--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Adam Ford <aford173@gmail.com>
+Date: Wed, 11 Jul 2018 12:54:54 -0500
+Subject: ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 923847413f7316b5ced3491769b3fefa6c56a79a ]
+
+The AM3517 has a different OTG controller location than the OMAP3,
+which is included from omap3.dtsi. This results in a hwmod error.
+Since the AM3517 has a different OTG controller address, this patch
+disabes one that is isn't available.
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am3517.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm/boot/dts/am3517.dtsi
++++ b/arch/arm/boot/dts/am3517.dtsi
+@@ -62,6 +62,11 @@
+ };
+ };
+
++/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
++&usb_otg_hs {
++ status = "disabled";
++};
++
+ &iva {
+ status = "disabled";
+ };
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Daniel Mack <daniel@zonque.org>
+Date: Sun, 17 Jun 2018 13:53:09 +0200
+Subject: ARM: dts: am437x: make edt-ft5x06 a wakeup source
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit 49a6ec5b807ea4ad7ebe1f58080ebb8497cb2d2c ]
+
+The touchscreen driver no longer configures the device as wakeup source by
+default. A "wakeup-source" property is needed.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/am437x-sk-evm.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/am437x-sk-evm.dts
++++ b/arch/arm/boot/dts/am437x-sk-evm.dts
+@@ -415,6 +415,8 @@
+
+ touchscreen-size-x = <480>;
+ touchscreen-size-y = <272>;
++
++ wakeup-source;
+ };
+
+ tlv320aic3106: tlv320aic3106@1b {
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Keerthy <j-keerthy@ti.com>
+Date: Tue, 5 Jun 2018 15:37:51 +0530
+Subject: ARM: dts: da850: Fix interrups property for gpio
+
+From: Keerthy <j-keerthy@ti.com>
+
+[ Upstream commit 3eb1b955cd7ed1e621ace856710006c2a8a7f231 ]
+
+The intc #interrupt-cells is equal to 1. Currently gpio
+node has 2 cells per IRQ which is wrong. Remove the additional
+cell for each of the interrupts.
+
+Signed-off-by: Keerthy <j-keerthy@ti.com>
+Fixes: 2e38b946dc54 ("ARM: davinci: da850: add GPIO DT node")
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/da850.dtsi | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/arch/arm/boot/dts/da850.dtsi
++++ b/arch/arm/boot/dts/da850.dtsi
+@@ -267,11 +267,7 @@
+ compatible = "ti,dm6441-gpio";
+ gpio-controller;
+ reg = <0x226000 0x1000>;
+- interrupts = <42 IRQ_TYPE_EDGE_BOTH
+- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
+- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
+- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
+- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
++ interrupts = <42 43 44 45 46 47 48 49 50>;
+ ti,ngpio = <144>;
+ ti,davinci-gpio-unbanked = <0>;
+ status = "disabled";
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Tue, 26 Jun 2018 08:37:09 -0300
+Subject: ARM: imx_v4_v5_defconfig: Select ULPI support
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+[ Upstream commit 2ceb2780b790b74bc408a949f6aedbad8afa693e ]
+
+Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
+USB ULPI can be functional on some boards like that use ULPI
+interface.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/configs/imx_v4_v5_defconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/configs/imx_v4_v5_defconfig
++++ b/arch/arm/configs/imx_v4_v5_defconfig
+@@ -146,9 +146,11 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
++CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_NOP_USB_XCEIV=y
+ CONFIG_USB_GADGET=y
+ CONFIG_USB_ETH=m
++CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Daniel Mack <daniel@zonque.org>
+Date: Fri, 6 Jul 2018 22:15:00 +0200
+Subject: ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit 0c1049dcb4ceec640d8bd797335bcbebdcab44d2 ]
+
+PXA3xx platforms have 56 interrupts that are stored in two ICMR
+registers. The code in pxa_irq_suspend() and pxa_irq_resume() however
+does a simple division by 32 which only leads to one register being
+saved at suspend and restored at resume time. The NAND interrupt
+setting, for instance, is lost.
+
+Fix this by using DIV_ROUND_UP() instead.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-pxa/irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-pxa/irq.c
++++ b/arch/arm/mach-pxa/irq.c
+@@ -160,7 +160,7 @@ static int pxa_irq_suspend(void)
+ {
+ int i;
+
+- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ void __iomem *base = irq_base(i);
+
+ saved_icmr[i] = __raw_readl(base + ICMR);
+@@ -179,7 +179,7 @@ static void pxa_irq_resume(void)
+ {
+ int i;
+
+- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
++ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
+ void __iomem *base = irq_base(i);
+
+ __raw_writel(saved_icmr[i], base + ICMR);
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
+Date: Tue, 12 Jun 2018 17:07:37 +0800
+Subject: arm64: make secondary_start_kernel() notrace
+
+From: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
+
+[ Upstream commit b154886f7892499d0d3054026e19dfb9a731df61 ]
+
+We can't call function trace hook before setup percpu offset.
+When entering secondary_start_kernel(), percpu offset has not
+been initialized. So this lead hotplug malfunction.
+Here is the flow to reproduce this bug:
+
+echo 0 > /sys/devices/system/cpu/cpu1/online
+echo function > /sys/kernel/debug/tracing/current_tracer
+echo 1 > /sys/kernel/debug/tracing/tracing_on
+echo 1 > /sys/devices/system/cpu/cpu1/online
+
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -130,7 +130,7 @@ static void smp_store_cpu_info(unsigned
+ * This is the secondary CPU boot entry. We're using this CPUs
+ * idle thread stack, but a set of temporary page tables.
+ */
+-asmlinkage void secondary_start_kernel(void)
++asmlinkage notrace void secondary_start_kernel(void)
+ {
+ struct mm_struct *mm = &init_mm;
+ unsigned int cpu = smp_processor_id();
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Thu, 28 Jun 2018 04:52:15 -0700
+Subject: bnx2x: Fix receiving tx-timeout in error or recovery state.
+
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+
+[ Upstream commit 484c016d9392786ce5c74017c206c706f29f823d ]
+
+Driver performs the internal reload when it receives tx-timeout event from
+the OS. Internal reload might fail in some scenarios e.g., fatal HW issues.
+In such cases OS still see the link, which would result in undesirable
+functionalities such as re-generation of tx-timeouts.
+The patch addresses this issue by indicating the link-down to OS when
+tx-timeout is detected, and keeping the link in down state till the
+internal reload is successful.
+
+Please consider applying it to 'net' branch.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 ++++++
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 6 ++++++
+ 3 files changed, 13 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -1613,6 +1613,7 @@ struct bnx2x {
+ struct link_vars link_vars;
+ u32 link_cnt;
+ struct bnx2x_link_report_data last_reported_link;
++ bool force_link_down;
+
+ struct mdio_if_info mdio;
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -1257,6 +1257,11 @@ void __bnx2x_link_report(struct bnx2x *b
+ {
+ struct bnx2x_link_report_data cur_data;
+
++ if (bp->force_link_down) {
++ bp->link_vars.link_up = 0;
++ return;
++ }
++
+ /* reread mf_cfg */
+ if (IS_PF(bp) && !CHIP_IS_E1(bp))
+ bnx2x_read_mf_cfg(bp);
+@@ -2799,6 +2804,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int
+ bp->pending_max = 0;
+ }
+
++ bp->force_link_down = false;
+ if (bp->port.pmf) {
+ rc = bnx2x_initial_phy_init(bp, load_mode);
+ if (rc)
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -10036,6 +10036,12 @@ static void bnx2x_sp_rtnl_task(struct wo
+ bp->sp_rtnl_state = 0;
+ smp_mb();
+
++ /* Immediately indicate link as down */
++ bp->link_vars.link_up = 0;
++ bp->force_link_down = true;
++ netif_carrier_off(bp->dev);
++ BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
++
+ bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
+ bnx2x_nic_load(bp, LOAD_NORMAL);
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Michael Trimarchi <michael@amarulasolutions.com>
+Date: Wed, 30 May 2018 11:06:34 +0200
+Subject: brcmfmac: stop watchdog before detach and free everything
+
+From: Michael Trimarchi <michael@amarulasolutions.com>
+
+[ Upstream commit 373c83a801f15b1e3d02d855fad89112bd4ccbe0 ]
+
+Using built-in in kernel image without a firmware in filesystem
+or in the kernel image can lead to a kernel NULL pointer deference.
