--- /dev/null
+From 40ccf75c5e86711ecf7b145b0395de8249af4282 Mon Sep 17 00:00:00 2001
+From: Chao Fan <fanc.fnst@cn.fujitsu.com>
+Date: Wed, 26 Dec 2018 11:34:50 +0800
+Subject: ACPI: NUMA: Use correct type for printing addresses on i386-PAE
+
+[ Upstream commit b9ced18acf68dffebe6888c7ec765a2b1db7a039 ]
+
+The addresses of NUMA nodes are not printed correctly on i386-PAE
+which is misleading.
+
+Here is a debian9-32bit with PAE in a QEMU guest having more than 4G
+of memory:
+
+qemu-system-i386 \
+-hda /var/lib/libvirt/images/debian32.qcow2 \
+-m 5G \
+-enable-kvm \
+-smp 10 \
+-numa node,mem=512M,nodeid=0,cpus=0 \
+-numa node,mem=512M,nodeid=1,cpus=1 \
+-numa node,mem=512M,nodeid=2,cpus=2 \
+-numa node,mem=512M,nodeid=3,cpus=3 \
+-numa node,mem=512M,nodeid=4,cpus=4 \
+-numa node,mem=512M,nodeid=5,cpus=5 \
+-numa node,mem=512M,nodeid=6,cpus=6 \
+-numa node,mem=512M,nodeid=7,cpus=7 \
+-numa node,mem=512M,nodeid=8,cpus=8 \
+-numa node,mem=512M,nodeid=9,cpus=9 \
+-serial stdio
+
+Because of the wrong value type, it prints as below:
+
+[ 0.021049] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled
+[ 0.021740] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled
+[ 0.022425] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled
+[ 0.023092] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled
+[ 0.023764] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled
+[ 0.024431] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled
+[ 0.025104] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled
+[ 0.025791] ACPI: SRAT Memory (0x0 length 0x20000000) in proximity domain 6 enabled
+[ 0.026412] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 7 enabled
+[ 0.027118] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 8 enabled
+[ 0.027802] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 9 enabled
+
+The upper half of the start address of the NUMA domains between 6
+and 9 inclusive was cut, so the printed values are incorrect.
+
+Fix the value type, to get the correct values in the log as follows:
+
+[ 0.023698] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled
+[ 0.024325] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled
+[ 0.024981] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled
+[ 0.025659] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled
+[ 0.026317] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled
+[ 0.026980] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled
+[ 0.027635] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled
+[ 0.028311] ACPI: SRAT Memory (0x100000000 length 0x20000000) in proximity domain 6 enabled
+[ 0.028985] ACPI: SRAT Memory (0x120000000 length 0x20000000) in proximity domain 7 enabled
+[ 0.029667] ACPI: SRAT Memory (0x140000000 length 0x20000000) in proximity domain 8 enabled
+[ 0.030334] ACPI: SRAT Memory (0x160000000 length 0x20000000) in proximity domain 9 enabled
+
+Signed-off-by: Chao Fan <fanc.fnst@cn.fujitsu.com>
+[ rjw: Subject & changelog ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/numa.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
+index 17b518cb787c..0ea065c6725a 100644
+--- a/drivers/acpi/numa.c
++++ b/drivers/acpi/numa.c
+@@ -147,9 +147,9 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)
+ {
+ struct acpi_srat_mem_affinity *p =
+ (struct acpi_srat_mem_affinity *)header;
+- pr_debug("SRAT Memory (0x%lx length 0x%lx) in proximity domain %d %s%s%s\n",
+- (unsigned long)p->base_address,
+- (unsigned long)p->length,
++ pr_debug("SRAT Memory (0x%llx length 0x%llx) in proximity domain %d %s%s%s\n",
++ (unsigned long long)p->base_address,
++ (unsigned long long)p->length,
+ p->proximity_domain,
+ (p->flags & ACPI_SRAT_MEM_ENABLED) ?
+ "enabled" : "disabled",
+--
+2.19.1
+
--- /dev/null
+From 32480dcf2e4a7a4023539021d10276a60062dcbd Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:15 -0500
+Subject: ARM: 8789/1: signal: copy registers using __copy_to_user()
+
+Commit 5ca451cf6ed04443774bbb7ee45332dafa42e99f upstream.
+
+When saving the ARM integer registers, use __copy_to_user() to
+copy them into user signal frame, rather than __put_user_error().
+This has the benefit of disabling/enabling PAN once for the whole copy
+intead of once per write.
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/signal.c | 49 ++++++++++++++++++++++------------------
+ 1 file changed, 27 insertions(+), 22 deletions(-)
+
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 6bee5c9b1133..fbb325ff8acc 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -256,30 +256,35 @@ static int
+ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set)
+ {
+ struct aux_sigframe __user *aux;
++ struct sigcontext context;
+ int err = 0;
+
+- __put_user_error(regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err);
+- __put_user_error(regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err);
+- __put_user_error(regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err);
+- __put_user_error(regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err);
+- __put_user_error(regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err);
+- __put_user_error(regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err);
+- __put_user_error(regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err);
+- __put_user_error(regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err);
+- __put_user_error(regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err);
+- __put_user_error(regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err);
+- __put_user_error(regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err);
+- __put_user_error(regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err);
+- __put_user_error(regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err);
+- __put_user_error(regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err);
+- __put_user_error(regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err);
+- __put_user_error(regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err);
+- __put_user_error(regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err);
+-
+- __put_user_error(current->thread.trap_no, &sf->uc.uc_mcontext.trap_no, err);
+- __put_user_error(current->thread.error_code, &sf->uc.uc_mcontext.error_code, err);
+- __put_user_error(current->thread.address, &sf->uc.uc_mcontext.fault_address, err);
+- __put_user_error(set->sig[0], &sf->uc.uc_mcontext.oldmask, err);
++ context = (struct sigcontext) {
++ .arm_r0 = regs->ARM_r0,
++ .arm_r1 = regs->ARM_r1,
++ .arm_r2 = regs->ARM_r2,
++ .arm_r3 = regs->ARM_r3,
++ .arm_r4 = regs->ARM_r4,
++ .arm_r5 = regs->ARM_r5,
++ .arm_r6 = regs->ARM_r6,
++ .arm_r7 = regs->ARM_r7,
++ .arm_r8 = regs->ARM_r8,
++ .arm_r9 = regs->ARM_r9,
++ .arm_r10 = regs->ARM_r10,
++ .arm_fp = regs->ARM_fp,
++ .arm_ip = regs->ARM_ip,
++ .arm_sp = regs->ARM_sp,
++ .arm_lr = regs->ARM_lr,
++ .arm_pc = regs->ARM_pc,
++ .arm_cpsr = regs->ARM_cpsr,
++
++ .trap_no = current->thread.trap_no,
++ .error_code = current->thread.error_code,
++ .fault_address = current->thread.address,
++ .oldmask = set->sig[0],
++ };
++
++ err |= __copy_to_user(&sf->uc.uc_mcontext, &context, sizeof(context));
+
+ err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(*set));
+
+--
+2.19.1
+
--- /dev/null
+From 5ec7c2c5587c0f10997417e87808621c7dfc2fd6 Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:16 -0500
+Subject: ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
+
+Commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 upstream.
+
+Use __copy_to_user() rather than __put_user_error() for individual
+members when saving VFP state.
+This has the benefit of disabling/enabling PAN once per copied struct
+intead of once per write.
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/thread_info.h | 4 ++--
+ arch/arm/kernel/signal.c | 13 +++++++------
+ arch/arm/vfp/vfpmodule.c | 20 ++++++++------------
+ 3 files changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
+index 57d2ad9c75ca..df8420672c7e 100644
+--- a/arch/arm/include/asm/thread_info.h
++++ b/arch/arm/include/asm/thread_info.h
+@@ -124,8 +124,8 @@ extern void vfp_flush_hwstate(struct thread_info *);
+ struct user_vfp;
+ struct user_vfp_exc;
+
+-extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *,
+- struct user_vfp_exc __user *);
++extern int vfp_preserve_user_clear_hwstate(struct user_vfp *,
++ struct user_vfp_exc *);
+ extern int vfp_restore_user_hwstate(struct user_vfp *,
+ struct user_vfp_exc *);
+ #endif
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index fbb325ff8acc..135b1a8e12eb 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -94,17 +94,18 @@ static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame)
+
+ static int preserve_vfp_context(struct vfp_sigframe __user *frame)
+ {
+- const unsigned long magic = VFP_MAGIC;
+- const unsigned long size = VFP_STORAGE_SIZE;
++ struct vfp_sigframe kframe;
+ int err = 0;
+
+- __put_user_error(magic, &frame->magic, err);
+- __put_user_error(size, &frame->size, err);
++ memset(&kframe, 0, sizeof(kframe));
++ kframe.magic = VFP_MAGIC;
++ kframe.size = VFP_STORAGE_SIZE;
+
++ err = vfp_preserve_user_clear_hwstate(&kframe.ufp, &kframe.ufp_exc);
+ if (err)
+- return -EFAULT;
++ return err;
+
+- return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc);
++ return __copy_to_user(frame, &kframe, sizeof(kframe));
+ }
+
+ static int restore_vfp_context(struct vfp_sigframe __user *auxp)
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index 8e5e97989fda..df3fa52c0aa3 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -554,12 +554,11 @@ void vfp_flush_hwstate(struct thread_info *thread)
+ * Save the current VFP state into the provided structures and prepare
+ * for entry into a new function (signal handler).
+ */
+-int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
+- struct user_vfp_exc __user *ufp_exc)
++int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp,
++ struct user_vfp_exc *ufp_exc)
+ {
+ struct thread_info *thread = current_thread_info();
+ struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+- int err = 0;
+
+ /* Ensure that the saved hwstate is up-to-date. */
+ vfp_sync_hwstate(thread);
+@@ -568,22 +567,19 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
+ * Copy the floating point registers. There can be unused
+ * registers see asm/hwcap.h for details.
