--- /dev/null
+From 22f9b5224fa9a159495a4f2e4588f22c46105cc0 Mon Sep 17 00:00:00 2001
+From: Suman Tripathi <stripathi@apm.com>
+Date: Mon, 29 Dec 2014 08:52:47 +0530
+Subject: ahci_xgene: Fix the DMA state machine lockup for the ATA_CMD_PACKET
+ PIO mode command.
+
+[ Upstream commit 1102407bb714dcebb43f385335bcb72f6b8843bc ]
+
+This patch addresses the issue with ATA_CMD_PACKET pio mode
+command for enumeration and device detection with ATAPI devices.
+The X-Gene AHCI controller has an errata in which it cannot clear
+the BSY bit after the PIO setup FIS. The dma state machine enters
+CMFatalErrorUpdate state and locks up.
+
+Signed-off-by: Suman Tripathi <stripathi@apm.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci_xgene.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c
+index 0ffd3c930bed..d33216155827 100644
+--- a/drivers/ata/ahci_xgene.c
++++ b/drivers/ata/ahci_xgene.c
+@@ -125,10 +125,11 @@ static int xgene_ahci_restart_engine(struct ata_port *ap)
+ * xgene_ahci_qc_issue - Issue commands to the device
+ * @qc: Command to issue
+ *
+- * Due to Hardware errata for IDENTIFY DEVICE command, the controller cannot
+- * clear the BSY bit after receiving the PIO setup FIS. This results in the dma
+- * state machine goes into the CMFatalErrorUpdate state and locks up. By
+- * restarting the dma engine, it removes the controller out of lock up state.
++ * Due to Hardware errata for IDENTIFY DEVICE command and PACKET
++ * command of ATAPI protocol set, the controller cannot clear the BSY bit
++ * after receiving the PIO setup FIS. This results in the DMA state machine
++ * going into the CMFatalErrorUpdate state and locks up. By restarting the
++ * DMA engine, it removes the controller out of lock up state.
+ */
+ static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc)
+ {
+@@ -137,7 +138,8 @@ static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc)
+ struct xgene_ahci_context *ctx = hpriv->plat_data;
+ int rc = 0;
+
+- if (unlikely(ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA))
++ if (unlikely((ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA) ||
++ (ctx->last_cmd[ap->port_no] == ATA_CMD_PACKET)))
+ xgene_ahci_restart_engine(ap);
+
+ rc = ahci_qc_issue(qc);
+--
+2.17.1
+
--- /dev/null
+From 71ec529f0aa9e55f69e42052ddb68ebe1b142828 Mon Sep 17 00:00:00 2001
+From: Mateusz Sylwestrzak <matisec7@gmail.com>
+Date: Sun, 19 Jul 2015 17:38:56 +0200
+Subject: ALSA: hda - Add headset mic support for Acer Aspire V5-573G
+
+[ Upstream commit 0420694dddeb9e269a1ab2129a0119a5cea294a4 ]
+
+Acer Aspire V5 with the ALC282 codec is given the wrong value for the
+0x19 PIN by the laptop's BIOS. Overriding it with the correct value
+adds support for the headset microphone which would not otherwise be
+visible in the system.
+
+The fix is based on commit 7819717b1134 with a similar quirk for Acer
+Aspire with the ALC269 codec.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96201
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mateusz Sylwestrzak <matisec7@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index fd3bbcf317ee..c32d51d51b3e 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5185,7 +5185,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ { 0x14, 0x90170110 },
+ { 0x17, 0x40000008 },
+ { 0x18, 0x411111f0 },
+- { 0x19, 0x411111f0 },
++ { 0x19, 0x01a1913c },
+ { 0x1a, 0x411111f0 },
+ { 0x1b, 0x411111f0 },
+ { 0x1d, 0x40f89b2d },
+--
+2.17.1
+
--- /dev/null
+From 0aa21553471235bbc279f2945340a880e25d8923 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@iki.fi>
+Date: Sun, 13 Dec 2015 20:49:58 +0200
+Subject: ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
+ DragonFly
+
+[ Upstream commit 42e3121d90f42e57f6dbd6083dff2f57b3ec7daa ]
+
+AudioQuest DragonFly DAC reports a volume control range of 0..50
+(0x0000..0x0032) which in USB Audio means a range of 0 .. 0.2dB, which
+is obviously incorrect and would cause software using the dB information
+in e.g. volume sliders to have a massive volume difference in 100..102%
+range.
+
+Commit 2d1cb7f658fb ("ALSA: usb-audio: add dB range mapping for some
+devices") added a dB range mapping for it with range 0..50 dB.
+
+However, the actual volume mapping seems to be neither linear volume nor
+linear dB scale, but instead quite close to the cubic mapping e.g.
+alsamixer uses, with a range of approx. -53...0 dB.
+
+Replace the previous quirk with a custom dB mapping based on some basic
+output measurements, using a 10-item range TLV (which will still fit in
+alsa-lib MAX_TLV_RANGE_SIZE).
+
+Tested on AudioQuest DragonFly HW v1.2. The quirk is only applied if the
+range is 0..50, so if this gets fixed/changed in later HW revisions it
+will no longer be applied.
+
+v2: incorporated Takashi Iwai's suggestion for the quirk application
+method
+
+Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 2 ++
+ sound/usb/mixer_maps.c | 12 ------------
+ sound/usb/mixer_quirks.c | 37 +++++++++++++++++++++++++++++++++++++
+ sound/usb/mixer_quirks.h | 4 ++++
+ 4 files changed, 43 insertions(+), 12 deletions(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 8d90cc5faf88..44812e4a4890 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1347,6 +1347,8 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
+ }
+ }
+
++ snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl);
++
+ range = (cval->max - cval->min) / cval->res;
+ /*
+ * Are there devices with volume range more than 255? I use a bit more
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 2f075cd27344..f0f526ca86e5 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -343,13 +343,6 @@ static struct usbmix_name_map bose_companion5_map[] = {
+ { 0 } /* terminator */
+ };
+
+-/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+-static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+-static struct usbmix_name_map dragonfly_1_2_map[] = {
+- { 7, NULL, .dB = &dragonfly_1_2_dB },
+- { 0 } /* terminator */
+-};
+-
+ /*
+ * Dell usb dock with ALC4020 codec had a firmware problem where it got
+ * screwed up when zero volume is passed; just skip it as a workaround
+@@ -478,11 +471,6 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
+- {
+- /* Dragonfly DAC 1.2 */
+- .id = USB_ID(0x21b4, 0x0081),
+- .map = dragonfly_1_2_map,
+- },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 524366f9d32d..05df7a75a2ea 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -37,6 +37,7 @@
+ #include <sound/control.h>
+ #include <sound/hwdep.h>
+ #include <sound/info.h>
++#include <sound/tlv.h>
+
+ #include "usbaudio.h"
+ #include "mixer.h"
+@@ -1711,3 +1712,39 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
+ }
+ }
+
++static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
++ struct snd_kcontrol *kctl)
++{
++ /* Approximation using 10 ranges based on output measurement on hw v1.2.
++ * This seems close to the cubic mapping e.g. alsamixer uses. */
++ static const DECLARE_TLV_DB_RANGE(scale,
++ 0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970),
++ 2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160),
++ 6, 7, TLV_DB_MINMAX_ITEM(-3884, -3710),
++ 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560),
++ 15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324),
++ 17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031),
++ 20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393),
++ 27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032),
++ 32, 40, TLV_DB_MINMAX_ITEM(-968, -490),
++ 41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
++ );
++
++ usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n");
++ kctl->tlv.p = scale;
++ kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
++ kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
++}
++
++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
++ struct usb_mixer_elem_info *cval, int unitid,
++ struct snd_kcontrol *kctl)
++{
++ switch (mixer->chip->usb_id) {
++ case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
++ if (unitid == 7 && cval->min == 0 && cval->max == 50)
++ snd_dragonfly_quirk_db_scale(mixer, kctl);
++ break;
++ }
++}
++
+diff --git a/sound/usb/mixer_quirks.h b/sound/usb/mixer_quirks.h
+index bdbfab093816..177c329cd4dd 100644
+--- a/sound/usb/mixer_quirks.h
++++ b/sound/usb/mixer_quirks.h
+@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
+ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
+ int unitid);
+
++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
++ struct usb_mixer_elem_info *cval, int unitid,
++ struct snd_kcontrol *kctl);
++
+ #endif /* SND_USB_MIXER_QUIRKS_H */
+
+--
+2.17.1
+
--- /dev/null
+From 1bb18771e5b3c7990490a7150dd4909cdfd018cf Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Date: Thu, 13 Sep 2018 16:48:08 +0100
+Subject: ARM: 8799/1: mm: fix pci_ioremap_io() offset check
+
+[ Upstream commit 3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e ]
+
+IO_SPACE_LIMIT is the ending address of the PCI IO space, i.e
+something like 0xfffff (and not 0x100000).
+
+Therefore, when offset = 0xf0000 is passed as argument, this function
+fails even though the offset + SZ_64K fits below the
+IO_SPACE_LIMIT. This makes the last chunk of 64 KB of the I/O space
+not usable as it cannot be mapped.
+
+This patch fixes that by substracing 1 to offset + SZ_64K, so that we
+compare the addrss of the last byte of the I/O space against
+IO_SPACE_LIMIT instead of the address of the first byte of what is
+after the I/O space.
+
+Fixes: c2794437091a4 ("ARM: Add fixed PCI i/o mapping")
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/ioremap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
+index d1e5ad7ab3bc..1500d3befe02 100644
+--- a/arch/arm/mm/ioremap.c
++++ b/arch/arm/mm/ioremap.c
+@@ -447,7 +447,7 @@ void pci_ioremap_set_mem_type(int mem_type)
+
+ int pci_ioremap_io(unsigned int offset, phys_addr_t phys_addr)
+ {
+- BUG_ON(offset + SZ_64K > IO_SPACE_LIMIT);
++ BUG_ON(offset + SZ_64K - 1 > IO_SPACE_LIMIT);
+
+ return ioremap_page_range(PCI_IO_VIRT_BASE + offset,
+ PCI_IO_VIRT_BASE + offset + SZ_64K,
+--
+2.17.1
+
--- /dev/null
+From b081918d21aa1070f59b933b356e05308dd469ff Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Thu, 16 Mar 2017 18:20:49 +0000
+Subject: arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
+
+[ Upstream commit 90f6e150e44a0dc3883110eeb3ab35d1be42b6bb ]
+
+We don't hold the mmap_sem while searching for the VMAs when
+we try to unmap each memslot for a VM. Fix this properly to
+avoid unexpected results.
+
+Fixes: commit 957db105c997 ("arm/arm64: KVM: Introduce stage2_unmap_vm")
+Cc: stable@vger.kernel.org # v3.19+
+Reviewed-by: Christoffer Dall <cdall@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kvm/mmu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index e506389d02fb..017d6d1e1766 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -760,6 +760,7 @@ void stage2_unmap_vm(struct kvm *kvm)
+ int idx;
+
+ idx = srcu_read_lock(&kvm->srcu);
++ down_read(¤t->mm->mmap_sem);
+ spin_lock(&kvm->mmu_lock);
+
+ slots = kvm_memslots(kvm);
+@@ -767,6 +768,7 @@ void stage2_unmap_vm(struct kvm *kvm)
+ stage2_unmap_memslot(kvm, memslot);
+
+ spin_unlock(&kvm->mmu_lock);
++ up_read(¤t->mm->mmap_sem);
+ srcu_read_unlock(&kvm->srcu, idx);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 36cec9c70ccba5d67b10a75061ebee2d453302d9 Mon Sep 17 00:00:00 2001
+From: Wenyou Yang <wenyou.yang@atmel.com>
+Date: Thu, 11 Dec 2014 15:31:09 +0800
+Subject: ARM: at91: board-dt-sama5: add phy_fixup to override NAND_Tree
+
+[ Upstream commit b8659752c37ec157ee254cff443b1c9d523aea22 ]
+
+Appearance: On some SAMA5D4EK boards, after power up, the Eth1 doesn't work.
+
+Reason: The PIOE2 pin is connected to the NAND_Tree# of KSZ8081,
+But it outputs LOW during the reset period, which cause the NAND_Tree# enabled.
+
+Add phy_fixup() to disable NAND_Tree by overriding the Operation
+Mode Strap Override register(i.e. Register 16h) to clear the NAND_Tree bit.
+
+Signed-off-by: Wenyou Yang <wenyou.yang@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/board-dt-sama5.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/arm/mach-at91/board-dt-sama5.c b/arch/arm/mach-at91/board-dt-sama5.c
+index 129e2917506b..5e4cedfa5c51 100644
+--- a/arch/arm/mach-at91/board-dt-sama5.c
++++ b/arch/arm/mach-at91/board-dt-sama5.c
+@@ -17,6 +17,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/phy.h>
+ #include <linux/clk-provider.h>
++#include <linux/phy.h>
+
+ #include <asm/setup.h>
+ #include <asm/irq.h>
+@@ -27,8 +28,25 @@
+ #include "at91_aic.h"
+ #include "generic.h"
+
++static int ksz8081_phy_fixup(struct phy_device *phy)
++{
++ int value;
++
++ value = phy_read(phy, 0x16);
++ value &= ~0x20;
++ phy_write(phy, 0x16, value);
++
++ return 0;
++}
++
+ static void __init sama5_dt_device_init(void)
+ {
++ if (of_machine_is_compatible("atmel,sama5d4ek") &&
++ IS_ENABLED(CONFIG_PHYLIB)) {
++ phy_register_fixup_for_id("fc028000.etherne:00",
++ ksz8081_phy_fixup);
++ }
++
+ of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 77b073aa0ad24a386933012ccf41cac42a024494 Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexanders83@web.de>
+Date: Fri, 5 Dec 2014 14:31:39 +0100
+Subject: ARM: at91/dt: sam9263: Add missing clocks to lcdc node
+
+[ Upstream commit 55eb9c343fdd3611ae3de6ab8a8512f303d3f581 ]
+
+atmel_lcdfb needs also uses hclk clock, but AT91SAM9263 doesn't have that
+specific clock, so use lcd_clk twice. The same was done in
+arch/arm/mach-at91/at91sam9263.c
+
+Signed-off-by: Alexander Stein <alexanders83@web.de>
+Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9263.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
+index 51416c7d0625..272fdd64197c 100644
+--- a/arch/arm/boot/dts/at91sam9263.dtsi
++++ b/arch/arm/boot/dts/at91sam9263.dtsi
+@@ -913,6 +913,8 @@
+ interrupts = <26 IRQ_TYPE_LEVEL_HIGH 3>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_fb>;
++ clocks = <&lcd_clk>, <&lcd_clk>;
++ clock-names = "lcdc_clk", "hclk";
+ status = "disabled";
+ };
+
+--
+2.17.1
+
--- /dev/null
+From 444df73f446ebffab4fa94b419f49443855415b0 Mon Sep 17 00:00:00 2001
+From: Bo Shen <voice.shen@atmel.com>
+Date: Thu, 11 Dec 2014 10:54:33 +0800
+Subject: ARM: at91/dt: sama5d4: fix the timer reg length
+
+[ Upstream commit 0068b2e1b7f925a818fdc0a5d10ef0ad40f746e7 ]
+
+The second property of reg is the length, so correct it for timer.
+
+Signed-off-by: Bo Shen <voice.shen@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sama5d4.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
+index 0837c1afd666..24e7b237c048 100644
+--- a/arch/arm/boot/dts/sama5d4.dtsi
++++ b/arch/arm/boot/dts/sama5d4.dtsi
+@@ -939,7 +939,7 @@
+
+ pit: timer@fc068630 {
+ compatible = "atmel,at91sam9260-pit";
+- reg = <0xfc068630 0xf>;
++ reg = <0xfc068630 0x10>;
+ interrupts = <3 IRQ_TYPE_LEVEL_HIGH 5>;
+ clocks = <&h32ck>;
+ };
+--
+2.17.1
+
--- /dev/null
+From 32097a8b19a574b2fe8e701f2a287a3a47131eeb Mon Sep 17 00:00:00 2001
+From: Bo Shen <voice.shen@atmel.com>
+Date: Fri, 9 Jan 2015 17:18:16 +0800
+Subject: ARM: at91: sama5d3: dt: correct the sound route
+
+[ Upstream commit 04582fd03fb263598e3b126c76cc42195aa0fd05 ]
+
+The MICBIAS is a supply, should route to MIC while not IN1L.
+
+Signed-off-by: Bo Shen <voice.shen@atmel.com>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sama5d3xmb.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sama5d3xmb.dtsi b/arch/arm/boot/dts/sama5d3xmb.dtsi
+index 49c10d33df30..77e03655aca3 100644
+--- a/arch/arm/boot/dts/sama5d3xmb.dtsi
++++ b/arch/arm/boot/dts/sama5d3xmb.dtsi
+@@ -176,7 +176,7 @@
+ "Headphone Jack", "HPOUTR",
+ "IN2L", "Line In Jack",
+ "IN2R", "Line In Jack",
+- "MICBIAS", "IN1L",
++ "Mic", "MICBIAS",
+ "IN1L", "Mic";
+
+ atmel,ssc-controller = <&ssc0>;
+--
+2.17.1
+
--- /dev/null
+From 2649cd2e6f7235e6ac92c432e7abd355c6efaf21 Mon Sep 17 00:00:00 2001
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Mon, 5 Jan 2015 15:45:45 -0800
+Subject: ARM: dra7xx: Fix counter frequency drift for AM572x errata i856
+
+[ Upstream commit afc9d590b8a150cfeaac0078ef5de6fb21a5ea6a ]
+
+Errata i856 for the AM572x (DRA7xx) points out that the 32.768KHz external
+crystal is not enabled at power up. Instead the CPU falls back to using
+an emulation for the 32KHz clock which is SYSCLK1/610. SYSCLK1 is usually
+20MHz on boards so far (which gives an emulated frequency of 32.786KHz),
+but can also be 19.2 or 27MHz which result in much larger drift.
+
+Since this is used to drive the master counter at 32.768KHz * 375 /
+2 = 6.144MHz, the emulated speed for 20MHz is of by 570ppm, or about 43
+seconds per day, and more than the 500ppm NTP is able to tolerate.
+
+Checking the CTRL_CORE_BOOTSTRAP register can determine if the CPU
+is using the real 32.768KHz crystal or the emulated SYSCLK1/610, and
+by known that the real counter frequency can be determined and used.
+The real speed is then SYSCLK1 / 610 * 375 / 2 or SYSCLK1 * 75 / 244.
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Tested-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/control.h | 4 ++++
+ arch/arm/mach-omap2/timer.c | 36 +++++++++++++++++++++++++++++++++--
+ 2 files changed, 38 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/control.h b/arch/arm/mach-omap2/control.h
+index a3c013345c45..a80ac2d70bb1 100644
+--- a/arch/arm/mach-omap2/control.h
++++ b/arch/arm/mach-omap2/control.h
+@@ -286,6 +286,10 @@
+ #define OMAP5XXX_CONTROL_STATUS 0x134
+ #define OMAP5_DEVICETYPE_MASK (0x7 << 6)
+
++/* DRA7XX CONTROL CORE BOOTSTRAP */
++#define DRA7_CTRL_CORE_BOOTSTRAP 0x6c4
++#define DRA7_SPEEDSELECT_MASK (0x3 << 8)
++
+ /*
+ * REVISIT: This list of registers is not comprehensive - there are more
+ * that should be added.
+diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
+index fb0cb2b817a9..7d45c84c69ba 100644
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -54,6 +54,7 @@
+
+ #include "soc.h"
+ #include "common.h"
++#include "control.h"
+ #include "powerdomain.h"
+ #include "omap-secure.h"
+
+@@ -496,7 +497,8 @@ static void __init realtime_counter_init(void)
+ void __iomem *base;
+ static struct clk *sys_clk;
+ unsigned long rate;
+- unsigned int reg, num, den;
++ unsigned int reg;
++ unsigned long long num, den;
+
+ base = ioremap(REALTIME_COUNTER_BASE, SZ_32);
+ if (!base) {
+@@ -511,6 +513,35 @@ static void __init realtime_counter_init(void)
+ }
+
+ rate = clk_get_rate(sys_clk);
++
++ if (soc_is_dra7xx()) {
++ /*
++ * Errata i856 says the 32.768KHz crystal does not start at
++ * power on, so the CPU falls back to an emulated 32KHz clock
++ * based on sysclk / 610 instead. This causes the master counter
++ * frequency to not be 6.144MHz but at sysclk / 610 * 375 / 2
++ * (OR sysclk * 75 / 244)
++ *
++ * This affects at least the DRA7/AM572x 1.0, 1.1 revisions.
++ * Of course any board built without a populated 32.768KHz
++ * crystal would also need this fix even if the CPU is fixed
++ * later.
++ *
++ * Either case can be detected by using the two speedselect bits
++ * If they are not 0, then the 32.768KHz clock driving the
++ * coarse counter that corrects the fine counter every time it
++ * ticks is actually rate/610 rather than 32.768KHz and we
++ * should compensate to avoid the 570ppm (at 20MHz, much worse
++ * at other rates) too fast system time.
++ */
++ reg = omap_ctrl_readl(DRA7_CTRL_CORE_BOOTSTRAP);
++ if (reg & DRA7_SPEEDSELECT_MASK) {
++ num = 75;
++ den = 244;
++ goto sysclk1_based;
++ }
++ }
++
+ /* Numerator/denumerator values refer TRM Realtime Counter section */
+ switch (rate) {
+ case 12000000:
+@@ -545,6 +576,7 @@ static void __init realtime_counter_init(void)
+ break;
+ }
+
++sysclk1_based:
+ /* Program numerator and denumerator registers */
+ reg = readl_relaxed(base + INCREMENTER_NUMERATOR_OFFSET) &
+ NUMERATOR_DENUMERATOR_MASK;
+@@ -556,7 +588,7 @@ static void __init realtime_counter_init(void)
+ reg |= den;
+ writel_relaxed(reg, base + INCREMENTER_DENUMERATOR_RELOAD_OFFSET);
+
+- arch_timer_freq = (rate / den) * num;
++ arch_timer_freq = DIV_ROUND_UP_ULL(rate * num, den);
+ set_cntfreq();
+
+ iounmap(base);
+--
+2.17.1
+
--- /dev/null
+From 9cb765a406d3cc13d95c542bdde4797001c9e2d4 Mon Sep 17 00:00:00 2001
+From: Abhilash Kesavan <a.kesavan@samsung.com>
+Date: Sat, 10 Jan 2015 08:41:36 +0530
+Subject: ARM: dts: disable CCI on exynos5420 based arndale-octa
+
+[ Upstream commit 25217fef355174209eff68c0eb438a8af5d7b01c ]
+
+The arndale-octa board was giving "imprecise external aborts" during
+boot-up with MCPM enabled. CCI enablement of the boot cluster was found
+to be the cause of these aborts (possibly because the secure f/w was not
+allowing it). Hence, disable CCI for the arndale-octa board.
+
+Signed-off-by: Abhilash Kesavan <a.kesavan@samsung.com>
+Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Tested-by: Kevin Hilman <khilman@linaro.org>
+Tested-by: Tyler Baker <tyler.baker@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-arndale-octa.dts | 4 ++++
+ arch/arm/boot/dts/exynos5420.dtsi | 2 +-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+index aa7a7d727a7e..db2c1c4cd900 100644
+--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+@@ -372,3 +372,7 @@
+ &usbdrd_dwc3_1 {
+ dr_mode = "host";
+ };
++
++&cci {
++ status = "disabled";
++};
+diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
+index 1353a092134f..9655a3efbd15 100644
+--- a/arch/arm/boot/dts/exynos5420.dtsi
++++ b/arch/arm/boot/dts/exynos5420.dtsi
+@@ -120,7 +120,7 @@
+ };
+ };
+
+- cci@10d20000 {
++ cci: cci@10d20000 {
+ compatible = "arm,cci-400";
+ #address-cells = <1>;
+ #size-cells = <1>;
+--
+2.17.1
+
--- /dev/null
+From ae28bebe73164598d29574ec26a67fe8bac36c5a Mon Sep 17 00:00:00 2001
+From: Vivek Gautam <gautam.vivek@samsung.com>
+Date: Fri, 9 Jan 2015 01:08:48 +0900
+Subject: arm: dts: Use pmu_system_controller phandle for dp phy
+
+[ Upstream commit e93e54544adf3aa6908b821e896cb17a562cb683 ]
+
+DP PHY now require pmu-system-controller to handle PMU register
+to control PHY's power isolation. Adding the same to dp-phy
+node.
+
+Signed-off-by: Vivek Gautam <gautam.vivek@samsung.com>
+Reviewed-by: Jingoo Han <jg1.han@samsung.com>
+Tested-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
+Signed-off-by: Kukjin Kim <kgene@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250.dtsi | 2 +-
+ arch/arm/boot/dts/exynos5420.dtsi | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
+index d55c1a2eb798..251226eefad7 100644
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -732,7 +732,7 @@
+
+ dp_phy: video-phy@10040720 {
+ compatible = "samsung,exynos5250-dp-video-phy";
+- reg = <0x10040720 4>;
++ samsung,pmu-syscon = <&pmu_system_controller>;
+ #phy-cells = <0>;
+ };
+
+diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi
+index 8617a031cbc0..1353a092134f 100644
+--- a/arch/arm/boot/dts/exynos5420.dtsi
++++ b/arch/arm/boot/dts/exynos5420.dtsi
+@@ -503,8 +503,8 @@
+ };
+
+ dp_phy: video-phy@10040728 {
+- compatible = "samsung,exynos5250-dp-video-phy";
+- reg = <0x10040728 4>;
++ compatible = "samsung,exynos5420-dp-video-phy";
++ samsung,pmu-syscon = <&pmu_system_controller>;
+ #phy-cells = <0>;
+ };
+
+--
+2.17.1
+
--- /dev/null
+From 31464eaadc47765e761f2ea27b6a059aee680019 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 5 Jan 2015 15:45:45 -0800
+Subject: ARM: OMAP2+: Fix n900 board name for legacy user space
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 71c4f6027da75c6c1fd92e05b63108a09ec2b109 ]
+
+N900 legacy user space apps need the board name in
+/proc/cpuinfo to work properly for the Hardware entry.
+
+For other boards this should not be an issues and they
+can use the generic Hardware entry.
+
+Let's fix the issue by adding a custom DT_MACHINE_START
+for n900.
+
+Tested-by: Pali Rohár <pali.rohar@gmail.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/board-generic.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
+index 608079a1aba6..b61c049f92d6 100644
+--- a/arch/arm/mach-omap2/board-generic.c
++++ b/arch/arm/mach-omap2/board-generic.c
+@@ -77,6 +77,24 @@ MACHINE_END
+ #endif
+
+ #ifdef CONFIG_ARCH_OMAP3
++/* Some boards need board name for legacy userspace in /proc/cpuinfo */
++static const char *const n900_boards_compat[] __initconst = {
++ "nokia,omap3-n900",
++ NULL,
++};
++
++DT_MACHINE_START(OMAP3_N900_DT, "Nokia RX-51 board")
++ .reserve = omap_reserve,
++ .map_io = omap3_map_io,
++ .init_early = omap3430_init_early,
++ .init_machine = omap_generic_init,
++ .init_late = omap3_init_late,
++ .init_time = omap3_sync32k_timer_init,
++ .dt_compat = n900_boards_compat,
++ .restart = omap3xxx_restart,
++MACHINE_END
++
++/* Generic omap3 boards, most boards can use these */
+ static const char *const omap3_boards_compat[] __initconst = {
+ "ti,omap3430",
+ "ti,omap3",
+--
+2.17.1
+
--- /dev/null
+From 118f841a3b8b33fd0502334494197737cec5d51b Mon Sep 17 00:00:00 2001
+From: Matthijs van Duin <matthijsvanduin@gmail.com>
+Date: Thu, 16 Feb 2017 01:05:04 +0100
+Subject: ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build
+
+[ Upstream commit 448c077eeb02240c430db2a2c3bf5285a4c65d66 ]
+
+'adr' yields a data-pointer, not a function-pointer.
+
+Fixes: 999f934de195 ("ARM: omap5/dra7xx: Enable booting secondary
+CPU in HYP mode")
+Signed-off-by: Matthijs van Duin <matthijsvanduin@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap-headsmp.S | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S
+index 6d1dffca6c7b..748dde9fa4a5 100644
+--- a/arch/arm/mach-omap2/omap-headsmp.S
++++ b/arch/arm/mach-omap2/omap-headsmp.S
+@@ -17,6 +17,7 @@
+
+ #include <linux/linkage.h>
+ #include <linux/init.h>
++#include <asm/assembler.h>
+
+ #include "omap44xx.h"
+
+@@ -56,7 +57,7 @@ wait_2: ldr r2, =AUX_CORE_BOOT0_PA @ read from AuxCoreBoot0
+ cmp r0, r4
+ bne wait_2
+ ldr r12, =API_HYP_ENTRY
+- adr r0, hyp_boot
++ badr r0, hyp_boot
+ smc #0
+ hyp_boot:
+ b secondary_startup
+--
+2.17.1
+
--- /dev/null
+From 7686b631db40af912323f0951863407e8d70b25b Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 17 Dec 2014 14:40:42 +0100
+Subject: ARM: shmobile: r8a7740: Instantiate GIC from C board code in legacy
+ builds
+
+[ Upstream commit d034f53cc6c5c09a4e10cb9716986f3844c58514 ]
+
+As of commit 9a1091ef0017c40a ("irqchip: gic: Support hierarchy irq
+domain."), armadillo-legacy hangs during boot with:
+
+ sh-tmu.0: ch0: used for clock events
+ sh-tmu.0: ch0: used for periodic clock events
+ sh-tmu.0: ch0: failed to request irq 230
+ sh-tmu.0: ch1: used as clock source
+ sh-cmt-48.1: ch0: failed to request irq 90
+ sh-cmt-48.1: ch0: registration failed
+ earlytimer: unable to probe sh-cmt-48 early.
+ Calibrating delay loop...
+
+This happens because the IRQ numbers of the GIC are now virtual, and no
+longer match the hardcoded hardware IRQ numbers in the platform board
+code.
+To fix this, instantiate the GIC from platform board code when compiling
+a legacy kernel, like is done on sh73a0 for kzm9g-legacy.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-shmobile/setup-r8a7740.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm/mach-shmobile/setup-r8a7740.c b/arch/arm/mach-shmobile/setup-r8a7740.c
+index 8894e1b7ab0e..6ccdc4574c89 100644
+--- a/arch/arm/mach-shmobile/setup-r8a7740.c
++++ b/arch/arm/mach-shmobile/setup-r8a7740.c
+@@ -792,7 +792,14 @@ void __init r8a7740_init_irq_of(void)
+ void __iomem *intc_msk_base = ioremap_nocache(0xe6900040, 0x10);
+ void __iomem *pfc_inta_ctrl = ioremap_nocache(0xe605807c, 0x4);
+
++#ifdef CONFIG_ARCH_SHMOBILE_LEGACY
++ void __iomem *gic_dist_base = ioremap_nocache(0xc2800000, 0x1000);
++ void __iomem *gic_cpu_base = ioremap_nocache(0xc2000000, 0x1000);
++
++ gic_init(0, 29, gic_dist_base, gic_cpu_base);
++#else
+ irqchip_init();
++#endif
+
+ /* route signals to GIC */
+ iowrite32(0x0, pfc_inta_ctrl);
+--
+2.17.1
+
--- /dev/null
+From 02b89dd5aa73859eea78b057890ec63bb89669dc Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:50 -0700
+Subject: asix: Check for supported Wake-on-LAN modes
+
+[ Upstream commit c4ce446e33d7a0e978256ac6fea4c80e59d9de5f ]
+
+The driver currently silently accepts unsupported Wake-on-LAN modes
+(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
+which is confusing.
+
+Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/asix_common.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c
+index 75d6f26729a3..ad81af135a32 100644
+--- a/drivers/net/usb/asix_common.c
++++ b/drivers/net/usb/asix_common.c
+@@ -417,6 +417,9 @@ int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+ struct usbnet *dev = netdev_priv(net);
+ u8 opt = 0;
+
++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
++ return -EINVAL;
++
+ if (wolinfo->wolopts & WAKE_PHY)
+ opt |= AX_MONITOR_LINK;
+ if (wolinfo->wolopts & WAKE_MAGIC)
+--
+2.17.1
+
--- /dev/null
+From 922ecb1b7c03c4c106e1613247c35ef0948f5fc7 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Tue, 21 Jul 2015 11:51:35 +0200
+Subject: ASoC: dapm: Don't add prefix to widget stream name
+
+[ Upstream commit a798c24a69b64f09e2d323ac8155a36373e5d5fd ]
+
+Commit fdb6eb0a1287 ("ASoC: dapm: Modify widget stream name according to
+prefix") fixed the case where a DAPM route between a DAI widget and a
+DAC/ADC/AIF widget with a matching stream name was not created when the
+DAPM context was using a prefix.
+
+Unfortunately the patch introduced a few issues on its own like leaking the
+dynamically allocated stream name memory and also not checking whether the
+allocation succeeded in the first place.
+
+It is also incomplete in that it still does not handle the case where
+stream name of the widget is a substring of the stream name of the DAI,
+which is explicitly allowed and works fine if no DAPM prefix is used.
+
+Revert the commit and take a slightly different approach to solving the
+issue. Instead of comparing the widget's stream name to the name of the DAI
+widget compare it to the stream name of the DAI widget. The stream name of
+the DAI widget is identical to the name of the DAI widget except that it
+wont have the DAPM prefix added. So this approach behaves identical
+regardless to whether the DAPM context uses a prefix or not.
+
+We don't have to worry about potentially matching with a widget with the
+same stream name, but from a different DAPM context with a different
+prefix, since the code already makes sure that both the DAI widget and the
+matched widget are from the same DAPM context.
+
+Fixes: fdb6eb0a1287 ("ASoC: dapm: Modify widget stream name according to prefix")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index d8ac9e5e2c00..d15c34e2f04f 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3087,16 +3087,10 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ }
+
+ prefix = soc_dapm_prefix(dapm);
+- if (prefix) {
++ if (prefix)
+ w->name = kasprintf(GFP_KERNEL, "%s %s", prefix, widget->name);
+- if (widget->sname)
+- w->sname = kasprintf(GFP_KERNEL, "%s %s", prefix,
+- widget->sname);
+- } else {
++ else
+ w->name = kasprintf(GFP_KERNEL, "%s", widget->name);
+- if (widget->sname)
+- w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
+- }
+ if (w->name == NULL) {
+ kfree(w);
+ return NULL;
+@@ -3422,7 +3416,7 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
+ break;
+ }
+
+- if (!w->sname || !strstr(w->sname, dai_w->name))
++ if (!w->sname || !strstr(w->sname, dai_w->sname))
+ continue;
+
+ if (dai_w->id == snd_soc_dapm_dai_in) {
+--
+2.17.1
+
--- /dev/null
+From e3054b2ba5b8a3a962950d86983756a15ea45a08 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:51 -0700
+Subject: ax88179_178a: Check for supported Wake-on-LAN modes
+
+[ Upstream commit 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 ]
+
+The driver currently silently accepts unsupported Wake-on-LAN modes
+(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
+which is confusing.
