--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 27 Aug 2018 09:45:44 +0200
+Subject: ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 240714061c58e6b1abfb3322398a7634151c06cb ]
+
+Bay and Cherry Trail DSTDs represent a different set of devices depending
+on which OS the device think it is booting. One set of decices for Windows
+and another set of devices for Android which targets the Android-x86 Linux
+kernel fork (which e.g. used to have its own display driver instead of
+using the i915 driver).
+
+Which set of devices we are actually going to get is out of our control,
+this is controlled by the ACPI OSID variable, which gets either set through
+an EFI setup option, or sometimes is autodetected. So we need to support
+both.
+
+This commit adds support for the 80862286 and 808622C0 ACPI HIDs which we
+get for the first resp. second DMA controller on Cherry Trail devices when
+OSID is set to Android.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpi_lpss.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -327,9 +327,11 @@ static const struct acpi_device_id acpi_
+ { "INT33FC", },
+
+ /* Braswell LPSS devices */
++ { "80862286", LPSS_ADDR(lpss_dma_desc) },
+ { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(bsw_uart_dev_desc) },
+ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
++ { "808622C0", LPSS_ADDR(lpss_dma_desc) },
+ { "808622C1", LPSS_ADDR(bsw_i2c_dev_desc) },
+
+ /* Broadwell LPSS devices */
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
+Date: Fri, 28 Sep 2018 14:24:02 +0530
+Subject: ACPI / PM: LPIT: Register sysfs attributes based on FADT
+
+From: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
+
+[ Upstream commit 1cdda9486f5103fb133f88e662e48c504adbb779 ]
+
+ACPI Low Power S0 Idle capabilities are announced via FADT table and can
+be used to inform the kernel about the presence of one or more Low Power
+Idle (LPI) entries as descried in LPIT table. LPIT table can exist
+independently even if the FADT S0 Idle flag is not set and thus it could
+confuse user since the following cpuidle attributes are created.
+
+/sys/devices/system/cpu/cpuidle/low_power_idle_cpu_residency_us
+/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us
+
+Presence or absence of above attributes could mean that the given
+platform supports S0ix state or not.
+
+This change allows to create the above cpuidle attributes only if
+FADT table supports Low Power S0 Idle.
+
+Signed-off-by: Rajneesh Bhardwaj <rajneesh.bhardwaj@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpi_lpit.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/acpi/acpi_lpit.c
++++ b/drivers/acpi/acpi_lpit.c
+@@ -117,11 +117,17 @@ static void lpit_update_residency(struct
+ if (!info->iomem_addr)
+ return;
+
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_system_residency_us.attr,
+ "cpuidle");
+ } else if (info->gaddr.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) {
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_cpu_residency_us.attr,
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jeffrey Hugo <jhugo@codeaurora.org>
+Date: Thu, 4 Oct 2018 09:20:06 -0600
+Subject: ACPI/PPTT: Handle architecturally unknown cache types
+
+From: Jeffrey Hugo <jhugo@codeaurora.org>
+
+[ Upstream commit 59bbff3775c0951300f7b41345a54b999438f8d0 ]
+
+The type of a cache might not be specified by architectural mechanisms (ie
+system registers), but its type might be specified in the PPTT. In this
+case, we should populate the type of the cache, rather than leave it
+undefined.
+
+This fixes the issue where the cacheinfo driver will not populate sysfs
+for such caches, resulting in the information missing from utilities like
+lstopo and lscpu, thus degrading the user experience.
+
+Fixes: 2bd00bcd73e5 (ACPI/PPTT: Add Processor Properties Topology Table parsing)
+Reported-by: Vijaya Kumar K <vkilari@codeaurora.org>
+Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/pptt.c | 33 +++++++++++++--------------------
+ 1 file changed, 13 insertions(+), 20 deletions(-)
+
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -338,9 +338,6 @@ static struct acpi_pptt_cache *acpi_find
+ return found;
+ }
+
+-/* total number of attributes checked by the properties code */
+-#define PPTT_CHECKED_ATTRIBUTES 4
+-
+ /**
+ * update_cache_properties() - Update cacheinfo for the given processor
+ * @this_leaf: Kernel cache info structure being updated
+@@ -357,25 +354,15 @@ static void update_cache_properties(stru
+ struct acpi_pptt_cache *found_cache,
+ struct acpi_pptt_processor *cpu_node)
+ {
+- int valid_flags = 0;
+-
+ this_leaf->fw_token = cpu_node;
+- if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID)
+ this_leaf->size = found_cache->size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID) {
++ if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID)
+ this_leaf->coherency_line_size = found_cache->line_size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID) {
++ if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID)
+ this_leaf->number_of_sets = found_cache->number_of_sets;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID)
+ this_leaf->ways_of_associativity = found_cache->associativity;
+- valid_flags++;
+- }
+ if (found_cache->flags & ACPI_PPTT_WRITE_POLICY_VALID) {
+ switch (found_cache->attributes & ACPI_PPTT_MASK_WRITE_POLICY) {
+ case ACPI_PPTT_CACHE_POLICY_WT:
+@@ -402,11 +389,17 @@ static void update_cache_properties(stru
+ }
+ }
+ /*
+- * If the above flags are valid, and the cache type is NOCACHE
+- * update the cache type as well.
++ * If cache type is NOCACHE, then the cache hasn't been specified
++ * via other mechanisms. Update the type if a cache type has been
++ * provided.
++ *
++ * Note, we assume such caches are unified based on conventional system
++ * design and known examples. Significant work is required elsewhere to
++ * fully support data/instruction only type caches which are only
++ * specified in PPTT.
+ */
+ if (this_leaf->type == CACHE_TYPE_NOCACHE &&
+- valid_flags == PPTT_CHECKED_ATTRIBUTES)
++ found_cache->flags & ACPI_PPTT_CACHE_TYPE_VALID)
+ this_leaf->type = CACHE_TYPE_UNIFIED;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Dou Liyang <douly.fnst@cn.fujitsu.com>
+Date: Fri, 24 Aug 2018 10:51:26 +0800
+Subject: ACPI / processor: Fix the return value of acpi_processor_ids_walk()
+
+From: Dou Liyang <douly.fnst@cn.fujitsu.com>
+
+[ Upstream commit d0381bf4f80c571dde1244fe5b85dc35e8b3f546 ]
+
+ACPI driver should make sure all the processor IDs in their ACPI Namespace
+are unique. the driver performs a depth-first walk of the namespace tree
+and calls the acpi_processor_ids_walk() to check the duplicate IDs.
+
+But, the acpi_processor_ids_walk() mistakes the return value. If a
+processor is checked, it returns true which causes the walk break
+immediately, and other processors will never be checked.
+
+Repace the value with AE_OK which is the standard acpi_status value.
+And don't abort the namespace walk even on error.
+
+Fixes: 8c8cb30f49b8 (acpi/processor: Implement DEVICE operator for processor enumeration)
+Signed-off-by: Dou Liyang <douly.fnst@cn.fujitsu.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpi_processor.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -643,7 +643,7 @@ static acpi_status __init acpi_processor
+
+ status = acpi_get_type(handle, &acpi_type);
+ if (ACPI_FAILURE(status))
+- return false;
++ return status;
+
+ switch (acpi_type) {
+ case ACPI_TYPE_PROCESSOR:
+@@ -663,11 +663,12 @@ static acpi_status __init acpi_processor
+ }
+
+ processor_validated_ids_update(uid);
+- return true;
++ return AE_OK;
+
+ err:
++ /* Exit on error, but don't abort the namespace walk */
+ acpi_handle_info(handle, "Invalid processor object\n");
+- return false;
++ return AE_OK;
+
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 11 Aug 2018 23:33:34 +0200
+Subject: ALSA: hda: Check the non-cached stream buffers more explicitly
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 78c9be61c3a5cd9e2439fd27a5ffad73a81958c7 ]
+
+Introduce a new flag, uc_buffer, to indicate that the controller
+requires the non-cached pages for stream buffers, either as a
+chip-specific requirement or specified via snoop=0 option.
+This improves the code-readability.
+
+Also, this patch fixes the incorrect behavior for C-Media chip where
+the stream buffers were never handled as non-cached due to the check
+of driver_type even if you pass snoop=0 option.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_controller.h | 1 +
+ sound/pci/hda/hda_intel.c | 11 ++++++++---
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -160,6 +160,7 @@ struct azx {
+ unsigned int msi:1;
+ unsigned int probing:1; /* codec probing phase */
+ unsigned int snoop:1;
++ unsigned int uc_buffer:1; /* non-cached pages for stream buffers */
+ unsigned int align_buffer_size:1;
+ unsigned int region_requested:1;
+ unsigned int disabled:1; /* disabled by vga_switcheroo */
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -410,7 +410,7 @@ static void __mark_pages_wc(struct azx *
+ #ifdef CONFIG_SND_DMA_SGBUF
+ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
+ struct snd_sg_buf *sgbuf = dmab->private_data;
+- if (chip->driver_type == AZX_DRIVER_CMEDIA)
++ if (!chip->uc_buffer)
+ return; /* deal with only CORB/RIRB buffers */
+ if (on)
+ set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
+@@ -1636,6 +1636,7 @@ static void azx_check_snoop_available(st
+ dev_info(chip->card->dev, "Force to %s mode by module option\n",
+ snoop ? "snoop" : "non-snoop");
+ chip->snoop = snoop;
++ chip->uc_buffer = !snoop;
+ return;
+ }
+
+@@ -1656,8 +1657,12 @@ static void azx_check_snoop_available(st
+ snoop = false;
+
+ chip->snoop = snoop;
+- if (!snoop)
++ if (!snoop) {
+ dev_info(chip->card->dev, "Force to non-snoop mode\n");
++ /* C-Media requires non-cached pages only for CORB/RIRB */
++ if (chip->driver_type != AZX_DRIVER_CMEDIA)
++ chip->uc_buffer = true;
++ }
+ }
+
+ static void azx_probe_work(struct work_struct *work)
+@@ -2096,7 +2101,7 @@ static void pcm_mmap_prepare(struct snd_
+ #ifdef CONFIG_X86
+ struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
+ struct azx *chip = apcm->chip;
+- if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA)
++ if (chip->uc_buffer)
+ area->vm_page_prot = pgprot_writecombine(area->vm_page_prot);
+ #endif
+ }
--- /dev/null
+From f5e758b8358f6c27e8a351ddf0b441a64cdabb94 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 5 Sep 2018 12:02:15 +0200
+Subject: ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit f5e758b8358f6c27e8a351ddf0b441a64cdabb94 upstream.
+
+PMIC_IRQB and PMIC_KEYINB lines on Exynos4210-based Origen board have
+external pull-up resistors, so disable any pull control for those lines
+in respective pin controller node. This fixes support for MAX8997
+interrupts and enables operation of wakeup from MAX8997 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Fixes: 17419726aaa1 ("ARM: dts: add max8997 device node for exynos4210-origen board")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos4210-origen.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm/boot/dts/exynos4210-origen.dts
++++ b/arch/arm/boot/dts/exynos4210-origen.dts
+@@ -151,6 +151,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx0>;
+ interrupts = <4 IRQ_TYPE_NONE>, <3 IRQ_TYPE_NONE>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&max8997_irq>;
+
+ max8997,pmic-buck1-dvs-voltage = <1350000>;
+ max8997,pmic-buck2-dvs-voltage = <1100000>;
+@@ -288,6 +290,13 @@
+ };
+ };
+
++&pinctrl_1 {
++ max8997_irq: max8997-irq {
++ samsung,pins = "gpx0-3", "gpx0-4";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &sdhci_0 {
+ bus-width = <4>;
+ pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus4 &sd0_cd>;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Tue, 9 Oct 2018 14:47:05 +0100
+Subject: arm64: cpufeature: ctr: Fix cpu capability check for late CPUs
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 8ab66cbe63aeaf9e5970fb4aaef1c660fca59321 ]
+
+The matches() routine for a capability must honor the "scope"
+passed to it and return the proper results.
+i.e, when passed with SCOPE_LOCAL_CPU, it should check the
+status of the capability on the current CPU. This is used by
+verify_local_cpu_capabilities() on a late secondary CPU to make
+sure that it's compliant with the established system features.
+However, ARM64_HAS_CACHE_{IDC/DIC} always checks the system wide
+registers and this could mean that a late secondary CPU could return
+"true" (since the CPU hasn't updated the system wide registers yet)
+and thus lead the system in an inconsistent state, where
+the system assumes it has IDC/DIC feature, while the new CPU
+doesn't.
+
+Fixes: commit 6ae4b6e0578886eb36 ("arm64: Add support for new control bits CTR_EL0.DIC and CTR_EL0.IDC")
+Cc: Philip Elcan <pelcan@codeaurora.org>
+Cc: Shanker Donthineni <shankerd@codeaurora.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/cpufeature.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -847,15 +847,29 @@ static bool has_no_fpsimd(const struct a
+ }
+
+ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_IDC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_IDC_SHIFT);
+ }
+
+ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_DIC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_DIC_SHIFT);
+ }
+
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 7 Aug 2018 13:43:06 +0100
+Subject: arm64: entry: Allow handling of undefined instructions from EL1
+
+From: Will Deacon <will.deacon@arm.com>
+
+[ Upstream commit 0bf0f444b2c49241b2b39aa3cf210d7c95ef6c34 ]
+
+Rather than panic() when taking an undefined instruction exception from
+EL1, allow a hook to be registered in case we want to emulate the
+instruction, like we will for the SSBS PSTATE manipulation instructions.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/entry.S | 2 +-
+ arch/arm64/kernel/traps.c | 11 +++++++----
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -599,7 +599,7 @@ el1_undef:
+ inherit_daif pstate=x23, tmp=x2
+ mov x0, sp
+ bl do_undefinstr
+- ASM_BUG()
++ kernel_exit 1
+ el1_dbg:
+ /*
+ * Debug exception handling
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -310,10 +310,12 @@ static int call_undef_hook(struct pt_reg
+ int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
+ void __user *pc = (void __user *)instruction_pointer(regs);
+
+- if (!user_mode(regs))
+- return 1;
+-
+- if (compat_thumb_mode(regs)) {
++ if (!user_mode(regs)) {
++ __le32 instr_le;
++ if (probe_kernel_address((__force __le32 *)pc, instr_le))
++ goto exit;
++ instr = le32_to_cpu(instr_le);
++ } else if (compat_thumb_mode(regs)) {
+ /* 16-bit Thumb instruction */
+ __le16 instr_le;
+ if (get_user(instr_le, (__le16 __user *)pc))
+@@ -407,6 +409,7 @@ asmlinkage void __exception do_undefinst
+ return;
+
+ force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc);
++ BUG_ON(!user_mode(regs));
+ }
+
+ void cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Thu, 11 Oct 2018 12:20:49 -0700
+Subject: ataflop: fix error handling during setup
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 71327f547ee3a46ec5c39fdbbd268401b2578d0e ]
+
+Move queue allocation next to disk allocation to fix a couple of issues:
+
+- If add_disk() hasn't been called, we should clear disk->queue before
+ calling put_disk().
+- If we fail to allocate a request queue, we still need to put all of
+ the disks, not just the ones that we allocated queues for.
+
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/ataflop.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -1935,6 +1935,11 @@ static int __init atari_floppy_init (voi
+ unit[i].disk = alloc_disk(1);
+ if (!unit[i].disk)
+ goto Enomem;
++
++ unit[i].disk->queue = blk_init_queue(do_fd_request,
++ &ataflop_lock);
++ if (!unit[i].disk->queue)
++ goto Enomem;
+ }
+
+ if (UseTrackbuffer < 0)
+@@ -1966,10 +1971,6 @@ static int __init atari_floppy_init (voi
+ sprintf(unit[i].disk->disk_name, "fd%d", i);
+ unit[i].disk->fops = &floppy_fops;
+ unit[i].disk->private_data = &unit[i];
+- unit[i].disk->queue = blk_init_queue(do_fd_request,
+- &ataflop_lock);
+- if (!unit[i].disk->queue)
+- goto Enomem;
+ set_capacity(unit[i].disk, MAX_DISK_SIZE * 2);
+ add_disk(unit[i].disk);
+ }
+@@ -1984,13 +1985,17 @@ static int __init atari_floppy_init (voi
+
+ return 0;
+ Enomem:
+- while (i--) {
+- struct request_queue *q = unit[i].disk->queue;
++ do {
++ struct gendisk *disk = unit[i].disk;
+
+- put_disk(unit[i].disk);
+- if (q)
+- blk_cleanup_queue(q);
+- }
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(unit[i].disk);
++ }
++ } while (i--);
+
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+ return -ENOMEM;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Martin Willi <martin@strongswan.org>
+Date: Wed, 22 Aug 2018 09:39:52 +0200
+Subject: ath10k: schedule hardware restart if WMI command times out
+
+From: Martin Willi <martin@strongswan.org>
+
+[ Upstream commit a9911937e7d332761e8c4fcbc7ba0426bdc3956f ]
+
+When running in AP mode, ath10k sometimes suffers from TX credit
+starvation. The issue is hard to reproduce and shows up once in a
+few days, but has been repeatedly seen with QCA9882 and a large
+range of firmwares, including 10.2.4.70.67.
+
+Once the module is in this state, TX credits are never replenished,
+which results in "SWBA overrun" errors, as no beacons can be sent.
+Even worse, WMI commands run in a timeout while holding the conf
+mutex for three seconds each, making any further operations slow
+and the whole system unresponsive.
+
+The firmware/driver never recovers from that state automatically,
+and triggering TX flush or warm restarts won't work over WMI. So
+issue a hardware restart if a WMI command times out due to missing
+TX credits. This implies a connectivity outage of about 1.4s in AP
+mode, but brings back the interface and the whole system to a usable
+state. WMI command timeouts have not been seen in absent of this
+specific issue, so taking such drastic actions seems legitimate.
+
+Signed-off-by: Martin Willi <martin@strongswan.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1869,6 +1869,12 @@ int ath10k_wmi_cmd_send(struct ath10k *a
+ if (ret)
+ dev_kfree_skb_any(skb);
+
++ if (ret == -EAGAIN) {
++ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n",
++ cmd_id);
++ queue_work(ar->workqueue, &ar->restart_work);
++ }
++
+ return ret;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Ben Peddell <klightspeed@killerwolves.net>
+Date: Mon, 8 Oct 2018 20:41:13 +0800
+Subject: bcache: Populate writeback_rate_minimum attribute
+
+From: Ben Peddell <klightspeed@killerwolves.net>
+
+[ Upstream commit 7567c2a2ad9e80a2ce977eef535e64b61899633e ]
+
+Forgot to include the maintainers with my first email.
+
+Somewhere between Michael Lyle's original
+"bcache: PI controller for writeback rate V2" patch dated 07 Sep 2017
+and 1d316e6 bcache: implement PI controller for writeback rate,
+the mapping of the writeback_rate_minimum attribute was dropped.
+
+Re-add the missing sysfs writeback_rate_minimum attribute mapping to
+"allow the user to specify a minimum rate at which dirty blocks are
+retired."
+
+Fixes: 1d316e6 ("bcache: implement PI controller for writeback rate")
+Signed-off-by: Ben Peddell <klightspeed@killerwolves.net>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/bcache/sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -263,6 +263,7 @@ STORE(__cached_dev)
+ 1, WRITEBACK_RATE_UPDATE_SECS_MAX);
+ d_strtoul(writeback_rate_i_term_inverse);
+ d_strtoul_nonzero(writeback_rate_p_term_inverse);
++ d_strtoul_nonzero(writeback_rate_minimum);
+
+ sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX);
+
+@@ -389,6 +390,7 @@ static struct attribute *bch_cached_dev_
+ &sysfs_writeback_rate_update_seconds,
+ &sysfs_writeback_rate_i_term_inverse,
+ &sysfs_writeback_rate_p_term_inverse,
++ &sysfs_writeback_rate_minimum,
+ &sysfs_writeback_rate_debug,
+ &sysfs_errors,
+ &sysfs_io_error_limit,
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Paolo Valente <paolo.valente@linaro.org>
+Date: Fri, 14 Sep 2018 16:23:07 +0200
+Subject: block, bfq: correctly charge and reset entity service in all cases
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit cbeb869a3d1110450186b738199963c5e68c2a71 ]
+
+BFQ schedules entities (which represent either per-process queues or
+groups of queues) as a function of their timestamps. In particular, as
+a function of their (virtual) finish times. The finish time of an
+entity is computed as a function of the budget assigned to the entity,
+assuming, tentatively, that the entity, once in service, will receive
+an amount of service equal to its budget. Then, when the entity is
+expired because it finishes to be served, this finish time is updated
+as a function of the actual service received by the entity. This
+allows the entity to be correctly charged with only the service
+received, and then to be correctly re-scheduled.
+
+Yet an entity may receive service also while not being the entity in
+service (in the scheduling environment of its parent entity), for
+several reasons. If the entity remains with no backlog while receiving
+this 'unofficial' service, then it is expired. Also on such an
+expiration, the finish time of the entity should be updated to account
+for only the service actually received by the entity. Unfortunately,
+such an update is not performed for an entity expiring without being
+the entity in service.
+
+In a similar vein, the service counter of the entity in service is
+reset when the entity is expired, to be ready to be used for next
+service cycle. This reset too should be performed also in case an
+entity is expired because it remains empty after receiving service
+while not being the entity in service. But in this case the reset is
+not performed.
+
+This commit performs the above update of the finish time and reset of
+the service received, also for an entity expiring while not being the
+entity in service.
+
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/bfq-wf2q.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -1178,10 +1178,17 @@ bool __bfq_deactivate_entity(struct bfq_
+ st = bfq_entity_service_tree(entity);
+ is_in_service = entity == sd->in_service_entity;
+
+- if (is_in_service) {
+- bfq_calc_finish(entity, entity->service);
++ bfq_calc_finish(entity, entity->service);
++
++ if (is_in_service)
+ sd->in_service_entity = NULL;
+- }
++ else
++ /*
++ * Non in-service entity: nobody will take care of
++ * resetting its service counter on expiration. Do it
++ * now.
++ */
++ entity->service = 0;
+
+ if (entity->tree == &st->active)
+ bfq_active_extract(st, entity);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Christian Hewitt <christianshewitt@gmail.com>
+Date: Tue, 4 Sep 2018 21:50:57 +0400
+Subject: Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+[ Upstream commit a357ea098c9605f60d92a66a9073f56ce25726da ]
+
+This patch adds the device ID for the AMPAK AP6335 combo module used
+in the 1st generation WeTek Hub Android/LibreELEC HTPC box. The WiFI
+chip identifies itself as BCM4339, while Bluetooth identifies itself
+as BCM4335 (rev C0):
+
+```
+[ 4.864248] Bluetooth: hci0: BCM: chip id 86
+[ 4.866388] Bluetooth: hci0: BCM: features 0x2f
+[ 4.889317] Bluetooth: hci0: BCM4335C0
+[ 4.889332] Bluetooth: hci0: BCM4335C0 (003.001.009) build 0000
+[ 9.778383] Bluetooth: hci0: BCM4335C0 (003.001.009) build 0268
+```
+
+Output from hciconfig:
+
+```
+hci0: Type: Primary Bus: UART
+ BD Address: 43:39:00:00:1F:AC ACL MTU: 1021:8 SCO MTU: 64:1
+ UP RUNNING
+ RX bytes:7567 acl:234 sco:0 events:386 errors:0
+ TX bytes:53844 acl:77 sco:0 commands:304 errors:0
+ Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
+ Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
+ Link policy: RSWITCH SNIFF
+ Link mode: SLAVE ACCEPT
+ Name: 'HUB'
+ Class: 0x0c0000
+ Service Classes: Rendering, Capturing
+ Device Class: Miscellaneous,
+ HCI Version: 4.0 (0x6) Revision: 0x10c
+ LMP Version: 4.0 (0x6) Subversion: 0x6109
+ Manufacturer: Broadcom Corporation (15)
+```
+
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bluetooth/btbcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm
+ { 0x4103, "BCM4330B1" }, /* 002.001.003 */
+ { 0x410e, "BCM43341B0" }, /* 002.001.014 */
+ { 0x4406, "BCM4324B3" }, /* 002.004.006 */
++ { 0x6109, "BCM4335C0" }, /* 003.001.009 */
+ { 0x610c, "BCM4354" }, /* 003.001.012 */
+ { 0x2122, "BCM4343A0" }, /* 001.001.034 */
+ { 0x2209, "BCM43430A1" }, /* 001.002.009 */
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 5 Oct 2018 19:38:46 -0700
+Subject: bpf: do not blindly change rlimit in reuseport net selftest
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 262f9d811c7608f1e74258ceecfe1fa213bdf912 ]
+
+If the current process has unlimited RLIMIT_MEMLOCK,
+we should should leave it as is.
+
+Fixes: 941ff6f11c02 ("bpf: fix rlimit in reuseport net selftest")
+Signed-off-by: John Sperbeck <jsperbeck@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/reuseport_bpf.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/tools/testing/selftests/net/reuseport_bpf.c
++++ b/tools/testing/selftests/net/reuseport_bpf.c
+@@ -437,14 +437,19 @@ void enable_fastopen(void)
+ }
+ }
+
+-static struct rlimit rlim_old, rlim_new;
++static struct rlimit rlim_old;
+
+ static __attribute__((constructor)) void main_ctor(void)
+ {
+ getrlimit(RLIMIT_MEMLOCK, &rlim_old);
+- rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
+- rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
+- setrlimit(RLIMIT_MEMLOCK, &rlim_new);
++
++ if (rlim_old.rlim_cur != RLIM_INFINITY) {
++ struct rlimit rlim_new;
++
++ rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
++ rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
++ setrlimit(RLIMIT_MEMLOCK, &rlim_new);
++ }
+ }
+
+ static __attribute__((destructor)) void main_dtor(void)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Alexei Starovoitov <ast@kernel.org>
+Date: Tue, 4 Sep 2018 19:13:44 -0700
+Subject: bpf/verifier: fix verifier instability
+
+From: Alexei Starovoitov <ast@kernel.org>
+
+[ Upstream commit a9c676bc8fc58d00eea9836fb14ee43c0346416a ]
+
+Edward Cree says:
+In check_mem_access(), for the PTR_TO_CTX case, after check_ctx_access()
+has supplied a reg_type, the other members of the register state are set
+appropriately. Previously reg.range was set to 0, but as it is in a
+union with reg.map_ptr, which is larger, upper bytes of the latter were
+left in place. This then caused the memcmp() in regsafe() to fail,
+preventing some branches from being pruned (and occasionally causing the
+same program to take a varying number of processed insns on repeated
+verifier runs).
+
+Fix the instability by clearing bpf_reg_state in __mark_reg_[un]known()
+
+Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
+Debugged-by: Edward Cree <ecree@solarflare.com>
+Acked-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/verifier.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -553,7 +553,9 @@ static void __mark_reg_not_init(struct b
+ */
+ static void __mark_reg_known(struct bpf_reg_state *reg, u64 imm)
+ {
+- reg->id = 0;
++ /* Clear id, off, and union(map_ptr, range) */
++ memset(((u8 *)reg) + sizeof(reg->type), 0,
++ offsetof(struct bpf_reg_state, var_off) - sizeof(reg->type));
+ reg->var_off = tnum_const(imm);
+ reg->smin_value = (s64)imm;
+ reg->smax_value = (s64)imm;
+@@ -572,7 +574,6 @@ static void __mark_reg_known_zero(struct
+ static void __mark_reg_const_zero(struct bpf_reg_state *reg)
+ {
+ __mark_reg_known(reg, 0);
+- reg->off = 0;
+ reg->type = SCALAR_VALUE;
+ }
+
+@@ -683,9 +684,12 @@ static void __mark_reg_unbounded(struct
+ /* Mark a register as having a completely unknown (scalar) value. */
+ static void __mark_reg_unknown(struct bpf_reg_state *reg)
+ {
++ /*
++ * Clear type, id, off, and union(map_ptr, range) and
++ * padding between 'type' and union
++ */
++ memset(reg, 0, offsetof(struct bpf_reg_state, var_off));
+ reg->type = SCALAR_VALUE;
+- reg->id = 0;
+- reg->off = 0;
+ reg->var_off = tnum_unknown;
+ reg->frameno = 0;
+ __mark_reg_unbounded(reg);
+@@ -1726,9 +1730,6 @@ static int check_mem_access(struct bpf_v
+ else
+ mark_reg_known_zero(env, regs,
+ value_regno);
+- regs[value_regno].id = 0;
+- regs[value_regno].off = 0;
+- regs[value_regno].range = 0;
+ regs[value_regno].type = reg_type;
+ }
+
+@@ -2549,7 +2550,6 @@ static int check_helper_call(struct bpf_
+ regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL;
+ /* There is no offset yet applied, variable or fixed */
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+- regs[BPF_REG_0].off = 0;
+ /* remember map_ptr, so that check_map_access()
+ * can check 'value_size' boundary of memory access
+ * to map element returned from bpf_map_lookup_elem()
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 5 Sep 2018 09:48:58 +0200
+Subject: brcmfmac: fix for proper support of 160MHz bandwidth
+
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+
+[ Upstream commit 330994e8e8ec5d0b269a5265e6032b37e29aa336 ]
+
+Decoding of firmware channel information was not complete for 160MHz
+support. This resulted in the following warning:
+
+ WARNING: CPU: 2 PID: 2222 at .../broadcom/brcm80211/brcmutil/d11.c:196
+ brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
+ Modules linked in: brcmfmac(O) brcmutil(O) sha256_generic cfg80211 ...
+ CPU: 2 PID: 2222 Comm: kworker/2:0 Tainted: G O
+ 4.17.0-wt-testing-x64-00002-gf1bed50 #1
+ Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
+ Workqueue: events request_firmware_work_func
+ RIP: 0010:brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
+ RSP: 0018:ffffc90000047bd0 EFLAGS: 00010206
+ RAX: 000000000000e832 RBX: ffff8801146fe910 RCX: ffff8801146fd3c0
+ RDX: 0000000000002800 RSI: 0000000000000070 RDI: ffffc90000047c30
+ RBP: ffffc90000047bd0 R08: 0000000000000000 R09: ffffffffa0798c80
+ R10: ffff88012bca55e0 R11: ffff880110a4ea00 R12: ffff8801146f8000
+ R13: ffffc90000047c30 R14: ffff8801146fe930 R15: ffff8801138e02e0
+ FS: 0000000000000000(0000) GS:ffff88012bc80000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f18ce8b8070 CR3: 000000000200a003 CR4: 00000000000206e0
+ Call Trace:
+ brcmf_setup_wiphybands+0x212/0x780 [brcmfmac]
+ brcmf_cfg80211_attach+0xae2/0x11a0 [brcmfmac]
+ brcmf_attach+0x1fc/0x4b0 [brcmfmac]
+ ? __kmalloc+0x13c/0x1c0
+ brcmf_pcie_setup+0x99b/0xe00 [brcmfmac]
+ brcmf_fw_request_done+0x16a/0x1f0 [brcmfmac]
+ request_firmware_work_func+0x36/0x60
+ process_one_work+0x146/0x350
+ worker_thread+0x4a/0x3b0
+ kthread+0x102/0x140
+ ? process_one_work+0x350/0x350
+ ? kthread_bind+0x20/0x20
+ ret_from_fork+0x35/0x40
+ Code: 66 90 0f b7 07 55 48 89 e5 89 c2 88 47 02 88 47 03 66 81 e2 00 38
+ 66 81 fa 00 18 74 6e 66 81 fa 00 20 74 39 66 81 fa 00 10 74 14 <0f>
+ 0b 66 25 00 c0 74 20 66 3d 00 c0 75 20 c6 47 04 01 5d c3 66
+ ---[ end trace 550c46682415b26d ]---
+ brcmfmac: brcmf_construct_chaninfo: Ignoring unexpected firmware channel 50
+
+This patch adds the missing stuff to properly handle this.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 34 ++++++++++-
+ drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h | 2
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw b
+ return BRCMU_CHSPEC_D11AC_BW_40;
+ case BRCMU_CHAN_BW_80:
+ return BRCMU_CHSPEC_D11AC_BW_80;
++ case BRCMU_CHAN_BW_160:
++ return BRCMU_CHSPEC_D11AC_BW_160;
+ default:
+ WARN_ON(1);
+ }
+@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct
+ break;
+ }
+ break;
+- case BRCMU_CHSPEC_D11AC_BW_8080:
+ case BRCMU_CHSPEC_D11AC_BW_160:
++ switch (ch->sb) {
++ case BRCMU_CHAN_SB_LLL:
++ ch->control_ch_num -= CH_70MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LLU:
++ ch->control_ch_num -= CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUL:
++ ch->control_ch_num -= CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUU:
++ ch->control_ch_num -= CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULL:
++ ch->control_ch_num += CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULU:
++ ch->control_ch_num += CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUL:
++ ch->control_ch_num += CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUU:
++ ch->control_ch_num += CH_70MHZ_APART;
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++ break;
++ case BRCMU_CHSPEC_D11AC_BW_8080:
+ default:
+ WARN_ON_ONCE(1);
+ break;
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+@@ -29,6 +29,8 @@
+ #define CH_UPPER_SB 0x01
+ #define CH_LOWER_SB 0x02
+ #define CH_EWA_VALID 0x04
++#define CH_70MHZ_APART 14
++#define CH_50MHZ_APART 10
+ #define CH_30MHZ_APART 6
+ #define CH_20MHZ_APART 4
+ #define CH_10MHZ_APART 2
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Michal Hocko <mhocko@suse.com>
+Date: Thu, 18 Oct 2018 10:56:17 +0200
+Subject: cgroup, netclassid: add a preemption point to write_classid
+
+From: Michal Hocko <mhocko@suse.com>
+
+[ Upstream commit a90e90b7d55e789c71d85b946ffb5c1ab2f137ca ]
+
+We have seen a customer complaining about soft lockups on !PREEMPT
+kernel config with 4.4 based kernel
+
+[1072141.435366] NMI watchdog: BUG: soft lockup - CPU#21 stuck for 22s! [systemd:1]
+[1072141.444090] Modules linked in: mpt3sas raid_class binfmt_misc af_packet 8021q garp mrp stp llc xfs libcrc32c bonding iscsi_ibft iscsi_boot_sysfs msr ext4 crc16 jbd2 mbcache cdc_ether usbnet mii joydev hid_generic usbhid intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ipmi_ssif mgag200 i2c_algo_bit ttm ipmi_devintf drbg ixgbe drm_kms_helper vxlan ansi_cprng ip6_udp_tunnel drm aesni_intel udp_tunnel aes_x86_64 iTCO_wdt syscopyarea ptp xhci_pci lrw iTCO_vendor_support pps_core gf128mul ehci_pci glue_helper sysfillrect mdio pcspkr sb_edac ablk_helper cryptd ehci_hcd sysimgblt xhci_hcd fb_sys_fops edac_core mei_me lpc_ich ses usbcore enclosure dca mfd_core ipmi_si mei i2c_i801 scsi_transport_sas usb_common ipmi_msghandler shpchp fjes wmi processor button acpi_pad btrfs xor raid6_pq sd_mod crc32c_intel megaraid_sas sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod md_mod autofs4
+[1072141.444146] Supported: Yes
+[1072141.444149] CPU: 21 PID: 1 Comm: systemd Not tainted 4.4.121-92.80-default #1
+[1072141.444150] Hardware name: LENOVO Lenovo System x3650 M5 -[5462P4U]- -[5462P4U]-/01GR451, BIOS -[TCE136H-2.70]- 06/13/2018
+[1072141.444151] task: ffff880191bd0040 ti: ffff880191bd4000 task.ti: ffff880191bd4000
+[1072141.444153] RIP: 0010:[<ffffffff815229f9>] [<ffffffff815229f9>] update_classid_sock+0x29/0x40
+[1072141.444157] RSP: 0018:ffff880191bd7d58 EFLAGS: 00000286
+[1072141.444158] RAX: ffff883b177cb7c0 RBX: 0000000000000000 RCX: 0000000000000000
+[1072141.444159] RDX: 00000000000009c7 RSI: ffff880191bd7d5c RDI: ffff8822e29bb200
+[1072141.444160] RBP: ffff883a72230980 R08: 0000000000000101 R09: 0000000000000000
+[1072141.444161] R10: 0000000000000008 R11: f000000000000000 R12: ffffffff815229d0
+[1072141.444162] R13: 0000000000000000 R14: ffff881fd0a47ac0 R15: ffff880191bd7f28
+[1072141.444163] FS: 00007f3e2f1eb8c0(0000) GS:ffff882000340000(0000) knlGS:0000000000000000
+[1072141.444164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[1072141.444165] CR2: 00007f3e2f200000 CR3: 0000001ffea4e000 CR4: 00000000001606f0
+[1072141.444166] Stack:
+[1072141.444166] ffffffa800000246 00000000000009c7 ffffffff8121d583 ffff8818312a05c0
+[1072141.444168] ffff8818312a1100 ffff880197c3b280 ffff881861422858 ffffffffffffffea
+[1072141.444170] ffffffff81522b1c ffffffff81d0ca20 ffff8817fa17b950 ffff883fdd8121e0
+[1072141.444171] Call Trace:
+[1072141.444179] [<ffffffff8121d583>] iterate_fd+0x53/0x80
+[1072141.444182] [<ffffffff81522b1c>] write_classid+0x4c/0x80
+[1072141.444187] [<ffffffff8111328b>] cgroup_file_write+0x9b/0x100
+[1072141.444193] [<ffffffff81278bcb>] kernfs_fop_write+0x11b/0x150
+[1072141.444198] [<ffffffff81201566>] __vfs_write+0x26/0x100
+[1072141.444201] [<ffffffff81201bed>] vfs_write+0x9d/0x190
+[1072141.444203] [<ffffffff812028c2>] SyS_write+0x42/0xa0
+[1072141.444207] [<ffffffff815f58c3>] entry_SYSCALL_64_fastpath+0x1e/0xca
+[1072141.445490] DWARF2 unwinder stuck at entry_SYSCALL_64_fastpath+0x1e/0xca
+
+If a cgroup has many tasks with many open file descriptors then we would
+end up in a large loop without any rescheduling point throught the
+operation. Add cond_resched once per task.
+
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/netclassid_cgroup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -106,6 +106,7 @@ static int write_classid(struct cgroup_s
+ iterate_fd(p->files, 0, update_classid_sock,
+ (void *)(unsigned long)cs->classid);
+ task_unlock(p);
++ cond_resched();
+ }
+ css_task_iter_end(&it);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Thu, 20 Sep 2018 13:17:46 -0600
+Subject: coresight: etb10: Fix handling of perf mode
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit 987d1e8dcd370d96029a3d76a0031b043c4a69ae ]
+
+If the ETB is already enabled in sysfs mode, the ETB reports
+success even if a perf mode is requested. Fix this by checking
+the requested mode.
+
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwtracing/coresight/coresight-etb10.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -147,6 +147,10 @@ static int etb_enable(struct coresight_d
+ if (val == CS_MODE_PERF)
+ return -EBUSY;
+
++ /* Don't let perf disturb sysFS sessions */
++ if (val == CS_MODE_SYSFS && mode == CS_MODE_PERF)
++ return -EBUSY;
++
+ /* Nothing to do, the tracer is already enabled. */
+ if (val == CS_MODE_SYSFS)
+ goto out;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Wed, 3 Oct 2018 15:35:21 +0530
+Subject: cpufreq: dt: Try freeing static OPPs only if we have added them
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 51c99dd2c06b234575661fa1e0a1dea6c3ef566f ]
+
+We can not call dev_pm_opp_of_cpumask_remove_table() freely anymore
+since the latest OPP core updates as that uses reference counting to
+free resources. There are cases where no static OPPs are added (using
+DT) for a platform and trying to remove the OPP table may end up
+decrementing refcount which is already zero and hence generating
+warnings.