+Watchdog need to be stopped in brcmf_sdio_remove
+
+The system is going down NOW!
+[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
+Sent SIGTERM to all processes
+[ 1348.121412] Mem abort info:
+[ 1348.126962] ESR = 0x96000004
+[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits
+[ 1348.135948] SET = 0, FnV = 0
+[ 1348.138997] EA = 0, S1PTW = 0
+[ 1348.142154] Data abort info:
+[ 1348.145045] ISV = 0, ISS = 0x00000004
+[ 1348.148884] CM = 0, WnR = 0
+[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
+[ 1348.158475] [00000000000002f8] pgd=0000000000000000
+[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 1348.168927] Modules linked in: ipv6
+[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
+[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
+[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
+[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
+[ 1348.200253] sp : ffff00000b85be30
+[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
+[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
+[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
+[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
+[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
+[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
+[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
+[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
+[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
+[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
+[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
+[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
+[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
+[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
+[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
+
+Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+@@ -4201,6 +4201,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ brcmf_dbg(TRACE, "Enter\n");
+
+ if (bus) {
++ /* Stop watchdog task */
++ if (bus->watchdog_tsk) {
++ send_sig(SIGTERM, bus->watchdog_tsk, 1);
++ kthread_stop(bus->watchdog_tsk);
++ bus->watchdog_tsk = NULL;
++ }
++
+ /* De-register interrupt handler */
+ brcmf_sdiod_intr_unregister(bus->sdiodev);
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+Date: Sat, 23 Jun 2018 20:28:26 +0530
+Subject: cxgb4: when disabling dcb set txq dcb priority to 0
+
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+
+[ Upstream commit 5ce36338a30f9814fc4824f9fe6c20cd83d872c7 ]
+
+When we are disabling DCB, store "0" in txq->dcb_prio
+since that's used for future TX Work Request "OVLAN_IDX"
+values. Setting non zero priority upon disabling DCB
+would halt the traffic.
+
+Reported-by: AMG Zollner Robert <robert@cloudmedia.eu>
+CC: David Ahern <dsa@cumulusnetworks.com>
+Signed-off-by: Casey Leedom <leedom@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -529,7 +529,7 @@ static void dcb_tx_queue_prio_enable(str
+ "Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
+ enable ? "set" : "unset", pi->port_id, i, -err);
+ else
+- txq->dcb_prio = value;
++ txq->dcb_prio = enable ? value : 0;
+ }
+ }
+ #endif /* CONFIG_CHELSIO_T4_DCB */
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Jun 2018 14:15:47 +0300
+Subject: dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c4c2b7644cc9a41f17a8cc8904efe3f66ae4c7ed ]
+
+The d->chans[] array has d->dma_requests elements so the > should be
+>= here.
+
+Fixes: 8e6152bc660e ("dmaengine: Add hisilicon k3 DMA engine driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/k3dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/k3dma.c
++++ b/drivers/dma/k3dma.c
+@@ -652,7 +652,7 @@ static struct dma_chan *k3_of_dma_simple
+ struct k3_dma_dev *d = ofdma->of_dma_data;
+ unsigned int request = dma_spec->args[0];
+
+- if (request > d->dma_requests)
++ if (request >= d->dma_requests)
+ return NULL;
+
+ return dma_get_slave_channel(&(d->chans[request].vc.chan));
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sun, 24 Jun 2018 14:35:10 +0100
+Subject: drm/armada: fix colorkey mode property
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit d378859a667edc99e3473704847698cae97ca2b1 ]
+
+The colorkey mode property was not correctly disabling the colorkeying
+when "disabled" mode was selected. Arrange for this to work as one
+would expect.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/armada/armada_hw.h | 1 +
+ drivers/gpu/drm/armada/armada_overlay.c | 30 ++++++++++++++++++++++--------
+ 2 files changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/armada/armada_hw.h
++++ b/drivers/gpu/drm/armada/armada_hw.h
+@@ -160,6 +160,7 @@ enum {
+ CFG_ALPHAM_GRA = 0x1 << 16,
+ CFG_ALPHAM_CFG = 0x2 << 16,
+ CFG_ALPHA_MASK = 0xff << 8,
++#define CFG_ALPHA(x) ((x) << 8)
+ CFG_PIXCMD_MASK = 0xff,
+ };
+
+--- a/drivers/gpu/drm/armada/armada_overlay.c
++++ b/drivers/gpu/drm/armada/armada_overlay.c
+@@ -26,6 +26,7 @@ struct armada_plane_properties {
+ uint16_t contrast;
+ uint16_t saturation;
+ uint32_t colorkey_mode;
++ uint32_t colorkey_enable;
+ };
+
+ struct armada_plane {
+@@ -62,11 +63,13 @@ armada_ovl_update_attr(struct armada_pla
+ writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
+
+ spin_lock_irq(&dcrtc->irq_lock);
+- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
+- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+- dcrtc->base + LCD_SPU_DMA_CTRL1);
+-
+- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
++ armada_updatel(prop->colorkey_mode,
++ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
++ dcrtc->base + LCD_SPU_DMA_CTRL1);
++ if (dcrtc->variant->has_spu_adv_reg)
++ armada_updatel(prop->colorkey_enable,
++ ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
++ dcrtc->base + LCD_SPU_ADV_REG);
+ spin_unlock_irq(&dcrtc->irq_lock);
+ }
+
+@@ -329,8 +332,17 @@ static int armada_plane_set_property(str
+ dplane->prop.colorkey_vb |= K2B(val);
+ update_attr = true;
+ } else if (property == priv->colorkey_mode_prop) {
+- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
+- dplane->prop.colorkey_mode |= CFG_CKMODE(val);
++ if (val == CKMODE_DISABLE) {
++ dplane->prop.colorkey_mode =
++ CFG_CKMODE(CKMODE_DISABLE) |
++ CFG_ALPHAM_CFG | CFG_ALPHA(255);
++ dplane->prop.colorkey_enable = 0;
++ } else {
++ dplane->prop.colorkey_mode =
++ CFG_CKMODE(val) |
++ CFG_ALPHAM_GRA | CFG_ALPHA(0);
++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
++ }
+ update_attr = true;
+ } else if (property == priv->brightness_prop) {
+ dplane->prop.brightness = val - 256;
+@@ -449,7 +461,9 @@ int armada_overlay_plane_create(struct d
+ dplane->prop.colorkey_yr = 0xfefefe00;
+ dplane->prop.colorkey_ug = 0x01010100;
+ dplane->prop.colorkey_vb = 0x01010100;
+- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
++ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
++ CFG_ALPHAM_GRA | CFG_ALPHA(0);
++ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+ dplane->prop.brightness = 0;
+ dplane->prop.contrast = 0x4000;
+ dplane->prop.saturation = 0x4000;
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 7 Jun 2018 13:06:13 +0200
+Subject: drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit dd209ef809080ced903e7747ee3ef640c923a1d2 ]
+
+Fix following issues related to planar YUV pixel format configuration:
+- NV16/61 modes were incorrectly programmed as NV12/21,
+- YVU420 was programmed as YUV420 on source,
+- YVU420 and YUV422 were programmed as YUV420 on output.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_gsc.c | 29 ++++++++++++++++++++---------
+ drivers/gpu/drm/exynos/regs-gsc.h | 1 +
+ 2 files changed, 21 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+@@ -526,21 +526,25 @@ static int gsc_src_set_fmt(struct device
+ GSC_IN_CHROMA_ORDER_CRCB);
+ break;
+ case DRM_FORMAT_NV21:
++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
++ break;
+ case DRM_FORMAT_NV61:
+- cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
+- GSC_IN_YUV420_2P);
++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
+ break;
+ case DRM_FORMAT_YUV422:
+ cfg |= GSC_IN_YUV422_3P;
+ break;
+ case DRM_FORMAT_YUV420:
++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
++ break;
+ case DRM_FORMAT_YVU420:
+- cfg |= GSC_IN_YUV420_3P;
++ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
+ break;
+ case DRM_FORMAT_NV12:
++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
++ break;
+ case DRM_FORMAT_NV16:
+- cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
+- GSC_IN_YUV420_2P);
++ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
+ break;
+ case DRM_FORMAT_NV12MT:
+ cfg |= (GSC_IN_TILE_C_16x8 | GSC_IN_TILE_MODE);
+@@ -796,18 +800,25 @@ static int gsc_dst_set_fmt(struct device
+ GSC_OUT_CHROMA_ORDER_CRCB);
+ break;
+ case DRM_FORMAT_NV21:
+- case DRM_FORMAT_NV61:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
+ break;
++ case DRM_FORMAT_NV61:
++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
++ break;
+ case DRM_FORMAT_YUV422:
++ cfg |= GSC_OUT_YUV422_3P;
++ break;
+ case DRM_FORMAT_YUV420:
++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
++ break;
+ case DRM_FORMAT_YVU420:
+- cfg |= GSC_OUT_YUV420_3P;
++ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
+ break;
+ case DRM_FORMAT_NV12:
++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
++ break;
+ case DRM_FORMAT_NV16:
+- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
+- GSC_OUT_YUV420_2P);
++ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
+ break;
+ case DRM_FORMAT_NV12MT:
+ cfg |= (GSC_OUT_TILE_C_16x8 | GSC_OUT_TILE_MODE);
+--- a/drivers/gpu/drm/exynos/regs-gsc.h
++++ b/drivers/gpu/drm/exynos/regs-gsc.h
+@@ -138,6 +138,7 @@
+ #define GSC_OUT_YUV420_3P (3 << 4)
+ #define GSC_OUT_YUV422_1P (4 << 4)
+ #define GSC_OUT_YUV422_2P (5 << 4)
++#define GSC_OUT_YUV422_3P (6 << 4)
+ #define GSC_OUT_YUV444 (7 << 4)
+ #define GSC_OUT_TILE_TYPE_MASK (1 << 2)
+ #define GSC_OUT_TILE_C_16x8 (0 << 2)
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Govindarajulu Varadarajan <gvaradar@cisco.com>
+Date: Tue, 19 Jun 2018 08:15:24 -0700
+Subject: enic: initialize enic->rfs_h.lock in enic_probe
+
+From: Govindarajulu Varadarajan <gvaradar@cisco.com>
+
+[ Upstream commit 3256d29fc7aecdf99feb1cb9475ed2252769a8a7 ]
+
+lockdep spotted that we are using rfs_h.lock in enic_get_rxnfc() without
+initializing. rfs_h.lock is initialized in enic_open(). But ethtool_ops
+can be called when interface is down.
+
+Move enic_rfs_flw_tbl_init to enic_probe.
+
+INFO: trying to register non-static key.
+the code is fine but needs lockdep annotation.
+turning off the locking correctness validator.
+CPU: 18 PID: 1189 Comm: ethtool Not tainted 4.17.0-rc7-devel+ #27
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
+Call Trace:
+dump_stack+0x85/0xc0
+register_lock_class+0x550/0x560
+? __handle_mm_fault+0xa8b/0x1100
+__lock_acquire+0x81/0x670
+lock_acquire+0xb9/0x1e0
+? enic_get_rxnfc+0x139/0x2b0 [enic]
+_raw_spin_lock_bh+0x38/0x80
+? enic_get_rxnfc+0x139/0x2b0 [enic]
+enic_get_rxnfc+0x139/0x2b0 [enic]
+ethtool_get_rxnfc+0x8d/0x1c0
+dev_ethtool+0x16c8/0x2400
+? __mutex_lock+0x64d/0xa00
+? dev_load+0x6a/0x150
+dev_ioctl+0x253/0x4b0
+sock_do_ioctl+0x9a/0x130
+sock_ioctl+0x1af/0x350
+do_vfs_ioctl+0x8e/0x670
+? syscall_trace_enter+0x1e2/0x380
+ksys_ioctl+0x60/0x90
+__x64_sys_ioctl+0x16/0x20
+do_syscall_64+0x5a/0x170
+entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cisco/enic/enic_clsf.c | 3 +--
+ drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
++++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
+@@ -78,7 +78,6 @@ void enic_rfs_flw_tbl_init(struct enic *
+ enic->rfs_h.max = enic->config.num_arfs;
+ enic->rfs_h.free = enic->rfs_h.max;
+ enic->rfs_h.toclean = 0;
+- enic_rfs_timer_start(enic);
+ }
+
+ void enic_rfs_flw_tbl_free(struct enic *enic)
+@@ -87,7 +86,6 @@ void enic_rfs_flw_tbl_free(struct enic *
+
+ enic_rfs_timer_stop(enic);
+ spin_lock_bh(&enic->rfs_h.lock);
+- enic->rfs_h.free = 0;
+ for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
+ struct hlist_head *hhead;
+ struct hlist_node *tmp;
+@@ -98,6 +96,7 @@ void enic_rfs_flw_tbl_free(struct enic *
+ enic_delfltr(enic, n->fltr_id);
+ hlist_del(&n->node);
+ kfree(n);
++ enic->rfs_h.free++;
+ }
+ }
+ spin_unlock_bh(&enic->rfs_h.lock);
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -1643,7 +1643,7 @@ static int enic_open(struct net_device *
+ vnic_intr_unmask(&enic->intr[i]);
+
+ enic_notify_timer_start(enic);
+- enic_rfs_flw_tbl_init(enic);
++ enic_rfs_timer_start(enic);
+
+ return 0;
+
+@@ -2508,6 +2508,7 @@ static int enic_probe(struct pci_dev *pd
+ enic->notify_timer.function = enic_notify_timer;
+ enic->notify_timer.data = (unsigned long)enic;
+
++ enic_rfs_flw_tbl_init(enic);
+ enic_set_rx_coal_setting(enic);
+ INIT_WORK(&enic->reset, enic_reset);
+ INIT_WORK(&enic->change_mtu_work, enic_change_mtu_work);
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Thu, 21 Jun 2018 19:49:36 +0800
+Subject: ipv6: mcast: fix unsolicited report interval after receiving querys
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 6c6da92808442908287fae8ebb0ca041a52469f4 ]
+
+After recieving MLD querys, we update idev->mc_maxdelay with max_delay
+from query header. This make the later unsolicited reports have the same
+interval with mc_maxdelay, which means we may send unsolicited reports with
+long interval time instead of default configured interval time.