+
+Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ax88179_178a.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index e6338c16081a..e3f2e6098db4 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+ struct usbnet *dev = netdev_priv(net);
+ u8 opt = 0;
+
++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
++ return -EINVAL;
++
+ if (wolinfo->wolopts & WAKE_PHY)
+ opt |= AX_MONITOR_MODE_RWLC;
+ if (wolinfo->wolopts & WAKE_MAGIC)
+--
+2.17.1
+
--- /dev/null
+From bcab29bf6e4fdb81e5075265fd5396a22478b9d5 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Tue, 31 Mar 2015 14:16:52 +0100
+Subject: Btrfs: avoid syncing log in the fast fsync path when not necessary
+
+[ Upstream commit b659ef027792219b590d67a2baf1643a93727d29 ]
+
+Commit 3a8b36f37806 ("Btrfs: fix data loss in the fast fsync path") added
+a performance regression for that causes an unnecessary sync of the log
+trees (fs/subvol and root log trees) when 2 consecutive fsyncs are done
+against a file, without no writes or any metadata updates to the inode in
+between them and if a transaction is committed before the second fsync is
+called.
+
+Huang Ying reported this to lkml (https://lkml.org/lkml/2015/3/18/99)
+after a test sysbench test that measured a -62% decrease of file io
+requests per second for that tests' workload.
+
+The test is:
+
+ echo performance > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor
+ echo performance > /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor
+ echo performance > /sys/devices/system/cpu/cpu2/cpufreq/scaling_governor
+ echo performance > /sys/devices/system/cpu/cpu3/cpufreq/scaling_governor
+ mkfs -t btrfs /dev/sda2
+ mount -t btrfs /dev/sda2 /fs/sda2
+ cd /fs/sda2
+ for ((i = 0; i < 1024; i++)); do fallocate -l 67108864 testfile.$i; done
+ sysbench --test=fileio --max-requests=0 --num-threads=4 --max-time=600 \
+ --file-test-mode=rndwr --file-total-size=68719476736 --file-io-mode=sync \
+ --file-num=1024 run
+
+A test on kvm guest, running a debug kernel gave me the following results:
+
+Without 3a8b36f378060d: 16.01 reqs/sec
+With 3a8b36f378060d: 3.39 reqs/sec
+With 3a8b36f378060d and this patch: 16.04 reqs/sec
+
+Reported-by: Huang Ying <ying.huang@intel.com>
+Tested-by: Huang, Ying <ying.huang@intel.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 9 ++++++---
+ fs/btrfs/ordered-data.c | 14 ++++++++++++++
+ fs/btrfs/ordered-data.h | 3 +++
+ 3 files changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 2ad4cb3da8f6..ba37ec6263ca 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1879,6 +1879,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ struct btrfs_log_ctx ctx;
+ int ret = 0;
+ bool full_sync = 0;
++ const u64 len = end - start + 1;
+
+ trace_btrfs_sync_file(file, datasync);
+
+@@ -1907,7 +1908,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * all extents are persisted and the respective file extent
+ * items are in the fs/subvol btree.
+ */
+- ret = btrfs_wait_ordered_range(inode, start, end - start + 1);
++ ret = btrfs_wait_ordered_range(inode, start, len);
+ } else {
+ /*
+ * Start any new ordered operations before starting to log the
+@@ -1979,8 +1980,10 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ */
+ smp_mb();
+ if (btrfs_inode_in_log(inode, root->fs_info->generation) ||
+- (full_sync && BTRFS_I(inode)->last_trans <=
+- root->fs_info->last_trans_committed)) {
++ (BTRFS_I(inode)->last_trans <=
++ root->fs_info->last_trans_committed &&
++ (full_sync ||
++ !btrfs_have_ordered_extents_in_range(inode, start, len)))) {
+ /*
+ * We'v had everything committed since the last time we were
+ * modified so clear this flag in case it was set for whatever
+diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
+index b23d024c0234..4c20199cef62 100644
+--- a/fs/btrfs/ordered-data.c
++++ b/fs/btrfs/ordered-data.c
+@@ -848,6 +848,20 @@ out:
+ return entry;
+ }
+
++bool btrfs_have_ordered_extents_in_range(struct inode *inode,
++ u64 file_offset,
++ u64 len)
++{
++ struct btrfs_ordered_extent *oe;
++
++ oe = btrfs_lookup_ordered_range(inode, file_offset, len);
++ if (oe) {
++ btrfs_put_ordered_extent(oe);
++ return true;
++ }
++ return false;
++}
++
+ /*
+ * lookup and return any extent before 'file_offset'. NULL is returned
+ * if none is found
+diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h
+index 0124bffc775f..a1bce0a5cccc 100644
+--- a/fs/btrfs/ordered-data.h
++++ b/fs/btrfs/ordered-data.h
+@@ -191,6 +191,9 @@ btrfs_lookup_first_ordered_extent(struct inode * inode, u64 file_offset);
+ struct btrfs_ordered_extent *btrfs_lookup_ordered_range(struct inode *inode,
+ u64 file_offset,
+ u64 len);
++bool btrfs_have_ordered_extents_in_range(struct inode *inode,
++ u64 file_offset,
++ u64 len);
+ int btrfs_ordered_update_i_size(struct inode *inode, u64 offset,
+ struct btrfs_ordered_extent *ordered);
+ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
+--
+2.17.1
+
--- /dev/null
+From 0040a24b8cdf753205e0623c48a8310cfaeb0524 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 23 Feb 2015 19:50:49 +0000
+Subject: Btrfs: do not ignore errors from btrfs_lookup_xattr in do_setxattr
+
+[ Upstream commit 5cdf83edb8e41cad1ec8eab2d402b4f9d9eb7ee0 ]
+
+The return value from btrfs_lookup_xattr() can be a pointer encoding an
+error, therefore deal with it. This fixes commit 5f5bc6b1e2d5
+("Btrfs: make xattr replace operations atomic").
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/xattr.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index fbb0533e977f..de5d69a63e3f 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -111,6 +111,8 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
+ name, name_len, -1);
+ if (!di && (flags & XATTR_REPLACE))
+ ret = -ENODATA;
++ else if (IS_ERR(di))
++ ret = PTR_ERR(di);
+ else if (di)
+ ret = btrfs_delete_one_dir_name(trans, root, path, di);
+ goto out;
+@@ -127,10 +129,12 @@ static int do_setxattr(struct btrfs_trans_handle *trans,
+ ASSERT(mutex_is_locked(&inode->i_mutex));
+ di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode),
+ name, name_len, 0);
+- if (!di) {
++ if (!di)
+ ret = -ENODATA;
++ else if (IS_ERR(di))
++ ret = PTR_ERR(di);
++ if (ret)
+ goto out;
+- }
+ btrfs_release_path(path);
+ di = NULL;
+ }
+--
+2.17.1
+
--- /dev/null
+From 7c71a3f0d169d56638640102fb29b4c8172fdb7a Mon Sep 17 00:00:00 2001
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Date: Wed, 5 Sep 2018 08:06:12 +0300
+Subject: cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
+
+[ Upstream commit 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8 ]
+
+Core regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since
+the regulatory request is zeroed, wiphy_idx was always implicitly set to
+0. This resulted in updating only phy #0.
+Fix that.
+
+Fixes: 806a9e39670b ("cfg80211: make regulatory_request use wiphy_idx instead of wiphy")
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+[add fixes tag]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 6fd53ea30193..306464b3acdb 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2033,6 +2033,7 @@ static int regulatory_hint_core(const char *alpha2)
+ request->alpha2[0] = alpha2[0];
+ request->alpha2[1] = alpha2[1];
+ request->initiator = NL80211_REGDOM_SET_BY_CORE;
++ request->wiphy_idx = WIPHY_IDX_INVALID;
+
+ queue_regulatory_request(request);
+
+--
+2.17.1
+
--- /dev/null
+From 40b48f1dd22107675cd9baf3c540280ab2ea9ad2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Heiko=20St=C3=BCbner?= <heiko@sntech.de>
+Date: Fri, 16 Jan 2015 17:52:44 +0100
+Subject: clk: rockchip: fix deadlock possibility in cpuclk
+
+[ Upstream commit a5e1baf7dca10f8cf945394034013260297bc416 ]
+
+Lockdep reported a possible deadlock between the cpuclk lock and for example
+the i2c driver.
+
+ CPU0 CPU1
+ ---- ----
+ lock(clk_lock);
+ local_irq_disable();
+ lock(&(&i2c->lock)->rlock);
+ lock(clk_lock);
+ <Interrupt>
+ lock(&(&i2c->lock)->rlock);
+
+ *** DEADLOCK ***
+
+The generic clock-types of the core ccf already use spin_lock_irqsave when
+touching clock registers, so do the same for the cpuclk.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Reviewed-by: Doug Anderson <dianders@chromium.org>
+Signed-off-by: Michael Turquette <mturquette@linaro.org>
+[mturquette@linaro.org: removed initialization of "flags"]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-cpu.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-cpu.c b/drivers/clk/rockchip/clk-cpu.c
+index 75c8c45ef728..8539c4fd34cc 100644
+--- a/drivers/clk/rockchip/clk-cpu.c
++++ b/drivers/clk/rockchip/clk-cpu.c
+@@ -124,10 +124,11 @@ static int rockchip_cpuclk_pre_rate_change(struct rockchip_cpuclk *cpuclk,
+ {
+ const struct rockchip_cpuclk_reg_data *reg_data = cpuclk->reg_data;
+ unsigned long alt_prate, alt_div;
++ unsigned long flags;
+
+ alt_prate = clk_get_rate(cpuclk->alt_parent);
+
+- spin_lock(cpuclk->lock);
++ spin_lock_irqsave(cpuclk->lock, flags);
+
+ /*
+ * If the old parent clock speed is less than the clock speed
+@@ -164,7 +165,7 @@ static int rockchip_cpuclk_pre_rate_change(struct rockchip_cpuclk *cpuclk,
+ cpuclk->reg_base + reg_data->core_reg);
+ }
+
+- spin_unlock(cpuclk->lock);
++ spin_unlock_irqrestore(cpuclk->lock, flags);
+ return 0;
+ }
+
+@@ -173,6 +174,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk,
+ {
+ const struct rockchip_cpuclk_reg_data *reg_data = cpuclk->reg_data;
+ const struct rockchip_cpuclk_rate_table *rate;
++ unsigned long flags;
+
+ rate = rockchip_get_cpuclk_settings(cpuclk, ndata->new_rate);
+ if (!rate) {
+@@ -181,7 +183,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk,
+ return -EINVAL;
+ }
+
+- spin_lock(cpuclk->lock);
++ spin_lock_irqsave(cpuclk->lock, flags);
+
+ if (ndata->old_rate < ndata->new_rate)
+ rockchip_cpuclk_set_dividers(cpuclk, rate);
+@@ -201,7 +203,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk,
+ if (ndata->old_rate > ndata->new_rate)
+ rockchip_cpuclk_set_dividers(cpuclk, rate);
+
+- spin_unlock(cpuclk->lock);
++ spin_unlock_irqrestore(cpuclk->lock, flags);
+ return 0;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From a5403bf1921b79e042818af726b428d44b6477c2 Mon Sep 17 00:00:00 2001
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+Date: Tue, 17 Jan 2017 13:54:36 +0900
+Subject: clocksource/exynos_mct: Clear interrupt when cpu is shut down
+
+[ Upstream commit bc7c36eedb0c7004aa06c2afc3c5385adada8fa3 ]
+
+When a CPU goes offline a potentially pending timer interrupt is not
+cleared. When the CPU comes online again then the pending interrupt is
+delivered before the per cpu clockevent device is initialized. As a
+consequence the tick interrupt handler dereferences a NULL pointer.
+
+[ 51.251378] Unable to handle kernel NULL pointer dereference at virtual address 00000040
+[ 51.289348] task: ee942d00 task.stack: ee960000
+[ 51.293861] PC is at tick_periodic+0x38/0xb0
+[ 51.298102] LR is at tick_handle_periodic+0x1c/0x90
+
+Clear the pending interrupt in the cpu dying path.
+
+Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
+Reported-by: Seung-Woo Kim <sw0312.kim@samsung.com>
+Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Cc: linux-samsung-soc@vger.kernel.org
+Cc: cw00.choi@samsung.com
+Cc: daniel.lezcano@linaro.org
+Cc: stable@vger.kernel.org
+Cc: javier@osg.samsung.com
+Cc: kgene@kernel.org
+Cc: krzk@kernel.org
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lkml.kernel.org/r/1484628876-22065-1-git-send-email-jy0922.shim@samsung.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/exynos_mct.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index c844616028d2..714f9a767b17 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -487,6 +487,7 @@ static void exynos4_local_timer_stop(struct clock_event_device *evt)
+ if (mct_int_type == MCT_INT_SPI) {
+ if (evt->irq != -1)
+ disable_irq_nosync(evt->irq);
++ exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
+ } else {
+ disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
+ }
+--
+2.17.1
+
--- /dev/null
+From e889e3ac98fcb8ce1fbc98616147c3883c118f9a Mon Sep 17 00:00:00 2001
+From: Ian Munsie <imunsie@au1.ibm.com>
+Date: Wed, 7 Jan 2015 16:33:04 +1100
+Subject: cxl: Fix issues when unmapping contexts
+
+[ Upstream commit 0712dc7e73e59d79bcead5d5520acf4e9e917e87 ]
+
+An issue was introduced with "cxl: Unmap MMIO regions when detaching a
+context" (b123429e6a9e8d03aacf888d23262835f0081448) where closing a
+context normally could also unmap the problem state area of other
+contexts currently using the AFU.
+
+It was also discovered that after a context's MMIO space had been
+unmapped it would read 0s when accessing it, whereas the expected
+behaviour was for the access to fail altogether.
+
+In order to address these issues, this patch does two things:
+
+- Forced mmap unmapping is only done when we are forcefully detaching
+ all contexts, and not in the normal detach path. Since the normal
+ context close path is tied to the file release any mmaps must have
+ already been released so we don't need to worry in that case.
+
+- The mmap path now uses a vm_operations_struct with a fault handler.
+ The fault handler ensures that the context is in started state,
+ otherwise it fails the access attempt with a SIGBUS.
+
+Fixes: b123429e6a9e ("cxl: Unmap MMIO regions when detaching a context")
+Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/cxl/context.c | 82 +++++++++++++++++++++++++++++---------
+ drivers/misc/cxl/file.c | 14 ++++---
+ 2 files changed, 71 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index 51fd6b524371..d1b55fe62817 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -100,6 +100,46 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
+ return 0;
+ }
+
++static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
++{
++ struct cxl_context *ctx = vma->vm_file->private_data;
++ unsigned long address = (unsigned long)vmf->virtual_address;
++ u64 area, offset;
++
++ offset = vmf->pgoff << PAGE_SHIFT;
++
++ pr_devel("%s: pe: %i address: 0x%lx offset: 0x%llx\n",
++ __func__, ctx->pe, address, offset);
++
++ if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
++ area = ctx->afu->psn_phys;
++ if (offset > ctx->afu->adapter->ps_size)
++ return VM_FAULT_SIGBUS;
++ } else {
++ area = ctx->psn_phys;
++ if (offset > ctx->psn_size)
++ return VM_FAULT_SIGBUS;
++ }
++
++ mutex_lock(&ctx->status_mutex);
++
++ if (ctx->status != STARTED) {
++ mutex_unlock(&ctx->status_mutex);
++ pr_devel("%s: Context not started, failing problem state access\n", __func__);
++ return VM_FAULT_SIGBUS;
++ }
++
++ vm_insert_pfn(vma, address, (area + offset) >> PAGE_SHIFT);
++
++ mutex_unlock(&ctx->status_mutex);
++
++ return VM_FAULT_NOPAGE;
++}
++
++static const struct vm_operations_struct cxl_mmap_vmops = {
++ .fault = cxl_mmap_fault,
++};
++
+ /*
+ * Map a per-context mmio space into the given vma.
+ */
+@@ -108,26 +148,25 @@ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma)
+ u64 len = vma->vm_end - vma->vm_start;
+ len = min(len, ctx->psn_size);
+
+- if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+- return vm_iomap_memory(vma, ctx->afu->psn_phys, ctx->afu->adapter->ps_size);
+- }
++ if (ctx->afu->current_mode != CXL_MODE_DEDICATED) {
++ /* make sure there is a valid per process space for this AFU */
++ if ((ctx->master && !ctx->afu->psa) || (!ctx->afu->pp_psa)) {
++ pr_devel("AFU doesn't support mmio space\n");
++ return -EINVAL;
++ }
+
+- /* make sure there is a valid per process space for this AFU */
+- if ((ctx->master && !ctx->afu->psa) || (!ctx->afu->pp_psa)) {
+- pr_devel("AFU doesn't support mmio space\n");
+- return -EINVAL;
++ /* Can't mmap until the AFU is enabled */
++ if (!ctx->afu->enabled)
++ return -EBUSY;
+ }
+
+- /* Can't mmap until the AFU is enabled */
+- if (!ctx->afu->enabled)
+- return -EBUSY;
+-
+ pr_devel("%s: mmio physical: %llx pe: %i master:%i\n", __func__,
+ ctx->psn_phys, ctx->pe , ctx->master);
+
++ vma->vm_flags |= VM_IO | VM_PFNMAP;
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+- return vm_iomap_memory(vma, ctx->psn_phys, len);
++ vma->vm_ops = &cxl_mmap_vmops;
++ return 0;
+ }
+
+ /*
+@@ -150,12 +189,6 @@ static void __detach_context(struct cxl_context *ctx)
+ afu_release_irqs(ctx);
+ flush_work(&ctx->fault_work); /* Only needed for dedicated process */
+ wake_up_all(&ctx->wq);
+-
+- /* Release Problem State Area mapping */
+- mutex_lock(&ctx->mapping_lock);
+- if (ctx->mapping)
+- unmap_mapping_range(ctx->mapping, 0, 0, 1);
+- mutex_unlock(&ctx->mapping_lock);
+ }
+
+ /*
+@@ -184,6 +217,17 @@ void cxl_context_detach_all(struct cxl_afu *afu)
+ * created and torn down after the IDR removed
+ */
+ __detach_context(ctx);
++
++ /*
++ * We are force detaching - remove any active PSA mappings so
++ * userspace cannot interfere with the card if it comes back.
++ * Easiest way to exercise this is to unbind and rebind the
++ * driver via sysfs while it is in use.
++ */
++ mutex_lock(&ctx->mapping_lock);
++ if (ctx->mapping)
++ unmap_mapping_range(ctx->mapping, 0, 0, 1);
++ mutex_unlock(&ctx->mapping_lock);
+ }
+ mutex_unlock(&afu->contexts_lock);
+ }
+diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
+index e9f2f10dbb37..b15d8113877c 100644
+--- a/drivers/misc/cxl/file.c
++++ b/drivers/misc/cxl/file.c
+@@ -140,18 +140,20 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
+
+ pr_devel("%s: pe: %i\n", __func__, ctx->pe);
+
+- mutex_lock(&ctx->status_mutex);
+- if (ctx->status != OPENED) {
+- rc = -EIO;
+- goto out;
+- }
+-
++ /* Do this outside the status_mutex to avoid a circular dependency with
++ * the locking in cxl_mmap_fault() */
+ if (copy_from_user(&work, uwork,
+ sizeof(struct cxl_ioctl_start_work))) {
+ rc = -EFAULT;
+ goto out;
+ }
+
++ mutex_lock(&ctx->status_mutex);
++ if (ctx->status != OPENED) {
++ rc = -EIO;
++ goto out;
++ }
++
+ /*
+ * if any of the reserved fields are set or any of the unused
+ * flags are set it's invalid
+--
+2.17.1
+
--- /dev/null
+From 25fe074b8d497f048956bb39464f1ae1ab6bd147 Mon Sep 17 00:00:00 2001
+From: Junichi Nomura <j-nomura@ce.jp.nec.com>
+Date: Thu, 1 Oct 2015 08:31:51 +0000
+Subject: dm: fix AB-BA deadlock in __dm_destroy()
+
+[ Upstream commit 2a708cff93f1845b9239bc7d6310aef54e716c6a ]
+
+__dm_destroy() takes io_barrier SRCU lock (dm_get_live_table) and
+suspend_lock in reverse order. Doing so can cause AB-BA deadlock:
+
+ __dm_destroy dm_swap_table
+ ---------------------------------------------------
+ mutex_lock(suspend_lock)
+ dm_get_live_table()
+ srcu_read_lock(io_barrier)
+ dm_sync_table()
+ synchronize_srcu(io_barrier)
+ .. waiting for dm_put_live_table()
+ mutex_lock(suspend_lock)
+ .. waiting for suspend_lock
+
+Fix this by taking the locks in proper order.
+
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Fixes: ab7c7bb6f4ab ("dm: hold suspend_lock while suspending device during device deletion")
+Acked-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 1d08dc6fa0b5..00c86ff3c721 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2599,14 +2599,14 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ * do not race with internal suspend.
+ */
+ mutex_lock(&md->suspend_lock);
++ map = dm_get_live_table(md, &srcu_idx);
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
+ dm_table_postsuspend_targets(map);
+ }
+- mutex_unlock(&md->suspend_lock);
+-
+ /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+ dm_put_live_table(md, srcu_idx);
++ mutex_unlock(&md->suspend_lock);
+
+ /*
+ * Rare, but there may be I/O requests still going to complete,
+--
+2.17.1
+
--- /dev/null
+From b4d5d394f438399c8b7ac080b8a621af79e7de39 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Fri, 6 Nov 2015 10:53:01 -0500
+Subject: dm thin: restore requested 'error_if_no_space' setting on OODS to
+ WRITE transition
+
+[ Upstream commit 172c238612ebf81cabccc86b788c9209af591f61 ]
+
+A thin-pool that is in out-of-data-space (OODS) mode may transition back
+to write mode -- without the admin adding more space to the thin-pool --
+if/when blocks are released (either by deleting thin devices or
+discarding provisioned blocks).
+
+But as part of the thin-pool's earlier transition to out-of-data-space
+mode the thin-pool may have set the 'error_if_no_space' flag to true if
+the no_space_timeout expires without more space having been made
+available. That implementation detail, of changing the pool's
+error_if_no_space setting, needs to be reset back to the default that
+the user specified when the thin-pool's table was loaded.
+
+Otherwise we'll drop the user requested behaviour on the floor when this
+out-of-data-space to write mode transition occurs.
+
+Reported-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Acked-by: Joe Thornber <ejt@redhat.com>
+Fixes: 2c43fd26e4 ("dm thin: fix missing out-of-data-space to write mode transition if blocks are released")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-thin.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 68c7102a64c8..936c57b57539 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -1909,6 +1909,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode)
+ case PM_WRITE:
+ if (old_mode != new_mode)
+ notify_of_pool_mode_change(pool, "write");
++ pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
+ dm_pool_metadata_read_write(pool->pmd);
+ pool->process_bio = process_bio;
+ pool->process_discard = process_discard;
+--
+2.17.1
+
--- /dev/null
+From ecf7ee1946e481094c0f8939b081e9706ea47e24 Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Tue, 9 Aug 2016 18:00:08 +0200
+Subject: dm9000: Fix irq trigger type setup on non-dt platforms
+
+[ Upstream commit a96d3b7593a3eefab62dd930e5c99201c3678ee4 ]
+
+Commit b5a099c67a1c36b "net: ethernet: davicom: fix devicetree irq
+resource" causes an interrupt storm after the ethernet interface
+is activated on S3C24XX platform (ARM non-dt), due to the interrupt
+trigger type not being set properly.
+
+It seems, after adding parsing of IRQ flags in commit 7085a7401ba54e92b
+"drivers: platform: parse IRQ flags from resources", there is no path
+for non-dt platforms where irq_set_type callback could be invoked when
+we don't pass the trigger type flags to the request_irq() call.
+
+In case of a board where the regression is seen the interrupt trigger
+type flags are passed through a platform device's resource and it is
+not currently handled properly without passing the irq trigger type
+flags to the request_irq() call. In case of OF an of_irq_get() call
+within platform_get_irq() function seems to be ensuring required irq_chip
+setup, but there is no equivalent code for non OF/ACPI platforms.
+
+This patch mostly restores irq trigger type setting code which has been
+removed in commit ("net: ethernet: davicom: fix devicetree irq resource").
+
+Fixes: b5a099c67a1c36b913 ("net: ethernet: davicom: fix devicetree irq resource")
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index ef24b60b4d3f..d2e0a10a8511 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1296,6 +1296,7 @@ static int
+ dm9000_open(struct net_device *dev)
+ {
+ struct board_info *db = netdev_priv(dev);
++ unsigned int irq_flags = irq_get_trigger_type(dev->irq);
+
+ if (netif_msg_ifup(db))
+ dev_dbg(db->dev, "enabling %s\n", dev->name);
+@@ -1303,9 +1304,11 @@ dm9000_open(struct net_device *dev)
+ /* If there is no IRQ type specified, tell the user that this is a
+ * problem
+ */
+- if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE)
++ if (irq_flags == IRQF_TRIGGER_NONE)
+ dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n");
+
++ irq_flags |= IRQF_SHARED;
++
+ /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
+ iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
+ mdelay(1); /* delay needs by DM9000B */
+@@ -1313,8 +1316,7 @@ dm9000_open(struct net_device *dev)
+ /* Initialize DM9000 board */
+ dm9000_init_dm9000(dev);
+
+- if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED,
+- dev->name, dev))
++ if (request_irq(dev->irq, dm9000_interrupt, irq_flags, dev->name, dev))
+ return -EAGAIN;
+ /* Now that we have an interrupt handler hooked up we can unmask
+ * our interrupts
+--
+2.17.1
+
--- /dev/null
+From 51c953254e57d93317c7f915474ec7b40330ed1d Mon Sep 17 00:00:00 2001
+From: Abhilash Kesavan <a.kesavan@samsung.com>
+Date: Sat, 10 Jan 2015 08:41:35 +0530
+Subject: drivers: bus: check cci device tree node status
+
+[ Upstream commit 896ddd600ba4a3426aeb11710ae9c28dd7ce68ce ]
+
+The arm-cci driver completes the probe sequence even if the cci node is
+marked as disabled. Add a check in the driver to honour the cci status
+in the device tree.
+
+Signed-off-by: Abhilash Kesavan <a.kesavan@samsung.com>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Kevin Hilman <khilman@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/arm-cci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
+index 7af78df241f2..99cad3ac38f2 100644
+--- a/drivers/bus/arm-cci.c
++++ b/drivers/bus/arm-cci.c
+@@ -976,6 +976,9 @@ static int cci_probe(void)
+ if (!np)
+ return -ENODEV;
+
++ if (!of_device_is_available(np))
++ return -ENODEV;
++
+ cci_config = of_match_node(arm_cci_matches, np)->data;
+ if (!cci_config)
+ return -ENODEV;
+--
+2.17.1
+
--- /dev/null
+From d65fd2014584f040d5a99868ea5b99c38146dc6c Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 15 May 2015 00:24:10 -0400
+Subject: ext4: fix an ext3 collapse range regression in xfstests
+
+[ Upstream commit b9576fc3624eb9fc88bec0d0ae883fd78be86239 ]
+
+The xfstests test suite assumes that an attempt to collapse range on
+the range (0, 1) will return EOPNOTSUPP if the file system does not
+support collapse range. Commit 280227a75b56: "ext4: move check under
+lock scope to close a race" broke this, and this caused xfstests to
+fail when run when testing file systems that did not have the extents
+feature enabled.
+
+Reported-by: Eric Whitney <enwlinux@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 6dbfa92bf78a..1e51008e237f 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -5400,6 +5400,14 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
+ loff_t new_size, ioffset;
+ int ret;
+
++ /*
++ * We need to test this early because xfstests assumes that a
++ * collapse range of (0, 1) will return EOPNOTSUPP if the file
++ * system does not support collapse range.
++ */
++ if (!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
++ return -EOPNOTSUPP;
++
+ /* Collapse range works only on fs block size aligned offsets. */
+ if (offset & (EXT4_CLUSTER_SIZE(sb) - 1) ||
+ len & (EXT4_CLUSTER_SIZE(sb) - 1))
+--
+2.17.1
+
--- /dev/null
+From 6103a1fdb328988300d9bc150244f34360532d5e Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 12 Jan 2015 15:27:52 +0000
+Subject: fbdev/broadsheetfb: fix memory leak
+
+[ Upstream commit ef6899cdc8608e2f018e590683f04bb04a069704 ]
+
+static code analysis from cppcheck reports:
+
+[drivers/video/fbdev/broadsheetfb.c:673]:
+ (error) Memory leak: sector_buffer
+
+sector_buffer is not being kfree'd on each call to
+broadsheet_spiflash_rewrite_sector(), so free it.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/broadsheetfb.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c
+index 8556264b16b7..235542f42da9 100644
+--- a/drivers/video/fbdev/broadsheetfb.c
++++ b/drivers/video/fbdev/broadsheetfb.c
+@@ -636,7 +636,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
+ err = broadsheet_spiflash_read_range(par, start_sector_addr,
+ data_start_addr, sector_buffer);
+ if (err)
+- return err;
++ goto out;
+ }
+
+ /* now we copy our data into the right place in the sector buffer */
+@@ -657,7 +657,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
+ err = broadsheet_spiflash_read_range(par, tail_start_addr,
+ tail_len, sector_buffer + tail_start_addr);
+ if (err)
+- return err;
++ goto out;
+ }
+
+ /* if we got here we have the full sector that we want to rewrite. */
+@@ -665,11 +665,13 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par,
+ /* first erase the sector */
+ err = broadsheet_spiflash_erase_sector(par, start_sector_addr);
+ if (err)
+- return err;
++ goto out;
+
+ /* now write it */
+ err = broadsheet_spiflash_write_sector(par, start_sector_addr,
+ sector_buffer, sector_size);
++out:
++ kfree(sector_buffer);
+ return err;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 512db0889a2d8a6c4e1dbc2838fff6f50dc2cbbc Mon Sep 17 00:00:00 2001
+From: Khazhismel Kumykov <khazhy@google.com>
+Date: Fri, 12 Oct 2018 21:34:40 -0700
+Subject: fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
+
+[ Upstream commit ac081c3be3fae6d0cc3e1862507fca3862d30b67 ]
+
+On non-preempt kernels this loop can take a long time (more than 50 ticks)
+processing through entries.
+
+Link: http://lkml.kernel.org/r/20181010172623.57033-1-khazhy@google.com
+Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
+Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fat/fatent.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
+index 08b3db146888..83550ac31f49 100644
+--- a/fs/fat/fatent.c
++++ b/fs/fat/fatent.c
+@@ -684,6 +684,7 @@ int fat_count_free_clusters(struct super_block *sb)
+ if (ops->ent_get(&fatent) == FAT_ENT_FREE)
+ free++;
+ } while (fat_ent_next(sbi, &fatent));
++ cond_resched();
+ }
+ sbi->free_clusters = free;
+ sbi->free_clus_valid = 1;
+--
+2.17.1
+
--- /dev/null
+From de75fdac7b41e12ee45759416a38ec289ae863e9 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Mon, 19 Oct 2015 04:23:29 -0600
+Subject: igb: fix NULL derefs due to skipped SR-IOV enabling
+
+[ Upstream commit be06998f96ecb93938ad2cce46c4289bf7cf45bc ]
+
+The combined effect of commits 6423fc3416 ("igb: do not re-init SR-IOV
+during probe") and ceee3450b3 ("igb: make sure SR-IOV init uses the
+right number of queues") causes VFs no longer getting set up, leading
+to NULL pointer dereferences due to the adapter's ->vf_data being NULL
+while ->vfs_allocated_count is non-zero. The first commit not only
+neglected the side effect of igb_sriov_reinit() that the second commit
+tried to account for, but also that of setting IGB_FLAG_HAS_MSIX,
+without which igb_enable_sriov() is effectively a no-op. Calling
+igb_{,re}set_interrupt_capability() as done here seems to address this,
+but I'm not sure whether this is better than sinply reverting the other
+two commits.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 84049078c4f0..b73c896ed184 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -2866,6 +2866,13 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
+ if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
+ return;
+
++ /* Of the below we really only want the effect of getting
++ * IGB_FLAG_HAS_MSIX set (if available), without which
++ * igb_enable_sriov() has no effect.
++ */
++ igb_set_interrupt_capability(adapter, true);
++ igb_reset_interrupt_capability(adapter);
++
+ pci_sriov_set_totalvfs(pdev, 7);
+ igb_enable_sriov(pdev, max_vfs);
+
+--
+2.17.1
+
--- /dev/null
+From 0852b00a6fd7a5942a17d6b6f85bbe4a2295ca8d Mon Sep 17 00:00:00 2001
+From: Shota Suzuki <suzuki_shota_t3@lab.ntt.co.jp>
+Date: Fri, 11 Dec 2015 18:44:00 +0900
+Subject: igb: Unpair the queues when changing the number of queues
+
+[ Upstream commit 37a5d163fb447b39f7960d0534de30e88ad395bb ]
+
+By the commit 72ddef0506da ("igb: Fix oops caused by missing queue
+pairing"), the IGB_FLAG_QUEUE_PAIRS flag can now be set when changing the
+number of queues by "ethtool -L", but it is never cleared unless the igb
+driver is reloaded.
+This patch clears it if queue pairing becomes unnecessary as a result of
+"ethtool -L".
+
+Signed-off-by: Shota Suzuki <suzuki_shota_t3@lab.ntt.co.jp>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 1ffad88e8a29..84049078c4f0 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -2941,6 +2941,8 @@ void igb_set_flag_queue_pairs(struct igb_adapter *adapter,
+ */
+ if (adapter->rss_queues > (max_rss_queues / 2))
+ adapter->flags |= IGB_FLAG_QUEUE_PAIRS;
++ else
++ adapter->flags &= ~IGB_FLAG_QUEUE_PAIRS;
+ break;
+ }
+ }
+--
+2.17.1
+
--- /dev/null
+From 393c50151b454099a68b782369d2323e0fa3103f Mon Sep 17 00:00:00 2001
+From: Fabien Proriol <fabien.proriol@jdsu.com>
+Date: Thu, 1 Jan 2015 12:46:48 +0000
+Subject: iio: iio: Fix iio_channel_read return if channel havn't info
+
+[ Upstream commit 65de7654d39c70c2b942f801cea01590cf7e3458 ]
+
+When xilinx-xadc is used with hwmon driver to read voltage, offset used
+for temperature is always applied whatever the channel.
