--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 2 Jan 2018 10:02:19 +0000
+Subject: afs: Fix missing error handling in afs_write_end()
+
+From: David Howells <dhowells@redhat.com>
+
+
+[ Upstream commit afae457d874860a7e299d334f59eede5f3ad4b47 ]
+
+afs_write_end() is missing page unlock and put if afs_fill_page() fails.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/write.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -282,7 +282,7 @@ int afs_write_end(struct file *file, str
+ ret = afs_fill_page(vnode, key, pos + copied,
+ len - copied, page);
+ if (ret < 0)
+- return ret;
++ goto out;
+ }
+ SetPageUptodate(page);
+ }
+@@ -290,10 +290,12 @@ int afs_write_end(struct file *file, str
+ set_page_dirty(page);
+ if (PageDirty(page))
+ _debug("dirtied");
++ ret = copied;
++
++out:
+ unlock_page(page);
+ put_page(page);
+-
+- return copied;
++ return ret;
+ }
+
+ /*
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Chunyan Zhang <zhang.lyra@gmail.com>
+Date: Fri, 1 Dec 2017 03:51:04 +0100
+Subject: ARM: 8731/1: Fix csum_partial_copy_from_user() stack mismatch
+
+From: Chunyan Zhang <zhang.lyra@gmail.com>
+
+
+[ Upstream commit 36b0cb84ee858f02c256d26f0cb4229c78e3399e ]
+
+An additional 'ip' will be pushed to the stack, for restoring the
+DACR later, if CONFIG_CPU_SW_DOMAIN_PAN defined.
+
+However, the fixup still get the err_ptr by add #8*4 to sp, which
+results in the fact that the code area pointed by the LR will be
+overwritten, or the kernel will crash if CONFIG_DEBUG_RODATA is enabled.
+
+This patch fixes the stack mismatch.
+
+Fixes: a5e090acbf54 ("ARM: software-based priviledged-no-access support")
+Signed-off-by: Lvqiang Huang <Lvqiang.Huang@spreadtrum.com>
+Signed-off-by: Chunyan Zhang <zhang.lyra@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/lib/csumpartialcopyuser.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/lib/csumpartialcopyuser.S
++++ b/arch/arm/lib/csumpartialcopyuser.S
+@@ -85,7 +85,11 @@
+ .pushsection .text.fixup,"ax"
+ .align 4
+ 9001: mov r4, #-EFAULT
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ ldr r5, [sp, #9*4] @ *err_ptr
++#else
+ ldr r5, [sp, #8*4] @ *err_ptr
++#endif
+ str r4, [r5]
+ ldmia sp, {r1, r2} @ retrieve dst, len
+ add r2, r2, r1
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 21 Dec 2017 22:35:19 +0100
+Subject: ARM: dts: ls1021a: fix incorrect clock references
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 506e8a912661c97b41adc8a286b875d01323ec45 ]
+
+dtc warns about two 'clocks' properties that have an extraneous '1'
+at the end:
+
+arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a
+arch/arm/boot/dts/ls1021a-qds.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2180000/mux@77/i2c@4/sgtl5000@2a:clocks[1])
+Property 'clocks', cell 1 is not a phandle reference in /soc/i2c@2190000/sgtl5000@a
+arch/arm/boot/dts/ls1021a-twr.dtb: Warning (clocks_property): Missing property '#clock-cells' in node /soc/interrupt-controller@1400000 or bad phandle (referred from /soc/i2c@2190000/sgtl5000@a:clocks[1])
+
+The clocks that get referenced here are fixed-rate, so they do not
+take any argument, and dtc interprets the next cell as a phandle, which
+is invalid.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/ls1021a-qds.dts | 2 +-
+ arch/arm/boot/dts/ls1021a-twr.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/ls1021a-qds.dts
++++ b/arch/arm/boot/dts/ls1021a-qds.dts
+@@ -215,7 +215,7 @@
+ reg = <0x2a>;
+ VDDA-supply = <®_3p3v>;
+ VDDIO-supply = <®_3p3v>;
+- clocks = <&sys_mclk 1>;
++ clocks = <&sys_mclk>;
+ };
+ };
+ };
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -187,7 +187,7 @@
+ reg = <0x0a>;
+ VDDA-supply = <®_3p3v>;
+ VDDIO-supply = <®_3p3v>;
+- clocks = <&sys_mclk 1>;
++ clocks = <&sys_mclk>;
+ };
+ };
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Bogdan Mirea <Bogdan-Stefan_Mirea@mentor.com>
+Date: Thu, 21 Dec 2017 17:18:59 +0200
+Subject: arm64: dts: renesas: ulcb: Remove renesas, no-ether-link property
+
+From: Bogdan Mirea <Bogdan-Stefan_Mirea@mentor.com>
+
+
+[ Upstream commit 7d2901f809c110bd9a261e879d59efe62e3bc758 ]
+
+The present change is a bug fix for AVB link iteratively up/down.
+
+Steps to reproduce:
+- start AVB TX stream (Using aplay via MSE),
+- disconnect+reconnect the eth cable,
+- after a reconnection the eth connection goes iteratively up/down
+ without user interaction,
+- this may heal after some seconds or even stay for minutes.
+
+As the documentation specifies, the "renesas,no-ether-link" option
+should be used when a board does not provide a proper AVB_LINK signal.
+There is no need for this option enabled on RCAR H3/M3 Salvator-X/XS
+and ULCB starter kits since the AVB_LINK is correctly handled by HW.
+
+Choosing to keep or remove the "renesas,no-ether-link" option will
+have impact on the code flow in the following ways:
+- keeping this option enabled may lead to unexpected behavior since
+ the RX & TX are enabled/disabled directly from adjust_link function
+ without any HW interrogation,
+- removing this option, the RX & TX will only be enabled/disabled after
+ HW interrogation. The HW check is made through the LMON pin in PSR
+ register which specifies AVB_LINK signal value (0 - at low level;
+ 1 - at high level).
+
+In conclusion, the present change is also a safety improvement because
+it removes the "renesas,no-ether-link" option leading to a proper way
+of detecting the link state based on HW interrogation and not on
+software heuristic.
+
+Fixes: dc36965a8905 ("arm64: dts: r8a7796: salvator-x: Enable EthernetAVB")
+Fixes: 6fa501c549aa ("arm64: dts: r8a7795: enable EthernetAVB on Salvator-X")
+Signed-off-by: Bogdan Mirea <Bogdan-Stefan_Mirea@mentor.com>
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/renesas/ulcb.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi
++++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi
+@@ -145,7 +145,6 @@
+ &avb {
+ pinctrl-0 = <&avb_pins>;
+ pinctrl-names = "default";
+- renesas,no-ether-link;
+ phy-handle = <&phy0>;
+ status = "okay";
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Abhijeet Kumar <abhijeet.kumar@intel.com>
+Date: Tue, 12 Dec 2017 00:40:25 +0530
+Subject: ASoC: nau8825: fix issue that pop noise when start capture
+
+From: Abhijeet Kumar <abhijeet.kumar@intel.com>
+
+
+[ Upstream commit d070f7c703ef26e3db613f24206823f916272fc6 ]
+
+In skylake platform, we hear a loud pop noise(0 dB) at start of
+audio capture power up sequence. This patch removes the pop noise
+from the recording by adding a delay before enabling ADC.
+
+Signed-off-by: Abhijeet Kumar <abhijeet.kumar@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/codecs/nau8825.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/nau8825.c
++++ b/sound/soc/codecs/nau8825.c
+@@ -905,6 +905,7 @@ static int nau8825_adc_event(struct snd_
+
+ switch (event) {
+ case SND_SOC_DAPM_POST_PMU:
++ msleep(125);
+ regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL,
+ NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC);
+ break;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Wed, 20 Dec 2017 06:11:59 +0000
+Subject: ASoC: rsnd: fixup ADG register mask
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+
+[ Upstream commit d5aa24825da5711f8cb829f873160ddf1a29b19c ]
+
+BRGCKR should use 0x80770000, instead of 0x80FF0000.
+
+R-Car Gen2 xxx_TIMSEL should use 0x0F1F,
+R-Car Gen3 xxx_TIMSEL should use 0x1F1F.
+Here, Gen3 doesn't support AVD, thus, both case can use 0x0F1F.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Reviewed-by: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/rcar/adg.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -216,7 +216,7 @@ int rsnd_adg_set_cmd_timsel_gen2(struct
+ NULL, &val, NULL);
+
+ val = val << shift;
+- mask = 0xffff << shift;
++ mask = 0x0f1f << shift;
+
+ rsnd_mod_bset(adg_mod, CMDOUT_TIMSEL, mask, val);
+
+@@ -244,7 +244,7 @@ int rsnd_adg_set_src_timesel_gen2(struct
+
+ in = in << shift;
+ out = out << shift;
+- mask = 0xffff << shift;
++ mask = 0x0f1f << shift;
+
+ switch (id / 2) {
+ case 0:
+@@ -374,7 +374,7 @@ int rsnd_adg_ssi_clk_try_start(struct rs
+ ckr = 0x80000000;
+ }
+
+- rsnd_mod_bset(adg_mod, BRGCKR, 0x80FF0000, adg->ckr | ckr);
++ rsnd_mod_bset(adg_mod, BRGCKR, 0x80770000, adg->ckr | ckr);
+ rsnd_mod_write(adg_mod, BRRA, adg->rbga);
+ rsnd_mod_write(adg_mod, BRRB, adg->rbgb);
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Ming Lei <ming.lei@redhat.com>
+Date: Thu, 30 Nov 2017 07:56:35 +0800
+Subject: block: drain queue before waiting for q_usage_counter becoming zero
+
+From: Ming Lei <ming.lei@redhat.com>
+
+
+[ Upstream commit 454be724f6f99cc7e7bbf15067128be9868186c6 ]
+
+Now we track legacy requests with .q_usage_counter in commit 055f6e18e08f
+("block: Make q_usage_counter also track legacy requests"), but that
+commit never runs and drains legacy queue before waiting for this counter
+becoming zero, then IO hang is caused in the test of pulling disk during IO.
+
+This patch fixes the issue by draining requests before waiting for
+q_usage_counter becoming zero, both Mauricio and chenxiang reported this
+issue, and observed that it can be fixed by this patch.
+
+Link: https://marc.info/?l=linux-block&m=151192424731797&w=2
+Fixes: 055f6e18e08f("block: Make q_usage_counter also track legacy requests")
+Cc: Wen Xiong <wenxiong@us.ibm.com>
+Tested-by: "chenxiang (M)" <chenxiang66@hisilicon.com>
+Tested-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-core.c | 9 +++++++--
+ block/blk-mq.c | 2 ++
+ block/blk.h | 2 ++
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -531,6 +531,13 @@ static void __blk_drain_queue(struct req
+ }
+ }
+
++void blk_drain_queue(struct request_queue *q)
++{
++ spin_lock_irq(q->queue_lock);
++ __blk_drain_queue(q, true);
++ spin_unlock_irq(q->queue_lock);
++}
++
+ /**
+ * blk_queue_bypass_start - enter queue bypass mode
+ * @q: queue of interest
+@@ -655,8 +662,6 @@ void blk_cleanup_queue(struct request_qu
+ */
+ blk_freeze_queue(q);
+ spin_lock_irq(lock);
+- if (!q->mq_ops)
+- __blk_drain_queue(q, true);
+ queue_flag_set(QUEUE_FLAG_DEAD, q);
+ spin_unlock_irq(lock);
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -159,6 +159,8 @@ void blk_freeze_queue(struct request_que
+ * exported to drivers as the only user for unfreeze is blk_mq.
+ */
+ blk_freeze_queue_start(q);
++ if (!q->mq_ops)
++ blk_drain_queue(q);
+ blk_mq_freeze_queue_wait(q);
+ }
+
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -362,4 +362,6 @@ static inline void blk_queue_bounce(stru
+ }
+ #endif /* CONFIG_BOUNCE */
+
++extern void blk_drain_queue(struct request_queue *q);
++
+ #endif /* BLK_INTERNAL_H */
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
+Date: Fri, 22 Dec 2017 13:01:39 -0200
+Subject: bnx2x: Improve reliability in case of nested PCI errors
+
+From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
+
+
+[ Upstream commit f7084059a9cb9e56a186e1677b1dcffd76c2cd24 ]
+
+While in recovery process of PCI error (called EEH on PowerPC arch),
+another PCI transaction could be corrupted causing a situation of
+nested PCI errors. Also, this scenario could be reproduced with
+error injection mechanisms (for debug purposes).
+
+We observe that in case of nested PCI errors, bnx2x might attempt to
+initialize its shmem and cause a kernel crash due to bad addresses
+read from MCP. Multiple different stack traces were observed depending
+on the point the second PCI error happens.
+
+This patch avoids the crashes by:
+
+ * failing PCI recovery in case of nested errors (since multiple
+ PCI errors in a row are not expected to lead to a functional
+ adapter anyway), and by,
+
+ * preventing access to adapter FW when MCP is failed (we mark it as
+ failed when shmem cannot get initialized properly).
+
+Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+Acked-by: Shahed Shaikh <Shahed.Shaikh@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 4 ++--
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 +++++++++++++-
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
+
+ del_timer_sync(&bp->timer);
+
+- if (IS_PF(bp)) {
++ if (IS_PF(bp) && !BP_NOMCP(bp)) {
+ /* Set ALWAYS_ALIVE bit in shmem */
+ bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
+ bnx2x_drv_pulse(bp);
+@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
+ bp->cnic_loaded = false;
+
+ /* Clear driver version indication in shmem */
+- if (IS_PF(bp))
++ if (IS_PF(bp) && !BP_NOMCP(bp))
+ bnx2x_update_mng_version(bp);
+
+ /* Check if there are pending parity attentions. If there are - set
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x
+
+ do {
+ bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
++
++ /* If we read all 0xFFs, means we are in PCI error state and
++ * should bail out to avoid crashes on adapter's FW reads.
++ */
++ if (bp->common.shmem_base == 0xFFFFFFFF) {
++ bp->flags |= NO_MCP_FLAG;
++ return -ENODEV;
++ }
++
+ if (bp->common.shmem_base) {
+ val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
+ if (val & SHR_MEM_VALIDITY_MB)
+@@ -14315,7 +14324,10 @@ static pci_ers_result_t bnx2x_io_slot_re
+ BNX2X_ERR("IO slot reset --> driver unload\n");
+
+ /* MCP should have been reset; Need to wait for validity */
+- bnx2x_init_shmem(bp);
++ if (bnx2x_init_shmem(bp)) {
++ rtnl_unlock();
++ return PCI_ERS_RESULT_DISCONNECT;
++ }
+
+ if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
+ u32 v;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Sunil Challa <sunilkumar.challa@broadcom.com>
+Date: Thu, 4 Jan 2018 18:46:54 -0500
+Subject: bnxt_en: Fix population of flow_type in bnxt_hwrm_cfa_flow_alloc()
+
+From: Sunil Challa <sunilkumar.challa@broadcom.com>
+
+
+[ Upstream commit 7deea450eb912f269d999de62c8ab922d1461748 ]
+
+flow_type in HWRM_FLOW_ALLOC is not being populated correctly due to
+incorrect passing of pointer and size of l3_mask argument of is_wildcard().
+Fixed this.
+
+Fixes: db1d36a27324 ("bnxt_en: add TC flower offload flow_alloc/free FW cmds")
+Signed-off-by: Sunil Challa <sunilkumar.challa@broadcom.com>
+Reviewed-by: Sathya Perla <sathya.perla@broadcom.com>
+Reviewed-by: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+@@ -327,7 +327,7 @@ static int bnxt_hwrm_cfa_flow_alloc(stru
+ }
+
+ /* If all IP and L4 fields are wildcarded then this is an L2 flow */
+- if (is_wildcard(&l3_mask, sizeof(l3_mask)) &&
++ if (is_wildcard(l3_mask, sizeof(*l3_mask)) &&
+ is_wildcard(&flow->l4_mask, sizeof(flow->l4_mask))) {
+ flow_flags |= CFA_FLOW_ALLOC_REQ_FLAGS_FLOWTYPE_L2;
+ } else {
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+Date: Thu, 4 Jan 2018 18:46:55 -0500
+Subject: bnxt_en: Fix the 'Invalid VF' id check in bnxt_vf_ndo_prep routine.
+
+From: Venkat Duvvuru <venkatkumar.duvvuru@broadcom.com>
+
+
+[ Upstream commit 78f300049335ae81a5cc6b4b232481dc5e1f9d41 ]
+
+In bnxt_vf_ndo_prep (which is called by bnxt_get_vf_config ndo), there is a
+check for "Invalid VF id". Currently, the check is done against max_vfs.
+However, the user doesn't always create max_vfs. So, the check should be
+against the created number of VFs. The number of bnxt_vf_info structures
+that are allocated in bnxt_alloc_vf_resources routine is the "number of
+requested VFs". So, if an "invalid VF id" falls between the requested
+number of VFs and the max_vfs, the driver will be dereferencing an invalid
+pointer.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Venkat Devvuru <venkatkumar.duvvuru@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -70,7 +70,7 @@ static int bnxt_vf_ndo_prep(struct bnxt
+ netdev_err(bp->dev, "vf ndo called though sriov is disabled\n");
+ return -EINVAL;
+ }
+- if (vf_id >= bp->pf.max_vfs) {
++ if (vf_id >= bp->pf.active_vfs) {
+ netdev_err(bp->dev, "Invalid VF id %d\n", vf_id);
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Thu, 4 Jan 2018 20:02:09 -0800
+Subject: bpf: sockmap missing NULL psock check
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+
+[ Upstream commit 5731a879d03bdaa00265f8ebc32dfd0e65d25276 ]
+
+Add psock NULL check to handle a racing sock event that can get the
+sk_callback_lock before this case but after xchg happens causing the
+refcnt to hit zero and sock user data (psock) to be null and queued
+for garbage collection.
+
+Also add a comment in the code because this is a bit subtle and
+not obvious in my opinion.
+
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/sockmap.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/kernel/bpf/sockmap.c
++++ b/kernel/bpf/sockmap.c
+@@ -588,8 +588,15 @@ static void sock_map_free(struct bpf_map
+
+ write_lock_bh(&sock->sk_callback_lock);
+ psock = smap_psock_sk(sock);
+- smap_list_remove(psock, &stab->sock_map[i]);
+- smap_release_sock(psock, sock);
++ /* This check handles a racing sock event that can get the
++ * sk_callback_lock before this case but after xchg happens
++ * causing the refcnt to hit zero and sock user data (psock)
++ * to be null and queued for garbage collection.
++ */
++ if (likely(psock)) {
++ smap_list_remove(psock, &stab->sock_map[i]);
++ smap_release_sock(psock, sock);
++ }
+ write_unlock_bh(&sock->sk_callback_lock);
+ }
+ rcu_read_unlock();
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Wed, 13 Dec 2017 13:50:07 +0200
+Subject: btrfs: Fix flush bio leak
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+
+[ Upstream commit beed9263f4000c48a5c48912f26576f6fa091181 ]
+
+Commit e0ae99941423 ("btrfs: preallocate device flush bio") reworked
+the way the flush bio is allocated and used. Concretely it allocates
+the bio in __alloc_device and then re-uses it multiple times with a
+very simple endio routine that just calls complete() without consuming
+a reference. Allocated bios by default come with a ref count of 1,
+which is then consumed by the endio routine (or not, in which case they
+should be bio_put by the caller). The way the impleementation works now
+is that the flush bio has a refcount of 2 and we only ever bio_put it
+once, leaving it to hang indefinitely. Fix this by removing the extra
+bio_get in __alloc_device.
+
+Fixes: e0ae99941423 ("btrfs: preallocate device flush bio")
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/volumes.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -236,7 +236,6 @@ static struct btrfs_device *__alloc_devi
+ kfree(dev);
+ return ERR_PTR(-ENOMEM);
+ }
+- bio_get(dev->flush_bio);
+
+ INIT_LIST_HEAD(&dev->dev_list);
+ INIT_LIST_HEAD(&dev->dev_alloc_list);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Luu An Phu <phu.luuan@nxp.com>
+Date: Tue, 2 Jan 2018 10:44:18 +0700
+Subject: can: flex_can: Correct the checking for frame length in flexcan_start_xmit()
+
+From: Luu An Phu <phu.luuan@nxp.com>
+
+
+[ Upstream commit 13454c14550065fcc1705d6bd4ee6d40e057099f ]
+
+The flexcan_start_xmit() function compares the frame length with data
+register length to write frame content into data[0] and data[1]
+register. Data register length is 4 bytes and frame maximum length is 8
+bytes.
+
+Fix the check that compares frame length with 3. Because the register
+length is 4.
+
+Signed-off-by: Luu An Phu <phu.luuan@nxp.com>
+Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/flexcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -526,7 +526,7 @@ static int flexcan_start_xmit(struct sk_
+ data = be32_to_cpup((__be32 *)&cf->data[0]);
+ flexcan_write(data, &priv->tx_mb->data[0]);
+ }
+- if (cf->can_dlc > 3) {
++ if (cf->can_dlc > 4) {
+ data = be32_to_cpup((__be32 *)&cf->data[4]);
+ flexcan_write(data, &priv->tx_mb->data[1]);
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Prateek Sood <prsood@codeaurora.org>
+Date: Tue, 19 Dec 2017 12:56:57 +0530
+Subject: cgroup: Fix deadlock in cpu hotplug path
+
+From: Prateek Sood <prsood@codeaurora.org>
+
+
+[ Upstream commit 116d2f7496c51b2e02e8e4ecdd2bdf5fb9d5a641 ]
+
+Deadlock during cgroup migration from cpu hotplug path when a task T is
+being moved from source to destination cgroup.
+
+kworker/0:0
+cpuset_hotplug_workfn()
+ cpuset_hotplug_update_tasks()
+ hotplug_update_tasks_legacy()
+ remove_tasks_in_empty_cpuset()
+ cgroup_transfer_tasks() // stuck in iterator loop
+ cgroup_migrate()
+ cgroup_migrate_add_task()
+
+In cgroup_migrate_add_task() it checks for PF_EXITING flag of task T.
+Task T will not migrate to destination cgroup. css_task_iter_start()
+will keep pointing to task T in loop waiting for task T cg_list node
+to be removed.
+
+Task T
+do_exit()
+ exit_signals() // sets PF_EXITING
+ exit_task_namespaces()
+ switch_task_namespaces()
+ free_nsproxy()
+ put_mnt_ns()
+ drop_collected_mounts()
+ namespace_unlock()
+ synchronize_rcu()
+ _synchronize_rcu_expedited()
+ schedule_work() // on cpu0 low priority worker pool
+ wait_event() // waiting for work item to execute
+
+Task T inserted a work item in the worklist of cpu0 low priority
+worker pool. It is waiting for expedited grace period work item
+to execute. This work item will only be executed once kworker/0:0
+complete execution of cpuset_hotplug_workfn().
+
+kworker/0:0 ==> Task T ==>kworker/0:0
+
+In case of PF_EXITING task being migrated from source to destination
+cgroup, migrate next available task in source cgroup.
+
+Signed-off-by: Prateek Sood <prsood@codeaurora.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/cgroup/cgroup-v1.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -123,7 +123,11 @@ int cgroup_transfer_tasks(struct cgroup
+ */
+ do {
+ css_task_iter_start(&from->self, 0, &it);
+- task = css_task_iter_next(&it);
++
++ do {
++ task = css_task_iter_next(&it);
++ } while (task && (task->flags & PF_EXITING));
++
+ if (task)
+ get_task_struct(task);
+ css_task_iter_end(&it);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Tue, 19 Dec 2017 10:27:24 +0000
+Subject: crypto: af_alg - Fix race around ctx->rcvused by making it atomic_t
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+
+[ Upstream commit af955bf15d2c27496b0269b1f05c26f758c68314 ]
+
+This variable was increased and decreased without any protection.
+Result was an occasional misscount and negative wrap around resulting
+in false resource allocation failures.
+
+Fixes: 7d2c3f54e6f6 ("crypto: af_alg - remove locking in async callback")
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/af_alg.c | 4 ++--
+ crypto/algif_aead.c | 2 +-
+ crypto/algif_skcipher.c | 2 +-
+ include/crypto/if_alg.h | 5 +++--
+ 4 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -693,7 +693,7 @@ void af_alg_free_areq_sgls(struct af_alg
+ unsigned int i;
+
+ list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) {
+- ctx->rcvused -= rsgl->sg_num_bytes;
++ atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused);
+ af_alg_free_sg(&rsgl->sgl);
+ list_del(&rsgl->list);
+ if (rsgl != &areq->first_rsgl)
+@@ -1192,7 +1192,7 @@ int af_alg_get_rsgl(struct sock *sk, str
+
+ areq->last_rsgl = rsgl;
+ len += err;
+- ctx->rcvused += err;
++ atomic_add(err, &ctx->rcvused);
+ rsgl->sg_num_bytes = err;
+ iov_iter_advance(&msg->msg_iter, err);
+ }
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void
+ INIT_LIST_HEAD(&ctx->tsgl_list);
+ ctx->len = len;
+ ctx->used = 0;
+- ctx->rcvused = 0;
++ atomic_set(&ctx->rcvused, 0);
+ ctx->more = 0;
+ ctx->merge = 0;
+ ctx->enc = 0;
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -391,7 +391,7 @@ static int skcipher_accept_parent_nokey(
+ INIT_LIST_HEAD(&ctx->tsgl_list);
+ ctx->len = len;
+ ctx->used = 0;
+- ctx->rcvused = 0;
++ atomic_set(&ctx->rcvused, 0);
+ ctx->more = 0;
+ ctx->merge = 0;
+ ctx->enc = 0;
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -18,6 +18,7 @@
+ #include <linux/if_alg.h>
+ #include <linux/scatterlist.h>
+ #include <linux/types.h>
++#include <linux/atomic.h>
+ #include <net/sock.h>
+
+ #include <crypto/aead.h>
+@@ -155,7 +156,7 @@ struct af_alg_ctx {
+ struct af_alg_completion completion;
+
+ size_t used;
+- size_t rcvused;
++ atomic_t rcvused;
+
+ bool more;
+ bool merge;
+@@ -228,7 +229,7 @@ static inline int af_alg_rcvbuf(struct s
+ struct af_alg_ctx *ctx = ask->private;
+
+ return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) -
+- ctx->rcvused, 0);
++ atomic_read(&ctx->rcvused), 0);
+ }
+
+ /**
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: "Antoine Ténart" <antoine.tenart@free-electrons.com>
+Date: Mon, 11 Dec 2017 12:10:57 +0100
+Subject: crypto: inside-secure - fix request allocations in invalidation path
+
+From: "Antoine Ténart" <antoine.tenart@free-electrons.com>
+
+
+[ Upstream commit 7cad2fabd5691dbb17762877d4e7f236fe4bc181 ]
+
+This patch makes use of the SKCIPHER_REQUEST_ON_STACK and
+AHASH_REQUEST_ON_STACK helpers to allocate enough memory to contain both
+the crypto request structures and their embedded context (__ctx).
+
+Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")
+Suggested-by: Ofer Heifetz <oferh@marvell.com>
+Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel_cipher.c | 16 ++++++++--------
+ drivers/crypto/inside-secure/safexcel_hash.c | 14 +++++++-------
+ 2 files changed, 15 insertions(+), 15 deletions(-)
+
+--- a/drivers/crypto/inside-secure/safexcel_cipher.c
++++ b/drivers/crypto/inside-secure/safexcel_cipher.c
+@@ -422,25 +422,25 @@ static int safexcel_cipher_exit_inv(stru
+ {
+ struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
+ struct safexcel_crypto_priv *priv = ctx->priv;
+- struct skcipher_request req;
+- struct safexcel_cipher_req *sreq = skcipher_request_ctx(&req);
++ SKCIPHER_REQUEST_ON_STACK(req, __crypto_skcipher_cast(tfm));
++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
+ struct safexcel_inv_result result = {};
+ int ring = ctx->base.ring;
+
+- memset(&req, 0, sizeof(struct skcipher_request));
++ memset(req, 0, sizeof(struct skcipher_request));
+
+ /* create invalidation request */
+ init_completion(&result.completion);
+- skcipher_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+- safexcel_inv_complete, &result);
++ skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
++ safexcel_inv_complete, &result);
+
+- skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm));
+- ctx = crypto_tfm_ctx(req.base.tfm);
++ skcipher_request_set_tfm(req, __crypto_skcipher_cast(tfm));
++ ctx = crypto_tfm_ctx(req->base.tfm);
+ ctx->base.exit_inv = true;
+ sreq->needs_inv = true;
+
+ spin_lock_bh(&priv->ring[ring].queue_lock);
+- crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
++ crypto_enqueue_request(&priv->ring[ring].queue, &req->base);
+ spin_unlock_bh(&priv->ring[ring].queue_lock);
+
+ if (!priv->ring[ring].need_dequeue)
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -470,25 +470,25 @@ static int safexcel_ahash_exit_inv(struc
+ {
+ struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm);
+ struct safexcel_crypto_priv *priv = ctx->priv;
+- struct ahash_request req;
+- struct safexcel_ahash_req *rctx = ahash_request_ctx(&req);
++ AHASH_REQUEST_ON_STACK(req, __crypto_ahash_cast(tfm));
++ struct safexcel_ahash_req *rctx = ahash_request_ctx(req);
+ struct safexcel_inv_result result = {};
+ int ring = ctx->base.ring;
+
+- memset(&req, 0, sizeof(struct ahash_request));
++ memset(req, 0, sizeof(struct ahash_request));
+
+ /* create invalidation request */
+ init_completion(&result.completion);
+- ahash_request_set_callback(&req, CRYPTO_TFM_REQ_MAY_BACKLOG,
++ ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ safexcel_inv_complete, &result);
+
+- ahash_request_set_tfm(&req, __crypto_ahash_cast(tfm));
+- ctx = crypto_tfm_ctx(req.base.tfm);
++ ahash_request_set_tfm(req, __crypto_ahash_cast(tfm));
++ ctx = crypto_tfm_ctx(req->base.tfm);
+ ctx->base.exit_inv = true;
+ rctx->needs_inv = true;
+
+ spin_lock_bh(&priv->ring[ring].queue_lock);
+- crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
++ crypto_enqueue_request(&priv->ring[ring].queue, &req->base);
+ spin_unlock_bh(&priv->ring[ring].queue_lock);
+
+ if (!priv->ring[ring].need_dequeue)
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: "Antoine Ténart" <antoine.tenart@free-electrons.com>
+Date: Mon, 11 Dec 2017 12:10:56 +0100
+Subject: crypto: inside-secure - free requests even if their handling failed
+
+From: "Antoine Ténart" <antoine.tenart@free-electrons.com>
+
+
+[ Upstream commit 0a02dcca126280595950f3ea809f77c9cb0a235c ]
+
+This patch frees the request private data even if its handling failed,
+as it would never be freed otherwise.
