac_softc *sc = netdev_priv(dev);
+ unsigned long flags;
+--
+2.20.1
+
--- /dev/null
+From dfafecc73ff3934d5536bfab06efee5cf0876171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:13:05 +0800
+Subject: net: faraday: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0a715156656bddf4aa92d9868f850aeeb0465fd0 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/faraday/ftgmac100.c | 4 ++--
+ drivers/net/ethernet/faraday/ftmac100.c | 7 ++++---
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
+index bfda315a3f1b1..a1baddcd67993 100644
+--- a/drivers/net/ethernet/faraday/ftgmac100.c
++++ b/drivers/net/ethernet/faraday/ftgmac100.c
+@@ -707,8 +707,8 @@ static bool ftgmac100_prep_tx_csum(struct sk_buff *skb, u32 *csum_vlan)
+ return skb_checksum_help(skb) == 0;
+ }
+
+-static int ftgmac100_hard_start_xmit(struct sk_buff *skb,
+- struct net_device *netdev)
++static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
++ struct net_device *netdev)
+ {
+ struct ftgmac100 *priv = netdev_priv(netdev);
+ struct ftgmac100_txdes *txdes, *first;
+diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
+index 415fd93e9930f..769c627aace5d 100644
+--- a/drivers/net/ethernet/faraday/ftmac100.c
++++ b/drivers/net/ethernet/faraday/ftmac100.c
+@@ -632,8 +632,8 @@ static void ftmac100_tx_complete(struct ftmac100 *priv)
+ ;
+ }
+
+-static int ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
+- dma_addr_t map)
++static netdev_tx_t ftmac100_xmit(struct ftmac100 *priv, struct sk_buff *skb,
++ dma_addr_t map)
+ {
+ struct net_device *netdev = priv->netdev;
+ struct ftmac100_txdes *txdes;
+@@ -1013,7 +1013,8 @@ static int ftmac100_stop(struct net_device *netdev)
+ return 0;
+ }
+
+-static int ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t
++ftmac100_hard_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct ftmac100 *priv = netdev_priv(netdev);
+ dma_addr_t map;
+--
+2.20.1
+
--- /dev/null
+From f45e7160b90a1c18e9abc3a9471ec25d39723503 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 10:50:32 +0800
+Subject: net: freescale: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 06983aa526c759ebdf43f202d8d0491d9494e2f4 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 3 ++-
+ drivers/net/ethernet/freescale/fec_mpc52xx.c | 3 ++-
+ drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c | 3 ++-
+ drivers/net/ethernet/freescale/gianfar.c | 4 ++--
+ drivers/net/ethernet/freescale/ucc_geth.c | 3 ++-
+ 5 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index d5f8bf87519ac..39b8b6730e77c 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2036,7 +2036,8 @@ static inline int dpaa_xmit(struct dpaa_priv *priv,
+ return 0;
+ }
+
+-static int dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
++static netdev_tx_t
++dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ {
+ const int queue_mapping = skb_get_queue_mapping(skb);
+ bool nonlinear = skb_is_nonlinear(skb);
+diff --git a/drivers/net/ethernet/freescale/fec_mpc52xx.c b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+index 6d7269d87a850..b90bab72efdb3 100644
+--- a/drivers/net/ethernet/freescale/fec_mpc52xx.c
++++ b/drivers/net/ethernet/freescale/fec_mpc52xx.c
+@@ -305,7 +305,8 @@ static int mpc52xx_fec_close(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct mpc52xx_fec_priv *priv = netdev_priv(dev);
+ struct bcom_fec_bd *bd;
+diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+index 28bd4cf61741b..708082c255d09 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
++++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+@@ -481,7 +481,8 @@ static struct sk_buff *tx_skb_align_workaround(struct net_device *dev,
+ }
+ #endif
+
+-static int fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++fs_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct fs_enet_private *fep = netdev_priv(dev);
+ cbd_t __iomem *bdp;
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 63daae120b2d4..27d0e3b9833cd 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -112,7 +112,7 @@
+ const char gfar_driver_version[] = "2.0";
+
+ static int gfar_enet_open(struct net_device *dev);
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
+ static void gfar_reset_task(struct work_struct *work);
+ static void gfar_timeout(struct net_device *dev);
+ static int gfar_close(struct net_device *dev);
+@@ -2334,7 +2334,7 @@ static inline bool gfar_csum_errata_76(struct gfar_private *priv,
+ /* This is called by the kernel when a frame is ready for transmission.
+ * It is pointed to by the dev->hard_start_xmit function pointer
+ */
+-static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct gfar_private *priv = netdev_priv(dev);
+ struct gfar_priv_tx_q *tx_queue = NULL;
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
+index 94df1ddc5dcba..bddf4c25ee6ea 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.c
++++ b/drivers/net/ethernet/freescale/ucc_geth.c
+@@ -3085,7 +3085,8 @@ static int ucc_geth_startup(struct ucc_geth_private *ugeth)
+
+ /* This is called by the kernel when a frame is ready for transmission. */
+ /* It is pointed to by the dev->hard_start_xmit function pointer */
+-static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct ucc_geth_private *ugeth = netdev_priv(dev);
+ #ifdef CONFIG_UGETH_TX_ON_DEMAND
+--
+2.20.1
+
--- /dev/null
+From 0679104ade476f5a2ff62d0a457a777fbff07618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:54 +0100
+Subject: net: hns3: Fix for setting speed for phy failed problem
+
+From: Fuyun Liang <liangfuyun1@huawei.com>
+
+[ Upstream commit fd8133148eb6a733f9cfdaecd4d99f378e21d582 ]
+
+The function of genphy_read_status is that reading phy information
+from HW and using these information to update SW variable. If user
+is using ethtool to setting the speed of phy and service task is calling
+by hclge_get_mac_phy_link, the result of speed setting is uncertain.
+Because ethtool cmd will modified phydev and hclge_get_mac_phy_link also
+will modified phydev.
+
+Because phy state machine will update phy link periodically, we can
+just use phydev->link to check the link status. This patch removes
+function call of genphy_read_status. To ensure accuracy, this patch
+adds a phy state check. If phy state is not PHY_RUNNING, we consider
+link is down. Because in some scenarios, phydev->link may be link up,
+but phy state is not PHY_RUNNING. This is just an intermediate state.
+In fact, the link is not ready yet.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 86523e8993cb9..3bb6181ff0548 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2179,7 +2179,7 @@ static int hclge_get_mac_phy_link(struct hclge_dev *hdev)
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+- if (!genphy_read_status(hdev->hw.mac.phydev))
++ if (hdev->hw.mac.phydev->state == PHY_RUNNING)
+ link_stat = mac_state &
+ hdev->hw.mac.phydev->link;
+ else
+--
+2.20.1
+
--- /dev/null
+From 28e150b2c36b26973962991ee382d1d5c7702b61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:29:58 +0100
+Subject: net: hns3: Fix parameter type for q_id in hclge_tm_q_to_qs_map_cfg()
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 32c7fbc8ffd752c6aa05d2dd7c13b0f0aa00ddaa ]
+
+So far all the places calling hclge_tm_q_to_qs_map_cfg() are assigning
+an u16 type value to "q_id", and in the processing of
+hclge_tm_q_to_qs_map_cfg(), it also converts the "q_id" to le16.
+
+The max tqp number for pf can be more than 256, we should use "u16" to
+store the queue id, instead of "u8", which may cause data lost.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 55228b91d80b6..3799cb2548ce6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -200,7 +200,7 @@ static int hclge_tm_qs_to_pri_map_cfg(struct hclge_dev *hdev,
+ }
+
+ static int hclge_tm_q_to_qs_map_cfg(struct hclge_dev *hdev,
+- u8 q_id, u16 qs_id)
++ u16 q_id, u16 qs_id)
+ {
+ struct hclge_nq_to_qs_link_cmd *map;
+ struct hclge_desc desc;
+--
+2.20.1
+
--- /dev/null
+From cbd5aa71453a97816921ea1e1c09eea2feea07f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 14:09:43 +0800
+Subject: net: hns3: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c9c3941186c5637caed131c4f4064411d6882299 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, also the implementation in this
+driver has returns 'netdev_tx_t' value, so just change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hip04_eth.c | 3 ++-
+ drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index ebc056b9a0fd2..84c0f22ac2db0 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -424,7 +424,8 @@ static void hip04_start_tx_timer(struct hip04_priv *priv)
+ ns, HRTIMER_MODE_REL);
+ }
+
+-static int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct hip04_priv *priv = netdev_priv(ndev);
+ struct net_device_stats *stats = &ndev->stats;
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index 25a6c8722ecac..aab6fb10af94a 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -736,7 +736,7 @@ static int hix5hd2_fill_sg_desc(struct hix5hd2_priv *priv,
+ return 0;
+ }
+
+-static int hix5hd2_net_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t hix5hd2_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct hix5hd2_priv *priv = netdev_priv(dev);
+ struct hix5hd2_desc *desc;
+--
+2.20.1
+
--- /dev/null
+From 46c77526bc1ac9a1e91355d2a174e1f00b69da3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 19:29:09 +0200
+Subject: net: lan78xx: Bail out if lan78xx_get_endpoints fails
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit fa8cd98c06407b5798b927cd7fd14d30f360ed02 ]
+
+We need to bail out if lan78xx_get_endpoints() fails, otherwise the
+result is overwritten.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Raghuram Chary Jallipalli <raghuramchary.jallipalli@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 78a12d7b96e86..2229284d16f56 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -2818,6 +2818,11 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ int i;
+
+ ret = lan78xx_get_endpoints(dev, intf);
++ if (ret) {
++ netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
++ ret);
++ return ret;
++ }
+
+ dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+
+--
+2.20.1
+
--- /dev/null
+From 28f7db58d16a8626181742378f0f898aff8ec177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 10:42:15 +0800
+Subject: net: micrel: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2b49117a5abee8478b0470cba46ac74f93b4a479 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8695net.c | 2 +-
+ drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8695net.c b/drivers/net/ethernet/micrel/ks8695net.c
+index bd51e057e9150..b881f5d4a7f9e 100644
+--- a/drivers/net/ethernet/micrel/ks8695net.c
++++ b/drivers/net/ethernet/micrel/ks8695net.c
+@@ -1164,7 +1164,7 @@ ks8695_timeout(struct net_device *ndev)
+ * sk_buff and adds it to the TX ring. It then kicks the TX DMA
+ * engine to ensure transmission begins.
+ */
+-static int
++static netdev_tx_t
+ ks8695_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct ks8695_priv *ksp = netdev_priv(ndev);
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index f3e9dd47b56f0..adbe0a6fe0db9 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -1020,9 +1020,9 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ * spin_lock_irqsave is required because tx and rx should be mutual exclusive.
+ * So while tx is in-progress, prevent IRQ interrupt from happenning.
+ */
+-static int ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
++static netdev_tx_t ks_start_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+- int retv = NETDEV_TX_OK;
++ netdev_tx_t retv = NETDEV_TX_OK;
+ struct ks_net *ks = netdev_priv(netdev);
+
+ disable_irq(netdev->irq);
+--
+2.20.1
+
--- /dev/null
+From 4da408a088c5461290ab6a3b4eadbef56d8d6047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 17:05:40 -0700
+Subject: net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit b78ac6ecd1b6b46f8767cbafa95a7b0b51b87ad8 ]
+
+Allow the configuration of the MDIO clock divider when the Device Tree
+contains 'clock-frequency' property (similar to I2C and SPI buses).
+Because the hardware may have lost its state during suspend/resume,
+re-apply the MDIO clock divider upon resumption.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/net/brcm,unimac-mdio.txt | 3 +
+ drivers/net/phy/mdio-bcm-unimac.c | 83 ++++++++++++++++++-
+ 2 files changed, 84 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt b/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
+index 4648948f7c3b8..e15589f477876 100644
+--- a/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
++++ b/Documentation/devicetree/bindings/net/brcm,unimac-mdio.txt
+@@ -19,6 +19,9 @@ Optional properties:
+ - interrupt-names: must be "mdio_done_error" when there is a share interrupt fed
+ to this hardware block, or must be "mdio_done" for the first interrupt and
+ "mdio_error" for the second when there are separate interrupts
++- clocks: A reference to the clock supplying the MDIO bus controller
++- clock-frequency: the MDIO bus clock that must be output by the MDIO bus
++ hardware, if absent, the default hardware values are used
+
+ Child nodes of this MDIO bus controller node are standard Ethernet PHY device
+ nodes as described in Documentation/devicetree/bindings/net/phy.txt
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
+index 08e0647b85e23..f9d98a6e67bc4 100644
+--- a/drivers/net/phy/mdio-bcm-unimac.c
++++ b/drivers/net/phy/mdio-bcm-unimac.c
+@@ -16,6 +16,7 @@
+ #include <linux/module.h>
+ #include <linux/io.h>
+ #include <linux/delay.h>
++#include <linux/clk.h>
+
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+@@ -45,6 +46,8 @@ struct unimac_mdio_priv {
+ void __iomem *base;
+ int (*wait_func) (void *wait_func_data);
+ void *wait_func_data;
++ struct clk *clk;
++ u32 clk_freq;
+ };
+
+ static inline u32 unimac_mdio_readl(struct unimac_mdio_priv *priv, u32 offset)
+@@ -189,6 +192,35 @@ static int unimac_mdio_reset(struct mii_bus *bus)
+ return 0;
+ }
+
++static void unimac_mdio_clk_set(struct unimac_mdio_priv *priv)
++{
++ unsigned long rate;
++ u32 reg, div;
++
++ /* Keep the hardware default values */
++ if (!priv->clk_freq)
++ return;
++
++ if (!priv->clk)
++ rate = 250000000;
++ else
++ rate = clk_get_rate(priv->clk);
++
++ div = (rate / (2 * priv->clk_freq)) - 1;
++ if (div & ~MDIO_CLK_DIV_MASK) {
++ pr_warn("Incorrect MDIO clock frequency, ignoring\n");
++ return;
++ }
++
++ /* The MDIO clock is the reference clock (typicaly 250Mhz) divided by
++ * 2 x (MDIO_CLK_DIV + 1)
++ */
++ reg = unimac_mdio_readl(priv, MDIO_CFG);
++ reg &= ~(MDIO_CLK_DIV_MASK << MDIO_CLK_DIV_SHIFT);
++ reg |= div << MDIO_CLK_DIV_SHIFT;
++ unimac_mdio_writel(priv, reg, MDIO_CFG);
++}
++
+ static int unimac_mdio_probe(struct platform_device *pdev)
+ {
+ struct unimac_mdio_pdata *pdata = pdev->dev.platform_data;
+@@ -215,9 +247,26 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
++ priv->clk = devm_clk_get(&pdev->dev, NULL);
++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER)
++ return PTR_ERR(priv->clk);
++ else
++ priv->clk = NULL;
++
++ ret = clk_prepare_enable(priv->clk);
++ if (ret)
++ return ret;
++
++ if (of_property_read_u32(np, "clock-frequency", &priv->clk_freq))
++ priv->clk_freq = 0;
++
++ unimac_mdio_clk_set(priv);
++
+ priv->mii_bus = mdiobus_alloc();
+- if (!priv->mii_bus)
+- return -ENOMEM;
++ if (!priv->mii_bus) {
++ ret = -ENOMEM;
++ goto out_clk_disable;
++ }
+
+ bus = priv->mii_bus;
+ bus->priv = priv;
+@@ -251,6 +300,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
+
+ out_mdio_free:
+ mdiobus_free(bus);
++out_clk_disable:
++ clk_disable_unprepare(priv->clk);
+ return ret;
+ }
+
+@@ -260,10 +311,37 @@ static int unimac_mdio_remove(struct platform_device *pdev)
+
+ mdiobus_unregister(priv->mii_bus);
+ mdiobus_free(priv->mii_bus);
++ clk_disable_unprepare(priv->clk);
++
++ return 0;
++}
++
++static int unimac_mdio_suspend(struct device *d)
++{
++ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
++
++ clk_disable_unprepare(priv->clk);
++
++ return 0;
++}
++
++static int unimac_mdio_resume(struct device *d)
++{
++ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
++ int ret;
++
++ ret = clk_prepare_enable(priv->clk);
++ if (ret)
++ return ret;
++
++ unimac_mdio_clk_set(priv);
+
+ return 0;
+ }
+
++static SIMPLE_DEV_PM_OPS(unimac_mdio_pm_ops,
++ unimac_mdio_suspend, unimac_mdio_resume);
++
+ static const struct of_device_id unimac_mdio_ids[] = {
+ { .compatible = "brcm,genet-mdio-v5", },
+ { .compatible = "brcm,genet-mdio-v4", },
+@@ -279,6 +357,7 @@ static struct platform_driver unimac_mdio_driver = {
+ .driver = {
+ .name = UNIMAC_MDIO_DRV_NAME,
+ .of_match_table = unimac_mdio_ids,
++ .pm = &unimac_mdio_pm_ops,
+ },
+ .probe = unimac_mdio_probe,
+ .remove = unimac_mdio_remove,
+--
+2.20.1
+
--- /dev/null
+From ac436d705079f3f1bc4f99a75be81efc1eed414a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 15:14:10 +0200
+Subject: net: phy: mdio-bcm-unimac: mark PM functions as __maybe_unused
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9b97123a584f60a5bca5a2663485768a1f6cd0a4 ]
+
+The newly added runtime-pm support causes a harmless warning
+when CONFIG_PM is disabled:
+
+drivers/net/phy/mdio-bcm-unimac.c:330:12: error: 'unimac_mdio_resume' defined but not used [-Werror=unused-function]
+ static int unimac_mdio_resume(struct device *d)
+drivers/net/phy/mdio-bcm-unimac.c:321:12: error: 'unimac_mdio_suspend' defined but not used [-Werror=unused-function]
+ static int unimac_mdio_suspend(struct device *d)
+
+Marking the functions as __maybe_unused is the easiest workaround
+and avoids adding #ifdef checks.
+
+Fixes: b78ac6ecd1b6 ("net: phy: mdio-bcm-unimac: Allow configuring MDIO clock divider")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio-bcm-unimac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c
+index f9d98a6e67bc4..52703bbd4d666 100644
+--- a/drivers/net/phy/mdio-bcm-unimac.c
++++ b/drivers/net/phy/mdio-bcm-unimac.c
+@@ -316,7 +316,7 @@ static int unimac_mdio_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-static int unimac_mdio_suspend(struct device *d)
++static int __maybe_unused unimac_mdio_suspend(struct device *d)
+ {
+ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
+
+@@ -325,7 +325,7 @@ static int unimac_mdio_suspend(struct device *d)
+ return 0;
+ }
+
+-static int unimac_mdio_resume(struct device *d)
++static int __maybe_unused unimac_mdio_resume(struct device *d)
+ {
+ struct unimac_mdio_priv *priv = dev_get_drvdata(d);
+ int ret;
+--
+2.20.1
+
--- /dev/null
+From 5e6606e9a91c2ae277d0bfed51a1f669f52827e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 10:48:50 +0200
+Subject: net: phy: mscc: read 'vsc8531, edge-slowdown' as an u32
+
+From: Quentin Schulz <quentin.schulz@bootlin.com>
+
+[ Upstream commit 36c53cf0f46526b898390659b125155939f67892 ]
+
+In the DT binding, it is specified nowhere that 'vsc8531,edge-slowdown'
+is an u8, even though it's read as an u8 in the driver.
+
+Let's update the driver to take into consideration that the
+'vsc8531,edge-slowdown' property is of the default type u32.
+
+Signed-off-by: Quentin Schulz <quentin.schulz@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
+index 88bcdbcb432cc..fe81741ab66a3 100644
+--- a/drivers/net/phy/mscc.c
++++ b/drivers/net/phy/mscc.c
+@@ -112,7 +112,7 @@ struct vsc8531_private {
+ #ifdef CONFIG_OF_MDIO
+ struct vsc8531_edge_rate_table {
+ u32 vddmac;
+- u8 slowdown[8];
++ u32 slowdown[8];
+ };
+
+ static const struct vsc8531_edge_rate_table edge_table[] = {
+@@ -375,8 +375,7 @@ out_unlock:
+ #ifdef CONFIG_OF_MDIO
+ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ {
+- u8 sd;
+- u32 vdd;
++ u32 vdd, sd;
+ int rc, i, j;
+ struct device *dev = &phydev->mdio.dev;
+ struct device_node *of_node = dev->of_node;
+@@ -389,7 +388,7 @@ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ if (rc != 0)
+ vdd = MSCC_VDDMAC_3300;
+
+- rc = of_property_read_u8(of_node, "vsc8531,edge-slowdown", &sd);
++ rc = of_property_read_u32(of_node, "vsc8531,edge-slowdown", &sd);
+ if (rc != 0)
+ sd = 0;
+
+--
+2.20.1
+
--- /dev/null
+From 1f1d5f14e7ca904639fa6ba430b7d3c23d75fa81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 10:48:49 +0200
+Subject: net: phy: mscc: read 'vsc8531,vddmac' as an u32
+
+From: Quentin Schulz <quentin.schulz@bootlin.com>
+
+[ Upstream commit a993e0f583c7925adaa7721226ccd7a41e7e63d1 ]
+
+In the DT binding, it is specified nowhere that 'vsc8531,vddmac' is an
+u16, even though it's read as an u16 in the driver.
+
+Let's update the driver to take into consideration that the
+'vsc8531,vddmac' property is of the default type u32.
+
+Signed-off-by: Quentin Schulz <quentin.schulz@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c
+index 650c2667d523d..88bcdbcb432cc 100644
+--- a/drivers/net/phy/mscc.c
++++ b/drivers/net/phy/mscc.c
+@@ -111,7 +111,7 @@ struct vsc8531_private {
+
+ #ifdef CONFIG_OF_MDIO
+ struct vsc8531_edge_rate_table {
+- u16 vddmac;
++ u32 vddmac;
+ u8 slowdown[8];
+ };
+
+@@ -376,7 +376,7 @@ out_unlock:
+ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ {
+ u8 sd;
+- u16 vdd;
++ u32 vdd;
+ int rc, i, j;
+ struct device *dev = &phydev->mdio.dev;
+ struct device_node *of_node = dev->of_node;
+@@ -385,7 +385,7 @@ static int vsc85xx_edge_rate_magic_get(struct phy_device *phydev)
+ if (!of_node)
+ return -ENODEV;
+
+- rc = of_property_read_u16(of_node, "vsc8531,vddmac", &vdd);
++ rc = of_property_read_u32(of_node, "vsc8531,vddmac", &vdd);
+ if (rc != 0)
+ vdd = MSCC_VDDMAC_3300;
+
+--
+2.20.1
+
--- /dev/null
+From e6d9142c2fb1bd3fac7cd277ef0fbc7be62743bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:06:29 +0800
+Subject: net: smsc: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 6323d57f335ce1490d025cacc83fc10b07792130 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc911x.c | 3 ++-
+ drivers/net/ethernet/smsc/smc91x.c | 3 ++-
+ drivers/net/ethernet/smsc/smsc911x.c | 3 ++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
+index 05157442a9807..42d35a87bcc9f 100644
+--- a/drivers/net/ethernet/smsc/smc911x.c
++++ b/drivers/net/ethernet/smsc/smc911x.c
+@@ -514,7 +514,8 @@ static void smc911x_hardware_send_pkt(struct net_device *dev)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc911x_local *lp = netdev_priv(dev);
+ unsigned int free;
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 0804287628584..96ac0d3af6f5b 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -638,7 +638,8 @@ done: if (!THROTTLE_TX_PKTS)
+ * now, or set the card to generates an interrupt when ready
+ * for the packet.