+
+iio_channel_read must return an error to avoid offset for channel
+without IIO_CHAN_INFO_OFFSET property.
+
+Signed-off-by: Fabien Proriol <fabien.proriol@jdsu.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/inkern.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
+index f0846108d006..d33590e89337 100644
+--- a/drivers/iio/inkern.c
++++ b/drivers/iio/inkern.c
+@@ -426,6 +426,9 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2,
+ if (val2 == NULL)
+ val2 = &unused;
+
++ if(!iio_channel_has_info(chan->channel, info))
++ return -EINVAL;
++
+ if (chan->indio_dev->info->read_raw_multi) {
+ ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev,
+ chan->channel, INDIO_MAX_RAW_ELEMENTS,
+--
+2.17.1
+
--- /dev/null
+From b6e9c397312ca6040dd9c58f13a9e96516a9b4d5 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 14 Jul 2015 14:48:53 -0600
+Subject: iommu/vt-d: Fix VM domain ID leak
+
+[ Upstream commit 46ebb7af7b93792de65e124e1ab8b89a108a41f2 ]
+
+This continues the attempt to fix commit fb170fb4c548 ("iommu/vt-d:
+Introduce helper functions to make code symmetric for readability").
+The previous attempt in commit 71684406905f ("iommu/vt-d: Detach
+domain *only* from attached iommus") overlooked the fact that
+dmar_domain.iommu_bmp gets cleared for VM domains when devices are
+detached:
+
+intel_iommu_detach_device
+ domain_remove_one_dev_info
+ domain_detach_iommu
+
+The domain is detached from the iommu, but the iommu is still attached
+to the domain, for whatever reason. Thus when we get to domain_exit(),
+we can't rely on iommu_bmp for VM domains to find the active iommus,
+we must check them all. Without that, the corresponding bit in
+intel_iommu.domain_ids doesn't get cleared and repeated VM domain
+creation and destruction will run out of domain IDs. Meanwhile we
+still can't call iommu_detach_domain() on arbitrary non-VM domains or
+we risk clearing in-use domain IDs, as 71684406905f attempted to
+address.
+
+It's tempting to modify iommu_detach_domain() to test the domain
+iommu_bmp, but the call ordering from domain_remove_one_dev_info()
+prevents it being able to work as fb170fb4c548 seems to have intended.
+Caching of unused VM domains on the iommu object seems to be the root
+of the problem, but this code is far too fragile for that kind of
+rework to be proposed for stable, so we simply revert this chunk to
+its state prior to fb170fb4c548.
+
+Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make
+ code symmetric for readability")
+Fixes: 71684406905f ("iommu/vt-d: Detach domain *only* from attached
+ iommus")
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Cc: Jiang Liu <jiang.liu@linux.intel.com>
+Cc: stable@vger.kernel.org # v3.17+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 351da1da814f..2068cb59f7ed 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1759,8 +1759,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
+
+ static void domain_exit(struct dmar_domain *domain)
+ {
++ struct dmar_drhd_unit *drhd;
++ struct intel_iommu *iommu;
+ struct page *freelist = NULL;
+- int i;
+
+ /* Domain 0 is reserved, so dont process it */
+ if (!domain)
+@@ -1780,8 +1781,10 @@ static void domain_exit(struct dmar_domain *domain)
+
+ /* clear attached or cached domains */
+ rcu_read_lock();
+- for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+- iommu_detach_domain(domain, g_iommus[i]);
++ for_each_active_iommu(iommu, drhd)
++ if (domain_type_is_vm(domain) ||
++ test_bit(iommu->seq_id, domain->iommu_bmp))
++ iommu_detach_domain(domain, iommu);
+ rcu_read_unlock();
+
+ dma_free_pagelist(freelist);
+--
+2.17.1
+
--- /dev/null
+From c8617e8074ce5cd9e221dc1f97b4775caf42fa1c Mon Sep 17 00:00:00 2001
+From: Arik Nemtsov <arikx.nemtsov@intel.com>
+Date: Thu, 25 Dec 2014 15:28:58 +0200
+Subject: iwlwifi: pcie: correctly define 7265-D cfg
+
+[ Upstream commit 2b0e2b0f7bfe9a9098bda6109176adcf78f9b7ac ]
+
+The trans cfg was not replaced for 7265-D cards. This led to a check of
+the min-NVM version against a 7265-C card, causing very-old 7265-D cards
+to operate incorrectly with the driver.
+
+Fixes: 3fd0d3c170ad ("iwlwifi: pcie: support 7265-D devices")
+Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/iwlwifi/pcie/drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
+index 8407ce5f672f..4c7be34219d7 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
+@@ -533,8 +533,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ else if (cfg == &iwl7265_n_cfg)
+ cfg_7265d = &iwl7265d_n_cfg;
+ if (cfg_7265d &&
+- (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D)
++ (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D) {
+ cfg = cfg_7265d;
++ iwl_trans->cfg = cfg_7265d;
++ }
+ #endif
+
+ pci_set_drvdata(pdev, iwl_trans);
+--
+2.17.1
+
--- /dev/null
+From 4701703d55fef6d9624f875b030a64817d735102 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Thu, 8 Jun 2017 14:48:03 +0100
+Subject: KEYS: put keyring if install_session_keyring_to_cred() fails
+
+[ Upstream commit d636bd9f12a66ea3775c9fabbf3f8e118253467a ]
+
+In join_session_keyring(), if install_session_keyring_to_cred() were to
+fail, we would leak the keyring reference, just like in the bug fixed by
+commit 23567fd052a9 ("KEYS: Fix keyring ref leak in
+join_session_keyring()"). Fortunately this cannot happen currently, but
+we really should be more careful. Do this by adding and using a new
+error label at which the keyring reference is dropped.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/process_keys.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
+index 85b61a3ac981..6f32ca53456a 100644
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -808,15 +808,14 @@ long join_session_keyring(const char *name)
+ ret = PTR_ERR(keyring);
+ goto error2;
+ } else if (keyring == new->session_keyring) {
+- key_put(keyring);
+ ret = 0;
+- goto error2;
++ goto error3;
+ }
+
+ /* we've got a keyring - now to install it */
+ ret = install_session_keyring_to_cred(new, keyring);
+ if (ret < 0)
+- goto error2;
++ goto error3;
+
+ commit_creds(new);
+ mutex_unlock(&key_session_mutex);
+@@ -826,6 +825,8 @@ long join_session_keyring(const char *name)
+ okay:
+ return ret;
+
++error3:
++ key_put(keyring);
+ error2:
+ mutex_unlock(&key_session_mutex);
+ error:
+--
+2.17.1
+
--- /dev/null
+From f419557e0f51894101aff85e2034694eabf30373 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 30 Apr 2015 04:13:52 +0200
+Subject: lib: make memzero_explicit more robust against dead store elimination
+
+[ Upstream commit 7829fb09a2b4268b30dd9bc782fa5ebee278b137 ]
+
+In commit 0b053c951829 ("lib: memzero_explicit: use barrier instead
+of OPTIMIZER_HIDE_VAR"), we made memzero_explicit() more robust in
+case LTO would decide to inline memzero_explicit() and eventually
+find out it could be elimiated as dead store.
+
+While using barrier() works well for the case of gcc, recent efforts
+from LLVMLinux people suggest to use llvm as an alternative to gcc,
+and there, Stephan found in a simple stand-alone user space example
+that llvm could nevertheless optimize and thus elimitate the memset().
+A similar issue has been observed in the referenced llvm bug report,
+which is regarded as not-a-bug.
+
+Based on some experiments, icc is a bit special on its own, while it
+doesn't seem to eliminate the memset(), it could do so with an own
+implementation, and then result in similar findings as with llvm.
+
+The fix in this patch now works for all three compilers (also tested
+with more aggressive optimization levels). Arguably, in the current
+kernel tree it's more of a theoretical issue, but imho, it's better
+to be pedantic about it.
+
+It's clearly visible with gcc/llvm though, with the below code: if we
+would have used barrier() only here, llvm would have omitted clearing,
+not so with barrier_data() variant:
+
+ static inline void memzero_explicit(void *s, size_t count)
+ {
+ memset(s, 0, count);
+ barrier_data(s);
+ }
+
+ int main(void)
+ {
+ char buff[20];
+ memzero_explicit(buff, sizeof(buff));
+ return 0;
+ }
+
+ $ gcc -O2 test.c
+ $ gdb a.out
+ (gdb) disassemble main
+ Dump of assembler code for function main:
+ 0x0000000000400400 <+0>: lea -0x28(%rsp),%rax
+ 0x0000000000400405 <+5>: movq $0x0,-0x28(%rsp)
+ 0x000000000040040e <+14>: movq $0x0,-0x20(%rsp)
+ 0x0000000000400417 <+23>: movl $0x0,-0x18(%rsp)
+ 0x000000000040041f <+31>: xor %eax,%eax
+ 0x0000000000400421 <+33>: retq
+ End of assembler dump.
+
+ $ clang -O2 test.c
+ $ gdb a.out
+ (gdb) disassemble main
+ Dump of assembler code for function main:
+ 0x00000000004004f0 <+0>: xorps %xmm0,%xmm0
+ 0x00000000004004f3 <+3>: movaps %xmm0,-0x18(%rsp)
+ 0x00000000004004f8 <+8>: movl $0x0,-0x8(%rsp)
+ 0x0000000000400500 <+16>: lea -0x18(%rsp),%rax
+ 0x0000000000400505 <+21>: xor %eax,%eax
+ 0x0000000000400507 <+23>: retq
+ End of assembler dump.
+
+As gcc, clang, but also icc defines __GNUC__, it's sufficient to define
+this in compiler-gcc.h only to be picked up. For a fallback or otherwise
+unsupported compiler, we define it as a barrier. Similarly, for ecc which
+does not support gcc inline asm.
+
+Reference: https://llvm.org/bugs/show_bug.cgi?id=15495
+Reported-by: Stephan Mueller <smueller@chronox.de>
+Tested-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Theodore Ts'o <tytso@mit.edu>
+Cc: Stephan Mueller <smueller@chronox.de>
+Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Cc: mancha security <mancha1@zoho.com>
+Cc: Mark Charlebois <charlebm@gmail.com>
+Cc: Behan Webster <behanw@converseincode.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler-gcc.h | 16 +++++++++++++++-
+ include/linux/compiler-intel.h | 3 +++
+ include/linux/compiler.h | 4 ++++
+ lib/string.c | 2 +-
+ 4 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 633716ef19b0..4d9e673bd76c 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -9,10 +9,24 @@
+ + __GNUC_MINOR__ * 100 \
+ + __GNUC_PATCHLEVEL__)
+
+-
+ /* Optimization barrier */
++
+ /* The "volatile" is due to gcc bugs */
+ #define barrier() __asm__ __volatile__("": : :"memory")
++/*
++ * This version is i.e. to prevent dead stores elimination on @ptr
++ * where gcc and llvm may behave differently when otherwise using
++ * normal barrier(): while gcc behavior gets along with a normal
++ * barrier(), llvm needs an explicit input variable to be assumed
++ * clobbered. The issue is as follows: while the inline asm might
++ * access any memory it wants, the compiler could have fit all of
++ * @ptr into memory registers instead, and since @ptr never escaped
++ * from that, it proofed that the inline asm wasn't touching any of
++ * it. This version works well with both compilers, i.e. we're telling
++ * the compiler that the inline asm absolutely may see the contents
++ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
++ */
++#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
+
+ /*
+ * This macro obfuscates arithmetic on a variable address so that gcc
+diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
+index ba147a1727e6..0c9a2f2c2802 100644
+--- a/include/linux/compiler-intel.h
++++ b/include/linux/compiler-intel.h
+@@ -13,9 +13,12 @@
+ /* Intel ECC compiler doesn't support gcc specific asm stmts.
+ * It uses intrinsics to do the equivalent things.
+ */
++#undef barrier_data
+ #undef RELOC_HIDE
+ #undef OPTIMIZER_HIDE_VAR
+
++#define barrier_data(ptr) barrier()
++
+ #define RELOC_HIDE(ptr, off) \
+ ({ unsigned long __ptr; \
+ __ptr = (unsigned long) (ptr); \
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 8cf7a33e1b72..78b27883744c 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -165,6 +165,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
+ # define barrier() __memory_barrier()
+ #endif
+
++#ifndef barrier_data
++# define barrier_data(ptr) barrier()
++#endif
++
+ /* Unreachable code */
+ #ifndef unreachable
+ # define unreachable() do { } while (1)
+diff --git a/lib/string.c b/lib/string.c
+index 8e8a2e9e9522..de4bf3778958 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -699,7 +699,7 @@ EXPORT_SYMBOL(memset);
+ void memzero_explicit(void *s, size_t count)
+ {
+ memset(s, 0, count);
+- barrier();
++ barrier_data(s);
+ }
+ EXPORT_SYMBOL(memzero_explicit);
+
+--
+2.17.1
+
--- /dev/null
+From b57ce70f5bd1c8279107f9202a3e380355827ced Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Sat, 19 May 2018 22:29:36 +0100
+Subject: libata: blacklist Micron 500IT SSD with MU01 firmware
+
+[ Upstream commit 136d769e0b3475d71350aa3648a116a6ee7a8f6c ]
+
+While whitelisting Micron M500DC drives, the tweaked blacklist entry
+enabled queued TRIM from M500IT variants also. But these do not support
+queued TRIM. And while using those SSDs with the latest kernel we have
+seen errors and even the partition table getting corrupted.
+
+Some part from the dmesg:
+[ 6.727384] ata1.00: ATA-9: Micron_M500IT_MTFDDAK060MBD, MU01, max UDMA/133
+[ 6.727390] ata1.00: 117231408 sectors, multi 16: LBA48 NCQ (depth 31/32), AA
+[ 6.741026] ata1.00: supports DRM functions and may not be fully accessible
+[ 6.759887] ata1.00: configured for UDMA/133
+[ 6.762256] scsi 0:0:0:0: Direct-Access ATA Micron_M500IT_MT MU01 PQ: 0 ANSI: 5
+
+and then for the error:
+[ 120.860334] ata1.00: exception Emask 0x1 SAct 0x7ffc0007 SErr 0x0 action 0x6 frozen
+[ 120.860338] ata1.00: irq_stat 0x40000008
+[ 120.860342] ata1.00: failed command: SEND FPDMA QUEUED
+[ 120.860351] ata1.00: cmd 64/01:00:00:00:00/00:00:00:00:00/a0 tag 0 ncq dma 512 out
+ res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x5 (timeout)
+[ 120.860353] ata1.00: status: { DRDY }
+[ 120.860543] ata1: hard resetting link
+[ 121.166128] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
+[ 121.166376] ata1.00: supports DRM functions and may not be fully accessible
+[ 121.186238] ata1.00: supports DRM functions and may not be fully accessible
+[ 121.204445] ata1.00: configured for UDMA/133
+[ 121.204454] ata1.00: device reported invalid CHS sector 0
+[ 121.204541] sd 0:0:0:0: [sda] tag#18 UNKNOWN(0x2003) Result: hostbyte=0x00 driverbyte=0x08
+[ 121.204546] sd 0:0:0:0: [sda] tag#18 Sense Key : 0x5 [current]
+[ 121.204550] sd 0:0:0:0: [sda] tag#18 ASC=0x21 ASCQ=0x4
+[ 121.204555] sd 0:0:0:0: [sda] tag#18 CDB: opcode=0x93 93 08 00 00 00 00 00 04 28 80 00 00 00 30 00 00
+[ 121.204559] print_req_error: I/O error, dev sda, sector 272512
+
+After few reboots with these errors, and the SSD is corrupted.
+After blacklisting it, the errors are not seen and the SSD does not get
+corrupted any more.
+
+Fixes: 243918be6393 ("libata: Do not blacklist Micron M500DC")
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index cd589d012ef1..6629a5deccbd 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4249,6 +4249,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
++ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+--
+2.17.1
+
--- /dev/null
+From 2a86c9c871c2ccdd58f5dbb7b5e515acf652a3ec Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <johannes.thumshirn@men.de>
+Date: Tue, 16 Dec 2014 10:09:20 +0100
+Subject: mcb: mcb-pci: Only remap the 1st 0x200 bytes of BAR 0
+
+[ Upstream commit 7b7c54914f73966976893747ee8e2ca58166a627 ]
+
+Currently it is not possible to have a kernel with built-in MCB attached
+devices. This results out of the fact that mcb-pci requests PCI BAR 0, then
+parses the chameleon table and calls the driver's probe function before
+releasing BAR 0 again. When building the kernel with modules this is not a
+problem (and therefore it wasn't detected by my tests yet).
+
+A solution is to only remap the 1st 0x200 bytes of a Chameleon PCI device.
+0x200 bytes is the maximum size of a Chameleon v2 Table.
+
+Also this patch stops disabling the PCI device on successful registration of MCB
+devices.
+
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@men.de>
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mcb/mcb-internal.h | 1 +
+ drivers/mcb/mcb-pci.c | 27 ++++++++++++++++++---------
+ 2 files changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/mcb/mcb-internal.h b/drivers/mcb/mcb-internal.h
+index f956ef26c0ce..fb7493dcfb79 100644
+--- a/drivers/mcb/mcb-internal.h
++++ b/drivers/mcb/mcb-internal.h
+@@ -7,6 +7,7 @@
+ #define PCI_DEVICE_ID_MEN_CHAMELEON 0x4d45
+ #define CHAMELEON_FILENAME_LEN 12
+ #define CHAMELEONV2_MAGIC 0xabce
++#define CHAM_HEADER_SIZE 0x200
+
+ enum chameleon_descriptor_type {
+ CHAMELEON_DTYPE_GENERAL = 0x0,
+diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c
+index b59181965643..5e1bd5db02c8 100644
+--- a/drivers/mcb/mcb-pci.c
++++ b/drivers/mcb/mcb-pci.c
+@@ -17,6 +17,7 @@
+
+ struct priv {
+ struct mcb_bus *bus;
++ phys_addr_t mapbase;
+ void __iomem *base;
+ };
+
+@@ -31,8 +32,8 @@ static int mcb_pci_get_irq(struct mcb_device *mdev)
+
+ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ {
++ struct resource *res;
+ struct priv *priv;
+- phys_addr_t mapbase;
+ int ret;
+ int num_cells;
+ unsigned long flags;
+@@ -47,19 +48,21 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return -ENODEV;
+ }
+
+- mapbase = pci_resource_start(pdev, 0);
+- if (!mapbase) {
++ priv->mapbase = pci_resource_start(pdev, 0);
++ if (!priv->mapbase) {
+ dev_err(&pdev->dev, "No PCI resource\n");
+ goto err_start;
+ }
+
+- ret = pci_request_region(pdev, 0, KBUILD_MODNAME);
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to request PCI BARs\n");
++ res = request_mem_region(priv->mapbase, CHAM_HEADER_SIZE,
++ KBUILD_MODNAME);
++ if (IS_ERR(res)) {
++ dev_err(&pdev->dev, "Failed to request PCI memory\n");
++ ret = PTR_ERR(res);
+ goto err_start;
+ }
+
+- priv->base = pci_iomap(pdev, 0, 0);
++ priv->base = ioremap(priv->mapbase, CHAM_HEADER_SIZE);
+ if (!priv->base) {
+ dev_err(&pdev->dev, "Cannot ioremap\n");
+ ret = -ENOMEM;
+@@ -84,7 +87,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ priv->bus->get_irq = mcb_pci_get_irq;
+
+- ret = chameleon_parse_cells(priv->bus, mapbase, priv->base);
++ ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);
+ if (ret < 0)
+ goto err_drvdata;
+ num_cells = ret;
+@@ -93,8 +96,10 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ mcb_bus_add_devices(priv->bus);
+
++ return 0;
++
+ err_drvdata:
+- pci_iounmap(pdev, priv->base);
++ iounmap(priv->base);
+ err_ioremap:
+ pci_release_region(pdev, 0);
+ err_start:
+@@ -107,6 +112,10 @@ static void mcb_pci_remove(struct pci_dev *pdev)
+ struct priv *priv = pci_get_drvdata(pdev);
+
+ mcb_release_bus(priv->bus);
++
++ iounmap(priv->base);
++ release_region(priv->mapbase, CHAM_HEADER_SIZE);
++ pci_disable_device(pdev);
+ }
+
+ static const struct pci_device_id mcb_pci_tbl[] = {
+--
+2.17.1
+
--- /dev/null
+From 92859d8997007c9cf03453db939d4f726612bc1d Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
+Date: Tue, 28 Apr 2015 18:34:23 -0300
+Subject: MIPS: Fix up obsolete cpu_set usage
+
+[ Upstream commit 7363cb7de3999e84243bca79ffea257fd86a2cc6 ]
+
+cpu_set was removed (along with a bunch of cpumask helpers) by
+commit 2f0f267ea072 ("cpumask: remove deprecated functions.").
+
+Fix this by replacing cpu_set with cpumask_set_cpu. Without this
+fix the following error is triggered when CONFIG_MIPS_MT_FPAFF=y.
+
+ arch/mips/kernel/smp-cps.c: In function 'cps_smp_setup':
+ arch/mips/kernel/smp-cps.c:95:3: error: implicit declaration of function 'cpu_set' [-Werror=implicit-function-declaration]
+
+Fixes: 90db024f140d ("MIPS: smp-cps: cpu_set FPU mask if FPU present")
+Signed-off-by: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
+Acked-by: Niklas Cassel <niklass@axis.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/9912/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/smp-cps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
+index 0854f17829f3..5680ff0eb599 100644
+--- a/arch/mips/kernel/smp-cps.c
++++ b/arch/mips/kernel/smp-cps.c
+@@ -92,7 +92,7 @@ static void __init cps_smp_setup(void)
+ #ifdef CONFIG_MIPS_MT_FPAFF
+ /* If we have an FPU, enroll ourselves in the FPU-full mask */
+ if (cpu_has_fpu)
+- cpu_set(0, mt_fpu_cpumask);
++ cpumask_set_cpu(0, &mt_fpu_cpumask);
+ #endif /* CONFIG_MIPS_MT_FPAFF */
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 92bf5fab61b4479ac06ac1b4f6f11668639425ac Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Tue, 22 Sep 2015 14:59:14 -0700
+Subject: mm: migrate: hugetlb: putback destination hugepage to active list
+
+[ Upstream commit 3aaa76e125c1dd58c9b599baa8c6021896874c12 ]
+
+Since commit bcc54222309c ("mm: hugetlb: introduce page_huge_active")
+each hugetlb page maintains its active flag to avoid a race condition
+betwe= en multiple calls of isolate_huge_page(), but current kernel
+doesn't set the f= lag on a hugepage allocated by migration because the
+proper putback routine isn= 't called. This means that users could
+still encounter the race referred to by bcc54222309c in this special
+case, so this patch fixes it.
+
+Fixes: bcc54222309c ("mm: hugetlb: introduce page_huge_active")
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: <stable@vger.kernel.org> [4.1.x]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 4d743bce5a23..57559f9295f9 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1077,7 +1077,7 @@ out:
+ if (rc != MIGRATEPAGE_SUCCESS && put_new_page)
+ put_new_page(new_hpage, private);
+ else
+- put_page(new_hpage);
++ putback_active_hugepage(new_hpage);
+
+ if (result) {
+ if (rc)
+--
+2.17.1
+
--- /dev/null
+From d1b3fb279e84db9a22b89ee3b37b9509d239a62a Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@marvell.com>
+Date: Fri, 11 Dec 2015 21:36:29 +0800
+Subject: mmc: sdhci: restore behavior when setting VDD via external regulator
+
+[ Upstream commit 918f4cbd4340ddd1eb389cd8efa3b07ac74ec4c0 ]
+
+After commit 52221610dd84 ("mmc: sdhci: Improve external VDD regulator
+support"), for the VDD is supplied via external regulators, we ignore
+the code to convert a VDD voltage request into one of the standard
+SDHCI voltage levels, then program it in the SDHCI_POWER_CONTROL. This
+brings two issues:
+
+1. SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON quirk isn't handled properly any
+more.
+
+2. What's more, once SDHCI_POWER_ON bit is set, some controllers such
+as the sdhci-pxav3 used in marvell berlin SoCs require the voltage
+levels programming in the SDHCI_POWER_CONTROL register, even the VDD
+is supplied by external regulator. So the host in marvell berlin SoCs
+still works fine after the commit. However, commit 3cbc6123a93d ("mmc:
+sdhci: Set SDHCI_POWER_ON with external vmmc") sets the SDHCI_POWER_ON
+bit, this would make the host in marvell berlin SoCs won't work any
+more with external vmmc.
+
+This patch restores the behavior when setting VDD through external
+regulator by moving the call of mmc_regulator_set_ocr() to the end
+of sdhci_set_power() function.
+
+After this patch, the sdcard on Marvell Berlin SoC boards work again.
+
+Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
+Fixes: 52221610dd84 ("mmc: sdhci: Improve external VDD ...")
+Reviewed-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Tested-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 56578504fd24..2295bf6e94a1 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1248,19 +1248,6 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+ struct mmc_host *mmc = host->mmc;
+ u8 pwr = 0;
+
+- if (!IS_ERR(mmc->supply.vmmc)) {
+- spin_unlock_irq(&host->lock);
+- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+- spin_lock_irq(&host->lock);
+-
+- if (mode != MMC_POWER_OFF)
+- sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
+- else
+- sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
+-
+- return;
+- }
+-
+ if (mode != MMC_POWER_OFF) {
+ switch (1 << vdd) {
+ case MMC_VDD_165_195:
+@@ -1319,6 +1306,12 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+ if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER)
+ mdelay(10);
+ }
++
++ if (!IS_ERR(mmc->supply.vmmc)) {
++ spin_unlock_irq(&host->lock);
++ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
++ spin_lock_irq(&host->lock);
++ }
+ }
+
+ /*****************************************************************************\
+--
+2.17.1
+
--- /dev/null
+From f342cd402546ac265fb6e560a39b332e325a22df Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Mon, 26 Oct 2015 10:20:23 -0700
+Subject: mtd: blkdevs: fix potential deadlock + lockdep warnings
+
+[ Upstream commit f3c63795e90f0c6238306883b6c72f14d5355721 ]
+
+Commit 073db4a51ee4 ("mtd: fix: avoid race condition when accessing
+mtd->usecount") fixed a race condition but due to poor ordering of the
+mutex acquisition, introduced a potential deadlock.
+
+The deadlock can occur, for example, when rmmod'ing the m25p80 module, which
+will delete one or more MTDs, along with any corresponding mtdblock
+devices. This could potentially race with an acquisition of the block
+device as follows.
+
+ -> blktrans_open()
+ -> mutex_lock(&dev->lock);
+ -> mutex_lock(&mtd_table_mutex);
+
+ -> del_mtd_device()
+ -> mutex_lock(&mtd_table_mutex);
+ -> blktrans_notify_remove() -> del_mtd_blktrans_dev()
+ -> mutex_lock(&dev->lock);
+
+This is a classic (potential) ABBA deadlock, which can be fixed by
+making the A->B ordering consistent everywhere. There was no real
+purpose to the ordering in the original patch, AFAIR, so this shouldn't
+be a problem. This ordering was actually already present in
+del_mtd_blktrans_dev(), for one, where the function tried to ensure that
+its caller already held mtd_table_mutex before it acquired &dev->lock:
+
+ if (mutex_trylock(&mtd_table_mutex)) {
+ mutex_unlock(&mtd_table_mutex);
+ BUG();
+ }
+
+So, reverse the ordering of acquisition of &dev->lock and &mtd_table_mutex so
+we always acquire mtd_table_mutex first.
+
+Snippets of the lockdep output follow:
+
+ # modprobe -r m25p80
+ [ 53.419251]
+ [ 53.420838] ======================================================
+ [ 53.427300] [ INFO: possible circular locking dependency detected ]
+ [ 53.433865] 4.3.0-rc6 #96 Not tainted
+ [ 53.437686] -------------------------------------------------------
+ [ 53.444220] modprobe/372 is trying to acquire lock:
+ [ 53.449320] (&new->lock){+.+...}, at: [<c043fe4c>] del_mtd_blktrans_dev+0x80/0xdc
+ [ 53.457271]
+ [ 53.457271] but task is already holding lock:
+ [ 53.463372] (mtd_table_mutex){+.+.+.}, at: [<c0439994>] del_mtd_device+0x18/0x100
+ [ 53.471321]
+ [ 53.471321] which lock already depends on the new lock.
+ [ 53.471321]
+ [ 53.479856]
+ [ 53.479856] the existing dependency chain (in reverse order) is:
+ [ 53.487660]
+ -> #1 (mtd_table_mutex){+.+.+.}:
+ [ 53.492331] [<c043fc5c>] blktrans_open+0x34/0x1a4
+ [ 53.497879] [<c01afce0>] __blkdev_get+0xc4/0x3b0
+ [ 53.503364] [<c01b0bb8>] blkdev_get+0x108/0x320
+ [ 53.508743] [<c01713c0>] do_dentry_open+0x218/0x314
+ [ 53.514496] [<c0180454>] path_openat+0x4c0/0xf9c
+ [ 53.519959] [<c0182044>] do_filp_open+0x5c/0xc0
+ [ 53.525336] [<c0172758>] do_sys_open+0xfc/0x1cc
+ [ 53.530716] [<c000f740>] ret_fast_syscall+0x0/0x1c
+ [ 53.536375]
+ -> #0 (&new->lock){+.+...}:
+ [ 53.540587] [<c063f124>] mutex_lock_nested+0x38/0x3cc
+ [ 53.546504] [<c043fe4c>] del_mtd_blktrans_dev+0x80/0xdc
+ [ 53.552606] [<c043f164>] blktrans_notify_remove+0x7c/0x84
+ [ 53.558891] [<c04399f0>] del_mtd_device+0x74/0x100
+ [ 53.564544] [<c043c670>] del_mtd_partitions+0x80/0xc8
+ [ 53.570451] [<c0439aa0>] mtd_device_unregister+0x24/0x48
+ [ 53.576637] [<c046ce6c>] spi_drv_remove+0x1c/0x34
+ [ 53.582207] [<c03de0f0>] __device_release_driver+0x88/0x114
+ [ 53.588663] [<c03de19c>] device_release_driver+0x20/0x2c
+ [ 53.594843] [<c03dd9e8>] bus_remove_device+0xd8/0x108
+ [ 53.600748] [<c03dacc0>] device_del+0x10c/0x210
+ [ 53.606127] [<c03dadd0>] device_unregister+0xc/0x20
+ [ 53.611849] [<c046d878>] __unregister+0x10/0x20
+ [ 53.617211] [<c03da868>] device_for_each_child+0x50/0x7c
+ [ 53.623387] [<c046eae8>] spi_unregister_master+0x58/0x8c
+ [ 53.629578] [<c03e12f0>] release_nodes+0x15c/0x1c8
+ [ 53.635223] [<c03de0f8>] __device_release_driver+0x90/0x114
+ [ 53.641689] [<c03de900>] driver_detach+0xb4/0xb8
+ [ 53.647147] [<c03ddc78>] bus_remove_driver+0x4c/0xa0
+ [ 53.652970] [<c00cab50>] SyS_delete_module+0x11c/0x1e4
+ [ 53.658976] [<c000f740>] ret_fast_syscall+0x0/0x1c
+ [ 53.664621]
+ [ 53.664621] other info that might help us debug this:
+ [ 53.664621]
+ [ 53.672979] Possible unsafe locking scenario:
+ [ 53.672979]
+ [ 53.679169] CPU0 CPU1
+ [ 53.683900] ---- ----
+ [ 53.688633] lock(mtd_table_mutex);
+ [ 53.692383] lock(&new->lock);
+ [ 53.698306] lock(mtd_table_mutex);
+ [ 53.704658] lock(&new->lock);
+ [ 53.707946]
+ [ 53.707946] *** DEADLOCK ***
+
+Fixes: 073db4a51ee4 ("mtd: fix: avoid race condition when accessing mtd->usecount")
+Reported-by: Felipe Balbi <balbi@ti.com>
+Tested-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtd_blkdevs.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index 3e3aa17ee3bd..6368300f3fbe 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -195,8 +195,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ if (!dev)
+ return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
+
+- mutex_lock(&dev->lock);
+ mutex_lock(&mtd_table_mutex);
++ mutex_lock(&dev->lock);
+
+ if (dev->open)
+ goto unlock;
+@@ -220,8 +220,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+
+ unlock:
+ dev->open++;
+- mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
++ mutex_unlock(&mtd_table_mutex);
+ blktrans_dev_put(dev);
+ return ret;
+
+@@ -231,8 +231,8 @@ error_release:
+ error_put:
+ module_put(dev->tr->owner);
+ kref_put(&dev->ref, blktrans_dev_release);
+- mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
++ mutex_unlock(&mtd_table_mutex);
+ blktrans_dev_put(dev);
+ return ret;
+ }
+@@ -244,8 +244,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
+ if (!dev)
+ return;
+
+- mutex_lock(&dev->lock);
+ mutex_lock(&mtd_table_mutex);
++ mutex_lock(&dev->lock);
+
+ if (--dev->open)
+ goto unlock;
+@@ -259,8 +259,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
+ __put_mtd_device(dev->mtd);
+ }
+ unlock:
+- mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
++ mutex_unlock(&mtd_table_mutex);
+ blktrans_dev_put(dev);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From aaac5c6d8d51f14eaf6716945efd932489c14553 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Fri, 5 Oct 2018 08:48:27 -0500
+Subject: net: cxgb3_main: fix a missing-check bug
+
+[ Upstream commit 2c05d88818ab6571816b93edce4d53703870d7ae ]
+
+In cxgb_extension_ioctl(), the command of the ioctl is firstly copied from
+the user-space buffer 'useraddr' to 'cmd' and checked through the
+switch statement. If the command is not as expected, an error code
+EOPNOTSUPP is returned. In the following execution, i.e., the cases of the
+switch statement, the whole buffer of 'useraddr' is copied again to a
+specific data structure, according to what kind of command is requested.
+However, after the second copy, there is no re-check on the newly-copied
+command. Given that the buffer 'useraddr' is in the user space, a malicious
+user can race to change the command between the two copies. By doing so,
+the attacker can supply malicious data to the kernel and cause undefined
+behavior.