+
+Lets track if we were able to add static OPPs or not and then only
+remove the table based on that. Some reshuffling of code is also done to
+do that.
+
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Tested-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/cpufreq-dt.c | 34 +++++++++++++++++++---------------
+ 1 file changed, 19 insertions(+), 15 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq-dt.c
++++ b/drivers/cpufreq/cpufreq-dt.c
+@@ -32,6 +32,7 @@ struct private_data {
+ struct device *cpu_dev;
+ struct thermal_cooling_device *cdev;
+ const char *reg_name;
++ bool have_static_opps;
+ };
+
+ static struct freq_attr *cpufreq_dt_attr[] = {
+@@ -204,6 +205,15 @@ static int cpufreq_init(struct cpufreq_p
+ }
+ }
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv) {
++ ret = -ENOMEM;
++ goto out_put_regulator;
++ }
++
++ priv->reg_name = name;
++ priv->opp_table = opp_table;
++
+ /*
+ * Initialize OPP tables for all policy->cpus. They will be shared by
+ * all CPUs which have marked their CPUs shared with OPP bindings.
+@@ -214,7 +224,8 @@ static int cpufreq_init(struct cpufreq_p
+ *
+ * OPPs might be populated at runtime, don't check for error here
+ */
+- dev_pm_opp_of_cpumask_add_table(policy->cpus);
++ if (!dev_pm_opp_of_cpumask_add_table(policy->cpus))
++ priv->have_static_opps = true;
+
+ /*
+ * But we need OPP table to function so if it is not there let's
+@@ -240,19 +251,10 @@ static int cpufreq_init(struct cpufreq_p
+ __func__, ret);
+ }
+
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv) {
+- ret = -ENOMEM;
+- goto out_free_opp;
+- }
+-
+- priv->reg_name = name;
+- priv->opp_table = opp_table;
+-
+ ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+ if (ret) {
+ dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
+- goto out_free_priv;
++ goto out_free_opp;
+ }
+
+ priv->cpu_dev = cpu_dev;
+@@ -282,10 +284,11 @@ static int cpufreq_init(struct cpufreq_p
+
+ out_free_cpufreq_table:
+ dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+-out_free_priv:
+- kfree(priv);
+ out_free_opp:
+- dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ kfree(priv);
++out_put_regulator:
+ if (name)
+ dev_pm_opp_put_regulators(opp_table);
+ out_put_clk:
+@@ -300,7 +303,8 @@ static int cpufreq_exit(struct cpufreq_p
+
+ cpufreq_cooling_unregister(priv->cdev);
+ dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
+- dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
+ if (priv->reg_name)
+ dev_pm_opp_put_regulators(priv->opp_table);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Mon, 8 Oct 2018 11:06:18 -0400
+Subject: cpupower: Fix AMD Family 0x17 msr_pstate size
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit 8c22e2f695920ebd94f9a53bcf2a65eb36d4dba1 ]
+
+The msr_pstate data is only 63 bits long and should be 64 bits.
+
+Add in the missing bit from res1 for AMD Family 0x17.
+
+Reference: https://www.amd.com/system/files/TechDocs/54945_PPR_Family_17h_Models_00h-0Fh.pdf, page 138.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/power/cpupower/utils/helpers/amd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/power/cpupower/utils/helpers/amd.c
++++ b/tools/power/cpupower/utils/helpers/amd.c
+@@ -33,7 +33,7 @@ union msr_pstate {
+ unsigned vid:8;
+ unsigned iddval:8;
+ unsigned idddiv:2;
+- unsigned res1:30;
++ unsigned res1:31;
+ unsigned en:1;
+ } fam17h_bits;
+ unsigned long long val;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Mon, 8 Oct 2018 11:06:19 -0400
+Subject: cpupower: Fix coredump on VMWare
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit f69ffc5d3db8f1f03fd6d1df5930f9a1fbd787b6 ]
+
+cpupower crashes on VMWare guests. The guests have the AMD PStateDef MSR
+(0xC0010064 + state number) set to zero. As a result fid and did are zero
+and the crash occurs because of a divide by zero (cof = fid/did). This
+can be prevented by checking the enable bit in the PStateDef MSR before
+calculating cof. By doing this the value of pstate[i] remains zero and
+the value can be tested before displaying the active Pstates.
+
+Check the enable bit in the PstateDef register for all supported families
+and only print out enabled Pstates.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/power/cpupower/utils/cpufreq-info.c | 2 ++
+ tools/power/cpupower/utils/helpers/amd.c | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -200,6 +200,8 @@ static int get_boost_mode(unsigned int c
+ printf(_(" Boost States: %d\n"), b_states);
+ printf(_(" Total States: %d\n"), pstate_no);
+ for (i = 0; i < pstate_no; i++) {
++ if (!pstates[i])
++ continue;
+ if (i < b_states)
+ printf(_(" Pstate-Pb%d: %luMHz (boost state)"
+ "\n"), i, pstates[i]);
+--- a/tools/power/cpupower/utils/helpers/amd.c
++++ b/tools/power/cpupower/utils/helpers/amd.c
+@@ -119,6 +119,11 @@ int decode_pstates(unsigned int cpu, uns
+ }
+ if (read_msr(cpu, MSR_AMD_PSTATE + i, &pstate.val))
+ return -1;
++ if ((cpu_family == 0x17) && (!pstate.fam17h_bits.en))
++ continue;
++ else if (!pstate.bits.en)
++ continue;
++
+ pstates[i] = get_cof(cpu_family, pstate);
+ }
+ *no = i;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Horia Geantă" <horia.geanta@nxp.com>
+Date: Wed, 12 Sep 2018 11:59:30 +0300
+Subject: crypto: caam - fix implicit casts in endianness helpers
+
+From: "Horia Geantă" <horia.geanta@nxp.com>
+
+[ Upstream commit aae733a3f46f5ef338fbdde26e14cbb205a23de0 ]
+
+Fix the following sparse endianness warnings:
+
+drivers/crypto/caam/regs.h:95:1: sparse: incorrect type in return expression (different base types) @@ expected unsigned int @@ got restricted __le32unsigned int @@
+drivers/crypto/caam/regs.h:95:1: expected unsigned int
+drivers/crypto/caam/regs.h:95:1: got restricted __le32 [usertype] <noident>
+drivers/crypto/caam/regs.h:95:1: sparse: incorrect type in return expression (different base types) @@ expected unsigned int @@ got restricted __be32unsigned int @@
+drivers/crypto/caam/regs.h:95:1: expected unsigned int
+drivers/crypto/caam/regs.h:95:1: got restricted __be32 [usertype] <noident>
+
+drivers/crypto/caam/regs.h:92:1: sparse: cast to restricted __le32
+drivers/crypto/caam/regs.h:92:1: sparse: cast to restricted __be32
+
+Fixes: 261ea058f016 ("crypto: caam - handle core endianness != caam endianness")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/caam/regs.h | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/crypto/caam/regs.h
++++ b/drivers/crypto/caam/regs.h
+@@ -70,22 +70,22 @@
+ extern bool caam_little_end;
+ extern bool caam_imx;
+
+-#define caam_to_cpu(len) \
+-static inline u##len caam##len ## _to_cpu(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return le##len ## _to_cpu(val); \
+- else \
+- return be##len ## _to_cpu(val); \
++#define caam_to_cpu(len) \
++static inline u##len caam##len ## _to_cpu(u##len val) \
++{ \
++ if (caam_little_end) \
++ return le##len ## _to_cpu((__force __le##len)val); \
++ else \
++ return be##len ## _to_cpu((__force __be##len)val); \
+ }
+
+-#define cpu_to_caam(len) \
+-static inline u##len cpu_to_caam##len(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return cpu_to_le##len(val); \
+- else \
+- return cpu_to_be##len(val); \
++#define cpu_to_caam(len) \
++static inline u##len cpu_to_caam##len(u##len val) \
++{ \
++ if (caam_little_end) \
++ return (__force u##len)cpu_to_le##len(val); \
++ else \
++ return (__force u##len)cpu_to_be##len(val); \
+ }
+
+ caam_to_cpu(16)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Wed, 29 Aug 2018 23:32:44 +0200
+Subject: dmaengine: dma-jz4780: Return error if not probed from DT
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 54f919a04cf221bc1601d1193682d4379dacacbd ]
+
+The driver calls clk_get() with the clock name set to NULL, which means
+that the driver could only work when probed from devicetree. From now
+on, we explicitly require the driver to be probed from devicetree.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dma-jz4780.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -761,6 +761,11 @@ static int jz4780_dma_probe(struct platf
+ struct resource *res;
+ int i, ret;
+
++ if (!dev->of_node) {
++ dev_err(dev, "This driver must be probed from devicetree\n");
++ return -EINVAL;
++ }
++
+ jzdma = devm_kzalloc(dev, sizeof(*jzdma), GFP_KERNEL);
+ if (!jzdma)
+ return -ENOMEM;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Waiman Long <longman@redhat.com>
+Date: Fri, 14 Sep 2018 14:53:32 -0400
+Subject: driver/dma/ioat: Call del_timer_sync() without holding prep_lock
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit cfb03be6c7e8a1591285849c361d67b09f5149f7 ]
+
+The following lockdep splat was observed:
+
+[ 1222.241750] ======================================================
+[ 1222.271301] WARNING: possible circular locking dependency detected
+[ 1222.301060] 4.16.0-10.el8+5.x86_64+debug #1 Not tainted
+[ 1222.326659] ------------------------------------------------------
+[ 1222.356565] systemd-shutdow/1 is trying to acquire lock:
+[ 1222.382660] ((&ioat_chan->timer)){+.-.}, at: [<00000000f71e1a28>] del_timer_sync+0x5/0xf0
+[ 1222.422928]
+[ 1222.422928] but task is already holding lock:
+[ 1222.451743] (&(&ioat_chan->prep_lock)->rlock){+.-.}, at: [<000000008ea98b12>] ioat_shutdown+0x86/0x100 [ioatdma]
+ :
+[ 1223.524987] Chain exists of:
+[ 1223.524987] (&ioat_chan->timer) --> &(&ioat_chan->cleanup_lock)->rlock --> &(&ioat_chan->prep_lock)->rlock
+[ 1223.524987]
+[ 1223.594082] Possible unsafe locking scenario:
+[ 1223.594082]
+[ 1223.622630] CPU0 CPU1
+[ 1223.645080] ---- ----
+[ 1223.667404] lock(&(&ioat_chan->prep_lock)->rlock);
+[ 1223.691535] lock(&(&ioat_chan->cleanup_lock)->rlock);
+[ 1223.728657] lock(&(&ioat_chan->prep_lock)->rlock);
+[ 1223.765122] lock((&ioat_chan->timer));
+[ 1223.784095]
+[ 1223.784095] *** DEADLOCK ***
+[ 1223.784095]
+[ 1223.813492] 4 locks held by systemd-shutdow/1:
+[ 1223.834677] #0: (reboot_mutex){+.+.}, at: [<0000000056d33456>] SYSC_reboot+0x10f/0x300
+[ 1223.873310] #1: (&dev->mutex){....}, at: [<00000000258dfdd7>] device_shutdown+0x1c8/0x660
+[ 1223.913604] #2: (&dev->mutex){....}, at: [<0000000068331147>] device_shutdown+0x1d6/0x660
+[ 1223.954000] #3: (&(&ioat_chan->prep_lock)->rlock){+.-.}, at: [<000000008ea98b12>] ioat_shutdown+0x86/0x100 [ioatdma]
+
+In the ioat_shutdown() function:
+
+ spin_lock_bh(&ioat_chan->prep_lock);
+ set_bit(IOAT_CHAN_DOWN, &ioat_chan->state);
+ del_timer_sync(&ioat_chan->timer);
+ spin_unlock_bh(&ioat_chan->prep_lock);
+
+According to the synchronization rule for the del_timer_sync() function,
+the caller must not hold locks which would prevent completion of the
+timer's handler.
+
+The timer structure has its own lock that manages its synchronization.
+Setting the IOAT_CHAN_DOWN bit should prevent other CPUs from
+trying to use that device anyway, there is probably no need to call
+del_timer_sync() while holding the prep_lock. So the del_timer_sync()
+call is now moved outside of the prep_lock critical section to prevent
+the circular lock dependency.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/ioat/init.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -1205,8 +1205,15 @@ static void ioat_shutdown(struct pci_dev
+
+ spin_lock_bh(&ioat_chan->prep_lock);
+ set_bit(IOAT_CHAN_DOWN, &ioat_chan->state);
+- del_timer_sync(&ioat_chan->timer);
+ spin_unlock_bh(&ioat_chan->prep_lock);
++ /*
++ * Synchronization rule for del_timer_sync():
++ * - The caller must not hold locks which would prevent
++ * completion of the timer's handler.
++ * So prep_lock cannot be held before calling it.
++ */
++ del_timer_sync(&ioat_chan->timer);
++
+ /* this should quiesce then reset */
+ ioat_reset_hw(ioat_chan);
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Dexuan Cui <decui@microsoft.com>
+Date: Sun, 23 Sep 2018 21:10:44 +0000
+Subject: Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 25355252607ca288f329ee033f387764883393f6 ]
+
+A cpumask structure on the stack can cause a warning with
+CONFIG_NR_CPUS=8192 (e.g. Ubuntu 16.04 and 18.04 use this):
+
+drivers/hv//channel_mgmt.c: In function ‘init_vp_index’:
+drivers/hv//channel_mgmt.c:702:1: warning: the frame size of 1032 bytes
+ is larger than 1024 bytes [-Wframe-larger-than=]
+
+Nowadays it looks most distros enable CONFIG_CPUMASK_OFFSTACK=y, and
+hence we can work around the warning by using cpumask_var_t.
+
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hv/channel_mgmt.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,16 +606,18 @@ static void init_vp_index(struct vmbus_c
+ bool perf_chn = vmbus_devs[dev_type].perf_device;
+ struct vmbus_channel *primary = channel->primary_channel;
+ int next_node;
+- struct cpumask available_mask;
++ cpumask_var_t available_mask;
+ struct cpumask *alloced_mask;
+
+ if ((vmbus_proto_version == VERSION_WS2008) ||
+- (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) {
++ (vmbus_proto_version == VERSION_WIN7) || (!perf_chn) ||
++ !alloc_cpumask_var(&available_mask, GFP_KERNEL)) {
+ /*
+ * Prior to win8, all channel interrupts are
+ * delivered on cpu 0.
+ * Also if the channel is not a performance critical
+ * channel, bind it to cpu 0.
++ * In case alloc_cpumask_var() fails, bind it to cpu 0.
+ */
+ channel->numa_node = 0;
+ channel->target_cpu = 0;
+@@ -653,7 +655,7 @@ static void init_vp_index(struct vmbus_c
+ cpumask_clear(alloced_mask);
+ }
+
+- cpumask_xor(&available_mask, alloced_mask,
++ cpumask_xor(available_mask, alloced_mask,
+ cpumask_of_node(primary->numa_node));
+
+ cur_cpu = -1;
+@@ -671,10 +673,10 @@ static void init_vp_index(struct vmbus_c
+ }
+
+ while (true) {
+- cur_cpu = cpumask_next(cur_cpu, &available_mask);
++ cur_cpu = cpumask_next(cur_cpu, available_mask);
+ if (cur_cpu >= nr_cpu_ids) {
+ cur_cpu = -1;
+- cpumask_copy(&available_mask,
++ cpumask_copy(available_mask,
+ cpumask_of_node(primary->numa_node));
+ continue;
+ }
+@@ -704,6 +706,8 @@ static void init_vp_index(struct vmbus_c
+
+ channel->target_cpu = cur_cpu;
+ channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
++
++ free_cpumask_var(available_mask);
+ }
+
+ static void vmbus_wait_for_unload(void)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Mon, 17 Sep 2018 14:00:54 +0300
+Subject: drm: fix use of freed memory in drm_mode_setcrtc
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+[ Upstream commit 064253c1c0625efd0362a0b7ecdbe8bee2a2904d ]
+
+drm_mode_setcrtc() retries modesetting in case one of the functions it
+calls returns -EDEADLK. connector_set, mode and fb are freed before
+retrying, but they are not set to NULL. This can cause
+drm_mode_setcrtc() to use those variables.
+
+For example: On the first try __drm_mode_set_config_internal() returns
+-EDEADLK. connector_set, mode and fb are freed. Next retry starts, and
+drm_modeset_lock_all_ctx() returns -EDEADLK, and we jump to 'out'. The
+code will happily try to release all three again.
+
+This leads to crashes of different kinds, depending on the sequence the
+EDEADLKs happen.
+
+Fix this by setting the three variables to NULL at the start of the
+retry loop.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180917110054.4053-1-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_crtc.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -560,9 +560,9 @@ int drm_mode_setcrtc(struct drm_device *
+ struct drm_mode_crtc *crtc_req = data;
+ struct drm_crtc *crtc;
+ struct drm_plane *plane;
+- struct drm_connector **connector_set = NULL, *connector;
+- struct drm_framebuffer *fb = NULL;
+- struct drm_display_mode *mode = NULL;
++ struct drm_connector **connector_set, *connector;
++ struct drm_framebuffer *fb;
++ struct drm_display_mode *mode;
+ struct drm_mode_set set;
+ uint32_t __user *set_connectors_ptr;
+ struct drm_modeset_acquire_ctx ctx;
+@@ -591,6 +591,10 @@ int drm_mode_setcrtc(struct drm_device *
+ mutex_lock(&crtc->dev->mode_config.mutex);
+ drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
+ retry:
++ connector_set = NULL;
++ fb = NULL;
++ mode = NULL;
++
+ ret = drm_modeset_lock_all_ctx(crtc->dev, &ctx);
+ if (ret)
+ goto out;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Leo Li <sunpeng.li@amd.com>
+Date: Mon, 15 Oct 2018 09:46:40 -0400
+Subject: drm: Get ref on CRTC commit object when waiting for flip_done
+
+From: Leo Li <sunpeng.li@amd.com>
+
+[ Upstream commit 4364bcb2cd21d042bde4776448417ddffbc54045 ]
+
+This fixes a general protection fault, caused by accessing the contents
+of a flip_done completion object that has already been freed. It occurs
+due to the preemption of a non-blocking commit worker thread W by
+another commit thread X. X continues to clear its atomic state at the
+end, destroying the CRTC commit object that W still needs. Switching
+back to W and accessing the commit objects then leads to bad results.
+
+Worker W becomes preemptable when waiting for flip_done to complete. At
+this point, a frequently occurring commit thread X can take over. Here's
+an example where W is a worker thread that flips on both CRTCs, and X
+does a legacy cursor update on both CRTCs:
+
+ ...
+ 1. W does flip work
+ 2. W runs commit_hw_done()
+ 3. W waits for flip_done on CRTC 1
+ 4. > flip_done for CRTC 1 completes
+ 5. W finishes waiting for CRTC 1
+ 6. W waits for flip_done on CRTC 2
+
+ 7. > Preempted by X
+ 8. > flip_done for CRTC 2 completes
+ 9. X atomic_check: hw_done and flip_done are complete on all CRTCs
+ 10. X updates cursor on both CRTCs
+ 11. X destroys atomic state
+ 12. X done
+
+ 13. > Switch back to W
+ 14. W waits for flip_done on CRTC 2
+ 15. W raises general protection fault
+
+The error looks like so:
+
+ general protection fault: 0000 [#1] PREEMPT SMP PTI
+ **snip**
+ Call Trace:
+ lock_acquire+0xa2/0x1b0
+ _raw_spin_lock_irq+0x39/0x70
+ wait_for_completion_timeout+0x31/0x130
+ drm_atomic_helper_wait_for_flip_done+0x64/0x90 [drm_kms_helper]
+ amdgpu_dm_atomic_commit_tail+0xcae/0xdd0 [amdgpu]
+ commit_tail+0x3d/0x70 [drm_kms_helper]
+ process_one_work+0x212/0x650
+ worker_thread+0x49/0x420
+ kthread+0xfb/0x130
+ ret_from_fork+0x3a/0x50
+ Modules linked in: x86_pkg_temp_thermal amdgpu(O) chash(O)
+ gpu_sched(O) drm_kms_helper(O) syscopyarea sysfillrect sysimgblt
+ fb_sys_fops ttm(O) drm(O)
+
+Note that i915 has this issue masked, since hw_done is signaled after
+waiting for flip_done. Doing so will block the cursor update from
+happening until hw_done is signaled, preventing the cursor commit from
+destroying the state.
+
+v2: The reference on the commit object needs to be obtained before
+ hw_done() is signaled, since that's the point where another commit
+ is allowed to modify the state. Assuming that the
+ new_crtc_state->commit object still exists within flip_done() is
+ incorrect.
+
+ Fix by getting a reference in setup_commit(), and releasing it
+ during default_clear().
+
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1539611200-6184-1-git-send-email-sunpeng.li@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic.c | 5 +++++
+ drivers/gpu/drm/drm_atomic_helper.c | 12 ++++++++----
+ include/drm/drm_atomic.h | 11 +++++++++++
+ 3 files changed, 24 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -173,6 +173,11 @@ void drm_atomic_state_default_clear(stru
+ state->crtcs[i].state = NULL;
+ state->crtcs[i].old_state = NULL;
+ state->crtcs[i].new_state = NULL;
++
++ if (state->crtcs[i].commit) {
++ drm_crtc_commit_put(state->crtcs[i].commit);
++ state->crtcs[i].commit = NULL;
++ }
+ }
+
+ for (i = 0; i < config->num_total_plane; i++) {
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1384,15 +1384,16 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for
+ void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev,
+ struct drm_atomic_state *old_state)
+ {
+- struct drm_crtc_state *new_crtc_state;
+ struct drm_crtc *crtc;
+ int i;
+
+- for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) {
+- struct drm_crtc_commit *commit = new_crtc_state->commit;
++ for (i = 0; i < dev->mode_config.num_crtc; i++) {
++ struct drm_crtc_commit *commit = old_state->crtcs[i].commit;
+ int ret;
+
+- if (!commit)
++ crtc = old_state->crtcs[i].ptr;
++
++ if (!crtc || !commit)
+ continue;
+
+ ret = wait_for_completion_timeout(&commit->flip_done, 10 * HZ);
+@@ -1906,6 +1907,9 @@ int drm_atomic_helper_setup_commit(struc
+ drm_crtc_commit_get(commit);
+
+ commit->abort_completion = true;
++
++ state->crtcs[i].commit = commit;
++ drm_crtc_commit_get(commit);
+ }
+
+ for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {
+--- a/include/drm/drm_atomic.h
++++ b/include/drm/drm_atomic.h
+@@ -153,6 +153,17 @@ struct __drm_planes_state {
+ struct __drm_crtcs_state {
+ struct drm_crtc *ptr;
+ struct drm_crtc_state *state, *old_state, *new_state;
++
++ /**
++ * @commit:
++ *
++ * A reference to the CRTC commit object that is kept for use by
++ * drm_atomic_helper_wait_for_flip_done() after
++ * drm_atomic_helper_commit_hw_done() is called. This ensures that a
++ * concurrent commit won't free a commit object that is still in use.
++ */
++ struct drm_crtc_commit *commit;
++
+ s32 __user *out_fence_ptr;
+ u64 last_vblank_count;
+ };
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Tue, 2 Oct 2018 01:34:44 -0400
+Subject: ext4: fix argument checking in EXT4_IOC_MOVE_EXT
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit f18b2b83a727a3db208308057d2c7945f368e625 ]
+
+If the starting block number of either the source or destination file
+exceeds the EOF, EXT4_IOC_MOVE_EXT should return EINVAL.
+
+Also fixed the helper function mext_check_coverage() so that if the
+logical block is beyond EOF, make it return immediately, instead of
+looping until the block number wraps all the away around. This takes
+long enough that if there are multiple threads trying to do pound on
+an the same inode doing non-sensical things, it can end up triggering
+the kernel's soft lockup detector.
+
+Reported-by: syzbot+c61979f6f2cba5cb3c06@syzkaller.appspotmail.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/move_extent.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -518,9 +518,13 @@ mext_check_arguments(struct inode *orig_
+ orig_inode->i_ino, donor_inode->i_ino);
+ return -EINVAL;
+ }
+- if (orig_eof < orig_start + *len - 1)
++ if (orig_eof <= orig_start)
++ *len = 0;
++ else if (orig_eof < orig_start + *len - 1)
+ *len = orig_eof - orig_start;
+- if (donor_eof < donor_start + *len - 1)
++ if (donor_eof <= donor_start)
++ *len = 0;
++ else if (donor_eof < donor_start + *len - 1)
+ *len = donor_eof - donor_start;
+ if (!*len) {
+ ext4_debug("ext4 move extent: len should not be 0 "
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Zhikang Zhang <zhangzhikang1@huawei.com>
+Date: Mon, 10 Sep 2018 16:18:25 +0800
+Subject: f2fs: avoid sleeping under spin_lock
+
+From: Zhikang Zhang <zhangzhikang1@huawei.com>
+
+[ Upstream commit b430f7263673eab1dc40e662ae3441a9619d16b8 ]
+
+In the call trace below, we might sleep in function dput().
+
+So in order to avoid sleeping under spin_lock, we remove f2fs_mark_inode_dirty_sync
+from __try_update_largest_extent && __drop_largest_extent.
+
+BUG: sleeping function called from invalid context at fs/dcache.c:796
+Call trace:
+ dump_backtrace+0x0/0x3f4
+ show_stack+0x24/0x30
+ dump_stack+0xe0/0x138
+ ___might_sleep+0x2a8/0x2c8
+ __might_sleep+0x78/0x10c
+ dput+0x7c/0x750
+ block_dump___mark_inode_dirty+0x120/0x17c
+ __mark_inode_dirty+0x344/0x11f0
+ f2fs_mark_inode_dirty_sync+0x40/0x50
+ __insert_extent_tree+0x2e0/0x2f4
+ f2fs_update_extent_tree_range+0xcf4/0xde8
+ f2fs_update_extent_cache+0x114/0x12c
+ f2fs_update_data_blkaddr+0x40/0x50
+ write_data_page+0x150/0x314
+ do_write_data_page+0x648/0x2318
+ __write_data_page+0xdb4/0x1640
+ f2fs_write_cache_pages+0x768/0xafc
+ __f2fs_write_data_pages+0x590/0x1218
+ f2fs_write_data_pages+0x64/0x74
+ do_writepages+0x74/0xe4
+ __writeback_single_inode+0xdc/0x15f0
+ writeback_sb_inodes+0x574/0xc98
+ __writeback_inodes_wb+0x190/0x204
+ wb_writeback+0x730/0xf14
+ wb_check_old_data_flush+0x1bc/0x1c8
+ wb_workfn+0x554/0xf74
+ process_one_work+0x440/0x118c
+ worker_thread+0xac/0x974
+ kthread+0x1a0/0x1c8
+ ret_from_fork+0x10/0x1c
+
+Signed-off-by: Zhikang Zhang <zhangzhikang1@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/extent_cache.c | 51 ++++++++++++++++++++++++++++++-------------------
+ fs/f2fs/f2fs.h | 7 +++---
+ 2 files changed, 36 insertions(+), 22 deletions(-)
+
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -308,14 +308,13 @@ static unsigned int __free_extent_tree(s
+ return count - atomic_read(&et->node_cnt);
+ }
+
+-static void __drop_largest_extent(struct inode *inode,
++static void __drop_largest_extent(struct extent_tree *et,
+ pgoff_t fofs, unsigned int len)
+ {
+- struct extent_info *largest = &F2FS_I(inode)->extent_tree->largest;
+-
+- if (fofs < largest->fofs + largest->len && fofs + len > largest->fofs) {
+- largest->len = 0;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ if (fofs < et->largest.fofs + et->largest.len &&
++ fofs + len > et->largest.fofs) {
++ et->largest.len = 0;
++ et->largest_updated = true;
+ }
+ }
+
+@@ -416,12 +415,11 @@ out:
+ return ret;
+ }
+
+-static struct extent_node *__try_merge_extent_node(struct inode *inode,
++static struct extent_node *__try_merge_extent_node(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct extent_node *prev_ex,
+ struct extent_node *next_ex)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_node *en = NULL;
+
+ if (prev_ex && __is_back_mergeable(ei, &prev_ex->ei)) {
+@@ -443,7 +441,7 @@ static struct extent_node *__try_merge_e
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ spin_lock(&sbi->extent_lock);
+ if (!list_empty(&en->list)) {
+@@ -454,12 +452,11 @@ static struct extent_node *__try_merge_e
+ return en;
+ }
+
+-static struct extent_node *__insert_extent_tree(struct inode *inode,
++static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct rb_node **insert_p,
+ struct rb_node *insert_parent)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct rb_node **p;
+ struct rb_node *parent = NULL;
+ struct extent_node *en = NULL;
+@@ -476,7 +473,7 @@ do_insert:
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ /* update in global extent list */
+ spin_lock(&sbi->extent_lock);
+@@ -497,6 +494,7 @@ static void f2fs_update_extent_tree_rang
+ struct rb_node **insert_p = NULL, *insert_parent = NULL;
+ unsigned int end = fofs + len;
+ unsigned int pos = (unsigned int)fofs;
++ bool updated = false;
+
+ if (!et)
+ return;
+@@ -517,7 +515,7 @@ static void f2fs_update_extent_tree_rang
+ * drop largest extent before lookup, in case it's already
+ * been shrunk from extent tree
+ */
+- __drop_largest_extent(inode, fofs, len);
++ __drop_largest_extent(et, fofs, len);
+
+ /* 1. lookup first extent node in range [fofs, fofs + len - 1] */
+ en = (struct extent_node *)f2fs_lookup_rb_tree_ret(&et->root,
+@@ -550,7 +548,7 @@ static void f2fs_update_extent_tree_rang
+ set_extent_info(&ei, end,
+ end - dei.fofs + dei.blk,
+ org_end - end);
+- en1 = __insert_extent_tree(inode, et, &ei,
++ en1 = __insert_extent_tree(sbi, et, &ei,
+ NULL, NULL);
+ next_en = en1;
+ } else {
+@@ -570,7 +568,7 @@ static void f2fs_update_extent_tree_rang
+ }
+
+ if (parts)
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+ else
+ __release_extent_node(sbi, et, en);
+
+@@ -590,15 +588,16 @@ static void f2fs_update_extent_tree_rang
+ if (blkaddr) {
+
+ set_extent_info(&ei, fofs, blkaddr, len);
+- if (!__try_merge_extent_node(inode, et, &ei, prev_en, next_en))
+- __insert_extent_tree(inode, et, &ei,
++ if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en))
++ __insert_extent_tree(sbi, et, &ei,
+ insert_p, insert_parent);
+
+ /* give up extent_cache, if split and small updates happen */
+ if (dei.len >= 1 &&
+ prev.len < F2FS_MIN_EXTENT_LEN &&
+ et->largest.len < F2FS_MIN_EXTENT_LEN) {
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ et->largest.len = 0;
++ et->largest_updated = true;
+ set_inode_flag(inode, FI_NO_EXTENT);
+ }
+ }
+@@ -606,7 +605,15 @@ static void f2fs_update_extent_tree_rang
+ if (is_inode_flag_set(inode, FI_NO_EXTENT))
+ __free_extent_tree(sbi, et);
+
++ if (et->largest_updated) {
++ et->largest_updated = false;
++ updated = true;
++ }
++
+ write_unlock(&et->lock);
++
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ unsigned int f2fs_shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink)
+@@ -705,6 +712,7 @@ void f2fs_drop_extent_tree(struct inode
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_tree *et = F2FS_I(inode)->extent_tree;
++ bool updated = false;
+
+ if (!f2fs_may_extent_tree(inode))
+ return;
+@@ -713,8 +721,13 @@ void f2fs_drop_extent_tree(struct inode
+
+ write_lock(&et->lock);
+ __free_extent_tree(sbi, et);
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ if (et->largest.len) {
++ et->largest.len = 0;
++ updated = true;
++ }
+ write_unlock(&et->lock);
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ void f2fs_destroy_extent_tree(struct inode *inode)
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -556,6 +556,7 @@ struct extent_tree {
+ struct list_head list; /* to be used by sbi->zombie_list */
+ rwlock_t lock; /* protect extent info rb-tree */
+ atomic_t node_cnt; /* # of extent node in rb-tree*/
++ bool largest_updated; /* largest extent updated */
+ };
+
+ /*
+@@ -736,12 +737,12 @@ static inline bool __is_front_mergeable(
+ }
+
+ extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
+-static inline void __try_update_largest_extent(struct inode *inode,
+- struct extent_tree *et, struct extent_node *en)
++static inline void __try_update_largest_extent(struct extent_tree *et,
++ struct extent_node *en)
+ {
+ if (en->ei.len > et->largest.len) {
+ et->largest = en->ei;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ et->largest_updated = true;
+ }
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Tue, 25 Sep 2018 13:54:33 -0700
+Subject: f2fs: clear PageError on the read path
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit fb7d70db305a1446864227abf711b756568f8242 ]
+
+When running fault injection test, I hit somewhat wrong behavior in f2fs_gc ->
+gc_data_segment():
+
+0. fault injection generated some PageError'ed pages
+
+1. gc_data_segment
+ -> f2fs_get_read_data_page(REQ_RAHEAD)
+
+2. move_data_page
+ -> f2fs_get_lock_data_page()
+ -> f2f_get_read_data_page()
+ -> f2fs_submit_page_read()
+ -> submit_bio(READ)
+ -> return EIO due to PageError
+ -> fail to move data
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -80,7 +80,8 @@ static void __read_end_io(struct bio *bi
+ /* PG_error was set if any post_read step failed */
+ if (bio->bi_status || PageError(page)) {
+ ClearPageUptodate(page);
+- SetPageError(page);
++ /* will re-read again later */
++ ClearPageError(page);
+ } else {
+ SetPageUptodate(page);
+ }
+@@ -584,6 +585,7 @@ static int f2fs_submit_page_read(struct
+ bio_put(bio);
+ return -EFAULT;
+ }
++ ClearPageError(page);
+ __submit_bio(F2FS_I_SB(inode), bio, DATA);
+ return 0;
+ }
+@@ -1528,6 +1530,7 @@ submit_and_realloc:
+ if (bio_add_page(bio, page, blocksize, 0) < blocksize)
+ goto submit_and_realloc;
+
++ ClearPageError(page);
+ last_block_in_bio = block_nr;
+ goto next_page;
+ set_error_page:
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Mon, 22 Oct 2018 23:24:28 +0800
+Subject: f2fs: fix to account IO correctly for cgroup writeback
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 78efac537de33faab9a4302cc05a70bb4a8b3b63 ]
+
+Now, we have supported cgroup writeback, it depends on correctly IO
+account of specified filesystem.
+
+But in commit d1b3e72d5490 ("f2fs: submit bio of in-place-update pages"),
+we split write paths from f2fs_submit_page_mbio() to two:
+- f2fs_submit_page_bio() for IPU path
+- f2fs_submit_page_bio() for OPU path
+
+But still we account write IO only in f2fs_submit_page_mbio(), result in
+incorrect IO account, fix it by adding missing IO account in IPU path.
+
+Fixes: d1b3e72d5490 ("f2fs: submit bio of in-place-update pages")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/data.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -453,6 +453,10 @@ int f2fs_submit_page_bio(struct f2fs_io_
+ bio_put(bio);
+ return -EFAULT;
+ }
++
++ if (fio->io_wbc && !is_read_io(fio->op))
++ wbc_account_io(fio->io_wbc, page, PAGE_SIZE);
++
+ bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+ __submit_bio(fio->sbi, bio, fio->type);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Tue, 25 Sep 2018 15:36:01 +0800
+Subject: f2fs: fix to recover inode's crtime during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 5cd1f387a13b5188b4edb4c834310302a85a6ea2 ]
+
+Testcase to reproduce this bug:
+1. mkfs.f2fs -O extra_attr -O inode_crtime /dev/sdd
+2. mount -t f2fs /dev/sdd /mnt/f2fs
+3. touch /mnt/f2fs/file
+4. xfs_io -f /mnt/f2fs/file -c "fsync"
+5. godown /mnt/f2fs
+6. umount /mnt/f2fs
+7. mount -t f2fs /dev/sdd /mnt/f2fs
+8. xfs_io -f /mnt/f2fs/file -c "statx -r"
+
+stat.btime.tv_sec = 0
+stat.btime.tv_nsec = 0
+
+This patch fixes to recover inode creation time fields during
+mount.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/node.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2379,6 +2379,13 @@ retry:
+ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
+ i_projid))
+ dst->i_projid = src->i_projid;
++
++ if (f2fs_sb_has_inode_crtime(sbi->sb) &&
++ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
++ i_crtime_nsec)) {
++ dst->i_crtime = src->i_crtime;
++ dst->i_crtime_nsec = src->i_crtime_nsec;
++ }
+ }
+
+ new_ni = old_ni;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Chao Yu <yuchao0@huawei.com>
+Date: Tue, 25 Sep 2018 15:35:59 +0800
+Subject: f2fs: fix to recover inode's i_flags during POR
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 19c73a691ccf6fb2f12d4e9cf9830023966cec88 ]
+
+Testcase to reproduce this bug:
+1. mkfs.f2fs /dev/sdd
+2. mount -t f2fs /dev/sdd /mnt/f2fs
+3. touch /mnt/f2fs/file
+4. sync
+5. chattr +A /mnt/f2fs/file
+6. xfs_io -f /mnt/f2fs/file -c "fsync"
+7. godown /mnt/f2fs
+8. umount /mnt/f2fs
+9. mount -t f2fs /dev/sdd /mnt/f2fs
+10. lsattr /mnt/f2fs/file
+
+-----------------N- /mnt/f2fs/file
+
+But actually, we expect the corrct result is:
+
+-------A---------N- /mnt/f2fs/file
+
+The reason is we didn't recover inode.i_flags field during mount,
+fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/recovery.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -221,6 +221,7 @@ static void recover_inode(struct inode *
+ inode->i_mtime.tv_nsec = le32_to_cpu(raw->i_mtime_nsec);
+
+ F2FS_I(inode)->i_advise = raw->i_advise;
++ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags);
+
+ recover_inline_flags(inode, raw);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Yunlei He <heyunlei@huawei.com>
+Date: Tue, 26 Jun 2018 13:12:43 +0800
+Subject: f2fs: report error if quota off error during umount
+
+From: Yunlei He <heyunlei@huawei.com>
+
+[ Upstream commit cda9cc595f0bb6ffa51a4efc4b6533dfa4039b4c ]
+
+Now, we depend on fsck to ensure quota file data is ok,
+so we scan whole partition if checkpoint without umount
+flag. It's same for quota off error case, which may make
+quota file data inconsistent.
+
+generic/019 reports below error:
+
+ __quota_error: 1160 callbacks suppressed
+ Quota error (device zram1): write_blk: dquota write failed
+ Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota
+ Quota error (device zram1): write_blk: dquota write failed
+ Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota
+ Quota error (device zram1): write_blk: dquota write failed
+ Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota
+ Quota error (device zram1): write_blk: dquota write failed
+ Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota
+ Quota error (device zram1): write_blk: dquota write failed
+ Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota
+ VFS: Busy inodes after unmount of zram1. Self-destruct in 5 seconds. Have a nice day...
+
+If we failed in below path due to fail to write dquot block, we will miss
+to release quota inode, fix it.