+ */
+-static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smc_local *lp = netdev_priv(dev);
+ void __iomem *ioaddr = lp->base;
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index f0afb88d7bc2b..ce4bfecc26c7a 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1786,7 +1786,8 @@ static int smsc911x_stop(struct net_device *dev)
+ }
+
+ /* Entry point for transmitting a packet */
+-static int smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++smsc911x_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct smsc911x_data *pdata = netdev_priv(dev);
+ unsigned int freespace;
+--
+2.20.1
+
--- /dev/null
+From be96c2a979d0b73e386f6a457ddbf69cfffcd034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 19:21:32 +0800
+Subject: net: sun: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0e0cc31f6999df18bb5cfd0bd83c892ed5633975 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, but the implementation in this
+driver returns an 'int'.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Shannon Nelson <shannon.nelson@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sun/ldmvsw.c | 2 +-
+ drivers/net/ethernet/sun/sunbmac.c | 3 ++-
+ drivers/net/ethernet/sun/sunqe.c | 2 +-
+ drivers/net/ethernet/sun/sunvnet.c | 2 +-
+ drivers/net/ethernet/sun/sunvnet_common.c | 14 ++++++++------
+ drivers/net/ethernet/sun/sunvnet_common.h | 7 ++++---
+ 6 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
+index 5b56c24b6ed2e..e6b96c2989b22 100644
+--- a/drivers/net/ethernet/sun/ldmvsw.c
++++ b/drivers/net/ethernet/sun/ldmvsw.c
+@@ -111,7 +111,7 @@ static u16 vsw_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* Wrappers to common functions */
+-static int vsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vsw_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ return sunvnet_start_xmit_common(skb, dev, vsw_tx_port_find);
+ }
+diff --git a/drivers/net/ethernet/sun/sunbmac.c b/drivers/net/ethernet/sun/sunbmac.c
+index 3189722110c26..9a60fb2b4e9dc 100644
+--- a/drivers/net/ethernet/sun/sunbmac.c
++++ b/drivers/net/ethernet/sun/sunbmac.c
+@@ -951,7 +951,8 @@ static void bigmac_tx_timeout(struct net_device *dev)
+ }
+
+ /* Put a packet on the wire. */
+-static int bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++bigmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct bigmac *bp = netdev_priv(dev);
+ int len, entry;
+diff --git a/drivers/net/ethernet/sun/sunqe.c b/drivers/net/ethernet/sun/sunqe.c
+index a6bcdcdd947e3..82386a375bd26 100644
+--- a/drivers/net/ethernet/sun/sunqe.c
++++ b/drivers/net/ethernet/sun/sunqe.c
+@@ -569,7 +569,7 @@ out:
+ }
+
+ /* Get a packet queued to go onto the wire. */
+-static int qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t qe_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct sunqe *qep = netdev_priv(dev);
+ struct sunqe_buffers *qbufs = qep->buffers;
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 65347d2f139b7..02ebbe74d93de 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -245,7 +245,7 @@ static u16 vnet_select_queue(struct net_device *dev, struct sk_buff *skb,
+ }
+
+ /* Wrappers to common functions */
+-static int vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t vnet_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ return sunvnet_start_xmit_common(skb, dev, vnet_tx_port_find);
+ }
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethernet/sun/sunvnet_common.c
+index ecf456c7b6d14..fd84ff8bba31a 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.c
++++ b/drivers/net/ethernet/sun/sunvnet_common.c
+@@ -1215,9 +1215,10 @@ static inline struct sk_buff *vnet_skb_shape(struct sk_buff *skb, int ncookies)
+ return skb;
+ }
+
+-static int vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *))
++static netdev_tx_t
++vnet_handle_offloads(struct vnet_port *port, struct sk_buff *skb,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *))
+ {
+ struct net_device *dev = VNET_PORT_TO_NET_DEVICE(port);
+ struct vio_dring_state *dr = &port->vio.drings[VIO_DRIVER_TX_RING];
+@@ -1320,9 +1321,10 @@ out_dropped:
+ return NETDEV_TX_OK;
+ }
+
+-int sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *))
++netdev_tx_t
++sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *))
+ {
+ struct vnet_port *port = NULL;
+ struct vio_dring_state *dr;
+diff --git a/drivers/net/ethernet/sun/sunvnet_common.h b/drivers/net/ethernet/sun/sunvnet_common.h
+index 6a4dd1fb19bf6..3fcb608fbbb31 100644
+--- a/drivers/net/ethernet/sun/sunvnet_common.h
++++ b/drivers/net/ethernet/sun/sunvnet_common.h
+@@ -136,9 +136,10 @@ int sunvnet_close_common(struct net_device *dev);
+ void sunvnet_set_rx_mode_common(struct net_device *dev, struct vnet *vp);
+ int sunvnet_set_mac_addr_common(struct net_device *dev, void *p);
+ void sunvnet_tx_timeout_common(struct net_device *dev);
+-int sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
+- struct vnet_port *(*vnet_tx_port)
+- (struct sk_buff *, struct net_device *));
++netdev_tx_t
++sunvnet_start_xmit_common(struct sk_buff *skb, struct net_device *dev,
++ struct vnet_port *(*vnet_tx_port)
++ (struct sk_buff *, struct net_device *));
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ void sunvnet_poll_controller_common(struct net_device *dev, struct vnet *vp);
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 5b0c8361a5e8355183ad71b5b51a52abe441ddbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:23:39 +0800
+Subject: net: toshiba: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit bacade822524e02f662d88f784d2ae821a5546fb ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/toshiba/ps3_gelic_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/ps3_gelic_net.h | 2 +-
+ drivers/net/ethernet/toshiba/spider_net.c | 4 ++--
+ drivers/net/ethernet/toshiba/tc35815.c | 6 ++++--
+ 4 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+index 88d74aef218a2..75237c81c63d6 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
+@@ -845,9 +845,9 @@ static int gelic_card_kick_txdma(struct gelic_card *card,
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, <0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ struct gelic_card *card = netdev_card(netdev);
+ struct gelic_descr *descr;
+diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.h b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+index 003d0452d9cb1..fbbf9b54b173b 100644
+--- a/drivers/net/ethernet/toshiba/ps3_gelic_net.h
++++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.h
+@@ -370,7 +370,7 @@ void gelic_card_up(struct gelic_card *card);
+ void gelic_card_down(struct gelic_card *card);
+ int gelic_net_open(struct net_device *netdev);
+ int gelic_net_stop(struct net_device *netdev);
+-int gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
++netdev_tx_t gelic_net_xmit(struct sk_buff *skb, struct net_device *netdev);
+ void gelic_net_set_multi(struct net_device *netdev);
+ void gelic_net_tx_timeout(struct net_device *netdev);
+ int gelic_net_setup_netdev(struct net_device *netdev, struct gelic_card *card);
+diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c
+index cec9e70ab9955..da136b8843dd9 100644
+--- a/drivers/net/ethernet/toshiba/spider_net.c
++++ b/drivers/net/ethernet/toshiba/spider_net.c
+@@ -880,9 +880,9 @@ out:
+ * @skb: packet to send out
+ * @netdev: interface device structure
+ *
+- * returns 0 on success, !0 on failure
++ * returns NETDEV_TX_OK on success, NETDEV_TX_BUSY on failure
+ */
+-static int
++static netdev_tx_t
+ spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
+ {
+ int cnt;
+diff --git a/drivers/net/ethernet/toshiba/tc35815.c b/drivers/net/ethernet/toshiba/tc35815.c
+index 9146068979d2c..03afc4d8c3ec1 100644
+--- a/drivers/net/ethernet/toshiba/tc35815.c
++++ b/drivers/net/ethernet/toshiba/tc35815.c
+@@ -474,7 +474,8 @@ static void free_rxbuf_skb(struct pci_dev *hwdev, struct sk_buff *skb, dma_addr_
+ /* Index to functions, as function prototypes. */
+
+ static int tc35815_open(struct net_device *dev);
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev);
++static netdev_tx_t tc35815_send_packet(struct sk_buff *skb,
++ struct net_device *dev);
+ static irqreturn_t tc35815_interrupt(int irq, void *dev_id);
+ static int tc35815_rx(struct net_device *dev, int limit);
+ static int tc35815_poll(struct napi_struct *napi, int budget);
+@@ -1248,7 +1249,8 @@ tc35815_open(struct net_device *dev)
+ * invariant will hold if you make sure that the netif_*_queue()
+ * calls are done at the proper times.
+ */
+-static int tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
++static netdev_tx_t
++tc35815_send_packet(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct tc35815_local *lp = netdev_priv(dev);
+ struct TxFD *txfd;
+--
+2.20.1
+
--- /dev/null
+From eab8cc12061a1d1f2554c7cf46f625b81ced2fe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 18:32:40 +0800
+Subject: net: xilinx: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 81255af8d9d5565004792c295dde49344df450ca ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/ll_temac_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 3 ++-
+ drivers/net/ethernet/xilinx/xilinx_emaclite.c | 9 +++++----
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
+index 60abc9250f56a..2241f98970926 100644
+--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
++++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
+@@ -674,7 +674,8 @@ static inline int temac_check_tx_bd_space(struct temac_local *lp, int num_frag)
+ return 0;
+ }
+
+-static int temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++temac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct temac_local *lp = netdev_priv(ndev);
+ struct cdmac_bd *cur_p;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index b481cb174b23e..9ccd08a051f6a 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -657,7 +657,8 @@ static inline int axienet_check_tx_bd_space(struct axienet_local *lp,
+ * start the transmission. Additionally if checksum offloading is supported,
+ * it populates AXI Stream Control fields with appropriate values.
+ */
+-static int axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t
++axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ u32 ii;
+ u32 num_frag;
+diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+index 69e31ceccfae4..6f3e79159d7a6 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+@@ -1005,9 +1005,10 @@ static int xemaclite_close(struct net_device *dev)
+ * deferred and the Tx queue is stopped so that the deferred socket buffer can
+ * be transmitted when the Emaclite device is free to transmit data.
+ *
+- * Return: 0, always.
++ * Return: NETDEV_TX_OK, always.
+ */
+-static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
++static netdev_tx_t
++xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ {
+ struct net_local *lp = netdev_priv(dev);
+ struct sk_buff *new_skb;
+@@ -1028,7 +1029,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ /* Take the time stamp now, since we can't do this in an ISR. */
+ skb_tx_timestamp(new_skb);
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+- return 0;
++ return NETDEV_TX_OK;
+ }
+ spin_unlock_irqrestore(&lp->reset_lock, flags);
+
+@@ -1037,7 +1038,7 @@ static int xemaclite_send(struct sk_buff *orig_skb, struct net_device *dev)
+ dev->stats.tx_bytes += len;
+ dev_consume_skb_any(new_skb);
+
+- return 0;
++ return NETDEV_TX_OK;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 5e8370c5511c1a569767cbadcbde6474205806b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:33:33 +0800
+Subject: netfilter: masquerade: don't flush all conntracks if only one address
+ deleted on device
+
+From: Tan Hu <tan.hu@zte.com.cn>
+
+[ Upstream commit 097f95d319f817e651bd51f8846aced92a55a6a1 ]
+
+We configured iptables as below, which only allowed incoming data on
+established connections:
+
+iptables -t mangle -A PREROUTING -m state --state ESTABLISHED -j ACCEPT
+iptables -t mangle -P PREROUTING DROP
+
+When deleting a secondary address, current masquerade implements would
+flush all conntracks on this device. All the established connections on
+primary address also be deleted, then subsequent incoming data on the
+connections would be dropped wrongly because it was identified as NEW
+connection.
+
+So when an address was delete, it should only flush connections related
+with the address.
+
+Signed-off-by: Tan Hu <tan.hu@zte.com.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 22 ++++++++++++++++++---
+ net/ipv6/netfilter/nf_nat_masquerade_ipv6.c | 19 +++++++++++++++---
+ 2 files changed, 35 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+index 0c366aad89cb4..b531fe204323d 100644
+--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+@@ -105,12 +105,26 @@ static int masq_device_event(struct notifier_block *this,
+ return NOTIFY_DONE;
+ }
+
++static int inet_cmp(struct nf_conn *ct, void *ptr)
++{
++ struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
++ struct net_device *dev = ifa->ifa_dev->dev;
++ struct nf_conntrack_tuple *tuple;
++
++ if (!device_cmp(ct, (void *)(long)dev->ifindex))
++ return 0;
++
++ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++ return ifa->ifa_address == tuple->dst.u3.ip;
++}
++
+ static int masq_inet_event(struct notifier_block *this,
+ unsigned long event,
+ void *ptr)
+ {
+ struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
+- struct netdev_notifier_info info;
++ struct net *net = dev_net(idev->dev);
+
+ /* The masq_dev_notifier will catch the case of the device going
+ * down. So if the inetdev is dead and being destroyed we have
+@@ -120,8 +134,10 @@ static int masq_inet_event(struct notifier_block *this,
+ if (idev->dead)
+ return NOTIFY_DONE;
+
+- netdev_notifier_info_init(&info, idev->dev);
+- return masq_device_event(this, event, &info);
++ if (event == NETDEV_DOWN)
++ nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0);
++
++ return NOTIFY_DONE;
+ }
+
+ static struct notifier_block masq_dev_notifier = {
+diff --git a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+index 98f61fcb91088..b0f3745d1bee9 100644
+--- a/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
++++ b/net/ipv6/netfilter/nf_nat_masquerade_ipv6.c
+@@ -88,18 +88,30 @@ static struct notifier_block masq_dev_notifier = {
+ struct masq_dev_work {
+ struct work_struct work;
+ struct net *net;
++ struct in6_addr addr;
+ int ifindex;
+ };
+
++static int inet_cmp(struct nf_conn *ct, void *work)
++{
++ struct masq_dev_work *w = (struct masq_dev_work *)work;
++ struct nf_conntrack_tuple *tuple;
++
++ if (!device_cmp(ct, (void *)(long)w->ifindex))
++ return 0;
++
++ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
++
++ return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6);
++}
++
+ static void iterate_cleanup_work(struct work_struct *work)
+ {
+ struct masq_dev_work *w;
+- long index;
+
+ w = container_of(work, struct masq_dev_work, work);
+
+- index = w->ifindex;
+- nf_ct_iterate_cleanup_net(w->net, device_cmp, (void *)index, 0, 0);
++ nf_ct_iterate_cleanup_net(w->net, inet_cmp, (void *)w, 0, 0);
+
+ put_net(w->net);
+ kfree(w);
+@@ -148,6 +160,7 @@ static int masq_inet_event(struct notifier_block *this,
+ INIT_WORK(&w->work, iterate_cleanup_work);
+ w->ifindex = dev->ifindex;
+ w->net = net;
++ w->addr = ifa->addr;
+ schedule_work(&w->work);
+
+ return NOTIFY_DONE;
+--
+2.20.1
+
--- /dev/null
+From 529b853d771cf8b00ea1a6a295c9eed3777a92ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Sep 2018 14:42:50 -0700
+Subject: nfp: provide a better warning when ring allocation fails
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 23d9f5531c7c28546954b0bf332134a9b8a38c0a ]
+
+NFP supports fairly enormous ring sizes (up to 256k descriptors).
+In commit 466271703867 ("nfp: use kvcalloc() to allocate SW buffer
+descriptor arrays") we have started using kvcalloc() functions to
+make sure the allocation of software state arrays doesn't hit
+the MAX_ORDER limit. Unfortunately, we can't use virtual mappings
+for the DMA region holding HW descriptors. In case this allocation
+fails instead of the generic (and fairly scary) warning/splat in
+the logs print a helpful message explaining what happened and
+suggesting how to fix it.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/netronome/nfp/nfp_net_common.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+index 6df2c8b2ce6f3..bffa25d6dc294 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -2169,9 +2169,13 @@ nfp_net_tx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring)
+
+ tx_ring->size = sizeof(*tx_ring->txds) * tx_ring->cnt;
+ tx_ring->txds = dma_zalloc_coherent(dp->dev, tx_ring->size,
+- &tx_ring->dma, GFP_KERNEL);
+- if (!tx_ring->txds)
++ &tx_ring->dma,
++ GFP_KERNEL | __GFP_NOWARN);
++ if (!tx_ring->txds) {
++ netdev_warn(dp->netdev, "failed to allocate TX descriptor ring memory, requested descriptor count: %d, consider lowering descriptor count\n",
++ tx_ring->cnt);
+ goto err_alloc;
++ }
+
+ sz = sizeof(*tx_ring->txbufs) * tx_ring->cnt;
+ tx_ring->txbufs = kzalloc(sz, GFP_KERNEL);
+@@ -2314,9 +2318,13 @@ nfp_net_rx_ring_alloc(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring)
+ rx_ring->cnt = dp->rxd_cnt;
+ rx_ring->size = sizeof(*rx_ring->rxds) * rx_ring->cnt;
+ rx_ring->rxds = dma_zalloc_coherent(dp->dev, rx_ring->size,
+- &rx_ring->dma, GFP_KERNEL);
+- if (!rx_ring->rxds)
++ &rx_ring->dma,
++ GFP_KERNEL | __GFP_NOWARN);
++ if (!rx_ring->rxds) {
++ netdev_warn(dp->netdev, "failed to allocate RX descriptor ring memory, requested descriptor count: %d, consider lowering descriptor count\n",
++ rx_ring->cnt);
+ goto err_alloc;
++ }
+
+ sz = sizeof(*rx_ring->rxbufs) * rx_ring->cnt;
+ rx_ring->rxbufs = kzalloc(sz, GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From da88b1c6a669f66aef13155273983eedd099ffe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:19:35 +0100
+Subject: nvmem: core: return error code instead of NULL from nvmem_device_get
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit ca6ac25cecf0e740d7cc8e03e0ebbf8acbeca3df ]
+
+nvmem_device_get() should return ERR_PTR() on error or valid pointer
+on success, but one of the code path seems to return NULL, so fix it.
+
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index b414d9d207d45..08b171731664e 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -617,7 +617,7 @@ static struct nvmem_device *nvmem_find(const char *name)
+ d = bus_find_device(&nvmem_bus_type, NULL, (void *)name, nvmem_match);
+
+ if (!d)
+- return NULL;
++ return ERR_PTR(-ENOENT);
+
+ return to_nvmem_device(d);
+ }
+--
+2.20.1
+
--- /dev/null
+From 3b1a05e86fb6e87018274d9e8a1979383e56fac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 09:50:09 -0500
+Subject: of: make PowerMac cache node search conditional on CONFIG_PPC_PMAC
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f6707fd6241e483f6fea2caae82d876e422bb11a ]
+
+Cache nodes under the cpu node(s) is PowerMac specific according to the
+comment above, so make the code enforce that.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index ce8a6e0c9b6a9..41b254be02954 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1837,7 +1837,7 @@ struct device_node *of_find_next_cache_node(const struct device_node *np)
+ /* OF on pmac has nodes instead of properties named "l2-cache"
+ * beneath CPU nodes.
+ */
+- if (!strcmp(np->type, "cpu"))
++ if (IS_ENABLED(CONFIG_PPC_PMAC) && !strcmp(np->type, "cpu"))
+ for_each_child_of_node(np, child)
+ if (!strcmp(child->type, "cache"))
+ return child;
+--
+2.20.1
+
--- /dev/null
+From aa55132606a7abf5313678a3028e46fdb3941008 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Aug 2018 07:05:21 +0530
+Subject: OPP: Protect dev_list with opp_table lock
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 3d2556992a878a2210d3be498416aee39e0c32aa ]
+
+The dev_list needs to be protected with a lock, else we may have
+simultaneous access (addition/removal) to it and that would be racy.
+Extend scope of the opp_table lock to protect dev_list as well.
+
+Tested-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/opp/core.c | 21 +++++++++++++++++++--
+ drivers/base/power/opp/cpu.c | 2 ++
+ drivers/base/power/opp/opp.h | 2 +-
+ 3 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c
+index d5e7e8cc4f221..8100c87691497 100644
+--- a/drivers/base/power/opp/core.c
++++ b/drivers/base/power/opp/core.c
+@@ -49,9 +49,14 @@ static struct opp_device *_find_opp_dev(const struct device *dev,
+ static struct opp_table *_find_opp_table_unlocked(struct device *dev)
+ {
+ struct opp_table *opp_table;
++ bool found;
+
+ list_for_each_entry(opp_table, &opp_tables, node) {
+- if (_find_opp_dev(dev, opp_table)) {
++ mutex_lock(&opp_table->lock);
++ found = !!_find_opp_dev(dev, opp_table);
++ mutex_unlock(&opp_table->lock);
++
++ if (found) {
+ _get_opp_table_kref(opp_table);
+
+ return opp_table;
+@@ -711,6 +716,8 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+
+ /* Initialize opp-dev */
+ opp_dev->dev = dev;
++
++ mutex_lock(&opp_table->lock);
+ list_add(&opp_dev->node, &opp_table->dev_list);
+
+ /* Create debugfs entries for the opp_table */
+@@ -718,6 +725,7 @@ struct opp_device *_add_opp_dev(const struct device *dev,
+ if (ret)
+ dev_err(dev, "%s: Failed to register opp debugfs (%d)\n",
+ __func__, ret);
++ mutex_unlock(&opp_table->lock);
+
+ return opp_dev;
+ }
+@@ -736,6 +744,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+ if (!opp_table)
+ return NULL;
+
++ mutex_init(&opp_table->lock);
+ INIT_LIST_HEAD(&opp_table->dev_list);
+
+ opp_dev = _add_opp_dev(dev, opp_table);
+@@ -757,7 +766,6 @@ static struct opp_table *_allocate_opp_table(struct device *dev)
+
+ BLOCKING_INIT_NOTIFIER_HEAD(&opp_table->head);
+ INIT_LIST_HEAD(&opp_table->opp_list);
+- mutex_init(&opp_table->lock);
+ kref_init(&opp_table->kref);
+
+ /* Secure the device table modification */
+@@ -799,6 +807,10 @@ static void _opp_table_kref_release(struct kref *kref)
+ if (!IS_ERR(opp_table->clk))
+ clk_put(opp_table->clk);
+
++ /*
++ * No need to take opp_table->lock here as we are guaranteed that no
++ * references to the OPP table are taken at this point.
++ */
+ opp_dev = list_first_entry(&opp_table->dev_list, struct opp_device,
+ node);
+
+@@ -1702,6 +1714,9 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ {
+ struct dev_pm_opp *opp, *tmp;
+
++ /* Protect dev_list */
++ mutex_lock(&opp_table->lock);
++
+ /* Find if opp_table manages a single device */
+ if (list_is_singular(&opp_table->dev_list)) {
+ /* Free static OPPs */
+@@ -1712,6 +1727,8 @@ void _dev_pm_opp_remove_table(struct opp_table *opp_table, struct device *dev,
+ } else {
+ _remove_opp_dev(_find_opp_dev(dev, opp_table), opp_table);
+ }
++
++ mutex_unlock(&opp_table->lock);
+ }
+
+ void _dev_pm_opp_find_and_remove_table(struct device *dev, bool remove_all)
+diff --git a/drivers/base/power/opp/cpu.c b/drivers/base/power/opp/cpu.c
+index 2d87bc1adf38b..66e406bd4d628 100644
+--- a/drivers/base/power/opp/cpu.c
++++ b/drivers/base/power/opp/cpu.c
+@@ -222,8 +222,10 @@ int dev_pm_opp_get_sharing_cpus(struct device *cpu_dev, struct cpumask *cpumask)
+ cpumask_clear(cpumask);
+
+ if (opp_table->shared_opp == OPP_TABLE_ACCESS_SHARED) {
++ mutex_lock(&opp_table->lock);
+ list_for_each_entry(opp_dev, &opp_table->dev_list, node)
+ cpumask_set_cpu(opp_dev->dev->id, cpumask);
++ mutex_unlock(&opp_table->lock);
+ } else {
+ cpumask_set_cpu(cpu_dev->id, cpumask);
+ }
+diff --git a/drivers/base/power/opp/opp.h b/drivers/base/power/opp/opp.h
+index 166eef9905995..0a206c6b90868 100644
+--- a/drivers/base/power/opp/opp.h
++++ b/drivers/base/power/opp/opp.h
+@@ -124,7 +124,7 @@ enum opp_table_access {
+ * @dev_list: list of devices that share these OPPs
+ * @opp_list: table of opps
+ * @kref: for reference count of the table.
+- * @lock: mutex protecting the opp_list.
++ * @lock: mutex protecting the opp_list and dev_list.
+ * @np: struct device_node pointer for opp's DT node.
+ * @clock_latency_ns_max: Max clock latency in nanoseconds.
+ * @shared_opp: OPP is shared between multiple devices.
+--
+2.20.1
+
--- /dev/null
+From 3f4e003e01c335969490a00b0104bec8ff474827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 04:32:11 +0000
+Subject: PCI/ACPI: Correct error message for ASPM disabling
+
+From: Sinan Kaya <okaya@kernel.org>
+
+[ Upstream commit 1ad61b612b95980a4d970c52022aa01dfc0f6068 ]
+
+If _OSC execution fails today for platforms without an _OSC entry, code is
+printing a misleading message saying disabling ASPM as follows:
+
+ acpi PNP0A03:00: _OSC failed (AE_NOT_FOUND); disabling ASPM
+
+We need to ensure that platform supports ASPM to begin with.
+
+Reported-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sinan Kaya <okaya@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_root.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index eb857d6ea1fef..96911360a28e7 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -454,8 +454,9 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm)
+ decode_osc_support(root, "OS supports", support);
+ status = acpi_pci_osc_support(root, support);
+ if (ACPI_FAILURE(status)) {
+- dev_info(&device->dev, "_OSC failed (%s); disabling ASPM\n",
+- acpi_format_exception(status));
++ dev_info(&device->dev, "_OSC failed (%s)%s\n",
++ acpi_format_exception(status),
++ pcie_aspm_support_enabled() ? "; disabling ASPM" : "");
+ *no_aspm = 1;
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From 344eacb89828127da072066de8d6f30a8514e7a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 12:16:36 -0700
+Subject: phy: brcm-sata: allow PHY_BRCM_SATA driver to be built for DSL SoCs
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 26728df4b254ae06247726a9a6e64823e39ac504 ]
+
+Broadcom ARM-based DSL SoCs (BCM63xx product line) have the same
+Broadcom SATA PHY that other SoCs are using, make it possible to select
+that driver on these platforms.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/broadcom/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/broadcom/Kconfig b/drivers/phy/broadcom/Kconfig
+index 64fc59c3ae6d9..181b8fde2bfe6 100644
+--- a/drivers/phy/broadcom/Kconfig
++++ b/drivers/phy/broadcom/Kconfig
+@@ -60,7 +60,8 @@ config PHY_NS2_USB_DRD
+
+ config PHY_BRCM_SATA
+ tristate "Broadcom SATA PHY driver"
+- depends on ARCH_BRCMSTB || ARCH_BCM_IPROC || BMIPS_GENERIC || COMPILE_TEST
++ depends on ARCH_BRCMSTB || ARCH_BCM_IPROC || BMIPS_GENERIC || \
++ ARCH_BCM_63XX || COMPILE_TEST
+ depends on OF
+ select GENERIC_PHY
+ default ARCH_BCM_IPROC
+--
+2.20.1
+
--- /dev/null
+From 63217f9cd8ec4b62c4e4689aaac4e7bd6b91c466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 21:54:07 +0200
+Subject: phy: lantiq: Fix compile warning
+
+From: Hauke Mehrtens <hauke@hauke-m.de>
+
+[ Upstream commit 3a00dae006623d799266d85f28b5f76ef07d6b6c ]
+
+This local variable is unused, remove it.