+
+This patch adds a re-check in each case of the switch statement if there is
+a second copy in that case, to re-check whether the command obtained in the
+second copy is the same as the one in the first copy. If not, an error code
+EINVAL is returned.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+index db76f7040455..dd3e5247190e 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -2146,6 +2146,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EPERM;
+ if (copy_from_user(&t, useraddr, sizeof(t)))
+ return -EFAULT;
++ if (t.cmd != CHELSIO_SET_QSET_PARAMS)
++ return -EINVAL;
+ if (t.qset_idx >= SGE_QSETS)
+ return -EINVAL;
+ if (!in_range(t.intr_lat, 0, M_NEWTIMER) ||
+@@ -2245,6 +2247,9 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ if (copy_from_user(&t, useraddr, sizeof(t)))
+ return -EFAULT;
+
++ if (t.cmd != CHELSIO_GET_QSET_PARAMS)
++ return -EINVAL;
++
+ /* Display qsets for all ports when offload enabled */
+ if (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) {
+ q1 = 0;
+@@ -2289,6 +2294,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EBUSY;
+ if (copy_from_user(&edata, useraddr, sizeof(edata)))
+ return -EFAULT;
++ if (edata.cmd != CHELSIO_SET_QSET_NUM)
++ return -EINVAL;
+ if (edata.val < 1 ||
+ (edata.val > 1 && !(adapter->flags & USING_MSIX)))
+ return -EINVAL;
+@@ -2329,6 +2336,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EPERM;
+ if (copy_from_user(&t, useraddr, sizeof(t)))
+ return -EFAULT;
++ if (t.cmd != CHELSIO_LOAD_FW)
++ return -EINVAL;
+ /* Check t.len sanity ? */
+ fw_data = memdup_user(useraddr + sizeof(t), t.len);
+ if (IS_ERR(fw_data))
+@@ -2352,6 +2361,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EBUSY;
+ if (copy_from_user(&m, useraddr, sizeof(m)))
+ return -EFAULT;
++ if (m.cmd != CHELSIO_SETMTUTAB)
++ return -EINVAL;
+ if (m.nmtus != NMTUS)
+ return -EINVAL;
+ if (m.mtus[0] < 81) /* accommodate SACK */
+@@ -2393,6 +2404,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EBUSY;
+ if (copy_from_user(&m, useraddr, sizeof(m)))
+ return -EFAULT;
++ if (m.cmd != CHELSIO_SET_PM)
++ return -EINVAL;
+ if (!is_power_of_2(m.rx_pg_sz) ||
+ !is_power_of_2(m.tx_pg_sz))
+ return -EINVAL; /* not power of 2 */
+@@ -2426,6 +2439,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EIO; /* need the memory controllers */
+ if (copy_from_user(&t, useraddr, sizeof(t)))
+ return -EFAULT;
++ if (t.cmd != CHELSIO_GET_MEM)
++ return -EINVAL;
+ if ((t.addr & 7) || (t.len & 7))
+ return -EINVAL;
+ if (t.mem_id == MEM_CM)
+@@ -2478,6 +2493,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
+ return -EAGAIN;
+ if (copy_from_user(&t, useraddr, sizeof(t)))
+ return -EFAULT;
++ if (t.cmd != CHELSIO_SET_TRACE_FILTER)
++ return -EINVAL;
+
+ tp = (const struct trace_params *)&t.sip;
+ if (t.config_tx)
+--
+2.17.1
+
--- /dev/null
+From dc198140a4ba992c0b57ea1170bcf42630797d7d Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Sat, 20 Feb 2016 21:45:26 +0100
+Subject: net: ethernet: davicom: fix devicetree irq resource
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit b5a099c67a1c36b91356624ce86eb3f9f48a82c7 ]
+
+The dm9000 driver doesn't work in at least one device-tree
+configuration, spitting an error message on irq resource :
+[ 1.062495] dm9000 8000000.ethernet: insufficient resources
+[ 1.068439] dm9000 8000000.ethernet: not found (-2).
+[ 1.073451] dm9000: probe of 8000000.ethernet failed with error -2
+
+The reason behind is that the interrupt might be provided by a gpio
+controller, not probed when dm9000 is probed, and needing the probe
+deferral mechanism to apply.
+
+Currently, the interrupt is directly taken from resources. This patch
+changes this to use the more generic platform_get_irq(), which handles
+the deferral.
+
+Moreover, since commit Fixes: 7085a7401ba5 ("drivers: platform: parse
+IRQ flags from resources"), the interrupt trigger flags are honored in
+platform_get_irq(), so remove the needless code in dm9000.
+
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Acked-by: Marcel Ziswiler <marcel@ziswiler.com>
+Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Tested-by: Sergei Ianovich <ynvich@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 34 +++++++++++++--------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index f3ba840cbf7b..ef24b60b4d3f 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -125,7 +125,6 @@ struct board_info {
+ struct resource *data_res;
+ struct resource *addr_req; /* resources requested */
+ struct resource *data_req;
+- struct resource *irq_res;
+
+ int irq_wake;
+
+@@ -1297,22 +1296,16 @@ static int
+ dm9000_open(struct net_device *dev)
+ {
+ struct board_info *db = netdev_priv(dev);
+- unsigned long irqflags = db->irq_res->flags & IRQF_TRIGGER_MASK;
+
+ if (netif_msg_ifup(db))
+ dev_dbg(db->dev, "enabling %s\n", dev->name);
+
+- /* If there is no IRQ type specified, default to something that
+- * may work, and tell the user that this is a problem */
+-
+- if (irqflags == IRQF_TRIGGER_NONE)
+- irqflags = irq_get_trigger_type(dev->irq);
+-
+- if (irqflags == IRQF_TRIGGER_NONE)
++ /* If there is no IRQ type specified, tell the user that this is a
++ * problem
++ */
++ if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE)
+ dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n");
+
+- irqflags |= IRQF_SHARED;
+-
+ /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
+ iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
+ mdelay(1); /* delay needs by DM9000B */
+@@ -1320,7 +1313,8 @@ dm9000_open(struct net_device *dev)
+ /* Initialize DM9000 board */
+ dm9000_init_dm9000(dev);
+
+- if (request_irq(dev->irq, dm9000_interrupt, irqflags, dev->name, dev))
++ if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED,
++ dev->name, dev))
+ return -EAGAIN;
+ /* Now that we have an interrupt handler hooked up we can unmask
+ * our interrupts
+@@ -1460,15 +1454,22 @@ dm9000_probe(struct platform_device *pdev)
+
+ db->addr_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ db->data_res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+- db->irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+
+- if (db->addr_res == NULL || db->data_res == NULL ||
+- db->irq_res == NULL) {
+- dev_err(db->dev, "insufficient resources\n");
++ if (!db->addr_res || !db->data_res) {
++ dev_err(db->dev, "insufficient resources addr=%p data=%p\n",
++ db->addr_res, db->data_res);
+ ret = -ENOENT;
+ goto out;
+ }
+
++ ndev->irq = platform_get_irq(pdev, 0);
++ if (ndev->irq < 0) {
++ dev_err(db->dev, "interrupt resource unavailable: %d\n",
++ ndev->irq);
++ ret = ndev->irq;
++ goto out;
++ }
++
+ db->irq_wake = platform_get_irq(pdev, 1);
+ if (db->irq_wake >= 0) {
+ dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake);
+@@ -1530,7 +1531,6 @@ dm9000_probe(struct platform_device *pdev)
+
+ /* fill in parameters for net-dev structure */
+ ndev->base_addr = (unsigned long)db->io_addr;
+- ndev->irq = db->irq_res->start;
+
+ /* ensure at least we have a default set of IO routines */
+ dm9000_set_io(db, iosize);
+--
+2.17.1
+
--- /dev/null
+From 1181bd3d92cb27e6f0d751645dbb3cebb6147a08 Mon Sep 17 00:00:00 2001
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Date: Mon, 14 Dec 2015 23:30:43 +0100
+Subject: net: fix warnings in 'make htmldocs' by moving macro definition out
+ of field declaration
+
+[ Upstream commit 7bbadd2d1009575dad675afc16650ebb5aa10612 ]
+
+Docbook does not like the definition of macros inside a field declaration
+and adds a warning. Move the definition out.
+
+Fixes: 79462ad02e86180 ("net: add validation for the socket syscall protocol argument")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index a40bc8c0af4b..76afe92a0f4a 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -379,8 +379,8 @@ struct sock {
+ sk_no_check_rx : 1,
+ sk_userlocks : 4,
+ sk_protocol : 8,
+-#define SK_PROTOCOL_MAX U8_MAX
+ sk_type : 16;
++#define SK_PROTOCOL_MAX U8_MAX
+ kmemcheck_bitfield_end(flags);
+ int sk_wmem_queued;
+ gfp_t sk_allocation;
+--
+2.17.1
+
--- /dev/null
+From c0733030d1c74d152a53b0a83c3126d98a8164c5 Mon Sep 17 00:00:00 2001
+From: Eugenia Emantayev <eugenia@mellanox.com>
+Date: Thu, 17 Dec 2015 15:35:37 +0200
+Subject: net/mlx4_en: Remove dependency between timestamping capability and
+ service_task
+
+[ Upstream commit fc9f5ea9b4ecbe9b7839c92f0a54261809c723d3 ]
+
+Service task is responsible for other tasks in addition to timestamping
+overflow check. Launch it even if timestamping is not supported by device.
+
+Fixes: 07841f9d94c1 ('net/mlx4_en: Schedule napi when RX buffers allocation fails')
+Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
+Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index f31814293d3c..980dd359e3f7 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -2638,9 +2638,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ }
+ queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
+
+- if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
+- queue_delayed_work(mdev->workqueue, &priv->service_task,
+- SERVICE_TASK_DELAY);
++ queue_delayed_work(mdev->workqueue, &priv->service_task,
++ SERVICE_TASK_DELAY);
+
+ err = register_netdev(dev);
+ if (err) {
+--
+2.17.1
+
--- /dev/null
+From e3ec6385a979abb487f3ba4ac7f0cbd5fab3b927 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@poochiereds.net>
+Date: Fri, 20 Mar 2015 15:15:14 -0400
+Subject: nfs: fix high load average due to callback thread sleeping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 5d05e54af3cdbb13cf19c557ff2184781b91a22c ]
+
+Chuck pointed out a problem that crept in with commit 6ffa30d3f734 (nfs:
+don't call blocking operations while !TASK_RUNNING). Linux counts tasks
+in uninterruptible sleep against the load average, so this caused the
+system's load average to be pinned at at least 1 when there was a
+NFSv4.1+ mount active.
+
+Not a huge problem, but it's probably worth fixing before we get too
+many complaints about it. This patch converts the code back to use
+TASK_INTERRUPTIBLE sleep, simply has it flush any signals on each loop
+iteration. In practice no one should really be signalling this thread at
+all, so I think this is reasonably safe.
+
+With this change, there's also no need to game the hung task watchdog so
+we can also convert the schedule_timeout call back to a normal schedule.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Fixes: commit 6ffa30d3f734 (“nfs: don't call blocking . . .”)
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
+index 3b8cdb8298c4..a78558a25035 100644
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -128,7 +128,7 @@ nfs41_callback_svc(void *vrqstp)
+ if (try_to_freeze())
+ continue;
+
+- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE);
++ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE);
+ spin_lock_bh(&serv->sv_cb_lock);
+ if (!list_empty(&serv->sv_cb_list)) {
+ req = list_first_entry(&serv->sv_cb_list,
+@@ -142,10 +142,10 @@ nfs41_callback_svc(void *vrqstp)
+ error);
+ } else {
+ spin_unlock_bh(&serv->sv_cb_lock);
+- /* schedule_timeout to game the hung task watchdog */
+- schedule_timeout(60 * HZ);
++ schedule();
+ finish_wait(&serv->sv_cb_waitq, &wq);
+ }
++ flush_signals(current);
+ }
+ return 0;
+ }
+--
+2.17.1
+
--- /dev/null
+From 9da3c8de71eda04a6f2bba8505be1394d77e117f Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Sat, 3 Jan 2015 14:45:33 -0500
+Subject: NFS: Ignore transport protocol when detecting server trunking
+
+[ Upstream commit 7a01edf0058df98d6cc734c5a4ecc51f929a86ec ]
+
+Detect server trunking across transport protocols. Otherwise, an
+RDMA mount and a TCP mount of the same server will end up with
+separate nfs_clients using the same clientid4.
+
+Reported-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index a8a9be4c6cf4..eb8777eb4d2b 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -495,9 +495,6 @@ int nfs40_walk_client_list(struct nfs_client *new,
+ if (pos->rpc_ops != new->rpc_ops)
+ continue;
+
+- if (pos->cl_proto != new->cl_proto)
+- continue;
+-
+ if (pos->cl_minorversion != new->cl_minorversion)
+ continue;
+
+@@ -633,9 +630,6 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ if (pos->rpc_ops != new->rpc_ops)
+ continue;
+
+- if (pos->cl_proto != new->cl_proto)
+- continue;
+-
+ if (pos->cl_minorversion != new->cl_minorversion)
+ continue;
+
+--
+2.17.1
+
--- /dev/null
+From e11ef1c4d20d847f2758b9bd05dfb5214b77de06 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Sat, 3 Jan 2015 15:16:04 -0500
+Subject: NFSv4: Cache the NFSv4/v4.1 client owner_id in the struct nfs_client
+
+[ Upstream commit ceb3a16c070c403f5f9ca46b46cf2bb79ea11750 ]
+
+Ensure that we cache the NFSv4/v4.1 client owner_id so that we can
+verify it when we're doing trunking detection.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 1 +
+ fs/nfs/nfs4proc.c | 19 +++++++++++++++----
+ include/linux/nfs_fs_sb.h | 3 +++
+ 3 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 723c656ebd28..d748d403bab1 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -228,6 +228,7 @@ static void nfs4_shutdown_client(struct nfs_client *clp)
+ kfree(clp->cl_serverowner);
+ kfree(clp->cl_serverscope);
+ kfree(clp->cl_implid);
++ kfree(clp->cl_owner_id);
+ }
+
+ void nfs4_free_client(struct nfs_client *clp)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 321044c183f5..db8456b4ecb8 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4913,11 +4913,14 @@ static void nfs4_init_boot_verifier(const struct nfs_client *clp,
+ }
+
+ static unsigned int
+-nfs4_init_nonuniform_client_string(const struct nfs_client *clp,
++nfs4_init_nonuniform_client_string(struct nfs_client *clp,
+ char *buf, size_t len)
+ {
+ unsigned int result;
+
++ if (clp->cl_owner_id != NULL)
++ return strlcpy(buf, clp->cl_owner_id, len);
++
+ rcu_read_lock();
+ result = scnprintf(buf, len, "Linux NFSv4.0 %s/%s %s",
+ clp->cl_ipaddr,
+@@ -4926,24 +4929,32 @@ nfs4_init_nonuniform_client_string(const struct nfs_client *clp,
+ rpc_peeraddr2str(clp->cl_rpcclient,
+ RPC_DISPLAY_PROTO));
+ rcu_read_unlock();
++ clp->cl_owner_id = kstrdup(buf, GFP_KERNEL);
+ return result;
+ }
+
+ static unsigned int
+-nfs4_init_uniform_client_string(const struct nfs_client *clp,
++nfs4_init_uniform_client_string(struct nfs_client *clp,
+ char *buf, size_t len)
+ {
+ const char *nodename = clp->cl_rpcclient->cl_nodename;
++ unsigned int result;
++
++ if (clp->cl_owner_id != NULL)
++ return strlcpy(buf, clp->cl_owner_id, len);
+
+ if (nfs4_client_id_uniquifier[0] != '\0')
+- return scnprintf(buf, len, "Linux NFSv%u.%u %s/%s",
++ result = scnprintf(buf, len, "Linux NFSv%u.%u %s/%s",
+ clp->rpc_ops->version,
+ clp->cl_minorversion,
+ nfs4_client_id_uniquifier,
+ nodename);
+- return scnprintf(buf, len, "Linux NFSv%u.%u %s",
++ else
++ result = scnprintf(buf, len, "Linux NFSv%u.%u %s",
+ clp->rpc_ops->version, clp->cl_minorversion,
+ nodename);
++ clp->cl_owner_id = kstrdup(buf, GFP_KERNEL);
++ return result;
+ }
+
+ /*
+diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
+index fd249ab2718f..4ac99c07406a 100644
+--- a/include/linux/nfs_fs_sb.h
++++ b/include/linux/nfs_fs_sb.h
+@@ -74,6 +74,9 @@ struct nfs_client {
+ /* idmapper */
+ struct idmap * cl_idmap;
+
++ /* Client owner identifier */
++ const char * cl_owner_id;
++
+ /* Our own IP address, as a null-terminated string.
+ * This is used to generate the mv0 callback address.
+ */
+--
+2.17.1
+
--- /dev/null
+From 814dc2008f043f485f7a2007397c0a85a04986b6 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Fri, 19 Dec 2014 12:47:50 -0500
+Subject: NFSv4: Remove incorrect check in can_open_delegated()
+
+[ Upstream commit 4e379d36c050b0117b5d10048be63a44f5036115 ]
+
+Remove an incorrect check for NFS_DELEGATION_NEED_RECLAIM in
+can_open_delegated(). We are allowed to cache opens even in
+a situation where we're doing reboot recovery.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index db8456b4ecb8..21906d2a13cc 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1117,8 +1117,6 @@ static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode)
+ return 0;
+ if ((delegation->type & fmode) != fmode)
+ return 0;
+- if (test_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags))
+- return 0;
+ if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags))
+ return 0;
+ nfs_mark_delegation_referenced(delegation);
+--
+2.17.1
+
--- /dev/null
+From 8dd48c2885007f371a0abd59bfa231fa4c753124 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Sat, 3 Jan 2015 15:35:27 -0500
+Subject: NFSv4/v4.1: Verify the client owner id during trunking detection
+
+[ Upstream commit 55b9df93ddd684cbc4c2dee9b8a99f6e48348212 ]
+
+While we normally expect the NFSv4 client to always send the same client
+owner to all servers, there are a couple of situations where that is not
+the case:
+ 1) In NFSv4.0, switching between use of '-omigration' and not will cause
+ the kernel to switch between using the non-uniform and uniform client
+ strings.
+ 2) In NFSv4.1, or NFSv4.0 when using uniform client strings, if the
+ uniquifier string is suddenly changed.
+
+This patch will catch those situations by checking the client owner id
+in the trunking detection code, and will do the right thing if it notices
+that the strings differ.
+
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4client.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index d748d403bab1..a8a9be4c6cf4 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -456,6 +456,14 @@ static void nfs4_swap_callback_idents(struct nfs_client *keep,
+ spin_unlock(&nn->nfs_client_lock);
+ }
+
++static bool nfs4_match_client_owner_id(const struct nfs_client *clp1,
++ const struct nfs_client *clp2)
++{
++ if (clp1->cl_owner_id == NULL || clp2->cl_owner_id == NULL)
++ return true;
++ return strcmp(clp1->cl_owner_id, clp2->cl_owner_id) == 0;
++}
++
+ /**
+ * nfs40_walk_client_list - Find server that recognizes a client ID
+ *
+@@ -515,6 +523,9 @@ int nfs40_walk_client_list(struct nfs_client *new,
+ if (pos->cl_clientid != new->cl_clientid)
+ continue;
+
++ if (!nfs4_match_client_owner_id(pos, new))
++ continue;
++
+ atomic_inc(&pos->cl_count);
+ spin_unlock(&nn->nfs_client_lock);
+
+@@ -664,6 +675,13 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ if (!nfs4_check_clientid_trunking(pos, new))
+ continue;
+
++ /* Unlike NFSv4.0, we know that NFSv4.1 always uses the
++ * uniform string, however someone might switch the
++ * uniquifier string on us.
++ */
++ if (!nfs4_match_client_owner_id(pos, new))
++ continue;
++
+ atomic_inc(&pos->cl_count);
+ *result = pos;
+ status = 0;
+--
+2.17.1
+
--- /dev/null
+From bb2cbbbb0dd9031959750e0c1c6220518fe52fba Mon Sep 17 00:00:00 2001
+From: alex chen <alex.chen@huawei.com>
+Date: Tue, 10 Feb 2015 14:09:02 -0800
+Subject: ocfs2: fix journal commit deadlock in
+ ocfs2_convert_inline_data_to_extents
+
+[ Upstream commit 15eba0fe3eeaeb1b80489c1ebb9d47d6d7003f57 ]
+
+Similar to ocfs2_write_end_nolock() which is metioned at commit
+136f49b91710 ("ocfs2: fix journal commit deadlock"), we should unlock
+pages before ocfs2_commit_trans() in ocfs2_convert_inline_data_to_extents.
+
+Otherwise, it will cause a deadlock with journal commit threads.
+
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Mark Fasheh <mfasheh@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/alloc.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index d9db90446c9d..3564b896a92e 100644
+--- a/fs/ocfs2/alloc.c
++++ b/fs/ocfs2/alloc.c
+@@ -6871,7 +6871,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+ mlog_errno(ret);
+- goto out_unlock;
++ goto out;
+ }
+
+ ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh,
+@@ -6929,7 +6929,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ if (ret) {
+ mlog_errno(ret);
+ need_free = 1;
+- goto out_commit;
++ goto out_unlock;
+ }
+
+ page_end = PAGE_CACHE_SIZE;
+@@ -6962,12 +6962,16 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
+ if (ret) {
+ mlog_errno(ret);
+ need_free = 1;
+- goto out_commit;
++ goto out_unlock;
+ }
+
+ inode->i_blocks = ocfs2_inode_sector_count(inode);
+ }
+
++out_unlock:
++ if (pages)
++ ocfs2_unlock_and_free_pages(pages, num_pages);
++
+ out_commit:
+ if (ret < 0 && did_quota)
+ dquot_free_space_nodirty(inode,
+@@ -6987,15 +6991,11 @@ out_commit:
+
+ ocfs2_commit_trans(osb, handle);
+
+-out_unlock:
++out:
+ if (data_ac)
+ ocfs2_free_alloc_context(data_ac);
+-
+-out:
+- if (pages) {
+- ocfs2_unlock_and_free_pages(pages, num_pages);
++ if (pages)
+ kfree(pages);
+- }
+
+ return ret;
+ }
+--
+2.17.1
+
--- /dev/null
+From 7845a494911f8a67f28059303e4d6b05fce4925d Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Wed, 11 Feb 2015 04:58:35 +0000
+Subject: of/pci: Remove duplicate kfree in of_pci_get_host_bridge_resources()
+
+[ Upstream commit feb28979c137ba3f649ad36fc27c85c64c111f78 ]
+
+Commit d2be00c0fb5a ("of/pci: Free resources on failure in
+of_pci_get_host_bridge_resources()") fixed the error path so it frees
+everything on the "resources" list. That list includes the bus_range, so
+we should not free it again.
+
+Remove the superfluous free of bus_range.
+
+[bhelgaas: changelog]
+Fixes: d2be00c0fb5a ("of/pci: Free resources on failure in of_pci_get_host_bridge_resources()")
+Reported-by: Jiang Liu <jiang.liu@linux.intel.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Rafael J. Wysocki <rjw@rjwysocki.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_pci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/of/of_pci.c b/drivers/of/of_pci.c
+index ecc5fa5640d2..8a74b1d399a1 100644
+--- a/drivers/of/of_pci.c
++++ b/drivers/of/of_pci.c
+@@ -229,7 +229,6 @@ parse_failed:
+ list_for_each_entry(window, resources, list)
+ kfree(window->res);
+ pci_free_resource_list(resources);
+- kfree(bus_range);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(of_pci_get_host_bridge_resources);
+--
+2.17.1
+
--- /dev/null
+From dcc72cbffe9818e7ea67aee2f6238efbf9a50988 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <miklos@szeredi.hu>
+Date: Mon, 12 Oct 2015 15:56:20 +0200
+Subject: ovl: fix open in stacked overlay
+
+[ Upstream commit 1c8a47df36d72ace8cf78eb6c228aa0f8027d3c2 ]
+
+If two overlayfs filesystems are stacked on top of each other, then we need
+recursion in ovl_d_select_inode().
+
+I guess d_backing_inode() is supposed to do that. But currently it doesn't
+and that functionality is open coded in vfs_open(). This is now copied
+into ovl_d_select_inode() to fix this regression.
+
+Reported-by: Alban Crequy <alban.crequy@gmail.com>
+Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
+Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay...")
+Cc: David Howells <dhowells@redhat.com>
+Cc: <stable@vger.kernel.org> # v4.2+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/inode.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index df5c2853c4e5..a01ec1836a72 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -377,6 +377,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
+ ovl_path_upper(dentry, &realpath);
+ }
+
++ if (realpath.dentry->d_flags & DCACHE_OP_SELECT_INODE)
++ return realpath.dentry->d_op->d_select_inode(realpath.dentry, file_flags);
++
+ return d_backing_inode(realpath.dentry);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From eef5f4ca5cdd2ca1c46f3906d0d7d89b2fb2cfba Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 15 Sep 2015 11:17:21 -0600
+Subject: PCI: Fix devfn for VPD access through function 0
+
+[ Upstream commit 9d9240756e63dd87d6cbf5da8b98ceb8f8192b55 ]
+
+Commit 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function
+0") passes PCI_SLOT(devfn) for the devfn parameter of pci_get_slot().
+Generally this works because we're fairly well guaranteed that a PCIe
+device is at slot address 0, but for the general case, including
+conventional PCI, it's incorrect. We need to get the slot and then convert
+it back into a devfn.
+
+Fixes: 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0")
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Myron Stowe <myron.stowe@redhat.com>
+Acked-by: Mark Rustad <mark.d.rustad@intel.com>
+CC: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/access.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 7f249b9ab2ce..2f15e7bb9f44 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -355,7 +355,8 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = {
+ static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
+ void *arg)
+ {
+- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ struct pci_dev *tdev = pci_get_slot(dev->bus,
++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+ ssize_t ret;
+
+ if (!tdev)
+@@ -369,7 +370,8 @@ static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
+ static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count,
+ const void *arg)
+ {
+- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ struct pci_dev *tdev = pci_get_slot(dev->bus,
++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+ ssize_t ret;
+
+ if (!tdev)
+@@ -388,7 +390,8 @@ static const struct pci_vpd_ops pci_vpd_f0_ops = {
+
+ static int pci_vpd_f0_dev_check(struct pci_dev *dev)
+ {
+- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ struct pci_dev *tdev = pci_get_slot(dev->bus,
++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
+ int ret = 0;
+
+ if (!tdev)
+--
+2.17.1
+
--- /dev/null
+From d664153da5ad0c36d679d936430dfaacc8c8a0cd Mon Sep 17 00:00:00 2001
+From: Maik Broemme <mbroemme@libmpq.org>
+Date: Tue, 9 Aug 2016 16:41:31 +0200
+Subject: PCI: Mark Atheros AR9580 to avoid bus reset
+
+[ Upstream commit 8e2e03179923479ca0c0b6fdc7c93ecf89bce7a8 ]
+
+Similar to the AR93xx and the AR94xx series, the AR95xx also have the same
+quirk for the Bus Reset. It will lead to instant system reset if the
+device is assigned via VFIO to a KVM VM. I've been able reproduce this
+behavior with a MikroTik R11e-2HnD.
+
+Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset")
+Signed-off-by: Maik Broemme <mbroemme@libmpq.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: stable@vger.kernel.org # v3.14+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 9e86ace95832..0b75b47a5329 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3081,6 +3081,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
+
+ #ifdef CONFIG_ACPI
+ /*
+--
+2.17.1
+
--- /dev/null
+From b1401ec96b36818401f13cc406489db93a5d5093 Mon Sep 17 00:00:00 2001
+From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Date: Wed, 24 Jun 2015 16:40:04 +0530
+Subject: perf bench numa: Fix to show proper convergence stats
+
+[ Upstream commit 2b42b09b88c831ba4da2d669581dde371c38c2af ]
+
+With commit: e1e455f4f4d3 (perf tools: Work around lack of sched_getcpu
+in glibc < 2.6), perf_bench numa mem with -c or -m option is not able to
+correctly calculate convergence.
+
+With the above commit, sched_getcpu always seems to return -1. The
+intention of commit e1e455f was to add a sched_getcpu in glibc < 2.6.
+Hence keep the sched_getcpu definition under an ifdef.
+
+This regression happened occurred between v4.0 and v4.1
+
+Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Vinson Lee <vlee@twitter.com>
+Fixes: e1e455f4f4d3 ("perf tools: Work around lack of sched_getcpu in glibc < 2.6")
+Link: http://lkml.kernel.org/r/20150624111004.GA5220@linux.vnet.ibm.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cloexec.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
+index 85b523885f9d..2babddaa2481 100644
+--- a/tools/perf/util/cloexec.c
++++ b/tools/perf/util/cloexec.c
+@@ -7,11 +7,15 @@
+
+ static unsigned long flag = PERF_FLAG_FD_CLOEXEC;
+
++#ifdef __GLIBC_PREREQ
++#if !__GLIBC_PREREQ(2, 6)
+ int __weak sched_getcpu(void)
+ {
+ errno = ENOSYS;
+ return -1;
+ }
++#endif
++#endif
+
+ static int perf_flag_probe(void)
+ {
+--
+2.17.1
+
--- /dev/null
+From 75de191ea4012421df35a64d5869da3d9f0be152 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 30 Nov 2015 12:56:15 +0100
+Subject: perf: Fix PERF_EVENT_IOC_PERIOD deadlock
+
+[ Upstream commit 642c2d671ceff40e9453203ea0c66e991e11e249 ]
+
+Dmitry reported a fairly silly recursive lock deadlock for
+PERF_EVENT_IOC_PERIOD, fix this by explicitly doing the inactive part of
+__perf_event_period() instead of calling that function.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: <stable@vger.kernel.org>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kostya Serebryany <kcc@google.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sasha Levin <sasha.levin@oracle.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Fixes: c7999c6f3fed ("perf: Fix PERF_EVENT_IOC_PERIOD migration race")
+Link: http://lkml.kernel.org/r/20151130115615.GJ17308@twins.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 1f08f691de59..7b2f9d432fe7 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3929,7 +3929,14 @@ retry:
+ goto retry;
+ }
+
+- __perf_event_period(&pe);
++ if (event->attr.freq) {
++ event->attr.sample_freq = value;
++ } else {
++ event->attr.sample_period = value;
++ event->hw.sample_period = value;
++ }
++
++ local64_set(&event->hw.period_left, 0);
+ raw_spin_unlock_irq(&ctx->lock);
+
+ return 0;
+--
+2.17.1
+
--- /dev/null
+From 737967d63f3e5ee9c28a5f086a4916281173d58a Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Fri, 9 Jan 2015 09:38:12 +0900
+Subject: perf machine: Fix __machine__findnew_thread() error path
+
+[ Upstream commit 260d819e3abdbdaa2b88fb983d1314f1b263f9e2 ]
+
+When thread__init_map_groups() fails, a new thread should be removed
+from the rbtree since it's gonna be freed. Also update last match cache
+only if the function succeeded.
+
+Reported-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/1420763892-15535-1-git-send-email-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/machine.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 34fc7c8672e4..84238a10c34b 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -389,7 +389,6 @@ static struct thread *__machine__findnew_thread(struct machine *machine,
+ if (th != NULL) {
+ rb_link_node(&th->rb_node, parent, p);
+ rb_insert_color(&th->rb_node, &machine->threads);
+- machine->last_match = th;
+
+ /*
+ * We have to initialize map_groups separately
+@@ -400,9 +399,12 @@ static struct thread *__machine__findnew_thread(struct machine *machine,
+ * leader and that would screwed the rb tree.
+ */
+ if (thread__init_map_groups(th, machine)) {
++ rb_erase(&th->rb_node, &machine->threads);
+ thread__delete(th);
+ return NULL;
+ }
++
++ machine->last_match = th;
+ }
+
+ return th;
+--
+2.17.1
+
--- /dev/null
+From e64079c9102e6bdf575340a040a1f28563fecb32 Mon Sep 17 00:00:00 2001
+From: Stephane Eranian <eranian@google.com>
+Date: Tue, 13 Jan 2015 23:59:53 +0100
+Subject: perf/rapl: Fix sysfs_show() initialization for RAPL PMU
+
+[ Upstream commit 433678bdc6ed39f053c55da96b51de5bf0aeebb1 ]
+
+This patch fixes a problem with the initialization of the
+sysfs_show() routine for the RAPL PMU.
+
+The current code was wrongly relying on the EVENT_ATTR_STR()
+macro which uses the events_sysfs_show() function in the x86
+PMU code. That function itself was relying on the x86_pmu data
+structure. Yet RAPL and the core PMU (x86_pmu) have nothing to
+do with each other. They should therefore not interact with
+each other.
+
+The x86_pmu structure is initialized at boot time based on
+the host CPU model. When the host CPU is not supported, the
+x86_pmu remains uninitialized and some of the callbacks it
+contains are NULL.
+
+The false dependency with x86_pmu could potentially cause crashes
+in case the x86_pmu is not initialized while the RAPL PMU is. This
+may, for instance, be the case in virtualized environments.
+
+This patch fixes the problem by using a private sysfs_show()
+routine for exporting the RAPL PMU events.