+
+Also as we will not call ipv6_mc_reset() after device up. This issue will
+be there even after leave the group and join other groups.
+
+Fixes: fc4eba58b4c14 ("ipv6: make unsolicited report intervals configurable for mld")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/mcast.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2062,7 +2062,8 @@ void ipv6_mc_dad_complete(struct inet6_d
+ mld_send_initial_cr(idev);
+ idev->mc_dad_count--;
+ if (idev->mc_dad_count)
+- mld_dad_start_timer(idev, idev->mc_maxdelay);
++ mld_dad_start_timer(idev,
++ unsolicited_report_interval(idev));
+ }
+ }
+
+@@ -2074,7 +2075,8 @@ static void mld_dad_timer_expire(unsigne
+ if (idev->mc_dad_count) {
+ idev->mc_dad_count--;
+ if (idev->mc_dad_count)
+- mld_dad_start_timer(idev, idev->mc_maxdelay);
++ mld_dad_start_timer(idev,
++ unsolicited_report_interval(idev));
+ }
+ in6_dev_put(idev);
+ }
+@@ -2432,7 +2434,8 @@ static void mld_ifc_timer_expire(unsigne
+ if (idev->mc_ifc_count) {
+ idev->mc_ifc_count--;
+ if (idev->mc_ifc_count)
+- mld_ifc_start_timer(idev, idev->mc_maxdelay);
++ mld_ifc_start_timer(idev,
++ unsolicited_report_interval(idev));
+ }
+ in6_dev_put(idev);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Mon, 18 Jun 2018 12:02:00 -0400
+Subject: ixgbe: Be more careful when modifying MAC filters
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+[ Upstream commit d14c780c11fbc10f66c43e7b64eefe87ca442bd3 ]
+
+This change makes it so that we are much more explicit about the ordering
+of updates to the receive address register (RAR) table. Prior to this patch
+I believe we may have been updating the table while entries were still
+active, or possibly allowing for reordering of things since we weren't
+explicitly flushing writes to either the lower or upper portion of the
+register prior to accessing the other half.
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Reviewed-by: Shannon Nelson <shannon.nelson@oracle.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+@@ -1781,7 +1781,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h
+ if (enable_addr != 0)
+ rar_high |= IXGBE_RAH_AV;
+
++ /* Record lower 32 bits of MAC address and then make
++ * sure that write is flushed to hardware before writing
++ * the upper 16 bits and setting the valid bit.
++ */
+ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
++ IXGBE_WRITE_FLUSH(hw);
+ IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+
+ return 0;
+@@ -1813,8 +1818,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe
+ rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
+ rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
+
+- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
++ /* Clear the address valid bit and upper 16 bits of the address
++ * before clearing the lower bits. This way we aren't updating
++ * a live filter.
++ */
+ IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
++ IXGBE_WRITE_FLUSH(hw);
++ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+
+ /* clear VMDq pool/queue selection for this RAR */
+ hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Wed, 4 Apr 2018 14:06:30 -0400
+Subject: locking/lockdep: Do not record IRQ state within lockdep code
+
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+
+[ Upstream commit fcc784be837714a9173b372ff9fb9b514590dad9 ]
+
+While debugging where things were going wrong with mapping
+enabling/disabling interrupts with the lockdep state and actual real
+enabling and disabling interrupts, I had to silent the IRQ
+disabling/enabling in debug_check_no_locks_freed() because it was
+always showing up as it was called before the splat was.
+
+Use raw_local_irq_save/restore() for not only debug_check_no_locks_freed()
+but for all internal lockdep functions, as they hide useful information
+about where interrupts were used incorrectly last.
+
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Link: https://lkml.kernel.org/lkml/20180404140630.3f4f4c7a@gandalf.local.home
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -1253,11 +1253,11 @@ unsigned long lockdep_count_forward_deps
+ this.parent = NULL;
+ this.class = class;
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ arch_spin_lock(&lockdep_lock);
+ ret = __lockdep_count_forward_deps(&this);
+ arch_spin_unlock(&lockdep_lock);
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+
+ return ret;
+ }
+@@ -1280,11 +1280,11 @@ unsigned long lockdep_count_backward_dep
+ this.parent = NULL;
+ this.class = class;
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ arch_spin_lock(&lockdep_lock);
+ ret = __lockdep_count_backward_deps(&this);
+ arch_spin_unlock(&lockdep_lock);
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+
+ return ret;
+ }
+@@ -4083,7 +4083,7 @@ void debug_check_no_locks_freed(const vo
+ if (unlikely(!debug_locks))
+ return;
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ for (i = 0; i < curr->lockdep_depth; i++) {
+ hlock = curr->held_locks + i;
+
+@@ -4094,7 +4094,7 @@ void debug_check_no_locks_freed(const vo
+ print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
+ break;
+ }
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Greg Ungerer <gerg@linux-m68k.org>
+Date: Mon, 18 Jun 2018 15:34:14 +1000
+Subject: m68k: fix "bad page state" oops on ColdFire boot
+
+From: Greg Ungerer <gerg@linux-m68k.org>
+
+[ Upstream commit ecd60532e060e45c63c57ecf1c8549b1d656d34d ]
+
+Booting a ColdFire m68k core with MMU enabled causes a "bad page state"
+oops since commit 1d40a5ea01d5 ("mm: mark pages in use for page tables"):
+
+ BUG: Bad page state in process sh pfn:01ce2
+ page:004fefc8 count:0 mapcount:-1024 mapping:00000000 index:0x0
+ flags: 0x0()
+ raw: 00000000 00000000 00000000 fffffbff 00000000 00000100 00000200 00000000
+ raw: 039c4000
+ page dumped because: nonzero mapcount
+ Modules linked in:
+ CPU: 0 PID: 22 Comm: sh Not tainted 4.17.0-07461-g1d40a5ea01d5 #13
+
+Fix by calling pgtable_page_dtor() in our __pte_free_tlb() code path,
+so that the PG_table flag is cleared before we free the pte page.
+
+Note that I had to change the type of pte_free() to be static from
+extern. Otherwise you get a lot of warnings like this:
+
+./arch/m68k/include/asm/mcf_pgalloc.h:80:2: warning: ‘pgtable_page_dtor’ is static but used in inline function ‘pte_free’ which is not static
+ pgtable_page_dtor(page);
+ ^
+
+And making it static is consistent with our use of this in the other
+m68k pgalloc definitions of pte_free().
+
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+CC: Matthew Wilcox <willy@infradead.org>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/m68k/include/asm/mcf_pgalloc.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/m68k/include/asm/mcf_pgalloc.h
++++ b/arch/m68k/include/asm/mcf_pgalloc.h
+@@ -43,6 +43,7 @@ extern inline pmd_t *pmd_alloc_kernel(pg
+ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t page,
+ unsigned long address)
+ {
++ pgtable_page_dtor(page);
+ __free_page(page);
+ }
+
+@@ -73,8 +74,9 @@ static inline struct page *pte_alloc_one
+ return page;
+ }
+
+-extern inline void pte_free(struct mm_struct *mm, struct page *page)
++static inline void pte_free(struct mm_struct *mm, struct page *page)
+ {
++ pgtable_page_dtor(page);
+ __free_page(page);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: BingJing Chang <bingjingc@synology.com>
+Date: Thu, 28 Jun 2018 18:40:11 +0800
+Subject: md/raid10: fix that replacement cannot complete recovery after reassemble
+
+From: BingJing Chang <bingjingc@synology.com>
+
+[ Upstream commit bda3153998f3eb2cafa4a6311971143628eacdbc ]
+
+During assemble, the spare marked for replacement is not checked.