+
+Fixes: dea54fbad332 ("phy: Add an USB PHY driver for the Lantiq SoCs using the RCU module")
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/lantiq/phy-lantiq-rcu-usb2.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+index 986224fca9e91..5a180f71d8d4d 100644
+--- a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
++++ b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+@@ -156,7 +156,6 @@ static int ltq_rcu_usb2_of_parse(struct ltq_rcu_usb2_priv *priv,
+ {
+ struct device *dev = priv->dev;
+ const __be32 *offset;
+- int ret;
+
+ priv->reg_bits = of_device_get_match_data(dev);
+
+--
+2.20.1
+
--- /dev/null
+From 112338a8859fe565fe613038a6eefe956fd784be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 11:44:05 +0200
+Subject: phy: phy-twl4030-usb: fix denied runtime access
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 6c7103aa026094a4ee2c2708ec6977a6dfc5331d ]
+
+When runtime is not enabled, pm_runtime_get_sync() returns -EACCESS,
+the counter will be incremented but the resume callback not called,
+so enumeration and charging will not start properly.
+To avoid that happen, disable irq on suspend and recheck on resume.
+
+Practically this happens when the device is woken up from suspend by
+plugging in usb.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-twl4030-usb.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/drivers/phy/ti/phy-twl4030-usb.c b/drivers/phy/ti/phy-twl4030-usb.c
+index a44680d64f9b4..c267afb68f077 100644
+--- a/drivers/phy/ti/phy-twl4030-usb.c
++++ b/drivers/phy/ti/phy-twl4030-usb.c
+@@ -144,6 +144,7 @@
+ #define PMBR1 0x0D
+ #define GPIO_USB_4PIN_ULPI_2430C (3 << 0)
+
++static irqreturn_t twl4030_usb_irq(int irq, void *_twl);
+ /*
+ * If VBUS is valid or ID is ground, then we know a
+ * cable is present and we need to be runtime-enabled
+@@ -395,6 +396,33 @@ static void __twl4030_phy_power(struct twl4030_usb *twl, int on)
+ WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+ }
+
++static int __maybe_unused twl4030_usb_suspend(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ /*
++ * we need enabled runtime on resume,
++ * so turn irq off here, so we do not get it early
++ * note: wakeup on usb plug works independently of this
++ */
++ dev_dbg(twl->dev, "%s\n", __func__);
++ disable_irq(twl->irq);
++
++ return 0;
++}
++
++static int __maybe_unused twl4030_usb_resume(struct device *dev)
++{
++ struct twl4030_usb *twl = dev_get_drvdata(dev);
++
++ dev_dbg(twl->dev, "%s\n", __func__);
++ enable_irq(twl->irq);
++ /* check whether cable status changed */
++ twl4030_usb_irq(0, twl);
++
++ return 0;
++}
++
+ static int __maybe_unused twl4030_usb_runtime_suspend(struct device *dev)
+ {
+ struct twl4030_usb *twl = dev_get_drvdata(dev);
+@@ -655,6 +683,7 @@ static const struct phy_ops ops = {
+ static const struct dev_pm_ops twl4030_usb_pm_ops = {
+ SET_RUNTIME_PM_OPS(twl4030_usb_runtime_suspend,
+ twl4030_usb_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(twl4030_usb_suspend, twl4030_usb_resume)
+ };
+
+ static int twl4030_usb_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 43f21536b2436e781a75aa163527f8e5e4709509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 20:53:18 +0900
+Subject: phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 09938ea9d136243e8d1fed6d4d7a257764f28f6d ]
+
+This patch fixes and issue that the vbus_ctrl is disabled by
+rcar_gen3_init_from_a_peri_to_a_host(), so a usb host cannot
+supply the vbus.
+
+Note that this condition will exit when the otg irq happens
+even if we don't apply this patch.
+
+Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index e8fe80312820d..7f5e36bfeee8d 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -195,7 +195,7 @@ static void rcar_gen3_init_from_a_peri_to_a_host(struct rcar_gen3_chan *ch)
+ val = readl(usb2_base + USB2_OBINTEN);
+ writel(val & ~USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+
+- rcar_gen3_enable_vbus_ctrl(ch, 0);
++ rcar_gen3_enable_vbus_ctrl(ch, 1);
+ rcar_gen3_init_for_host(ch);
+
+ writel(val | USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+--
+2.20.1
+
--- /dev/null
+From 0bf03726b916118442f4c047ba93800fb4cae4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 14:42:13 +0200
+Subject: pinctrl: at91: don't use the same irqchip with multiple gpiochips
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+[ Upstream commit 0c3dfa176912b5f87732545598200fb55e9c1978 ]
+
+Sharing the same irqchip with multiple gpiochips is not a good
+practice. For instance, when installing hooks, we change the state
+of the irqchip. The initial state of the irqchip for the second
+gpiochip to register is then disrupted.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index 569bc28cb9097..404711f0985aa 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -1566,16 +1566,6 @@ void at91_pinctrl_gpio_resume(void)
+ #define gpio_irq_set_wake NULL
+ #endif /* CONFIG_PM */
+
+-static struct irq_chip gpio_irqchip = {
+- .name = "GPIO",
+- .irq_ack = gpio_irq_ack,
+- .irq_disable = gpio_irq_mask,
+- .irq_mask = gpio_irq_mask,
+- .irq_unmask = gpio_irq_unmask,
+- /* .irq_set_type is set dynamically */
+- .irq_set_wake = gpio_irq_set_wake,
+-};
+-
+ static void gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct irq_chip *chip = irq_desc_get_chip(desc);
+@@ -1616,12 +1606,22 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ struct gpio_chip *gpiochip_prev = NULL;
+ struct at91_gpio_chip *prev = NULL;
+ struct irq_data *d = irq_get_irq_data(at91_gpio->pioc_virq);
++ struct irq_chip *gpio_irqchip;
+ int ret, i;
+
++ gpio_irqchip = devm_kzalloc(&pdev->dev, sizeof(*gpio_irqchip), GFP_KERNEL);
++ if (!gpio_irqchip)
++ return -ENOMEM;
++
+ at91_gpio->pioc_hwirq = irqd_to_hwirq(d);
+
+- /* Setup proper .irq_set_type function */
+- gpio_irqchip.irq_set_type = at91_gpio->ops->irq_type;
++ gpio_irqchip->name = "GPIO";
++ gpio_irqchip->irq_ack = gpio_irq_ack;
++ gpio_irqchip->irq_disable = gpio_irq_mask;
++ gpio_irqchip->irq_mask = gpio_irq_mask;
++ gpio_irqchip->irq_unmask = gpio_irq_unmask;
++ gpio_irqchip->irq_set_wake = gpio_irq_set_wake,
++ gpio_irqchip->irq_set_type = at91_gpio->ops->irq_type;
+
+ /* Disable irqs of this PIO controller */
+ writel_relaxed(~0, at91_gpio->regbase + PIO_IDR);
+@@ -1632,7 +1632,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ * interrupt.
+ */
+ ret = gpiochip_irqchip_add(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ 0,
+ handle_edge_irq,
+ IRQ_TYPE_NONE);
+@@ -1650,7 +1650,7 @@ static int at91_gpio_of_irq_setup(struct platform_device *pdev,
+ if (!gpiochip_prev) {
+ /* Then register the chain on the parent IRQ */
+ gpiochip_set_chained_irqchip(&at91_gpio->chip,
+- &gpio_irqchip,
++ gpio_irqchip,
+ at91_gpio->pioc_virq,
+ gpio_irq_handler);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 151d74819aa075a892c0f4efd149151d61dc2efc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:37:45 +0300
+Subject: pinctrl: at91-pio4: fix has_config check in
+ atmel_pctl_dt_subnode_to_map()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b97760ae8e3dc8bb91881c13425a0bff55f2bd85 ]
+
+Smatch complains about this condition:
+
+ if (has_config && num_pins >= 1)
+
+The "has_config" variable is either uninitialized or true. The
+"num_pins" variable is unsigned and we verified that it is non-zero on
+the lines before so we know "num_pines >= 1" is true. Really, we could
+just check "num_configs" directly and remove the "has_config" variable.
+
+Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
+index e61e2f8c91ce8..e9d7977072553 100644
+--- a/drivers/pinctrl/pinctrl-at91-pio4.c
++++ b/drivers/pinctrl/pinctrl-at91-pio4.c
+@@ -483,7 +483,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ unsigned num_pins, num_configs, reserve;
+ unsigned long *configs;
+ struct property *pins;
+- bool has_config;
+ u32 pinfunc;
+ int ret, i;
+
+@@ -499,9 +498,6 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ return ret;
+ }
+
+- if (num_configs)
+- has_config = true;
+-
+ num_pins = pins->length / sizeof(u32);
+ if (!num_pins) {
+ dev_err(pctldev->dev, "no pins found in node %pOF\n", np);
+@@ -514,7 +510,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ * map for each pin.
+ */
+ reserve = 1;
+- if (has_config && num_pins >= 1)
++ if (num_configs)
+ reserve++;
+ reserve *= num_pins;
+ ret = pinctrl_utils_reserve_map(pctldev, map, reserved_maps, num_maps,
+@@ -537,7 +533,7 @@ static int atmel_pctl_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ pinctrl_utils_add_map_mux(pctldev, map, reserved_maps, num_maps,
+ group, func);
+
+- if (has_config) {
++ if (num_configs) {
+ ret = pinctrl_utils_add_map_configs(pctldev, map,
+ reserved_maps, num_maps, group,
+ configs, num_configs,
+--
+2.20.1
+
--- /dev/null
+From d9dc1cd22528acbd598e152fbb3652a9070d0fa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 18:42:30 +0200
+Subject: pinctrl: ingenic: Probe driver at subsys_initcall
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 556a36a71ed80e17ade49225b58513ea3c9e4558 ]
+
+Using postcore_initcall() makes the driver try to initialize way too
+early.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-ingenic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
+index 103aaab413570..1541f8cba5562 100644
+--- a/drivers/pinctrl/pinctrl-ingenic.c
++++ b/drivers/pinctrl/pinctrl-ingenic.c
+@@ -849,4 +849,4 @@ static int __init ingenic_pinctrl_drv_register(void)
+ {
+ return platform_driver_register(&ingenic_pinctrl_driver);
+ }
+-postcore_initcall(ingenic_pinctrl_drv_register);
++subsys_initcall(ingenic_pinctrl_drv_register);
+--
+2.20.1
+
--- /dev/null
+From 7d247629063096b9ba6eeaca224c41e3a3544898 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 14:50:11 +0300
+Subject: power: reset: at91-poweroff: do not procede if at91_shdwc is
+ allocated
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 9f1e44774be578fb92776add95f1fcaf8284d692 ]
+
+There should be only one instance of struct shdwc in the system. This is
+referenced through at91_shdwc. Return in probe if at91_shdwc is already
+allocated.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/at91-sama5d2_shdwc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index 31080c2541249..037976a1fe40b 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -246,6 +246,9 @@ static int __init at91_shdwc_probe(struct platform_device *pdev)
+ if (!pdev->dev.of_node)
+ return -ENODEV;
+
++ if (at91_shdwc)
++ return -EBUSY;
++
+ at91_shdwc = devm_kzalloc(&pdev->dev, sizeof(*at91_shdwc), GFP_KERNEL);
+ if (!at91_shdwc)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From f5c5e8c03646afd17efdcf02917a5df513319b0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:39:04 +0300
+Subject: power: supply: ab8500_fg: silence uninitialized variable warnings
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 54baff8d4e5dce2cef61953b1dc22079cda1ddb1 ]
+
+If kstrtoul() fails then we print "charge_full" when it's uninitialized.
+The debug printk doesn't add anything so I deleted it and cleaned these
+two functions up a bit.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/ab8500_fg.c | 31 ++++++++++++-------------------
+ 1 file changed, 12 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c
+index c569f82a00718..b87768238b702 100644
+--- a/drivers/power/supply/ab8500_fg.c
++++ b/drivers/power/supply/ab8500_fg.c
+@@ -2437,17 +2437,14 @@ static ssize_t charge_full_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_full;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_full);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_full %lu", ret, charge_full);
+-
+- if (!ret) {
+- di->bat_cap.max_mah = (int) charge_full;
+- ret = count;
+- }
+- return ret;
++ di->bat_cap.max_mah = (int) charge_full;
++ return count;
+ }
+
+ static ssize_t charge_now_show(struct ab8500_fg *di, char *buf)
+@@ -2459,20 +2456,16 @@ static ssize_t charge_now_store(struct ab8500_fg *di, const char *buf,
+ size_t count)
+ {
+ unsigned long charge_now;
+- ssize_t ret;
++ int ret;
+
+ ret = kstrtoul(buf, 10, &charge_now);
++ if (ret)
++ return ret;
+
+- dev_dbg(di->dev, "Ret %zd charge_now %lu was %d",
+- ret, charge_now, di->bat_cap.prev_mah);
+-
+- if (!ret) {
+- di->bat_cap.user_mah = (int) charge_now;
+- di->flags.user_cap = true;
+- ret = count;
+- queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
+- }
+- return ret;
++ di->bat_cap.user_mah = (int) charge_now;
++ di->flags.user_cap = true;
++ queue_delayed_work(di->fg_wq, &di->fg_periodic_work, 0);
++ return count;
+ }
+
+ static struct ab8500_fg_sysfs_entry charge_full_attr =
+--
+2.20.1
+
--- /dev/null
+From 4aa6a61439197ced3a4a9adbf02114ec4023a880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Jul 2018 18:05:07 +0200
+Subject: power: supply: max8998-charger: Fix platform data retrieval
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Figa <tomasz.figa@gmail.com>
+
+[ Upstream commit cb90a2c6f77fe9b43d1e3f759bb2f13fe7fa1811 ]
+
+Since the max8998 MFD driver supports instantiation by DT, platform data
+retrieval is handled in MFD probe and cell drivers should get use
+the pdata field of max8998_dev struct to obtain them.
+
+Fixes: ee999fb3f17f ("mfd: max8998: Add support for Device Tree")
+Signed-off-by: Tomasz Figa <tomasz.figa@gmail.com>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max8998_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/max8998_charger.c b/drivers/power/supply/max8998_charger.c
+index b64cf0f141425..66438029bdd0c 100644
+--- a/drivers/power/supply/max8998_charger.c
++++ b/drivers/power/supply/max8998_charger.c
+@@ -85,7 +85,7 @@ static const struct power_supply_desc max8998_battery_desc = {
+ static int max8998_battery_probe(struct platform_device *pdev)
+ {
+ struct max8998_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+- struct max8998_platform_data *pdata = dev_get_platdata(iodev->dev);
++ struct max8998_platform_data *pdata = iodev->pdata;
+ struct power_supply_config psy_cfg = {};
+ struct max8998_battery_data *max8998;
+ struct i2c_client *i2c;
+--
+2.20.1
+
--- /dev/null
+From 76c3f2bf0bed7730662f786b9ceba045393727a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:00:07 +0200
+Subject: power: supply: twl4030_charger: disable eoc interrupt on linear
+ charge
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 079cdff3d0a09c5da10ae1be35def7a116776328 ]
+
+This avoids getting woken up from suspend after power interruptions
+when the bci wrongly thinks the battery is full just because
+of input current going low because of low input power
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/twl4030_charger.c | 27 +++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index d3cba954bab54..b20491016b1e4 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -440,6 +440,7 @@ static void twl4030_current_worker(struct work_struct *data)
+ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ {
+ int ret;
++ u32 reg;
+
+ if (bci->usb_mode == CHARGE_OFF)
+ enable = false;
+@@ -453,14 +454,38 @@ static int twl4030_charger_enable_usb(struct twl4030_bci *bci, bool enable)
+ bci->usb_enabled = 1;
+ }
+
+- if (bci->usb_mode == CHARGE_AUTO)
++ if (bci->usb_mode == CHARGE_AUTO) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_ICHGEOC |
++ TWL4030_TBATOR2 | TWL4030_TBATOR1 |
++ TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ /* forcing the field BCIAUTOUSB (BOOT_BCI[1]) to 1 */
+ ret = twl4030_clear_set_boot_bci(0, TWL4030_BCIAUTOUSB);
++ }
+
+ /* forcing USBFASTMCHG(BCIMFSTS4[2]) to 1 */
+ ret = twl4030_clear_set(TWL_MODULE_MAIN_CHARGE, 0,
+ TWL4030_USBFASTMCHG, TWL4030_BCIMFSTS4);
+ if (bci->usb_mode == CHARGE_LINEAR) {
++ /* Enable interrupts now. */
++ reg = ~(u32)(TWL4030_ICHGLOW | TWL4030_TBATOR2 |
++ TWL4030_TBATOR1 | TWL4030_BATSTS);
++ ret = twl_i2c_write_u8(TWL4030_MODULE_INTERRUPTS, reg,
++ TWL4030_INTERRUPTS_BCIIMR1A);
++ if (ret < 0) {
++ dev_err(bci->dev,
++ "failed to unmask interrupts: %d\n",
++ ret);
++ return ret;
++ }
+ twl4030_clear_set_boot_bci(TWL4030_BCIAUTOAC|TWL4030_CVENAC, 0);
+ /* Watch dog key: WOVF acknowledge */
+ ret = twl_i2c_write_u8(TWL_MODULE_MAIN_CHARGE, 0x33,
+--
+2.20.1
+
--- /dev/null
+From cf11fa5d4f2b850262a3da12599ed80071366494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 07:20:35 +0200
+Subject: power: supply: twl4030_charger: fix charging current out-of-bounds
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 8314c212f995bc0d06b54ad02ef0ab4089781540 ]
+
+the charging current uses unsigned int variables, if we step back
+if the current is still low, we would run into negative which
+means setting the target to a huge value.
+Better add checks here.
+
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/twl4030_charger.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index 0cc12bfe7b020..d3cba954bab54 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -420,7 +420,8 @@ static void twl4030_current_worker(struct work_struct *data)
+
+ if (v < USB_MIN_VOLT) {
+ /* Back up and stop adjusting. */
+- bci->usb_cur -= USB_CUR_STEP;
++ if (bci->usb_cur >= USB_CUR_STEP)
++ bci->usb_cur -= USB_CUR_STEP;
+ bci->usb_cur_target = bci->usb_cur;
+ } else if (bci->usb_cur >= bci->usb_cur_target ||
+ bci->usb_cur + USB_CUR_STEP > USB_MAX_CURRENT) {
+--
+2.20.1
+
--- /dev/null
+From 1b749e5941201a7153cb5772de873661501fef68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Sep 2018 01:30:45 +1000
+Subject: powerpc/64s/hash: Fix stab_rr off by one initialization
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 09b4438db13fa83b6219aee5993711a2aa2a0c64 ]
+
+This causes SLB alloation to start 1 beyond the start of the SLB.
+There is no real problem because after it wraps it stats behaving
+properly, it's just surprisig to see when looking at SLB traces.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/slb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c
+index 6d9bf014b3e78..2502fe3bfb54a 100644
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -315,7 +315,7 @@ void slb_initialize(void)
+ #endif
+ }
+
+- get_paca()->stab_rr = SLB_NUM_BOLTED;
++ get_paca()->stab_rr = SLB_NUM_BOLTED - 1;
+
+ lflags = SLB_VSID_KERNEL | linear_llp;
+ vflags = SLB_VSID_KERNEL | vmalloc_llp;
+--
+2.20.1
+
--- /dev/null
+From 43c32e9b5063a23e4a169ac975d739246dfea8c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 13:36:48 +0930
+Subject: powerpc: Fix duplicate const clang warning in user access code
+
+From: Anton Blanchard <anton@samba.org>
+
+[ Upstream commit e00d93ac9a189673028ac125a74b9bc8ae73eebc ]
+
+This re-applies commit b91c1e3e7a6f ("powerpc: Fix duplicate const
+clang warning in user access code") (Jun 2015) which was undone in
+commits:
+ f2ca80905929 ("powerpc/sparse: Constify the address pointer in __get_user_nosleep()") (Feb 2017)
+ d466f6c5cac1 ("powerpc/sparse: Constify the address pointer in __get_user_nocheck()") (Feb 2017)
+ f84ed59a612d ("powerpc/sparse: Constify the address pointer in __get_user_check()") (Feb 2017)
+
+We see a large number of duplicate const errors in the user access
+code when building with llvm/clang:
+
+ include/linux/pagemap.h:576:8: warning: duplicate 'const' declaration specifier [-Wduplicate-decl-specifier]
+ ret = __get_user(c, uaddr);
+
+The problem is we are doing const __typeof__(*(ptr)), which will hit
+the warning if ptr is marked const.
+
+Removing const does not seem to have any effect on GCC code
+generation.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/uaccess.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 51f00c00d7e49..3865d1d235976 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -234,7 +234,7 @@ do { \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ __chk_user_ptr(ptr); \
+ if (!is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+@@ -248,7 +248,7 @@ do { \
+ ({ \
+ long __gu_err = -EFAULT; \
+ __long_type(*(ptr)) __gu_val = 0; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ might_fault(); \
+ if (access_ok(VERIFY_READ, __gu_addr, (size))) { \
+ barrier_nospec(); \
+@@ -262,7 +262,7 @@ do { \
+ ({ \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+- const __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+ __chk_user_ptr(ptr); \
+ barrier_nospec(); \
+ __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
+--
+2.20.1
+
--- /dev/null
+From ba6a73a32b2859e0f79c7ff1bf2c157d8befe8f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 15:44:48 -0300
+Subject: powerpc/iommu: Avoid derefence before pointer check
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 984ecdd68de0fa1f63ce205d6c19ef5a7bc67b40 ]
+
+The tbl pointer is being derefenced by IOMMU_PAGE_SIZE prior the check
+if it is not NULL.
+
+Just moving the dereference code to after the check, where there will
+be guarantee that 'tbl' will not be NULL.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
+index af7a20dc6e093..80b6caaa9b92e 100644
+--- a/arch/powerpc/kernel/iommu.c
++++ b/arch/powerpc/kernel/iommu.c
+@@ -785,9 +785,9 @@ dma_addr_t iommu_map_page(struct device *dev, struct iommu_table *tbl,
+
+ vaddr = page_address(page) + offset;
+ uaddr = (unsigned long)vaddr;
+- npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+
+ if (tbl) {
++ npages = iommu_num_pages(uaddr, size, IOMMU_PAGE_SIZE(tbl));
+ align = 0;
+ if (tbl->it_page_shift < PAGE_SHIFT && size >= PAGE_SIZE &&
+ ((unsigned long)vaddr & ~PAGE_MASK) == 0)
+--
+2.20.1
+
--- /dev/null
+From d1d274fa9331d4db2fe8ba02af1bdbc8fc630523 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 14:14:02 -0500
+Subject: powerpc/pseries: Disable CPU hotplug across migrations
+
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+
+[ Upstream commit 85a88cabad57d26d826dd94ea34d3a785824d802 ]
+
+When performing partition migrations all present CPUs must be online
+as all present CPUs must make the H_JOIN call as part of the migration
+process. Once all present CPUs make the H_JOIN call, one CPU is returned
+to make the rtas call to perform the migration to the destination system.
+
+During testing of migration and changing the SMT state we have found
+instances where CPUs are offlined, as part of the SMT state change,
+before they make the H_JOIN call. This results in a hung system where
+every CPU is either in H_JOIN or offline.
+
+To prevent this this patch disables CPU hotplug during the migration
+process.
+
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 141d192c69538..a01f83ba739ef 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -984,6 +984,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ goto out;
+ }
+
++ cpu_hotplug_disable();
+ stop_topology_update();
+
+ /* Call function on all CPUs. One of us will make the
+@@ -998,6 +999,7 @@ int rtas_ibm_suspend_me(u64 handle)
+ printk(KERN_ERR "Error doing global join\n");
+
+ start_topology_update();
++ cpu_hotplug_enable();
+
+ /* Take down CPUs not online prior to suspend */
+ cpuret = rtas_offline_cpus_mask(offline_mask);
+--
+2.20.1
+
--- /dev/null
+From 6e5648c96bd603824e7d6fc5c3d2e4ac026332b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Sep 2018 13:10:04 +0930
+Subject: powerpc/vdso: Correct call frame information
+
+From: Alan Modra <amodra@gmail.com>
+
+[ Upstream commit 56d20861c027498b5a1112b4f9f05b56d906fdda ]
+
+Call Frame Information is used by gdb for back-traces and inserting
+breakpoints on function return for the "finish" command. This failed
+when inside __kernel_clock_gettime. More concerning than difficulty
+debugging is that CFI is also used by stack frame unwinding code to
+implement exceptions. If you have an app that needs to handle
+asynchronous exceptions for some reason, and you are unlucky enough to
+get one inside the VDSO time functions, your app will crash.