+
+Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")
+Suggested-by: Ofer Heifetz <oferh@marvell.com>
+Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -607,6 +607,7 @@ static inline void safexcel_handle_resul
+ ndesc = ctx->handle_result(priv, ring, sreq->req,
+ &should_complete, &ret);
+ if (ndesc < 0) {
++ kfree(sreq);
+ dev_err(priv->dev, "failed to handle result (%d)", ndesc);
+ return;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Ofer Heifetz <oferh@marvell.com>
+Date: Mon, 11 Dec 2017 12:10:55 +0100
+Subject: crypto: inside-secure - per request invalidation
+
+From: Ofer Heifetz <oferh@marvell.com>
+
+
+[ Upstream commit 1eb7b40386c97f6c4d1c62931bf306f4535a4bd6 ]
+
+When an invalidation request is needed we currently override the context
+.send and .handle_result helpers. This is wrong as under high load other
+requests can already be queued and overriding the context helpers will
+make them execute the wrong .send and .handle_result functions.
+
+This commit fixes this by adding a needs_inv flag in the request to
+choose the action to perform when sending requests or handling their
+results. This flag will be set when needed (i.e. when the context flag
+will be set).
+
+Fixes: 1b44c5a60c13 ("crypto: inside-secure - add SafeXcel EIP197 crypto engine driver")
+Signed-off-by: Ofer Heifetz <oferh@marvell.com>
+[Antoine: commit message, and removed non related changes from the
+original commit]
+Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/inside-secure/safexcel_cipher.c | 71 ++++++++++++++++++++-----
+ drivers/crypto/inside-secure/safexcel_hash.c | 67 ++++++++++++++++++-----
+ 2 files changed, 111 insertions(+), 27 deletions(-)
+
+--- a/drivers/crypto/inside-secure/safexcel_cipher.c
++++ b/drivers/crypto/inside-secure/safexcel_cipher.c
+@@ -14,6 +14,7 @@
+
+ #include <crypto/aes.h>
+ #include <crypto/skcipher.h>
++#include <crypto/internal/skcipher.h>
+
+ #include "safexcel.h"
+
+@@ -33,6 +34,10 @@ struct safexcel_cipher_ctx {
+ unsigned int key_len;
+ };
+
++struct safexcel_cipher_req {
++ bool needs_inv;
++};
++
+ static void safexcel_cipher_token(struct safexcel_cipher_ctx *ctx,
+ struct crypto_async_request *async,
+ struct safexcel_command_desc *cdesc,
+@@ -126,9 +131,9 @@ static int safexcel_context_control(stru
+ return 0;
+ }
+
+-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
+- struct crypto_async_request *async,
+- bool *should_complete, int *ret)
++static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring,
++ struct crypto_async_request *async,
++ bool *should_complete, int *ret)
+ {
+ struct skcipher_request *req = skcipher_request_cast(async);
+ struct safexcel_result_desc *rdesc;
+@@ -265,7 +270,6 @@ static int safexcel_aes_send(struct cryp
+ spin_unlock_bh(&priv->ring[ring].egress_lock);
+
+ request->req = &req->base;
+- ctx->base.handle_result = safexcel_handle_result;
+
+ *commands = n_cdesc;
+ *results = n_rdesc;
+@@ -341,8 +345,6 @@ static int safexcel_handle_inv_result(st
+
+ ring = safexcel_select_ring(priv);
+ ctx->base.ring = ring;
+- ctx->base.needs_inv = false;
+- ctx->base.send = safexcel_aes_send;
+
+ spin_lock_bh(&priv->ring[ring].queue_lock);
+ enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async);
+@@ -359,6 +361,26 @@ static int safexcel_handle_inv_result(st
+ return ndesc;
+ }
+
++static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
++ struct crypto_async_request *async,
++ bool *should_complete, int *ret)
++{
++ struct skcipher_request *req = skcipher_request_cast(async);
++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
++ int err;
++
++ if (sreq->needs_inv) {
++ sreq->needs_inv = false;
++ err = safexcel_handle_inv_result(priv, ring, async,
++ should_complete, ret);
++ } else {
++ err = safexcel_handle_req_result(priv, ring, async,
++ should_complete, ret);
++ }
++
++ return err;
++}
++
+ static int safexcel_cipher_send_inv(struct crypto_async_request *async,
+ int ring, struct safexcel_request *request,
+ int *commands, int *results)
+@@ -368,8 +390,6 @@ static int safexcel_cipher_send_inv(stru
+ struct safexcel_crypto_priv *priv = ctx->priv;
+ int ret;
+
+- ctx->base.handle_result = safexcel_handle_inv_result;
+-
+ ret = safexcel_invalidate_cache(async, &ctx->base, priv,
+ ctx->base.ctxr_dma, ring, request);
+ if (unlikely(ret))
+@@ -381,11 +401,29 @@ static int safexcel_cipher_send_inv(stru
+ return 0;
+ }
+
++static int safexcel_send(struct crypto_async_request *async,
++ int ring, struct safexcel_request *request,
++ int *commands, int *results)
++{
++ struct skcipher_request *req = skcipher_request_cast(async);
++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
++ int ret;
++
++ if (sreq->needs_inv)
++ ret = safexcel_cipher_send_inv(async, ring, request,
++ commands, results);
++ else
++ ret = safexcel_aes_send(async, ring, request,
++ commands, results);
++ return ret;
++}
++
+ static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm)
+ {
+ struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(tfm);
+ struct safexcel_crypto_priv *priv = ctx->priv;
+ struct skcipher_request req;
++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(&req);
+ struct safexcel_inv_result result = {};
+ int ring = ctx->base.ring;
+
+@@ -399,7 +437,7 @@ static int safexcel_cipher_exit_inv(stru
+ skcipher_request_set_tfm(&req, __crypto_skcipher_cast(tfm));
+ ctx = crypto_tfm_ctx(req.base.tfm);
+ ctx->base.exit_inv = true;
+- ctx->base.send = safexcel_cipher_send_inv;
++ sreq->needs_inv = true;
+
+ spin_lock_bh(&priv->ring[ring].queue_lock);
+ crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
+@@ -424,19 +462,21 @@ static int safexcel_aes(struct skcipher_
+ enum safexcel_cipher_direction dir, u32 mode)
+ {
+ struct safexcel_cipher_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
++ struct safexcel_cipher_req *sreq = skcipher_request_ctx(req);
+ struct safexcel_crypto_priv *priv = ctx->priv;
+ int ret, ring;
+
++ sreq->needs_inv = false;
+ ctx->direction = dir;
+ ctx->mode = mode;
+
+ if (ctx->base.ctxr) {
+- if (ctx->base.needs_inv)
+- ctx->base.send = safexcel_cipher_send_inv;
++ if (ctx->base.needs_inv) {
++ sreq->needs_inv = true;
++ ctx->base.needs_inv = false;
++ }
+ } else {
+ ctx->base.ring = safexcel_select_ring(priv);
+- ctx->base.send = safexcel_aes_send;
+-
+ ctx->base.ctxr = dma_pool_zalloc(priv->context_pool,
+ EIP197_GFP_FLAGS(req->base),
+ &ctx->base.ctxr_dma);
+@@ -476,6 +516,11 @@ static int safexcel_skcipher_cra_init(st
+ alg.skcipher.base);
+
+ ctx->priv = tmpl->priv;
++ ctx->base.send = safexcel_send;
++ ctx->base.handle_result = safexcel_handle_result;
++
++ crypto_skcipher_set_reqsize(__crypto_skcipher_cast(tfm),
++ sizeof(struct safexcel_cipher_req));
+
+ return 0;
+ }
+--- a/drivers/crypto/inside-secure/safexcel_hash.c
++++ b/drivers/crypto/inside-secure/safexcel_hash.c
+@@ -32,6 +32,7 @@ struct safexcel_ahash_req {
+ bool last_req;
+ bool finish;
+ bool hmac;
++ bool needs_inv;
+
+ int nents;
+
+@@ -121,9 +122,9 @@ static void safexcel_context_control(str
+ }
+ }
+
+-static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
+- struct crypto_async_request *async,
+- bool *should_complete, int *ret)
++static int safexcel_handle_req_result(struct safexcel_crypto_priv *priv, int ring,
++ struct crypto_async_request *async,
++ bool *should_complete, int *ret)
+ {
+ struct safexcel_result_desc *rdesc;
+ struct ahash_request *areq = ahash_request_cast(async);
+@@ -169,9 +170,9 @@ static int safexcel_handle_result(struct
+ return 1;
+ }
+
+-static int safexcel_ahash_send(struct crypto_async_request *async, int ring,
+- struct safexcel_request *request, int *commands,
+- int *results)
++static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring,
++ struct safexcel_request *request,
++ int *commands, int *results)
+ {
+ struct ahash_request *areq = ahash_request_cast(async);
+ struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq);
+@@ -310,7 +311,6 @@ send_command:
+
+ req->processed += len;
+ request->req = &areq->base;
+- ctx->base.handle_result = safexcel_handle_result;
+
+ *commands = n_cdesc;
+ *results = 1;
+@@ -394,8 +394,6 @@ static int safexcel_handle_inv_result(st
+
+ ring = safexcel_select_ring(priv);
+ ctx->base.ring = ring;
+- ctx->base.needs_inv = false;
+- ctx->base.send = safexcel_ahash_send;
+
+ spin_lock_bh(&priv->ring[ring].queue_lock);
+ enq_ret = crypto_enqueue_request(&priv->ring[ring].queue, async);
+@@ -412,6 +410,26 @@ static int safexcel_handle_inv_result(st
+ return 1;
+ }
+
++static int safexcel_handle_result(struct safexcel_crypto_priv *priv, int ring,
++ struct crypto_async_request *async,
++ bool *should_complete, int *ret)
++{
++ struct ahash_request *areq = ahash_request_cast(async);
++ struct safexcel_ahash_req *req = ahash_request_ctx(areq);
++ int err;
++
++ if (req->needs_inv) {
++ req->needs_inv = false;
++ err = safexcel_handle_inv_result(priv, ring, async,
++ should_complete, ret);
++ } else {
++ err = safexcel_handle_req_result(priv, ring, async,
++ should_complete, ret);
++ }
++
++ return err;
++}
++
+ static int safexcel_ahash_send_inv(struct crypto_async_request *async,
+ int ring, struct safexcel_request *request,
+ int *commands, int *results)
+@@ -420,7 +438,6 @@ static int safexcel_ahash_send_inv(struc
+ struct safexcel_ahash_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(areq));
+ int ret;
+
+- ctx->base.handle_result = safexcel_handle_inv_result;
+ ret = safexcel_invalidate_cache(async, &ctx->base, ctx->priv,
+ ctx->base.ctxr_dma, ring, request);
+ if (unlikely(ret))
+@@ -432,11 +449,29 @@ static int safexcel_ahash_send_inv(struc
+ return 0;
+ }
+
++static int safexcel_ahash_send(struct crypto_async_request *async,
++ int ring, struct safexcel_request *request,
++ int *commands, int *results)
++{
++ struct ahash_request *areq = ahash_request_cast(async);
++ struct safexcel_ahash_req *req = ahash_request_ctx(areq);
++ int ret;
++
++ if (req->needs_inv)
++ ret = safexcel_ahash_send_inv(async, ring, request,
++ commands, results);
++ else
++ ret = safexcel_ahash_send_req(async, ring, request,
++ commands, results);
++ return ret;
++}
++
+ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm)
+ {
+ struct safexcel_ahash_ctx *ctx = crypto_tfm_ctx(tfm);
+ struct safexcel_crypto_priv *priv = ctx->priv;
+ struct ahash_request req;
++ struct safexcel_ahash_req *rctx = ahash_request_ctx(&req);
+ struct safexcel_inv_result result = {};
+ int ring = ctx->base.ring;
+
+@@ -450,7 +485,7 @@ static int safexcel_ahash_exit_inv(struc
+ ahash_request_set_tfm(&req, __crypto_ahash_cast(tfm));
+ ctx = crypto_tfm_ctx(req.base.tfm);
+ ctx->base.exit_inv = true;
+- ctx->base.send = safexcel_ahash_send_inv;
++ rctx->needs_inv = true;
+
+ spin_lock_bh(&priv->ring[ring].queue_lock);
+ crypto_enqueue_request(&priv->ring[ring].queue, &req.base);
+@@ -501,14 +536,16 @@ static int safexcel_ahash_enqueue(struct
+ struct safexcel_crypto_priv *priv = ctx->priv;
+ int ret, ring;
+
+- ctx->base.send = safexcel_ahash_send;
++ req->needs_inv = false;
+
+ if (req->processed && ctx->digest == CONTEXT_CONTROL_DIGEST_PRECOMPUTED)
+ ctx->base.needs_inv = safexcel_ahash_needs_inv_get(areq);
+
+ if (ctx->base.ctxr) {
+- if (ctx->base.needs_inv)
+- ctx->base.send = safexcel_ahash_send_inv;
++ if (ctx->base.needs_inv) {
++ ctx->base.needs_inv = false;
++ req->needs_inv = true;
++ }
+ } else {
+ ctx->base.ring = safexcel_select_ring(priv);
+ ctx->base.ctxr = dma_pool_zalloc(priv->context_pool,
+@@ -642,6 +679,8 @@ static int safexcel_ahash_cra_init(struc
+ struct safexcel_alg_template, alg.ahash);
+
+ ctx->priv = tmpl->priv;
++ ctx->base.send = safexcel_ahash_send;
++ ctx->base.handle_result = safexcel_handle_result;
+
+ crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
+ sizeof(struct safexcel_ahash_req));
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Andreas Platschek <andreas.platschek@opentech.at>
+Date: Thu, 14 Dec 2017 12:50:51 +0100
+Subject: dmaengine: fsl-edma: disable clks on all error paths
+
+From: Andreas Platschek <andreas.platschek@opentech.at>
+
+
+[ Upstream commit 2610acf46b9ed528ec2cacd717bc9d354e452b73 ]
+
+Previously enabled clks are only disabled if clk_prepare_enable() fails.
+However, there are other error paths were the previously enabled
+clocks are not disabled.
+
+To fix the problem, fsl_disable_clocks() now takes the number of clocks
+that shall be disabled + unprepared. For existing calls were all clocks
+were already successfully prepared + enabled, DMAMUX_NR is passed to
+disable + unprepare all clocks.
+
+In error paths were only some clocks were successfully prepared +
+enabled the loop counter is passed, in order to disable + unprepare
+all successfully prepared + enabled clocks.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Andreas Platschek <andreas.platschek@opentech.at>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/fsl-edma.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/dma/fsl-edma.c
++++ b/drivers/dma/fsl-edma.c
+@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit(
+ }
+ }
+
+-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
++static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
+ {
+ int i;
+
+- for (i = 0; i < DMAMUX_NR; i++)
++ for (i = 0; i < nr_clocks; i++)
+ clk_disable_unprepare(fsl_edma->muxclk[i]);
+ }
+
+@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platfor
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
+ fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(fsl_edma->muxbase[i]))
++ if (IS_ERR(fsl_edma->muxbase[i])) {
++ /* on error: disable all previously enabled clks */
++ fsl_disable_clocks(fsl_edma, i);
+ return PTR_ERR(fsl_edma->muxbase[i]);
++ }
+
+ sprintf(clkname, "dmamux%d", i);
+ fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
+ if (IS_ERR(fsl_edma->muxclk[i])) {
+ dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
++ /* on error: disable all previously enabled clks */
++ fsl_disable_clocks(fsl_edma, i);
+ return PTR_ERR(fsl_edma->muxclk[i]);
+ }
+
+ ret = clk_prepare_enable(fsl_edma->muxclk[i]);
+- if (ret) {
+- /* disable only clks which were enabled on error */
+- for (; i >= 0; i--)
+- clk_disable_unprepare(fsl_edma->muxclk[i]);
+-
+- dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
+- return ret;
+- }
++ if (ret)
++ /* on error: disable all previously enabled clks */
++ fsl_disable_clocks(fsl_edma, i);
+
+ }
+
+@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platfor
+ if (ret) {
+ dev_err(&pdev->dev,
+ "Can't register Freescale eDMA engine. (%d)\n", ret);
+- fsl_disable_clocks(fsl_edma);
++ fsl_disable_clocks(fsl_edma, DMAMUX_NR);
+ return ret;
+ }
+
+@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platfor
+ dev_err(&pdev->dev,
+ "Can't register Freescale eDMA of_dma. (%d)\n", ret);
+ dma_async_device_unregister(&fsl_edma->dma_dev);
+- fsl_disable_clocks(fsl_edma);
++ fsl_disable_clocks(fsl_edma, DMAMUX_NR);
+ return ret;
+ }
+
+@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platfo
+ fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
+ of_dma_controller_free(np);
+ dma_async_device_unregister(&fsl_edma->dma_dev);
+- fsl_disable_clocks(fsl_edma);
++ fsl_disable_clocks(fsl_edma, DMAMUX_NR);
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Karol Herbst <kherbst@redhat.com>
+Date: Fri, 24 Nov 2017 03:56:26 +0100
+Subject: drm/nouveau/pci: do a msi rearm on init
+
+From: Karol Herbst <kherbst@redhat.com>
+
+
+[ Upstream commit a121027d2747168df0aac0c3da35509eea39f61c ]
+
+On my GP107 when I load nouveau after unloading it, for some reason the
+GPU stopped sending or the CPU stopped receiving interrupts if MSI was
+enabled.
+
+Doing a rearm once before getting any interrupts fixes this.
+
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Reviewed-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev
+ return ret;
+
+ pci->irq = pdev->irq;
++
++ /* Ensure MSI interrupts are armed, for the case where there are
++ * already interrupts pending (for whatever reason) at load time.
++ */
++ if (pci->msi)
++ pci->func->msi_rearm(pci);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xiongwei Song <sxwjean@gmail.com>
+Date: Tue, 2 Jan 2018 21:24:55 +0800
+Subject: drm/ttm: check the return value of kzalloc
+
+From: Xiongwei Song <sxwjean@gmail.com>
+
+
+[ Upstream commit 19d859a7205bc59ffc38303eb25ae394f61d21dc ]
+
+In the function ttm_page_alloc_init, kzalloc call is made for variable
+_manager, we need to check its return value, it may return NULL.
+
+Signed-off-by: Xiongwei Song <sxwjean@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -821,6 +821,8 @@ int ttm_page_alloc_init(struct ttm_mem_g
+ pr_info("Initializing pool allocator\n");
+
+ _manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
++ if (!_manager)
++ return -ENOMEM;
+
+ ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Tushar Dave <tushar.n.dave@oracle.com>
+Date: Wed, 6 Dec 2017 02:26:29 +0530
+Subject: e1000: fix disabling already-disabled warning
+
+From: Tushar Dave <tushar.n.dave@oracle.com>
+
+
+[ Upstream commit 0b76aae741abb9d16d2c0e67f8b1e766576f897d ]
+
+This patch adds check so that driver does not disable already
+disabled device.
+
+[ 44.637743] advantechwdt: Unexpected close, not stopping watchdog!
+[ 44.997548] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input6
+[ 45.013419] e1000 0000:00:03.0: disabling already-disabled device
+[ 45.013447] ------------[ cut here ]------------
+[ 45.014868] WARNING: CPU: 1 PID: 71 at drivers/pci/pci.c:1641 pci_disable_device+0xa1/0x105:
+ pci_disable_device at drivers/pci/pci.c:1640
+[ 45.016171] CPU: 1 PID: 71 Comm: rcu_perf_shutdo Not tainted 4.14.0-01330-g3c07399 #1
+[ 45.017197] task: ffff88011bee9e40 task.stack: ffffc90000860000
+[ 45.017987] RIP: 0010:pci_disable_device+0xa1/0x105:
+ pci_disable_device at drivers/pci/pci.c:1640
+[ 45.018603] RSP: 0000:ffffc90000863e30 EFLAGS: 00010286
+[ 45.019282] RAX: 0000000000000035 RBX: ffff88013a230008 RCX: 0000000000000000
+[ 45.020182] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000203
+[ 45.021084] RBP: ffff88013a3f31e8 R08: 0000000000000001 R09: 0000000000000000
+[ 45.021986] R10: ffffffff827ec29c R11: 0000000000000002 R12: 0000000000000001
+[ 45.022946] R13: ffff88013a230008 R14: ffff880117802b20 R15: ffffc90000863e8f
+[ 45.023842] FS: 0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000
+[ 45.024863] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 45.025583] CR2: ffffc900006d4000 CR3: 000000000220f000 CR4: 00000000000006a0
+[ 45.026478] Call Trace:
+[ 45.026811] __e1000_shutdown+0x1d4/0x1e2:
+ __e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5162
+[ 45.027344] ? rcu_perf_cleanup+0x2a1/0x2a1:
+ rcu_perf_shutdown at kernel/rcu/rcuperf.c:627
+[ 45.027883] e1000_shutdown+0x14/0x3a:
+ e1000_shutdown at drivers/net/ethernet/intel/e1000/e1000_main.c:5235
+[ 45.028351] device_shutdown+0x110/0x1aa:
+ device_shutdown at drivers/base/core.c:2807
+[ 45.028858] kernel_power_off+0x31/0x64:
+ kernel_power_off at kernel/reboot.c:260
+[ 45.029343] rcu_perf_shutdown+0x9b/0xa7:
+ rcu_perf_shutdown at kernel/rcu/rcuperf.c:637
+[ 45.029852] ? __wake_up_common_lock+0xa2/0xa2:
+ autoremove_wake_function at kernel/sched/wait.c:376
+[ 45.030414] kthread+0x126/0x12e:
+ kthread at kernel/kthread.c:233
+[ 45.030834] ? __kthread_bind_mask+0x8e/0x8e:
+ kthread at kernel/kthread.c:190
+[ 45.031399] ? ret_from_fork+0x1f/0x30:
+ ret_from_fork at arch/x86/entry/entry_64.S:443
+[ 45.031883] ? kernel_init+0xa/0xf5:
+ kernel_init at init/main.c:997
+[ 45.032325] ret_from_fork+0x1f/0x30:
+ ret_from_fork at arch/x86/entry/entry_64.S:443
+[ 45.032777] Code: 00 48 85 ed 75 07 48 8b ab a8 00 00 00 48 8d bb 98 00 00 00 e8 aa d1 11 00 48 89 ea 48 89 c6 48 c7 c7 d8 e4 0b 82 e8 55 7d da ff <0f> ff b9 01 00 00 00 31 d2 be 01 00 00 00 48 c7 c7 f0 b1 61 82
+[ 45.035222] ---[ end trace c257137b1b1976ef ]---
+[ 45.037838] ACPI: Preparing to enter system sleep state S5
+
+Signed-off-by: Tushar Dave <tushar.n.dave@oracle.com>
+Tested-by: Fengguang Wu <fengguang.wu@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000.h | 3 +-
+ drivers/net/ethernet/intel/e1000/e1000_main.c | 27 +++++++++++++++++++++-----
+ 2 files changed, 24 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/e1000/e1000.h
++++ b/drivers/net/ethernet/intel/e1000/e1000.h
+@@ -331,7 +331,8 @@ struct e1000_adapter {
+ enum e1000_state_t {
+ __E1000_TESTING,
+ __E1000_RESETTING,
+- __E1000_DOWN
++ __E1000_DOWN,
++ __E1000_DISABLED
+ };
+
+ #undef pr_fmt
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -945,7 +945,7 @@ static int e1000_init_hw_struct(struct e
+ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct net_device *netdev;
+- struct e1000_adapter *adapter;
++ struct e1000_adapter *adapter = NULL;
+ struct e1000_hw *hw;
+
+ static int cards_found;
+@@ -955,6 +955,7 @@ static int e1000_probe(struct pci_dev *p
+ u16 tmp = 0;
+ u16 eeprom_apme_mask = E1000_EEPROM_APME;
+ int bars, need_ioport;
++ bool disable_dev = false;
+
+ /* do not allocate ioport bars when not needed */
+ need_ioport = e1000_is_need_ioport(pdev);
+@@ -1259,11 +1260,13 @@ err_mdio_ioremap:
+ iounmap(hw->ce4100_gbe_mdio_base_virt);
+ iounmap(hw->hw_addr);
+ err_ioremap:
++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+ free_netdev(netdev);
+ err_alloc_etherdev:
+ pci_release_selected_regions(pdev, bars);
+ err_pci_reg:
+- pci_disable_device(pdev);
++ if (!adapter || disable_dev)
++ pci_disable_device(pdev);
+ return err;
+ }
+
+@@ -1281,6 +1284,7 @@ static void e1000_remove(struct pci_dev
+ struct net_device *netdev = pci_get_drvdata(pdev);
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ struct e1000_hw *hw = &adapter->hw;
++ bool disable_dev;
+
+ e1000_down_and_stop(adapter);
+ e1000_release_manageability(adapter);
+@@ -1299,9 +1303,11 @@ static void e1000_remove(struct pci_dev
+ iounmap(hw->flash_address);
+ pci_release_selected_regions(pdev, adapter->bars);
+
++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+ free_netdev(netdev);
+
+- pci_disable_device(pdev);
++ if (disable_dev)
++ pci_disable_device(pdev);
+ }
+
+ /**
+@@ -5156,7 +5162,8 @@ static int __e1000_shutdown(struct pci_d
+ if (netif_running(netdev))
+ e1000_free_irq(adapter);
+
+- pci_disable_device(pdev);
++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
++ pci_disable_device(pdev);
+
+ return 0;
+ }
+@@ -5200,6 +5207,10 @@ static int e1000_resume(struct pci_dev *
+ pr_err("Cannot enable PCI device from suspend\n");
+ return err;
+ }
++
++ /* flush memory to make sure state is correct */
++ smp_mb__before_atomic();
++ clear_bit(__E1000_DISABLED, &adapter->flags);
+ pci_set_master(pdev);
+
+ pci_enable_wake(pdev, PCI_D3hot, 0);
+@@ -5274,7 +5285,9 @@ static pci_ers_result_t e1000_io_error_d
+
+ if (netif_running(netdev))
+ e1000_down(adapter);
+- pci_disable_device(pdev);
++
++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
++ pci_disable_device(pdev);
+
+ /* Request a slot slot reset. */
+ return PCI_ERS_RESULT_NEED_RESET;
+@@ -5302,6 +5315,10 @@ static pci_ers_result_t e1000_io_slot_re
+ pr_err("Cannot re-enable PCI device after reset.\n");
+ return PCI_ERS_RESULT_DISCONNECT;
+ }
++
++ /* flush memory to make sure state is correct */
++ smp_mb__before_atomic();
++ clear_bit(__E1000_DISABLED, &adapter->flags);
+ pci_set_master(pdev);
+
+ pci_enable_wake(pdev, PCI_D3hot, 0);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 14 Dec 2017 15:32:41 -0800
+Subject: exec: avoid gcc-8 warning for get_task_comm
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+
+[ Upstream commit 3756f6401c302617c5e091081ca4d26ab604bec5 ]
+
+gcc-8 warns about using strncpy() with the source size as the limit:
+
+ fs/exec.c:1223:32: error: argument to 'sizeof' in 'strncpy' call is the same expression as the source; did you mean to use the size of the destination? [-Werror=sizeof-pointer-memaccess]
+
+This is indeed slightly suspicious, as it protects us from source
+arguments without NUL-termination, but does not guarantee that the
+destination is terminated.
+
+This keeps the strncpy() to ensure we have properly padded target
+buffer, but ensures that we use the correct length, by passing the
+actual length of the destination buffer as well as adding a build-time
+check to ensure it is exactly TASK_COMM_LEN.
+
+There are only 23 callsites which I all reviewed to ensure this is
+currently the case. We could get away with doing only the check or
+passing the right length, but it doesn't hurt to do both.
+
+Link: http://lkml.kernel.org/r/20171205151724.1764896-1-arnd@arndb.de
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Suggested-by: Kees Cook <keescook@chromium.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Serge Hallyn <serge@hallyn.com>
+Cc: James Morris <james.l.morris@oracle.com>
+Cc: Aleksa Sarai <asarai@suse.de>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/exec.c | 7 +++----
+ include/linux/sched.h | 6 +++++-
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1216,15 +1216,14 @@ killed:
+ return -EAGAIN;
+ }
+
+-char *get_task_comm(char *buf, struct task_struct *tsk)
++char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
+ {
+- /* buf must be at least sizeof(tsk->comm) in size */
+ task_lock(tsk);
+- strncpy(buf, tsk->comm, sizeof(tsk->comm));
++ strncpy(buf, tsk->comm, buf_size);
+ task_unlock(tsk);
+ return buf;
+ }
+-EXPORT_SYMBOL_GPL(get_task_comm);
++EXPORT_SYMBOL_GPL(__get_task_comm);
+
+ /*
+ * These functions flushes out all traces of the currently running executable
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1502,7 +1502,11 @@ static inline void set_task_comm(struct
+ __set_task_comm(tsk, from, false);
+ }
+
+-extern char *get_task_comm(char *to, struct task_struct *tsk);
++extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk);
++#define get_task_comm(buf, tsk) ({ \
++ BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN); \
++ __get_task_comm(buf, sizeof(buf), tsk); \
++})
+
+ #ifdef CONFIG_SMP
+ void scheduler_ipi(void);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sat, 2 Dec 2017 09:13:04 -0800
+Subject: genirq: Guard handle_bad_irq log messages
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+
+[ Upstream commit 11bca0a83f83f6093d816295668e74ef24595944 ]
+
+An interrupt storm on a bad interrupt will cause the kernel
+log to be clogged.