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20150113225953.GA21525@thinkpad
+Cc: vincent.weaver@maine.edu
+Cc: jolsa@redhat.com
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/perf_event_intel_rapl.c | 44 +++++++++++++++------
+ 1 file changed, 32 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+index 611d821eac1a..040915c87cb6 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
+@@ -103,6 +103,13 @@ static struct kobj_attribute format_attr_##_var = \
+
+ #define RAPL_CNTR_WIDTH 32 /* 32-bit rapl counters */
+
++#define RAPL_EVENT_ATTR_STR(_name, v, str) \
++static struct perf_pmu_events_attr event_attr_##v = { \
++ .attr = __ATTR(_name, 0444, rapl_sysfs_show, NULL), \
++ .id = 0, \
++ .event_str = str, \
++};
++
+ struct rapl_pmu {
+ spinlock_t lock;
+ int hw_unit; /* 1/2^hw_unit Joule */
+@@ -383,23 +390,36 @@ static struct attribute_group rapl_pmu_attr_group = {
+ .attrs = rapl_pmu_attrs,
+ };
+
+-EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01");
+-EVENT_ATTR_STR(energy-pkg , rapl_pkg, "event=0x02");
+-EVENT_ATTR_STR(energy-ram , rapl_ram, "event=0x03");
+-EVENT_ATTR_STR(energy-gpu , rapl_gpu, "event=0x04");
++static ssize_t rapl_sysfs_show(struct device *dev,
++ struct device_attribute *attr,
++ char *page)
++{
++ struct perf_pmu_events_attr *pmu_attr = \
++ container_of(attr, struct perf_pmu_events_attr, attr);
++
++ if (pmu_attr->event_str)
++ return sprintf(page, "%s", pmu_attr->event_str);
++
++ return 0;
++}
++
++RAPL_EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01");
++RAPL_EVENT_ATTR_STR(energy-pkg , rapl_pkg, "event=0x02");
++RAPL_EVENT_ATTR_STR(energy-ram , rapl_ram, "event=0x03");
++RAPL_EVENT_ATTR_STR(energy-gpu , rapl_gpu, "event=0x04");
+
+-EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules");
+-EVENT_ATTR_STR(energy-pkg.unit , rapl_pkg_unit, "Joules");
+-EVENT_ATTR_STR(energy-ram.unit , rapl_ram_unit, "Joules");
+-EVENT_ATTR_STR(energy-gpu.unit , rapl_gpu_unit, "Joules");
++RAPL_EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules");
++RAPL_EVENT_ATTR_STR(energy-pkg.unit , rapl_pkg_unit, "Joules");
++RAPL_EVENT_ATTR_STR(energy-ram.unit , rapl_ram_unit, "Joules");
++RAPL_EVENT_ATTR_STR(energy-gpu.unit , rapl_gpu_unit, "Joules");
+
+ /*
+ * we compute in 0.23 nJ increments regardless of MSR
+ */
+-EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10");
+-EVENT_ATTR_STR(energy-pkg.scale, rapl_pkg_scale, "2.3283064365386962890625e-10");
+-EVENT_ATTR_STR(energy-ram.scale, rapl_ram_scale, "2.3283064365386962890625e-10");
+-EVENT_ATTR_STR(energy-gpu.scale, rapl_gpu_scale, "2.3283064365386962890625e-10");
++RAPL_EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10");
++RAPL_EVENT_ATTR_STR(energy-pkg.scale, rapl_pkg_scale, "2.3283064365386962890625e-10");
++RAPL_EVENT_ATTR_STR(energy-ram.scale, rapl_ram_scale, "2.3283064365386962890625e-10");
++RAPL_EVENT_ATTR_STR(energy-gpu.scale, rapl_gpu_scale, "2.3283064365386962890625e-10");
+
+ static struct attribute *rapl_events_srv_attr[] = {
+ EVENT_PTR(rapl_cores),
+--
+2.17.1
+
--- /dev/null
+From 67d65cc5404503d8a976ae12795437f5c72f4be3 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Sun, 23 Sep 2018 18:13:43 +0200
+Subject: perf/ring_buffer: Prevent concurent ring buffer access
+
+[ Upstream commit cd6fb677ce7e460c25bdd66f689734102ec7d642 ]
+
+Some of the scheduling tracepoints allow the perf_tp_event
+code to write to ring buffer under different cpu than the
+code is running on.
+
+This results in corrupted ring buffer data demonstrated in
+following perf commands:
+
+ # perf record -e 'sched:sched_switch,sched:sched_wakeup' perf bench sched messaging
+ # Running 'sched/messaging' benchmark:
+ # 20 sender and receiver processes per group
+ # 10 groups == 400 processes run
+
+ Total time: 0.383 [sec]
+ [ perf record: Woken up 8 times to write data ]
+ 0x42b890 [0]: failed to process type: -1765585640
+ [ perf record: Captured and wrote 4.825 MB perf.data (29669 samples) ]
+
+ # perf report --stdio
+ 0x42b890 [0]: failed to process type: -1765585640
+
+The reason for the corruption are some of the scheduling tracepoints,
+that have __perf_task dfined and thus allow to store data to another
+cpu ring buffer:
+
+ sched_waking
+ sched_wakeup
+ sched_wakeup_new
+ sched_stat_wait
+ sched_stat_sleep
+ sched_stat_iowait
+ sched_stat_blocked
+
+The perf_tp_event function first store samples for current cpu
+related events defined for tracepoint:
+
+ hlist_for_each_entry_rcu(event, head, hlist_entry)
+ perf_swevent_event(event, count, &data, regs);
+
+And then iterates events of the 'task' and store the sample
+for any task's event that passes tracepoint checks:
+
+ ctx = rcu_dereference(task->perf_event_ctxp[perf_sw_context]);
+
+ list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
+ if (event->attr.type != PERF_TYPE_TRACEPOINT)
+ continue;
+ if (event->attr.config != entry->type)
+ continue;
+
+ perf_swevent_event(event, count, &data, regs);
+ }
+
+Above code can race with same code running on another cpu,
+ending up with 2 cpus trying to store under the same ring
+buffer, which is specifically not allowed.
+
+This patch prevents the problem, by allowing only events with the same
+current cpu to receive the event.
+
+NOTE: this requires the use of (per-task-)per-cpu buffers for this
+feature to work; perf-record does this.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+[peterz: small edits to Changelog]
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andrew Vagin <avagin@openvz.org>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Fixes: e6dab5ffab59 ("perf/trace: Add ability to set a target task for events")
+Link: http://lkml.kernel.org/r/20180923161343.GB15054@krava
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 1f08f691de59..98ec8186b7d6 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6351,6 +6351,8 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size,
+ goto unlock;
+
+ list_for_each_entry_rcu(event, &ctx->event_list, event_entry) {
++ if (event->cpu != smp_processor_id())
++ continue;
+ if (event->attr.type != PERF_TYPE_TRACEPOINT)
+ continue;
+ if (event->attr.config != entry->type)
+--
+2.17.1
+
--- /dev/null
+From 30a34a14dcec55b7cbb9768ef4e2f45d29e54bef Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
+Date: Tue, 13 Jan 2015 19:13:22 +0530
+Subject: perf tools: Avoid build splat for syscall numbers with uclibc
+
+[ Upstream commit ea1fe3a88763d4dfef7e2529ba606f96e8e6b271 ]
+
+This is due to duplicated unistd inclusion (via uClibc headers + kernel headers)
+Also seen on ARM uClibc based tools
+
+ ------- ARC build ---------->8-------------
+
+ CC util/evlist.o
+In file included from
+~/arc/k.org/arch/arc/include/uapi/asm/unistd.h:25:0,
+ from util/../perf-sys.h:10,
+ from util/../perf.h:15,
+ from util/event.h:7,
+ from util/event.c:3:
+~/arc/k.org/include/uapi/asm-generic/unistd.h:906:0:
+warning: "__NR_fcntl64" redefined [enabled by default]
+ #define __NR_fcntl64 __NR3264_fcntl
+ ^
+In file included from
+~/arc/gnu/INSTALL_1412-arc-2014.12-rc1/arc-snps-linux-uclibc/sysroot/usr/include/sys/syscall.h:24:0,
+ from util/../perf-sys.h:6,
+ ----------------->8-------------------
+
+ ------- ARM build ---------->8-------------
+
+ CC FPIC plugin_scsi.o
+In file included from util/../perf-sys.h:9:0,
+ from util/../perf.h:15,
+ from util/cache.h:7,
+ from perf.c:12:
+~/arc/k.org/arch/arm/include/uapi/asm/unistd.h:28:0:
+warning: "__NR_restart_syscall" redefined [enabled by default]
+In file included from
+~/buildroot/host/usr/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/include/sys/syscall.h:25:0,
+ from util/../perf-sys.h:6,
+ from util/../perf.h:15,
+ from util/cache.h:7,
+ from perf.c:12:
+~/buildroot/host/usr/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/include/bits/sysnum.h:17:0:
+note: this is the location of the previous definition
+ ----------------->8-------------------
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Cc: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1421156604-30603-4-git-send-email-vgupta@synopsys.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/sched-pipe.c | 2 +-
+ tools/perf/builtin-top.c | 1 -
+ tools/perf/perf-sys.h | 1 -
+ 3 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/perf/bench/sched-pipe.c b/tools/perf/bench/sched-pipe.c
+index 07a8d7646a15..005cc283790c 100644
+--- a/tools/perf/bench/sched-pipe.c
++++ b/tools/perf/bench/sched-pipe.c
+@@ -19,12 +19,12 @@
+ #include <stdlib.h>
+ #include <signal.h>
+ #include <sys/wait.h>
+-#include <linux/unistd.h>
+ #include <string.h>
+ #include <errno.h>
+ #include <assert.h>
+ #include <sys/time.h>
+ #include <sys/types.h>
++#include <sys/syscall.h>
+
+ #include <pthread.h>
+
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index 8e37334db4fa..c5b9c3f01d85 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -66,7 +66,6 @@
+ #include <sys/utsname.h>
+ #include <sys/mman.h>
+
+-#include <linux/unistd.h>
+ #include <linux/types.h>
+
+ static volatile int done;
+diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h
+index a3b13d7dc1d4..6ef68165c9db 100644
+--- a/tools/perf/perf-sys.h
++++ b/tools/perf/perf-sys.h
+@@ -6,7 +6,6 @@
+ #include <sys/syscall.h>
+ #include <linux/types.h>
+ #include <linux/perf_event.h>
+-#include <asm/unistd.h>
+
+ #if defined(__i386__)
+ #define mb() asm volatile("lock; addl $0,0(%%esp)" ::: "memory")
+--
+2.17.1
+
--- /dev/null
+From 26afaf4b8e6d93a63c0905481a55685ab43b83c5 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Wed, 14 Jan 2015 20:18:05 +0900
+Subject: perf tools: Fix segfault for symbol annotation on TUI
+
+[ Upstream commit 813ccd15452ed34e97aa526ffc70d6d8e6c466c5 ]
+
+Currently the symbol structure is allocated with symbol_conf.priv_size
+to carry sideband information like annotation, map browser on TUI and
+sort-by-name tree node. So retrieving these information from symbol
+needs to care about the details of such placement.
+
+However the annotation code just assumes that the symbol is placed after
+the struct annotation. But actually there's other info between them.
+So accessing those struct will lead to an undefined behavior (usually a
+crash) after they write their info to the same location.
+
+To reproduce the problem, please follow the steps below:
+
+ 1. run perf report (TUI of course) with -v option
+ 2. open map browser (by pressing right arrow key for any entry)
+ 3. search any function (by pressing '/' key and input whatever..)
+ 4. return to the hist browser (by pressing 'q' or left arrow key)
+ 5. open annotation window for the same entry (by pressing 'a' key)
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/1421234288-22758-1-git-send-email-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/annotate.h | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
+index 112d6e268150..dfa6c4c36b3e 100644
+--- a/tools/perf/util/annotate.h
++++ b/tools/perf/util/annotate.h
+@@ -115,11 +115,6 @@ struct annotation {
+ struct annotated_source *src;
+ };
+
+-struct sannotation {
+- struct annotation annotation;
+- struct symbol symbol;
+-};
+-
+ static inline struct sym_hist *annotation__histogram(struct annotation *notes, int idx)
+ {
+ return (((void *)¬es->src->histograms) +
+@@ -128,8 +123,7 @@ static inline struct sym_hist *annotation__histogram(struct annotation *notes, i
+
+ static inline struct annotation *symbol__annotation(struct symbol *sym)
+ {
+- struct sannotation *a = container_of(sym, struct sannotation, symbol);
+- return &a->annotation;
++ return (void *)sym - symbol_conf.priv_size;
+ }
+
+ int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, int evidx);
+--
+2.17.1
+
--- /dev/null
+From bcb0e290c3953f8e9055e1c0323f8b4cae41d65e Mon Sep 17 00:00:00 2001
+From: Alexey Brodkin <abrodkin@synopsys.com>
+Date: Sat, 10 Jan 2015 16:40:50 +0530
+Subject: perf tools: Fix statfs.f_type data type mismatch build error with
+ uclibc
+
+[ Upstream commit db1806edcfef007d9594435a331dcf7e7f1b8fac ]
+
+ARC Linux uses the no legacy syscalls abi and corresponding uClibc headers
+statfs defines f_type to be U32 which causes perf build breakage
+
+http://git.uclibc.org/uClibc/tree/libc/sysdeps/linux/common-generic/bits/statfs.h
+
+ ----------->8---------------
+ CC fs/fs.o
+ fs/fs.c: In function 'fs__valid_mount':
+ fs/fs.c:82:24: error: comparison between signed and unsigned integer
+ expressions [-Werror=sign-compare]
+ else if (st_fs.f_type != magic)
+ ^
+ cc1: all warnings being treated as errors
+ ----------->8---------------
+
+Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Cody P Schafer <dev@codyps.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Vineet Gupta <Vineet.Gupta1@synopsys.com>
+Link: http://lkml.kernel.org/r/1420888254-17504-2-git-send-email-vgupta@synopsys.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/api/fs/debugfs.c | 2 +-
+ tools/lib/api/fs/fs.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/api/fs/debugfs.c b/tools/lib/api/fs/debugfs.c
+index a74fba6d7743..86ea2d7b8845 100644
+--- a/tools/lib/api/fs/debugfs.c
++++ b/tools/lib/api/fs/debugfs.c
+@@ -67,7 +67,7 @@ int debugfs_valid_mountpoint(const char *debugfs)
+
+ if (statfs(debugfs, &st_fs) < 0)
+ return -ENOENT;
+- else if (st_fs.f_type != (long) DEBUGFS_MAGIC)
++ else if ((long)st_fs.f_type != (long)DEBUGFS_MAGIC)
+ return -ENOENT;
+
+ return 0;
+diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
+index c1b49c36a951..4b2fa7bcbb84 100644
+--- a/tools/lib/api/fs/fs.c
++++ b/tools/lib/api/fs/fs.c
+@@ -75,7 +75,7 @@ static int fs__valid_mount(const char *fs, long magic)
+
+ if (statfs(fs, &st_fs) < 0)
+ return -ENOENT;
+- else if (st_fs.f_type != magic)
++ else if ((long)st_fs.f_type != magic)
+ return -ENOENT;
+
+ return 0;
+--
+2.17.1
+
--- /dev/null
+From da5512efe9cd8eba2ec56e31be00e7793e885736 Mon Sep 17 00:00:00 2001
+From: Kan Liang <kan.liang@intel.com>
+Date: Mon, 12 Jan 2015 17:42:21 +0000
+Subject: perf/x86/intel: Fix bug for "cycles:p" and "cycles:pp" on SLM
+
+[ Upstream commit 33636732dcd7cc738a5913bb730d663c6b03c8fb ]
+
+cycles:p and cycles:pp do not work on SLM since commit:
+
+ 86a04461a99f ("perf/x86: Revamp PEBS event selection")
+
+UOPS_RETIRED.ALL is not a PEBS capable event, so it should not be used
+to count cycle number.
+
+Actually SLM calls intel_pebs_aliases_core2() which uses INST_RETIRED.ANY_P
+to count the number of cycles. It's a PEBS capable event. But inv and
+cmask must be set to count cycles.
+
+Considering SLM allows all events as PEBS with no flags, only
+INST_RETIRED.ANY_P, inv=1, cmask=16 needs to handled specially.
+
+Signed-off-by: Kan Liang <kan.liang@intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1421084541-31639-1-git-send-email-kan.liang@intel.com
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/perf_event_intel_ds.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+index 46211bcc813e..423cbd9bea3e 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+@@ -568,8 +568,8 @@ struct event_constraint intel_atom_pebs_event_constraints[] = {
+ };
+
+ struct event_constraint intel_slm_pebs_event_constraints[] = {
+- /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */
+- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf),
++ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */
++ INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x1),
+ /* Allow all events as PEBS with no flags */
+ INTEL_ALL_EVENT_CONSTRAINT(0, 0x1),
+ EVENT_CONSTRAINT_END
+--
+2.17.1
+
--- /dev/null
+From d971b73a9325d5cde15ea419b1bea64743de4c30 Mon Sep 17 00:00:00 2001
+From: Vignesh R <vigneshr@ti.com>
+Date: Tue, 16 Dec 2014 14:52:50 +0530
+Subject: phy: phy-ti-pipe3: fix inconsistent enumeration of PCIe gen2 cards
+
+[ Upstream commit 0bc09f9cdc589e0b54724096138996a00b19babb ]
+
+Prior to DRA74x silicon rev 1.1, pcie_pcs register bits 8-15 and bits 16-23
+were used to configure RC delay count for phy1 and phy2 respectively.
+phyid was used as index to distinguish the phys and to configure the delay
+values appropriately.
+
+As of DRA74x silicon rev 1.1, pcie_pcs register definition has changed.
+Bits 16-23 are used to configure delay values for *both* phy1 and phy2.
+
+Hence phyid is no longer required.
+
+So, drop id field from ti_pipe3 structure and its subsequent references
+for configuring pcie_pcs register.
+
+Also, pcie_pcs register now needs to be configured with delay value of 0x96
+at bit positions 16-23. See register description of CTRL_CORE_PCIE_PCS in
+ARM572x TRM, SPRUHZ6, October 2014, section 18.5.2.2, table 18-1804.
+
+This is needed to ensure Gen2 cards are enumerated consistently.
+
+DRA72x silicon behaves same way as DRA74x rev 1.1 as far as this functionality
+is considered.
+
+Test results on DRA74x and DRA72x EVMs:
+
+Before patch
+------------
+DRA74x ES 1.0: Gen1 cards work, Gen2 cards do not work (expected result due to
+silicon errata)
+DRA74x ES 1.1: Gen1 cards work, Gen2 cards do not work sometimes due to incorrect
+programming of register
+
+DRA72x: Gen1 cards work, Gen2 cards do not work sometimes due to incorrect
+programming of register
+
+After patch
+-----------
+DRA74x ES 1.0: Gen1 cards work, Gen2 cards do not work (expected result due to
+silicon errata)
+DRA74x ES 1.1: Gen1 cards work, Gen2 cards work consistently.
+
+DRA72x: Gen1 and Gen2 cards enumerate consistently.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/phy-omap-control.c | 7 +++----
+ drivers/phy/phy-ti-pipe3.c | 10 ++++++----
+ include/linux/phy/omap_control_phy.h | 6 +++---
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/phy/phy-omap-control.c b/drivers/phy/phy-omap-control.c
+index c96e8183a8ff..efe724f97e02 100644
+--- a/drivers/phy/phy-omap-control.c
++++ b/drivers/phy/phy-omap-control.c
+@@ -29,10 +29,9 @@
+ /**
+ * omap_control_pcie_pcs - set the PCS delay count
+ * @dev: the control module device
+- * @id: index of the pcie PHY (should be 1 or 2)
+ * @delay: 8 bit delay value
+ */
+-void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay)
++void omap_control_pcie_pcs(struct device *dev, u8 delay)
+ {
+ u32 val;
+ struct omap_control_phy *control_phy;
+@@ -55,8 +54,8 @@ void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay)
+
+ val = readl(control_phy->pcie_pcs);
+ val &= ~(OMAP_CTRL_PCIE_PCS_MASK <<
+- (id * OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT));
+- val |= delay << (id * OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT);
++ OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT);
++ val |= (delay << OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT);
+ writel(val, control_phy->pcie_pcs);
+ }
+ EXPORT_SYMBOL_GPL(omap_control_pcie_pcs);
+diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c
+index ab1e22d9a1e8..fd92fc64f5da 100644
+--- a/drivers/phy/phy-ti-pipe3.c
++++ b/drivers/phy/phy-ti-pipe3.c
+@@ -82,7 +82,6 @@ struct ti_pipe3 {
+ struct clk *refclk;
+ struct clk *div_clk;
+ struct pipe3_dpll_map *dpll_map;
+- u8 id;
+ };
+
+ static struct pipe3_dpll_map dpll_map_usb[] = {
+@@ -217,8 +216,13 @@ static int ti_pipe3_init(struct phy *x)
+ u32 val;
+ int ret = 0;
+
++ /*
++ * Set pcie_pcs register to 0x96 for proper functioning of phy
++ * as recommended in AM572x TRM SPRUHZ6, section 18.5.2.2, table
++ * 18-1804.
++ */
+ if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie")) {
+- omap_control_pcie_pcs(phy->control_dev, phy->id, 0xF1);
++ omap_control_pcie_pcs(phy->control_dev, 0x96);
+ return 0;
+ }
+
+@@ -347,8 +351,6 @@ static int ti_pipe3_probe(struct platform_device *pdev)
+ }
+
+ if (of_device_is_compatible(node, "ti,phy-pipe3-pcie")) {
+- if (of_property_read_u8(node, "id", &phy->id) < 0)
+- phy->id = 1;
+
+ clk = devm_clk_get(phy->dev, "dpll_ref");
+ if (IS_ERR(clk)) {
+diff --git a/include/linux/phy/omap_control_phy.h b/include/linux/phy/omap_control_phy.h
+index e9e6cfbfbb58..eb7d4a135a9e 100644
+--- a/include/linux/phy/omap_control_phy.h
++++ b/include/linux/phy/omap_control_phy.h
+@@ -66,7 +66,7 @@ enum omap_control_usb_mode {
+ #define OMAP_CTRL_PIPE3_PHY_TX_RX_POWEROFF 0x0
+
+ #define OMAP_CTRL_PCIE_PCS_MASK 0xff
+-#define OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT 0x8
++#define OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT 16
+
+ #define OMAP_CTRL_USB2_PHY_PD BIT(28)
+
+@@ -79,7 +79,7 @@ enum omap_control_usb_mode {
+ void omap_control_phy_power(struct device *dev, int on);
+ void omap_control_usb_set_mode(struct device *dev,
+ enum omap_control_usb_mode mode);
+-void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay);
++void omap_control_pcie_pcs(struct device *dev, u8 delay);
+ #else
+
+ static inline void omap_control_phy_power(struct device *dev, int on)
+@@ -91,7 +91,7 @@ static inline void omap_control_usb_set_mode(struct device *dev,
+ {
+ }
+
+-static inline void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay)
++static inline void omap_control_pcie_pcs(struct device *dev, u8 delay)
+ {
+ }
+ #endif
+--
+2.17.1
+
--- /dev/null
+From 83b39ad7a630c1efb488e5a60cf4f250a3b3fad6 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 17 Dec 2014 15:39:37 +0100
+Subject: phy-sun4i-usb: Change disconnect threshold value for sun6i
+
+[ Upstream commit 372400344afb60e275a271f3f5ccce17af0e45cb ]
+
+The allwinner SDK uses a value of 3 for the disconnect threshold setting on
+sun6i, do the same in the kernel.
+
+In my previous experience with sun5i problems getting the threshold right
+is important to avoid usb2 devices being unplugged sometimes going unnoticed.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/phy-sun4i-usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
+index 0baf5efc8a40..1a2b045d6a67 100644
+--- a/drivers/phy/phy-sun4i-usb.c
++++ b/drivers/phy/phy-sun4i-usb.c
+@@ -240,7 +240,8 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
+ else
+ data->num_phys = 3;
+
+- if (of_device_is_compatible(np, "allwinner,sun4i-a10-usb-phy"))
++ if (of_device_is_compatible(np, "allwinner,sun4i-a10-usb-phy") ||
++ of_device_is_compatible(np, "allwinner,sun6i-a31-usb-phy"))
+ data->disc_thresh = 3;
+ else
+ data->disc_thresh = 2;
+--
+2.17.1
+
--- /dev/null
+From 9cbb2e530ab2a49a3877d905709f70655867009e Mon Sep 17 00:00:00 2001
+From: David Dueck <davidcdueck@googlemail.com>
+Date: Tue, 28 Jul 2015 09:48:16 +0200
+Subject: pinctrl: at91: fix null pointer dereference
+
+[ Upstream commit 1ab36387ea4face01aac3560b396b1e2ce07c4ff ]
+
+Not all gpio banks are necessarily enabled, in the current code this can
+lead to null pointer dereferences.
+
+[ 51.130000] Unable to handle kernel NULL pointer dereference at virtual address 00000058
+[ 51.130000] pgd = dee04000
+[ 51.130000] [00000058] *pgd=3f66d831, *pte=00000000, *ppte=00000000
+[ 51.140000] Internal error: Oops: 17 [#1] ARM
+[ 51.140000] Modules linked in:
+[ 51.140000] CPU: 0 PID: 1664 Comm: cat Not tainted 4.1.1+ #6
+[ 51.140000] Hardware name: Atmel SAMA5
+[ 51.140000] task: df6dd880 ti: dec60000 task.ti: dec60000
+[ 51.140000] PC is at at91_pinconf_get+0xb4/0x200
+[ 51.140000] LR is at at91_pinconf_get+0xb4/0x200
+[ 51.140000] pc : [<c01e71a0>] lr : [<c01e71a0>] psr: 600f0013
+sp : dec61e48 ip : 600f0013 fp : df522538
+[ 51.140000] r10: df52250c r9 : 00000058 r8 : 00000068
+[ 51.140000] r7 : 00000000 r6 : df53c910 r5 : 00000000 r4 : dec61e7c
+[ 51.140000] r3 : 00000000 r2 : c06746d4 r1 : 00000000 r0 : 00000003
+[ 51.140000] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 51.140000] Control: 10c53c7d Table: 3ee04059 DAC: 00000015
+[ 51.140000] Process cat (pid: 1664, stack limit = 0xdec60208)
+[ 51.140000] Stack: (0xdec61e48 to 0xdec62000)
+[ 51.140000] 1e40: 00000358 00000000 df522500 ded15f80 c05a9d08 ded15f80
+[ 51.140000] 1e60: 0000048c 00000061 df522500 ded15f80 c05a9d08 c01e7304 ded15f80 00000000
+[ 51.140000] 1e80: c01e6008 00000060 0000048c c01e6034 c01e5f6c ded15f80 dec61ec0 00000000
+[ 51.140000] 1ea0: 00020000 ded6f280 dec61f80 00000001 00000001 c00ae0b8 b6e80000 ded15fb0
+[ 51.140000] 1ec0: 00000000 00000000 df4bc974 00000055 00000800 ded6f280 b6e80000 ded6f280
+[ 51.140000] 1ee0: ded6f280 00020000 b6e80000 00000000 00020000 c0090dec c0671e1c dec61fb0
+[ 51.140000] 1f00: b6f8b510 00000001 00004201 c000924c 00000000 00000003 00000003 00000000
+[ 51.140000] 1f20: df4bc940 00022000 00000022 c066e188 b6e7f000 c00836f4 000b6e7f ded6f280
+[ 51.140000] 1f40: ded6f280 b6e80000 dec61f80 ded6f280 00020000 c0091508 00000000 00000003
+[ 51.140000] 1f60: 00022000 00000000 00000000 ded6f280 ded6f280 00020000 b6e80000 c0091d9c
+[ 51.140000] 1f80: 00000000 00000000 ffffffff 00020000 00020000 b6e80000 00000003 c000f124
+[ 51.140000] 1fa0: dec60000 c000efa0 00020000 00020000 00000003 b6e80000 00020000 000271c4
+[ 51.140000] 1fc0: 00020000 00020000 b6e80000 00000003 7fffe000 00000000 00000000 00020000
+[ 51.140000] 1fe0: 00000000 bef50b64 00013835 b6f29c76 400f0030 00000003 00000000 00000000
+[ 51.140000] [<c01e71a0>] (at91_pinconf_get) from [<c01e7304>] (at91_pinconf_dbg_show+0x18/0x2c0)
+[ 51.140000] [<c01e7304>] (at91_pinconf_dbg_show) from [<c01e6034>] (pinconf_pins_show+0xc8/0xf8)
+[ 51.140000] [<c01e6034>] (pinconf_pins_show) from [<c00ae0b8>] (seq_read+0x1a0/0x464)
+[ 51.140000] [<c00ae0b8>] (seq_read) from [<c0090dec>] (__vfs_read+0x20/0xd0)
+[ 51.140000] [<c0090dec>] (__vfs_read) from [<c0091508>] (vfs_read+0x7c/0x108)
+[ 51.140000] [<c0091508>] (vfs_read) from [<c0091d9c>] (SyS_read+0x40/0x94)
+[ 51.140000] [<c0091d9c>] (SyS_read) from [<c000efa0>] (ret_fast_syscall+0x0/0x3c)
+[ 51.140000] Code: eb010ec2 e30a0d08 e34c005a eb0ae5a7 (e5993000)
+[ 51.150000] ---[ end trace fb3c370da3ea4794 ]---
+
+Fixes: a0b957f306fa ("pinctrl: at91: allow to have disabled gpio bank")
+Cc: stable@vger.kernel.org # 3.18
+Signed-off-by: David Dueck <davidcdueck@googlemail.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Cc: Boris Brezillon <boris.brezillon@free-electrons.com>
+Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-at91.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
+index d6380c187db6..ceebe2e3882f 100644
+--- a/drivers/pinctrl/pinctrl-at91.c
++++ b/drivers/pinctrl/pinctrl-at91.c
+@@ -322,6 +322,9 @@ static const struct pinctrl_ops at91_pctrl_ops = {
+ static void __iomem *pin_to_controller(struct at91_pinctrl *info,
+ unsigned int bank)
+ {
++ if (!gpio_chips[bank])
++ return NULL;
++
+ return gpio_chips[bank]->regbase;
+ }
+
+@@ -731,6 +734,10 @@ static int at91_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,
+ pin = &pins_conf[i];
+ at91_pin_dbg(info->dev, pin);
+ pio = pin_to_controller(info, pin->bank);
++
++ if (!pio)
++ continue;
++
+ mask = pin_to_mask(pin->pin);
+ at91_mux_disable_interrupt(pio, mask);
+ switch (pin->mux) {
+@@ -850,6 +857,10 @@ static int at91_pinconf_get(struct pinctrl_dev *pctldev,
+ *config = 0;
+ dev_dbg(info->dev, "%s:%d, pin_id=%d", __func__, __LINE__, pin_id);
+ pio = pin_to_controller(info, pin_to_bank(pin_id));
++
++ if (!pio)
++ return -EINVAL;
++
+ pin = pin_id % MAX_NB_GPIO_PER_BANK;
+
+ if (at91_mux_get_multidrive(pio, pin))
+@@ -891,6 +902,10 @@ static int at91_pinconf_set(struct pinctrl_dev *pctldev,
+ "%s:%d, pin_id=%d, config=0x%lx",
+ __func__, __LINE__, pin_id, config);
+ pio = pin_to_controller(info, pin_to_bank(pin_id));
++
++ if (!pio)
++ return -EINVAL;
++
+ pin = pin_id % MAX_NB_GPIO_PER_BANK;
+ mask = pin_to_mask(pin);
+
+--
+2.17.1
+
--- /dev/null
+From 1f1ba05b81c10450308ab23c046894c4b3d363e4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Wed, 23 Sep 2015 16:35:09 +0200
+Subject: pinctrl: imx25: ensure that a pin with id i is at position i in the
+ info array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 9911a2d5e9d14e39692b751929a92cb5a1d9d0e0 ]
+
+The code in pinctrl-imx.c only works correctly if in the
+imx_pinctrl_soc_info passed to imx_pinctrl_probe we have:
+
+ info->pins[i].number = i
+ conf_reg(info->pins[i]) = 4 * i
+
+(which conf_reg(pin) being the offset of the pin's configuration
+register).
+
+When the imx25 specific part was introduced in b4a87c9b966f ("pinctrl:
+pinctrl-imx: add imx25 pinctrl driver") we had:
+
+ info->pins[i].number = i + 1
+ conf_reg(info->pins[i]) = 4 * i
+
+. Commit 34027ca2bbc6 ("pinctrl: imx25: fix numbering for pins") tried
+to fix that but made the situation:
+
+ info->pins[i-1].number = i
+ conf_reg(info->pins[i-1]) = 4 * i
+
+which is hardly better but fixed the error seen back then.
+
+So insert another reserved entry in the array to finally yield:
+
+ info->pins[i].number = i
+ conf_reg(info->pins[i]) = 4 * i
+
+Fixes: 34027ca2bbc6 ("pinctrl: imx25: fix numbering for pins")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/freescale/pinctrl-imx25.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx25.c b/drivers/pinctrl/freescale/pinctrl-imx25.c
+index b5fabf684632..23e480b5da3e 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx25.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx25.c
+@@ -26,7 +26,8 @@
+ #include "pinctrl-imx.h"
+
+ enum imx25_pads {
+- MX25_PAD_RESERVE0 = 1,
++ MX25_PAD_RESERVE0 = 0,
++ MX25_PAD_RESERVE1 = 1,
+ MX25_PAD_A10 = 2,
+ MX25_PAD_A13 = 3,
+ MX25_PAD_A14 = 4,
+@@ -169,6 +170,7 @@ enum imx25_pads {
+ /* Pad names for the pinmux subsystem */
+ static const struct pinctrl_pin_desc imx25_pinctrl_pads[] = {
+ IMX_PINCTRL_PIN(MX25_PAD_RESERVE0),
++ IMX_PINCTRL_PIN(MX25_PAD_RESERVE1),
+ IMX_PINCTRL_PIN(MX25_PAD_A10),
+ IMX_PINCTRL_PIN(MX25_PAD_A13),
+ IMX_PINCTRL_PIN(MX25_PAD_A14),
+--
+2.17.1
+
--- /dev/null
+From 2dd8873ee38cbccf053e1e4427a2bf3dd89089dd Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 4 Mar 2015 14:42:02 +0100
+Subject: quota: Fix maximum quota limit settings
+
+[ Upstream commit 7e08da50cf706151f324349f9235ebd311226997 ]
+
+Currently quota format that supports 64-bit usage sets maximum quota
+limit as 2^64-1. However quota core code uses signed numbers to track
+usage and even limits themselves are stored in long long. Checking of
+maximum allowable limits worked by luck until commit 14bf61ffe6ac
+(quota: Switch ->get_dqblk() and ->set_dqblk() to use bytes as space
+units) because variable we compared with was unsigned. After that commit
+the type we compared against changed to signed and thus checks for
+maximum limits with the newest VFS quota format started to refuse any
+non-negative value. Later the problem was inadvertedly fixed by commit
+b10a08194c2b (quota: Store maximum space limit in bytes) because we
+started to compare against unsigned type as well.
+
+Fix possible future problems of this kind by setting maximum limits to
+2^63-1 to avoid overflow issues.