+ */
+- err |= __copy_to_user(&ufp->fpregs, &hwstate->fpregs,
+- sizeof(hwstate->fpregs));
++ memcpy(&ufp->fpregs, &hwstate->fpregs, sizeof(hwstate->fpregs));
++
+ /*
+ * Copy the status and control register.
+ */
+- __put_user_error(hwstate->fpscr, &ufp->fpscr, err);
++ ufp->fpscr = hwstate->fpscr;
+
+ /*
+ * Copy the exception registers.
+ */
+- __put_user_error(hwstate->fpexc, &ufp_exc->fpexc, err);
+- __put_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
+- __put_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+-
+- if (err)
+- return -EFAULT;
++ ufp_exc->fpexc = hwstate->fpexc;
++ ufp_exc->fpinst = hwstate->fpinst;
++ ufp_exc->fpinst2 = ufp_exc->fpinst2;
+
+ /* Ensure that VFP is disabled. */
+ vfp_flush_hwstate(thread);
+--
+2.19.1
+
--- /dev/null
+From 75ba865956435aaefbb507425c75ad330d78f93b Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:17 -0500
+Subject: ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
+
+Commit 319508902600c2688e057750148487996396e9ca upstream.
+
+Copy events to user using __copy_to_user() rather than copy members of
+individually with __put_user_error().
+This has the benefit of disabling/enabling PAN once per event intead of
+once per event member.
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/sys_oabi-compat.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
+index 640748e27035..d844c5c9364b 100644
+--- a/arch/arm/kernel/sys_oabi-compat.c
++++ b/arch/arm/kernel/sys_oabi-compat.c
+@@ -276,6 +276,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
+ int maxevents, int timeout)
+ {
+ struct epoll_event *kbuf;
++ struct oabi_epoll_event e;
+ mm_segment_t fs;
+ long ret, err, i;
+
+@@ -294,8 +295,11 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
+ set_fs(fs);
+ err = 0;
+ for (i = 0; i < ret; i++) {
+- __put_user_error(kbuf[i].events, &events->events, err);
+- __put_user_error(kbuf[i].data, &events->data, err);
++ e.events = kbuf[i].events;
++ e.data = kbuf[i].data;
++ err = __copy_to_user(events, &e, sizeof(e));
++ if (err)
++ break;
+ events++;
+ }
+ kfree(kbuf);
+--
+2.19.1
+
--- /dev/null
+From c7f1bdd2005c33116c9bba9728a5cc7e3f17068a Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:18 -0500
+Subject: ARM: 8793/1: signal: replace __put_user_error with __put_user
+
+Commit 18ea66bd6e7a95bdc598223d72757190916af28b upstream.
+
+With Spectre-v1.1 mitigations, __put_user_error is pointless. In an attempt
+to remove it, replace its references in frame setups with __put_user.
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/signal.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index 135b1a8e12eb..0a066f03b5ec 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -302,7 +302,7 @@ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set)
+ if (err == 0)
+ err |= preserve_vfp_context(&aux->vfp);
+ #endif
+- __put_user_error(0, &aux->end_magic, err);
++ err |= __put_user(0, &aux->end_magic);
+
+ return err;
+ }
+@@ -434,7 +434,7 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
+ /*
+ * Set uc.uc_flags to a value which sc.trap_no would never have.
+ */
+- __put_user_error(0x5ac3c35a, &frame->uc.uc_flags, err);
++ err = __put_user(0x5ac3c35a, &frame->uc.uc_flags);
+
+ err |= setup_sigframe(frame, regs, set);
+ if (err == 0)
+@@ -454,8 +454,8 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)
+
+ err |= copy_siginfo_to_user(&frame->info, &ksig->info);
+
+- __put_user_error(0, &frame->sig.uc.uc_flags, err);
+- __put_user_error(NULL, &frame->sig.uc.uc_link, err);
++ err |= __put_user(0, &frame->sig.uc.uc_flags);
++ err |= __put_user(NULL, &frame->sig.uc.uc_link);
+
+ err |= __save_altstack(&frame->sig.uc.uc_stack, regs->ARM_sp);
+ err |= setup_sigframe(&frame->sig, regs, set);
+--
+2.19.1
+
--- /dev/null
+From c7038260cec939903b25278591deb9ec5d77158c Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:19 -0500
+Subject: ARM: 8794/1: uaccess: Prevent speculative use of the current
+ addr_limit
+
+Commit 621afc677465db231662ed126ae1f355bf8eac47 upstream.
+
+A mispredicted conditional call to set_fs could result in the wrong
+addr_limit being forwarded under speculation to a subsequent access_ok
+check, potentially forming part of a spectre-v1 attack using uaccess
+routines.
+
+This patch prevents this forwarding from taking place, but putting heavy
+barriers in set_fs after writing the addr_limit.
+
+Porting commit c2f0ad4fc089cff8 ("arm64: uaccess: Prevent speculative use
+of the current addr_limit").
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index 7b17460127fd..9ae888775743 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -99,6 +99,14 @@ extern int __put_user_bad(void);
+ static inline void set_fs(mm_segment_t fs)
+ {
+ current_thread_info()->addr_limit = fs;
++
++ /*
++ * Prevent a mispredicted conditional call to set_fs from forwarding
++ * the wrong address limit to access_ok under speculation.
++ */
++ dsb(nsh);
++ isb();
++
+ modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 9eff03c3396b398733cb9dae01f724d4becbc1d9 Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:20 -0500
+Subject: ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
+
+Commit e3aa6243434fd9a82e84bb79ab1abd14f2d9a5a7 upstream.
+
+When Spectre mitigation is required, __put_user() needs to include
+check_uaccess. This is already the case for put_user(), so just make
+__put_user() an alias of put_user().
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess.h | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index 9ae888775743..b61acd62cffb 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -400,6 +400,14 @@ do { \
+ __pu_err; \
+ })
+
++#ifdef CONFIG_CPU_SPECTRE
++/*
++ * When mitigating Spectre variant 1.1, all accessors need to include
++ * verification of the address space.
++ */
++#define __put_user(x, ptr) put_user(x, ptr)
++
++#else
+ #define __put_user(x, ptr) \
+ ({ \
+ long __pu_err = 0; \
+@@ -407,12 +415,6 @@ do { \
+ __pu_err; \
+ })
+
+-#define __put_user_error(x, ptr, err) \
+-({ \
+- __put_user_switch((x), (ptr), (err), __put_user_nocheck); \
+- (void) 0; \
+-})
+-
+ #define __put_user_nocheck(x, __pu_ptr, __err, __size) \
+ do { \
+ unsigned long __pu_addr = (unsigned long)__pu_ptr; \
+@@ -492,6 +494,7 @@ do { \
+ : "r" (x), "i" (-EFAULT) \
+ : "cc")
+
++#endif /* !CONFIG_CPU_SPECTRE */
+
+ #ifdef CONFIG_MMU
+ extern unsigned long __must_check
+--
+2.19.1
+
--- /dev/null
+From fd174ccea0b27bd10e9c1072d7f48f752e497c2f Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:21 -0500
+Subject: ARM: 8796/1: spectre-v1,v1.1: provide helpers for address
+ sanitization
+
+Commit afaf6838f4bc896a711180b702b388b8cfa638fc upstream.
+
+Introduce C and asm helpers to sanitize user address, taking the
+address range they target into account.
+
+Use asm helper for existing sanitization in __copy_from_user().
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 11 +++++++++++
+ arch/arm/include/asm/uaccess.h | 26 ++++++++++++++++++++++++++
+ arch/arm/lib/copy_from_user.S | 6 +-----
+ 3 files changed, 38 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index e616f61f859d..7d727506096f 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -465,6 +465,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ #endif
+ .endm
+
++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
++#ifdef CONFIG_CPU_SPECTRE
++ sub \tmp, \limit, #1
++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
++ subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ movlo \addr, #0 @ if (tmp < 0) addr = NULL
++ csdb
++#endif
++ .endm
++
+ .macro uaccess_disable, tmp, isb=1
+ #ifdef CONFIG_CPU_SW_DOMAIN_PAN
+ /*
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index b61acd62cffb..0f6c6b873bc5 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -129,6 +129,32 @@ static inline void set_fs(mm_segment_t fs)
+ #define __inttype(x) \
+ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+
++/*
++ * Sanitise a uaccess pointer such that it becomes NULL if addr+size
++ * is above the current addr_limit.
++ */
++#define uaccess_mask_range_ptr(ptr, size) \
++ ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size))
++static inline void __user *__uaccess_mask_range_ptr(const void __user *ptr,
++ size_t size)
++{
++ void __user *safe_ptr = (void __user *)ptr;
++ unsigned long tmp;
++
++ asm volatile(
++ " sub %1, %3, #1\n"
++ " subs %1, %1, %0\n"
++ " addhs %1, %1, #1\n"
++ " subhss %1, %1, %2\n"
++ " movlo %0, #0\n"
++ : "+r" (safe_ptr), "=&r" (tmp)
++ : "r" (size), "r" (current_thread_info()->addr_limit)
++ : "cc");
++
++ csdb();
++ return safe_ptr;
++}
++
+ /*
+ * Single-value transfer routines. They automatically use the right
+ * size if we just have the right pointer type. Note that the functions
+diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
+index a826df3d3814..6709a8d33963 100644
+--- a/arch/arm/lib/copy_from_user.S
++++ b/arch/arm/lib/copy_from_user.S
+@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user)
+ #ifdef CONFIG_CPU_SPECTRE
+ get_thread_info r3
+ ldr r3, [r3, #TI_ADDR_LIMIT]
+- adds ip, r1, r2 @ ip=addr+size
+- sub r3, r3, #1 @ addr_limit - 1
+- cmpcc ip, r3 @ if (addr+size > addr_limit - 1)
+- movcs r1, #0 @ addr = NULL
+- csdb
++ uaccess_mask_range_ptr r1, r2, r3, ip
+ #endif
+
+ #include "copy_template.S"
+--
+2.19.1
+
--- /dev/null
+From 30de8027d1730c14572e2f01d978e38847b5576e Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:22 -0500
+Subject: ARM: 8797/1: spectre-v1.1: harden __copy_to_user
+
+Commit a1d09e074250fad24f1b993f327b18cc6812eb7a upstream.
