--- /dev/null
+From f722f03e6fdb4b398ac743a1709789ef046a10ce Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 19 Jul 2018 12:17:38 +0100
+Subject: ARM: add PROC_VTABLE and PROC_TABLE macros
+
+[ Upstream commit e209950fdd065d2cc46e6338e47e52841b830cba ]
+
+Allow the way we access members of the processor vtable to be changed
+at compile time. We will need to move to per-CPU vtables to fix the
+Spectre variant 2 issues on big.Little systems.
+
+However, we have a couple of calls that do not need the vtable
+treatment, and indeed cause a kernel warning due to the (later) use
+of smp_processor_id(), so also introduce the PROC_TABLE macro for
+these which always use CPU 0's function pointers.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/proc-fns.h | 39 ++++++++++++++++++++++-----------
+ arch/arm/kernel/setup.c | 4 +---
+ 2 files changed, 27 insertions(+), 16 deletions(-)
+
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index 30c499146320..c259cc49c641 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -23,7 +23,7 @@ struct mm_struct;
+ /*
+ * Don't change this structure - ASM code relies on it.
+ */
+-extern struct processor {
++struct processor {
+ /* MISC
+ * get data abort address/flags
+ */
+@@ -79,9 +79,13 @@ extern struct processor {
+ unsigned int suspend_size;
+ void (*do_suspend)(void *);
+ void (*do_resume)(void *);
+-} processor;
++};
+
+ #ifndef MULTI_CPU
++static inline void init_proc_vtable(const struct processor *p)
++{
++}
++
+ extern void cpu_proc_init(void);
+ extern void cpu_proc_fin(void);
+ extern int cpu_do_idle(void);
+@@ -98,18 +102,27 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn));
+ extern void cpu_do_suspend(void *);
+ extern void cpu_do_resume(void *);
+ #else
+-#define cpu_proc_init processor._proc_init
+-#define cpu_check_bugs processor.check_bugs
+-#define cpu_proc_fin processor._proc_fin
+-#define cpu_reset processor.reset
+-#define cpu_do_idle processor._do_idle
+-#define cpu_dcache_clean_area processor.dcache_clean_area
+-#define cpu_set_pte_ext processor.set_pte_ext
+-#define cpu_do_switch_mm processor.switch_mm
+
+-/* These three are private to arch/arm/kernel/suspend.c */
+-#define cpu_do_suspend processor.do_suspend
+-#define cpu_do_resume processor.do_resume
++extern struct processor processor;
++#define PROC_VTABLE(f) processor.f
++#define PROC_TABLE(f) processor.f
++static inline void init_proc_vtable(const struct processor *p)
++{
++ processor = *p;
++}
++
++#define cpu_proc_init PROC_VTABLE(_proc_init)
++#define cpu_check_bugs PROC_VTABLE(check_bugs)
++#define cpu_proc_fin PROC_VTABLE(_proc_fin)
++#define cpu_reset PROC_VTABLE(reset)
++#define cpu_do_idle PROC_VTABLE(_do_idle)
++#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area)
++#define cpu_set_pte_ext PROC_TABLE(set_pte_ext)
++#define cpu_do_switch_mm PROC_VTABLE(switch_mm)
++
++/* These two are private to arch/arm/kernel/suspend.c */
++#define cpu_do_suspend PROC_VTABLE(do_suspend)
++#define cpu_do_resume PROC_VTABLE(do_resume)
+ #endif
+
+ extern void cpu_resume(void);
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index 4c249cb261f3..6b9d191da868 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -686,9 +686,7 @@ static void __init setup_processor(void)
+ cpu_name = list->cpu_name;
+ __cpu_architecture = __get_cpu_architecture();
+
+-#ifdef MULTI_CPU
+- processor = *list->proc;
+-#endif
++ init_proc_vtable(list->proc);
+ #ifdef MULTI_TLB
+ cpu_tlb = *list->tlb;
+ #endif
+--
+2.17.1
+
--- /dev/null
+From 126a8c99f7943e0e70c191c97b233a112e6f77a9 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 19 Jul 2018 12:43:03 +0100
+Subject: ARM: clean up per-processor check_bugs method call
+
+[ Upstream commit 945aceb1db8885d3a35790cf2e810f681db52756 ]
+
+Call the per-processor type check_bugs() method in the same way as we
+do other per-processor functions - move the "processor." detail into
+proc-fns.h.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/proc-fns.h | 1 +
+ arch/arm/kernel/bugs.c | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index e25f4392e1b2..30c499146320 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -99,6 +99,7 @@ extern void cpu_do_suspend(void *);
+ extern void cpu_do_resume(void *);
+ #else
+ #define cpu_proc_init processor._proc_init
++#define cpu_check_bugs processor.check_bugs
+ #define cpu_proc_fin processor._proc_fin
+ #define cpu_reset processor.reset
+ #define cpu_do_idle processor._do_idle
+diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c
+index 7be511310191..d41d3598e5e5 100644
+--- a/arch/arm/kernel/bugs.c
++++ b/arch/arm/kernel/bugs.c
+@@ -6,8 +6,8 @@
+ void check_other_bugs(void)
+ {
+ #ifdef MULTI_CPU
+- if (processor.check_bugs)
+- processor.check_bugs();
++ if (cpu_check_bugs)
++ cpu_check_bugs();
+ #endif
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 709a9d4f708170faf204bf59c0a1af26762cef78 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 19 Jul 2018 11:42:36 +0100
+Subject: ARM: make lookup_processor_type() non-__init
+
+[ Upstream commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc ]
+
+Move lookup_processor_type() out of the __init section so it is callable
+from (eg) the secondary startup code during hotplug.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/head-common.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
+index 6e0375e7db05..997b02302c31 100644
+--- a/arch/arm/kernel/head-common.S
++++ b/arch/arm/kernel/head-common.S
+@@ -145,6 +145,9 @@ __mmap_switched_data:
+ #endif
+ .size __mmap_switched_data, . - __mmap_switched_data
+
++ __FINIT
++ .text
++
+ /*
+ * This provides a C-API version of __lookup_processor_type
+ */
+@@ -156,9 +159,6 @@ ENTRY(lookup_processor_type)
+ ldmfd sp!, {r4 - r6, r9, pc}
+ ENDPROC(lookup_processor_type)
+
+- __FINIT
+- .text
+-
+ /*
+ * Read processor ID register (CP#15, CR0), and look up in the linker-built
+ * supported processor list. Note that we can't use the absolute addresses
+--
+2.17.1
+
--- /dev/null
+From bf59fa8ce6a739b0d5c6e75bd7925785de232a9f Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 19 Jul 2018 12:21:31 +0100
+Subject: ARM: spectre-v2: per-CPU vtables to work around big.Little systems
+
+[ Upstream commit 383fb3ee8024d596f488d2dbaf45e572897acbdb ]
+
+In big.Little systems, some CPUs require the Spectre workarounds in
+paths such as the context switch, but other CPUs do not. In order
+to handle these differences, we need per-CPU vtables.
+
+We are unable to use the kernel's per-CPU variables to support this
+as per-CPU is not initialised at times when we need access to the
+vtables, so we have to use an array indexed by logical CPU number.
+
+We use an array-of-pointers to avoid having function pointers in
+the kernel's read/write .data section.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/proc-fns.h | 23 +++++++++++++++++++++++
+ arch/arm/kernel/setup.c | 5 +++++
+ arch/arm/kernel/smp.c | 31 +++++++++++++++++++++++++++++++
+ arch/arm/mm/proc-v7-bugs.c | 17 ++---------------
+ 4 files changed, 61 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index c259cc49c641..e1b6f280ab08 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -104,12 +104,35 @@ extern void cpu_do_resume(void *);
+ #else
+
+ extern struct processor processor;
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++#include <linux/smp.h>
++/*
++ * This can't be a per-cpu variable because we need to access it before
++ * per-cpu has been initialised. We have a couple of functions that are
++ * called in a pre-emptible context, and so can't use smp_processor_id()
++ * there, hence PROC_TABLE(). We insist in init_proc_vtable() that the
++ * function pointers for these are identical across all CPUs.
++ */
++extern struct processor *cpu_vtable[];
++#define PROC_VTABLE(f) cpu_vtable[smp_processor_id()]->f
++#define PROC_TABLE(f) cpu_vtable[0]->f
++static inline void init_proc_vtable(const struct processor *p)
++{
++ unsigned int cpu = smp_processor_id();
++ *cpu_vtable[cpu] = *p;
++ WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area !=
++ cpu_vtable[0]->dcache_clean_area);
++ WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext !=
++ cpu_vtable[0]->set_pte_ext);
++}
++#else
+ #define PROC_VTABLE(f) processor.f
+ #define PROC_TABLE(f) processor.f
+ static inline void init_proc_vtable(const struct processor *p)
+ {
+ processor = *p;
+ }
++#endif
+
+ #define cpu_proc_init PROC_VTABLE(_proc_init)
+ #define cpu_check_bugs PROC_VTABLE(check_bugs)
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index 6b9d191da868..830d7b4ecb84 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2);
+
+ #ifdef MULTI_CPU
+ struct processor processor __ro_after_init;
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++struct processor *cpu_vtable[NR_CPUS] = {
++ [0] = &processor,
++};
++#endif
+ #endif
+ #ifdef MULTI_TLB
+ struct cpu_tlb_fns cpu_tlb __ro_after_init;
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 0978282d5fc2..12a6172263c0 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -42,6 +42,7 @@
+ #include <asm/mmu_context.h>
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
++#include <asm/procinfo.h>
+ #include <asm/processor.h>
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)
+ #endif
+ }
+
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++static int secondary_biglittle_prepare(unsigned int cpu)
++{
++ if (!cpu_vtable[cpu])
++ cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL);
++
++ return cpu_vtable[cpu] ? 0 : -ENOMEM;
++}
++
++static void secondary_biglittle_init(void)
++{
++ init_proc_vtable(lookup_processor(read_cpuid_id())->proc);
++}
++#else
++static int secondary_biglittle_prepare(unsigned int cpu)
++{
++ return 0;
++}
++
++static void secondary_biglittle_init(void)
++{
++}
++#endif
++
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+ int ret;
+@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ if (!smp_ops.smp_boot_secondary)
+ return -ENOSYS;
+
++ ret = secondary_biglittle_prepare(cpu);
++ if (ret)
++ return ret;
++
+ /*
+ * We need to tell the secondary core where to find
+ * its stack and the page tables.
+@@ -359,6 +388,8 @@ asmlinkage void secondary_start_kernel(void)
+ struct mm_struct *mm = &init_mm;
+ unsigned int cpu;
+
++ secondary_biglittle_init();
++
+ /*
+ * The identity mapping is uncached (strongly ordered), so
+ * switch away from it before attempting any exclusive accesses.