+
+[ 60.089234] ->handle_irq(): ffffffffbe2f803f,
+[ 60.090455] 0xffffffffbf2af380
+[ 60.090510] handle_bad_irq+0x0/0x2e5
+[ 60.090522] ->irq_data.chip(): ffffffffbf2af380,
+[ 60.090553] IRQ_NOPROBE set
+[ 60.090584] ->handle_irq(): ffffffffbe2f803f,
+[ 60.090590] handle_bad_irq+0x0/0x2e5
+[ 60.090596] ->irq_data.chip(): ffffffffbf2af380,
+[ 60.090602] 0xffffffffbf2af380
+[ 60.090608] ->action(): (null)
+[ 60.090779] handle_bad_irq+0x0/0x2e5
+
+This was seen when running an upstream kernel on Acer Chromebook R11. The
+system was unstable as result.
+
+Guard the log message with __printk_ratelimit to reduce the impact. This
+won't prevent the interrupt storm from happening, but at least the system
+remains stable.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Dmitry Torokhov <dtor@chromium.org>
+Cc: Joe Perches <joe@perches.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197953
+Link: https://lkml.kernel.org/r/1512234784-21038-1-git-send-email-linux@roeck-us.net
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/irq/debug.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/irq/debug.h
++++ b/kernel/irq/debug.h
+@@ -12,6 +12,11 @@
+
+ static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
+ {
++ static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
++
++ if (!__ratelimit(&ratelimit))
++ return;
++
+ printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n",
+ irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
+ printk("->handle_irq(): %p, ", desc->handle_irq);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Wed, 20 Dec 2017 11:04:36 -0500
+Subject: i40e: don't remove netdev->dev_addr when syncing uc list
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+
+[ Upstream commit 458867b2ca0c987445c5d9adccd1642970e1ba07 ]
+
+In some circumstances, such as with bridging, it is possible that the
+stack will add a devices own MAC address to its unicast address list.
+
+If, later, the stack deletes this address, then the i40e driver will
+receive a request to remove this address.
+
+The driver stores its current MAC address as part of the MAC/VLAN hash
+array, since it is convenient and matches exactly how the hardware
+expects to be told which traffic to receive.
+
+This causes a problem, since for more devices, the MAC address is stored
+separately, and requests to delete a unicast address should not have the
+ability to remove the filter for the MAC address.
+
+Fix this by forcing a check on every address sync to ensure we do not
+remove the device address.
+
+There is a very narrow possibility of a race between .set_mac and
+.set_rx_mode, if we don't change netdev->dev_addr before updating our
+internal MAC list in .set_mac. This might be possible if .set_rx_mode is
+going to remove MAC "XYZ" from the list, at the same time as .set_mac
+changes our dev_addr to MAC "XYZ", we might possibly queue a delete,
+then an add in .set_mac, then queue a delete in .set_rx_mode's
+dev_uc_sync and then update netdev->dev_addr. We can avoid this by
+moving the copy into dev_addr prior to the changes to the MAC filter
+list.
+
+A similar race on the other side does not cause problems, as if we're
+changing our MAC form A to B, and we race with .set_rx_mode, it could
+queue a delete from A, we'd update our address, and allow the delete.
+This seems like a race, but in reality we're about to queue a delete of
+A anyways, so it would not cause any issues.
+
+A race in the initialization code is unlikely because the netdevice has
+not yet been fully initialized and the stack should not be adding or
+removing addresses yet.
+
+Note that we don't (yet) need similar code for the VF driver because it
+does not make use of __dev_uc_sync and __dev_mc_sync, but instead roles
+its own method for handling updates to the MAC/VLAN list, which already
+has code to protect against removal of the hardware address.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -1553,11 +1553,18 @@ static int i40e_set_mac(struct net_devic
+ else
+ netdev_info(netdev, "set new mac address %pM\n", addr->sa_data);
+
++ /* Copy the address first, so that we avoid a possible race with
++ * .set_rx_mode(). If we copy after changing the address in the filter
++ * list, we might open ourselves to a narrow race window where
++ * .set_rx_mode could delete our dev_addr filter and prevent traffic
++ * from passing.
++ */
++ ether_addr_copy(netdev->dev_addr, addr->sa_data);
++
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+ i40e_del_mac_filter(vsi, netdev->dev_addr);
+ i40e_add_mac_filter(vsi, addr->sa_data);
+ spin_unlock_bh(&vsi->mac_filter_hash_lock);
+- ether_addr_copy(netdev->dev_addr, addr->sa_data);
+ if (vsi->type == I40E_VSI_MAIN) {
+ i40e_status ret;
+
+@@ -1739,6 +1746,14 @@ static int i40e_addr_unsync(struct net_d
+ struct i40e_netdev_priv *np = netdev_priv(netdev);
+ struct i40e_vsi *vsi = np->vsi;
+
++ /* Under some circumstances, we might receive a request to delete
++ * our own device address from our uc list. Because we store the
++ * device address in the VSI's MAC/VLAN filter list, we need to ignore
++ * such requests and not delete our device address from this list.
++ */
++ if (ether_addr_equal(addr, netdev->dev_addr))
++ return 0;
++
+ i40e_del_mac_filter(vsi, addr);
+
+ return 0;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Fri, 8 Dec 2017 10:55:04 -0800
+Subject: i40e/i40evf: Account for frags split over multiple descriptors in check linearize
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+
+[ Upstream commit 248de22e638f10bd5bfc7624a357f940f66ba137 ]
+
+The original code for __i40e_chk_linearize didn't take into account the
+fact that if a fragment is 16K in size or larger it has to be split over 2
+descriptors and the smaller of those 2 descriptors will be on the trailing
+edge of the transmit. As a result we can get into situations where we didn't
+catch requests that could result in a Tx hang.
+
+This patch takes care of that by subtracting the length of all but the
+trailing edge of the stale fragment before we test for sum. By doing this
+we can guarantee that we have all cases covered, including the case of a
+fragment that spans multiple descriptors. We don't need to worry about
+checking the inner portions of this since 12K is the maximum aligned DMA
+size and that is larger than any MSS will ever be since the MTU limit for
+jumbos is something on the order of 9K.
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 26 +++++++++++++++++++++++---
+ drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 26 +++++++++++++++++++++++---
+ 2 files changed, 46 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3048,10 +3048,30 @@ bool __i40e_chk_linearize(struct sk_buff
+ /* Walk through fragments adding latest fragment, testing it, and
+ * then removing stale fragments from the sum.
+ */
+- stale = &skb_shinfo(skb)->frags[0];
+- for (;;) {
++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
++ int stale_size = skb_frag_size(stale);
++
+ sum += skb_frag_size(frag++);
+
++ /* The stale fragment may present us with a smaller
++ * descriptor than the actual fragment size. To account
++ * for that we need to remove all the data on the front and
++ * figure out what the remainder would be in the last
++ * descriptor associated with the fragment.
++ */
++ if (stale_size > I40E_MAX_DATA_PER_TXD) {
++ int align_pad = -(stale->page_offset) &
++ (I40E_MAX_READ_REQ_SIZE - 1);
++
++ sum -= align_pad;
++ stale_size -= align_pad;
++
++ do {
++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++ } while (stale_size > I40E_MAX_DATA_PER_TXD);
++ }
++
+ /* if sum is negative we failed to make sufficient progress */
+ if (sum < 0)
+ return true;
+@@ -3059,7 +3079,7 @@ bool __i40e_chk_linearize(struct sk_buff
+ if (!nr_frags--)
+ break;
+
+- sum -= skb_frag_size(stale++);
++ sum -= stale_size;
+ }
+
+ return false;
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -2014,10 +2014,30 @@ bool __i40evf_chk_linearize(struct sk_bu
+ /* Walk through fragments adding latest fragment, testing it, and
+ * then removing stale fragments from the sum.
+ */
+- stale = &skb_shinfo(skb)->frags[0];
+- for (;;) {
++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
++ int stale_size = skb_frag_size(stale);
++
+ sum += skb_frag_size(frag++);
+
++ /* The stale fragment may present us with a smaller
++ * descriptor than the actual fragment size. To account
++ * for that we need to remove all the data on the front and
++ * figure out what the remainder would be in the last
++ * descriptor associated with the fragment.
++ */
++ if (stale_size > I40E_MAX_DATA_PER_TXD) {
++ int align_pad = -(stale->page_offset) &
++ (I40E_MAX_READ_REQ_SIZE - 1);
++
++ sum -= align_pad;
++ stale_size -= align_pad;
++
++ do {
++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++ } while (stale_size > I40E_MAX_DATA_PER_TXD);
++ }
++
+ /* if sum is negative we failed to make sufficient progress */
+ if (sum < 0)
+ return true;
+@@ -2025,7 +2045,7 @@ bool __i40evf_chk_linearize(struct sk_bu
+ if (!nr_frags--)
+ break;
+
+- sum -= skb_frag_size(stale++);
++ sum -= stale_size;
+ }
+
+ return false;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+Date: Tue, 19 Dec 2017 22:24:10 -0200
+Subject: i915: Reject CCS modifiers for pipe C on Geminilake
+
+From: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+
+
+[ Upstream commit 8bc0d7ac934b6f2d0dc8f38a3104d281c9db1e98 ]
+
+Current code advertises (on the modifiers blob property) support for CCS
+modifier for pipe C on GLK, only to reject it later when validating the
+request before the atomic commit.
+
+This fixes the tests igt@kms_ccs@pipe-c-*, which should skip on GLK for
+pipe C (see bug 104096).
+
+A relevant discussion is archived at:
+
+https://lists.freedesktop.org/archives/intel-gfx/2017-December/150646.html
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104096
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+Cc: Ben Widawsky <ben@bwidawsk.net>
+Reviewed-by: Ben Widawsky <ben@bwidawsk.net>
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20171220002410.5604-1-krisman@collabora.co.uk
+(cherry picked from commit f0cbd8bd877f3d8c5b80a6b1add9ca9010d7f9d8)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13240,7 +13240,7 @@ intel_primary_plane_create(struct drm_i9
+ primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe);
+ primary->check_plane = intel_check_primary_plane;
+
+- if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) {
++ if (INTEL_GEN(dev_priv) >= 10) {
+ intel_primary_formats = skl_primary_formats;
+ num_formats = ARRAY_SIZE(skl_primary_formats);
+ modifiers = skl_format_modifiers_ccs;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Valentin Ilie <valentin.ilie@gmail.com>
+Date: Fri, 5 Jan 2018 23:12:59 +0000
+Subject: ia64, sched/cputime: Fix build error if CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y
+
+From: Valentin Ilie <valentin.ilie@gmail.com>
+
+
+[ Upstream commit 7729bebc619307a0233c86f8585a4bf3eadc7ce4 ]
+
+Remove the extra parenthesis.
+
+This bug was introduced by:
+
+ e2339a4caa5e: ("ia64: Convert vtime to use nsec units directly")
+
+Signed-off-by: Valentin Ilie <valentin.ilie@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: fenghua.yu@intel.com
+Cc: linux-ia64@vger.kernel.org
+Cc: tony.luck@intel.com
+Link: http://lkml.kernel.org/r/1515193979-24873-1-git-send-email-valentin.ilie@gmail.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/ia64/kernel/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/ia64/kernel/time.c
++++ b/arch/ia64/kernel/time.c
+@@ -88,7 +88,7 @@ void vtime_flush(struct task_struct *tsk
+ }
+
+ if (ti->softirq_time) {
+- delta = cycle_to_nsec(ti->softirq_time));
++ delta = cycle_to_nsec(ti->softirq_time);
+ account_system_index_time(tsk, delta, CPUTIME_SOFTIRQ);
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Erez Shitrit <erezsh@mellanox.com>
+Date: Sun, 31 Dec 2017 15:33:15 +0200
+Subject: IB/ipoib: Fix race condition in neigh creation
+
+From: Erez Shitrit <erezsh@mellanox.com>
+
+
+[ Upstream commit 16ba3defb8bd01a9464ba4820a487f5b196b455b ]
+
+When using enhanced mode for IPoIB, two threads may execute xmit in
+parallel to two different TX queues while the target is the same.
+In this case, both of them will add the same neighbor to the path's
+neigh link list and we might see the following message:
+
+ list_add double add: new=ffff88024767a348, prev=ffff88024767a348...
+ WARNING: lib/list_debug.c:31__list_add_valid+0x4e/0x70
+ ipoib_start_xmit+0x477/0x680 [ib_ipoib]
+ dev_hard_start_xmit+0xb9/0x3e0
+ sch_direct_xmit+0xf9/0x250
+ __qdisc_run+0x176/0x5d0
+ __dev_queue_xmit+0x1f5/0xb10
+ __dev_queue_xmit+0x55/0xb10
+
+Analysis:
+Two SKB are scheduled to be transmitted from two cores.
+In ipoib_start_xmit, both gets NULL when calling ipoib_neigh_get.
+Two calls to neigh_add_path are made. One thread takes the spin-lock
+and calls ipoib_neigh_alloc which creates the neigh structure,
+then (after the __path_find) the neigh is added to the path's neigh
+link list. When the second thread enters the critical section it also
+calls ipoib_neigh_alloc but in this case it gets the already allocated
+ipoib_neigh structure, which is already linked to the path's neigh
+link list and adds it again to the list. Which beside of triggering
+the list, it creates a loop in the linked list. This loop leads to
+endless loop inside path_rec_completion.
+
+Solution:
+Check list_empty(&neigh->list) before adding to the list.
+Add a similar fix in "ipoib_multicast.c::ipoib_mcast_send"
+
+Fixes: b63b70d87741 ('IPoIB: Use a private hash table for path lookup in xmit path')
+Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
+Reviewed-by: Alex Vesker <valex@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 25 ++++++++++++++++++-------
+ drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 5 ++++-
+ 2 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -903,8 +903,8 @@ static int path_rec_start(struct net_dev
+ return 0;
+ }
+
+-static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+- struct net_device *dev)
++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr,
++ struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+ struct rdma_netdev *rn = netdev_priv(dev);
+@@ -918,7 +918,15 @@ static void neigh_add_path(struct sk_buf
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ++dev->stats.tx_dropped;
+ dev_kfree_skb_any(skb);
+- return;
++ return NULL;
++ }
++
++ /* To avoid race condition, make sure that the
++ * neigh will be added only once.
++ */
++ if (unlikely(!list_empty(&neigh->list))) {
++ spin_unlock_irqrestore(&priv->lock, flags);
++ return neigh;
+ }
+
+ path = __path_find(dev, daddr + 4);
+@@ -957,7 +965,7 @@ static void neigh_add_path(struct sk_buf
+ path->ah->last_send = rn->send(dev, skb, path->ah->ah,
+ IPOIB_QPN(daddr));
+ ipoib_neigh_put(neigh);
+- return;
++ return NULL;
+ }
+ } else {
+ neigh->ah = NULL;
+@@ -974,7 +982,7 @@ static void neigh_add_path(struct sk_buf
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ipoib_neigh_put(neigh);
+- return;
++ return NULL;
+
+ err_path:
+ ipoib_neigh_free(neigh);
+@@ -984,6 +992,8 @@ err_drop:
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ipoib_neigh_put(neigh);
++
++ return NULL;
+ }
+
+ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+@@ -1092,8 +1102,9 @@ static int ipoib_start_xmit(struct sk_bu
+ case htons(ETH_P_TIPC):
+ neigh = ipoib_neigh_get(dev, phdr->hwaddr);
+ if (unlikely(!neigh)) {
+- neigh_add_path(skb, phdr->hwaddr, dev);
+- return NETDEV_TX_OK;
++ neigh = neigh_add_path(skb, phdr->hwaddr, dev);
++ if (likely(!neigh))
++ return NETDEV_TX_OK;
+ }
+ break;
+ case htons(ETH_P_ARP):
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -816,7 +816,10 @@ void ipoib_mcast_send(struct net_device
+ spin_lock_irqsave(&priv->lock, flags);
+ if (!neigh) {
+ neigh = ipoib_neigh_alloc(daddr, dev);
+- if (neigh) {
++ /* Make sure that the neigh will be added only
++ * once to mcast list.
++ */
++ if (neigh && list_empty(&neigh->list)) {
+ kref_get(&mcast->ah->ref);
+ neigh->ah = mcast->ah;
+ list_add_tail(&neigh->list, &mcast->neigh_list);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Sun, 31 Dec 2017 15:33:14 +0200
+Subject: IB/mlx4: Fix mlx4_ib_alloc_mr error flow
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+
+[ Upstream commit 5a371cf87e145b86efd32007e46146e78c1eff6d ]
+
+ibmr.device is being set only after ib_alloc_mr() is successfully complete.
+Therefore, in case imlx4_mr_enable() returns with error, the error flow
+unwinder calls to mlx4_free_priv_pages(), which uses ibmr.device.
+
+Such usage causes to NULL dereference oops and to fix it, the IB device
+should be set in the mr struct earlier stage (e.g. prior to calling
+mlx4_free_priv_pages()).
+
+Fixes: 1b2cd0fc673c ("IB/mlx4: Support the new memory registration API")
+Signed-off-by: Nitzan Carmi <nitzanc@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx4/mr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -406,7 +406,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib
+ goto err_free_mr;
+
+ mr->max_pages = max_num_sg;
+-
+ err = mlx4_mr_enable(dev->dev, &mr->mmr);
+ if (err)
+ goto err_free_pl;
+@@ -417,6 +416,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib
+ return &mr->ibmr;
+
+ err_free_pl:
++ mr->ibmr.device = pd->device;
+ mlx4_free_priv_pages(mr);
+ err_free_mr:
+ (void) mlx4_mr_free(dev->dev, &mr->mmr);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Nitzan Carmi <nitzanc@mellanox.com>
+Date: Tue, 26 Dec 2017 11:20:20 +0200
+Subject: IB/mlx5: Fix mlx5_ib_alloc_mr error flow
+
+From: Nitzan Carmi <nitzanc@mellanox.com>
+
+
+[ Upstream commit 45e6ae7ef21b907dacb18da62d5787d74a31d860 ]
+
+ibmr.device is being set only after ib_alloc_mr() is
+(successfully) complete. Therefore, in case mlx5_core_create_mkey()
+return with error, the error flow calls mlx5_free_priv_descs()
+which uses ibmr.device (which doesn't exist yet), causing
+a NULL dereference oops.
+
+To fix this, the IB device should be set in the mr struct earlier
+stage (e.g. prior to calling mlx5_core_create_mkey()).
+
+Fixes: 8a187ee52b04 ("IB/mlx5: Support the new memory registration API")
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Nitzan Carmi <nitzanc@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1637,6 +1637,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib
+ MLX5_SET(mkc, mkc, access_mode, mr->access_mode);
+ MLX5_SET(mkc, mkc, umr_en, 1);
+
++ mr->ibmr.device = pd->device;
+ err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);
+ if (err)
+ goto err_destroy_psv;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+Date: Tue, 2 Jan 2018 09:39:25 -0800
+Subject: Input: xen-kbdfront - do not advertise multi-touch pressure support
+
+From: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+
+
+[ Upstream commit 02a0d9216d4daf6a58d88642bd2da2c78c327552 ]
+
+Some user-space applications expect multi-touch pressure
+on contact to be reported if it is advertised in device
+properties. Otherwise, such applications may treat reports
+not as actual touches, but hovering. Currently this is
+only advertised, but not reported.
+Fix this by not advertising that ABS_MT_PRESSURE is supported.
+
+Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
+Signed-off-by: Andrii Chepurnyi <andrii_chepurnyi@epam.com>
+Patchwork-Id: 10140017
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/misc/xen-kbdfront.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/input/misc/xen-kbdfront.c
++++ b/drivers/input/misc/xen-kbdfront.c
+@@ -326,8 +326,6 @@ static int xenkbd_probe(struct xenbus_de
+ 0, width, 0, 0);
+ input_set_abs_params(mtouch, ABS_MT_POSITION_Y,
+ 0, height, 0, 0);
+- input_set_abs_params(mtouch, ABS_MT_PRESSURE,
+- 0, 255, 0, 0);
+
+ ret = input_mt_init_slots(mtouch, num_cont, INPUT_MT_DIRECT);
+ if (ret) {
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 18 Dec 2017 14:25:09 +0800
+Subject: ip6_gre: remove the incorrect mtu limit for ipgre tap
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit 2c52129a7d74d017320804c6928de770815c5f4a ]
+
+The same fix as the patch "ip_gre: remove the incorrect mtu limit for
+ipgre tap" is also needed for ip6_gre.
+
+Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_gre.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1335,6 +1335,7 @@ static void ip6gre_tap_setup(struct net_
+
+ ether_setup(dev);
+
++ dev->max_mtu = 0;
+ dev->netdev_ops = &ip6gre_tap_netdev_ops;
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = ip6gre_dev_free;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 25 Dec 2017 14:45:12 +0800
+Subject: ip6_tunnel: allow ip6gre dev mtu to be set below 1280
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit 2fa771be953a17f8e0a9c39103464c2574444c62 ]
+
+Commit 582442d6d5bc ("ipv6: Allow the MTU of ipip6 tunnel to be set
+below 1280") fixed a mtu setting issue. It works for ipip6 tunnel.
+
+But ip6gre dev updates the mtu also with ip6_tnl_change_mtu. Since
+the inner packet over ip6gre can be ipv4 and it's mtu should also
+be allowed to set below 1280, the same issue also exists on ip6gre.
+
+This patch is to fix it by simply changing to check if parms.proto
+is IPPROTO_IPV6 in ip6_tnl_change_mtu instead, to make ip6gre to
+go to 'else' branch.
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_tunnel.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1684,11 +1684,11 @@ int ip6_tnl_change_mtu(struct net_device
+ {
+ struct ip6_tnl *tnl = netdev_priv(dev);
+
+- if (tnl->parms.proto == IPPROTO_IPIP) {
+- if (new_mtu < ETH_MIN_MTU)
++ if (tnl->parms.proto == IPPROTO_IPV6) {
++ if (new_mtu < IPV6_MIN_MTU)
+ return -EINVAL;
+ } else {
+- if (new_mtu < IPV6_MIN_MTU)
++ if (new_mtu < ETH_MIN_MTU)
+ return -EINVAL;
+ }
+ if (new_mtu > 0xFFF8 - dev->hard_header_len)
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 18 Dec 2017 14:26:21 +0800
+Subject: ip6_tunnel: get the min mtu properly in ip6_tnl_xmit
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit c9fefa08190fc879fb2e681035d7774e0a8c5170 ]
+
+Now it's using IPV6_MIN_MTU as the min mtu in ip6_tnl_xmit, but
+IPV6_MIN_MTU actually only works when the inner packet is ipv6.
+
+With IPV6_MIN_MTU for ipv4 packets, the new pmtu for inner dst
+couldn't be set less than 1280. It would cause tx_err and the
+packet to be dropped when the outer dst pmtu is close to 1280.
+
+Jianlin found it by running ipv4 traffic with the topo:
+
+ (client) gre6 <---> eth1 (route) eth2 <---> gre6 (server)
+
+After changing eth2 mtu to 1300, the performance became very
+low, or the connection was even broken. The issue also affects
+ip4ip6 and ip6ip6 tunnels.
+
+So if the inner packet is ipv4, 576 should be considered as the
+min mtu.
+
+Note that for ip4ip6 and ip6ip6 tunnels, the inner packet can
+only be ipv4 or ipv6, but for gre6 tunnel, it may also be ARP.
+This patch using 576 as the min mtu for non-ipv6 packet works
+for all those cases.
+
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6_tunnel.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1131,8 +1131,13 @@ route_lookup:
+ max_headroom += 8;
+ mtu -= 8;
+ }
+- if (mtu < IPV6_MIN_MTU)
+- mtu = IPV6_MIN_MTU;
++ if (skb->protocol == htons(ETH_P_IPV6)) {
++ if (mtu < IPV6_MIN_MTU)
++ mtu = IPV6_MIN_MTU;
++ } else if (mtu < 576) {
++ mtu = 576;
++ }
++
+ if (skb_dst(skb) && !t->parms.collect_md)
+ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+ if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 18 Dec 2017 14:24:35 +0800
+Subject: ip_gre: remove the incorrect mtu limit for ipgre tap
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit cfddd4c33c254954927942599d299b3865743146 ]
+
+ipgre tap driver calls ether_setup(), after commit 61e84623ace3
+("net: centralize net_device min/max MTU checking"), the range
+of mtu is [min_mtu, max_mtu], which is [68, 1500] by default.
+
+It causes the dev mtu of the ipgre tap device to not be greater
+than 1500, this limit value is not correct for ipgre tap device.
+
+Besides, it's .change_mtu already does the right check. So this
+patch is just to set max_mtu as 0, and leave the check to it's
+.change_mtu.
+
+Fixes: 61e84623ace3 ("net: centralize net_device min/max MTU checking")
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_gre.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1274,6 +1274,7 @@ static const struct net_device_ops erspa
+ static void ipgre_tap_setup(struct net_device *dev)
+ {
+ ether_setup(dev);
++ dev->max_mtu = 0;
+ dev->netdev_ops = &gre_tap_netdev_ops;
+ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Brendan McGrath <redmcg@redmandi.dyndns.org>
+Date: Wed, 13 Dec 2017 22:14:57 +1100
+Subject: ipv6: icmp6: Allow icmp messages to be looped back
+
+From: Brendan McGrath <redmcg@redmandi.dyndns.org>
+
+
+[ Upstream commit 588753f1eb18978512b1c9b85fddb457d46f9033 ]
+
+One example of when an ICMPv6 packet is required to be looped back is
+when a host acts as both a Multicast Listener and a Multicast Router.
+
+A Multicast Router will listen on address ff02::16 for MLDv2 messages.
+
+Currently, MLDv2 messages originating from a Multicast Listener running
+on the same host as the Multicast Router are not being delivered to the
+Multicast Router. This is due to dst.input being assigned the default
+value of dst_discard.
+
+This results in the packet being looped back but discarded before being
+delivered to the Multicast Router.
+
+This patch sets dst.input to ip6_input to ensure a looped back packet
+is delivered to the Multicast Router.
+
+Signed-off-by: Brendan McGrath <redmcg@redmandi.dyndns.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/route.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1755,6 +1755,7 @@ struct dst_entry *icmp6_dst_alloc(struct
+ }
+
+ rt->dst.flags |= DST_HOST;
++ rt->dst.input = ip6_input;
+ rt->dst.output = ip6_output;
+ rt->rt6i_gateway = fl6->daddr;
+ rt->rt6i_dst.addr = fl6->daddr;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+Date: Tue, 12 Dec 2017 11:10:44 +0100
+Subject: led: core: Fix brightness setting when setting delay_off=0
+
+From: Matthieu CASTET <matthieu.castet@parrot.com>
+
+
+[ Upstream commit 2b83ff96f51d0b039c4561b9f95c824d7bddb85c ]
+
+With the current code, the following sequence won't work :
+echo timer > trigger
+
+echo 0 > delay_off
+* at this point we call
+** led_delay_off_store
+** led_blink_set
+---
+ drivers/leds/led-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -187,7 +187,7 @@ void led_blink_set(struct led_classdev *
+ unsigned long *delay_on,
+ unsigned long *delay_off)
+ {
+- del_timer_sync(&led_cdev->blink_timer);
++ led_stop_software_blink(led_cdev);
+
+ clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
+ clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Date: Wed, 3 Jan 2018 21:13:45 +0100
+Subject: leds: core: Fix regression caused by commit 2b83ff96f51d
+
+From: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+
+
+[ Upstream commit 7b6af2c53192f1766892ef40c8f48a413509ed72 ]
+
+Commit 2b83ff96f51d ("led: core: Fix brightness setting when setting delay_off=0")
+replaced del_timer_sync(&led_cdev->blink_timer) with led_stop_software_blink()
+in led_blink_set(), which additionally clears LED_BLINK_SW flag as well as
+zeroes blink_delay_on and blink_delay_off properties of the struct led_classdev.
+
+Cleansing of the latter ones wasn't required to fix the original issue but
+wasn't considered harmful. It nonetheless turned out to be so in case when
+pointer to one or both props is passed to led_blink_set() like in the
+ledtrig-timer.c. In such cases zeroes are passed later in delay_on and/or
+delay_off arguments to led_blink_setup(), which results either in stopping
+the software blinking or setting blinking frequency always to 1Hz.
+
+Avoid using led_stop_software_blink() and add a single call required
+to clear LED_BLINK_SW flag, which was the only needed modification to
+fix the original issue.
+
+Fixes 2b83ff96f51d ("led: core: Fix brightness setting when setting delay_off=0")
+Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/led-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -187,8 +187,9 @@ void led_blink_set(struct led_classdev *
+ unsigned long *delay_on,
+ unsigned long *delay_off)
+ {
+- led_stop_software_blink(led_cdev);
++ del_timer_sync(&led_cdev->blink_timer);
+
++ clear_bit(LED_BLINK_SW, &led_cdev->work_flags);
+ clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags);
+ clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags);
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: James Hogan <jhogan@kernel.org>
+Date: Tue, 5 Dec 2017 23:31:35 +0000
+Subject: lib/mpi: Fix umul_ppmm() for MIPS64r6
+
+From: James Hogan <jhogan@kernel.org>
+
+
+[ Upstream commit bbc25bee37d2b32cf3a1fab9195b6da3a185614a ]
+
+Current MIPS64r6 toolchains aren't able to generate efficient
+DMULU/DMUHU based code for the C implementation of umul_ppmm(), which
+performs an unsigned 64 x 64 bit multiply and returns the upper and
+lower 64-bit halves of the 128-bit result. Instead it widens the 64-bit
+inputs to 128-bits and emits a __multi3 intrinsic call to perform a 128
+x 128 multiply. This is both inefficient, and it results in a link error
+since we don't include __multi3 in MIPS linux.