+
+What's wrong: There is control flow in __kernel_clock_gettime that
+reaches label 99 without saving lr in r12. CFI info however is
+interpreted by the unwinder without reference to control flow: It's a
+simple matter of "Execute all the CFI opcodes up to the current
+address". That means the unwinder thinks r12 contains the return
+address at label 99. Disabuse it of that notion by resetting CFI for
+the return address at label 99.
+
+Note that the ".cfi_restore lr" could have gone anywhere from the
+"mtlr r12" a few instructions earlier to the instruction at label 99.
+I put the CFI as late as possible, because in general that's best
+practice (and if possible grouped with other CFI in order to reduce
+the number of CFI opcodes executed when unwinding). Using r12 as the
+return address is perfectly fine after the "mtlr r12" since r12 on
+that code path still contains the return address.
+
+__get_datapage also has a CFI error. That function temporarily saves
+lr in r0, and reflects that fact with ".cfi_register lr,r0". A later
+use of r0 means the CFI at that point isn't correct, as r0 no longer
+contains the return address. Fix that too.
+
+Signed-off-by: Alan Modra <amodra@gmail.com>
+Tested-by: Reza Arbab <arbab@linux.ibm.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vdso32/datapage.S | 1 +
+ arch/powerpc/kernel/vdso32/gettimeofday.S | 1 +
+ arch/powerpc/kernel/vdso64/datapage.S | 1 +
+ arch/powerpc/kernel/vdso64/gettimeofday.S | 1 +
+ 4 files changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/kernel/vdso32/datapage.S b/arch/powerpc/kernel/vdso32/datapage.S
+index 3745113fcc652..2a7eb5452aba7 100644
+--- a/arch/powerpc/kernel/vdso32/datapage.S
++++ b/arch/powerpc/kernel/vdso32/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso32/gettimeofday.S b/arch/powerpc/kernel/vdso32/gettimeofday.S
+index 769c2624e0a6b..1e0bc5955a400 100644
+--- a/arch/powerpc/kernel/vdso32/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S
+@@ -139,6 +139,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index abf17feffe404..bf96686915116 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -37,6 +37,7 @@ data_page_branch:
+ mtlr r0
+ addi r3, r3, __kernel_datapage_offset-data_page_branch
+ lwz r0,0(r3)
++ .cfi_restore lr
+ add r3,r0,r3
+ blr
+ .cfi_endproc
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index 3820213248836..09b2a49f6dd53 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -124,6 +124,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime)
+ */
+ 99:
+ li r0,__NR_clock_gettime
++ .cfi_restore lr
+ sc
+ blr
+ .cfi_endproc
+--
+2.20.1
+
--- /dev/null
+From 6f427424b0625beee60a6355760072ab54315e26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Sep 2018 10:55:31 +0300
+Subject: RDMA/core: Follow correct unregister order between sysfs and cgroup
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit c715a39541bb399eb03d728a996b224d90ce1336 ]
+
+During register_device() init sequence is,
+(a) register with rdma cgroup followed by
+(b) register with sysfs
+
+Therefore, unregister_device() sequence should follow the reverse order.
+
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 61ade4b3e7bb5..6b0d1d8609cad 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -599,8 +599,8 @@ void ib_unregister_device(struct ib_device *device)
+ }
+ up_read(&lists_rwsem);
+
+- ib_device_unregister_rdmacg(device);
+ ib_device_unregister_sysfs(device);
++ ib_device_unregister_rdmacg(device);
+
+ mutex_unlock(&device_mutex);
+
+--
+2.20.1
+
--- /dev/null
+From 03cef8931acb727fc4e9d93c8fb56cb75279c051 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 14:45:31 +0300
+Subject: RDMA/core: Rate limit MAD error messages
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit f9d08f1e1939ad4d92e38bd3dee6842512f5bee6 ]
+
+While registering a mad agent, a user space can trigger various errors
+and flood the logs.
+
+Therefore, decrease verbosity and rate limit such error messages.
+While we are at it, use __func__ to print function name.
+
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/mad.c | 72 ++++++++++++++++++-----------------
+ 1 file changed, 37 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index e4339b9e43a54..6072ac7023cb7 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -217,30 +217,30 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ /* Validate parameters */
+ qpn = get_spl_qp_index(qp_type);
+ if (qpn == -1) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid QP Type %d\n",
+- qp_type);
++ dev_dbg_ratelimited(&device->dev, "%s: invalid QP Type %d\n",
++ __func__, qp_type);
+ goto error1;
+ }
+
+ if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid RMPP Version %u\n",
+- rmpp_version);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: invalid RMPP Version %u\n",
++ __func__, rmpp_version);
+ goto error1;
+ }
+
+ /* Validate MAD registration request if supplied */
+ if (mad_reg_req) {
+ if (mad_reg_req->mgmt_class_version >= MAX_MGMT_VERSION) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: invalid Class Version %u\n",
+- mad_reg_req->mgmt_class_version);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: invalid Class Version %u\n",
++ __func__,
++ mad_reg_req->mgmt_class_version);
+ goto error1;
+ }
+ if (!recv_handler) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: no recv_handler\n");
++ dev_dbg_ratelimited(&device->dev,
++ "%s: no recv_handler\n", __func__);
+ goto error1;
+ }
+ if (mad_reg_req->mgmt_class >= MAX_MGMT_CLASS) {
+@@ -250,9 +250,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ */
+ if (mad_reg_req->mgmt_class !=
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid Mgmt Class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid Mgmt Class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ } else if (mad_reg_req->mgmt_class == 0) {
+@@ -260,8 +260,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ * Class 0 is reserved in IBA and is used for
+ * aliasing of IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
+ */
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid Mgmt Class 0\n");
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid Mgmt Class 0\n",
++ __func__);
+ goto error1;
+ } else if (is_vendor_class(mad_reg_req->mgmt_class)) {
+ /*
+@@ -269,18 +270,19 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ * ensure supplied OUI is not zero
+ */
+ if (!is_vendor_oui(mad_reg_req->oui)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: No OUI specified for class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: No OUI specified for class 0x%x\n",
++ __func__,
++ mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+ /* Make sure class supplied is consistent with RMPP */
+ if (!ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
+ if (rmpp_version) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: RMPP version for non-RMPP class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: RMPP version for non-RMPP class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+@@ -291,9 +293,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ IB_MGMT_CLASS_SUBN_LID_ROUTED) &&
+ (mad_reg_req->mgmt_class !=
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid SM QP type: class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid SM QP type: class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ } else {
+@@ -301,9 +303,9 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ IB_MGMT_CLASS_SUBN_LID_ROUTED) ||
+ (mad_reg_req->mgmt_class ==
+ IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid GS QP type: class 0x%x\n",
+- mad_reg_req->mgmt_class);
++ dev_dbg_ratelimited(&device->dev,
++ "%s: Invalid GS QP type: class 0x%x\n",
++ __func__, mad_reg_req->mgmt_class);
+ goto error1;
+ }
+ }
+@@ -318,18 +320,18 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
+ /* Validate device and port */
+ port_priv = ib_get_mad_port(device, port_num);
+ if (!port_priv) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: Invalid port %d\n",
+- port_num);
++ dev_dbg_ratelimited(&device->dev, "%s: Invalid port %d\n",
++ __func__, port_num);
+ ret = ERR_PTR(-ENODEV);
+ goto error1;
+ }
+
+- /* Verify the QP requested is supported. For example, Ethernet devices
+- * will not have QP0 */
++ /* Verify the QP requested is supported. For example, Ethernet devices
++ * will not have QP0.
++ */
+ if (!port_priv->qp_info[qpn].qp) {
+- dev_notice(&device->dev,
+- "ib_register_mad_agent: QP %d not supported\n", qpn);
++ dev_dbg_ratelimited(&device->dev, "%s: QP %d not supported\n",
++ __func__, qpn);
+ ret = ERR_PTR(-EPROTONOSUPPORT);
+ goto error1;
+ }
+--
+2.20.1
+
--- /dev/null
+From ad88360843c3580f34403463634e54cc3eedff25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 16:07:07 +0200
+Subject: RDMA/i40iw: Fix incorrect iterator type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <Haakon.Bugge@oracle.com>
+
+[ Upstream commit 802fa45cd320de319e86c93bca72abec028ba059 ]
+
+Commit f27b4746f378 ("i40iw: add connection management code") uses an
+incorrect rcu iterator, whilst holding the rtnl_lock. Since the
+critical region invokes i40iw_manage_qhash(), which is a sleeping
+function, the rcu locking and traversal cannot be used.
+
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index b7f1ce5333cb8..880c63579ba88 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1667,7 +1667,7 @@ static enum i40iw_status_code i40iw_add_mqh_6(struct i40iw_device *iwdev,
+ unsigned long flags;
+
+ rtnl_lock();
+- for_each_netdev_rcu(&init_net, ip_dev) {
++ for_each_netdev(&init_net, ip_dev) {
+ if ((((rdma_vlan_dev_vlan_id(ip_dev) < I40IW_NO_VLAN) &&
+ (rdma_vlan_dev_real_dev(ip_dev) == iwdev->netdev)) ||
+ (ip_dev == iwdev->netdev)) && (ip_dev->flags & IFF_UP)) {
+--
+2.20.1
+
--- /dev/null
+From e08fe9432ba7e70b415394db67cad0ffb6c80fd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 17:49:19 -0700
+Subject: remoteproc/davinci: Use %zx for formating size_t
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 1e28dbbeced6152b9ea7c417ff8cef3f7dcf0f19 ]
+
+da8xx_rproc_mem size is of type size_t, so use %zx to format the debug
+print of it to avoid a compile warning.
+
+Acked-by: Suman Anna <s-anna@ti.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/da8xx_remoteproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/da8xx_remoteproc.c b/drivers/remoteproc/da8xx_remoteproc.c
+index bf3b9034c319e..a127d2ccd7ca5 100644
+--- a/drivers/remoteproc/da8xx_remoteproc.c
++++ b/drivers/remoteproc/da8xx_remoteproc.c
+@@ -207,7 +207,7 @@ static int da8xx_rproc_get_internal_memories(struct platform_device *pdev,
+ res->start & DA8XX_RPROC_LOCAL_ADDRESS_MASK;
+ drproc->mem[i].size = resource_size(res);
+
+- dev_dbg(dev, "memory %8s: bus addr %pa size 0x%x va %p da 0x%x\n",
++ dev_dbg(dev, "memory %8s: bus addr %pa size 0x%zx va %p da 0x%x\n",
+ mem_names[i], &drproc->mem[i].bus_addr,
+ drproc->mem[i].size, drproc->mem[i].cpu_addr,
+ drproc->mem[i].dev_addr);
+--
+2.20.1
+
--- /dev/null
+From 68803b2fc3b2acef3cb256b3f23d336b0a1460fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Sep 2018 16:25:34 +0200
+Subject: rtc: armada38x: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 7d61cbb945a753af08e247b5f10bdd5dbb8d6c80 ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-armada38x.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/rtc/rtc-armada38x.c b/drivers/rtc/rtc-armada38x.c
+index 21f355c37eab5..10b5c85490392 100644
+--- a/drivers/rtc/rtc-armada38x.c
++++ b/drivers/rtc/rtc-armada38x.c
+@@ -390,7 +390,6 @@ MODULE_DEVICE_TABLE(of, armada38x_rtc_of_match_table);
+
+ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ {
+- const struct rtc_class_ops *ops;
+ struct resource *res;
+ struct armada38x_rtc *rtc;
+ const struct of_device_id *match;
+@@ -427,6 +426,11 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "no irq\n");
+ return rtc->irq;
+ }
++
++ rtc->rtc_dev = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(rtc->rtc_dev))
++ return PTR_ERR(rtc->rtc_dev);
++
+ if (devm_request_irq(&pdev->dev, rtc->irq, armada38x_rtc_alarm_irq,
+ 0, pdev->name, rtc) < 0) {
+ dev_warn(&pdev->dev, "Interrupt not available.\n");
+@@ -436,28 +440,24 @@ static __init int armada38x_rtc_probe(struct platform_device *pdev)
+
+ if (rtc->irq != -1) {
+ device_init_wakeup(&pdev->dev, 1);
+- ops = &armada38x_rtc_ops;
++ rtc->rtc_dev->ops = &armada38x_rtc_ops;
+ } else {
+ /*
+ * If there is no interrupt available then we can't
+ * use the alarm
+ */
+- ops = &armada38x_rtc_ops_noirq;
++ rtc->rtc_dev->ops = &armada38x_rtc_ops_noirq;
+ }
+ rtc->data = (struct armada38x_rtc_data *)match->data;
+
+-
+ /* Update RTC-MBUS bridge timing parameters */
+ rtc->data->update_mbus_timing(rtc);
+
+- rtc->rtc_dev = devm_rtc_device_register(&pdev->dev, pdev->name,
+- ops, THIS_MODULE);
+- if (IS_ERR(rtc->rtc_dev)) {
+- ret = PTR_ERR(rtc->rtc_dev);
++ ret = rtc_register_device(rtc->rtc_dev);
++ if (ret)
+ dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret);
+- return ret;
+- }
+- return 0;
++
++ return ret;
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+--
+2.20.1
+
--- /dev/null
+From c1275c9d079b33f5eecaa6151c153b0565450998 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Sep 2018 22:38:46 +0200
+Subject: rtc: mt6397: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit babab2f86440352d24e76118fdd7d40cab5fd7bf ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Acked-by: Eddie Huang <eddie.huang@mediatek.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-mt6397.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/rtc/rtc-mt6397.c b/drivers/rtc/rtc-mt6397.c
+index 1a61fa56f3ad7..e82df43e5ca28 100644
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -333,6 +333,10 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+
+ platform_set_drvdata(pdev, rtc);
+
++ rtc->rtc_dev = devm_rtc_allocate_device(rtc->dev);
++ if (IS_ERR(rtc->rtc_dev))
++ return PTR_ERR(rtc->rtc_dev);
++
+ ret = request_threaded_irq(rtc->irq, NULL,
+ mtk_rtc_irq_handler_thread,
+ IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
+@@ -345,11 +349,11 @@ static int mtk_rtc_probe(struct platform_device *pdev)
+
+ device_init_wakeup(&pdev->dev, 1);
+
+- rtc->rtc_dev = rtc_device_register("mt6397-rtc", &pdev->dev,
+- &mtk_rtc_ops, THIS_MODULE);
+- if (IS_ERR(rtc->rtc_dev)) {
++ rtc->rtc_dev->ops = &mtk_rtc_ops;
++
++ ret = rtc_register_device(rtc->rtc_dev);
++ if (ret) {
+ dev_err(&pdev->dev, "register rtc device failed\n");
+- ret = PTR_ERR(rtc->rtc_dev);
+ goto out_free_irq;
+ }
+
+@@ -366,7 +370,6 @@ static int mtk_rtc_remove(struct platform_device *pdev)
+ {
+ struct mt6397_rtc *rtc = platform_get_drvdata(pdev);
+
+- rtc_device_unregister(rtc->rtc_dev);
+ free_irq(rtc->irq, rtc->rtc_dev);
+ irq_dispose_mapping(rtc->irq);
+
+--
+2.20.1
+
--- /dev/null
+From 1557314f4ac5bea089f40d678e189e6b073d2124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Sep 2018 22:38:47 +0200
+Subject: rtc: pl030: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit c778ec85825dc895936940072aea9fe9037db684 ]
+
+The IRQ is requested before the struct rtc is allocated and registered, but
+this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before requesting the IRQ.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pl030.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pl030.c b/drivers/rtc/rtc-pl030.c
+index f85a1a93e669f..343bb6ed17839 100644
+--- a/drivers/rtc/rtc-pl030.c
++++ b/drivers/rtc/rtc-pl030.c
+@@ -112,6 +112,13 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id)
+ goto err_rtc;
+ }
+
++ rtc->rtc = devm_rtc_allocate_device(&dev->dev);
++ if (IS_ERR(rtc->rtc)) {
++ ret = PTR_ERR(rtc->rtc);
++ goto err_rtc;
++ }
++
++ rtc->rtc->ops = &pl030_ops;
+ rtc->base = ioremap(dev->res.start, resource_size(&dev->res));
+ if (!rtc->base) {
+ ret = -ENOMEM;
+@@ -128,12 +135,9 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id)
+ if (ret)
+ goto err_irq;
+
+- rtc->rtc = rtc_device_register("pl030", &dev->dev, &pl030_ops,
+- THIS_MODULE);
+- if (IS_ERR(rtc->rtc)) {
+- ret = PTR_ERR(rtc->rtc);
++ ret = rtc_register_device(rtc->rtc);
++ if (ret)
+ goto err_reg;
+- }
+
+ return 0;
+
+@@ -154,7 +158,6 @@ static int pl030_remove(struct amba_device *dev)
+ writel(0, rtc->base + RTC_CR);
+
+ free_irq(dev->irq[0], rtc);
+- rtc_device_unregister(rtc->rtc);
+ iounmap(rtc->base);
+ amba_release_regions(dev);
+
+--
+2.20.1
+
--- /dev/null
+From 7f89cdbf640853e08046a90e7cf34e04afc25d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 23:23:43 +0200
+Subject: rtc: rv8803: fix the rv8803 id in the OF table
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit c856618d20662695fcdb47bf4d560dc457662aec ]
+
+The ID for RV8803 must be rv_8803
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-rv8803.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-rv8803.c b/drivers/rtc/rtc-rv8803.c
+index aae2576741a61..6e06fb3b0b928 100644
+--- a/drivers/rtc/rtc-rv8803.c
++++ b/drivers/rtc/rtc-rv8803.c
+@@ -622,7 +622,7 @@ MODULE_DEVICE_TABLE(i2c, rv8803_id);
+ static const struct of_device_id rv8803_of_match[] = {
+ {
+ .compatible = "microcrystal,rv8803",
+- .data = (void *)rx_8900
++ .data = (void *)rv_8803
+ },
+ {
+ .compatible = "epson,rx8900",
+--
+2.20.1
+
--- /dev/null
+From 0bce53cd3106549814afbe7c2a769263b8cfa9b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 13:48:31 -0500
+Subject: rtl8187: Fix warning generated when strncpy() destination length
+ matches the sixe argument
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 199ba9faca909e77ac533449ecd1248123ce89e7 ]
+
+In gcc8, when the 3rd argument (size) of a call to strncpy() matches the
+length of the first argument, the compiler warns of the possibility of an
+unterminated string. Using strlcpy() forces a null at the end.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+index c2d5b495c179a..c089540116fa7 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/leds.c
+@@ -146,7 +146,7 @@ static int rtl8187_register_led(struct ieee80211_hw *dev,
+ led->dev = dev;
+ led->ledpin = ledpin;
+ led->is_radio = is_radio;
+- strncpy(led->name, name, sizeof(led->name));
++ strlcpy(led->name, name, sizeof(led->name));
+
+ led->led_dev.name = led->name;
+ led->led_dev.default_trigger = default_trigger;
+--
+2.20.1
+
--- /dev/null
+From 9e4b653c61c891843a8fc57e1c068e4237447d56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 17:36:06 +0200
+Subject: s390/qeth: invoke softirqs after napi_schedule()
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 4d19db777a2f32c9b76f6fd517ed8960576cb43e ]
+
+Calling napi_schedule() from process context does not ensure that the
+NET_RX softirq is run in a timely fashion. So trigger it manually.
+
+This is no big issue with current code. A call to ndo_open() is usually
+followed by a ndo_set_rx_mode() call, and for qeth this contains a
+spin_unlock_bh(). Except for OSN, where qeth_l2_set_rx_mode() bails out
+early.
+Nevertheless it's best to not depend on this behaviour, and just fix
+the issue at its source like all other drivers do. For instance see
+commit 83a0c6e58901 ("i40e: Invoke softirqs after napi_reschedule").
+
+Fixes: a1c3ed4c9ca0 ("qeth: NAPI support for l2 and l3 discipline")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_l2_main.c | 3 +++
+ drivers/s390/net/qeth_l3_main.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 2845316db5545..6fa07c2469150 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -869,7 +869,10 @@ static int __qeth_l2_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index d9830c86d0c11..8bccfd686b735 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2849,7 +2849,10 @@ static int __qeth_l3_open(struct net_device *dev)
+
+ if (qdio_stop_irq(card->data.ccwdev, 0) >= 0) {
+ napi_enable(&card->napi);
++ local_bh_disable();
+ napi_schedule(&card->napi);
++ /* kick-start the NAPI softirq: */
++ local_bh_enable();
+ } else
+ rc = -EIO;
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 35eae88e6f7d34225539c1355038b91f523efa02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Sep 2018 22:08:13 -0700
+Subject: samples/bpf: fix a compilation failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 534e0e52bc23de588e81b5a6f75e10c8c4b189fc ]
+
+samples/bpf build failed with the following errors:
+
+ $ make samples/bpf/
+ ...
+ HOSTCC samples/bpf/sockex3_user.o
+ /data/users/yhs/work/net-next/samples/bpf/sockex3_user.c:16:8: error: redefinition of ‘struct bpf_flow_keys’
+ struct bpf_flow_keys {
+ ^
+ In file included from /data/users/yhs/work/net-next/samples/bpf/sockex3_user.c:4:0:
+ ./usr/include/linux/bpf.h:2338:9: note: originally defined here
+ struct bpf_flow_keys *flow_keys;
+ ^
+ make[3]: *** [samples/bpf/sockex3_user.o] Error 1
+
+Commit d58e468b1112d ("flow_dissector: implements flow dissector BPF hook")
+introduced struct bpf_flow_keys in include/uapi/linux/bpf.h and hence
+caused the naming conflict with samples/bpf/sockex3_user.c.
+
+The fix is to rename struct bpf_flow_keys in samples/bpf/sockex3_user.c
+to flow_keys to avoid the conflict.
