--- /dev/null
+From 50f5d01ef763dadc8d0e945bb28882744be0297e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 09:43:52 -0800
+Subject: ACPICA: Use %d for signed int print formatting instead of %u
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f8ddf49b420112e28bdd23d7ad52d7991a0ccbe3 ]
+
+Fix warnings found using static analysis with cppcheck, use %d printf
+format specifier for signed ints rather than %u
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Erik Schmauss <erik.schmauss@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/acpi/tools/acpidump/apmain.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/power/acpi/tools/acpidump/apmain.c b/tools/power/acpi/tools/acpidump/apmain.c
+index 943b6b6146834..bed0794e3295f 100644
+--- a/tools/power/acpi/tools/acpidump/apmain.c
++++ b/tools/power/acpi/tools/acpidump/apmain.c
+@@ -139,7 +139,7 @@ static int ap_insert_action(char *argument, u32 to_be_done)
+
+ current_action++;
+ if (current_action > AP_MAX_ACTIONS) {
+- fprintf(stderr, "Too many table options (max %u)\n",
++ fprintf(stderr, "Too many table options (max %d)\n",
+ AP_MAX_ACTIONS);
+ return (-1);
+ }
+--
+2.20.1
+
--- /dev/null
+From 1b84f527a7d03cd066ea6693417d866b776c531a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 12:33:02 +0200
+Subject: ALSA: i2c/cs8427: Fix int to char conversion
+
+From: Philipp Klocke <philipp97kl@gmail.com>
+
+[ Upstream commit eb7ebfa3c1989aa8e59d5e68ab3cddd7df1bfb27 ]
+
+Compiling with clang yields the following warning:
+
+sound/i2c/cs8427.c:140:31: warning: implicit conversion from 'int'
+to 'char' changes value from 160 to -96 [-Wconstant-conversion]
+ data[0] = CS8427_REG_AUTOINC | CS8427_REG_CORU_DATABUF;
+ ~ ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
+
+Because CS8427_REG_AUTOINC is defined as 128, it is too big for a
+char field.
+So change data from char to unsigned char, that it can hold the value.
+
+This patch does not change the generated code.
+
+Signed-off-by: Philipp Klocke <philipp97kl@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/i2c/cs8427.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c
+index 7e21621e492a4..7fd1b40008838 100644
+--- a/sound/i2c/cs8427.c
++++ b/sound/i2c/cs8427.c
+@@ -118,7 +118,7 @@ static int snd_cs8427_send_corudata(struct snd_i2c_device *device,
+ struct cs8427 *chip = device->private_data;
+ char *hw_data = udata ?
+ chip->playback.hw_udata : chip->playback.hw_status;
+- char data[32];
++ unsigned char data[32];
+ int err, idx;
+
+ if (!memcmp(hw_data, ndata, count))
+--
+2.20.1
+
--- /dev/null
+From e4ef072b3e496f14372c60d52b324ee0fc74151a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 14:25:22 +0900
+Subject: ALSA: isight: fix leak of reference to firewire unit in error path of
+ .probe callback
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 51e68fb0929c29e47e9074ca3e99ffd6021a1c5a ]
+
+In some error paths, reference count of firewire unit is not decreased.
+This commit fixes the bug.
+
+Fixes: 5b14ec25a79b('ALSA: firewire: release reference count of firewire unit in .remove callback of bus driver')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/isight.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
+index 5826aa8362f10..9edb26ab16e90 100644
+--- a/sound/firewire/isight.c
++++ b/sound/firewire/isight.c
+@@ -639,7 +639,7 @@ static int isight_probe(struct fw_unit *unit,
+ if (!isight->audio_base) {
+ dev_err(&unit->device, "audio unit base not found\n");
+ err = -ENXIO;
+- goto err_unit;
++ goto error;
+ }
+ fw_iso_resources_init(&isight->resources, unit);
+
+@@ -668,12 +668,12 @@ static int isight_probe(struct fw_unit *unit,
+ dev_set_drvdata(&unit->device, isight);
+
+ return 0;
+-
+-err_unit:
+- fw_unit_put(isight->unit);
+- mutex_destroy(&isight->mutex);
+ error:
+ snd_card_free(card);
++
++ mutex_destroy(&isight->mutex);
++ fw_unit_put(isight->unit);
++
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 370778c243c36e4995a60537e4062be8d9df1597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Oct 2018 12:20:46 -0700
+Subject: amiflop: clean up on errors during setup
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit 53d0f8dbde89cf6c862c7a62e00c6123e02cba41 ]
+
+The error handling in fd_probe_drives() doesn't clean up at all. Fix it
+up in preparation for converting to blk-mq. While we're here, get rid of
+the commented out amiga_floppy_remove().
+
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/amiflop.c | 84 ++++++++++++++++++++---------------------
+ 1 file changed, 40 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
+index 49908c74bfcb0..b0e8d8364876b 100644
+--- a/drivers/block/amiflop.c
++++ b/drivers/block/amiflop.c
+@@ -1699,11 +1699,41 @@ static const struct block_device_operations floppy_fops = {
+ .check_events = amiga_check_events,
+ };
+
++static struct gendisk *fd_alloc_disk(int drive)
++{
++ struct gendisk *disk;
++
++ disk = alloc_disk(1);
++ if (!disk)
++ goto out;
++
++ disk->queue = blk_init_queue(do_fd_request, &amiflop_lock);
++ if (IS_ERR(disk->queue)) {
++ disk->queue = NULL;
++ goto out_put_disk;
++ }
++
++ unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL);
++ if (!unit[drive].trackbuf)
++ goto out_cleanup_queue;
++
++ return disk;
++
++out_cleanup_queue:
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++out_put_disk:
++ put_disk(disk);
++out:
++ unit[drive].type->code = FD_NODRIVE;
++ return NULL;
++}
++
+ static int __init fd_probe_drives(void)
+ {
+ int drive,drives,nomem;
+
+- printk(KERN_INFO "FD: probing units\nfound ");
++ pr_info("FD: probing units\nfound");
+ drives=0;
+ nomem=0;
+ for(drive=0;drive<FD_MAX_UNITS;drive++) {
+@@ -1711,27 +1741,17 @@ static int __init fd_probe_drives(void)
+ fd_probe(drive);
+ if (unit[drive].type->code == FD_NODRIVE)
+ continue;
+- disk = alloc_disk(1);
++
++ disk = fd_alloc_disk(drive);
+ if (!disk) {
+- unit[drive].type->code = FD_NODRIVE;
++ pr_cont(" no mem for fd%d", drive);
++ nomem = 1;
+ continue;
+ }
+ unit[drive].gendisk = disk;
+-
+- disk->queue = blk_init_queue(do_fd_request, &amiflop_lock);
+- if (!disk->queue) {
+- unit[drive].type->code = FD_NODRIVE;
+- continue;
+- }
+-
+ drives++;
+- if ((unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL)) == NULL) {
+- printk("no mem for ");
+- unit[drive].type = &drive_types[num_dr_types - 1]; /* FD_NODRIVE */
+- drives--;
+- nomem = 1;
+- }
+- printk("fd%d ",drive);
++
++ pr_cont(" fd%d",drive);
+ disk->major = FLOPPY_MAJOR;
+ disk->first_minor = drive;
+ disk->fops = &floppy_fops;
+@@ -1742,11 +1762,11 @@ static int __init fd_probe_drives(void)
+ }
+ if ((drives > 0) || (nomem == 0)) {
+ if (drives == 0)
+- printk("no drives");
+- printk("\n");
++ pr_cont(" no drives");
++ pr_cont("\n");
+ return drives;
+ }
+- printk("\n");
++ pr_cont("\n");
+ return -ENOMEM;
+ }
+
+@@ -1837,30 +1857,6 @@ static int __init amiga_floppy_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-#if 0 /* not safe to unload */
+-static int __exit amiga_floppy_remove(struct platform_device *pdev)
+-{
+- int i;
+-
+- for( i = 0; i < FD_MAX_UNITS; i++) {
+- if (unit[i].type->code != FD_NODRIVE) {
+- struct request_queue *q = unit[i].gendisk->queue;
+- del_gendisk(unit[i].gendisk);
+- put_disk(unit[i].gendisk);
+- kfree(unit[i].trackbuf);
+- if (q)
+- blk_cleanup_queue(q);
+- }
+- }
+- blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256);
+- free_irq(IRQ_AMIGA_CIAA_TB, NULL);
+- free_irq(IRQ_AMIGA_DSKBLK, NULL);
+- custom.dmacon = DMAF_DISK; /* disable DMA */
+- amiga_chip_free(raw_buf);
+- unregister_blkdev(FLOPPY_MAJOR, "fd");
+-}
+-#endif
+-
+ static struct platform_driver amiga_floppy_driver = {
+ .driver = {
+ .name = "amiga-floppy",
+--
+2.20.1
+
--- /dev/null
+From 9ebd24c8e1ad005452f31b0c9b8199ca463eeb01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 15:02:30 -0700
+Subject: arm64: lib: use C string functions with KASAN enabled
+
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+
+[ Upstream commit 19a2ca0fb560fd7be7b5293c6b652c6d6078dcde ]
+
+ARM64 has asm implementation of memchr(), memcmp(), str[r]chr(),
+str[n]cmp(), str[n]len(). KASAN don't see memory accesses in asm code,
+thus it can potentially miss many bugs.
+
+Ifdef out __HAVE_ARCH_* defines of these functions when KASAN is enabled,
+so the generic implementations from lib/string.c will be used.
+
+We can't just remove the asm functions because efistub uses them. And we
+can't have two non-weak functions either, so declare the asm functions as
+weak.
+
+Link: http://lkml.kernel.org/r/20180920135631.23833-2-aryabinin@virtuozzo.com
+Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Reported-by: Kyeongdon Kim <kyeongdon.kim@lge.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/string.h | 14 ++++++++------
+ arch/arm64/kernel/arm64ksyms.c | 7 +++++--
+ arch/arm64/lib/memchr.S | 2 +-
+ arch/arm64/lib/memcmp.S | 2 +-
+ arch/arm64/lib/strchr.S | 2 +-
+ arch/arm64/lib/strcmp.S | 2 +-
+ arch/arm64/lib/strlen.S | 2 +-
+ arch/arm64/lib/strncmp.S | 2 +-
+ arch/arm64/lib/strnlen.S | 2 +-
+ arch/arm64/lib/strrchr.S | 2 +-
+ 10 files changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h
+index dd95d33a5bd5d..03a6c256b7ec4 100644
+--- a/arch/arm64/include/asm/string.h
++++ b/arch/arm64/include/asm/string.h
+@@ -16,6 +16,7 @@
+ #ifndef __ASM_STRING_H
+ #define __ASM_STRING_H
+
++#ifndef CONFIG_KASAN
+ #define __HAVE_ARCH_STRRCHR
+ extern char *strrchr(const char *, int c);
+
+@@ -34,6 +35,13 @@ extern __kernel_size_t strlen(const char *);
+ #define __HAVE_ARCH_STRNLEN
+ extern __kernel_size_t strnlen(const char *, __kernel_size_t);
+
++#define __HAVE_ARCH_MEMCMP
++extern int memcmp(const void *, const void *, size_t);
++
++#define __HAVE_ARCH_MEMCHR
++extern void *memchr(const void *, int, __kernel_size_t);
++#endif
++
+ #define __HAVE_ARCH_MEMCPY
+ extern void *memcpy(void *, const void *, __kernel_size_t);
+ extern void *__memcpy(void *, const void *, __kernel_size_t);
+@@ -42,16 +50,10 @@ extern void *__memcpy(void *, const void *, __kernel_size_t);
+ extern void *memmove(void *, const void *, __kernel_size_t);
+ extern void *__memmove(void *, const void *, __kernel_size_t);
+
+-#define __HAVE_ARCH_MEMCHR
+-extern void *memchr(const void *, int, __kernel_size_t);
+-
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *, int, __kernel_size_t);
+ extern void *__memset(void *, int, __kernel_size_t);
+
+-#define __HAVE_ARCH_MEMCMP
+-extern int memcmp(const void *, const void *, size_t);
+-
+ #ifdef CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE
+ #define __HAVE_ARCH_MEMCPY_FLUSHCACHE