+
+Sanitize user pointer given to __copy_to_user, both for standard version
+and memcopy version of the user accessor.
+
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/lib/copy_to_user.S | 6 +++++-
+ arch/arm/lib/uaccess_with_memcpy.c | 3 ++-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
+index caf5019d8161..970abe521197 100644
+--- a/arch/arm/lib/copy_to_user.S
++++ b/arch/arm/lib/copy_to_user.S
+@@ -94,6 +94,11 @@
+
+ ENTRY(__copy_to_user_std)
+ WEAK(arm_copy_to_user)
++#ifdef CONFIG_CPU_SPECTRE
++ get_thread_info r3
++ ldr r3, [r3, #TI_ADDR_LIMIT]
++ uaccess_mask_range_ptr r0, r2, r3, ip
++#endif
+
+ #include "copy_template.S"
+
+@@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std)
+ rsb r0, r0, r2
+ copy_abort_end
+ .popsection
+-
+diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
+index 6bd1089b07e0..f598d792bace 100644
+--- a/arch/arm/lib/uaccess_with_memcpy.c
++++ b/arch/arm/lib/uaccess_with_memcpy.c
+@@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n)
+ n = __copy_to_user_std(to, from, n);
+ uaccess_restore(ua_flags);
+ } else {
+- n = __copy_to_user_memcpy(to, from, n);
++ n = __copy_to_user_memcpy(uaccess_mask_range_ptr(to, n),
++ from, n);
+ }
+ return n;
+ }
+--
+2.19.1
+
--- /dev/null
+From 14a2655ee86b4ae9f61da1e335beb8e09bf2526d Mon Sep 17 00:00:00 2001
+From: Julien Thierry <julien.thierry@arm.com>
+Date: Thu, 14 Feb 2019 09:49:23 -0500
+Subject: ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
+
+Commit 5df7a99bdd0de4a0480320264c44c04543c29d5a upstream.
+
+In vfp_preserve_user_clear_hwstate, ufp_exc->fpinst2 gets assigned to
+itself. It should actually be hwstate->fpinst2 that gets assigned to the
+ufp_exc field.
+
+Fixes commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 ("ARM: 8791/1:
+vfp: use __copy_to_user() when saving VFP state").
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/vfp/vfpmodule.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index df3fa52c0aa3..00dd8cf36632 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -579,7 +579,7 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp,
+ */
+ ufp_exc->fpexc = hwstate->fpexc;
+ ufp_exc->fpinst = hwstate->fpinst;
+- ufp_exc->fpinst2 = ufp_exc->fpinst2;
++ ufp_exc->fpinst2 = hwstate->fpinst2;
+
+ /* Ensure that VFP is disabled. */
+ vfp_flush_hwstate(thread);
+--
+2.19.1
+
--- /dev/null
+From 129aa4bf60ed14fabb0775cadb548e9c3df1aa15 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:27 -0500
+Subject: ARM: add PROC_VTABLE and PROC_TABLE macros
+
+Commit e209950fdd065d2cc46e6338e47e52841b830cba upstream.
+
+Allow the way we access members of the processor vtable to be changed
+at compile time. We will need to move to per-CPU vtables to fix the
+Spectre variant 2 issues on big.Little systems.
+
+However, we have a couple of calls that do not need the vtable
+treatment, and indeed cause a kernel warning due to the (later) use
+of smp_processor_id(), so also introduce the PROC_TABLE macro for
+these which always use CPU 0's function pointers.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/proc-fns.h | 39 ++++++++++++++++++++++-----------
+ arch/arm/kernel/setup.c | 4 +---
+ 2 files changed, 27 insertions(+), 16 deletions(-)
+
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index 19939e88efca..a1a71b068edc 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -23,7 +23,7 @@ struct mm_struct;
+ /*
+ * Don't change this structure - ASM code relies on it.
+ */
+-extern struct processor {
++struct processor {
+ /* MISC
+ * get data abort address/flags
+ */
+@@ -79,9 +79,13 @@ extern struct processor {
+ unsigned int suspend_size;
+ void (*do_suspend)(void *);
+ void (*do_resume)(void *);
+-} processor;
++};
+
+ #ifndef MULTI_CPU
++static inline void init_proc_vtable(const struct processor *p)
++{
++}
++
+ extern void cpu_proc_init(void);
+ extern void cpu_proc_fin(void);
+ extern int cpu_do_idle(void);
+@@ -98,18 +102,27 @@ extern void cpu_reset(unsigned long addr) __attribute__((noreturn));
+ extern void cpu_do_suspend(void *);
+ extern void cpu_do_resume(void *);
+ #else
+-#define cpu_proc_init processor._proc_init
+-#define cpu_check_bugs processor.check_bugs
+-#define cpu_proc_fin processor._proc_fin
+-#define cpu_reset processor.reset
+-#define cpu_do_idle processor._do_idle
+-#define cpu_dcache_clean_area processor.dcache_clean_area
+-#define cpu_set_pte_ext processor.set_pte_ext
+-#define cpu_do_switch_mm processor.switch_mm
+
+-/* These three are private to arch/arm/kernel/suspend.c */
+-#define cpu_do_suspend processor.do_suspend
+-#define cpu_do_resume processor.do_resume
++extern struct processor processor;
++#define PROC_VTABLE(f) processor.f
++#define PROC_TABLE(f) processor.f
++static inline void init_proc_vtable(const struct processor *p)
++{
++ processor = *p;
++}
++
++#define cpu_proc_init PROC_VTABLE(_proc_init)
++#define cpu_check_bugs PROC_VTABLE(check_bugs)
++#define cpu_proc_fin PROC_VTABLE(_proc_fin)
++#define cpu_reset PROC_VTABLE(reset)
++#define cpu_do_idle PROC_VTABLE(_do_idle)
++#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area)
++#define cpu_set_pte_ext PROC_TABLE(set_pte_ext)
++#define cpu_do_switch_mm PROC_VTABLE(switch_mm)
++
++/* These two are private to arch/arm/kernel/suspend.c */
++#define cpu_do_suspend PROC_VTABLE(do_suspend)
++#define cpu_do_resume PROC_VTABLE(do_resume)
+ #endif
+
+ extern void cpu_resume(void);
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index 8d5c3a118abe..2eebb67fa08b 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -693,9 +693,7 @@ static void __init setup_processor(void)
+ cpu_name = list->cpu_name;
+ __cpu_architecture = __get_cpu_architecture();
+
+-#ifdef MULTI_CPU
+- processor = *list->proc;
+-#endif
++ init_proc_vtable(list->proc);
+ #ifdef MULTI_TLB
+ cpu_tlb = *list->tlb;
+ #endif
+--
+2.19.1
+
--- /dev/null
+From 3dd808a6abbfdb353c2a6a7b4dfd436d4e0681ed Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:26 -0500
+Subject: ARM: clean up per-processor check_bugs method call
+
+Commit 945aceb1db8885d3a35790cf2e810f681db52756 upstream.
+
+Call the per-processor type check_bugs() method in the same way as we
+do other per-processor functions - move the "processor." detail into
+proc-fns.h.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/proc-fns.h | 1 +
+ arch/arm/kernel/bugs.c | 4 ++--
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index f379f5f849a9..19939e88efca 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -99,6 +99,7 @@ extern void cpu_do_suspend(void *);
+ extern void cpu_do_resume(void *);
+ #else
+ #define cpu_proc_init processor._proc_init
++#define cpu_check_bugs processor.check_bugs
+ #define cpu_proc_fin processor._proc_fin
+ #define cpu_reset processor.reset
+ #define cpu_do_idle processor._do_idle
+diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c
+index 7be511310191..d41d3598e5e5 100644
+--- a/arch/arm/kernel/bugs.c
++++ b/arch/arm/kernel/bugs.c
+@@ -6,8 +6,8 @@
+ void check_other_bugs(void)
+ {
+ #ifdef MULTI_CPU
+- if (processor.check_bugs)
+- processor.check_bugs();
++ if (cpu_check_bugs)
++ cpu_check_bugs();
+ #endif
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 266b7d3d629924174d16e8b40a8cde735abb0939 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 19 Dec 2018 13:47:24 +0200
+Subject: ARM: dts: da850-evm: Correct the sound card name
+
+[ Upstream commit 7fca69d4e43fa1ae9cb4f652772c132dc5a659c6 ]
+
+To avoid the following error:
+asoc-simple-card sound: ASoC: Failed to create card debugfs directory
+
+Which is because the card name contains '/' character, which can not be
+used in file or directory names.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/da850-evm.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
+index 78492a0bbbab..3c58ec707ea9 100644
+--- a/arch/arm/boot/dts/da850-evm.dts
++++ b/arch/arm/boot/dts/da850-evm.dts
+@@ -156,7 +156,7 @@
+
+ sound {
+ compatible = "simple-audio-card";
+- simple-audio-card,name = "DA850/OMAP-L138 EVM";
++ simple-audio-card,name = "DA850-OMAPL138 EVM";
+ simple-audio-card,widgets =
+ "Line", "Line In",
+ "Line", "Line Out";
+--
+2.19.1
+
--- /dev/null
+From 5c1c3811e361afced8faed5e1d5ad0cad9aea4a3 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 19 Dec 2018 13:47:26 +0200
+Subject: ARM: dts: da850-lcdk: Correct the sound card name
+
+[ Upstream commit c25748acc5c20786ecb7518bfeae8fcef93472d6 ]
+
+To avoid the following error:
+asoc-simple-card sound: ASoC: Failed to create card debugfs directory
+
+Which is because the card name contains '/' character, which can not be
+used in file or directory names.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/da850-lcdk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/da850-lcdk.dts b/arch/arm/boot/dts/da850-lcdk.dts
+index 7b8ab21fed6c..920e64cdb673 100644
+--- a/arch/arm/boot/dts/da850-lcdk.dts
++++ b/arch/arm/boot/dts/da850-lcdk.dts
+@@ -26,7 +26,7 @@
+
+ sound {
+ compatible = "simple-audio-card";
+- simple-audio-card,name = "DA850/OMAP-L138 LCDK";
++ simple-audio-card,name = "DA850-OMAPL138 LCDK";
+ simple-audio-card,widgets =
+ "Line", "Line In",
+ "Line", "Line Out";
+--
+2.19.1
+
--- /dev/null
+From e32cfff770cdf89b7c096d69780dcfb7d6208c70 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 8 Jan 2019 00:08:18 +0100
+Subject: ARM: dts: kirkwood: Fix polarity of GPIO fan lines
+
+[ Upstream commit b5f034845e70916fd33e172fad5ad530a29c10ab ]
+
+These two lines are active high, not active low. The bug was
+found when we changed the kernel to respect the polarity defined
+in the device tree.