+conf->fullsync cannot be updated to be 1. As a result, recovery will
+treat it as a clean array. All recovering sectors are skipped. Original
+device is replaced with the not-recovered spare.
+
+mdadm -C /dev/md0 -l10 -n4 -pn2 /dev/loop[0123]
+mdadm /dev/md0 -a /dev/loop4
+mdadm /dev/md0 --replace /dev/loop0
+mdadm -S /dev/md0 # stop array during recovery
+
+mdadm -A /dev/md0 /dev/loop[01234]
+
+After reassemble, you can see recovery go on, but it completes
+immediately. In fact, recovery is not actually processed.
+
+To solve this problem, we just add the missing logics for replacment
+spares. (In raid1.c or raid5.c, they have already been checked.)
+
+Reported-by: Alex Chen <alexchen@synology.com>
+Reviewed-by: Alex Wu <alexwu@synology.com>
+Reviewed-by: Chung-Chiang Cheng <cccheng@synology.com>
+Signed-off-by: BingJing Chang <bingjingc@synology.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid10.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3770,6 +3770,13 @@ static int run(struct mddev *mddev)
+ disk->rdev->saved_raid_disk < 0)
+ conf->fullsync = 1;
+ }
++
++ if (disk->replacement &&
++ !test_bit(In_sync, &disk->replacement->flags) &&
++ disk->replacement->saved_raid_disk < 0) {
++ conf->fullsync = 1;
++ }
++
+ disk->recovery_disabled = mddev->recovery_disabled - 1;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Wed, 20 Jun 2018 10:03:56 +0200
+Subject: net: davinci_emac: match the mdio device against its compatible if possible
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit ea0820bb771175c7d4192fc6f5b5c56b3c6d5239 ]
+
+Device tree based systems without of_dev_auxdata will have the mdio
+device named differently than "davinci_mdio(.0)". In this case use the
+device's parent's compatible string for matching
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1514,6 +1514,10 @@ static int emac_devioctl(struct net_devi
+
+ static int match_first_device(struct device *dev, void *data)
+ {
++ if (dev->parent && dev->parent->of_node)
++ return of_device_is_compatible(dev->parent->of_node,
++ "ti,davinci_mdio");
++
+ return !strncmp(dev_name(dev), "davinci_mdio", 12);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Stefan Agner <stefan@agner.ch>
+Date: Sun, 17 Jun 2018 23:40:53 +0200
+Subject: net: hamradio: use eth_broadcast_addr
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 4e8439aa34802deab11cee68b0ecb18f887fb153 ]
+
+The array bpq_eth_addr is only used to get the size of an
+address, whereas the bcast_addr is used to set the broadcast
+address. This leads to a warning when using clang:
+drivers/net/hamradio/bpqether.c:94:13: warning: variable 'bpq_eth_addr' is not
+ needed and will not be emitted [-Wunneeded-internal-declaration]
+static char bpq_eth_addr[6];
+ ^
+
+Remove both variables and use the common eth_broadcast_addr
+to set the broadcast address.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hamradio/bpqether.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/hamradio/bpqether.c
++++ b/drivers/net/hamradio/bpqether.c
+@@ -90,10 +90,6 @@
+ static const char banner[] __initconst = KERN_INFO \
+ "AX.25: bpqether driver version 004\n";
+
+-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
+-
+-static char bpq_eth_addr[6];
+-
+ static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
+ static int bpq_device_event(struct notifier_block *, unsigned long, void *);
+
+@@ -512,8 +508,8 @@ static int bpq_new_device(struct net_dev
+ bpq->ethdev = edev;
+ bpq->axdev = ndev;
+
+- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
+- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
++ eth_broadcast_addr(bpq->dest_addr);
++ eth_broadcast_addr(bpq->acpt_addr);
+
+ err = register_netdevice(ndev);
+ if (err)
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Li RongQing <lirongqing@baidu.com>
+Date: Tue, 19 Jun 2018 17:23:17 +0800
+Subject: net: propagate dev_get_valid_name return code
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 7892bd081045222b9e4027fec279a28d6fe7aa66 ]
+
+if dev_get_valid_name failed, propagate its return code
+
+and remove the setting err to ENODEV, it will be set to
+0 again before dev_change_net_namespace exits.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -6911,7 +6911,8 @@ int dev_change_net_namespace(struct net_
+ /* We get here if we can't use the current device name */
+ if (!pat)
+ goto out;
+- if (dev_get_valid_name(net, dev, pat) < 0)
++ err = dev_get_valid_name(net, dev, pat);
++ if (err < 0)
+ goto out;
+ }
+
+@@ -6923,7 +6924,6 @@ int dev_change_net_namespace(struct net_
+ dev_close(dev);
+
+ /* And unlink it from device chain */
+- err = -ENODEV;
+ unlist_netdevice(dev);
+
+ synchronize_net();
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 18 Jul 2018 08:31:43 +0200
+Subject: net: qca_spi: Avoid packet drop during initial sync
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ]
+
+As long as the synchronization with the QCA7000 isn't finished, we
+cannot accept packets from the upper layers. So let the SPI thread
+enable the TX queue after sync and avoid unwanted packet drop.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -636,7 +636,7 @@ qcaspi_netdev_open(struct net_device *de
+ return ret;
+ }
+
+- netif_start_queue(qca->net_dev);
++ /* SPI thread takes care of TX queue */
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 18 Jul 2018 08:31:44 +0200
+Subject: net: qca_spi: Make sure the QCA7000 reset is triggered
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ]
+
+In case the SPI thread is not running, a simple reset of sync
+state won't fix the transmit timeout. We also need to wake up the kernel
+thread.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: ed7d42e24eff ("net: qca_spi: fix transmit queue timeout handling")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -740,6 +740,9 @@ qcaspi_netdev_tx_timeout(struct net_devi
+ qca->net_dev->stats.tx_errors++;
+ /* Trigger tx queue flush and QCA7000 reset */
+ qca->sync = QCASPI_SYNC_UNKNOWN;
++
++ if (qca->spi_thread)
++ wake_up_process(qca->spi_thread);
+ }
+
+ static int
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: David Lechner <david@lechnology.com>
+Date: Mon, 16 Jul 2018 17:58:10 -0500
+Subject: net: usb: rtl8150: demote allmulti message to dev_dbg()
+
+From: David Lechner <david@lechnology.com>
+
+[ Upstream commit 3a9b0455062ffb9d2f6cd4473a76e3456f318c9f ]
+
+This driver can spam the kernel log with multiple messages of:
+
+ net eth0: eth0: allmulti set
+
+Usually 4 or 8 at a time (probably because of using ConnMan).
+
+This message doesn't seem useful, so let's demote it from dev_info()
+to dev_dbg().
+
+Signed-off-by: David Lechner <david@lechnology.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/rtl8150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct
+ (netdev->flags & IFF_ALLMULTI)) {
+ rx_creg &= 0xfffe;
+ rx_creg |= 0x0002;
+- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
++ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
+ } else {
+ /* ~RX_MULTICAST, ~RX_PROMISCUOUS */
+ rx_creg &= 0x00fc;
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 13 Jun 2018 10:11:56 -0700
+Subject: netfilter: ipv6: nf_defrag: reduce struct net memory waste
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9ce7bc036ae4cfe3393232c86e9e1fea2153c237 ]
+
+It is a waste of memory to use a full "struct netns_sysctl_ipv6"
+while only one pointer is really used, considering netns_sysctl_ipv6
+keeps growing.