+ void memcpy_flushcache(void *dst, const void *src, size_t cnt);
+diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
+index 66be504edb6cf..9eedf839e7393 100644
+--- a/arch/arm64/kernel/arm64ksyms.c
++++ b/arch/arm64/kernel/arm64ksyms.c
+@@ -44,20 +44,23 @@ EXPORT_SYMBOL(__arch_copy_in_user);
+ EXPORT_SYMBOL(memstart_addr);
+
+ /* string / mem functions */
++#ifndef CONFIG_KASAN
+ EXPORT_SYMBOL(strchr);
+ EXPORT_SYMBOL(strrchr);
+ EXPORT_SYMBOL(strcmp);
+ EXPORT_SYMBOL(strncmp);
+ EXPORT_SYMBOL(strlen);
+ EXPORT_SYMBOL(strnlen);
++EXPORT_SYMBOL(memcmp);
++EXPORT_SYMBOL(memchr);
++#endif
++
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memmove);
+ EXPORT_SYMBOL(__memset);
+ EXPORT_SYMBOL(__memcpy);
+ EXPORT_SYMBOL(__memmove);
+-EXPORT_SYMBOL(memchr);
+-EXPORT_SYMBOL(memcmp);
+
+ /* atomic bitops */
+ EXPORT_SYMBOL(set_bit);
+diff --git a/arch/arm64/lib/memchr.S b/arch/arm64/lib/memchr.S
+index 4444c1d25f4bb..0f164a4baf52a 100644
+--- a/arch/arm64/lib/memchr.S
++++ b/arch/arm64/lib/memchr.S
+@@ -30,7 +30,7 @@
+ * Returns:
+ * x0 - address of first occurrence of 'c' or 0
+ */
+-ENTRY(memchr)
++WEAK(memchr)
+ and w1, w1, #0xff
+ 1: subs x2, x2, #1
+ b.mi 2f
+diff --git a/arch/arm64/lib/memcmp.S b/arch/arm64/lib/memcmp.S
+index 2a4e239bd17a0..fb295f52e9f87 100644
+--- a/arch/arm64/lib/memcmp.S
++++ b/arch/arm64/lib/memcmp.S
+@@ -58,7 +58,7 @@ pos .req x11
+ limit_wd .req x12
+ mask .req x13
+
+-ENTRY(memcmp)
++WEAK(memcmp)
+ cbz limit, .Lret0
+ eor tmp1, src1, src2
+ tst tmp1, #7
+diff --git a/arch/arm64/lib/strchr.S b/arch/arm64/lib/strchr.S
+index dae0cf5591f99..7c83091d1bcdd 100644
+--- a/arch/arm64/lib/strchr.S
++++ b/arch/arm64/lib/strchr.S
+@@ -29,7 +29,7 @@
+ * Returns:
+ * x0 - address of first occurrence of 'c' or 0
+ */
+-ENTRY(strchr)
++WEAK(strchr)
+ and w1, w1, #0xff
+ 1: ldrb w2, [x0], #1
+ cmp w2, w1
+diff --git a/arch/arm64/lib/strcmp.S b/arch/arm64/lib/strcmp.S
+index 471fe61760ef6..7d5d15398bfbc 100644
+--- a/arch/arm64/lib/strcmp.S
++++ b/arch/arm64/lib/strcmp.S
+@@ -60,7 +60,7 @@ tmp3 .req x9
+ zeroones .req x10
+ pos .req x11
+
+-ENTRY(strcmp)
++WEAK(strcmp)
+ eor tmp1, src1, src2
+ mov zeroones, #REP8_01
+ tst tmp1, #7
+diff --git a/arch/arm64/lib/strlen.S b/arch/arm64/lib/strlen.S
+index 55ccc8e24c084..8e0b14205dcb4 100644
+--- a/arch/arm64/lib/strlen.S
++++ b/arch/arm64/lib/strlen.S
+@@ -56,7 +56,7 @@ pos .req x12
+ #define REP8_7f 0x7f7f7f7f7f7f7f7f
+ #define REP8_80 0x8080808080808080
+
+-ENTRY(strlen)
++WEAK(strlen)
+ mov zeroones, #REP8_01
+ bic src, srcin, #15
+ ands tmp1, srcin, #15
+diff --git a/arch/arm64/lib/strncmp.S b/arch/arm64/lib/strncmp.S
+index e267044761c6f..66bd145935d9e 100644
+--- a/arch/arm64/lib/strncmp.S
++++ b/arch/arm64/lib/strncmp.S
+@@ -64,7 +64,7 @@ limit_wd .req x13
+ mask .req x14
+ endloop .req x15
+
+-ENTRY(strncmp)
++WEAK(strncmp)
+ cbz limit, .Lret0
+ eor tmp1, src1, src2
+ mov zeroones, #REP8_01
+diff --git a/arch/arm64/lib/strnlen.S b/arch/arm64/lib/strnlen.S
+index eae38da6e0bb3..355be04441fe6 100644
+--- a/arch/arm64/lib/strnlen.S
++++ b/arch/arm64/lib/strnlen.S
+@@ -59,7 +59,7 @@ limit_wd .req x14
+ #define REP8_7f 0x7f7f7f7f7f7f7f7f
+ #define REP8_80 0x8080808080808080
+
+-ENTRY(strnlen)
++WEAK(strnlen)
+ cbz limit, .Lhit_limit
+ mov zeroones, #REP8_01
+ bic src, srcin, #15
+diff --git a/arch/arm64/lib/strrchr.S b/arch/arm64/lib/strrchr.S
+index 61eabd9a289a6..f3b9f8e2917c6 100644
+--- a/arch/arm64/lib/strrchr.S
++++ b/arch/arm64/lib/strrchr.S
+@@ -29,7 +29,7 @@
+ * Returns:
+ * x0 - address of last occurrence of 'c' or 0
+ */
+-ENTRY(strrchr)
++WEAK(strrchr)
+ mov x3, #0
+ and w1, w1, #0xff
+ 1: ldrb w2, [x0], #1
+--
+2.20.1
+
--- /dev/null
+From 6e963cac161596b8e506ca0e607f1e040b10b421 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 16:37:10 -0700
+Subject: arm64: makefile fix build of .i file in external module case
+
+From: Victor Kamensky <kamensky@cisco.com>
+
+[ Upstream commit 98356eb0ae499c63e78073ccedd9a5fc5c563288 ]
+
+After 'a66649dab350 arm64: fix vdso-offsets.h dependency' if
+one will try to build .i file in case of external kernel module,
+build fails complaining that prepare0 target is missing. This
+issue came up with SystemTap when it tries to build variety
+of .i files for its own generated kernel modules trying to
+figure given kernel features/capabilities.
+
+The issue is that prepare0 is defined in top level Makefile
+only if KBUILD_EXTMOD is not defined. .i file rule depends
+on prepare and in case KBUILD_EXTMOD defined top level Makefile
+contains empty rule for prepare. But after mentioned commit
+arch/arm64/Makefile would introduce dependency on prepare0
+through its own prepare target.
+
+Fix it to put proper ifdef KBUILD_EXTMOD around code introduced
+by mentioned commit. It matches what top level Makefile does.
+
+Acked-by: Kevin Brodsky <kevin.brodsky@arm.com>
+Signed-off-by: Victor Kamensky <kamensky@cisco.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
+index 0c5f70e6d5cfa..8c4bc5a2c61f4 100644
+--- a/arch/arm64/Makefile
++++ b/arch/arm64/Makefile
+@@ -149,6 +149,7 @@ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+ $(Q)$(MAKE) $(clean)=$(boot)/dts
+
++ifeq ($(KBUILD_EXTMOD),)
+ # We need to generate vdso-offsets.h before compiling certain files in kernel/.
