--- /dev/null
+From ebbd43fc6d159f2ba7ee78a9dc79a5265e5c19c0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 21 Dec 2018 12:06:58 +0300
+Subject: ALSA: compress: prevent potential divide by zero bugs
+
+[ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ]
+
+The problem is seen in the q6asm_dai_compr_set_params() function:
+
+ ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys,
+ (prtd->pcm_size / prtd->periods),
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+ prtd->periods);
+
+In this code prtd->pcm_size is the buffer_size and prtd->periods comes
+from params->buffer.fragments. If we allow the number of fragments to
+be zero then it results in a divide by zero bug. One possible fix would
+be to use prtd->pcm_count directly instead of using the division to
+re-calculate it. But I decided that it doesn't really make sense to
+allow zero fragments.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 26b5e245b0747..8b78ddffa509a 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size)
++ params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments == 0)
+ return -EINVAL;
+
+ /* now codec parameters */
+--
+2.19.1
+
--- /dev/null
+From c44d24c0be4f67a8c0c1d1184e37518f8b5c8687 Mon Sep 17 00:00:00 2001
+From: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Date: Thu, 13 Dec 2018 18:42:57 +0300
+Subject: ARC: fix __ffs return value to avoid build warnings
+
+[ Upstream commit 4e868f8419cb4cb558c5d428e7ab5629cef864c7 ]
+
+| CC mm/nobootmem.o
+|In file included from ./include/asm-generic/bug.h:18:0,
+| from ./arch/arc/include/asm/bug.h:32,
+| from ./include/linux/bug.h:5,
+| from ./include/linux/mmdebug.h:5,
+| from ./include/linux/gfp.h:5,
+| from ./include/linux/slab.h:15,
+| from mm/nobootmem.c:14:
+|mm/nobootmem.c: In function '__free_pages_memory':
+|./include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast
+| (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
+| ^
+|./include/linux/kernel.h:859:4: note: in expansion of macro '__typecheck'
+| (__typecheck(x, y) && __no_side_effects(x, y))
+| ^~~~~~~~~~~
+|./include/linux/kernel.h:869:24: note: in expansion of macro '__safe_cmp'
+| __builtin_choose_expr(__safe_cmp(x, y), \
+| ^~~~~~~~~~
+|./include/linux/kernel.h:878:19: note: in expansion of macro '__careful_cmp'
+| #define min(x, y) __careful_cmp(x, y, <)
+| ^~~~~~~~~~~~~
+|mm/nobootmem.c:104:11: note: in expansion of macro 'min'
+| order = min(MAX_ORDER - 1UL, __ffs(start));
+
+Change __ffs return value from 'int' to 'unsigned long' as it
+is done in other implementations (like asm-generic, x86, etc...)
+to avoid build-time warnings in places where type is strictly
+checked.
+
+As __ffs may return values in [0-31] interval changing return
+type to unsigned is valid.
+
+Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/bitops.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 8da87feec59aa..99e6d8948f4ac 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x)
+ /*
+ * __ffs: Similar to ffs, but zero based (0-31)
+ */
+-static inline __attribute__ ((const)) int __ffs(unsigned long word)
++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word)
+ {
+ if (!word)
+ return word;
+@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x)
+ /*
+ * __ffs: Similar to ffs, but zero based (0-31)
+ */
+-static inline __attribute__ ((const)) int __ffs(unsigned long x)
++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x)
+ {
+- int n;
++ unsigned long n;
+
+ asm volatile(
+ " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */
+--
+2.19.1
+
--- /dev/null
+From d0ed1d56a7baae524817e40dc91170b711004bb4 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Mon, 17 Dec 2018 14:11:19 -0800
+Subject: ARC: show_regs: lockdep: avoid page allocator...
+
+[ Upstream commit ab6c03676cb190156603cf4c5ecf97aa406c9c53 ]
+
+and use smaller/on-stack buffer instead
+
+The motivation for this change was lockdep splat like below.
+
+| potentially unexpected fatal signal 11.
+| BUG: sleeping function called from invalid context at ../mm/page_alloc.c:4317
+| in_atomic(): 1, irqs_disabled(): 0, pid: 57, name: segv
+| no locks held by segv/57.
+| Preemption disabled at:
+| [<8182f17e>] get_signal+0x4a6/0x7c4
+| CPU: 0 PID: 57 Comm: segv Not tainted 4.17.0+ #23
+|
+| Stack Trace:
+| arc_unwind_core.constprop.1+0xd0/0xf4
+| __might_sleep+0x1f6/0x234
+| __get_free_pages+0x174/0xca0
+| show_regs+0x22/0x330
+| get_signal+0x4ac/0x7c4 # print_fatal_signals() -> preempt_disable()
+| do_signal+0x30/0x224
+| resume_user_mode_begin+0x90/0xd8
+
+So signal handling core calls show_regs() with preemption disabled but
+an ensuing GFP_KERNEL page allocator call is flagged by lockdep.
+
+We could have switched to GFP_NOWAIT, but turns out that is not enough
+anways and eliding page allocator call leads to less code and
+instruction traces to sift thru when debugging pesky crashes.
+
+FWIW, this patch doesn't cure the lockdep splat (which next patch does).
+
+Reviewed-by: William Kucharski <william.kucharski@oracle.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/troubleshoot.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
+index e8d9fb4523462..5c6663321e873 100644
+--- a/arch/arc/kernel/troubleshoot.c
++++ b/arch/arc/kernel/troubleshoot.c
+@@ -18,6 +18,8 @@
+ #include <asm/arcregs.h>
+ #include <asm/irqflags.h>
+
++#define ARC_PATH_MAX 256
++
+ /*
+ * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25)
+ * -Prints 3 regs per line and a CR.
+@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs)
+ print_reg_file(&(cregs->r13), 13);
+ }
+
+-static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
++static void print_task_path_n_nm(struct task_struct *tsk)
+ {
+ char *path_nm = NULL;
+ struct mm_struct *mm;
+ struct file *exe_file;
++ char buf[ARC_PATH_MAX];
+
+ mm = get_task_mm(tsk);
+ if (!mm)
+@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
+ mmput(mm);
+
+ if (exe_file) {
+- path_nm = file_path(exe_file, buf, 255);
++ path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1);
+ fput(exe_file);
+ }
+
+@@ -80,10 +83,9 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf)
+ pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?");
+ }
+
+-static void show_faulting_vma(unsigned long address, char *buf)
++static void show_faulting_vma(unsigned long address)
+ {
+ struct vm_area_struct *vma;
+- char *nm = buf;
+ struct mm_struct *active_mm = current->active_mm;
+
+ /* can't use print_vma_addr() yet as it doesn't check for
+@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf)
+ * if the container VMA is not found
+ */
+ if (vma && (vma->vm_start <= address)) {
++ char buf[ARC_PATH_MAX];
++ char *nm = "?";
++
+ if (vma->vm_file) {
+- nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1);
++ nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1);
+ if (IS_ERR(nm))
+ nm = "?";
+ }
+@@ -173,13 +178,8 @@ void show_regs(struct pt_regs *regs)
+ {
+ struct task_struct *tsk = current;
+ struct callee_regs *cregs;
+- char *buf;
+
+- buf = (char *)__get_free_page(GFP_KERNEL);
+- if (!buf)
+- return;
+-
+- print_task_path_n_nm(tsk, buf);
++ print_task_path_n_nm(tsk);
+ show_regs_print_info(KERN_INFO);
+
+ show_ecr_verbose(regs);
+@@ -189,7 +189,7 @@ void show_regs(struct pt_regs *regs)
+ (void *)regs->blink, (void *)regs->ret);
+
+ if (user_mode(regs))
+- show_faulting_vma(regs->ret, buf); /* faulting code, not data */
++ show_faulting_vma(regs->ret); /* faulting code, not data */
+
+ pr_info("[STAT32]: 0x%08lx", regs->status32);
+
+@@ -221,8 +221,6 @@ void show_regs(struct pt_regs *regs)
+ cregs = (struct callee_regs *)current->thread.callee_reg;
+ if (cregs)
+ show_callee_regs(cregs);
+-
+- free_page((unsigned long)buf);
+ }
+
+ void show_kernel_fault_diag(const char *str, struct pt_regs *regs,
+--
+2.19.1
+
--- /dev/null
+From f3beb7b50f5a00fd391c2346b70a63d450156306 Mon Sep 17 00:00:00 2001
+From: Silvio Cesare <silvio.cesare@gmail.com>
+Date: Sat, 12 Jan 2019 16:28:43 +0100
+Subject: ASoC: dapm: change snprintf to scnprintf for possible overflow
+
+[ Upstream commit e581e151e965bf1f2815dd94620b638fec4d0a7e ]
+
+Change snprintf to scnprintf. There are generally two cases where using
+snprintf causes problems.
+
+1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
+In this case, if snprintf would have written more characters than what the
+buffer size (SIZE) is, then size will end up larger than SIZE. In later
+uses of snprintf, SIZE - size will result in a negative number, leading
+to problems. Note that size might already be too large by using
+size = snprintf before the code reaches a case of size += snprintf.
+
+2) If size is ultimately used as a length parameter for a copy back to user
+space, then it will potentially allow for a buffer overflow and information
+disclosure when size is greater than SIZE. When the size is used to index
+the buffer directly, we can have memory corruption. This also means when
+size = snprintf... is used, it may also cause problems since size may become
+large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
+configuration.
+
+The solution to these issues is to use scnprintf which returns the number of
+characters actually written to the buffer, so the size variable will never
+exceed SIZE.
+
+Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 461d951917c05..6537069452226 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2028,19 +2028,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ out = is_connected_output_ep(w, NULL, NULL);
+ }
+
+- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d",
++ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d",
+ w->name, w->power ? "On" : "Off",
+ w->force ? " (forced)" : "", in, out);
+
+ if (w->reg >= 0)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ " - R%d(0x%x) mask 0x%x",
+ w->reg, w->reg, w->mask << w->shift);
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
+
+ if (w->sname)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n",
+ w->sname,
+ w->active ? "active" : "inactive");
+
+@@ -2053,7 +2053,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,
+ if (!p->connect)
+ continue;
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ " %s \"%s\" \"%s\"\n",
+ (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out",
+ p->name ? p->name : "static",
+--
+2.19.1
+
--- /dev/null
+From 8055b2042a8f26acaf6fa975093ab4e63c9f8179 Mon Sep 17 00:00:00 2001
+From: Silvio Cesare <silvio.cesare@gmail.com>
+Date: Tue, 15 Jan 2019 04:27:27 +0100
+Subject: ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
+
+[ Upstream commit c407cd008fd039320d147088b52d0fa34ed3ddcb ]
+
+Change snprintf to scnprintf. There are generally two cases where using
+snprintf causes problems.
+
+1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
+In this case, if snprintf would have written more characters than what the
+buffer size (SIZE) is, then size will end up larger than SIZE. In later
+uses of snprintf, SIZE - size will result in a negative number, leading
+to problems. Note that size might already be too large by using
+size = snprintf before the code reaches a case of size += snprintf.
+
+2) If size is ultimately used as a length parameter for a copy back to user
+space, then it will potentially allow for a buffer overflow and information
+disclosure when size is greater than SIZE. When the size is used to index
+the buffer directly, we can have memory corruption. This also means when
+size = snprintf... is used, it may also cause problems since size may become
+large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel
+configuration.
+
+The solution to these issues is to use scnprintf which returns the number of
+characters actually written to the buffer, so the size variable will never
+exceed SIZE.
+
+Signed-off-by: Silvio Cesare <silvio.cesare@gmail.com>
+Cc: Timur Tabi <timur@kernel.org>
+Cc: Nicolin Chen <nicoleotsuka@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Xiubo Li <Xiubo.Lee@gmail.com>
+Cc: Fabio Estevam <fabio.estevam@nxp.com>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
+index 392d5eef356d3..99e07b01a2ce9 100644
+--- a/sound/soc/fsl/imx-audmux.c
++++ b/sound/soc/fsl/imx-audmux.c
+@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
+ if (!buf)
+ return -ENOMEM;
+
+- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
++ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
+ pdcr, ptcr);
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxFS output from %s, ",
+ audmux_port_string((ptcr >> 27) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxFS input, ");
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxClk output from %s",
+ audmux_port_string((ptcr >> 22) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "TxClk input");
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n");
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) {
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "Port is symmetric");
+ } else {
+ if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxFS output from %s, ",
+ audmux_port_string((ptcr >> 17) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxFS input, ");
+
+ if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR)
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxClk output from %s",
+ audmux_port_string((ptcr >> 12) & 0x7));
+ else
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "RxClk input");
+ }
+
+- ret += snprintf(buf + ret, PAGE_SIZE - ret,
++ ret += scnprintf(buf + ret, PAGE_SIZE - ret,
+ "\nData received from %s\n",
+ audmux_port_string((pdcr >> 13) & 0x7));
+
+--
+2.19.1
+
--- /dev/null
+From f06fe5a29bcdba910c667394d052d0d95820fe4a Mon Sep 17 00:00:00 2001
+From: Rander Wang <rander.wang@linux.intel.com>
+Date: Tue, 18 Dec 2018 16:24:54 +0800
+Subject: ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
+
+[ Upstream commit 906a9abc5de73c383af518f5a806f4be2993a0c7 ]
+
+For some reason this field was set to zero when all other drivers use
+.dynamic = 1 for front-ends. This change was tested on Dell XPS13 and
+has no impact with the existing legacy driver. The SOF driver also works
+with this change which enables it to override the fixed topology.
+
+Signed-off-by: Rander Wang <rander.wang@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/broadwell.c | 2 +-
+ sound/soc/intel/boards/haswell.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c
+index 7b0ee67b4fc8b..78ec97b53f50e 100644
+--- a/sound/soc/intel/boards/broadwell.c
++++ b/sound/soc/intel/boards/broadwell.c
+@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = {
+ .stream_name = "Loopback",
+ .cpu_dai_name = "Loopback Pin",
+ .platform_name = "haswell-pcm-audio",
+- .dynamic = 0,
++ .dynamic = 1,
+ .codec_name = "snd-soc-dummy",
+ .codec_dai_name = "snd-soc-dummy-dai",
+ .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c
+index eab1f439dd3f1..a4022983a7ce0 100644
+--- a/sound/soc/intel/boards/haswell.c
++++ b/sound/soc/intel/boards/haswell.c
+@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = {
+ .stream_name = "Loopback",
+ .cpu_dai_name = "Loopback Pin",
+ .platform_name = "haswell-pcm-audio",
+- .dynamic = 0,
++ .dynamic = 1,
+ .codec_name = "snd-soc-dummy",
+ .codec_dai_name = "snd-soc-dummy-dai",
+ .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
+--
+2.19.1
+
--- /dev/null
+From 6b892c85b53a5884bd362ba3ef06cbe5363240b0 Mon Sep 17 00:00:00 2001
+From: Shuming Fan <shumingf@realtek.com>
+Date: Tue, 15 Jan 2019 11:27:39 +0800
+Subject: ASoC: rt5682: Fix PLL source register definitions
+
+[ Upstream commit ee7ea2a9a318a89d21b156dc75e54d53904bdbe5 ]
+
+Fix typo which causes headphone no sound while using BCLK
+as PLL source.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682.h | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h
+index 8068140ebe3f1..cdd659f4df93d 100644
+--- a/sound/soc/codecs/rt5682.h
++++ b/sound/soc/codecs/rt5682.h
+@@ -849,18 +849,18 @@
+ #define RT5682_SCLK_SRC_PLL2 (0x2 << 13)
+ #define RT5682_SCLK_SRC_SDW (0x3 << 13)
+ #define RT5682_SCLK_SRC_RCCLK (0x4 << 13)
+-#define RT5682_PLL1_SRC_MASK (0x3 << 10)
+-#define RT5682_PLL1_SRC_SFT 10
+-#define RT5682_PLL1_SRC_MCLK (0x0 << 10)
+-#define RT5682_PLL1_SRC_BCLK1 (0x1 << 10)
+-#define RT5682_PLL1_SRC_SDW (0x2 << 10)
+-#define RT5682_PLL1_SRC_RC (0x3 << 10)
+-#define RT5682_PLL2_SRC_MASK (0x3 << 8)
+-#define RT5682_PLL2_SRC_SFT 8
+-#define RT5682_PLL2_SRC_MCLK (0x0 << 8)
+-#define RT5682_PLL2_SRC_BCLK1 (0x1 << 8)
+-#define RT5682_PLL2_SRC_SDW (0x2 << 8)
+-#define RT5682_PLL2_SRC_RC (0x3 << 8)
++#define RT5682_PLL2_SRC_MASK (0x3 << 10)
++#define RT5682_PLL2_SRC_SFT 10
++#define RT5682_PLL2_SRC_MCLK (0x0 << 10)
++#define RT5682_PLL2_SRC_BCLK1 (0x1 << 10)
++#define RT5682_PLL2_SRC_SDW (0x2 << 10)
++#define RT5682_PLL2_SRC_RC (0x3 << 10)
++#define RT5682_PLL1_SRC_MASK (0x3 << 8)
++#define RT5682_PLL1_SRC_SFT 8
++#define RT5682_PLL1_SRC_MCLK (0x0 << 8)
++#define RT5682_PLL1_SRC_BCLK1 (0x1 << 8)
++#define RT5682_PLL1_SRC_SDW (0x2 << 8)
++#define RT5682_PLL1_SRC_RC (0x3 << 8)
+
+
+
+--
+2.19.1
+
--- /dev/null
+From cf412fdc2e59b2cd48e079d7e7084aec4e065d06 Mon Sep 17 00:00:00 2001
+From: Yizhuo <yzhai003@ucr.edu>
+Date: Thu, 3 Jan 2019 13:59:12 -0800
+Subject: ASoC: Variable "val" in function rt274_i2c_probe() could be
+ uninitialized
+
+[ Upstream commit 8c3590de0a378c2449fc1aec127cc693632458e4 ]
+
+Inside function rt274_i2c_probe(), if regmap_read() function
+returns -EINVAL, then local variable "val" leaves uninitialized
+but used in if statement. This is potentially unsafe.