+
+Also, since "struct netns_frags" has cache line alignment,
+it is better to move the frags_hdr pointer outside, otherwise
+we spend a full cache line for this pointer.
+
+This saves 192 bytes of memory per netns.
+
+Fixes: c038a767cd69 ("ipv6: add a new namespace for nf_conntrack_reasm")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/net_namespace.h | 1 +
+ include/net/netns/ipv6.h | 1 -
+ net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++---
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/include/net/net_namespace.h
++++ b/include/net/net_namespace.h
+@@ -112,6 +112,7 @@ struct net {
+ #endif
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ struct netns_nf_frag nf_frag;
++ struct ctl_table_header *nf_frag_frags_hdr;
+ #endif
+ struct sock *nfnl;
+ struct sock *nfnl_stash;
+--- a/include/net/netns/ipv6.h
++++ b/include/net/netns/ipv6.h
+@@ -81,7 +81,6 @@ struct netns_ipv6 {
+
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ struct netns_nf_frag {
+- struct netns_sysctl_ipv6 sysctl;
+ struct netns_frags frags;
+ };
+ #endif
+--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
+@@ -118,7 +118,7 @@ static int nf_ct_frag6_sysctl_register(s
+ if (hdr == NULL)
+ goto err_reg;
+
+- net->nf_frag.sysctl.frags_hdr = hdr;
++ net->nf_frag_frags_hdr = hdr;
+ return 0;
+
+ err_reg:
+@@ -132,8 +132,8 @@ static void __net_exit nf_ct_frags6_sysc
+ {
+ struct ctl_table *table;
+
+- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
+- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
++ table = net->nf_frag_frags_hdr->ctl_table_arg;
++ unregister_net_sysctl_table(net->nf_frag_frags_hdr);
+ if (!net_eq(net, &init_net))
+ kfree(table);
+ }
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 4 Jul 2018 20:25:32 +0200
+Subject: netfilter: x_tables: set module owner for icmp(6) matches
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81 ]
+
+nft_compat relies on xt_request_find_match to increment
+refcount of the module that provides the match/target.
+
+The (builtin) icmp matches did't set the module owner so it
+was possible to rmmod ip(6)tables while icmp extensions were still in use.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/netfilter/ip_tables.c | 1 +
+ net/ipv6/netfilter/ip6_tables.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -2069,6 +2069,7 @@ static struct xt_match ipt_builtin_mt[]
+ .checkentry = icmp_checkentry,
+ .proto = IPPROTO_ICMP,
+ .family = NFPROTO_IPV4,
++ .me = THIS_MODULE,
+ },
+ };
+
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -2071,6 +2071,7 @@ static struct xt_match ip6t_builtin_mt[]
+ .checkentry = icmp6_checkentry,
+ .proto = IPPROTO_ICMPV6,
+ .family = NFPROTO_IPV6,
++ .me = THIS_MODULE,
+ },
+ };
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Alexander Sverdlin <alexander.sverdlin@nsn.com>
+Date: Fri, 13 Jul 2018 17:31:50 +0200
+Subject: octeon_mgmt: Fix MIX registers configuration on MTU setup
+
+From: Alexander Sverdlin <alexander.sverdlin@nsn.com>
+
+[ Upstream commit 4aac0b43474d18f6160302a3caa147d77fa3baa1 ]
+
+octeon_mgmt driver doesn't drop RX frames that are 1-4 bytes bigger than
+MTU set for the corresponding interface. The problem is in the
+AGL_GMX_RX0/1_FRM_MAX register setting, which should not account for VLAN
+tagging.
+
+According to Octeon HW manual:
+"For tagged frames, MAX increases by four bytes for each VLAN found up to a
+maximum of two VLANs, or MAX + 8 bytes."
+
+OCTEON_FRAME_HEADER_LEN "define" is fine for ring buffer management, but
+should not be used for AGL_GMX_RX0/1_FRM_MAX.
+
+The problem could be easily reproduced using "ping" command. If affected
+system has default MTU 1500, other host (having MTU >= 1504) can
+successfully "ping" the affected system with payload size 1473-1476,
+resulting in IP packets of size 1501-1504 accepted by the mgmt driver.
+Fixed system still accepts IP packets of 1500 bytes even with VLAN tagging,
+because the limits are lifted in HW as expected, for every VLAN tag.
+
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/octeon/octeon_mgmt.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/octeon/octeon_mgmt.c
++++ b/drivers/net/ethernet/octeon/octeon_mgmt.c
+@@ -644,7 +644,7 @@ static int octeon_mgmt_set_mac_address(s
+ static int octeon_mgmt_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ struct octeon_mgmt *p = netdev_priv(netdev);
+- int size_without_fcs = new_mtu + OCTEON_MGMT_RX_HEADROOM;
++ int max_packet = new_mtu + ETH_HLEN + ETH_FCS_LEN;
+
+ /* Limit the MTU to make sure the ethernet packets are between
+ * 64 bytes and 16383 bytes.
+@@ -658,9 +658,17 @@ static int octeon_mgmt_change_mtu(struct
+
+ netdev->mtu = new_mtu;
+
+- cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, size_without_fcs);
++ /* HW lifts the limit if the frame is VLAN tagged
++ * (+4 bytes per each tag, up to two tags)
++ */
++ cvmx_write_csr(p->agl + AGL_GMX_RX_FRM_MAX, max_packet);
++ /* Set the hardware to truncate packets larger than the MTU. The jabber
++ * register must be set to a multiple of 8 bytes, so round up. JABBER is
++ * an unconditional limit, so we need to account for two possible VLAN
++ * tags.
++ */
+ cvmx_write_csr(p->agl + AGL_GMX_RX_JABBER,
+- (size_without_fcs + 7) & 0xfff8);
++ (max_packet + 7 + VLAN_HLEN * 2) & 0xfff8);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Mon, 11 Jun 2018 16:10:49 +0530
+Subject: perf report powerpc: Fix crash if callchain is empty
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 143c99f6ac6812d23254e80844d6e34be897d3e1 ]
+
+For some cases, the callchain provided by the kernel may be empty. So,
+the callchain ip filtering code will cause a crash if we do not check
+whether the struct ip_callchain pointer is NULL before accessing any
+members.
+
+This can be observed on a powerpc64le system running Fedora 27 as shown
+below.
+
+ # perf record -b -e cycles:u ls
+
+Before:
+
+ # perf report --branch-history
+
+ perf: Segmentation fault
+ -------- backtrace --------
+ perf[0x1027615c]
+ linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
+ perf(arch_skip_callchain_idx+0x44)[0x10257c58]
+ perf[0x1017f2e4]
+ perf(thread__resolve_callchain+0x124)[0x1017ff5c]
+ perf(sample__resolve_callchain+0xf0)[0x10172788]
+ ...
+
+After:
+
+ # perf report --branch-history
+
+ Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
+ Overhead Source:Line Symbol Shared Object
+ + 11.60% _init+35736 [.] _init ls
+ + 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
+ + 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
+ + 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
+ + 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
+ + 8.83% _init+236 [.] _init ls
+ ...