+ # In order to do that, we should use the archprepare target, but we can't since
+ # asm-offsets.h is included in some files used to generate vdso-offsets.h, and
+@@ -158,6 +159,7 @@ archclean:
+ prepare: vdso_prepare
+ vdso_prepare: prepare0
+ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso include/generated/vdso-offsets.h
++endif
+
+ define archhelp
+ echo '* Image.gz - Compressed kernel image (arch/$(ARCH)/boot/Image.gz)'
+--
+2.20.1
+
--- /dev/null
+From 40f6cc9c8ef4f82db33d1febbbac9c906987b4bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 12:47:29 +0200
+Subject: ASoC: tegra_sgtl5000: fix device_node refcounting
+
+From: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+
+[ Upstream commit a85227da2dcc291b762c8482a505bc7d0d2d4b07 ]
+
+Similar to the following:
+
+commit 4321723648b0 ("ASoC: tegra_alc5632: fix device_node refcounting")
+
+commit 7c5dfd549617 ("ASoC: tegra: fix device_node refcounting")
+
+Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/tegra/tegra_sgtl5000.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c
+index 45a4aa9d2a479..901457da25ec3 100644
+--- a/sound/soc/tegra/tegra_sgtl5000.c
++++ b/sound/soc/tegra/tegra_sgtl5000.c
+@@ -149,14 +149,14 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev,
+ "Property 'nvidia,i2s-controller' missing/invalid\n");
+ ret = -EINVAL;
+- goto err;
++ goto err_put_codec_of_node;
+ }
+
+ tegra_sgtl5000_dai.platform_of_node = tegra_sgtl5000_dai.cpu_of_node;
+
+ ret = tegra_asoc_utils_init(&machine->util_data, &pdev->dev);
+ if (ret)
+- goto err;
++ goto err_put_cpu_of_node;
+
+ ret = snd_soc_register_card(card);
+ if (ret) {
+@@ -169,6 +169,13 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
+
+ err_fini_utils:
+ tegra_asoc_utils_fini(&machine->util_data);
++err_put_cpu_of_node:
++ of_node_put(tegra_sgtl5000_dai.cpu_of_node);
++ tegra_sgtl5000_dai.cpu_of_node = NULL;
++ tegra_sgtl5000_dai.platform_of_node = NULL;
++err_put_codec_of_node:
++ of_node_put(tegra_sgtl5000_dai.codec_of_node);
++ tegra_sgtl5000_dai.codec_of_node = NULL;
+ err:
+ return ret;
+ }
+@@ -183,6 +190,12 @@ static int tegra_sgtl5000_driver_remove(struct platform_device *pdev)
+
+ tegra_asoc_utils_fini(&machine->util_data);
+
++ of_node_put(tegra_sgtl5000_dai.cpu_of_node);
++ tegra_sgtl5000_dai.cpu_of_node = NULL;
++ tegra_sgtl5000_dai.platform_of_node = NULL;
++ of_node_put(tegra_sgtl5000_dai.codec_of_node);
++ tegra_sgtl5000_dai.codec_of_node = NULL;
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 56426c6535b0464fd6b6e4c849d1daece13ffdf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Oct 2018 15:55:26 +0800
+Subject: ath10k: allocate small size dma memory in ath10k_pci_diag_write_mem
+
+From: Carl Huang <cjhuang@codeaurora.org>
+
+[ Upstream commit 0738b4998c6d1caf9ca2447b946709a7278c70f1 ]
+
+ath10k_pci_diag_write_mem may allocate big size of the dma memory
+based on the parameter nbytes. Take firmware diag download as
+example, the biggest size is about 500K. In some systems, the
+allocation is likely to fail because it can't acquire such a large
+contiguous dma memory.
+
+The fix is to allocate a small size dma memory. In the loop,
+driver copies the data to the allocated dma memory and writes to
+the destination until all the data is written.
+
+Tested with QCA6174 PCI with
+firmware-6.bin_WLAN.RM.4.4.1-00119-QCARMSWP-1, this also affects
+QCA9377 PCI.
+
+Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
+Reviewed-by: Brian Norris <briannorris@chomium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/pci.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 27ab3eb47534f..0298ddc1ff060 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1039,10 +1039,9 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ struct ath10k_ce *ce = ath10k_ce_priv(ar);
+ int ret = 0;
+ u32 *buf;
+- unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
++ unsigned int completed_nbytes, alloc_nbytes, remaining_bytes;
+ struct ath10k_ce_pipe *ce_diag;
+ void *data_buf = NULL;
+- u32 ce_data; /* Host buffer address in CE space */
+ dma_addr_t ce_data_base = 0;
+ int i;
+
+@@ -1056,9 +1055,10 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ * 1) 4-byte alignment
+ * 2) Buffer in DMA-able space
+ */
+- orig_nbytes = nbytes;
++ alloc_nbytes = min_t(unsigned int, nbytes, DIAG_TRANSFER_LIMIT);
++
+ data_buf = (unsigned char *)dma_alloc_coherent(ar->dev,
+- orig_nbytes,
++ alloc_nbytes,
+ &ce_data_base,
+ GFP_ATOMIC);
+ if (!data_buf) {
+@@ -1066,9 +1066,6 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ goto done;
+ }
+
+- /* Copy caller's data to allocated DMA buf */
+- memcpy(data_buf, data, orig_nbytes);
+-
+ /*
+ * The address supplied by the caller is in the
+ * Target CPU virtual address space.
+@@ -1081,12 +1078,14 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ */
+ address = ath10k_pci_targ_cpu_to_ce_addr(ar, address);
+
+- remaining_bytes = orig_nbytes;
+- ce_data = ce_data_base;
++ remaining_bytes = nbytes;
+ while (remaining_bytes) {
+ /* FIXME: check cast */
+ nbytes = min_t(int, remaining_bytes, DIAG_TRANSFER_LIMIT);
+
++ /* Copy caller's data to allocated DMA buf */
++ memcpy(data_buf, data, nbytes);
++
+ /* Set up to receive directly into Target(!) address */
+ ret = __ath10k_ce_rx_post_buf(ce_diag, &address, address);
+ if (ret != 0)
+@@ -1096,7 +1095,7 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+ * Request CE to send caller-supplied data that
+ * was copied to bounce buffer to Target(!) address.