+
+- f2fs_put_super
+ - f2fs_quota_off_umount
+ - f2fs_quota_off
+ - f2fs_quota_sync <-- failed
+ - dquot_quota_off <-- missed to call
+
+Signed-off-by: Yunlei He <heyunlei@huawei.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/f2fs/super.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1820,7 +1820,9 @@ static int f2fs_quota_off(struct super_b
+ if (!inode || !igrab(inode))
+ return dquot_quota_off(sb, type);
+
+- f2fs_quota_sync(sb, type);
++ err = f2fs_quota_sync(sb, type);
++ if (err)
++ goto out_put;
+
+ err = dquot_quota_off(sb, type);
+ if (err || f2fs_sb_has_quota_ino(sb))
+@@ -1839,9 +1841,20 @@ out_put:
+ void f2fs_quota_off_umount(struct super_block *sb)
+ {
+ int type;
++ int err;
+
+- for (type = 0; type < MAXQUOTAS; type++)
+- f2fs_quota_off(sb, type);
++ for (type = 0; type < MAXQUOTAS; type++) {
++ err = f2fs_quota_off(sb, type);
++ if (err) {
++ int ret = dquot_quota_off(sb, type);
++
++ f2fs_msg(sb, KERN_ERR,
++ "Fail to turn off disk quota "
++ "(type: %d, err: %d, ret:%d), Please "
++ "run fsck to fix it.", type, err, ret);
++ set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK);
++ }
++ }
+ }
+
+ static int f2fs_get_projid(struct inode *inode, kprojid_t *projid)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 4 Sep 2018 02:56:26 +0000
+Subject: failover: Add missing check to validate 'slave_dev' in net_failover_slave_unregister
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9e7e6cabf371cc008cb2244a04c012b516753693 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/net/net_failover.c: In function 'net_failover_slave_unregister':
+drivers/net/net_failover.c:598:35: warning:
+ variable 'primary_dev' set but not used [-Wunused-but-set-variable]
+
+There should check the validity of 'slave_dev'.
+
+Fixes: cfc80d9a1163 ("net: Introduce net_failover driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/net_failover.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -602,6 +602,9 @@ static int net_failover_slave_unregister
+ primary_dev = rtnl_dereference(nfo_info->primary_dev);
+ standby_dev = rtnl_dereference(nfo_info->standby_dev);
+
++ if (WARN_ON_ONCE(slave_dev != primary_dev && slave_dev != standby_dev))
++ return -ENODEV;
++
+ vlan_vids_del_by_dev(slave_dev, failover_dev);
+ dev_uc_unsync(slave_dev, failover_dev);
+ dev_mc_unsync(slave_dev, failover_dev);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Stephen Boyd <swboyd@chromium.org>
+Date: Wed, 15 Aug 2018 13:37:04 -0700
+Subject: firmware: coreboot: Unmap ioregion after device population
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 20edec388277b62ddfddb8b2b376a937a2cd6d1b ]
+
+Both callers of coreboot_table_init() ioremap the pointer that comes in
+but they don't unmap the memory on failure. Both of them also fail probe
+immediately with the return value of coreboot_table_init(), leaking a
+mapping when it fails. The mapping isn't necessary at all after devices
+are populated either, so we can just drop the mapping here when we exit
+the function. Let's do that to simplify the code a bit and plug the leak.
+
+Cc: Wei-Ning Huang <wnhuang@chromium.org>
+Cc: Julius Werner <jwerner@chromium.org>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Samuel Holland <samuel@sholland.org>
+Fixes: 570d30c2823f ("firmware: coreboot: Expose the coreboot table as a bus")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Julius Werner <jwerner@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/google/coreboot_table.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/firmware/google/coreboot_table.c
++++ b/drivers/firmware/google/coreboot_table.c
+@@ -110,7 +110,8 @@ int coreboot_table_init(struct device *d
+
+ if (strncmp(header.signature, "LBIO", sizeof(header.signature))) {
+ pr_warn("coreboot_table: coreboot table missing or corrupt!\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out;
+ }
+
+ ptr_entry = (void *)ptr_header + header.header_bytes;
+@@ -137,7 +138,8 @@ int coreboot_table_init(struct device *d
+
+ ptr_entry += entry.size;
+ }
+-
++out:
++ iounmap(ptr);
+ return ret;
+ }
+ EXPORT_SYMBOL(coreboot_table_init);
+@@ -146,7 +148,6 @@ int coreboot_table_exit(void)
+ {
+ if (ptr_header) {
+ bus_unregister(&coreboot_bus_type);
+- iounmap(ptr_header);
+ ptr_header = NULL;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Justin Chen <justinpopo6@gmail.com>
+Date: Fri, 17 Aug 2018 16:47:39 -0700
+Subject: gpio: brcmstb: allow 0 width GPIO banks
+
+From: Justin Chen <justinpopo6@gmail.com>
+
+[ Upstream commit bfba223dcc4548632d8f3bfd15690a86d4c68504 ]
+
+Sometimes we have empty banks within the GPIO block. This commit allows
+proper handling of 0 width GPIO banks. We handle 0 width GPIO banks by
+incrementing the bank and number of GPIOs, but not initializing them.
+This will mean a call into the non-existent GPIOs will return an error.
+
+Also remove "GPIO registered" dev print. This information is misleading
+since the incremented banks and gpio_base do not reflect the actual GPIOs
+that get initialized. We leave this information out since it is already
+printed with dev_dbg.
+
+Signed-off-by: Justin Chen <justinpopo6@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpio-brcmstb.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpio/gpio-brcmstb.c
++++ b/drivers/gpio/gpio-brcmstb.c
+@@ -664,6 +664,18 @@ static int brcmstb_gpio_probe(struct pla
+ struct brcmstb_gpio_bank *bank;
+ struct gpio_chip *gc;
+
++ /*
++ * If bank_width is 0, then there is an empty bank in the
++ * register block. Special handling for this case.
++ */
++ if (bank_width == 0) {
++ dev_dbg(dev, "Width 0 found: Empty bank @ %d\n",
++ num_banks);
++ num_banks++;
++ gpio_base += MAX_GPIO_PER_BANK;
++ continue;
++ }
++
+ bank = devm_kzalloc(dev, sizeof(*bank), GFP_KERNEL);
+ if (!bank) {
+ err = -ENOMEM;
+@@ -740,9 +752,6 @@ static int brcmstb_gpio_probe(struct pla
+ goto fail;
+ }
+
+- dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n",
+- num_banks, priv->gpio_base, gpio_base - 1);
+-
+ if (priv->parent_wake_irq && need_wakeup_event)
+ pm_wakeup_event(dev, 0);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Thierry Reding <treding@nvidia.com>
+Date: Fri, 21 Sep 2018 12:10:48 +0200
+Subject: hwmon: (pwm-fan) Set fan speed to 0 on suspend
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 95dcd64bc5a27080beaa344edfe5bdcca3d2e7dc ]
+
+Technically this is not required because disabling the PWM should be
+enough. However, when support for atomic operations was implemented in
+the PWM subsystem, only actual changes to the PWM channel are applied
+during pwm_config(), which means that during after resume from suspend
+the old settings won't be applied.
+
+One possible solution is for the PWM driver to implement its own PM
+operations such that settings from before suspend get applied on resume.
+This has the disadvantage of completely ignoring any particular ordering
+requirements that PWM user drivers might have, so it is best to leave it
+up to the user drivers to apply the settings that they want at the
+appropriate time.
+
+Another way to solve this would be to read back the current state of the
+PWM at the time of resume. That way, in case the configuration was lost
+during suspend, applying the old settings in PWM user drivers would
+actually get them applied because they differ from the current settings.
+However, not all PWM drivers support reading the hardware state, and not
+all hardware may support it.
+
+The best workaround at this point seems to be to let PWM user drivers
+tell the PWM subsystem that the PWM is turned off by, in addition to
+disabling it, also setting the duty cycle to 0. This causes the resume
+operation to apply a configuration that is different from the current
+configuration, resulting in the proper state from before suspend getting
+restored.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/pwm-fan.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -290,9 +290,19 @@ static int pwm_fan_remove(struct platfor
+ static int pwm_fan_suspend(struct device *dev)
+ {
+ struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
++ struct pwm_args args;
++ int ret;
++
++ pwm_get_args(ctx->pwm, &args);
++
++ if (ctx->pwm_value) {
++ ret = pwm_config(ctx->pwm, 0, args.period);
++ if (ret < 0)
++ return ret;
+
+- if (ctx->pwm_value)
+ pwm_disable(ctx->pwm);
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Fri, 19 Oct 2018 21:15:26 +0200
+Subject: i2c: rcar: cleanup DMA for all kinds of failure
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 31d86033a0749a0463ea654130b2de5c163154f1 ]
+
+DMA needs to be cleaned up not only on timeout, but on all errors where
+it has been setup before.
+
+Fixes: 73e8b0528346 ("i2c: rcar: add DMA support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -812,8 +812,12 @@ static int rcar_i2c_master_xfer(struct i
+
+ time_left = wait_event_timeout(priv->wait, priv->flags & ID_DONE,
+ num * adap->timeout);
+- if (!time_left) {
++
++ /* cleanup DMA if it couldn't complete properly due to an error */
++ if (priv->dma_direction != DMA_NONE)
+ rcar_i2c_cleanup_dma(priv);
++
++ if (!time_left) {
+ rcar_i2c_init(priv);
+ ret = -ETIMEDOUT;
+ } else if (priv->flags & ID_NACK) {
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Denis Drozdov <denisd@mellanox.com>
+Date: Thu, 11 Oct 2018 22:33:57 +0300
+Subject: IB/ipoib: Clear IPCB before icmp_send
+
+From: Denis Drozdov <denisd@mellanox.com>
+
+[ Upstream commit 4d6e4d12da2c308f8f976d3955c45ee62539ac98 ]
+
+IPCB should be cleared before icmp_send, since it may contain data from
+previous layers and the data could be misinterpreted as ip header options,
+which later caused the ihl to be set to an invalid value and resulted in
+the following stack corruption:
+
+[ 1083.031512] ib0: packet len 57824 (> 2048) too long to send, dropping
+[ 1083.031843] ib0: packet len 37904 (> 2048) too long to send, dropping
+[ 1083.032004] ib0: packet len 4040 (> 2048) too long to send, dropping
+[ 1083.032253] ib0: packet len 63800 (> 2048) too long to send, dropping
+[ 1083.032481] ib0: packet len 23960 (> 2048) too long to send, dropping
+[ 1083.033149] ib0: packet len 63800 (> 2048) too long to send, dropping
+[ 1083.033439] ib0: packet len 63800 (> 2048) too long to send, dropping
+[ 1083.033700] ib0: packet len 63800 (> 2048) too long to send, dropping
+[ 1083.034124] ib0: packet len 63800 (> 2048) too long to send, dropping
+[ 1083.034387] ==================================================================
+[ 1083.034602] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xf08/0x1310
+[ 1083.034798] Write of size 4 at addr ffff880353457c5f by task kworker/u16:0/7
+[ 1083.034990]
+[ 1083.035104] CPU: 7 PID: 7 Comm: kworker/u16:0 Tainted: G O 4.19.0-rc5+ #1
+[ 1083.035316] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014
+[ 1083.035573] Workqueue: ipoib_wq ipoib_cm_skb_reap [ib_ipoib]
+[ 1083.035750] Call Trace:
+[ 1083.035888] dump_stack+0x9a/0xeb
+[ 1083.036031] print_address_description+0xe3/0x2e0
+[ 1083.036213] kasan_report+0x18a/0x2e0
+[ 1083.036356] ? __ip_options_echo+0xf08/0x1310
+[ 1083.036522] __ip_options_echo+0xf08/0x1310
+[ 1083.036688] icmp_send+0x7b9/0x1cd0
+[ 1083.036843] ? icmp_route_lookup.constprop.9+0x1070/0x1070
+[ 1083.037018] ? netif_schedule_queue+0x5/0x200
+[ 1083.037180] ? debug_show_all_locks+0x310/0x310
+[ 1083.037341] ? rcu_dynticks_curr_cpu_in_eqs+0x85/0x120
+[ 1083.037519] ? debug_locks_off+0x11/0x80
+[ 1083.037673] ? debug_check_no_obj_freed+0x207/0x4c6
+[ 1083.037841] ? check_flags.part.27+0x450/0x450
+[ 1083.037995] ? debug_check_no_obj_freed+0xc3/0x4c6
+[ 1083.038169] ? debug_locks_off+0x11/0x80
+[ 1083.038318] ? skb_dequeue+0x10e/0x1a0
+[ 1083.038476] ? ipoib_cm_skb_reap+0x2b5/0x650 [ib_ipoib]
+[ 1083.038642] ? netif_schedule_queue+0xa8/0x200
+[ 1083.038820] ? ipoib_cm_skb_reap+0x544/0x650 [ib_ipoib]
+[ 1083.038996] ipoib_cm_skb_reap+0x544/0x650 [ib_ipoib]
+[ 1083.039174] process_one_work+0x912/0x1830
+[ 1083.039336] ? wq_pool_ids_show+0x310/0x310
+[ 1083.039491] ? lock_acquire+0x145/0x3a0
+[ 1083.042312] worker_thread+0x87/0xbb0
+[ 1083.045099] ? process_one_work+0x1830/0x1830
+[ 1083.047865] kthread+0x322/0x3e0
+[ 1083.050624] ? kthread_create_worker_on_cpu+0xc0/0xc0
+[ 1083.053354] ret_from_fork+0x3a/0x50
+
+For instance __ip_options_echo is failing to proceed with invalid srr and
+optlen passed from another layer via IPCB
+
+[ 762.139568] IPv4: __ip_options_echo rr=0 ts=0 srr=43 cipso=0
+[ 762.139720] IPv4: ip_options_build: IPCB 00000000f3cd969e opt 000000002ccb3533
+[ 762.139838] IPv4: __ip_options_echo in srr: optlen 197 soffset 84
+[ 762.139852] IPv4: ip_options_build srr=0 is_frag=0 rr_needaddr=0 ts_needaddr=0 ts_needtime=0 rr=0 ts=0
+[ 762.140269] ==================================================================
+[ 762.140713] IPv4: __ip_options_echo rr=0 ts=0 srr=0 cipso=0
+[ 762.141078] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x12ec/0x1680
+[ 762.141087] Write of size 4 at addr ffff880353457c7f by task kworker/u16:0/7
+
+Signed-off-by: Denis Drozdov <denisd@mellanox.com>
+Reviewed-by: Erez Shitrit <erezsh@mellanox.com>
+Reviewed-by: Feras Daoud <ferasda@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1439,11 +1439,15 @@ static void ipoib_cm_skb_reap(struct wor
+ spin_unlock_irqrestore(&priv->lock, flags);
+ netif_tx_unlock_bh(dev);
+
+- if (skb->protocol == htons(ETH_P_IP))
++ if (skb->protocol == htons(ETH_P_IP)) {
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
++ }
+ #if IS_ENABLED(CONFIG_IPV6)
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ else if (skb->protocol == htons(ETH_P_IPV6)) {
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ }
+ #endif
+ dev_kfree_skb_any(skb);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Moni Shoua <monis@mellanox.com>
+Date: Wed, 12 Sep 2018 09:33:55 +0300
+Subject: IB/mlx5: Allow transition of DCI QP to reset
+
+From: Moni Shoua <monis@mellanox.com>
+
+[ Upstream commit 99ed748e878a99c6c7b87bbec063eefd9e47cb42 ]
+
+The transition is allowed from any state and the atrribute mask must be
+IB_QP_STATE.
+
+Fixes: c32a4f296e1d ("IB/mlx5: Add support for DC Initiator QP")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3264,7 +3264,9 @@ static bool modify_dci_qp_is_ok(enum ib_
+ int req = IB_QP_STATE;
+ int opt = 0;
+
+- if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
++ if (new_state == IB_QPS_RESET) {
++ return is_valid_mask(attr_mask, req, opt);
++ } else if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
+ req |= IB_QP_PKEY_INDEX | IB_QP_PORT;
+ return is_valid_mask(attr_mask, req, opt);
+ } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) {
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Vijay Immanuel <vijayi@attalasystems.com>
+Date: Tue, 12 Jun 2018 18:20:49 -0700
+Subject: IB/rxe: fix for duplicate request processing and ack psns
+
+From: Vijay Immanuel <vijayi@attalasystems.com>
+
+[ Upstream commit b97db58557f4aa6d9903f8e1deea6b3d1ed0ba43 ]
+
+Don't reset the resp opcode for a replayed read response.
+The resp opcode could be in the middle of a write or send
+sequence, when the duplicate read request was received.
+An example sequence is as follows:
+- Receive read request for 12KB PSN 20. Transmit read response
+ first, middle and last with PSNs 20,21,22.
+- Receive write first PSN 23.
+ At this point the resp psn is 24 and resp opcode is write first.
+- The sender notices that PSN 20 is dropped and retransmits.
+ Receive read request for 12KB PSN 20. Transmit read response
+ first, middle and last with PSNs 20,21,22. The resp opcode is
+ set to -1, the resp psn remains 24.
+- Receive write first PSN 23. This is processed by duplicate_request().
+ The resp opcode remains -1 and resp psn remains 24.
+- Receive write middle PSN 24. check_op_seq() reports a missing
+ first error since the resp opcode is -1.
+
+When sending an ack for a duplicate send or write request,
+use the psn of the previous ack sent. Do not use the psn
+of a read response for the ack.
+An example sequence is as follows:
+- Receive write PSN 30. Transmit ACK for PSN 30.
+- Receive read request 4KB PSN 31. Transmit read response with
+ PSN 31. The resp psn is now 32.
+- The sender notices that PSN 30 is dropped and retransmits.
+ Receive write PSN 30. duplicate_request() sends an ACK with
+ PSN 31. That is incorrect since PSN 31 was a read request.
+
+Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rxe/rxe_resp.c | 8 ++++++--
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 2 ++
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -682,6 +682,7 @@ static enum resp_states read_reply(struc
+ rxe_advance_resp_resource(qp);
+
+ res->type = RXE_READ_MASK;
++ res->replay = 0;
+
+ res->read.va = qp->resp.va;
+ res->read.va_org = qp->resp.va;
+@@ -752,7 +753,8 @@ static enum resp_states read_reply(struc
+ state = RESPST_DONE;
+ } else {
+ qp->resp.res = NULL;
+- qp->resp.opcode = -1;
++ if (!res->replay)
++ qp->resp.opcode = -1;
+ if (psn_compare(res->cur_psn, qp->resp.psn) >= 0)
+ qp->resp.psn = res->cur_psn;
+ state = RESPST_CLEANUP;
+@@ -814,6 +816,7 @@ static enum resp_states execute(struct r
+
+ /* next expected psn, read handles this separately */
+ qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ qp->resp.ack_psn = qp->resp.psn;
+
+ qp->resp.opcode = pkt->opcode;
+ qp->resp.status = IB_WC_SUCCESS;
+@@ -1060,7 +1063,7 @@ static enum resp_states duplicate_reques
+ struct rxe_pkt_info *pkt)
+ {
+ enum resp_states rc;
+- u32 prev_psn = (qp->resp.psn - 1) & BTH_PSN_MASK;
++ u32 prev_psn = (qp->resp.ack_psn - 1) & BTH_PSN_MASK;
+
+ if (pkt->mask & RXE_SEND_MASK ||
+ pkt->mask & RXE_WRITE_MASK) {
+@@ -1103,6 +1106,7 @@ static enum resp_states duplicate_reques
+ res->state = (pkt->psn == res->first_psn) ?
+ rdatm_res_state_new :
+ rdatm_res_state_replay;
++ res->replay = 1;
+
+ /* Reset the resource, except length. */
+ res->read.va_org = iova;
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -171,6 +171,7 @@ enum rdatm_res_state {
+
+ struct resp_res {
+ int type;
++ int replay;
+ u32 first_psn;
+ u32 last_psn;
+ u32 cur_psn;
+@@ -195,6 +196,7 @@ struct rxe_resp_info {
+ enum rxe_qp_state state;
+ u32 msn;
+ u32 psn;
++ u32 ack_psn;
+ int opcode;
+ int drop_msg;
+ int goto_error;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Bruce Allan <bruce.w.allan@intel.com>
+Date: Wed, 19 Sep 2018 17:23:11 -0700
+Subject: ice: fix changing of ring descriptor size (ethtool -G)
+
+From: Bruce Allan <bruce.w.allan@intel.com>
+
+[ Upstream commit f934bb9b8b6136edd261b2dc2c9ad4dbc39ffc66 ]
+
+rx_mini_pending was set to an incorrect value. This was causing EINVAL to
+always be returned to 'ethtool -G'. The driver does not support mini or
+jumbo rings so the respective settings should be zero.
+
+Also, change the valid range of the number of descriptors in the rings to
+make the code simpler and easier for users to understand (this removes the
+valid settings of 8 and 16). Add a system log message indicating when the
+number is rounded-up from what the user specifies with the 'ethtool -G'
+command (i.e. when it is not a multiple of 32), and update the log message
+when a user-provided value is out of range to also indicate the stride.
+
+Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 4 ++--
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 17 ++++++++++++++---
+ 2 files changed, 16 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -39,9 +39,9 @@
+ extern const char ice_drv_ver[];
+ #define ICE_BAR0 0
+ #define ICE_DFLT_NUM_DESC 128
+-#define ICE_MIN_NUM_DESC 8
+-#define ICE_MAX_NUM_DESC 8160
+ #define ICE_REQ_DESC_MULTIPLE 32
++#define ICE_MIN_NUM_DESC ICE_REQ_DESC_MULTIPLE
++#define ICE_MAX_NUM_DESC 8160
+ #define ICE_DFLT_TRAFFIC_CLASS BIT(0)
+ #define ICE_INT_NAME_STR_LEN (IFNAMSIZ + 16)
+ #define ICE_ETHTOOL_FWVER_LEN 32
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -478,9 +478,11 @@ ice_get_ringparam(struct net_device *net
+ ring->tx_max_pending = ICE_MAX_NUM_DESC;
+ ring->rx_pending = vsi->rx_rings[0]->count;
+ ring->tx_pending = vsi->tx_rings[0]->count;
+- ring->rx_mini_pending = ICE_MIN_NUM_DESC;
++
++ /* Rx mini and jumbo rings are not supported */
+ ring->rx_mini_max_pending = 0;
+ ring->rx_jumbo_max_pending = 0;
++ ring->rx_mini_pending = 0;
+ ring->rx_jumbo_pending = 0;
+ }
+
+@@ -498,14 +500,23 @@ ice_set_ringparam(struct net_device *net
+ ring->tx_pending < ICE_MIN_NUM_DESC ||
+ ring->rx_pending > ICE_MAX_NUM_DESC ||
+ ring->rx_pending < ICE_MIN_NUM_DESC) {
+- netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n",
++ netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d] (increment %d)\n",
+ ring->tx_pending, ring->rx_pending,
+- ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC);
++ ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC,
++ ICE_REQ_DESC_MULTIPLE);
+ return -EINVAL;
+ }
+
+ new_tx_cnt = ALIGN(ring->tx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_tx_cnt != ring->tx_pending)
++ netdev_info(netdev,
++ "Requested Tx descriptor count rounded up to %d\n",
++ new_tx_cnt);
+ new_rx_cnt = ALIGN(ring->rx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_rx_cnt != ring->rx_pending)
++ netdev_info(netdev,
++ "Requested Rx descriptor count rounded up to %d\n",
++ new_rx_cnt);
+
+ /* if nothing to do return success */
+ if (new_tx_cnt == vsi->tx_rings[0]->count &&
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Wed, 19 Sep 2018 17:23:07 -0700
+Subject: ice: update fw version check logic
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit 396fbf9cab5dc07f8f87773062a8d35f54b40a05 ]
+
+We have MAX_FW_API_VER_BRANCH, MAX_FW_API_VER_MAJOR, and
+MAX_FW_API_VER_MINOR that we use in ice_controlq.h to test when a
+firmware version is newer than expected. This is currently tested by
+comparing each field separately. Thus, we compare the branch field
+against the MAX_FW_API_VER_BRANCH, and so forth.
+
+This means that currently, if we suppose that the max firmware version
+is defined as 0.2.1, i.e.
+
+Then firmware 0.1.3 will fail to load. This is because the minor version
+3 is greater than the max minor version 1.
+
+This is not intuitive, because of the notion that increasing the major
+firmware version to 2 should mean any firmware version with a major
+version is less than 2 should be considered older than 2...
+
+In order to allow both 0.2.1 and 0.1.3 to load, you would have to define
+the "max" firmware version as 0.2.3.. It is possible that such
+a firmware version doesn't even exist yet!
+
+Fix this by replacing the current logic with an updated check that
+behaves as follows:
+
+First, we check the major version. If it is greater than the expected
+version, then we prevent driver load. Additionally, a warning message is
+logged to indicate to the system administrator that they need to update
+their driver. This is now the only case where the driver will refuse to
+load.
+
+Second, if the major version is less than the expected version, we log
+an information message indicating the NVM should be updated.
+
+Third, if the major version is exact, we'll then check the minor
+version. If the minor version is more than two versions less than
+expected, we log an information message indicating the NVM should be
+updated. If it is more than two versions greater than the expected
+version, we log an information message that the driver should be
+updated.
+
+To support this, the ice_aq_ver_check function needs its signature
+updated to pass the HW structure. Since we now pass this structure,
+there is no need to pass the firmware API versions separately.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ice/ice_controlq.c | 30 ++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -518,22 +518,31 @@ shutdown_sq_out:
+
+ /**
+ * ice_aq_ver_check - Check the reported AQ API version.
+- * @fw_branch: The "branch" of FW, typically describes the device type
+- * @fw_major: The major version of the FW API
+- * @fw_minor: The minor version increment of the FW API
++ * @hw: pointer to the hardware structure
+ *
+ * Checks if the driver should load on a given AQ API version.
+ *
+ * Return: 'true' iff the driver should attempt to load. 'false' otherwise.
+ */
+-static bool ice_aq_ver_check(u8 fw_branch, u8 fw_major, u8 fw_minor)
++static bool ice_aq_ver_check(struct ice_hw *hw)
+ {
+- if (fw_branch != EXP_FW_API_VER_BRANCH)
+- return false;
+- if (fw_major != EXP_FW_API_VER_MAJOR)
+- return false;
+- if (fw_minor != EXP_FW_API_VER_MINOR)
++ if (hw->api_maj_ver > EXP_FW_API_VER_MAJOR) {
++ /* Major API version is newer than expected, don't load */
++ dev_warn(ice_hw_to_dev(hw),
++ "The driver for the device stopped because the NVM image is newer than expected. You must install the most recent version of the network driver.\n");
+ return false;
++ } else if (hw->api_maj_ver == EXP_FW_API_VER_MAJOR) {
++ if (hw->api_min_ver > (EXP_FW_API_VER_MINOR + 2))
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected a newer version of the NVM image than expected. Please install the most recent version of the network driver.\n");
++ else if ((hw->api_min_ver + 2) < EXP_FW_API_VER_MINOR)
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ } else {
++ /* Major API version is older than expected, log a warning */
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ }
+ return true;
+ }
+
+@@ -588,8 +597,7 @@ static enum ice_status ice_init_check_ad
+ if (status)
+ goto init_ctrlq_free_rq;
+
+- if (!ice_aq_ver_check(hw->api_branch, hw->api_maj_ver,
+- hw->api_min_ver)) {
++ if (!ice_aq_ver_check(hw)) {
+ status = ICE_ERR_FW_API_VER;
+ goto init_ctrlq_free_rq;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Lina Iyer <ilina@codeaurora.org>
+Date: Thu, 27 Sep 2018 11:18:10 -0600
+Subject: irqchip/pdc: Setup all edge interrupts as rising edge at GIC
+
+From: Lina Iyer <ilina@codeaurora.org>
+
+[ Upstream commit 7bae48b22c8d38c5cd50f52b6e15d134e2bb3935 ]
+
+The PDC irqchp can convert a falling edge or level low interrupt to a
+rising edge or level high interrupt at the GIC. We just need to setup
+the GIC correctly. Set up the interrupt type for the IRQ_TYPE_EDGE_BOTH
+as IRQ_TYPE_EDGE_RISING at the GIC.
+
+Fixes: f55c73aef890 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs")
+Reported-by: Evan Green <evgreen@chromium.org>
+Reviewed-by: Evan Green <evgreen@chromium.org>
+Signed-off-by: Lina Iyer <ilina@codeaurora.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/irqchip/qcom-pdc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -124,6 +124,7 @@ static int qcom_pdc_gic_set_type(struct
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ pdc_type = PDC_EDGE_DUAL;
++ type = IRQ_TYPE_EDGE_RISING;
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ pdc_type = PDC_LEVEL_HIGH;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Mon, 11 Jun 2018 11:15:17 +0300
+Subject: iwlwifi: mvm: check for n_profiles validity in EWRD ACPI
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 2e1976bb75263fbad918e82184b16a23bd721546 ]
+
+When reading the profiles from the EWRD table in ACPI, we loop over
+the data and set it into our internal table. We use the number of
+profiles specified in ACPI without checking its validity, so if the
+ACPI table is corrupted and the number is larger than our array size,
+we will try to make an out-of-bounds access.
+
+Fix this by making sure the value specified in the ACPI table is
+valid.
+
+Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -669,8 +669,12 @@ static int iwl_mvm_sar_get_ewrd_table(st
+ enabled = !!(wifi_pkg->package.elements[1].integer.value);
+ n_profiles = wifi_pkg->package.elements[2].integer.value;
+
+- /* in case of BIOS bug */
+- if (n_profiles <= 0) {
++ /*
++ * Check the validity of n_profiles. The EWRD profiles start
++ * from index 1, so the maximum value allowed here is
++ * ACPI_SAR_PROFILES_NUM - 1.
++ */
++ if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
+ ret = -EINVAL;
+ goto out_free;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Wed, 13 Jun 2018 11:49:20 +0300
+Subject: iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 155f7e0441cd121b1e673d465a35e99f4b9b2f0b ]
+
+Fix a bug that happens in the following scenario:
+1) suspend without WoWLAN
+2) mac80211 calls drv_stop because of the suspend
+3) __iwl_mvm_mac_stop deallocates the aux station
+4) during drv_stop the firmware crashes
+5) iwlmvm:
+ * sets IWL_MVM_STATUS_HW_RESTART_REQUESTED
+ * asks mac80211 to kick the restart flow
+6) mac80211 puts the restart worker into a freezable
+ queue which means that the worker will not run for now
+ since the workqueue is already frozen
+7) ...
+8) resume
+9) mac80211 runs ieee80211_reconfig as part of the resume
+10) mac80211 detects that a restart flow has been requested
+ and that we are now resuming from suspend and cancels
+ the restart worker
+11) mac80211 calls drv_start()
+12) __iwl_mvm_mac_start checks that IWL_MVM_STATUS_HW_RESTART_REQUESTED
+ clears it, sets IWL_MVM_STATUS_IN_HW_RESTART and calls
+ iwl_mvm_restart_cleanup()
+13) iwl_fw_error_dump gets called and accesses the device
+ to get debug data
+14) iwl_mvm_up adds the aux station
+15) iwl_mvm_add_aux_sta() allocates an internal station for
+ the aux station
+16) iwl_mvm_allocate_int_sta() tests IWL_MVM_STATUS_IN_HW_RESTART
+ and doesn't really allocate a station ID for the aux
+ station
+17) a new queue is added for the aux station
+
+Note that steps from 5 to 9 aren't really part of the
+problem but were described for the sake of completeness.
+
+Once the iwl_mvm_mac_stop() is called, the device is not
+accessible, meaning that step 12) can't succeed and we'll
+see the following:
+
+drivers/net/wireless/intel/iwlwifi/pcie/trans.c:2122 iwl_trans_pcie_grab_nic_access+0xc0/0x1d6 [iwlwifi]()
+Timeout waiting for hardware access (CSR_GP_CNTRL 0x080403d8)
+Call Trace:
+[<ffffffffc03e6ad3>] iwl_trans_pcie_grab_nic_access+0xc0/0x1d6 [iwlwifi]
+[<ffffffffc03e6a13>] iwl_trans_pcie_dump_regs+0x3fd/0x3fd [iwlwifi]
+[<ffffffffc03dad42>] iwl_fw_error_dump+0x4f5/0xe8b [iwlwifi]
+[<ffffffffc04bd43e>] __iwl_mvm_mac_start+0x5a/0x21a [iwlmvm]
+[<ffffffffc04bd6d2>] iwl_mvm_mac_start+0xd4/0x103 [iwlmvm]
+[<ffffffffc042d378>] drv_start+0xa1/0xc5 [iwl7000_mac80211]
+[<ffffffffc045a339>] ieee80211_reconfig+0x145/0xf50 [mac80211]
+[<ffffffffc044788b>] ieee80211_resume+0x62/0x66 [mac80211]
+[<ffffffffc0366c5b>] wiphy_resume+0xa9/0xc6 [cfg80211]
+
+The station id of the aux station is set to 0xff in step 3
+and because we don't really allocate a new station id for
+the auxliary station (as explained in 16), we end up sending
+a command to the firmware asking to connect the queue
+to station id 0xff. This makes the firmware crash with the
+following information:
+
+0x00002093 | ADVANCED_SYSASSERT
+0x000002F0 | trm_hw_status0
+0x00000000 | trm_hw_status1
+0x00000B38 | branchlink2
+0x0001978C | interruptlink1
+0x00000000 | interruptlink2
+0xFF080501 | data1
+0xDEADBEEF | data2
+0xDEADBEEF | data3
+Firmware error during reconfiguration - reprobe!
+FW error in SYNC CMD SCD_QUEUE_CFG
+
+Fix this by clearing IWL_MVM_STATUS_HW_RESTART_REQUESTED
+in iwl_mvm_mac_stop(). We won't be able to collect debug
+data anyway and when we will brought up again, we will
+have a clean state from the firmware perspective.
+Since we won't have IWL_MVM_STATUS_IN_HW_RESTART set in
+step 12) we won't get to the 2093 ASSERT either.
+
+Fixes: bf8b286f86fc ("iwlwifi: mvm: defer setting IWL_MVM_STATUS_IN_HW_RESTART")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1232,12 +1232,15 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *
+ iwl_mvm_del_aux_sta(mvm);
+
+ /*
+- * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
+- * won't be called in this case).
++ * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
++ * hw (as restart_complete() won't be called in this case) and mac80211
++ * won't execute the restart.
+ * But make sure to cleanup interfaces that have gone down before/during
+ * HW restart was requested.
+ */
+- if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
++ if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
++ test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
++ &mvm->status))
+ ieee80211_iterate_interfaces(mvm->hw, 0,
+ iwl_mvm_cleanup_iterator, mvm);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Tue, 1 May 2018 14:54:22 +0300
+Subject: iwlwifi: mvm: fix BAR seq ctrl reporting
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 941ab4eb66c10bc5c7234e83a7a858b2806ed151 ]
+
+There is a bug in FW where the sequence control may be
+incorrect, and the driver overrides it with the value
+of the ieee80211 header.
+
+However, in BAR there is no sequence control in the header,
+which result with arbitrary sequence.
+
+This access to an unknown location is bad and it makes the
+logs very confusing - so fix it.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1385,6 +1385,7 @@ static void iwl_mvm_rx_tx_cmd_single(str
+ while (!skb_queue_empty(&skbs)) {
+ struct sk_buff *skb = __skb_dequeue(&skbs);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_hdr *hdr = (void *)skb->data;
+ bool flushed = false;
+
+ skb_freed++;
+@@ -1429,11 +1430,11 @@ static void iwl_mvm_rx_tx_cmd_single(str
+ info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+ info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
+- /* W/A FW bug: seq_ctl is wrong when the status isn't success */
+- if (status != TX_STATUS_SUCCESS) {
+- struct ieee80211_hdr *hdr = (void *)skb->data;
++ /* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */
++ if (ieee80211_is_back_req(hdr->frame_control))
++ seq_ctl = 0;
++ else if (status != TX_STATUS_SUCCESS)
+ seq_ctl = le16_to_cpu(hdr->seq_ctrl);
+- }
+
+ if (unlikely(!seq_ctl)) {
+ struct ieee80211_hdr *hdr = (void *)skb->data;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Shaul Triebitz <shaul.triebitz@intel.com>
+Date: Wed, 6 Jun 2018 17:20:58 +0300
+Subject: iwlwifi: pcie: avoid empty free RB queue
+
+From: Shaul Triebitz <shaul.triebitz@intel.com>
+
+[ Upstream commit 868a1e863f95183f00809363fefba6d4f5bcd116 ]
+
+If all free RB queues are empty, the driver will never restock the
+free RB queue. That's because the restocking happens in the Rx flow,
+and if the free queue is empty there will be no Rx.
+
+Although there's a background worker (a.k.a. allocator) allocating
+memory for RBs so that the Rx handler can restock them, the worker may
+run only after the free queue has become empty (and then it is too
+late for restocking as explained above).
+
+There is a solution for that called 'emergency': If the number of used
+RB's reaches half the amount of all RB's, the Rx handler will not wait
+for the allocator but immediately allocate memory for the used RB's
+and restock the free queue.
+
+But, since the used RB's is per queue, it may happen that the used
+RB's are spread between the queues such that the emergency check will
+fail for each of the queues
+(and still run out of RBs, causing the above symptom).
+
+To fix it, move to emergency mode if the sum of *all* used RBs (for
+all Rx queues) reaches half the amount of all RB's
+
+Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 32 +++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1050,6 +1050,14 @@ void iwl_pcie_rx_free(struct iwl_trans *
+ kfree(trans_pcie->rxq);
+ }
+
++static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,
++ struct iwl_rb_allocator *rba)
++{
++ spin_lock(&rba->lock);
++ list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
++ spin_unlock(&rba->lock);
++}
++
+ /*
+ * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
+ *
+@@ -1081,9 +1089,7 @@ static void iwl_pcie_rx_reuse_rbd(struct
+ if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
+ /* Move the 2 RBDs to the allocator ownership.
+ Allocator has another 6 from pool for the request completion*/
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+
+ atomic_inc(&rba->req_pending);
+ queue_work(rba->alloc_wq, &rba->rx_alloc);
+@@ -1261,10 +1267,18 @@ restart:
+ IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r);
+
+ while (i != r) {
++ struct iwl_rb_allocator *rba = &trans_pcie->rba;
+ struct iwl_rx_mem_buffer *rxb;
+-
+- if (unlikely(rxq->used_count == rxq->queue_size / 2))
++ /* number of RBDs still waiting for page allocation */
++ u32 rb_pending_alloc =
++ atomic_read(&trans_pcie->rba.req_pending) *
++ RX_CLAIM_REQ_ALLOC;
++
++ if (unlikely(rb_pending_alloc >= rxq->queue_size / 2 &&
++ !emergency)) {
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ emergency = true;
++ }
+
+ if (trans->cfg->mq_rx_supported) {
+ /*
+@@ -1307,17 +1321,13 @@ restart:
+ iwl_pcie_rx_allocator_get(trans, rxq);
+
+ if (rxq->used_count % RX_CLAIM_REQ_ALLOC == 0 && !emergency) {
+- struct iwl_rb_allocator *rba = &trans_pcie->rba;
+-
+ /* Add the remaining empty RBDs for allocator use */
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ } else if (emergency) {
+ count++;
+ if (count == 8) {
+ count = 0;
+- if (rxq->used_count < rxq->queue_size / 3)
++ if (rb_pending_alloc < rxq->queue_size / 3)
+ emergency = false;
+
+ rxq->read = i;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Shannon Nelson <shannon.nelson@oracle.com>
+Date: Wed, 22 Aug 2018 16:47:14 -0700
+Subject: ixgbe: disallow IPsec Tx offload when in SR-IOV mode
+
+From: Shannon Nelson <shannon.nelson@oracle.com>
+
+[ Upstream commit 47b6f50077e68bcd544f657526dad4bfdce7e87d ]
+
+There seems to be a problem in the x540's internal switch wherein if SR-IOV
+mode is enabled and an offloaded IPsec packet is sent to a local VF,
+the packet is silently dropped. This might never be a problem as it is
+somewhat a corner case, but if someone happens to be using IPsec offload
+from the PF to a VF that just happens to get migrated to the local box,
+communication will mysteriously fail.
+
+Not good.