+
+Reported-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Acked-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20180611104049.11048-1-sandipan@linux.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+@@ -230,7 +230,7 @@ int arch_skip_callchain_idx(struct machi
+ u64 ip;
+ u64 skip_slot = -1;
+
+- if (chain->nr < 3)
++ if (!chain || chain->nr < 3)
+ return skip_slot;
+
+ ip = chain->ips[2];
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 12 Jul 2018 15:23:45 +0300
+Subject: qlogic: check kstrtoul() for errors
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5fc853cc01c68f84984ecc2d5fd777ecad78240f ]
+
+We accidentally left out the error handling for kstrtoul().
+
+Fixes: a520030e326a ("qlcnic: Implement flash sysfs callback for 83xx adapter")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+@@ -1136,6 +1136,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w
+ return QL_STATUS_INVALID_PARAM;
+
+ ret = kstrtoul(buf, 16, &data);
++ if (ret)
++ return ret;
+
+ switch (data) {
+ case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Fathi Boudra <fathi.boudra@linaro.org>
+Date: Thu, 14 Jun 2018 11:57:08 +0200
+Subject: selftests: sync: add config fragment for testing sync framework
+
+From: Fathi Boudra <fathi.boudra@linaro.org>
+
+[ Upstream commit d6a3e55131fcb1e5ca1753f4b6f297a177b2fc91 ]
+
+Unless the software synchronization objects (CONFIG_SW_SYNC) is enabled,
+the sync test will be skipped:
+
+TAP version 13
+1..0 # Skipped: Sync framework not supported by kernel
+
+Add a config fragment file to be able to run "make kselftest-merge" to
+enable relevant configuration required in order to run the sync test.
+
+Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org>
+Link: https://lkml.org/lkml/2017/5/5/14
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/sync/config | 4 ++++
+ 1 file changed, 4 insertions(+)
+ create mode 100644 tools/testing/selftests/sync/config
+
+--- /dev/null
++++ b/tools/testing/selftests/sync/config
+@@ -0,0 +1,4 @@
++CONFIG_STAGING=y
++CONFIG_ANDROID=y
++CONFIG_SYNC=y
++CONFIG_SW_SYNC=y
serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch
bluetooth-avoid-killing-an-already-killed-socket.patch
isdn-disable-iiocdbgvar.patch
+netfilter-ipv6-nf_defrag-reduce-struct-net-memory-waste.patch
+selftests-sync-add-config-fragment-for-testing-sync-framework.patch
+usb-dwc2-fix-isoc-split-in-transfer-with-no-data.patch
+usb-gadget-composite-fix-delayed_status-race-condition-when-set_interface.patch
+arm64-make-secondary_start_kernel-notrace.patch
+enic-initialize-enic-rfs_h.lock-in-enic_probe.patch
+net-hamradio-use-eth_broadcast_addr.patch
+net-propagate-dev_get_valid_name-return-code.patch
+net-davinci_emac-match-the-mdio-device-against-its-compatible-if-possible.patch
+locking-lockdep-do-not-record-irq-state-within-lockdep-code.patch
+ipv6-mcast-fix-unsolicited-report-interval-after-receiving-querys.patch
+smack-mark-inode-instant-in-smack_task_to_inode.patch
+cxgb4-when-disabling-dcb-set-txq-dcb-priority-to-0.patch
+brcmfmac-stop-watchdog-before-detach-and-free-everything.patch
+arm-dts-am437x-make-edt-ft5x06-a-wakeup-source.patch
+perf-report-powerpc-fix-crash-if-callchain-is-empty.patch
+arm-dts-da850-fix-interrups-property-for-gpio.patch
+dmaengine-k3dma-off-by-one-in-k3_of_dma_simple_xlate.patch
+md-raid10-fix-that-replacement-cannot-complete-recovery-after-reassemble.patch
+drm-exynos-gsc-fix-support-for-nv16-61-yuv420-yvu420-and-yuv422-modes.patch
+bnx2x-fix-receiving-tx-timeout-in-error-or-recovery-state.patch
+m68k-fix-bad-page-state-oops-on-coldfire-boot.patch
+arm-imx_v4_v5_defconfig-select-ulpi-support.patch
+tracing-use-__printf-markup-to-silence-compiler.patch
+smsc75xx-add-workaround-for-gigabit-link-up-hardware-errata.patch
+netfilter-x_tables-set-module-owner-for-icmp-6-matches.patch
+arm-pxa-irq-fix-handling-of-icmr-registers-in-suspend-resume.patch
+drm-armada-fix-colorkey-mode-property.patch
+arm-dts-am3517.dtsi-disable-reference-to-omap3-otg-controller.patch
+ixgbe-be-more-careful-when-modifying-mac-filters.patch
+qlogic-check-kstrtoul-for-errors.patch
+octeon_mgmt-fix-mix-registers-configuration-on-mtu-setup.patch
+net-usb-rtl8150-demote-allmulti-message-to-dev_dbg.patch
+net-qca_spi-avoid-packet-drop-during-initial-sync.patch
+net-qca_spi-make-sure-the-qca7000-reset-is-triggered.patch
+tcp-identify-cryptic-messages-as-tcp-seq-bugs.patch
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Fri, 22 Jun 2018 10:54:45 -0700
+Subject: Smack: Mark inode instant in smack_task_to_inode
+
+From: Casey Schaufler <casey@schaufler-ca.com>
+
+[ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ]
+
+Smack: Mark inode instant in smack_task_to_inode
+
+/proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188
+resulted in smack_task_to_inode() being called before smack_d_instantiate.
+This resulted in the smk_inode value being ignored, even while present
+for files in /proc/self. Marking the inode as instant here fixes that.
+
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/smack/smack_lsm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2037,6 +2037,7 @@ static void smack_task_to_inode(struct t
+ struct smack_known *skp = smk_of_task_struct(p);
+
+ isp->smk_inode = skp;
++ isp->smk_flags |= SMK_INODE_INSTANT;
+ }
+
+ /*
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Yuiko Oshino <yuiko.oshino@microchip.com>
+Date: Tue, 3 Jul 2018 11:21:46 -0400
+Subject: smsc75xx: Add workaround for gigabit link up hardware errata.
+
+From: Yuiko Oshino <yuiko.oshino@microchip.com>
+
+[ Upstream commit d461e3da905332189aad546b2ad9adbe6071c7cc ]
+
+In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state.
+
+Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices")
+Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/smsc75xx.c | 62 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -81,6 +81,9 @@ static bool turbo_mode = true;
+ module_param(turbo_mode, bool, 0644);
+ MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+
++static int smsc75xx_link_ok_nopm(struct usbnet *dev);
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
++
+ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
+ u32 *data, int in_pm)
+ {
+@@ -840,6 +843,9 @@ static int smsc75xx_phy_initialize(struc
+ return -EIO;
+ }
+
++ /* phy workaround for gig link */
++ smsc75xx_phy_gig_workaround(dev);
++
+ smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
+ ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
+ ADVERTISE_PAUSE_ASYM);
+@@ -978,6 +984,62 @@ static int smsc75xx_wait_ready(struct us
+ return -EIO;
+ }
+
++static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
++{
++ struct mii_if_info *mii = &dev->mii;
++ int ret = 0, timeout = 0;
++ u32 buf, link_up = 0;
++
++ /* Set the phy in Gig loopback */
++ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
++
++ /* Wait for the link up */
++ do {
++ link_up = smsc75xx_link_ok_nopm(dev);
++ usleep_range(10000, 20000);
++ timeout++;
++ } while ((!link_up) && (timeout < 1000));
++
++ if (timeout >= 1000) {
++ netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
++ return -EIO;
++ }
++
++ /* phy reset */
++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++ if (ret < 0) {
++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
++ return ret;
++ }
++
++ buf |= PMT_CTL_PHY_RST;
++
++ ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
++ if (ret < 0) {
++ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
++ return ret;
++ }
++
++ timeout = 0;
++ do {
++ usleep_range(10000, 20000);
++ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
++ if (ret < 0) {
++ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
++ ret);
++ return ret;
++ }
++ timeout++;
++ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
++
++ if (timeout >= 100) {
++ netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
++ return -EIO;
++ }
++
++ return 0;
++}
++
+ static int smsc75xx_reset(struct usbnet *dev)
+ {
+ struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Tue, 17 Jul 2018 18:27:45 -0700
+Subject: tcp: identify cryptic messages as TCP seq # bugs
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit e56b8ce363a36fb7b74b80aaa5cc9084f2c908b4 ]
+
+Attempt to make cryptic TCP seq number error messages clearer by
+(1) identifying the source of the message as "TCP", (2) identifying the
+errors as "seq # bug", and (3) grouping the field identifiers and values
+by separating them with commas.