+ */
+- ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)ce_data,
++ ret = ath10k_ce_send_nolock(ce_diag, NULL, ce_data_base,
+ nbytes, 0, 0);
+ if (ret != 0)
+ goto done;
+@@ -1137,12 +1136,12 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
+
+ remaining_bytes -= nbytes;
+ address += nbytes;
+- ce_data += nbytes;
++ data += nbytes;
+ }
+
+ done:
+ if (data_buf) {
+- dma_free_coherent(ar->dev, orig_nbytes, data_buf,
++ dma_free_coherent(ar->dev, alloc_nbytes, data_buf,
+ ce_data_base);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2993f8dbc8986f9b951784a3770b85e60b67fdef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Oct 2018 11:04:19 -0700
+Subject: atm: zatm: Fix empty body Clang warnings
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 64b9d16e2d02ca6e5dc8fcd30cfd52b0ecaaa8f4 ]
+
+Clang warns:
+
+drivers/atm/zatm.c:513:7: error: while loop has empty body
+[-Werror,-Wempty-body]
+ zwait;
+ ^
+drivers/atm/zatm.c:513:7: note: put the semicolon on a separate line to
+silence this warning
+
+Get rid of this warning by using an empty do-while loop. While we're at
+it, add parentheses to make it clear that this is a function-like macro.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/42
+Suggested-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/zatm.c | 42 +++++++++++++++++++++---------------------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
+index 2c288d1f42bba..817c7edfec0b4 100644
+--- a/drivers/atm/zatm.c
++++ b/drivers/atm/zatm.c
+@@ -126,7 +126,7 @@ static unsigned long dummy[2] = {0,0};
+ #define zin_n(r) inl(zatm_dev->base+r*4)
+ #define zin(r) inl(zatm_dev->base+uPD98401_##r*4)
+ #define zout(v,r) outl(v,zatm_dev->base+uPD98401_##r*4)
+-#define zwait while (zin(CMR) & uPD98401_BUSY)
++#define zwait() do {} while (zin(CMR) & uPD98401_BUSY)
+
+ /* RX0, RX1, TX0, TX1 */
+ static const int mbx_entries[NR_MBX] = { 1024,1024,1024,1024 };
+@@ -140,7 +140,7 @@ static const int mbx_esize[NR_MBX] = { 16,16,4,4 }; /* entry size in bytes */
+
+ static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr)
+ {
+- zwait;
++ zwait();
+ zout(value,CER);
+ zout(uPD98401_IND_ACC | uPD98401_IA_BALL |
+ (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+@@ -149,10 +149,10 @@ static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr)
+
+ static u32 zpeekl(struct zatm_dev *zatm_dev,u32 addr)
+ {
+- zwait;
++ zwait();
+ zout(uPD98401_IND_ACC | uPD98401_IA_BALL | uPD98401_IA_RW |
+ (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+- zwait;
++ zwait();
+ return zin(CER);
+ }
+
+@@ -241,7 +241,7 @@ static void refill_pool(struct atm_dev *dev,int pool)
+ }
+ if (first) {
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(virt_to_bus(first),CER);
+ zout(uPD98401_ADD_BAT | (pool << uPD98401_POOL_SHIFT) | count,
+ CMR);
+@@ -508,9 +508,9 @@ static int open_rx_first(struct atm_vcc *vcc)
+ }
+ if (zatm_vcc->pool < 0) return -EMSGSIZE;
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(uPD98401_OPEN_CHAN,CMR);
+- zwait;
++ zwait();
+ DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER));
+ chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT;
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+@@ -571,21 +571,21 @@ static void close_rx(struct atm_vcc *vcc)
+ pos = vcc->vci >> 1;
+ shift = (1-(vcc->vci & 1)) << 4;
+ zpokel(zatm_dev,zpeekl(zatm_dev,pos) & ~(0xffff << shift),pos);
+- zwait;
++ zwait();
+ zout(uPD98401_NOP,CMR);
+- zwait;
++ zwait();
+ zout(uPD98401_NOP,CMR);
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+ }
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(uPD98401_DEACT_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan <<
+ uPD98401_CHAN_ADDR_SHIFT),CMR);
+- zwait;
++ zwait();
+ udelay(10); /* why oh why ... ? */
+ zout(uPD98401_CLOSE_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan <<
+ uPD98401_CHAN_ADDR_SHIFT),CMR);
+- zwait;
++ zwait();
+ if (!(zin(CMR) & uPD98401_CHAN_ADDR))
+ printk(KERN_CRIT DEV_LABEL "(itf %d): can't close RX channel "
+ "%d\n",vcc->dev->number,zatm_vcc->rx_chan);
+@@ -699,7 +699,7 @@ printk("NONONONOO!!!!\n");
+ skb_queue_tail(&zatm_vcc->tx_queue,skb);
+ DPRINTK("QRP=0x%08lx\n",zpeekl(zatm_dev,zatm_vcc->tx_chan*VC_SIZE/4+
+ uPD98401_TXVC_QRP));
+- zwait;
++ zwait();
+ zout(uPD98401_TX_READY | (zatm_vcc->tx_chan <<
+ uPD98401_CHAN_ADDR_SHIFT),CMR);
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+@@ -891,12 +891,12 @@ static void close_tx(struct atm_vcc *vcc)
+ }
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+ #if 0
+- zwait;
++ zwait();
+ zout(uPD98401_DEACT_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR);
+ #endif
+- zwait;
++ zwait();
+ zout(uPD98401_CLOSE_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR);
+- zwait;
++ zwait();
+ if (!(zin(CMR) & uPD98401_CHAN_ADDR))
+ printk(KERN_CRIT DEV_LABEL "(itf %d): can't close TX channel "
+ "%d\n",vcc->dev->number,chan);
+@@ -926,9 +926,9 @@ static int open_tx_first(struct atm_vcc *vcc)
+ zatm_vcc->tx_chan = 0;
+ if (vcc->qos.txtp.traffic_class == ATM_NONE) return 0;
+ spin_lock_irqsave(&zatm_dev->lock, flags);
+- zwait;
++ zwait();
+ zout(uPD98401_OPEN_CHAN,CMR);
+- zwait;
++ zwait();
+ DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER));
+ chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT;
+ spin_unlock_irqrestore(&zatm_dev->lock, flags);
+@@ -1559,7 +1559,7 @@ static void zatm_phy_put(struct atm_dev *dev,unsigned char value,
+ struct zatm_dev *zatm_dev;
+
+ zatm_dev = ZATM_DEV(dev);
+- zwait;
++ zwait();
+ zout(value,CER);
+ zout(uPD98401_IND_ACC | uPD98401_IA_B0 |
+ (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+@@ -1571,10 +1571,10 @@ static unsigned char zatm_phy_get(struct atm_dev *dev,unsigned long addr)
+ struct zatm_dev *zatm_dev;
+
+ zatm_dev = ZATM_DEV(dev);
+- zwait;
++ zwait();
+ zout(uPD98401_IND_ACC | uPD98401_IA_B0 | uPD98401_IA_RW |
+ (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR);
+- zwait;
++ zwait();
+ return zin(CER) & 0xff;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3935bac028feca5321bbed4fdfb956ff1dd42355 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 16:22:57 -0400
+Subject: audit: print empty EXECVE args
+
+From: Richard Guy Briggs <rgb@redhat.com>
+
+[ Upstream commit ea956d8be91edc702a98b7fe1f9463e7ca8c42ab ]
+
+Empty executable arguments were being skipped when printing out the list
+of arguments in an EXECVE record, making it appear they were somehow
+lost. Include empty arguments as an itemized empty string.