+
+For example commit 90a53e4432b1 ("cfg80211: implement regdb signature
+checking") merged in v4.15-rc1 recently broke the 64r6_defconfig and
+64r6el_defconfig builds by indirectly selecting MPILIB. The same build
+errors can be reproduced on older kernels by enabling e.g. CRYPTO_RSA:
+
+lib/mpi/generic_mpih-mul1.o: In function `mpihelp_mul_1':
+lib/mpi/generic_mpih-mul1.c:50: undefined reference to `__multi3'
+lib/mpi/generic_mpih-mul2.o: In function `mpihelp_addmul_1':
+lib/mpi/generic_mpih-mul2.c:49: undefined reference to `__multi3'
+lib/mpi/generic_mpih-mul3.o: In function `mpihelp_submul_1':
+lib/mpi/generic_mpih-mul3.c:49: undefined reference to `__multi3'
+lib/mpi/mpih-div.o In function `mpihelp_divrem':
+lib/mpi/mpih-div.c:205: undefined reference to `__multi3'
+lib/mpi/mpih-div.c:142: undefined reference to `__multi3'
+
+Therefore add an efficient MIPS64r6 implementation of umul_ppmm() using
+inline assembly and the DMULU/DMUHU instructions, to prevent __multi3
+calls being emitted.
+
+Fixes: 7fd08ca58ae6 ("MIPS: Add build support for the MIPS R6 ISA")
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: linux-mips@linux-mips.org
+Cc: linux-crypto@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/mpi/longlong.h | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -671,7 +671,23 @@ do { \
+ ************** MIPS/64 **************
+ ***************************************/
+ #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
+-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
++/*
++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
++ * code below, so we special case MIPS64r6 until the compiler can do better.
++ */
++#define umul_ppmm(w1, w0, u, v) \
++do { \
++ __asm__ ("dmulu %0,%1,%2" \
++ : "=d" ((UDItype)(w0)) \
++ : "d" ((UDItype)(u)), \
++ "d" ((UDItype)(v))); \
++ __asm__ ("dmuhu %0,%1,%2" \
++ : "=d" ((UDItype)(w1)) \
++ : "d" ((UDItype)(u)), \
++ "d" ((UDItype)(v))); \
++} while (0)
++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v) \
+ do { \
+ typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 4 Jan 2018 15:51:53 +0100
+Subject: mac80211: mesh: drop frames appearing to be from us
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+
+[ Upstream commit 736a80bbfda709fb3631f5f62056f250a38e5804 ]
+
+If there are multiple mesh stations with the same MAC address,
+they will both get confused and start throwing warnings.
+
+Obviously in this case nothing can actually work anyway, so just
+drop frames that look like they're from ourselves early on.
+
+Reported-by: Gui Iribarren <gui@altermundi.net>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/rx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struc
+ }
+ return true;
+ case NL80211_IFTYPE_MESH_POINT:
++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
++ return false;
+ if (multicast)
+ return true;
+ return ether_addr_equal(sdata->vif.addr, hdr->addr1);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Jia-Ju Bai <baijiaju1990@163.com>
+Date: Tue, 12 Dec 2017 17:26:36 +0800
+Subject: mac80211_hwsim: Fix a possible sleep-in-atomic bug in hwsim_get_radio_nl
+
+From: Jia-Ju Bai <baijiaju1990@163.com>
+
+
+[ Upstream commit 162bd5e5fd921785077b5862d8f2ffabe2fe11e5 ]
+
+The driver may sleep under a spinlock.
+The function call path is:
+hwsim_get_radio_nl (acquire the spinlock)
+ nlmsg_new(GFP_KERNEL) --> may sleep
+
+To fix it, GFP_KERNEL is replaced with GFP_ATOMIC.
+
+This bug is found by my static analysis tool(DSAC) and checked by my code review.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3220,7 +3220,7 @@ static int hwsim_get_radio_nl(struct sk_
+ if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
+ continue;
+
+- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
++ skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+ if (!skb) {
+ res = -ENOMEM;
+ goto out_err;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Gao Feng <gfree.wind@vip.163.com>
+Date: Tue, 26 Dec 2017 21:44:32 +0800
+Subject: macvlan: Fix one possible double free
+
+From: Gao Feng <gfree.wind@vip.163.com>
+
+
+[ Upstream commit d02fd6e7d2933ede6478a15f9e4ce8a93845824e ]
+
+Because the macvlan_uninit would free the macvlan port, so there is one
+double free case in macvlan_common_newlink. When the macvlan port is just
+created, then register_netdevice or netdev_upper_dev_link failed and they
+would invoke macvlan_uninit. Then it would reach the macvlan_port_destroy
+which triggers the double free.
+
+Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/macvlan.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1441,9 +1441,14 @@ int macvlan_common_newlink(struct net *s
+ return 0;
+
+ unregister_netdev:
++ /* macvlan_uninit would free the macvlan port */
+ unregister_netdevice(dev);
++ return err;
+ destroy_macvlan_port:
+- if (create)
++ /* the macvlan port may be freed by macvlan_uninit when fail to register.
++ * so we destroy the macvlan port only when it's valid.
++ */
++ if (create && macvlan_port_get_rtnl(dev))
+ macvlan_port_destroy(port->dev);
+ return err;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sat, 6 Jan 2018 09:00:09 +0100
+Subject: mdio-sun4i: Fix a memory leak
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 56c0290202ab94a2f2780c449395d4ae8495fab4 ]
+
+If the probing of the regulator is deferred, the memory allocated by
+'mdiobus_alloc_size()' will be leaking.
+It should be freed before the next call to 'sun4i_mdio_probe()' which will
+reallocate it.
+
+Fixes: 4bdcb1dd9feb ("net: Add MDIO bus driver for the Allwinner EMAC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mdio-sun4i.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/mdio-sun4i.c
++++ b/drivers/net/phy/mdio-sun4i.c
+@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platf
+
+ data->regulator = devm_regulator_get(&pdev->dev, "phy");
+ if (IS_ERR(data->regulator)) {
+- if (PTR_ERR(data->regulator) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto err_out_free_mdiobus;
++ }
+
+ dev_info(&pdev->dev, "no regulator found\n");
+ data->regulator = NULL;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Yuval Mintz <yuvalm@mellanox.com>
+Date: Wed, 10 Jan 2018 11:42:43 +0100
+Subject: mlxsw: pci: Wait after reset before accessing HW
+
+From: Yuval Mintz <yuvalm@mellanox.com>
+
+
+[ Upstream commit 8e033a93b37f37aa9fca71a370a895155320af60 ]
+
+After performing reset driver polls on HW indication until learning
+that the reset is done, but immediately after reset the device becomes
+unresponsive which might lead to completion timeout on the first read.
+
+Wait for 100ms before starting the polling.
+
+Fixes: 233fa44bd67a ("mlxsw: pci: Implement reset done check")
+Signed-off-by: Yuval Mintz <yuvalm@mellanox.com>
+Reviewed-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/pci.c | 7 ++++++-
+ drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 1 +
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
+@@ -1643,7 +1643,12 @@ static int mlxsw_pci_sw_reset(struct mlx
+ return 0;
+ }
+
+- wmb(); /* reset needs to be written before we read control register */
++ /* Reset needs to be written before we read control register, and
++ * we must wait for the HW to become responsive once again
++ */
++ wmb();
++ msleep(MLXSW_PCI_SW_RESET_WAIT_MSECS);
++
+ end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS);
+ do {
+ u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY);
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+@@ -59,6 +59,7 @@
+ #define MLXSW_PCI_SW_RESET 0xF0010
+ #define MLXSW_PCI_SW_RESET_RST_BIT BIT(0)
+ #define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 5000
++#define MLXSW_PCI_SW_RESET_WAIT_MSECS 100
+ #define MLXSW_PCI_FW_READY 0xA1844
+ #define MLXSW_PCI_FW_READY_MASK 0xFFFF
+ #define MLXSW_PCI_FW_READY_MAGIC 0x5E
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Thu, 14 Dec 2017 15:33:08 -0800
+Subject: mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+
+[ Upstream commit 1f704fd0d14043e76e80f6b8b2251b9b2cedcca6 ]
+
+A semaphore is acquired before this check, so we must release it before
+leaving.
+
+Link: http://lkml.kernel.org/r/20171211211009.4971-1-christophe.jaillet@wanadoo.fr
+Fixes: b7f0554a56f2 ("mm: fail get_vaddr_frames() for filesystem-dax mappings")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Christian Borntraeger <borntraeger@de.ibm.com>
+Cc: David Sterba <dsterba@suse.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/frame_vector.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/frame_vector.c
++++ b/mm/frame_vector.c
+@@ -62,8 +62,10 @@ int get_vaddr_frames(unsigned long start
+ * get_user_pages_longterm() and disallow it for filesystem-dax
+ * mappings.
+ */
+- if (vma_is_fsdax(vma))
+- return -EOPNOTSUPP;
++ if (vma_is_fsdax(vma)) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
+
+ if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) {
+ vec->got_ref = true;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Albert Hsieh <wen.hsieh@broadcom.com>
+Date: Mon, 20 Nov 2017 11:26:26 +0800
+Subject: mtd: nand: brcmnand: Zero bitflip is not an error
+
+From: Albert Hsieh <wen.hsieh@broadcom.com>
+
+
+[ Upstream commit e44b9a9c135727f3410e029910275f40681dc8bc ]
+
+A negative return value of brcmstb_nand_verify_erased_page() indicates a
+real bitflip error of an erased page, and other return values (>= 0) show
+the corrected bitflip number. Zero return value means no bitflip, but the
+current driver code treats it as an error, and eventually leads to
+falsely reported ECC error.
+
+Fixes: 02b88eea9f9c ("mtd: brcmnand: Add check for erased page bitflip")
+Signed-off-by: Albert Hsieh <wen.hsieh@broadcom.com>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/brcmnand/brcmnand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -1763,7 +1763,7 @@ try_dmaread:
+ err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
+ addr);
+ /* erased page bitflips corrected */
+- if (err > 0)
++ if (err >= 0)
+ return err;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Tue, 5 Dec 2017 11:51:40 +0100
+Subject: mtd: nand: gpmi: Fix failure when a erased page has a bitflip at BBM
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+
+[ Upstream commit fdf2e821052958a114618a95ab18a300d0b080cb ]
+
+When erased subpages are read then the BCH decoder returns STATUS_ERASED
+if they are all empty, or STATUS_UNCORRECTABLE if there are bitflips.
+When there are bitflips, we have to set these bits again to show the
+upper layers a completely erased page. When a bitflip happens in the
+exact byte where the bad block marker is, then this byte is swapped
+with another byte in block_mark_swapping(). The correction code then
+detects a bitflip in another subpage and no longer corrects the bitflip
+where it really happens.
+
+Correct this behaviour by calling block_mark_swapping() after the
+bitflips have been corrected.
+
+In our case UBIFS failed with this bug because it expects erased
+pages to be really empty:
+
+UBIFS error (pid 187): ubifs_scan: corrupt empty space at LEB 36:118735
+UBIFS error (pid 187): ubifs_scanned_corruption: corruption at LEB 36:118735
+UBIFS error (pid 187): ubifs_scanned_corruption: first 8192 bytes from LEB 36:118735
+UBIFS error (pid 187): ubifs_scan: LEB 36 scanning failed
+UBIFS error (pid 187): do_commit: commit failed, error -117
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Richard Weinberger <richard@nod.at>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -1067,9 +1067,6 @@ static int gpmi_ecc_read_page(struct mtd
+ return ret;
+ }
+
+- /* handle the block mark swapping */
+- block_mark_swapping(this, payload_virt, auxiliary_virt);
+-
+ /* Loop over status bytes, accumulating ECC status. */
+ status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
+
+@@ -1158,6 +1155,9 @@ static int gpmi_ecc_read_page(struct mtd
+ max_bitflips = max_t(unsigned int, max_bitflips, *status);
+ }
+
++ /* handle the block mark swapping */
++ block_mark_swapping(this, buf, auxiliary_virt);
++
+ if (oob_required) {
+ /*
+ * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Igor Russkikh <igor.russkikh@aquantia.com>
+Date: Thu, 14 Dec 2017 12:34:40 +0300
+Subject: net: aquantia: Fix actual speed capabilities reporting
+
+From: Igor Russkikh <igor.russkikh@aquantia.com>
+
+
+[ Upstream commit e4d02ca04c6d48ab2226342a1c4ed54f1dbb72bd ]
+
+Different hardware device Ids correspond to different maximum speed
+available. Extra checks were added for devices D108 and D109 to
+remove unsupported speeds from these device capabilities list.
+
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_hw.h | 4 +++-
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 7 ++++---
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.h | 2 +-
+ drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 5 +++--
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 13 ++++++++++++-
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 13 ++++++++++++-
+ 6 files changed, 35 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h
+@@ -85,7 +85,9 @@ struct aq_hw_ops {
+ void (*destroy)(struct aq_hw_s *self);
+
+ int (*get_hw_caps)(struct aq_hw_s *self,
+- struct aq_hw_caps_s *aq_hw_caps);
++ struct aq_hw_caps_s *aq_hw_caps,
++ unsigned short device,
++ unsigned short subsystem_device);
+
+ int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring,
+ unsigned int frags);
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -222,7 +222,7 @@ static struct net_device *aq_nic_ndev_al
+
+ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
+ const struct ethtool_ops *et_ops,
+- struct device *dev,
++ struct pci_dev *pdev,
+ struct aq_pci_func_s *aq_pci_func,
+ unsigned int port,
+ const struct aq_hw_ops *aq_hw_ops)
+@@ -242,7 +242,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const
+ ndev->netdev_ops = ndev_ops;
+ ndev->ethtool_ops = et_ops;
+
+- SET_NETDEV_DEV(ndev, dev);
++ SET_NETDEV_DEV(ndev, &pdev->dev);
+
+ ndev->if_port = port;
+ self->ndev = ndev;
+@@ -254,7 +254,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const
+
+ self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port,
+ &self->aq_hw_ops);
+- err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps);
++ err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps,
++ pdev->device, pdev->subsystem_device);
+ if (err < 0)
+ goto err_exit;
+
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+@@ -71,7 +71,7 @@ struct aq_nic_cfg_s {
+
+ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops,
+ const struct ethtool_ops *et_ops,
+- struct device *dev,
++ struct pci_dev *pdev,
+ struct aq_pci_func_s *aq_pci_func,
+ unsigned int port,
+ const struct aq_hw_ops *aq_hw_ops);
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc(
+ pci_set_drvdata(pdev, self);
+ self->pdev = pdev;
+
+- err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps);
++ err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device,
++ pdev->subsystem_device);
+ if (err < 0)
+ goto err_exit;
+
+@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc(
+
+ for (port = 0; port < self->ports; ++port) {
+ struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops,
+- &pdev->dev, self,
++ pdev, self,
+ port, aq_hw_ops);
+
+ if (!aq_nic) {
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -18,9 +18,20 @@
+ #include "hw_atl_a0_internal.h"
+
+ static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self,
+- struct aq_hw_caps_s *aq_hw_caps)
++ struct aq_hw_caps_s *aq_hw_caps,
++ unsigned short device,
++ unsigned short subsystem_device)
+ {
+ memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps));
++
++ if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
++
++ if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G;
++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G;
++ }
++
+ return 0;
+ }
+
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -18,9 +18,20 @@
+ #include "hw_atl_b0_internal.h"
+
+ static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
+- struct aq_hw_caps_s *aq_hw_caps)
++ struct aq_hw_caps_s *aq_hw_caps,
++ unsigned short device,
++ unsigned short subsystem_device)
+ {
+ memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps));
++
++ if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001)
++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
++
++ if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) {
++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G;
++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Igor Russkikh <igor.russkikh@aquantia.com>
+Date: Thu, 14 Dec 2017 12:34:41 +0300
+Subject: net: aquantia: Fix hardware DMA stream overload on large MRRS
+
+From: Igor Russkikh <igor.russkikh@aquantia.com>
+
+
+[ Upstream commit 1e366161510f266516107a69db91f1f2edaea11c ]
+
+Systems with large MRRS on device (2K, 4K) with high data rates and/or
+large MTU, atlantic observes DMA packet buffer overflow. On some systems
+that causes PCIe transaction errors, hardware NMIs or datapath freeze.
+This patch
+1) Limits MRRS from device side to 2K (thats maximum our hardware supports)
+2) Limit maximum size of outstanding TX DMA data read requests. This makes
+hardware buffers running fine.
+
+Signed-off-by: Pavel Belous <pavel.belous@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 12 ++++++++++
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h | 6 +++++
+ 2 files changed, 18 insertions(+)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -16,6 +16,7 @@
+ #include "hw_atl_utils.h"
+ #include "hw_atl_llh.h"
+ #include "hw_atl_b0_internal.h"
++#include "hw_atl_llh_internal.h"
+
+ static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self,
+ struct aq_hw_caps_s *aq_hw_caps,
+@@ -368,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_h
+ };
+
+ int err = 0;
++ u32 val;
+
+ self->aq_nic_cfg = aq_nic_cfg;
+
+@@ -385,6 +387,16 @@ static int hw_atl_b0_hw_init(struct aq_h
+ hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss);
+ hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss);
+
++ /* Force limit MRRS on RDM/TDM to 2K */
++ val = aq_hw_read_reg(self, pci_reg_control6_adr);
++ aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404);
++
++ /* TX DMA total request limit. B0 hardware is not capable to
++ * handle more than (8K-MRRS) incoming DMA data.
++ * Value 24 in 256byte units
++ */
++ aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24);
++
+ err = aq_hw_err_from_flags(self);
+ if (err < 0)
+ goto err_exit;
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -2343,6 +2343,9 @@
+ #define tx_dma_desc_base_addrmsw_adr(descriptor) \
+ (0x00007c04u + (descriptor) * 0x40)
+
++/* tx dma total request limit */
++#define tx_dma_total_req_limit_adr 0x00007b20u
++
+ /* tx interrupt moderation control register definitions
+ * Preprocessor definitions for TX Interrupt Moderation Control Register
+ * Base Address: 0x00008980
+@@ -2369,6 +2372,9 @@
+ /* default value of bitfield reg_res_dsbl */
+ #define pci_reg_res_dsbl_default 0x1
+
++/* PCI core control register */
++#define pci_reg_control6_adr 0x1014u
++
+ /* global microprocessor scratch pad definitions */
+ #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4)
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Fri, 15 Dec 2017 20:20:06 +0300
+Subject: net: arc_emac: fix arc_emac_rx() error paths
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+
+[ Upstream commit e688822d035b494071ecbadcccbd6f3325fb0f59 ]
+
+arc_emac_rx() has some issues found by code review.
+
+In case netdev_alloc_skb_ip_align() or dma_map_single() failure
+rx fifo entry will not be returned to EMAC.
+
+In case dma_map_single() failure previously allocated skb became
+lost to driver. At the same time address of newly allocated skb
+will not be provided to EMAC.
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/arc/emac_main.c | 53 ++++++++++++++++++++---------------
+ 1 file changed, 31 insertions(+), 22 deletions(-)
+
+--- a/drivers/net/ethernet/arc/emac_main.c
++++ b/drivers/net/ethernet/arc/emac_main.c
+@@ -210,39 +210,48 @@ static int arc_emac_rx(struct net_device
+ continue;
+ }
+
+- pktlen = info & LEN_MASK;
+- stats->rx_packets++;
+- stats->rx_bytes += pktlen;
+- skb = rx_buff->skb;
+- skb_put(skb, pktlen);
+- skb->dev = ndev;
+- skb->protocol = eth_type_trans(skb, ndev);
+-
+- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+-
+- /* Prepare the BD for next cycle */
+- rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
+- EMAC_BUFFER_SIZE);
+- if (unlikely(!rx_buff->skb)) {
++ /* Prepare the BD for next cycle. netif_receive_skb()
++ * only if new skb was allocated and mapped to avoid holes
++ * in the RX fifo.
++ */
++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
++ if (unlikely(!skb)) {
++ if (net_ratelimit())
++ netdev_err(ndev, "cannot allocate skb\n");
++ /* Return ownership to EMAC */
++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+ stats->rx_errors++;
+- /* Because receive_skb is below, increment rx_dropped */
+ stats->rx_dropped++;
+ continue;
+ }
+
+- /* receive_skb only if new skb was allocated to avoid holes */
+- netif_receive_skb(skb);
+-
+- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
++ addr = dma_map_single(&ndev->dev, (void *)skb->data,
+ EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+ if (dma_mapping_error(&ndev->dev, addr)) {
+ if (net_ratelimit())
+- netdev_err(ndev, "cannot dma map\n");
+- dev_kfree_skb(rx_buff->skb);
++ netdev_err(ndev, "cannot map dma buffer\n");
++ dev_kfree_skb(skb);
++ /* Return ownership to EMAC */
++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+ stats->rx_errors++;
++ stats->rx_dropped++;
+ continue;
+ }
++
++ /* unmap previosly mapped skb */
++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
++
++ pktlen = info & LEN_MASK;
++ stats->rx_packets++;
++ stats->rx_bytes += pktlen;
++ skb_put(rx_buff->skb, pktlen);
++ rx_buff->skb->dev = ndev;
++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
++
++ netif_receive_skb(rx_buff->skb);
++
++ rx_buff->skb = skb;
+ dma_unmap_addr_set(rx_buff, addr, addr);
+ dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Netanel Belgazal <netanel@amazon.com>
+Date: Wed, 3 Jan 2018 06:17:29 +0000
+Subject: net: ena: unmask MSI-X only after device initialization is completed
+
+From: Netanel Belgazal <netanel@amazon.com>
+
+
+[ Upstream commit 7853b49ce8e0ef6364d24512b287463841d71bd3 ]
+
+Under certain conditions MSI-X interrupt might arrive right after it
+was unmasked in ena_up(). There is a chance it would be processed by
+the driver before device ENA_FLAG_DEV_UP flag is set. In such a case
+the interrupt is ignored.
+ENA device operates in auto-masked mode, therefore ignoring
+interrupt leaves it masked for good.
+Moving unmask of interrupt to be the last step in ena_up().
+
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1565,7 +1565,7 @@ static int ena_rss_configure(struct ena_
+
+ static int ena_up_complete(struct ena_adapter *adapter)
+ {
+- int rc, i;
++ int rc;
+
+ rc = ena_rss_configure(adapter);
+ if (rc)
+@@ -1584,17 +1584,6 @@ static int ena_up_complete(struct ena_ad
+
+ ena_napi_enable_all(adapter);
+
+- /* Enable completion queues interrupt */
+- for (i = 0; i < adapter->num_queues; i++)
+- ena_unmask_interrupt(&adapter->tx_ring[i],
+- &adapter->rx_ring[i]);
+-
+- /* schedule napi in case we had pending packets
+- * from the last time we disable napi
+- */
+- for (i = 0; i < adapter->num_queues; i++)
+- napi_schedule(&adapter->ena_napi[i].napi);
+-
+ return 0;
+ }
+
+@@ -1731,7 +1720,7 @@ create_err:
+
+ static int ena_up(struct ena_adapter *adapter)
+ {
+- int rc;
++ int rc, i;
+
+ netdev_dbg(adapter->netdev, "%s\n", __func__);
+
+@@ -1774,6 +1763,17 @@ static int ena_up(struct ena_adapter *ad
+
+ set_bit(ENA_FLAG_DEV_UP, &adapter->flags);
+
++ /* Enable completion queues interrupt */
++ for (i = 0; i < adapter->num_queues; i++)
++ ena_unmask_interrupt(&adapter->tx_ring[i],
++ &adapter->rx_ring[i]);
++
++ /* schedule napi in case we had pending packets
++ * from the last time we disable napi
++ */
++ for (i = 0; i < adapter->num_queues; i++)
++ napi_schedule(&adapter->ena_napi[i].napi);
++
+ return rc;
+
+ err_up:
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Yangbo Lu <yangbo.lu@nxp.com>
+Date: Tue, 9 Jan 2018 11:02:33 +0800
+Subject: net: gianfar_ptp: move set_fipers() to spinlock protecting area
+
+From: Yangbo Lu <yangbo.lu@nxp.com>
+
+
+[ Upstream commit 11d827a993a969c3c6ec56758ff63a44ba19b466 ]
+
+set_fipers() calling should be protected by spinlock in
+case that any interrupt breaks related registers setting
+and the function we expect. This patch is to move set_fipers()
+to spinlock protecting area in ptp_gianfar_adjtime().
+
+Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar_ptp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
+@@ -319,11 +319,10 @@ static int ptp_gianfar_adjtime(struct pt
+ now = tmr_cnt_read(etsects);
+ now += delta;
+ tmr_cnt_write(etsects, now);
++ set_fipers(etsects);
+
+ spin_unlock_irqrestore(&etsects->lock, flags);
+
+- set_fipers(etsects);
+-
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Sean Wang <sean.wang@mediatek.com>
+Date: Mon, 18 Dec 2017 17:00:17 +0800
+Subject: net: mediatek: setup proper state for disabled GMAC on the default
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+
+[ Upstream commit 7352e252b5bf40d59342494a70354a2d436fd0cd ]
+
+The current solution would setup fixed and force link of 1Gbps to the both
+GMAC on the default. However, The GMAC should always be put to link down
+state when the GMAC is disabled on certain target boards. Otherwise,
+the driver possibly receives unexpected data from the floating hardware
+connection through the unused GMAC. Although the driver had been added
+certain protection in RX path to get rid of such kind of unexpected data
+sent to the upper stack.
+
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1959,11 +1959,12 @@ static int mtk_hw_init(struct mtk_eth *e
+ /* set GE2 TUNE */
+ regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
+
+- /* GE1, Force 1000M/FD, FC ON */
+- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));
+-
+- /* GE2, Force 1000M/FD, FC ON */
+- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));
++ /* Set linkdown as the default for each GMAC. Its own MCR would be set
++ * up with the more appropriate value when mtk_phy_link_adjust call is
++ * being invoked.
++ */
++ for (i = 0; i < MTK_MAC_COUNT; i++)
++ mtk_w32(eth, 0, MTK_MAC_MCR(i));
+
+ /* Indicates CDM to parse the MTK special tag from CPU
+ * which also is working out for untag packets.
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Moshe Shemesh <moshe@mellanox.com>
+Date: Tue, 21 Nov 2017 15:15:51 +0200
+Subject: net/mlx5: Cleanup IRQs in case of unload failure
+
+From: Moshe Shemesh <moshe@mellanox.com>
+
+
+[ Upstream commit d6b2785cd55ee72e9608762650b3ef299f801b1b ]
+
+When mlx5_stop_eqs fails to destroy any of the eqs it returns with an error.
+In such failure flow the function will return without
+releasing all EQs irqs and then pci_free_irq_vectors will fail.
+Fix by only warn on destroy EQ failure and continue to release other
+EQs and their irqs.
+
+It fixes the following kernel trace:
+kernel: kernel BUG at drivers/pci/msi.c:352!
+...
+...
+kernel: Call Trace:
+kernel: pci_disable_msix+0xd3/0x100
+kernel: pci_free_irq_vectors+0xe/0x20
+kernel: mlx5_load_one.isra.17+0x9f5/0xec0 [mlx5_core]
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eq.c | 20 +++++++++++++-------
+ include/linux/mlx5/driver.h | 2 +-
+ 2 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+@@ -776,7 +776,7 @@ err1:
+ return err;
+ }
+
+-int mlx5_stop_eqs(struct mlx5_core_dev *dev)
++void mlx5_stop_eqs(struct mlx5_core_dev *dev)
+ {
+ struct mlx5_eq_table *table = &dev->priv.eq_table;
+ int err;
+@@ -785,22 +785,28 @@ int mlx5_stop_eqs(struct mlx5_core_dev *
+ if (MLX5_CAP_GEN(dev, pg)) {
+ err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq);
+ if (err)
+- return err;
++ mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n",
++ err);
+ }
+ #endif
+
+ err = mlx5_destroy_unmap_eq(dev, &table->pages_eq);
+ if (err)
+- return err;
++ mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n",
++ err);
+
+- mlx5_destroy_unmap_eq(dev, &table->async_eq);
++ err = mlx5_destroy_unmap_eq(dev, &table->async_eq);
++ if (err)
++ mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n",
++ err);
+ mlx5_cmd_use_polling(dev);
+
+ err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
+- if (err)
++ if (err) {
++ mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
++ err);
+ mlx5_cmd_use_events(dev);
+-
+- return err;
++ }
+ }
+
+ int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -1017,7 +1017,7 @@ int mlx5_create_map_eq(struct mlx5_core_
+ enum mlx5_eq_type type);
+ int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq);
+ int mlx5_start_eqs(struct mlx5_core_dev *dev);
+-int mlx5_stop_eqs(struct mlx5_core_dev *dev);
++void mlx5_stop_eqs(struct mlx5_core_dev *dev);
+ int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn,
+ unsigned int *irqn);
+ int mlx5_core_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Moshe Shemesh <moshe@mellanox.com>
+Date: Mon, 4 Dec 2017 15:23:51 +0200
+Subject: net/mlx5: Stay in polling mode when command EQ destroy fails
+
+From: Moshe Shemesh <moshe@mellanox.com>
+
+
+[ Upstream commit a2fba188fd5eadd6061bef4f2f2577a43231ebf3 ]
+
+During unload, on mlx5_stop_eqs we move command interface from events
+mode to polling mode, but if command interface EQ destroy fail we move
+back to events mode.
+That's wrong since even if we fail to destroy command interface EQ, we
+do release its irq, so no interrupts will be received.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eq.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+@@ -802,11 +802,9 @@ void mlx5_stop_eqs(struct mlx5_core_dev
+ mlx5_cmd_use_polling(dev);
+
+ err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq);
+- if (err) {
++ if (err)
+ mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n",
+ err);
+- mlx5_cmd_use_events(dev);
+- }
+ }
+
+ int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq,
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Huy Nguyen <huyn@mellanox.com>
+Date: Thu, 26 Oct 2017 09:56:34 -0500
+Subject: net/mlx5e: Fix ETS BW check
+
+From: Huy Nguyen <huyn@mellanox.com>
+
+
+[ Upstream commit ff0891915cd7b24ab27eee9b360c0452853bf9f6 ]
+
+Fix bug that allows ets bw sum to be 0% when ets tc type exists.