+
+Signed-off-by: Yizhuo <yzhai003@ucr.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt274.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c
+index d88e673410835..18a931c25ca58 100644
+--- a/sound/soc/codecs/rt274.c
++++ b/sound/soc/codecs/rt274.c
+@@ -1126,8 +1126,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c,
+ return ret;
+ }
+
+- regmap_read(rt274->regmap,
++ ret = regmap_read(rt274->regmap,
+ RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val);
++ if (ret)
++ return ret;
++
+ if (val != RT274_VENDOR_ID) {
+ dev_err(&i2c->dev,
+ "Device with ID register %#x is not rt274\n", val);
+--
+2.19.1
+
--- /dev/null
+From 3bd2c68e7d747a6bd74983373655182167e93f04 Mon Sep 17 00:00:00 2001
+From: Chaitanya Tata <chaitanya.tata@bluwirelesstechnology.com>
+Date: Sat, 19 Jan 2019 03:17:47 +0530
+Subject: cfg80211: extend range deviation for DMG
+
+[ Upstream commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 ]
+
+Recently, DMG frequency bands have been extended till 71GHz, so extend
+the range check till 20GHz (45-71GHZ), else some channels will be marked
+as disabled.
+
+Signed-off-by: Chaitanya Tata <Chaitanya.Tata@bluwireless.co.uk>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 24cfa2776f50b..8002ace7c9f65 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1249,7 +1249,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
+ * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"),
+ * however it is safe for now to assume that a frequency rule should not be
+ * part of a frequency's band if the start freq or end freq are off by more
+- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the
++ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the
+ * 60 GHz band.
+ * This resolution can be lowered and should be considered as we add
+ * regulatory rule support for other "bands".
+@@ -1264,7 +1264,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
+ * with the Channel starting frequency above 45 GHz.
+ */
+ u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ?
+- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
++ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ;
+ if (abs(freq_khz - freq_range->start_freq_khz) <= limit)
+ return true;
+ if (abs(freq_khz - freq_range->end_freq_khz) <= limit)
+--
+2.19.1
+
--- /dev/null
+From 280830c705c70eb6d7a2a8a07f3a1f0d01d9a69e Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Fri, 4 Jan 2019 23:05:49 +0100
+Subject: clk: sysfs: fix invalid JSON in clk_dump
+
+[ Upstream commit c6e909972ef87aa2a479269f46b84126f99ec6db ]
+
+Add a missing comma so that the output is valid JSON format again.
+
+Fixes: 9fba738a53dd ("clk: add duty cycle support")
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index d31055ae6ec6f..5413ffaf02e23 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -2687,7 +2687,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
+ seq_printf(s, "\"protect_count\": %d,", c->protect_count);
+ seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
+ seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
+- seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
++ seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
+ seq_printf(s, "\"duty_cycle\": %u",
+ clk_core_get_scaled_duty_cycle(c, 100000));
+ }
+--
+2.19.1
+
--- /dev/null
+From 45f15183376af02dc904c09240eb0833372f8556 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 18 Dec 2018 11:22:41 +0300
+Subject: clk: tegra: dfll: Fix a potential Oop in remove()
+
+[ Upstream commit d39eca547f3ec67140a5d765a426eb157b978a59 ]
+
+If tegra_dfll_unregister() fails then "soc" is an error pointer. We
+should just return instead of dereferencing it.
+
+Fixes: 1752c9ee23fb ("clk: tegra: dfll: Fix drvdata overwriting issue")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-tegra124-dfll-fcpu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+index 269d3595758be..edc31bb56674a 100644
+--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
++++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c
+@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev)
+ struct tegra_dfll_soc_data *soc;
+
+ soc = tegra_dfll_unregister(pdev);
+- if (IS_ERR(soc))
++ if (IS_ERR(soc)) {
+ dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n",
+ PTR_ERR(soc));
++ return PTR_ERR(soc);
++ }
+
+ tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq);
+
+--
+2.19.1
+
--- /dev/null
+From 4525e4a86e635c961578cab4cea24f460e0baa25 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marek.vasut@gmail.com>
+Date: Sat, 15 Dec 2018 01:55:19 +0100
+Subject: clk: vc5: Abort clock configuration without upstream clock
+
+[ Upstream commit 2137a109a5e39c2bdccfffe65230ed3fadbaac0e ]
+
+In case the upstream clock are not set, which can happen in case the
+VC5 has no valid upstream clock, the $src variable is used uninited
+by regmap_update_bits(). Check for this condition and return -EINVAL
+in such case.
+
+Note that in case the VC5 has no valid upstream clock, the VC5 can
+not operate correctly. That is a hardware property of the VC5. The
+internal oscilator present in some VC5 models is also considered
+upstream clock.
+
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+Cc: Alexey Firago <alexey_firago@mentor.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: linux-renesas-soc@vger.kernel.org
+[sboyd@kernel.org: Added comment about probe preventing this from
+happening in the first place]
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-versaclock5.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c
+index decffb3826ece..a738af893532f 100644
+--- a/drivers/clk/clk-versaclock5.c
++++ b/drivers/clk/clk-versaclock5.c
+@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index)
+
+ if (vc5->clk_mux_ins == VC5_MUX_IN_XIN)
+ src = VC5_PRIM_SRC_SHDN_EN_XTAL;
+- if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
++ else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN)
+ src = VC5_PRIM_SRC_SHDN_EN_CLKIN;
++ else /* Invalid; should have been caught by vc5_probe() */
++ return -EINVAL;
+ }
+
+ return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src);
+--
+2.19.1
+
--- /dev/null
+From 253b063ba2466c0462b86a1568e30ada11b1bcfd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?=
+ <ernesto.mnd.fernandez@gmail.com>
+Date: Mon, 8 Oct 2018 20:58:23 -0300
+Subject: direct-io: allow direct writes to empty inodes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 8b9433eb4de3c26a9226c981c283f9f4896ae030 ]
+
+On a DIO_SKIP_HOLES filesystem, the ->get_block() method is currently
+not allowed to create blocks for an empty inode. This confusion comes
+from trying to bit shift a negative number, so check the size of the
+inode first.
+
+The problem is most visible for hfsplus, because the fallback to
+buffered I/O doesn't happen and the write fails with EIO. This is in
+part the fault of the module, because it gives a wrong return value on
+->get_block(); that will be fixed in a separate patch.
+
+Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/direct-io.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/direct-io.c b/fs/direct-io.c
+index 1991460360930..1abb7634b2d58 100644
+--- a/fs/direct-io.c
++++ b/fs/direct-io.c
+@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
+ unsigned long fs_count; /* Number of filesystem-sized blocks */
+ int create;
+ unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor;
++ loff_t i_size;
+
+ /*
+ * If there was a memory error and we've overwritten all the
+@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio,
+ */
+ create = dio->op == REQ_OP_WRITE;
+ if (dio->flags & DIO_SKIP_HOLES) {
+- if (fs_startblk <= ((i_size_read(dio->inode) - 1) >>
+- i_blkbits))
++ i_size = i_size_read(dio->inode);
++ if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits)
+ create = 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From b5692589c110eb0789b90fd890e02d01fef85a15 Mon Sep 17 00:00:00 2001
+From: Aaron Hill <aa1ronham@gmail.com>
+Date: Mon, 24 Dec 2018 14:23:36 -0500
+Subject: drivers: thermal: int340x_thermal: Fix sysfs race condition
+
+[ Upstream commit 129699bb8c7572106b5bbb2407c2daee4727ccad ]
+
+Changes since V1:
+* Use dev_info instead of printk
+* Use dev_warn instead of BUG_ON
+
+Previously, sysfs_create_group was called before all initialization had
+fully run - specifically, before pci_set_drvdata was called. Since the
+sysctl group is visible to userspace as soon as sysfs_create_group
+returns, a small window of time existed during which a process could read
+from an uninitialized/partially-initialized device.
+
+This commit moves the creation of the sysctl group to after all
+initialized is completed. This ensures that it's impossible for
+userspace to read from a sysctl file before initialization has fully
+completed.
+
+To catch any future regressions, I've added a check to ensure
+that proc_thermal_emum_mode is never PROC_THERMAL_NONE when a process
+tries to read from a sysctl file. Previously, the aforementioned race
+condition could result in the 'else' branch
+running while PROC_THERMAL_NONE was set,
+leading to a null pointer deference.
+
+Signed-off-by: Aaron Hill <aa1ronham@gmail.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../processor_thermal_device.c | 28 ++++++++++---------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c
+index 8e0f665cf06f8..8e1cf4d789be1 100644
+--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c
++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c
+@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \
+ struct pci_dev *pci_dev; \
+ struct platform_device *pdev; \
+ struct proc_thermal_device *proc_dev; \
+-\
++ \
++ if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \
++ dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \
++ return 0; \
++ } \
++ \
+ if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \
+ pdev = to_platform_device(dev); \
+ proc_dev = platform_get_drvdata(pdev); \
+@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev,
+ *priv = proc_priv;
+
+ ret = proc_thermal_read_ppcc(proc_priv);
+- if (!ret) {
+- ret = sysfs_create_group(&dev->kobj,
+- &power_limit_attribute_group);
+-
+- }
+ if (ret)
+ return ret;
+
+@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev,
+
+ proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops);
+ if (IS_ERR(proc_priv->int340x_zone)) {
+- ret = PTR_ERR(proc_priv->int340x_zone);
+- goto remove_group;
++ return PTR_ERR(proc_priv->int340x_zone);
+ } else
+ ret = 0;
+
+@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev,
+
+ remove_zone:
+ int340x_thermal_zone_remove(proc_priv->int340x_zone);
+-remove_group:
+- sysfs_remove_group(&proc_priv->dev->kobj,
+- &power_limit_attribute_group);
+
+ return ret;
+ }
+@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev)
+ platform_set_drvdata(pdev, proc_priv);
+ proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV;
+
+- return 0;
++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n");
++
++ return sysfs_create_group(&pdev->dev.kobj,
++ &power_limit_attribute_group);
+ }
+
+ static int int3401_remove(struct platform_device *pdev)
+@@ -441,7 +440,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev,
+ dev_err(&pdev->dev, "No auxiliary DTSs enabled\n");
+ }
+
+- return 0;
++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n");
++
++ return sysfs_create_group(&pdev->dev.kobj,
++ &power_limit_attribute_group);
+ }
+
+ static void proc_thermal_pci_remove(struct pci_dev *pdev)
+--
+2.19.1
+
--- /dev/null
+From f48cf7cee75a6e4dfea87a7ed879e7e82d37a7ea Mon Sep 17 00:00:00 2001
+From: Kenneth Feng <kenneth.feng@amd.com>
+Date: Fri, 18 Jan 2019 18:08:19 +0800
+Subject: drm/amd/powerplay: OD setting fix on Vega10
+
+[ Upstream commit 6d87dc97eb3341de3f7b1efa3156cb0e014f4a96 ]
+
+gfxclk for OD setting is limited to 1980M for non-acg
+ASICs of Vega10
+
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../powerplay/hwmgr/vega10_processpptables.c | 22 ++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+index 16b1a9cf6cf08..743d3c983082d 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+@@ -32,6 +32,7 @@
+ #include "vega10_pptable.h"
+
+ #define NUM_DSPCLK_LEVELS 8
++#define VEGA10_ENGINECLOCK_HARDMAX 198000
+
+ static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable,
+ enum phm_platform_caps cap)
+@@ -258,7 +259,26 @@ static int init_over_drive_limits(
+ struct pp_hwmgr *hwmgr,
+ const ATOM_Vega10_POWERPLAYTABLE *powerplay_table)
+ {
+- hwmgr->platform_descriptor.overdriveLimit.engineClock =
++ const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table =
++ (const ATOM_Vega10_GFXCLK_Dependency_Table *)
++ (((unsigned long) powerplay_table) +
++ le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset));
++ bool is_acg_enabled = false;
++ ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2;
++
++ if (gfxclk_dep_table->ucRevId == 1) {
++ patom_record_v2 =
++ (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
++ is_acg_enabled =
++ (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable;
++ }
++
++ if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX &&
++ !is_acg_enabled)
++ hwmgr->platform_descriptor.overdriveLimit.engineClock =
++ VEGA10_ENGINECLOCK_HARDMAX;
++ else
++ hwmgr->platform_descriptor.overdriveLimit.engineClock =
+ le32_to_cpu(powerplay_table->ulMaxODEngineClock);
+ hwmgr->platform_descriptor.overdriveLimit.memoryClock =
+ le32_to_cpu(powerplay_table->ulMaxODMemoryClock);
+--
+2.19.1
+
--- /dev/null
+From b4e1f95910a20a1adc33bf64be778d34b9ac3d53 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Wed, 16 Jan 2019 10:46:21 -0800
+Subject: drm/msm: Fix A6XX support for opp-level
+
+[ Upstream commit a3c5e2cd79753121f49a8662c1e0a60ddb5486ca ]
+
+The bindings for Qualcomm opp levels changed after being Acked but
+before landing. Thus the code in the GPU driver that was relying on
+the old bindings is now broken.
+
+Let's change the code to match the new bindings by adjusting the old
+string 'qcom,level' to the new string 'opp-level'. See the patch
+("dt-bindings: opp: Introduce opp-level bindings").
+
+NOTE: we will do additional cleanup to totally remove the string from
+the code and use the new dev_pm_opp_get_level() but we'll do it in a
+future patch. This will facilitate getting the important code fix in
+sooner without having to deal with cross-maintainer dependencies.
+
+This patch needs to land before the patch ("arm64: dts: sdm845: Add
+gpu and gmu device nodes") since if a tree contains the device tree
+patch but not this one you'll get a crash at bootup.