+
+A simple way to protect from this is to simply not allow any IPsec offloads
+for outgoing packets when num_vfs != 0. This doesn't help any offloads that
+were created before SR-IOV was enabled, but we'll get to that later.
+
+Signed-off-by: Shannon Nelson <shannon.nelson@oracle.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -676,6 +676,9 @@ static int ixgbe_ipsec_add_sa(struct xfr
+ } else {
+ struct tx_sa tsa;
+
++ if (adapter->num_vfs)
++ return -EOPNOTSUPP;
++
+ /* find the first unused index */
+ ret = ixgbe_ipsec_find_empty_idx(ipsec, false);
+ if (ret < 0) {
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sebastian Basierski <sebastianx.basierski@intel.com>
+Date: Thu, 9 Aug 2018 11:45:40 +0200
+Subject: ixgbevf: VF2VF TCP RSS
+
+From: Sebastian Basierski <sebastianx.basierski@intel.com>
+
+[ Upstream commit 7fb94bd58dd6650a0158e68d414e185077d8b57a ]
+
+While VF2VF with RSS communication, RSS Type were wrongly recognized
+and RSS hash was not calculated as it should be. Packets was
+distributed on various queues by accident.
+This commit fixes that behaviour and causes proper RSS Type recognition.
+
+Signed-off-by: Sebastian Basierski <sebastianx.basierski@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -3849,6 +3849,10 @@ static void ixgbevf_tx_csum(struct ixgbe
+ skb_checksum_help(skb);
+ goto no_csum;
+ }
++
++ if (first->protocol == htons(ETH_P_IP))
++ type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
++
+ /* update TX checksum flag */
+ first->tx_flags |= IXGBE_TX_FLAGS_CSUM;
+ vlan_macip_lens = skb_checksum_start_offset(skb) -
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Tue, 11 Sep 2018 19:20:40 +0900
+Subject: kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 819319fc93461c07b9cdb3064f154bd8cfd48172 ]
+
+Make reuse_unused_kprobe() to return error code if
+it fails to reuse unused kprobe for optprobe instead
+of calling BUG_ON().
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: David S . Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N . Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/153666124040.21306.14150398706331307654.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kprobes.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -700,9 +700,10 @@ static void unoptimize_kprobe(struct kpr
+ }
+
+ /* Cancel unoptimizing for reusing */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ struct optimized_kprobe *op;
++ int ret;
+
+ BUG_ON(!kprobe_unused(ap));
+ /*
+@@ -714,8 +715,12 @@ static void reuse_unused_kprobe(struct k
+ /* Enable the probe again */
+ ap->flags &= ~KPROBE_FLAG_DISABLED;
+ /* Optimize it again (remove from op->list) */
+- BUG_ON(!kprobe_optready(ap));
++ ret = kprobe_optready(ap);
++ if (ret)
++ return ret;
++
+ optimize_kprobe(ap);
++ return 0;
+ }
+
+ /* Remove optimized instructions */
+@@ -940,11 +945,16 @@ static void __disarm_kprobe(struct kprob
+ #define kprobe_disarmed(p) kprobe_disabled(p)
+ #define wait_for_kprobe_optimizer() do {} while (0)
+
+-/* There should be no unused kprobes can be reused without optimization */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
++ /*
++ * If the optimized kprobe is NOT supported, the aggr kprobe is
++ * released at the same time that the last aggregated kprobe is
++ * unregistered.
++ * Thus there should be no chance to reuse unused kprobe.
++ */
+ printk(KERN_ERR "Error: There should be no unused kprobe here.\n");
+- BUG_ON(kprobe_unused(ap));
++ return -EINVAL;
+ }
+
+ static void free_aggr_kprobe(struct kprobe *p)
+@@ -1343,9 +1353,12 @@ static int register_aggr_kprobe(struct k
+ goto out;
+ }
+ init_aggr_kprobe(ap, orig_p);
+- } else if (kprobe_unused(ap))
++ } else if (kprobe_unused(ap)) {
+ /* This probe is going to die. Rescue it */
+- reuse_unused_kprobe(ap);
++ ret = reuse_unused_kprobe(ap);
++ if (ret)
++ goto out;
++ }
+
+ if (kprobe_gone(ap)) {
+ /*
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jim Mattson <jmattson@google.com>
+Date: Fri, 21 Sep 2018 10:36:17 -0700
+Subject: KVM: nVMX: Clear reserved bits of #DB exit qualification
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit cfb634fe3052aefc4e1360fa322018c9a0b49755 ]
+
+According to volume 3 of the SDM, bits 63:15 and 12:4 of the exit
+qualification field for debug exceptions are reserved (cleared to
+0). However, the SDM is incorrect about bit 16 (corresponding to
+DR6.RTM). This bit should be set if a debug exception (#DB) or a
+breakpoint exception (#BP) occurred inside an RTM region while
+advanced debugging of RTM transactional regions was enabled. Note that
+this is the opposite of DR6.RTM, which "indicates (when clear) that a
+debug exception (#DB) or breakpoint exception (#BP) occurred inside an
+RTM region while advanced debugging of RTM transactional regions was
+enabled."
+
+There is still an issue with stale DR6 bits potentially being
+misreported for the current debug exception. DR6 should not have been
+modified before vectoring the #DB exception, and the "new DR6 bits"
+should be available somewhere, but it was and they aren't.
+
+Fixes: b96fb439774e1 ("KVM: nVMX: fixes to nested virt interrupt injection")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/kvm_host.h | 1 +
+ arch/x86/kvm/vmx.c | 7 +++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -176,6 +176,7 @@ enum {
+
+ #define DR6_BD (1 << 13)
+ #define DR6_BS (1 << 14)
++#define DR6_BT (1 << 15)
+ #define DR6_RTM (1 << 16)
+ #define DR6_FIXED_1 0xfffe0ff0
+ #define DR6_INIT 0xffff0ff0
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3160,10 +3160,13 @@ static int nested_vmx_check_exception(st
+ }
+ } else {
+ if (vmcs12->exception_bitmap & (1u << nr)) {
+- if (nr == DB_VECTOR)
++ if (nr == DB_VECTOR) {
+ *exit_qual = vcpu->arch.dr6;
+- else
++ *exit_qual &= ~(DR6_FIXED_1 | DR6_BT);
++ *exit_qual ^= DR6_RTM;
++ } else {
+ *exit_qual = 0;
++ }
+ return 1;
+ }
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Diego Viola <diego.viola@gmail.com>
+Date: Fri, 26 Oct 2018 10:45:16 -0300
+Subject: libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9
+
+From: Diego Viola <diego.viola@gmail.com>
+
+[ Upstream commit a435ab4f80f983c53b4ca4f8c12b3ddd3ca17670 ]
+
+med_power_with_dipm causes my T450 to freeze with a SAMSUNG
+MZ7TD256HAFV-000L9 SSD (firmware DXT02L5Q).
+
+Switching the LPM to max_performance fixes this issue.
+
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Diego Viola <diego.viola@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4552,6 +4552,7 @@ static const struct ata_blacklist_entry
+ /* These specific Samsung models/firmware-revs do not handle LPM well */
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Javier González" <javier@javigon.com>
+Date: Tue, 9 Oct 2018 13:11:35 +0200
+Subject: lightnvm: pblk: fix race condition on metadata I/O
+
+From: "Javier González" <javier@javigon.com>
+
+[ Upstream commit d8adaa3b86324c6186d0adf74bc256bdacfffdb6 ]
+
+In pblk, when a new line is allocated, metadata for the previously
+written line is scheduled. This is done through a fixed memory region
+that is shared through time and contexts across different lines and
+therefore protected by a lock. Unfortunately, this lock is not properly
+covering all the metadata used for sharing this memory regions,
+resulting in a race condition.
+
+This patch fixes this race condition by protecting this metadata
+properly.
+
+Fixes: dd2a43437337 ("lightnvm: pblk: sched. metadata on write thread")
+Signed-off-by: Javier González <javier@cnexlabs.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/lightnvm/pblk-write.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/lightnvm/pblk-write.c
++++ b/drivers/lightnvm/pblk-write.c
+@@ -417,12 +417,11 @@ int pblk_submit_meta_io(struct pblk *pbl
+ rqd->ppa_list[i] = addr_to_gen_ppa(pblk, paddr, id);
+ }
+
++ spin_lock(&l_mg->close_lock);
+ emeta->mem += rq_len;
+- if (emeta->mem >= lm->emeta_len[0]) {
+- spin_lock(&l_mg->close_lock);
++ if (emeta->mem >= lm->emeta_len[0])
+ list_del(&meta_line->list);
+- spin_unlock(&l_mg->close_lock);
+- }
++ spin_unlock(&l_mg->close_lock);
+
+ pblk_down_page(pblk, rqd->ppa_list, rqd->nr_ppas);
+
+@@ -491,14 +490,15 @@ static struct pblk_line *pblk_should_sub
+ struct pblk_line *meta_line;
+
+ spin_lock(&l_mg->close_lock);
+-retry:
+ if (list_empty(&l_mg->emeta_list)) {
+ spin_unlock(&l_mg->close_lock);
+ return NULL;
+ }
+ meta_line = list_first_entry(&l_mg->emeta_list, struct pblk_line, list);
+- if (meta_line->emeta->mem >= lm->emeta_len[0])
+- goto retry;
++ if (meta_line->emeta->mem >= lm->emeta_len[0]) {
++ spin_unlock(&l_mg->close_lock);
++ return NULL;
++ }
+ spin_unlock(&l_mg->close_lock);
+
+ if (!pblk_valid_meta_ppa(pblk, meta_line, data_rqd))
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Javier González" <javier@javigon.com>
+Date: Tue, 9 Oct 2018 13:12:07 +0200
+Subject: lightnvm: pblk: fix race on sysfs line state
+
+From: "Javier González" <javier@javigon.com>
+
+[ Upstream commit 44cdbdc657b23f75736eca3e88b781f009104363 ]
+
+pblk exposes a sysfs interface that represents its internal state. Part
+of this state is the map bitmap for the current open line, which should
+be protected by the line lock to avoid a race when freeing the line
+metadata. Currently, it is not.
+
+This patch makes sure that the line state is consistent and NULL
+bitmap pointers are not dereferenced.
+
+Signed-off-by: Javier González <javier@cnexlabs.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/lightnvm/pblk-core.c | 5 +++--
+ drivers/lightnvm/pblk-sysfs.c | 8 +++++++-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -1538,13 +1538,14 @@ struct pblk_line *pblk_line_replace_data
+ struct pblk_line *cur, *new = NULL;
+ unsigned int left_seblks;
+
+- cur = l_mg->data_line;
+ new = l_mg->data_next;
+ if (!new)
+ goto out;
+- l_mg->data_line = new;
+
+ spin_lock(&l_mg->free_lock);
++ cur = l_mg->data_line;
++ l_mg->data_line = new;
++
+ pblk_line_setup_metadata(new, l_mg, &pblk->lm);
+ spin_unlock(&l_mg->free_lock);
+
+--- a/drivers/lightnvm/pblk-sysfs.c
++++ b/drivers/lightnvm/pblk-sysfs.c
+@@ -262,8 +262,14 @@ static ssize_t pblk_sysfs_lines(struct p
+ sec_in_line = l_mg->data_line->sec_in_line;
+ meta_weight = bitmap_weight(&l_mg->meta_bitmap,
+ PBLK_DATA_LINES);
+- map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
++
++ spin_lock(&l_mg->data_line->lock);
++ if (l_mg->data_line->map_bitmap)
++ map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
+ lm->sec_per_line);
++ else
++ map_weight = 0;
++ spin_unlock(&l_mg->data_line->lock);
+ }
+ spin_unlock(&l_mg->free_lock);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 9 Oct 2018 13:12:00 +0200
+Subject: lightnvm: pblk: fix two sleep-in-atomic-context bugs
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 7325b4bbe5952e3e939f15de812f2ee0c0d33ca9 ]
+
+The driver may sleep with holding a spinlock.
+
+The function call paths (from bottom to top) in Linux-4.16 are:
+
+[FUNC] nvm_dev_dma_alloc(GFP_KERNEL)
+drivers/lightnvm/pblk-core.c, 754:
+ nvm_dev_dma_alloc in pblk_line_submit_smeta_io
+drivers/lightnvm/pblk-core.c, 1048:
+ pblk_line_submit_smeta_io in pblk_line_init_bb
+drivers/lightnvm/pblk-core.c, 1434:
+ pblk_line_init_bb in pblk_line_replace_data
+drivers/lightnvm/pblk-recovery.c, 980:
+ pblk_line_replace_data in pblk_recov_l2p
+drivers/lightnvm/pblk-recovery.c, 976:
+ spin_lock in pblk_recov_l2p
+
+[FUNC] bio_map_kern(GFP_KERNEL)
+drivers/lightnvm/pblk-core.c, 762:
+ bio_map_kern in pblk_line_submit_smeta_io
+drivers/lightnvm/pblk-core.c, 1048:
+ pblk_line_submit_smeta_io in pblk_line_init_bb
+drivers/lightnvm/pblk-core.c, 1434:
+ pblk_line_init_bb in pblk_line_replace_data
+drivers/lightnvm/pblk-recovery.c, 980:
+ pblk_line_replace_data in pblk_recov_l2p
+drivers/lightnvm/pblk-recovery.c, 976:
+ spin_lock in pblk_recov_l2p
+
+To fix these bugs, the call to pblk_line_replace_data()
+is moved out of the spinlock protection.
+
+These bugs are found by my static analysis tool DSAC.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Javier González <javier@cnexlabs.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/lightnvm/pblk-recovery.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/lightnvm/pblk-recovery.c
++++ b/drivers/lightnvm/pblk-recovery.c
+@@ -956,12 +956,14 @@ next:
+ }
+ }
+
+- spin_lock(&l_mg->free_lock);
+ if (!open_lines) {
++ spin_lock(&l_mg->free_lock);
+ WARN_ON_ONCE(!test_and_clear_bit(meta_line,
+ &l_mg->meta_bitmap));
++ spin_unlock(&l_mg->free_lock);
+ pblk_line_replace_data(pblk);
+ } else {
++ spin_lock(&l_mg->free_lock);
+ /* Allocate next line for preparation */
+ l_mg->data_next = pblk_line_get(pblk);
+ if (l_mg->data_next) {
+@@ -969,8 +971,8 @@ next:
+ l_mg->data_next->type = PBLK_LINETYPE_DATA;
+ is_next = 1;
+ }
++ spin_unlock(&l_mg->free_lock);
+ }
+- spin_unlock(&l_mg->free_lock);
+
+ if (is_next)
+ pblk_line_erase(pblk, l_mg->data_next);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Waiman Long <longman@redhat.com>
+Date: Thu, 18 Oct 2018 21:45:17 -0400
+Subject: locking/lockdep: Fix debug_locks off performance problem
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 9506a7425b094d2f1d9c877ed5a78f416669269b ]
+
+It was found that when debug_locks was turned off because of a problem
+found by the lockdep code, the system performance could drop quite
+significantly when the lock_stat code was also configured into the
+kernel. For instance, parallel kernel build time on a 4-socket x86-64
+server nearly doubled.
+
+Further analysis into the cause of the slowdown traced back to the
+frequent call to debug_locks_off() from the __lock_acquired() function
+probably due to some inconsistent lockdep states with debug_locks
+off. The debug_locks_off() function did an unconditional atomic xchg
+to write a 0 value into debug_locks which had already been set to 0.
+This led to severe cacheline contention in the cacheline that held
+debug_locks. As debug_locks is being referenced in quite a few different
+places in the kernel, this greatly slow down the system performance.
+
+To prevent that trashing of debug_locks cacheline, lock_acquired()
+and lock_contended() now checks the state of debug_locks before
+proceeding. The debug_locks_off() function is also modified to check
+debug_locks before calling __debug_locks_off().
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Link: http://lkml.kernel.org/r/1539913518-15598-1-git-send-email-longman@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c | 4 ++--
+ lib/debug_locks.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -4148,7 +4148,7 @@ void lock_contended(struct lockdep_map *
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+@@ -4168,7 +4168,7 @@ void lock_acquired(struct lockdep_map *l
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+--- a/lib/debug_locks.c
++++ b/lib/debug_locks.c
+@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent);
+ */
+ int debug_locks_off(void)
+ {
+- if (__debug_locks_off()) {
++ if (debug_locks && __debug_locks_off()) {
+ if (!debug_locks_silent) {
+ console_verbose();
+ return 1;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Shaohua Li <shli@fb.com>
+Date: Mon, 1 Oct 2018 18:36:36 -0700
+Subject: MD: fix invalid stored role for a disk
+
+From: Shaohua Li <shli@fb.com>
+
+[ Upstream commit d595567dc4f0c1d90685ec1e2e296e2cad2643ac ]
+
+If we change the number of array's device after device is removed from array,
+then add the device back to array, we can see that device is added as active
+role instead of spare which we expected.
+
+Please see the below link for details:
+https://marc.info/?l=linux-raid&m=153736982015076&w=2
+
+This is caused by that we prefer to use device's previous role which is
+recorded by saved_raid_disk, but we should respect the new number of
+conf->raid_disks since it could be changed after device is removed.
+
+Reported-by: Gioh Kim <gi-oh.kim@profitbricks.com>
+Tested-by: Gioh Kim <gi-oh.kim@profitbricks.com>
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1779,6 +1779,10 @@ static int super_1_validate(struct mddev
+ } else
+ set_bit(In_sync, &rdev->flags);
+ rdev->raid_disk = role;
++ if (role >= mddev->raid_disks) {
++ rdev->saved_raid_disk = -1;
++ rdev->raid_disk = -1;
++ }
+ break;
+ }
+ if (sb->devflags & WriteMostly1)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jack Wang <jinpu.wang@profitbricks.com>
+Date: Fri, 19 Oct 2018 16:21:31 +0200
+Subject: md: fix memleak for mempool
+
+From: Jack Wang <jinpu.wang@profitbricks.com>
+
+[ Upstream commit 6aaa58c994277647f8b05ffef3b9b225a2d08f36 ]
+
+I noticed kmemleak report memory leak when run create/stop
+md in a loop, backtrace:
+[<000000001ca975e7>] mempool_create_node+0x86/0xd0
+[<0000000095576bcd>] md_run+0x1057/0x1410 [md_mod]
+[<000000007b45c5fc>] do_md_run+0x15/0x130 [md_mod]
+[<000000001ede9ec0>] md_ioctl+0x1f49/0x25d0 [md_mod]
+[<000000004142cacf>] blkdev_ioctl+0x680/0xd00
+
+The root cause is we alloc mddev->flush_pool and
+mddev->flush_bio_pool in md_run, but from do_md_stop
+will not call into md_stop but __md_stop, move the
+mempool_destroy to __md_stop fixes the problem for me.
+
+The bug was introduced in 5a409b4f56d5, the fixes should go to
+4.18+
+
+Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios")
+Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
+Reviewed-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5909,14 +5909,6 @@ static void __md_stop(struct mddev *mdde
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+-}
+-
+-void md_stop(struct mddev *mddev)
+-{
+- /* stop the array and free an attached data structures.
+- * This is called from dm-raid
+- */
+- __md_stop(mddev);
+ if (mddev->flush_bio_pool) {
+ mempool_destroy(mddev->flush_bio_pool);
+ mddev->flush_bio_pool = NULL;
+@@ -5925,6 +5917,14 @@ void md_stop(struct mddev *mddev)
+ mempool_destroy(mddev->flush_pool);
+ mddev->flush_pool = NULL;
+ }
++}
++
++void md_stop(struct mddev *mddev)
++{
++ /* stop the array and free an attached data structures.
++ * This is called from dm-raid
++ */
++ __md_stop(mddev);
+ bioset_exit(&mddev->bio_set);
+ bioset_exit(&mddev->sync_set);
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Xiao Ni <xni@redhat.com>
+Date: Sat, 20 Oct 2018 08:09:25 +0800
+Subject: MD: Memory leak when flush bio size is zero
+
+From: Xiao Ni <xni@redhat.com>
+
+[ Upstream commit af9b926de9c5986ab009e64917de87c9758bab10 ]
+
+flush_pool is leaked when flush bio size is zero
+
+Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios")
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Signed-off-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -455,10 +455,11 @@ static void md_end_flush(struct bio *fbi
+ rdev_dec_pending(rdev, mddev);
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -512,10 +513,11 @@ void md_flush_request(struct mddev *mdde
+ rcu_read_unlock();
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Sun, 9 Sep 2018 22:48:58 +0200
+Subject: mfd: menelaus: Fix possible race condition and leak
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 9612f8f503804d2fd2f63aa6ba1e58bba4612d96 ]
+
+The IRQ work is added before the struct rtc is allocated and registered,
+but this struct is used in the IRQ handler. This may lead to a NULL pointer
+dereference.
+
+Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc
+before calling menelaus_add_irq_work.
+
+Also, this solves a possible leak as the RTC is never released.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mfd/menelaus.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/mfd/menelaus.c
++++ b/drivers/mfd/menelaus.c
+@@ -1094,6 +1094,7 @@ static void menelaus_rtc_alarm_work(stru
+ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ {
+ int alarm = (m->client->irq > 0);
++ int err;
+
+ /* assume 32KDETEN pin is pulled high */
+ if (!(menelaus_read_reg(MENELAUS_OSC_CTRL) & 0x80)) {
+@@ -1101,6 +1102,12 @@ static inline void menelaus_rtc_init(str
+ return;
+ }
+
++ m->rtc = devm_rtc_allocate_device(&m->client->dev);
++ if (IS_ERR(m->rtc))
++ return;
++
++ m->rtc->ops = &menelaus_rtc_ops;
++
+ /* support RTC alarm; it can issue wakeups */
+ if (alarm) {
+ if (menelaus_add_irq_work(MENELAUS_RTCALM_IRQ,
+@@ -1125,10 +1132,8 @@ static inline void menelaus_rtc_init(str
+ menelaus_write_reg(MENELAUS_RTC_CTRL, m->rtc_control);
+ }
+
+- m->rtc = rtc_device_register(DRIVER_NAME,
+- &m->client->dev,
+- &menelaus_rtc_ops, THIS_MODULE);
+- if (IS_ERR(m->rtc)) {
++ err = rtc_register_device(m->rtc);
++ if (err) {
+ if (alarm) {
+ menelaus_remove_irq_work(MENELAUS_RTCALM_IRQ);
+ device_init_wakeup(&m->client->dev, 0);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Yu Zhao <yuzhao@google.com>
+Date: Sun, 23 Sep 2018 14:39:24 -0600
+Subject: mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
+
+From: Yu Zhao <yuzhao@google.com>
+
+[ Upstream commit 5169894982bb67486d93cc1e10151712bb86bcb6 ]
+
+This device reports SDHCI_CLOCK_INT_STABLE even though it's not
+ready to take SDHCI_CLOCK_CARD_EN. The symptom is that reading
+SDHCI_CLOCK_CONTROL after enabling the clock shows absence of the
+bit from the register (e.g. expecting 0x0000fa07 = 0x0000fa03 |
+SDHCI_CLOCK_CARD_EN but only observed the first operand).
+
+mmc1: Timeout waiting for hardware cmd interrupt.
+mmc1: sdhci: ============ SDHCI REGISTER DUMP ===========
+mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00000603
+mmc1: sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000
+mmc1: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000
+mmc1: sdhci: Present: 0x01ff0001 | Host ctl: 0x00000001
+mmc1: sdhci: Power: 0x0000000f | Blk gap: 0x00000000
+mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x0000fa03
+mmc1: sdhci: Timeout: 0x00000000 | Int stat: 0x00000000
+mmc1: sdhci: Int enab: 0x00ff0083 | Sig enab: 0x00ff0083
+mmc1: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000
+mmc1: sdhci: Caps: 0x25fcc8bf | Caps_1: 0x00002077
+mmc1: sdhci: Cmd: 0x00000000 | Max curr: 0x005800c8
+mmc1: sdhci: Resp[0]: 0x00000000 | Resp[1]: 0x00000000
+mmc1: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000000
+mmc1: sdhci: Host ctl2: 0x00000008
+mmc1: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000
+mmc1: sdhci: ============================================
+
+The problem happens during wakeup from S3. Adding a delay quirk
+after power up reliably fixes the problem.
+
+Signed-off-by: Yu Zhao <yuzhao@google.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-pci-o2micro.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -367,6 +367,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+ case PCI_DEVICE_ID_O2_SEABIRD0:
++ if (chip->pdev->revision == 0x01)
++ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER;
++ /* fall through */
+ case PCI_DEVICE_ID_O2_SEABIRD1:
+ /* UnLock WP */
+ ret = pci_read_config_byte(chip->pdev,
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Sep 2018 08:55:55 -0500
+Subject: mtd: rawnand: atmel: Fix potential NULL pointer dereference
+
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+
+[ Upstream commit fbed20280d912449cfb40c382cb55e3d11502587 ]
+
+There is a potential execution path in which function
+of_find_compatible_node() returns NULL. In such a case,
+we end up having a NULL pointer dereference when accessing
+pointer *nfc_np* in function of_clk_get().
+
+So, we better don't take any chances and fix this by null
+checking pointer *nfc_np* before calling of_clk_get().
+
+Addresses-Coverity-ID: 1473052 ("Dereference null return value")
+Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2081,6 +2081,10 @@ atmel_hsmc_nand_controller_legacy_init(s
+ nand_np = dev->of_node;
+ nfc_np = of_find_compatible_node(dev->of_node, NULL,
+ "atmel,sama5d3-nfc");
++ if (!nfc_np) {
++ dev_err(dev, "Could not find device node for sama5d3-nfc\n");
++ return -ENODEV;
++ }
+
+ nc->clk = of_clk_get(nfc_np, 0);
+ if (IS_ERR(nc->clk)) {
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Fri, 28 Sep 2018 13:16:01 +0900
+Subject: mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 0d55c668b218a1db68b5044bce4de74e1bd0f0c8 ]
+
+NAND devices need additional data area (OOB) for error correction,
+but it is also used for Bad Block Marker (BBM). In many cases, the
+first byte in OOB is used for BBM, but the location actually depends
+on chip vendors. The NAND controller should preserve the precious
+BBM to keep track of bad blocks.
+
+In Denali IP, the SPARE_AREA_SKIP_BYTES register is used to specify
+the number of bytes to skip from the start of OOB. The ECC engine
+will automatically skip the specified number of bytes when it gets
+access to OOB area.
+
+The same value for SPARE_AREA_SKIP_BYTES should be used between
+firmware and the operating system if you intend to use the NAND
+device across the control hand-off.
+
+In fact, the current denali.c code expects firmware to have already
+set the SPARE_AREA_SKIP_BYTES register, then reads the value out.
+
+If no firmware (or bootloader) has initialized the controller, the
+register value is zero, which is the default after power-on-reset.
+In other words, the Linux driver cannot initialize the controller
+by itself.
+
+Some possible solutions are:
+
+ [1] Add a DT property to specify the skipped bytes in OOB
+ [2] Associate the preferred value with compatible
+ [3] Hard-code the default value in the driver
+
+My first attempt was [1], but in the review process, [3] was suggested
+as a counter-implementation.
+(https://lore.kernel.org/patchwork/patch/983055/)
+
+The default value 8 was chosen to match to the boot ROM of the UniPhier
+platform. The preferred value may vary by platform. If so, please
+trade up to a different solution.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/denali.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/raw/denali.c
++++ b/drivers/mtd/nand/raw/denali.c
+@@ -28,6 +28,7 @@
+ MODULE_LICENSE("GPL");
+
+ #define DENALI_NAND_NAME "denali-nand"
++#define DENALI_DEFAULT_OOB_SKIP_BYTES 8
+
+ /* for Indexed Addressing */
+ #define DENALI_INDEXED_CTRL 0x00
+@@ -1106,12 +1107,17 @@ static void denali_hw_init(struct denali
+ denali->revision = swab16(ioread32(denali->reg + REVISION));
+
+ /*
+- * tell driver how many bit controller will skip before
+- * writing ECC code in OOB, this register may be already
+- * set by firmware. So we read this value out.
+- * if this value is 0, just let it be.
++ * Set how many bytes should be skipped before writing data in OOB.
++ * If a non-zero value has already been set (by firmware or something),
++ * just use it. Otherwise, set the driver default.
+ */
+ denali->oob_skip_bytes = ioread32(denali->reg + SPARE_AREA_SKIP_BYTES);
++ if (!denali->oob_skip_bytes) {
++ denali->oob_skip_bytes = DENALI_DEFAULT_OOB_SKIP_BYTES;
++ iowrite32(denali->oob_skip_bytes,
++ denali->reg + SPARE_AREA_SKIP_BYTES);
++ }
++
+ denali_detect_max_banks(denali);
+ iowrite32(0x0F, denali->reg + RB_PIN_ENABLED);
+ iowrite32(CHIP_EN_DONT_CARE__FLAG, denali->reg + CHIP_ENABLE_DONT_CARE);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Sun, 2 Sep 2018 18:13:14 +0200
+Subject: net: dsa: mv88e6xxx: Fix writing to a PHY page.
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit c309b158090d788e96ee597444965cb79b040484 ]
+
+After changing to the needed page, actually write the value to the
+register!
+
+Fixes: 09cb7dfd3f14 ("net: dsa: mv88e6xxx: describe PHY page and SerDes")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/mv88e6xxx/phy.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/dsa/mv88e6xxx/phy.c
++++ b/drivers/net/dsa/mv88e6xxx/phy.c
+@@ -110,6 +110,9 @@ int mv88e6xxx_phy_page_write(struct mv88
+ err = mv88e6xxx_phy_page_get(chip, phy, page);
+ if (!err) {
+ err = mv88e6xxx_phy_write(chip, phy, MV88E6XXX_PHY_PAGE, page);
++ if (!err)
++ err = mv88e6xxx_phy_write(chip, phy, reg, val);
++
+ mv88e6xxx_phy_page_put(chip, phy);
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Date: Mon, 22 Oct 2018 21:51:36 +0300
+Subject: net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode
+
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+
+[ Upstream commit 9737cc99dd14b5b8b9d267618a6061feade8ea68 ]
+
+After flushing all mcast entries from the table, the ones contained in
+mc list of ndev are not restored when promisc mode is toggled off,
+because they are considered as synched with ALE, thus, in order to
+restore them after promisc mode - reset syncing info. This fix
+touches only switch mode devices, including single port boards
+like Beagle Bone.
+
+Fixes: commit 5da1948969bc
+("net: ethernet: ti: cpsw: fix lost of mcast packets while rx_mode update")
+
+Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ti/cpsw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -641,6 +641,7 @@ static void cpsw_set_promiscious(struct
+
+ /* Clear all mcast from ALE */
+ cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS, -1);
++ __dev_mc_unsync(ndev, NULL);
+
+ /* Flood All Unicast Packets to Host port */
+ cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jian Shen <shenjian15@huawei.com>
+Date: Fri, 21 Sep 2018 16:41:43 +0100
+Subject: net: hns3: Add nic state check before calling netif_tx_wake_queue
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit 7a8101109dd37837f587cd56f3111d4fc17a07f5 ]
+
+When nic down, it firstly calls netif_tx_stop_all_queues(), then calls
+napi_disable(). But napi_disable() will wait current napi_poll finish,
+it may call netif_tx_wake_queue(). This patch fixes it by add nic state
+checking.
+
+Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1907,6 +1907,7 @@ static int is_valid_clean_head(struct hn
+ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ {
+ struct net_device *netdev = ring->tqp->handle->kinfo.netdev;
++ struct hns3_nic_priv *priv = netdev_priv(netdev);
+ struct netdev_queue *dev_queue;
+ int bytes, pkts;
+ int head;
+@@ -1953,7 +1954,8 @@ bool hns3_clean_tx_ring(struct hns3_enet
+ * sees the new next_to_clean.
+ */
+ smp_mb();
+- if (netif_tx_queue_stopped(dev_queue)) {
++ if (netif_tx_queue_stopped(dev_queue) &&
++ !test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+ netif_tx_wake_queue(dev_queue);
+ ring->stats.restart_queue++;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Peng Li <lipeng321@huawei.com>
+Date: Wed, 19 Sep 2018 18:29:53 +0100
+Subject: net: hns3: Check hdev state when getting link status
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit 582d37bbb613b8ad86bf82845d3a74a02a5a0fa1 ]
+
+By default, HW link status is up. If hclge_update_link_status is called
+before net up, driver will print "link up". It is not suitable. hdev
+state check is needed when getting link status.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2398,6 +2398,9 @@ static int hclge_get_mac_phy_link(struct
+ int mac_state;
+ int link_stat;
+
++ if (test_bit(HCLGE_STATE_DOWN, &hdev->state))
++ return 0;
++
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -299,6 +299,9 @@ void hclgevf_update_link_status(struct h
+
+ client = handle->client;
+
++ link_state =
++ test_bit(HCLGEVF_STATE_DOWN, &hdev->state) ? 0 : link_state;
++
+ if (link_state != hdev->hw.mac.link) {
+ client->ops->link_status_change(handle, !!link_state);
+ hdev->hw.mac.link = link_state;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jian Shen <shenjian15@huawei.com>
+Date: Fri, 21 Sep 2018 16:41:37 +0100
+Subject: net: hns3: Fix ets validate issue
+
+From: Jian Shen <shenjian15@huawei.com>
+
+[ Upstream commit adefc0a2ff465f4ac4a88450fe69d336c8b074c5 ]
+
+There is a defect in hclge_ets_validate(). If each member of tc_tsa is
+not IEEE_8021QAZ_TSA_ETS, the variable total_ets_bw won't be updated.
+In this case, the check for value of total_ets_bw will fail. This patch
+fixes it by checking total_ets_bw only after it has been updated.
+
+Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
+Signed-off-by: Jian Shen <shenjian15@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -79,6 +79,7 @@ static int hclge_ieee_getets(struct hnae
+ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ u8 *tc, bool *changed)
+ {
++ bool has_ets_tc = false;
+ u32 total_ets_bw = 0;
+ u8 max_tc = 0;
+ u8 i;
+@@ -106,13 +107,14 @@ static int hclge_ets_validate(struct hcl
+ *changed = true;
+
+ total_ets_bw += ets->tc_tx_bw[i];
+- break;
++ has_ets_tc = true;
++ break;
+ default:
+ return -EINVAL;
+ }
+ }
+
+- if (total_ets_bw != BW_PERCENT)
++ if (has_ets_tc && total_ets_bw != BW_PERCENT)
+ return -EINVAL;
+
+ *tc = max_tc + 1;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Wed, 26 Sep 2018 19:28:36 +0100
+Subject: net: hns3: Fix for packet buffer setting bug
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 996ff91840eb6f288826e472685abde78bac20ea ]
+
+The hardware expects a unit of 128 bytes when setting
+packet buffer. When calculating the packet buffer size,
+hclge_rx_buffer_calc does not round up the size as a unit
+of 128 byte, which may casue packet lost problem when stress
+testing.
+
+This patch fixes it by rounding up packet size when calculating.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -1669,11 +1669,13 @@ static int hclge_tx_buffer_calc(struct h
+ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ struct hclge_pkt_buf_alloc *buf_alloc)
+ {
+- u32 rx_all = hdev->pkt_buf_size;
++#define HCLGE_BUF_SIZE_UNIT 128
++ u32 rx_all = hdev->pkt_buf_size, aligned_mps;
+ int no_pfc_priv_num, pfc_priv_num;
+ struct hclge_priv_buf *priv;
+ int i;
+
++ aligned_mps = round_up(hdev->mps, HCLGE_BUF_SIZE_UNIT);
+ rx_all -= hclge_get_tx_buff_alloced(buf_alloc);
+
+ /* When DCB is not supported, rx private
+@@ -1692,13 +1694,13 @@ static int hclge_rx_buffer_calc(struct h
+ if (hdev->hw_tc_map & BIT(i)) {
+ priv->enable = 1;
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+- priv->wl.low = hdev->mps;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.low = aligned_mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high +
+ HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = 2 * hdev->mps;
++ priv->wl.high = 2 * aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ } else {
+@@ -1730,11 +1732,11 @@ static int hclge_rx_buffer_calc(struct h
+
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+ priv->wl.low = 128;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high + HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = hdev->mps;
++ priv->wl.high = aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Mon, 3 Sep 2018 11:21:46 +0100
+Subject: net: hns3: Fix for vf vlan delete failed problem
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 41dafea2af781d8e3ab8626d236b52e4172905a3 ]
+
+There are only 128 entries in vf vlan table, if user has added
+more than 128 vlan, fw will ignore it and disable the vf vlan
+table. So when user deletes the vlan entry that has not been
+set to vf vlan table, fw will return not found result and driver
+treat that as error, which will cause vlan delete failed problem.
+
+This patch fixes it by returning ok when fw returns not found
+result.
+
+Fixes: 6c251711b37f ("net: hns3: Disable vf vlan filter when vf vlan table is full")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4686,9 +4686,17 @@ static int hclge_set_vf_vlan_common(stru
+ "Add vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+ } else {
++#define HCLGE_VF_VLAN_DEL_NO_FOUND 1
+ if (!req0->resp_code)
+ return 0;
+
++ if (req0->resp_code == HCLGE_VF_VLAN_DEL_NO_FOUND) {
++ dev_warn(&hdev->pdev->dev,
++ "vlan %d filter is not in vf vlan table\n",
++ vlan);
++ return 0;
++ }
++
+ dev_err(&hdev->pdev->dev,
+ "Kill vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Mon, 3 Sep 2018 11:21:51 +0100
+Subject: net: hns3: Fix ping exited problem when doing lp selftest
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 3f8601f0f5716c4e63a9f215bbc581df42859d61 ]
+
+When ping is runnig and user executes the loopback selftest, the
+ping cmd will stop and exit.
+
+This patch fixes it by using the hns3_nic_net_open/stop to offline
+the netdev when doing loopback selftest.
+
+Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -310,7 +310,7 @@ static void hns3_self_test(struct net_de
+ h->flags & HNAE3_SUPPORT_MAC_LOOPBACK;
+
+ if (if_running)
+- dev_close(ndev);
++ ndev->netdev_ops->ndo_stop(ndev);
+
+ #if IS_ENABLED(CONFIG_VLAN_8021Q)
+ /* Disable the vlan filter for selftest does not support it */
+@@ -348,7 +348,7 @@ static void hns3_self_test(struct net_de
+ #endif
+
+ if (if_running)
+- dev_open(ndev);
++ ndev->netdev_ops->ndo_open(ndev);
+ }
+
+ static int hns3_get_sset_count(struct net_device *netdev, int stringset)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Mon, 3 Sep 2018 11:21:52 +0100
+Subject: net: hns3: Preserve vlan 0 in hardware table
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit daaa8521760ee4d4e65f309c4c37b3a1e58c9d4e ]
+
+When netdev is down, the stack will delete the vlan from
+hardware including vlan0, which will cause problem when
+doing loopback selftest when netdev is down.
+
+This patch fixes it by always preserving vlan 0 in hardware,
+because vlan 0 is defalut vlan, which should always be in
+hardware.
+
+Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -4732,6 +4732,9 @@ static int hclge_set_vlan_filter_hw(stru
+ u16 vport_idx, vport_num = 0;
+ int ret;
+
++ if (is_kill && !vlan_id)
++ return 0;
++
+ ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id,
+ 0, proto);
+ if (ret) {
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Fuyun Liang <liangfuyun1@huawei.com>
+Date: Wed, 19 Sep 2018 18:29:52 +0100
+Subject: net: hns3: Set STATE_DOWN bit of hdev state when stopping net
+
+From: Fuyun Liang <liangfuyun1@huawei.com>
+
+[ Upstream commit 2f7e489611bc685b8e00aba436032a8aac6cac57 ]
+
+We clear STATE_DOWN bit of hdev state when starting net, but do not set
+it again when stopping net. It causes that the net is down, but hdev state
+is still up. STATE_DOWN bit of hdev state should be set when stopping net.