+
+E.g., the following message is changed from:
+
+recvmsg bug 2: copied 73BCB6CD seq 70F17CBE rcvnxt 73BCB9AA fl 0
+WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:1881 tcp_recvmsg+0x649/0xb90
+
+to:
+
+TCP recvmsg seq # bug 2: copied 73BCB6CD, seq 70F17CBE, rcvnxt 73BCB9AA, fl 0
+WARNING: CPU: 2 PID: 1501 at /linux/net/ipv4/tcp.c:2011 tcp_recvmsg+0x694/0xba0
+
+Suggested-by: 積丹尼 Dan Jacobson <jidanni@jidanni.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -1668,7 +1668,7 @@ int tcp_recvmsg(struct kiocb *iocb, stru
+ * shouldn't happen.
+ */
+ if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
+- "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
++ "TCP recvmsg seq # bug: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+ flags))
+ break;
+@@ -1681,7 +1681,7 @@ int tcp_recvmsg(struct kiocb *iocb, stru
+ if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+ goto found_fin_ok;
+ WARN(!(flags & MSG_PEEK),
+- "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
++ "TCP recvmsg seq # bug 2: copied %X, seq %X, rcvnxt %X, fl %X\n",
+ *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Mathieu Malaterre <malat@debian.org>
+Date: Thu, 8 Mar 2018 21:58:43 +0100
+Subject: tracing: Use __printf markup to silence compiler
+
+From: Mathieu Malaterre <malat@debian.org>
+
+[ Upstream commit 26b68dd2f48fe7699a89f0cfbb9f4a650dc1c837 ]
+
+Silence warnings (triggered at W=1) by adding relevant __printf attributes.
+
+ CC kernel/trace/trace.o
+kernel/trace/trace.c: In function ‘__trace_array_vprintk’:
+kernel/trace/trace.c:2979:2: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format]
+ len = vscnprintf(tbuffer, TRACE_BUF_SIZE, fmt, args);
+ ^~~
+ AR kernel/trace/built-in.o
+
+Link: http://lkml.kernel.org/r/20180308205843.27447-1-malat@debian.org
+
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2137,6 +2137,7 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(trace_vbprintk);
+
++__printf(3, 0)
+ static int
+ __trace_array_vprintk(struct ring_buffer *buffer,
+ unsigned long ip, const char *fmt, va_list args)
+@@ -2190,12 +2191,14 @@ __trace_array_vprintk(struct ring_buffer
+ return len;
+ }
+
++__printf(3, 0)
+ int trace_array_vprintk(struct trace_array *tr,
+ unsigned long ip, const char *fmt, va_list args)
+ {
+ return __trace_array_vprintk(tr->trace_buffer.buffer, ip, fmt, args);
+ }
+
++__printf(3, 0)
+ int trace_array_printk(struct trace_array *tr,
+ unsigned long ip, const char *fmt, ...)
+ {
+@@ -2211,6 +2214,7 @@ int trace_array_printk(struct trace_arra
+ return ret;
+ }
+
++__printf(3, 4)
+ int trace_array_printk_buf(struct ring_buffer *buffer,
+ unsigned long ip, const char *fmt, ...)
+ {
+@@ -2226,6 +2230,7 @@ int trace_array_printk_buf(struct ring_b
+ return ret;
+ }
+
++__printf(2, 0)
+ int trace_vprintk(unsigned long ip, const char *fmt, va_list args)
+ {
+ return trace_array_vprintk(&global_trace, ip, fmt, args);
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: William Wu <william.wu@rock-chips.com>
+Date: Fri, 11 May 2018 17:46:32 +0800
+Subject: usb: dwc2: fix isoc split in transfer with no data
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit 70c3c8cb83856758025c2a211dd022bc0478922a ]
+
+If isoc split in transfer with no data (the length of DATA0
+packet is zero), we can't simply return immediately. Because
+the DATA0 can be the first transaction or the second transaction
+for the isoc split in transaction. If the DATA0 packet with no
+data is in the first transaction, we can return immediately.
+But if the DATA0 packet with no data is in the second transaction
+of isoc split in transaction sequence, we need to increase the
+qtd->isoc_frame_index and giveback urb to device driver if needed,
+otherwise, the MDATA packet will be lost.
+
+A typical test case is that connect the dwc2 controller with an
+usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics
+headset) into the downstream port of Hub. Then use the usb mic
+to record, we can find noise when playback.
+
+In the case, the isoc split in transaction sequence like this:
+
+- SSPLIT IN transaction
+- CSPLIT IN transaction
+ - MDATA packet (176 bytes)
+- CSPLIT IN transaction
+ - DATA0 packet (0 byte)
+
+This patch use both the length of DATA0 and qtd->isoc_split_offset
+to check if the DATA0 is in the second transaction.
+
+Tested-by: Gevorg Sahakyan <sahakyan@synopsys.com>
+Tested-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Minas Harutyunyan hminas@synopsys.com>
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd_intr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -913,9 +913,8 @@ static int dwc2_xfercomp_isoc_split_in(s
+ frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
+ len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
+ DWC2_HC_XFER_COMPLETE, NULL);
+- if (!len) {
++ if (!len && !qtd->isoc_split_offset) {
+ qtd->complete_split = 0;
+- qtd->isoc_split_offset = 0;
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Aug 22 10:36:41 CEST 2018
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Fri, 25 May 2018 17:24:57 +0800
+Subject: usb: gadget: composite: fix delayed_status race condition when set_interface
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit 980900d6318066b9f8314bfb87329a20fd0d1ca4 ]
+
+It happens when enable debug log, if set_alt() returns
+USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue()
+is called before increasing count of @delayed_status,
+so fix it by using spinlock of @cdev->lock.
+
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Tested-by: Jay Hsu <shih-chieh.hsu@mediatek.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/composite.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1530,6 +1530,8 @@ composite_setup(struct usb_gadget *gadge
+ break;
+ if (w_value && !f->set_alt)
+ break;
++
++ spin_lock(&cdev->lock);
+ value = f->set_alt(f, w_index, w_value);
+ if (value == USB_GADGET_DELAYED_STATUS) {
+ DBG(cdev,
+@@ -1539,6 +1541,7 @@ composite_setup(struct usb_gadget *gadge
+ DBG(cdev, "delayed_status count %d\n",
+ cdev->delayed_status);
+ }
++ spin_unlock(&cdev->lock);
+ break;
+ case USB_REQ_GET_INTERFACE:
+ if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
projects / thirdparty / kernel / stable-queue.git / commitdiff