+
+Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index bbb8126ec5c57..9acb9dfaf57e6 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -896,7 +896,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq)
+ np = dev_pm_opp_get_of_node(opp);
+
+ if (np) {
+- of_property_read_u32(np, "qcom,level", &val);
++ of_property_read_u32(np, "opp-level", &val);
+ of_node_put(np);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 56ca32e1c249721fe882121bfd8ede30003c7ba8 Mon Sep 17 00:00:00 2001
+From: "Kristian H. Kristensen" <hoegsberg@gmail.com>
+Date: Wed, 19 Dec 2018 08:57:41 -0800
+Subject: drm/msm: Unblock writer if reader closes file
+
+[ Upstream commit 99c66bc051e7407fe0bf0607b142ec0be1a1d1dd ]
+
+Prevents deadlock when fifo is full and reader closes file.
+
+Signed-off-by: Kristian H. Kristensen <hoegsberg@chromium.org>
+Signed-off-by: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_rd.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c
+index f7a0edea4705b..d4cc5ceb22d01 100644
+--- a/drivers/gpu/drm/msm/msm_rd.c
++++ b/drivers/gpu/drm/msm/msm_rd.c
+@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
+ char *fptr = &fifo->buf[fifo->head];
+ int n;
+
+- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0);
++ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
++ if (!rd->open)
++ return;
+
+ /* Note that smp_load_acquire() is not strictly required
+ * as CIRC_SPACE_TO_END() does not access the tail more
+@@ -213,7 +215,10 @@ static int rd_open(struct inode *inode, struct file *file)
+ static int rd_release(struct inode *inode, struct file *file)
+ {
+ struct msm_rd_state *rd = inode->i_private;
++
+ rd->open = false;
++ wake_up_all(&rd->fifo_event);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 00432e7b98effba57b0e66aa87ab5d05b2bdf8e8 Mon Sep 17 00:00:00 2001
+From: Priit Laes <priit.laes@paf.com>
+Date: Tue, 22 Jan 2019 09:32:32 +0200
+Subject: drm/sun4i: hdmi: Fix usage of TMDS clock
+
+[ Upstream commit 5e1bc251cebc84b41b8eb5d2434e54d939a85430 ]
+
+Although TMDS clock is required for HDMI to properly function,
+nobody called clk_prepare_enable(). This fixes reference counting
+issues and makes sure clock is running when it needs to be running.
+
+Due to TDMS clock being parent clock for DDC clock, TDMS clock
+was turned on/off for each EDID probe, causing spurious failures
+for certain HDMI/DVI screens.
+
+Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support")
+Signed-off-by: Priit Laes <priit.laes@paf.com>
+[Maxime: Moved the TMDS clock enable earlier]
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190122073232.7240-1-plaes@plaes.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 061d2e0d9011e..416da53767018 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder)
+ val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
+ val &= ~SUN4I_HDMI_VID_CTRL_ENABLE;
+ writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG);
++
++ clk_disable_unprepare(hdmi->tmds_clk);
+ }
+
+ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
+@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder)
+
+ DRM_DEBUG_DRIVER("Enabling the HDMI Output\n");
+
++ clk_prepare_enable(hdmi->tmds_clk);
++
+ sun4i_hdmi_setup_avi_infoframes(hdmi, mode);
+ val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI);
+ val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END);
+--
+2.19.1
+
--- /dev/null
+From 2b4630941aa7ce7ef65a605b705879365dfb6947 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 29 Nov 2018 14:44:49 +0100
+Subject: futex: Fix (possible) missed wakeup
+
+[ Upstream commit b061c38bef43406df8e73c5be06cbfacad5ee6ad ]
+
+We must not rely on wake_q_add() to delay the wakeup; in particular
+commit:
+
+ 1d0dcb3ad9d3 ("futex: Implement lockless wakeups")
+
+moved wake_q_add() before smp_store_release(&q->lock_ptr, NULL), which
+could result in futex_wait() waking before observing ->lock_ptr ==
+NULL and going back to sleep again.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 1d0dcb3ad9d3 ("futex: Implement lockless wakeups")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/futex.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index d7c465fd687c6..c5fca746edc46 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1444,11 +1444,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
+ return;
+
+- /*
+- * Queue the task for later wakeup for after we've released
+- * the hb->lock. wake_q_add() grabs reference to p.
+- */
+- wake_q_add(wake_q, p);
++ get_task_struct(p);
+ __unqueue_futex(q);
+ /*
+ * The waiting task can free the futex_q as soon as q->lock_ptr = NULL
+@@ -1458,6 +1454,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ * plist_del in __unqueue_futex().
+ */
+ smp_store_release(&q->lock_ptr, NULL);
++
++ /*
++ * Queue the task for later wakeup for after we've released
++ * the hb->lock. wake_q_add() grabs reference to p.
++ */
++ wake_q_add(wake_q, p);
++ put_task_struct(p);
+ }
+
+ /*
+--
+2.19.1
+
--- /dev/null
+From de58b982935bab5d8e976f27cb5e17aa63555e70 Mon Sep 17 00:00:00 2001
+From: Srinivas Ramana <sramana@codeaurora.org>
+Date: Thu, 20 Dec 2018 19:05:57 +0530
+Subject: genirq: Make sure the initial affinity is not empty
+
+[ Upstream commit bddda606ec76550dd63592e32a6e87e7d32583f7 ]
+
+If all CPUs in the irq_default_affinity mask are offline when an interrupt
+is initialized then irq_setup_affinity() can set an empty affinity mask for
+a newly allocated interrupt.
+
+Fix this by falling back to cpu_online_mask in case the resulting affinity
+mask is zero.
+
+Signed-off-by: Srinivas Ramana <sramana@codeaurora.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-arm-msm@vger.kernel.org
+Link: https://lkml.kernel.org/r/1545312957-8504-1-git-send-email-sramana@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/manage.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 9dbdccab3b6a3..5c0ba5ca59308 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc)
+ }
+
+ cpumask_and(&mask, cpu_online_mask, set);
++ if (cpumask_empty(&mask))
++ cpumask_copy(&mask, cpu_online_mask);
++
+ if (node != NUMA_NO_NODE) {
+ const struct cpumask *nodemask = cpumask_of_node(node);
+
+--
+2.19.1
+
--- /dev/null
+From def5bc3f60ba0cdd38011fd638d29a3744311532 Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Tue, 15 Jan 2019 00:51:42 +0000
+Subject: hv_netvsc: Fix ethtool change hash key error
+
+[ Upstream commit b4a10c750424e01b5e37372fef0a574ebf7b56c3 ]
+
+Hyper-V hosts require us to disable RSS before changing RSS key,
+otherwise the changing request will fail. This patch fixes the
+coding error.
+
+Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table")
+Reported-by: Wei Hu <weh@microsoft.com>
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+[sl: fix up subject line]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/rndis_filter.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index 2a5209f23f296..0b05f7ebeb01e 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -715,8 +715,8 @@ rndis_filter_set_offload_params(struct net_device *ndev,
+ return ret;
+ }
+
+-int rndis_filter_set_rss_param(struct rndis_device *rdev,
+- const u8 *rss_key)
++static int rndis_set_rss_param_msg(struct rndis_device *rdev,
++ const u8 *rss_key, u16 flag)
+ {
+ struct net_device *ndev = rdev->ndev;
+ struct rndis_request *request;
+@@ -745,7 +745,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
+ rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS;
+ rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2;
+ rssp->hdr.size = sizeof(struct ndis_recv_scale_param);
+- rssp->flag = 0;
++ rssp->flag = flag;
+ rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 |
+ NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 |
+ NDIS_HASH_TCP_IPV6;
+@@ -770,9 +770,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
+
+ wait_for_completion(&request->wait_event);
+ set_complete = &request->response_msg.msg.set_complete;
+- if (set_complete->status == RNDIS_STATUS_SUCCESS)
+- memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
+- else {
++ if (set_complete->status == RNDIS_STATUS_SUCCESS) {
++ if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) &&
++ !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED))
++ memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN);
++
++ } else {
+ netdev_err(ndev, "Fail to set RSS parameters:0x%x\n",
+ set_complete->status);
+ ret = -EINVAL;
+@@ -783,6 +786,16 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev,
+ return ret;
+ }
+
++int rndis_filter_set_rss_param(struct rndis_device *rdev,
++ const u8 *rss_key)
++{
++ /* Disable RSS before change */
++ rndis_set_rss_param_msg(rdev, rss_key,
++ NDIS_RSS_PARAM_FLAG_DISABLE_RSS);
++
++ return rndis_set_rss_param_msg(rdev, rss_key, 0);
++}
++
+ static int rndis_filter_query_device_link_status(struct rndis_device *dev,
+ struct netvsc_device *net_device)
+ {
+--
+2.19.1
+
--- /dev/null
+From c96df1c2a74fb65b59d5597019f9d3e19bc5f7ac Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Tue, 15 Jan 2019 00:51:44 +0000
+Subject: hv_netvsc: Fix hash key value reset after other ops
+
+[ Upstream commit 17d91256898402daf4425cc541ac9cbf64574d9a ]
+
+Changing mtu, channels, or buffer sizes ops call to netvsc_attach(),
+rndis_set_subchannel(), which always reset the hash key to default
+value. That will override hash key changed previously. This patch
+fixes the problem by save the hash key, then restore it when we re-
+add the netvsc device.
+
+Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table")
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+[sl: fix up subject line]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/hyperv_net.h | 10 +++++++---
+ drivers/net/hyperv/netvsc.c | 2 +-
+ drivers/net/hyperv/netvsc_drv.c | 5 ++++-
+ drivers/net/hyperv/rndis_filter.c | 9 +++++++--
+ 4 files changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
+index a32ded5b4f416..42d284669b03a 100644
+--- a/drivers/net/hyperv/hyperv_net.h
++++ b/drivers/net/hyperv/hyperv_net.h
+@@ -144,6 +144,8 @@ struct hv_netvsc_packet {
+ u32 total_data_buflen;
+ };
+
++#define NETVSC_HASH_KEYLEN 40
++
+ struct netvsc_device_info {
+ unsigned char mac_adr[ETH_ALEN];
+ u32 num_chn;
+@@ -151,6 +153,8 @@ struct netvsc_device_info {
+ u32 recv_sections;
+ u32 send_section_size;
+ u32 recv_section_size;
++
++ u8 rss_key[NETVSC_HASH_KEYLEN];
+ };
+
+ enum rndis_device_state {
+@@ -160,8 +164,6 @@ enum rndis_device_state {
+ RNDIS_DEV_DATAINITIALIZED,
+ };
+
+-#define NETVSC_HASH_KEYLEN 40
+-
+ struct rndis_device {
+ struct net_device *ndev;
+
+@@ -210,7 +212,9 @@ int netvsc_recv_callback(struct net_device *net,
+ void netvsc_channel_cb(void *context);
+ int netvsc_poll(struct napi_struct *napi, int budget);
+
+-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev);
++int rndis_set_subchannel(struct net_device *ndev,
++ struct netvsc_device *nvdev,
++ struct netvsc_device_info *dev_info);
+ int rndis_filter_open(struct netvsc_device *nvdev);
+ int rndis_filter_close(struct netvsc_device *nvdev);
+ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev,
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index fe01e141c8f87..1a942feab9548 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w)
+
+ rdev = nvdev->extension;
+ if (rdev) {
+- ret = rndis_set_subchannel(rdev->ndev, nvdev);
++ ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL);
+ if (ret == 0) {
+ netif_device_attach(rdev->ndev);
+ } else {
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index bece935567c14..c9e2a986ccb72 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -875,6 +875,9 @@ static struct netvsc_device_info *netvsc_devinfo_get
+ dev_info->send_section_size = nvdev->send_section_size;
+ dev_info->recv_sections = nvdev->recv_section_cnt;
+ dev_info->recv_section_size = nvdev->recv_section_size;
++
++ memcpy(dev_info->rss_key, nvdev->extension->rss_key,
++ NETVSC_HASH_KEYLEN);
+ } else {
+ dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
+ dev_info->send_sections = NETVSC_DEFAULT_TX;
+@@ -937,7 +940,7 @@ static int netvsc_attach(struct net_device *ndev,
+ return PTR_ERR(nvdev);
+
+ if (nvdev->num_chn > 1) {
+- ret = rndis_set_subchannel(ndev, nvdev);
++ ret = rndis_set_subchannel(ndev, nvdev, dev_info);
+
+ /* if unavailable, just proceed with one queue */
+ if (ret) {
+diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
+index 0b05f7ebeb01e..53c6039bffb67 100644
+--- a/drivers/net/hyperv/rndis_filter.c
++++ b/drivers/net/hyperv/rndis_filter.c
+@@ -1075,7 +1075,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc)
+ * This breaks overlap of processing the host message for the
+ * new primary channel with the initialization of sub-channels.
+ */
+-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
++int rndis_set_subchannel(struct net_device *ndev,
++ struct netvsc_device *nvdev,
++ struct netvsc_device_info *dev_info)
+ {
+ struct nvsp_message *init_packet = &nvdev->channel_init_pkt;
+ struct net_device_context *ndev_ctx = netdev_priv(ndev);
+@@ -1116,7 +1118,10 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev)
+ atomic_read(&nvdev->open_chn) == nvdev->num_chn);
+
+ /* ignore failues from setting rss parameters, still have channels */
+- rndis_filter_set_rss_param(rdev, netvsc_hash_key);
++ if (dev_info)
++ rndis_filter_set_rss_param(rdev, dev_info->rss_key);
++ else
++ rndis_filter_set_rss_param(rdev, netvsc_hash_key);
+
+ netif_set_real_num_tx_queues(ndev, nvdev->num_chn);
+ netif_set_real_num_rx_queues(ndev, nvdev->num_chn);
+--
+2.19.1
+
--- /dev/null
+From 6e780175fc320cdbef7a9a199b7735f63c17f035 Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Tue, 15 Jan 2019 00:51:43 +0000
+Subject: hv_netvsc: Refactor assignments of struct netvsc_device_info
+
+[ Upstream commit 7c9f335a3ff20557a92584199f3d35c7e992bbe5 ]
+
+These assignments occur in multiple places. The patch refactor them
+to a function for simplicity. It also puts the struct to heap area
+for future expension.
+
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+[sl: fix up subject line]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 134 ++++++++++++++++++++------------
+ 1 file changed, 85 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 1c37a821895b7..bece935567c14 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -856,6 +856,36 @@ static void netvsc_get_channels(struct net_device *net,
+ }
+ }
+
++/* Alloc struct netvsc_device_info, and initialize it from either existing
++ * struct netvsc_device, or from default values.