+
+Fixes: 1b90e06b1429 ("ARM: kirkwood: Use devicetree to define DNS-32[05] fan")
+Cc: Jamie Lentin <jm@lentin.co.uk>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Gregory Clement <gregory.clement@bootlin.com>
+Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
+Cc: Julien D'Ascenzio <jdascenzio@posteo.net>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Jamie Lentin <jm@lentin.co.uk>
+Reported-by: Julien D'Ascenzio <jdascenzio@posteo.net>
+Tested-by: Julien D'Ascenzio <jdascenzio@posteo.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/kirkwood-dnskw.dtsi b/arch/arm/boot/dts/kirkwood-dnskw.dtsi
+index d8fca9db46d0..dddbc0d03da5 100644
+--- a/arch/arm/boot/dts/kirkwood-dnskw.dtsi
++++ b/arch/arm/boot/dts/kirkwood-dnskw.dtsi
+@@ -35,8 +35,8 @@
+ compatible = "gpio-fan";
+ pinctrl-0 = <&pmx_fan_high_speed &pmx_fan_low_speed>;
+ pinctrl-names = "default";
+- gpios = <&gpio1 14 GPIO_ACTIVE_LOW
+- &gpio1 13 GPIO_ACTIVE_LOW>;
++ gpios = <&gpio1 14 GPIO_ACTIVE_HIGH
++ &gpio1 13 GPIO_ACTIVE_HIGH>;
+ gpio-fan,speed-map = <0 0
+ 3000 1
+ 6000 2>;
+--
+2.19.1
+
--- /dev/null
+From 233553c6370a55f67607c75551e8a08818b19040 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:29 -0500
+Subject: ARM: ensure that processor vtables is not lost after boot
+
+Commit 3a4d0c2172bcf15b7a3d9d498b2b355f9864286b upstream.
+
+Marek Szyprowski reported problems with CPU hotplug in current kernels.
+This was tracked down to the processor vtables being located in an
+init section, and therefore discarded after kernel boot, despite being
+required after boot to properly initialise the non-boot CPUs.
+
+Arrange for these tables to end up in .rodata when required.
+
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 383fb3ee8024 ("ARM: spectre-v2: per-CPU vtables to work around big.Little systems")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/proc-macros.S | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
+index 7d9176c4a21d..7be1d7921342 100644
+--- a/arch/arm/mm/proc-macros.S
++++ b/arch/arm/mm/proc-macros.S
+@@ -275,6 +275,13 @@
+ .endm
+
+ .macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0, bugs=0
++/*
++ * If we are building for big.Little with branch predictor hardening,
++ * we need the processor function tables to remain available after boot.
++ */
++#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++ .section ".rodata"
++#endif
+ .type \name\()_processor_functions, #object
+ .align 2
+ ENTRY(\name\()_processor_functions)
+@@ -310,6 +317,9 @@ ENTRY(\name\()_processor_functions)
+ .endif
+
+ .size \name\()_processor_functions, . - \name\()_processor_functions
++#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++ .previous
++#endif
+ .endm
+
+ .macro define_cache_functions name:req
+--
+2.19.1
+
--- /dev/null
+From c5fc69dc6a73573416a7e5233cd4b424183562c4 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:30 -0500
+Subject: ARM: fix the cockup in the previous patch
+
+Commit d6951f582cc50ba0ad22ef46b599740966599b14 upstream.
+
+The intention in the previous patch was to only place the processor
+tables in the .rodata section if big.Little was being built and we
+wanted the branch target hardening, but instead (due to the way it
+was tested) it ended up always placing the tables into the .rodata
+section.
+
+Although harmless, let's correct this anyway.
+
+Fixes: 3a4d0c2172bc ("ARM: ensure that processor vtables is not lost after boot")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/proc-macros.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
+index 7be1d7921342..f8bb65032b79 100644
+--- a/arch/arm/mm/proc-macros.S
++++ b/arch/arm/mm/proc-macros.S
+@@ -279,7 +279,7 @@
+ * If we are building for big.Little with branch predictor hardening,
+ * we need the processor function tables to remain available after boot.
+ */
+-#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+ .section ".rodata"
+ #endif
+ .type \name\()_processor_functions, #object
+@@ -317,7 +317,7 @@ ENTRY(\name\()_processor_functions)
+ .endif
+
+ .size \name\()_processor_functions, . - \name\()_processor_functions
+-#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
+ .previous
+ #endif
+ .endm
+--
+2.19.1
+
--- /dev/null
+From f4ef85aabfd5ea8acf8cb68e14908804d162691d Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:24 -0500
+Subject: ARM: make lookup_processor_type() non-__init
+
+Commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc upstream.
+
+Move lookup_processor_type() out of the __init section so it is callable
+from (eg) the secondary startup code during hotplug.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/head-common.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S
+index 8733012d231f..7e662bdd5cb3 100644
+--- a/arch/arm/kernel/head-common.S
++++ b/arch/arm/kernel/head-common.S
+@@ -122,6 +122,9 @@ __mmap_switched_data:
+ .long init_thread_union + THREAD_START_SP @ sp
+ .size __mmap_switched_data, . - __mmap_switched_data
+
++ __FINIT
++ .text
++
+ /*
+ * This provides a C-API version of __lookup_processor_type
+ */
+@@ -133,9 +136,6 @@ ENTRY(lookup_processor_type)
+ ldmfd sp!, {r4 - r6, r9, pc}
+ ENDPROC(lookup_processor_type)
+
+- __FINIT
+- .text
+-
+ /*
+ * Read processor ID register (CP#15, CR0), and look up in the linker-built
+ * supported processor list. Note that we can't use the absolute addresses
+--
+2.19.1
+
--- /dev/null
+From 6839e267acfe8a3ac3a3829bc5fa2a6a24a767de Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:28 -0500
+Subject: ARM: spectre-v2: per-CPU vtables to work around big.Little systems
+
+Commit 383fb3ee8024d596f488d2dbaf45e572897acbdb upstream.
+
+In big.Little systems, some CPUs require the Spectre workarounds in
+paths such as the context switch, but other CPUs do not. In order
+to handle these differences, we need per-CPU vtables.
+
+We are unable to use the kernel's per-CPU variables to support this
+as per-CPU is not initialised at times when we need access to the
+vtables, so we have to use an array indexed by logical CPU number.
+
+We use an array-of-pointers to avoid having function pointers in
+the kernel's read/write .data section.
+
+Note: Added include of linux/slab.h in arch/arm/smp.c.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/proc-fns.h | 23 +++++++++++++++++++++++
+ arch/arm/kernel/setup.c | 5 +++++
+ arch/arm/kernel/smp.c | 32 ++++++++++++++++++++++++++++++++
+ arch/arm/mm/proc-v7-bugs.c | 17 ++---------------
+ 4 files changed, 62 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h
+index a1a71b068edc..1bfcc3bcfc6d 100644
+--- a/arch/arm/include/asm/proc-fns.h
++++ b/arch/arm/include/asm/proc-fns.h
+@@ -104,12 +104,35 @@ extern void cpu_do_resume(void *);
+ #else
+
+ extern struct processor processor;
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++#include <linux/smp.h>
++/*
++ * This can't be a per-cpu variable because we need to access it before
++ * per-cpu has been initialised. We have a couple of functions that are
++ * called in a pre-emptible context, and so can't use smp_processor_id()
++ * there, hence PROC_TABLE(). We insist in init_proc_vtable() that the
++ * function pointers for these are identical across all CPUs.
++ */
++extern struct processor *cpu_vtable[];
++#define PROC_VTABLE(f) cpu_vtable[smp_processor_id()]->f
++#define PROC_TABLE(f) cpu_vtable[0]->f
++static inline void init_proc_vtable(const struct processor *p)
++{
++ unsigned int cpu = smp_processor_id();
++ *cpu_vtable[cpu] = *p;
++ WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area !=
++ cpu_vtable[0]->dcache_clean_area);
++ WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext !=
++ cpu_vtable[0]->set_pte_ext);
++}
++#else
+ #define PROC_VTABLE(f) processor.f
+ #define PROC_TABLE(f) processor.f
+ static inline void init_proc_vtable(const struct processor *p)
+ {
+ processor = *p;
+ }
++#endif
+
+ #define cpu_proc_init PROC_VTABLE(_proc_init)
+ #define cpu_check_bugs PROC_VTABLE(check_bugs)
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index 2eebb67fa08b..4764742db7b0 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2);
+
+ #ifdef MULTI_CPU
+ struct processor processor __ro_after_init;
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++struct processor *cpu_vtable[NR_CPUS] = {
++ [0] = &processor,
++};
++#endif
+ #endif
+ #ifdef MULTI_TLB
+ struct cpu_tlb_fns cpu_tlb __ro_after_init;
+diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
+index 4b129aac7233..8faf869e9fb2 100644
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -27,6 +27,7 @@
+ #include <linux/completion.h>
+ #include <linux/cpufreq.h>
+ #include <linux/irq_work.h>
++#include <linux/slab.h>
+
+ #include <linux/atomic.h>
+ #include <asm/bugs.h>
+@@ -40,6 +41,7 @@
+ #include <asm/mmu_context.h>
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
++#include <asm/procinfo.h>
+ #include <asm/processor.h>
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -100,6 +102,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)
+ #endif
+ }
+
++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR)
++static int secondary_biglittle_prepare(unsigned int cpu)
++{
++ if (!cpu_vtable[cpu])
++ cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL);
++
++ return cpu_vtable[cpu] ? 0 : -ENOMEM;
++}
++
++static void secondary_biglittle_init(void)
++{
++ init_proc_vtable(lookup_processor(read_cpuid_id())->proc);
++}
++#else
++static int secondary_biglittle_prepare(unsigned int cpu)
++{
++ return 0;
++}
++
++static void secondary_biglittle_init(void)
++{
++}
++#endif
++
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+ int ret;
+@@ -107,6 +133,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ if (!smp_ops.smp_boot_secondary)
+ return -ENOSYS;
+
++ ret = secondary_biglittle_prepare(cpu);
++ if (ret)
++ return ret;
++
+ /*
+ * We need to tell the secondary core where to find
+ * its stack and the page tables.