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 5544b82a2e7a..9a07916af8dd 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)
+ case ARM_CPU_PART_CORTEX_A17:
+ case ARM_CPU_PART_CORTEX_A73:
+ case ARM_CPU_PART_CORTEX_A75:
+- if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ harden_branch_predictor_bpiall;
+ spectre_v2_method = "BPIALL";
+@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)
+
+ case ARM_CPU_PART_CORTEX_A15:
+ case ARM_CPU_PART_BRAHMA_B15:
+- if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ harden_branch_predictor_iciallu;
+ spectre_v2_method = "ICIALLU";
+@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ call_hvc_arch_workaround_1;
+- processor.switch_mm = cpu_v7_hvc_switch_mm;
++ cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
+ spectre_v2_method = "hypervisor";
+ break;
+
+@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ call_smc_arch_workaround_1;
+- processor.switch_mm = cpu_v7_smc_switch_mm;
++ cpu_do_switch_mm = cpu_v7_smc_switch_mm;
+ spectre_v2_method = "firmware";
+ break;
+
+@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)
+ if (spectre_v2_method)
+ pr_info("CPU%u: Spectre v2: using %s workaround\n",
+ smp_processor_id(), spectre_v2_method);
+- return;
+-
+-bl_error:
+- pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
+- cpu);
+ }
+ #else
+ static void cpu_v7_spectre_init(void)
+--
+2.17.1
+
--- /dev/null
+From 8bf5f2faf0b5f3cfbcc74b7032b82498977319d7 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.com>
+Date: Mon, 12 Nov 2018 10:35:25 -0700
+Subject: block: copy ioprio in __bio_clone_fast() and bounce
+
+[ Upstream commit ca474b73896bf6e0c1eb8787eb217b0f80221610 ]
+
+We need to copy the io priority, too; otherwise the clone will run
+with a different priority than the original one.
+
+Fixes: 43b62ce3ff0a ("block: move bio io prio to a new field")
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+
+Fixed up subject, and ordered stores.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 1 +
+ block/bounce.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/block/bio.c b/block/bio.c
+index 41173710430c..c4ef8aa46452 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
+ if (bio_flagged(bio_src, BIO_THROTTLED))
+ bio_set_flag(bio, BIO_THROTTLED);
+ bio->bi_opf = bio_src->bi_opf;
++ bio->bi_ioprio = bio_src->bi_ioprio;
+ bio->bi_write_hint = bio_src->bi_write_hint;
+ bio->bi_iter = bio_src->bi_iter;
+ bio->bi_io_vec = bio_src->bi_io_vec;
+diff --git a/block/bounce.c b/block/bounce.c
+index 418677dcec60..abb50e7e5fab 100644
+--- a/block/bounce.c
++++ b/block/bounce.c
+@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask,
+ return NULL;
+ bio->bi_disk = bio_src->bi_disk;
+ bio->bi_opf = bio_src->bi_opf;
++ bio->bi_ioprio = bio_src->bi_ioprio;
+ bio->bi_write_hint = bio_src->bi_write_hint;
+ bio->bi_iter.bi_sector = bio_src->bi_iter.bi_sector;
+ bio->bi_iter.bi_size = bio_src->bi_iter.bi_size;
+--
+2.17.1
+
--- /dev/null
+From a82084937d7f776e75dea34dff8e0f05563a364c Mon Sep 17 00:00:00 2001
+From: Anson Huang <anson.huang@nxp.com>
+Date: Mon, 5 Nov 2018 00:59:28 +0000
+Subject: cpufreq: imx6q: add return value check for voltage scale
+
+[ Upstream commit 6ef28a04d1ccf718eee069b72132ce4aa1e52ab9 ]
+
+Add return value check for voltage scale when ARM clock
+rate change fail.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/imx6q-cpufreq.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
+index b2ff423ad7f8..f4880a4f865b 100644
+--- a/drivers/cpufreq/imx6q-cpufreq.c
++++ b/drivers/cpufreq/imx6q-cpufreq.c
+@@ -159,8 +159,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
+ /* Ensure the arm clock divider is what we expect */
+ ret = clk_set_rate(clks[ARM].clk, new_freq * 1000);
+ if (ret) {
++ int ret1;
++
+ dev_err(cpu_dev, "failed to set clock rate: %d\n", ret);
+- regulator_set_voltage_tol(arm_reg, volt_old, 0);
++ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0);
++ if (ret1)
++ dev_warn(cpu_dev,
++ "failed to restore vddarm voltage: %d\n", ret1);
+ return ret;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 8f2af66b3e2cab4458001003a4ea74898c7ed08e Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Thu, 8 Nov 2018 23:55:16 +0100
+Subject: crypto: simd - correctly take reqsize of wrapped skcipher into
+ account
+
+[ Upstream commit 508a1c4df085a547187eed346f1bfe5e381797f1 ]
+
+The simd wrapper's skcipher request context structure consists
+of a single subrequest whose size is taken from the subordinate
+skcipher. However, in simd_skcipher_init(), the reqsize that is
+retrieved is not from the subordinate skcipher but from the
+cryptd request structure, whose size is completely unrelated to
+the actual wrapped skcipher.
+
+Reported-by: Qian Cai <cai@gmx.us>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Tested-by: Qian Cai <cai@gmx.us>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/simd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/simd.c b/crypto/simd.c
+index ea7240be3001..78e8d037ae2b 100644
+--- a/crypto/simd.c
++++ b/crypto/simd.c
+@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm)
+
+ ctx->cryptd_tfm = cryptd_tfm;
+
+- reqsize = sizeof(struct skcipher_request);
+- reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base);
++ reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm));
++ reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base));
++ reqsize += sizeof(struct skcipher_request);
+
+ crypto_skcipher_set_reqsize(tfm, reqsize);
+
+--
+2.17.1
+
--- /dev/null
+From 0ce5ed41d523e009cb79ac8a18c319bea76c21b5 Mon Sep 17 00:00:00 2001
+From: Philip Yang <Philip.Yang@amd.com>
+Date: Mon, 12 Nov 2018 14:00:45 -0500
+Subject: drm/amdgpu: fix bug with IH ring setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit c837243ff4017f493c7d6f4ab57278d812a86859 ]
+
+The bug limits the IH ring wptr address to 40bit. When the system memory
+is bigger than 1TB, the bus address is more than 40bit, this causes the
+interrupt cannot be handled and cleared correctly.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vega10_ih.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+index 5ae5ed2e62d6..21bc12e02311 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev)
+ else
+ wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4);
+ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off));
+- WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF);
++ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF);
+
+ /* set rptr, wptr to 0 */
+ WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0);
+--
+2.17.1
+
--- /dev/null
+From c5561008cdaa8d379d3e26264697c39638ba275d Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Wed, 14 Nov 2018 09:55:41 -0800
+Subject: efi/arm: Revert deferred unmap of early memmap mapping
+
+[ Upstream commit 33412b8673135b18ea42beb7f5117ed0091798b6 ]
+
+Commit:
+
+ 3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory map longer for BGRT")
+
+deferred the unmap of the early mapping of the UEFI memory map to
+accommodate the ACPI BGRT code, which looks up the memory type that
+backs the BGRT table to validate it against the requirements of the UEFI spec.
+
+Unfortunately, this causes problems on ARM, which does not permit
+early mappings to persist after paging_init() is called, resulting
+in a WARN() splat. Since we don't support the BGRT table on ARM anway,
+let's revert ARM to the old behaviour, which is to take down the
+early mapping at the end of efi_init().
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Fixes: 3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory ...")
+Link: http://lkml.kernel.org/r/20181114175544.12860-3-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/arm-init.c | 4 ++++
+ drivers/firmware/efi/arm-runtime.c | 2 +-
+ drivers/firmware/efi/memmap.c | 3 +++
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index 388a929baf95..1a6a77df8a5e 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -265,6 +265,10 @@ void __init efi_init(void)
+ (params.mmap & ~PAGE_MASK)));
+
+ init_screen_info();
++
++ /* ARM does not permit early mappings to persist across paging_init() */
++ if (IS_ENABLED(CONFIG_ARM))
++ efi_memmap_unmap();
+ }
+
+ static int __init register_gop_device(void)
+diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
+index 922cfb813109..a00934d263c5 100644
+--- a/drivers/firmware/efi/arm-runtime.c
++++ b/drivers/firmware/efi/arm-runtime.c
+@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void)
+ {
+ u64 mapsize;
+
+- if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
++ if (!efi_enabled(EFI_BOOT)) {
+ pr_info("EFI services will not be available.\n");
+ return 0;
+ }
+diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c
+index 5fc70520e04c..1907db2b38d8 100644
+--- a/drivers/firmware/efi/memmap.c
++++ b/drivers/firmware/efi/memmap.c
+@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data)
+
+ void __init efi_memmap_unmap(void)
+ {
++ if (!efi_enabled(EFI_MEMMAP))
++ return;
++
+ if (!efi.memmap.late) {
+ unsigned long size;
+
+--
+2.17.1
+
--- /dev/null
+From ff5edcf876adc920666faf569ee293ed9499a704 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Fri, 9 Nov 2018 15:58:40 -0700
+Subject: floppy: fix race condition in __floppy_read_block_0()
+
+[ Upstream commit de7b75d82f70c5469675b99ad632983c50b6f7e7 ]
+
+LKP recently reported a hang at bootup in the floppy code:
+
+[ 245.678853] INFO: task mount:580 blocked for more than 120 seconds.
+[ 245.679906] Tainted: G T 4.19.0-rc6-00172-ga9f38e1 #1
+[ 245.680959] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 245.682181] mount D 6372 580 1 0x00000004
+[ 245.683023] Call Trace:
+[ 245.683425] __schedule+0x2df/0x570
+[ 245.683975] schedule+0x2d/0x80
+[ 245.684476] schedule_timeout+0x19d/0x330
+[ 245.685090] ? wait_for_common+0xa5/0x170
+[ 245.685735] wait_for_common+0xac/0x170
+[ 245.686339] ? do_sched_yield+0x90/0x90
+[ 245.686935] wait_for_completion+0x12/0x20
+[ 245.687571] __floppy_read_block_0+0xfb/0x150
+[ 245.688244] ? floppy_resume+0x40/0x40
+[ 245.688844] floppy_revalidate+0x20f/0x240
+[ 245.689486] check_disk_change+0x43/0x60
+[ 245.690087] floppy_open+0x1ea/0x360
+[ 245.690653] __blkdev_get+0xb4/0x4d0
+[ 245.691212] ? blkdev_get+0x1db/0x370
+[ 245.691777] blkdev_get+0x1f3/0x370
+[ 245.692351] ? path_put+0x15/0x20
+[ 245.692871] ? lookup_bdev+0x4b/0x90
+[ 245.693539] blkdev_get_by_path+0x3d/0x80
+[ 245.694165] mount_bdev+0x2a/0x190
+[ 245.694695] squashfs_mount+0x10/0x20
+[ 245.695271] ? squashfs_alloc_inode+0x30/0x30
+[ 245.695960] mount_fs+0xf/0x90
+[ 245.696451] vfs_kern_mount+0x43/0x130
+[ 245.697036] do_mount+0x187/0xc40
+[ 245.697563] ? memdup_user+0x28/0x50
+[ 245.698124] ksys_mount+0x60/0xc0
+[ 245.698639] sys_mount+0x19/0x20
+[ 245.699167] do_int80_syscall_32+0x61/0x130
+[ 245.699813] entry_INT80_32+0xc7/0xc7
+
+showing that we never complete that read request. The reason is that
+the completion setup is racy - it initializes the completion event
+AFTER submitting the IO, which means that the IO could complete
+before/during the init. If it does, we are passing garbage to
+complete() and we may sleep forever waiting for the event to
+occur.