+
+Reported-by: Carlos Carvalho <carlos@fisica.ufpr.br>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/quota_v2.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index d1a8054bba9a..5d9fc7918e24 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -117,12 +117,16 @@ static int v2_read_file_info(struct super_block *sb, int type)
+ qinfo = info->dqi_priv;
+ if (version == 0) {
+ /* limits are stored as unsigned 32-bit data */
+- info->dqi_max_spc_limit = 0xffffffffULL << QUOTABLOCK_BITS;
++ info->dqi_max_spc_limit = 0xffffffffLL << QUOTABLOCK_BITS;
+ info->dqi_max_ino_limit = 0xffffffff;
+ } else {
+- /* used space is stored as unsigned 64-bit value in bytes */
+- info->dqi_max_spc_limit = 0xffffffffffffffffULL; /* 2^64-1 */
+- info->dqi_max_ino_limit = 0xffffffffffffffffULL;
++ /*
++ * Used space is stored as unsigned 64-bit value in bytes but
++ * quota core supports only signed 64-bit values so use that
++ * as a limit
++ */
++ info->dqi_max_spc_limit = 0x7fffffffffffffffLL; /* 2^63-1 */
++ info->dqi_max_ino_limit = 0x7fffffffffffffffLL;
+ }
+ info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace);
+ info->dqi_igrace = le32_to_cpu(dinfo.dqi_igrace);
+--
+2.17.1
+
--- /dev/null
+From 062f0dfdcc2a8ee448c41fefbc32a877df1e2a5a Mon Sep 17 00:00:00 2001
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Thu, 22 Jan 2015 22:47:14 -0800
+Subject: rcu: Clear need_qs flag to prevent splat
+
+[ Upstream commit c0135d07b013fa8f7ba9ec91b4369c372e6a28cb ]
+
+If the scheduling-clock interrupt sets the current tasks need_qs flag,
+but if the current CPU passes through a quiescent state in the meantime,
+then rcu_preempt_qs() will fail to clear the need_qs flag, which can fool
+RCU into thinking that additional rcu_read_unlock_special() processing
+is needed. This commit therefore clears the need_qs flag before checking
+for additional processing.
+
+For this problem to occur, we need rcu_preempt_data.passed_quiesce equal
+to true and current->rcu_read_unlock_special.b.need_qs also equal to true.
+This condition can occur as follows:
+
+1. CPU 0 is aware of the current preemptible RCU grace period,
+ but has not yet passed through a quiescent state. Among other
+ things, this means that rcu_preempt_data.passed_quiesce is false.
+
+2. Task A running on CPU 0 enters a preemptible RCU read-side
+ critical section.
+
+3. CPU 0 takes a scheduling-clock interrupt, which notices the
+ RCU read-side critical section and the need for a quiescent state,
+ and thus sets current->rcu_read_unlock_special.b.need_qs to true.
+
+4. Task A is preempted, enters the scheduler, eventually invoking
+ rcu_preempt_note_context_switch() which in turn invokes
+ rcu_preempt_qs().
+
+ Because rcu_preempt_data.passed_quiesce is false,
+ control enters the body of the "if" statement, which sets
+ rcu_preempt_data.passed_quiesce to true.
+
+5. At this point, CPU 0 takes an interrupt. The interrupt
+ handler contains an RCU read-side critical section, and
+ the rcu_read_unlock() notes that current->rcu_read_unlock_special
+ is nonzero, and thus invokes rcu_read_unlock_special().
+
+6. Once in rcu_read_unlock_special(), the fact that
+ current->rcu_read_unlock_special.b.need_qs is true becomes
+ apparent, so rcu_read_unlock_special() invokes rcu_preempt_qs().
+ Recursively, given that we interrupted out of that same
+ function in the preceding step.
+
+7. Because rcu_preempt_data.passed_quiesce is now true,
+ rcu_preempt_qs() does nothing, and simply returns.
+
+8. Upon return to rcu_read_unlock_special(), it is noted that
+ current->rcu_read_unlock_special is still nonzero (because
+ the interrupted rcu_preempt_qs() had not yet gotten around
+ to clearing current->rcu_read_unlock_special.b.need_qs).
+
+9. Execution proceeds to the WARN_ON_ONCE(), which notes that
+ we are in an interrupt handler and thus duly splats.
+
+The solution, as noted above, is to make rcu_read_unlock_special()
+clear out current->rcu_read_unlock_special.b.need_qs after calling
+rcu_preempt_qs(). The interrupted rcu_preempt_qs() will clear it again,
+but this is harmless. The worst that happens is that we clobber another
+attempt to set this field, but this is not a problem because we just
+got done reporting a quiescent state.
+
+Reported-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+[ paulmck: Fix embarrassing build bug noted by Sasha Levin. ]
+Tested-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_plugin.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index c1d7f27bd38f..c038831bfa57 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -328,6 +328,7 @@ void rcu_read_unlock_special(struct task_struct *t)
+ special = t->rcu_read_unlock_special;
+ if (special.b.need_qs) {
+ rcu_preempt_qs();
++ t->rcu_read_unlock_special.b.need_qs = false;
+ if (!t->rcu_read_unlock_special.s) {
+ local_irq_restore(flags);
+ return;
+--
+2.17.1
+
--- /dev/null
+From 453596924d406799c74c9f74fd9654086b7547a6 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 26 Jan 2015 04:43:22 -0800
+Subject: Revert "drm/i915: Fix mutex->owner inspection race under
+ DEBUG_MUTEXES"
+
+[ Upstream commit a50940510e94f5fb65ffd79877a60592d85598a9 ]
+
+The core fix was applied in
+
+commit a63b03e2d2477586440741677ecac45bcf28d7b1
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue Jan 6 10:29:35 2015 +0000
+
+ mutex: Always clear owner field upon mutex_unlock()
+
+(note the absence of stable@ tag)
+
+so we can now revert our band-aid commit 226e5ae9e5f910 for -next.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index d88dbedeaa77..d0f0a7943d88 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -5144,7 +5144,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task)
+ if (!mutex_is_locked(mutex))
+ return false;
+
+-#if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES)
++#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES)
+ return mutex->owner == task;
+ #else
+ /* Since UP may be pre-empted, we cannot assume that we own the lock */
+--
+2.17.1
+
--- /dev/null
+From 291fbfe5f2e069765f6526b515001c7344047304 Mon Sep 17 00:00:00 2001
+From: Ken Xue <ken.xue@amd.com>
+Date: Tue, 1 Dec 2015 14:45:23 +0800
+Subject: Revert "SCSI: Fix NULL pointer dereference in runtime PM"
+
+[ Upstream commit 1c69d3b6eb73e466ecbb8edaf1bc7fd585b288da ]
+
+This reverts commit 49718f0fb8c9 ("SCSI: Fix NULL pointer dereference in
+runtime PM")
+
+The old commit may lead to a issue that blk_{pre|post}_runtime_suspend and
+blk_{pre|post}_runtime_resume may not be called in pairs.
+
+Take sr device as example, when sr device goes to runtime suspend,
+blk_{pre|post}_runtime_suspend will be called since sr device defined
+pm->runtime_suspend. But blk_{pre|post}_runtime_resume will not be called
+since sr device doesn't have pm->runtime_resume. so, sr device can not
+resume correctly anymore.
+
+More discussion can be found from below link.
+http://marc.info/?l=linux-scsi&m=144163730531875&w=2
+
+Signed-off-by: Ken Xue <Ken.Xue@amd.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: Xiangliang Yu <Xiangliang.Yu@amd.com>
+Cc: James E.J. Bottomley <JBottomley@odin.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Michael Terry <Michael.terry@canonical.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_pm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
+index a2dcf6a54ec6..75320dad9677 100644
+--- a/drivers/scsi/scsi_pm.c
++++ b/drivers/scsi/scsi_pm.c
+@@ -221,13 +221,13 @@ static int sdev_runtime_suspend(struct device *dev)
+ struct scsi_device *sdev = to_scsi_device(dev);
+ int err = 0;
+
+- if (pm && pm->runtime_suspend) {
+- err = blk_pre_runtime_suspend(sdev->request_queue);
+- if (err)
+- return err;
++ err = blk_pre_runtime_suspend(sdev->request_queue);
++ if (err)
++ return err;
++ if (pm && pm->runtime_suspend)
+ err = pm->runtime_suspend(dev);
+- blk_post_runtime_suspend(sdev->request_queue, err);
+- }
++ blk_post_runtime_suspend(sdev->request_queue, err);
++
+ return err;
+ }
+
+@@ -250,11 +250,11 @@ static int sdev_runtime_resume(struct device *dev)
+ const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+ int err = 0;
+
+- if (pm && pm->runtime_resume) {
+- blk_pre_runtime_resume(sdev->request_queue);
++ blk_pre_runtime_resume(sdev->request_queue);
++ if (pm && pm->runtime_resume)
+ err = pm->runtime_resume(dev);
+- blk_post_runtime_resume(sdev->request_queue, err);
+- }
++ blk_post_runtime_resume(sdev->request_queue, err);
++
+ return err;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 381e5448297ddfad20ccff098fc01a41ec9ae1d0 Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Tue, 30 Dec 2014 07:17:09 -0500
+Subject: Revert "tty: Fix pty master poll() after slave closes v2"
+
+[ Upstream commit 2ce3c10c0c3e0d418c1a7a4c838319ba42c75388 ]
+
+This reverts commit c4dc304677e8d566572c4738d95c48be150c6606.
+This fix is superseded by commit 52bce7f8d4fc633c9a9d0646eef58ba6ae9a3b73,
+'pty, n_tty: Simplify input processing on final close'.
+
+The final close now waits for input processing to complete before
+destroying the pty, so poll() does not need to special case this
+condition.
+
+Cc: Francesco Ruggeri <fruggeri@arista.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_tty.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 6acdd553b707..0ed99ad74bee 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -2472,17 +2472,12 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
+
+ poll_wait(file, &tty->read_wait, wait);
+ poll_wait(file, &tty->write_wait, wait);
+- if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+- mask |= POLLHUP;
+ if (input_available_p(tty, 1))
+ mask |= POLLIN | POLLRDNORM;
+- else if (mask & POLLHUP) {
+- tty_flush_to_ldisc(tty);
+- if (input_available_p(tty, 1))
+- mask |= POLLIN | POLLRDNORM;
+- }
+ if (tty->packet && tty->link->ctrl_status)
+ mask |= POLLPRI | POLLIN | POLLRDNORM;
++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
++ mask |= POLLHUP;
+ if (tty_hung_up_p(file))
+ mask |= POLLHUP;
+ if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
+--
+2.17.1
+
--- /dev/null
+From 6e7941e06d9e89155471fbab18bac1674de62de9 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 10 Nov 2015 10:46:11 -0600
+Subject: rtlwifi: rtl8821ae: Fix lockups on boot
+
+[ Upstream commit eeec5d0ef7ee54a75e09e861c3cc44177b8752c7 ]
+
+In commit 54328e64047a5 ("rtlwifi: rtl8821ae: Fix system lockups on boot"),
+an attempt was made to fix a regression introduced in commit 1277fa2ab2f9
+("rtlwifi: Remove the clear interrupt routine from all drivers").
+Unfortunately, there were logic errors in that patch that prevented
+affected boxes from booting even after that patch was applied.
+
+The actual cause of the original problem is unknown as none of the
+developers have systems that are affected.
+
+Fixes: 54328e64047a ("rtlwifi: rtl8821ae: Fix system lockups on boot")
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Stable <stable@vger.kernel.org> [V4.1+]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 2 +-
+ drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+index 28b8b6a25f6d..3639398f3c71 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+@@ -2272,7 +2272,7 @@ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- if (!rtlpci->int_clear)
++ if (rtlpci->int_clear)
+ rtl8821ae_clear_interrupt(hw);/*clear it here first*/
+
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+index 80307d187c0a..71cf8120a95e 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+@@ -474,7 +474,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
+ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+ MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
+-MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n");
++MODULE_PARM_DESC(int_clear, "Set to 0 to disable interrupt clear before set (default 1)\n");
+
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+
+--
+2.17.1
+
--- /dev/null
+From c615fdcfb3dd757129be4b6f83f8a641b64255cc Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 2 Oct 2015 11:44:30 -0500
+Subject: rtlwifi: rtl8821ae: Fix system lockups on boot
+
+[ Upstream commit 54328e64047a54b8fc2362c2e1f0fa16c90f739f ]
+
+In commit 1277fa2ab2f9 ("rtlwifi: Remove the clear interrupt routine from all
+drivers"), the code that cleared all interrupt enable bits before setting them
+was removed for all PCI drivers. This fixed an issue that caused TX to be
+blocked for 3-5 seconds. On some RTL8821AE units, this change causes soft
+lockups to occur on boot. For that reason, the portion of the earlier commit
+that applied to rtl8821ae is reverted. Kernels 4.1 and newer are affected.
+
+See http://marc.info/?l=linux-wireless&m=144373370103285&w=2 and
+https://bugzilla.opensuse.org/show_bug.cgi?id=944978 for two cases where
+this regression affected user systems. Note that this bug does not appear on
+any of the developer's setups. For those users whose systems are affected
+by the TX blockage, but do not lock up on boot, a module parameter is added
+to disable the interrupt clear
+
+Fixes: 1277fa2ab2f9 ("rtlwifi: Remove the clear interrupt routine from all drivers")
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Stable <stable@vger.kernel.org> [V4.1+]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rtlwifi/pci.h | 2 ++
+ drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 17 +++++++++++++++++
+ drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 5 +++++
+ drivers/net/wireless/rtlwifi/wifi.h | 3 +++
+ 4 files changed, 27 insertions(+)
+
+diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
+index d4567d12e07e..5da6703942d9 100644
+--- a/drivers/net/wireless/rtlwifi/pci.h
++++ b/drivers/net/wireless/rtlwifi/pci.h
+@@ -247,6 +247,8 @@ struct rtl_pci {
+ /* MSI support */
+ bool msi_support;
+ bool using_msi;
++ /* interrupt clear before set */
++ bool int_clear;
+ };
+
+ struct mp_adapter {
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+index e17b728a21aa..28b8b6a25f6d 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+@@ -2253,11 +2253,28 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci)
+ }
+ }
+
++static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++ u32 tmp = rtl_read_dword(rtlpriv, REG_HISR);
++
++ rtl_write_dword(rtlpriv, REG_HISR, tmp);
++
++ tmp = rtl_read_dword(rtlpriv, REG_HISRE);
++ rtl_write_dword(rtlpriv, REG_HISRE, tmp);
++
++ tmp = rtl_read_dword(rtlpriv, REG_HSISR);
++ rtl_write_dword(rtlpriv, REG_HSISR, tmp);
++}
++
+ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
++ if (!rtlpci->int_clear)
++ rtl8821ae_clear_interrupt(hw);/*clear it here first*/
++
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+index fc92dd6a0d07..80307d187c0a 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+@@ -142,6 +142,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
+
+ rtl8821ae_bt_reg_init(hw);
+ rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
++ rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear;
+ rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
+
+ rtlpriv->dm.dm_initialgain_enable = 1;
+@@ -213,6 +214,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
+ rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
+ rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
+ rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
++ rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear;
+ if (rtlpriv->cfg->mod_params->disable_watchdog)
+ pr_info("watchdog disabled\n");
+ rtlpriv->psc.reg_fwctrl_lps = 3;
+@@ -334,6 +336,7 @@ static struct rtl_mod_params rtl8821ae_mod_params = {
+ .swctrl_lps = false,
+ .fwctrl_lps = true,
+ .msi_support = true,
++ .int_clear = true,
+ .debug = DBG_EMERG,
+ .disable_watchdog = 0,
+ };
+@@ -463,6 +466,7 @@ module_param_named(fwlps, rtl8821ae_mod_params.fwctrl_lps, bool, 0444);
+ module_param_named(msi, rtl8821ae_mod_params.msi_support, bool, 0444);
+ module_param_named(disable_watchdog, rtl8821ae_mod_params.disable_watchdog,
+ bool, 0444);
++module_param_named(int_clear, rtl8821ae_mod_params.int_clear, bool, 0444);
+ MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+ MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+ MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+@@ -470,6 +474,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
+ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n");
+ MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
+ MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
++MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n");
+
+ static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
+
+diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
+index 27822fe34d9a..318078645e64 100644
+--- a/drivers/net/wireless/rtlwifi/wifi.h
++++ b/drivers/net/wireless/rtlwifi/wifi.h
+@@ -2212,6 +2212,9 @@ struct rtl_mod_params {
+
+ /* default 0: 1 means disable */
+ bool disable_watchdog;
++
++ /* default 0: 1 means do not disable interrupts */
++ bool int_clear;
+ };
+
+ struct rtl_hal_usbint_cfg {
+--
+2.17.1
+
--- /dev/null
+From 3085b6eefad91291a1a76d136638fb6740309546 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Fri, 17 Feb 2017 01:56:11 +0100
+Subject: rtnl: don't account unused struct ifla_port_vsi in rtnl_port_size
+
+[ Upstream commit 025331df34f6722f86b467cb13a69326444ab1bc ]
+
+When allocating rtnl dump messages, struct ifla_port_vsi is never dumped,
+so we can save header plus payload in rtnl_port_size(). Infact, attribute
+IFLA_PORT_VSI_TYPE and struct ifla_port_vsi are not used anywhere in
+the kernel. We only need to keep the nla policy should applications in
+user space be filling this out. Same NLA_BINARY issue exists as was fixed
+in 364d5716a7ad ("rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY")
+and others, but then again IFLA_PORT_VSI_TYPE is not used anywhere, so
+just add a comment that it's unused.
+
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/rtnetlink.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 51301ad3c2d9..cd09f85ba8d6 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -817,8 +817,6 @@ static size_t rtnl_port_size(const struct net_device *dev,
+ {
+ size_t port_size = nla_total_size(4) /* PORT_VF */
+ + nla_total_size(PORT_PROFILE_MAX) /* PORT_PROFILE */
+- + nla_total_size(sizeof(struct ifla_port_vsi))
+- /* PORT_VSI_TYPE */
+ + nla_total_size(PORT_UUID_MAX) /* PORT_INSTANCE_UUID */
+ + nla_total_size(PORT_UUID_MAX) /* PORT_HOST_UUID */
+ + nla_total_size(1) /* PROT_VDP_REQUEST */
+@@ -1231,14 +1229,19 @@ static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
+ [IFLA_PORT_VF] = { .type = NLA_U32 },
+ [IFLA_PORT_PROFILE] = { .type = NLA_STRING,
+ .len = PORT_PROFILE_MAX },
+- [IFLA_PORT_VSI_TYPE] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_port_vsi)},
+ [IFLA_PORT_INSTANCE_UUID] = { .type = NLA_BINARY,
+ .len = PORT_UUID_MAX },
+ [IFLA_PORT_HOST_UUID] = { .type = NLA_STRING,
+ .len = PORT_UUID_MAX },
+ [IFLA_PORT_REQUEST] = { .type = NLA_U8, },
+ [IFLA_PORT_RESPONSE] = { .type = NLA_U16, },
++
++ /* Unused, but we need to keep it here since user space could
++ * fill it. It's also broken with regard to NLA_BINARY use in
++ * combination with structs.
++ */
++ [IFLA_PORT_VSI_TYPE] = { .type = NLA_BINARY,
++ .len = sizeof(struct ifla_port_vsi) },
+ };
+
+ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+--
+2.17.1
+
--- /dev/null
+From 6fdd7cf27eec069415466874711662982233cc0a Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Sun, 31 Jul 2016 14:52:53 +0200
+Subject: s390/ftrace/jprobes: Fix conflict between jprobes and function graph
+ tracing
+
+[ Upstream commit e64a5470dcd2900ab8f8f83638c00098b10e6300 ]
+
+This fixes the same issue Steven already fixed for x86
+in following commit:
+
+ 237d28db036e ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing
+
+It fixes the crash, that happens when function graph tracing
+and jprobes are used simultaneously. Please refer to above
+commit for details.
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/kprobes.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
+index 014d4729b134..ee03d8f0ee60 100644
+--- a/arch/s390/kernel/kprobes.c
++++ b/arch/s390/kernel/kprobes.c
+@@ -633,6 +633,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
+ stack = (unsigned long) regs->gprs[15];
+
+ memcpy(kcb->jprobes_stack, (void *) stack, MIN_STACK_SIZE(stack));
++
++ /*
++ * jprobes use jprobe_return() which skips the normal return
++ * path of the function, and this messes up the accounting of the
++ * function graph tracer to get messed up.
++ *
++ * Pause function graph tracing while performing the jprobe function.
++ */
++ pause_graph_tracing();
+ return 1;
+ }
+
+@@ -646,6 +655,9 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
+ struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ unsigned long stack;
+
++ /* It's OK to start function graph tracing again */
++ unpause_graph_tracing();
++
+ stack = (unsigned long) kcb->jprobe_saved_regs.gprs[15];
+
+ /* Put the regs back */
+--
+2.17.1
+
--- /dev/null
+From 76b7d6e6b1ecea7e8a76344f8424ae721e4fa0f3 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Tue, 25 Nov 2014 13:17:34 +0100
+Subject: s390/kvm: REPLACE barrier fixup with READ_ONCE
+
+[ Upstream commit 5de72a2247ac05bde7c89039631b3d0c6186fafb ]
+
+ACCESS_ONCE does not work reliably on non-scalar types. For
+example gcc 4.6 and 4.7 might remove the volatile tag for such
+accesses during the SRA (scalar replacement of aggregates) step
+(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145)
+
+Commit 1365039d0cb3 ("KVM: s390: Fix ipte locking") replace
+ACCESS_ONCE with barriers. Lets use READ_ONCE instead.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/gaccess.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
+index 6dc0ad9c7050..8f195fa904a1 100644
+--- a/arch/s390/kvm/gaccess.c
++++ b/arch/s390/kvm/gaccess.c
+@@ -229,12 +229,10 @@ static void ipte_lock_simple(struct kvm_vcpu *vcpu)
+ goto out;
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- old = *ic;
+- barrier();
++ old = READ_ONCE(*ic);
+ while (old.k) {
+ cond_resched();
+- old = *ic;
+- barrier();
++ old = READ_ONCE(*ic);
+ }
+ new = old;
+ new.k = 1;
+@@ -253,8 +251,7 @@ static void ipte_unlock_simple(struct kvm_vcpu *vcpu)
+ goto out;
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- old = *ic;
+- barrier();
++ old = READ_ONCE(*ic);
+ new = old;
+ new.k = 0;
+ } while (cmpxchg(&ic->val, old.val, new.val) != old.val);
+@@ -269,12 +266,10 @@ static void ipte_lock_siif(struct kvm_vcpu *vcpu)
+
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- old = *ic;
+- barrier();
++ old = READ_ONCE(*ic);
+ while (old.kg) {
+ cond_resched();
+- old = *ic;
+- barrier();
++ old = READ_ONCE(*ic);
+ }
+ new = old;
+ new.k = 1;
+@@ -288,8 +283,7 @@ static void ipte_unlock_siif(struct kvm_vcpu *vcpu)
+
+ ic = &vcpu->kvm->arch.sca->ipte_control;
+ do {
+- old = *ic;
+- barrier();
++ old = READ_ONCE(*ic);
+ new = old;
+ new.kh--;
+ if (!new.kh)
+--
+2.17.1
+
--- /dev/null
+From 09e8b9e3dd71022d8f7518ef9713c637c4243b21 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Mon, 5 Jan 2015 20:29:38 +0100
+Subject: scsi: ->queue_rq can't sleep
+
+[ Upstream commit 70a0f2c1898c6abf53670e55642b6e840b003892 ]
+
+The blk-mq ->queue_rq method is always called from process context,
+but might have preemption disabled. This means we still always
+have to use GFP_ATOMIC for memory allocations, and thus need to
+revert part of commit 3c356bde1 ("scsi: stop passing a gfp_mask
+argument down the command setup path").
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reported-by: Sasha Levin <sasha.levin@oracle.com>
+Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Tested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index a11837054d6c..0d5c218b7ad1 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -616,7 +616,7 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents,
+ }
+
+ ret = __sg_alloc_table(&sdb->table, nents, SCSI_MAX_SG_SEGMENTS,
+- first_chunk, gfp_mask, scsi_sg_alloc);
++ first_chunk, GFP_ATOMIC, scsi_sg_alloc);
+ if (unlikely(ret))
+ scsi_free_sgtable(sdb, mq);
+ return ret;
+--
+2.17.1
+
--- /dev/null
+From f93a4482d318bbbbbf8b0a1cc2b90ae58e9646be Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Wed, 3 Feb 2016 23:33:30 +0800
+Subject: sctp: translate network order to host order when users get a hmacid
+
+[ Upstream commit 7a84bd46647ff181eb2659fdc99590e6f16e501d ]
+
+Commit ed5a377d87dc ("sctp: translate host order to network order when
+setting a hmacid") corrected the hmacid byte-order when setting a hmacid.
+but the same issue also exists on getting a hmacid.
+
+We fix it by changing hmacids to host order when users get them with
+getsockopt.
+
+Fixes: Commit ed5a377d87dc ("sctp: translate host order to network order when setting a hmacid")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 13693d0adeaf..5c16d0e13987 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -5607,6 +5607,7 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
+ struct sctp_hmac_algo_param *hmacs;
+ __u16 data_len = 0;
+ u32 num_idents;
++ int i;
+
+ if (!ep->auth_enable)
+ return -EACCES;
+@@ -5624,8 +5625,12 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
+ return -EFAULT;
+ if (put_user(num_idents, &p->shmac_num_idents))
+ return -EFAULT;
+- if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
+- return -EFAULT;
++ for (i = 0; i < num_idents; i++) {
++ __u16 hmacid = ntohs(hmacs->hmac_ids[i]);
++
++ if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
++ return -EFAULT;
++ }
+ return 0;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 007a2f4c6678cba528b754ebb23f14fb50b15c59 Mon Sep 17 00:00:00 2001
+From: Chris Mi <chrism@mellanox.com>
+Date: Thu, 26 Oct 2017 18:24:42 -0700
+Subject: selftests: Introduce a new script to generate tc batch file
+
+[ Upstream commit 7f071998474a9e5f7b98103d3058a1b8ca5887e6 ]
+
+ # ./tdc_batch.py -h
+ usage: tdc_batch.py [-h] [-n NUMBER] [-o] [-s] [-p] device file
+
+ TC batch file generator
+
+ positional arguments:
+ device device name
+ file batch file name
+
+ optional arguments:
+ -h, --help show this help message and exit
+ -n NUMBER, --number NUMBER
+ how many lines in batch file
+ -o, --skip_sw skip_sw (offload), by default skip_hw
+ -s, --share_action all filters share the same action
+ -p, --prio all filters have different prio
+
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Acked-by: Lucas Bates <lucasb@mojatatu.com>
+Signed-off-by: Chris Mi <chrism@mellanox.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../testing/selftests/tc-testing/tdc_batch.py | 62 +++++++++++++++++++
+ 1 file changed, 62 insertions(+)
+ create mode 100755 tools/testing/selftests/tc-testing/tdc_batch.py
+
+diff --git a/tools/testing/selftests/tc-testing/tdc_batch.py b/tools/testing/selftests/tc-testing/tdc_batch.py
+new file mode 100755
+index 000000000000..707c6bfef689
+--- /dev/null
++++ b/tools/testing/selftests/tc-testing/tdc_batch.py
+@@ -0,0 +1,62 @@
++#!/usr/bin/python3
++
++"""
++tdc_batch.py - a script to generate TC batch file
++
++Copyright (C) 2017 Chris Mi <chrism@mellanox.com>
++"""
++
++import argparse
++
++parser = argparse.ArgumentParser(description='TC batch file generator')
++parser.add_argument("device", help="device name")
++parser.add_argument("file", help="batch file name")
++parser.add_argument("-n", "--number", type=int,
++ help="how many lines in batch file")
++parser.add_argument("-o", "--skip_sw",
++ help="skip_sw (offload), by default skip_hw",
++ action="store_true")
++parser.add_argument("-s", "--share_action",
++ help="all filters share the same action",
++ action="store_true")
++parser.add_argument("-p", "--prio",
++ help="all filters have different prio",
++ action="store_true")
++args = parser.parse_args()
++
++device = args.device
++file = open(args.file, 'w')
++
++number = 1
++if args.number:
++ number = args.number
++
++skip = "skip_hw"
++if args.skip_sw:
++ skip = "skip_sw"
++
++share_action = ""
++if args.share_action:
++ share_action = "index 1"
++
++prio = "prio 1"
++if args.prio:
++ prio = ""
++ if number > 0x4000:
++ number = 0x4000
++
++index = 0
++for i in range(0x100):
++ for j in range(0x100):
++ for k in range(0x100):
++ mac = ("%02x:%02x:%02x" % (i, j, k))
++ src_mac = "e4:11:00:" + mac
++ dst_mac = "e4:12:00:" + mac
++ cmd = ("filter add dev %s %s protocol ip parent ffff: flower %s "
++ "src_mac %s dst_mac %s action drop %s" %
++ (device, prio, skip, src_mac, dst_mac, share_action))
++ file.write("%s\n" % cmd)
++ index += 1
++ if index >= number:
++ file.close()
++ exit(0)
+--
+2.17.1
+
--- /dev/null
+From ca2099da4c46808a88377be89f62cc67c87ca437 Mon Sep 17 00:00:00 2001
+From: Chanwoo Choi <cw00.choi@samsung.com>
+Date: Tue, 2 Dec 2014 17:49:54 +0900
+Subject: serial: samsung: Add the support for Exynos5433 SoC
+
+[ Upstream commit 31ec77aca72ee5920ed3ec3d047734dc0bc43342 ]
+
+This patch adds new s3c24xx_serial_drv_data structure for Exynos5433 SoC
+because Exynos5433 has different fifo size from existing Exynos4 SoC.