+@@ -358,6 +388,8 @@ asmlinkage void secondary_start_kernel(void)
+ struct mm_struct *mm = &init_mm;
+ unsigned int cpu;
+
++ secondary_biglittle_init();
++
+ /*
+ * The identity mapping is uncached (strongly ordered), so
+ * switch away from it before attempting any exclusive accesses.
+diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c
+index 5544b82a2e7a..9a07916af8dd 100644
+--- a/arch/arm/mm/proc-v7-bugs.c
++++ b/arch/arm/mm/proc-v7-bugs.c
+@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)
+ case ARM_CPU_PART_CORTEX_A17:
+ case ARM_CPU_PART_CORTEX_A73:
+ case ARM_CPU_PART_CORTEX_A75:
+- if (processor.switch_mm != cpu_v7_bpiall_switch_mm)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ harden_branch_predictor_bpiall;
+ spectre_v2_method = "BPIALL";
+@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)
+
+ case ARM_CPU_PART_CORTEX_A15:
+ case ARM_CPU_PART_BRAHMA_B15:
+- if (processor.switch_mm != cpu_v7_iciallu_switch_mm)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ harden_branch_predictor_iciallu;
+ spectre_v2_method = "ICIALLU";
+@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ call_hvc_arch_workaround_1;
+- processor.switch_mm = cpu_v7_hvc_switch_mm;
++ cpu_do_switch_mm = cpu_v7_hvc_switch_mm;
+ spectre_v2_method = "hypervisor";
+ break;
+
+@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void)
+ ARM_SMCCC_ARCH_WORKAROUND_1, &res);
+ if ((int)res.a0 != 0)
+ break;
+- if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu)
+- goto bl_error;
+ per_cpu(harden_branch_predictor_fn, cpu) =
+ call_smc_arch_workaround_1;
+- processor.switch_mm = cpu_v7_smc_switch_mm;
++ cpu_do_switch_mm = cpu_v7_smc_switch_mm;
+ spectre_v2_method = "firmware";
+ break;
+
+@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)
+ if (spectre_v2_method)
+ pr_info("CPU%u: Spectre v2: using %s workaround\n",
+ smp_processor_id(), spectre_v2_method);
+- return;
+-
+-bl_error:
+- pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n",
+- cpu);
+ }
+ #else
+ static void cpu_v7_spectre_init(void)
+--
+2.19.1
+
--- /dev/null
+From 4d090ecea589cadaefd09c9f5289ae9801a15520 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 14 Feb 2019 09:49:25 -0500
+Subject: ARM: split out processor lookup
+
+Commit 65987a8553061515b5851b472081aedb9837a391 upstream.
+
+Split out the lookup of the processor type and associated error handling
+from the rest of setup_processor() - we will need to use this in the
+secondary CPU bringup path for big.Little Spectre variant 2 mitigation.
+
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David A. Long <dave.long@linaro.org>
+Reviewed-by: Julien Thierry <julien.thierry@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/cputype.h | 1 +
+ arch/arm/kernel/setup.c | 31 +++++++++++++++++++------------
+ 2 files changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
+index c55db1e22f0c..b9356dbfded0 100644
+--- a/arch/arm/include/asm/cputype.h
++++ b/arch/arm/include/asm/cputype.h
+@@ -106,6 +106,7 @@
+ #define ARM_CPU_PART_SCORPION 0x510002d0
+
+ extern unsigned int processor_id;
++struct proc_info_list *lookup_processor(u32 midr);
+
+ #ifdef CONFIG_CPU_CP15
+ #define read_cpuid(reg) \
+diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
+index f4e54503afa9..8d5c3a118abe 100644
+--- a/arch/arm/kernel/setup.c
++++ b/arch/arm/kernel/setup.c
+@@ -667,22 +667,29 @@ static void __init smp_build_mpidr_hash(void)
+ }
+ #endif
+
+-static void __init setup_processor(void)
++/*
++ * locate processor in the list of supported processor types. The linker
++ * builds this table for us from the entries in arch/arm/mm/proc-*.S
++ */
++struct proc_info_list *lookup_processor(u32 midr)
+ {
+- struct proc_info_list *list;
++ struct proc_info_list *list = lookup_processor_type(midr);
+
+- /*
+- * locate processor in the list of supported processor
+- * types. The linker builds this table for us from the
+- * entries in arch/arm/mm/proc-*.S
+- */
+- list = lookup_processor_type(read_cpuid_id());
+ if (!list) {
+- pr_err("CPU configuration botched (ID %08x), unable to continue.\n",
+- read_cpuid_id());
+- while (1);
++ pr_err("CPU%u: configuration botched (ID %08x), CPU halted\n",
++ smp_processor_id(), midr);
++ while (1)
++ /* can't use cpu_relax() here as it may require MMU setup */;
+ }
+
++ return list;
++}
++
++static void __init setup_processor(void)
++{
++ unsigned int midr = read_cpuid_id();
++ struct proc_info_list *list = lookup_processor(midr);
++
+ cpu_name = list->cpu_name;
+ __cpu_architecture = __get_cpu_architecture();
+
+@@ -700,7 +707,7 @@ static void __init setup_processor(void)
+ #endif
+
+ pr_info("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n",
+- cpu_name, read_cpuid_id(), read_cpuid_id() & 15,
++ list->cpu_name, midr, midr & 15,
+ proc_arch[cpu_architecture()], get_cr());
+
+ snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
+--
+2.19.1
+
--- /dev/null
+From b8206c300202296ced642ee296b099a8549eac48 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Thu, 14 Feb 2019 11:31:18 +0100
+Subject: bnx2x: disable GSO where gso_size is too big for hardware
+
+commit 8914a595110a6eca69a5e275b323f5d09e18f4f9 upstream
+
+If a bnx2x card is passed a GSO packet with a gso_size larger than
+~9700 bytes, it will cause a firmware error that will bring the card
+down:
+
+bnx2x: [bnx2x_attn_int_deasserted3:4323(enP24p1s0f0)]MC assert!
+bnx2x: [bnx2x_mc_assert:720(enP24p1s0f0)]XSTORM_ASSERT_LIST_INDEX 0x2
+bnx2x: [bnx2x_mc_assert:736(enP24p1s0f0)]XSTORM_ASSERT_INDEX 0x0 = 0x00000000 0x25e43e47 0x00463e01 0x00010052
+bnx2x: [bnx2x_mc_assert:750(enP24p1s0f0)]Chip Revision: everest3, FW Version: 7_13_1
+... (dump of values continues) ...
+
+Detect when the mac length of a GSO packet is greater than the maximum
+packet size (9700 bytes) and disable GSO.
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[jwang: cherry pick for CVE-2018-1000026]
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 4bc2c806eb61..eeeb4c5740bf 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -12979,6 +12979,24 @@ static netdev_features_t bnx2x_features_check(struct sk_buff *skb,
+ struct net_device *dev,
+ netdev_features_t features)
+ {
++ /*
++ * A skb with gso_size + header length > 9700 will cause a
++ * firmware panic. Drop GSO support.
++ *
++ * Eventually the upper layer should not pass these packets down.
++ *
++ * For speed, if the gso_size is <= 9000, assume there will
++ * not be 700 bytes of headers and pass it through. Only do a
++ * full (slow) validation if the gso_size is > 9000.
++ *
++ * (Due to the way SKB_BY_FRAGS works this will also do a full
++ * validation in that case.)
++ */
++ if (unlikely(skb_is_gso(skb) &&
++ (skb_shinfo(skb)->gso_size > 9000) &&
++ !skb_gso_validate_mac_len(skb, 9700)))
++ features &= ~NETIF_F_GSO_MASK;
++
+ features = vlan_features_check(skb, features);
+ return vxlan_features_check(skb, features);
+ }
+--
+2.19.1
+
--- /dev/null
+From 0313743b2e374926f273c118d79501e3d2bdace3 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Tue, 8 Jan 2019 18:30:56 +0000
+Subject: cifs: Limit memory used by lock request calls to a page
+
+[ Upstream commit 92a8109e4d3a34fb6b115c9098b51767dc933444 ]
+
+The code tries to allocate a contiguous buffer with a size supplied by
+the server (maxBuf). This could fail if memory is fragmented since it
+results in high order allocations for commonly used server
+implementations. It is also wasteful since there are probably
+few locks in the usual case. Limit the buffer to be no larger than a
+page to avoid memory allocation failures due to fragmentation.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/file.c | 8 ++++++++
+ fs/cifs/smb2file.c | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index a3046b6523c8..8ec296308729 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1126,6 +1126,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
+ return -EINVAL;
+ }
+
++ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) >
++ PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr),
++ PAGE_SIZE);
+ max_num = (max_buf - sizeof(struct smb_hdr)) /
+ sizeof(LOCKING_ANDX_RANGE);
+ buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
+@@ -1462,6 +1466,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
+ return -EINVAL;
+
++ BUILD_BUG_ON(sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE) >
++ PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr),
++ PAGE_SIZE);
+ max_num = (max_buf - sizeof(struct smb_hdr)) /
+ sizeof(LOCKING_ANDX_RANGE);
+ buf = kcalloc(max_num, sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL);
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index b7885dc0d9bb..dee5250701de 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -129,6 +129,8 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+ if (max_buf < sizeof(struct smb2_lock_element))
+ return -EINVAL;
+
++ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
+ max_num = max_buf / sizeof(struct smb2_lock_element);
+ buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL);
+ if (!buf)
+@@ -265,6 +267,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)
+ return -EINVAL;
+ }
+
++ BUILD_BUG_ON(sizeof(struct smb2_lock_element) > PAGE_SIZE);
++ max_buf = min_t(unsigned int, max_buf, PAGE_SIZE);
+ max_num = max_buf / sizeof(struct smb2_lock_element);
+ buf = kcalloc(max_num, sizeof(struct smb2_lock_element), GFP_KERNEL);
+ if (!buf) {
+--
+2.19.1
+
--- /dev/null
+From 410ae68156e06fcd8ba86f606a77255daccc2a0e Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Mon, 7 Jan 2019 18:51:53 +0000
+Subject: cpufreq: check if policy is inactive early in __cpufreq_get()
+
+[ Upstream commit 2f66196208c98b3d1b4294edffb2c5a8197be899 ]
+
+cpuinfo_cur_freq gets current CPU frequency as detected by hardware
+while scaling_cur_freq last known CPU frequency. Some platforms may not
+allow checking the CPU frequency of an offline CPU or the associated
+resources may have been released via cpufreq_exit when the CPU gets
+offlined, in which case the policy would have been invalidated already.