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/sockex3_user.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/samples/bpf/sockex3_user.c b/samples/bpf/sockex3_user.c
+index 495ee02e2fb7c..4d75674bee35e 100644
+--- a/samples/bpf/sockex3_user.c
++++ b/samples/bpf/sockex3_user.c
+@@ -13,7 +13,7 @@
+ #define PARSE_IP_PROG_FD (prog_fd[0])
+ #define PROG_ARRAY_FD (map_fd[0])
+
+-struct bpf_flow_keys {
++struct flow_keys {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -64,7 +64,7 @@ int main(int argc, char **argv)
+ (void) f;
+
+ for (i = 0; i < 5; i++) {
+- struct bpf_flow_keys key = {}, next_key;
++ struct flow_keys key = {}, next_key;
+ struct pair value;
+
+ sleep(1);
+--
+2.20.1
+
--- /dev/null
+From 1bbabcfed219a99ce14aa19ca1320b6821220616 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:52:03 +0900
+Subject: samples/bpf: fix compilation failure
+
+From: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
+
+[ Upstream commit 32c009798385ce21080beaa87a9b95faad3acd1e ]
+
+following commit:
+commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
+added struct bpf_flow_keys which conflicts with the struct with
+same name in sockex2_kern.c and sockex3_kern.c
+
+similar to commit:
+commit 534e0e52bc23 ("samples/bpf: fix a compilation failure")
+we tried the rename it "flow_keys" but it also conflicted with struct
+having same name in include/net/flow_dissector.h. Hence renaming the
+struct to "flow_key_record". Also, this commit doesn't fix the
+compilation error completely because the similar struct is present in
+sockex3_kern.c. Hence renaming it in both files sockex3_user.c and
+sockex3_kern.c
+
+Signed-off-by: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/sockex2_kern.c | 11 ++++++-----
+ samples/bpf/sockex3_kern.c | 8 ++++----
+ samples/bpf/sockex3_user.c | 4 ++--
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/samples/bpf/sockex2_kern.c b/samples/bpf/sockex2_kern.c
+index f58acfc925561..f2f9dbc021b0d 100644
+--- a/samples/bpf/sockex2_kern.c
++++ b/samples/bpf/sockex2_kern.c
+@@ -14,7 +14,7 @@ struct vlan_hdr {
+ __be16 h_vlan_encapsulated_proto;
+ };
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -59,7 +59,7 @@ static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
+ }
+
+ static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+- struct bpf_flow_keys *flow)
++ struct flow_key_record *flow)
+ {
+ __u64 verlen;
+
+@@ -83,7 +83,7 @@ static inline __u64 parse_ip(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto
+ }
+
+ static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_proto,
+- struct bpf_flow_keys *flow)
++ struct flow_key_record *flow)
+ {
+ *ip_proto = load_byte(skb,
+ nhoff + offsetof(struct ipv6hdr, nexthdr));
+@@ -96,7 +96,8 @@ static inline __u64 parse_ipv6(struct __sk_buff *skb, __u64 nhoff, __u64 *ip_pro
+ return nhoff;
+ }
+
+-static inline bool flow_dissector(struct __sk_buff *skb, struct bpf_flow_keys *flow)
++static inline bool flow_dissector(struct __sk_buff *skb,
++ struct flow_key_record *flow)
+ {
+ __u64 nhoff = ETH_HLEN;
+ __u64 ip_proto;
+@@ -198,7 +199,7 @@ struct bpf_map_def SEC("maps") hash_map = {
+ SEC("socket2")
+ int bpf_prog2(struct __sk_buff *skb)
+ {
+- struct bpf_flow_keys flow = {};
++ struct flow_key_record flow = {};
+ struct pair *value;
+ u32 key;
+
+diff --git a/samples/bpf/sockex3_kern.c b/samples/bpf/sockex3_kern.c
+index 95907f8d2b17d..c527b57d3ec8a 100644
+--- a/samples/bpf/sockex3_kern.c
++++ b/samples/bpf/sockex3_kern.c
+@@ -61,7 +61,7 @@ struct vlan_hdr {
+ __be16 h_vlan_encapsulated_proto;
+ };
+
+-struct bpf_flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -88,7 +88,7 @@ static inline __u32 ipv6_addr_hash(struct __sk_buff *ctx, __u64 off)
+ }
+
+ struct globals {
+- struct bpf_flow_keys flow;
++ struct flow_key_record flow;
+ };
+
+ struct bpf_map_def SEC("maps") percpu_map = {
+@@ -114,14 +114,14 @@ struct pair {
+
+ struct bpf_map_def SEC("maps") hash_map = {
+ .type = BPF_MAP_TYPE_HASH,
+- .key_size = sizeof(struct bpf_flow_keys),
++ .key_size = sizeof(struct flow_key_record),
+ .value_size = sizeof(struct pair),
+ .max_entries = 1024,
+ };
+
+ static void update_stats(struct __sk_buff *skb, struct globals *g)
+ {
+- struct bpf_flow_keys key = g->flow;
++ struct flow_key_record key = g->flow;
+ struct pair *value;
+
+ value = bpf_map_lookup_elem(&hash_map, &key);
+diff --git a/samples/bpf/sockex3_user.c b/samples/bpf/sockex3_user.c
+index 4d75674bee35e..741b899b693f3 100644
+--- a/samples/bpf/sockex3_user.c
++++ b/samples/bpf/sockex3_user.c
+@@ -13,7 +13,7 @@
+ #define PARSE_IP_PROG_FD (prog_fd[0])
+ #define PROG_ARRAY_FD (map_fd[0])
+
+-struct flow_keys {
++struct flow_key_record {
+ __be32 src;
+ __be32 dst;
+ union {
+@@ -64,7 +64,7 @@ int main(int argc, char **argv)
+ (void) f;
+
+ for (i = 0; i < 5; i++) {
+- struct flow_keys key = {}, next_key;
++ struct flow_key_record key = {}, next_key;
+ struct pair value;
+
+ sleep(1);
+--
+2.20.1
+
--- /dev/null
+From 05e91d0e82b8809e1e0a3d62458e124570e51d8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 11:36:36 +0200
+Subject: sched/debug: Use symbolic names for task state constants
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit ff28915fd31ccafc0d38e6f84b66df280ed9e86a ]
+
+include/trace/events/sched.h includes <linux/sched.h> (via
+<linux/sched/numa_balancing.h>) and so knows about the TASK_* constants
+used to interpret .prev_state. So instead of duplicating the magic
+numbers make use of the defined macros to ease understanding the
+mapping from state bits to letters which isn't completely intuitive for
+an outsider.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: kernel@pengutronix.de
+Link: http://lkml.kernel.org/r/20180905093636.24068-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/sched.h | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 6e692a52936c7..18197e0bb5108 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -169,9 +169,14 @@ TRACE_EVENT(sched_switch,
+
+ (__entry->prev_state & (TASK_REPORT_MAX - 1)) ?
+ __print_flags(__entry->prev_state & (TASK_REPORT_MAX - 1), "|",
+- { 0x01, "S" }, { 0x02, "D" }, { 0x04, "T" },
+- { 0x08, "t" }, { 0x10, "X" }, { 0x20, "Z" },
+- { 0x40, "P" }, { 0x80, "I" }) :
++ { TASK_INTERRUPTIBLE, "S" },
++ { TASK_UNINTERRUPTIBLE, "D" },
++ { __TASK_STOPPED, "T" },
++ { __TASK_TRACED, "t" },
++ { EXIT_DEAD, "X" },
++ { EXIT_ZOMBIE, "Z" },
++ { TASK_PARKED, "P" },
++ { TASK_DEAD, "I" }) :
+ "R",
+
+ __entry->prev_state & TASK_REPORT_MAX ? "+" : "",
+--
+2.20.1
+
--- /dev/null
+From bbe4dc0c58859a21d047e27cddf6b850964535e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 10:56:52 +0800
+Subject: scsi: libsas: always unregister the old device if going to discover
+ new
+
+From: Jason Yan <yanaijie@huawei.com>
+
+[ Upstream commit 32c850bf587f993b2620b91e5af8a64a7813f504 ]
+
+If we went into sas_rediscover_dev() the attached_sas_addr was already insured
+not to be zero. So it's unnecessary to check if the attached_sas_addr is zero.
+
+And although if the sas address is not changed, we always have to unregister
+the old device when we are going to register a new one. We cannot just leave
+the device there and bring up the new.
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: chenxiang <chenxiang66@hisilicon.com>
+CC: John Garry <john.garry@huawei.com>
+CC: Johannes Thumshirn <jthumshirn@suse.de>
+CC: Ewan Milne <emilne@redhat.com>
+CC: Christoph Hellwig <hch@lst.de>
+CC: Tomas Henzl <thenzl@redhat.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+CC: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 259ee0d3c3e61..7f2d00354a850 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -2060,14 +2060,11 @@ static int sas_rediscover_dev(struct domain_device *dev, int phy_id, bool last)
+ return res;
+ }
+
+- /* delete the old link */
+- if (SAS_ADDR(phy->attached_sas_addr) &&
+- SAS_ADDR(sas_addr) != SAS_ADDR(phy->attached_sas_addr)) {
+- SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
+- SAS_ADDR(dev->sas_addr), phy_id,
+- SAS_ADDR(phy->attached_sas_addr));
+- sas_unregister_devs_sas_addr(dev, phy_id, last);
+- }
++ /* we always have to delete the old device when we went here */
++ SAS_DPRINTK("ex %016llx phy 0x%x replace %016llx\n",
++ SAS_ADDR(dev->sas_addr), phy_id,
++ SAS_ADDR(phy->attached_sas_addr));
++ sas_unregister_devs_sas_addr(dev, phy_id, last);
+
+ return sas_discover_new(dev, phy_id);
+ }
+--
+2.20.1
+
--- /dev/null
+From 0120cc3409fde89d1e1e21d4251f35de9cd4dc68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 10:30:48 -0700
+Subject: scsi: lpfc: Fix errors in log messages.
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 2879265f514b1f4154288243c91438ddbedb3ed4 ]
+
+Message 6408 is displayed for each entry in an array, but the cpu and queue
+numbers were incorrect for the entry. Message 6001 includes an extraneous
+character.
+
+Resolve both issues
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvme.c | 2 +-
+ drivers/scsi/lpfc/lpfc_nvmet.c | 7 +++----
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 23bdb1ca106e4..6c4499db969c1 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -144,7 +144,7 @@ lpfc_nvme_delete_queue(struct nvme_fc_local_port *pnvme_lport,
+ vport = lport->vport;
+
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME,
+- "6001 ENTER. lpfc_pnvme %p, qidx x%xi qhandle %p\n",
++ "6001 ENTER. lpfc_pnvme %p, qidx x%x qhandle %p\n",
+ lport, qidx, handle);
+ kfree(handle);
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 7ac1a067d7801..eacdcb931bdab 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1078,15 +1078,14 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+ idx = 0;
+ }
+
+- infop = phba->sli4_hba.nvmet_ctx_info;
+- for (j = 0; j < phba->cfg_nvmet_mrq; j++) {
+- for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
++ for (i = 0; i < phba->sli4_hba.num_present_cpu; i++) {
++ for (j = 0; j < phba->cfg_nvmet_mrq; j++) {
++ infop = lpfc_get_ctx_list(phba, i, j);
+ lpfc_printf_log(phba, KERN_INFO, LOG_NVME | LOG_INIT,
+ "6408 TOTAL NVMET ctx for CPU %d "
+ "MRQ %d: cnt %d nextcpu %p\n",
+ i, j, infop->nvmet_ctx_list_cnt,
+ infop->nvmet_ctx_next_cpu);
+- infop++;
+ }
+ }
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 617cb046479e86b08ae3c016c435dd79ede1b052 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Check for bus reset
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 6b0e87a6aafe12d75c2bea6fc8e49e88b98b3083 ]
+
+The SR_RST bit isn't latched. Hence, detecting a bus reset isn't reliable.
+When it is detected, the right thing to do is to drop all connected and
+disconnected commands. The code for that is already present so refactor it and
+call it when SR_RST is set.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 74 +++++++++++++++++++++++++-----------------
+ 1 file changed, 45 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index a85c5155fcf40..21377ac71168c 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -131,6 +131,7 @@
+
+ static int do_abort(struct Scsi_Host *);
+ static void do_reset(struct Scsi_Host *);
++static void bus_reset_cleanup(struct Scsi_Host *);
+
+ /**
+ * initialize_SCp - init the scsi pointer field
+@@ -885,7 +886,14 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ /* Probably Bus Reset */
+ NCR5380_read(RESET_PARITY_INTERRUPT_REG);
+
+- dsprintk(NDEBUG_INTR, instance, "unknown interrupt\n");
++ if (sr & SR_RST) {
++ /* Certainly Bus Reset */
++ shost_printk(KERN_WARNING, instance,
++ "bus reset interrupt\n");
++ bus_reset_cleanup(instance);
++ } else {
++ dsprintk(NDEBUG_INTR, instance, "unknown interrupt\n");
++ }
+ #ifdef SUN3_SCSI_VME
+ dregs->csr |= CSR_DMA_ENABLE;
+ #endif
+@@ -2303,31 +2311,12 @@ out:
+ }
+
+
+-/**
+- * NCR5380_host_reset - reset the SCSI host
+- * @cmd: SCSI command undergoing EH
+- *
+- * Returns SUCCESS
+- */
+-
+-static int NCR5380_host_reset(struct scsi_cmnd *cmd)
++static void bus_reset_cleanup(struct Scsi_Host *instance)
+ {
+- struct Scsi_Host *instance = cmd->device->host;
+ struct NCR5380_hostdata *hostdata = shost_priv(instance);
+ int i;
+- unsigned long flags;
+ struct NCR5380_cmd *ncmd;
+
+- spin_lock_irqsave(&hostdata->lock, flags);
+-
+-#if (NDEBUG & NDEBUG_ANY)
+- shost_printk(KERN_INFO, instance, __func__);
+-#endif
+- NCR5380_dprint(NDEBUG_ANY, instance);
+- NCR5380_dprint_phase(NDEBUG_ANY, instance);
+-
+- do_reset(instance);
+-
+ /* reset NCR registers */
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(TARGET_COMMAND_REG, 0);
+@@ -2339,14 +2328,6 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ * commands!
+ */
+
+- list_for_each_entry(ncmd, &hostdata->unissued, list) {
+- struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
+-
+- cmd->result = DID_RESET << 16;
+- cmd->scsi_done(cmd);
+- }
+- INIT_LIST_HEAD(&hostdata->unissued);
+-
+ if (hostdata->selecting) {
+ hostdata->selecting->result = DID_RESET << 16;
+ complete_cmd(instance, hostdata->selecting);
+@@ -2380,6 +2361,41 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
++}
++
++/**
++ * NCR5380_host_reset - reset the SCSI host
++ * @cmd: SCSI command undergoing EH
++ *
++ * Returns SUCCESS
++ */
++
++static int NCR5380_host_reset(struct scsi_cmnd *cmd)
++{
++ struct Scsi_Host *instance = cmd->device->host;
++ struct NCR5380_hostdata *hostdata = shost_priv(instance);
++ unsigned long flags;
++ struct NCR5380_cmd *ncmd;
++
++ spin_lock_irqsave(&hostdata->lock, flags);
++
++#if (NDEBUG & NDEBUG_ANY)
++ shost_printk(KERN_INFO, instance, __func__);
++#endif
++ NCR5380_dprint(NDEBUG_ANY, instance);
++ NCR5380_dprint_phase(NDEBUG_ANY, instance);
++
++ list_for_each_entry(ncmd, &hostdata->unissued, list) {
++ struct scsi_cmnd *scmd = NCR5380_to_scmd(ncmd);
++
++ scmd->result = DID_RESET << 16;
++ scmd->scsi_done(scmd);
++ }
++ INIT_LIST_HEAD(&hostdata->unissued);
++
++ do_reset(instance);
++ bus_reset_cleanup(instance);
++
+ spin_unlock_irqrestore(&hostdata->lock, flags);
+
+ return SUCCESS;
+--
+2.20.1
+
--- /dev/null
+From dfbe9851089e0d36b3a28682782f4c6a84338000 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Check for invalid reselection target
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 7ef55f6744c45e3d7c85a3f74ada39b67ac741dd ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION", that "the
+initiator shall not respond to a RESELECTION phase if other than two SCSI ID
+bits are on the DATA BUS." This issue (too many bits set) has been observed in
+the wild, so add a check.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 00397e89d652d..a290ec632248e 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2014,6 +2014,11 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(MODE_REG, MR_BASE);
+
+ target_mask = NCR5380_read(CURRENT_SCSI_DATA_REG) & ~(hostdata->id_mask);
++ if (!target_mask || target_mask & (target_mask - 1)) {
++ shost_printk(KERN_WARNING, instance,
++ "reselect: bad target_mask 0x%02x\n", target_mask);
++ return;
++ }
+
+ dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
+
+--
+2.20.1
+
--- /dev/null
+From 847772b799ea7ab8bd2104005ef41d1730dbb240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Clear all unissued commands on host reset
+
+From: Hannes Reinecke <hare@suse.com>
+
+[ Upstream commit 1aeeeed7f03c576f096eede7b0384f99a98f588c ]
+
+When doing a host reset we should be clearing all outstanding commands, not
+just the command triggering the reset.
+
+[mkp: adjusted Hannes' SoB address]
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Cc: Ondrey Zary <linux@rainbow-software.org>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 8caa51797511e..9131d30b2da75 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2309,7 +2309,7 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ spin_lock_irqsave(&hostdata->lock, flags);
+
+ #if (NDEBUG & NDEBUG_ANY)
+- scmd_printk(KERN_INFO, cmd, __func__);
++ shost_printk(KERN_INFO, instance, __func__);
+ #endif
+ NCR5380_dprint(NDEBUG_ANY, instance);
+ NCR5380_dprint_phase(NDEBUG_ANY, instance);
+@@ -2327,10 +2327,13 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ * commands!
+ */
+
+- if (list_del_cmd(&hostdata->unissued, cmd)) {
++ list_for_each_entry(ncmd, &hostdata->unissued, list) {
++ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
++
+ cmd->result = DID_RESET << 16;
+ cmd->scsi_done(cmd);
+ }
++ INIT_LIST_HEAD(&hostdata->unissued);
+
+ if (hostdata->selecting) {
+ hostdata->selecting->result = DID_RESET << 16;
+--
+2.20.1
+
--- /dev/null
+From 99542122c1146159326fd0d4cef1713aa962567c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Don't call dsprintk() following reselection interrupt
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 08267216b3f8aa5adc204bdccf8deb72c1cd7665 ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.1 RESELECTION",
+
+ ... The reselected initiator shall then assert the BSY signal
+ within a selection abort time of its most recent detection of being
+ reselected; this is required for correct operation of the time-out
+ procedure.
+
+The selection abort time is only 200 us which may be insufficient time for a
+printk() call. Move the diagnostics to the error paths.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index b13290b3e5d38..48f123601f575 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2021,8 +2021,6 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ return;
+ }
+
+- dsprintk(NDEBUG_RESELECTION, instance, "reselect\n");
+-
+ /*
+ * At this point, we have detected that our SCSI ID is on the bus,
+ * SEL is true and BSY was false for at least one bus settle delay
+@@ -2035,6 +2033,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE | ICR_ASSERT_BSY);
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_SEL, 0, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: !SEL timeout\n");
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+ return;
+ }
+@@ -2046,6 +2045,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From d36fc731f759459b0353db3f07cf21f1f91f7c02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Don't clear busy flag when abort fails
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 45ddc1b24806cc8f1a09f23dd4e7b6e4a8ae36e1 ]
+
+When NCR5380_abort() returns FAILED, the driver forgets that the target is
+still busy. Hence, further commands may be sent to the target, which may fail
+during selection and produce the error message, "reselection after won
+arbitration?". Prevent this by leaving the busy flag set when NCR5380_abort()
+fails.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index a290ec632248e..b13290b3e5d38 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -522,8 +522,6 @@ static void complete_cmd(struct Scsi_Host *instance,
+ hostdata->sensing = NULL;
+ }
+
+- hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+-
+ cmd->scsi_done(cmd);
+ }
+
+@@ -1711,6 +1709,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ return;
+ #endif
+ case PHASE_DATAIN:
+@@ -1793,6 +1792,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ cmd, scmd_id(cmd), cmd->device->lun);
+
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+
+ cmd->result &= ~0xffff;
+ cmd->result |= cmd->SCp.Status;
+@@ -1952,6 +1952,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)
+ NCR5380_transfer_pio(instance, &phase, &len, &data);
+ if (msgout == ABORT) {
+ hostdata->connected = NULL;
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ maybe_release_dma_irq(instance);
+@@ -2106,13 +2107,16 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ dsprintk(NDEBUG_RESELECTION | NDEBUG_QUEUES, instance,
+ "reselect: removed %p from disconnected queue\n", tmp);
+ } else {
++ int target = ffs(target_mask) - 1;
++
+ shost_printk(KERN_ERR, instance, "target bitmask 0x%02x lun %d not in disconnected queue.\n",
+ target_mask, lun);
+ /*
+ * Since we have an established nexus that we can't do anything
+ * with, we must abort it.
+ */
+- do_abort(instance);
++ if (do_abort(instance) == 0)
++ hostdata->busy[target] &= ~(1 << lun);
+ return;
+ }
+
+@@ -2283,8 +2287,10 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ out:
+ if (result == FAILED)
+ dsprintk(NDEBUG_ABORT, instance, "abort: failed to abort %p\n", cmd);
+- else
++ else {
++ hostdata->busy[scmd_id(cmd)] &= ~(1 << cmd->device->lun);
+ dsprintk(NDEBUG_ABORT, instance, "abort: successfully aborted %p\n", cmd);
++ }
+
+ queue_work(hostdata->work_q, &hostdata->main_task);
+ maybe_release_dma_irq(instance);
+--
+2.20.1
+
--- /dev/null
+From bb6139e6d23e35bc2ececf3c301b8f11db40efef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Handle BUS FREE during reselection
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit ca694afad707cb3ae2fdef3b28454444d9ac726e ]
+
+The X3T9.2 specification (draft) says, under "6.1.4.2 RESELECTION time-out
+procedure", that a target may assert RST or go to BUS FREE phase if the
+initiator does not respond within 200 us. Something like this has been
+observed with AztecMonster II target. When it happens, all we can do is wait
+for the target to try again.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 48f123601f575..a85c5155fcf40 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2045,6 +2045,9 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+
+ if (NCR5380_poll_politely(hostdata,
+ STATUS_REG, SR_REQ, SR_REQ, 2 * HZ) < 0) {
++ if ((NCR5380_read(STATUS_REG) & (SR_BSY | SR_SEL)) == 0)
++ /* BUS FREE phase */
++ return;
+ shost_printk(KERN_ERR, instance, "reselect: REQ timeout\n");
+ do_abort(instance);
+ return;
+--
+2.20.1
+
--- /dev/null
+From ac2c5b045eead8f0c594b188dc28e1b2c6be63ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Have NCR5380_select() return a bool
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit dad8261e643849ea134c7cd5c8e794e31d93b9eb ]
+
+The return value is taken to mean "retry" or "don't retry". Change it to bool
+to improve readability. Fix related comments. No functional change.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 46 +++++++++++++++++++-----------------------
+ drivers/scsi/NCR5380.h | 2 +-
+ 2 files changed, 22 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 9131d30b2da75..60e051c249a6f 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -904,20 +904,16 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ return IRQ_RETVAL(handled);
+ }
+
+-/*
+- * Function : int NCR5380_select(struct Scsi_Host *instance,
+- * struct scsi_cmnd *cmd)
+- *
+- * Purpose : establishes I_T_L or I_T_L_Q nexus for new or existing command,
+- * including ARBITRATION, SELECTION, and initial message out for
+- * IDENTIFY and queue messages.
++/**
++ * NCR5380_select - attempt arbitration and selection for a given command
++ * @instance: the Scsi_Host instance
++ * @cmd: the scsi_cmnd to execute
+ *
+- * Inputs : instance - instantiation of the 5380 driver on which this
+- * target lives, cmd - SCSI command to execute.
++ * This routine establishes an I_T_L nexus for a SCSI command. This involves
++ * ARBITRATION, SELECTION and MESSAGE OUT phases and an IDENTIFY message.
+ *
+- * Returns cmd if selection failed but should be retried,
+- * NULL if selection failed and should not be retried, or
+- * NULL if selection succeeded (hostdata->connected == cmd).
++ * Returns true if the operation should be retried.
++ * Returns false if it should not be retried.
+ *
+ * Side effects :
+ * If bus busy, arbitration failed, etc, NCR5380_select() will exit
+@@ -925,16 +921,15 @@ static irqreturn_t __maybe_unused NCR5380_intr(int irq, void *dev_id)
+ * SELECT_ENABLE will be set appropriately, the NCR5380
+ * will cease to drive any SCSI bus signals.
+ *
+- * If successful : I_T_L or I_T_L_Q nexus will be established,
+- * instance->connected will be set to cmd.
++ * If successful : the I_T_L nexus will be established, and
++ * hostdata->connected will be set to cmd.
+ * SELECT interrupt will be disabled.
+ *
+ * If failed (no target) : cmd->scsi_done() will be called, and the
+ * cmd->result host byte set to DID_BAD_TARGET.
+ */
+
+-static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+- struct scsi_cmnd *cmd)
++static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+ __releases(&hostdata->lock) __acquires(&hostdata->lock)
+ {
+ struct NCR5380_hostdata *hostdata = shost_priv(instance);
+@@ -942,6 +937,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ unsigned char *data;
+ int len;
+ int err;
++ bool ret = true;
+
+ NCR5380_dprint(NDEBUG_ARBITRATION, instance);
+ dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
+@@ -950,7 +946,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ /*
+ * Arbitration and selection phases are slow and involve dropping the
+ * lock, so we have to watch out for EH. An exception handler may
+- * change 'selecting' to NULL. This function will then return NULL
++ * change 'selecting' to NULL. This function will then return false
+ * so that the caller will forget about 'cmd'. (During information
+ * transfer phases, EH may change 'connected' to NULL.)
+ */
+@@ -986,7 +982,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ /* Command was aborted */
+ NCR5380_write(MODE_REG, MR_BASE);
+- return NULL;
++ return false;
+ }
+ if (err < 0) {
+ NCR5380_write(MODE_REG, MR_BASE);
+@@ -1035,7 +1031,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ if (!hostdata->selecting) {
+ NCR5380_write(MODE_REG, MR_BASE);
+ NCR5380_write(INITIATOR_COMMAND_REG, ICR_BASE);
+- return NULL;
++ return false;
+ }
+
+ dsprintk(NDEBUG_ARBITRATION, instance, "won arbitration\n");
+@@ -1118,13 +1114,13 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+
+ /* Can't touch cmd if it has been reclaimed by the scsi ML */
+ if (!hostdata->selecting)
+- return NULL;
++ return false;
+
+ cmd->result = DID_BAD_TARGET << 16;
+ complete_cmd(instance, cmd);
+ dsprintk(NDEBUG_SELECTION, instance,
+ "target did not respond within 250ms\n");
+- cmd = NULL;
++ ret = false;
+ goto out;
+ }
+
+@@ -1156,7 +1152,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ }
+ if (!hostdata->selecting) {
+ do_abort(instance);
+- return NULL;
++ return false;
+ }
+
+ dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+@@ -1172,7 +1168,7 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+ cmd->result = DID_ERROR << 16;
+ complete_cmd(instance, cmd);
+ dsprintk(NDEBUG_SELECTION, instance, "IDENTIFY message transfer failed\n");
+- cmd = NULL;
++ ret = false;
+ goto out;
+ }
+
+@@ -1187,13 +1183,13 @@ static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *instance,
+
+ initialize_SCp(cmd);
+
+- cmd = NULL;
++ ret = false;
+
+ out:
+ if (!hostdata->selecting)
+ return NULL;
+ hostdata->selecting = NULL;
+- return cmd;
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/scsi/NCR5380.h b/drivers/scsi/NCR5380.h
+index 8a6d002e67894..5935fd6d1a058 100644
+--- a/drivers/scsi/NCR5380.h
++++ b/drivers/scsi/NCR5380.h
+@@ -275,7 +275,7 @@ static irqreturn_t NCR5380_intr(int irq, void *dev_id);
+ static void NCR5380_main(struct work_struct *work);
+ static const char *NCR5380_info(struct Scsi_Host *instance);
+ static void NCR5380_reselect(struct Scsi_Host *instance);
+-static struct scsi_cmnd *NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
++static bool NCR5380_select(struct Scsi_Host *, struct scsi_cmnd *);
+ static int NCR5380_transfer_dma(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
+ static int NCR5380_transfer_pio(struct Scsi_Host *instance, unsigned char *phase, int *count, unsigned char **data);
+ static int NCR5380_poll_politely2(struct NCR5380_hostdata *,
+--
+2.20.1
+
--- /dev/null
+From bbe0ffbf9198145680ada694a97ad6eab9744093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Use DRIVER_SENSE to indicate valid sense data
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 070356513963be6196142acff56acc8359069fa1 ]
+
+When sense data is valid, call set_driver_byte(cmd, DRIVER_SENSE). Otherwise
+some callers of scsi_execute() will ignore sense data. Don't set DID_ERROR or
+DID_RESET just because sense data is missing.