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: linux-serial@vger.kernel.org
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Acked-by: Inki Dae <inki.dae@samsung.com>
+Acked-by: Geunsik Lim <geunsik.lim@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/samsung.c | 56 +++++++++++++++++++++++-------------
+ 1 file changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index ba59a76edc8b..957992ceba0a 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1785,32 +1785,43 @@ static struct s3c24xx_serial_drv_data s5pv210_serial_drv_data = {
+ #endif
+
+ #if defined(CONFIG_ARCH_EXYNOS)
++#define EXYNOS_COMMON_SERIAL_DRV_DATA \
++ .info = &(struct s3c24xx_uart_info) { \
++ .name = "Samsung Exynos UART", \
++ .type = PORT_S3C6400, \
++ .has_divslot = 1, \
++ .rx_fifomask = S5PV210_UFSTAT_RXMASK, \
++ .rx_fifoshift = S5PV210_UFSTAT_RXSHIFT, \
++ .rx_fifofull = S5PV210_UFSTAT_RXFULL, \
++ .tx_fifofull = S5PV210_UFSTAT_TXFULL, \
++ .tx_fifomask = S5PV210_UFSTAT_TXMASK, \
++ .tx_fifoshift = S5PV210_UFSTAT_TXSHIFT, \
++ .def_clk_sel = S3C2410_UCON_CLKSEL0, \
++ .num_clks = 1, \
++ .clksel_mask = 0, \
++ .clksel_shift = 0, \
++ }, \
++ .def_cfg = &(struct s3c2410_uartcfg) { \
++ .ucon = S5PV210_UCON_DEFAULT, \
++ .ufcon = S5PV210_UFCON_DEFAULT, \
++ .has_fracval = 1, \
++ } \
++
+ static struct s3c24xx_serial_drv_data exynos4210_serial_drv_data = {
+- .info = &(struct s3c24xx_uart_info) {
+- .name = "Samsung Exynos4 UART",
+- .type = PORT_S3C6400,
+- .has_divslot = 1,
+- .rx_fifomask = S5PV210_UFSTAT_RXMASK,
+- .rx_fifoshift = S5PV210_UFSTAT_RXSHIFT,
+- .rx_fifofull = S5PV210_UFSTAT_RXFULL,
+- .tx_fifofull = S5PV210_UFSTAT_TXFULL,
+- .tx_fifomask = S5PV210_UFSTAT_TXMASK,
+- .tx_fifoshift = S5PV210_UFSTAT_TXSHIFT,
+- .def_clk_sel = S3C2410_UCON_CLKSEL0,
+- .num_clks = 1,
+- .clksel_mask = 0,
+- .clksel_shift = 0,
+- },
+- .def_cfg = &(struct s3c2410_uartcfg) {
+- .ucon = S5PV210_UCON_DEFAULT,
+- .ufcon = S5PV210_UFCON_DEFAULT,
+- .has_fracval = 1,
+- },
++ EXYNOS_COMMON_SERIAL_DRV_DATA,
+ .fifosize = { 256, 64, 16, 16 },
+ };
++
++static struct s3c24xx_serial_drv_data exynos5433_serial_drv_data = {
++ EXYNOS_COMMON_SERIAL_DRV_DATA,
++ .fifosize = { 64, 256, 16, 256 },
++};
++
+ #define EXYNOS4210_SERIAL_DRV_DATA ((kernel_ulong_t)&exynos4210_serial_drv_data)
++#define EXYNOS5433_SERIAL_DRV_DATA ((kernel_ulong_t)&exynos5433_serial_drv_data)
+ #else
+ #define EXYNOS4210_SERIAL_DRV_DATA (kernel_ulong_t)NULL
++#define EXYNOS5433_SERIAL_DRV_DATA (kernel_ulong_t)NULL
+ #endif
+
+ static struct platform_device_id s3c24xx_serial_driver_ids[] = {
+@@ -1832,6 +1843,9 @@ static struct platform_device_id s3c24xx_serial_driver_ids[] = {
+ }, {
+ .name = "exynos4210-uart",
+ .driver_data = EXYNOS4210_SERIAL_DRV_DATA,
++ }, {
++ .name = "exynos5433-uart",
++ .driver_data = EXYNOS5433_SERIAL_DRV_DATA,
+ },
+ { },
+ };
+@@ -1851,6 +1865,8 @@ static const struct of_device_id s3c24xx_uart_dt_match[] = {
+ .data = (void *)S5PV210_SERIAL_DRV_DATA },
+ { .compatible = "samsung,exynos4210-uart",
+ .data = (void *)EXYNOS4210_SERIAL_DRV_DATA },
++ { .compatible = "samsung,exynos5433-uart",
++ .data = (void *)EXYNOS5433_SERIAL_DRV_DATA },
+ {},
+ };
+ MODULE_DEVICE_TABLE(of, s3c24xx_uart_dt_match);
+--
+2.17.1
+
media-af9035-prevent-buffer-overflow-on-write.patch
powerpc-tm-fix-userspace-r13-corruption.patch
powerpc-tm-avoid-possible-userspace-r1-corruption-on-reclaim.patch
+xfrm-validate-address-prefix-lengths-in-the-xfrm-sel.patch
+xfrm6-call-kfree_skb-when-skb-is-toobig.patch
+cfg80211-reg-init-wiphy_idx-in-regulatory_hint_core.patch
+arm-8799-1-mm-fix-pci_ioremap_io-offset-check.patch
+xfrm-validate-template-mode.patch
+asix-check-for-supported-wake-on-lan-modes.patch
+ax88179_178a-check-for-supported-wake-on-lan-modes.patch
+sr9800-check-for-supported-wake-on-lan-modes.patch
+smsc75xx-check-for-wake-on-lan-modes.patch
+smsc95xx-check-for-wake-on-lan-modes.patch
+perf-ring_buffer-prevent-concurent-ring-buffer-acces.patch
+net-cxgb3_main-fix-a-missing-check-bug.patch
+dm-thin-restore-requested-error_if_no_space-setting-.patch
+ocfs2-fix-journal-commit-deadlock-in-ocfs2_convert_i.patch
+s390-kvm-replace-barrier-fixup-with-read_once.patch
+usb-qcserial-fix-support-for-hp-lt4112-lte-hspa-gobi.patch
+cxl-fix-issues-when-unmapping-contexts.patch
+s390-ftrace-jprobes-fix-conflict-between-jprobes-and.patch
+mmc-sdhci-restore-behavior-when-setting-vdd-via-exte.patch
+arm-omap5-dra7-fix-hyp-mode-boot-for-thumb2-build.patch
+usb-gadget-gadgetfs-fix-an-oops-in-ep_write.patch
+ahci_xgene-fix-the-dma-state-machine-lockup-for-the-.patch
+revert-drm-i915-fix-mutex-owner-inspection-race-unde.patch
+pinctrl-at91-fix-null-pointer-dereference.patch
+pci-mark-atheros-ar9580-to-avoid-bus-reset.patch
+arm-shmobile-r8a7740-instantiate-gic-from-c-board-co.patch
+usb-musb-fix-a-few-off-by-one-lengths.patch
+usb-gadget-f_uac1-access-freed-memory-at-f_audio_fre.patch
+usb-musb-fix-randconfig-build-issues-for-kconfig-opt.patch
+usb-dwc2-gadget-kill-requests-with-force-in-s3c_hsot.patch
+phy-sun4i-usb-change-disconnect-threshold-value-for-.patch
+phy-phy-ti-pipe3-fix-inconsistent-enumeration-of-pci.patch
+iio-iio-fix-iio_channel_read-return-if-channel-havn-.patch
+arm-dra7xx-fix-counter-frequency-drift-for-am572x-er.patch
+arm-omap2-fix-n900-board-name-for-legacy-user-space.patch
+nfsv4-cache-the-nfsv4-v4.1-client-owner_id-in-the-st.patch
+nfsv4-v4.1-verify-the-client-owner-id-during-trunkin.patch
+nfs-ignore-transport-protocol-when-detecting-server-.patch
+nfsv4-remove-incorrect-check-in-can_open_delegated.patch
+arm-dts-use-pmu_system_controller-phandle-for-dp-phy.patch
+scsi-queue_rq-can-t-sleep.patch
+usb-ehci-adjust-error-return-code.patch
+uas-disable-uas-on-apricorn-sata-dongles.patch
+usb-host-ehci-tegra-request-deferred-probe-when-fail.patch
+revert-tty-fix-pty-master-poll-after-slave-closes-v2.patch
+serial-samsung-add-the-support-for-exynos5433-soc.patch
+mcb-mcb-pci-only-remap-the-1st-0x200-bytes-of-bar-0.patch
+arm-at91-dt-sama5d4-fix-the-timer-reg-length.patch
+arm-at91-sama5d3-dt-correct-the-sound-route.patch
+arm-at91-dt-sam9263-add-missing-clocks-to-lcdc-node.patch
+arm-at91-board-dt-sama5-add-phy_fixup-to-override-na.patch
+fbdev-broadsheetfb-fix-memory-leak.patch
+tracing-fix-enabling-of-syscall-events-on-the-comman.patch
+perf-rapl-fix-sysfs_show-initialization-for-rapl-pmu.patch
+perf-x86-intel-fix-bug-for-cycles-p-and-cycles-pp-on.patch
+perf-machine-fix-__machine__findnew_thread-error-pat.patch
+perf-tools-fix-statfs.f_type-data-type-mismatch-buil.patch
+perf-tools-avoid-build-splat-for-syscall-numbers-wit.patch
+perf-tools-fix-segfault-for-symbol-annotation-on-tui.patch
+drivers-bus-check-cci-device-tree-node-status.patch
+arm-dts-disable-cci-on-exynos5420-based-arndale-octa.patch
+clk-rockchip-fix-deadlock-possibility-in-cpuclk.patch
+quota-fix-maximum-quota-limit-settings.patch
+rtnl-don-t-account-unused-struct-ifla_port_vsi-in-rt.patch
+nfs-fix-high-load-average-due-to-callback-thread-sle.patch
+rcu-clear-need_qs-flag-to-prevent-splat.patch
+x86-irq-check-for-valid-irq-descriptor-in-check_irq_.patch
+of-pci-remove-duplicate-kfree-in-of_pci_get_host_bri.patch
+btrfs-avoid-syncing-log-in-the-fast-fsync-path-when-.patch
+pinctrl-imx25-ensure-that-a-pin-with-id-i-is-at-posi.patch
+dm-fix-ab-ba-deadlock-in-__dm_destroy.patch
+arm-arm64-kvm-take-mmap_sem-in-stage2_unmap_vm.patch
+net-mlx4_en-remove-dependency-between-timestamping-c.patch
+iommu-vt-d-fix-vm-domain-id-leak.patch
+tty-serial-fsl_lpuart-fix-clearing-of-receive-flag.patch
+x86-idle-restore-trace_cpu_idle-to-mwait_idle-calls.patch
+ext4-fix-an-ext3-collapse-range-regression-in-xfstes.patch
+net-ethernet-davicom-fix-devicetree-irq-resource.patch
+perf-bench-numa-fix-to-show-proper-convergence-stats.patch
+mips-fix-up-obsolete-cpu_set-usage.patch
+dm9000-fix-irq-trigger-type-setup-on-non-dt-platform.patch
+lib-make-memzero_explicit-more-robust-against-dead-s.patch
+asoc-dapm-don-t-add-prefix-to-widget-stream-name.patch
+mtd-blkdevs-fix-potential-deadlock-lockdep-warnings.patch
+selftests-introduce-a-new-script-to-generate-tc-batc.patch
+rtlwifi-rtl8821ae-fix-system-lockups-on-boot.patch
+rtlwifi-rtl8821ae-fix-lockups-on-boot.patch
+clocksource-exynos_mct-clear-interrupt-when-cpu-is-s.patch
+alsa-hda-add-headset-mic-support-for-acer-aspire-v5-.patch
+alsa-usb-audio-add-a-more-accurate-volume-quirk-for-.patch
+tty-audit-fix-audit-source.patch
+btrfs-do-not-ignore-errors-from-btrfs_lookup_xattr-i.patch
+igb-unpair-the-queues-when-changing-the-number-of-qu.patch
+libata-blacklist-micron-500it-ssd-with-mu01-firmware.patch
+perf-fix-perf_event_ioc_period-deadlock.patch
+mm-migrate-hugetlb-putback-destination-hugepage-to-a.patch
+revert-scsi-fix-null-pointer-dereference-in-runtime-.patch
+x86-ldt-fix-small-ldt-allocation-for-xen.patch
+pci-fix-devfn-for-vpd-access-through-function-0.patch
+vfs-make-sendfile-2-killable-even-better.patch
+sctp-translate-network-order-to-host-order-when-user.patch
+iwlwifi-pcie-correctly-define-7265-d-cfg.patch
+ovl-fix-open-in-stacked-overlay.patch
+igb-fix-null-derefs-due-to-skipped-sr-iov-enabling.patch
+keys-put-keyring-if-install_session_keyring_to_cred-.patch
+usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch
+net-fix-warnings-in-make-htmldocs-by-moving-macro-de.patch
+x86-pci-mark-broadwell-ep-home-agent-1-as-having-non.patch
+unix-correctly-track-in-flight-fds-in-sending-proces.patch
+fs-fat-fatent.c-add-cond_resched-to-fat_count_free_c.patch
--- /dev/null
+From 1af81e9faeea269f8bd839dd2ad523ff5ffeba7c Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:55 -0700
+Subject: smsc75xx: Check for Wake-on-LAN modes
+
+[ Upstream commit 9c734b2769a73eea2e9e9767c0e0bf839ff23679 ]
+
+The driver does not check for Wake-on-LAN modes specified by an user,
+but will conditionally set the device as wake-up enabled or not based on
+that, which could be a very confusing user experience.
+
+Fixes: 6c636503260d ("smsc75xx: add wol magic packet support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/smsc75xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 3850c342bc54..31724e40f142 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -728,6 +728,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net,
+ struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
+ int ret;
+
++ if (wolinfo->wolopts & ~SUPPORTED_WAKE)
++ return -EINVAL;
++
+ pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
+
+ ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
+--
+2.17.1
+
--- /dev/null
+From 8ced0c2c371a4984950f33efc9fef786bec3a269 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:56 -0700
+Subject: smsc95xx: Check for Wake-on-LAN modes
+
+[ Upstream commit c530c471ba37bdd9fe1c7185b01455c00ae606fb ]
+
+The driver does not check for Wake-on-LAN modes specified by an user,
+but will conditionally set the device as wake-up enabled or not based on
+that, which could be a very confusing user experience.
+
+Fixes: e0e474a83c18 ("smsc95xx: add wol magic packet support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/smsc95xx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index d07bf4cb893f..cf71dc04b5bb 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -727,6 +727,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net,
+ struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+ int ret;
+
++ if (wolinfo->wolopts & ~SUPPORTED_WAKE)
++ return -EINVAL;
++
+ pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE;
+
+ ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts);
+--
+2.17.1
+
--- /dev/null
+From 0f7683aeaf1be4bcb09cd4002daf7d4071b06e2b Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 28 Sep 2018 16:18:53 -0700
+Subject: sr9800: Check for supported Wake-on-LAN modes
+
+[ Upstream commit c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 ]
+
+The driver currently silently accepts unsupported Wake-on-LAN modes
+(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user,
+which is confusing.
+
+Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/sr9800.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index 953de13267df..0144fb19a099 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+ struct usbnet *dev = netdev_priv(net);
+ u8 opt = 0;
+
++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC))
++ return -EINVAL;
++
+ if (wolinfo->wolopts & WAKE_PHY)
+ opt |= SR_MONITOR_LINK;
+ if (wolinfo->wolopts & WAKE_MAGIC)
+--
+2.17.1
+
--- /dev/null
+From dca9a14c2fc1802df048218792e9e9f26055c3c0 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
+Date: Wed, 14 Jan 2015 12:53:45 -0500
+Subject: tracing: Fix enabling of syscall events on the command line
+
+[ Upstream commit ce1039bd3a89e99e4f624e75fb1777fc92d76eb3 ]
+
+Commit 5f893b2639b2 "tracing: Move enabling tracepoints to just after
+rcu_init()" broke the enabling of system call events from the command
+line. The reason was that the enabling of command line trace events
+was moved before PID 1 started, and the syscall tracepoints require
+that all tasks have the TIF_SYSCALL_TRACEPOINT flag set. But the
+swapper task (pid 0) is not part of that. Since the swapper task is the
+only task that is running at this early in boot, no task gets the
+flag set, and the tracepoint never gets reached.
+
+Instead of setting the swapper task flag (there should be no reason to
+do that), re-enabled trace events again after the init thread (PID 1)
+has been started. It requires disabling all command line events and
+re-enabling them, as just enabling them again will not reset the logic
+to set the TIF_SYSCALL_TRACEPOINT flag, as the syscall tracepoint will
+be fooled into thinking that it was already set, and wont try setting
+it again. For this reason, we must first disable it and re-enable it.
+
+Link: http://lkml.kernel.org/r/1421188517-18312-1-git-send-email-mpe@ellerman.id.au
+Link: http://lkml.kernel.org/r/20150115040506.216066449@goodmis.org
+
+Reported-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events.c | 69 +++++++++++++++++++++++++++++--------
+ 1 file changed, 55 insertions(+), 14 deletions(-)
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 51c47bc832d4..edf6ab4d8650 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2400,12 +2400,39 @@ static __init int event_trace_memsetup(void)
+ return 0;
+ }
+
++static __init void
++early_enable_events(struct trace_array *tr, bool disable_first)
++{
++ char *buf = bootup_event_buf;
++ char *token;
++ int ret;
++
++ while (true) {
++ token = strsep(&buf, ",");
++
++ if (!token)
++ break;
++ if (!*token)
++ continue;
++
++ /* Restarting syscalls requires that we stop them first */
++ if (disable_first)
++ ftrace_set_clr_event(tr, token, 0);
++
++ ret = ftrace_set_clr_event(tr, token, 1);
++ if (ret)
++ pr_warn("Failed to enable trace event: %s\n", token);
++
++ /* Put back the comma to allow this to be called again */
++ if (buf)
++ *(buf - 1) = ',';
++ }
++}
++
+ static __init int event_trace_enable(void)
+ {
+ struct trace_array *tr = top_trace_array();
+ struct ftrace_event_call **iter, *call;
+- char *buf = bootup_event_buf;
+- char *token;
+ int ret;
+
+ if (!tr)
+@@ -2427,18 +2454,7 @@ static __init int event_trace_enable(void)
+ */
+ __trace_early_add_events(tr);
+
+- while (true) {
+- token = strsep(&buf, ",");
+-
+- if (!token)
+- break;
+- if (!*token)
+- continue;
+-
+- ret = ftrace_set_clr_event(tr, token, 1);
+- if (ret)
+- pr_warn("Failed to enable trace event: %s\n", token);
+- }
++ early_enable_events(tr, false);
+
+ trace_printk_start_comm();
+
+@@ -2449,6 +2465,31 @@ static __init int event_trace_enable(void)
+ return 0;
+ }
+
++/*
++ * event_trace_enable() is called from trace_event_init() first to
++ * initialize events and perhaps start any events that are on the
++ * command line. Unfortunately, there are some events that will not
++ * start this early, like the system call tracepoints that need
++ * to set the TIF_SYSCALL_TRACEPOINT flag of pid 1. But event_trace_enable()
++ * is called before pid 1 starts, and this flag is never set, making
++ * the syscall tracepoint never get reached, but the event is enabled
++ * regardless (and not doing anything).
++ */
++static __init int event_trace_enable_again(void)
++{
++ struct trace_array *tr;
++
++ tr = top_trace_array();
++ if (!tr)
++ return -ENODEV;
++
++ early_enable_events(tr, true);
++
++ return 0;
++}
++
++early_initcall(event_trace_enable_again);
++
+ static __init int event_trace_init(void)
+ {
+ struct trace_array *tr;
+--
+2.17.1
+
--- /dev/null
+From f89cfa6a6a3c5da233bd9ed75df3062d203029ad Mon Sep 17 00:00:00 2001
+From: Peter Hurley <peter@hurleysoftware.com>
+Date: Sun, 8 Nov 2015 08:52:31 -0500
+Subject: tty: audit: Fix audit source
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 6b2a3d628aa752f0ab825fc6d4d07b09e274d1c1 ]
+
+The data to audit/record is in the 'from' buffer (ie., the input
+read buffer).
+
+Fixes: 72586c6061ab ("n_tty: Fix auditing support for cannonical mode")
+Cc: stable <stable@vger.kernel.org> # 4.1+
+Cc: Miloslav Trmač <mitr@redhat.com>
+Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
+Acked-by: Laura Abbott <labbott@fedoraproject.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_tty.c | 2 +-
+ drivers/tty/tty_audit.c | 2 +-
+ include/linux/tty.h | 6 +++---
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 0ed99ad74bee..f53682bb30cf 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -195,7 +195,7 @@ static inline int tty_copy_to_user(struct tty_struct *tty,
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+
+- tty_audit_add_data(tty, to, n, ldata->icanon);
++ tty_audit_add_data(tty, from, n, ldata->icanon);
+ return copy_to_user(to, from, n);
+ }
+
+diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c
+index 90ca082935f6..3d245cd3d8e6 100644
+--- a/drivers/tty/tty_audit.c
++++ b/drivers/tty/tty_audit.c
+@@ -265,7 +265,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty,
+ *
+ * Audit @data of @size from @tty, if necessary.
+ */
+-void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
++void tty_audit_add_data(struct tty_struct *tty, const void *data,
+ size_t size, unsigned icanon)
+ {
+ struct tty_audit_buf *buf;
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 4858a3b79b7a..47d0bfa536e7 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -587,7 +587,7 @@ extern void n_tty_inherit_ops(struct tty_ldisc_ops *ops);
+
+ /* tty_audit.c */
+ #ifdef CONFIG_AUDIT
+-extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data,
++extern void tty_audit_add_data(struct tty_struct *tty, const void *data,
+ size_t size, unsigned icanon);
+ extern void tty_audit_exit(void);
+ extern void tty_audit_fork(struct signal_struct *sig);
+@@ -595,8 +595,8 @@ extern void tty_audit_tiocsti(struct tty_struct *tty, char ch);
+ extern void tty_audit_push(struct tty_struct *tty);
+ extern int tty_audit_push_current(void);
+ #else
+-static inline void tty_audit_add_data(struct tty_struct *tty,
+- unsigned char *data, size_t size, unsigned icanon)
++static inline void tty_audit_add_data(struct tty_struct *tty, const void *data,
++ size_t size, unsigned icanon)
+ {
+ }
+ static inline void tty_audit_tiocsti(struct tty_struct *tty, char ch)
+--
+2.17.1
+
--- /dev/null
+From 38a96be4e54195b7c81cb07ea5f0519bb1138772 Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Tue, 19 Jul 2016 13:13:05 +0530
+Subject: tty: serial: fsl_lpuart: fix clearing of receive flag
+
+[ Upstream commit d68827c62a105eec547945daedf4d1d3e283717d ]
+
+Commit 8e4934c6d6c6 ("tty: serial: fsl_lpuart: clear receive flag on FIFO
+flush") implemented clearing of the receive flag by reading the status register
+only. It turned out that even though we flush the FIFO afterwards, a explicit
+read of the data register is still required.
+
+This leads to a FIFO underrun. To avoid this, follow the advice in the overrun
+"Operation section": Unconditionally clear RXUF after using RXFLUSH.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index af3047d8322a..92b7a5bf7c4d 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -910,13 +910,16 @@ static void lpuart_setup_watermark(struct lpuart_port *sport)
+ writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE,
+ sport->port.membase + UARTPFIFO);
+
+- /* explicitly clear RDRF */
+- readb(sport->port.membase + UARTSR1);
+-
+ /* flush Tx and Rx FIFO */
+ writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH,
+ sport->port.membase + UARTCFIFO);
+
++ /* explicitly clear RDRF */
++ if (readb(sport->port.membase + UARTSR1) & UARTSR1_RDRF) {
++ readb(sport->port.membase + UARTDR);
++ writeb(UARTSFIFO_RXUF, sport->port.membase + UARTSFIFO);
++ }
++
+ writeb(0, sport->port.membase + UARTTWFIFO);
+ writeb(1, sport->port.membase + UARTRWFIFO);
+
+--
+2.17.1
+
--- /dev/null
+From efe0b79a52544952898f696449040114ce10e6e1 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Thu, 11 Dec 2014 11:01:11 -0800
+Subject: uas: disable UAS on Apricorn SATA dongles
+
+[ Upstream commit 36d1ffdb210ec2d0d6a69e9f6466ae8727d34119 ]
+
+The Apricorn SATA dongle will occasionally return "USBSUSBSUSB" in
+response to SCSI commands when running in UAS mode. Therefore,
+disable UAS mode on this dongle.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/storage/unusual_uas.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index baf671aef9d0..31c79b1f970e 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -40,6 +40,16 @@
+ * and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
+ */
+
++/*
++ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI
++ * commands in UAS mode. Observed with the 1.28 firmware; are there others?
++ */
++UNUSUAL_DEV(0x0984, 0x0301, 0x0128, 0x0128,
++ "Apricorn",
++ "",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_IGNORE_UAS),
++
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=79511 */
+ UNUSUAL_DEV(0x0bc2, 0x2312, 0x0000, 0x9999,
+ "Seagate",
+--
+2.17.1
+
--- /dev/null
+From f6379e4f39e6e6433d9f69df119c3d6cfa6db33e Mon Sep 17 00:00:00 2001
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Date: Wed, 3 Feb 2016 02:11:03 +0100
+Subject: unix: correctly track in-flight fds in sending process user_struct
+
+[ Upstream commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 ]
+
+The commit referenced in the Fixes tag incorrectly accounted the number
+of in-flight fds over a unix domain socket to the original opener
+of the file-descriptor. This allows another process to arbitrary
+deplete the original file-openers resource limit for the maximum of
+open files. Instead the sending processes and its struct cred should
+be credited.
+
+To do so, we add a reference counted struct user_struct pointer to the
+scm_fp_list and use it to account for the number of inflight unix fds.
+
+Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets")
+Reported-by: David Herrmann <dh.herrmann@gmail.com>
+Cc: David Herrmann <dh.herrmann@gmail.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/af_unix.h | 4 ++--
+ include/net/scm.h | 1 +
+ net/core/scm.c | 7 +++++++
+ net/unix/af_unix.c | 4 ++--
+ net/unix/garbage.c | 8 ++++----
+ 5 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index e830c3dff61a..7bb69c9c3c43 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -6,8 +6,8 @@
+ #include <linux/mutex.h>
+ #include <net/sock.h>
+
+-void unix_inflight(struct file *fp);
+-void unix_notinflight(struct file *fp);
++void unix_inflight(struct user_struct *user, struct file *fp);
++void unix_notinflight(struct user_struct *user, struct file *fp);
+ void unix_gc(void);
+ void wait_for_unix_gc(void);
+ struct sock *unix_get_socket(struct file *filp);
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 262532d111f5..59fa93c01d2a 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -21,6 +21,7 @@ struct scm_creds {
+ struct scm_fp_list {
+ short count;
+ short max;
++ struct user_struct *user;
+ struct file *fp[SCM_MAX_FD];
+ };
+
+diff --git a/net/core/scm.c b/net/core/scm.c
+index d30eb057fa7b..cad57a1390dd 100644
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
+ *fplp = fpl;
+ fpl->count = 0;
+ fpl->max = SCM_MAX_FD;
++ fpl->user = NULL;
+ }
+ fpp = &fpl->fp[fpl->count];
+
+@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
+ *fpp++ = file;
+ fpl->count++;
+ }
++
++ if (!fpl->user)
++ fpl->user = get_uid(current_user());
++
+ return num;
+ }
+
+@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm)
+ scm->fp = NULL;
+ for (i=fpl->count-1; i>=0; i--)
+ fput(fpl->fp[i]);
++ free_uid(fpl->user);
+ kfree(fpl);
+ }
+ }
+@@ -337,6 +343,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
+ for (i = 0; i < fpl->count; i++)
+ get_file(fpl->fp[i]);
+ new_fpl->max = new_fpl->count;
++ new_fpl->user = get_uid(fpl->user);
+ }
+ return new_fpl;
+ }
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 29b1f4dc48ca..1bd4ba6b6aa4 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1469,7 +1469,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ UNIXCB(skb).fp = NULL;
+
+ for (i = scm->fp->count-1; i >= 0; i--)
+- unix_notinflight(scm->fp->fp[i]);
++ unix_notinflight(scm->fp->user, scm->fp->fp[i]);
+ }
+
+ static void unix_destruct_scm(struct sk_buff *skb)
+@@ -1534,7 +1534,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
+ return -ENOMEM;
+
+ for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
++ unix_inflight(scm->fp->user, scm->fp->fp[i]);
+ return max_level;
+ }
+
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index 58783dcfd35d..1105a60468ac 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file *filp)
+ * descriptor if it is for an AF_UNIX socket.
+ */
+
+-void unix_inflight(struct file *fp)
++void unix_inflight(struct user_struct *user, struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
+
+@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp)
+ }
+ unix_tot_inflight++;
+ }
+- fp->f_cred->user->unix_inflight++;
++ user->unix_inflight++;
+ spin_unlock(&unix_gc_lock);
+ }
+
+-void unix_notinflight(struct file *fp)
++void unix_notinflight(struct user_struct *user, struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
+
+@@ -158,7 +158,7 @@ void unix_notinflight(struct file *fp)
+ list_del_init(&u->link);
+ unix_tot_inflight--;
+ }
+- fp->f_cred->user->unix_inflight--;
++ user->unix_inflight--;
+ spin_unlock(&unix_gc_lock);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 1a2232bf578897ab25f0cef4fe4f6de64146c86e Mon Sep 17 00:00:00 2001
+From: Robert Baldyga <r.baldyga@samsung.com>
+Date: Tue, 9 Dec 2014 14:41:45 +0100
+Subject: usb: dwc2: gadget: kill requests with 'force' in s3c_hsotg_udc_stop()
+
+[ Upstream commit 62f4f0651ce8ef966a0e5b6db6a7a524c268fdd2 ]
+
+This makes us sure that all requests are completed before we unbind
+gadget. There are assumptions in gadget API that all requests have to
+be completed and leak of complete can break some usb function drivers.
+
+For example unbind of ECM function can cause NULL pointer dereference:
+
+[ 26.396595] configfs-gadget gadget: unbind function
+'cdc_ethernet'/e79c4c00
+[ 26.414999] Unable to handle kernel NULL pointer dereference at
+virtual address 00000000
+(...)
+[ 26.452223] PC is at ecm_unbind+0x6c/0x9c
+[ 26.456209] LR is at ecm_unbind+0x68/0x9c
+(...)
+[ 26.603696] [<c033fdb4>] (ecm_unbind) from [<c033661c>]
+(purge_configs_funcs+0x94/0xd8)
+[ 26.611674] [<c033661c>] (purge_configs_funcs) from [<c0336674>]
+(configfs_composite_unbind+0x14/0x34)
+[ 26.620961] [<c0336674>] (configfs_composite_unbind) from
+[<c0337124>] (usb_gadget_remove_driver+0x68/0x9c)
+[ 26.630683] [<c0337124>] (usb_gadget_remove_driver) from [<c03376c8>]
+(usb_gadget_unregister_driver+0x64/0x94)
+[ 26.640664] [<c03376c8>] (usb_gadget_unregister_driver) from
+[<c0336be8>] (unregister_gadget+0x20/0x3c)
+[ 26.650038] [<c0336be8>] (unregister_gadget) from [<c0336c84>]
+(gadget_dev_desc_UDC_store+0x80/0xb8)
+[ 26.659152] [<c0336c84>] (gadget_dev_desc_UDC_store) from
+[<c0335120>] (gadget_info_attr_store+0x1c/0x28)
+[ 26.668703] [<c0335120>] (gadget_info_attr_store) from [<c012135c>]
+(configfs_write_file+0xe8/0x148)
+[ 26.677818] [<c012135c>] (configfs_write_file) from [<c00c8dd4>]
+(vfs_write+0xb0/0x1a0)
+[ 26.685801] [<c00c8dd4>] (vfs_write) from [<c00c91b8>]
+(SyS_write+0x44/0x84)
+[ 26.692834] [<c00c91b8>] (SyS_write) from [<c000e560>]
+(ret_fast_syscall+0x0/0x30)
+[ 26.700381] Code: e30409f8 e34c0069 eb07b88d e59430a8 (e5930000)
+[ 26.706485] ---[ end trace f62a082b323838a2 ]---
+
+It's because in some cases request is still running on endpoint during
+unbind and kill_all_requests() called from s3c_hsotg_udc_stop() function
+doesn't cause call of complete() of request. Missing complete() call
+causes ecm->notify_req equals NULL in ecm_unbind() function, and this
+is reason of this bug.
+
+Similar breaks can be observed in another usb function drivers.
+
+This patch fixes this bug forcing usb request completion in when
+s3c_hsotg_ep_disable() is called from s3c_hsotg_udc_stop().
+
+Acked-by: Paul Zimmerman <paulz@synopsys.com>
+Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 8b5c079c7b7d..cb4c925fb87c 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2590,7 +2590,7 @@ error:
+ * s3c_hsotg_ep_disable - disable given endpoint
+ * @ep: The endpoint to disable.
+ */
+-static int s3c_hsotg_ep_disable(struct usb_ep *ep)
++static int s3c_hsotg_ep_disable_force(struct usb_ep *ep, bool force)
+ {
+ struct s3c_hsotg_ep *hs_ep = our_ep(ep);
+ struct s3c_hsotg *hsotg = hs_ep->parent;
+@@ -2611,7 +2611,7 @@ static int s3c_hsotg_ep_disable(struct usb_ep *ep)
+
+ spin_lock_irqsave(&hsotg->lock, flags);
+ /* terminate all requests with shutdown */
+- kill_all_requests(hsotg, hs_ep, -ESHUTDOWN, false);
++ kill_all_requests(hsotg, hs_ep, -ESHUTDOWN, force);
+
+ hsotg->fifo_map &= ~(1<<hs_ep->fifo_index);
+ hs_ep->fifo_index = 0;
+@@ -2632,6 +2632,10 @@ static int s3c_hsotg_ep_disable(struct usb_ep *ep)
+ return 0;
+ }
+
++static int s3c_hsotg_ep_disable(struct usb_ep *ep)
++{
++ return s3c_hsotg_ep_disable_force(ep, false);
++}
+ /**
+ * on_list - check request is on the given endpoint
+ * @ep: The endpoint to check.
+@@ -2933,7 +2937,7 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget,
+
+ /* all endpoints should be shutdown */
+ for (ep = 1; ep < hsotg->num_of_eps; ep++)
+- s3c_hsotg_ep_disable(&hsotg->eps[ep].ep);
++ s3c_hsotg_ep_disable_force(&hsotg->eps[ep].ep, true);
+
+ spin_lock_irqsave(&hsotg->lock, flags);
+
+--
+2.17.1
+
--- /dev/null
+From 4d3d5e236027c2da59ade274ec058bb487c63d73 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 4 Dec 2014 10:22:57 -0500
+Subject: USB: EHCI: adjust error return code
+
+[ Upstream commit c401e7b4a808d50ab53ef45cb8d0b99b238bf2c9 ]
+
+The USB stack uses error code -ENOSPC to indicate that the periodic
+schedule is too full, with insufficient bandwidth to accommodate a new
+allocation. It uses -EFBIG to indicate that an isochronous transfer
+could not be linked into the schedule because it would exceed the
+number of isochronous packets the host controller driver can handle
+(generally because the new transfer would extend too far into the
+future).
+
+ehci-hcd uses the wrong error code at one point. This patch fixes it,
+along with a misleading comment and debugging message.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-sched.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
+index c399606f154e..f9a332775c47 100644
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1604,11 +1604,11 @@ iso_stream_schedule (
+ */
+ now2 = (now - base) & (mod - 1);
+
+- /* Is the schedule already full? */
++ /* Is the schedule about to wrap around? */
+ if (unlikely(!empty && start < period)) {
+- ehci_dbg(ehci, "iso sched full %p (%u-%u < %u mod %u)\n",
++ ehci_dbg(ehci, "request %p would overflow (%u-%u < %u mod %u)\n",
+ urb, stream->next_uframe, base, period, mod);
+- status = -ENOSPC;
++ status = -EFBIG;
+ goto fail;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 0d684de5a27b7c022f92795ace572b3bc120b90c Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Mon, 1 Dec 2014 16:09:27 +0800
+Subject: usb: gadget: f_uac1: access freed memory at f_audio_free_inst
+
+[ Upstream commit 4fde6204df052bb89ba3d915ed6ed9f306f3cfa1 ]
+
+At f_audio_free_inst, it tries to access struct gaudio *card which is
+freed at f_audio_free, it causes below oops if the audio device is not
+there (do unload module may trigger the same problem). The gaudio_cleanup
+is related to function, so it is better move to f_audio_free.