+
+Fixes: 08fb1dacdd76 ('net/mlx5e: Support DCBNL IEEE ETS')
+Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
+Reviewed-by: Huy Nguyen <huyn@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+@@ -259,6 +259,7 @@ int mlx5e_dcbnl_ieee_setets_core(struct
+ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
+ struct ieee_ets *ets)
+ {
++ bool have_ets_tc = false;
+ int bw_sum = 0;
+ int i;
+
+@@ -273,11 +274,14 @@ static int mlx5e_dbcnl_validate_ets(stru
+ }
+
+ /* Validate Bandwidth Sum */
+- for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++)
+- if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS)
++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
++ if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
++ have_ets_tc = true;
+ bw_sum += ets->tc_tx_bw[i];
++ }
++ }
+
+- if (bw_sum != 0 && bw_sum != 100) {
++ if (have_ets_tc && bw_sum != 100) {
+ netdev_err(netdev,
+ "Failed to validate ETS: BW sum is illegal\n");
+ return -EINVAL;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 12 Dec 2017 10:45:36 +0000
+Subject: net: phy: fix resume handling
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit f5e64032a799d4f54decc7eb6aafcdffb67f9ad9 ]
+
+When a PHY has the BMCR_PDOWN bit set, it may decide to ignore writes
+to other registers, or reset the registers to power-on defaults.
+Micrel PHYs do this for their interrupt registers.
+
+The current structure of phylib tries to enable interrupts before
+resuming (and releasing) the BMCR_PDOWN bit. This fails, causing
+Micrel PHYs to stop working after a suspend/resume sequence if they
+are using interrupts.
+
+Fix this by ensuring that the PHY driver resume methods do not take
+the phydev->lock mutex themselves, but the callers of phy_resume()
+take that lock. This then allows us to move the call to phy_resume()
+before we enable interrupts in phy_start().
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/at803x.c | 4 ----
+ drivers/net/phy/phy.c | 9 +++------
+ drivers/net/phy/phy_device.c | 10 ++++++----
+ 3 files changed, 9 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -239,14 +239,10 @@ static int at803x_resume(struct phy_devi
+ {
+ int value;
+
+- mutex_lock(&phydev->lock);
+-
+ value = phy_read(phydev, MII_BMCR);
+ value &= ~(BMCR_PDOWN | BMCR_ISOLATE);
+ phy_write(phydev, MII_BMCR, value);
+
+- mutex_unlock(&phydev->lock);
+-
+ return 0;
+ }
+
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -828,7 +828,6 @@ EXPORT_SYMBOL(phy_stop);
+ */
+ void phy_start(struct phy_device *phydev)
+ {
+- bool do_resume = false;
+ int err = 0;
+
+ mutex_lock(&phydev->lock);
+@@ -841,6 +840,9 @@ void phy_start(struct phy_device *phydev
+ phydev->state = PHY_UP;
+ break;
+ case PHY_HALTED:
++ /* if phy was suspended, bring the physical link up again */
++ phy_resume(phydev);
++
+ /* make sure interrupts are re-enabled for the PHY */
+ if (phydev->irq != PHY_POLL) {
+ err = phy_enable_interrupts(phydev);
+@@ -849,17 +851,12 @@ void phy_start(struct phy_device *phydev
+ }
+
+ phydev->state = PHY_RESUMING;
+- do_resume = true;
+ break;
+ default:
+ break;
+ }
+ mutex_unlock(&phydev->lock);
+
+- /* if phy was suspended, bring the physical link up again */
+- if (do_resume)
+- phy_resume(phydev);
+-
+ phy_trigger_machine(phydev, true);
+ }
+ EXPORT_SYMBOL(phy_start);
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -135,7 +135,9 @@ static int mdio_bus_phy_resume(struct de
+ if (!mdio_bus_phy_may_suspend(phydev))
+ goto no_resume;
+
++ mutex_lock(&phydev->lock);
+ ret = phy_resume(phydev);
++ mutex_unlock(&phydev->lock);
+ if (ret < 0)
+ return ret;
+
+@@ -1026,7 +1028,9 @@ int phy_attach_direct(struct net_device
+ if (err)
+ goto error;
+
++ mutex_lock(&phydev->lock);
+ phy_resume(phydev);
++ mutex_unlock(&phydev->lock);
+ phy_led_triggers_register(phydev);
+
+ return err;
+@@ -1157,6 +1161,8 @@ int phy_resume(struct phy_device *phydev
+ struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
+ int ret = 0;
+
++ WARN_ON(!mutex_is_locked(&phydev->lock));
++
+ if (phydev->drv && phydrv->resume)
+ ret = phydrv->resume(phydev);
+
+@@ -1639,13 +1645,9 @@ int genphy_resume(struct phy_device *phy
+ {
+ int value;
+
+- mutex_lock(&phydev->lock);
+-
+ value = phy_read(phydev, MII_BMCR);
+ phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
+
+- mutex_unlock(&phydev->lock);
+-
+ return 0;
+ }
+ EXPORT_SYMBOL(genphy_resume);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sat, 16 Dec 2017 00:52:39 +0300
+Subject: net: phy: xgene: disable clk on error paths
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+
+[ Upstream commit ab14436065c8066c265540312742390d6d07ddd2 ]
+
+There are several error paths in xgene_mdio_probe(),
+where clk is left undisabled. The patch fixes them.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/mdio-xgene.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/phy/mdio-xgene.c
++++ b/drivers/net/phy/mdio-xgene.c
+@@ -194,8 +194,11 @@ static int xgene_mdio_reset(struct xgene
+ }
+
+ ret = xgene_enet_ecc_init(pdata);
+- if (ret)
++ if (ret) {
++ if (pdata->dev->of_node)
++ clk_disable_unprepare(pdata->clk);
+ return ret;
++ }
+ xgene_gmac_reset(pdata);
+
+ return 0;
+@@ -388,8 +391,10 @@ static int xgene_mdio_probe(struct platf
+ return ret;
+
+ mdio_bus = mdiobus_alloc();
+- if (!mdio_bus)
+- return -ENOMEM;
++ if (!mdio_bus) {
++ ret = -ENOMEM;
++ goto out_clk;
++ }
+
+ mdio_bus->name = "APM X-Gene MDIO bus";
+
+@@ -418,7 +423,7 @@ static int xgene_mdio_probe(struct platf
+ mdio_bus->phy_mask = ~0;
+ ret = mdiobus_register(mdio_bus);
+ if (ret)
+- goto out;
++ goto out_mdiobus;
+
+ acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1,
+ acpi_register_phy, NULL, mdio_bus, NULL);
+@@ -426,16 +431,20 @@ static int xgene_mdio_probe(struct platf
+ }
+
+ if (ret)
+- goto out;
++ goto out_mdiobus;
+
+ pdata->mdio_bus = mdio_bus;
+ xgene_mdio_status = true;
+
+ return 0;
+
+-out:
++out_mdiobus:
+ mdiobus_free(mdio_bus);
+
++out_clk:
++ if (dev->of_node)
++ clk_disable_unprepare(pdata->clk);
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Fredrik Hallenberg <megahallon@gmail.com>
+Date: Mon, 18 Dec 2017 23:34:00 +0100
+Subject: net: stmmac: Fix bad RX timestamp extraction
+
+From: Fredrik Hallenberg <megahallon@gmail.com>
+
+
+[ Upstream commit a1762456993893795030d911106a7650481db0ef ]
+
+As noted in dwmac4_wrback_get_rx_timestamp_status the timestamp is found
+in the context descriptor following the current descriptor. However the
+current code looks for the context descriptor in the current
+descriptor, which will always fail.
+
+Signed-off-by: Fredrik Hallenberg <megahallon@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h | 2 +-
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 5 +++--
+ drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 3 ++-
+ drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 2 +-
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
+ 5 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -409,7 +409,7 @@ struct stmmac_desc_ops {
+ /* get timestamp value */
+ u64(*get_timestamp) (void *desc, u32 ats);
+ /* get rx timestamp status */
+- int (*get_rx_timestamp_status) (void *desc, u32 ats);
++ int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
+ /* Display ring */
+ void (*display_ring)(void *head, unsigned int size, bool rx);
+ /* set MSS via context descriptor */
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -258,7 +258,8 @@ static int dwmac4_rx_check_timestamp(voi
+ return ret;
+ }
+
+-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
++static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc,
++ u32 ats)
+ {
+ struct dma_desc *p = (struct dma_desc *)desc;
+ int ret = -EINVAL;
+@@ -270,7 +271,7 @@ static int dwmac4_wrback_get_rx_timestam
+
+ /* Check if timestamp is OK from context descriptor */
+ do {
+- ret = dwmac4_rx_check_timestamp(desc);
++ ret = dwmac4_rx_check_timestamp(next_desc);
+ if (ret < 0)
+ goto exit;
+ i++;
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void *
+ return ns;
+ }
+
+-static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats)
++static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc,
++ u32 ats)
+ {
+ if (ats) {
+ struct dma_extended_desc *p = (struct dma_extended_desc *)desc;
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *des
+ return ns;
+ }
+
+-static int ndesc_get_rx_timestamp_status(void *desc, u32 ats)
++static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)
+ {
+ struct dma_desc *p = (struct dma_desc *)desc;
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -489,7 +489,7 @@ static void stmmac_get_rx_hwtstamp(struc
+ desc = np;
+
+ /* Check if timestamp is available */
+- if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {
++ if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) {
+ ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
+ netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
+ shhwtstamp = skb_hwtstamps(skb);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Fredrik Hallenberg <megahallon@gmail.com>
+Date: Mon, 18 Dec 2017 23:33:59 +0100
+Subject: net: stmmac: Fix TX timestamp calculation
+
+From: Fredrik Hallenberg <megahallon@gmail.com>
+
+
+[ Upstream commit 200922c93f008e03ddc804c6dacdf26ca1ba86d7 ]
+
+When using GMAC4 the value written in PTP_SSIR should be shifted however
+the shifted value is also used in subsequent calculations which results
+in a bad timestamp value.
+
+Signed-off-by: Fredrik Hallenberg <megahallon@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -34,6 +34,7 @@ static u32 stmmac_config_sub_second_incr
+ {
+ u32 value = readl(ioaddr + PTP_TCR);
+ unsigned long data;
++ u32 reg_value;
+
+ /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
+ * formula = (1/ptp_clock) * 1000000000
+@@ -50,10 +51,11 @@ static u32 stmmac_config_sub_second_incr
+
+ data &= PTP_SSIR_SSINC_MASK;
+
++ reg_value = data;
+ if (gmac4)
+- data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
++ reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT;
+
+- writel(data, ioaddr + PTP_SSIR);
++ writel(reg_value, ioaddr + PTP_SSIR);
+
+ return data;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: "SZ Lin (林上智)" <sz.lin@moxa.com>
+Date: Fri, 29 Dec 2017 17:02:17 +0800
+Subject: NET: usb: qmi_wwan: add support for YUGA CLM920-NC5 PID 0x9625
+
+From: "SZ Lin (林上智)" <sz.lin@moxa.com>
+
+
+[ Upstream commit bd30ffc414e55194ed6149fad69a145550cb7c18 ]
+
+This patch adds support for PID 0x9625 of YUGA CLM920-NC5.
+
+YUGA CLM920-NC5 needs to enable QMI_WWAN_QUIRK_DTR before QMI operation.
+
+qmicli -d /dev/cdc-wdm0 -p --dms-get-revision
+[/dev/cdc-wdm0] Device revision retrieved:
+ Revision: 'CLM920_NC5-V1 1 [Oct 23 2016 19:00:00]'
+
+Signed-off-by: SZ Lin (林上智) <sz.lin@moxa.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1100,6 +1100,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
+ {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
+ {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
+ {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
+ {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */
+ {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Thu, 14 Dec 2017 16:56:14 +0100
+Subject: net: usb: qmi_wwan: add Telit ME910 PID 0x1101 support
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+
+[ Upstream commit c647c0d62c82eb3ddf78a0d8b3d58819d9f552aa ]
+
+This patch adds support for Telit ME910 PID 0x1101.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1211,6 +1211,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
+ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
++ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
+ {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 19 Dec 2017 12:01:21 +0100
+Subject: netfilter: nf_tables: fix chain filter in nf_tables_dump_rules()
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+
+[ Upstream commit 24c0df82ef7919e4d10cf2e4e65d368eb2e8ea21 ]
+
+ctx->chain may be null now that we have very large object names,
+so we cannot check for ctx->chain[0] here.
+
+Fixes: b7263e071aba7 ("netfilter: nf_tables: Allow table names of up to 255 chars")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Acked-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2072,7 +2072,7 @@ static int nf_tables_dump_rules(struct s
+ continue;
+
+ list_for_each_entry_rcu(chain, &table->chains, list) {
+- if (ctx && ctx->chain[0] &&
++ if (ctx && ctx->chain &&
+ strcmp(ctx->chain, chain->name) != 0)
+ continue;
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Hangbin Liu <liuhangbin@gmail.com>
+Date: Mon, 25 Dec 2017 11:34:54 +0800
+Subject: netfilter: nf_tables: fix potential NULL-ptr deref in nf_tables_dump_obj_done()
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+
+[ Upstream commit 8bea728dce8972e534e6b99fd550f7b5cc3864e8 ]
+
+If there is no NFTA_OBJ_TABLE and NFTA_OBJ_TYPE, the c.data will be NULL in
+nf_tables_getobj(). So before free filter->table in nf_tables_dump_obj_done(),
+we need to check if filter is NULL first.
+
+Fixes: e46abbcc05aa ("netfilter: nf_tables: Allow table names of up to 255 chars")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Acked-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/nf_tables_api.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -4596,8 +4596,10 @@ static int nf_tables_dump_obj_done(struc
+ {
+ struct nft_obj_filter *filter = cb->data;
+
+- kfree(filter->table);
+- kfree(filter);
++ if (filter) {
++ kfree(filter->table);
++ kfree(filter);
++ }
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 20 Dec 2017 12:08:33 +0100
+Subject: netfilter: uapi: correct UNTRACKED conntrack state bit number
+
+From: Florian Westphal <fw@strlen.de>
+
+
+[ Upstream commit 4c82fd0abb87e20d0d68ef5237e74732352806c8 ]
+
+nft_ct exposes this bit to userspace. This used to be
+
+ #define NF_CT_STATE_UNTRACKED_BIT (1 << (IP_CT_NUMBER + 1))
+ (IP_CT_NUMBER is 5, so this was 0x40)
+
+.. but this got changed to 8 (0x100) when the untracked object got removed.
+Replace this with a literal 6 to prevent further incompatible changes
+in case IP_CT_NUMBER ever increases.
+
+Fixes: cc41c84b7e7f2 ("netfilter: kill the fake untracked conntrack objects")
+Reported-by: Li Shuang <shuali@redhat.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/netfilter/nf_conntrack_common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/uapi/linux/netfilter/nf_conntrack_common.h
++++ b/include/uapi/linux/netfilter/nf_conntrack_common.h
+@@ -36,7 +36,7 @@ enum ip_conntrack_info {
+
+ #define NF_CT_STATE_INVALID_BIT (1 << 0)
+ #define NF_CT_STATE_BIT(ctinfo) (1 << ((ctinfo) % IP_CT_IS_REPLY + 1))
+-#define NF_CT_STATE_UNTRACKED_BIT (1 << (IP_CT_UNTRACKED + 1))
++#define NF_CT_STATE_UNTRACKED_BIT (1 << 6)
+
+ /* Bitset representing status of connection. */
+ enum ip_conntrack_status {
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Tue, 9 Jan 2018 18:14:28 -0800
+Subject: nfp: always unmask aux interrupts at init
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+
+[ Upstream commit fc2336505fb49a8b932a0a67a9745c408b79992c ]
+
+The link state and exception interrupts may be masked when we probe.
+The firmware should in theory prevent sending (and automasking) those
+interrupts if the device is disabled, but if my reading of the FW code
+is correct there are firmwares out there with race conditions in this
+area. The interrupt may also be masked if previous driver which used
+the device was malfunctioning and we didn't load the FW (there is no
+other good way to comprehensively reset the PF).
+
+Note that FW unmasks the data interrupts by itself when vNIC is
+enabled, such helpful operation is not performed for LSC/EXN interrupts.
+
+Always unmask the auxiliary interrupts after request_irq(). On the
+remove path add missing PCI write flush before free_irq().
+
+Fixes: 4c3523623dc0 ("net: add driver for Netronome NFP4000/NFP6000 NIC VFs")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+@@ -568,6 +568,7 @@ nfp_net_aux_irq_request(struct nfp_net *
+ return err;
+ }
+ nn_writeb(nn, ctrl_offset, entry->entry);
++ nfp_net_irq_unmask(nn, entry->entry);
+
+ return 0;
+ }
+@@ -582,6 +583,7 @@ static void nfp_net_aux_irq_free(struct
+ unsigned int vector_idx)
+ {
+ nn_writeb(nn, ctrl_offset, 0xff);
++ nn_pci_flush(nn);
+ free_irq(nn->irq_entries[vector_idx].vector, nn);
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Hao Chen <flank3rsky@gmail.com>
+Date: Wed, 3 Jan 2018 11:00:31 +0800
+Subject: nl80211: Check for the required netlink attribute presence
+
+From: Hao Chen <flank3rsky@gmail.com>
+
+
+[ Upstream commit 3ea15452ee85754f70f3b9fa1f23165ef2e77ba7 ]
+
+nl80211_nan_add_func() does not check if the required attribute
+NL80211_NAN_FUNC_FOLLOW_UP_DEST is present when processing
+NL80211_CMD_ADD_NAN_FUNCTION request. This request can be issued
+by users with CAP_NET_ADMIN privilege and may result in NULL dereference
+and a system crash. Add a check for the required attribute presence.
+
+Signed-off-by: Hao Chen <flank3rsky@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/wireless/nl80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11301,7 +11301,8 @@ static int nl80211_nan_add_func(struct s
+ break;
+ case NL80211_NAN_FUNC_FOLLOW_UP:
+ if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
+- !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
+ err = -EINVAL;
+ goto out;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Keith Busch <keith.busch@intel.com>
+Date: Thu, 14 Dec 2017 11:20:14 -0700
+Subject: nvme: check hw sectors before setting chunk sectors
+
+From: Keith Busch <keith.busch@intel.com>
+
+
+[ Upstream commit 249159c5f15812140fa216f9997d799ac0023a1f ]
+
+Some devices with IDs matching the "stripe" quirk don't actually have
+this quirk, and don't have an MDTS value. When MDTS is not set, the
+driver sets the max sectors to UINT_MAX, which is not a power of 2,
+hitting a BUG_ON from blk_queue_chunk_sectors. This patch skips setting
+chunk sectors for such devices.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1515,7 +1515,8 @@ static void nvme_set_queue_limits(struct
+ blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
+ blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
+ }
+- if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE)
++ if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) &&
++ is_power_of_2(ctrl->max_hw_sectors))
+ blk_queue_chunk_sectors(q, ctrl->max_hw_sectors);
+ blk_queue_virt_boundary(q, ctrl->page_size - 1);
+ if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Fri, 5 Jan 2018 12:44:06 -0500
+Subject: nvme-fabrics: initialize default host->id in nvmf_host_default()
+
+From: "Ewan D. Milne" <emilne@redhat.com>
+
+
+[ Upstream commit 6b018235b4daabae96d855219fae59c3fb8be417 ]
+
+The field was uninitialized before use.
+
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/fabrics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -74,6 +74,7 @@ static struct nvmf_host *nvmf_host_defau
+ return NULL;
+
+ kref_init(&host->ref);
++ uuid_gen(&host->id);
+ snprintf(host->nqn, NVMF_NQN_SIZE,
+ "nqn.2014-08.org.nvmexpress:uuid:%pUb", &host->id);
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Wed, 29 Nov 2017 15:11:37 -0800
+Subject: nvme-fc: remove double put reference if admin connect fails
+
+From: James Smart <jsmart2021@gmail.com>
+
+
+[ Upstream commit 4596e752db02d47038cd7c965419789ab15d1985 ]
+
+There are two put references in the failure case of initial
+create_association. The first put actually frees the controller, thus the
+second put references freed memory.
+
+Remove the unnecessary 2nd put.
+
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/fc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -2876,7 +2876,6 @@ nvme_fc_init_ctrl(struct device *dev, st
+
+ /* initiate nvme ctrl ref counting teardown */
+ nvme_uninit_ctrl(&ctrl->ctrl);
+- nvme_put_ctrl(&ctrl->ctrl);
+
+ /* Remove core ctrl ref. */
+ nvme_put_ctrl(&ctrl->ctrl);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Madalin Bucur <madalin.bucur@nxp.com>
+Date: Tue, 9 Jan 2018 14:43:34 +0200
+Subject: of_mdio: avoid MDIO bus removal when a PHY is missing
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+
+[ Upstream commit 95f566de0269a0c59fd6a737a147731302136429 ]
+
+If one of the child devices is missing the of_mdiobus_register_phy()
+call will return -ENODEV. When a missing device is encountered the
+registration of the remaining PHYs is stopped and the MDIO bus will
+fail to register. Propagate all errors except ENODEV to avoid it.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/of/of_mdio.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -228,7 +228,12 @@ int of_mdiobus_register(struct mii_bus *
+ rc = of_mdiobus_register_phy(mdio, child, addr);
+ else
+ rc = of_mdiobus_register_device(mdio, child, addr);
+- if (rc)
++
++ if (rc == -ENODEV)
++ dev_err(&mdio->dev,
++ "MDIO device at address %d is missing.\n",
++ addr);
++ else if (rc)
+ goto unregister;
+ }
+
+@@ -252,7 +257,7 @@ int of_mdiobus_register(struct mii_bus *
+
+ if (of_mdiobus_child_is_phy(child)) {
+ rc = of_mdiobus_register_phy(mdio, child, addr);
+- if (rc)
++ if (rc && rc != -ENODEV)
+ goto unregister;
+ }
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: John David Anglin <dave.anglin@bell.net>
+Date: Mon, 13 Nov 2017 19:35:33 -0500
+Subject: parisc: Reduce thread stack to 16 kb
+
+From: John David Anglin <dave.anglin@bell.net>
+
+
+[ Upstream commit da57c5414f49ef9e4bcb9ae0bbafd1d650b31411 ]
+
+In testing, I found that the thread stack can be 16 kB when using an irq
+stack. Without it, the thread stack needs to be 32 kB. Currently, the irq
+stack is 32 kB. While it probably could be 16 kB, I would prefer to leave it
+as is for safety.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/include/asm/thread_info.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/parisc/include/asm/thread_info.h
++++ b/arch/parisc/include/asm/thread_info.h
+@@ -35,7 +35,12 @@ struct thread_info {
+
+ /* thread information allocation */
+
++#ifdef CONFIG_IRQSTACKS
++#define THREAD_SIZE_ORDER 2 /* PA-RISC requires at least 16k stack */
++#else
+ #define THREAD_SIZE_ORDER 3 /* PA-RISC requires at least 32k stack */
++#endif
++
+ /* Be sure to hunt all references to this down when you change the size of
+ * the kernel stack */
+ #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 27 Dec 2017 19:45:31 +0100
+Subject: perf/x86/intel: Plug memory leak in intel_pmu_init()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+
+[ Upstream commit 7ad1437d6ace0e450a6c1167720608ad660b191d ]
+
+A recent commit introduced an extra merge_attr() call in the skylake
+branch, which causes a memory leak.
+
+Store the pointer to the extra allocated memory and free it at the end of
+the function.
+
+Fixes: a5df70c354c2 ("perf/x86: Only show format attributes when supported")
+Reported-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/intel/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -3847,6 +3847,8 @@ static struct attribute *intel_pmu_attrs
+
+ __init int intel_pmu_init(void)
+ {
++ struct attribute **extra_attr = NULL;
++ struct attribute **to_free = NULL;
+ union cpuid10_edx edx;
+ union cpuid10_eax eax;
+ union cpuid10_ebx ebx;
+@@ -3854,7 +3856,6 @@ __init int intel_pmu_init(void)
+ unsigned int unused;
+ struct extra_reg *er;
+ int version, i;
+- struct attribute **extra_attr = NULL;
+ char *name;
+
+ if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) {
+@@ -4294,6 +4295,7 @@ __init int intel_pmu_init(void)
+ extra_attr = boot_cpu_has(X86_FEATURE_RTM) ?
+ hsw_format_attr : nhm_format_attr;
+ extra_attr = merge_attr(extra_attr, skl_format_attr);
++ to_free = extra_attr;
+ x86_pmu.cpu_events = get_hsw_events_attrs();
+ intel_pmu_pebs_data_source_skl(
+ boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X);
+@@ -4401,6 +4403,7 @@ __init int intel_pmu_init(void)
+ pr_cont("full-width counters, ");
+ }
+
++ kfree(to_free);
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Date: Fri, 17 Nov 2017 16:55:35 +0530
+Subject: phy: cpcap-usb: Fix platform_get_irq_byname's error checking.
+
+From: Arvind Yadav <arvind.yadav.cs@gmail.com>
+
+
+[ Upstream commit e796cc6a3a9186c92092e2f5929cf8f65b56cf01 ]
+
+The platform_get_irq_byname() function returns negative if an error occurs.
+zero or positive number on success. platform_get_irq_byname() error
+checking for zero is not correct.
+
+Fixes: 6d6ce40f63af ("phy: cpcap-usb: Add CPCAP PMIC USB support")
+Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/motorola/phy-cpcap-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/motorola/phy-cpcap-usb.c
++++ b/drivers/phy/motorola/phy-cpcap-usb.c
+@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct pla
+ int irq, error;
+
+ irq = platform_get_irq_byname(pdev, name);
+- if (!irq)
++ if (irq < 0)
+ return -ENODEV;
+
+ error = devm_request_threaded_irq(ddata->dev, irq, NULL,
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Mon, 8 Jan 2018 14:54:32 +1100
+Subject: powerpc/pseries: Make RAS IRQ explicitly dependent on DLPAR WQ
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+
+[ Upstream commit e2d5915293ffdff977ddcfc12b817b08c53ffa7a ]
+
+The hotplug code uses its own workqueue to handle IRQ requests
+(pseries_hp_wq), however that workqueue is initialized after
+init_ras_IRQ(). That can lead to a kernel panic if any hotplug
+interrupts fire after init_ras_IRQ() but before pseries_hp_wq is
+initialised. eg:
+
+ UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes)
+ NET: Registered protocol family 1
+ Unpacking initramfs...
+ (qemu) object_add memory-backend-ram,id=mem1,size=10G
+ (qemu) device_add pc-dimm,id=dimm1,memdev=mem1
+ Unable to handle kernel paging request for data at address 0xf94d03007c421378
+ Faulting instruction address: 0xc00000000012d744
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE SMP NR_CPUS=2048 NUMA pSeries
+ Modules linked in:
+ CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc2-ziviani+ #26
+ task: (ptrval) task.stack: (ptrval)
+ NIP: c00000000012d744 LR: c00000000012d744 CTR: 0000000000000000
+ REGS: (ptrval) TRAP: 0380 Not tainted (4.15.0-rc2-ziviani+)
+ MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28088042 XER: 20040000
+ CFAR: c00000000012d3c4 SOFTE: 0
+ ...
+ NIP [c00000000012d744] __queue_work+0xd4/0x5c0
+ LR [c00000000012d744] __queue_work+0xd4/0x5c0
+ Call Trace:
+ [c0000000fffefb90] [c00000000012d744] __queue_work+0xd4/0x5c0 (unreliable)
+ [c0000000fffefc70] [c00000000012dce4] queue_work_on+0xb4/0xf0
+
+This commit makes the RAS IRQ registration explicitly dependent on the
+creation of the pseries_hp_wq.
+
+Reported-by: Min Deng <mdeng@redhat.com>
+Reported-by: Daniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
+Tested-by: Jose Ricardo Ziviani <joserz@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 21 ++++++++++++++++++---
+ arch/powerpc/platforms/pseries/pseries.h | 2 ++
+ arch/powerpc/platforms/pseries/ras.c | 3 ++-
+ 3 files changed, 22 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -586,11 +586,26 @@ static ssize_t dlpar_show(struct class *
+
+ static CLASS_ATTR_RW(dlpar);
+
+-static int __init pseries_dlpar_init(void)
++int __init dlpar_workqueue_init(void)
+ {
++ if (pseries_hp_wq)
++ return 0;
++
+ pseries_hp_wq = alloc_workqueue("pseries hotplug workqueue",
+- WQ_UNBOUND, 1);
++ WQ_UNBOUND, 1);
++
++ return pseries_hp_wq ? 0 : -ENOMEM;
++}
++
++static int __init dlpar_sysfs_init(void)
++{
++ int rc;
++
++ rc = dlpar_workqueue_init();
++ if (rc)
++ return rc;
++
+ return sysfs_create_file(kernel_kobj, &class_attr_dlpar.attr);
+ }
+-machine_device_initcall(pseries, pseries_dlpar_init);
++machine_device_initcall(pseries, dlpar_sysfs_init);
+
+--- a/arch/powerpc/platforms/pseries/pseries.h
++++ b/arch/powerpc/platforms/pseries/pseries.h
+@@ -98,4 +98,6 @@ static inline unsigned long cmo_get_page
+ return CMO_PageSize;
+ }
+
++int dlpar_workqueue_init(void);
++
+ #endif /* _PSERIES_PSERIES_H */
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -69,7 +69,8 @@ static int __init init_ras_IRQ(void)
+ /* Hotplug Events */
+ np = of_find_node_by_path("/event-sources/hot-plug-events");
+ if (np != NULL) {
+- request_event_sources_irqs(np, ras_hotplug_interrupt,
++ if (dlpar_workqueue_init() == 0)
++ request_event_sources_irqs(np, ras_hotplug_interrupt,
+ "RAS_HOTPLUG");
+ of_node_put(np);
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Mon, 1 Jan 2018 13:07:15 +0200
+Subject: RDMA/netlink: Fix locking around __ib_get_device_by_index
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+
+[ Upstream commit f8978bd95cf92f869f3d9b34c1b699f49253b8c6 ]
+
+Holding locks is mandatory when calling __ib_device_get_by_index,
+otherwise there are races during the list iteration with device removal.