+
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 5f26aa2875bd9..00397e89d652d 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -513,11 +513,12 @@ static void complete_cmd(struct Scsi_Host *instance,
+
+ if (hostdata->sensing == cmd) {
+ /* Autosense processing ends here */
+- if ((cmd->result & 0xff) != SAM_STAT_GOOD) {
++ if (status_byte(cmd->result) != GOOD) {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
+- set_host_byte(cmd, DID_ERROR);
+- } else
++ } else {
+ scsi_eh_restore_cmnd(cmd, &hostdata->ses);
++ set_driver_byte(cmd, DRIVER_SENSE);
++ }
+ hostdata->sensing = NULL;
+ }
+
+@@ -2271,7 +2272,6 @@ static int NCR5380_abort(struct scsi_cmnd *cmd)
+ if (list_del_cmd(&hostdata->autosense, cmd)) {
+ dsprintk(NDEBUG_ABORT, instance,
+ "abort: removed %p from sense queue\n", cmd);
+- set_host_byte(cmd, DID_ERROR);
+ complete_cmd(instance, cmd);
+ }
+
+@@ -2350,7 +2350,6 @@ static int NCR5380_host_reset(struct scsi_cmnd *cmd)
+ list_for_each_entry(ncmd, &hostdata->autosense, list) {
+ struct scsi_cmnd *cmd = NCR5380_to_scmd(ncmd);
+
+- set_host_byte(cmd, DID_RESET);
+ cmd->scsi_done(cmd);
+ }
+ INIT_LIST_HEAD(&hostdata->autosense);
+--
+2.20.1
+
--- /dev/null
+From d0f939256e6818a74afbaf6b13bcec47a0a264fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 11:17:11 +1000
+Subject: scsi: NCR5380: Withhold disconnect privilege for REQUEST SENSE
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 7c8ed783c2faa1e3f741844ffac41340338ea0f4 ]
+
+This is mostly needed because an AztecMonster II target has been observed
+disconnecting REQUEST SENSE commands and then failing to reselect properly.
+
+Suggested-by: Michael Schmitz <schmitzmic@gmail.com>
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/NCR5380.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 60e051c249a6f..5f26aa2875bd9 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -938,6 +938,8 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+ int len;
+ int err;
+ bool ret = true;
++ bool can_disconnect = instance->irq != NO_IRQ &&
++ cmd->cmnd[0] != REQUEST_SENSE;
+
+ NCR5380_dprint(NDEBUG_ARBITRATION, instance);
+ dsprintk(NDEBUG_ARBITRATION, instance, "starting arbitration, id = %d\n",
+@@ -1157,7 +1159,7 @@ static bool NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd)
+
+ dsprintk(NDEBUG_SELECTION, instance, "target %d selected, going into MESSAGE OUT phase.\n",
+ scmd_id(cmd));
+- tmp[0] = IDENTIFY(((instance->irq == NO_IRQ) ? 0 : 1), cmd->device->lun);
++ tmp[0] = IDENTIFY(can_disconnect, cmd->device->lun);
+
+ len = 1;
+ data = tmp;
+--
+2.20.1
+
--- /dev/null
+From a6c84b0ea267555be22e3ee0ea5d984619804ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:03 +0530
+Subject: scsi: pm80xx: Corrected dma_unmap_sg() parameter
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 76cb25b058034d37244be6aca97a2ad52a5fbcad ]
+
+For the function dma_unmap_sg(), the <nents> parameter should be number of
+elements in the scatter list prior to the mapping, not after the mapping.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_sas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index ce584c31d36e5..d1fcd21f7f7dd 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -466,7 +466,7 @@ err_out:
+ dev_printk(KERN_ERR, pm8001_ha->dev, "pm8001 exec failed[%d]!\n", rc);
+ if (!sas_protocol_ata(t->task_proto))
+ if (n_elem)
+- dma_unmap_sg(pm8001_ha->dev, t->scatter, n_elem,
++ dma_unmap_sg(pm8001_ha->dev, t->scatter, t->num_scatter,
+ t->data_dir);
+ out_done:
+ spin_unlock_irqrestore(&pm8001_ha->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From f52928d7d82db91a406c0aab3aae14bbc9c0b348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 14:18:04 +0530
+Subject: scsi: pm80xx: Fixed system hang issue during kexec boot
+
+From: Deepak Ukey <deepak.ukey@microchip.com>
+
+[ Upstream commit 72349b62a571effd6faadd0600b8e657dd87afbf ]
+
+When the firmware is not responding, execution of kexec boot causes a system
+hang. When firmware assertion happened, driver get notified with interrupt
+vector updated in MPI configuration table. Then, the driver will read
+scratchpad register and set controller_fatal_error flag to true.
+
+Signed-off-by: Deepak Ukey <deepak.ukey@microchip.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Acked-by: Jack Wang <jinpu.wang@profitbricks.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 6 +++
+ drivers/scsi/pm8001/pm8001_sas.c | 7 +++
+ drivers/scsi/pm8001/pm8001_sas.h | 1 +
+ drivers/scsi/pm8001/pm80xx_hwi.c | 80 +++++++++++++++++++++++++++++---
+ drivers/scsi/pm8001/pm80xx_hwi.h | 3 ++
+ 5 files changed, 91 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index 10546faac58c6..f374abfb7f1f8 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -1479,6 +1479,12 @@ u32 pm8001_mpi_msg_consume(struct pm8001_hba_info *pm8001_ha,
+ } else {
+ u32 producer_index;
+ void *pi_virt = circularQ->pi_virt;
++ /* spurious interrupt during setup if
++ * kexec-ing and driver doing a doorbell access
++ * with the pre-kexec oq interrupt setup
++ */
++ if (!pi_virt)
++ break;
+ /* Update the producer index from SPC */
+ producer_index = pm8001_read_32(pi_virt);
+ circularQ->producer_index = cpu_to_le32(producer_index);
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index d1fcd21f7f7dd..e64a13f0bce17 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -374,6 +374,13 @@ static int pm8001_task_exec(struct sas_task *task,
+ return 0;
+ }
+ pm8001_ha = pm8001_find_ha_by_dev(task->dev);
++ if (pm8001_ha->controller_fatal_error) {
++ struct task_status_struct *ts = &t->task_status;
++
++ ts->resp = SAS_TASK_UNDELIVERED;
++ t->task_done(t);
++ return 0;
++ }
+ PM8001_IO_DBG(pm8001_ha, pm8001_printk("pm8001_task_exec device \n "));
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ do {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index e81a8fa7ef1a8..e954ecd3f6c08 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -529,6 +529,7 @@ struct pm8001_hba_info {
+ u32 logging_level;
+ u32 fw_status;
+ u32 smp_exp_mode;
++ bool controller_fatal_error;
+ const struct firmware *fw_image;
+ struct isr_param irq_vector[PM8001_MAX_MSIX_VEC];
+ };
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index eb4fee61df729..9edd61c063a1a 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -572,6 +572,9 @@ static void update_main_config_table(struct pm8001_hba_info *pm8001_ha)
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_size);
+ pm8001_mw32(address, MAIN_PCS_EVENT_LOG_OPTION,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity);
++ /* Update Fatal error interrupt vector */
++ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |=
++ ((pm8001_ha->number_of_intr - 1) << 8);
+ pm8001_mw32(address, MAIN_FATAL_ERROR_INTERRUPT,
+ pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt);
+ pm8001_mw32(address, MAIN_EVENT_CRC_CHECK,
+@@ -1099,6 +1102,9 @@ static int pm80xx_chip_init(struct pm8001_hba_info *pm8001_ha)
+ return -EBUSY;
+ }
+
++ /* Initialize the controller fatal error flag */
++ pm8001_ha->controller_fatal_error = false;
++
+ /* Initialize pci space address eg: mpi offset */
+ init_pci_device_addresses(pm8001_ha);
+ init_default_table_values(pm8001_ha);
+@@ -1207,13 +1213,17 @@ pm80xx_chip_soft_rst(struct pm8001_hba_info *pm8001_ha)
+ u32 bootloader_state;
+ u32 ibutton0, ibutton1;
+
+- /* Check if MPI is in ready state to reset */
+- if (mpi_uninit_check(pm8001_ha) != 0) {
+- PM8001_FAIL_DBG(pm8001_ha,
+- pm8001_printk("MPI state is not ready\n"));
+- return -1;
++ /* Process MPI table uninitialization only if FW is ready */
++ if (!pm8001_ha->controller_fatal_error) {
++ /* Check if MPI is in ready state to reset */
++ if (mpi_uninit_check(pm8001_ha) != 0) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "MPI state is not ready scratch1 :0x%x\n",
++ regval));
++ return -1;
++ }
+ }
+-
+ /* checked for reset register normal state; 0x0 */
+ regval = pm8001_cr32(pm8001_ha, 0, SPC_REG_SOFT_RESET);
+ PM8001_INIT_DBG(pm8001_ha,
+@@ -3717,6 +3727,46 @@ static void process_one_iomb(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ }
+ }
+
++static void print_scratchpad_registers(struct pm8001_hba_info *pm8001_ha)
++{
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_1:0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_0)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_1)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_2: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_2)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_3: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_3)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_4: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_4)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_HOST_SCRATCH_PAD_5: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_5)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_0: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_6)));
++ PM8001_FAIL_DBG(pm8001_ha,
++ pm8001_printk("MSGU_RSVD_SCRATCH_PAD_1: 0x%x\n",
++ pm8001_cr32(pm8001_ha, 0, MSGU_HOST_SCRATCH_PAD_7)));
++}
++
+ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ {
+ struct outbound_queue_table *circularQ;
+@@ -3724,10 +3774,28 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec)
+ u8 uninitialized_var(bc);
+ u32 ret = MPI_IO_STATUS_FAIL;
+ unsigned long flags;
++ u32 regval;
+
++ if (vec == (pm8001_ha->number_of_intr - 1)) {
++ regval = pm8001_cr32(pm8001_ha, 0, MSGU_SCRATCH_PAD_1);
++ if ((regval & SCRATCH_PAD_MIPSALL_READY) !=
++ SCRATCH_PAD_MIPSALL_READY) {
++ pm8001_ha->controller_fatal_error = true;
++ PM8001_FAIL_DBG(pm8001_ha, pm8001_printk(
++ "Firmware Fatal error! Regval:0x%x\n", regval));
++ print_scratchpad_registers(pm8001_ha);
++ return ret;
++ }
++ }
+ spin_lock_irqsave(&pm8001_ha->lock, flags);
+ circularQ = &pm8001_ha->outbnd_q_tbl[vec];
+ do {
++ /* spurious interrupt during setup if kexec-ing and
++ * driver doing a doorbell access w/ the pre-kexec oq
++ * interrupt setup.
++ */
++ if (!circularQ->pi_virt)
++ break;
+ ret = pm8001_mpi_msg_consume(pm8001_ha, circularQ, &pMsg1, &bc);
+ if (MPI_IO_STATUS_SUCCESS == ret) {
+ /* process the outbound message */
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.h b/drivers/scsi/pm8001/pm80xx_hwi.h
+index 7a443bad61634..411b414a9a0ef 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.h
++++ b/drivers/scsi/pm8001/pm80xx_hwi.h
+@@ -1288,6 +1288,9 @@ typedef struct SASProtocolTimerConfig SASProtocolTimerConfig_t;
+ #define SCRATCH_PAD_BOOT_LOAD_SUCCESS 0x0
+ #define SCRATCH_PAD_IOP0_READY 0xC00
+ #define SCRATCH_PAD_IOP1_READY 0x3000
++#define SCRATCH_PAD_MIPSALL_READY (SCRATCH_PAD_IOP1_READY | \
++ SCRATCH_PAD_IOP0_READY | \
++ SCRATCH_PAD_RAAE_READY)
+
+ /* boot loader state */
+ #define SCRATCH_PAD1_BOOTSTATE_MASK 0x70 /* Bit 4-6 */
+--
+2.20.1
+
--- /dev/null
+From 5a0c45bc9c0384e0cf2f69035422fd47e804e6be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 11:24:37 -0700
+Subject: scsi: qla2xxx: Defer chip reset until target mode is enabled
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 93eca6135183f7a71e36acd47655a085ed11bcdc ]
+
+For target mode, any chip reset triggered before target mode is enabled will
+be held off until user is ready to enable. This prevents the chip from
+starting or running before it is intended.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 343fbaa6d2a2d..5617bb18c2335 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -5801,12 +5801,27 @@ qla2x00_do_dpc(void *data)
+ if (test_and_clear_bit
+ (ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
+ !test_bit(UNLOADING, &base_vha->dpc_flags)) {
++ bool do_reset = true;
++
++ switch (ql2x_ini_mode) {
++ case QLA2XXX_INI_MODE_ENABLED:
++ break;
++ case QLA2XXX_INI_MODE_DISABLED:
++ if (!qla_tgt_mode_enabled(base_vha))
++ do_reset = false;
++ break;
++ case QLA2XXX_INI_MODE_DUAL:
++ if (!qla_dual_mode_enabled(base_vha))
++ do_reset = false;
++ break;
++ default:
++ break;
++ }
+
+- ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
+- "ISP abort scheduled.\n");
+- if (!(test_and_set_bit(ABORT_ISP_ACTIVE,
++ if (do_reset && !(test_and_set_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags))) {
+-
++ ql_dbg(ql_dbg_dpc, base_vha, 0x4007,
++ "ISP abort scheduled.\n");
+ if (ha->isp_ops->abort_isp(base_vha)) {
+ /* failed. retry later */
+ set_bit(ISP_ABORT_NEEDED,
+@@ -5814,10 +5829,9 @@ qla2x00_do_dpc(void *data)
+ }
+ clear_bit(ABORT_ISP_ACTIVE,
+ &base_vha->dpc_flags);
++ ql_dbg(ql_dbg_dpc, base_vha, 0x4008,
++ "ISP abort end.\n");
+ }
+-
+- ql_dbg(ql_dbg_dpc, base_vha, 0x4008,
+- "ISP abort end.\n");
+ }
+
+ if (test_and_clear_bit(FCPORT_UPDATE_NEEDED,
+--
+2.20.1
+
--- /dev/null
+From d0fc4f0897f2f2581007181feafd1ce21d6c34ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 10:18:16 -0700
+Subject: scsi: qla2xxx: Fix dropped srb resource.
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 527b8ae3948bb59c13ebaa7d657ced56ea25ab05 ]
+
+When FW rejects a command due to "entry_status" error (malform IOCB), the srb
+resource needs to be returned back for cleanup. The filter to catch this is
+in the wrong location.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index df94ef816826b..6a76d72175154 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2792,6 +2792,7 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ case ELS_IOCB_TYPE:
+ case ABORT_IOCB_TYPE:
+ case MBX_IOCB_TYPE:
++ default:
+ sp = qla2x00_get_sp_from_handle(vha, func, req, pkt);
+ if (sp) {
+ sp->done(sp, res);
+@@ -2802,7 +2803,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt)
+ case ABTS_RESP_24XX:
+ case CTIO_TYPE7:
+ case CTIO_CRC2:
+- default:
+ return 1;
+ }
+ fatal:
+--
+2.20.1
+
--- /dev/null
+From 0885b0df6ed0fc8bf694aa77c77ac2c212ba0aed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Aug 2018 11:24:36 -0700
+Subject: scsi: qla2xxx: Fix iIDMA error
+
+From: Quinn Tran <quinn.tran@cavium.com>
+
+[ Upstream commit 8d9bf0a9a268f7ca0b811d6e6a1fc783afa5c746 ]
+
+When switch responds with error for Get Port Speed Command (GPSC), driver
+should not proceed with telling FW about the speed of the remote port.
+
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 2a19ec0660cbb..1088038e6a418 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3033,7 +3033,7 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ ql_dbg(ql_dbg_disc, vha, 0x2019,
+ "GPSC command unsupported, disabling query.\n");
+ ha->flags.gpsc_supported = 0;
+- res = QLA_SUCCESS;
++ goto done;
+ }
+ } else {
+ switch (be16_to_cpu(ct_rsp->rsp.gpsc.speed)) {
+@@ -3066,13 +3066,13 @@ static void qla24xx_async_gpsc_sp_done(void *s, int res)
+ be16_to_cpu(ct_rsp->rsp.gpsc.speeds),
+ be16_to_cpu(ct_rsp->rsp.gpsc.speed));
+ }
+-done:
+ memset(&ea, 0, sizeof(ea));
+ ea.event = FCME_GPSC_DONE;
+ ea.rc = res;
+ ea.fcport = fcport;
+ qla2x00_fcport_event_handler(vha, &ea);
+
++done:
+ sp->free(sp);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 53b710c27fbe222b304243a609fb67ff9de7f06a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 11:38:16 -0400
+Subject: scsi: sym53c8xx: fix NULL pointer dereference panic in sym_int_sir()
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit 288315e95264b6355e26609e9dec5dc4563d4ab0 ]
+
+sym_int_sir() in sym_hipd.c does not check the command pointer for NULL before
+using it in debug message prints.
+
+Suggested-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reviewed-by: Mark Kanda <mark.kanda@oracle.com>
+Acked-by: Matthew Wilcox <matthew.wilcox@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sym53c8xx_2/sym_hipd.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+index 378af306fda17..b87b6c63431dd 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -4371,6 +4371,13 @@ static void sym_nego_rejected(struct sym_hcb *np, struct sym_tcb *tp, struct sym
+ OUTB(np, HS_PRT, HS_BUSY);
+ }
+
++#define sym_printk(lvl, tp, cp, fmt, v...) do { \
++ if (cp) \
++ scmd_printk(lvl, cp->cmd, fmt, ##v); \
++ else \
++ starget_printk(lvl, tp->starget, fmt, ##v); \
++} while (0)
++
+ /*
+ * chip exception handler for programmed interrupts.
+ */
+@@ -4416,7 +4423,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * been selected with ATN. We do not want to handle that.
+ */
+ case SIR_SEL_ATN_NO_MSG_OUT:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG OUT phase after selection with ATN\n");
+ goto out_stuck;
+ /*
+@@ -4424,7 +4431,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * having reselected the initiator.
+ */
+ case SIR_RESEL_NO_MSG_IN:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No MSG IN phase after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4432,7 +4439,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ * an IDENTIFY.
+ */
+ case SIR_RESEL_NO_IDENTIFY:
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "No IDENTIFY after reselection\n");
+ goto out_stuck;
+ /*
+@@ -4461,7 +4468,7 @@ static void sym_int_sir(struct sym_hcb *np)
+ case SIR_RESEL_ABORTED:
+ np->lastmsg = np->msgout[0];
+ np->msgout[0] = M_NOOP;
+- scmd_printk(KERN_WARNING, cp->cmd,
++ sym_printk(KERN_WARNING, tp, cp,
+ "message %x sent on bad reselection\n", np->lastmsg);
+ goto out;
+ /*
+--
+2.20.1
+
--- /dev/null
+From 2908f12f7a7d5de10d349c3c211f07fe1f52810c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Aug 2018 13:59:05 +0300
+Subject: serial: mxs-auart: Fix potential infinite loop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anton Vasilyev <vasilyev@ispras.ru>
+
+[ Upstream commit 5963e8a3122471cadfe0eba41c4ceaeaa5c8bb4d ]
+
+On the error path of mxs_auart_request_gpio_irq() is performed
+backward iterating with index i of enum type. Underline enum type
+may be unsigned char. In this case check (--i >= 0) will be always
+true and error handling goes into infinite loop.
+
+The patch changes the check so that it is valid for signed and unsigned
+types.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/mxs-auart.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 673c8fd7e34f6..e83750831f15e 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1638,8 +1638,9 @@ static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s)
+
+ /*
+ * If something went wrong, rollback.
++ * Be careful: i may be unsigned.
+ */
+- while (err && (--i >= 0))
++ while (err && (i-- > 0))
+ if (irq[i] >= 0)
+ free_irq(irq[i], s);
+
+--
+2.20.1
+
--- /dev/null
+From 141c371bfbac5a795b97d760ad9bd0a8efdafc43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 10:21:25 +0200
+Subject: serial: samsung: Enable baud clock for UART reset procedure in resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 1ff3652bc7111df26b5807037f624be294cf69d5 ]
+
+Ensure that the baud clock is also enabled for UART register writes in
+driver resume. On Exynos5433 SoC this is needed to avoid external abort
+issue.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/samsung.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index f4b8e4e17a868..808373d4e37a6 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1922,7 +1922,11 @@ static int s3c24xx_serial_resume(struct device *dev)
+
+ if (port) {
+ clk_prepare_enable(ourport->clk);
++ if (!IS_ERR(ourport->baudclk))
++ clk_prepare_enable(ourport->baudclk);
+ s3c24xx_serial_resetport(port, s3c24xx_port_to_cfg(port));
++ if (!IS_ERR(ourport->baudclk))
++ clk_disable_unprepare(ourport->baudclk);
+ clk_disable_unprepare(ourport->clk);
+
+ uart_resume_port(&s3c24xx_uart_drv, port);
+@@ -1945,7 +1949,11 @@ static int s3c24xx_serial_resume_noirq(struct device *dev)
+ if (rx_enabled(port))
+ uintm &= ~S3C64XX_UINTM_RXD_MSK;
+ clk_prepare_enable(ourport->clk);
++ if (!IS_ERR(ourport->baudclk))
++ clk_prepare_enable(ourport->baudclk);
+ wr_regl(port, S3C64XX_UINTM, uintm);
++ if (!IS_ERR(ourport->baudclk))
++ clk_disable_unprepare(ourport->baudclk);
+ clk_disable_unprepare(ourport->clk);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From acd2361a5db5a581207945fae788d429e2832778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Sep 2018 15:10:51 +0200
+Subject: serial: uartps: Fix suspend functionality
+
+From: Nava kishore Manne <nava.manne@xilinx.com>
+
+[ Upstream commit 4b9d33c6a30688344a3e95179654ea31b07f59b7 ]
+
+The driver's suspend/resume functions were buggy.
+If UART node contains any child node in the DT and
+the child is established a communication path with
+the parent UART. The relevant /dev/ttyPS* node will
+be not available for other operations.
+If the driver is trying to do any operations like
+suspend/resume without checking the tty->dev status
+it leads to the kernel crash/hang.
+
+This patch fix this issue by call the device_may_wake()
+with the generic parameter of type struct device.
+in the uart suspend and resume paths.
+
+It also fixes a race condition in the uart suspend
+path(i.e uart_suspend_port() should be called at the
+end of cdns_uart_suspend API this path updates the same)
+
+Signed-off-by: Nava kishore Manne <navam@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/xilinx_uartps.c | 41 +++++++++---------------------
+ 1 file changed, 12 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b0da63737aa19..0dbfd02e3b196 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -1342,24 +1342,11 @@ static struct uart_driver cdns_uart_uart_driver = {
+ static int cdns_uart_suspend(struct device *device)
+ {
+ struct uart_port *port = dev_get_drvdata(device);
+- struct tty_struct *tty;
+- struct device *tty_dev;
+- int may_wake = 0;
+-
+- /* Get the tty which could be NULL so don't assume it's valid */
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- tty_dev = tty->dev;
+- may_wake = device_may_wakeup(tty_dev);
+- tty_kref_put(tty);
+- }
++ int may_wake;
+
+- /*
+- * Call the API provided in serial_core.c file which handles
+- * the suspend.
+- */
+- uart_suspend_port(&cdns_uart_uart_driver, port);
+- if (!(console_suspend_enabled && !may_wake)) {
++ may_wake = device_may_wakeup(device);
++
++ if (console_suspend_enabled && may_wake) {
+ unsigned long flags = 0;
+
+ spin_lock_irqsave(&port->lock, flags);
+@@ -1374,7 +1361,11 @@ static int cdns_uart_suspend(struct device *device)
+ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+- return 0;
++ /*
++ * Call the API provided in serial_core.c file which handles
++ * the suspend.