++ */
++static struct netvsc_device_info *netvsc_devinfo_get
++ (struct netvsc_device *nvdev)
++{
++ struct netvsc_device_info *dev_info;
++
++ dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC);
++
++ if (!dev_info)
++ return NULL;
++
++ if (nvdev) {
++ dev_info->num_chn = nvdev->num_chn;
++ dev_info->send_sections = nvdev->send_section_cnt;
++ dev_info->send_section_size = nvdev->send_section_size;
++ dev_info->recv_sections = nvdev->recv_section_cnt;
++ dev_info->recv_section_size = nvdev->recv_section_size;
++ } else {
++ dev_info->num_chn = VRSS_CHANNEL_DEFAULT;
++ dev_info->send_sections = NETVSC_DEFAULT_TX;
++ dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE;
++ dev_info->recv_sections = NETVSC_DEFAULT_RX;
++ dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE;
++ }
++
++ return dev_info;
++}
++
+ static int netvsc_detach(struct net_device *ndev,
+ struct netvsc_device *nvdev)
+ {
+@@ -941,7 +971,7 @@ static int netvsc_set_channels(struct net_device *net,
+ struct net_device_context *net_device_ctx = netdev_priv(net);
+ struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev);
+ unsigned int orig, count = channels->combined_count;
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info;
+ int ret;
+
+ /* We do not support separate count for rx, tx, or other */
+@@ -960,24 +990,26 @@ static int netvsc_set_channels(struct net_device *net,
+
+ orig = nvdev->num_chn;
+
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = count;
+- device_info.send_sections = nvdev->send_section_cnt;
+- device_info.send_section_size = nvdev->send_section_size;
+- device_info.recv_sections = nvdev->recv_section_cnt;
+- device_info.recv_section_size = nvdev->recv_section_size;
++ device_info = netvsc_devinfo_get(nvdev);
++
++ if (!device_info)
++ return -ENOMEM;
++
++ device_info->num_chn = count;
+
+ ret = netvsc_detach(net, nvdev);
+ if (ret)
+- return ret;
++ goto out;
+
+- ret = netvsc_attach(net, &device_info);
++ ret = netvsc_attach(net, device_info);
+ if (ret) {
+- device_info.num_chn = orig;
+- if (netvsc_attach(net, &device_info))
++ device_info->num_chn = orig;
++ if (netvsc_attach(net, device_info))
+ netdev_err(net, "restoring channel setting failed\n");
+ }
+
++out:
++ kfree(device_info);
+ return ret;
+ }
+
+@@ -1044,48 +1076,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu)
+ struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev);
+ struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
+ int orig_mtu = ndev->mtu;
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info;
+ int ret = 0;
+
+ if (!nvdev || nvdev->destroy)
+ return -ENODEV;
+
++ device_info = netvsc_devinfo_get(nvdev);
++
++ if (!device_info)
++ return -ENOMEM;
++
+ /* Change MTU of underlying VF netdev first. */
+ if (vf_netdev) {
+ ret = dev_set_mtu(vf_netdev, mtu);
+ if (ret)
+- return ret;
++ goto out;
+ }
+
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = nvdev->num_chn;
+- device_info.send_sections = nvdev->send_section_cnt;
+- device_info.send_section_size = nvdev->send_section_size;
+- device_info.recv_sections = nvdev->recv_section_cnt;
+- device_info.recv_section_size = nvdev->recv_section_size;
+-
+ ret = netvsc_detach(ndev, nvdev);
+ if (ret)
+ goto rollback_vf;
+
+ ndev->mtu = mtu;
+
+- ret = netvsc_attach(ndev, &device_info);
+- if (ret)
+- goto rollback;
+-
+- return 0;
++ ret = netvsc_attach(ndev, device_info);
++ if (!ret)
++ goto out;
+
+-rollback:
+ /* Attempt rollback to original MTU */
+ ndev->mtu = orig_mtu;
+
+- if (netvsc_attach(ndev, &device_info))
++ if (netvsc_attach(ndev, device_info))
+ netdev_err(ndev, "restoring mtu failed\n");
+ rollback_vf:
+ if (vf_netdev)
+ dev_set_mtu(vf_netdev, orig_mtu);
+
++out:
++ kfree(device_info);
+ return ret;
+ }
+
+@@ -1690,7 +1719,7 @@ static int netvsc_set_ringparam(struct net_device *ndev,
+ {
+ struct net_device_context *ndevctx = netdev_priv(ndev);
+ struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev);
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info;
+ struct ethtool_ringparam orig;
+ u32 new_tx, new_rx;
+ int ret = 0;
+@@ -1710,26 +1739,29 @@ static int netvsc_set_ringparam(struct net_device *ndev,
+ new_rx == orig.rx_pending)
+ return 0; /* no change */
+
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = nvdev->num_chn;
+- device_info.send_sections = new_tx;
+- device_info.send_section_size = nvdev->send_section_size;
+- device_info.recv_sections = new_rx;
+- device_info.recv_section_size = nvdev->recv_section_size;
++ device_info = netvsc_devinfo_get(nvdev);
++
++ if (!device_info)
++ return -ENOMEM;
++
++ device_info->send_sections = new_tx;
++ device_info->recv_sections = new_rx;
+
+ ret = netvsc_detach(ndev, nvdev);
+ if (ret)
+- return ret;
++ goto out;
+
+- ret = netvsc_attach(ndev, &device_info);
++ ret = netvsc_attach(ndev, device_info);
+ if (ret) {
+- device_info.send_sections = orig.tx_pending;
+- device_info.recv_sections = orig.rx_pending;
++ device_info->send_sections = orig.tx_pending;
++ device_info->recv_sections = orig.rx_pending;
+
+- if (netvsc_attach(ndev, &device_info))
++ if (netvsc_attach(ndev, device_info))
+ netdev_err(ndev, "restoring ringparam failed");
+ }
+
++out:
++ kfree(device_info);
+ return ret;
+ }
+
+@@ -2158,7 +2190,7 @@ static int netvsc_probe(struct hv_device *dev,
+ {
+ struct net_device *net = NULL;
+ struct net_device_context *net_device_ctx;
+- struct netvsc_device_info device_info;
++ struct netvsc_device_info *device_info = NULL;
+ struct netvsc_device *nvdev;
+ int ret = -ENOMEM;
+
+@@ -2205,21 +2237,21 @@ static int netvsc_probe(struct hv_device *dev,
+ netif_set_real_num_rx_queues(net, 1);
+
+ /* Notify the netvsc driver of the new device */
+- memset(&device_info, 0, sizeof(device_info));
+- device_info.num_chn = VRSS_CHANNEL_DEFAULT;
+- device_info.send_sections = NETVSC_DEFAULT_TX;
+- device_info.send_section_size = NETVSC_SEND_SECTION_SIZE;
+- device_info.recv_sections = NETVSC_DEFAULT_RX;
+- device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE;
+-
+- nvdev = rndis_filter_device_add(dev, &device_info);
++ device_info = netvsc_devinfo_get(NULL);
++
++ if (!device_info) {
++ ret = -ENOMEM;
++ goto devinfo_failed;
++ }
++
++ nvdev = rndis_filter_device_add(dev, device_info);
+ if (IS_ERR(nvdev)) {
+ ret = PTR_ERR(nvdev);
+ netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
+ goto rndis_failed;
+ }
+
+- memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN);
++ memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN);
+
+ /* We must get rtnl lock before scheduling nvdev->subchan_work,
+ * otherwise netvsc_subchan_work() can get rtnl lock first and wait
+@@ -2257,12 +2289,16 @@ static int netvsc_probe(struct hv_device *dev,
+
+ list_add(&net_device_ctx->list, &netvsc_dev_list);
+ rtnl_unlock();
++
++ kfree(device_info);
+ return 0;
+
+ register_failed:
+ rtnl_unlock();
+ rndis_filter_device_remove(dev, nvdev);
+ rndis_failed:
++ kfree(device_info);
++devinfo_failed:
+ free_percpu(net_device_ctx->vf_stats);
+ no_stats:
+ hv_set_drvdata(dev, NULL);
+--
+2.19.1
+
--- /dev/null
+From c45dd362107e028d609bf03eb4d64d180eba7d1a Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 24 Jan 2019 11:17:01 -0600
+Subject: ibmveth: Do not process frames after calling napi_reschedule
+
+[ Upstream commit e95d22c69b2c130ccce257b84daf283fd82d611e ]
+
+The IBM virtual ethernet driver's polling function continues
+to process frames after rescheduling NAPI, resulting in a warning
+if it exhausted its budget. Do not restart polling after calling
+napi_reschedule. Instead let frames be processed in the following
+instance.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmveth.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 91f48c0780734..f70cb4d3c6846 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -1314,7 +1314,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
+ unsigned long lpar_rc;
+ u16 mss = 0;
+
+-restart_poll:
+ while (frames_processed < budget) {
+ if (!ibmveth_rxq_pending_buffer(adapter))
+ break;
+@@ -1402,7 +1401,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
+ napi_reschedule(napi)) {
+ lpar_rc = h_vio_signal(adapter->vdev->unit_address,
+ VIO_IRQ_DISABLE);
+- goto restart_poll;
+ }
+ }
+
+--
+2.19.1
+
--- /dev/null
+From a4a622bf94eab9692f998cfa224a06122e84918c Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 26 Oct 2018 15:51:17 +0800
+Subject: irqchip/gic-v3-mbi: Fix uninitialized mbi_lock
+
+[ Upstream commit c530bb8a726a37811e9fb5d68cd6b5408173b545 ]
+
+The mbi_lock mutex is left uninitialized, so let's use DEFINE_MUTEX
+to initialize it statically.
+
+Fixes: 505287525c24d ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-mbi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c
+index ad70e7c416e30..fbfa7ff6deb16 100644
+--- a/drivers/irqchip/irq-gic-v3-mbi.c
++++ b/drivers/irqchip/irq-gic-v3-mbi.c
+@@ -24,7 +24,7 @@ struct mbi_range {
+ unsigned long *bm;
+ };
+
+-static struct mutex mbi_lock;
++static DEFINE_MUTEX(mbi_lock);
+ static phys_addr_t mbi_phys_base;
+ static struct mbi_range *mbi_ranges;
+ static unsigned int mbi_range_nr;
+--
+2.19.1
+
--- /dev/null
+From 162ec9e45830ea70786fba3a24b6c3afe94669ab Mon Sep 17 00:00:00 2001
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+Date: Mon, 7 Jan 2019 19:44:51 +0100
+Subject: KVM: nSVM: clear events pending from svm_complete_interrupts() when
+ exiting to L1
+
+[ Upstream commit 619ad846fc3452adaf71ca246c5aa711e2055398 ]
+
+kvm-unit-tests' eventinj "NMI failing on IDT" test results in NMI being
+delivered to the host (L1) when it's running nested. The problem seems to
+be: svm_complete_interrupts() raises 'nmi_injected' flag but later we
+decide to reflect EXIT_NPF to L1. The flag remains pending and we do NMI
+injection upon entry so it got delivered to L1 instead of L2.
+
+It seems that VMX code solves the same issue in prepare_vmcs12(), this was
+introduced with code refactoring in commit 5f3d5799974b ("KVM: nVMX: Rework
+event injection and recovery").
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 8241fd27de19c..b475419620121 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3399,6 +3399,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
+ kvm_mmu_reset_context(&svm->vcpu);
+ kvm_mmu_load(&svm->vcpu);
+
++ /*
++ * Drop what we picked up for L2 via svm_complete_interrupts() so it
++ * doesn't end up in L1.
++ */
++ svm->vcpu.arch.nmi_injected = false;
++ kvm_clear_exception_queue(&svm->vcpu);
++ kvm_clear_interrupt_queue(&svm->vcpu);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 2ee52999f528b076ed1294602c572cbce6ef5e9d Mon Sep 17 00:00:00 2001
+From: Ben Gardon <bgardon@google.com>
+Date: Wed, 16 Jan 2019 09:41:15 -0800
+Subject: kvm: selftests: Fix region overlap check in kvm_util
+
+[ Upstream commit 94a980c39c8e3f8abaff5d3b5bbcd4ccf1c02c4f ]
+
+Fix a call to userspace_mem_region_find to conform to its spec of
+taking an inclusive, inclusive range. It was previously being called
+with an inclusive, exclusive range. Also remove a redundant region bounds
+check in vm_userspace_mem_region_add. Region overlap checking is already
+performed by the call to userspace_mem_region_find.
+
+Tested: Compiled tools/testing/selftests/kvm with -static
+ Ran all resulting test binaries on an Intel Haswell test machine
+ All tests passed
+
+Signed-off-by: Ben Gardon <bgardon@google.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/lib/kvm_util.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
+index 6fd8c089cafcd..fb5d2d1e0c048 100644
+--- a/tools/testing/selftests/kvm/lib/kvm_util.c
++++ b/tools/testing/selftests/kvm/lib/kvm_util.c
+@@ -590,7 +590,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
+ * already exist.
+ */
+ region = (struct userspace_mem_region *) userspace_mem_region_find(
+- vm, guest_paddr, guest_paddr + npages * vm->page_size);
++ vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1);
+ if (region != NULL)
+ TEST_ASSERT(false, "overlapping userspace_mem_region already "
+ "exists\n"
+@@ -606,15 +606,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm,
+ region = region->next) {
+ if (region->region.slot == slot)
+ break;
+- if ((guest_paddr <= (region->region.guest_phys_addr
+- + region->region.memory_size))
+- && ((guest_paddr + npages * vm->page_size)
+- >= region->region.guest_phys_addr))
+- break;
+ }
+ if (region != NULL)
+ TEST_ASSERT(false, "A mem region with the requested slot "
+- "or overlapping physical memory range already exists.\n"
++ "already exists.\n"
+ " requested slot: %u paddr: 0x%lx npages: 0x%lx\n"
+ " existing slot: %u paddr: 0x%lx size: 0x%lx",
+ slot, guest_paddr, npages,
+--
+2.19.1
+
--- /dev/null
+From 70eb3bda42f7139c735a2840ac73c90efb556a9d Mon Sep 17 00:00:00 2001
+From: Xie Yongji <xieyongji@baidu.com>
+Date: Thu, 29 Nov 2018 20:50:30 +0800
+Subject: locking/rwsem: Fix (possible) missed wakeup
+
+[ Upstream commit e158488be27b157802753a59b336142dc0eb0380 ]
+
+Because wake_q_add() can imply an immediate wakeup (cmpxchg failure
+case), we must not rely on the wakeup being delayed. However, commit:
+
+ e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task")
+
+relies on exactly that behaviour in that the wakeup must not happen
+until after we clear waiter->task.
+
+[ peterz: Added changelog. ]
+
+Signed-off-by: Xie Yongji <xieyongji@baidu.com>
+Signed-off-by: Zhang Yu <zhangyu31@baidu.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task")
+Link: https://lkml.kernel.org/r/1543495830-2644-1-git-send-email-xieyongji@baidu.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/rwsem-xadd.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
+index 3064c50e181e1..ef909357b84e1 100644
+--- a/kernel/locking/rwsem-xadd.c
++++ b/kernel/locking/rwsem-xadd.c
+@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem,
+ woken++;
+ tsk = waiter->task;
+
+- wake_q_add(wake_q, tsk);
++ get_task_struct(tsk);
+ list_del(&waiter->list);
+ /*
+- * Ensure that the last operation is setting the reader
++ * Ensure calling get_task_struct() before setting the reader
+ * waiter to nil such that rwsem_down_read_failed() cannot
+ * race with do_exit() by always holding a reference count
+ * to the task to wakeup.
+ */
+ smp_store_release(&waiter->task, NULL);
++ /*
++ * Ensure issuing the wakeup (either by us or someone else)
++ * after setting the reader waiter to nil.
++ */
++ wake_q_add(wake_q, tsk);
++ /* wake_q_add() already take the task ref */
++ put_task_struct(tsk);
+ }
+
+ adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
+--
+2.19.1
+
--- /dev/null
+From 171fb7eeb69ea01acb7e7954e9b0017307f1d9db Mon Sep 17 00:00:00 2001
+From: Mathieu Malaterre <malat@debian.org>
+Date: Thu, 24 Jan 2019 19:19:57 +0100
+Subject: mac80211: Add attribute aligned(2) to struct 'action'
+
+[ Upstream commit 7c53eb5d87bc21464da4268c3c0c47457b6d9c9b ]
+
+During refactor in commit 9e478066eae4 ("mac80211: fix MU-MIMO
+follow-MAC mode") a new struct 'action' was declared with packed
+attribute as:
+
+ struct {
+ struct ieee80211_hdr_3addr hdr;
+ u8 category;
+ u8 action_code;
+ } __packed action;
+
+But since struct 'ieee80211_hdr_3addr' is declared with an aligned
+keyword as:
+
+ struct ieee80211_hdr {
+ __le16 frame_control;
+ __le16 duration_id;
+ u8 addr1[ETH_ALEN];
+ u8 addr2[ETH_ALEN];
+ u8 addr3[ETH_ALEN];
+ __le16 seq_ctrl;
+ u8 addr4[ETH_ALEN];
+ } __packed __aligned(2);
+
+Solve the ambiguity of placing aligned structure in a packed one by
+adding the aligned(2) attribute to struct 'action'.
+
+This removes the following warning (W=1):
+
+ net/mac80211/rx.c:234:2: warning: alignment 1 of 'struct <anonymous>' is less than 2 [-Wpacked-not-aligned]
+
+Cc: Johannes Berg <johannes.berg@intel.com>
+Suggested-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index d7a05a9944421..e946ee4f335bd 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -221,7 +221,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
+ struct ieee80211_hdr_3addr hdr;
+ u8 category;
+ u8 action_code;
+- } __packed action;
++ } __packed __aligned(2) action;
+
+ if (!sdata)
+ return;
+--
+2.19.1
+
--- /dev/null
+From b5b9d81745870106fc8cd416b6d76b9d7ced04f7 Mon Sep 17 00:00:00 2001
+From: Balaji Pothunoori <bpothuno@codeaurora.org>
+Date: Mon, 21 Jan 2019 12:30:43 +0530
+Subject: mac80211: don't initiate TDLS connection if station is not associated
+ to AP
+
+[ Upstream commit 7ed5285396c257fd4070b1e29e7b2341aae2a1ce ]
+
+Following call trace is observed while adding TDLS peer entry in driver
+during TDLS setup.