+
+Fixes: 7b7b68bba5ef ("floppy: bail out in open() if drive is not responding to block0 read")
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/floppy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index f2b6f4da1034..fdabd0b74492 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4151,10 +4151,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive)
+ bio.bi_end_io = floppy_rb0_cb;
+ bio_set_op_attrs(&bio, REQ_OP_READ, 0);
+
++ init_completion(&cbdata.complete);
++
+ submit_bio(&bio);
+ process_fd_request();
+
+- init_completion(&cbdata.complete);
+ wait_for_completion(&cbdata.complete);
+
+ __free_page(page);
+--
+2.17.1
+
--- /dev/null
+From 8479c0c750d1510eff812f06f9915b6d806d2db5 Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Thu, 20 Sep 2018 08:59:14 -0400
+Subject: kdb: Use strscpy with destination buffer size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit c2b94c72d93d0929f48157eef128c4f9d2e603ce ]
+
+gcc 8.1.0 warns with:
+
+kernel/debug/kdb/kdb_support.c: In function ‘kallsyms_symbol_next’:
+kernel/debug/kdb/kdb_support.c:239:4: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=]
+ strncpy(prefix_name, name, strlen(name)+1);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+kernel/debug/kdb/kdb_support.c:239:31: note: length computed here
+
+Use strscpy() with the destination buffer size, and use ellipses when
+displaying truncated symbols.
+
+v2: Use strscpy()
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Cc: Jonathan Toppins <jtoppins@redhat.com>
+Cc: Jason Wessel <jason.wessel@windriver.com>
+Cc: Daniel Thompson <daniel.thompson@linaro.org>
+Cc: kgdb-bugreport@lists.sourceforge.net
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/debug/kdb/kdb_io.c | 15 +++++++++------
+ kernel/debug/kdb/kdb_private.h | 2 +-
+ kernel/debug/kdb/kdb_support.c | 10 +++++-----
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
+index ed5d34925ad0..6a4b41484afe 100644
+--- a/kernel/debug/kdb/kdb_io.c
++++ b/kernel/debug/kdb/kdb_io.c
+@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize)
+ int count;
+ int i;
+ int diag, dtab_count;
+- int key;
++ int key, buf_size, ret;
+
+
+ diag = kdbgetintenv("DTABCOUNT", &dtab_count);
+@@ -336,9 +336,8 @@ poll_again:
+ else
+ p_tmp = tmpbuffer;
+ len = strlen(p_tmp);
+- count = kallsyms_symbol_complete(p_tmp,
+- sizeof(tmpbuffer) -
+- (p_tmp - tmpbuffer));
++ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer);
++ count = kallsyms_symbol_complete(p_tmp, buf_size);
+ if (tab == 2 && count > 0) {
+ kdb_printf("\n%d symbols are found.", count);
+ if (count > dtab_count) {
+@@ -350,9 +349,13 @@ poll_again:
+ }
+ kdb_printf("\n");
+ for (i = 0; i < count; i++) {
+- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
++ ret = kallsyms_symbol_next(p_tmp, i, buf_size);
++ if (WARN_ON(!ret))
+ break;
+- kdb_printf("%s ", p_tmp);
++ if (ret != -E2BIG)
++ kdb_printf("%s ", p_tmp);
++ else
++ kdb_printf("%s... ", p_tmp);
+ *(p_tmp + len) = '\0';
+ }
+ if (i >= dtab_count)
+diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
+index 1e5a502ba4a7..2118d8258b7c 100644
+--- a/kernel/debug/kdb/kdb_private.h
++++ b/kernel/debug/kdb/kdb_private.h
+@@ -83,7 +83,7 @@ typedef struct __ksymtab {
+ unsigned long sym_start;
+ unsigned long sym_end;
+ } kdb_symtab_t;
+-extern int kallsyms_symbol_next(char *prefix_name, int flag);
++extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size);
+ extern int kallsyms_symbol_complete(char *prefix_name, int max_len);
+
+ /* Exported Symbols for kernel loadable modules to use. */
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 987eb73284d2..b14b0925c184 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len)
+ * Parameters:
+ * prefix_name prefix of a symbol name to lookup
+ * flag 0 means search from the head, 1 means continue search.
++ * buf_size maximum length that can be written to prefix_name
++ * buffer
+ * Returns:
+ * 1 if a symbol matches the given prefix.
+ * 0 if no string found
+ */
+-int kallsyms_symbol_next(char *prefix_name, int flag)
++int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size)
+ {
+ int prefix_len = strlen(prefix_name);
+ static loff_t pos;
+@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag)
+ pos = 0;
+
+ while ((name = kdb_walk_kallsyms(&pos))) {
+- if (strncmp(name, prefix_name, prefix_len) == 0) {
+- strncpy(prefix_name, name, strlen(name)+1);
+- return 1;
+- }
++ if (!strncmp(name, prefix_name, prefix_len))
++ return strscpy(prefix_name, name, buf_size);
+ }
+ return 0;
+ }
+--
+2.17.1
+
--- /dev/null
+From aad771f93ee8517c71b189b9fb1ea90fa8fe816c Mon Sep 17 00:00:00 2001
+From: Scott Wood <oss@buserror.net>
+Date: Tue, 6 Nov 2018 19:49:34 -0600
+Subject: KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
+
+[ Upstream commit 28c5bcf74fa07c25d5bd118d1271920f51ce2a98 ]
+
+TRACE_INCLUDE_PATH and TRACE_INCLUDE_FILE are used by
+<trace/define_trace.h>, so like that #include, they should
+be outside #ifdef protection.
+
+They also need to be #undefed before defining, in case multiple trace
+headers are included by the same C file. This became the case on
+book3e after commit cf4a6085151a ("powerpc/mm: Add missing tracepoint for
+tlbie"), leading to the following build error:
+
+ CC arch/powerpc/kvm/powerpc.o
+In file included from arch/powerpc/kvm/powerpc.c:51:0:
+arch/powerpc/kvm/trace.h:9:0: error: "TRACE_INCLUDE_PATH" redefined
+[-Werror]
+ #define TRACE_INCLUDE_PATH .
+ ^
+In file included from arch/powerpc/kvm/../mm/mmu_decl.h:25:0,
+ from arch/powerpc/kvm/powerpc.c:48:
+./arch/powerpc/include/asm/trace.h:224:0: note: this is the location of
+the previous definition
+ #define TRACE_INCLUDE_PATH asm
+ ^
+cc1: all warnings being treated as errors
+
+Reported-by: Christian Zigotzky <chzigotzky@xenosoft.de>
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/trace.h | 8 ++++++--
+ arch/powerpc/kvm/trace_booke.h | 9 +++++++--
+ arch/powerpc/kvm/trace_hv.h | 9 +++++++--
+ arch/powerpc/kvm/trace_pr.h | 9 +++++++--
+ 4 files changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h
+index 491b0f715d6b..ea1d7c808319 100644
+--- a/arch/powerpc/kvm/trace.h
++++ b/arch/powerpc/kvm/trace.h
+@@ -6,8 +6,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace
+
+ /*
+ * Tracepoint for guest mode entry.
+@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests,
+ #endif /* _TRACE_KVM_H */
+
+ /* This part must be outside protection */
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h
+index ac640e81fdc5..3837842986aa 100644
+--- a/arch/powerpc/kvm/trace_booke.h
++++ b/arch/powerpc/kvm/trace_booke.h
+@@ -6,8 +6,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_booke
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_booke
+
+ #define kvm_trace_symbol_exit \
+ {0, "CRITICAL"}, \
+@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio,
+ #endif
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_booke
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h
+index bcfe8a987f6a..8a1e3b0047f1 100644
+--- a/arch/powerpc/kvm/trace_hv.h
++++ b/arch/powerpc/kvm/trace_hv.h
+@@ -9,8 +9,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_hv
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_hv
+
+ #define kvm_trace_symbol_hcall \
+ {H_REMOVE, "H_REMOVE"}, \
+@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit,
+ #endif /* _TRACE_KVM_HV_H */
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_hv
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h
+index 2f9a8829552b..46a46d328fbf 100644
+--- a/arch/powerpc/kvm/trace_pr.h
++++ b/arch/powerpc/kvm/trace_pr.h
+@@ -8,8 +8,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_pr
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_pr
+
+ TRACE_EVENT(kvm_book3s_reenter,
+ TP_PROTO(int r, struct kvm_vcpu *vcpu),
+@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit,
+ #endif /* _TRACE_KVM_H */
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_pr
++
+ #include <trace/define_trace.h>
+--
+2.17.1
+
--- /dev/null
+From a4e3783ae28220adcfd1f119c4431bbc732da6e5 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Fri, 16 Nov 2018 15:08:15 -0800
+Subject: mm, memory_hotplug: check zone_movable in has_unmovable_pages
+
+[ Upstream commit 9d7899999c62c1a81129b76d2a6ecbc4655e1597 ]
+
+Page state checks are racy. Under a heavy memory workload (e.g. stress
+-m 200 -t 2h) it is quite easy to hit a race window when the page is
+allocated but its state is not fully populated yet. A debugging patch to
+dump the struct page state shows
+
+ has_unmovable_pages: pfn:0x10dfec00, found:0x1, count:0x0
+ page:ffffea0437fb0000 count:1 mapcount:1 mapping:ffff880e05239841 index:0x7f26e5000 compound_mapcount: 1
+ flags: 0x5fffffc0090034(uptodate|lru|active|head|swapbacked)
+
+Note that the state has been checked for both PageLRU and PageSwapBacked
+already. Closing this race completely would require some sort of retry
+logic. This can be tricky and error prone (think of potential endless
+or long taking loops).
+
+Workaround this problem for movable zones at least. Such a zone should
+only contain movable pages. Commit 15c30bc09085 ("mm, memory_hotplug:
+make has_unmovable_pages more robust") has told us that this is not
+strictly true though. Bootmem pages should be marked reserved though so
+we can move the original check after the PageReserved check. Pages from
+other zones are still prone to races but we even do not pretend that
+memory hotremove works for those so pre-mature failure doesn't hurt that
+much.
+
+Link: http://lkml.kernel.org/r/20181106095524.14629-1-mhocko@kernel.org
+Fixes: 15c30bc09085 ("mm, memory_hotplug: make has_unmovable_pages more robust")
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Reported-by: Baoquan He <bhe@redhat.com>
+Tested-by: Baoquan He <bhe@redhat.com>
+Acked-by: Baoquan He <bhe@redhat.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Acked-by: Balbir Singh <bsingharora@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index e2ef1c17942f..3a4065312938 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7690,6 +7690,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
+ if (PageReserved(page))
+ goto unmovable;
+
++ /*
++ * If the zone is movable and we have ruled out all reserved
++ * pages then it should be reasonably safe to assume the rest
++ * is movable.
++ */
++ if (zone_idx(zone) == ZONE_MOVABLE)
++ continue;
++
+ /*
+ * Hugepages are not in LRU lists, but they're movable.
+ * We need not scan over tail pages bacause we don't
+--
+2.17.1
+
--- /dev/null
+From 7c690849dbc08f67c661fc417bec5a178ba869e8 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Fri, 16 Nov 2018 15:08:53 -0800
+Subject: mm, page_alloc: check for max order in hot path
+
+[ Upstream commit c63ae43ba53bc432b414fd73dd5f4b01fcb1ab43 ]
+
+Konstantin has noticed that kvmalloc might trigger the following
+warning:
+
+ WARNING: CPU: 0 PID: 6676 at mm/vmstat.c:986 __fragmentation_index+0x54/0x60
+ [...]