++ */
++ return uart_suspend_port(&cdns_uart_uart_driver, port);
+ }
+
+ /**
+@@ -1388,17 +1379,9 @@ static int cdns_uart_resume(struct device *device)
+ struct uart_port *port = dev_get_drvdata(device);
+ unsigned long flags = 0;
+ u32 ctrl_reg;
+- struct tty_struct *tty;
+- struct device *tty_dev;
+- int may_wake = 0;
+-
+- /* Get the tty which could be NULL so don't assume it's valid */
+- tty = tty_port_tty_get(&port->state->port);
+- if (tty) {
+- tty_dev = tty->dev;
+- may_wake = device_may_wakeup(tty_dev);
+- tty_kref_put(tty);
+- }
++ int may_wake;
++
++ may_wake = device_may_wakeup(device);
+
+ if (console_suspend_enabled && !may_wake) {
+ struct cdns_uart *cdns_uart = port->private_data;
+--
+2.20.1
+
mm-memcg-switch-to-css_tryget-in-get_mem_cgroup_from_mm.patch
mm-hugetlb-switch-to-css_tryget-in-hugetlb_cgroup_charge_cgroup.patch
mmc-sdhci-of-at91-fix-quirk2-overwrite.patch
+iio-adc-max9611-explicitly-cast-gain_selectors.patch
+tee-optee-take-dt-status-property-into-account.patch
+ath10k-fix-kernel-panic-by-moving-pci-flush-after-na.patch
+iio-dac-mcp4922-fix-error-handling-in-mcp4922_write_.patch
+arm64-dts-allwinner-a64-olinuxino-fix-dram-voltage.patch
+arm64-dts-allwinner-a64-nanopi-a64-fix-dcdc1-voltage.patch
+alsa-pcm-signedness-bug-in-snd_pcm_plug_alloc.patch
+arm64-dts-tegra210-p2180-correct-sdmmc4-vqmmc-supply.patch
+arm-dts-at91-trivial-fix-usart1-definition-for-at91s.patch
+rtc-rv8803-fix-the-rv8803-id-in-the-of-table.patch
+remoteproc-davinci-use-zx-for-formating-size_t.patch
+extcon-cht-wc-return-from-default-case-to-avoid-warn.patch
+cfg80211-avoid-regulatory-restore-when-country_ie_ig.patch
+alsa-seq-do-error-checks-at-creating-system-ports.patch
+ath9k-fix-tx99-with-monitor-mode-interface.patch
+ath10k-limit-available-channels-via-dt-ieee80211-fre.patch
+gfs2-don-t-set-gfs2_rdf_uptodate-when-the-lvb-is-upd.patch
+asoc-dpcm-properly-initialise-hw-rate_max.patch
+pinctrl-ingenic-probe-driver-at-subsys_initcall.patch
+mips-bcm47xx-enable-usb-power-on-netgear-wndr3400v3.patch
+arm-dts-exynos-fix-sound-in-snow-rev5-chromebook.patch
+liquidio-fix-race-condition-in-instruction-completio.patch
+arm-dts-exynos-fix-regulators-configuration-on-peach.patch
+i40e-use-correct-length-for-strncpy.patch
+i40e-hold-the-rtnl-lock-on-clearing-interrupt-scheme.patch
+i40e-prevent-deleting-mac-address-from-vf-when-set-b.patch
+ib-rxe-fixes-for-rdma-read-retry.patch
+iwlwifi-don-t-warn-on-trying-to-dump-dead-firmware.patch
+iwlwifi-mvm-avoid-sending-too-many-bars.patch
+arm-dts-pxa-fix-the-rtc-controller.patch
+arm-dts-pxa-fix-power-i2c-base-address.patch
+rtl8187-fix-warning-generated-when-strncpy-destinati.patch
+soc-imx-gpc-fix-pdn-delay.patch
+asoc-rsnd-ssi-fix-issue-in-dma-data-address-assignme.patch
+net-phy-mscc-read-vsc8531-vddmac-as-an-u32.patch
+net-phy-mscc-read-vsc8531-edge-slowdown-as-an-u32.patch
+arm-dts-meson8-fix-the-clock-controller-register-siz.patch
+arm-dts-meson8b-fix-the-clock-controller-register-si.patch
+net-lan78xx-bail-out-if-lan78xx_get_endpoints-fails.patch
+asoc-sgtl5000-avoid-division-by-zero-if-lo_vag-is-ze.patch
+arm-dts-exynos-disable-pull-control-for-s5m8767-pmic.patch
+ath10k-wmi-disable-softirq-s-while-calling-ieee80211.patch
+ib-ipoib-ensure-that-mtu-isn-t-less-than-minimum-per.patch
+rdma-core-rate-limit-mad-error-messages.patch
+rdma-core-follow-correct-unregister-order-between-sy.patch
+mips-txx9-fix-iounmap-related-issue.patch
+asoc-intel-hdac_hdmi-limit-sampling-rates-at-dai-cre.patch
+of-make-powermac-cache-node-search-conditional-on-co.patch
+arm-dts-omap3-gta04-give-spi_lcd-node-a-label-so-tha.patch
+arm-dts-omap3-gta04-fixes-for-tvout-venc.patch
+arm-dts-omap3-gta04-tvout-enable-as-display1-alias.patch
+arm-dts-omap3-gta04-fix-touchscreen-tsc2007.patch
+arm-dts-omap3-gta04-make-nand-partitions-compatible-.patch
+arm-dts-omap3-gta04-keep-vpll2-always-on.patch
+sched-debug-use-symbolic-names-for-task-state-consta.patch
+arm64-dts-rockchip-fix-vcc5v0_host_en-on-rk3399-sapp.patch
+dmaengine-dma-jz4780-don-t-depend-on-mach_jz4780.patch
+dmaengine-dma-jz4780-further-residue-status-fix.patch
+edac-sb_edac-return-early-on-addrv-bit-and-address-t.patch
+rtc-mt6397-fix-possible-race-condition.patch
+rtc-pl030-fix-possible-race-condition.patch
+ath9k-add-back-support-for-using-active-monitor-inte.patch
+ib-hfi1-missing-return-value-in-error-path-for-user-.patch
+signal-always-ignore-sigkill-and-sigstop-sent-to-the.patch
+signal-properly-deliver-sigill-from-uprobes.patch
+signal-properly-deliver-sigsegv-from-x86-uprobes.patch
+f2fs-fix-memory-leak-of-percpu-counter-in-fill_super.patch
+scsi-qla2xxx-fix-iidma-error.patch
+scsi-qla2xxx-defer-chip-reset-until-target-mode-is-e.patch
+scsi-qla2xxx-fix-dropped-srb-resource.patch
+scsi-lpfc-fix-errors-in-log-messages.patch
+scsi-sym53c8xx-fix-null-pointer-dereference-panic-in.patch
+arm-imx6-register-pm_power_off-handler-if-fsl-pmic-s.patch
+scsi-pm80xx-corrected-dma_unmap_sg-parameter.patch
+scsi-pm80xx-fixed-system-hang-issue-during-kexec-boo.patch
+kprobes-don-t-call-bug_on-if-there-is-a-kprobe-in-us.patch
+drivers-hv-vmbus-fix-synic-per-cpu-context-initializ.patch
+nvmem-core-return-error-code-instead-of-null-from-nv.patch
+media-dt-bindings-adv748x-fix-decimal-unit-addresses.patch
+media-fix-media-pci-meye-validate-offset-to-avoid-ar.patch
+media-dvb-fix-compat-ioctl-translation.patch
+arm64-dts-meson-libretech-update-board-model.patch
+alsa-intel8x0m-register-irq-handler-after-register-i.patch
+pinctrl-at91-pio4-fix-has_config-check-in-atmel_pctl.patch
+mips-lantiq-do-not-enable-irqs-in-dma-open.patch
+llc-avoid-blocking-in-llc_sap_close.patch
+arm-dts-qcom-ipq4019-fix-cpu0-s-qcom-saw2-reg-value.patch
+soc-qcom-wcnss_ctrl-avoid-string-overflow.patch
+powerpc-vdso-correct-call-frame-information.patch
+arm-dts-socfpga-fix-i2c-bus-unit-address-error.patch
+pinctrl-at91-don-t-use-the-same-irqchip-with-multipl.patch
+cxgb4-fix-endianness-issue-in-t4_fwcache.patch
+blok-bfq-do-not-plug-i-o-if-all-queues-are-weight-ra.patch
+arm64-dts-meson-fix-erroneous-spi-bus-warnings.patch
+power-supply-ab8500_fg-silence-uninitialized-variabl.patch
+power-reset-at91-poweroff-do-not-procede-if-at91_shd.patch
+power-supply-max8998-charger-fix-platform-data-retri.patch
+component-fix-loop-condition-to-call-unbind-if-bind-.patch
+kernfs-fix-range-checks-in-kernfs_get_target_path.patch
+ip_gre-fix-parsing-gre-header-in-ipgre_err.patch
+arm-dts-rockchip-fix-erroneous-spi-bus-dtc-warnings-.patch
+acpi-lpss-exclude-i2c-busses-shared-with-punit-from-.patch
+ath9k-fix-a-locking-bug-in-ath9k_add_interface.patch
+s390-qeth-invoke-softirqs-after-napi_schedule.patch
+pci-acpi-correct-error-message-for-aspm-disabling.patch
+serial-uartps-fix-suspend-functionality.patch
+serial-samsung-enable-baud-clock-for-uart-reset-proc.patch
+serial-mxs-auart-fix-potential-infinite-loop.patch
+samples-bpf-fix-a-compilation-failure.patch
+spi-mediatek-don-t-modify-spi_transfer-when-transfer.patch
+ipmi-dmi-ignore-ipmi-smbios-entries-with-a-zero-base.patch
+net-hns3-fix-return-type-of-ndo_start_xmit-function.patch
+powerpc-iommu-avoid-derefence-before-pointer-check.patch
+powerpc-64s-hash-fix-stab_rr-off-by-one-initializati.patch
+powerpc-pseries-disable-cpu-hotplug-across-migration.patch
+powerpc-fix-duplicate-const-clang-warning-in-user-ac.patch
+rdma-i40iw-fix-incorrect-iterator-type.patch
+opp-protect-dev_list-with-opp_table-lock.patch
+libfdt-ensure-int_max-is-defined-in-libfdt_env.h.patch
+power-supply-twl4030_charger-fix-charging-current-ou.patch
+power-supply-twl4030_charger-disable-eoc-interrupt-o.patch
+net-toshiba-fix-return-type-of-ndo_start_xmit-functi.patch
+net-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch
+net-broadcom-fix-return-type-of-ndo_start_xmit-funct.patch
+net-amd-fix-return-type-of-ndo_start_xmit-function.patch
+net-sun-fix-return-type-of-ndo_start_xmit-function.patch
+net-hns3-fix-for-setting-speed-for-phy-failed-proble.patch
+net-hns3-fix-parameter-type-for-q_id-in-hclge_tm_q_t.patch
+nfp-provide-a-better-warning-when-ring-allocation-fa.patch
+usb-chipidea-imx-enable-otg-overcurrent-in-case-usb-.patch
+usb-chipidea-fix-otg-event-handler.patch
+mlxsw-spectrum-init-shaper-for-tcs-8.15.patch
+arm-dts-am335x-evm-fix-number-of-cpsw.patch
+f2fs-fix-to-recover-inode-s-uid-gid-during-por.patch
+arm-dts-ux500-correct-scu-unit-address.patch
+arm-dts-ux500-fix-lcda-clock-line-muxing.patch
+arm-dts-ste-fix-spi-controller-node-names.patch
+spi-pic32-use-proper-enum-in-dmaengine_prep_slave_rg.patch
+cpufeature-avoid-warning-when-compiling-with-clang.patch
+crypto-arm-crc32-avoid-warning-when-compiling-with-c.patch
+arm-dts-marvell-fix-spi-and-i2c-bus-warnings.patch
+x86-mce-inject-reset-injection-struct-after-injectio.patch
+arm-dts-clearfog-fix-sdhci-supply-property-name.patch
+bnx2x-ignore-bandwidth-attention-in-single-function-.patch
+samples-bpf-fix-compilation-failure.patch
+net-phy-mdio-bcm-unimac-allow-configuring-mdio-clock.patch
+net-micrel-fix-return-type-of-ndo_start_xmit-functio.patch
+net-freescale-fix-return-type-of-ndo_start_xmit-func.patch
+x86-cpu-use-correct-macros-for-cyrix-calls.patch
+x86-cpu-change-query-logic-so-cpuid-is-enabled-befor.patch
+mips-kexec-relax-memory-restriction.patch
+arm64-dts-rockchip-fix-microsd-in-rk3399-sapphire-bo.patch
+media-pci-ivtv-fix-a-sleep-in-atomic-context-bug-in-.patch
+media-au0828-fix-incorrect-error-messages.patch
+media-davinci-fix-implicit-enum-conversion-warning.patch
+arm-dts-rockchip-explicitly-set-vcc_sd0-pin-to-gpio-.patch
+usb-gadget-uvc-configfs-drop-leaked-references-to-co.patch
+usb-gadget-uvc-configfs-prevent-format-changes-after.patch
+i2c-aspeed-fix-invalid-clock-parameters-for-very-lar.patch
+phy-brcm-sata-allow-phy_brcm_sata-driver-to-be-built.patch
+phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
+phy-phy-twl4030-usb-fix-denied-runtime-access.patch
+usb-gadget-uvc-factor-out-video-usb-request-queueing.patch
+usb-gadget-uvc-only-halt-video-streaming-endpoint-in.patch
+coresight-fix-handling-of-sinks.patch
+coresight-perf-fix-per-cpu-path-management.patch
+coresight-perf-disable-trace-path-upon-source-error.patch
+coresight-etm4x-configure-el2-exception-level-when-k.patch
+coresight-tmc-fix-byte-address-alignment-for-rrp.patch
+misc-kgdbts-fix-restrict-error.patch
+misc-genwqe-should-return-proper-error-value.patch
+vfio-pci-fix-potential-memory-leak-in-vfio_msi_cap_l.patch
+vfio-pci-mask-buggy-sr-iov-vf-intx-support.patch
+scsi-libsas-always-unregister-the-old-device-if-goin.patch
+phy-lantiq-fix-compile-warning.patch
+arm-dts-tegra30-fix-xcvr-setup-use-fuses.patch
+arm-tegra-apalis_t30-fix-mmc1-cmd-pull-up.patch
+arm-dts-paz00-fix-wakeup-gpio-keycode.patch
+net-smsc-fix-return-type-of-ndo_start_xmit-function.patch
+net-faraday-fix-return-type-of-ndo_start_xmit-functi.patch
+f2fs-fix-to-recover-inode-s-project-id-during-por.patch
+f2fs-mark-inode-dirty-explicitly-in-recover_inode.patch
+edac-raise-the-maximum-number-of-memory-controllers.patch
+arm-dts-realview-fix-spi-controller-node-names.patch
+firmware-dell_rbu-make-payload-memory-uncachable.patch
+bluetooth-hci_serdev-clear-hci_uart_proto_ready-to-a.patch
+bluetooth-l2cap-detect-if-remote-is-not-able-to-use-.patch
+x86-hyperv-suppress-pci-fatal-no-config-space-access.patch
+crypto-s5p-sss-fix-fix-argument-list-alignment.patch
+crypto-fix-a-memory-leak-in-rsa-kcs1pad-s-encryption.patch
+iwlwifi-dbg-don-t-crash-if-the-firmware-crashes-in-t.patch
+iwlwifi-api-annotate-compressed-ba-notif-array-sizes.patch
+iwlwifi-mvm-allow-tkip-for-ap-mode.patch
+scsi-ncr5380-clear-all-unissued-commands-on-host-res.patch
+scsi-ncr5380-have-ncr5380_select-return-a-bool.patch
+scsi-ncr5380-withhold-disconnect-privilege-for-reque.patch
+scsi-ncr5380-use-driver_sense-to-indicate-valid-sens.patch
+scsi-ncr5380-check-for-invalid-reselection-target.patch
+scsi-ncr5380-don-t-clear-busy-flag-when-abort-fails.patch
+scsi-ncr5380-don-t-call-dsprintk-following-reselecti.patch
+scsi-ncr5380-handle-bus-free-during-reselection.patch
+scsi-ncr5380-check-for-bus-reset.patch
+arm64-dts-amd-fix-spi-bus-warnings.patch
+arm64-dts-lg-fix-spi-controller-node-names.patch
+arm-dts-lpc32xx-fix-spi-controller-node-names.patch
+arm64-dts-rockchip-enable-display-nodes-on-rk3328-ro.patch
+rtc-armada38x-fix-possible-race-condition.patch
+netfilter-masquerade-don-t-flush-all-conntracks-if-o.patch
+usb-xhci-mtk-fix-isoc-error-when-interval-is-zero.patch
+fuse-use-read_once-on-congestion_threshold-and-max_b.patch
+ib-iser-fix-possible-null-deref-at-iser_inv_desc.patch
+net-phy-mdio-bcm-unimac-mark-pm-functions-as-__maybe.patch
--- /dev/null
+From 403fc06517c41dffdad3cb8d656e7bcdecb48694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 19:47:27 -0500
+Subject: signal: Always ignore SIGKILL and SIGSTOP sent to the global init
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 86989c41b5ea08776c450cb759592532314a4ed6 ]
+
+If the first process started (aka /sbin/init) receives a SIGKILL it
+will panic the system if it is delivered. Making the system unusable
+and undebugable. It isn't much better if the first process started
+receives SIGSTOP.
+
+So always ignore SIGSTOP and SIGKILL sent to init.
+
+This is done in a separate clause in sig_task_ignored as force_sig_info
+can clear SIG_UNKILLABLE and this protection should work even then.
+
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/signal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index bb801156628ee..c9b203875001e 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -77,6 +77,10 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
+
+ handler = sig_handler(t, sig);
+
++ /* SIGKILL and SIGSTOP may not be sent to the global init */
++ if (unlikely(is_global_init(t) && sig_kernel_only(sig)))
++ return true;
++
+ if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) &&
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From e22184176c85fc177d0a1ee96ca6464af339c778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:33:53 -0500
+Subject: signal: Properly deliver SIGILL from uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 55a3235fc71bf34303e34a95eeee235b2d2a35dd ]
+
+For userspace to tell the difference between a random signal and an
+exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGILL is thus wrong, and it will result
+in userspace seeing si_code == SI_USER (like a random signal) instead
+of si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGILL, SEND_SIG_FORCE, current)
+with force_sig(SIG_ILL, current) which gets this right and is
+shorter and easier to type.
+
+Fixes: 014940bad8e4 ("uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails")
+Fixes: 0b5256c7f173 ("uprobes: Send SIGILL if handle_trampoline() fails")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/uprobes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 01941cffa9c2f..c74fc98262508 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -1854,7 +1854,7 @@ static void handle_trampoline(struct pt_regs *regs)
+
+ sigill:
+ uprobe_warn(current, "handle uretprobe, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+
+ }
+
+@@ -1970,7 +1970,7 @@ static void handle_singlestep(struct uprobe_task *utask, struct pt_regs *regs)
+
+ if (unlikely(err)) {
+ uprobe_warn(current, "execute the probed insn, sending SIGILL.");
+- force_sig_info(SIGILL, SEND_SIG_FORCED, current);
++ force_sig(SIGILL, current);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dc9aa662c85376b13e0bd4b352bded49bc8ecc3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jul 2018 20:48:30 -0500
+Subject: signal: Properly deliver SIGSEGV from x86 uprobes
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 4a63c1ffd384ebdce40aac9c997dab68379137be ]
+
+For userspace to tell the difference between an random signal
+and an exception, the exception must include siginfo information.
+
+Using SEND_SIG_FORCED for SIGSEGV is thus wrong, and it will result in
+userspace seeing si_code == SI_USER (like a random signal) instead of
+si_code == SI_KERNEL or a more specific si_code as all exceptions
+deliver.
+
+Therefore replace force_sig_info(SIGSEGV, SEND_SIG_FORCE, current)
+with force_sig(SIG_SEGV, current) which gets this right and is shorter
+and easier to type.
+
+Fixes: 791eca10107f ("uretprobes/x86: Hijack return address")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/uprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 7a87ef1f5b5e6..73391c1bd2a9a 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -987,7 +987,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
+ pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
+ "%%ip=%#lx\n", current->pid, regs->sp, regs->ip);
+
+- force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
++ force_sig(SIGSEGV, current);
+ }
+
+ return -1;
+--
+2.20.1
+
--- /dev/null
+From 0a99995e495394d13c38967174bf13f29bc1d390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jul 2018 09:46:03 +0000
+Subject: soc: imx: gpc: fix PDN delay
+
+From: Sven Schmitt <Sven.Schmitt@mixed-mode.de>
+
+[ Upstream commit 9f4d61d531e0efc9c3283963ae5ef7e314579191 ]
+
+imx6_pm_domain_power_off() reads iso and iso2sw from GPC_PGC_PUPSCR_OFFS
+which stores the power up delays.
+So use GPC_PGC_PDNSCR_OFFS for the correct delays.
+
+Signed-off-by: Sven Schmitt <sven.schmitt@mixed-mode.de>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/gpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index c54d229f8da49..3a12123de4662 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -73,7 +73,7 @@ static int imx6_pm_domain_power_off(struct generic_pm_domain *genpd)
+ return -EBUSY;
+
+ /* Read ISO and ISO2SW power down delays */
+- regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PUPSCR_OFFS, &val);
++ regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PDNSCR_OFFS, &val);
+ iso = val & 0x3f;
+ iso2sw = (val >> 8) & 0x3f;
+
+--
+2.20.1
+
--- /dev/null
+From 7569ec78847d3b9a2b52360158820c903076bb4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 09:57:21 +0200
+Subject: soc: qcom: wcnss_ctrl: Avoid string overflow
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+[ Upstream commit 4c96ed170d658d8826d94edec8ac93ee777981a2 ]
+
+'chinfo.name' is used as a NUL-terminated string, but using strncpy() with
+the length equal to the buffer size may result in lack of the termination:
+
+drivers//soc/qcom/wcnss_ctrl.c: In function 'qcom_wcnss_open_channel':
+drivers//soc/qcom/wcnss_ctrl.c:284:2: warning: 'strncpy' specified bound 32 equals destination size [-Wstringop-truncation]
+ strncpy(chinfo.name, name, sizeof(chinfo.name));
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This changes it to use the safer strscpy() instead.
+
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/wcnss_ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c
+index df3ccb30bc2dd..373400dd816d6 100644
+--- a/drivers/soc/qcom/wcnss_ctrl.c
++++ b/drivers/soc/qcom/wcnss_ctrl.c
+@@ -281,7 +281,7 @@ struct rpmsg_endpoint *qcom_wcnss_open_channel(void *wcnss, const char *name, rp
+ struct rpmsg_channel_info chinfo;
+ struct wcnss_ctrl *_wcnss = wcnss;
+
+- strncpy(chinfo.name, name, sizeof(chinfo.name));
++ strscpy(chinfo.name, name, sizeof(chinfo.name));
+ chinfo.src = RPMSG_ADDR_ANY;
+ chinfo.dst = RPMSG_ADDR_ANY;
+
+--
+2.20.1
+
--- /dev/null
+From 02b23de66c6b6209c96dfc30d8e5b4fa7439d22c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 11:54:21 +0800
+Subject: spi: mediatek: Don't modify spi_transfer when transfer.
+
+From: Peter Shih <pihsun@chromium.org>
+
+[ Upstream commit 00bca73bfca4fb0ab089b94cad0fc83d8b49c25f ]
+
+Mediatek SPI driver modifies some fields (tx_buf, rx_buf, len, tx_dma,
+rx_dma) of the spi_transfer* passed in when doing transfer_one and in
+interrupt handler. This is somewhat unexpected, and there are some
+caller (e.g. Cr50 spi driver) that reuse the spi_transfer for multiple
+messages. Add a field to record how many bytes have been transferred,
+and calculate the right len / buffer based on it instead.