+
+Call Trace:
+[<c1301476>] dump_stack+0x47/0x61
+[<c10537d2>] __warn+0xe2/0x100
+[<fa22415f>] ? sta_apply_parameters+0x49f/0x550 [mac80211]
+[<c1053895>] warn_slowpath_null+0x25/0x30
+[<fa22415f>] sta_apply_parameters+0x49f/0x550 [mac80211]
+[<fa20ad42>] ? sta_info_alloc+0x1c2/0x450 [mac80211]
+[<fa224623>] ieee80211_add_station+0xe3/0x160 [mac80211]
+[<c1876fe3>] nl80211_new_station+0x273/0x420
+[<c170f6d9>] genl_rcv_msg+0x219/0x3c0
+[<c170f4c0>] ? genl_rcv+0x30/0x30
+[<c170ee7e>] netlink_rcv_skb+0x8e/0xb0
+[<c170f4ac>] genl_rcv+0x1c/0x30
+[<c170e8aa>] netlink_unicast+0x13a/0x1d0
+[<c170ec18>] netlink_sendmsg+0x2d8/0x390
+[<c16c5acd>] sock_sendmsg+0x2d/0x40
+[<c16c6369>] ___sys_sendmsg+0x1d9/0x1e0
+
+Fixing this by allowing TDLS setup request only when we have completed
+association.
+
+Signed-off-by: Balaji Pothunoori <bpothuno@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index c2abe9db1ea24..40c5102234679 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1478,6 +1478,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
+ if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+ sta->sta.tdls = true;
+
++ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
++ !sdata->u.mgd.associated)
++ return -EINVAL;
++
+ err = sta_apply_parameters(local, sta, params);
+ if (err) {
+ sta_info_free(local, sta);
+--
+2.19.1
+
--- /dev/null
+From e3443fa00c63e1e712376dfb49c4b78394575e1d Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Thu, 17 Jan 2019 16:32:42 -0500
+Subject: mac80211: fix miscounting of ttl-dropped frames
+
+[ Upstream commit a0dc02039a2ee54fb4ae400e0b755ed30e73e58c ]
+
+In ieee80211_rx_h_mesh_fwding, we increment the 'dropped_frames_ttl'
+counter when we decrement the ttl to zero. For unicast frames
+destined for other hosts, we stop processing the frame at that point.
+
+For multicast frames, we do not rebroadcast it in this case, but we
+do pass the frame up the stack to process it on this STA. That
+doesn't match the usual definition of "dropped," so don't count
+those as such.
+
+With this change, something like `ping6 -i0.2 ff02::1%mesh0` from a
+peer in a ttl=1 network no longer increments the counter rapidly.
+
+Signed-off-by: Bob Copeland <bobcopeland@fb.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 828348b2a504d..d7a05a9944421 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2678,7 +2678,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ skb_set_queue_mapping(skb, q);
+
+ if (!--mesh_hdr->ttl) {
+- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++ if (!is_multicast_ether_addr(hdr->addr1))
++ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
++ dropped_frames_ttl);
+ goto out;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 513c243e677dfa2508b760cad593f97afe9db04b Mon Sep 17 00:00:00 2001
+From: Atsushi Nemoto <atsushi.nemoto@sord.co.jp>
+Date: Mon, 21 Jan 2019 17:26:41 +0900
+Subject: net: altera_tse: fix connect_local_phy error path
+
+[ Upstream commit 17b42a20d7ca59377788c6a2409e77569570cc10 ]
+
+The connect_local_phy should return NULL (not negative errno) on
+error, since its caller expects it.
+
+Signed-off-by: Atsushi Nemoto <atsushi.nemoto@sord.co.jp>
+Acked-by: Thor Thayer <thor.thayer@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/altera/altera_tse_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
+index baca8f704a459..c3c1195021a2b 100644
+--- a/drivers/net/ethernet/altera/altera_tse_main.c
++++ b/drivers/net/ethernet/altera/altera_tse_main.c
+@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev)
+
+ phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link,
+ priv->phy_iface);
+- if (IS_ERR(phydev))
++ if (IS_ERR(phydev)) {
+ netdev_err(dev, "Could not attach to PHY\n");
++ phydev = NULL;
++ }
+
+ } else {
+ int ret;
+--
+2.19.1
+
--- /dev/null
+From 5693d459c561a0e618d5580fa16fa0772c531c77 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Thu, 24 Jan 2019 03:07:02 -0800
+Subject: net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 3b707c3008cad04604c1f50e39f456621821c414 ]
+
+__bpf_redirect() and act_mirred checks this boolean
+to determine whether to prefix an ethernet header.
+
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/if_arp.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h
+index 6756fea18b69f..e44746de95cdf 100644
+--- a/include/linux/if_arp.h
++++ b/include/linux/if_arp.h
+@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev)
+ case ARPHRD_IPGRE:
+ case ARPHRD_VOID:
+ case ARPHRD_NONE:
++ case ARPHRD_RAWIP:
+ return false;
+ default:
+ return true;
+--
+2.19.1
+
--- /dev/null
+From d232a83aad0d3964142933c6b861a4882cffa9c1 Mon Sep 17 00:00:00 2001
+From: Zhang Run <zhang.run@zte.com.cn>
+Date: Thu, 24 Jan 2019 13:48:49 +0800
+Subject: net: usb: asix: ax88772_bind return error when hw_reset fail
+
+[ Upstream commit 6eea3527e68acc22483f4763c8682f223eb90029 ]
+
+The ax88772_bind() should return error code immediately when the PHY
+was not reset properly through ax88772a_hw_reset().
+Otherwise, The asix_get_phyid() will block when get the PHY
+Identifier from the PHYSID1 MII registers through asix_mdio_read()
+due to the PHY isn't ready. Furthermore, it will produce a lot of
+error message cause system crash.As follows:
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write
+ reg index 0x0000: -71
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to send
+ software reset: ffffffb9
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write
+ reg index 0x0000: -71
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable
+ software MII access
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read
+ reg index 0x0000: -71
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write
+ reg index 0x0000: -71
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable
+ software MII access
+asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read
+ reg index 0x0000: -71
+...
+
+Signed-off-by: Zhang Run <zhang.run@zte.com.cn>
+Reviewed-by: Yang Wei <yang.wei9@zte.com.cn>
+Tested-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/asix_devices.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
+index b654f05b2ccd0..3d93993e74da0 100644
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
+ asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0);
+ chipcode &= AX_CHIPCODE_MASK;
+
+- (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
+- ax88772a_hw_reset(dev, 0);
++ ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) :
++ ax88772a_hw_reset(dev, 0);
++
++ if (ret < 0) {
++ netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret);
++ return ret;
++ }
+
+ /* Read PHYID register *AFTER* the PHY was reset properly */
+ phyid = asix_get_phyid(dev);
+--
+2.19.1
+
--- /dev/null
+From 2ab10acbfdaa0eea29b3d9cb87cbc963591dc51a Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Wed, 9 Jan 2019 09:45:15 +0100
+Subject: nvme-multipath: drop optimization for static ANA group IDs
+
+[ Upstream commit 78a61cd42a64f3587862b372a79e1d6aaf131fd7 ]
+
+Bit 6 in the ANACAP field is used to indicate that the ANA group ID
+doesn't change while the namespace is attached to the controller.
+There is an optimisation in the code to only allocate space
+for the ANA group header, as the namespace list won't change and
+hence would not need to be refreshed.
+However, this optimisation was never carried over to the actual
+workflow, which always assumes that the buffer is large enough
+to hold the ANA header _and_ the namespace list.
+So drop this optimisation and always allocate enough space.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 815509dbed846..da8f5ad30c719 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -531,8 +531,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0);
+ ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) +
+ ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc);
+- if (!(ctrl->anacap & (1 << 6)))
+- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
++ ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32);
+
+ if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) {
+ dev_err(ctrl->device,
+--
+2.19.1
+
--- /dev/null
+From 99afadd4cd85e1c005fd0089e6aa035895aa4b1b Mon Sep 17 00:00:00 2001
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Tue, 8 Jan 2019 00:53:22 -0800
+Subject: nvme-rdma: fix timeout handler
+
+[ Upstream commit 4c174e6366746ae8d49f9cc409f728eebb7a9ac9 ]
+
+Currently, we have several problems with the timeout
+handler:
+1. If we timeout on the controller establishment flow, we will hang
+because we don't execute the error recovery (and we shouldn't because
+the create_ctrl flow needs to fail and cleanup on its own)
+2. We might also hang if we get a disconnet on a queue while the
+controller is already deleting. This racy flow can cause the controller
+disable/shutdown admin command to hang.
+
+We cannot complete a timed out request from the timeout handler without
+mutual exclusion from the teardown flow (e.g. nvme_rdma_error_recovery_work).
+So we serialize it in the timeout handler and teardown io and admin
+queues to guarantee that no one races with us from completing the
+request.
+
+Reported-by: Jaesoo Lee <jalee@purestorage.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index b6a28de682e85..0939a4e178fb9 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1672,18 +1672,28 @@ static enum blk_eh_timer_return
+ nvme_rdma_timeout(struct request *rq, bool reserved)
+ {
+ struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
++ struct nvme_rdma_queue *queue = req->queue;
++ struct nvme_rdma_ctrl *ctrl = queue->ctrl;
+
+- dev_warn(req->queue->ctrl->ctrl.device,
+- "I/O %d QID %d timeout, reset controller\n",
+- rq->tag, nvme_rdma_queue_idx(req->queue));
++ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
++ rq->tag, nvme_rdma_queue_idx(queue));
+
+- /* queue error recovery */
+- nvme_rdma_error_recovery(req->queue->ctrl);
++ if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
++ /*
++ * Teardown immediately if controller times out while starting
++ * or we are already started error recovery. all outstanding
++ * requests are completed on shutdown, so we return BLK_EH_DONE.
++ */
++ flush_work(&ctrl->err_work);
++ nvme_rdma_teardown_io_queues(ctrl, false);
++ nvme_rdma_teardown_admin_queue(ctrl, false);
++ return BLK_EH_DONE;
++ }
+
+- /* fail with DNR on cmd timeout */
+- nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR;
++ dev_warn(ctrl->ctrl.device, "starting error recovery\n");
++ nvme_rdma_error_recovery(ctrl);
+
+- return BLK_EH_DONE;
++ return BLK_EH_RESET_TIMER;
+ }
+
+ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
+--
+2.19.1
+
--- /dev/null
+From df2bd256f1b74260e3ade5f5abd6b7f732b7a8c2 Mon Sep 17 00:00:00 2001
+From: Alban Bedel <albeu@free.fr>
+Date: Mon, 7 Jan 2019 20:44:54 +0100
+Subject: phy: ath79-usb: Fix the main reset name to match the DT binding
+
+[ Upstream commit 827cb0323928952c0db9515aba9d534fb1285b3f ]
+
+I submitted this driver several times before it got accepted. The
+first series hasn't been accepted but the DTS binding did made it.
+I then made a second series that added generic reset support to the
+PHY core, this in turn required a change to the DT binding. This
+second series seemed to have been ignored, so I did a third one
+without the change to the PHY core and the DT binding update, and this
+last attempt finally made it.
+
+But two months later the DT binding update from the second series has
+been integrated too. So now the driver doesn't match the binding and
+the only DTS using it. This patch fix the driver to match the new
+binding.
+
+Signed-off-by: Alban Bedel <albeu@free.fr>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-ath79-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
+index f7d64f3910b4d..09a77e556eceb 100644
+--- a/drivers/phy/qualcomm/phy-ath79-usb.c
++++ b/drivers/phy/qualcomm/phy-ath79-usb.c
+@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev)
+ if (!priv)
+ return -ENOMEM;
+
+- priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy");
++ priv->reset = devm_reset_control_get(&pdev->dev, "phy");
+ if (IS_ERR(priv->reset))
+ return PTR_ERR(priv->reset);
+
+--
+2.19.1
+
--- /dev/null
+From fe8115da330ee9aa5de8354fbb07ad7a1050301f Mon Sep 17 00:00:00 2001
+From: Alban Bedel <albeu@free.fr>
+Date: Mon, 7 Jan 2019 20:44:53 +0100
+Subject: phy: ath79-usb: Fix the power on error path
+
+[ Upstream commit 009808154c69c48d5b41fc8cf5ad5ab5704efd8f ]
+
+In the power on function the error path doesn't return the suspend
+override to its proper state. It should should deassert this reset
+line to enable the suspend override.
+
+Signed-off-by: Alban Bedel <albeu@free.fr>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-ath79-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c
+index 6fd6e07ab345f..f7d64f3910b4d 100644
+--- a/drivers/phy/qualcomm/phy-ath79-usb.c
++++ b/drivers/phy/qualcomm/phy-ath79-usb.c
+@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy)
+
+ err = reset_control_deassert(priv->reset);
+ if (err && priv->no_suspend_override)
+- reset_control_assert(priv->no_suspend_override);
++ reset_control_deassert(priv->no_suspend_override);
+
+ return err;
+ }
+--
+2.19.1
+
--- /dev/null
+From c3a8139eedce52a4f008f76708c4334efc6a482a Mon Sep 17 00:00:00 2001
+From: Prateek Sood <prsood@codeaurora.org>
+Date: Fri, 30 Nov 2018 20:40:56 +0530
+Subject: sched/wait: Fix rcuwait_wake_up() ordering
+
+[ Upstream commit 6dc080eeb2ba01973bfff0d79844d7a59e12542e ]
+
+For some peculiar reason rcuwait_wake_up() has the right barrier in
+the comment, but not in the code.
+
+This mistake has been observed to cause a deadlock in the following
+situation:
+
+ P1 P2
+
+ percpu_up_read() percpu_down_write()
+ rcu_sync_is_idle() // false
+ rcu_sync_enter()
+ ...
+ __percpu_up_read()
+
+[S] ,- __this_cpu_dec(*sem->read_count)
+ | smp_rmb();
+[L] | task = rcu_dereference(w->task) // NULL
+ |
+ | [S] w->task = current
+ | smp_mb();
+ | [L] readers_active_check() // fail
+ `-> <store happens here>
+
+Where the smp_rmb() (obviously) fails to constrain the store.
+
+[ peterz: Added changelog. ]
+
+Signed-off-by: Prateek Sood <prsood@codeaurora.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Andrea Parri <andrea.parri@amarulasolutions.com>
+Acked-by: Davidlohr Bueso <dbueso@suse.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 8f95c90ceb54 ("sched/wait, RCU: Introduce rcuwait machinery")
+Link: https://lkml.kernel.org/r/1543590656-7157-1-git-send-email-prsood@codeaurora.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/exit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 55b4fa6d01ebd..d607e23fd0c3e 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w)
+ * MB (A) MB (B)
+ * [L] cond [L] tsk
+ */
+- smp_rmb(); /* (B) */
++ smp_mb(); /* (B) */
+
+ /*
+ * Avoid using task_rcu_dereference() magic as long as we are careful,
+--
+2.19.1
+
--- /dev/null
+From b62099029e96c7743cec11dfa391ff1f0c87980a Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 17 Dec 2018 10:14:53 +0100
+Subject: sched/wake_q: Fix wakeup ordering for wake_q
+
+[ Upstream commit 4c4e3731564c8945ac5ac90fc2a1e1f21cb79c92 ]
+
+Notable cmpxchg() does not provide ordering when it fails, however
+wake_q_add() requires ordering in this specific case too. Without this
+it would be possible for the concurrent wakeup to not observe our
+prior state.