+ Call Trace:
+ fragmentation_index+0x76/0x90
+ compaction_suitable+0x4f/0xf0
+ shrink_node+0x295/0x310
+ node_reclaim+0x205/0x250
+ get_page_from_freelist+0x649/0xad0
+ __alloc_pages_nodemask+0x12a/0x2a0
+ kmalloc_large_node+0x47/0x90
+ __kmalloc_node+0x22b/0x2e0
+ kvmalloc_node+0x3e/0x70
+ xt_alloc_table_info+0x3a/0x80 [x_tables]
+ do_ip6t_set_ctl+0xcd/0x1c0 [ip6_tables]
+ nf_setsockopt+0x44/0x60
+ SyS_setsockopt+0x6f/0xc0
+ do_syscall_64+0x67/0x120
+ entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+
+the problem is that we only check for an out of bound order in the slow
+path and the node reclaim might happen from the fast path already. This
+is fixable by making sure that kvmalloc doesn't ever use kmalloc for
+requests that are larger than KMALLOC_MAX_SIZE but this also shows that
+the code is rather fragile. A recent UBSAN report just underlines that
+by the following report
+
+ UBSAN: Undefined behaviour in mm/page_alloc.c:3117:19
+ shift exponent 51 is too large for 32-bit type 'int'
+ CPU: 0 PID: 6520 Comm: syz-executor1 Not tainted 4.19.0-rc2 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
+ Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xd2/0x148 lib/dump_stack.c:113
+ ubsan_epilogue+0x12/0x94 lib/ubsan.c:159
+ __ubsan_handle_shift_out_of_bounds+0x2b6/0x30b lib/ubsan.c:425
+ __zone_watermark_ok+0x2c7/0x400 mm/page_alloc.c:3117
+ zone_watermark_fast mm/page_alloc.c:3216 [inline]
+ get_page_from_freelist+0xc49/0x44c0 mm/page_alloc.c:3300
+ __alloc_pages_nodemask+0x21e/0x640 mm/page_alloc.c:4370
+ alloc_pages_current+0xcc/0x210 mm/mempolicy.c:2093
+ alloc_pages include/linux/gfp.h:509 [inline]
+ __get_free_pages+0x12/0x60 mm/page_alloc.c:4414
+ dma_mem_alloc+0x36/0x50 arch/x86/include/asm/floppy.h:156
+ raw_cmd_copyin drivers/block/floppy.c:3159 [inline]
+ raw_cmd_ioctl drivers/block/floppy.c:3206 [inline]
+ fd_locked_ioctl+0xa00/0x2c10 drivers/block/floppy.c:3544
+ fd_ioctl+0x40/0x60 drivers/block/floppy.c:3571
+ __blkdev_driver_ioctl block/ioctl.c:303 [inline]
+ blkdev_ioctl+0xb3c/0x1a30 block/ioctl.c:601
+ block_ioctl+0x105/0x150 fs/block_dev.c:1883
+ vfs_ioctl fs/ioctl.c:46 [inline]
+ do_vfs_ioctl+0x1c0/0x1150 fs/ioctl.c:687
+ ksys_ioctl+0x9e/0xb0 fs/ioctl.c:702
+ __do_sys_ioctl fs/ioctl.c:709 [inline]
+ __se_sys_ioctl fs/ioctl.c:707 [inline]
+ __x64_sys_ioctl+0x7e/0xc0 fs/ioctl.c:707
+ do_syscall_64+0xc4/0x510 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Note that this is not a kvmalloc path. It is just that the fast path
+really depends on having sanitzed order as well. Therefore move the
+order check to the fast path.
+
+Link: http://lkml.kernel.org/r/20181113094305.GM15120@dhcp22.suse.cz
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Kyungtae Kim <kt0755@gmail.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Pavel Tatashin <pavel.tatashin@microsoft.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
+Cc: Aaron Lu <aaron.lu@intel.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Byoungyoung Lee <lifeasageek@gmail.com>
+Cc: "Dae R. Jeong" <threeearcat@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 3a4065312938..b721631d78ab 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4055,17 +4055,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
+ unsigned int cpuset_mems_cookie;
+ int reserve_flags;
+
+- /*
+- * In the slowpath, we sanity check order to avoid ever trying to
+- * reclaim >= MAX_ORDER areas which will never succeed. Callers may
+- * be using allocators in order of preference for an area that is
+- * too large.
+- */
+- if (order >= MAX_ORDER) {
+- WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
+- return NULL;
+- }
+-
+ /*
+ * We also sanity check to catch abuse of atomic reserves being used by
+ * callers that are not in atomic context.
+@@ -4359,6 +4348,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid,
+ gfp_t alloc_mask; /* The gfp_t that was actually used for allocation */
+ struct alloc_context ac = { };
+
++ /*
++ * There are several places where we assume that the order value is sane
++ * so bail out early if the request is out of bound.
++ */
++ if (unlikely(order >= MAX_ORDER)) {
++ WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
++ return NULL;
++ }
++
+ gfp_mask &= gfp_allowed_mask;
+ alloc_mask = gfp_mask;
+ if (!prepare_alloc_pages(gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags))
+--
+2.17.1
+
--- /dev/null
+From 3e0b1b48f185860c3e59efae9ca88172eb3f8812 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Tue, 13 Nov 2018 16:37:54 -0500
+Subject: NFSv4: Fix an Oops during delegation callbacks
+
+[ Upstream commit e39d8a186ed002854196668cb7562ffdfbc6d379 ]
+
+If the server sends a CB_GETATTR or a CB_RECALL while the filesystem is
+being unmounted, then we can Oops when releasing the inode in
+nfs4_callback_getattr() and nfs4_callback_recall().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_proc.c | 4 ++--
+ fs/nfs/delegation.c | 11 +++++++++--
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index fa515d5ea5ba..7b861bbc0b43 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp,
+ out_iput:
+ rcu_read_unlock();
+ trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status));
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ out:
+ dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status));
+ return res->status;
+@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp,
+ }
+ trace_nfs4_cb_recall(cps->clp, &args->fh, inode,
+ &args->stateid, -ntohl(res));
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ out:
+ dprintk("%s: exit with status = %d\n", __func__, ntohl(res));
+ return res;
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index f033f3a69a3b..75fe92eaa681 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -849,16 +849,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server,
+ const struct nfs_fh *fhandle)
+ {
+ struct nfs_delegation *delegation;
+- struct inode *res = NULL;
++ struct inode *freeme, *res = NULL;
+
+ list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
+ spin_lock(&delegation->lock);
+ if (delegation->inode != NULL &&
+ nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) {
+- res = igrab(delegation->inode);
++ freeme = igrab(delegation->inode);
++ if (freeme && nfs_sb_active(freeme->i_sb))
++ res = freeme;
+ spin_unlock(&delegation->lock);
+ if (res != NULL)
+ return res;
++ if (freeme) {
++ rcu_read_unlock();
++ iput(freeme);
++ rcu_read_lock();
++ }
+ return ERR_PTR(-EAGAIN);
+ }
+ spin_unlock(&delegation->lock);
+--
+2.17.1
+
--- /dev/null
+From cf08b3eee3db7ae91f9e954dbc3c96efd428a838 Mon Sep 17 00:00:00 2001
+From: Kan Liang <kan.liang@linux.intel.com>
+Date: Fri, 19 Oct 2018 10:04:18 -0700
+Subject: perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and
+ CoffeeLake CPUs
+
+[ Upstream commit c10a8de0d32e95b0b8c7c17b6dc09baea5a5a899 ]
+
+KabyLake and CoffeeLake CPUs have the same client uncore events as SkyLake.
+
+Add the PCI IDs for the KabyLake Y, U, S processor lines and CoffeeLake U,
+H, S processor lines.
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Link: http://lkml.kernel.org/r/20181019170419.378-1-kan.liang@linux.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/uncore_snb.c | 115 ++++++++++++++++++++++++++++-
+ 1 file changed, 114 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index 8527c3e1038b..bfa25814fe5f 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -15,6 +15,25 @@
+ #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910
+ #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f
+ #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f
++#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c
++#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904
++#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914
++#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC 0x590f
++#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC 0x591f
++#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC 0x3ecc
++#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC 0x3ed0
++#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC 0x3e10
++#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC 0x3ec4
++#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC 0x3e0f
++#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC 0x3e1f
++#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC 0x3ec2
++#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC 0x3e30
++#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC 0x3e18
++#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC 0x3ec6
++#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC 0x3e31
++#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC 0x3e33
++#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC 0x3eca
++#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC 0x3e32
+
+ /* SNB event control */
+ #define SNB_UNC_CTL_EV_SEL_MASK 0x000000ff
+@@ -569,7 +588,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
+ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+ },
+-
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_UQ_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SD_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SQ_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4H_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6H_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
+ { /* end: all zeroes */ },
+ };
+
+@@ -618,6 +712,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
+ IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core H Quad Core */
+ IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Dual Core */
+ IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Quad Core */
++ IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver), /* 7th Gen Core Y */
++ IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U */
++ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */
++ IMC_DEV(KBL_SD_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Dual Core */
++ IMC_DEV(KBL_SQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Quad Core */
++ IMC_DEV(CFL_2U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 2 Cores */
++ IMC_DEV(CFL_4U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 4 Cores */
++ IMC_DEV(CFL_4H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 4 Cores */
++ IMC_DEV(CFL_6H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 6 Cores */
++ IMC_DEV(CFL_2S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 2 Cores Desktop */
++ IMC_DEV(CFL_4S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Desktop */
++ IMC_DEV(CFL_6S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Desktop */
++ IMC_DEV(CFL_8S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Desktop */
++ IMC_DEV(CFL_4S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Work Station */
++ IMC_DEV(CFL_6S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Work Station */
++ IMC_DEV(CFL_8S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Work Station */
++ IMC_DEV(CFL_4S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Server */
++ IMC_DEV(CFL_6S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Server */
++ IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Server */
+ { /* end marker */ }
+ };
+
+--
+2.17.1
+
--- /dev/null
+From 0d3f380ceb14700e51af3aca5780c01117144f59 Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Oct 2018 16:13:37 +0100
+Subject: pinctrl: meson: fix gxbb ao pull register bits
+
+[ Upstream commit 4bc51e1e350cd4707ce6e551a93eae26d40b9889 ]
+
+AO pull register definition is inverted between pull (up/down) and
+pull enable. Fixing this allows to properly apply bias setting
+through pinconf
+
+Fixes: 468c234f9ed7 ("pinctrl: amlogic: Add support for Amlogic Meson GXBB SoC")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxbb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+index 4ceb06f8a33c..4edeb4cae72a 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = {
+
+ static struct meson_bank meson_gxbb_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = {
+--
+2.17.1
+
--- /dev/null
+From 311a0341a029608687587b31028e4da1ec392ff7 Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Oct 2018 16:13:38 +0100
+Subject: pinctrl: meson: fix gxl ao pull register bits
+
+[ Upstream commit ed3a2b74f3eb34c84c8377353f4730f05acdfd05 ]
+
+AO pull register definition is inverted between pull (up/down) and
+pull enable. Fixing this allows to properly apply bias setting
+through pinconf
+
+Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson-gxl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 7dae1d7bf6b0..158f618f1695 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = {
+
+ static struct meson_bank meson_gxl_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = {
+--
+2.17.1
+
--- /dev/null
+From 3c16a6e0ef482af058fa2bebe31b8cda78eeea5b Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Oct 2018 16:13:39 +0100
+Subject: pinctrl: meson: fix meson8 ao pull register bits
+
+[ Upstream commit e91b162d2868672d06010f34aa83d408db13d3c6 ]
+
+AO pull register definition is inverted between pull (up/down) and
+pull enable. Fixing this allows to properly apply bias setting
+through pinconf
+
+Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson8.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
+index c6d79315218f..86466173114d 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8.c
+@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = {
+
+ static struct meson_bank meson8_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson8_cbus_pinctrl_data = {
+--
+2.17.1
+
--- /dev/null
+From 9dec29e6a7fde47789822f64c7ba8a49face098a Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Oct 2018 16:13:40 +0100
+Subject: pinctrl: meson: fix meson8b ao pull register bits
+
+[ Upstream commit a1705f02704cd8a24d434bfd0141ee8142ad277a ]
+
+AO pull register definition is inverted between pull (up/down) and
+pull enable. Fixing this allows to properly apply bias setting
+through pinconf
+
+Fixes: 0fefcb6876d0 ("pinctrl: Add support for Meson8b")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index bb2a30964fc6..647ad15d5c3c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = {
+
+ static struct meson_bank meson8b_aobus_banks[] = {
+ /* name first lastc irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = {
+--
+2.17.1
+
--- /dev/null
+From a5b7d5d91677a44a16f2f318342fedb04ae5253c Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Tue, 23 Oct 2018 18:03:19 +0200
+Subject: pinctrl: meson: fix pinconf bias disable
+
+[ Upstream commit e39f9dd8206ad66992ac0e6218ef1ba746f2cce9 ]
+
+If a bias is enabled on a pin of an Amlogic SoC, calling .pin_config_set()
+with PIN_CONFIG_BIAS_DISABLE will not disable the bias. Instead it will
+force a pull-down bias on the pin.