+
+Since the locks are static to device.c, __ib_device_get_by_index can
+never be called correctly by any user out side the file.
+
+Make the function static and provide a safe function that gets the
+correct locks and returns a kref'd pointer. Fix all callers.
+
+Fixes: e5c9469efcb1 ("RDMA/netlink: Add nldev device doit implementation")
+Fixes: c3f66f7b0052 ("RDMA/netlink: Implement nldev port doit callback")
+Fixes: 7d02f605f0dc ("RDMA/netlink: Add nldev port dumpit implementation")
+Reviewed-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/core_priv.h | 2 -
+ drivers/infiniband/core/device.c | 18 +++++++++++-
+ drivers/infiniband/core/nldev.c | 54 ++++++++++++++++++++++++------------
+ 3 files changed, 54 insertions(+), 20 deletions(-)
+
+--- a/drivers/infiniband/core/core_priv.h
++++ b/drivers/infiniband/core/core_priv.h
+@@ -314,7 +314,7 @@ static inline int ib_mad_enforce_securit
+ }
+ #endif
+
+-struct ib_device *__ib_device_get_by_index(u32 ifindex);
++struct ib_device *ib_device_get_by_index(u32 ifindex);
+ /* RDMA device netlink */
+ void nldev_init(void);
+ void nldev_exit(void);
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -134,7 +134,7 @@ static int ib_device_check_mandatory(str
+ return 0;
+ }
+
+-struct ib_device *__ib_device_get_by_index(u32 index)
++static struct ib_device *__ib_device_get_by_index(u32 index)
+ {
+ struct ib_device *device;
+
+@@ -145,6 +145,22 @@ struct ib_device *__ib_device_get_by_ind
+ return NULL;
+ }
+
++/*
++ * Caller is responsible to return refrerence count by calling put_device()
++ */
++struct ib_device *ib_device_get_by_index(u32 index)
++{
++ struct ib_device *device;
++
++ down_read(&lists_rwsem);
++ device = __ib_device_get_by_index(index);
++ if (device)
++ get_device(&device->dev);
++
++ up_read(&lists_rwsem);
++ return device;
++}
++
+ static struct ib_device *__ib_device_get_by_name(const char *name)
+ {
+ struct ib_device *device;
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -142,27 +142,34 @@ static int nldev_get_doit(struct sk_buff
+
+ index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
+
+- device = __ib_device_get_by_index(index);
++ device = ib_device_get_by_index(index);
+ if (!device)
+ return -EINVAL;
+
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+- if (!msg)
+- return -ENOMEM;
++ if (!msg) {
++ err = -ENOMEM;
++ goto err;
++ }
+
+ nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
+ RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET),
+ 0, 0);
+
+ err = fill_dev_info(msg, device);
+- if (err) {
+- nlmsg_free(msg);
+- return err;
+- }
++ if (err)
++ goto err_free;
+
+ nlmsg_end(msg, nlh);
+
++ put_device(&device->dev);
+ return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
++
++err_free:
++ nlmsg_free(msg);
++err:
++ put_device(&device->dev);
++ return err;
+ }
+
+ static int _nldev_get_dumpit(struct ib_device *device,
+@@ -220,31 +227,40 @@ static int nldev_port_get_doit(struct sk
+ return -EINVAL;
+
+ index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
+- device = __ib_device_get_by_index(index);
++ device = ib_device_get_by_index(index);
+ if (!device)
+ return -EINVAL;
+
+ port = nla_get_u32(tb[RDMA_NLDEV_ATTR_PORT_INDEX]);
+- if (!rdma_is_port_valid(device, port))
+- return -EINVAL;
++ if (!rdma_is_port_valid(device, port)) {
++ err = -EINVAL;
++ goto err;
++ }
+
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+- if (!msg)
+- return -ENOMEM;
++ if (!msg) {
++ err = -ENOMEM;
++ goto err;
++ }
+
+ nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
+ RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET),
+ 0, 0);
+
+ err = fill_port_info(msg, device, port);
+- if (err) {
+- nlmsg_free(msg);
+- return err;
+- }
++ if (err)
++ goto err_free;
+
+ nlmsg_end(msg, nlh);
++ put_device(&device->dev);
+
+ return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
++
++err_free:
++ nlmsg_free(msg);
++err:
++ put_device(&device->dev);
++ return err;
+ }
+
+ static int nldev_port_get_dumpit(struct sk_buff *skb,
+@@ -265,7 +281,7 @@ static int nldev_port_get_dumpit(struct
+ return -EINVAL;
+
+ ifindex = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]);
+- device = __ib_device_get_by_index(ifindex);
++ device = ib_device_get_by_index(ifindex);
+ if (!device)
+ return -EINVAL;
+
+@@ -299,7 +315,9 @@ static int nldev_port_get_dumpit(struct
+ nlmsg_end(skb, nlh);
+ }
+
+-out: cb->args[0] = idx;
++out:
++ put_device(&device->dev);
++ cb->args[0] = idx;
+ return skb->len;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Bryan Tan <bryantan@vmware.com>
+Date: Wed, 20 Dec 2017 09:49:03 -0800
+Subject: RDMA/vmw_pvrdma: Call ib_umem_release on destroy QP path
+
+From: Bryan Tan <bryantan@vmware.com>
+
+
+[ Upstream commit 17748056ce123ee37fb7382bc698fc721e3c4a09 ]
+
+The QP cleanup did not previously call ib_umem_release,
+resulting in a user-triggerable kernel resource leak.
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Reviewed-by: Adit Ranadive <aditr@vmware.com>
+Reviewed-by: Aditya Sarwade <asarwade@vmware.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: Bryan Tan <bryantan@vmware.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+@@ -406,6 +406,13 @@ static void pvrdma_free_qp(struct pvrdma
+ atomic_dec(&qp->refcnt);
+ wait_event(qp->wait, !atomic_read(&qp->refcnt));
+
++ if (!qp->is_kernel) {
++ if (qp->rumem)
++ ib_umem_release(qp->rumem);
++ if (qp->sumem)
++ ib_umem_release(qp->sumem);
++ }
++
+ pvrdma_page_dir_cleanup(dev, &qp->pdir);
+
+ kfree(qp);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Wed, 6 Dec 2017 10:30:39 +0100
+Subject: s390/dasd: fix wrongly assigned configuration data
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+
+[ Upstream commit 8a9bd4f8ebc6800bfc0596e28631ff6809a2f615 ]
+
+We store per path and per device configuration data to identify the
+path or device correctly. The per path configuration data might get
+mixed up if the original request gets into error recovery and is
+started with a random path mask.
+
+This would lead to a wrong identification of a path in case of a CUIR
+event for example.
+
+Fix by copying the path mask from the original request to the error
+recovery request in case it is a path verification request.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd_3990_erp.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/s390/block/dasd_3990_erp.c
++++ b/drivers/s390/block/dasd_3990_erp.c
+@@ -2803,6 +2803,16 @@ dasd_3990_erp_action(struct dasd_ccw_req
+ erp = dasd_3990_erp_handle_match_erp(cqr, erp);
+ }
+
++
++ /*
++ * For path verification work we need to stick with the path that was
++ * originally chosen so that the per path configuration data is
++ * assigned correctly.
++ */
++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) {
++ erp->lpm = cqr->lpm;
++ }
++
+ if (device->features & DASD_FEATURE_ERPLOG) {
+ /* print current erp_chain */
+ dev_err(&device->cdev->dev,
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Prasad B Munirathnam <prasad.munirathnam@microsemi.com>
+Date: Tue, 12 Dec 2017 11:40:10 -0800
+Subject: scsi: aacraid: Fix I/O drop during reset
+
+From: Prasad B Munirathnam <prasad.munirathnam@microsemi.com>
+
+
+[ Upstream commit 5771cfffdffe709ae9b403b6f80438ca40bf850e ]
+
+"FIB_CONTEXT_FLAG_TIMEDOUT" flag is set in aac_eh_abort to indicate
+command timeout. Using the same flag in reset handler causes the command
+to time out and the I/Os were dropped.
+
+Define a new flag "FIB_CONTEXT_FLAG_EH_RESET" to make sure I/O is
+properly handled in eh_reset handler.
+
+[mkp: tweaked commit message]
+
+Signed-off-by: Prasad B Munirathnam <prasad.munirathnam@microsemi.com>
+Reviewed-by: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/aacraid/aacraid.h | 1 +
+ drivers/scsi/aacraid/linit.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/aacraid/aacraid.h
++++ b/drivers/scsi/aacraid/aacraid.h
+@@ -1724,6 +1724,7 @@ struct aac_dev
+ #define FIB_CONTEXT_FLAG_NATIVE_HBA (0x00000010)
+ #define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020)
+ #define FIB_CONTEXT_FLAG_SCSI_CMD (0x00000040)
++#define FIB_CONTEXT_FLAG_EH_RESET (0x00000080)
+
+ /*
+ * Define the command values
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_
+ info = &aac->hba_map[bus][cid];
+ if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS ||
+ info->devtype != AAC_DEVTYPE_NATIVE_RAW) {
+- fib->flags |= FIB_CONTEXT_FLAG_TIMED_OUT;
++ fib->flags |= FIB_CONTEXT_FLAG_EH_RESET;
+ cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER;
+ }
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Cathy Avery <cavery@redhat.com>
+Date: Tue, 19 Dec 2017 13:32:48 -0500
+Subject: scsi: storvsc: Fix scsi_cmd error assignments in storvsc_handle_error
+
+From: Cathy Avery <cavery@redhat.com>
+
+
+[ Upstream commit d1b8b2391c24751e44f618fcf86fb55d9a9247fd ]
+
+When an I/O is returned with an srb_status of SRB_STATUS_INVALID_LUN
+which has zero good_bytes it must be assigned an error. Otherwise the
+I/O will be continuously requeued and will cause a deadlock in the case
+where disks are being hot added and removed. sd_probe_async will wait
+forever for its I/O to complete while holding scsi_sd_probe_domain.
+
+Also returning the default error of DID_TARGET_FAILURE causes multipath
+to not retry the I/O resulting in applications receiving I/O errors
+before a failover can occur.
+
+Signed-off-by: Cathy Avery <cavery@redhat.com>
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/storvsc_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -952,10 +952,11 @@ static void storvsc_handle_error(struct
+ case TEST_UNIT_READY:
+ break;
+ default:
+- set_host_byte(scmnd, DID_TARGET_FAILURE);
++ set_host_byte(scmnd, DID_ERROR);
+ }
+ break;
+ case SRB_STATUS_INVALID_LUN:
++ set_host_byte(scmnd, DID_NO_CONNECT);
+ do_work = true;
+ process_err_fn = storvsc_remove_lun;
+ break;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Mon, 8 Jan 2018 19:02:28 -0200
+Subject: sctp: add a ceiling to optlen in some sockopts
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+
+[ Upstream commit 5960cefab9df76600a1a7d4ff592c59e14616e88 ]
+
+Hangbin Liu reported that some sockopt calls could cause the kernel to log
+a warning on memory allocation failure if the user supplied a large optlen
+value. That is because some of them called memdup_user() without a ceiling
+on optlen, allowing it to try to allocate really large buffers.
+
+This patch adds a ceiling by limiting optlen to the maximum allowed that
+would still make sense for these sockopt.
+
+Reported-by: Hangbin Liu <haliu@redhat.com>
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3494,6 +3494,8 @@ static int sctp_setsockopt_hmac_ident(st
+
+ if (optlen < sizeof(struct sctp_hmacalgo))
+ return -EINVAL;
++ optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) +
++ SCTP_AUTH_NUM_HMACS * sizeof(u16));
+
+ hmacs = memdup_user(optval, optlen);
+ if (IS_ERR(hmacs))
+@@ -3532,6 +3534,11 @@ static int sctp_setsockopt_auth_key(stru
+
+ if (optlen <= sizeof(struct sctp_authkey))
+ return -EINVAL;
++ /* authkey->sca_keylength is u16, so optlen can't be bigger than
++ * this.
++ */
++ optlen = min_t(unsigned int, optlen, USHRT_MAX +
++ sizeof(struct sctp_authkey));
+
+ authkey = memdup_user(optval, optlen);
+ if (IS_ERR(authkey))
+@@ -3889,6 +3896,9 @@ static int sctp_setsockopt_reset_streams
+
+ if (optlen < sizeof(*params))
+ return -EINVAL;
++ /* srs_number_streams is u16, so optlen can't be bigger than this. */
++ optlen = min_t(unsigned int, optlen, USHRT_MAX +
++ sizeof(__u16) * sizeof(*params));
+
+ params = memdup_user(optval, optlen);
+ if (IS_ERR(params))
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 18 Dec 2017 14:07:25 +0800
+Subject: sctp: fix the issue that a __u16 variable may overflow in sctp_ulpq_renege
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit 5c468674d17056148da06218d4da5d04baf22eac ]
+
+Now when reneging events in sctp_ulpq_renege(), the variable freed
+could be increased by a __u16 value twice while freed is of __u16
+type. It means freed may overflow at the second addition.
+
+This patch is to fix it by using __u32 type for 'freed', while at
+it, also to remove 'if (chunk)' check, as all renege commands are
+generated in sctp_eat_data and it can't be NULL.
+
+Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/ulpqueue.c | 24 ++++++++----------------
+ 1 file changed, 8 insertions(+), 16 deletions(-)
+
+--- a/net/sctp/ulpqueue.c
++++ b/net/sctp/ulpqueue.c
+@@ -1084,29 +1084,21 @@ void sctp_ulpq_partial_delivery(struct s
+ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
+ gfp_t gfp)
+ {
+- struct sctp_association *asoc;
+- __u16 needed, freed;
++ struct sctp_association *asoc = ulpq->asoc;
++ __u32 freed = 0;
++ __u16 needed;
+
+- asoc = ulpq->asoc;
+-
+- if (chunk) {
+- needed = ntohs(chunk->chunk_hdr->length);
+- needed -= sizeof(struct sctp_data_chunk);
+- } else
+- needed = SCTP_DEFAULT_MAXWINDOW;
+-
+- freed = 0;
++ needed = ntohs(chunk->chunk_hdr->length) -
++ sizeof(struct sctp_data_chunk);
+
+ if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) {
+ freed = sctp_ulpq_renege_order(ulpq, needed);
+- if (freed < needed) {
++ if (freed < needed)
+ freed += sctp_ulpq_renege_frags(ulpq, needed - freed);
+- }
+ }
+ /* If able to free enough room, accept this chunk. */
+- if (chunk && (freed >= needed)) {
+- int retval;
+- retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
++ if (freed >= needed) {
++ int retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
+ /*
+ * Enter partial delivery if chunk has not been
+ * delivered; otherwise, drain the reassembly queue.
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Mon, 8 Jan 2018 19:02:29 -0200
+Subject: sctp: make use of pre-calculated len
+
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+
+
+[ Upstream commit c76f97c99ae6d26d14c7f0e50e074382bfbc9f98 ]
+
+Some sockopt handling functions were calculating the length of the
+buffer to be written to userspace and then calculating it again when
+actually writing the buffer, which could lead to some write not using
+an up-to-date length.
+
+This patch updates such places to just make use of the len variable.
+
+Also, replace some sizeof(type) to sizeof(var).
+
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4957,7 +4957,7 @@ static int sctp_getsockopt_autoclose(str
+ len = sizeof(int);
+ if (put_user(len, optlen))
+ return -EFAULT;
+- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
+ return -EFAULT;
+ return 0;
+ }
+@@ -5588,6 +5588,9 @@ copy_getaddrs:
+ err = -EFAULT;
+ goto out;
+ }
++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
++ * but we can't change it anymore.
++ */
+ if (put_user(bytes_copied, optlen))
+ err = -EFAULT;
+ out:
+@@ -6024,7 +6027,7 @@ static int sctp_getsockopt_maxseg(struct
+ params.assoc_id = 0;
+ } else if (len >= sizeof(struct sctp_assoc_value)) {
+ len = sizeof(struct sctp_assoc_value);
+- if (copy_from_user(¶ms, optval, sizeof(params)))
++ if (copy_from_user(¶ms, optval, len))
+ return -EFAULT;
+ } else
+ return -EINVAL;
+@@ -6194,7 +6197,9 @@ static int sctp_getsockopt_active_key(st
+
+ if (len < sizeof(struct sctp_authkeyid))
+ return -EINVAL;
+- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
++
++ len = sizeof(struct sctp_authkeyid);
++ if (copy_from_user(&val, optval, len))
+ return -EFAULT;
+
+ asoc = sctp_id2assoc(sk, val.scact_assoc_id);
+@@ -6206,7 +6211,6 @@ static int sctp_getsockopt_active_key(st
+ else
+ val.scact_keynumber = ep->active_key_id;
+
+- len = sizeof(struct sctp_authkeyid);
+ if (put_user(len, optlen))
+ return -EFAULT;
+ if (copy_to_user(optval, &val, len))
+@@ -6232,7 +6236,7 @@ static int sctp_getsockopt_peer_auth_chu
+ if (len < sizeof(struct sctp_authchunks))
+ return -EINVAL;
+
+- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
++ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+ to = p->gauth_chunks;
+@@ -6277,7 +6281,7 @@ static int sctp_getsockopt_local_auth_ch
+ if (len < sizeof(struct sctp_authchunks))
+ return -EINVAL;
+
+- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
++ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+ to = p->gauth_chunks;
hrtimer-ensure-posix-compliance-relative-clock_realtime-hrtimers.patch
+net-phy-fix-resume-handling.patch
+exec-avoid-gcc-8-warning-for-get_task_comm.patch
+mm-frame_vector.c-release-a-semaphore-in-get_vaddr_frames.patch
+scsi-aacraid-fix-i-o-drop-during-reset.patch
+dmaengine-fsl-edma-disable-clks-on-all-error-paths.patch
+phy-cpcap-usb-fix-platform_get_irq_byname-s-error-checking.patch
+nvme-fc-remove-double-put-reference-if-admin-connect-fails.patch
+nvme-check-hw-sectors-before-setting-chunk-sectors.patch
+net-aquantia-fix-actual-speed-capabilities-reporting.patch
+net-aquantia-fix-hardware-dma-stream-overload-on-large-mrrs.patch
+net-usb-qmi_wwan-add-telit-me910-pid-0x1101-support.patch
+mtd-nand-gpmi-fix-failure-when-a-erased-page-has-a-bitflip-at-bbm.patch
+mtd-nand-brcmnand-zero-bitflip-is-not-an-error.patch
+ipv6-icmp6-allow-icmp-messages-to-be-looped-back.patch
+parisc-reduce-thread-stack-to-16-kb.patch
+arm-8731-1-fix-csum_partial_copy_from_user-stack-mismatch.patch
+x86-asm-allow-again-using-asm.h-when-building-for-the-bpf-clang-target.patch
+sctp-fix-the-issue-that-a-__u16-variable-may-overflow-in-sctp_ulpq_renege.patch
+sget-handle-failures-of-register_shrinker.patch
+net-phy-xgene-disable-clk-on-error-paths.patch
+drm-nouveau-pci-do-a-msi-rearm-on-init.patch
+xfrm-reinject-transport-mode-packets-through-tasklet.patch
+x86-stacktrace-make-zombie-stack-traces-reliable.patch
+mac80211_hwsim-fix-a-possible-sleep-in-atomic-bug-in-hwsim_get_radio_nl.patch
+spi-atmel-fixed-spin_lock-usage-inside-atmel_spi_remove.patch
+asoc-nau8825-fix-issue-that-pop-noise-when-start-capture.patch
+cgroup-fix-deadlock-in-cpu-hotplug-path.patch
+staging-ion-fix-ion_cma_heap-allocations.patch
+x86-64-xen-eliminate-w-x-mappings.patch
+net-mediatek-setup-proper-state-for-disabled-gmac-on-the-default.patch
+net-arc_emac-fix-arc_emac_rx-error-paths.patch
+vxlan-update-skb-dst-pmtu-on-tx-path.patch
+ip_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch
+ip6_gre-remove-the-incorrect-mtu-limit-for-ipgre-tap.patch
+ip6_tunnel-get-the-min-mtu-properly-in-ip6_tnl_xmit.patch
+net-stmmac-fix-tx-timestamp-calculation.patch
+net-stmmac-fix-bad-rx-timestamp-extraction.patch
+net-mlx5e-fix-ets-bw-check.patch
+net-mlx5-cleanup-irqs-in-case-of-unload-failure.patch
+net-mlx5-stay-in-polling-mode-when-command-eq-destroy-fails.patch
+asoc-rsnd-fixup-adg-register-mask.patch
+xen-balloon-mark-unallocated-host-memory-as-unusable.patch
+netfilter-nf_tables-fix-chain-filter-in-nf_tables_dump_rules.patch
+scsi-storvsc-fix-scsi_cmd-error-assignments-in-storvsc_handle_error.patch
+netfilter-uapi-correct-untracked-conntrack-state-bit-number.patch
+i915-reject-ccs-modifiers-for-pipe-c-on-geminilake.patch
+rdma-vmw_pvrdma-call-ib_umem_release-on-destroy-qp-path.patch
+arm-dts-ls1021a-fix-incorrect-clock-references.patch
+crypto-af_alg-fix-race-around-ctx-rcvused-by-making-it-atomic_t.patch
+lib-mpi-fix-umul_ppmm-for-mips64r6.patch
+arm64-dts-renesas-ulcb-remove-renesas-no-ether-link-property.patch
+crypto-inside-secure-per-request-invalidation.patch
+crypto-inside-secure-free-requests-even-if-their-handling-failed.patch
+crypto-inside-secure-fix-request-allocations-in-invalidation-path.patch
+netfilter-nf_tables-fix-potential-null-ptr-deref-in-nf_tables_dump_obj_done.patch
+tipc-error-path-leak-fixes-in-tipc_enable_bearer.patch
+tipc-fix-tipc_mon_delete-oops-in-tipc_enable_bearer-error-path.patch
+tg3-add-workaround-to-restrict-5762-mrrs-to-2048.patch
+tg3-enable-phy-reset-in-mtu-change-path-for-5720.patch
+bnx2x-improve-reliability-in-case-of-nested-pci-errors.patch
+perf-x86-intel-plug-memory-leak-in-intel_pmu_init.patch
+led-core-fix-brightness-setting-when-setting-delay_off-0.patch
+ib-mlx5-fix-mlx5_ib_alloc_mr-error-flow.patch
+genirq-guard-handle_bad_irq-log-messages.patch
+afs-fix-missing-error-handling-in-afs_write_end.patch
+s390-dasd-fix-wrongly-assigned-configuration-data.patch
+btrfs-fix-flush-bio-leak.patch
+ip6_tunnel-allow-ip6gre-dev-mtu-to-be-set-below-1280.patch
+input-xen-kbdfront-do-not-advertise-multi-touch-pressure-support.patch
+ib-mlx4-fix-mlx4_ib_alloc_mr-error-flow.patch
+ib-ipoib-fix-race-condition-in-neigh-creation.patch
+xfs-quota-fix-missed-destroy-of-qi_tree_lock.patch
+xfs-quota-check-result-of-register_shrinker.patch
+macvlan-fix-one-possible-double-free.patch
+e1000-fix-disabling-already-disabled-warning.patch
+net-usb-qmi_wwan-add-support-for-yuga-clm920-nc5-pid-0x9625.patch
+drm-ttm-check-the-return-value-of-kzalloc.patch
+rdma-netlink-fix-locking-around-__ib_get_device_by_index.patch
+x86-efi-fix-kernel-param-add_efi_memmap-regression.patch
+uapi-libc-compat-add-fallback-for-unsupported-libcs.patch
+i40e-i40evf-account-for-frags-split-over-multiple-descriptors-in-check-linearize.patch
+i40e-don-t-remove-netdev-dev_addr-when-syncing-uc-list.patch
+net-ena-unmask-msi-x-only-after-device-initialization-is-completed.patch
+nl80211-check-for-the-required-netlink-attribute-presence.patch
+mac80211-mesh-drop-frames-appearing-to-be-from-us.patch
+can-flex_can-correct-the-checking-for-frame-length-in-flexcan_start_xmit.patch
+wcn36xx-fix-dynamic-power-saving.patch
+block-drain-queue-before-waiting-for-q_usage_counter-becoming-zero.patch
+ia64-sched-cputime-fix-build-error-if-config_virt_cpu_accounting_native-y.patch
+bpf-sockmap-missing-null-psock-check.patch
+leds-core-fix-regression-caused-by-commit-2b83ff96f51d.patch
+powerpc-pseries-make-ras-irq-explicitly-dependent-on-dlpar-wq.patch
+nvme-fabrics-initialize-default-host-id-in-nvmf_host_default.patch
+x86-platform-intel-mid-revert-make-bt_sfi_data-const.patch
+bnxt_en-fix-population-of-flow_type-in-bnxt_hwrm_cfa_flow_alloc.patch
+bnxt_en-fix-the-invalid-vf-id-check-in-bnxt_vf_ndo_prep-routine.patch
+xen-netfront-enable-device-after-manual-module-load.patch
+mdio-sun4i-fix-a-memory-leak.patch
+solutionengine771x-fix-ether-platform-data.patch
+xen-gntdev-fix-off-by-one-error-when-unmapping-with-holes.patch
+xen-gntdev-fix-partial-gntdev_mmap-cleanup.patch
+sctp-add-a-ceiling-to-optlen-in-some-sockopts.patch
+sctp-make-use-of-pre-calculated-len.patch
+net-gianfar_ptp-move-set_fipers-to-spinlock-protecting-area.patch
+of_mdio-avoid-mdio-bus-removal-when-a-phy-is-missing.patch
+nfp-always-unmask-aux-interrupts-at-init.patch
+mlxsw-pci-wait-after-reset-before-accessing-hw.patch
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 18 Dec 2017 15:05:07 -0500
+Subject: sget(): handle failures of register_shrinker()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+
+[ Upstream commit 9ee332d99e4d5a97548943b81c54668450ce641b ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/super.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -522,7 +522,11 @@ retry:
+ hlist_add_head(&s->s_instances, &type->fs_supers);
+ spin_unlock(&sb_lock);
+ get_filesystem(type);
+- register_shrinker(&s->s_shrink);
++ err = register_shrinker(&s->s_shrink);
++ if (err) {
++ deactivate_locked_super(s);
++ s = ERR_PTR(err);
++ }
+ return s;
+ }
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Sat, 6 Jan 2018 21:53:26 +0300
+Subject: SolutionEngine771x: fix Ether platform data
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+
+[ Upstream commit 195e2addbce09e5afbc766efc1e6567c9ce840d3 ]
+
+The 'sh_eth' driver's probe() method would fail on the SolutionEngine7710
+board and crash on SolutionEngine7712 board as the platform code is
+hopelessly behind the driver's platform data -- it passes the PHY address
+instead of 'struct sh_eth_plat_data *'; pass the latter to the driver in
+order to fix the bug...
+
+Fixes: 71557a37adb5 ("[netdrvr] sh_eth: Add SH7619 support")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/sh/boards/mach-se/770x/setup.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/sh/boards/mach-se/770x/setup.c
++++ b/arch/sh/boards/mach-se/770x/setup.c
+@@ -9,6 +9,7 @@
+ */
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
++#include <linux/sh_eth.h>
+ #include <mach-se/mach/se.h>
+ #include <mach-se/mach/mrshpc.h>
+ #include <asm/machvec.h>
+@@ -115,6 +116,11 @@ static struct platform_device heartbeat_
+ #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\
+ defined(CONFIG_CPU_SUBTYPE_SH7712)
+ /* SH771X Ethernet driver */
++static struct sh_eth_plat_data sh_eth_plat = {
++ .phy = PHY_ID,
++ .phy_interface = PHY_INTERFACE_MODE_MII,
++};
++
+ static struct resource sh_eth0_resources[] = {
+ [0] = {
+ .start = SH_ETH0_BASE,
+@@ -132,7 +138,7 @@ static struct platform_device sh_eth0_de
+ .name = "sh771x-ether",
+ .id = 0,
+ .dev = {
+- .platform_data = PHY_ID,
++ .platform_data = &sh_eth_plat,
+ },
+ .num_resources = ARRAY_SIZE(sh_eth0_resources),
+ .resource = sh_eth0_resources,
+@@ -155,7 +161,7 @@ static struct platform_device sh_eth1_de
+ .name = "sh771x-ether",
+ .id = 1,
+ .dev = {
+- .platform_data = PHY_ID,
++ .platform_data = &sh_eth_plat,
+ },
+ .num_resources = ARRAY_SIZE(sh_eth1_resources),
+ .resource = sh_eth1_resources,
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Radu Pirea <radu.pirea@microchip.com>
+Date: Fri, 15 Dec 2017 17:40:17 +0200
+Subject: spi: atmel: fixed spin_lock usage inside atmel_spi_remove
+
+From: Radu Pirea <radu.pirea@microchip.com>
+
+
+[ Upstream commit 66e900a3d225575c8b48b59ae1fe74bb6e5a65cc ]
+
+The only part of atmel_spi_remove which needs to be atomic is hardware
+reset.
+
+atmel_spi_stop_dma calls dma_terminate_all and this needs interrupts
+enabled.
+atmel_spi_release_dma calls dma_release_channel and dma_release_channel
+locks a mutex inside of spin_lock.
+
+So the call of these functions can't be inside a spin_lock.
+
+Reported-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Radu Pirea <radu.pirea@microchip.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-atmel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1661,12 +1661,12 @@ static int atmel_spi_remove(struct platf
+ pm_runtime_get_sync(&pdev->dev);
+
+ /* reset the hardware and block queue progress */
+- spin_lock_irq(&as->lock);
+ if (as->use_dma) {
+ atmel_spi_stop_dma(master);
+ atmel_spi_release_dma(master);
+ }
+
++ spin_lock_irq(&as->lock);
+ spi_writel(as, CR, SPI_BIT(SWRST));
+ spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
+ spi_readl(as, SR);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: John Stultz <john.stultz@linaro.org>
+Date: Fri, 15 Dec 2017 19:59:47 -0800
+Subject: staging: ion: Fix ion_cma_heap allocations
+
+From: John Stultz <john.stultz@linaro.org>
+
+
+[ Upstream commit f292b9b28097d8fe870336108e91bd95a14294bf ]
+
+In trying to add support for drm_hwcomposer to HiKey,
+I've needed to utilize the ION CMA heap, and I've noticed
+problems with allocations on newer kernels failing.