+
+Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
+Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
+Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -3794,6 +3794,8 @@ static void hclge_ae_stop(struct hnae3_h
+ struct hclge_dev *hdev = vport->back;
+ int i;
+
++ set_bit(HCLGE_STATE_DOWN, &hdev->state);
++
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
+ clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -1442,6 +1442,8 @@ static void hclgevf_ae_stop(struct hnae3
+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+ int i, queue_id;
+
++ set_bit(HCLGEVF_STATE_DOWN, &hdev->state);
++
+ for (i = 0; i < hdev->num_tqps; i++) {
+ /* Ring disable */
+ queue_id = hclgevf_get_queue_id(handle->kinfo.tqp[i]);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+Date: Wed, 19 Sep 2018 11:39:31 +0200
+Subject: net: phy: phylink: ensure the carrier is off when starting phylink
+
+From: Antoine Tenart <antoine.tenart@bootlin.com>
+
+[ Upstream commit aeeb2e8fdefdd5d257a1446351c70cb3df540199 ]
+
+Phylink made an assumption about the carrier state being down when
+calling phylink_start(). If this assumption isn't satisfied, the
+internal phylink state could misbehave and a net device could end up not
+being functional.
+
+This patch fixes this by explicitly calling netif_carrier_off() in
+phylink_start().
+
+Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
+Acked-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phylink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -907,6 +907,9 @@ void phylink_start(struct phylink *pl)
+ phylink_an_mode_str(pl->link_an_mode),
+ phy_modes(pl->link_config.interface));
+
++ /* Always set the carrier off */
++ netif_carrier_off(pl->netdev);
++
+ /* Apply the link configuration to the MAC when starting. This allows
+ * a fixed-link to start with the correct parameters, and also
+ * ensures that we set the appropriate advertisement for Serdes links.
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Fri, 12 Oct 2018 19:14:58 -0700
+Subject: net: qla3xxx: Remove overflowing shift statement
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8c3bf9b62b667456a57aefcf1689e826df146159 ]
+
+Clang currently warns:
+
+drivers/net/ethernet/qlogic/qla3xxx.c:384:24: warning: signed shift
+result (0xF00000000) requires 37 bits to represent, but 'int' only has
+32 bits [-Wshift-overflow]
+ ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
+ ~~~~~~~~~~~~~~ ^ ~~
+1 warning generated.
+
+The warning is certainly accurate since ISP_NVRAM_MASK is defined as
+(0x000F << 16) which is then shifted by 16, resulting in 64424509440,
+well above UINT_MAX.
+
+Given that this is the only location in this driver where ISP_NVRAM_MASK
+is shifted again, it seems likely that ISP_NVRAM_MASK was originally
+defined without a shift and during the move of the shift to the
+definition, this statement wasn't properly removed (since ISP_NVRAM_MASK
+is used in the statenent right above this). Only the maintainers can
+confirm this since this statment has been here since the driver was
+first added to the kernel.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/127
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qla3xxx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -380,8 +380,6 @@ static void fm93c56a_select(struct ql3_a
+
+ qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1;
+ ql_write_nvram_reg(qdev, spir, ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
+- ql_write_nvram_reg(qdev, spir,
+- ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
+ }
+
+ /*
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Masahisa Kojima <masahisa.kojima@linaro.org>
+Date: Tue, 23 Oct 2018 20:24:28 +0900
+Subject: net: socionext: Reset tx queue in ndo_stop
+
+From: Masahisa Kojima <masahisa.kojima@linaro.org>
+
+[ Upstream commit 8d5b0bf611ec5b7618d5b772dddc93b8afa78cb8 ]
+
+We observed that packets and bytes count are not reset
+when user performs interface down. Eventually, tx queue is
+exhausted and packets will not be sent out.
+To avoid this problem, resets tx queue in ndo_stop.
+
+Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver")
+Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
+Signed-off-by: Yoshitoyo Osaki <osaki.yoshitoyo@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/socionext/netsec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -945,6 +945,9 @@ static void netsec_uninit_pkt_dring(stru
+ dring->head = 0;
+ dring->tail = 0;
+ dring->pkt_cnt = 0;
++
++ if (id == NETSEC_RING_TX)
++ netdev_reset_queue(priv->ndev);
+ }
+
+ static void netsec_free_dring(struct netsec_priv *priv, int id)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:51 +0200
+Subject: net: stmmac: dwmac-sun8i: fix OF child-node lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit ac63043d8cb5503c7e0fe110f947eacf2663804e ]
+
+Use the new of_get_compatible_child() helper to lookup the mdio-internal
+child node instead of using of_find_compatible_node(), which searches
+the entire tree from a given start node and thus can return an unrelated
+(i.e. non-child) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the mdio-mux node). Fortunately, this was inadvertently
+balanced by a failure to drop the mdio-mux reference after lookup.
+
+While at it, also fix the related mdio-internal- and phy-node reference
+leaks.
+
+Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs")
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Jose Abreu <joabreu@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -714,8 +714,9 @@ static int get_ephy_nodes(struct stmmac_
+ return -ENODEV;
+ }
+
+- mdio_internal = of_find_compatible_node(mdio_mux, NULL,
++ mdio_internal = of_get_compatible_child(mdio_mux,
+ "allwinner,sun8i-h3-mdio-internal");
++ of_node_put(mdio_mux);
+ if (!mdio_internal) {
+ dev_err(priv->device, "Cannot get internal_mdio node\n");
+ return -ENODEV;
+@@ -729,13 +730,20 @@ static int get_ephy_nodes(struct stmmac_
+ gmac->rst_ephy = of_reset_control_get_exclusive(iphynode, NULL);
+ if (IS_ERR(gmac->rst_ephy)) {
+ ret = PTR_ERR(gmac->rst_ephy);
+- if (ret == -EPROBE_DEFER)
++ if (ret == -EPROBE_DEFER) {
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return ret;
++ }
+ continue;
+ }
+ dev_info(priv->device, "Found internal PHY node\n");
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return 0;
+ }
++
++ of_node_put(mdio_internal);
+ return -ENODEV;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Tue, 16 Oct 2018 16:52:05 +0200
+Subject: netfilter: xt_nat: fix DNAT target for shifted portmap ranges
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+[ Upstream commit cb20f2d2c0507d60d94ef896991e95708f051dd1 ]
+
+The commit 2eb0f624b709 ("netfilter: add NAT support for shifted
+portmap ranges") did not set the checkentry/destroy callbacks for
+the newly added DNAT target. As a result, rulesets using only
+such nat targets are not effective, as the relevant conntrack hooks
+are not enabled.
+The above affect also nft_compat rulesets.
+Fix the issue adding the missing initializers.
+
+Fixes: 2eb0f624b709 ("netfilter: add NAT support for shifted portmap ranges")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netfilter/xt_nat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/netfilter/xt_nat.c
++++ b/net/netfilter/xt_nat.c
+@@ -216,6 +216,8 @@ static struct xt_target xt_nat_target_re
+ {
+ .name = "DNAT",
+ .revision = 2,
++ .checkentry = xt_nat_checkentry,
++ .destroy = xt_nat_destroy,
+ .target = xt_dnat_target_v2,
+ .targetsize = sizeof(struct nf_nat_range2),
+ .table = "nat",
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Ryan C Goodfellow <rgoodfel@isi.edu>
+Date: Fri, 12 Oct 2018 11:09:01 -0700
+Subject: nfp: devlink port split support for 1x100G CXP NIC
+
+From: Ryan C Goodfellow <rgoodfel@isi.edu>
+
+[ Upstream commit 5948185b97fa1f83d7855e638a72982a1073ebf5 ]
+
+This commit makes it possible to use devlink to split the 100G CXP
+Netronome into two 40G interfaces. Currently when you ask for 2
+interfaces, the math in src/nfp_devlink.c:nfp_devlink_port_split
+calculates that you want 5 lanes per port because for some reason
+eth_port.port_lanes=10 (shouldn't this be 12 for CXP?). What we really
+want when asking for 2 breakout interfaces is 4 lanes per port. This
+commit makes that happen by calculating based on 8 lanes if 10 are
+present.
+
+Signed-off-by: Ryan C Goodfellow <rgoodfel@isi.edu>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Greg Weeks <greg.weeks@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+@@ -96,6 +96,7 @@ nfp_devlink_port_split(struct devlink *d
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ if (count < 2)
+@@ -114,8 +115,12 @@ nfp_devlink_port_split(struct devlink *d
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index,
+- eth_port.port_lanes / count);
++ /* Special case the 100G CXP -> 2x40G split */
++ lanes = eth_port.port_lanes / count;
++ if (eth_port.lanes == 10 && count == 2)
++ lanes = 8 / count;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+@@ -128,6 +133,7 @@ nfp_devlink_port_unsplit(struct devlink
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ mutex_lock(&pf->lock);
+@@ -143,7 +149,12 @@ nfp_devlink_port_unsplit(struct devlink
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index, eth_port.port_lanes);
++ /* Special case the 100G CXP -> 2x40G unsplit */
++ lanes = eth_port.port_lanes;
++ if (eth_port.port_lanes == 8)
++ lanes = 10;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Date: Mon, 15 Oct 2018 16:52:23 -0700
+Subject: nfp: flower: fix pedit set actions for multiple partial masks
+
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+
+[ Upstream commit 8913806f166e47c6b3fe8253e9cfb9caabe64341 ]
+
+Previously we did not correctly change headers when using multiple
+pedit actions with partial masks. We now take this into account and
+no longer just commit the last pedit action.
+
+Fixes: c0b1bd9a8b8a ("nfp: add set ipv4 header action flower offload")
+Signed-off-by: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/action.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
+@@ -314,12 +314,14 @@ nfp_fl_set_ip4(const struct tc_action *a
+
+ switch (off) {
+ case offsetof(struct iphdr, daddr):
+- set_ip_addr->ipv4_dst_mask = mask;
+- set_ip_addr->ipv4_dst = exact;
++ set_ip_addr->ipv4_dst_mask |= mask;
++ set_ip_addr->ipv4_dst &= ~mask;
++ set_ip_addr->ipv4_dst |= exact & mask;
+ break;
+ case offsetof(struct iphdr, saddr):
+- set_ip_addr->ipv4_src_mask = mask;
+- set_ip_addr->ipv4_src = exact;
++ set_ip_addr->ipv4_src_mask |= mask;
++ set_ip_addr->ipv4_src &= ~mask;
++ set_ip_addr->ipv4_src |= exact & mask;
+ break;
+ default:
+ return -EOPNOTSUPP;
+@@ -336,8 +338,9 @@ static void
+ nfp_fl_set_ip6_helper(int opcode_tag, int idx, __be32 exact, __be32 mask,
+ struct nfp_fl_set_ipv6_addr *ip6)
+ {
+- ip6->ipv6[idx % 4].mask = mask;
+- ip6->ipv6[idx % 4].exact = exact;
++ ip6->ipv6[idx % 4].mask |= mask;
++ ip6->ipv6[idx % 4].exact &= ~mask;
++ ip6->ipv6[idx % 4].exact |= exact & mask;
+
+ ip6->reserved = cpu_to_be16(0);
+ ip6->head.jump_id = opcode_tag;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Date: Mon, 15 Oct 2018 16:52:25 -0700
+Subject: nfp: flower: use offsets provided by pedit instead of index for ipv6
+
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+
+[ Upstream commit 140b6abac26d799f75d772ab5e969b34ad8d68f1 ]
+
+Previously when populating the set ipv6 address action, we incorrectly
+made use of pedit's key index to determine which 32bit word should be
+set. We now calculate which word has been selected based on the offset
+provided by the pedit action.
+
+Fixes: 354b82bb320e ("nfp: add set ipv6 source and destination address")
+Signed-off-by: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/action.c | 26 ++++++++++++---------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
+@@ -335,12 +335,12 @@ nfp_fl_set_ip4(const struct tc_action *a
+ }
+
+ static void
+-nfp_fl_set_ip6_helper(int opcode_tag, int idx, __be32 exact, __be32 mask,
++nfp_fl_set_ip6_helper(int opcode_tag, u8 word, __be32 exact, __be32 mask,
+ struct nfp_fl_set_ipv6_addr *ip6)
+ {
+- ip6->ipv6[idx % 4].mask |= mask;
+- ip6->ipv6[idx % 4].exact &= ~mask;
+- ip6->ipv6[idx % 4].exact |= exact & mask;
++ ip6->ipv6[word].mask |= mask;
++ ip6->ipv6[word].exact &= ~mask;
++ ip6->ipv6[word].exact |= exact & mask;
+
+ ip6->reserved = cpu_to_be16(0);
+ ip6->head.jump_id = opcode_tag;
+@@ -353,6 +353,7 @@ nfp_fl_set_ip6(const struct tc_action *a
+ struct nfp_fl_set_ipv6_addr *ip_src)
+ {
+ __be32 exact, mask;
++ u8 word;
+
+ /* We are expecting tcf_pedit to return a big endian value */
+ mask = (__force __be32)~tcf_pedit_mask(action, idx);
+@@ -361,17 +362,20 @@ nfp_fl_set_ip6(const struct tc_action *a
+ if (exact & ~mask)
+ return -EOPNOTSUPP;
+
+- if (off < offsetof(struct ipv6hdr, saddr))
++ if (off < offsetof(struct ipv6hdr, saddr)) {
+ return -EOPNOTSUPP;
+- else if (off < offsetof(struct ipv6hdr, daddr))
+- nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, idx,
++ } else if (off < offsetof(struct ipv6hdr, daddr)) {
++ word = (off - offsetof(struct ipv6hdr, saddr)) / sizeof(exact);
++ nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, word,
+ exact, mask, ip_src);
+- else if (off < offsetof(struct ipv6hdr, daddr) +
+- sizeof(struct in6_addr))
+- nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, idx,
++ } else if (off < offsetof(struct ipv6hdr, daddr) +
++ sizeof(struct in6_addr)) {
++ word = (off - offsetof(struct ipv6hdr, daddr)) / sizeof(exact);
++ nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, word,
+ exact, mask, ip_dst);
+- else
++ } else {
+ return -EOPNOTSUPP;
++ }
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Keith Busch <keith.busch@intel.com>
+Date: Fri, 5 Oct 2018 08:57:06 -0600
+Subject: nvme: remove ns sibling before clearing path
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit 48f78be3326052a7718678ff9a78d6d884a50323 ]
+
+The code had been clearing a namespace being deleted as the current
+path while that namespace was still in the path siblings list. It is
+possible a new IO could set that namespace back to the current path
+since it appeared to be an eligable path to select, which may result in
+a use-after-free error.
+
+This patch ensures a namespace being removed is not eligable to be reset
+as a current path prior to clearing it as the current path.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3119,8 +3119,8 @@ static void nvme_ns_remove(struct nvme_n
+ }
+
+ mutex_lock(&ns->ctrl->subsys->lock);
+- nvme_mpath_clear_current_path(ns);
+ list_del_rcu(&ns->siblings);
++ nvme_mpath_clear_current_path(ns);
+ mutex_unlock(&ns->ctrl->subsys->lock);
+
+ down_write(&ns->ctrl->namespaces_rwsem);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Date: Fri, 21 Sep 2018 06:40:07 -0700
+Subject: nvmem: check the return value of nvmem_add_cells()
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit fa72d847d68d7833b77a4bef944cf2c5baf56f49 ]
+
+This function can fail so check its return value in nvmem_register()
+and act accordingly.
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -518,11 +518,17 @@ struct nvmem_device *nvmem_register(cons
+ goto err_device_del;
+ }
+
+- if (config->cells)
+- nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (config->cells) {
++ rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (rval)
++ goto err_teardown_compat;
++ }
+
+ return nvmem;
+
++err_teardown_compat:
++ if (config->compat)
++ device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
+ err_device_del:
+ device_del(&nvmem->dev);
+ err_put_device:
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Thu, 27 Sep 2018 11:00:31 -0700
+Subject: nvmet-rdma: use a private workqueue for delete
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 2acf70ade79d26b97611a8df52eb22aa33814cd4 ]
+
+Queue deletion is done asynchronous when the last reference on the queue
+is dropped. Thus, in order to make sure we don't over allocate under a
+connect/disconnect storm, we let queue deletion complete before making
+forward progress.
+
+However, given that we flush the system_wq from rdma_cm context which
+runs from a workqueue context, we can have a circular locking complaint
+[1]. Fix that by using a private workqueue for queue deletion.
+
+[1]:
+======================================================
+WARNING: possible circular locking dependency detected
+4.19.0-rc4-dbg+ #3 Not tainted
+------------------------------------------------------
+kworker/5:0/39 is trying to acquire lock:
+00000000a10b6db9 (&id_priv->handler_mutex){+.+.}, at: rdma_destroy_id+0x6f/0x440 [rdma_cm]
+
+but task is already holding lock:
+00000000331b4e2c ((work_completion)(&queue->release_work)){+.+.}, at: process_one_work+0x3ed/0xa20
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #3 ((work_completion)(&queue->release_work)){+.+.}:
+ process_one_work+0x474/0xa20
+ worker_thread+0x63/0x5a0
+ kthread+0x1cf/0x1f0
+ ret_from_fork+0x24/0x30
+
+-> #2 ((wq_completion)"events"){+.+.}:
+ flush_workqueue+0xf3/0x970
+ nvmet_rdma_cm_handler+0x133d/0x1734 [nvmet_rdma]
+ cma_ib_req_handler+0x72f/0xf90 [rdma_cm]
+ cm_process_work+0x2e/0x110 [ib_cm]
+ cm_req_handler+0x135b/0x1c30 [ib_cm]
+ cm_work_handler+0x2b7/0x38cd [ib_cm]
+ process_one_work+0x4ae/0xa20
+nvmet_rdma:nvmet_rdma_cm_handler: nvmet_rdma: disconnected (10): status 0 id 0000000040357082
+ worker_thread+0x63/0x5a0
+ kthread+0x1cf/0x1f0
+ ret_from_fork+0x24/0x30
+nvme nvme0: Reconnecting in 10 seconds...
+
+-> #1 (&id_priv->handler_mutex/1){+.+.}:
+ __mutex_lock+0xfe/0xbe0
+ mutex_lock_nested+0x1b/0x20
+ cma_ib_req_handler+0x6aa/0xf90 [rdma_cm]
+ cm_process_work+0x2e/0x110 [ib_cm]
+ cm_req_handler+0x135b/0x1c30 [ib_cm]
+ cm_work_handler+0x2b7/0x38cd [ib_cm]
+ process_one_work+0x4ae/0xa20
+ worker_thread+0x63/0x5a0
+ kthread+0x1cf/0x1f0
+ ret_from_fork+0x24/0x30
+
+-> #0 (&id_priv->handler_mutex){+.+.}:
+ lock_acquire+0xc5/0x200
+ __mutex_lock+0xfe/0xbe0
+ mutex_lock_nested+0x1b/0x20
+ rdma_destroy_id+0x6f/0x440 [rdma_cm]
+ nvmet_rdma_release_queue_work+0x8e/0x1b0 [nvmet_rdma]
+ process_one_work+0x4ae/0xa20
+ worker_thread+0x63/0x5a0
+ kthread+0x1cf/0x1f0
+ ret_from_fork+0x24/0x30
+
+Fixes: 777dc82395de ("nvmet-rdma: occasionally flush ongoing controller teardown")
+Reported-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Tested-by: Bart Van Assche <bvanassche@acm.org>
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/rdma.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -119,6 +119,7 @@ struct nvmet_rdma_device {
+ struct list_head entry;
+ };
+
++struct workqueue_struct *nvmet_rdma_delete_wq;
+ static bool nvmet_rdma_use_srq;
+ module_param_named(use_srq, nvmet_rdma_use_srq, bool, 0444);
+ MODULE_PARM_DESC(use_srq, "Use shared receive queue.");
+@@ -1169,12 +1170,12 @@ static int nvmet_rdma_queue_connect(stru
+
+ if (queue->host_qid == 0) {
+ /* Let inflight controller teardown complete */
+- flush_scheduled_work();
++ flush_workqueue(nvmet_rdma_delete_wq);
+ }
+
+ ret = nvmet_rdma_cm_accept(cm_id, queue, &event->param.conn);
+ if (ret) {
+- schedule_work(&queue->release_work);
++ queue_work(nvmet_rdma_delete_wq, &queue->release_work);
+ /* Destroying rdma_cm id is not needed here */
+ return 0;
+ }
+@@ -1239,7 +1240,7 @@ static void __nvmet_rdma_queue_disconnec
+
+ if (disconnect) {
+ rdma_disconnect(queue->cm_id);
+- schedule_work(&queue->release_work);
++ queue_work(nvmet_rdma_delete_wq, &queue->release_work);
+ }
+ }
+
+@@ -1269,7 +1270,7 @@ static void nvmet_rdma_queue_connect_fai
+ mutex_unlock(&nvmet_rdma_queue_mutex);
+
+ pr_err("failed to connect queue %d\n", queue->idx);
+- schedule_work(&queue->release_work);
++ queue_work(nvmet_rdma_delete_wq, &queue->release_work);
+ }
+
+ /**
+@@ -1543,8 +1544,17 @@ static int __init nvmet_rdma_init(void)
+ if (ret)
+ goto err_ib_client;
+
++ nvmet_rdma_delete_wq = alloc_workqueue("nvmet-rdma-delete-wq",
++ WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS, 0);
++ if (!nvmet_rdma_delete_wq) {
++ ret = -ENOMEM;
++ goto err_unreg_transport;
++ }
++
+ return 0;
+
++err_unreg_transport:
++ nvmet_unregister_transport(&nvmet_rdma_ops);
+ err_ib_client:
+ ib_unregister_client(&nvmet_rdma_ib_client);
+ return ret;
+@@ -1552,6 +1562,7 @@ err_ib_client:
+
+ static void __exit nvmet_rdma_exit(void)
+ {
++ destroy_workqueue(nvmet_rdma_delete_wq);
+ nvmet_unregister_transport(&nvmet_rdma_ops);
+ ib_unregister_client(&nvmet_rdma_ib_client);
+ WARN_ON_ONCE(!list_empty(&nvmet_rdma_queue_list));
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Thu, 27 Sep 2018 16:54:13 -0500
+Subject: PCI / ACPI: Enable wake automatically for power managed bridges
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 6299cf9ec3985cac70bede8a855b5087b81a6640 ]
+
+We enable power management automatically for bridges where
+pci_bridge_d3_possible() returns true. However, these bridges may have
+ACPI methods such as _DSW that need to be called before D3 entry. For
+example in Lenovo Thinkpad X1 Carbon 6th _DSW method is used to prepare
+D3cold for the PCIe root port hosting Thunderbolt chain. Because wake is
+not enabled _DSW method is never called and the port does not enter
+D3cold properly consuming more power than necessary.
+
+Users can work this around by writing "enabled" to "wakeup" sysfs file
+under the device in question but that is not something an ordinary user
+is expected to do.
+
+Since we already automatically enable power management for PCIe ports
+with ->bridge_d3 set extend that to enable wake for them as well,
+assuming the port has any ACPI wakeup related objects implemented in the
+namespace (adev->wakeup.flags.valid is true). This ensures the necessary
+ACPI methods get called at appropriate times and allows the root port in
+Thinkpad X1 Carbon 6th to go into D3cold.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/pci-acpi.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -779,19 +779,33 @@ static void pci_acpi_setup(struct device
+ return;
+
+ device_set_wakeup_capable(dev, true);
++ /*
++ * For bridges that can do D3 we enable wake automatically (as
++ * we do for the power management itself in that case). The
++ * reason is that the bridge may have additional methods such as
++ * _DSW that need to be called.
++ */
++ if (pci_dev->bridge_d3)
++ device_wakeup_enable(dev);
++
+ acpi_pci_wakeup(pci_dev, false);
+ }
+
+ static void pci_acpi_cleanup(struct device *dev)
+ {
+ struct acpi_device *adev = ACPI_COMPANION(dev);
++ struct pci_dev *pci_dev = to_pci_dev(dev);
+
+ if (!adev)
+ return;
+
+ pci_acpi_remove_pm_notifier(adev);
+- if (adev->wakeup.flags.valid)
++ if (adev->wakeup.flags.valid) {
++ if (pci_dev->bridge_d3)
++ device_wakeup_disable(dev);
++
+ device_set_wakeup_capable(dev, false);
++ }
+ }
+
+ static bool pci_acpi_bus_match(struct device *dev)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Alan Douglas <adouglas@cadence.com>
+Date: Thu, 11 Oct 2018 17:15:43 +0100
+Subject: PCI: cadence: Use AXI region 0 to signal interrupts from EP
+
+From: Alan Douglas <adouglas@cadence.com>
+
+[ Upstream commit 0652d4b6b56f73c81abbdbc7e26f772cb2dfe370 ]
+
+The IRQ physical address is allocated from region 0, rather than
+the highest region. Update the driver to reserve this region in
+the bitmap and to use region 0 for all types of interrupt.
+
+This corrects a problem which prevents the interrupt being
+signalled correctly if using the first address in the AXI region,
+since an offset of zero will always be mapped to region 0.
+
+Fixes: 37dddf14f1ae ("PCI: cadence: Add EndPoint Controller driver for Cadence PCIe controller")
+Signed-off-by: Alan Douglas <adouglas@cadence.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pcie-cadence-ep.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/controller/pcie-cadence-ep.c
++++ b/drivers/pci/controller/pcie-cadence-ep.c
+@@ -259,7 +259,6 @@ static void cdns_pcie_ep_assert_intx(str
+ u8 intx, bool is_asserted)
+ {
+ struct cdns_pcie *pcie = &ep->pcie;
+- u32 r = ep->max_regions - 1;
+ u32 offset;
+ u16 status;
+ u8 msg_code;
+@@ -269,8 +268,8 @@ static void cdns_pcie_ep_assert_intx(str
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, r,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, 0,
+ ep->irq_phys_addr);
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY;
+ ep->irq_pci_fn = fn;
+@@ -348,8 +347,8 @@ static int cdns_pcie_ep_send_msi_irq(str
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != (pci_addr & ~pci_addr_mask) ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region(pcie, fn, ep->max_regions - 1,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region(pcie, fn, 0,
+ false,
+ ep->irq_phys_addr,
+ pci_addr & ~pci_addr_mask,
+@@ -510,6 +509,8 @@ static int cdns_pcie_ep_probe(struct pla
+ goto free_epc_mem;
+ }
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE;
++ /* Reserve region 0 for IRQs */
++ set_bit(0, &ep->ob_region_map);
+
+ return 0;
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Vignesh R <vigneshr@ti.com>
+Date: Tue, 25 Sep 2018 14:00:24 +0530
+Subject: PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode
+
+From: Vignesh R <vigneshr@ti.com>
+
+[ Upstream commit 726d75a6d243bf6730da3216f3592503f6f0f588 ]
+
+Errata i870 is applicable in both EP and RC mode. Therefore rename
+function dra7xx_pcie_ep_unaligned_memaccess(), that implements errata
+workaround, to dra7xx_pcie_unaligned_memaccess() and call it for both RC
+and EP. Make sure driver probe does not fail in case the workaround is not
+applied for RC mode in order to maintain DT backward compatibility.
+
+Reported-by: Chris Welch <Chris.Welch@viavisolutions.com>
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+[lorenzo.pieralisi@arm.com: reworded the log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-dra7xx.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -542,7 +542,7 @@ static const struct of_device_id of_dra7
+ };
+
+ /*
+- * dra7xx_pcie_ep_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
++ * dra7xx_pcie_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
+ * @dra7xx: the dra7xx device where the workaround should be applied
+ *
+ * Access to the PCIe slave port that are not 32-bit aligned will result
+@@ -552,7 +552,7 @@ static const struct of_device_id of_dra7
+ *
+ * To avoid this issue set PCIE_SS1_AXI2OCP_LEGACY_MODE_ENABLE to 1.
+ */
+-static int dra7xx_pcie_ep_unaligned_memaccess(struct device *dev)
++static int dra7xx_pcie_unaligned_memaccess(struct device *dev)
+ {
+ int ret;
+ struct device_node *np = dev->of_node;
+@@ -704,6 +704,11 @@ static int __init dra7xx_pcie_probe(stru
+
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_RC);
++
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
++ if (ret)
++ dev_err(dev, "WA for Errata i870 not applied\n");
++
+ ret = dra7xx_add_pcie_port(dra7xx, pdev);
+ if (ret < 0)
+ goto err_gpio;
+@@ -717,7 +722,7 @@ static int __init dra7xx_pcie_probe(stru
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_EP);
+
+- ret = dra7xx_pcie_ep_unaligned_memaccess(dev);
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
+ if (ret)
+ goto err_gpio;
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Honghui Zhang <honghui.zhang@mediatek.com>
+Date: Mon, 15 Oct 2018 16:08:52 +0800
+Subject: PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic
+
+From: Honghui Zhang <honghui.zhang@mediatek.com>
+
+[ Upstream commit 074d6f32689ce05a084b6fa3db38445745bf11cc ]
+
+The Mediatek's host controller has two slots, each with its own control
+registers. The host driver needs to identify what slot is connected to
+what port in order to access the device's configuration space.
+
+Current code retrieving slot connected to a given endpoint device.
+
+Assuming each slot is connected to one endpoint device as below:
+
+ host bridge
+ bus 0 --> __________|_______
+ | |
+ | |
+ slot 0 slot 1
+ bus 1 -->| bus 2 --> |
+ | |
+ EP 0 EP 1
+
+During PCI enumeration, system software will scan all the PCI devices on
+every bus starting from devfn 0. Using PCI_SLOT(devfn) for matching an
+endpoint to its slot is erroneous in that the devfn does not contain the
+hierarchical bus numbering in it. In order to match an endpoint with its
+slot (and related port), the PCI tree must be walked up to the root bus
+(where the root ports are situated) and then the PCI_SLOT(devfn)
+matching logic can be correctly applied for matching.
+
+This patch fixes the mtk_pcie_find_port() slot matching logic by adding
+appropriate PCI tree walking code to retrieve the slot/port a given
+endpoint is connected to.
+
+Signed-off-by: Honghui Zhang <honghui.zhang@mediatek.com>
+[lorenzo.pieralisi@arm.com: rewrote the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/pcie-mediatek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -337,6 +337,17 @@ static struct mtk_pcie_port *mtk_pcie_fi
+ {
+ struct mtk_pcie *pcie = bus->sysdata;
+ struct mtk_pcie_port *port;
++ struct pci_dev *dev = NULL;
++
++ /*
++ * Walk the bus hierarchy to get the devfn value
++ * of the port in the root bus.
++ */
++ while (bus && bus->number) {
++ dev = bus->self;
++ bus = dev->bus;
++ devfn = dev->devfn;
++ }
+
+ list_for_each_entry(port, &pcie->ports, list)
+ if (port->slot == PCI_SLOT(devfn))
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+Date: Mon, 24 Sep 2018 07:00:41 -0700
+Subject: PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
+
+From: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+
+[ Upstream commit 4c1ef72e9b71a19fb405ebfcd37c0a5e16fa44ca ]
+
+It is a serious driver defect to enable MSI or MSI-X more than once. Doing
+so may panic the kernel as in the stack trace below:
+
+ Call Trace:
+ sysfs_add_one+0xa5/0xd0
+ create_dir+0x7c/0xe0
+ sysfs_create_subdir+0x1c/0x20
+ internal_create_group+0x6d/0x290
+ sysfs_create_groups+0x4a/0xa0
+ populate_msi_sysfs+0x1cd/0x210
+ pci_enable_msix+0x31c/0x3e0
+ igbuio_pci_open+0x72/0x300 [igb_uio]
+ uio_open+0xcc/0x120 [uio]
+ chrdev_open+0xa1/0x1e0
+ [...]
+ do_sys_open+0xf3/0x1f0
+ SyS_open+0x1e/0x20
+ system_call_fastpath+0x16/0x1b
+ ---[ end trace 11042e2848880209 ]---
+ Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa056b4fa
+
+We want to keep the WARN_ON() and stack trace so the driver can be fixed,
+but we can avoid the kernel panic by returning an error. We may still get
+warnings like this:
+
+ Call Trace:
+ pci_enable_msix+0x3c9/0x3e0
+ igbuio_pci_open+0x72/0x300 [igb_uio]
+ uio_open+0xcc/0x120 [uio]
+ chrdev_open+0xa1/0x1e0
+ [...]
+ do_sys_open+0xf3/0x1f0
+ SyS_open+0x1e/0x20
+ system_call_fastpath+0x16/0x1b
+ ------------[ cut here ]------------
+ WARNING: at fs/sysfs/dir.c:526 sysfs_add_one+0xa5/0xd0()
+ sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/0000:01:00.1/msi_irqs'
+
+Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+[bhelgaas: changelog, fix patch whitespace, remove !!]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/msi.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -958,7 +958,6 @@ static int __pci_enable_msix(struct pci_
+ }
+ }
+ }
+- WARN_ON(!!dev->msix_enabled);
+
+ /* Check whether driver already requested for MSI irq */
+ if (dev->msi_enabled) {
+@@ -1028,8 +1027,6 @@ static int __pci_enable_msi_range(struct
+ if (!pci_msi_supported(dev, minvec))
+ return -EINVAL;
+
+- WARN_ON(!!dev->msi_enabled);
+-
+ /* Check whether driver already requested MSI-X irqs */
+ if (dev->msix_enabled) {
+ pci_info(dev, "can't enable MSI (MSI-X already enabled)\n");
+@@ -1039,6 +1036,9 @@ static int __pci_enable_msi_range(struct
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msi_enabled))
++ return -EINVAL;
++
+ nvec = pci_msi_vec_count(dev);
+ if (nvec < 0)
+ return nvec;
+@@ -1087,6 +1087,9 @@ static int __pci_enable_msix_range(struc
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msix_enabled))
++ return -EINVAL;
++
+ for (;;) {
+ if (affd) {
+ nvec = irq_calc_affinity_vectors(minvec, nvec, affd);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: David Miller <davem@davemloft.net>
+Date: Thu, 11 Oct 2018 22:46:55 -0700
+Subject: perf cpu_map: Align cpu map synthesized events properly.
+
+From: David Miller <davem@davemloft.net>
+
+[ Upstream commit 0ed149cf5239cc6e7e65bf00f769e8f1e91076c0 ]
+
+The size of the resulting cpu map can be smaller than a multiple of
+sizeof(u64), resulting in SIGBUS on cpus like Sparc as the next event
+will not be aligned properly.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@intel.com>
+Fixes: 6c872901af07 ("perf cpu_map: Add cpu_map event synthesize function")
+Link: http://lkml.kernel.org/r/20181011.224655.716771175766946817.davem@davemloft.net
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/event.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -1074,6 +1074,7 @@ void *cpu_map_data__alloc(struct cpu_map
+ }
+
+ *size += sizeof(struct cpu_map_data);
++ *size = PERF_ALIGN(*size, sizeof(u64));
+ return zalloc(*size);
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Wed, 3 Oct 2018 23:20:52 +0200
+Subject: perf evsel: Store ids for events with their own cpus perf_event__synthesize_event_update_cpus
+
+From: Jiri Olsa <jolsa@redhat.com>
+
+[ Upstream commit 4ab8455f8bd83298bf7f67ab9357e3b1cc765c7d ]
+
+John reported crash when recording on an event under PMU with cpumask defined:
+
+ root@localhost:~# ./perf_debug_ record -e armv8_pmuv3_0/br_mis_pred/ sleep 1
+ perf: Segmentation fault
+ Obtained 9 stack frames.
+ ./perf_debug_() [0x4c5ef8]
+ [0xffff82ba267c]
+ ./perf_debug_() [0x4bc5a8]
+ ./perf_debug_() [0x419550]
+ ./perf_debug_() [0x41a928]
+ ./perf_debug_() [0x472f58]
+ ./perf_debug_() [0x473210]
+ ./perf_debug_() [0x4070f4]
+ /lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0xe0) [0xffff8294c8a0]
+ Segmentation fault (core dumped)
+
+We synthesize an update event that needs to touch the evsel id array, which is
+not defined at that time. Fixing this by forcing the id allocation for events
+with their own cpus.
+
+Reported-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: John Garry <john.garry@huawei.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxarm@huawei.com
+Fixes: bfd8f72c2778 ("perf record: Synthesize unit/scale/... in event update")
+Link: http://lkml.kernel.org/r/20181003212052.GA32371@krava
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/builtin-report.c | 1 +
+ tools/perf/util/evsel.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -981,6 +981,7 @@ int cmd_report(int argc, const char **ar
+ .id_index = perf_event__process_id_index,
+ .auxtrace_info = perf_event__process_auxtrace_info,
+ .auxtrace = perf_event__process_auxtrace,
++ .event_update = perf_event__process_event_update,
+ .feature = process_feature_event,
+ .ordered_events = true,
+ .ordering_requires_timestamps = true,
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1078,6 +1078,9 @@ void perf_evsel__config(struct perf_evse
+ attr->exclude_user = 1;
+ }
+
++ if (evsel->own_cpus)
++ evsel->attr.read_format |= PERF_FORMAT_ID;
++
+ /*
+ * Apply event specific term settings,
+ * it overloads any global configuration.
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Milian Wolff <milian.wolff@kdab.com>
+Date: Wed, 26 Sep 2018 15:52:07 +0200
+Subject: perf report: Don't crash on invalid inline debug information
+
+From: Milian Wolff <milian.wolff@kdab.com>
+
+[ Upstream commit d4046e8e17b9f378cb861982ef71c63911b5dff3 ]
+
+When the function name for an inline frame is invalid, we must not try
+to demangle this symbol, otherwise we crash with:
+
+ #0 0x0000555555895c01 in bfd_demangle ()
+ #1 0x0000555555823262 in demangle_sym (dso=0x555555d92b90, elf_name=0x0, kmodule=0) at util/symbol-elf.c:215
+ #2 dso__demangle_sym (dso=dso@entry=0x555555d92b90, kmodule=<optimized out>, kmodule@entry=0, elf_name=elf_name@entry=0x0) at util/symbol-elf.c:400
+ #3 0x00005555557fef4b in new_inline_sym (funcname=0x0, base_sym=0x555555d92b90, dso=0x555555d92b90) at util/srcline.c:89
+ #4 inline_list__append_dso_a2l (dso=dso@entry=0x555555c7bb00, node=node@entry=0x555555e31810, sym=sym@entry=0x555555d92b90) at util/srcline.c:264
+ #5 0x00005555557ff27f in addr2line (dso_name=dso_name@entry=0x555555d92430 "/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf", addr=addr@entry=2888, file=file@entry=0x0,
+ line=line@entry=0x0, dso=dso@entry=0x555555c7bb00, unwind_inlines=unwind_inlines@entry=true, node=0x555555e31810, sym=0x555555d92b90) at util/srcline.c:313
+ #6 0x00005555557ffe7c in addr2inlines (sym=0x555555d92b90, dso=0x555555c7bb00, addr=2888, dso_name=0x555555d92430 "/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf")
+ at util/srcline.c:358
+
+So instead handle the case where we get invalid function names for
+inlined frames and use a fallback '??' function name instead.
+
+While this crash was originally reported by Hadrien for rust code, I can
+now also reproduce it with trivial C++ code. Indeed, it seems like
+libbfd fails to interpret the debug information for the inline frame
+symbol name:
+
+ $ addr2line -e /home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf -if b48
+ main
+ /usr/include/c++/8.2.1/complex:610
+ ??
+ /usr/include/c++/8.2.1/complex:618
+ ??
+ /usr/include/c++/8.2.1/complex:675
+ ??