+
+Reproducer:
+ autrace /bin/ls "" "/etc"
+ ausearch --start recent -m execve -i | grep EXECVE
+ type=EXECVE msg=audit(10/03/2018 13:04:03.208:1391) : argc=3 a0=/bin/ls a2=/etc
+
+With fix:
+ type=EXECVE msg=audit(10/03/2018 21:51:38.290:194) : argc=3 a0=/bin/ls a1= a2=/etc
+ type=EXECVE msg=audit(1538617898.290:194): argc=3 a0="/bin/ls" a1="" a2="/etc"
+
+Passes audit-testsuite. GH issue tracker at
+https://github.com/linux-audit/audit-kernel/issues/99
+
+Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
+[PM: cleaned up the commit metadata]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/auditsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 76d789d6cea06..ffa8d64f6fef4 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1102,7 +1102,7 @@ static void audit_log_execve_info(struct audit_context *context,
+ }
+
+ /* write as much as we can to the audit log */
+- if (len_buf > 0) {
++ if (len_buf >= 0) {
+ /* NOTE: some magic numbers here - basically if we
+ * can't fit a reasonable amount of data into the
+ * existing audit buffer, flush it and start with
+--
+2.20.1
+
--- /dev/null
+From ae3cfe6dfd53f7db442690227b0d6f398a1af009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Oct 2018 19:52:14 +0800
+Subject: block: fix the DISCARD request merge
+
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+
+[ Upstream commit 69840466086d2248898020a08dda52732686c4e6 ]
+
+There are two cases when handle DISCARD merge.
+If max_discard_segments == 1, the bios/requests need to be contiguous
+to merge. If max_discard_segments > 1, it takes every bio as a range
+and different range needn't to be contiguous.
+
+But now, attempt_merge screws this up. It always consider contiguity
+for DISCARD for the case max_discard_segments > 1 and cannot merge
+contiguous DISCARD for the case max_discard_segments == 1, because
+rq_attempt_discard_merge always returns false in this case.
+This patch fixes both of the two cases above.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 46 ++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 36 insertions(+), 10 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 8d60a5bbcef93..94650cdf2924b 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -659,6 +659,31 @@ static void blk_account_io_merge(struct request *req)
+ part_stat_unlock();
+ }
+ }
++/*
++ * Two cases of handling DISCARD merge:
++ * If max_discard_segments > 1, the driver takes every bio
++ * as a range and send them to controller together. The ranges
++ * needn't to be contiguous.
++ * Otherwise, the bios/requests will be handled as same as
++ * others which should be contiguous.
++ */
++static inline bool blk_discard_mergable(struct request *req)
++{
++ if (req_op(req) == REQ_OP_DISCARD &&
++ queue_max_discard_segments(req->q) > 1)
++ return true;
++ return false;
++}
++
++enum elv_merge blk_try_req_merge(struct request *req, struct request *next)
++{
++ if (blk_discard_mergable(req))
++ return ELEVATOR_DISCARD_MERGE;
++ else if (blk_rq_pos(req) + blk_rq_sectors(req) == blk_rq_pos(next))
++ return ELEVATOR_BACK_MERGE;
++
++ return ELEVATOR_NO_MERGE;
++}
+
+ /*
+ * For non-mq, this has to be called with the request spinlock acquired.
+@@ -676,12 +701,6 @@ static struct request *attempt_merge(struct request_queue *q,
+ if (req_op(req) != req_op(next))
+ return NULL;
+
+- /*
+- * not contiguous
+- */
+- if (blk_rq_pos(req) + blk_rq_sectors(req) != blk_rq_pos(next))
+- return NULL;
+-
+ if (rq_data_dir(req) != rq_data_dir(next)
+ || req->rq_disk != next->rq_disk
+ || req_no_special_merge(next))
+@@ -705,11 +724,19 @@ static struct request *attempt_merge(struct request_queue *q,
+ * counts here. Handle DISCARDs separately, as they
+ * have separate settings.
+ */
+- if (req_op(req) == REQ_OP_DISCARD) {
++
++ switch (blk_try_req_merge(req, next)) {
++ case ELEVATOR_DISCARD_MERGE:
+ if (!req_attempt_discard_merge(q, req, next))
+ return NULL;
+- } else if (!ll_merge_requests_fn(q, req, next))
++ break;
++ case ELEVATOR_BACK_MERGE:
++ if (!ll_merge_requests_fn(q, req, next))
++ return NULL;
++ break;
++ default:
+ return NULL;
++ }
+
+ /*
+ * If failfast settings disagree or any of the two is already
+@@ -834,8 +861,7 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio)
+
+ enum elv_merge blk_try_merge(struct request *rq, struct bio *bio)
+ {
+- if (req_op(rq) == REQ_OP_DISCARD &&
+- queue_max_discard_segments(rq->q) > 1)
++ if (blk_discard_mergable(rq))
+ return ELEVATOR_DISCARD_MERGE;
+ else if (blk_rq_pos(rq) + blk_rq_sectors(rq) == bio->bi_iter.bi_sector)
+ return ELEVATOR_BACK_MERGE;
+--
+2.20.1
+
--- /dev/null
+From 4cd165397880158596e0ba236ad9a88f1c5d4539 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Oct 2018 20:15:17 +0900
+Subject: bpf: devmap: fix wrong interface selection in notifier_call
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit f592f804831f1cf9d1f9966f58c80f150e6829b5 ]
+
+The dev_map_notification() removes interface in devmap if
+unregistering interface's ifindex is same.
+But only checking ifindex is not enough because other netns can have
+same ifindex. so that wrong interface selection could occurred.
+Hence netdev pointer comparison code is added.
+
+v2: compare netdev pointer instead of using net_eq() (Daniel Borkmann)
+v1: Initial patch
+
+Fixes: 2ddf71e23cc2 ("net: add notifier hooks for devmap bpf map")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/devmap.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index 482bf42e21a41..1060eee6c8d5f 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -388,8 +388,7 @@ static int dev_map_notification(struct notifier_block *notifier,
+ struct bpf_dtab_netdev *dev, *odev;
+
+ dev = READ_ONCE(dtab->netdev_map[i]);
+- if (!dev ||
+- dev->dev->ifindex != netdev->ifindex)
++ if (!dev || netdev != dev->dev)
+ continue;
+ odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
+ if (dev == odev)
+--
+2.20.1
+
--- /dev/null
+From 0de6e084f0354c1a322ed6ae67de35fc6e352065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 19:21:39 +0300
+Subject: brcmsmac: AP mode: update beacon when TIM changes
+
+From: Ali MJ Al-Nasrawy <alimjalnasrawy@gmail.com>
+
+[ Upstream commit 2258ee58baa554609a3cc3996276e4276f537b6d ]
+
+Beacons are not updated to reflect TIM changes. This is not compliant with
+power-saving client stations as the beacons do not have valid TIM and can
+cause the network to stall at random occasions and to have highly variable
+latencies.
+Fix it by updating beacon templates on mac80211 set_tim callback.