+
+It seems back with 204f672255c2 ("ion: Use CMA APIs directly"),
+the ion_cma_heap code was modified to use the CMA API, but
+kept the arguments as buffer lengths rather then number of pages.
+
+This results in errors as we don't have enough pages in CMA to
+satisfy the exaggerated requests.
+
+This patch converts the ion_cma_heap CMA API usage to properly
+request pages.
+
+It also fixes a minor issue in the allocation where in the error
+path, the cma_release is called with the buffer->size value which
+hasn't yet been set.
+
+Cc: Laura Abbott <labbott@redhat.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Cc: Archit Taneja <architt@codeaurora.org>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Dmitry Shmidt <dimitrysh@google.com>
+Cc: Todd Kjos <tkjos@google.com>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly")
+Acked-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/android/ion/Kconfig | 2 +-
+ drivers/staging/android/ion/ion_cma_heap.c | 15 +++++++++++----
+ 2 files changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/android/ion/Kconfig
++++ b/drivers/staging/android/ion/Kconfig
+@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP
+
+ config ION_CMA_HEAP
+ bool "Ion CMA heap support"
+- depends on ION && CMA
++ depends on ION && DMA_CMA
+ help
+ Choose this option to enable CMA heaps with Ion. This heap is backed
+ by the Contiguous Memory Allocator (CMA). If your system has these
+--- a/drivers/staging/android/ion/ion_cma_heap.c
++++ b/drivers/staging/android/ion/ion_cma_heap.c
+@@ -39,9 +39,15 @@ static int ion_cma_allocate(struct ion_h
+ struct ion_cma_heap *cma_heap = to_cma_heap(heap);
+ struct sg_table *table;
+ struct page *pages;
++ unsigned long size = PAGE_ALIGN(len);
++ unsigned long nr_pages = size >> PAGE_SHIFT;
++ unsigned long align = get_order(size);
+ int ret;
+
+- pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL);
++ if (align > CONFIG_CMA_ALIGNMENT)
++ align = CONFIG_CMA_ALIGNMENT;
++
++ pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL);
+ if (!pages)
+ return -ENOMEM;
+
+@@ -53,7 +59,7 @@ static int ion_cma_allocate(struct ion_h
+ if (ret)
+ goto free_mem;
+
+- sg_set_page(table->sgl, pages, len, 0);
++ sg_set_page(table->sgl, pages, size, 0);
+
+ buffer->priv_virt = pages;
+ buffer->sg_table = table;
+@@ -62,7 +68,7 @@ static int ion_cma_allocate(struct ion_h
+ free_mem:
+ kfree(table);
+ err:
+- cma_release(cma_heap->cma, pages, buffer->size);
++ cma_release(cma_heap->cma, pages, nr_pages);
+ return -ENOMEM;
+ }
+
+@@ -70,9 +76,10 @@ static void ion_cma_free(struct ion_buff
+ {
+ struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap);
+ struct page *pages = buffer->priv_virt;
++ unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT;
+
+ /* release memory */
+- cma_release(cma_heap->cma, pages, buffer->size);
++ cma_release(cma_heap->cma, pages, nr_pages);
+ /* release sg table */
+ sg_free_table(buffer->sg_table);
+ kfree(buffer->sg_table);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Date: Fri, 22 Dec 2017 16:05:28 +0530
+Subject: tg3: Add workaround to restrict 5762 MRRS to 2048
+
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+
+
+[ Upstream commit 4419bb1cedcda0272e1dc410345c5a1d1da0e367 ]
+
+One of AMD based server with 5762 hangs with jumbo frame traffic.
+This AMD platform has southbridge limitation which is restricting MRRS
+to 4000. As a work around, driver to restricts the MRRS to 2048 for
+this particular 5762 NX1 card.
+
+Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 10 ++++++++++
+ drivers/net/ethernet/broadcom/tg3.h | 4 ++++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10052,6 +10052,16 @@ static int tg3_reset_hw(struct tg3 *tp,
+
+ tw32(GRC_MODE, tp->grc_mode | val);
+
++ /* On one of the AMD platform, MRRS is restricted to 4000 because of
++ * south bridge limitation. As a workaround, Driver is setting MRRS
++ * to 2048 instead of default 4096.
++ */
++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
++ }
++
+ /* Setup the timer prescalar register. Clock is always 66Mhz. */
+ val = tr32(GRC_MISC_CFG);
+ val &= ~0xff;
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -96,6 +96,7 @@
+ #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106
+ #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109
+ #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a
++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0
+ #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ
+ #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c
+ #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a
+@@ -281,6 +282,9 @@
+ #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */
+ #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */
+ /* 0xa8 --> 0xb8 unused */
++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4
++#define MAX_READ_REQ_SIZE_2048 0x00004000
++#define MAX_READ_REQ_MASK 0x00007000
+ #define TG3PCI_DUAL_MAC_CTRL 0x000000b8
+ #define DUAL_MAC_CTRL_CH_MASK 0x00000003
+ #define DUAL_MAC_CTRL_ID 0x00000004
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Date: Fri, 22 Dec 2017 16:05:29 +0530
+Subject: tg3: Enable PHY reset in MTU change path for 5720
+
+From: Siva Reddy Kallam <siva.kallam@broadcom.com>
+
+
+[ Upstream commit e60ee41aaf898584205a6af5c996860d0fe6a836 ]
+
+A customer noticed RX path hang when MTU is changed on the fly while
+running heavy traffic with NCSI enabled for 5717 and 5719. Since 5720
+belongs to same ASIC family, we observed same issue and same fix
+could solve this problem for 5720.
+
+Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -14239,7 +14239,8 @@ static int tg3_change_mtu(struct net_dev
+ */
+ if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
+ tg3_asic_rev(tp) == ASIC_REV_5717 ||
+- tg3_asic_rev(tp) == ASIC_REV_5719)
++ tg3_asic_rev(tp) == ASIC_REV_5719 ||
++ tg3_asic_rev(tp) == ASIC_REV_5720)
+ reset_phy = true;
+
+ err = tg3_restart_hw(tp, reset_phy);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+Date: Fri, 22 Dec 2017 09:35:16 +0200
+Subject: tipc: error path leak fixes in tipc_enable_bearer()
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+
+[ Upstream commit 19142551b2be4a9e13838099fde1351386e5e007 ]
+
+Fix memory leak in tipc_enable_bearer() if enable_media() fails, and
+cleanup with bearer_disable() if tipc_mon_create() fails.
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/bearer.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -324,6 +324,7 @@ restart:
+ if (res) {
+ pr_warn("Bearer <%s> rejected, enable failure (%d)\n",
+ name, -res);
++ kfree(b);
+ return -EINVAL;
+ }
+
+@@ -347,8 +348,10 @@ restart:
+ if (skb)
+ tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
+
+- if (tipc_mon_create(net, bearer_id))
++ if (tipc_mon_create(net, bearer_id)) {
++ bearer_disable(net, b);
+ return -ENOMEM;
++ }
+
+ pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n",
+ name,
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+Date: Fri, 22 Dec 2017 09:35:17 +0200
+Subject: tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+
+[ Upstream commit 642a8439ddd8423b92f2e71960afe21ee1f66bb6 ]
+
+Calling tipc_mon_delete() before the monitor has been created will oops.
+This can happen in tipc_enable_bearer() error path if tipc_disc_create()
+fails.
+
+[ 48.589074] BUG: unable to handle kernel paging request at 0000000000001008
+[ 48.590266] IP: tipc_mon_delete+0xea/0x270 [tipc]
+[ 48.591223] PGD 1e60c5067 P4D 1e60c5067 PUD 1eb0cf067 PMD 0
+[ 48.592230] Oops: 0000 [#1] SMP KASAN
+[ 48.595610] CPU: 5 PID: 1199 Comm: tipc Tainted: G B 4.15.0-rc4-pc64-dirty #5
+[ 48.597176] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
+[ 48.598489] RIP: 0010:tipc_mon_delete+0xea/0x270 [tipc]
+[ 48.599347] RSP: 0018:ffff8801d827f668 EFLAGS: 00010282
+[ 48.600705] RAX: ffff8801ee813f00 RBX: 0000000000000204 RCX: 0000000000000000
+[ 48.602183] RDX: 1ffffffff1de6a75 RSI: 0000000000000297 RDI: 0000000000000297
+[ 48.604373] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1dd1533
+[ 48.605607] R10: ffffffff8eafbb05 R11: fffffbfff1dd1534 R12: 0000000000000050
+[ 48.607082] R13: dead000000000200 R14: ffffffff8e73f310 R15: 0000000000001020
+[ 48.608228] FS: 00007fc686484800(0000) GS:ffff8801f5540000(0000) knlGS:0000000000000000
+[ 48.610189] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 48.611459] CR2: 0000000000001008 CR3: 00000001dda70002 CR4: 00000000003606e0
+[ 48.612759] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 48.613831] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 48.615038] Call Trace:
+[ 48.615635] tipc_enable_bearer+0x415/0x5e0 [tipc]
+[ 48.620623] tipc_nl_bearer_enable+0x1ab/0x200 [tipc]
+[ 48.625118] genl_family_rcv_msg+0x36b/0x570
+[ 48.631233] genl_rcv_msg+0x5a/0xa0
+[ 48.631867] netlink_rcv_skb+0x1cc/0x220
+[ 48.636373] genl_rcv+0x24/0x40
+[ 48.637306] netlink_unicast+0x29c/0x350
+[ 48.639664] netlink_sendmsg+0x439/0x590
+[ 48.642014] SYSC_sendto+0x199/0x250
+[ 48.649912] do_syscall_64+0xfd/0x2c0
+[ 48.650651] entry_SYSCALL64_slow_path+0x25/0x25
+[ 48.651843] RIP: 0033:0x7fc6859848e3
+[ 48.652539] RSP: 002b:00007ffd25dff938 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+[ 48.654003] RAX: ffffffffffffffda RBX: 00007ffd25dff990 RCX: 00007fc6859848e3
+[ 48.655303] RDX: 0000000000000054 RSI: 00007ffd25dff990 RDI: 0000000000000003
+[ 48.656512] RBP: 00007ffd25dff980 R08: 00007fc685c35fc0 R09: 000000000000000c
+[ 48.657697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000d13010
+[ 48.658840] R13: 00007ffd25e009c0 R14: 0000000000000000 R15: 0000000000000000
+[ 48.662972] RIP: tipc_mon_delete+0xea/0x270 [tipc] RSP: ffff8801d827f668
+[ 48.664073] CR2: 0000000000001008
+[ 48.664576] ---[ end trace e811818d54d5ce88 ]---
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/monitor.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -633,9 +633,13 @@ void tipc_mon_delete(struct net *net, in
+ {
+ struct tipc_net *tn = tipc_net(net);
+ struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
+- struct tipc_peer *self = get_self(net, bearer_id);
++ struct tipc_peer *self;
+ struct tipc_peer *peer, *tmp;
+
++ if (!mon)
++ return;
++
++ self = get_self(net, bearer_id);
+ write_lock_bh(&mon->lock);
+ tn->monitors[bearer_id] = NULL;
+ list_for_each_entry_safe(peer, tmp, &self->list, list) {
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Felix Janda <felix.janda@posteo.de>
+Date: Mon, 1 Jan 2018 19:33:20 +0100
+Subject: uapi libc compat: add fallback for unsupported libcs
+
+From: Felix Janda <felix.janda@posteo.de>
+
+
+[ Upstream commit c0bace798436bca0fdc221ff61143f1376a9c3de ]
+
+libc-compat.h aims to prevent symbol collisions between uapi and libc
+headers for each supported libc. This requires continuous coordination
+between them.
+
+The goal of this commit is to improve the situation for libcs (such as
+musl) which are not yet supported and/or do not wish to be explicitly
+supported, while not affecting supported libcs. More precisely, with
+this commit, unsupported libcs can request the suppression of any
+specific uapi definition by defining the correspondings _UAPI_DEF_*
+macro as 0. This can fix symbol collisions for them, as long as the
+libc headers are included before the uapi headers. Inclusion in the
+other order is outside the scope of this commit.
+
+All infrastructure in order to enable this fallback for unsupported
+libcs is already in place, except that libc-compat.h unconditionally
+defines all _UAPI_DEF_* macros to 1 for all unsupported libcs so that
+any previous definitions are ignored. In order to fix this, this commit
+merely makes these definitions conditional.
+
+This commit together with the musl libc commit
+
+http://git.musl-libc.org/cgit/musl/commit/?id=04983f2272382af92eb8f8838964ff944fbb8258
+
+fixes for example the following compiler errors when <linux/in6.h> is
+included after musl's <netinet/in.h>:
+
+./linux/in6.h:32:8: error: redefinition of 'struct in6_addr'
+./linux/in6.h:49:8: error: redefinition of 'struct sockaddr_in6'
+./linux/in6.h:59:8: error: redefinition of 'struct ipv6_mreq'
+
+The comments referencing glibc are still correct, but this file is not
+only used for glibc any more.
+
+Signed-off-by: Felix Janda <felix.janda@posteo.de>
+Reviewed-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/libc-compat.h | 55 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 54 insertions(+), 1 deletion(-)
+
+--- a/include/uapi/linux/libc-compat.h
++++ b/include/uapi/linux/libc-compat.h
+@@ -168,46 +168,99 @@
+
+ /* If we did not see any headers from any supported C libraries,
+ * or we are being included in the kernel, then define everything
+- * that we need. */
++ * that we need. Check for previous __UAPI_* definitions to give
++ * unsupported C libraries a way to opt out of any kernel definition. */
+ #else /* !defined(__GLIBC__) */
+
+ /* Definitions for if.h */
++#ifndef __UAPI_DEF_IF_IFCONF
+ #define __UAPI_DEF_IF_IFCONF 1
++#endif
++#ifndef __UAPI_DEF_IF_IFMAP
+ #define __UAPI_DEF_IF_IFMAP 1
++#endif
++#ifndef __UAPI_DEF_IF_IFNAMSIZ
+ #define __UAPI_DEF_IF_IFNAMSIZ 1
++#endif
++#ifndef __UAPI_DEF_IF_IFREQ
+ #define __UAPI_DEF_IF_IFREQ 1
++#endif
+ /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */
++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS
+ #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1
++#endif
+ /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */
++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO
+ #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1
++#endif
+
+ /* Definitions for in.h */
++#ifndef __UAPI_DEF_IN_ADDR
+ #define __UAPI_DEF_IN_ADDR 1
++#endif
++#ifndef __UAPI_DEF_IN_IPPROTO
+ #define __UAPI_DEF_IN_IPPROTO 1
++#endif
++#ifndef __UAPI_DEF_IN_PKTINFO
+ #define __UAPI_DEF_IN_PKTINFO 1
++#endif
++#ifndef __UAPI_DEF_IP_MREQ
+ #define __UAPI_DEF_IP_MREQ 1
++#endif
++#ifndef __UAPI_DEF_SOCKADDR_IN
+ #define __UAPI_DEF_SOCKADDR_IN 1
++#endif
++#ifndef __UAPI_DEF_IN_CLASS
+ #define __UAPI_DEF_IN_CLASS 1
++#endif
+
+ /* Definitions for in6.h */
++#ifndef __UAPI_DEF_IN6_ADDR
+ #define __UAPI_DEF_IN6_ADDR 1
++#endif
++#ifndef __UAPI_DEF_IN6_ADDR_ALT
+ #define __UAPI_DEF_IN6_ADDR_ALT 1
++#endif
++#ifndef __UAPI_DEF_SOCKADDR_IN6
+ #define __UAPI_DEF_SOCKADDR_IN6 1
++#endif
++#ifndef __UAPI_DEF_IPV6_MREQ
+ #define __UAPI_DEF_IPV6_MREQ 1
++#endif
++#ifndef __UAPI_DEF_IPPROTO_V6
+ #define __UAPI_DEF_IPPROTO_V6 1
++#endif
++#ifndef __UAPI_DEF_IPV6_OPTIONS
+ #define __UAPI_DEF_IPV6_OPTIONS 1
++#endif
++#ifndef __UAPI_DEF_IN6_PKTINFO
+ #define __UAPI_DEF_IN6_PKTINFO 1
++#endif
++#ifndef __UAPI_DEF_IP6_MTUINFO
+ #define __UAPI_DEF_IP6_MTUINFO 1
++#endif
+
+ /* Definitions for ipx.h */
++#ifndef __UAPI_DEF_SOCKADDR_IPX
+ #define __UAPI_DEF_SOCKADDR_IPX 1
++#endif
++#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION
+ #define __UAPI_DEF_IPX_ROUTE_DEFINITION 1
++#endif
++#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION
+ #define __UAPI_DEF_IPX_INTERFACE_DEFINITION 1
++#endif
++#ifndef __UAPI_DEF_IPX_CONFIG_DATA
+ #define __UAPI_DEF_IPX_CONFIG_DATA 1
++#endif
++#ifndef __UAPI_DEF_IPX_ROUTE_DEF
+ #define __UAPI_DEF_IPX_ROUTE_DEF 1
++#endif
+
+ /* Definitions for xattr.h */
++#ifndef __UAPI_DEF_XATTR
+ #define __UAPI_DEF_XATTR 1
++#endif
+
+ #endif /* __GLIBC__ */
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 18 Dec 2017 14:20:56 +0800
+Subject: vxlan: update skb dst pmtu on tx path
+
+From: Xin Long <lucien.xin@gmail.com>
+
+
+[ Upstream commit a93bf0ff449064e6b7f44e58522e940f88c0d966 ]
+
+Unlike ip tunnels, now vxlan doesn't do any pmtu update for
+upper dst pmtu, even if it doesn't match the lower dst pmtu
+any more.
+
+The problem can be reproduced when reducing the vxlan lower
+dev's pmtu when running netperf. In jianlin's testing, the
+performance went to 1/7 of the previous.
+
+This patch is to update the upper dst pmtu to match the lower
+dst pmtu on tx path so that packets can be sent out even when
+lower dev's pmtu has been changed.
+
+It also works for metadata dst.
+
+Note that this patch doesn't process any pmtu icmp packet.
+But even in the future, the support for pmtu icmp packets
+process of udp tunnels will also needs this.
+
+The same thing will be done for geneve in another patch.
+
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/vxlan.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2155,6 +2155,13 @@ static void vxlan_xmit_one(struct sk_buf
+ }
+
+ ndst = &rt->dst;
++ if (skb_dst(skb)) {
++ int mtu = dst_mtu(ndst) - VXLAN_HEADROOM;
++
++ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
++ skb, mtu);
++ }
++
+ tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
+ err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
+@@ -2190,6 +2197,13 @@ static void vxlan_xmit_one(struct sk_buf
+ goto out_unlock;
+ }
+
++ if (skb_dst(skb)) {
++ int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM;
++
++ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL,
++ skb, mtu);
++ }
++
+ tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ ttl = ttl ? : ip6_dst_hoplimit(ndst);
+ skb_scrub_packet(skb, xnet);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Mon, 11 Dec 2017 09:52:22 +0100
+Subject: wcn36xx: Fix dynamic power saving
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+
+[ Upstream commit 0856655a25476d4431005e39d606e349050066b0 ]
+
+Since driver does not report hardware dynamic power saving cap,
+this is up to the mac80211 to manage power saving timeout and
+state machine, using the ieee80211 config callback to report
+PS changes. This patch enables/disables PS mode according to
+the new configuration.
+
+Remove old behaviour enabling PS mode in a static way, this make
+the device unusable when power save is enabled since device is
+forced to PS regardless RX/TX traffic.
+
+Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/wcn36xx/main.c | 23 ++++++++++++-----------
+ drivers/net/wireless/ath/wcn36xx/pmc.c | 6 ++++--
+ 2 files changed, 16 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ath/wcn36xx/main.c
++++ b/drivers/net/wireless/ath/wcn36xx/main.c
+@@ -384,6 +384,18 @@ static int wcn36xx_config(struct ieee802
+ }
+ }
+
++ if (changed & IEEE80211_CONF_CHANGE_PS) {
++ list_for_each_entry(tmp, &wcn->vif_list, list) {
++ vif = wcn36xx_priv_to_vif(tmp);
++ if (hw->conf.flags & IEEE80211_CONF_PS) {
++ if (vif->bss_conf.ps) /* ps allowed ? */
++ wcn36xx_pmc_enter_bmps_state(wcn, vif);
++ } else {
++ wcn36xx_pmc_exit_bmps_state(wcn, vif);
++ }
++ }
++ }
++
+ mutex_unlock(&wcn->conf_mutex);
+
+ return 0;
+@@ -747,17 +759,6 @@ static void wcn36xx_bss_info_changed(str
+ vif_priv->dtim_period = bss_conf->dtim_period;
+ }
+
+- if (changed & BSS_CHANGED_PS) {
+- wcn36xx_dbg(WCN36XX_DBG_MAC,
+- "mac bss PS set %d\n",
+- bss_conf->ps);
+- if (bss_conf->ps) {
+- wcn36xx_pmc_enter_bmps_state(wcn, vif);
+- } else {
+- wcn36xx_pmc_exit_bmps_state(wcn, vif);
+- }
+- }
+-
+ if (changed & BSS_CHANGED_BSSID) {
+ wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n",
+ bss_conf->bssid);
+--- a/drivers/net/wireless/ath/wcn36xx/pmc.c
++++ b/drivers/net/wireless/ath/wcn36xx/pmc.c
+@@ -45,8 +45,10 @@ int wcn36xx_pmc_exit_bmps_state(struct w
+ struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
+
+ if (WCN36XX_BMPS != vif_priv->pw_state) {
+- wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n");
+- return -EINVAL;
++ /* Unbalanced call or last BMPS enter failed */
++ wcn36xx_dbg(WCN36XX_DBG_PMC,
++ "Not in BMPS mode, no need to exit\n");
++ return -EALREADY;
+ }
+ wcn36xx_smd_exit_bmps(wcn, vif);
+ vif_priv->pw_state = WCN36XX_FULL_POWER;
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Jan Beulich <JBeulich@suse.com>
+Date: Mon, 18 Dec 2017 09:37:45 -0700
+Subject: x86-64/Xen: eliminate W+X mappings
+
+From: Jan Beulich <JBeulich@suse.com>
+
+
+[ Upstream commit 2cc42bac1c795f75fcc062b95c6ca7ac1b84d5d8 ]
+
+A few thousand such pages are usually left around due to the re-use of
+L1 tables having been provided by the hypervisor (Dom0) or tool stack
+(DomU). Set NX in the direct map variant, which needs to be done in L2
+due to the dual use of the re-used L1s.
+
+For x86_configure_nx() to actually do what it is supposed to do, call
+get_cpu_cap() first. This was broken by commit 4763ed4d45 ("x86, mm:
+Clean up and simplify NX enablement") when switching away from the
+direct EFER read.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/xen/enlighten_pv.c | 3 +++
+ arch/x86/xen/mmu_pv.c | 12 ++++++++++++
+ 2 files changed, 15 insertions(+)
+
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -88,6 +88,8 @@
+ #include "multicalls.h"
+ #include "pmu.h"
+
++#include "../kernel/cpu/cpu.h" /* get_cpu_cap() */
++
+ void *xen_initial_gdt;
+
+ static int xen_cpu_up_prepare_pv(unsigned int cpu);
+@@ -1257,6 +1259,7 @@ asmlinkage __visible void __init xen_sta
+ __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
+
+ /* Work out if we support NX */
++ get_cpu_cap(&boot_cpu_data);
+ x86_configure_nx();
+
+ /* Get mfn list */
+--- a/arch/x86/xen/mmu_pv.c
++++ b/arch/x86/xen/mmu_pv.c
+@@ -1902,6 +1902,18 @@ void __init xen_setup_kernel_pagetable(p
+ /* Graft it onto L4[511][510] */
+ copy_page(level2_kernel_pgt, l2);
+
++ /*
++ * Zap execute permission from the ident map. Due to the sharing of
++ * L1 entries we need to do this in the L2.
++ */
++ if (__supported_pte_mask & _PAGE_NX) {
++ for (i = 0; i < PTRS_PER_PMD; ++i) {
++ if (pmd_none(level2_ident_pgt[i]))
++ continue;
++ level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i], _PAGE_NX);
++ }
++ }
++
+ /* Copy the initial P->M table mappings if necessary. */
+ i = pgd_index(xen_start_info->mfn_list);
+ if (i && i < pgd_index(__START_KERNEL_map))
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Mon, 4 Dec 2017 13:08:47 -0300
+Subject: x86/asm: Allow again using asm.h when building for the 'bpf' clang target
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+
+[ Upstream commit ca26cffa4e4aaeb09bb9e308f95c7835cb149248 ]
+
+Up to f5caf621ee35 ("x86/asm: Fix inline asm call constraints for Clang")
+we were able to use x86 headers to build to the 'bpf' clang target, as
+done by the BPF code in tools/perf/.
+
+With that commit, we ended up with following failure for 'perf test LLVM', this
+is because "clang ... -target bpf ..." fails since 4.0 does not have bpf inline
+asm support and 6.0 does not recognize the register 'esp', fix it by guarding
+that part with an #ifndef __BPF__, that is defined by clang when building to
+the "bpf" target.
+
+ # perf test -v LLVM
+ 37: LLVM search and compile :
+ 37.1: Basic BPF llvm compile :
+ --- start ---
+ test child forked, pid 25526
+ Kernel build dir is set to /lib/modules/4.14.0+/build
+ set env: KBUILD_DIR=/lib/modules/4.14.0+/build
+ unset env: KBUILD_OPTS
+ include option is set to -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
+ set env: NR_CPUS=4
+ set env: LINUX_VERSION_CODE=0x40e00
+ set env: CLANG_EXEC=/usr/local/bin/clang
+ set env: CLANG_OPTIONS=-xc
+ set env: KERNEL_INC_OPTIONS= -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
+ set env: WORKING_DIR=/lib/modules/4.14.0+/build
+ set env: CLANG_SOURCE=-
+ llvm compiling command template: echo '/*
+ * bpf-script-example.c
+ * Test basic LLVM building
+ */
+ #ifndef LINUX_VERSION_CODE
+ # error Need LINUX_VERSION_CODE
+ # error Example: for 4.2 kernel, put 'clang-opt="-DLINUX_VERSION_CODE=0x40200" into llvm section of ~/.perfconfig'
+ #endif
+ #define BPF_ANY 0
+ #define BPF_MAP_TYPE_ARRAY 2
+ #define BPF_FUNC_map_lookup_elem 1
+ #define BPF_FUNC_map_update_elem 2
+
+ static void *(*bpf_map_lookup_elem)(void *map, void *key) =
+ (void *) BPF_FUNC_map_lookup_elem;
+ static void *(*bpf_map_update_elem)(void *map, void *key, void *value, int flags) =
+ (void *) BPF_FUNC_map_update_elem;
+
+ struct bpf_map_def {
+ unsigned int type;
+ unsigned int key_size;
+ unsigned int value_size;
+ unsigned int max_entries;
+ };
+
+ #define SEC(NAME) __attribute__((section(NAME), used))
+ struct bpf_map_def SEC("maps") flip_table = {
+ .type = BPF_MAP_TYPE_ARRAY,
+ .key_size = sizeof(int),
+ .value_size = sizeof(int),
+ .max_entries = 1,
+ };
+
+ SEC("func=SyS_epoll_wait")
+ int bpf_func__SyS_epoll_wait(void *ctx)
+ {
+ int ind =0;
+ int *flag = bpf_map_lookup_elem(&flip_table, &ind);
+ int new_flag;
+ if (!flag)
+ return 0;
+ /* flip flag and store back */
+ new_flag = !*flag;
+ bpf_map_update_elem(&flip_table, &ind, &new_flag, BPF_ANY);
+ return new_flag;
+ }
+ char _license[] SEC("license") = "GPL";
+ int _version SEC("version") = LINUX_VERSION_CODE;
+ ' | $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=$NR_CPUS -DLINUX_VERSION_CODE=$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o -
+ test child finished with 0
+ ---- end ----
+ LLVM search and compile subtest 0: Ok
+ 37.2: kbuild searching :
+ --- start ---
+ test child forked, pid 25950
+ Kernel build dir is set to /lib/modules/4.14.0+/build
+ set env: KBUILD_DIR=/lib/modules/4.14.0+/build
+ unset env: KBUILD_OPTS
+ include option is set to -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
+ set env: NR_CPUS=4
+ set env: LINUX_VERSION_CODE=0x40e00
+ set env: CLANG_EXEC=/usr/local/bin/clang
+ set env: CLANG_OPTIONS=-xc
+ set env: KERNEL_INC_OPTIONS= -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linux/include/linux/kconfig.h
+ set env: WORKING_DIR=/lib/modules/4.14.0+/build
+ set env: CLANG_SOURCE=-
+ llvm compiling command template: echo '/*
+ * bpf-script-test-kbuild.c
+ * Test include from kernel header
+ */
+ #ifndef LINUX_VERSION_CODE
+ # error Need LINUX_VERSION_CODE
+ # error Example: for 4.2 kernel, put 'clang-opt="-DLINUX_VERSION_CODE=0x40200" into llvm section of ~/.perfconfig'
+ #endif
+ #define SEC(NAME) __attribute__((section(NAME), used))
+
+ #include <uapi/linux/fs.h>
+ #include <uapi/asm/ptrace.h>
+
+ SEC("func=vfs_llseek")
+ int bpf_func__vfs_llseek(void *ctx)
+ {
+ return 0;
+ }
+
+ char _license[] SEC("license") = "GPL";
+ int _version SEC("version") = LINUX_VERSION_CODE;
+ ' | $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=$NR_CPUS -DLINUX_VERSION_CODE=$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_INC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_DIR -c "$CLANG_SOURCE" -target bpf -O2 -o -
+ In file included from <stdin>:12:
+ In file included from /home/acme/git/linux/arch/x86/include/uapi/asm/ptrace.h:5:
+ In file included from /home/acme/git/linux/include/linux/compiler.h:242:
+ In file included from /home/acme/git/linux/arch/x86/include/asm/barrier.h:5:
+ In file included from /home/acme/git/linux/arch/x86/include/asm/alternative.h:10:
+ /home/acme/git/linux/arch/x86/include/asm/asm.h:145:50: error: unknown register name 'esp' in asm
+ register unsigned long current_stack_pointer asm(_ASM_SP);
+ ^
+ /home/acme/git/linux/arch/x86/include/asm/asm.h:44:18: note: expanded from macro '_ASM_SP'
+ #define _ASM_SP __ASM_REG(sp)
+ ^
+ /home/acme/git/linux/arch/x86/include/asm/asm.h:27:32: note: expanded from macro '__ASM_REG'
+ #define __ASM_REG(reg) __ASM_SEL_RAW(e##reg, r##reg)
+ ^
+ /home/acme/git/linux/arch/x86/include/asm/asm.h:18:29: note: expanded from macro '__ASM_SEL_RAW'
+ # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a)
+ ^
+ /home/acme/git/linux/arch/x86/include/asm/asm.h:11:32: note: expanded from macro '__ASM_FORM_RAW'
+ # define __ASM_FORM_RAW(x) #x
+ ^
+ <scratch space>:4:1: note: expanded from here
+ "esp"
+ ^
+ 1 error generated.