+
+Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
+
+Change-Id: I23e218cd964f16c0b2b26127d4a5ca6529867673
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt65xx.c | 37 +++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 86bf45667a040..3dc31627c6558 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -98,6 +98,7 @@ struct mtk_spi {
+ struct clk *parent_clk, *sel_clk, *spi_clk;
+ struct spi_transfer *cur_transfer;
+ u32 xfer_len;
++ u32 num_xfered;
+ struct scatterlist *tx_sgl, *rx_sgl;
+ u32 tx_sgl_len, rx_sgl_len;
+ const struct mtk_spi_compatible *dev_comp;
+@@ -385,6 +386,7 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,
+
+ mdata->cur_transfer = xfer;
+ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, xfer->len);
++ mdata->num_xfered = 0;
+ mtk_spi_prepare_transfer(master, xfer);
+ mtk_spi_setup_packet(master);
+
+@@ -415,6 +417,7 @@ static int mtk_spi_dma_transfer(struct spi_master *master,
+ mdata->tx_sgl_len = 0;
+ mdata->rx_sgl_len = 0;
+ mdata->cur_transfer = xfer;
++ mdata->num_xfered = 0;
+
+ mtk_spi_prepare_transfer(master, xfer);
+
+@@ -482,7 +485,7 @@ static int mtk_spi_setup(struct spi_device *spi)
+
+ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ {
+- u32 cmd, reg_val, cnt, remainder;
++ u32 cmd, reg_val, cnt, remainder, len;
+ struct spi_master *master = dev_id;
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
+ struct spi_transfer *trans = mdata->cur_transfer;
+@@ -497,36 +500,38 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id)
+ if (trans->rx_buf) {
+ cnt = mdata->xfer_len / 4;
+ ioread32_rep(mdata->base + SPI_RX_DATA_REG,
+- trans->rx_buf, cnt);
++ trans->rx_buf + mdata->num_xfered, cnt);
+ remainder = mdata->xfer_len % 4;
+ if (remainder > 0) {
+ reg_val = readl(mdata->base + SPI_RX_DATA_REG);
+- memcpy(trans->rx_buf + (cnt * 4),
+- ®_val, remainder);
++ memcpy(trans->rx_buf +
++ mdata->num_xfered +
++ (cnt * 4),
++ ®_val,
++ remainder);
+ }
+ }
+
+- trans->len -= mdata->xfer_len;
+- if (!trans->len) {
++ mdata->num_xfered += mdata->xfer_len;
++ if (mdata->num_xfered == trans->len) {
+ spi_finalize_current_transfer(master);
+ return IRQ_HANDLED;
+ }
+
+- if (trans->tx_buf)
+- trans->tx_buf += mdata->xfer_len;
+- if (trans->rx_buf)
+- trans->rx_buf += mdata->xfer_len;
+-
+- mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, trans->len);
++ len = trans->len - mdata->num_xfered;
++ mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len);
+ mtk_spi_setup_packet(master);
+
+- cnt = trans->len / 4;
+- iowrite32_rep(mdata->base + SPI_TX_DATA_REG, trans->tx_buf, cnt);
++ cnt = len / 4;
++ iowrite32_rep(mdata->base + SPI_TX_DATA_REG,
++ trans->tx_buf + mdata->num_xfered, cnt);
+
+- remainder = trans->len % 4;
++ remainder = len % 4;
+ if (remainder > 0) {
+ reg_val = 0;
+- memcpy(®_val, trans->tx_buf + (cnt * 4), remainder);
++ memcpy(®_val,
++ trans->tx_buf + (cnt * 4) + mdata->num_xfered,
++ remainder);
+ writel(reg_val, mdata->base + SPI_TX_DATA_REG);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d930e61df4e4862fb27c1bb976dc24e5e1fb0102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 16:13:37 -0700
+Subject: spi: pic32: Use proper enum in dmaengine_prep_slave_rg
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8cfde7847d5ed0bb77bace41519572963e43cd17 ]
+
+Clang warns when one enumerated type is converted implicitly to another:
+
+drivers/spi/spi-pic32.c:323:8: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ DMA_FROM_DEVICE,
+ ^~~~~~~~~~~~~~~
+drivers/spi/spi-pic32.c:333:8: warning: implicit conversion from
+enumeration type 'enum dma_data_direction' to different enumeration type
+'enum dma_transfer_direction' [-Wenum-conversion]
+ DMA_TO_DEVICE,
+ ^~~~~~~~~~~~~
+2 warnings generated.
+
+Use the proper enums from dma_transfer_direction (DMA_FROM_DEVICE =
+DMA_DEV_TO_MEM = 2, DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1) to satify Clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/159
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pic32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index f8a45af1fa9f2..288002f6c613e 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -320,7 +320,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_rx = dmaengine_prep_slave_sg(master->dma_rx,
+ xfer->rx_sg.sgl,
+ xfer->rx_sg.nents,
+- DMA_FROM_DEVICE,
++ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_rx) {
+ ret = -EINVAL;
+@@ -330,7 +330,7 @@ static int pic32_spi_dma_transfer(struct pic32_spi *pic32s,
+ desc_tx = dmaengine_prep_slave_sg(master->dma_tx,
+ xfer->tx_sg.sgl,
+ xfer->tx_sg.nents,
+- DMA_TO_DEVICE,
++ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+ if (!desc_tx) {
+ ret = -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 16c6c85d7bd35b8b418e5272ceb4e8da110867ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Aug 2018 11:48:33 +0200
+Subject: tee: optee: take DT status property into account
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit db878f76b9ff7487da9bb0f686153f81829f1230 ]
+
+DT nodes may have a 'status' property which, if set to anything other
+than 'ok' or 'okay', indicates to the OS that the DT node should be
+treated as if it was not present. So add that missing logic to the
+OP-TEE driver.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index edb6e4e9ef3ac..ca79c2ba2ef2a 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -590,7 +590,7 @@ static int __init optee_driver_init(void)
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, optee_match);
+- if (!np)
++ if (!np || !of_device_is_available(np))
+ return -ENODEV;
+
+ optee = optee_probe(np);
+--
+2.20.1
+
--- /dev/null
+From ea5e006c91cdc65787dbb15f7be7bc199b9f8cf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 17:18:58 +0200
+Subject: usb: chipidea: Fix otg event handler
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 59739131e0ca06db7560f9073fff2fb83f6bc2a5 ]
+
+At OTG work running time, it's possible that several events need to be
+addressed (e.g. ID and VBUS events). The current implementation handles
+only one event at a time which leads to ignoring the other one. Fix it.
+
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/otg.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index 10236fe715228..8bf4032226ed5 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -206,14 +206,17 @@ static void ci_otg_work(struct work_struct *work)
+ }
+
+ pm_runtime_get_sync(ci->dev);
++
+ if (ci->id_event) {
+ ci->id_event = false;
+ ci_handle_id_switch(ci);
+- } else if (ci->b_sess_valid_event) {
++ }
++
++ if (ci->b_sess_valid_event) {
+ ci->b_sess_valid_event = false;
+ ci_handle_vbus_change(ci);
+- } else
+- dev_err(ci->dev, "unexpected event occurs at %s\n", __func__);
++ }
++
+ pm_runtime_put_sync(ci->dev);
+
+ enable_irq(ci->irq);
+--
+2.20.1
+
--- /dev/null
+From f1b60c3cfcc97a5903ba8e33e49c1e4430a57e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 15:59:56 +0200
+Subject: usb: chipidea: imx: enable OTG overcurrent in case USB subsystem is
+ already started
+
+From: Nicolas Adell <nicolas.adell@actia.fr>
+
+[ Upstream commit 1dedbdf2bbb1ede8d96f35f9845ecae179dc1988 ]
+
+When initializing the USB subsystem before starting the kernel,
+OTG overcurrent detection is disabled. In case the OTG polarity of
+overcurrent is low active, the overcurrent detection is never enabled
+again and events cannot be reported as expected. Because imx usb
+overcurrent polarity is low active by default, only detection needs
+to be enable in usbmisc init function.
+
+Signed-off-by: Nicolas Adell <nicolas.adell@actia.fr>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/usbmisc_imx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c
+index 9f4a0185dd609..b7477fd4443a3 100644
+--- a/drivers/usb/chipidea/usbmisc_imx.c
++++ b/drivers/usb/chipidea/usbmisc_imx.c
+@@ -343,6 +343,8 @@ static int usbmisc_imx6q_init(struct imx_usbmisc_data *data)
+ } else if (data->oc_polarity == 1) {
+ /* High active */
+ reg &= ~(MX6_BM_OVER_CUR_DIS | MX6_BM_OVER_CUR_POLARITY);
++ } else {
++ reg &= ~(MX6_BM_OVER_CUR_DIS);
+ }
+ writel(reg, usbmisc->base + data->index * 4);
+
+--
+2.20.1
+
--- /dev/null
+From ccea4f453afbb3b9a0df14021e513c4cf553df04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Aug 2018 00:14:00 +0300
+Subject: usb: gadget: uvc: configfs: Drop leaked references to config items
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 86f3daed59bceb4fa7981d85e89f63ebbae1d561 ]
+
+Some of the .allow_link() and .drop_link() operations implementations
+call config_group_find_item() and then leak the reference to the
+returned item. Fix this by dropping those references where needed.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index 844cb738bafd0..fc604439b25a1 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -543,6 +543,7 @@ static int uvcg_control_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -578,6 +579,7 @@ static void uvcg_control_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ }
+
+@@ -2037,6 +2039,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ return ret;
+ }
+@@ -2077,6 +2080,7 @@ static void uvcg_streaming_class_drop_link(struct config_item *src,
+ unlock:
+ mutex_unlock(&opts->lock);
+ out:
++ config_item_put(header);
+ mutex_unlock(su_mutex);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a7dd02d7a163fbfb8209fe28e6628f7fc2132bcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 May 2018 21:02:12 +0200
+Subject: usb: gadget: uvc: configfs: Prevent format changes after linking
+ header
+
+From: Joel Pepper <joel.pepper@rwth-aachen.de>
+
+[ Upstream commit cb2200f7af8341aaf0c6abd7ba37e4c667c41639 ]
+
+While checks are in place to avoid attributes and children of a format
+being manipulated after the format is linked into the streaming header,
+the linked flag was never actually set, invalidating the protections.
+Update the flag as appropriate in the header link calls.
+
+Signed-off-by: Joel Pepper <joel.pepper@rwth-aachen.de>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_configfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
+index fc604439b25a1..57f6e8a668cf5 100644
+--- a/drivers/usb/gadget/function/uvc_configfs.c
++++ b/drivers/usb/gadget/function/uvc_configfs.c
+@@ -765,6 +765,7 @@ static int uvcg_streaming_header_allow_link(struct config_item *src,
+ format_ptr->fmt = target_fmt;
+ list_add_tail(&format_ptr->entry, &src_hdr->formats);
+ ++src_hdr->num_fmt;
++ ++target_fmt->linked;
+
+ out:
+ mutex_unlock(&opts->lock);
+@@ -802,6 +803,8 @@ static void uvcg_streaming_header_drop_link(struct config_item *src,
+ break;
+ }
+
++ --target_fmt->linked;
++
+ out:
+ mutex_unlock(&opts->lock);
+ mutex_unlock(su_mutex);
+--
+2.20.1
+
--- /dev/null
+From 8b36ed787c9253a336ede65ee353caeac31d0a04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:42:03 +0300
+Subject: usb: gadget: uvc: Factor out video USB request queueing
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 9d1ff5dcb3cd3390b1e56f1c24ae42c72257c4a3 ]
+
+USB requests for video data are queued from two different locations in
+the driver, with the same code block occurring twice. Factor it out to a
+function.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 30 ++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 0f01c04d7cbd8..540917f54506a 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -129,6 +129,19 @@ uvc_video_encode_isoc(struct usb_request *req, struct uvc_video *video,
+ * Request handling
+ */
+
++static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
++{
++ int ret;
++
++ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ if (ret < 0) {
++ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
++ usb_ep_set_halt(video->ep);
++ }
++
++ return ret;
++}
++
+ /*
+ * I somehow feel that synchronisation won't be easy to achieve here. We have
+ * three events that control USB requests submission:
+@@ -193,14 +206,13 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+
+ video->encode(req, video, buf);
+
+- if ((ret = usb_ep_queue(ep, req, GFP_ATOMIC)) < 0) {
+- printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(ep);
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&video->queue.irqlock, flags);
++
++ if (ret < 0) {
+ uvcg_queue_cancel(queue, 0);
+ goto requeue;
+ }
+- spin_unlock_irqrestore(&video->queue.irqlock, flags);
+
+ return;
+
+@@ -320,15 +332,13 @@ int uvcg_video_pump(struct uvc_video *video)
+ video->encode(req, video, buf);
+
+ /* Queue the USB request */
+- ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
++ ret = uvcg_video_ep_queue(video, req);
++ spin_unlock_irqrestore(&queue->irqlock, flags);
++
+ if (ret < 0) {
+- printk(KERN_INFO "Failed to queue request (%d)\n", ret);
+- usb_ep_set_halt(video->ep);
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ uvcg_queue_cancel(queue, 0);
+ break;
+ }
+- spin_unlock_irqrestore(&queue->irqlock, flags);
+ }
+
+ spin_lock_irqsave(&video->req_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 6e0eadbdfcb6e4d9b0413b6d2aefd0cdf6cadecc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Aug 2018 15:44:57 +0300
+Subject: usb: gadget: uvc: Only halt video streaming endpoint in bulk mode
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 8dbf9c7abefd5c1434a956d5c6b25e11183061a3 ]
+
+When USB requests for video data fail to be submitted, the driver
+signals a problem to the host by halting the video streaming endpoint.
+This is only valid in bulk mode, as isochronous transfers have no
+handshake phase and can't thus report a stall. The usb_ep_set_halt()
+call returns an error when using isochronous endpoints, which we happily
+ignore, but some UDCs complain in the kernel log. Fix this by only
+trying to halt the endpoint in bulk mode.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
+Tested-by: Paul Elder <paul.elder@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 540917f54506a..d6bab12b0b47d 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -136,7 +136,9 @@ static int uvcg_video_ep_queue(struct uvc_video *video, struct usb_request *req)
+ ret = usb_ep_queue(video->ep, req, GFP_ATOMIC);
+ if (ret < 0) {
+ printk(KERN_INFO "Failed to queue request (%d).\n", ret);
+- usb_ep_set_halt(video->ep);
++ /* Isochronous endpoints can't be halted. */
++ if (usb_endpoint_xfer_bulk(video->ep->desc))
++ usb_ep_set_halt(video->ep);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From c7c91f7d1025efe0afdf8bccd2d6676e299115c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Sep 2018 19:13:32 +0300
+Subject: usb: xhci-mtk: fix ISOC error when interval is zero
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 87173acc0d8f0987bda8827da35fff67f52ad15d ]
+
+If the interval equal zero, needn't round up to power of two
+for the number of packets in each ESIT, so fix it.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mtk-sch.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-mtk-sch.c b/drivers/usb/host/xhci-mtk-sch.c
+index 6e7ddf6cafae1..defaf950e6314 100644
+--- a/drivers/usb/host/xhci-mtk-sch.c
++++ b/drivers/usb/host/xhci-mtk-sch.c
+@@ -122,7 +122,9 @@ static void setup_sch_info(struct usb_device *udev,
+ }
+
+ if (ep_type == ISOC_IN_EP || ep_type == ISOC_OUT_EP) {
+- if (esit_pkts <= sch_ep->esit)
++ if (sch_ep->esit == 1)
++ sch_ep->pkts = esit_pkts;
++ else if (esit_pkts <= sch_ep->esit)
+ sch_ep->pkts = 1;
+ else
+ sch_ep->pkts = roundup_pow_of_two(esit_pkts)
+--
+2.20.1
+
--- /dev/null
+From c068545a49bb5f5f1559911b411dc013fb885e55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Fix potential memory leak in vfio_msi_cap_len
+
+From: Li Qiang <liq3ea@gmail.com>
+
+[ Upstream commit 30ea32ab1951c80c6113f300fce2c70cd12659e4 ]
+
+Free allocated vdev->msi_perm in error path.
+
+Signed-off-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_config.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 115a36f6f4039..62023b4a373b4 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
+ return -ENOMEM;
+
+ ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
+- if (ret)
++ if (ret) {
++ kfree(vdev->msi_perm);
+ return ret;
++ }
+
+ return len;
+ }
+--
+2.20.1
+
--- /dev/null
+From da8e38551218a501e6c7e87c08e7045ac2583480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 13:01:27 -0600
+Subject: vfio/pci: Mask buggy SR-IOV VF INTx support
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+[ Upstream commit db04264fe9bc0f2b62e036629f9afb530324b693 ]
+
+The SR-IOV spec requires that VFs must report zero for the INTx pin
+register as VFs are precluded from INTx support. It's much easier for
+the host kernel to understand whether a device is a VF and therefore
+whether a non-zero pin register value is bogus than it is to do the
+same in userspace. Override the INTx count for such devices and
+virtualize the pin register to provide a consistent view of the device
+to the user.
+
+As this is clearly a spec violation, warn about it to support hardware
+validation, but also provide a known whitelist as it doesn't do much
+good to continue complaining if the hardware vendor doesn't plan to
+fix it.
+
+Known devices with this issue: 8086:270c
+
+Tested-by: Gage Eads <gage.eads@intel.com>
+Reviewed-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 8 ++++++--
+ drivers/vfio/pci/vfio_pci_config.c | 27 +++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 15b1cd4ef5a77..9bd3e7911af2b 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -433,10 +433,14 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type)
+ {
+ if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) {
+ u8 pin;
++
++ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) ||
++ vdev->nointx || vdev->pdev->is_virtfn)
++ return 0;
++
+ pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin);
+- if (IS_ENABLED(CONFIG_VFIO_PCI_INTX) && !vdev->nointx && pin)
+- return 1;
+
++ return pin ? 1 : 0;
+ } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) {
+ u8 pos;
+ u16 flags;
+diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
+index 62023b4a373b4..423ea1f98441a 100644
+--- a/drivers/vfio/pci/vfio_pci_config.c
++++ b/drivers/vfio/pci/vfio_pci_config.c
+@@ -1611,6 +1611,15 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev)
+ return 0;
+ }
+
++/*
++ * Nag about hardware bugs, hopefully to have vendors fix them, but at least
++ * to collect a list of dependencies for the VF INTx pin quirk below.
++ */
++static const struct pci_device_id known_bogus_vf_intx_pin[] = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x270c) },
++ {}
++};
++
+ /*
+ * For each device we allocate a pci_config_map that indicates the
+ * capability occupying each dword and thus the struct perm_bits we
+@@ -1676,6 +1685,24 @@ int vfio_config_init(struct vfio_pci_device *vdev)
+ if (pdev->is_virtfn) {
+ *(__le16 *)&vconfig[PCI_VENDOR_ID] = cpu_to_le16(pdev->vendor);
+ *(__le16 *)&vconfig[PCI_DEVICE_ID] = cpu_to_le16(pdev->device);
++
++ /*
++ * Per SR-IOV spec rev 1.1, 3.4.1.18 the interrupt pin register
++ * does not apply to VFs and VFs must implement this register
++ * as read-only with value zero. Userspace is not readily able
++ * to identify whether a device is a VF and thus that the pin
++ * definition on the device is bogus should it violate this
++ * requirement. We already virtualize the pin register for
++ * other purposes, so we simply need to replace the bogus value
++ * and consider VFs when we determine INTx IRQ count.
++ */
++ if (vconfig[PCI_INTERRUPT_PIN] &&
++ !pci_match_id(known_bogus_vf_intx_pin, pdev))
++ pci_warn(pdev,
++ "Hardware bug: VF reports bogus INTx pin %d\n",
++ vconfig[PCI_INTERRUPT_PIN]);
++
++ vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */
+ }
+
+ if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx)
+--
+2.20.1
+
--- /dev/null
+From 6657464dc1a92077a2de90caad0fe6f2b1bc63c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 17:20:41 -0400
+Subject: x86/CPU: Change query logic so CPUID is enabled before testing
+
+From: Matthew Whitehead <tedheadster@gmail.com>
+
+[ Upstream commit 2893cc8ff892fa74972d8dc0e1d0dc65116daaa3 ]
+
+Presently we check first if CPUID is enabled. If it is not already
+enabled, then we next call identify_cpu_without_cpuid() and clear
+X86_FEATURE_CPUID.
+
+Unfortunately, identify_cpu_without_cpuid() is the function where CPUID
+becomes _enabled_ on Cyrix 6x86/6x86L CPUs.
+
+Reverse the calling sequence so that CPUID is first enabled, and then
+check a second time to see if the feature has now been activated.
+
+[ bp: Massage commit message and remove trailing whitespace. ]
+
+Suggested-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Matthew Whitehead <tedheadster@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180921212041.13096-3-tedheadster@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index c0c9c5a44e82c..3d805e8b37396 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1066,6 +1066,9 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ memset(&c->x86_capability, 0, sizeof c->x86_capability);
+ c->extended_cpuid_level = 0;
+
++ if (!have_cpuid_p())
++ identify_cpu_without_cpuid(c);
++
+ /* cyrix could have cpuid enabled via c_identify()*/
+ if (have_cpuid_p()) {
+ cpu_detect(c);
+@@ -1082,7 +1085,6 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
+ if (this_cpu->c_bsp_init)
+ this_cpu->c_bsp_init(c);
+ } else {
+- identify_cpu_without_cpuid(c);
+ setup_clear_cpu_cap(X86_FEATURE_CPUID);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d43e66156d29d1c2d302dde1556f0e8e23c7282c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Sep 2018 17:20:40 -0400
+Subject: x86/CPU: Use correct macros for Cyrix calls
+
+From: Matthew Whitehead <tedheadster@gmail.com>
+
+[ Upstream commit 03b099bdcdf7125d4a63dc9ddeefdd454e05123d ]
+
+There are comments in processor-cyrix.h advising you to _not_ make calls
+using the deprecated macros in this style:
+
+ setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
+
+This is because it expands the macro into a non-functioning calling
+sequence. The calling order must be:
+
+ outb(CX86_CCR2, 0x22);
+ inb(0x23);
+
+From the comments:
+
+ * When using the old macros a line like
+ * setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
+ * gets expanded to:
+ * do {
+ * outb((CX86_CCR2), 0x22);
+ * outb((({
+ * outb((CX86_CCR2), 0x22);
+ * inb(0x23);
+ * }) | 0x88), 0x23);
+ * } while (0);
+
+The new macros fix this problem, so use them instead.
+
+Signed-off-by: Matthew Whitehead <tedheadster@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Andy Lutomirski <luto@amacapital.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jia Zhang <qianyue.zj@alibaba-inc.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180921212041.13096-2-tedheadster@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/cyrix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
+index fa61c870ada94..1d9b8aaea06c8 100644
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -437,7 +437,7 @@ static void cyrix_identify(struct cpuinfo_x86 *c)
+ /* enable MAPEN */
+ setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);
+ /* enable cpuid */
+- setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x80);
++ setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x80);
+ /* disable MAPEN */
+ setCx86(CX86_CCR3, ccr3);
+ local_irq_restore(flags);
+--
+2.20.1
+
--- /dev/null
+From 3b32077af0f53369837d52bcc2e267b41569fdb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 22:29:50 +0000
+Subject: x86/hyperv: Suppress "PCI: Fatal: No config space access function
+ found"
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 2f285f46240d67060061d153786740d4df53cd78 ]
+
+A Generation-2 Linux VM on Hyper-V doesn't have the legacy PCI bus, and
+users always see the scary warning, which is actually harmless.
+
+Suppress it.
+
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: KY Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: "devel@linuxdriverproject.org" <devel@linuxdriverproject.org>
+Cc: Olaf Aepfle <olaf@aepfle.de>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
+Cc: Marcelo Cerri <marcelo.cerri@canonical.com>
+Cc: Josh Poulson <jopoulso@microsoft.com>
+Link: https://lkml.kernel.org/r/ <KU1P153MB0166D977DC930996C4BF538ABF1D0@KU1P153MB0166.APCP153.PROD.OUTLOOK.COM
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/hyperv/hv_init.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
+index 2e9d58cc371e6..2653b7b25d176 100644
+--- a/arch/x86/hyperv/hv_init.c
++++ b/arch/x86/hyperv/hv_init.c
+@@ -17,6 +17,7 @@
+ *
+ */
+
++#include <linux/efi.h>
+ #include <linux/types.h>
+ #include <asm/hypervisor.h>
+ #include <asm/hyperv.h>
+@@ -101,6 +102,22 @@ static int hv_cpu_init(unsigned int cpu)
+ return 0;
+ }
+
++static int __init hv_pci_init(void)
++{
++ int gen2vm = efi_enabled(EFI_BOOT);
++
++ /*
++ * For Generation-2 VM, we exit from pci_arch_init() by returning 0.
++ * The purpose is to suppress the harmless warning:
++ * "PCI: Fatal: No config space access function found"
++ */
++ if (gen2vm)
++ return 0;
++
++ /* For Generation-1 VM, we'll proceed in pci_arch_init(). */
++ return 1;
++}
++
+ /*
+ * This function is to be invoked early in the boot sequence after the
+ * hypervisor has been detected.
+@@ -154,6 +171,8 @@ void hyperv_init(void)
+
+ hyper_alloc_mmu();
+
++ x86_init.pci.arch_init = hv_pci_init;
++
+ /*
+ * Register Hyper-V specific clocksource.
+ */
+--
+2.20.1
+
--- /dev/null
+From 29ad9cf363e6e1a1ecf3b01ce54e73c51bb87756 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Sep 2018 11:22:12 +0200
+Subject: x86/mce-inject: Reset injection struct after injection
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit 7401a633c34adc7aefd3edfec60074cb0475a3e8 ]
+
+Clear the MCE struct which is used for collecting the injection details
+after injection.
+
+Also, populate it with more details from the machine.
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20180905081954.10391-1-bp@alien8.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce-inject.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+index 8fec687b3e44e..f12141ba9a76d 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c
+@@ -108,6 +108,9 @@ static void setup_inj_struct(struct mce *m)
+ memset(m, 0, sizeof(struct mce));
+
+ m->cpuvendor = boot_cpu_data.x86_vendor;
++ m->time = ktime_get_real_seconds();
++ m->cpuid = cpuid_eax(1);
++ m->microcode = boot_cpu_data.microcode;
+ }
+
+ /* Update fake mce registers on current CPU. */
+@@ -576,6 +579,9 @@ static int inj_bank_set(void *data, u64 val)
+ m->bank = val;
+ do_inject();
+
++ /* Reset injection struct */
++ setup_inj_struct(&i_mce);
++
+ return 0;
+ }
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