+
+Addresses an issue described in:
+https://marc.info/?i=20180911163534.21312d08%20()%20manjaro
+
+Signed-off-by: Ali MJ Al-Nasrawy <alimjalnasrawy@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../broadcom/brcm80211/brcmsmac/mac80211_if.c | 26 +++++++++++++++++++
+ .../broadcom/brcm80211/brcmsmac/main.h | 1 +
+ 2 files changed, 27 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+index ddfdfe177e245..257968fb3111f 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -502,6 +502,7 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ }
+
+ spin_lock_bh(&wl->lock);
++ wl->wlc->vif = vif;
+ wl->mute_tx = false;
+ brcms_c_mute(wl->wlc, false);
+ if (vif->type == NL80211_IFTYPE_STATION)
+@@ -519,6 +520,11 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ static void
+ brcms_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ {
++ struct brcms_info *wl = hw->priv;
++
++ spin_lock_bh(&wl->lock);
++ wl->wlc->vif = NULL;
++ spin_unlock_bh(&wl->lock);
+ }
+
+ static int brcms_ops_config(struct ieee80211_hw *hw, u32 changed)
+@@ -937,6 +943,25 @@ static void brcms_ops_set_tsf(struct ieee80211_hw *hw,
+ spin_unlock_bh(&wl->lock);
+ }
+
++static int brcms_ops_beacon_set_tim(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta, bool set)
++{
++ struct brcms_info *wl = hw->priv;
++ struct sk_buff *beacon = NULL;
++ u16 tim_offset = 0;
++
++ spin_lock_bh(&wl->lock);
++ if (wl->wlc->vif)
++ beacon = ieee80211_beacon_get_tim(hw, wl->wlc->vif,
++ &tim_offset, NULL);
++ if (beacon)
++ brcms_c_set_new_beacon(wl->wlc, beacon, tim_offset,
++ wl->wlc->vif->bss_conf.dtim_period);
++ spin_unlock_bh(&wl->lock);
++
++ return 0;
++}
++
+ static const struct ieee80211_ops brcms_ops = {
+ .tx = brcms_ops_tx,
+ .start = brcms_ops_start,
+@@ -955,6 +980,7 @@ static const struct ieee80211_ops brcms_ops = {
+ .flush = brcms_ops_flush,
+ .get_tsf = brcms_ops_get_tsf,
+ .set_tsf = brcms_ops_set_tsf,
++ .set_tim = brcms_ops_beacon_set_tim,
+ };
+
+ void brcms_dpc(unsigned long data)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
+index c4d135cff04ad..9f76b880814e8 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
+@@ -563,6 +563,7 @@ struct brcms_c_info {
+
+ struct wiphy *wiphy;
+ struct scb pri_scb;
++ struct ieee80211_vif *vif;
+
+ struct sk_buff *beacon;
+ u16 beacon_tim_offset;
+--
+2.20.1
+
--- /dev/null
+From 3ffe0de54a74e5597d51e9c1516ffd57e1e82d65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Oct 2018 19:12:35 +0300
+Subject: brcmsmac: never log "tid x is not agg'able" by default
+
+From: Ali MJ Al-Nasrawy <alimjalnasrawy@gmail.com>
+
+[ Upstream commit 96fca788e5788b7ea3b0050eb35a343637e0a465 ]
+
+This message greatly spams the log under heavy Tx of frames with BK access
+class which is especially true when operating as AP. It is also not informative
+as the "agg'ablity" of TIDs are set once and never change.
+Fix this by logging only in debug mode.
+
+Signed-off-by: Ali MJ Al-Nasrawy <alimjalnasrawy@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+index 257968fb3111f..66f1f41b13803 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
+@@ -846,8 +846,8 @@ brcms_ops_ampdu_action(struct ieee80211_hw *hw,
+ status = brcms_c_aggregatable(wl->wlc, tid);
+ spin_unlock_bh(&wl->lock);
+ if (!status) {
+- brcms_err(wl->wlc->hw->d11core,
+- "START: tid %d is not agg\'able\n", tid);
++ brcms_dbg_ht(wl->wlc->hw->d11core,
++ "START: tid %d is not agg\'able\n", tid);
+ return -EINVAL;
+ }
+ ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+--
+2.20.1
+
--- /dev/null
+From 0091fb2b8c27bd0f909171cf2d083db2d7f4205e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Nov 2018 16:39:28 +0100
+Subject: btrfs: avoid link error with CONFIG_NO_AUTO_INLINE
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7e17916b35797396f681a3270245fd29c1e4c250 ]
+
+Note: this patch fixes a problem in a feature outside of btrfs ("kernel
+hacking: add a config option to disable compiler auto-inlining") and is
+applied ahead of time due to cross-subsystem dependencies.
+
+On 32-bit ARM with gcc-8, I see a link error with the addition of the
+CONFIG_NO_AUTO_INLINE option:
+
+fs/btrfs/super.o: In function `btrfs_statfs':
+super.c:(.text+0x67b8): undefined reference to `__aeabi_uldivmod'
+super.c:(.text+0x67fc): undefined reference to `__aeabi_uldivmod'
+super.c:(.text+0x6858): undefined reference to `__aeabi_uldivmod'
+super.c:(.text+0x6920): undefined reference to `__aeabi_uldivmod'
+super.c:(.text+0x693c): undefined reference to `__aeabi_uldivmod'
+fs/btrfs/super.o:super.c:(.text+0x6958): more undefined references to `__aeabi_uldivmod' follow
+
+So far this is the only file that shows the behavior, so I'd propose
+to just work around it by marking the functions as 'static inline'
+that normally get inlined here.
+
+The reference to __aeabi_uldivmod comes from a div_u64() which has an
+optimization for a constant division that uses a straight '/' operator
+when the result should be known to the compiler. My interpretation is
+that as we turn off inlining, gcc still expects the result to be constant
+but fails to use that constant value.
+
+Link: https://lkml.kernel.org/r/20181103153941.1881966-1-arnd@arndb.de
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+[ add the note ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/super.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 49a02bf091aea..204d585e012a8 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1863,7 +1863,7 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
+ }
+
+ /* Used to sort the devices by max_avail(descending sort) */
+-static int btrfs_cmp_device_free_bytes(const void *dev_info1,
++static inline int btrfs_cmp_device_free_bytes(const void *dev_info1,
+ const void *dev_info2)
+ {
+ if (((struct btrfs_device_info *)dev_info1)->max_avail >
+@@ -1892,8 +1892,8 @@ static inline void btrfs_descending_sort_devices(
+ * The helper to calc the free space on the devices that can be used to store
+ * file data.