+If we attempt to get current frequency from the hardware, it may result
+in hang or crash.
+
+For example on Juno, I see:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188
+[0000000000000188] pgd=0000000000000000
+Internal error: Oops: 96000004 [#1] PREEMPT SMP
+Modules linked in:
+CPU: 5 PID: 4202 Comm: cat Not tainted 4.20.0-08251-ga0f2c0318a15-dirty #87
+Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform
+pstate: 40000005 (nZcv daif -PAN -UAO)
+pc : scmi_cpufreq_get_rate+0x34/0xb0
+lr : scmi_cpufreq_get_rate+0x34/0xb0
+Call trace:
+ scmi_cpufreq_get_rate+0x34/0xb0
+ __cpufreq_get+0x34/0xc0
+ show_cpuinfo_cur_freq+0x24/0x78
+ show+0x40/0x60
+ sysfs_kf_seq_show+0xc0/0x148
+ kernfs_seq_show+0x44/0x50
+ seq_read+0xd4/0x480
+ kernfs_fop_read+0x15c/0x208
+ __vfs_read+0x60/0x188
+ vfs_read+0x94/0x150
+ ksys_read+0x6c/0xd8
+ __arm64_sys_read+0x24/0x30
+ el0_svc_common+0x78/0x100
+ el0_svc_handler+0x38/0x78
+ el0_svc+0x8/0xc
+---[ end trace 3d1024e58f77f6b2 ]---
+
+So fix the issue by checking if the policy is invalid early in
+__cpufreq_get before attempting to get the current frequency.
+
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index d6d91e8afa9e..61fe4bbc6dc0 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1496,17 +1496,16 @@ static unsigned int __cpufreq_get(struct cpufreq_policy *policy)
+ {
+ unsigned int ret_freq = 0;
+
+- if (!cpufreq_driver->get)
++ if (unlikely(policy_is_inactive(policy)) || !cpufreq_driver->get)
+ return ret_freq;
+
+ ret_freq = cpufreq_driver->get(policy->cpu);
+
+ /*
+- * Updating inactive policies is invalid, so avoid doing that. Also
+- * if fast frequency switching is used with the given policy, the check
++ * If fast frequency switching is used with the given policy, the check
+ * against policy->cur is pointless, so skip it in that case too.
+ */
+- if (unlikely(policy_is_inactive(policy)) || policy->fast_switch_enabled)
++ if (policy->fast_switch_enabled)
+ return ret_freq;
+
+ if (ret_freq && policy->cur &&
+--
+2.19.1
+
--- /dev/null
+From 9bbedb3c0120f51b1928dd61f5c013d826e42a1f Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 3 Jan 2019 13:59:49 +0200
+Subject: drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE
+
+[ Upstream commit adf4109896bbee27fd2ac3b48d22d6a0062fe517 ]
+
+DP1_SRCCTRL register and PHY_2LANE field did not have matching defines.
+Add these.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-3-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index f64f35cdc2ff..e67b163a8ce8 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -140,6 +140,8 @@
+ #define DP0_LTLOOPCTRL 0x06d8
+ #define DP0_SNKLTCTRL 0x06e4
+
++#define DP1_SRCCTRL 0x07a0
++
+ /* PHY */
+ #define DP_PHY_CTRL 0x0800
+ #define DP_PHY_RST BIT(28) /* DP PHY Global Soft Reset */
+@@ -148,6 +150,7 @@
+ #define PHY_M1_RST BIT(12) /* Reset PHY1 Main Channel */
+ #define PHY_RDY BIT(16) /* PHY Main Channels Ready */
+ #define PHY_M0_RST BIT(8) /* Reset PHY0 Main Channel */
++#define PHY_2LANE BIT(2) /* PHY Enable 2 lanes */
+ #define PHY_A0_EN BIT(1) /* PHY Aux Channel0 Enable */
+ #define PHY_M0_EN BIT(0) /* PHY Main Channel0 Enable */
+
+@@ -562,7 +565,7 @@ static int tc_aux_link_setup(struct tc_data *tc)
+ value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2;
+ tc_write(SYS_PLLPARAM, value);
+
+- tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | BIT(2) | PHY_A0_EN);
++ tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN);
+
+ /*
+ * Initially PLLs are in bypass. Force PLL parameter update,
+@@ -832,7 +835,7 @@ static int tc_main_link_setup(struct tc_data *tc)
+ DP0_SRCCTRL_LANESKEW | DP0_SRCCTRL_LANES_2 |
+ DP0_SRCCTRL_BW27 | DP0_SRCCTRL_AUTOCORRECT);
+ /* from excel file - DP1_SrcCtrl */
+- tc_write(0x07a0, 0x00003083);
++ tc_write(DP1_SRCCTRL, 0x00003083);
+
+ rate = clk_get_rate(tc->refclk);
+ switch (rate) {
+@@ -853,8 +856,9 @@ static int tc_main_link_setup(struct tc_data *tc)
+ }
+ value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2;
+ tc_write(SYS_PLLPARAM, value);
++
+ /* Setup Main Link */
+- dp_phy_ctrl = BGREN | PWR_SW_EN | BIT(2) | PHY_A0_EN | PHY_M0_EN;
++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN | PHY_M0_EN;
+ tc_write(DP_PHY_CTRL, dp_phy_ctrl);
+ msleep(100);
+
+--
+2.19.1
+
--- /dev/null
+From 86eb8d9827ec4affabd91d63284c195bbd864af8 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 3 Jan 2019 13:59:51 +0200
+Subject: drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value
+
+[ Upstream commit 9a63bd6fe1b5590ffa42ae2ed22ee21363293e31 ]
+
+Initially DP0_SRCCTRL is set to a static value which includes
+DP0_SRCCTRL_LANES_2 and DP0_SRCCTRL_BW27, even when only 1 lane of
+1.62Gbps speed is used. DP1_SRCCTRL is configured to a magic number.
+
+This patch changes the configuration as follows:
+
+Configure DP0_SRCCTRL by using tc_srcctrl() which provides the correct
+value.
+
+DP1_SRCCTRL needs two bits to be set to the same value as DP0_SRCCTRL:
+SSCG and BW27. All other bits can be zero.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-5-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 8098297c5fe5..dbe403ea130d 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -834,12 +834,11 @@ static int tc_main_link_setup(struct tc_data *tc)
+ if (!tc->mode)
+ return -EINVAL;
+
+- /* from excel file - DP0_SrcCtrl */
+- tc_write(DP0_SRCCTRL, DP0_SRCCTRL_SCRMBLDIS | DP0_SRCCTRL_EN810B |
+- DP0_SRCCTRL_LANESKEW | DP0_SRCCTRL_LANES_2 |
+- DP0_SRCCTRL_BW27 | DP0_SRCCTRL_AUTOCORRECT);
+- /* from excel file - DP1_SrcCtrl */
+- tc_write(DP1_SRCCTRL, 0x00003083);
++ tc_write(DP0_SRCCTRL, tc_srcctrl(tc));
++ /* SSCG and BW27 on DP1 must be set to the same as on DP0 */
++ tc_write(DP1_SRCCTRL,
++ (tc->link.spread ? DP0_SRCCTRL_SSCG : 0) |
++ ((tc->link.base.rate != 162000) ? DP0_SRCCTRL_BW27 : 0));
+
+ rate = clk_get_rate(tc->refclk);
+ switch (rate) {
+--
+2.19.1
+
--- /dev/null
+From 52251e8121d76dc581dc86bc779686f4d161efa5 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 3 Jan 2019 13:59:53 +0200
+Subject: drm/bridge: tc358767: fix output H/V syncs
+
+[ Upstream commit 7923e09c7a766e2d58de7fc395bb84c18e5bc625 ]
+
+The H and V syncs of the DP output are always set to active high. This
+patch fixes the syncs by configuring them according to the videomode.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-7-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index 16fa42984c50..fa3f2f039a74 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -96,6 +96,8 @@
+ #define DP0_STARTVAL 0x064c
+ #define DP0_ACTIVEVAL 0x0650
+ #define DP0_SYNCVAL 0x0654
++#define SYNCVAL_HS_POL_ACTIVE_LOW (1 << 15)
++#define SYNCVAL_VS_POL_ACTIVE_LOW (1 << 31)
+ #define DP0_MISC 0x0658
+ #define TU_SIZE_RECOMMENDED (63) /* LSCLK cycles per TU */
+ #define BPC_6 (0 << 5)
+@@ -724,7 +726,9 @@ static int tc_set_video_mode(struct tc_data *tc, struct drm_display_mode *mode)
+
+ tc_write(DP0_ACTIVEVAL, (mode->vdisplay << 16) | (mode->hdisplay));
+
+- tc_write(DP0_SYNCVAL, (vsync_len << 16) | (hsync_len << 0));
++ tc_write(DP0_SYNCVAL, (vsync_len << 16) | (hsync_len << 0) |
++ ((mode->flags & DRM_MODE_FLAG_NHSYNC) ? SYNCVAL_HS_POL_ACTIVE_LOW : 0) |
++ ((mode->flags & DRM_MODE_FLAG_NVSYNC) ? SYNCVAL_VS_POL_ACTIVE_LOW : 0));
+
+ tc_write(DPIPXLFMT, VS_POL_ACTIVE_LOW | HS_POL_ACTIVE_LOW |
+ DE_POL_ACTIVE_HIGH | SUB_CFG_TYPE_CONFIG1 | DPI_BPP_RGB888);
+--
+2.19.1
+
--- /dev/null
+From 851e60a933ff894523773272b638880cc3b665b5 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 3 Jan 2019 13:59:50 +0200
+Subject: drm/bridge: tc358767: fix single lane configuration
+
+[ Upstream commit 4d9d54a730434cc068dd3515ba6116697196f77b ]
+
+PHY_2LANE bit is always set in DP_PHY_CTRL, breaking 1 lane use.