+
+Instead of the pull type register bank, the driver should access the pull
+enable register bank.
+
+Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
+index 29a458da78db..4f3ab18636a3 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
+ dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
+
+ meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
+- ret = regmap_update_bits(pc->reg_pull, reg,
++ ret = regmap_update_bits(pc->reg_pullen, reg,
+ BIT(bit), 0);
+ if (ret)
+ return ret;
+--
+2.17.1
+
--- /dev/null
+From c2aa734d8c80fb2ef291f879764ad53973612d34 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Tue, 6 Nov 2018 23:37:58 +1100
+Subject: powerpc/io: Fix the IO workarounds code to work with Radix
+
+[ Upstream commit 43c6494fa1499912c8177e71450c0279041152a6 ]
+
+Back in 2006 Ben added some workarounds for a misbehaviour in the
+Spider IO bridge used on early Cell machines, see commit
+014da7ff47b5 ("[POWERPC] Cell "Spider" MMIO workarounds"). Later these
+were made to be generic, ie. not tied specifically to Spider.
+
+The code stashes a token in the high bits (59-48) of virtual addresses
+used for IO (eg. returned from ioremap()). This works fine when using
+the Hash MMU, but when we're using the Radix MMU the bits used for the
+token overlap with some of the bits of the virtual address.
+
+This is because the maximum virtual address is larger with Radix, up
+to c00fffffffffffff, and in fact we use that high part of the address
+range for ioremap(), see RADIX_KERN_IO_START.
+
+As it happens the bits that are used overlap with the bits that
+differentiate an IO address vs a linear map address. If the resulting
+address lies outside the linear mapping we will crash (see below), if
+not we just corrupt memory.
+
+ virtio-pci 0000:00:00.0: Using 64-bit direct DMA at offset 800000000000000
+ Unable to handle kernel paging request for data at address 0xc000000080000014
+ ...
+ CFAR: c000000000626b98 DAR: c000000080000014 DSISR: 42000000 IRQMASK: 0
+ GPR00: c0000000006c54fc c00000003e523378 c0000000016de600 0000000000000000
+ GPR04: c00c000080000014 0000000000000007 0fffffff000affff 0000000000000030
+ ^^^^
+ ...
+ NIP [c000000000626c5c] .iowrite8+0xec/0x100
+ LR [c0000000006c992c] .vp_reset+0x2c/0x90
+ Call Trace:
+ .pci_bus_read_config_dword+0xc4/0x120 (unreliable)
+ .register_virtio_device+0x13c/0x1c0
+ .virtio_pci_probe+0x148/0x1f0
+ .local_pci_probe+0x68/0x140
+ .pci_device_probe+0x164/0x220
+ .really_probe+0x274/0x3b0
+ .driver_probe_device+0x80/0x170
+ .__driver_attach+0x14c/0x150
+ .bus_for_each_dev+0xb8/0x130
+ .driver_attach+0x34/0x50
+ .bus_add_driver+0x178/0x2f0
+ .driver_register+0x90/0x1a0
+ .__pci_register_driver+0x6c/0x90
+ .virtio_pci_driver_init+0x2c/0x40
+ .do_one_initcall+0x64/0x280
+ .kernel_init_freeable+0x36c/0x474
+ .kernel_init+0x24/0x160
+ .ret_from_kernel_thread+0x58/0x7c
+
+This hasn't been a problem because CONFIG_PPC_IO_WORKAROUNDS which
+enables this code is usually not enabled. It is only enabled when it's
+selected by PPC_CELL_NATIVE which is only selected by
+PPC_IBM_CELL_BLADE and that in turn depends on BIG_ENDIAN. So in order
+to hit the bug you need to build a big endian kernel, with IBM Cell
+Blade support enabled, as well as Radix MMU support, and then boot
+that on Power9 using Radix MMU.
+
+Still we can fix the bug, so let's do that. We simply use fewer bits
+for the token, taking the union of the restrictions on the address
+from both Hash and Radix, we end up with 8 bits we can use for the
+token. The only user of the token is iowa_mem_find_bus() which only
+supports 8 token values, so 8 bits is plenty for that.
+
+Fixes: 566ca99af026 ("powerpc/mm/radix: Add dummy radix_enabled()")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/io.h | 20 +++++++-------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
+index e0331e754568..b855f56489ac 100644
+--- a/arch/powerpc/include/asm/io.h
++++ b/arch/powerpc/include/asm/io.h
+@@ -285,19 +285,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
+ * their hooks, a bitfield is reserved for use by the platform near the
+ * top of MMIO addresses (not PIO, those have to cope the hard way).
+ *
+- * This bit field is 12 bits and is at the top of the IO virtual
+- * addresses PCI_IO_INDIRECT_TOKEN_MASK.
++ * The highest address in the kernel virtual space are:
+ *
+- * The kernel virtual space is thus:
++ * d0003fffffffffff # with Hash MMU
++ * c00fffffffffffff # with Radix MMU
+ *
+- * 0xD000000000000000 : vmalloc
+- * 0xD000080000000000 : PCI PHB IO space
+- * 0xD000080080000000 : ioremap
+- * 0xD0000fffffffffff : end of ioremap region
+- *
+- * Since the top 4 bits are reserved as the region ID, we use thus
+- * the next 12 bits and keep 4 bits available for the future if the
+- * virtual address space is ever to be extended.
++ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits
++ * that can be used for the field.
+ *
+ * The direct IO mapping operations will then mask off those bits
+ * before doing the actual access, though that only happen when
+@@ -309,8 +303,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
+ */
+
+ #ifdef CONFIG_PPC_INDIRECT_MMIO
+-#define PCI_IO_IND_TOKEN_MASK 0x0fff000000000000ul
+-#define PCI_IO_IND_TOKEN_SHIFT 48
++#define PCI_IO_IND_TOKEN_SHIFT 52
++#define PCI_IO_IND_TOKEN_MASK (0xfful << PCI_IO_IND_TOKEN_SHIFT)
+ #define PCI_FIX_ADDR(addr) \
+ ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK))
+ #define PCI_GET_ADDR_TOKEN(addr) \
+--
+2.17.1
+
--- /dev/null
+From 55911bde8830bc8dcc065054f2f0773f59d1fda4 Mon Sep 17 00:00:00 2001
+From: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Date: Thu, 8 Nov 2018 10:47:56 +0530
+Subject: powerpc/numa: Suppress "VPHN is not supported" messages
+
+[ Upstream commit 437ccdc8ce629470babdda1a7086e2f477048cbd ]
+
+When VPHN function is not supported and during cpu hotplug event,
+kernel prints message 'VPHN function not supported. Disabling
+polling...'. Currently it prints on every hotplug event, it floods
+dmesg when a KVM guest tries to hotplug huge number of vcpus, let's
+just print once and suppress further kernel prints.
+
+Signed-off-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/numa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 055b211b7126..5500e4edabc6 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1179,7 +1179,7 @@ static long vphn_get_associativity(unsigned long cpu,
+
+ switch (rc) {
+ case H_FUNCTION:
+- printk(KERN_INFO
++ printk_once(KERN_INFO
+ "VPHN is not supported. Disabling polling...\n");
+ stop_topology_update();
+ break;
+--
+2.17.1
+
--- /dev/null
+From d567f84a52f4052ca584ba91ea5e2c045a017618 Mon Sep 17 00:00:00 2001
+From: Olof Johansson <olof@lixom.net>
+Date: Tue, 30 Oct 2018 23:47:09 -0700
+Subject: RISC-V: Silence some module warnings on 32-bit
+
+[ Upstream commit ef3a61406618291c46da168ff91acaa28d85944c ]
+
+Fixes:
+
+arch/riscv/kernel/module.c: In function 'apply_r_riscv_32_rela':
+./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=]
+arch/riscv/kernel/module.c:23:27: note: format string is defined here
+arch/riscv/kernel/module.c: In function 'apply_r_riscv_pcrel_hi20_rela':
+./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=]
+arch/riscv/kernel/module.c:104:23: note: format string is defined here
+arch/riscv/kernel/module.c: In function 'apply_r_riscv_hi20_rela':
+./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=]
+arch/riscv/kernel/module.c:146:23: note: format string is defined here
+arch/riscv/kernel/module.c: In function 'apply_r_riscv_got_hi20_rela':
+./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=]
+arch/riscv/kernel/module.c:190:60: note: format string is defined here
+arch/riscv/kernel/module.c: In function 'apply_r_riscv_call_plt_rela':
+./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=]
+arch/riscv/kernel/module.c:214:24: note: format string is defined here
+arch/riscv/kernel/module.c: In function 'apply_r_riscv_call_rela':
+./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=]
+arch/riscv/kernel/module.c:236:23: note: format string is defined here
+
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/module.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 3303ed2cd419..7dd308129b40 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+ if (v != (u32)v) {
+ pr_err("%s: value %016llx out of range for 32-bit field\n",
+- me->name, v);
++ me->name, (long long)v);
+ return -EINVAL;
+ }
+ *location = v;
+@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location,
+ if (offset != (s32)offset) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
+ if (IS_ENABLED(CMODEL_MEDLOW)) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location,
+ } else {
+ pr_err(
+ "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location,
+ } else {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+ }
+@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location,
+ if (offset != fill_v) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 40afd3845aba4da5197c54232dcabd6d6c2820a2 Mon Sep 17 00:00:00 2001
+From: David Abdurachmanov <david.abdurachmanov@gmail.com>
+Date: Mon, 5 Nov 2018 15:35:37 +0100
+Subject: riscv: add missing vdso_install target
+
+[ Upstream commit f157d411a9eb170d2ee6b766da7a381962017cc9 ]
+
+Building kernel 4.20 for Fedora as RPM fails, because riscv is missing
+vdso_install target in arch/riscv/Makefile.