+
+root@freescale ~$ modprobe g_audio
+[ 751.968931] g_audio gadget: unable to open sound control device file: /dev/snd/controlC0
+[ 751.977134] g_audio gadget: we need at least one control device
+[ 751.988633] Unable to handle kernel paging request at virtual address 455f448e
+[ 751.995963] pgd = bd42c000
+[ 751.998681] [455f448e] *pgd=00000000
+[ 752.002383] Internal error: Oops: 5 [#1] SMP ARM
+[ 752.007008] Modules linked in: usb_f_uac1 g_audio(+) usb_f_mass_storage libcomposite configfs [last unloaded: g_mass_storage]
+[ 752.018427] CPU: 0 PID: 692 Comm: modprobe Not tainted 3.18.0-rc4-00345-g842f57b #10
+[ 752.026176] task: bdb3ba80 ti: bd41a000 task.ti: bd41a000
+[ 752.031590] PC is at filp_close+0xc/0x84
+[ 752.035530] LR is at gaudio_cleanup+0x28/0x54 [usb_f_uac1]
+[ 752.041023] pc : [<800ec94c>] lr : [<7f03c63c>] psr: 20000013
+[ 752.041023] sp : bd41bcc8 ip : bd41bce8 fp : bd41bce4
+[ 752.052504] r10: 7f036234 r9 : 7f036220 r8 : 7f036500
+[ 752.057732] r7 : bd456480 r6 : 7f036500 r5 : 7f03626c r4 : bd441000
+[ 752.064264] r3 : 7f03b3dc r2 : 7f03cab0 r1 : 00000000 r0 : 455f4456
+[ 752.070798] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 752.077938] Control: 10c5387d Table: bd42c04a DAC: 00000015
+[ 752.083688] Process modprobe (pid: 692, stack limit = 0xbd41a240)
+[ 752.089786] Stack: (0xbd41bcc8 to 0xbd41c000)
+[ 752.094152] bcc0: 7f03b3dc bd441000 7f03626c 7f036500 bd41bcfc bd41bce8
+[ 752.102337] bce0: 7f03c63c 800ec94c 7f03b3dc bdaa6b00 bd41bd14 bd41bd00 7f03b3f4 7f03c620
+[ 752.110521] bd00: 7f03b3dc 7f03cbd4 bd41bd2c bd41bd18 7f00f88c 7f03b3e8 00000000 fffffffe
+[ 752.118705] bd20: bd41bd5c bd41bd30 7f0380d8 7f00f874 7f038000 bd456480 7f036364 be392240
+[ 752.126889] bd40: 00000000 7f00f620 7f00f638 bd41a008 bd41bd94 bd41bd60 7f00f6d4 7f03800c
+[ 752.135073] bd60: 00000001 00000000 8047438c be3a4000 7f036364 7f036364 7f00db28 7f00f620
+[ 752.143257] bd80: 7f00f638 bd41a008 bd41bdb4 bd41bd98 804742ac 7f00f644 00000000 809adde0
+[ 752.151442] bda0: 7f036364 7f036364 bd41bdcc bd41bdb8 804743c8 80474284 7f03633c 7f036200
+[ 752.159626] bdc0: bd41bdf4 bd41bdd0 7f00d5b4 8047435c bd41a000 80974060 7f038158 00000000
+[ 752.167811] bde0: 80974060 bdaa9940 bd41be04 bd41bdf8 7f03816c 7f00d518 bd41be8c bd41be08
+[ 752.175995] be00: 80008a5c 7f038164 be001f00 7f0363c4 bd41bf48 00000000 bd41be54 bd41be28
+[ 752.184179] be20: 800e9498 800e8e74 00000002 00000003 bd4129c0 c0a07000 00000001 7f0363c4
+[ 752.192363] be40: bd41bf48 00000000 bd41be74 bd41be58 800de780 800e9320 bd41a000 7f0363d0
+[ 752.200547] be60: 00000000 bd41a000 7f0363d0 00000000 bd41beec 7f0363c4 bd41bf48 00000000
+[ 752.208731] be80: bd41bf44 bd41be90 80093e54 800089e0 ffff8000 00007fff 80091390 0000065f
+[ 752.216915] bea0: 00000000 c0a0834c bd41bf7c 00000086 bd41bf50 00000000 7f03651c 00000086
+[ 752.225099] bec0: bd41a010 00c28758 800ddcc4 800ddae0 000000d2 bd412a00 bd41bf24 00000000
+[ 752.233283] bee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[ 752.241467] bf00: 00000000 00000000 00000000 00000000 00000000 00000000 bd41bf44 000025b0
+[ 752.249651] bf20: 00c28a08 00c28758 00000080 8000edc4 bd41a000 00000000 bd41bfa4 bd41bf48
+[ 752.257835] bf40: 800943e4 800932ec c0a07000 000025b0 c0a07f8c c0a07ea4 c0a08e5c 0000051c
+[ 752.266019] bf60: 0000088c 00000000 00000000 00000000 00000018 00000019 00000010 0000000b
+[ 752.274203] bf80: 00000009 00000000 00000000 000025b0 00000000 00c28758 00000000 bd41bfa8
+[ 752.282387] bfa0: 8000ec00 8009430c 000025b0 00000000 00c28a08 000025b0 00c28758 00c28980
+[ 752.290571] bfc0: 000025b0 00000000 00c28758 00000080 000a6a78 00000007 00c28718 00c28980
+[ 752.298756] bfe0: 7ebc1af0 7ebc1ae0 0001a32c 76e9c490 60000010 00c28a08 22013510 ecebffff
+[ 752.306933] Backtrace:
+[ 752.309414] [<800ec940>] (filp_close) from [<7f03c63c>] (gaudio_cleanup+0x28/0x54 [usb_f_uac1])
+[ 752.318115] r6:7f036500 r5:7f03626c r4:bd441000 r3:7f03b3dc
+[ 752.323851] [<7f03c614>] (gaudio_cleanup [usb_f_uac1]) from [<7f03b3f4>] (f_audio_free_inst+0x18/0x68 [usb_f_uac1])
+[ 752.334288] r4:bdaa6b00 r3:7f03b3dc
+[ 752.337931] [<7f03b3dc>] (f_audio_free_inst [usb_f_uac1]) from [<7f00f88c>] (usb_put_function_instance+0x24/0x30 [libcomposite])
+[ 752.349498] r4:7f03cbd4 r3:7f03b3dc
+[ 752.353127] [<7f00f868>] (usb_put_function_instance [libcomposite]) from [<7f0380d8>] (audio_bind+0xd8/0xfc [g_audio])
+[ 752.363824] r4:fffffffe r3:00000000
+[ 752.367456] [<7f038000>] (audio_bind [g_audio]) from [<7f00f6d4>] (composite_bind+0x9c/0x1e8 [libcomposite])
+[ 752.377284] r10:bd41a008 r9:7f00f638 r8:7f00f620 r7:00000000 r6:be392240 r5:7f036364
+[ 752.385193] r4:bd456480 r3:7f038000
+[ 752.388825] [<7f00f638>] (composite_bind [libcomposite]) from [<804742ac>] (udc_bind_to_driver+0x34/0xd8)
+[ 752.398394] r10:bd41a008 r9:7f00f638 r8:7f00f620 r7:7f00db28 r6:7f036364 r5:7f036364
+[ 752.406302] r4:be3a4000
+[ 752.408860] [<80474278>] (udc_bind_to_driver) from [<804743c8>] (usb_gadget_probe_driver+0x78/0xa8)
+[ 752.417908] r6:7f036364 r5:7f036364 r4:809adde0 r3:00000000
+[ 752.423649] [<80474350>] (usb_gadget_probe_driver) from [<7f00d5b4>] (usb_composite_probe+0xa8/0xd4 [libcomposite])
+[ 752.434086] r5:7f036200 r4:7f03633c
+[ 752.437713] [<7f00d50c>] (usb_composite_probe [libcomposite]) from [<7f03816c>] (audio_driver_init+0x14/0x1c [g_audio])
+[ 752.448498] r9:bdaa9940 r8:80974060 r7:00000000 r6:7f038158 r5:80974060 r4:bd41a000
+[ 752.456330] [<7f038158>] (audio_driver_init [g_audio]) from [<80008a5c>] (do_one_initcall+0x88/0x1d4)
+[ 752.465564] [<800089d4>] (do_one_initcall) from [<80093e54>] (load_module+0xb74/0x1020)
+[ 752.473571] r10:00000000 r9:bd41bf48 r8:7f0363c4 r7:bd41beec r6:00000000 r5:7f0363d0
+[ 752.481478] r4:bd41a000
+[ 752.484037] [<800932e0>] (load_module) from [<800943e4>] (SyS_init_module+0xe4/0xf8)
+[ 752.491781] r10:00000000 r9:bd41a000 r8:8000edc4 r7:00000080 r6:00c28758 r5:00c28a08
+[ 752.499689] r4:000025b0
+[ 752.502252] [<80094300>] (SyS_init_module) from [<8000ec00>] (ret_fast_syscall+0x0/0x48)
+[ 752.510345] r6:00c28758 r5:00000000 r4:000025b0
+[ 752.515013] Code: 808475b4 e1a0c00d e92dd878 e24cb004 (e5904038)
+[ 752.521223] ---[ end trace 70babe34de4ab99b ]---
+Segmentation fault
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_uac1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c
+index f7b203293205..e9715845f82e 100644
+--- a/drivers/usb/gadget/function/f_uac1.c
++++ b/drivers/usb/gadget/function/f_uac1.c
+@@ -897,7 +897,6 @@ static void f_audio_free_inst(struct usb_function_instance *f)
+ struct f_uac1_opts *opts;
+
+ opts = container_of(f, struct f_uac1_opts, func_inst);
+- gaudio_cleanup(opts->card);
+ if (opts->fn_play_alloc)
+ kfree(opts->fn_play);
+ if (opts->fn_cap_alloc)
+@@ -935,6 +934,7 @@ static void f_audio_free(struct usb_function *f)
+ struct f_audio *audio = func_to_audio(f);
+ struct f_uac1_opts *opts;
+
++ gaudio_cleanup(&audio->card);
+ opts = container_of(f->fi, struct f_uac1_opts, func_inst);
+ kfree(audio);
+ mutex_lock(&opts->lock);
+--
+2.17.1
+
--- /dev/null
+From e950bdf0fc69da545be135163071d2206e4e1bd2 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 6 Jan 2015 13:19:21 +0300
+Subject: usb: gadget: gadgetfs: fix an oops in ep_write()
+
+[ Upstream commit 42d6cfa0caec4b68a7f17147fbf13a36e94a8bf2 ]
+
+We try to free an ERR_PTR on this error path.
+
+Fixes: b44be2462dbe ('usb: gadget: gadgetfs: Free memory allocated by memdup_user()')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/legacy/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index e2d57e3d67c7..7974956e8ded 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -442,6 +442,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
+ kbuf = memdup_user(buf, len);
+ if (IS_ERR(kbuf)) {
+ value = PTR_ERR(kbuf);
++ kbuf = NULL;
+ goto free1;
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 6dd07b00fc418d5e2b2d32927b7623cad08e71aa Mon Sep 17 00:00:00 2001
+From: Vince Hsu <vinceh@nvidia.com>
+Date: Wed, 24 Dec 2014 18:16:30 +0800
+Subject: usb: host: ehci-tegra: request deferred probe when failing to get phy
+
+[ Upstream commit f56e67f0a880a5b795cdb5f62614aafe264c5304 ]
+
+The commit 1290a958d48e ("usb: phy: propagate __of_usb_find_phy()'s error on
+failure") changed the condition to return -EPROBE_DEFER to host driver.
+Originally the Tegra host driver depended on the returned -EPROBE_DEFER to
+get the phy device later when booting. Now we have to do that explicitly.
+
+Signed-off-by: Vince Hsu <vinceh@nvidia.com>
+Tested-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
+index aad253559bcd..b4cc4c90b8e3 100644
+--- a/drivers/usb/host/ehci-tegra.c
++++ b/drivers/usb/host/ehci-tegra.c
+@@ -451,7 +451,7 @@ static int tegra_ehci_probe(struct platform_device *pdev)
+
+ u_phy = devm_usb_get_phy_by_phandle(&pdev->dev, "nvidia,phy", 0);
+ if (IS_ERR(u_phy)) {
+- err = PTR_ERR(u_phy);
++ err = -EPROBE_DEFER;
+ goto cleanup_clk_en;
+ }
+ hcd->usb_phy = u_phy;
+--
+2.17.1
+
--- /dev/null
+From 50da2eb257c379fc61920a0625e962a84e45d706 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 5 Aug 2016 11:49:45 -0400
+Subject: USB: hub: fix up early-exit pathway in hub_activate
+
+[ Upstream commit ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 ]
+
+The early-exit pathway in hub_activate, added by commit e50293ef9775
+("USB: fix invalid memory access in hub_activate()") needs
+improvement. It duplicates code that is already present at the end of
+the subroutine, and it neglects to undo the effect of a
+usb_autopm_get_interface_no_resume() call.
+
+This patch fixes both problems by making the early-exit pathway jump
+directly to the end of the subroutine. It simplifies the code at the
+end by merging two conditionals that actually test the same condition
+although they appear different: If type < HUB_INIT3 then type must be
+either HUB_INIT2 or HUB_INIT, and it can't be HUB_INIT because in that
+case the subroutine would have exited earlier.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: <stable@vger.kernel.org> #4.4+
+Reviewed-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/hub.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 164fdeddfc05..9a47a9c8ebb4 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1000,11 +1000,8 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ device_lock(hub->intfdev);
+
+ /* Was the hub disconnected while we were waiting? */
+- if (hub->disconnected) {
+- device_unlock(hub->intfdev);
+- kref_put(&hub->kref, hub_release);
+- return;
+- }
++ if (hub->disconnected)
++ goto disconnected;
+ if (type == HUB_INIT2)
+ goto init2;
+ goto init3;
+@@ -1230,12 +1227,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ /* Scan all ports that need attention */
+ kick_hub_wq(hub);
+
+- /* Allow autosuspend if it was suppressed */
+- if (type <= HUB_INIT3)
++ if (type == HUB_INIT2 || type == HUB_INIT3) {
++ /* Allow autosuspend if it was suppressed */
++ disconnected:
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
+-
+- if (type == HUB_INIT2 || type == HUB_INIT3)
+ device_unlock(hub->intfdev);
++ }
+
+ kref_put(&hub->kref, hub_release);
+ }
+--
+2.17.1
+
--- /dev/null
+From 24e994f555e515ef7e7ef0e20d49254843d38908 Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Thu, 27 Nov 2014 22:25:45 +0100
+Subject: usb: musb: Fix a few off-by-one lengths
+
+[ Upstream commit e87c3f80ad0490d26ffe04754b7d094463b40f30 ]
+
+!strncmp(buf, "force host", 9) is true if and only if buf starts with
+"force hos". This was obviously not what was intended. The same error
+exists for "force full-speed", "force high-speed" and "test
+packet". Using strstarts avoids the error-prone hardcoding of the
+prefix length.
+
+For consistency, also change the other occurences of the !strncmp
+idiom.
+
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/musb_cppi41.c | 4 ++--
+ drivers/usb/musb/musb_debugfs.c | 16 ++++++++--------
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
+index 2a535b70af21..3d69971156ea 100644
+--- a/drivers/usb/musb/musb_cppi41.c
++++ b/drivers/usb/musb/musb_cppi41.c
+@@ -629,9 +629,9 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller)
+ ret = of_property_read_string_index(np, "dma-names", i, &str);
+ if (ret)
+ goto err;
+- if (!strncmp(str, "tx", 2))
++ if (strstarts(str, "tx"))
+ is_tx = 1;
+- else if (!strncmp(str, "rx", 2))
++ else if (strstarts(str, "rx"))
+ is_tx = 0;
+ else {
+ dev_err(dev, "Wrong dmatype %s\n", str);
+diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
+index 4c216790e86b..05d1b203f0d0 100644
+--- a/drivers/usb/musb/musb_debugfs.c
++++ b/drivers/usb/musb/musb_debugfs.c
+@@ -194,30 +194,30 @@ static ssize_t musb_test_mode_write(struct file *file,
+ if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+ return -EFAULT;
+
+- if (!strncmp(buf, "force host", 9))
++ if (strstarts(buf, "force host"))
+ test = MUSB_TEST_FORCE_HOST;
+
+- if (!strncmp(buf, "fifo access", 11))
++ if (strstarts(buf, "fifo access"))
+ test = MUSB_TEST_FIFO_ACCESS;
+
+- if (!strncmp(buf, "force full-speed", 15))
++ if (strstarts(buf, "force full-speed"))
+ test = MUSB_TEST_FORCE_FS;
+
+- if (!strncmp(buf, "force high-speed", 15))
++ if (strstarts(buf, "force high-speed"))
+ test = MUSB_TEST_FORCE_HS;
+
+- if (!strncmp(buf, "test packet", 10)) {
++ if (strstarts(buf, "test packet")) {
+ test = MUSB_TEST_PACKET;
+ musb_load_testpacket(musb);
+ }
+
+- if (!strncmp(buf, "test K", 6))
++ if (strstarts(buf, "test K"))
+ test = MUSB_TEST_K;
+
+- if (!strncmp(buf, "test J", 6))
++ if (strstarts(buf, "test J"))
+ test = MUSB_TEST_J;
+
+- if (!strncmp(buf, "test SE0 NAK", 12))
++ if (strstarts(buf, "test SE0 NAK"))
+ test = MUSB_TEST_SE0_NAK;
+
+ musb_writeb(musb->mregs, MUSB_TESTMODE, test);
+--
+2.17.1
+
--- /dev/null
+From 3f295c54c0b88640a6535c79b358a968725622c0 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 1 Dec 2014 11:10:15 -0800
+Subject: usb: musb: Fix randconfig build issues for Kconfig options
+
+[ Upstream commit c0442479652b99b62dd1ffccb34231caff25751c ]
+
+Commit 82c02f58ba3a ("usb: musb: Allow multiple glue layers to be
+built in") enabled selecting multiple glue layers, which in turn
+exposed things more for randconfig builds. If NOP_USB_XCEIV is
+built-in and TUSB6010 is a loadable module, we will get:
+
+drivers/built-in.o: In function `tusb_remove':
+tusb6010.c:(.text+0x16a817): undefined reference to `usb_phy_generic_unregister'
+drivers/built-in.o: In function `tusb_probe':
+tusb6010.c:(.text+0x16b24e): undefined reference to `usb_phy_generic_register'
+make: *** [vmlinux] Error 1
+
+Let's fix this the same way as commit 70c1ff4b3c86 ("usb: musb:
+tusb-dma can't be built-in if tusb is not").
+
+And while at it, let's not allow selecting the glue layers except
+on platforms really using them unless COMPILE_TEST is specified:
+
+- TUSB6010 is in practise only used on omaps
+
+- DSPS is only used on TI platforms
+
+- UX500 is only used on STE platforms
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Reported-by: Jim Davis <jim.epost@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/Kconfig | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
+index dbc56eb5eee4..5ab24cd38f37 100644
+--- a/drivers/usb/musb/Kconfig
++++ b/drivers/usb/musb/Kconfig
+@@ -73,6 +73,8 @@ config USB_MUSB_DA8XX
+
+ config USB_MUSB_TUSB6010
+ tristate "TUSB6010"
++ depends on ARCH_OMAP2PLUS || COMPILE_TEST
++ depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
+
+ config USB_MUSB_OMAP2PLUS
+ tristate "OMAP2430 and onwards"
+@@ -86,6 +88,7 @@ config USB_MUSB_AM35X
+ config USB_MUSB_DSPS
+ tristate "TI DSPS platforms"
+ select USB_MUSB_AM335X_CHILD
++ depends on ARCH_OMAP2PLUS || COMPILE_TEST
+ depends on OF_IRQ
+
+ config USB_MUSB_BLACKFIN
+@@ -94,6 +97,7 @@ config USB_MUSB_BLACKFIN
+
+ config USB_MUSB_UX500
+ tristate "Ux500 platforms"
++ depends on ARCH_U8500 || COMPILE_TEST
+
+ config USB_MUSB_JZ4740
+ tristate "JZ4740"
+--
+2.17.1
+
--- /dev/null
+From 18958aa10bc94ead18884bba371c9489b6090246 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 16 Nov 2015 13:15:46 +0100
+Subject: USB: qcserial: Fix support for HP lt4112 LTE/HSPA+ Gobi 4G Modem
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 59536da34513c594af2a6fd35ba65ea45b6960a1 ]
+
+The DEVICE_HWI type was added under the faulty assumption that Huawei
+devices based on Qualcomm chipsets and firmware use the static USB
+interface numbering known from Gobi devices. But this model does
+not apply to Huawei devices like the HP branded lt4112 (Huawei me906e).
+Huawei firmwares will dynamically assign interface numbers. Functions
+are renumbered when the firmware is reconfigured.
+
+Fix by changing the DEVICE_HWI type to use a simplified version
+of Huawei's subclass + protocol scheme: Blacklisting known network
+interface combinations and assuming the rest are serial.
+
+Reported-and-tested-by: Muri Nicanor <muri+libqmi@immerda.ch>
+Tested-by: Martin Hauke <mardnh@gmx.de>
+Cc: <stable@vger.kernel.org>
+Fixes: e7181d005e84 ("USB: qcserial: Add support for HP lt4112 LTE/HSPA+ Gobi 4G Modem")
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/qcserial.c | 54 ++++++++++++++++++++++-------------
+ 1 file changed, 34 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index adc372411019..7e8014304b33 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -190,6 +190,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
+ __u8 ifnum;
+ int altsetting = -1;
+
++ /* we only support vendor specific functions */
++ if (intf->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
++ goto done;
++
+ nintf = serial->dev->actconfig->desc.bNumInterfaces;
+ dev_dbg(dev, "Num Interfaces = %d\n", nintf);
+ ifnum = intf->desc.bInterfaceNumber;
+@@ -309,29 +313,39 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
+ break;
+ case QCSERIAL_HWI:
+ /*
+- * Huawei layout:
+- * 0: AT-capable modem port
+- * 1: DM/DIAG
+- * 2: AT-capable modem port
+- * 3: CCID-compatible PCSC interface
+- * 4: QMI/net
+- * 5: NMEA
++ * Huawei devices map functions by subclass + protocol
++ * instead of interface numbers. The protocol identify
++ * a specific function, while the subclass indicate a
++ * specific firmware source
++ *
++ * This is a blacklist of functions known to be
++ * non-serial. The rest are assumed to be serial and
++ * will be handled by this driver
+ */
+- switch (ifnum) {
+- case 0:
+- case 2:
+- dev_dbg(dev, "Modem port found\n");
+- break;
+- case 1:
+- dev_dbg(dev, "DM/DIAG interface found\n");
+- break;
+- case 5:
+- dev_dbg(dev, "NMEA GPS interface found\n");
+- break;
+- default:
+- /* don't claim any unsupported interface */
++ switch (intf->desc.bInterfaceProtocol) {
++ /* QMI combined (qmi_wwan) */
++ case 0x07:
++ case 0x37:
++ case 0x67:
++ /* QMI data (qmi_wwan) */
++ case 0x08:
++ case 0x38:
++ case 0x68:
++ /* QMI control (qmi_wwan) */
++ case 0x09:
++ case 0x39:
++ case 0x69:
++ /* NCM like (huawei_cdc_ncm) */
++ case 0x16:
++ case 0x46:
++ case 0x76:
+ altsetting = -1;
+ break;
++ default:
++ dev_dbg(dev, "Huawei type serial port found (%02x/%02x/%02x)\n",
++ intf->desc.bInterfaceClass,
++ intf->desc.bInterfaceSubClass,
++ intf->desc.bInterfaceProtocol);
+ }
+ break;
+ default:
+--
+2.17.1
+
--- /dev/null
+From 73d5001a2e0a07a7883e7cd190f020d8667c5278 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 23 Nov 2015 13:09:50 +0100
+Subject: vfs: Make sendfile(2) killable even better
+
+[ Upstream commit c725bfce7968009756ed2836a8cd7ba4dc163011 ]
+
+Commit 296291cdd162 (mm: make sendfile(2) killable) fixed an issue where
+sendfile(2) was doing a lot of tiny writes into a filesystem and thus
+was unkillable for a long time. However sendfile(2) can be (mis)used to
+issue lots of writes into arbitrary file descriptor such as evenfd or
+similar special file descriptors which never hit the standard filesystem
+write path and thus are still unkillable. E.g. the following example
+from Dmitry burns CPU for ~16s on my test system without possibility to
+be killed:
+
+ int r1 = eventfd(0, 0);
+ int r2 = memfd_create("", 0);
+ unsigned long n = 1<<30;
+ fallocate(r2, 0, 0, n);
+ sendfile(r1, r2, 0, n);
+
+There are actually quite a few tests for pending signals in sendfile
+code however we data to write is always available none of them seems to
+trigger. So fix the problem by adding a test for pending signal into
+splice_from_pipe_next() also before the loop waiting for pipe buffers to
+be available. This should fix all the lockup issues with sendfile of the
+do-ton-of-tiny-writes nature.
+
+CC: stable@vger.kernel.org
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/splice.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/splice.c b/fs/splice.c
+index cf0cb768a1a7..852194d3ce4a 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -809,6 +809,13 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des
+ */
+ static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+ {
++ /*
++ * Check for signal early to make process killable when there are
++ * always buffers available
++ */
++ if (signal_pending(current))
++ return -ERESTARTSYS;
++
+ while (!pipe->nrbufs) {
+ if (!pipe->writers)
+ return 0;
+--
+2.17.1
+
--- /dev/null
+From c18cc84849578ce60a11dda85714527fc9b96c1b Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@marvell.com>
+Date: Thu, 20 Aug 2015 12:54:39 +0800
+Subject: x86/idle: Restore trace_cpu_idle to mwait_idle() calls
+
+[ Upstream commit e43d0189ac02415fe4487f79fc35e8f147e9ea0d ]
+
+Commit b253149b843f ("sched/idle/x86: Restore mwait_idle() to fix boot
+hangs, to improve power savings and to improve performance") restores
+mwait_idle(), but the trace_cpu_idle related calls are missing. This
+causes powertop on my old desktop powered by Intel Core2 E6550 to
+report zero wakeups and zero events.
+
+Add them back to restore the proper behaviour.
+
+Fixes: b253149b843f ("sched/idle/x86: Restore mwait_idle() to ...")
+Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
+Cc: <len.brown@intel.com>
+Cc: stable@vger.kernel.org # 4.1
+Link: http://lkml.kernel.org/r/1440046479-4262-1-git-send-email-jszhang@marvell.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/process.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index a388bb883128..54499d34cf55 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -430,6 +430,7 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c)
+ static void mwait_idle(void)
+ {
+ if (!current_set_polling_and_test()) {
++ trace_cpu_idle_rcuidle(1, smp_processor_id());
+ if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) {
+ smp_mb(); /* quirk */
+ clflush((void *)¤t_thread_info()->flags);
+@@ -441,6 +442,7 @@ static void mwait_idle(void)
+ __sti_mwait(0, 0);
+ else
+ local_irq_enable();
++ trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id());
+ } else {
+ local_irq_enable();
+ }
+--
+2.17.1
+
--- /dev/null
+From 10227eb72dce2b9d4733c64717c9727481d43cd7 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Wed, 4 Feb 2015 13:33:33 +0100
+Subject: x86/irq: Check for valid irq descriptor in
+ check_irq_vectors_for_cpu_disable()
+
+[ Upstream commit d97eb8966c91f2c9d05f0a22eb89ed5b76d966d1 ]
+
+When an interrupt is migrated away from a cpu it will stay
+in its vector_irq array until smp_irq_move_cleanup_interrupt
+succeeded. The cfg->move_in_progress flag is cleared already
+when the IPI was sent.
+
+When the interrupt is destroyed after migration its 'struct
+irq_desc' is freed and the vector_irq arrays are cleaned up.
+But since cfg->move_in_progress is already 0 the references
+at cpus before the last migration will not be cleared. So
+this would leave a reference to an already destroyed irq
+alive.
+
+When the cpu is taken down at this point, the
+check_irq_vectors_for_cpu_disable() function finds a valid irq
+number in the vector_irq array, but gets NULL for its
+descriptor and dereferences it, causing a kernel panic.
+
+This has been observed on real systems at shutdown. Add a
+check to check_irq_vectors_for_cpu_disable() for a valid
+'struct irq_desc' to prevent this issue.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Jiang Liu <jiang.liu@linux.intel.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Jan Beulich <JBeulich@suse.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Prarit Bhargava <prarit@redhat.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: alnovak@suse.com
+Cc: joro@8bytes.org
+Link: http://lkml.kernel.org/r/20150204132754.GA10078@suse.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/irq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index 37907756fc41..1d6e2946a3da 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -302,6 +302,9 @@ int check_irq_vectors_for_cpu_disable(void)
+ irq = __this_cpu_read(vector_irq[vector]);
+ if (irq >= 0) {
+ desc = irq_to_desc(irq);
++ if (!desc)
++ continue;
++
+ data = irq_desc_get_irq_data(desc);
+ cpumask_copy(&affinity_new, data->affinity);
+ cpu_clear(this_cpu, affinity_new);
+--
+2.17.1
+
--- /dev/null
+From dc782d9354311ae96821743df7cd9f2e4e85a5b6 Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Wed, 2 Sep 2015 09:45:58 -0600
+Subject: x86/ldt: Fix small LDT allocation for Xen
+
+[ Upstream commit f454b478861325f067fd58ba7ee9f1b5c4a9d6a0 ]
+
+While the following commit:
+
+ 37868fe113 ("x86/ldt: Make modify_ldt synchronous")
+
+added a nice comment explaining that Xen needs page-aligned
+whole page chunks for guest descriptor tables, it then
+nevertheless used kzalloc() on the small size path.
+
+As I'm unaware of guarantees for kmalloc(PAGE_SIZE, ) to return
+page-aligned memory blocks, I believe this needs to be switched
+back to __get_free_page() (or better get_zeroed_page()).
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/55E735D6020000780009F1E6@prv-mh.provo.novell.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/ldt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index 2bcc0525f1c1..6acc9dd91f36 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -58,7 +58,7 @@ static struct ldt_struct *alloc_ldt_struct(int size)
+ if (alloc_size > PAGE_SIZE)
+ new_ldt->entries = vzalloc(alloc_size);
+ else
+- new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL);
++ new_ldt->entries = (void *)get_zeroed_page(GFP_KERNEL);
+
+ if (!new_ldt->entries) {
+ kfree(new_ldt);
+@@ -95,7 +95,7 @@ static void free_ldt_struct(struct ldt_struct *ldt)
+ if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE)
+ vfree(ldt->entries);
+ else
+- kfree(ldt->entries);
++ free_page((unsigned long)ldt->entries);
+ kfree(ldt);
+ }
+
+--
+2.17.1
+
--- /dev/null
+From 1fef93985e76902e2f88f7b69a43eeb8e3b5950c Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Wed, 11 May 2016 12:27:15 -0400
+Subject: x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
+
+[ Upstream commit da77b67195de1c65bef4908fa29967c4d0af2da2 ]
+
+Commit b894157145e4 ("x86/PCI: Mark Broadwell-EP Home Agent & PCU as having
+non-compliant BARs") marked Home Agent 0 & PCU has having non-compliant
+BARs. Home Agent 1 also has non-compliant BARs.
+
+Mark Home Agent 1 as having non-compliant BARs so the PCI core doesn't
+touch them.
+
+The problem with these devices is documented in the Xeon v4 specification
+update:
+
+ BDF2 PCI BARs in the Home Agent Will Return Non-Zero Values
+ During Enumeration
+
+ Problem: During system initialization the Operating System may access
+ the standard PCI BARs (Base Address Registers). Due to
+ this erratum, accesses to the Home Agent BAR registers (Bus
+ 1; Device 18; Function 0,4; Offsets (0x14-0x24) will return
+ non-zero values.
+
+ Implication: The operating system may issue a warning. Intel has not
+ observed any functional failures due to this erratum.
+
+Link: http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
+Fixes: b894157145e4 ("x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs")
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Thomas Gleixner <tglx@linutronix.de>
+CC: Ingo Molnar <mingo@redhat.com>
+CC: "H. Peter Anvin" <hpa@zytor.com>
+CC: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/pci/fixup.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index f16af96c60a2..156fbb69031c 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -554,9 +554,16 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
+
++/*
++ * Broadwell EP Home Agent BARs erroneously return non-zero values when read.
++ *
++ * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
++ * entry BDF2.
++ */
+ static void pci_bdwep_bar(struct pci_dev *dev)
+ {
+ dev->non_compliant_bars = 1;
+ }
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
+--
+2.17.1
+
--- /dev/null
+From d0ae6c3b4547fe7a1a5f9478ec857bda27bcf4d6 Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Wed, 1 Aug 2018 13:45:11 +0200
+Subject: xfrm: Validate address prefix lengths in the xfrm selector.
+
+[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ]
+
+We don't validate the address prefix lengths in the xfrm
+selector we got from userspace. This can lead to undefined
+behaviour in the address matching functions if the prefix
+is too big for the given address family. Fix this by checking
+the prefixes and refuse SA/policy insertation when a prefix
+is invalid.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Air Icy <icytxw@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 4fe43d80c153..ca99638b5d5a 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -150,10 +150,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
+ err = -EINVAL;
+ switch (p->family) {
+ case AF_INET:
++ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
++ goto out;
++
+ break;
+
+ case AF_INET6:
+ #if IS_ENABLED(CONFIG_IPV6)
++ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
++ goto out;
++
+ break;
+ #else
+ err = -EAFNOSUPPORT;
+@@ -1285,10 +1291,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
+
+ switch (p->sel.family) {
+ case AF_INET:
++ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32)
++ return -EINVAL;
++
+ break;
+
+ case AF_INET6:
+ #if IS_ENABLED(CONFIG_IPV6)
++ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128)
++ return -EINVAL;
++
+ break;
+ #else
+ return -EAFNOSUPPORT;
+--
+2.17.1
+
--- /dev/null
+From a1978bb833d17d8c584dea2bcc6f231d5aaa2378 Mon Sep 17 00:00:00 2001
+From: Sean Tranchetti <stranche@codeaurora.org>
+Date: Wed, 19 Sep 2018 13:54:56 -0600
+Subject: xfrm: validate template mode
+
+[ Upstream commit 32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa ]
+
+XFRM mode parameters passed as part of the user templates
+in the IP_XFRM_POLICY are never properly validated. Passing
+values other than valid XFRM modes can cause stack-out-of-bounds
+reads to occur later in the XFRM processing:
+
+[ 140.535608] ================================================================
+[ 140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4
+[ 140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148
+[ 140.557369]
+[ 140.558927] Call trace:
+[ 140.558936] dump_backtrace+0x0/0x388
+[ 140.558940] show_stack+0x24/0x30
+[ 140.558946] __dump_stack+0x24/0x2c
+[ 140.558949] dump_stack+0x8c/0xd0
+[ 140.558956] print_address_description+0x74/0x234
+[ 140.558960] kasan_report+0x240/0x264
+[ 140.558963] __asan_report_load4_noabort+0x2c/0x38
+[ 140.558967] xfrm_state_find+0x17e4/0x1cc4
+[ 140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8
+[ 140.558975] xfrm_lookup+0x238/0x1444
+[ 140.558977] xfrm_lookup_route+0x48/0x11c
+[ 140.558984] ip_route_output_flow+0x88/0xc4
+[ 140.558991] raw_sendmsg+0xa74/0x266c
+[ 140.558996] inet_sendmsg+0x258/0x3b0
+[ 140.559002] sock_sendmsg+0xbc/0xec
+[ 140.559005] SyS_sendto+0x3a8/0x5a8
+[ 140.559008] el0_svc_naked+0x34/0x38
+[ 140.559009]
+[ 140.592245] page dumped because: kasan: bad access detected
+[ 140.597981] page_owner info is not active (free page?)
+[ 140.603267]
+[ 140.653503] ================================================================
+
+Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_user.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index ca99638b5d5a..017b1c91d58e 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1381,6 +1381,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ (ut[i].family != prev_family))
+ return -EINVAL;
+
++ if (ut[i].mode >= XFRM_MODE_MAX)
++ return -EINVAL;
++
+ prev_family = ut[i].family;
+
+ switch (ut[i].family) {
+--
+2.17.1
+
--- /dev/null
+From 037f3cb483634958bfbbf4b15b3b4ecdca1b3399 Mon Sep 17 00:00:00 2001
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Date: Fri, 31 Aug 2018 08:38:49 -0300
+Subject: xfrm6: call kfree_skb when skb is toobig
+
+[ Upstream commit 215ab0f021c9fea3c18b75e7d522400ee6a49990 ]
+
+After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching
+and reporting on xmit"), some too big skbs might be potentially passed down to
+__xfrm6_output, causing it to fail to transmit but not free the skb, causing a
+leak of skb, and consequentially a leak of dst references.
+
+After running pmtu.sh, that shows as failure to unregister devices in a namespace:
+
+[ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1
+
+The fix is to call kfree_skb in case of transmit failures.
+
+Fixes: dd767856a36e ("xfrm6: Don't call icmpv6_send on local error")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/xfrm6_output.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index ca3f29b98ae5..63724226042c 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -151,9 +151,11 @@ static int __xfrm6_output(struct sk_buff *skb)
+
+ if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
+ xfrm6_local_rxpmtu(skb, mtu);
++ kfree_skb(skb);
+ return -EMSGSIZE;
+ } else if (!skb->ignore_df && skb->len > mtu && skb->sk) {
+ xfrm_local_error(skb, mtu);
++ kfree_skb(skb);
+ return -EMSGSIZE;
+ }
+
+--
+2.17.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