+ /usr/include/c++/8.2.1/complex:685
+ main
+ /home/milian/projects/kdab/rnd/hotspot/tests/test-clients/cpp-inlining/main.cpp:39
+
+I've reported this bug upstream and also attached a patch there which
+should fix this issue:
+
+https://sourceware.org/bugzilla/show_bug.cgi?id=23715
+
+Reported-by: Hadrien Grasland <grasland@lal.in2p3.fr>
+Signed-off-by: Milian Wolff <milian.wolff@kdab.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Fixes: a64489c56c30 ("perf report: Find the inline stack for a given address")
+[ The above 'Fixes:' cset is where originally the problem was
+ introduced, i.e. using a2l->funcname without checking if it is NULL,
+ but this current patch fixes the current codebase, i.e. multiple csets
+ were applied after a64489c56c30 before the problem was reported by Hadrien ]
+Link: http://lkml.kernel.org/r/20180926135207.30263-3-milian.wolff@kdab.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/srcline.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/tools/perf/util/srcline.c
++++ b/tools/perf/util/srcline.c
+@@ -85,6 +85,9 @@ static struct symbol *new_inline_sym(str
+ struct symbol *inline_sym;
+ char *demangled = NULL;
+
++ if (!funcname)
++ funcname = "??";
++
+ if (dso) {
+ demangled = dso__demangle_sym(dso, 0, funcname);
+ if (demangled)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sanskriti Sharma <sansharm@redhat.com>
+Date: Tue, 2 Oct 2018 10:29:10 -0400
+Subject: perf strbuf: Match va_{add,copy} with va_end
+
+From: Sanskriti Sharma <sansharm@redhat.com>
+
+[ Upstream commit ce49d8436cffa9b7a6a5f110879d53e89dbc6746 ]
+
+Ensure that all code paths in strbuf_addv() call va_end() on the
+ap_saved copy that was made.
+
+Fixes the following coverity complaint:
+
+ Error: VARARGS (CWE-237): [#def683]
+ tools/perf/util/strbuf.c:106: missing_va_end: va_end was not called
+ for "ap_saved".
+
+Signed-off-by: Sanskriti Sharma <sansharm@redhat.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Link: http://lkml.kernel.org/r/1538490554-8161-2-git-send-email-sansharm@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/strbuf.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/strbuf.c
++++ b/tools/perf/util/strbuf.c
+@@ -98,19 +98,25 @@ static int strbuf_addv(struct strbuf *sb
+
+ va_copy(ap_saved, ap);
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
+- if (len < 0)
++ if (len < 0) {
++ va_end(ap_saved);
+ return len;
++ }
+ if (len > strbuf_avail(sb)) {
+ ret = strbuf_grow(sb, len);
+- if (ret)
++ if (ret) {
++ va_end(ap_saved);
+ return ret;
++ }
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved);
+ va_end(ap_saved);
+ if (len > strbuf_avail(sb)) {
+ pr_debug("this should not happen, your vsnprintf is broken");
++ va_end(ap_saved);
+ return -EINVAL;
+ }
+ }
++ va_end(ap_saved);
+ return strbuf_setlen(sb, sb->len + len);
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Wed, 5 Sep 2018 10:47:56 -0300
+Subject: perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 1632936480a53d85ef3012cd9f290e247251cbb9 ]
+
+When we don't have the iputils-debuginfo package installed, i.e. when we
+don't have the DWARF information needed to resolve ping's samples, we
+end up failing this 'perf test' entry:
+
+ # perf test ping
+ 62: probe libc's inet_pton & backtrace it with ping : Ok
+ # rpm -e iputils-debuginfo
+ # perf test ping
+ 62: probe libc's inet_pton & backtrace it with ping : FAILED!
+ #
+
+Fix it to accept "[unknown]" where the symbol + offset, when resolved,
+is expected.
+
+I think this will fail in the other arches as well, but since I can't
+test now, I'm leaving s390x and ppc cases as-is.
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kim Phillips <kim.phillips@arm.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
+Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
+Cc: Wang Nan <wangnan0@huawei.com>
+Fixes: 7903a7086723 ("perf script: Show symbol offsets by default")
+Link: https://lkml.kernel.org/n/tip-hnizqwqrs03vcq1b74yao0f6@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -48,7 +48,7 @@ trace_libc_inet_pton_backtrace() {
+ *)
+ eventattr='max-stack=3'
+ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+- echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++ echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ ;;
+ esac
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sanskriti Sharma <sansharm@redhat.com>
+Date: Tue, 2 Oct 2018 10:29:11 -0400
+Subject: perf tools: Cleanup trace-event-info 'tdata' leak
+
+From: Sanskriti Sharma <sansharm@redhat.com>
+
+[ Upstream commit faedbf3fd19f2511a39397f76359e4cc6ee93072 ]
+
+Free tracing_data structure in tracing_data_get() error paths.
+
+Fixes the following coverity complaint:
+
+ Error: RESOURCE_LEAK (CWE-772):
+ leaked_storage: Variable "tdata" going out of scope leaks the storage
+
+Signed-off-by: Sanskriti Sharma <sansharm@redhat.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Link: http://lkml.kernel.org/r/1538490554-8161-3-git-send-email-sansharm@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/trace-event-info.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/tools/perf/util/trace-event-info.c
++++ b/tools/perf/util/trace-event-info.c
+@@ -531,12 +531,14 @@ struct tracing_data *tracing_data_get(st
+ "/tmp/perf-XXXXXX");
+ if (!mkstemp(tdata->temp_file)) {
+ pr_debug("Can't make temp file");
++ free(tdata);
+ return NULL;
+ }
+
+ temp_fd = open(tdata->temp_file, O_RDWR);
+ if (temp_fd < 0) {
+ pr_debug("Can't read '%s'", tdata->temp_file);
++ free(tdata);
+ return NULL;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jarod Wilson <jarod@redhat.com>
+Date: Thu, 6 Sep 2018 18:18:12 -0400
+Subject: perf tools: Fix use of alternatives to find JDIR
+
+From: Jarod Wilson <jarod@redhat.com>
+
+[ Upstream commit 36b8d4628d3cc8f5a748e508cce8673bc00fc63c ]
+
+When a build is run from something like a cron job, the user's $PATH is
+rather minimal, of note, not including /usr/sbin in my own case. Because
+of that, an automated rpm package build ultimately fails to find
+libperf-jvmti.so, because somewhere within the build, this happens...
+
+ /bin/sh: alternatives: command not found
+ /bin/sh: alternatives: command not found
+ Makefile.config:849: No openjdk development package found, please install
+ JDK package, e.g. openjdk-8-jdk, java-1.8.0-openjdk-devel
+
+...and while the build continues, libperf-jvmti.so isn't built, and
+things fall down when rpm tries to find all the %files specified. Exact
+same system builds everything just fine when the job is launched from a
+login shell instead of a cron job, since alternatives is in $PATH, so
+openjdk is actually found.
+
+The test required to get into this section of code actually specifies
+the full path, as does a block just above it, so let's do that here too.
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: William Cohen <wcohen@redhat.com>
+Fixes: d4dfdf00d43e ("perf jvmti: Plug compilation into perf build")
+Link: http://lkml.kernel.org/r/20180906221812.11167-1-jarod@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/Makefile.config | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -831,7 +831,7 @@ ifndef NO_JVMTI
+ JDIR=$(shell /usr/sbin/update-java-alternatives -l | head -1 | awk '{print $$3}')
+ else
+ ifneq (,$(wildcard /usr/sbin/alternatives))
+- JDIR=$(shell alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g')
++ JDIR=$(shell /usr/sbin/alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g')
+ endif
+ endif
+ ifndef JDIR
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sanskriti Sharma <sansharm@redhat.com>
+Date: Tue, 2 Oct 2018 10:29:14 -0400
+Subject: perf tools: Free temporary 'sys' string in read_event_files()
+
+From: Sanskriti Sharma <sansharm@redhat.com>
+
+[ Upstream commit 1e44224fb0528b4c0cc176bde2bb31e9127eb14b ]
+
+For each system in a given pevent, read_event_files() reads in a
+temporary 'sys' string. Be sure to free this string before moving onto
+to the next system and/or leaving read_event_files().
+
+Fixes the following coverity complaints:
+
+ Error: RESOURCE_LEAK (CWE-772):
+
+ tools/perf/util/trace-event-read.c:343: overwrite_var: Overwriting
+ "sys" in "sys = read_string()" leaks the storage that "sys" points to.
+
+ tools/perf/util/trace-event-read.c:353: leaked_storage: Variable "sys"
+ going out of scope leaks the storage it points to.
+
+Signed-off-by: Sanskriti Sharma <sansharm@redhat.com>
+Reviewed-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Link: http://lkml.kernel.org/r/1538490554-8161-6-git-send-email-sansharm@redhat.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/trace-event-read.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -349,9 +349,12 @@ static int read_event_files(struct peven
+ for (x=0; x < count; x++) {
+ size = read8(pevent);
+ ret = read_event_file(pevent, sys, size);
+- if (ret)
++ if (ret) {
++ free(sys);
+ return ret;
++ }
+ }
++ free(sys);
+ }
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Wed, 10 Oct 2018 10:03:39 +0200
+Subject: perf vendor events intel: Fix wrong filter_band* values for uncore events
+
+From: Jiri Olsa <jolsa@redhat.com>
+
+[ Upstream commit 94aafb74cee0002e2f2eb6dc5376f54d5951ab4d ]
+
+Michael reported that he could not stat following event:
+
+ $ perf stat -e unc_p_freq_ge_1200mhz_cycles -a -- ls
+ event syntax error: '..e_1200mhz_cycles'
+ \___ value too big for format, maximum is 255
+ Run 'perf list' for a list of valid events
+
+The event is unwrapped into:
+
+ uncore_pcu/event=0xb,filter_band0=1200/
+
+where filter_band0 format says it's one byte only:
+
+ # cat uncore_pcu/format/filter_band0
+ config1:0-7
+
+while JSON files specifies bigger number:
+
+ "Filter": "filter_band0=1200",
+
+all the filter_band* formats show 1 byte width:
+
+ # cat uncore_pcu/format/filter_band1
+ config1:8-15
+ # cat uncore_pcu/format/filter_band2
+ config1:16-23
+ # cat uncore_pcu/format/filter_band3
+ config1:24-31
+
+The reason of the issue is that filter_band* values are supposed to be
+in 100Mhz units.. it's stated in the JSON help for the events, like:
+
+ filter_band3=XXX, with XXX in 100Mhz units
+
+This patch divides the filter_band* values by 100, plus there's couple
+of changes that actually change the number completely, like:
+
+ - "Filter": "edge=1,filter_band2=4000",
+ + "Filter": "edge=1,filter_band2=30",
+
+Reported-by: Michael Petlan <mpetlan@redhat.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Andi Kleen <ak@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20181010080339.GB15790@krava
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json | 16 +++++++-------
+ tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json | 16 +++++++-------
+ 2 files changed, 16 insertions(+), 16 deletions(-)
+
+--- a/tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json
++++ b/tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json
+@@ -188,7 +188,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_CYCLES",
+- "Filter": "filter_band0=1200",
++ "Filter": "filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -199,7 +199,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_CYCLES",
+- "Filter": "filter_band1=2000",
++ "Filter": "filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -210,7 +210,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_CYCLES",
+- "Filter": "filter_band2=3000",
++ "Filter": "filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -221,7 +221,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_CYCLES",
+- "Filter": "filter_band3=4000",
++ "Filter": "filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+@@ -232,7 +232,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band0=1200",
++ "Filter": "edge=1,filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -243,7 +243,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band1=2000",
++ "Filter": "edge=1,filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -254,7 +254,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band2=4000",
++ "Filter": "edge=1,filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -265,7 +265,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band3=4000",
++ "Filter": "edge=1,filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+--- a/tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json
++++ b/tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json
+@@ -187,7 +187,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_CYCLES",
+- "Filter": "filter_band0=1200",
++ "Filter": "filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -198,7 +198,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_CYCLES",
+- "Filter": "filter_band1=2000",
++ "Filter": "filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -209,7 +209,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_CYCLES",
+- "Filter": "filter_band2=3000",
++ "Filter": "filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -220,7 +220,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_CYCLES",
+- "Filter": "filter_band3=4000",
++ "Filter": "filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+@@ -231,7 +231,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band0=1200",
++ "Filter": "edge=1,filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -242,7 +242,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band1=2000",
++ "Filter": "edge=1,filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -253,7 +253,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band2=4000",
++ "Filter": "edge=1,filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -264,7 +264,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band3=4000",
++ "Filter": "edge=1,filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Stephen Boyd <swboyd@chromium.org>
+Date: Thu, 30 Aug 2018 17:58:52 -0700
+Subject: pinctrl: qcom: spmi-mpp: Fix drive strength setting
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 89c68b102f13f123aaef22b292526d6b92501334 ]
+
+It looks like we parse the drive strength setting here, but never
+actually write it into the hardware to update it. Parse the setting and
+then write it at the end of the pinconf setting function so that it
+actually sticks in the hardware.
+
+Fixes: 0e948042c420 ("pinctrl: qcom: spmi-mpp: Implement support for sink mode")
+Cc: Doug Anderson <dianders@chromium.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -457,7 +457,7 @@ static int pmic_mpp_config_set(struct pi
+ pad->dtest = arg;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+- arg = pad->drive_strength;
++ pad->drive_strength = arg;
+ break;
+ case PMIC_MPP_CONF_AMUX_ROUTE:
+ if (arg >= PMIC_MPP_AMUX_ROUTE_ABUS4)
+@@ -504,6 +504,10 @@ static int pmic_mpp_config_set(struct pi
+ if (ret < 0)
+ return ret;
+
++ ret = pmic_mpp_write(state, pad, PMIC_MPP_REG_SINK_CTL, pad->drive_strength);
++ if (ret < 0)
++ return ret;
++
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+ return pmic_mpp_write(state, pad, PMIC_MPP_REG_EN_CTL, val);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 20 Sep 2018 01:58:18 +0000
+Subject: pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 69f8455f6cc78fa6cdf80d0105d7a748106271dc ]
+
+'ret' should be returned while pmic_mpp_write_mode_ctl fails.
+
+Fixes: 0e948042c420 ("pinctrl: qcom: spmi-mpp: Implement support for sink mode")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -319,6 +319,8 @@ static int pmic_mpp_set_mux(struct pinct
+ pad->function = function;
+
+ ret = pmic_mpp_write_mode_ctl(state, pad);
++ if (ret < 0)
++ return ret;
+
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 30 Aug 2018 08:23:39 -0700
+Subject: pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 0d5b476f8f57fcb06c45fe27681ac47254f63fd2 ]
+
+If you look at "pinconf-groups" in debugfs for ssbi-mpp you'll notice
+it looks like nonsense.
+
+The problem is fairly well described in commit 1cf86bc21257 ("pinctrl:
+qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant") and
+commit 05e0c828955c ("pinctrl: msm: Fix msm_config_group_get() to be
+compliant"), but it was pointed out that ssbi-mpp has the same
+problem. Let's fix it there too.
+
+NOTE: in case it's helpful to someone reading this, the way to tell
+whether to do the -EINVAL or not is to look at the PCONFDUMP for a
+given attribute. If the last element (has_arg) is false then you need
+to do the -EINVAL trick.
+
+ALSO NOTE: it seems unlikely that the values returned when we try to
+get PIN_CONFIG_BIAS_PULL_UP will actually be printed since "has_arg"
+is false for that one, but I guess it's still fine to return different
+values so I kept doing that. It seems like another driver (ssbi-gpio)
+uses a custom attribute (PM8XXX_QCOM_PULL_UP_STRENGTH) for something
+similar so maybe a future change should do that here too.
+
+Fixes: cfb24f6ebd38 ("pinctrl: Qualcomm SPMI PMIC MPP pin controller driver")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -345,13 +345,12 @@ static int pmic_mpp_config_get(struct pi
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pad->pullup == PMIC_MPP_PULL_UP_OPEN;
++ if (pad->pullup != PMIC_MPP_PULL_UP_OPEN)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+ switch (pad->pullup) {
+- case PMIC_MPP_PULL_UP_OPEN:
+- arg = 0;
+- break;
+ case PMIC_MPP_PULL_UP_0P6KOHM:
+ arg = 600;
+ break;
+@@ -366,13 +365,17 @@ static int pmic_mpp_config_get(struct pi
+ }
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = !pad->is_enabled;
++ if (pad->is_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_POWER_SOURCE:
+ arg = pad->power_source;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pad->input_enabled;
++ if (!pad->input_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ arg = pad->out_value;
+@@ -384,7 +387,9 @@ static int pmic_mpp_config_get(struct pi
+ arg = pad->amux_input;
+ break;
+ case PMIC_MPP_CONF_PAIRED:
+- arg = pad->paired;
++ if (!pad->paired)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+ arg = pad->drive_strength;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 30 Aug 2018 08:23:38 -0700
+Subject: pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit b432414b996d32a1bd9afe2bd595bd5729c1477f ]
+
+If you look at "pinconf-groups" in debugfs for ssbi-gpio you'll notice
+it looks like nonsense.
+
+The problem is fairly well described in commit 1cf86bc21257 ("pinctrl:
+qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant") and
+commit 05e0c828955c ("pinctrl: msm: Fix msm_config_group_get() to be
+compliant"), but it was pointed out that ssbi-gpio has the same
+problem. Let's fix it there too.
+
+Fixes: b4c45fe974bc ("pinctrl: qcom: ssbi: Family A gpio & mpp drivers")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -260,22 +260,32 @@ static int pm8xxx_pin_config_get(struct
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_NP;
++ if (pin->bias != PM8XXX_GPIO_BIAS_NP)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_PD;
++ if (pin->bias != PM8XXX_GPIO_BIAS_PD)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+- arg = pin->bias <= PM8XXX_GPIO_BIAS_PU_1P5_30;
++ if (pin->bias > PM8XXX_GPIO_BIAS_PU_1P5_30)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PM8XXX_QCOM_PULL_UP_STRENGTH:
+ arg = pin->pull_up_strength;
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = pin->disable;
++ if (!pin->disable)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pin->mode == PM8XXX_GPIO_MODE_INPUT;
++ if (pin->mode != PM8XXX_GPIO_MODE_INPUT)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ if (pin->mode & PM8XXX_GPIO_MODE_OUTPUT)
+@@ -290,10 +300,14 @@ static int pm8xxx_pin_config_get(struct
+ arg = pin->output_strength;
+ break;
+ case PIN_CONFIG_DRIVE_PUSH_PULL:
+- arg = !pin->open_drain;
++ if (pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- arg = pin->open_drain;
++ if (!pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ default:
+ return -EINVAL;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 21 Sep 2018 09:59:41 +0800
+Subject: pinctrl: sunxi: fix 'pctrl->functions' allocation in sunxi_pinctrl_build_state
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit a4925311a5443126ecc90671a1604ea7b0f5b32e ]
+
+fixes following Smatch static check warning:
+
+ ./drivers/pinctrl/sunxi/pinctrl-sunxi.c:1112 sunxi_pinctrl_build_state()
+ warn: passing devm_ allocated variable to kfree. 'pctrl->functions'
+
+As we will be calling krealloc() on pointer 'pctrl->functions', which means
+kfree() will be called in there, devm_kzalloc() shouldn't be used with
+the allocation in the first place. Fix the warning by calling kcalloc()
+and managing the free procedure in error path on our own.
+
+Fixes: 0e37f88d9ad8 ("ARM: sunxi: Add pinctrl driver for Allwinner SoCs")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sunxi.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1079,10 +1079,9 @@ static int sunxi_pinctrl_build_state(str
+ * We suppose that we won't have any more functions than pins,
+ * we'll reallocate that later anyway
+ */
+- pctl->functions = devm_kcalloc(&pdev->dev,
+- pctl->ngroups,
+- sizeof(*pctl->functions),
+- GFP_KERNEL);
++ pctl->functions = kcalloc(pctl->ngroups,
++ sizeof(*pctl->functions),
++ GFP_KERNEL);
+ if (!pctl->functions)
+ return -ENOMEM;
+
+@@ -1133,8 +1132,10 @@ static int sunxi_pinctrl_build_state(str
+
+ func_item = sunxi_pinctrl_find_function_by_name(pctl,
+ func->name);
+- if (!func_item)
++ if (!func_item) {
++ kfree(pctl->functions);
+ return -EINVAL;
++ }
+
+ if (!func_item->groups) {
+ func_item->groups =
+@@ -1142,8 +1143,10 @@ static int sunxi_pinctrl_build_state(str
+ func_item->ngroups,
+ sizeof(*func_item->groups),
+ GFP_KERNEL);
+- if (!func_item->groups)
++ if (!func_item->groups) {
++ kfree(pctl->functions);
+ return -ENOMEM;
++ }
+ }
+
+ func_grp = func_item->groups;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Thu, 27 Sep 2018 12:09:48 +0800
+Subject: r8169: Enable MSI-X on RTL8106e
+
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+
+[ Upstream commit d49c88d7677ba737e9d2759a87db0402d5ab2607 ]
+
+Originally, we have an issue where r8169 MSI-X interrupt is broken after
+S3 suspend/resume on RTL8106e of ASUS X441UAR.
+
+02:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd.
+RTL8101/2/6E PCI Express Fast/Gigabit Ethernet controller [10ec:8136]
+(rev 07)
+ Subsystem: ASUSTeK Computer Inc. RTL810xE PCI Express Fast
+Ethernet controller [1043:200f]
+ Flags: bus master, fast devsel, latency 0, IRQ 16
+ I/O ports at e000 [size=256]
+ Memory at ef100000 (64-bit, non-prefetchable) [size=4K]
+ Memory at e0000000 (64-bit, prefetchable) [size=16K]
+ Capabilities: [40] Power Management version 3
+ Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
+ Capabilities: [70] Express Endpoint, MSI 01
+ Capabilities: [b0] MSI-X: Enable+ Count=4 Masked-
+ Capabilities: [d0] Vital Product Data
+ Capabilities: [100] Advanced Error Reporting
+ Capabilities: [140] Virtual Channel
+ Capabilities: [160] Device Serial Number 01-00-00-00-36-4c-e0-00
+ Capabilities: [170] Latency Tolerance Reporting
+ Kernel driver in use: r8169
+ Kernel modules: r8169
+
+We found the all of the values in PCI BAR=4 of the ethernet adapter
+become 0xFF after system resumes. That breaks the MSI-X interrupt.
+Therefore, we can only fall back to MSI interrupt to fix the issue at
+that time.
+
+However, there is a commit which resolves the drivers getting nothing in
+PCI BAR=4 after system resumes. It is 04cb3ae895d7 "PCI: Reprogram
+bridge prefetch registers on resume" by Daniel Drake.
+
+After apply the patch, the ethernet adapter works fine before suspend
+and after resume. So, we can revert the workaround after the commit
+"PCI: Reprogram bridge prefetch registers on resume" is merged into main
+tree.
+
+This patch reverts commit 7bb05b85bc2d1a1b647b91424b2ed4a18e6ecd81
+"r8169: don't use MSI-X on RTL8106e".
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=201181
+Fixes: 7bb05b85bc2d ("r8169: don't use MSI-X on RTL8106e")
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7539,20 +7539,17 @@ static int rtl_alloc_irq(struct rtl8169_
+ {
+ unsigned int flags;
+
+- switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
++ if (tp->mac_version <= RTL_GIGA_MAC_VER_06) {
+ RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+ RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
+ RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ flags = PCI_IRQ_LEGACY;
+- break;
+- case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_40:
++ } else if (tp->mac_version == RTL_GIGA_MAC_VER_40) {
+ /* This version was reported to have issues with resume
+ * from suspend when using MSI-X
+ */
+ flags = PCI_IRQ_LEGACY | PCI_IRQ_MSI;
+- break;
+- default:
++ } else {
+ flags = PCI_IRQ_ALL_TYPES;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Tue, 16 Oct 2018 19:35:17 +0200
+Subject: r8169: re-enable MSI-X on RTL8168g
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 9675931e6b65d160d16bcc9472c1acef15524def ]
+
+Similar to d49c88d7677b ("r8169: Enable MSI-X on RTL8106e") after
+e9d0ba506ea8 ("PCI: Reprogram bridge prefetch registers on resume")
+we can safely assume that this also fixes the root cause of
+the issue worked around by 7c53a722459c ("r8169: don't use MSI-X on
+RTL8168g"). So let's revert it.
+
+Fixes: 7c53a722459c ("r8169: don't use MSI-X on RTL8168g")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/r8169.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7544,11 +7544,6 @@ static int rtl_alloc_irq(struct rtl8169_
+ RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
+ RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ flags = PCI_IRQ_LEGACY;
+- } else if (tp->mac_version == RTL_GIGA_MAC_VER_40) {
+- /* This version was reported to have issues with resume
+- * from suspend when using MSI-X
+- */
+- flags = PCI_IRQ_LEGACY | PCI_IRQ_MSI;
+ } else {
+ flags = PCI_IRQ_ALL_TYPES;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 8 Oct 2018 03:27:56 -0700
+Subject: RDMA/bnxt_re: Avoid accessing nq->bar_reg_iomem in failure case
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit ed51efd2ce44091a858ad829f666727e7c95695e ]
+
+In the failure path, nq->bar_reg_iomem gets accessed without
+initializing. Avoid this by calling the bnxt_qplib_nq_stop_irq only if the
+initialization is complete.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Fixes: 6e04b1035689 ("RDMA/bnxt_re: Fix broken RoCE driver due to recent L2 driver changes")
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -360,7 +360,8 @@ void bnxt_qplib_disable_nq(struct bnxt_q
+ }
+
+ /* Make sure the HW is stopped! */
+- bnxt_qplib_nq_stop_irq(nq, true);
++ if (nq->requested)
++ bnxt_qplib_nq_stop_irq(nq, true);
+
+ if (nq->bar_reg_iomem)
+ iounmap(nq->bar_reg_iomem);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+Date: Mon, 8 Oct 2018 03:27:53 -0700
+Subject: RDMA/bnxt_re: Fix recursive lock warning in debug kernel
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit d455f29f6d76a5f94881ca1289aaa1e90617ff5d ]
+
+Fix possible recursive lock warning. Its a false warning as the locks are
+part of two differnt HW Queue data structure - cmdq and creq. Debug kernel
+is throwing the following warning and stack trace.
+
+[ 783.914967] ============================================
+[ 783.914970] WARNING: possible recursive locking detected
+[ 783.914973] 4.19.0-rc2+ #33 Not tainted
+[ 783.914976] --------------------------------------------
+[ 783.914979] swapper/2/0 is trying to acquire lock:
+[ 783.914982] 000000002aa3949d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
+[ 783.914999]
+but task is already holding lock:
+[ 783.915002] 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re]
+[ 783.915013]
+other info that might help us debug this:
+[ 783.915016] Possible unsafe locking scenario:
+
+[ 783.915019] CPU0
+[ 783.915021] ----
+[ 783.915034] lock(&(&hwq->lock)->rlock);
+[ 783.915035] lock(&(&hwq->lock)->rlock);
+[ 783.915037]
+ *** DEADLOCK ***
+
+[ 783.915038] May be due to missing lock nesting notation
+
+[ 783.915039] 1 lock held by swapper/2/0:
+[ 783.915040] #0: 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re]
+[ 783.915044]
+stack backtrace:
+[ 783.915046] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.0-rc2+ #33
+[ 783.915047] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014
+[ 783.915048] Call Trace:
+[ 783.915049] <IRQ>
+[ 783.915054] dump_stack+0x90/0xe3
+[ 783.915058] __lock_acquire+0x106c/0x1080
+[ 783.915061] ? sched_clock+0x5/0x10
+[ 783.915063] lock_acquire+0xbd/0x1a0
+[ 783.915065] ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
+[ 783.915069] _raw_spin_lock_irqsave+0x4a/0x90
+[ 783.915071] ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
+[ 783.915073] bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
+[ 783.915078] tasklet_action_common.isra.17+0x197/0x1b0
+[ 783.915081] __do_softirq+0xcb/0x3a6
+[ 783.915084] irq_exit+0xe9/0x100
+[ 783.915085] do_IRQ+0x6a/0x120
+[ 783.915087] common_interrupt+0xf/0xf
+[ 783.915088] </IRQ>
+
+Use nested notation for the spin_lock to avoid this warning.
+
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -309,8 +309,17 @@ static int bnxt_qplib_process_qp_event(s
+ rcfw->aeq_handler(rcfw, qp_event, qp);
+ break;
+ default:
+- /* Command Response */
+- spin_lock_irqsave(&cmdq->lock, flags);
++ /*
++ * Command Response
++ * cmdq->lock needs to be acquired to synchronie
++ * the command send and completion reaping. This function
++ * is always called with creq->lock held. Using
++ * the nested variant of spin_lock.
++ *
++ */
++
++ spin_lock_irqsave_nested(&cmdq->lock, flags,
++ SINGLE_DEPTH_NESTING);
+ cookie = le16_to_cpu(qp_event->cookie);
+ mcookie = qp_event->cookie;
+ blocked = cookie & RCFW_CMD_IS_BLOCKING;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Parav Pandit <parav@mellanox.com>
+Date: Sun, 7 Oct 2018 12:12:40 +0300
+Subject: RDMA/core: Do not expose unsupported counters
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 0f6ef65d1c6ec8deb5d0f11f86631ec4cfe8f22e ]
+
+If the provider driver (such as rdma_rxe) doesn't support pma counters,
+avoid exposing its directory similar to optional hw_counters directory.
+If core fails to read the PMA counter, return an error so that user can
+retry later if needed.
+
+Fixes: 35c4cbb17811 ("IB/core: Create get_perf_mad function in sysfs.c")
+Reported-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Tested-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/core/sysfs.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -516,7 +516,7 @@ static ssize_t show_pma_counter(struct i
+ ret = get_perf_mad(p->ibdev, p->port_num, tab_attr->attr_id, &data,
+ 40 + offset / 8, sizeof(data));
+ if (ret < 0)
+- return sprintf(buf, "N/A (no PMA)\n");
++ return ret;
+
+ switch (width) {
+ case 4:
+@@ -1061,10 +1061,12 @@ static int add_port(struct ib_device *de
+ goto err_put;
+ }
+
+- p->pma_table = get_counter_table(device, port_num);
+- ret = sysfs_create_group(&p->kobj, p->pma_table);
+- if (ret)
+- goto err_put_gid_attrs;
++ if (device->process_mad) {
++ p->pma_table = get_counter_table(device, port_num);
++ ret = sysfs_create_group(&p->kobj, p->pma_table);
++ if (ret)
++ goto err_put_gid_attrs;
++ }
+
+ p->gid_group.name = "gids";
+ p->gid_group.attrs = alloc_group_attrs(show_port_gid, attr.gid_tbl_len);
+@@ -1177,7 +1179,8 @@ err_free_gid:
+ p->gid_group.attrs = NULL;
+
+ err_remove_pma:
+- sysfs_remove_group(&p->kobj, p->pma_table);
++ if (p->pma_table)
++ sysfs_remove_group(&p->kobj, p->pma_table);
+
+ err_put_gid_attrs:
+ kobject_put(&p->gid_attr_group->kobj);
+@@ -1289,7 +1292,9 @@ static void free_port_list_attributes(st
+ kfree(port->hw_stats);
+ free_hsag(&port->kobj, port->hw_stats_ag);
+ }
+- sysfs_remove_group(p, port->pma_table);
++
++ if (port->pma_table)
++ sysfs_remove_group(p, port->pma_table);
+ sysfs_remove_group(p, &port->pkey_group);
+ sysfs_remove_group(p, &port->gid_group);
+ sysfs_remove_group(&port->gid_attr_group->kobj,
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 3 Oct 2018 09:20:46 +0200
+Subject: Revert "perf tools: Fix PMU term format max value calculation"
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 1b9caa10b31dda0866f4028e4bfb923fb6e4072f ]
+
+This reverts commit ac0e2cd555373ae6f8f3a3ad3fbbf5b6d1e7aaaa.
+
+Michael reported an issue with oversized terms values assignment
+and I noticed there was actually a misunderstanding of the max
+value check in the past.
+
+The above commit's changelog says:
+
+ If bit 21 is set, there is parsing issues as below.
+
+ $ perf stat -a -e uncore_qpi_0/event=0x200002,umask=0x8/
+ event syntax error: '..pi_0/event=0x200002,umask=0x8/'
+ \___ value too big for format, maximum is 511
+
+But there's no issue there, because the event value is distributed
+along the value defined by the format. Even if the format defines
+separated bit, the value is treated as a continual number, which
+should follow the format definition.
+
+In above case it's 9-bit value with last bit separated:
+ $ cat uncore_qpi_0/format/event
+ config:0-7,21
+
+Hence the value 0x200002 is correctly reported as format violation,
+because it exceeds 9 bits. It should have been 0x102 instead, which
+sets the 9th bit - the bit 21 of the format.
+
+ $ perf stat -vv -a -e uncore_qpi_0/event=0x102,umask=0x8/
+ Using CPUID GenuineIntel-6-2D
+ ...
+ ------------------------------------------------------------
+ perf_event_attr:
+ type 10
+ size 112
+ config 0x200802
+ sample_type IDENTIFIER
+ ...
+
+Reported-by: Michael Petlan <mpetlan@redhat.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: ac0e2cd55537 ("perf tools: Fix PMU term format max value calculation")
+Link: http://lkml.kernel.org/r/20181003072046.29276-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/pmu.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -936,13 +936,14 @@ static void pmu_format_value(unsigned lo
+
+ static __u64 pmu_format_max_value(const unsigned long *format)
+ {
+- __u64 w = 0;
+- int fbit;
++ int w;
+
+- for_each_set_bit(fbit, format, PERF_PMU_FORMAT_BITS)
+- w |= (1ULL << fbit);
+-
+- return w;
++ w = bitmap_weight(format, PERF_PMU_FORMAT_BITS);
++ if (!w)
++ return 0;
++ if (w < 64)
++ return (1ULL << w) - 1;
++ return -1;
+ }
+
+ /*
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Date: Mon, 27 Aug 2018 17:05:14 +0530
+Subject: rsi: fix memory alignment issue in ARM32 platforms
+
+From: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+
+[ Upstream commit baa8caf4ab7af2d9e84b566b99fe919a4e9e7562 ]
+
+During testing in ARM32 platforms, observed below kernel panic, as driver
+accessing data beyond the allocated memory while submitting URB to USB.
+
+Fix: Resolved this by specifying correct length by considering 64 bit
+alignment. so that, USB bus driver will access only allocated memory.
+
+Unit-test: Tested and confirm that driver bring up and scanning,
+connection and data transfer works fine with this fix.
+
+...skipping...
+[ 25.389450] Unable to handle kernel paging request at virtual
+ address 5aa11422
+[ 25.403078] Internal error: Oops: 5 [#1] SMP ARM
+[ 25.407703] Modules linked in: rsi_usb
+[ 25.411473] CPU: 1 PID: 317 Comm: RX-Thread Not tainted 4.18.0-rc7 #1
+[ 25.419221] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+[ 25.425764] PC is at skb_release_data+0x90/0x168
+[ 25.430393] LR is at skb_release_all+0x28/0x2c
+[ 25.434842] pc : [<807435b0>] lr : [<80742ba0>] psr: 200e0013 5aa1141e
+[ 25.464633] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+[ 25.477524] Process RX-Thread (pid: 317, stack limit = 0x(ptrval))
+[ 25.483709] Stack: (0xedf69ed8 to 0xedf6a000)
+[ 25.569907] Backtrace:
+[ 25.572368] [<80743520>] (skb_release_data) from [<80742ba0>]
+ (skb_release_all+0x28/0x2c)
+[ 25.580555] r9:7f00258c r8:00000001 r7:ee355000 r6:eddab0d0
+ r5:eddab000 r4:eddbb840
+[ 25.588308] [<80742b78>] (skb_release_all) from [<807432cc>]
+ (consume_skb+0x30/0x50)
+[ 25.596055] r5:eddab000 r4:eddbb840
+[ 25.599648] [<8074329c>] (consume_skb) from [<7f00117c>]
+ (rsi_usb_rx_thread+0x64/0x12c [rsi_usb])
+[ 25.608524] r5:eddab000 r4:eddbb840
+[ 25.612116] [<7f001118>] (rsi_usb_rx_thread [rsi_usb]) from
+ [<80142750>] (kthread+0x11c/0x15c)
+[ 25.620735] r10:ee9ff9e0 r9:edcde3b8 r8:ee355000 r7:edf68000
+ r6:edd3a780 r5:00000000
+[ 25.628567] r4:edcde380
+[ 25.631110] [<80142634>] (kthread) from [<801010e8>]
+ (ret_from_fork+0x14/0x2c)
+[ 25.638336] Exception stack(0xedf69fb0 to 0xedf69ff8)
+[ 25.682929] ---[ end trace 8236a5496f5b5d3b ]---
+
+Signed-off-by: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_usb.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -266,15 +266,17 @@ static void rsi_rx_done_handler(struct u
+ if (urb->status)
+ goto out;
+
+- if (urb->actual_length <= 0) {
+- rsi_dbg(INFO_ZONE, "%s: Zero length packet\n", __func__);
++ if (urb->actual_length <= 0 ||
++ urb->actual_length > rx_cb->rx_skb->len) {
++ rsi_dbg(INFO_ZONE, "%s: Invalid packet length = %d\n",
++ __func__, urb->actual_length);
+ goto out;
+ }
+ if (skb_queue_len(&dev->rx_q) >= RSI_MAX_RX_PKTS) {
+ rsi_dbg(INFO_ZONE, "Max RX packets reached\n");
+ goto out;
+ }
+- skb_put(rx_cb->rx_skb, urb->actual_length);
++ skb_trim(rx_cb->rx_skb, urb->actual_length);
+ skb_queue_tail(&dev->rx_q, rx_cb->rx_skb);
+
+ rsi_set_event(&dev->rx_thread.event);
+@@ -308,6 +310,7 @@ static int rsi_rx_urb_submit(struct rsi_
+ if (!skb)
+ return -ENOMEM;
+ skb_reserve(skb, MAX_DWORD_ALIGN_BYTES);
++ skb_put(skb, RSI_MAX_RX_USB_PKT_SIZE - MAX_DWORD_ALIGN_BYTES);
+ dword_align_bytes = (unsigned long)skb->data & 0x3f;
+ if (dword_align_bytes > 0)
+ skb_push(skb, dword_align_bytes);
+@@ -319,7 +322,7 @@ static int rsi_rx_urb_submit(struct rsi_
+ usb_rcvbulkpipe(dev->usbdev,
+ dev->bulkin_endpoint_addr[ep_num - 1]),
+ urb->transfer_buffer,
+- RSI_MAX_RX_USB_PKT_SIZE,
++ skb->len,
+ rsi_rx_done_handler,
+ rx_cb);
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Janosch Frank <frankja@linux.ibm.com>
+Date: Tue, 2 Oct 2018 10:57:52 +0200
+Subject: s390/sthyi: Fix machine name validity indication
+
+From: Janosch Frank <frankja@linux.ibm.com>
+
+[ Upstream commit b5130dc2224d1881f24224c0590c6d97f2168d6a ]
+
+When running as a level 3 guest with no host provided sthyi support
+sclp_ocf_cpc_name_copy() will only return zeroes. Zeroes are not a
+valid group name, so let's not indicate that the group name field is
+valid.
+
+Also the group name is not dependent on stsi, let's not return based
+on stsi before setting it.