+
+Set PHY_2LANE only when 2 lanes are used.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-4-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index e67b163a8ce8..8098297c5fe5 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -541,6 +541,7 @@ static int tc_aux_link_setup(struct tc_data *tc)
+ unsigned long rate;
+ u32 value;
+ int ret;
++ u32 dp_phy_ctrl;
+
+ rate = clk_get_rate(tc->refclk);
+ switch (rate) {
+@@ -565,7 +566,10 @@ static int tc_aux_link_setup(struct tc_data *tc)
+ value |= SYSCLK_SEL_LSCLK | LSCLK_DIV_2;
+ tc_write(SYS_PLLPARAM, value);
+
+- tc_write(DP_PHY_CTRL, BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN);
++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_A0_EN;
++ if (tc->link.base.num_lanes == 2)
++ dp_phy_ctrl |= PHY_2LANE;
++ tc_write(DP_PHY_CTRL, dp_phy_ctrl);
+
+ /*
+ * Initially PLLs are in bypass. Force PLL parameter update,
+@@ -858,7 +862,9 @@ static int tc_main_link_setup(struct tc_data *tc)
+ tc_write(SYS_PLLPARAM, value);
+
+ /* Setup Main Link */
+- dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_2LANE | PHY_A0_EN | PHY_M0_EN;
++ dp_phy_ctrl = BGREN | PWR_SW_EN | PHY_A0_EN | PHY_M0_EN;
++ if (tc->link.base.num_lanes == 2)
++ dp_phy_ctrl |= PHY_2LANE;
+ tc_write(DP_PHY_CTRL, dp_phy_ctrl);
+ msleep(100);
+
+--
+2.19.1
+
--- /dev/null
+From 32023d93a46f36d11db85bbac297d15d3126a9b0 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Thu, 3 Jan 2019 13:59:52 +0200
+Subject: drm/bridge: tc358767: reject modes which require too much BW
+
+[ Upstream commit 51b9e62eb6950c762162ab7eb8390990179be067 ]
+
+The current driver accepts any videomode with pclk < 154MHz. This is not
+correct, as with 1 lane and/or 1.62Mbps speed not all videomodes can be
+supported.
+
+Add code to reject modes that require more bandwidth that is available.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-6-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index dbe403ea130d..16fa42984c50 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -1118,10 +1118,20 @@ static bool tc_bridge_mode_fixup(struct drm_bridge *bridge,
+ static int tc_connector_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
++ struct tc_data *tc = connector_to_tc(connector);
++ u32 req, avail;
++ u32 bits_per_pixel = 24;
++
+ /* DPI interface clock limitation: upto 154 MHz */
+ if (mode->clock > 154000)
+ return MODE_CLOCK_HIGH;
+
++ req = mode->clock * bits_per_pixel / 8;
++ avail = tc->link.base.num_lanes * tc->link.base.rate;
++
++ if (req > avail)
++ return MODE_BAD;
++
+ return MODE_OK;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 55150b86de475fbb832c2cbad3b6e5c8335e62d1 Mon Sep 17 00:00:00 2001
+From: Adrian Bunk <bunk@kernel.org>
+Date: Sun, 17 Feb 2019 13:14:51 +0200
+Subject: dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string
+
+commit 6c0c5dc33ff42af49243e94842d0ebdb153189ea upstream.
+
+Add new compatible to the device tree bindings.
+
+Signed-off-by: Adrian Bunk <bunk@kernel.org>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/eeprom/eeprom.txt | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/eeprom/eeprom.txt b/Documentation/devicetree/bindings/eeprom/eeprom.txt
+index 735bc94444bb..4dcce8ee5cee 100644
+--- a/Documentation/devicetree/bindings/eeprom/eeprom.txt
++++ b/Documentation/devicetree/bindings/eeprom/eeprom.txt
+@@ -6,7 +6,8 @@ Required properties:
+
+ "atmel,24c00", "atmel,24c01", "atmel,24c02", "atmel,24c04",
+ "atmel,24c08", "atmel,24c16", "atmel,24c32", "atmel,24c64",
+- "atmel,24c128", "atmel,24c256", "atmel,24c512", "atmel,24c1024"
++ "atmel,24c128", "atmel,24c256", "atmel,24c512", "atmel,24c1024",
++ "atmel,24c2048"
+
+ "catalyst,24c32"
+
+@@ -17,7 +18,7 @@ Required properties:
+ If there is no specific driver for <manufacturer>, a generic
+ driver based on <type> is selected. Possible types are:
+ "24c00", "24c01", "24c02", "24c04", "24c08", "24c16", "24c32", "24c64",
+- "24c128", "24c256", "24c512", "24c1024", "spd"
++ "24c128", "24c256", "24c512", "24c1024", "24c2048", "spd"
+
+ - reg : the I2C address of the EEPROM
+
+--
+2.19.1
+
--- /dev/null
+From fd16abf1ce128097dfbea1601d38989bc8060a1b Mon Sep 17 00:00:00 2001
+From: Adrian Bunk <bunk@kernel.org>
+Date: Sun, 17 Feb 2019 13:14:52 +0200
+Subject: eeprom: at24: add support for 24c2048
+
+commit 37cf28d3b5bca1b532a0b6aac722e7f2788a9294 upstream.
+
+Works with ST M24M02.
+
+Signed-off-by: Adrian Bunk <bunk@kernel.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/Kconfig | 2 +-
+ drivers/misc/eeprom/at24.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
+index c4e41c26649e..fac10c0e852c 100644
+--- a/drivers/misc/eeprom/Kconfig
++++ b/drivers/misc/eeprom/Kconfig
+@@ -12,7 +12,7 @@ config EEPROM_AT24
+ ones like at24c64, 24lc02 or fm24c04:
+
+ 24c00, 24c01, 24c02, spd (readonly 24c02), 24c04, 24c08,
+- 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024
++ 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024, 24c2048
+
+ Unless you like data loss puzzles, always be sure that any chip
+ you configure as a 24c32 (32 kbit) or larger is NOT really a
+diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
+index d8a485f1798b..a37b9b6a315a 100644
+--- a/drivers/misc/eeprom/at24.c
++++ b/drivers/misc/eeprom/at24.c
+@@ -170,6 +170,7 @@ static const struct i2c_device_id at24_ids[] = {
+ { "24c256", AT24_DEVICE_MAGIC(262144 / 8, AT24_FLAG_ADDR16) },
+ { "24c512", AT24_DEVICE_MAGIC(524288 / 8, AT24_FLAG_ADDR16) },
+ { "24c1024", AT24_DEVICE_MAGIC(1048576 / 8, AT24_FLAG_ADDR16) },
++ { "24c2048", AT24_DEVICE_MAGIC(2097152 / 8, AT24_FLAG_ADDR16) },
+ { "at24", 0 },
+ { /* END OF LIST */ }
+ };
+--
+2.19.1
+
--- /dev/null
+From 02a0f6601e99f0529cacf4c3d4e5ab02c9bb124c Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sat, 1 Dec 2018 12:57:18 +0100
+Subject: gpio: pl061: handle failed allocations
+
+[ Upstream commit df209c43a0e8258e096fb722dfbdae4f0dd13fde ]
+
+devm_kzalloc(), devm_kstrdup() and devm_kasprintf() all can
+fail internal allocation and return NULL. Using any of the assigned
+objects without checking is not safe. As this is early in the boot
+phase and these allocations really should not fail, any failure here
+is probably an indication of a more serious issue so it makes little
+sense to try and rollback the previous allocated resources or try to
+continue; but rather the probe function is simply exited with -ENOMEM.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 684284b64aae ("ARM: integrator: add MMCI device to IM-PD1")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-integrator/impd1.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-integrator/impd1.c b/arch/arm/mach-integrator/impd1.c
+index ed9a01484030..a52fe871adbc 100644
+--- a/arch/arm/mach-integrator/impd1.c
++++ b/arch/arm/mach-integrator/impd1.c
+@@ -394,7 +394,11 @@ static int __ref impd1_probe(struct lm_device *dev)
+ sizeof(*lookup) + 3 * sizeof(struct gpiod_lookup),
+ GFP_KERNEL);
+ chipname = devm_kstrdup(&dev->dev, devname, GFP_KERNEL);
+- mmciname = kasprintf(GFP_KERNEL, "lm%x:00700", dev->id);
++ mmciname = devm_kasprintf(&dev->dev, GFP_KERNEL,
++ "lm%x:00700", dev->id);
++ if (!lookup || !chipname || !mmciname)
++ return -ENOMEM;
++
+ lookup->dev_id = mmciname;
+ /*
+ * Offsets on GPIO block 1:
+--
+2.19.1
+
--- /dev/null
+From acc7bd306faab033389973ae4e69e22135129ec7 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Thu, 14 Feb 2019 11:31:17 +0100
+Subject: net: create skb_gso_validate_mac_len()
+
+commit 2b16f048729bf35e6c28a40cbfad07239f9dcd90 upstream
+
+If you take a GSO skb, and split it into packets, will the MAC
+length (L2 + L3 + L4 headers + payload) of those packets be small
+enough to fit within a given length?
+
+Move skb_gso_mac_seglen() to skbuff.h with other related functions
+like skb_gso_network_seglen() so we can use it, and then create
+skb_gso_validate_mac_len to do the full calculation.