+
+Signed-off-by: David Abdurachmanov <david.abdurachmanov@gmail.com>
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Makefile | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 61ec42405ec9..110be14e6122 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -82,4 +82,8 @@ core-y += arch/riscv/kernel/ arch/riscv/mm/
+
+ libs-y += arch/riscv/lib/
+
++PHONY += vdso_install
++vdso_install:
++ $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
++
+ all: vmlinux
+--
+2.17.1
+
--- /dev/null
+From 2bd4fd39e350f316c5ec5e5d7bd8655864a268d4 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 4 Sep 2018 16:51:29 +0200
+Subject: rtc: cmos: Do not export alarm rtc_ops when we do not support alarms
+
+[ Upstream commit fbb974ba693bbfb4e24a62181ef16d4e45febc37 ]
+
+When there is no IRQ configured for the RTC, the rtc-cmos code does not
+support alarms, all alarm rtc_ops fail with -EIO / -EINVAL.
+
+The rtc-core expects a rtc driver which does not support rtc alarms to
+not have alarm ops at all. Otherwise the wakealarm sysfs attr will read
+as empty rather then returning an error, making it impossible for
+userspace to find out beforehand if alarms are supported.
+
+A system without an IRQ for the RTC before this patch:
+[root@localhost ~]# cat /sys/class/rtc/rtc0/wakealarm
+[root@localhost ~]#
+
+After this patch:
+[root@localhost ~]# cat /sys/class/rtc/rtc0/wakealarm
+cat: /sys/class/rtc/rtc0/wakealarm: No such file or directory
+[root@localhost ~]#
+
+This fixes gnome-session + systemd trying to use suspend-then-hibernate,
+which causes systemd to abort the suspend when writing the RTC alarm fails.
+
+BugLink: https://github.com/systemd/systemd/issues/9988
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-cmos.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index df0c5776d49b..a5a19ff10535 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned char rtc_control;
+
++ /* This not only a rtc_op, but also called directly */
+ if (!is_valid_irq(cmos->irq))
+ return -EIO;
+
+@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ unsigned char mon, mday, hrs, min, sec, rtc_control;
+ int ret;
+
++ /* This not only a rtc_op, but also called directly */
+ if (!is_valid_irq(cmos->irq))
+ return -EIO;
+
+@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned long flags;
+
+- if (!is_valid_irq(cmos->irq))
+- return -EINVAL;
+-
+ spin_lock_irqsave(&rtc_lock, flags);
+
+ if (enabled)
+@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = {
+ .alarm_irq_enable = cmos_alarm_irq_enable,
+ };
+
++static const struct rtc_class_ops cmos_rtc_ops_no_alarm = {
++ .read_time = cmos_read_time,
++ .set_time = cmos_set_time,
++ .proc = cmos_procfs,
++};
++
+ /*----------------------------------------------------------------*/
+
+ /*
+@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+ dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
+ goto cleanup1;
+ }
++
++ cmos_rtc.rtc->ops = &cmos_rtc_ops;
++ } else {
++ cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm;
+ }
+
+- cmos_rtc.rtc->ops = &cmos_rtc_ops;
+ cmos_rtc.rtc->nvram_old_abi = true;
+ retval = rtc_register_device(cmos_rtc.rtc);
+ if (retval)
+--
+2.17.1
+
--- /dev/null
+From 60abe9bac1b2907be22d82a241d514cad8a2a1bd Mon Sep 17 00:00:00 2001
+From: Xulin Sun <xulin.sun@windriver.com>
+Date: Tue, 6 Nov 2018 16:42:19 +0800
+Subject: rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
+
+[ Upstream commit 9bde0afb7a906f1dabdba37162551565740b862d ]
+
+pcf2127_i2c_gather_write() allocates memory as local variable
+for i2c_master_send(), after finishing the master transfer,
+the allocated memory should be freed. The kmemleak is reported:
+
+unreferenced object 0xffff80231e7dba80 (size 64):
+ comm "hwclock", pid 27762, jiffies 4296880075 (age 356.944s)
+ hex dump (first 32 bytes):
+ 03 00 12 03 19 02 11 13 00 80 98 18 00 00 ff ff ................
+ 00 50 00 00 00 00 00 00 02 00 00 00 00 00 00 00 .P..............
+ backtrace:
+ [<ffff000008221398>] create_object+0xf8/0x278
+ [<ffff000008a96264>] kmemleak_alloc+0x74/0xa0
+ [<ffff00000821070c>] __kmalloc+0x1ac/0x348
+ [<ffff0000087ed1dc>] pcf2127_i2c_gather_write+0x54/0xf8
+ [<ffff0000085fd9d4>] _regmap_raw_write+0x464/0x850
+ [<ffff0000085fe3f4>] regmap_bulk_write+0x1a4/0x348
+ [<ffff0000087ed32c>] pcf2127_rtc_set_time+0xac/0xe8
+ [<ffff0000087eaad8>] rtc_set_time+0x80/0x138
+ [<ffff0000087ebfb0>] rtc_dev_ioctl+0x398/0x610
+ [<ffff00000823f2c0>] do_vfs_ioctl+0xb0/0x848
+ [<ffff00000823fae4>] SyS_ioctl+0x8c/0xa8
+ [<ffff000008083ac0>] el0_svc_naked+0x34/0x38
+ [<ffffffffffffffff>] 0xffffffffffffffff
+
+Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 9f99a0966550..7cb786d76e3c 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context,
+ memcpy(buf + 1, val, val_size);
+
+ ret = i2c_master_send(client, buf, val_size + 1);
++
++ kfree(buf);
++
+ if (ret != val_size + 1)
+ return ret < 0 ? ret : -EIO;
+
+--
+2.17.1
+
--- /dev/null
+From da74bbe9ff7a29044de3c843f0c4424390e8ff40 Mon Sep 17 00:00:00 2001
+From: Patrick Bellasi <patrick.bellasi@arm.com>
+Date: Mon, 5 Nov 2018 14:53:58 +0000
+Subject: sched/fair: Fix cpu_util_wake() for 'execl' type workloads
+
+[ Upstream commit c469933e772132aad040bd6a2adc8edf9ad6f825 ]
+
+A ~10% regression has been reported for UnixBench's execl throughput
+test by Aaron Lu and Ye Xiaolong:
+
+ https://lkml.org/lkml/2018/10/30/765
+
+That test is pretty simple, it does a "recursive" execve() syscall on the
+same binary. Starting from the syscall, this sequence is possible:
+
+ do_execve()
+ do_execveat_common()
+ __do_execve_file()
+ sched_exec()
+ select_task_rq_fair() <==| Task already enqueued
+ find_idlest_cpu()
+ find_idlest_group()
+ capacity_spare_wake() <==| Functions not called from
+ cpu_util_wake() | the wakeup path
+
+which means we can end up calling cpu_util_wake() not only from the
+"wakeup path", as its name would suggest. Indeed, the task doing an
+execve() syscall is already enqueued on the CPU we want to get the
+cpu_util_wake() for.
+
+The estimated utilization for a CPU computed in cpu_util_wake() was
+written under the assumption that function can be called only from the
+wakeup path. If instead the task is already enqueued, we end up with a
+utilization which does not remove the current task's contribution from
+the estimated utilization of the CPU.
+This will wrongly assume a reduced spare capacity on the current CPU and
+increase the chances to migrate the task on execve.
+
+The regression is tracked down to:
+
+ commit d519329f72a6 ("sched/fair: Update util_est only on util_avg updates")
+
+because in that patch we turn on by default the UTIL_EST sched feature.
+However, the real issue is introduced by:
+
+ commit f9be3e5961c5 ("sched/fair: Use util_est in LB and WU paths")
+
+Let's fix this by ensuring to always discount the task estimated
+utilization from the CPU's estimated utilization when the task is also
+the current one. The same benchmark of the bug report, executed on a
+dual socket 40 CPUs Intel(R) Xeon(R) CPU E5-2690 v2 @ 3.00GHz machine,
+reports these "Execl Throughput" figures (higher the better):
+
+ mainline : 48136.5 lps
+ mainline+fix : 55376.5 lps
+
+which correspond to a 15% speedup.
+
+Moreover, since {cpu_util,capacity_spare}_wake() are not really only
+used from the wakeup path, let's remove this ambiguity by using a better
+matching name: {cpu_util,capacity_spare}_without().
+
+Since we are at that, let's also improve the existing documentation.
+
+Reported-by: Aaron Lu <aaron.lu@intel.com>
+Reported-by: Ye Xiaolong <xiaolong.ye@intel.com>
+Tested-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Patrick Bellasi <patrick.bellasi@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Juri Lelli <juri.lelli@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Morten Rasmussen <morten.rasmussen@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Quentin Perret <quentin.perret@arm.com>
+Cc: Steve Muckle <smuckle@google.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Todd Kjos <tkjos@google.com>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Fixes: f9be3e5961c5 (sched/fair: Use util_est in LB and WU paths)
+Link: https://lore.kernel.org/lkml/20181025093100.GB13236@e110439-lin/
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 62 +++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 48 insertions(+), 14 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 908c9cdae2f0..1162552dc3cc 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5672,11 +5672,11 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p,
+ return target;
+ }
+
+-static unsigned long cpu_util_wake(int cpu, struct task_struct *p);
++static unsigned long cpu_util_without(int cpu, struct task_struct *p);
+
+-static unsigned long capacity_spare_wake(int cpu, struct task_struct *p)
++static unsigned long capacity_spare_without(int cpu, struct task_struct *p)
+ {
+- return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0);
++ return max_t(long, capacity_of(cpu) - cpu_util_without(cpu, p), 0);
+ }
+
+ /*
+@@ -5736,7 +5736,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p,
+
+ avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs);
+
+- spare_cap = capacity_spare_wake(i, p);
++ spare_cap = capacity_spare_without(i, p);
+
+ if (spare_cap > max_spare_cap)
+ max_spare_cap = spare_cap;
+@@ -5887,8 +5887,8 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
+ return prev_cpu;
+
+ /*
+- * We need task's util for capacity_spare_wake, sync it up to prev_cpu's
+- * last_update_time.
++ * We need task's util for capacity_spare_without, sync it up to
++ * prev_cpu's last_update_time.
+ */
+ if (!(sd_flag & SD_BALANCE_FORK))
+ sync_entity_load_avg(&p->se);
+@@ -6214,10 +6214,19 @@ static inline unsigned long cpu_util(int cpu)
+ }
+
+ /*
+- * cpu_util_wake: Compute CPU utilization with any contributions from
+- * the waking task p removed.
++ * cpu_util_without: compute cpu utilization without any contributions from *p
++ * @cpu: the CPU which utilization is requested
++ * @p: the task which utilization should be discounted
++ *
++ * The utilization of a CPU is defined by the utilization of tasks currently
++ * enqueued on that CPU as well as tasks which are currently sleeping after an
++ * execution on that CPU.