+
+Fixes: 95ca2cb57985 ("KVM: s390: Add sthyi emulation")
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/s390/kernel/sthyi.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/s390/kernel/sthyi.c
++++ b/arch/s390/kernel/sthyi.c
+@@ -183,17 +183,19 @@ static void fill_hdr(struct sthyi_sctns
+ static void fill_stsi_mac(struct sthyi_sctns *sctns,
+ struct sysinfo_1_1_1 *sysinfo)
+ {
++ sclp_ocf_cpc_name_copy(sctns->mac.infmname);
++ if (*(u64 *)sctns->mac.infmname != 0)
++ sctns->mac.infmval1 |= MAC_NAME_VLD;
++
+ if (stsi(sysinfo, 1, 1, 1))
+ return;
+
+- sclp_ocf_cpc_name_copy(sctns->mac.infmname);
+-
+ memcpy(sctns->mac.infmtype, sysinfo->type, sizeof(sctns->mac.infmtype));
+ memcpy(sctns->mac.infmmanu, sysinfo->manufacturer, sizeof(sctns->mac.infmmanu));
+ memcpy(sctns->mac.infmpman, sysinfo->plant, sizeof(sctns->mac.infmpman));
+ memcpy(sctns->mac.infmseq, sysinfo->sequence, sizeof(sctns->mac.infmseq));
+
+- sctns->mac.infmval1 |= MAC_ID_VLD | MAC_NAME_VLD;
++ sctns->mac.infmval1 |= MAC_ID_VLD;
+ }
+
+ static void fill_stsi_par(struct sthyi_sctns *sctns,
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Song Muchun <smuchun@gmail.com>
+Date: Sun, 14 Oct 2018 19:26:12 +0800
+Subject: sched/fair: Fix the min_vruntime update logic in dequeue_entity()
+
+From: Song Muchun <smuchun@gmail.com>
+
+[ Upstream commit 9845c49cc9bbb317a0bc9e9cf78d8e09d54c9af0 ]
+
+The comment and the code around the update_min_vruntime() call in
+dequeue_entity() are not in agreement.
+
+>From commit:
+
+ b60205c7c558 ("sched/fair: Fix min_vruntime tracking")
+
+I think that we want to update min_vruntime when a task is sleeping/migrating.
+So, the check is inverted there - fix it.
+
+Signed-off-by: Song Muchun <smuchun@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: b60205c7c558 ("sched/fair: Fix min_vruntime tracking")
+Link: http://lkml.kernel.org/r/20181014112612.2614-1-smuchun@gmail.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4321,7 +4321,7 @@ dequeue_entity(struct cfs_rq *cfs_rq, st
+ * put back on, and if we advance min_vruntime, we'll be placed back
+ * further than we started -- ie. we'll be penalized.
+ */
+- if ((flags & (DEQUEUE_SAVE | DEQUEUE_MOVE)) == DEQUEUE_SAVE)
++ if ((flags & (DEQUEUE_SAVE | DEQUEUE_MOVE)) != DEQUEUE_SAVE)
+ update_min_vruntime(cfs_rq);
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Finn Thain <fthain@telegraphics.com.au>
+Date: Tue, 16 Oct 2018 16:31:25 +1100
+Subject: scsi: esp_scsi: Track residual for PIO transfers
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit fd47d919d0c336e7c22862b51ee94927ffea227a ]
+
+If a target disconnects during a PIO data transfer the command may fail
+when the target reconnects:
+
+scsi host1: DMA length is zero!
+scsi host1: cur adr[04380000] len[00000000]
+
+The scsi bus is then reset. This happens because the residual reached
+zero before the transfer was completed.
+
+The usual residual calculation relies on the Transfer Count registers.
+That works for DMA transfers but not for PIO transfers. Fix the problem
+by storing the PIO transfer residual and using that to correctly
+calculate bytes_sent.
+
+Fixes: 6fe07aaffbf0 ("[SCSI] m68k: new mac_esp scsi driver")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/esp_scsi.c | 1 +
+ drivers/scsi/esp_scsi.h | 2 ++
+ drivers/scsi/mac_esp.c | 2 ++
+ 3 files changed, 5 insertions(+)
+
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -1338,6 +1338,7 @@ static int esp_data_bytes_sent(struct es
+
+ bytes_sent = esp->data_dma_len;
+ bytes_sent -= ecount;
++ bytes_sent -= esp->send_cmd_residual;
+
+ /*
+ * The am53c974 has a DMA 'pecularity'. The doc states:
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -540,6 +540,8 @@ struct esp {
+
+ void *dma;
+ int dmarev;
++
++ u32 send_cmd_residual;
+ };
+
+ /* A front-end driver for the ESP chip should do the following in
+--- a/drivers/scsi/mac_esp.c
++++ b/drivers/scsi/mac_esp.c
+@@ -427,6 +427,8 @@ static void mac_esp_send_pio_cmd(struct
+ scsi_esp_cmd(esp, ESP_CMD_TI);
+ }
+ }
++
++ esp->send_cmd_residual = esp_count;
+ }
+
+ static int mac_esp_irq_pending(struct esp *esp)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Mon, 10 Sep 2018 10:30:44 -0700
+Subject: scsi: lpfc: Correct race with abort on completion path
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit ca7fb76e091f889cfda1287c07a9358f73832b39 ]
+
+On io completion, the driver is taking an adapter wide lock and nulling the
+scsi command back pointer. The nulling of the back pointer is to signify the
+io was completed and the scsi_done() routine was called. However, the routine
+makes no check to see if the abort routine had done the same thing and
+possibly nulled the pointer. Thus it may doubly-complete the io.
+
+Make the following mods:
+
+- Check to make sure forward progress (call scsi_done()) only happens if the
+ command pointer was non-null.
+
+- As the taking of the lock, which is adapter wide, is very costly on a system
+ under load, null the pointer using an xchg operation rather than under lock.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -4140,9 +4140,17 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba
+ }
+ lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
+
+- spin_lock_irqsave(&phba->hbalock, flags);
+- lpfc_cmd->pCmd = NULL;
+- spin_unlock_irqrestore(&phba->hbalock, flags);
++ /* If pCmd was set to NULL from abort path, do not call scsi_done */
++ if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) {
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP,
++ "0711 FCP cmd already NULL, sid: 0x%06x, "
++ "did: 0x%06x, oxid: 0x%04x\n",
++ vport->fc_myDID,
++ (pnode) ? pnode->nlp_DID : 0,
++ phba->sli_rev == LPFC_SLI_REV4 ?
++ lpfc_cmd->cur_iocbq.sli4_xritag : 0xffff);
++ return;
++ }
+
+ /* The sdev is not guaranteed to be valid post scsi_done upcall. */
+ cmd->scsi_done(cmd);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: James Smart <jsmart2021@gmail.com>
+Date: Mon, 10 Sep 2018 10:30:45 -0700
+Subject: scsi: lpfc: Correct soft lockup when running mds diagnostics
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 0ef01a2d95fd62bb4f536e7ce4d5e8e74b97a244 ]
+
+When running an mds diagnostic that passes frames with the switch, soft
+lockups are detected. The driver is in a CQE processing loop and has
+sufficient amount of traffic that it never exits the ring processing routine,
+thus the "lockup".
+
+Cap the number of elements in the work processing routine to 64 elements. This
+ensures that the cpu will be given up and the handler reschedule to process
+additional items.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -3790,6 +3790,7 @@ lpfc_sli_handle_slow_ring_event_s4(struc
+ struct hbq_dmabuf *dmabuf;
+ struct lpfc_cq_event *cq_event;
+ unsigned long iflag;
++ int count = 0;
+
+ spin_lock_irqsave(&phba->hbalock, iflag);
+ phba->hba_flag &= ~HBA_SP_QUEUE_EVT;
+@@ -3811,16 +3812,22 @@ lpfc_sli_handle_slow_ring_event_s4(struc
+ if (irspiocbq)
+ lpfc_sli_sp_handle_rspiocb(phba, pring,
+ irspiocbq);
++ count++;
+ break;
+ case CQE_CODE_RECEIVE:
+ case CQE_CODE_RECEIVE_V1:
+ dmabuf = container_of(cq_event, struct hbq_dmabuf,
+ cq_event);
+ lpfc_sli4_handle_received_buffer(phba, dmabuf);
++ count++;
+ break;
+ default:
+ break;
+ }
++
++ /* Limit the number of events to 64 to avoid soft lockups */
++ if (count == 64)
++ break;
+ }
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Sat, 6 Oct 2018 13:34:21 -0500
+Subject: scsi: megaraid_sas: fix a missing-check bug
+
+From: Wenwen Wang <wang6495@umn.edu>
+
+[ Upstream commit 47db7873136a9c57c45390a53b57019cf73c8259 ]
+
+In megasas_mgmt_compat_ioctl_fw(), to handle the structure
+compat_megasas_iocpacket 'cioc', a user-space structure megasas_iocpacket
+'ioc' is allocated before megasas_mgmt_ioctl_fw() is invoked to handle
+the packet. Since the two data structures have different fields, the data
+is copied from 'cioc' to 'ioc' field by field. In the copy process,
+'sense_ptr' is prepared if the field 'sense_len' is not null, because it
+will be used in megasas_mgmt_ioctl_fw(). To prepare 'sense_ptr', the
+user-space data 'ioc->sense_off' and 'cioc->sense_off' are copied and
+saved to kernel-space variables 'local_sense_off' and 'user_sense_off'
+respectively. Given that 'ioc->sense_off' is also copied from
+'cioc->sense_off', 'local_sense_off' and 'user_sense_off' should have the
+same value. However, 'cioc' is in the user space and a malicious user can
+race to change the value of 'cioc->sense_off' after it is copied to
+'ioc->sense_off' but before it is copied to 'user_sense_off'. By doing
+so, the attacker can inject different values into 'local_sense_off' and
+'user_sense_off'. This can cause undefined behavior in the following
+execution, because the two variables are supposed to be same.
+
+This patch enforces a check on the two kernel variables 'local_sense_off'
+and 'user_sense_off' to make sure they are the same after the copy. In
+case they are not, an error code EINVAL will be returned.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -7499,6 +7499,9 @@ static int megasas_mgmt_compat_ioctl_fw(
+ get_user(user_sense_off, &cioc->sense_off))
+ return -EFAULT;
+
++ if (local_sense_off != user_sense_off)
++ return -EINVAL;
++
+ if (local_sense_len) {
+ void __user **sense_ioc_ptr =
+ (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Evan Green <evgreen@chromium.org>
+Date: Fri, 5 Oct 2018 10:27:32 -0700
+Subject: scsi: ufs: Schedule clk gating work on correct queue
+
+From: Evan Green <evgreen@chromium.org>
+
+[ Upstream commit f4bb7704699beee9edfbee875daa9089c86cf724 ]
+
+With commit 10e5e37581fc ("scsi: ufs: Add clock ungating to a separate
+workqueue"), clock gating work was moved to a separate work queue with
+WQ_MEM_RECLAIM set, since clock gating could occur from a memory reclaim
+context. Unfortunately, clk_gating.gate_work was left queued via
+schedule_delayed_work, which is a system workqueue that does not have
+WQ_MEM_RECLAIM set. Because ufshcd_ungate_work attempts to cancel
+gate_work, the following warning appears:
+
+[ 14.174170] workqueue: WQ_MEM_RECLAIM ufs_clk_gating_0:ufshcd_ungate_work is flushing !WQ_MEM_RECLAIM events:ufshcd_gate_work
+[ 14.174179] WARNING: CPU: 4 PID: 173 at kernel/workqueue.c:2440 check_flush_dependency+0x110/0x118
+[ 14.205725] CPU: 4 PID: 173 Comm: kworker/u16:3 Not tainted 4.14.68 #1
+[ 14.212437] Hardware name: Google Cheza (rev1) (DT)
+[ 14.217459] Workqueue: ufs_clk_gating_0 ufshcd_ungate_work
+[ 14.223107] task: ffffffc0f6a40080 task.stack: ffffff800a490000
+[ 14.229195] PC is at check_flush_dependency+0x110/0x118
+[ 14.234569] LR is at check_flush_dependency+0x110/0x118
+[ 14.239944] pc : [<ffffff80080cad14>] lr : [<ffffff80080cad14>] pstate: 60c001c9
+[ 14.333050] Call trace:
+[ 14.427767] [<ffffff80080cad14>] check_flush_dependency+0x110/0x118
+[ 14.434219] [<ffffff80080cafec>] start_flush_work+0xac/0x1fc
+[ 14.440046] [<ffffff80080caeec>] flush_work+0x40/0x94
+[ 14.445246] [<ffffff80080cb288>] __cancel_work_timer+0x11c/0x1b8
+[ 14.451433] [<ffffff80080cb4b8>] cancel_delayed_work_sync+0x20/0x30
+[ 14.457886] [<ffffff80085b9294>] ufshcd_ungate_work+0x24/0xd0
+[ 14.463800] [<ffffff80080cfb04>] process_one_work+0x32c/0x690
+[ 14.469713] [<ffffff80080d0154>] worker_thread+0x218/0x338
+[ 14.475361] [<ffffff80080d527c>] kthread+0x120/0x130
+[ 14.480470] [<ffffff8008084814>] ret_from_fork+0x10/0x18
+
+The simple solution is to put the gate_work on the same WQ_MEM_RECLAIM
+work queue as the ungate_work.
+
+Fixes: 10e5e37581fc ("scsi: ufs: Add clock ungating to a separate workqueue")
+Signed-off-by: Evan Green <evgreen@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1677,8 +1677,9 @@ static void __ufshcd_release(struct ufs_
+
+ hba->clk_gating.state = REQ_CLKS_OFF;
+ trace_ufshcd_clk_gating(dev_name(hba->dev), hba->clk_gating.state);
+- schedule_delayed_work(&hba->clk_gating.gate_work,
+- msecs_to_jiffies(hba->clk_gating.delay_ms));
++ queue_delayed_work(hba->clk_gating.clk_gating_workq,
++ &hba->clk_gating.gate_work,
++ msecs_to_jiffies(hba->clk_gating.delay_ms));
+ }
+
+ void ufshcd_release(struct ufs_hba *hba)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Wang Dongsheng <dongsheng.wang@hxt-semitech.com>
+Date: Thu, 16 Aug 2018 12:48:42 +0800
+Subject: sdhci: acpi: add free_slot callback
+
+From: Wang Dongsheng <dongsheng.wang@hxt-semitech.com>
+
+[ Upstream commit c7eabbee3de99347105faa7fd925a500ccf43baf ]
+
+The device specific resource can be free in free_slot after
+removing host controller.
+
+Signed-off-by: Wang Dongsheng <dongsheng.wang@hxt-semitech.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-acpi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -76,6 +76,7 @@ struct sdhci_acpi_slot {
+ size_t priv_size;
+ int (*probe_slot)(struct platform_device *, const char *, const char *);
+ int (*remove_slot)(struct platform_device *);
++ int (*free_slot)(struct platform_device *pdev);
+ int (*setup_host)(struct platform_device *pdev);
+ };
+
+@@ -756,6 +757,9 @@ static int sdhci_acpi_probe(struct platf
+ err_cleanup:
+ sdhci_cleanup_host(c->host);
+ err_free:
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+ return err;
+ }
+@@ -777,6 +781,10 @@ static int sdhci_acpi_remove(struct plat
+
+ dead = (sdhci_readl(c->host, SDHCI_INT_STATUS) == ~0);
+ sdhci_remove_host(c->host, dead);
++
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+
+ return 0;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Thu, 18 Oct 2018 22:13:02 +0900
+Subject: selftests: ftrace: Add synthetic event syntax testcase
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit ba0e41ca81b935b958006c7120466e2217357827 ]
+
+Add a testcase to check the syntax and field types for
+synthetic_events interface.
+
+Link: http://lkml.kernel.org/r/153986838264.18251.16627517536956299922.stgit@devbox
+
+Acked-by: Shuah Khan <shuah@kernel.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc | 80 ++++++++++
+ 1 file changed, 80 insertions(+)
+ create mode 100644 tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
+
+--- /dev/null
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
+@@ -0,0 +1,80 @@
++#!/bin/sh
++# SPDX-License-Identifier: GPL-2.0
++# description: event trigger - test synthetic_events syntax parser
++
++do_reset() {
++ reset_trigger
++ echo > set_event
++ clear_trace
++}
++
++fail() { #msg
++ do_reset
++ echo $1
++ exit_fail
++}
++
++if [ ! -f set_event ]; then
++ echo "event tracing is not supported"
++ exit_unsupported
++fi
++
++if [ ! -f synthetic_events ]; then
++ echo "synthetic event is not supported"
++ exit_unsupported
++fi
++
++reset_tracer
++do_reset
++
++echo "Test synthetic_events syntax parser"
++
++echo > synthetic_events
++
++# synthetic event must have a field
++! echo "myevent" >> synthetic_events
++echo "myevent u64 var1" >> synthetic_events
++
++# synthetic event must be found in synthetic_events
++grep "myevent[[:space:]]u64 var1" synthetic_events
++
++# it is not possible to add same name event
++! echo "myevent u64 var2" >> synthetic_events
++
++# Non-append open will cleanup all events and add new one
++echo "myevent u64 var2" > synthetic_events
++
++# multiple fields with different spaces
++echo "myevent u64 var1; u64 var2;" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++echo "myevent u64 var1 ; u64 var2 ;" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++echo "myevent u64 var1 ;u64 var2" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++
++# test field types
++echo "myevent u32 var" > synthetic_events
++echo "myevent u16 var" > synthetic_events
++echo "myevent u8 var" > synthetic_events
++echo "myevent s64 var" > synthetic_events
++echo "myevent s32 var" > synthetic_events
++echo "myevent s16 var" > synthetic_events
++echo "myevent s8 var" > synthetic_events
++
++echo "myevent char var" > synthetic_events
++echo "myevent int var" > synthetic_events
++echo "myevent long var" > synthetic_events
++echo "myevent pid_t var" > synthetic_events
++
++echo "myevent unsigned char var" > synthetic_events
++echo "myevent unsigned int var" > synthetic_events
++echo "myevent unsigned long var" > synthetic_events
++grep "myevent[[:space:]]unsigned long var" synthetic_events
++
++# test string type
++echo "myevent char var[10]" > synthetic_events
++grep "myevent[[:space:]]char\[10\] var" synthetic_events
++
++do_reset
++
++exit 0
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+Date: Fri, 5 Oct 2018 16:17:43 -0600
+Subject: selftests: usbip: add wait after attach and before checking port status
+
+From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
+
+[ Upstream commit 4b0aaacee51eb6592a03fdefd5ce97558518e291 ]
+
+Add sleep between attach and "usbip port" check to make sure status is
+updated. Running attach and query back shows incorrect status.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/drivers/usb/usbip/usbip_test.sh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/tools/testing/selftests/drivers/usb/usbip/usbip_test.sh
++++ b/tools/testing/selftests/drivers/usb/usbip/usbip_test.sh
+@@ -143,6 +143,10 @@ echo "Import devices from localhost - sh
+ src/usbip attach -r localhost -b $busid;
+ echo "=============================================================="
+
++# Wait for sysfs file to be updated. Without this sleep, usbip port
++# shows no imported devices.
++sleep 3;
++
+ echo "List imported devices - expect to see imported devices";
+ src/usbip port;
+ echo "=============================================================="
x86-corruption-check-fix-panic-in-memory_corruption_check-when-boot-option-without-value-is-provided.patch
x86-mm-pat-disable-preemption-around-__flush_tlb_all.patch
x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
+arm-dts-exynos-disable-pull-control-for-max8997-interrupts-on-origen.patch
+drm-fix-use-of-freed-memory-in-drm_mode_setcrtc.patch
+bpf-do-not-blindly-change-rlimit-in-reuseport-net-selftest.patch
+nvme-remove-ns-sibling-before-clearing-path.patch
+revert-perf-tools-fix-pmu-term-format-max-value-calculation.patch
+selftests-usbip-add-wait-after-attach-and-before-checking-port-status.patch
+xsk-do-not-call-synchronize_net-under-rcu-read-lock.patch
+xfrm-policy-use-hlist-rcu-variants-on-insert.patch
+perf-vendor-events-intel-fix-wrong-filter_band-values-for-uncore-events.patch
+r8169-enable-msi-x-on-rtl8106e.patch
+nfp-flower-fix-pedit-set-actions-for-multiple-partial-masks.patch
+nfp-flower-use-offsets-provided-by-pedit-instead-of-index-for-ipv6.patch
+sched-fair-fix-the-min_vruntime-update-logic-in-dequeue_entity.patch
+perf-evsel-store-ids-for-events-with-their-own-cpus-perf_event__synthesize_event_update_cpus.patch
+perf-tools-fix-use-of-alternatives-to-find-jdir.patch
+perf-cpu_map-align-cpu-map-synthesized-events-properly.patch
+perf-report-don-t-crash-on-invalid-inline-debug-information.patch
+x86-fpu-remove-second-definition-of-fpu-in-__fpu__restore_sig.patch
+net-qla3xxx-remove-overflowing-shift-statement.patch
+r8169-re-enable-msi-x-on-rtl8168g.patch
+drm-get-ref-on-crtc-commit-object-when-waiting-for-flip_done.patch
+selftests-ftrace-add-synthetic-event-syntax-testcase.patch
+i2c-rcar-cleanup-dma-for-all-kinds-of-failure.patch
+net-socionext-reset-tx-queue-in-ndo_stop.patch
+net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch
+locking-lockdep-fix-debug_locks-off-performance-problem.patch
+netfilter-xt_nat-fix-dnat-target-for-shifted-portmap-ranges.patch
+ataflop-fix-error-handling-during-setup.patch
+swim-fix-cleanup-on-setup-error.patch
+arm64-cpufeature-ctr-fix-cpu-capability-check-for-late-cpus.patch
+nfp-devlink-port-split-support-for-1x100g-cxp-nic.patch
+tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch
+s390-sthyi-fix-machine-name-validity-indication.patch
+hwmon-pwm-fan-set-fan-speed-to-0-on-suspend.patch
+lightnvm-pblk-fix-race-on-sysfs-line-state.patch
+lightnvm-pblk-fix-two-sleep-in-atomic-context-bugs.patch
+lightnvm-pblk-fix-race-condition-on-metadata-i-o.patch
+spi-spi-ep93xx-use-dma_data_direction-for-ep93xx_spi_dma_-finish-prepare.patch
+perf-tools-free-temporary-sys-string-in-read_event_files.patch
+perf-tools-cleanup-trace-event-info-tdata-leak.patch
+perf-strbuf-match-va_-add-copy-with-va_end.patch
+cpupower-fix-coredump-on-vmware.patch
+bcache-populate-writeback_rate_minimum-attribute.patch
+mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch
+sdhci-acpi-add-free_slot-callback.patch
+mtd-rawnand-denali-set-spare_area_skip_bytes-register-to-8-if-unset.patch
+iwlwifi-pcie-avoid-empty-free-rb-queue.patch
+iwlwifi-mvm-clear-hw_restart_requested-when-stopping-the-interface.patch
+iwlwifi-mvm-check-for-n_profiles-validity-in-ewrd-acpi.patch
+x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch
+nvmet-rdma-use-a-private-workqueue-for-delete.patch
+acpi-pptt-handle-architecturally-unknown-cache-types.patch
+acpi-pm-lpit-register-sysfs-attributes-based-on-fadt.patch
+acpi-processor-fix-the-return-value-of-acpi_processor_ids_walk.patch
+cpufreq-dt-try-freeing-static-opps-only-if-we-have-added-them.patch
+x86-intel_rdt-show-missing-resctrl-mount-options.patch
+mtd-rawnand-atmel-fix-potential-null-pointer-dereference.patch
+signal-introduce-compat_sigminstksz-for-use-in-compat_sys_sigaltstack.patch
+ice-fix-changing-of-ring-descriptor-size-ethtool-g.patch
+ice-update-fw-version-check-logic.patch
+net-hns3-fix-for-packet-buffer-setting-bug.patch
+bluetooth-btbcm-add-entry-for-bcm4335c0-uart-bluetooth.patch
+x86-boot-fix-efi-stub-alignment.patch
+net-hns3-add-nic-state-check-before-calling-netif_tx_wake_queue.patch
+net-hns3-fix-ets-validate-issue.patch
+pinctrl-sunxi-fix-pctrl-functions-allocation-in-sunxi_pinctrl_build_state.patch
+pinctrl-qcom-spmi-mpp-fix-err-handling-of-pmic_mpp_set_mux.patch
+brcmfmac-fix-for-proper-support-of-160mhz-bandwidth.patch
+net-hns3-check-hdev-state-when-getting-link-status.patch
+net-hns3-set-state_down-bit-of-hdev-state-when-stopping-net.patch
+net-phy-phylink-ensure-the-carrier-is-off-when-starting-phylink.patch
+block-bfq-correctly-charge-and-reset-entity-service-in-all-cases.patch
+arm64-entry-allow-handling-of-undefined-instructions-from-el1.patch
+kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch
+spi-gpio-no-miso-does-not-imply-no-rx.patch
+acpi-lpss-add-alternative-acpi-hids-for-cherry-trail-dma-controllers.patch
+pinctrl-qcom-spmi-mpp-fix-drive-strength-setting.patch
+bpf-verifier-fix-verifier-instability.patch
+failover-add-missing-check-to-validate-slave_dev-in-net_failover_slave_unregister.patch
+perf-tests-fix-record-probe_libc_inet_pton.sh-without-ping-s-debuginfo.patch
+pinctrl-spmi-mpp-fix-pmic_mpp_config_get-to-be-compliant.patch
+pinctrl-ssbi-gpio-fix-pm8xxx_pin_config_get-to-be-compliant.patch
+net-hns3-preserve-vlan-0-in-hardware-table.patch
+net-hns3-fix-ping-exited-problem-when-doing-lp-selftest.patch
+net-hns3-fix-for-vf-vlan-delete-failed-problem.patch
+net-dsa-mv88e6xxx-fix-writing-to-a-phy-page.patch
+rsi-fix-memory-alignment-issue-in-arm32-platforms.patch
+iwlwifi-mvm-fix-bar-seq-ctrl-reporting.patch
+gpio-brcmstb-allow-0-width-gpio-banks.patch
+ixgbe-disallow-ipsec-tx-offload-when-in-sr-iov-mode.patch
+ixgbevf-vf2vf-tcp-rss.patch
+ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch
+libata-apply-nolpm-quirk-for-samsung-mz7td256hafv-000l9.patch
+thermal-rcar_thermal-prevent-doing-work-after-unbind.patch
+thermal-da9062-61-prevent-hardware-access-during-system-suspend.patch
+cgroup-netclassid-add-a-preemption-point-to-write_classid.patch
+net-stmmac-dwmac-sun8i-fix-of-child-node-lookup.patch
+f2fs-fix-to-account-io-correctly-for-cgroup-writeback.patch
+md-memory-leak-when-flush-bio-size-is-zero.patch
+md-fix-memleak-for-mempool.patch
+scsi-esp_scsi-track-residual-for-pio-transfers.patch
+scsi-ufs-schedule-clk-gating-work-on-correct-queue.patch
+uapi-ndctl-fix-g-unsupported-initialisation-in-headers.patch
+kvm-nvmx-clear-reserved-bits-of-db-exit-qualification.patch
+scsi-megaraid_sas-fix-a-missing-check-bug.patch
+rdma-core-do-not-expose-unsupported-counters.patch
+ib-ipoib-clear-ipcb-before-icmp_send.patch
+rdma-bnxt_re-avoid-accessing-nq-bar_reg_iomem-in-failure-case.patch
+rdma-bnxt_re-fix-recursive-lock-warning-in-debug-kernel.patch
+usb-host-ohci-at91-fix-request-of-irq-for-optional-gpio.patch
+pci-mediatek-fix-mtk_pcie_find_port-endpoint-port-matching-logic.patch
+pci-cadence-use-axi-region-0-to-signal-interrupts-from-ep.patch
+usb-typec-tcpm-report-back-negotiated-pps-voltage-and-current.patch
+tpm-suppress-transmit-cmd-error-logs-when-tpm-1.2-is-disabled-deactivated.patch
+f2fs-clear-pageerror-on-the-read-path.patch
+drivers-hv-vmbus-use-cpumask_var_t-for-on-stack-cpu-mask.patch
+vmci-resource-wildcard-match-fixed.patch
+pci-acpi-enable-wake-automatically-for-power-managed-bridges.patch
+xprtrdma-reset-credit-grant-properly-after-a-disconnect.patch
+irqchip-pdc-setup-all-edge-interrupts-as-rising-edge-at-gic.patch
+usb-dwc2-fix-a-race-with-external-vbus-supply.patch
+usb-gadget-udc-atmel-handle-at91sam9rl-pmc.patch
+ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch
+md-fix-invalid-stored-role-for-a-disk.patch
+nvmem-check-the-return-value-of-nvmem_add_cells.patch
+xhci-avoid-usb-autosuspend-when-resuming-usb2-ports.patch
+f2fs-fix-to-recover-inode-s-crtime-during-por.patch
+f2fs-fix-to-recover-inode-s-i_flags-during-por.patch
+pci-msi-warn-and-return-error-if-driver-enables-msi-msi-x-twice.patch
+coresight-etb10-fix-handling-of-perf-mode.patch
+pci-dwc-pci-dra7xx-enable-errata-i870-for-both-ep-and-rc-mode.patch
+crypto-caam-fix-implicit-casts-in-endianness-helpers.patch
+usb-chipidea-prevent-unbalanced-irq-disable.patch
+smack-ptrace-capability-use-fixes.patch
+driver-dma-ioat-call-del_timer_sync-without-holding-prep_lock.patch
+firmware-coreboot-unmap-ioregion-after-device-population.patch
+ib-mlx5-allow-transition-of-dci-qp-to-reset.patch
+uio-ensure-class-is-registered-before-devices.patch
+scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch
+scsi-lpfc-correct-race-with-abort-on-completion-path.patch
+f2fs-avoid-sleeping-under-spin_lock.patch
+f2fs-report-error-if-quota-off-error-during-umount.patch
+signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch
+mfd-menelaus-fix-possible-race-condition-and-leak.patch
+dmaengine-dma-jz4780-return-error-if-not-probed-from-dt.patch
+ib-rxe-fix-for-duplicate-request-processing-and-ack-psns.patch
+alsa-hda-check-the-non-cached-stream-buffers-more-explicitly.patch
+cpupower-fix-amd-family-0x17-msr_pstate-size.patch
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 3 Sep 2018 20:02:46 +0200
+Subject: signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+[ Upstream commit 3597dfe01d12f570bc739da67f857fd222a3ea66 ]
+
+Instead of playing whack-a-mole and changing SEND_SIG_PRIV to
+SEND_SIG_FORCED throughout the kernel to ensure a pid namespace init
+gets signals sent by the kernel, stop allowing a pid namespace init to
+ignore SIGKILL or SIGSTOP sent by the kernel. A pid namespace init is
+only supposed to be able to ignore signals sent from itself and
+children with SIG_DFL.
+
+Fixes: 921cf9f63089 ("signals: protect cinit from unblocked SIG_DFL signals")
+Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/signal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1009,7 +1009,7 @@ static int __send_signal(int sig, struct
+
+ result = TRACE_SIGNAL_IGNORED;
+ if (!prepare_signal(sig, t,
+- from_ancestor_ns || (info == SEND_SIG_FORCED)))
++ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
+ goto ret;
+
+ pending = group ? &t->signal->shared_pending : &t->pending;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Will Deacon <will.deacon@arm.com>
+Date: Wed, 5 Sep 2018 15:34:42 +0100
+Subject: signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
+
+From: Will Deacon <will.deacon@arm.com>
+
+[ Upstream commit 22839869f21ab3850fbbac9b425ccc4c0023926f ]
+
+The sigaltstack(2) system call fails with -ENOMEM if the new alternative
+signal stack is found to be smaller than SIGMINSTKSZ. On architectures
+such as arm64, where the native value for SIGMINSTKSZ is larger than
+the compat value, this can result in an unexpected error being reported
+to a compat task. See, for example:
+
+ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904385
+
+This patch fixes the problem by extending do_sigaltstack to take the
+minimum signal stack size as an additional parameter, allowing the
+native and compat system call entry code to pass in their respective
+values. COMPAT_SIGMINSTKSZ is just defined as SIGMINSTKSZ if it has not
+been defined by the architecture.
+
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Reported-by: Steve McIntyre <steve.mcintyre@arm.com>
+Tested-by: Steve McIntyre <93sam@debian.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/compat.h | 3 +++
+ kernel/signal.c | 14 +++++++++-----
+ 2 files changed, 12 insertions(+), 5 deletions(-)
+
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -103,6 +103,9 @@ typedef struct compat_sigaltstack {
+ compat_size_t ss_size;
+ } compat_stack_t;
+ #endif
++#ifndef COMPAT_MINSIGSTKSZ
++#define COMPAT_MINSIGSTKSZ MINSIGSTKSZ
++#endif
+
+ #define compat_jiffies_to_clock_t(x) \
+ (((unsigned long)(x) * COMPAT_USER_HZ) / HZ)
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -3417,7 +3417,8 @@ int do_sigaction(int sig, struct k_sigac
+ }
+
+ static int
+-do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
++do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp,
++ size_t min_ss_size)
+ {
+ struct task_struct *t = current;
+
+@@ -3447,7 +3448,7 @@ do_sigaltstack (const stack_t *ss, stack
+ ss_size = 0;
+ ss_sp = NULL;
+ } else {
+- if (unlikely(ss_size < MINSIGSTKSZ))
++ if (unlikely(ss_size < min_ss_size))
+ return -ENOMEM;
+ }
+
+@@ -3465,7 +3466,8 @@ SYSCALL_DEFINE2(sigaltstack,const stack_
+ if (uss && copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+ err = do_sigaltstack(uss ? &new : NULL, uoss ? &old : NULL,
+- current_user_stack_pointer());
++ current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ if (!err && uoss && copy_to_user(uoss, &old, sizeof(stack_t)))
+ err = -EFAULT;
+ return err;
+@@ -3476,7 +3478,8 @@ int restore_altstack(const stack_t __use
+ stack_t new;
+ if (copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+- (void)do_sigaltstack(&new, NULL, current_user_stack_pointer());
++ (void)do_sigaltstack(&new, NULL, current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ /* squash all but EFAULT for now */
+ return 0;
+ }
+@@ -3510,7 +3513,8 @@ static int do_compat_sigaltstack(const c
+ uss.ss_size = uss32.ss_size;
+ }
+ ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss,
+- compat_user_stack_pointer());
++ compat_user_stack_pointer(),
++ COMPAT_MINSIGSTKSZ);
+ if (ret >= 0 && uoss_ptr) {
+ compat_stack_t old;
+ memset(&old, 0, sizeof(old));
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Casey Schaufler <casey.schaufler@intel.com>
+Date: Tue, 18 Sep 2018 16:09:16 -0700
+Subject: Smack: ptrace capability use fixes
+
+From: Casey Schaufler <casey.schaufler@intel.com>
+
+[ Upstream commit dcb569cf6ac99ca899b8109c128b6ae52477a015 ]
+
+This fixes a pair of problems in the Smack ptrace checks
+related to checking capabilities. In both cases, as reported
+by Lukasz Pawelczyk, the raw capability calls are used rather
+than the Smack wrapper that check addition restrictions.
+In one case, as reported by Jann Horn, the wrong task is being
+checked for capabilities.
+
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/smack/smack_lsm.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -420,6 +420,7 @@ static int smk_ptrace_rule_check(struct
+ struct smk_audit_info ad, *saip = NULL;
+ struct task_smack *tsp;
+ struct smack_known *tracer_known;
++ const struct cred *tracercred;
+
+ if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
+ smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
+@@ -428,7 +429,8 @@ static int smk_ptrace_rule_check(struct
+ }
+
+ rcu_read_lock();
+- tsp = __task_cred(tracer)->security;
++ tracercred = __task_cred(tracer);
++ tsp = tracercred->security;
+ tracer_known = smk_of_task(tsp);
+
+ if ((mode & PTRACE_MODE_ATTACH) &&
+@@ -438,7 +440,7 @@ static int smk_ptrace_rule_check(struct
+ rc = 0;
+ else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
+ rc = -EACCES;
+- else if (capable(CAP_SYS_PTRACE))
++ else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
+ rc = 0;
+ else
+ rc = -EACCES;
+@@ -1840,6 +1842,7 @@ static int smack_file_send_sigiotask(str
+ {
+ struct smack_known *skp;
+ struct smack_known *tkp = smk_of_task(tsk->cred->security);
++ const struct cred *tcred;
+ struct file *file;
+ int rc;
+ struct smk_audit_info ad;
+@@ -1853,8 +1856,12 @@ static int smack_file_send_sigiotask(str
+ skp = file->f_security;
+ rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
+ rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
+- if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
++
++ rcu_read_lock();
++ tcred = __task_cred(tsk);
++ if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
+ rc = 0;
++ rcu_read_unlock();
+
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, tsk);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 10 Sep 2018 00:28:05 +0200
+Subject: spi: gpio: No MISO does not imply no RX
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit abf5feef3ff0cefade0c76be53b59e55fdd46093 ]
+
+There is a logical problem in spi-gpio with host just
+assigning a MOSI line and no MISO: this is interpreted
+as the host cannot do RX and the host is flagged with
+SPI_MASTER_NO_RX.
+
+This is wrong: since GPIO lines can switch direction,
+in 3WIRE operation the host will simply reverse the
+direction of the GPIO line and start reading from it,
+there is even code for doing this in the driver, but
+it went unnoticed because it was tested by using a
+master with 4 wires but a device using just 3 wires.
+
+Remove the offending flag.
+
+Cc: Andrzej Hajda <a.hajda@samsung.com>
+Cc: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-gpio.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -282,9 +282,11 @@ static int spi_gpio_request(struct devic
+ spi_gpio->miso = devm_gpiod_get_optional(dev, "miso", GPIOD_IN);
+ if (IS_ERR(spi_gpio->miso))
+ return PTR_ERR(spi_gpio->miso);
+- if (!spi_gpio->miso)
+- /* HW configuration without MISO pin */
+- *mflags |= SPI_MASTER_NO_RX;
++ /*
++ * No setting SPI_MASTER_NO_RX here - if there is only a MOSI
++ * pin connected the host can still do RX by changing the
++ * direction of the line.
++ */
+
+ spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
+ if (IS_ERR(spi_gpio->sck))
+@@ -408,7 +410,7 @@ static int spi_gpio_probe(struct platfor
+ spi_gpio->bitbang.master = master;
+ spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
+
+- if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
++ if ((master_flags & SPI_MASTER_NO_TX) == 0) {
+ spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Mon, 8 Oct 2018 11:08:47 -0700
+Subject: spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare}
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit a1108c7b2efb892350ba6a0e932dfd45622f4e2b ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/spi/spi-ep93xx.c:342:62: warning: implicit conversion from
+enumeration type 'enum dma_transfer_direction' to different enumeration
+type 'enum dma_data_direction' [-Wenum-conversion]
+ nents = dma_map_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
+./include/linux/dma-mapping.h:428:58: note: expanded from macro
+'dma_map_sg'
+#define dma_map_sg(d, s, n, r) dma_map_sg_attrs(d, s, n, r, 0)
+ ~~~~~~~~~~~~~~~~ ^
+drivers/spi/spi-ep93xx.c:348:57: warning: implicit conversion from
+enumeration type 'enum dma_transfer_direction' to different enumeration
+type 'enum dma_data_direction' [-Wenum-conversion]
+ dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
+./include/linux/dma-mapping.h:429:62: note: expanded from macro
+'dma_unmap_sg'
+#define dma_unmap_sg(d, s, n, r) dma_unmap_sg_attrs(d, s, n, r, 0)
+ ~~~~~~~~~~~~~~~~~~ ^
+drivers/spi/spi-ep93xx.c:377:56: warning: implicit conversion from
+enumeration type 'enum dma_transfer_direction' to different enumeration
+type 'enum dma_data_direction' [-Wenum-conversion]
+ dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
+./include/linux/dma-mapping.h:429:62: note: expanded from macro
+'dma_unmap_sg'
+#define dma_unmap_sg(d, s, n, r) dma_unmap_sg_attrs(d, s, n, r, 0)
+ ~~~~~~~~~~~~~~~~~~ ^
+3 warnings generated.