+
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[jwang: cherry pick for CVE-2018-1000026]
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/skbuff.h | 16 +++++++++++
+ net/core/skbuff.c | 63 +++++++++++++++++++++++++++++++++---------
+ net/sched/sch_tbf.c | 10 -------
+ 3 files changed, 66 insertions(+), 23 deletions(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index ed329a39d621..f8761774a94f 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -3102,6 +3102,7 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen);
+ void skb_scrub_packet(struct sk_buff *skb, bool xnet);
+ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb);
+ bool skb_gso_validate_mtu(const struct sk_buff *skb, unsigned int mtu);
++bool skb_gso_validate_mac_len(const struct sk_buff *skb, unsigned int len);
+ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features);
+ struct sk_buff *skb_vlan_untag(struct sk_buff *skb);
+ int skb_ensure_writable(struct sk_buff *skb, int write_len);
+@@ -3880,6 +3881,21 @@ static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+ return hdr_len + skb_gso_transport_seglen(skb);
+ }
+
++/**
++ * skb_gso_mac_seglen - Return length of individual segments of a gso packet
++ *
++ * @skb: GSO skb
++ *
++ * skb_gso_mac_seglen is used to determine the real size of the
++ * individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4
++ * headers (TCP/UDP).
++ */
++static inline unsigned int skb_gso_mac_seglen(const struct sk_buff *skb)
++{
++ unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
++ return hdr_len + skb_gso_transport_seglen(skb);
++}
++
+ /* Local Checksum Offload.
+ * Compute outer checksum based on the assumption that the
+ * inner checksum will be offloaded later.
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index dca1fed0d7da..11501165f0df 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4469,37 +4469,74 @@ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
+ EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
+
+ /**
+- * skb_gso_validate_mtu - Return in case such skb fits a given MTU
++ * skb_gso_size_check - check the skb size, considering GSO_BY_FRAGS
+ *
+- * @skb: GSO skb
+- * @mtu: MTU to validate against
++ * There are a couple of instances where we have a GSO skb, and we
++ * want to determine what size it would be after it is segmented.
+ *
+- * skb_gso_validate_mtu validates if a given skb will fit a wanted MTU
+- * once split.
++ * We might want to check:
++ * - L3+L4+payload size (e.g. IP forwarding)
++ * - L2+L3+L4+payload size (e.g. sanity check before passing to driver)
++ *
++ * This is a helper to do that correctly considering GSO_BY_FRAGS.
++ *
++ * @seg_len: The segmented length (from skb_gso_*_seglen). In the
++ * GSO_BY_FRAGS case this will be [header sizes + GSO_BY_FRAGS].
++ *
++ * @max_len: The maximum permissible length.
++ *
++ * Returns true if the segmented length <= max length.
+ */
+-bool skb_gso_validate_mtu(const struct sk_buff *skb, unsigned int mtu)
+-{
++static inline bool skb_gso_size_check(const struct sk_buff *skb,
++ unsigned int seg_len,
++ unsigned int max_len) {
+ const struct skb_shared_info *shinfo = skb_shinfo(skb);
+ const struct sk_buff *iter;
+- unsigned int hlen;
+-
+- hlen = skb_gso_network_seglen(skb);
+
+ if (shinfo->gso_size != GSO_BY_FRAGS)
+- return hlen <= mtu;
++ return seg_len <= max_len;
+
+ /* Undo this so we can re-use header sizes */
+- hlen -= GSO_BY_FRAGS;
++ seg_len -= GSO_BY_FRAGS;
+
+ skb_walk_frags(skb, iter) {
+- if (hlen + skb_headlen(iter) > mtu)
++ if (seg_len + skb_headlen(iter) > max_len)
+ return false;
+ }
+
+ return true;
+ }
++
++/**
++ * skb_gso_validate_mtu - Return in case such skb fits a given MTU
++ *
++ * @skb: GSO skb
++ * @mtu: MTU to validate against
++ *
++ * skb_gso_validate_mtu validates if a given skb will fit a wanted MTU
++ * once split.
++ */
++bool skb_gso_validate_mtu(const struct sk_buff *skb, unsigned int mtu)
++{
++ return skb_gso_size_check(skb, skb_gso_network_seglen(skb), mtu);
++}
+ EXPORT_SYMBOL_GPL(skb_gso_validate_mtu);
+
++/**
++ * skb_gso_validate_mac_len - Will a split GSO skb fit in a given length?
++ *
++ * @skb: GSO skb
++ * @len: length to validate against
++ *
++ * skb_gso_validate_mac_len validates if a given skb will fit a wanted
++ * length once split, including L2, L3 and L4 headers and the payload.
++ */
++bool skb_gso_validate_mac_len(const struct sk_buff *skb, unsigned int len)
++{
++ return skb_gso_size_check(skb, skb_gso_mac_seglen(skb), len);
++}
++EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
++
+ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
+ {
+ int mac_len;
+diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
+index b3f7980b0f27..d646aa770ac8 100644
+--- a/net/sched/sch_tbf.c
++++ b/net/sched/sch_tbf.c
+@@ -142,16 +142,6 @@ static u64 psched_ns_t2l(const struct psched_ratecfg *r,
+ return len;
+ }
+
+-/*
+- * Return length of individual segments of a gso packet,
+- * including all headers (MAC, IP, TCP/UDP)
+- */
+-static unsigned int skb_gso_mac_seglen(const struct sk_buff *skb)
+-{
+- unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+- return hdr_len + skb_gso_transport_seglen(skb);
+-}
+-
+ /* GSO packet is too big, segment it so that tbf can transmit
+ * each segment in time
+ */
+--
+2.19.1
+
--- /dev/null
+dt-bindings-eeprom-at24-add-atmel-24c2048-compatible.patch
+eeprom-at24-add-support-for-24c2048.patch
+uapi-if_ether.h-prevent-redefinition-of-struct-ethhd.patch
+arm-8789-1-signal-copy-registers-using-__copy_to_use.patch
+arm-8791-1-vfp-use-__copy_to_user-when-saving-vfp-st.patch
+arm-8792-1-oabi-compat-copy-oabi-events-using-__copy.patch
+arm-8793-1-signal-replace-__put_user_error-with-__pu.patch
+arm-8794-1-uaccess-prevent-speculative-use-of-the-cu.patch
+arm-8795-1-spectre-v1.1-use-put_user-for-__put_user.patch
+arm-8796-1-spectre-v1-v1.1-provide-helpers-for-addre.patch
+arm-8797-1-spectre-v1.1-harden-__copy_to_user.patch
+arm-8810-1-vfp-fix-wrong-assignement-to-ufp_exc.patch
+arm-make-lookup_processor_type-non-__init.patch
+arm-split-out-processor-lookup.patch
+arm-clean-up-per-processor-check_bugs-method-call.patch
+arm-add-proc_vtable-and-proc_table-macros.patch
+arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch
+arm-ensure-that-processor-vtables-is-not-lost-after-.patch
+arm-fix-the-cockup-in-the-previous-patch.patch
+net-create-skb_gso_validate_mac_len.patch
+bnx2x-disable-gso-where-gso_size-is-too-big-for-hard.patch
+acpi-numa-use-correct-type-for-printing-addresses-on.patch
+cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch
+drm-bridge-tc358767-add-defines-for-dp1_srcctrl-phy_.patch
+drm-bridge-tc358767-fix-single-lane-configuration.patch
+drm-bridge-tc358767-fix-initial-dp0-1_srcctrl-value.patch
+drm-bridge-tc358767-reject-modes-which-require-too-m.patch
+drm-bridge-tc358767-fix-output-h-v-syncs.patch
+arm-dts-da850-evm-correct-the-sound-card-name.patch
+arm-dts-da850-lcdk-correct-the-sound-card-name.patch
+arm-dts-kirkwood-fix-polarity-of-gpio-fan-lines.patch
+gpio-pl061-handle-failed-allocations.patch
+cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch
--- /dev/null
+From c9310f18ccdcdcf844df9d642255d8cf9a098dd8 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Thu, 14 Feb 2019 14:18:00 +0100
+Subject: uapi/if_ether.h: prevent redefinition of struct ethhdr
+
+commit 6926e041a8920c8ec27e4e155efa760aa01551fd upstream.
+
+Musl provides its own ethhdr struct definition. Add a guard to prevent
+its definition of the appropriate musl header has already been included.
+
+glibc does not implement this header, but when glibc will implement this
+they can just define __UAPI_DEF_ETHHDR 0 to make it work with the
+kernel.
+
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/if_ether.h | 3 +++
+ include/uapi/linux/libc-compat.h | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
+index 659b1634de61..b31e2f836317 100644
+--- a/include/uapi/linux/if_ether.h
++++ b/include/uapi/linux/if_ether.h
+@@ -22,6 +22,7 @@
+ #define _UAPI_LINUX_IF_ETHER_H
+
+ #include <linux/types.h>
++#include <linux/libc-compat.h>
+
+ /*
+ * IEEE 802.3 Ethernet magic constants. The frame sizes omit the preamble
+@@ -139,11 +140,13 @@
+ * This is an Ethernet frame header.
+ */
+
++#if __UAPI_DEF_ETHHDR
+ struct ethhdr {
+ unsigned char h_dest[ETH_ALEN]; /* destination eth addr */
+ unsigned char h_source[ETH_ALEN]; /* source ether addr */
+ __be16 h_proto; /* packet type ID field */
+ } __attribute__((packed));
++#endif
+
+
+ #endif /* _UAPI_LINUX_IF_ETHER_H */
+diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
+index 774cb2db1b89..7c098d68d5e5 100644
+--- a/include/uapi/linux/libc-compat.h
++++ b/include/uapi/linux/libc-compat.h
+@@ -263,4 +263,10 @@
+
+ #endif /* __GLIBC__ */
+
++/* Definitions for if_ether.h */
++/* allow libcs like musl to deactivate this, glibc does not implement this. */
++#ifndef __UAPI_DEF_ETHHDR
++#define __UAPI_DEF_ETHHDR 1
++#endif
++
+ #endif /* _UAPI_LIBC_COMPAT_H */
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