++ *
++ * This method returns the utilization of the specified CPU by discounting the
++ * utilization of the specified task, whenever the task is currently
++ * contributing to the CPU utilization.
+ */
+-static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
++static unsigned long cpu_util_without(int cpu, struct task_struct *p)
+ {
+ struct cfs_rq *cfs_rq;
+ unsigned int util;
+@@ -6229,7 +6238,7 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ cfs_rq = &cpu_rq(cpu)->cfs;
+ util = READ_ONCE(cfs_rq->avg.util_avg);
+
+- /* Discount task's blocked util from CPU's util */
++ /* Discount task's util from CPU's util */
+ util -= min_t(unsigned int, util, task_util(p));
+
+ /*
+@@ -6238,14 +6247,14 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ * a) if *p is the only task sleeping on this CPU, then:
+ * cpu_util (== task_util) > util_est (== 0)
+ * and thus we return:
+- * cpu_util_wake = (cpu_util - task_util) = 0
++ * cpu_util_without = (cpu_util - task_util) = 0
+ *
+ * b) if other tasks are SLEEPING on this CPU, which is now exiting
+ * IDLE, then:
+ * cpu_util >= task_util
+ * cpu_util > util_est (== 0)
+ * and thus we discount *p's blocked utilization to return:
+- * cpu_util_wake = (cpu_util - task_util) >= 0
++ * cpu_util_without = (cpu_util - task_util) >= 0
+ *
+ * c) if other tasks are RUNNABLE on that CPU and
+ * util_est > cpu_util
+@@ -6258,8 +6267,33 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ * covered by the following code when estimated utilization is
+ * enabled.
+ */
+- if (sched_feat(UTIL_EST))
+- util = max(util, READ_ONCE(cfs_rq->avg.util_est.enqueued));
++ if (sched_feat(UTIL_EST)) {
++ unsigned int estimated =
++ READ_ONCE(cfs_rq->avg.util_est.enqueued);
++
++ /*
++ * Despite the following checks we still have a small window
++ * for a possible race, when an execl's select_task_rq_fair()
++ * races with LB's detach_task():
++ *
++ * detach_task()
++ * p->on_rq = TASK_ON_RQ_MIGRATING;
++ * ---------------------------------- A
++ * deactivate_task() \
++ * dequeue_task() + RaceTime
++ * util_est_dequeue() /
++ * ---------------------------------- B
++ *
++ * The additional check on "current == p" it's required to
++ * properly fix the execl regression and it helps in further
++ * reducing the chances for the above race.
++ */
++ if (unlikely(task_on_rq_queued(p) || current == p)) {
++ estimated -= min_t(unsigned int, estimated,
++ (_task_util_est(p) | UTIL_AVG_UNCHANGED));
++ }
++ util = max(util, estimated);
++ }
+
+ /*
+ * Utilization (estimated) can exceed the CPU capacity, thus let's
+--
+2.17.1
+
--- /dev/null
+From 3194c0ea9509594caa400f9e7b39cb2f80c9ed03 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 26 Oct 2018 15:07:31 +0800
+Subject: scsi: hisi_sas: Remove set but not used variable 'dq_list'
+
+[ Upstream commit e34ff8edcae89922d187425ab0b82e6a039aa371 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/scsi/hisi_sas/hisi_sas_v1_hw.c: In function 'start_delivery_v1_hw':
+drivers/scsi/hisi_sas/hisi_sas_v1_hw.c:907:20: warning:
+ variable 'dq_list' set but not used [-Wunused-but-set-variable]
+
+drivers/scsi/hisi_sas/hisi_sas_v2_hw.c: In function 'start_delivery_v2_hw':
+drivers/scsi/hisi_sas/hisi_sas_v2_hw.c:1671:20: warning:
+ variable 'dq_list' set but not used [-Wunused-but-set-variable]
+
+drivers/scsi/hisi_sas/hisi_sas_v3_hw.c: In function 'start_delivery_v3_hw':
+drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:889:20: warning:
+ variable 'dq_list' set but not used [-Wunused-but-set-variable]
+
+It never used since introduction in commit
+fa222db0b036 ("scsi: hisi_sas: Don't lock DQ for complete task sending")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 --
+ drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 --
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 --
+ 3 files changed, 6 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 8f60f0e04599..410eccf0bc5e 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -904,11 +904,9 @@ static void start_delivery_v1_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index 9c5c5a601332..1c4ea58da1ae 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -1666,11 +1666,9 @@ static void start_delivery_v2_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 08b503e274b8..687ff61bba9f 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -883,11 +883,9 @@ static void start_delivery_v3_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+--
+2.17.1
+
--- /dev/null
+From 085915fb7ced72142d018d5ed0897324377dc448 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 2 Nov 2018 16:35:48 +0100
+Subject: scsi: lpfc: fix remoteport access
+
+[ Upstream commit f8d294324598ec85bea2779512e48c94cbe4d7c6 ]
+
+The addition of a spinlock in lpfc_debugfs_nodelist_data() introduced
+a bug that lets us not skip NULL pointers correctly, as noticed by
+gcc-8:
+
+drivers/scsi/lpfc/lpfc_debugfs.c: In function 'lpfc_debugfs_nodelist_data.constprop':
+drivers/scsi/lpfc/lpfc_debugfs.c:728:13: error: 'nrport' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ if (nrport->port_role & FC_PORT_ROLE_NVME_INITIATOR)
+
+This changes the logic back to what it was, while keeping the added
+spinlock.
+
+Fixes: 9e210178267b ("scsi: lpfc: Synchronize access to remoteport via rport")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index aec5b10a8c85..ca6c3982548d 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -700,6 +700,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ rport = lpfc_ndlp_get_nrport(ndlp);
+ if (rport)
+ nrport = rport->remoteport;
++ else
++ nrport = NULL;
+ spin_unlock(&phba->hbalock);
+ if (!nrport)
+ continue;
+--
+2.17.1
+
ib-hfi1-eliminate-races-in-the-sdma-send-error-path.patch
fsnotify-generalize-handling-of-extra-event-flags.patch
fanotify-fix-handling-of-events-on-child-sub-directory.patch
+pinctrl-meson-fix-pinconf-bias-disable.patch
+pinctrl-meson-fix-gxbb-ao-pull-register-bits.patch
+pinctrl-meson-fix-gxl-ao-pull-register-bits.patch
+pinctrl-meson-fix-meson8-ao-pull-register-bits.patch
+pinctrl-meson-fix-meson8b-ao-pull-register-bits.patch
+tools-testing-nvdimm-fix-the-array-size-for-dimm-dev.patch
+scsi-lpfc-fix-remoteport-access.patch
+scsi-hisi_sas-remove-set-but-not-used-variable-dq_li.patch
+kvm-ppc-move-and-undef-trace_include_path-file.patch
+cpufreq-imx6q-add-return-value-check-for-voltage-sca.patch
+rtc-cmos-do-not-export-alarm-rtc_ops-when-we-do-not-.patch
+rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch
+crypto-simd-correctly-take-reqsize-of-wrapped-skciph.patch
+floppy-fix-race-condition-in-__floppy_read_block_0.patch
+powerpc-io-fix-the-io-workarounds-code-to-work-with-.patch
+sched-fair-fix-cpu_util_wake-for-execl-type-workload.patch
+perf-x86-intel-uncore-add-more-imc-pci-ids-for-kabyl.patch
+arm-make-lookup_processor_type-non-__init.patch
+arm-clean-up-per-processor-check_bugs-method-call.patch
+arm-add-proc_vtable-and-proc_table-macros.patch
+arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch
+block-copy-ioprio-in-__bio_clone_fast-and-bounce.patch
+sunrpc-fix-a-bogus-get-put-in-generic_key_to_expire.patch
+riscv-add-missing-vdso_install-target.patch
+risc-v-silence-some-module-warnings-on-32-bit.patch
+drm-amdgpu-fix-bug-with-ih-ring-setup.patch
+kdb-use-strscpy-with-destination-buffer-size.patch
+nfsv4-fix-an-oops-during-delegation-callbacks.patch
+powerpc-numa-suppress-vphn-is-not-supported-messages.patch
+efi-arm-revert-deferred-unmap-of-early-memmap-mappin.patch
+z3fold-fix-possible-reclaim-races.patch
+mm-memory_hotplug-check-zone_movable-in-has_unmovabl.patch
+tmpfs-make-lseek-seek_data-sek_hole-return-enxio-wit.patch
+mm-page_alloc-check-for-max-order-in-hot-path.patch
--- /dev/null
+From de5279d17f67ec3e1239b07a2d619fd6c71f3acb Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 12 Nov 2018 16:06:51 -0500
+Subject: SUNRPC: Fix a bogus get/put in generic_key_to_expire()
+
+[ Upstream commit e3d5e573a54dabdc0f9f3cb039d799323372b251 ]
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_generic.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
+index f1df9837f1ac..1ac08dcbf85d 100644
+--- a/net/sunrpc/auth_generic.c
++++ b/net/sunrpc/auth_generic.c
+@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred)
+ {
+ struct auth_cred *acred = &container_of(cred, struct generic_cred,
+ gc_base)->acred;
+- bool ret;
+-
+- get_rpccred(cred);
+- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+- put_rpccred(cred);
+-
+- return ret;
++ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+ }
+
+ static const struct rpc_credops generic_credops = {
+--
+2.17.1
+
--- /dev/null
+From e5eac91bd7bafadf9c68353986b7448eb974c3fe Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Fri, 16 Nov 2018 15:08:39 -0800
+Subject: tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative
+ offset
+
+[ Upstream commit 1a413646931cb14442065cfc17561e50f5b5bb44 ]
+
+Other filesystems such as ext4, f2fs and ubifs all return ENXIO when
+lseek (SEEK_DATA or SEEK_HOLE) requests a negative offset.
+
+man 2 lseek says
+
+: EINVAL whence is not valid. Or: the resulting file offset would be
+: negative, or beyond the end of a seekable device.
+:
+: ENXIO whence is SEEK_DATA or SEEK_HOLE, and the file offset is beyond
+: the end of the file.
+
+Make tmpfs return ENXIO under these circumstances as well. After this,
+tmpfs also passes xfstests's generic/448.
+
+[akpm@linux-foundation.org: rewrite changelog]
+Link: http://lkml.kernel.org/r/1540434176-14349-1-git-send-email-yuyufen@huawei.com
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: William Kucharski <william.kucharski@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/shmem.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 446942677cd4..38d228a30fdc 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2610,9 +2610,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)
+ inode_lock(inode);
+ /* We're holding i_mutex so we can access i_size directly */
+
+- if (offset < 0)
+- offset = -EINVAL;
+- else if (offset >= inode->i_size)
++ if (offset < 0 || offset >= inode->i_size)
+ offset = -ENXIO;
+ else {
+ start = offset >> PAGE_SHIFT;
+--
+2.17.1
+
--- /dev/null
+From 74e230a03ae7a8870fded254f079f5987dbfc854 Mon Sep 17 00:00:00 2001
+From: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Date: Tue, 30 Oct 2018 21:50:25 -0400
+Subject: tools/testing/nvdimm: Fix the array size for dimm devices.