+
+dma_{,un}map_sg expect an enum of type dma_data_direction but this
+driver uses dma_transfer_direction for everything. Convert the driver to
+use dma_data_direction for these two functions.
+
+There are two places that strictly require an enum of type
+dma_transfer_direction: the direction member in struct dma_slave_config
+and the direction parameter in dmaengine_prep_slave_sg. To avoid using
+an explicit cast, add a simple function, ep93xx_dma_data_to_trans_dir,
+to safely map between the two types because they are not 1 to 1 in
+meaning.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/spi/spi-ep93xx.c | 36 +++++++++++++++++++++++++-----------
+ 1 file changed, 25 insertions(+), 11 deletions(-)
+
+--- a/drivers/spi/spi-ep93xx.c
++++ b/drivers/spi/spi-ep93xx.c
+@@ -246,6 +246,19 @@ static int ep93xx_spi_read_write(struct
+ return -EINPROGRESS;
+ }
+
++static enum dma_transfer_direction
++ep93xx_dma_data_to_trans_dir(enum dma_data_direction dir)
++{
++ switch (dir) {
++ case DMA_TO_DEVICE:
++ return DMA_MEM_TO_DEV;
++ case DMA_FROM_DEVICE:
++ return DMA_DEV_TO_MEM;
++ default:
++ return DMA_TRANS_NONE;
++ }
++}
++
+ /**
+ * ep93xx_spi_dma_prepare() - prepares a DMA transfer
+ * @master: SPI master
+@@ -257,7 +270,7 @@ static int ep93xx_spi_read_write(struct
+ */
+ static struct dma_async_tx_descriptor *
+ ep93xx_spi_dma_prepare(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct spi_transfer *xfer = master->cur_msg->state;
+@@ -277,9 +290,9 @@ ep93xx_spi_dma_prepare(struct spi_master
+ buswidth = DMA_SLAVE_BUSWIDTH_1_BYTE;
+
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = dir;
++ conf.direction = ep93xx_dma_data_to_trans_dir(dir);
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ buf = xfer->rx_buf;
+ sgt = &espi->rx_sgt;
+@@ -343,7 +356,8 @@ ep93xx_spi_dma_prepare(struct spi_master
+ if (!nents)
+ return ERR_PTR(-ENOMEM);
+
+- txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, dir, DMA_CTRL_ACK);
++ txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, conf.direction,
++ DMA_CTRL_ACK);
+ if (!txd) {
+ dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ return ERR_PTR(-ENOMEM);
+@@ -360,13 +374,13 @@ ep93xx_spi_dma_prepare(struct spi_master
+ * unmapped.
+ */
+ static void ep93xx_spi_dma_finish(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_chan *chan;
+ struct sg_table *sgt;
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ sgt = &espi->rx_sgt;
+ } else {
+@@ -381,8 +395,8 @@ static void ep93xx_spi_dma_callback(void
+ {
+ struct spi_master *master = callback_param;
+
+- ep93xx_spi_dma_finish(master, DMA_MEM_TO_DEV);
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_TO_DEVICE);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+
+ spi_finalize_current_transfer(master);
+ }
+@@ -392,15 +406,15 @@ static int ep93xx_spi_dma_transfer(struc
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_async_tx_descriptor *rxd, *txd;
+
+- rxd = ep93xx_spi_dma_prepare(master, DMA_DEV_TO_MEM);
++ rxd = ep93xx_spi_dma_prepare(master, DMA_FROM_DEVICE);
+ if (IS_ERR(rxd)) {
+ dev_err(&master->dev, "DMA RX failed: %ld\n", PTR_ERR(rxd));
+ return PTR_ERR(rxd);
+ }
+
+- txd = ep93xx_spi_dma_prepare(master, DMA_MEM_TO_DEV);
++ txd = ep93xx_spi_dma_prepare(master, DMA_TO_DEVICE);
+ if (IS_ERR(txd)) {
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+ dev_err(&master->dev, "DMA TX failed: %ld\n", PTR_ERR(txd));
+ return PTR_ERR(txd);
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Omar Sandoval <osandov@fb.com>
+Date: Thu, 11 Oct 2018 12:20:41 -0700
+Subject: swim: fix cleanup on setup error
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 1448a2a5360ae06f25e2edc61ae070dff5c0beb4 ]
+
+If we fail to allocate the request queue for a disk, we still need to
+free that disk, not just the previous ones. Additionally, we need to
+cleanup the previous request queues.
+
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/swim.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -887,8 +887,17 @@ static int swim_floppy_init(struct swim_
+
+ exit_put_disks:
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+- while (drive--)
+- put_disk(swd->unit[drive].disk);
++ do {
++ struct gendisk *disk = swd->unit[drive].disk;
++
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(disk);
++ }
++ } while (drive--);
+ return err;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 12 Oct 2018 09:20:17 +0200
+Subject: thermal: da9062/61: Prevent hardware access during system suspend
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 760eea43f8c6d48684f1f34b8a02fddc1456e849 ]
+
+The workqueue used for monitoring the hardware may run while the device
+is already suspended. Fix this by using the freezable system workqueue
+instead, cfr. commit 51e20d0e3a60cf46 ("thermal: Prevent polling from
+happening during system suspend").
+
+Fixes: 608567aac3206ae8 ("thermal: da9062/61: Thermal junction temperature monitoring driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Steve Twiss <stwiss.opensource@diasemi.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/da9062-thermal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/thermal/da9062-thermal.c
++++ b/drivers/thermal/da9062-thermal.c
+@@ -106,7 +106,7 @@ static void da9062_thermal_poll_on(struc
+ THERMAL_EVENT_UNSPECIFIED);
+
+ delay = msecs_to_jiffies(thermal->zone->passive_delay);
+- schedule_delayed_work(&thermal->work, delay);
++ queue_delayed_work(system_freezable_wq, &thermal->work, delay);
+ return;
+ }
+
+@@ -125,7 +125,7 @@ static irqreturn_t da9062_thermal_irq_ha
+ struct da9062_thermal *thermal = data;
+
+ disable_irq_nosync(thermal->irq);
+- schedule_delayed_work(&thermal->work, 0);
++ queue_delayed_work(system_freezable_wq, &thermal->work, 0);
+
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 12 Oct 2018 09:20:16 +0200
+Subject: thermal: rcar_thermal: Prevent doing work after unbind
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 697ee786f15d7b65c7f3045d45fe3a05d28e0911 ]
+
+When testing bind/unbind on r8a7791/koelsch:
+
+ WARNING: CPU: 1 PID: 697 at lib/debugobjects.c:329 debug_print_object+0x8c/0xb4
+ ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x10
+
+This happens if the workqueue runs after the device has been unbound.
+Fix this by cancelling any queued work during remove.
+
+Fixes: e0a5172e9eec7f0d ("thermal: rcar: add interrupt support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thermal/rcar_thermal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -465,6 +465,7 @@ static int rcar_thermal_remove(struct pl
+
+ rcar_thermal_for_each_priv(priv, common) {
+ rcar_thermal_irq_disable(priv);
++ cancel_delayed_work_sync(&priv->work);
+ if (priv->chip->use_of_thermal)
+ thermal_remove_hwmon_sysfs(priv->zone);
+ else
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Thu, 30 Aug 2018 16:40:05 +0200
+Subject: tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
+
+From: Javier Martinez Canillas <javierm@redhat.com>
+
+[ Upstream commit 0d6d0d62d9505a9816716aa484ebd0b04c795063 ]
+
+For TPM 1.2 chips the system setup utility allows to set the TPM device in
+one of the following states:
+
+ * Active: Security chip is functional
+ * Inactive: Security chip is visible, but is not functional
+ * Disabled: Security chip is hidden and is not functional
+
+When choosing the "Inactive" state, the TPM 1.2 device is enumerated and
+registered, but sending TPM commands fail with either TPM_DEACTIVATED or
+TPM_DISABLED depending if the firmware deactivated or disabled the TPM.
+
+Since these TPM 1.2 error codes don't have special treatment, inactivating
+the TPM leads to a very noisy kernel log buffer that shows messages like
+the following:
+
+ tpm_tis 00:05: 1.2 TPM (device-id 0x0, rev-id 78)
+ tpm tpm0: A TPM error (6) occurred attempting to read a pcr value
+ tpm tpm0: TPM is disabled/deactivated (0x6)
+ tpm tpm0: A TPM error (6) occurred attempting get random
+ tpm tpm0: A TPM error (6) occurred attempting to read a pcr value
+ ima: No TPM chip found, activating TPM-bypass! (rc=6)
+ tpm tpm0: A TPM error (6) occurred attempting get random
+ tpm tpm0: A TPM error (6) occurred attempting get random
+ tpm tpm0: A TPM error (6) occurred attempting get random
+ tpm tpm0: A TPM error (6) occurred attempting get random
+
+Let's just suppress error log messages for the TPM_{DEACTIVATED,DISABLED}
+return codes, since this is expected when the TPM 1.2 is set to Inactive.
+
+In that case the kernel log is cleaner and less confusing for users, i.e:
+
+ tpm_tis 00:05: 1.2 TPM (device-id 0x0, rev-id 78)
+ tpm tpm0: TPM is disabled/deactivated (0x6)
+ ima: No TPM chip found, activating TPM-bypass! (rc=6)
+
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm-interface.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -664,7 +664,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip
+ return len;
+
+ err = be32_to_cpu(header->return_code);
+- if (err != 0 && desc)
++ if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED
++ && desc)
+ dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
+ desc);
+ if (err)
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Serhey Popovych <serhe.popovych@gmail.com>
+Date: Tue, 9 Oct 2018 21:21:01 +0300
+Subject: tun: Consistently configure generic netdev params via rtnetlink
+
+From: Serhey Popovych <serhe.popovych@gmail.com>
+
+[ Upstream commit df52eab23d703142c766ac00bdb8db19d71238d0 ]
+
+Configuring generic network device parameters on tun will fail in
+presence of IFLA_INFO_KIND attribute in IFLA_LINKINFO nested attribute
+since tun_validate() always return failure.
+
+This can be visualized with following ip-link(8) command sequences:
+
+ # ip link set dev tun0 group 100
+ # ip link set dev tun0 group 100 type tun
+ RTNETLINK answers: Invalid argument
+
+with contrast to dummy and veth drivers:
+
+ # ip link set dev dummy0 group 100
+ # ip link set dev dummy0 type dummy
+
+ # ip link set dev veth0 group 100
+ # ip link set dev veth0 group 100 type veth
+
+Fix by returning zero in tun_validate() when @data is NULL that is
+always in case since rtnl_link_ops->maxtype is zero in tun driver.
+
+Fixes: f019a7a594d9 ("tun: Implement ip link del tunXXX")
+Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/tun.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -2304,6 +2304,8 @@ static void tun_setup(struct net_device
+ static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
++ if (!data)
++ return 0;
+ return -EINVAL;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 6 Sep 2018 10:19:24 +0100
+Subject: UAPI: ndctl: Fix g++-unsupported initialisation in headers
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 9607871f37dc3e717639694b8d0dc738f2a68efc ]
+
+The following code in the linux/ndctl header file:
+
+ static inline const char *nvdimm_bus_cmd_name(unsigned cmd)
+ {
+ static const char * const names[] = {
+ [ND_CMD_ARS_CAP] = "ars_cap",
+ [ND_CMD_ARS_START] = "ars_start",
+ [ND_CMD_ARS_STATUS] = "ars_status",
+ [ND_CMD_CLEAR_ERROR] = "clear_error",
+ [ND_CMD_CALL] = "cmd_call",
+ };
+
+ if (cmd < ARRAY_SIZE(names) && names[cmd])
+ return names[cmd];
+ return "unknown";
+ }
+
+is broken in a number of ways:
+
+ (1) ARRAY_SIZE() is not generally defined.
+
+ (2) g++ does not support "non-trivial" array initialisers fully yet.
+
+ (3) Every file that calls this function will acquire a copy of names[].
+
+The same goes for nvdimm_cmd_name().
+
+Fix all three by converting to a switch statement where each case returns a
+string. That way if cmd is a constant, the compiler can trivially reduce it
+and, if not, the compiler can use a shared lookup table if it thinks that is
+more efficient.
+
+A better way would be to remove these functions and their arrays from the
+header entirely.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/uapi/linux/ndctl.h | 48 +++++++++++++++++++--------------------------
+ 1 file changed, 21 insertions(+), 27 deletions(-)
+
+--- a/include/uapi/linux/ndctl.h
++++ b/include/uapi/linux/ndctl.h
+@@ -128,37 +128,31 @@ enum {
+
+ static inline const char *nvdimm_bus_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_ARS_CAP] = "ars_cap",
+- [ND_CMD_ARS_START] = "ars_start",
+- [ND_CMD_ARS_STATUS] = "ars_status",
+- [ND_CMD_CLEAR_ERROR] = "clear_error",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_ARS_CAP: return "ars_cap";
++ case ND_CMD_ARS_START: return "ars_start";
++ case ND_CMD_ARS_STATUS: return "ars_status";
++ case ND_CMD_CLEAR_ERROR: return "clear_error";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ static inline const char *nvdimm_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_SMART] = "smart",
+- [ND_CMD_SMART_THRESHOLD] = "smart_thresh",
+- [ND_CMD_DIMM_FLAGS] = "flags",
+- [ND_CMD_GET_CONFIG_SIZE] = "get_size",
+- [ND_CMD_GET_CONFIG_DATA] = "get_data",
+- [ND_CMD_SET_CONFIG_DATA] = "set_data",
+- [ND_CMD_VENDOR_EFFECT_LOG_SIZE] = "effect_size",
+- [ND_CMD_VENDOR_EFFECT_LOG] = "effect_log",
+- [ND_CMD_VENDOR] = "vendor",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_SMART: return "smart";
++ case ND_CMD_SMART_THRESHOLD: return "smart_thresh";
++ case ND_CMD_DIMM_FLAGS: return "flags";
++ case ND_CMD_GET_CONFIG_SIZE: return "get_size";
++ case ND_CMD_GET_CONFIG_DATA: return "get_data";
++ case ND_CMD_SET_CONFIG_DATA: return "set_data";
++ case ND_CMD_VENDOR_EFFECT_LOG_SIZE: return "effect_size";
++ case ND_CMD_VENDOR_EFFECT_LOG: return "effect_log";
++ case ND_CMD_VENDOR: return "vendor";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ #define ND_IOCTL 'N'
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Thu, 16 Aug 2018 09:39:41 +0200
+Subject: uio: ensure class is registered before devices
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit ae61cf5b9913027c6953a79ed3894da4f47061bd ]
+
+When both uio and the uio drivers are built in the kernel, it is possible
+for a driver to register devices before the uio class is registered.
+
+This may result in a NULL pointer dereference later on in
+get_device_parent() when accessing the class glue_dirs spinlock.
+
+The trace looks like that:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000140
+[...]
+[<ffff0000089cc234>] _raw_spin_lock+0x14/0x48
+[<ffff0000084f56bc>] device_add+0x154/0x6a0
+[<ffff0000084f5e48>] device_create_groups_vargs+0x120/0x128
+[<ffff0000084f5edc>] device_create+0x54/0x60
+[<ffff0000086e72c0>] __uio_register_device+0x120/0x4a8
+[<ffff000008528b7c>] jaguar2_pci_probe+0x2d4/0x558
+[<ffff0000083fc18c>] local_pci_probe+0x3c/0xb8
+[<ffff0000083fd81c>] pci_device_probe+0x11c/0x180
+[<ffff0000084f88bc>] driver_probe_device+0x22c/0x2d8
+[<ffff0000084f8a24>] __driver_attach+0xbc/0xc0
+[<ffff0000084f69fc>] bus_for_each_dev+0x4c/0x98
+[<ffff0000084f81b8>] driver_attach+0x20/0x28
+[<ffff0000084f7d08>] bus_add_driver+0x1b8/0x228
+[<ffff0000084f93c0>] driver_register+0x60/0xf8
+[<ffff0000083fb918>] __pci_register_driver+0x40/0x48
+
+Return EPROBE_DEFER in that case so the driver can register the device
+later.
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/uio/uio.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -275,6 +275,8 @@ static struct class uio_class = {
+ .dev_groups = uio_groups,
+ };
+
++bool uio_class_registered;
++
+ /*
+ * device functions
+ */
+@@ -877,6 +879,9 @@ static int init_uio_class(void)
+ printk(KERN_ERR "class_register failed for uio\n");
+ goto err_class_register;
+ }
++
++ uio_class_registered = true;
++
+ return 0;
+
+ err_class_register:
+@@ -887,6 +892,7 @@ exit:
+
+ static void release_uio_class(void)
+ {
++ uio_class_registered = false;
+ class_unregister(&uio_class);
+ uio_major_cleanup();
+ }
+@@ -913,6 +919,9 @@ int __uio_register_device(struct module
+ struct uio_device *idev;
+ int ret = 0;
+
++ if (!uio_class_registered)
++ return -EPROBE_DEFER;
++
+ if (!parent || !info || !info->name || !info->version)
+ return -EINVAL;
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Tue, 4 Sep 2018 17:18:57 +0200
+Subject: usb: chipidea: Prevent unbalanced IRQ disable
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e ]
+
+The ChipIdea IRQ is disabled before scheduling the otg work and
+re-enabled on otg work completion. However if the job is already
+scheduled we have to undo the effect of disable_irq int order to
+balance the IRQ disable-depth value.
+
+Fixes: be6b0c1bd0be ("usb: chipidea: using one inline function to cover queue work operations")
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/chipidea/otg.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdr
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Wed, 5 Sep 2018 13:40:03 +0200
+Subject: usb: dwc2: fix a race with external vbus supply
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 41ee1ea21052583eaf5487dfa0d0c907c9667548 ]
+
+There's a race with root hub resume, when using external vbus supply.
+Root hub gets resumed, but runtime pm autosuspend runs as external vbus
+supply isn't enabled. So, host never exit from power down properly.
+Initialize vbus external supply before, rater that after hub resume.
+
+Fixes: 531ef5ebea96 ("usb: dwc2: add support for host mode external
+vbus supply")
+
+Tested-by: Artur Petrosyan <arturp@synopsys.com>
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -4394,6 +4394,7 @@ static int _dwc2_hcd_start(struct usb_hc
+ struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+ struct usb_bus *bus = hcd_to_bus(hcd);
+ unsigned long flags;
++ int ret;
+
+ dev_dbg(hsotg->dev, "DWC OTG HCD START\n");
+
+@@ -4409,6 +4410,13 @@ static int _dwc2_hcd_start(struct usb_hc
+
+ dwc2_hcd_reinit(hsotg);
+
++ /* enable external vbus supply before resuming root hub */
++ spin_unlock_irqrestore(&hsotg->lock, flags);
++ ret = dwc2_vbus_supply_init(hsotg);
++ if (ret)
++ return ret;
++ spin_lock_irqsave(&hsotg->lock, flags);
++
+ /* Initialize and connect root hub if one is not already attached */
+ if (bus->root_hub) {
+ dev_dbg(hsotg->dev, "DWC OTG HCD Has Root Hub\n");
+@@ -4418,7 +4426,7 @@ static int _dwc2_hcd_start(struct usb_hc
+
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+- return dwc2_vbus_supply_init(hsotg);
++ return 0;
+ }
+
+ /*
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Mon, 10 Sep 2018 22:12:49 +0200
+Subject: usb: gadget: udc: atmel: handle at91sam9rl PMC
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit bb80e4fa57eb75ebd64ae9be4155da6d12c1a997 ]
+
+The at91sam9rl PMC is not quite the same as the at91sam9g45 one and now has
+its own compatible string. Add support for that.
+
+Fixes: 217bace8e548 ("ARM: dts: fix PMC compatible")
+Acked-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/atmel_usba_udc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -2018,6 +2018,8 @@ static struct usba_ep * atmel_udc_of_ini
+ udc->errata = match->data;
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
+ if (IS_ERR(udc->pmc))
++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9rl-pmc");
++ if (IS_ERR(udc->pmc))
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
+ if (udc->errata && IS_ERR(udc->pmc))
+ return ERR_CAST(udc->pmc);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Tudor.Ambarus@microchip.com" <Tudor.Ambarus@microchip.com>
+Date: Mon, 15 Oct 2018 09:00:54 +0000
+Subject: usb: host: ohci-at91: fix request of irq for optional gpio
+
+From: "Tudor.Ambarus@microchip.com" <Tudor.Ambarus@microchip.com>
+
+[ Upstream commit 325b9313ec3be56c8e2fe03f977fee19cec75820 ]
+
+atmel,oc-gpio is optional. Request its irq only when atmel,oc is set
+in device tree.
+
+devm_gpiod_get_index_optional returns NULL if -ENOENT. Check its
+return value for NULL before error, because it is more probable that
+atmel,oc is not set.
+
+This fixes the following errors on boards where atmel,oc is not set in
+device tree:
+[ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ
+[ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ
+[ 0.970000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ
+
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ohci-at91.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -551,6 +551,8 @@ static int ohci_hcd_at91_drv_probe(struc
+ pdata->overcurrent_pin[i] =
+ devm_gpiod_get_index_optional(&pdev->dev, "atmel,oc",
+ i, GPIOD_IN);
++ if (!pdata->overcurrent_pin[i])
++ continue;
+ if (IS_ERR(pdata->overcurrent_pin[i])) {
+ err = PTR_ERR(pdata->overcurrent_pin[i]);
+ dev_err(&pdev->dev, "unable to claim gpio \"overcurrent\": %d\n", err);
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Date: Mon, 8 Oct 2018 13:53:59 +0100
+Subject: usb: typec: tcpm: Report back negotiated PPS voltage and current
+
+From: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+
+[ Upstream commit 554fab6dbf20ee7298ed2d4e8398b85e6058abb7 ]
+
+Currently when requesting a specific voltage or current through
+the psy interface, for PPS, when reading back from that interface
+the values will always be the same as previously given, if the
+request was successful. However PPS only allows for 20mV voltage
+steps and 50mA current steps, and the psy class expects microvolt
+and micro amp requests, so inbetween values can be provided through
+this interface. Really when reading back the true values negotiated
+should be given, and not the ones originally asked for.
+
+To report the actual values negotiated with the Source, the values
+stored are now rounded down to the relevant step units prior to
+building the PPS request, so that those values are later correctly
+reported through the psy interface. In addition this improves the
+adjustments made to meet the operating power requirements of the
+platform, which previously could have been slightly out due to not
+using valid PPS units of voltage and current.
+
+Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -4018,6 +4018,9 @@ static int tcpm_pps_set_op_curr(struct t
+ goto port_unlock;
+ }
+
++ /* Round down operating current to align with PPS valid steps */
++ op_curr = op_curr - (op_curr % RDO_PROG_CURR_MA_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.op_curr = op_curr;
+ port->pps_status = 0;
+@@ -4071,6 +4074,9 @@ static int tcpm_pps_set_out_volt(struct
+ goto port_unlock;
+ }
+
++ /* Round down output voltage to align with PPS valid steps */
++ out_volt = out_volt - (out_volt % RDO_PROG_VOLT_MV_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.out_volt = out_volt;
+ port->pps_status = 0;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Jorgen Hansen <jhansen@vmware.com>
+Date: Fri, 21 Sep 2018 00:31:05 -0700
+Subject: VMCI: Resource wildcard match fixed
+
+From: Jorgen Hansen <jhansen@vmware.com>
+
+[ Upstream commit 11924ba5e671d6caef1516923e2bd8c72929a3fe ]
+
+When adding a VMCI resource, the check for an existing entry
+would ignore that the new entry could be a wildcard. This could
+result in multiple resource entries that would match a given
+handle. One disastrous outcome of this is that the
+refcounting used to ensure that delayed callbacks for VMCI
+datagrams have run before the datagram is destroyed can be
+wrong, since the refcount could be increased on the duplicate
+entry. This in turn leads to a use after free bug. This issue
+was discovered by Hangbin Liu using KASAN and syzkaller.
+
+Fixes: bc63dedb7d46 ("VMCI: resource object implementation")
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Reviewed-by: Adit Ranadive <aditr@vmware.com>
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/vmw_vmci/vmci_driver.c | 2 +-
+ drivers/misc/vmw_vmci/vmci_resource.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/vmw_vmci/vmci_driver.c
++++ b/drivers/misc/vmw_vmci/vmci_driver.c
+@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
+
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
+-MODULE_VERSION("1.1.5.0-k");
++MODULE_VERSION("1.1.6.0-k");
+ MODULE_LICENSE("GPL v2");
+--- a/drivers/misc/vmw_vmci/vmci_resource.c
++++ b/drivers/misc/vmw_vmci/vmci_resource.c
+@@ -57,7 +57,8 @@ static struct vmci_resource *vmci_resour
+
+ if (r->type == type &&
+ rid == handle.resource &&
+- (cid == handle.context || cid == VMCI_INVALID_ID)) {
++ (cid == handle.context || cid == VMCI_INVALID_ID ||
++ handle.context == VMCI_INVALID_ID)) {
+ resource = r;
+ break;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 16 Sep 2018 16:22:47 +0100
+Subject: x86: boot: Fix EFI stub alignment
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 9c1442a9d039a1a3302fa93e9a11001c5f23b624 ]
+
+We currently align the end of the compressed image to a multiple of
+16. However, the PE-COFF header included in the EFI stub says that
+the file alignment is 32 bytes, and when adding an EFI signature to
+the file it must first be padded to this alignment.
+
+sbsigntool commands warn about this:
+
+ warning: file-aligned section .text extends beyond end of file
+ warning: checksum areas are greater than image size. Invalid section table?
+
+Worse, pesign -at least when creating a detached signature- uses the
+hash of the unpadded file, resulting in an invalid signature if
+padding is required.
+
+Avoid both these problems by increasing alignment to 32 bytes when
+CONFIG_EFI_STUB is enabled.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/boot/tools/build.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/boot/tools/build.c
++++ b/arch/x86/boot/tools/build.c
+@@ -391,6 +391,13 @@ int main(int argc, char ** argv)
+ die("Unable to mmap '%s': %m", argv[2]);
+ /* Number of 16-byte paragraphs, including space for a 4-byte CRC */
+ sys_size = (sz + 15 + 4) / 16;
++#ifdef CONFIG_EFI_STUB
++ /*
++ * COFF requires minimum 32-byte alignment of sections, and
++ * adding a signature is problematic without that alignment.
++ */
++ sys_size = (sys_size + 1) & ~1;
++#endif
+
+ /* Patch the setup code with the appropriate size parameters */
+ buf[0x1f1] = setup_sectors-1;
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Tue, 16 Oct 2018 22:25:24 +0200
+Subject: x86/fpu: Remove second definition of fpu in __fpu__restore_sig()
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 6aa676761d4c1acfa31320e55fa1f83f3fcbbc7a ]
+
+Commit:
+
+ c5bedc6847c3b ("x86/fpu: Get rid of PF_USED_MATH usage, convert it to fpu->fpstate_active")
+
+introduced the 'fpu' variable at top of __restore_xstate_sig(),
+which now shadows the other definition:
+
+ arch/x86/kernel/fpu/signal.c:318:28: warning: symbol 'fpu' shadows an earlier one
+ arch/x86/kernel/fpu/signal.c:271:20: originally declared here
+
+Remove the shadowed definition of 'fpu', as the two definitions are the same.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: c5bedc6847c3b ("x86/fpu: Get rid of PF_USED_MATH usage, convert it to fpu->fpstate_active")
+Link: http://lkml.kernel.org/r/20181016202525.29437-3-bigeasy@linutronix.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/fpu/signal.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/x86/kernel/fpu/signal.c
++++ b/arch/x86/kernel/fpu/signal.c
+@@ -314,7 +314,6 @@ static int __fpu__restore_sig(void __use
+ * thread's fpu state, reconstruct fxstate from the fsave
+ * header. Validate and sanitize the copied state.
+ */
+- struct fpu *fpu = &tsk->thread.fpu;
+ struct user_i387_ia32_struct env;
+ int err = 0;
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Xiaochen Shen <xiaochen.shen@intel.com>
+Date: Wed, 12 Sep 2018 16:48:38 -0700
+Subject: x86/intel_rdt: Show missing resctrl mount options
+
+From: Xiaochen Shen <xiaochen.shen@intel.com>
+
+[ Upstream commit 2cc81c6992248ea37d0241bc325977bab310bc3b ]
+
+In resctrl filesystem, mount options exist to enable L3/L2 CDP and MBA
+Software Controller features if the platform supports them:
+
+ mount -t resctrl resctrl [-o cdp[,cdpl2][,mba_MBps]] /sys/fs/resctrl
+
+But currently only "cdp" option is displayed in /proc/mounts. "cdpl2" and
+"mba_MBps" options are not shown even when they are active.
+
+Before:
+ # mount -t resctrl resctrl -o cdp,mba_MBps /sys/fs/resctrl
+ # grep resctrl /proc/mounts
+ /sys/fs/resctrl /sys/fs/resctrl resctrl rw,relatime,cdp 0 0
+
+After:
+ # mount -t resctrl resctrl -o cdp,mba_MBps /sys/fs/resctrl
+ # grep resctrl /proc/mounts
+ /sys/fs/resctrl /sys/fs/resctrl resctrl rw,relatime,cdp,mba_MBps 0 0
+
+Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: "H Peter Anvin" <hpa@zytor.com>
+Cc: "Tony Luck" <tony.luck@intel.com>
+Link: https://lkml.kernel.org/r/1536796118-60135-1-git-send-email-fenghua.yu@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -2032,6 +2032,13 @@ static int rdtgroup_show_options(struct
+ {
+ if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled)
+ seq_puts(seq, ",cdp");
++
++ if (rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled)
++ seq_puts(seq, ",cdpl2");
++
++ if (is_mba_sc(&rdt_resources_all[RDT_RESOURCE_MBA]))
++ seq_puts(seq, ",mba_MBps");
++
+ return 0;
+ }
+
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Thu, 4 Oct 2018 18:08:08 +0200
+Subject: x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit d92116b800fb79a72ad26121f5011f6aa3ad94c2 ]
+
+On OLPC XO-1, the RTC is discovered via device tree from the arch
+initcall. Don't let the PC platform register another one from its device
+initcall, it's not going to work:
+
+ sysfs: cannot create duplicate filename '/devices/platform/rtc_cmos'
+ CPU: 0 PID: 1 Comm: swapper Not tainted 4.19.0-rc6 #12
+ Hardware name: OLPC XO/XO, BIOS OLPC Ver 1.00.01 06/11/2014
+ Call Trace:
+ dump_stack+0x16/0x18
+ sysfs_warn_dup+0x46/0x58
+ sysfs_create_dir_ns+0x76/0x9b
+ kobject_add_internal+0xed/0x209
+ ? __schedule+0x3fa/0x447
+ kobject_add+0x5b/0x66
+ device_add+0x298/0x535
+ ? insert_resource_conflict+0x2a/0x3e
+ platform_device_add+0x14d/0x192
+ ? io_delay_init+0x19/0x19
+ platform_device_register+0x1c/0x1f
+ add_rtc_cmos+0x16/0x31
+ do_one_initcall+0x78/0x14a
+ ? do_early_param+0x75/0x75
+ kernel_init_freeable+0x152/0x1e0
+ ? rest_init+0xa2/0xa2
+ kernel_init+0x8/0xd5
+ ret_from_fork+0x2e/0x38
+ kobject_add_internal failed for rtc_cmos with -EEXIST, don't try to
+ register things with the same name in the same directory.
+ platform rtc_cmos: registered platform RTC device (no PNP device found)
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+CC: "H. Peter Anvin" <hpa@zytor.com>
+CC: Ingo Molnar <mingo@redhat.com>
+CC: x86-ml <x86@kernel.org>
+Link: http://lkml.kernel.org/r/20181004160808.307738-1-lkundrak@v3.sk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/platform/olpc/olpc-xo1-rtc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/platform/olpc/olpc-xo1-rtc.c
++++ b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+@@ -16,6 +16,7 @@
+
+ #include <asm/msr.h>
+ #include <asm/olpc.h>
++#include <asm/x86_init.h>
+
+ static void rtc_wake_on(struct device *dev)
+ {
+@@ -75,6 +76,8 @@ static int __init xo1_rtc_init(void)
+ if (r)
+ return r;
+
++ x86_platform.legacy.rtc = 0;
++
+ device_init_wakeup(&xo1_rtc_device.dev, 1);
+ return 0;
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 10 Oct 2018 18:02:21 +0200
+Subject: xfrm: policy: use hlist rcu variants on insert
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9dffff200fd178f11dd50eb1fd8ccd0650c9284e ]
+
+bydst table/list lookups use rcu, so insertions must use rcu versions.
+
+Fixes: a7c44247f704e ("xfrm: policy: make xfrm_policy_lookup_bytype lockless")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/xfrm/xfrm_policy.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -625,9 +625,9 @@ static void xfrm_hash_rebuild(struct wor
+ break;
+ }
+ if (newpos)
+- hlist_add_behind(&policy->bydst, newpos);
++ hlist_add_behind_rcu(&policy->bydst, newpos);
+ else
+- hlist_add_head(&policy->bydst, chain);
++ hlist_add_head_rcu(&policy->bydst, chain);
+ }
+
+ spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
+@@ -766,9 +766,9 @@ int xfrm_policy_insert(int dir, struct x
+ break;
+ }
+ if (newpos)
+- hlist_add_behind(&policy->bydst, newpos);
++ hlist_add_behind_rcu(&policy->bydst, newpos);
+ else
+- hlist_add_head(&policy->bydst, chain);
++ hlist_add_head_rcu(&policy->bydst, chain);
+ __xfrm_policy_link(policy, dir);
+
+ /* After previous checking, family can either be AF_INET or AF_INET6 */
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Anshuman Gupta <anshuman.gupta@intel.com>
+Date: Thu, 20 Sep 2018 19:13:40 +0300
+Subject: xhci: Avoid USB autosuspend when resuming USB2 ports.
+
+From: Anshuman Gupta <anshuman.gupta@intel.com>
+
+[ Upstream commit 330e2d61cdd58363eb5e66b2e72f76fe3c5492e0 ]
+
+When USB bus host controller root hub resumes from autosuspend,
+it immediately tries to enter auto-suspend, but there can be a
+scenario when root hub is resuming its usb2 ports, in that particular
+case USB host controller auto suspend fails since it is busy
+to resuming its usb2 ports.
+
+This makes multiple failed cycles of auto-suspend until all usb2
+ports of host controller root hub do not resume.
+
+This patch uses USB core framework usb_hcd_start_port_resume,
+usb_hcd_end_port_resume API's in order to autoresume/autosuspend
+root hub properly.
+
+Signed-off-by: Anshuman Gupta <anshuman.gupta@intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-hub.c | 5 +++++
+ drivers/usb/host/xhci-ring.c | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -900,6 +900,7 @@ static u32 xhci_get_port_status(struct u
+ set_bit(wIndex, &bus_state->resuming_ports);
+ bus_state->resume_done[wIndex] = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+ } else if (time_after_eq(jiffies,
+@@ -940,6 +941,7 @@ static u32 xhci_get_port_status(struct u
+ clear_bit(wIndex, &bus_state->rexit_ports);
+ }
+
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ bus_state->port_c_suspend |= 1 << wIndex;
+ bus_state->suspended_ports &= ~(1 << wIndex);
+ } else {
+@@ -962,6 +964,7 @@ static u32 xhci_get_port_status(struct u
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+ bus_state->resume_done[wIndex] = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+
+
+@@ -1337,6 +1340,7 @@ int xhci_hub_control(struct usb_hcd *hcd
+ goto error;
+
+ set_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_RESUME);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1345,6 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_U0);
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+ bus_state->port_c_suspend |= 1 << wIndex;
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1602,6 +1602,7 @@ static void handle_port_status(struct xh
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ mod_timer(&hcd->rh_timer,
+ bus_state->resume_done[hcd_portnum]);
++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ bogus_port_status = true;
+ }
+ }
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Mon, 1 Oct 2018 14:25:14 -0400
+Subject: xprtrdma: Reset credit grant properly after a disconnect
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit ef739b2175dde9c05594f768cb78149f1ce2ac36 ]
+
+On a fresh connection, an RPC/RDMA client is supposed to send only
+one RPC Call until it gets a credit grant in the first RPC Reply
+from the server [RFC 8166, Section 3.3.3].
+
+There is a bug in the Linux client's credit accounting mechanism
+introduced by commit e7ce710a8802 ("xprtrdma: Avoid deadlock when
+credit window is reset"). On connect, it simply dumps all pending
+RPC Calls onto the new connection.
+
+Servers have been tolerant of this bad behavior. Currently no server
+implementation ever changes its credit grant over reconnects, and
+servers always repost enough Receives before connections are fully
+established.
+
+To correct this issue, ensure that the client resets both the credit
+grant _and_ the congestion window when handling a reconnect.
+
+Fixes: e7ce710a8802 ("xprtrdma: Avoid deadlock when credit ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Cc: stable@kernel.org
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 1 +
+ net/sunrpc/xprtrdma/transport.c | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -248,6 +248,7 @@ static void
+ xprt_rdma_bc_close(struct rpc_xprt *xprt)
+ {
+ dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ static void
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -468,6 +468,12 @@ xprt_rdma_close(struct rpc_xprt *xprt)
+ xprt->reestablish_timeout = 0;
+ xprt_disconnect_done(xprt);
+ rpcrdma_ep_disconnect(ep, ia);
++
++ /* Prepare @xprt for the next connection by reinitializing
++ * its credit grant to one (see RFC 8166, Section 3.3.3).
++ */
++ r_xprt->rx_buf.rb_credits = 1;
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ /**
--- /dev/null
+From foo@baz Sat Nov 10 10:48:43 PST 2018
+From: "Björn Töpel" <bjorn.topel@intel.com>
+Date: Mon, 8 Oct 2018 19:40:16 +0200
+Subject: xsk: do not call synchronize_net() under RCU read lock
+
+From: "Björn Töpel" <bjorn.topel@intel.com>
+
+[ Upstream commit cee271678d0e3177a25d0fcb2fa5e051d48e4262 ]
+
+The XSKMAP update and delete functions called synchronize_net(), which
+can sleep. It is not allowed to sleep during an RCU read section.
+
+Instead we need to make sure that the sock sk_destruct (xsk_destruct)
+function is asynchronously called after an RCU grace period. Setting
+the SOCK_RCU_FREE flag for XDP sockets takes care of this.
+
+Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP")
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/xskmap.c | 10 ++--------
+ net/xdp/xsk.c | 2 ++
+ 2 files changed, 4 insertions(+), 8 deletions(-)
+
+--- a/kernel/bpf/xskmap.c
++++ b/kernel/bpf/xskmap.c
+@@ -191,11 +191,8 @@ static int xsk_map_update_elem(struct bp
+ sock_hold(sock->sk);
+
+ old_xs = xchg(&m->xsk_map[i], xs);
+- if (old_xs) {
+- /* Make sure we've flushed everything. */
+- synchronize_net();
++ if (old_xs)
+ sock_put((struct sock *)old_xs);
+- }
+
+ sockfd_put(sock);
+ return 0;
+@@ -211,11 +208,8 @@ static int xsk_map_delete_elem(struct bp
+ return -EINVAL;
+
+ old_xs = xchg(&m->xsk_map[k], NULL);
+- if (old_xs) {
+- /* Make sure we've flushed everything. */
+- synchronize_net();
++ if (old_xs)
+ sock_put((struct sock *)old_xs);
+- }
+
+ return 0;
+ }
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -744,6 +744,8 @@ static int xsk_create(struct net *net, s
+ sk->sk_destruct = xsk_destruct;
+ sk_refcnt_debug_inc(sk);
+
++ sock_set_flag(sk, SOCK_RCU_FREE);
++
+ xs = xdp_sk(sk);
+ mutex_init(&xs->mutex);
+ spin_lock_init(&xs->tx_completion_lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