+ ERROR: unable to compile -
+ Hint: Check error message shown above.
+ Hint: You can also pre-compile it into .o using:
+ clang -target bpf -O2 -c -
+ with proper -I and -D options.
+ Failed to compile test case: 'kbuild searching'
+ test child finished with -1
+ ---- end ----
+ LLVM search and compile subtest 1: FAILED!
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Dmitriy Vyukov <dvyukov@google.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthias Kaehlcke <mka@chromium.org>
+Cc: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Wang Nan <wangnan0@huawei.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: https://lkml.kernel.org/r/20171128175948.GL3298@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/asm.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/include/asm/asm.h
++++ b/arch/x86/include/asm/asm.h
+@@ -136,6 +136,7 @@
+ #endif
+
+ #ifndef __ASSEMBLY__
++#ifndef __BPF__
+ /*
+ * This output constraint should be used for any inline asm which has a "call"
+ * instruction. Otherwise the asm may be inserted before the frame pointer
+@@ -145,5 +146,6 @@
+ register unsigned long current_stack_pointer asm(_ASM_SP);
+ #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
+ #endif
++#endif
+
+ #endif /* _ASM_X86_ASM_H */
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Dave Young <dyoung@redhat.com>
+Date: Tue, 2 Jan 2018 17:21:09 +0000
+Subject: x86/efi: Fix kernel param add_efi_memmap regression
+
+From: Dave Young <dyoung@redhat.com>
+
+
+[ Upstream commit 835bcec5fdf3f9e880111b482177e7e70e3596da ]
+
+'add_efi_memmap' is an early param, but do_add_efi_memmap() has no
+chance to run because the code path is before parse_early_param().
+I believe it worked when the param was introduced but probably later
+some other changes caused the wrong order and nobody noticed it.
+
+Move efi_memblock_x86_reserve_range() after parse_early_param()
+to fix it.
+
+Signed-off-by: Dave Young <dyoung@redhat.com>
+Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Cc: Ge Song <ge.song@hxt-semitech.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Link: http://lkml.kernel.org/r/20180102172110.17018-2-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/setup.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -928,9 +928,6 @@ void __init setup_arch(char **cmdline_p)
+ set_bit(EFI_BOOT, &efi.flags);
+ set_bit(EFI_64BIT, &efi.flags);
+ }
+-
+- if (efi_enabled(EFI_BOOT))
+- efi_memblock_x86_reserve_range();
+ #endif
+
+ x86_init.oem.arch_setup();
+@@ -984,6 +981,8 @@ void __init setup_arch(char **cmdline_p)
+
+ parse_early_param();
+
++ if (efi_enabled(EFI_BOOT))
++ efi_memblock_x86_reserve_range();
+ #ifdef CONFIG_MEMORY_HOTPLUG
+ /*
+ * Memory used by the kernel cannot be hot-removed because Linux
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 28 Dec 2017 14:25:23 +0200
+Subject: x86/platform/intel-mid: Revert "Make 'bt_sfi_data' const"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+
+[ Upstream commit 9d0513d82f1a8fe17b41f113ac5922fa57dbaf5c ]
+
+So one of the constification patches unearthed a type casting fragility
+of the underlying code:
+
+ 276c87054751 ("x86/platform/intel-mid: Make 'bt_sfi_data' const")
+
+converted the struct to be const while it is also used as a temporary
+container for important data that is used to fill 'parent' and 'name'
+fields in struct platform_device_info.
+
+The compiler doesn't notice this due to an explicit type cast that loses
+the const - which fragility will be fixed separately.
+
+This type cast turned a seemingly trivial const propagation patch into a
+hard to debug data corruptor and crasher bug.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Bhumika Goyal <bhumirks@gmail.com>
+Cc: Darren Hart <dvhart@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: julia.lawall@lip6.fr
+Cc: platform-driver-x86@vger.kernel.org
+Link: http://lkml.kernel.org/r/20171228122523.21802-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/platform/intel-mid/device_libs/platform_bt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/platform/intel-mid/device_libs/platform_bt.c
++++ b/arch/x86/platform/intel-mid/device_libs/platform_bt.c
+@@ -60,7 +60,7 @@ static int __init tng_bt_sfi_setup(struc
+ return 0;
+ }
+
+-static const struct bt_sfi_data tng_bt_sfi_data __initdata = {
++static struct bt_sfi_data tng_bt_sfi_data __initdata = {
+ .setup = tng_bt_sfi_setup,
+ };
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Mon, 18 Dec 2017 15:13:44 -0600
+Subject: x86/stacktrace: Make zombie stack traces reliable
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+
+[ Upstream commit 6454b3bdd138dfc640deb5e7b9a0668fca2d55dd ]
+
+Commit:
+
+ 1959a60182f4 ("x86/dumpstack: Pin the target stack when dumping it")
+
+changed the behavior of stack traces for zombies. Before that commit,
+/proc/<pid>/stack reported the last execution path of the zombie before
+it died:
+
+ [<ffffffff8105b877>] do_exit+0x6f7/0xa80
+ [<ffffffff8105bc79>] do_group_exit+0x39/0xa0
+ [<ffffffff8105bcf0>] __wake_up_parent+0x0/0x30
+ [<ffffffff8152dd09>] system_call_fastpath+0x16/0x1b
+ [<00007fd128f9c4f9>] 0x7fd128f9c4f9
+ [<ffffffffffffffff>] 0xffffffffffffffff
+
+After the commit, it just reports an empty stack trace.
+
+The new behavior is actually probably more correct. If the stack
+refcount has gone down to zero, then the task has already gone through
+do_exit() and isn't going to run anymore. The stack could be freed at
+any time and is basically gone, so reporting an empty stack makes sense.
+
+However, save_stack_trace_tsk_reliable() treats such a missing stack
+condition as an error. That can cause livepatch transition stalls if
+there are any unreaped zombies. Instead, just treat it as a reliable,
+empty stack.
+
+Reported-and-tested-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: live-patching@vger.kernel.org
+Fixes: af085d9084b4 ("stacktrace/x86: add function for detecting reliable stack traces")
+Link: http://lkml.kernel.org/r/e4b09e630e99d0c1080528f0821fc9d9dbaeea82.1513631620.git.jpoimboe@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/stacktrace.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/stacktrace.c
++++ b/arch/x86/kernel/stacktrace.c
+@@ -160,8 +160,12 @@ int save_stack_trace_tsk_reliable(struct
+ {
+ int ret;
+
++ /*
++ * If the task doesn't have a stack (e.g., a zombie), the stack is
++ * "reliably" empty.
++ */
+ if (!try_get_task_stack(tsk))
+- return -EINVAL;
++ return 0;
+
+ ret = __save_stack_trace_reliable(trace, tsk);
+
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Date: Tue, 12 Dec 2017 15:08:21 -0500
+Subject: xen/balloon: Mark unallocated host memory as UNUSABLE
+
+From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+
+
+[ Upstream commit b3cf8528bb21febb650a7ecbf080d0647be40b9f ]
+
+Commit f5775e0b6116 ("x86/xen: discard RAM regions above the maximum
+reservation") left host memory not assigned to dom0 as available for
+memory hotplug.
+
+Unfortunately this also meant that those regions could be used by
+others. Specifically, commit fa564ad96366 ("x86/PCI: Enable a 64bit BAR
+on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)") may try to map those
+addresses as MMIO.
+
+To prevent this mark unallocated host memory as E820_TYPE_UNUSABLE (thus
+effectively reverting f5775e0b6116) and keep track of that region as
+a hostmem resource that can be used for the hotplug.
+
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/xen/enlighten.c | 81 +++++++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/xen/setup.c | 6 +--
+ drivers/xen/balloon.c | 65 ++++++++++++++++++++++++++++++++-----
+ include/xen/balloon.h | 5 ++
+ 4 files changed, 144 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1,8 +1,12 @@
++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
++#include <linux/bootmem.h>
++#endif
+ #include <linux/cpu.h>
+ #include <linux/kexec.h>
+
+ #include <xen/features.h>
+ #include <xen/page.h>
++#include <xen/interface/memory.h>
+
+ #include <asm/xen/hypercall.h>
+ #include <asm/xen/hypervisor.h>
+@@ -331,3 +335,80 @@ void xen_arch_unregister_cpu(int num)
+ }
+ EXPORT_SYMBOL(xen_arch_unregister_cpu);
+ #endif
++
++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
++void __init arch_xen_balloon_init(struct resource *hostmem_resource)
++{
++ struct xen_memory_map memmap;
++ int rc;
++ unsigned int i, last_guest_ram;
++ phys_addr_t max_addr = PFN_PHYS(max_pfn);
++ struct e820_table *xen_e820_table;
++ const struct e820_entry *entry;
++ struct resource *res;
++
++ if (!xen_initial_domain())
++ return;
++
++ xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL);
++ if (!xen_e820_table)
++ return;
++
++ memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries);
++ set_xen_guest_handle(memmap.buffer, xen_e820_table->entries);
++ rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap);
++ if (rc) {
++ pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc);
++ goto out;
++ }
++
++ last_guest_ram = 0;
++ for (i = 0; i < memmap.nr_entries; i++) {
++ if (xen_e820_table->entries[i].addr >= max_addr)
++ break;
++ if (xen_e820_table->entries[i].type == E820_TYPE_RAM)
++ last_guest_ram = i;
++ }
++
++ entry = &xen_e820_table->entries[last_guest_ram];
++ if (max_addr >= entry->addr + entry->size)
++ goto out; /* No unallocated host RAM. */
++
++ hostmem_resource->start = max_addr;
++ hostmem_resource->end = entry->addr + entry->size;
++
++ /*
++ * Mark non-RAM regions between the end of dom0 RAM and end of host RAM
++ * as unavailable. The rest of that region can be used for hotplug-based
++ * ballooning.
++ */
++ for (; i < memmap.nr_entries; i++) {
++ entry = &xen_e820_table->entries[i];
++
++ if (entry->type == E820_TYPE_RAM)
++ continue;
++
++ if (entry->addr >= hostmem_resource->end)
++ break;
++
++ res = kzalloc(sizeof(*res), GFP_KERNEL);
++ if (!res)
++ goto out;
++
++ res->name = "Unavailable host RAM";
++ res->start = entry->addr;
++ res->end = (entry->addr + entry->size < hostmem_resource->end) ?
++ entry->addr + entry->size : hostmem_resource->end;
++ rc = insert_resource(hostmem_resource, res);
++ if (rc) {
++ pr_warn("%s: Can't insert [%llx - %llx) (%d)\n",
++ __func__, res->start, res->end, rc);
++ kfree(res);
++ goto out;
++ }
++ }
++
++ out:
++ kfree(xen_e820_table);
++}
++#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -808,7 +808,6 @@ char * __init xen_memory_setup(void)
+ addr = xen_e820_table.entries[0].addr;
+ size = xen_e820_table.entries[0].size;
+ while (i < xen_e820_table.nr_entries) {
+- bool discard = false;
+
+ chunk_size = size;
+ type = xen_e820_table.entries[i].type;
+@@ -824,11 +823,10 @@ char * __init xen_memory_setup(void)
+ xen_add_extra_mem(pfn_s, n_pfns);
+ xen_max_p2m_pfn = pfn_s + n_pfns;
+ } else
+- discard = true;
++ type = E820_TYPE_UNUSABLE;
+ }
+
+- if (!discard)
+- xen_align_and_add_e820_region(addr, chunk_size, type);
++ xen_align_and_add_e820_region(addr, chunk_size, type);
+
+ addr += chunk_size;
+ size -= chunk_size;
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -257,10 +257,25 @@ static void release_memory_resource(stru
+ kfree(resource);
+ }
+
++/*
++ * Host memory not allocated to dom0. We can use this range for hotplug-based
++ * ballooning.
++ *
++ * It's a type-less resource. Setting IORESOURCE_MEM will make resource
++ * management algorithms (arch_remove_reservations()) look into guest e820,
++ * which we don't want.
++ */
++static struct resource hostmem_resource = {
++ .name = "Host RAM",
++};
++
++void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res)
++{}
++
+ static struct resource *additional_memory_resource(phys_addr_t size)
+ {
+- struct resource *res;
+- int ret;
++ struct resource *res, *res_hostmem;
++ int ret = -ENOMEM;
+
+ res = kzalloc(sizeof(*res), GFP_KERNEL);
+ if (!res)
+@@ -269,13 +284,42 @@ static struct resource *additional_memor
+ res->name = "System RAM";
+ res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
+
+- ret = allocate_resource(&iomem_resource, res,
+- size, 0, -1,
+- PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
+- if (ret < 0) {
+- pr_err("Cannot allocate new System RAM resource\n");
+- kfree(res);
+- return NULL;
++ res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL);
++ if (res_hostmem) {
++ /* Try to grab a range from hostmem */
++ res_hostmem->name = "Host memory";
++ ret = allocate_resource(&hostmem_resource, res_hostmem,
++ size, 0, -1,
++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
++ }
++
++ if (!ret) {
++ /*
++ * Insert this resource into iomem. Because hostmem_resource
++ * tracks portion of guest e820 marked as UNUSABLE noone else
++ * should try to use it.
++ */
++ res->start = res_hostmem->start;
++ res->end = res_hostmem->end;
++ ret = insert_resource(&iomem_resource, res);
++ if (ret < 0) {
++ pr_err("Can't insert iomem_resource [%llx - %llx]\n",
++ res->start, res->end);
++ release_memory_resource(res_hostmem);
++ res_hostmem = NULL;
++ res->start = res->end = 0;
++ }
++ }
++
++ if (ret) {
++ ret = allocate_resource(&iomem_resource, res,
++ size, 0, -1,
++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL);
++ if (ret < 0) {
++ pr_err("Cannot allocate new System RAM resource\n");
++ kfree(res);
++ return NULL;
++ }
+ }
+
+ #ifdef CONFIG_SPARSEMEM
+@@ -287,6 +331,7 @@ static struct resource *additional_memor
+ pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n",
+ pfn, limit);
+ release_memory_resource(res);
++ release_memory_resource(res_hostmem);
+ return NULL;
+ }
+ }
+@@ -765,6 +810,8 @@ static int __init balloon_init(void)
+ set_online_page_callback(&xen_online_page);
+ register_memory_notifier(&xen_memory_nb);
+ register_sysctl_table(xen_root);
++
++ arch_xen_balloon_init(&hostmem_resource);
+ #endif
+
+ #ifdef CONFIG_XEN_PV
+--- a/include/xen/balloon.h
++++ b/include/xen/balloon.h
+@@ -44,3 +44,8 @@ static inline void xen_balloon_init(void
+ {
+ }
+ #endif
++
++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
++struct resource;
++void arch_xen_balloon_init(struct resource *hostmem_resource);
++#endif
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Tue, 9 Jan 2018 12:10:21 +0000
+Subject: xen/gntdev: Fix off-by-one error when unmapping with holes
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+
+[ Upstream commit 951a010233625b77cde3430b4b8785a9a22968d1 ]
+
+If the requested range has a hole, the calculation of the number of
+pages to unmap is off by one. Fix it.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/gntdev.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -380,10 +380,8 @@ static int unmap_grant_pages(struct gran
+ }
+ range = 0;
+ while (range < pages) {
+- if (map->unmap_ops[offset+range].handle == -1) {
+- range--;
++ if (map->unmap_ops[offset+range].handle == -1)
+ break;
+- }
+ range++;
+ }
+ err = __unmap_grant_pages(map, offset, range);
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Tue, 9 Jan 2018 12:10:22 +0000
+Subject: xen/gntdev: Fix partial gntdev_mmap() cleanup
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+
+[ Upstream commit cf2acf66ad43abb39735568f55e1f85f9844e990 ]
+
+When cleaning up after a partially successful gntdev_mmap(), unmap the
+successfully mapped grant pages otherwise Xen will kill the domain if
+in debug mode (Attempt to implicitly unmap a granted PTE) or Linux will
+kill the process and emit "BUG: Bad page map in process" if Xen is in
+release mode.
+
+This is only needed when use_ptemod is true because gntdev_put_map()
+will unmap grant pages itself when use_ptemod is false.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/gntdev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -1071,8 +1071,10 @@ unlock_out:
+ out_unlock_put:
+ mutex_unlock(&priv->lock);
+ out_put_map:
+- if (use_ptemod)
++ if (use_ptemod) {
+ map->vma = NULL;
++ unmap_grant_pages(map, 0, map->count);
++ }
+ gntdev_put_map(priv, map);
+ return err;
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Eduardo Otubo <otubo@redhat.com>
+Date: Fri, 5 Jan 2018 09:42:16 +0100
+Subject: xen-netfront: enable device after manual module load
+
+From: Eduardo Otubo <otubo@redhat.com>
+
+
+[ Upstream commit b707fda2df4070785d0fa8a278aa13944c5f51f8 ]
+
+When loading the module after unloading it, the network interface would
+not be enabled and thus wouldn't have a backend counterpart and unable
+to be used by the guest.
+
+The guest would face errors like:
+
+ [root@guest ~]# ethtool -i eth0
+ Cannot get driver information: No such device
+
+ [root@guest ~]# ifconfig eth0
+ eth0: error fetching interface information: Device not found
+
+This patch initializes the state of the netfront device whenever it is
+loaded manually, this state would communicate the netback to create its
+device and establish the connection between them.
+
+Signed-off-by: Eduardo Otubo <otubo@redhat.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/xen-netfront.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1326,6 +1326,7 @@ static struct net_device *xennet_create_
+
+ netif_carrier_off(netdev);
+
++ xenbus_switch_state(dev, XenbusStateInitialising);
+ return netdev;
+
+ exit:
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Fri, 15 Dec 2017 16:40:44 +1100
+Subject: xfrm: Reinject transport-mode packets through tasklet
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+
+[ Upstream commit acf568ee859f098279eadf551612f103afdacb4e ]
+
+This is an old bugbear of mine:
+
+https://www.mail-archive.com/netdev@vger.kernel.org/msg03894.html
+
+By crafting special packets, it is possible to cause recursion
+in our kernel when processing transport-mode packets at levels
+that are only limited by packet size.
+
+The easiest one is with DNAT, but an even worse one is where
+UDP encapsulation is used in which case you just have to insert
+an UDP encapsulation header in between each level of recursion.
+
+This patch avoids this problem by reinjecting tranport-mode packets
+through a tasklet.
+
+Fixes: b05e106698d9 ("[IPV4/6]: Netfilter IPsec input hooks")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/xfrm.h | 3 ++
+ net/ipv4/xfrm4_input.c | 12 +++++++++-
+ net/ipv6/xfrm6_input.c | 10 +++++++-
+ net/xfrm/xfrm_input.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 80 insertions(+), 2 deletions(-)
+
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1570,6 +1570,9 @@ int xfrm_init_state(struct xfrm_state *x
+ int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
+ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type);
+ int xfrm_input_resume(struct sk_buff *skb, int nexthdr);
++int xfrm_trans_queue(struct sk_buff *skb,
++ int (*finish)(struct net *, struct sock *,
++ struct sk_buff *));
+ int xfrm_output_resume(struct sk_buff *skb, int err);
+ int xfrm_output(struct sock *sk, struct sk_buff *skb);
+ int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
+--- a/net/ipv4/xfrm4_input.c
++++ b/net/ipv4/xfrm4_input.c
+@@ -23,6 +23,12 @@ int xfrm4_extract_input(struct xfrm_stat
+ return xfrm4_extract_header(skb);
+ }
+
++static int xfrm4_rcv_encap_finish2(struct net *net, struct sock *sk,
++ struct sk_buff *skb)
++{
++ return dst_input(skb);
++}
++
+ static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk,
+ struct sk_buff *skb)
+ {
+@@ -33,7 +39,11 @@ static inline int xfrm4_rcv_encap_finish
+ iph->tos, skb->dev))
+ goto drop;
+ }
+- return dst_input(skb);
++
++ if (xfrm_trans_queue(skb, xfrm4_rcv_encap_finish2))
++ goto drop;
++
++ return 0;
+ drop:
+ kfree_skb(skb);
+ return NET_RX_DROP;
+--- a/net/ipv6/xfrm6_input.c
++++ b/net/ipv6/xfrm6_input.c
+@@ -32,6 +32,14 @@ int xfrm6_rcv_spi(struct sk_buff *skb, i
+ }
+ EXPORT_SYMBOL(xfrm6_rcv_spi);
+
++static int xfrm6_transport_finish2(struct net *net, struct sock *sk,
++ struct sk_buff *skb)
++{
++ if (xfrm_trans_queue(skb, ip6_rcv_finish))
++ __kfree_skb(skb);
++ return -1;
++}
++
+ int xfrm6_transport_finish(struct sk_buff *skb, int async)
+ {
+ struct xfrm_offload *xo = xfrm_offload(skb);
+@@ -56,7 +64,7 @@ int xfrm6_transport_finish(struct sk_buf
+
+ NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
+ dev_net(skb->dev), NULL, skb, skb->dev, NULL,
+- ip6_rcv_finish);
++ xfrm6_transport_finish2);
+ return -1;
+ }
+
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -8,15 +8,29 @@
+ *
+ */
+
++#include <linux/bottom_half.h>
++#include <linux/interrupt.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
+ #include <linux/netdevice.h>
++#include <linux/percpu.h>
+ #include <net/dst.h>
+ #include <net/ip.h>
+ #include <net/xfrm.h>
+ #include <net/ip_tunnels.h>
+ #include <net/ip6_tunnel.h>
+
++struct xfrm_trans_tasklet {
++ struct tasklet_struct tasklet;
++ struct sk_buff_head queue;
++};
++
++struct xfrm_trans_cb {
++ int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb);
++};
++
++#define XFRM_TRANS_SKB_CB(__skb) ((struct xfrm_trans_cb *)&((__skb)->cb[0]))
++
+ static struct kmem_cache *secpath_cachep __read_mostly;
+
+ static DEFINE_SPINLOCK(xfrm_input_afinfo_lock);
+@@ -25,6 +39,8 @@ static struct xfrm_input_afinfo const __
+ static struct gro_cells gro_cells;
+ static struct net_device xfrm_napi_dev;
+
++static DEFINE_PER_CPU(struct xfrm_trans_tasklet, xfrm_trans_tasklet);
++
+ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo)
+ {
+ int err = 0;
+@@ -477,9 +493,41 @@ int xfrm_input_resume(struct sk_buff *sk
+ }
+ EXPORT_SYMBOL(xfrm_input_resume);
+
++static void xfrm_trans_reinject(unsigned long data)
++{
++ struct xfrm_trans_tasklet *trans = (void *)data;
++ struct sk_buff_head queue;
++ struct sk_buff *skb;
++
++ __skb_queue_head_init(&queue);
++ skb_queue_splice_init(&trans->queue, &queue);
++
++ while ((skb = __skb_dequeue(&queue)))
++ XFRM_TRANS_SKB_CB(skb)->finish(dev_net(skb->dev), NULL, skb);
++}
++
++int xfrm_trans_queue(struct sk_buff *skb,
++ int (*finish)(struct net *, struct sock *,
++ struct sk_buff *))
++{
++ struct xfrm_trans_tasklet *trans;
++
++ trans = this_cpu_ptr(&xfrm_trans_tasklet);
++
++ if (skb_queue_len(&trans->queue) >= netdev_max_backlog)
++ return -ENOBUFS;
++
++ XFRM_TRANS_SKB_CB(skb)->finish = finish;
++ skb_queue_tail(&trans->queue, skb);
++ tasklet_schedule(&trans->tasklet);
++ return 0;
++}
++EXPORT_SYMBOL(xfrm_trans_queue);
++
+ void __init xfrm_input_init(void)
+ {
+ int err;
++ int i;
+
+ init_dummy_netdev(&xfrm_napi_dev);
+ err = gro_cells_init(&gro_cells, &xfrm_napi_dev);
+@@ -490,4 +538,13 @@ void __init xfrm_input_init(void)
+ sizeof(struct sec_path),
+ 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
+ NULL);
++
++ for_each_possible_cpu(i) {
++ struct xfrm_trans_tasklet *trans;
++
++ trans = &per_cpu(xfrm_trans_tasklet, i);
++ __skb_queue_head_init(&trans->queue);
++ tasklet_init(&trans->tasklet, xfrm_trans_reinject,
++ (unsigned long)trans);
++ }
+ }
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Date: Thu, 21 Dec 2017 13:18:26 -0800
+Subject: xfs: quota: check result of register_shrinker()
+
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+
+
+[ Upstream commit 3a3882ff26fbdbaf5f7e13f6a0bccfbf7121041d ]
+
+xfs_qm_init_quotainfo() does not check result of register_shrinker()
+which was tagged as __must_check recently, reported by sparse.
+
+Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+[darrick: move xfs_qm_destroy_quotainos nearer xfs_qm_init_quotainos]
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_qm.c | 45 +++++++++++++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -48,7 +48,7 @@
+ STATIC int xfs_qm_init_quotainos(xfs_mount_t *);
+ STATIC int xfs_qm_init_quotainfo(xfs_mount_t *);
+
+-
++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi);
+ STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp);
+ /*
+ * We use the batch lookup interface to iterate over the dquots as it
+@@ -695,9 +695,17 @@ xfs_qm_init_quotainfo(
+ qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan;
+ qinf->qi_shrinker.seeks = DEFAULT_SEEKS;
+ qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
+- register_shrinker(&qinf->qi_shrinker);
++
++ error = register_shrinker(&qinf->qi_shrinker);
++ if (error)
++ goto out_free_inos;
++
+ return 0;
+
++out_free_inos:
++ mutex_destroy(&qinf->qi_quotaofflock);
++ mutex_destroy(&qinf->qi_tree_lock);
++ xfs_qm_destroy_quotainos(qinf);
+ out_free_lru:
+ list_lru_destroy(&qinf->qi_lru);
+ out_free_qinf:
+@@ -706,7 +714,6 @@ out_free_qinf:
+ return error;
+ }
+
+-
+ /*
+ * Gets called when unmounting a filesystem or when all quotas get
+ * turned off.
+@@ -723,19 +730,7 @@ xfs_qm_destroy_quotainfo(
+
+ unregister_shrinker(&qi->qi_shrinker);
+ list_lru_destroy(&qi->qi_lru);
+-
+- if (qi->qi_uquotaip) {
+- IRELE(qi->qi_uquotaip);
+- qi->qi_uquotaip = NULL; /* paranoia */
+- }
+- if (qi->qi_gquotaip) {
+- IRELE(qi->qi_gquotaip);
+- qi->qi_gquotaip = NULL;
+- }
+- if (qi->qi_pquotaip) {
+- IRELE(qi->qi_pquotaip);
+- qi->qi_pquotaip = NULL;
+- }
++ xfs_qm_destroy_quotainos(qi);
+ mutex_destroy(&qi->qi_tree_lock);
+ mutex_destroy(&qi->qi_quotaofflock);
+ kmem_free(qi);
+@@ -1601,6 +1596,24 @@ error_rele:
+ }
+
+ STATIC void
++xfs_qm_destroy_quotainos(
++ xfs_quotainfo_t *qi)
++{
++ if (qi->qi_uquotaip) {
++ IRELE(qi->qi_uquotaip);
++ qi->qi_uquotaip = NULL; /* paranoia */
++ }
++ if (qi->qi_gquotaip) {
++ IRELE(qi->qi_gquotaip);
++ qi->qi_gquotaip = NULL;
++ }
++ if (qi->qi_pquotaip) {
++ IRELE(qi->qi_pquotaip);
++ qi->qi_pquotaip = NULL;
++ }
++}
++
++STATIC void
+ xfs_qm_dqfree_one(
+ struct xfs_dquot *dqp)
+ {
--- /dev/null
+From foo@baz Wed Feb 28 16:23:28 CET 2018
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Date: Thu, 21 Dec 2017 13:18:26 -0800
+Subject: xfs: quota: fix missed destroy of qi_tree_lock
+
+From: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+
+
+[ Upstream commit 2196881566225f3c3428d1a5f847a992944daa5b ]
+
+xfs_qm_destroy_quotainfo() does not destroy quotainfo->qi_tree_lock
+while destroys quotainfo->qi_quotaofflock.
+
+Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_qm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -736,6 +736,7 @@ xfs_qm_destroy_quotainfo(
+ IRELE(qi->qi_pquotaip);
+ qi->qi_pquotaip = NULL;
+ }
++ mutex_destroy(&qi->qi_tree_lock);
+ mutex_destroy(&qi->qi_quotaofflock);
+ kmem_free(qi);
+ mp->m_quotainfo = NULL;
projects / thirdparty / kernel / stable-queue.git / commitdiff