+
+[ Upstream commit af31b04b67f4fd7f639fd465a507c154c46fc9fb ]
+
+KASAN reports following global out of bounds access while
+nfit_test is being loaded. The out of bound access happens
+the following reference to dimm_fail_cmd_flags[dimm]. 'dimm' is
+over than the index value, NUM_DCR (==5).
+
+ static int override_return_code(int dimm, unsigned int func, int rc)
+ {
+ if ((1 << func) & dimm_fail_cmd_flags[dimm]) {
+
+dimm_fail_cmd_flags[] definition:
+ static unsigned long dimm_fail_cmd_flags[NUM_DCR];
+
+'dimm' is the return value of get_dimm(), and get_dimm() returns
+the index of handle[] array. The handle[] has 7 index. Let's use
+ARRAY_SIZE(handle) as the array size.
+
+KASAN report:
+
+==================================================================
+BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x47bb/0x55b0 [nfit_test]
+Read of size 8 at addr ffffffffc10cbbe8 by task kworker/u41:0/8
+...
+Call Trace:
+ dump_stack+0xea/0x1b0
+ ? dump_stack_print_info.cold.0+0x1b/0x1b
+ ? kmsg_dump_rewind_nolock+0xd9/0xd9
+ print_address_description+0x65/0x22e
+ ? nfit_test_ctl+0x47bb/0x55b0 [nfit_test]
+ kasan_report.cold.6+0x92/0x1a6
+ nfit_test_ctl+0x47bb/0x55b0 [nfit_test]
+...
+The buggy address belongs to the variable:
+ dimm_fail_cmd_flags+0x28/0xffffffffffffa440 [nfit_test]
+==================================================================
+
+Fixes: 39611e83a28c ("tools/testing/nvdimm: Make DSM failure code injection...")
+Signed-off-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/nvdimm/test/nfit.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index cffc2c5a778d..ec50d2a95076 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -139,8 +139,8 @@ static u32 handle[] = {
+ [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
+ };
+
+-static unsigned long dimm_fail_cmd_flags[NUM_DCR];
+-static int dimm_fail_cmd_code[NUM_DCR];
++static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)];
++static int dimm_fail_cmd_code[ARRAY_SIZE(handle)];
+
+ static const struct nd_intel_smart smart_def = {
+ .flags = ND_INTEL_SMART_HEALTH_VALID
+@@ -203,7 +203,7 @@ struct nfit_test {
+ unsigned long deadline;
+ spinlock_t lock;
+ } ars_state;
+- struct device *dimm_dev[NUM_DCR];
++ struct device *dimm_dev[ARRAY_SIZE(handle)];
+ struct nd_intel_smart *smart;
+ struct nd_intel_smart_threshold *smart_threshold;
+ struct badrange badrange;
+@@ -2678,7 +2678,7 @@ static int nfit_test_probe(struct platform_device *pdev)
+ u32 nfit_handle = __to_nfit_memdev(nfit_mem)->device_handle;
+ int i;
+
+- for (i = 0; i < NUM_DCR; i++)
++ for (i = 0; i < ARRAY_SIZE(handle); i++)
+ if (nfit_handle == handle[i])
+ dev_set_drvdata(nfit_test->dimm_dev[i],
+ nfit_mem);
+--
+2.17.1
+
--- /dev/null
+From bd5921dcc7ed51eecedc363277bff006dcee255d Mon Sep 17 00:00:00 2001
+From: Vitaly Wool <vitalywool@gmail.com>
+Date: Fri, 16 Nov 2018 15:07:56 -0800
+Subject: z3fold: fix possible reclaim races
+
+[ Upstream commit ca0246bb97c23da9d267c2107c07fb77e38205c9 ]
+
+Reclaim and free can race on an object which is basically fine but in
+order for reclaim to be able to map "freed" object we need to encode
+object length in the handle. handle_to_chunks() is then introduced to
+extract object length from a handle and use it during mapping.
+
+Moreover, to avoid racing on a z3fold "headless" page release, we should
+not try to free that page in z3fold_free() if the reclaim bit is set.
+Also, in the unlikely case of trying to reclaim a page being freed, we
+should not proceed with that page.
+
+While at it, fix the page accounting in reclaim function.
+
+This patch supersedes "[PATCH] z3fold: fix reclaim lock-ups".
+
+Link: http://lkml.kernel.org/r/20181105162225.74e8837d03583a9b707cf559@gmail.com
+Signed-off-by: Vitaly Wool <vitaly.vul@sony.com>
+Signed-off-by: Jongseok Kim <ks77sj@gmail.com>
+Reported-by-by: Jongseok Kim <ks77sj@gmail.com>
+Reviewed-by: Snild Dolkow <snild@sony.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/z3fold.c | 101 ++++++++++++++++++++++++++++++++--------------------
+ 1 file changed, 62 insertions(+), 39 deletions(-)
+
+diff --git a/mm/z3fold.c b/mm/z3fold.c
+index 4b366d181f35..aee9b0b8d907 100644
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -99,6 +99,7 @@ struct z3fold_header {
+ #define NCHUNKS ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT)
+
+ #define BUDDY_MASK (0x3)
++#define BUDDY_SHIFT 2
+
+ /**
+ * struct z3fold_pool - stores metadata for each z3fold pool
+@@ -145,7 +146,7 @@ enum z3fold_page_flags {
+ MIDDLE_CHUNK_MAPPED,
+ NEEDS_COMPACTING,
+ PAGE_STALE,
+- UNDER_RECLAIM
++ PAGE_CLAIMED, /* by either reclaim or free */
+ };
+
+ /*****************
+@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page,
+ clear_bit(MIDDLE_CHUNK_MAPPED, &page->private);
+ clear_bit(NEEDS_COMPACTING, &page->private);
+ clear_bit(PAGE_STALE, &page->private);
+- clear_bit(UNDER_RECLAIM, &page->private);
++ clear_bit(PAGE_CLAIMED, &page->private);
+
+ spin_lock_init(&zhdr->page_lock);
+ kref_init(&zhdr->refcount);
+@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)
+ unsigned long handle;
+
+ handle = (unsigned long)zhdr;
+- if (bud != HEADLESS)
+- handle += (bud + zhdr->first_num) & BUDDY_MASK;
++ if (bud != HEADLESS) {
++ handle |= (bud + zhdr->first_num) & BUDDY_MASK;
++ if (bud == LAST)
++ handle |= (zhdr->last_chunks << BUDDY_SHIFT);
++ }
+ return handle;
+ }
+
+@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle)
+ return (struct z3fold_header *)(handle & PAGE_MASK);
+ }
+
++/* only for LAST bud, returns zero otherwise */
++static unsigned short handle_to_chunks(unsigned long handle)
++{
++ return (handle & ~PAGE_MASK) >> BUDDY_SHIFT;
++}
++
+ /*
+ * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle
+ * but that doesn't matter. because the masking will result in the
+@@ -720,37 +730,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ page = virt_to_page(zhdr);
+
+ if (test_bit(PAGE_HEADLESS, &page->private)) {
+- /* HEADLESS page stored */
+- bud = HEADLESS;
+- } else {
+- z3fold_page_lock(zhdr);
+- bud = handle_to_buddy(handle);
+-
+- switch (bud) {
+- case FIRST:
+- zhdr->first_chunks = 0;
+- break;
+- case MIDDLE:
+- zhdr->middle_chunks = 0;
+- zhdr->start_middle = 0;
+- break;
+- case LAST:
+- zhdr->last_chunks = 0;
+- break;
+- default:
+- pr_err("%s: unknown bud %d\n", __func__, bud);
+- WARN_ON(1);
+- z3fold_page_unlock(zhdr);
+- return;
++ /* if a headless page is under reclaim, just leave.
++ * NB: we use test_and_set_bit for a reason: if the bit
++ * has not been set before, we release this page
++ * immediately so we don't care about its value any more.
++ */
++ if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) {
++ spin_lock(&pool->lock);
++ list_del(&page->lru);
++ spin_unlock(&pool->lock);
++ free_z3fold_page(page);
++ atomic64_dec(&pool->pages_nr);
+ }
++ return;
+ }
+
+- if (bud == HEADLESS) {
+- spin_lock(&pool->lock);
+- list_del(&page->lru);
+- spin_unlock(&pool->lock);
+- free_z3fold_page(page);
+- atomic64_dec(&pool->pages_nr);
++ /* Non-headless case */
++ z3fold_page_lock(zhdr);
++ bud = handle_to_buddy(handle);
++
++ switch (bud) {
++ case FIRST:
++ zhdr->first_chunks = 0;
++ break;
++ case MIDDLE:
++ zhdr->middle_chunks = 0;
++ break;
++ case LAST:
++ zhdr->last_chunks = 0;
++ break;
++ default:
++ pr_err("%s: unknown bud %d\n", __func__, bud);
++ WARN_ON(1);
++ z3fold_page_unlock(zhdr);
+ return;
+ }
+
+@@ -758,7 +770,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ atomic64_dec(&pool->pages_nr);
+ return;
+ }
+- if (test_bit(UNDER_RECLAIM, &page->private)) {
++ if (test_bit(PAGE_CLAIMED, &page->private)) {
+ z3fold_page_unlock(zhdr);
+ return;
+ }
+@@ -836,20 +848,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
+ }
+ list_for_each_prev(pos, &pool->lru) {
+ page = list_entry(pos, struct page, lru);
++
++ /* this bit could have been set by free, in which case
++ * we pass over to the next page in the pool.
++ */
++ if (test_and_set_bit(PAGE_CLAIMED, &page->private))
++ continue;
++
++ zhdr = page_address(page);
+ if (test_bit(PAGE_HEADLESS, &page->private))
+- /* candidate found */
+ break;
+
+- zhdr = page_address(page);
+- if (!z3fold_page_trylock(zhdr))
++ if (!z3fold_page_trylock(zhdr)) {
++ zhdr = NULL;
+ continue; /* can't evict at this point */
++ }
+ kref_get(&zhdr->refcount);
+ list_del_init(&zhdr->buddy);
+ zhdr->cpu = -1;
+- set_bit(UNDER_RECLAIM, &page->private);
+ break;
+ }
+
++ if (!zhdr)
++ break;
++
+ list_del_init(&page->lru);
+ spin_unlock(&pool->lock);
+
+@@ -898,6 +920,7 @@ next:
+ if (test_bit(PAGE_HEADLESS, &page->private)) {
+ if (ret == 0) {
+ free_z3fold_page(page);
++ atomic64_dec(&pool->pages_nr);
+ return 0;
+ }
+ spin_lock(&pool->lock);
+@@ -905,7 +928,7 @@ next:
+ spin_unlock(&pool->lock);
+ } else {
+ z3fold_page_lock(zhdr);
+- clear_bit(UNDER_RECLAIM, &page->private);
++ clear_bit(PAGE_CLAIMED, &page->private);
+ if (kref_put(&zhdr->refcount,
+ release_z3fold_page_locked)) {
+ atomic64_dec(&pool->pages_nr);
+@@ -964,7 +987,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle)
+ set_bit(MIDDLE_CHUNK_MAPPED, &page->private);
+ break;
+ case LAST:
+- addr += PAGE_SIZE - (zhdr->last_chunks << CHUNK_SHIFT);
++ addr += PAGE_SIZE - (handle_to_chunks(handle) << CHUNK_SHIFT);
+ break;
+ default:
+ pr_err("unknown buddy id %d\n", buddy);
+--
+2.17.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