+
+Andrea Parri provided:
+
+ C wake_up_q-wake_q_add
+
+ {
+ int next = 0;
+ int y = 0;
+ }
+
+ P0(int *next, int *y)
+ {
+ int r0;
+
+ /* in wake_up_q() */
+
+ WRITE_ONCE(*next, 1); /* node->next = NULL */
+ smp_mb(); /* implied by wake_up_process() */
+ r0 = READ_ONCE(*y);
+ }
+
+ P1(int *next, int *y)
+ {
+ int r1;
+
+ /* in wake_q_add() */
+
+ WRITE_ONCE(*y, 1); /* wake_cond = true */
+ smp_mb__before_atomic();
+ r1 = cmpxchg_relaxed(next, 1, 2);
+ }
+
+ exists (0:r0=0 /\ 1:r1=0)
+
+ This "exists" clause cannot be satisfied according to the LKMM:
+
+ Test wake_up_q-wake_q_add Allowed
+ States 3
+ 0:r0=0; 1:r1=1;
+ 0:r0=1; 1:r1=0;
+ 0:r0=1; 1:r1=1;
+ No
+ Witnesses
+ Positive: 0 Negative: 3
+ Condition exists (0:r0=0 /\ 1:r1=0)
+ Observation wake_up_q-wake_q_add Never 0 3
+
+Reported-by: Yongji Xie <elohimes@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Waiman Long <longman@redhat.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 13ddfa46d741f..152a0b0c91bb6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -405,10 +405,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
+ * its already queued (either by us or someone else) and will get the
+ * wakeup due to that.
+ *
+- * This cmpxchg() executes a full barrier, which pairs with the full
+- * barrier executed by the wakeup in wake_up_q().
++ * In order to ensure that a pending wakeup will observe our pending
++ * state, even in the failed case, an explicit smp_mb() must be used.
+ */
+- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
++ smp_mb__before_atomic();
++ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
+ return;
+
+ get_task_struct(task);
+--
+2.19.1
+
--- /dev/null
+From 1f6d308a085add0d178a5a45a06614dfcd0bc3e8 Mon Sep 17 00:00:00 2001
+From: Varun Prakash <varun@chelsio.com>
+Date: Sat, 12 Jan 2019 22:14:30 +0530
+Subject: scsi: csiostor: fix NULL pointer dereference in
+ csio_vport_set_state()
+
+[ Upstream commit fe35a40e675473eb65f2f5462b82770f324b5689 ]
+
+Assign fc_vport to ln->fc_vport before calling csio_fcoe_alloc_vnp() to
+avoid a NULL pointer dereference in csio_vport_set_state().
+
+ln->fc_vport is dereferenced in csio_vport_set_state().
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_attr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c
+index 8a004036e3d72..9bd2bd8dc2be2 100644
+--- a/drivers/scsi/csiostor/csio_attr.c
++++ b/drivers/scsi/csiostor/csio_attr.c
+@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable)
+ }
+
+ fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING);
++ ln->fc_vport = fc_vport;
+
+ if (csio_fcoe_alloc_vnp(hw, ln))
+ goto error;
+
+ *(struct csio_lnode **)fc_vport->dd_data = ln;
+- ln->fc_vport = fc_vport;
+ if (!fc_vport->node_name)
+ fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln));
+ if (!fc_vport->port_name)
+--
+2.19.1
+
--- /dev/null
+From 5cc980619ed51084ec0f0576e0f4df80ec01b55e Mon Sep 17 00:00:00 2001
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Thu, 17 Jan 2019 11:14:44 -0500
+Subject: scsi: lpfc: nvme: avoid hang / use-after-free when destroying
+ localport
+
+[ Upstream commit 7961cba6f7d8215fa632df3d220e5154bb825249 ]
+
+We cannot wait on a completion object in the lpfc_nvme_lport structure in
+the _destroy_localport() code path because the NVMe/fc transport will free
+that structure immediately after the .localport_delete() callback. This
+results in a use-after-free, and a hang if slub_debug=FZPU is enabled.
+
+Fix this by putting the completion on the stack.
+
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Acked-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvme.c | 16 +++++++++-------
+ drivers/scsi/lpfc/lpfc_nvme.h | 2 +-
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 918ae18ef8a82..ca62117a2d131 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport)
+ lport);
+
+ /* release any threads waiting for the unreg to complete */
+- complete(&lport->lport_unreg_done);
++ if (lport->vport->localport)
++ complete(lport->lport_unreg_cmp);
+ }
+
+ /* lpfc_nvme_remoteport_delete
+@@ -2556,7 +2557,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport)
+ */
+ void
+ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
+- struct lpfc_nvme_lport *lport)
++ struct lpfc_nvme_lport *lport,
++ struct completion *lport_unreg_cmp)
+ {
+ #if (IS_ENABLED(CONFIG_NVME_FC))
+ u32 wait_tmo;
+@@ -2568,8 +2570,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport,
+ */
+ wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000);
+ while (true) {
+- ret = wait_for_completion_timeout(&lport->lport_unreg_done,
+- wait_tmo);
++ ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo);
+ if (unlikely(!ret)) {
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR,
+ "6176 Lport %p Localport %p wait "
+@@ -2603,12 +2604,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
+ struct lpfc_nvme_lport *lport;
+ struct lpfc_nvme_ctrl_stat *cstat;
+ int ret;
++ DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp);
+
+ if (vport->nvmei_support == 0)
+ return;
+
+ localport = vport->localport;
+- vport->localport = NULL;
+ lport = (struct lpfc_nvme_lport *)localport->private;
+ cstat = lport->cstat;
+
+@@ -2619,13 +2620,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport)
+ /* lport's rport list is clear. Unregister
+ * lport and release resources.
+ */
+- init_completion(&lport->lport_unreg_done);
++ lport->lport_unreg_cmp = &lport_unreg_cmp;
+ ret = nvme_fc_unregister_localport(localport);
+
+ /* Wait for completion. This either blocks
+ * indefinitely or succeeds
+ */
+- lpfc_nvme_lport_unreg_wait(vport, lport);
++ lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp);
++ vport->localport = NULL;
+ kfree(cstat);
+
+ /* Regardless of the unregister upcall response, clear
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h
+index cfd4719be25c3..b234d02989942 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.h
++++ b/drivers/scsi/lpfc/lpfc_nvme.h
+@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat {
+ /* Declare nvme-based local and remote port definitions. */
+ struct lpfc_nvme_lport {
+ struct lpfc_vport *vport;
+- struct completion lport_unreg_done;
++ struct completion *lport_unreg_cmp;
+ /* Add stats counters here */
+ struct lpfc_nvme_ctrl_stat *cstat;
+ atomic_t fc4NvmeLsRequests;
+--
+2.19.1
+
--- /dev/null
+From 496b70b3518711aa80eaafa8a2fcf186d7f4e897 Mon Sep 17 00:00:00 2001
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Thu, 17 Jan 2019 11:14:45 -0500
+Subject: scsi: lpfc: nvmet: avoid hang / use-after-free when destroying
+ targetport
+
+[ Upstream commit c41f59884be5cca293ed61f3d64637dbba3a6381 ]
+
+We cannot wait on a completion object in the lpfc_nvme_targetport structure
+in the _destroy_targetport() code path because the NVMe/fc transport will
+free that structure immediately after the .targetport_delete() callback.
+This results in a use-after-free, and a hang if slub_debug=FZPU is enabled.
+
+Fix this by putting the completion on the stack.
+
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Acked-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvmet.c | 8 +++++---
+ drivers/scsi/lpfc/lpfc_nvmet.h | 2 +-
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index b766afe10d3d7..e2575c8ec93e8 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport)
+ struct lpfc_nvmet_tgtport *tport = targetport->private;
+
+ /* release any threads waiting for the unreg to complete */
+- complete(&tport->tport_unreg_done);
++ if (tport->phba->targetport)
++ complete(tport->tport_unreg_cmp);
+ }
+
+ static void
+@@ -1700,6 +1701,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ struct lpfc_nvmet_tgtport *tgtp;
+ struct lpfc_queue *wq;
+ uint32_t qidx;
++ DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp);
+
+ if (phba->nvmet_support == 0)
+ return;
+@@ -1709,9 +1711,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ wq = phba->sli4_hba.nvme_wq[qidx];
+ lpfc_nvmet_wqfull_flush(phba, wq, NULL);
+ }
+- init_completion(&tgtp->tport_unreg_done);
++ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
+ nvmet_fc_unregister_targetport(phba->targetport);
+- wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
++ wait_for_completion_timeout(&tport_unreg_cmp, 5);
+ lpfc_nvmet_cleanup_io_context(phba);
+ }
+ phba->targetport = NULL;
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
+index 1aaff63f1f419..0ec1082ce7ef6 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.h
++++ b/drivers/scsi/lpfc/lpfc_nvmet.h
+@@ -34,7 +34,7 @@
+ /* Used for NVME Target */
+ struct lpfc_nvmet_tgtport {
+ struct lpfc_hba *phba;
+- struct completion tport_unreg_done;
++ struct completion *tport_unreg_cmp;
+
+ /* Stats counters - lpfc_nvmet_unsol_ls_buffer */
+ atomic_t rcv_ls_req_in;
+--
+2.19.1
+
--- /dev/null
+From bb7b0b44666c0bd9d92ba745288132f96f62195e Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 14 Jan 2019 14:51:33 +0100
+Subject: selftests: gpio-mockup-chardev: Check asprintf() for error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 508cacd7da6659ae7b7bdd0a335f675422277758 ]
+
+With gcc 7.3.0:
+
+ gpio-mockup-chardev.c: In function ‘get_debugfs’:
+ gpio-mockup-chardev.c:62:3: warning: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Wunused-result]
+ asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Handle asprintf() failures to fix this.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/gpio/gpio-mockup-chardev.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+index f8d468f54e986..aaa1e9f083c37 100644
+--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c
++++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c
+@@ -37,7 +37,7 @@ static int get_debugfs(char **path)
+ struct libmnt_table *tb;
+ struct libmnt_iter *itr = NULL;
+ struct libmnt_fs *fs;
+- int found = 0;
++ int found = 0, ret;
+
+ cxt = mnt_new_context();
+ if (!cxt)
+@@ -58,8 +58,11 @@ static int get_debugfs(char **path)
+ break;
+ }
+ }
+- if (found)
+- asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
++ if (found) {
++ ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs));
++ if (ret < 0)
++ err(EXIT_FAILURE, "failed to format string");
++ }
+
+ mnt_free_iter(itr);
+ mnt_free_context(cxt);
+--
+2.19.1
+
--- /dev/null
+From 055d48b13dcfe96062d5e85c1e5983e99a19e249 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Tue, 18 Dec 2018 22:34:21 +0100
+Subject: selftests: rtc: rtctest: add alarm test on minute boundary
+
+[ Upstream commit 7b3027728f4d4f6763f4d7e771acfc9424cdd0e6 ]
+
+Unfortunately, some RTC don't have a second resolution for alarm so also
+test for alarm on a minute boundary.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/rtc/rtctest.c | 102 ++++++++++++++++++++++++++
+ 1 file changed, 102 insertions(+)
+
+diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
+index dea4e3d6d9e18..b2065536d4075 100644
+--- a/tools/testing/selftests/rtc/rtctest.c
++++ b/tools/testing/selftests/rtc/rtctest.c
+@@ -211,6 +211,108 @@ TEST_F(rtc, alarm_wkalm_set) {
+ ASSERT_EQ(new, secs);
+ }
+
++TEST_F(rtc, alarm_alm_set_minute) {
++ struct timeval tv = { .tv_sec = 62 };
++ unsigned long data;
++ struct rtc_time tm;
++ fd_set readfds;
++ time_t secs, new;
++ int rc;
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &tm);
++ ASSERT_NE(-1, rc);
++
++ secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec;
++ gmtime_r(&secs, (struct tm *)&tm);
++
++ rc = ioctl(self->fd, RTC_ALM_SET, &tm);
++ if (rc == -1) {
++ ASSERT_EQ(EINVAL, errno);
++ TH_LOG("skip alarms are not supported.");
++ return;
++ }
++
++ rc = ioctl(self->fd, RTC_ALM_READ, &tm);
++ ASSERT_NE(-1, rc);
++
++ TH_LOG("Alarm time now set to %02d:%02d:%02d.",
++ tm.tm_hour, tm.tm_min, tm.tm_sec);
++
++ /* Enable alarm interrupts */
++ rc = ioctl(self->fd, RTC_AIE_ON, 0);
++ ASSERT_NE(-1, rc);
++
++ FD_ZERO(&readfds);
++ FD_SET(self->fd, &readfds);
++
++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
++ ASSERT_NE(-1, rc);
++ ASSERT_NE(0, rc);
++
++ /* Disable alarm interrupts */
++ rc = ioctl(self->fd, RTC_AIE_OFF, 0);
++ ASSERT_NE(-1, rc);
++
++ rc = read(self->fd, &data, sizeof(unsigned long));
++ ASSERT_NE(-1, rc);
++ TH_LOG("data: %lx", data);
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &tm);
++ ASSERT_NE(-1, rc);
++
++ new = timegm((struct tm *)&tm);
++ ASSERT_EQ(new, secs);
++}
++
++TEST_F(rtc, alarm_wkalm_set_minute) {
++ struct timeval tv = { .tv_sec = 62 };
++ struct rtc_wkalrm alarm = { 0 };
++ struct rtc_time tm;
++ unsigned long data;
++ fd_set readfds;
++ time_t secs, new;
++ int rc;
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time);
++ ASSERT_NE(-1, rc);
++
++ secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec;
++ gmtime_r(&secs, (struct tm *)&alarm.time);
++
++ alarm.enabled = 1;
++
++ rc = ioctl(self->fd, RTC_WKALM_SET, &alarm);
++ if (rc == -1) {
++ ASSERT_EQ(EINVAL, errno);
++ TH_LOG("skip alarms are not supported.");
++ return;
++ }
++
++ rc = ioctl(self->fd, RTC_WKALM_RD, &alarm);
++ ASSERT_NE(-1, rc);
++
++ TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.",
++ alarm.time.tm_mday, alarm.time.tm_mon + 1,
++ alarm.time.tm_year + 1900, alarm.time.tm_hour,
++ alarm.time.tm_min, alarm.time.tm_sec);
++
++ FD_ZERO(&readfds);
++ FD_SET(self->fd, &readfds);
++
++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
++ ASSERT_NE(-1, rc);
++ ASSERT_NE(0, rc);
++
++ rc = read(self->fd, &data, sizeof(unsigned long));
++ ASSERT_NE(-1, rc);
++
++ rc = ioctl(self->fd, RTC_RD_TIME, &tm);
++ ASSERT_NE(-1, rc);
++
++ new = timegm((struct tm *)&tm);
++ ASSERT_EQ(new, secs);
++}
++
+ static void __attribute__((constructor))
+ __constructor_order_last(void)
+ {
+--
+2.19.1
+
--- /dev/null
+From 5d8b45fe80007bc67579dc921a24e2f32ba83fe7 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Tue, 18 Dec 2018 22:34:20 +0100
+Subject: selftests: rtc: rtctest: fix alarm tests
+
+[ Upstream commit fdac94489c4d247088b3885875b39b3e1eb621ef ]
+
+Return values for select are not checked properly and timeouts may not be
+detected.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/rtc/rtctest.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c
+index e20b017e70731..dea4e3d6d9e18 100644
+--- a/tools/testing/selftests/rtc/rtctest.c
++++ b/tools/testing/selftests/rtc/rtctest.c
+@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) {
+
+ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+ ASSERT_NE(-1, rc);
+- EXPECT_NE(0, rc);
++ ASSERT_NE(0, rc);
+
+ /* Disable alarm interrupts */
+ rc = ioctl(self->fd, RTC_AIE_OFF, 0);
+ ASSERT_NE(-1, rc);
+
+- if (rc == 0)
+- return;
+-
+ rc = read(self->fd, &data, sizeof(unsigned long));
+ ASSERT_NE(-1, rc);
+ TH_LOG("data: %lx", data);
+@@ -202,7 +199,7 @@ TEST_F(rtc, alarm_wkalm_set) {
+
+ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv);
+ ASSERT_NE(-1, rc);
+- EXPECT_NE(0, rc);
++ ASSERT_NE(0, rc);
+
+ rc = read(self->fd, &data, sizeof(unsigned long));
+ ASSERT_NE(-1, rc);
+--
+2.19.1
+
--- /dev/null
+From 169977f82b210d3dbb2d24bc9718db5726a8087f Mon Sep 17 00:00:00 2001
+From: Fathi Boudra <fathi.boudra@linaro.org>
+Date: Wed, 16 Jan 2019 11:43:19 -0600
+Subject: selftests: seccomp: use LDLIBS instead of LDFLAGS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 5bbc73a841d7f0bbe025a342146dde462a796a5a ]
+
+seccomp_bpf fails to build due to undefined reference errors:
+
+ aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey
+ -O2 -pipe -g -feliminate-unused-debug-types -Wl,-no-as-needed -Wall
+ -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lpthread seccomp_bpf.c -o
+ /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf
+ /tmp/ccrlR3MW.o: In function `tsync_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post'
+ /tmp/ccrlR3MW.o: In function `TSYNC_setup':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1863: undefined reference to `sem_init'
+ /tmp/ccrlR3MW.o: In function `TSYNC_teardown':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1904: undefined reference to `sem_destroy'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1897: undefined reference to `pthread_kill'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1898: undefined reference to `pthread_cancel'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1899: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /tmp/ccrlR3MW.o: In function `TSYNC_siblings_fail_prctl':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1978: undefined reference to `sem_wait'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1990: undefined reference to `pthread_join'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1992: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_ancestor':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2016: undefined reference to `sem_wait'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2032: undefined reference to `pthread_join'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2034: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /tmp/ccrlR3MW.o: In function `TSYNC_two_sibling_want_nnp':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2046: undefined reference to `sem_wait'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2058: undefined reference to `pthread_join'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2060: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_no_filter':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2073: undefined reference to `sem_wait'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2098: undefined reference to `pthread_join'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2100: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_one_divergence':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2125: undefined reference to `sem_wait'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2143: undefined reference to `pthread_join'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2145: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+ /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_not_under_filter':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2169: undefined reference to `sem_wait'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2202: undefined reference to `pthread_join'
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2227: undefined reference to `pthread_join'
+ /tmp/ccrlR3MW.o: In function `tsync_start_sibling':
+ /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create'
+
+It's GNU Make and linker specific.
+
+The default Makefile rule looks like:
+
+$(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS)
+
+When linking is done by gcc itself, no issue, but when it needs to be passed
+to proper ld, only LDLIBS follows and then ld cannot know what libs to link
+with.
+
+More detail:
+https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
+
+LDFLAGS
+Extra flags to give to compilers when they are supposed to invoke the linker,
+‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable
+instead.
+
+LDLIBS
+Library flags or names given to compilers when they are supposed to invoke the
+linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to
+LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS
+variable.
+
+https://lkml.org/lkml/2010/2/10/362
+
+tools/perf: libraries must come after objects
+
+Link order matters, use LDLIBS instead of LDFLAGS to properly link against
+libpthread.
+
+Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/seccomp/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile
+index fce7f4ce06925..1760b3e397306 100644
+--- a/tools/testing/selftests/seccomp/Makefile
++++ b/tools/testing/selftests/seccomp/Makefile
+@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark
+ CFLAGS += -Wl,-no-as-needed -Wall
+
+ seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h
+- $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@
++ $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@
+
+ TEST_PROGS += $(BINARIES)
+ EXTRA_CLEAN := $(BINARIES)
+--
+2.19.1
+
--- /dev/null
+From 759def61a47b1fded2a019a2980c3ad8c51f8f8d Mon Sep 17 00:00:00 2001
+From: Alison Schofield <alison.schofield@intel.com>
+Date: Fri, 7 Dec 2018 18:06:45 -0800
+Subject: selftests/vm/gup_benchmark.c: match gup struct to kernel
+
+[ Upstream commit 91cd63d320f84dcbf21d4327f31f7e1f85adebd0 ]
+
+An expansion field was added to the kernel copy of this structure for
+future use. See mm/gup_benchmark.c.
+
+Add the same expansion field here, so that the IOCTL command decodes
+correctly. Otherwise, it fails with EINVAL.
+
+Signed-off-by: Alison Schofield <alison.schofield@intel.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/gup_benchmark.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
+index 36df55132036f..9601bc24454d9 100644
+--- a/tools/testing/selftests/vm/gup_benchmark.c
++++ b/tools/testing/selftests/vm/gup_benchmark.c
+@@ -22,6 +22,7 @@ struct gup_benchmark {
+ __u64 size;
+ __u32 nr_pages_per_call;
+ __u32 flags;
++ __u64 expansion[10]; /* For future use */
+ };
+
+ int main(int argc, char **argv)
+--
+2.19.1
+
--- /dev/null
+From e5ac3f26a0065a5f683b3e9a91c2df47a6ddffe7 Mon Sep 17 00:00:00 2001
+From: Tomonori Sakita <tomonori.sakita@sord.co.jp>
+Date: Mon, 21 Jan 2019 17:34:16 +0900
+Subject: serial: fsl_lpuart: fix maximum acceptable baud rate with
+ over-sampling
+
+[ Upstream commit 815d835b7ba46685c316b000013367dacb2b461b ]
+
+Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4.
+
+Signed-off-by: Tomonori Sakita <tomonori.sakita@sord.co.jp>
+Signed-off-by: Atsushi Nemoto <atsushi.nemoto@sord.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 7d030c2e42ffd..50b6746a8b5d7 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1695,7 +1695,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
+ }
+
+ /* ask the core to calculate the divisor */
+- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16);
++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
+
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+--
+2.19.1
+
genirq-matrix-improve-target-cpu-selection-for-manag.patch
mac80211-change-default-tx_sk_pacing_shift-to-7.patch
scsi-libsas-fix-rphy-phy_identifier-for-phys-with-end-devices-attached.patch
+drm-msm-unblock-writer-if-reader-closes-file.patch
+asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch
+alsa-compress-prevent-potential-divide-by-zero-bugs.patch
+asoc-variable-val-in-function-rt274_i2c_probe-could-.patch
+clk-tegra-dfll-fix-a-potential-oop-in-remove.patch
+clk-sysfs-fix-invalid-json-in-clk_dump.patch
+clk-vc5-abort-clock-configuration-without-upstream-c.patch
+thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch
+usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch
+usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch
+usb-gadget-potential-null-dereference-on-allocation-.patch
+selftests-rtc-rtctest-fix-alarm-tests.patch
+selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch
+genirq-make-sure-the-initial-affinity-is-not-empty.patch
+x86-mm-mem_encrypt-fix-erroneous-sizeof.patch
+asoc-rt5682-fix-pll-source-register-definitions.patch
+asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch
+asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch
+selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch
+phy-ath79-usb-fix-the-power-on-error-path.patch
+phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch
+selftests-seccomp-use-ldlibs-instead-of-ldflags.patch
+selftests-gpio-mockup-chardev-check-asprintf-for-err.patch
+irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch
+arc-fix-__ffs-return-value-to-avoid-build-warnings.patch
+arc-show_regs-lockdep-avoid-page-allocator.patch
+drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch
+staging-rtl8723bs-fix-build-error-with-clang-when-in.patch
+mac80211-fix-miscounting-of-ttl-dropped-frames.patch
+sched-wait-fix-rcuwait_wake_up-ordering.patch
+sched-wake_q-fix-wakeup-ordering-for-wake_q.patch
+futex-fix-possible-missed-wakeup.patch
+locking-rwsem-fix-possible-missed-wakeup.patch
+drm-amd-powerplay-od-setting-fix-on-vega10.patch
+tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch
+serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch
+drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch
+staging-android-ion-support-cpu-access-during-dma_bu.patch
+direct-io-allow-direct-writes-to-empty-inodes.patch
+writeback-synchronize-sync-2-against-cgroup-writebac.patch
+scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch
+scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch
+scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch
+net-altera_tse-fix-connect_local_phy-error-path.patch
+hv_netvsc-fix-ethtool-change-hash-key-error.patch
+hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch
+hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch
+sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
+nvme-rdma-fix-timeout-handler.patch
+nvme-multipath-drop-optimization-for-static-ana-grou.patch
+drm-msm-fix-a6xx-support-for-opp-level.patch
+net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch
+net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch
+ibmveth-do-not-process-frames-after-calling-napi_res.patch
+mac80211-don-t-initiate-tdls-connection-if-station-i.patch
+mac80211-add-attribute-aligned-2-to-struct-action.patch
+cfg80211-extend-range-deviation-for-dmg.patch
+svm-fix-avic-incomplete-ipi-emulation.patch
+kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch
+kvm-selftests-fix-region-overlap-check-in-kvm_util.patch
--- /dev/null
+From 43065648286549fee83fdc0ab9f1132ad8427864 Mon Sep 17 00:00:00 2001
+From: Edward Cree <ecree@solarflare.com>
+Date: Tue, 22 Jan 2019 19:02:17 +0000
+Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
+
+[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ]
+
+Use a bitmap to keep track of which partition types we've already seen;
+ for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and
+ thus skip adding that partition.
+Duplicate partitions occur because of the A/B backup scheme used by newer
+ sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because
+ they have the same name, causing us not to expose any MTDs at all.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 7eeac3d6cfe89..a497aace7e4f4 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6042,22 +6042,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" },
+ { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types)
+
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ struct efx_mcdi_mtd_partition *part,
+- unsigned int type)
++ unsigned int type,
++ unsigned long *found)
+ {
+ MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ const struct efx_ef10_nvram_type_info *info;
+ size_t size, erase_size, outlen;
++ int type_idx = 0;
+ bool protected;
+ int rc;
+
+- for (info = efx_ef10_nvram_types; ; info++) {
+- if (info ==
+- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++ for (type_idx = 0; ; type_idx++) {
++ if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ return -ENODEV;
++ info = efx_ef10_nvram_types + type_idx;
+ if ((type & ~info->type_mask) == info->type)
+ break;
+ }
+@@ -6070,6 +6073,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ if (protected)
+ return -ENODEV; /* hide it */
+
++ /* If we've already exposed a partition of this type, hide this
++ * duplicate. All operations on MTDs are keyed by the type anyway,
++ * so we can't act on the duplicate.
++ */
++ if (__test_and_set_bit(type_idx, found))
++ return -EEXIST;
++
+ part->nvram_type = type;
+
+ MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -6098,6 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+@@ -6126,11 +6137,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ for (i = 0; i < n_parts_total; i++) {
+ type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ i);
+- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+- if (rc == 0)
+- n_parts++;
+- else if (rc != -ENODEV)
++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++ found);
++ if (rc == -EEXIST || rc == -ENODEV)
++ continue;
++ if (rc)
+ goto fail;
++ n_parts++;
+ }
+
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+--
+2.19.1
+
--- /dev/null
+From 37f2a8dcabb2951e0ca5730956bc9db28394f42c Mon Sep 17 00:00:00 2001
+From: Liam Mark <lmark@codeaurora.org>
+Date: Fri, 18 Jan 2019 10:37:44 -0800
+Subject: staging: android: ion: Support cpu access during dma_buf_detach
+
+[ Upstream commit 31eb79db420a3f94c4c45a8c0a05cd30e333f981 ]
+
+Often userspace doesn't know when the kernel will be calling dma_buf_detach
+on the buffer.
+If userpace starts its CPU access at the same time as the sg list is being
+freed it could end up accessing the sg list after it has been freed.
+
+Thread A Thread B
+- DMA_BUF_IOCTL_SYNC IOCT
+ - ion_dma_buf_begin_cpu_access
+ - list_for_each_entry
+ - ion_dma_buf_detatch
+ - free_duped_table
+ - dma_sync_sg_for_cpu
+
+Fix this by getting the ion_buffer lock before freeing the sg table memory.
+
+Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping")
+Signed-off-by: Liam Mark <lmark@codeaurora.org>
+Acked-by: Laura Abbott <labbott@redhat.com>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/android/ion/ion.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index 99073325b0c00..45c7f829e3872 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -237,10 +237,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf,
+ struct ion_dma_buf_attachment *a = attachment->priv;
+ struct ion_buffer *buffer = dmabuf->priv;
+
+- free_duped_table(a->table);
+ mutex_lock(&buffer->lock);
+ list_del(&a->list);
+ mutex_unlock(&buffer->lock);
++ free_duped_table(a->table);
+
+ kfree(a);
+ }
+--
+2.19.1
+
--- /dev/null
+From f980a4552c4677cacf7a1aeb5ead6941c2a82718 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 16 Jan 2019 06:20:11 -0700
+Subject: staging: rtl8723bs: Fix build error with Clang when inlining is
+ disabled
+
+[ Upstream commit 97715058b70da1262fd07798c8b2e3e894f759dd ]
+
+When CONFIG_NO_AUTO_INLINE was present in linux-next (which added
+'-fno-inline-functions' to KBUILD_CFLAGS), an allyesconfig build with
+Clang failed at the modpost stage:
+
+ERROR: "is_broadcast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
+ERROR: "is_zero_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
+ERROR: "is_multicast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined!
+
+These functions were marked as extern inline, meaning that if inlining
+doesn't happen, the function will be undefined, as it is above.
+
+This happens to work with GCC because the '-fno-inline-functions' option
+respects the __inline attribute so all instances of these functions are
+inlined as expected and the definition doesn't actually matter. However,
+with Clang and '-fno-inline-functions', a function has to be marked with
+the __always_inline attribute to be considered for inlining, which none
+of these functions are. Clang tries to find the symbol definition
+elsewhere as it was told and fails, which trickles down to modpost.
+
+To make sure that this code compiles regardless of compiler and make the
+intention of the code clearer, use 'static' to ensure these functions
+are always defined, regardless of inlining. Additionally, silence a
+checkpatch warning by switching from '__inline' to 'inline'.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/include/ieee80211.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h
+index bcc8dfa8e6728..9efb4dcb9d3a8 100644
+--- a/drivers/staging/rtl8723bs/include/ieee80211.h
++++ b/drivers/staging/rtl8723bs/include/ieee80211.h
+@@ -850,18 +850,18 @@ enum ieee80211_state {
+ #define IP_FMT "%pI4"
+ #define IP_ARG(x) (x)
+
+-extern __inline int is_multicast_mac_addr(const u8 *addr)
++static inline int is_multicast_mac_addr(const u8 *addr)
+ {
+ return ((addr[0] != 0xff) && (0x01 & addr[0]));
+ }
+
+-extern __inline int is_broadcast_mac_addr(const u8 *addr)
++static inline int is_broadcast_mac_addr(const u8 *addr)
+ {
+ return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) && \
+ (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff));
+ }
+
+-extern __inline int is_zero_mac_addr(const u8 *addr)
++static inline int is_zero_mac_addr(const u8 *addr)
+ {
+ return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) && \
+ (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00));
+--
+2.19.1
+
--- /dev/null
+From 75f50ccda30f28523643b88456814a55551a6642 Mon Sep 17 00:00:00 2001
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Date: Tue, 22 Jan 2019 10:25:13 +0000
+Subject: svm: Fix AVIC incomplete IPI emulation
+
+[ Upstream commit bb218fbcfaaa3b115d4cd7a43c0ca164f3a96e57 ]
+
+In case of incomplete IPI with invalid interrupt type, the current
+SVM driver does not properly emulate the IPI, and fails to boot
+FreeBSD guests with multiple vcpus when enabling AVIC.
+
+Fix this by update APIC ICR high/low registers, which also
+emulate sending the IPI.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index ee8f8d70b98a2..8241fd27de19c 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4485,25 +4485,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
+- int i;
+- struct kvm_vcpu *vcpu;
+- struct kvm *kvm = svm->vcpu.kvm;
+ struct kvm_lapic *apic = svm->vcpu.arch.apic;
+
+ /*
+- * At this point, we expect that the AVIC HW has already
+- * set the appropriate IRR bits on the valid target
+- * vcpus. So, we just need to kick the appropriate vcpu.
++ * Update ICR high and low, then emulate sending IPI,
++ * which is handled when writing APIC_ICR.
+ */
+- kvm_for_each_vcpu(i, vcpu, kvm) {
+- bool m = kvm_apic_match_dest(vcpu, apic,
+- icrl & KVM_APIC_SHORT_MASK,
+- GET_APIC_DEST_FIELD(icrh),
+- icrl & KVM_APIC_DEST_MASK);
+-
+- if (m && !avic_vcpu_is_running(vcpu))
+- kvm_vcpu_wake_up(vcpu);
+- }
++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
++ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ }
+ case AVIC_IPI_FAILURE_INVALID_TARGET:
+--
+2.19.1
+
--- /dev/null
+From c22d7bca84c868a7b09fdc9b080c4b76088c6986 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 17 Dec 2018 10:02:42 +0300
+Subject: thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
+
+[ Upstream commit 3fe931b31a4078395c1967f0495dcc9e5ec6b5e3 ]
+
+The intel_soc_dts_iosf_init() function doesn't return NULL, it returns
+error pointers.
+
+Fixes: 4d0dd6c1576b ("Thermal/int340x/processor_thermal: Enable auxiliary DTS for Braswell")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/int340x_thermal/processor_thermal_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c
+index 284cf2c5a8fd9..8e0f665cf06f8 100644
+--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c
++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c
+@@ -423,7 +423,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev,
+ proc_priv->soc_dts = intel_soc_dts_iosf_init(
+ INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0);
+
+- if (proc_priv->soc_dts && pdev->irq) {
++ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) {
+ ret = pci_enable_msi(pdev);
+ if (!ret) {
+ ret = request_threaded_irq(pdev->irq, NULL,
+--
+2.19.1
+
--- /dev/null
+From 0a768f86438e18ab182b477c11f8e69e40092a31 Mon Sep 17 00:00:00 2001
+From: Matthias Kaehlcke <mka@chromium.org>
+Date: Fri, 18 Jan 2019 16:23:05 -0800
+Subject: tty: serial: qcom_geni_serial: Allow mctrl when flow control is
+ disabled
+
+[ Upstream commit e8a6ca808c5ed1e2b43ab25f1f2cbd43a7574f73 ]
+
+The geni set/get_mctrl() functions currently do nothing unless
+hardware flow control is enabled. Remove this arbitrary limitation.
+
+Suggested-by: Johan Hovold <johan@kernel.org>
+Fixes: 8a8a66a1a18a ("tty: serial: qcom_geni_serial: Add support for flow control")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 1515074e18fb6..35d1f6fa0e3c3 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -221,7 +221,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport)
+ unsigned int mctrl = TIOCM_DSR | TIOCM_CAR;
+ u32 geni_ios;
+
+- if (uart_console(uport) || !uart_cts_enabled(uport)) {
++ if (uart_console(uport)) {
+ mctrl |= TIOCM_CTS;
+ } else {
+ geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS);
+@@ -237,7 +237,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
+ {
+ u32 uart_manual_rfr = 0;
+
+- if (uart_console(uport) || !uart_cts_enabled(uport))
++ if (uart_console(uport))
+ return;
+
+ if (!(mctrl & TIOCM_RTS))
+--
+2.19.1
+
--- /dev/null
+From 54750ed4b67023d6fc0618684e49463a809833c7 Mon Sep 17 00:00:00 2001
+From: Zeng Tao <prime.zeng@hisilicon.com>
+Date: Wed, 26 Dec 2018 19:22:00 +0800
+Subject: usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
+
+[ Upstream commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 ]
+
+Currently the link_state is uninitialized and the default value is 0(U0)
+before the first time we start the udc, and after we start the udc then
+ stop the udc, the link_state will be undefined.
+We may have the following warnings if we start the udc again with
+an undefined link_state:
+
+WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308
+dwc3 100e0000.hidwc3_0: wakeup failed --> -22
+[...]
+Call Trace:
+[<c010f270>] (unwind_backtrace) from [<c010b3d8>] (show_stack+0x10/0x14)
+[<c010b3d8>] (show_stack) from [<c034a4dc>] (dump_stack+0x84/0x98)
+[<c034a4dc>] (dump_stack) from [<c0118000>] (__warn+0xe8/0x100)
+[<c0118000>] (__warn) from [<c0118050>](warn_slowpath_fmt+0x38/0x48)
+[<c0118050>] (warn_slowpath_fmt) from [<c0442ec0>](dwc3_send_gadget_ep_cmd+0x304/0x308)
+[<c0442ec0>] (dwc3_send_gadget_ep_cmd) from [<c0445e68>](dwc3_ep0_start_trans+0x48/0xf4)
+[<c0445e68>] (dwc3_ep0_start_trans) from [<c0446750>](dwc3_ep0_out_start+0x64/0x80)
+[<c0446750>] (dwc3_ep0_out_start) from [<c04451c0>](__dwc3_gadget_start+0x1e0/0x278)
+[<c04451c0>] (__dwc3_gadget_start) from [<c04452e0>](dwc3_gadget_start+0x88/0x10c)
+[<c04452e0>] (dwc3_gadget_start) from [<c045ee54>](udc_bind_to_driver+0x88/0xbc)
+[<c045ee54>] (udc_bind_to_driver) from [<c045f29c>](usb_gadget_probe_driver+0xf8/0x140)
+[<c045f29c>] (usb_gadget_probe_driver) from [<bf005424>](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite])
+[<bf005424>] (gadget_dev_desc_UDC_store [libcomposite]) from[<c023d8e0>] (configfs_write_file+0xd4/0x160)
+[<c023d8e0>] (configfs_write_file) from [<c01d51e8>] (__vfs_write+0x1c/0x114)
+[<c01d51e8>] (__vfs_write) from [<c01d5ff4>] (vfs_write+0xa4/0x168)
+[<c01d5ff4>] (vfs_write) from [<c01d6d40>] (SyS_write+0x3c/0x90)
+[<c01d6d40>] (SyS_write) from [<c0107400>] (ret_fast_syscall+0x0/0x3c)
+
+Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f6cd7feeb1c4f..700fb626ad03b 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1864,6 +1864,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
+
+ /* begin to receive SETUP packets */
+ dwc->ep0state = EP0_SETUP_PHASE;
++ dwc->link_state = DWC3_LINK_STATE_SS_DIS;
+ dwc3_ep0_out_start(dwc);
+
+ dwc3_gadget_enable_irq(dwc);
+--
+2.19.1
+
--- /dev/null
+From 3879a4ff1bcd8b45b90f152ba64a975c68ec61e4 Mon Sep 17 00:00:00 2001
+From: Bo He <bo.he@intel.com>
+Date: Mon, 14 Jan 2019 09:48:32 +0200
+Subject: usb: dwc3: gadget: synchronize_irq dwc irq in suspend
+
+[ Upstream commit 01c10880d24291a96a4ab0da773e3c5ce4d12da8 ]
+
+We see dwc3 endpoint stopped by unwanted irq during
+suspend resume test, which is caused dwc3 ep can't be started
+with error "No Resource".
+
+Here, add synchronize_irq before suspend to sync the
+pending IRQ handlers complete.
+
+Signed-off-by: Bo He <bo.he@intel.com>
+Signed-off-by: Yu Wang <yu.y.wang@intel.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 0db90f6f4aa81..f6cd7feeb1c4f 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -3274,6 +3274,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc)
+ dwc3_disconnect_gadget(dwc);
+ __dwc3_gadget_stop(dwc);
+
++ synchronize_irq(dwc->irq_gadget);
++
+ return 0;
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 26f579c740351076b0ec01bb9a3bd88816bb6d7b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 21 Dec 2018 23:42:52 +0300
+Subject: usb: gadget: Potential NULL dereference on allocation error
+
+[ Upstream commit df28169e1538e4a8bcd8b779b043e5aa6524545c ]
+
+The source_sink_alloc_func() function is supposed to return error
+pointers on error. The function is called from usb_get_function() which
+doesn't check for NULL returns so it would result in an Oops.
+
+Of course, in the current kernel, small allocations always succeed so
+this doesn't affect runtime.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_sourcesink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c
+index 9cdef108fb1b3..ed68a4860b7d8 100644
+--- a/drivers/usb/gadget/function/f_sourcesink.c
++++ b/drivers/usb/gadget/function/f_sourcesink.c
+@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func(
+
+ ss = kzalloc(sizeof(*ss), GFP_KERNEL);
+ if (!ss)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ ss_opts = container_of(fi, struct f_ss_opts, func_inst);
+
+--
+2.19.1
+
--- /dev/null
+From d6f5487fcf8ee158d7c343010d20730a7d161d41 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 12 Dec 2017 08:38:30 -0800
+Subject: writeback: synchronize sync(2) against cgroup writeback membership
+ switches
+
+[ Upstream commit 7fc5854f8c6efae9e7624970ab49a1eac2faefb1 ]
+
+sync_inodes_sb() can race against cgwb (cgroup writeback) membership
+switches and fail to writeback some inodes. For example, if an inode
+switches to another wb while sync_inodes_sb() is in progress, the new
+wb might not be visible to bdi_split_work_to_wbs() at all or the inode
+might jump from a wb which hasn't issued writebacks yet to one which
+already has.
+
+This patch adds backing_dev_info->wb_switch_rwsem to synchronize cgwb
+switch path against sync_inodes_sb() so that sync_inodes_sb() is
+guaranteed to see all the target wbs and inodes can't jump wbs to
+escape syncing.
+
+v2: Fixed misplaced rwsem init. Spotted by Jiufei.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Jiufei Xue <xuejiufei@gmail.com>
+Link: http://lkml.kernel.org/r/dc694ae2-f07f-61e1-7097-7c8411cee12d@gmail.com
+Acked-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fs-writeback.c | 40 ++++++++++++++++++++++++++++++--
+ include/linux/backing-dev-defs.h | 1 +
+ mm/backing-dev.c | 1 +
+ 3 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index 471d863958bc2..82ce6d4f7e314 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -331,11 +331,22 @@ struct inode_switch_wbs_context {
+ struct work_struct work;
+ };
+
++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi)
++{
++ down_write(&bdi->wb_switch_rwsem);
++}
++
++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi)
++{
++ up_write(&bdi->wb_switch_rwsem);
++}
++
+ static void inode_switch_wbs_work_fn(struct work_struct *work)
+ {
+ struct inode_switch_wbs_context *isw =
+ container_of(work, struct inode_switch_wbs_context, work);
+ struct inode *inode = isw->inode;
++ struct backing_dev_info *bdi = inode_to_bdi(inode);
+ struct address_space *mapping = inode->i_mapping;
+ struct bdi_writeback *old_wb = inode->i_wb;
+ struct bdi_writeback *new_wb = isw->new_wb;
+@@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
+ bool switched = false;
+ void **slot;
+
++ /*
++ * If @inode switches cgwb membership while sync_inodes_sb() is
++ * being issued, sync_inodes_sb() might miss it. Synchronize.
++ */
++ down_read(&bdi->wb_switch_rwsem);
++
+ /*
+ * By the time control reaches here, RCU grace period has passed
+ * since I_WB_SWITCH assertion and all wb stat update transactions
+@@ -435,6 +452,8 @@ static void inode_switch_wbs_work_fn(struct work_struct *work)
+ spin_unlock(&new_wb->list_lock);
+ spin_unlock(&old_wb->list_lock);
+
++ up_read(&bdi->wb_switch_rwsem);
++
+ if (switched) {
+ wb_wakeup(new_wb);
+ wb_put(old_wb);
+@@ -475,9 +494,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ if (inode->i_state & I_WB_SWITCH)
+ return;
+
++ /*
++ * Avoid starting new switches while sync_inodes_sb() is in
++ * progress. Otherwise, if the down_write protected issue path
++ * blocks heavily, we might end up starting a large number of
++ * switches which will block on the rwsem.
++ */
++ if (!down_read_trylock(&bdi->wb_switch_rwsem))
++ return;
++
+ isw = kzalloc(sizeof(*isw), GFP_ATOMIC);
+ if (!isw)
+- return;
++ goto out_unlock;
+
+ /* find and pin the new wb */
+ rcu_read_lock();
+@@ -511,12 +539,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
+ * Let's continue after I_WB_SWITCH is guaranteed to be visible.
+ */
+ call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
+- return;
++ goto out_unlock;
+
+ out_free:
+ if (isw->new_wb)
+ wb_put(isw->new_wb);
+ kfree(isw);
++out_unlock:
++ up_read(&bdi->wb_switch_rwsem);
+ }
+
+ /**
+@@ -894,6 +924,9 @@ fs_initcall(cgroup_writeback_init);
+
+ #else /* CONFIG_CGROUP_WRITEBACK */
+
++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { }
++
+ static struct bdi_writeback *
+ locked_inode_to_wb_and_lock_list(struct inode *inode)
+ __releases(&inode->i_lock)
+@@ -2420,8 +2453,11 @@ void sync_inodes_sb(struct super_block *sb)
+ return;
+ WARN_ON(!rwsem_is_locked(&sb->s_umount));
+
++ /* protect against inode wb switch, see inode_switch_wbs_work_fn() */
++ bdi_down_write_wb_switch_rwsem(bdi);
+ bdi_split_work_to_wbs(bdi, &work, false);
+ wb_wait_for_completion(bdi, &done);
++ bdi_up_write_wb_switch_rwsem(bdi);
+
+ wait_sb_inodes(sb);
+ }
+diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
+index c311571355981..07e02d6df5ad9 100644
+--- a/include/linux/backing-dev-defs.h
++++ b/include/linux/backing-dev-defs.h
+@@ -190,6 +190,7 @@ struct backing_dev_info {
+ struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */
+ struct rb_root cgwb_congested_tree; /* their congested states */
+ struct mutex cgwb_release_mutex; /* protect shutdown of wb structs */
++ struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */
+ #else
+ struct bdi_writeback_congested *wb_congested;
+ #endif
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index 8a8bb8796c6c4..72e6d0c55cfad 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi)
+ INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
+ bdi->cgwb_congested_tree = RB_ROOT;
+ mutex_init(&bdi->cgwb_release_mutex);
++ init_rwsem(&bdi->wb_switch_rwsem);
+
+ ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
+ if (!ret) {
+--
+2.19.1
+
--- /dev/null
+From 2e35d41d38bd3985b38a13775064947bb3e8deda Mon Sep 17 00:00:00 2001
+From: Peng Hao <peng.hao2@zte.com.cn>
+Date: Sat, 29 Dec 2018 14:34:12 +0800
+Subject: x86/mm/mem_encrypt: Fix erroneous sizeof()
+
+[ Upstream commit bf7d28c53453ea904584960de55e33e03b9d93b1 ]
+
+Using sizeof(pointer) for determining the size of a memset() only works
+when the size of the pointer and the size of type to which it points are
+the same. For pte_t this is only true for 64bit and 32bit-NONPAE. On 32bit
+PAE systems this is wrong as the pointer size is 4 byte but the PTE entry
+is 8 bytes. It's actually not a real world issue as this code depends on
+64bit, but it's wrong nevertheless.
+
+Use sizeof(*p) for correctness sake.
+
+Fixes: aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()")
+Signed-off-by: Peng Hao <peng.hao2@zte.com.cn>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: dave.hansen@linux.intel.com
+Cc: peterz@infradead.org
+Cc: luto@kernel.org
+Link: https://lkml.kernel.org/r/1546065252-97996-1-git-send-email-peng.hao2@zte.com.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/mem_encrypt_identity.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index 7ae36868aed25..c9faf34cbb62e 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -157,8 +157,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd)
+ pmd = pmd_offset(pud, ppd->vaddr);
+ if (pmd_none(*pmd)) {
+ pte = ppd->pgtable_area;
+- memset(pte, 0, sizeof(pte) * PTRS_PER_PTE);
+- ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE;
++ memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE);
++ ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE;
+ set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte)));
+ }
+
+--
+2.19.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