+ */
+-static int btrfs_calc_avail_data_space(struct btrfs_fs_info *fs_info,
+- u64 *free_bytes)
++static inline int btrfs_calc_avail_data_space(struct btrfs_fs_info *fs_info,
++ u64 *free_bytes)
+ {
+ struct btrfs_device_info *devices_info;
+ struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
+--
+2.20.1
+
--- /dev/null
+From a95c3dedfc423cf9d25eb73e978d06c614303f89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 11:35:10 +0300
+Subject: btrfs: handle error of get_old_root
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit 315bed43fea532650933e7bba316a7601d439edf ]
+
+In btrfs_search_old_slot get_old_root is always used with the assumption
+it cannot fail. However, this is not true in rare circumstance it can
+fail and return null. This will lead to null point dereference when the
+header is read. Fix this by checking the return value and properly
+handling NULL by setting ret to -EIO and returning gracefully.
+
+Coverity-id: 1087503
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 27983fd657abd..d2263caff3070 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2988,6 +2988,10 @@ int btrfs_search_old_slot(struct btrfs_root *root, const struct btrfs_key *key,
+
+ again:
+ b = get_old_root(root, time_seq);
++ if (!b) {
++ ret = -EIO;
++ goto done;
++ }
+ level = btrfs_header_level(b);
+ p->locks[level] = BTRFS_READ_LOCK;
+
+--
+2.20.1
+
--- /dev/null
+From 62d65373cd88bd8fc7812b5935e1d4a87198aa04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Oct 2018 13:20:48 -0600
+Subject: cdrom: don't attempt to fiddle with cdo->capability
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 8f94004e2a51a3ea195cf3447eb5d5906f36d8b3 ]
+
+We can't modify cdo->capability as it is defined as a const.
+Change the modification hack to just WARN_ON_ONCE() if we hit
+any of the invalid combinations.
+
+This fixes a regression for pcd, which doesn't work after the
+constify patch.
+
+Fixes: 853fe1bf7554 ("cdrom: Make device operations read-only")
+Tested-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cdrom/cdrom.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index ea6558d4864c0..90dd8e7291dab 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -410,10 +410,10 @@ static int cdrom_get_disc_info(struct cdrom_device_info *cdi,
+ * hack to have the capability flags defined const, while we can still
+ * change it here without gcc complaining at every line.
+ */
+-#define ENSURE(call, bits) \
+-do { \
+- if (cdo->call == NULL) \
+- *change_capability &= ~(bits); \
++#define ENSURE(cdo, call, bits) \
++do { \
++ if (cdo->call == NULL) \
++ WARN_ON_ONCE((cdo)->capability & (bits)); \
+ } while (0)
+
+ /*
+@@ -589,7 +589,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ {
+ static char banner_printed;
+ const struct cdrom_device_ops *cdo = cdi->ops;
+- int *change_capability = (int *)&cdo->capability; /* hack */
+
+ cd_dbg(CD_OPEN, "entering register_cdrom\n");
+
+@@ -601,16 +600,16 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ cdrom_sysctl_register();
+ }
+
+- ENSURE(drive_status, CDC_DRIVE_STATUS);
++ ENSURE(cdo, drive_status, CDC_DRIVE_STATUS);
+ if (cdo->check_events == NULL && cdo->media_changed == NULL)
+- *change_capability = ~(CDC_MEDIA_CHANGED | CDC_SELECT_DISC);
+- ENSURE(tray_move, CDC_CLOSE_TRAY | CDC_OPEN_TRAY);
+- ENSURE(lock_door, CDC_LOCK);
+- ENSURE(select_speed, CDC_SELECT_SPEED);
+- ENSURE(get_last_session, CDC_MULTI_SESSION);
+- ENSURE(get_mcn, CDC_MCN);
+- ENSURE(reset, CDC_RESET);
+- ENSURE(generic_packet, CDC_GENERIC_PACKET);
++ WARN_ON_ONCE(cdo->capability & (CDC_MEDIA_CHANGED | CDC_SELECT_DISC));
++ ENSURE(cdo, tray_move, CDC_CLOSE_TRAY | CDC_OPEN_TRAY);
++ ENSURE(cdo, lock_door, CDC_LOCK);
++ ENSURE(cdo, select_speed, CDC_SELECT_SPEED);
++ ENSURE(cdo, get_last_session, CDC_MULTI_SESSION);
++ ENSURE(cdo, get_mcn, CDC_MCN);
++ ENSURE(cdo, reset, CDC_RESET);
++ ENSURE(cdo, generic_packet, CDC_GENERIC_PACKET);
+ cdi->mc_flags = 0;
+ cdi->options = CDO_USE_FFLAGS;
+
+--
+2.20.1
+
--- /dev/null
+From 1be06101c2b8a809d1dcc6af8936940a18e5715a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Sep 2018 09:10:29 +0800
+Subject: ceph: fix dentry leak in ceph_readdir_prepopulate
+
+From: Yan, Zheng <zyan@redhat.com>
+
+[ Upstream commit c58f450bd61511d897efc2ea472c69630635b557 ]
+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/inode.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 3818027c12f5a..5999d806de788 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1631,7 +1631,6 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
+ if (IS_ERR(realdn)) {
+ err = PTR_ERR(realdn);
+ d_drop(dn);
+- dn = NULL;
+ goto next_item;
+ }
+ dn = realdn;
+--
+2.20.1
+
--- /dev/null
+From 13f2eba19ea3babfb913f505477c386a1324ad66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 11:09:54 +0100
+Subject: cfg80211: call disconnect_wk when AP stops
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit e005bd7ddea06784c1eb91ac5bb6b171a94f3b05 ]
+
+Since we now prevent regulatory restore during STA disconnect
+if concurrent AP interfaces are active, we need to reschedule
+this check when the AP state changes. This fixes never doing
+a restore when an AP is the last interface to stop. Or to put
+it another way: we need to re-check after anything we check
+here changes.
+
+Cc: stable@vger.kernel.org
+Fixes: 113f3aaa81bd ("cfg80211: Prevent regulatory restore during STA disconnect in concurrent interfaces")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/ap.c | 2 ++
+ net/wireless/core.h | 2 ++
+ net/wireless/sme.c | 2 +-
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/ap.c b/net/wireless/ap.c
+index 63682176c96cb..c4bd3ecef5089 100644
+--- a/net/wireless/ap.c
++++ b/net/wireless/ap.c
+@@ -40,6 +40,8 @@ int __cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
+ cfg80211_sched_dfs_chan_update(rdev);
+ }
+
++ schedule_work(&cfg80211_disconnect_work);
++
+ return err;
+ }
+
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 90f90c7d8bf9b..507ec6446eb67 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -429,6 +429,8 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev);
+ bool cfg80211_does_bw_fit_range(const struct ieee80211_freq_range *freq_range,
+ u32 center_freq_khz, u32 bw_khz);
+
++extern struct work_struct cfg80211_disconnect_work;
++
+ /**
+ * cfg80211_chandef_dfs_usable - checks if chandef is DFS usable
+ * @wiphy: the wiphy to validate against
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index 66cccd16c24af..8344153800e27 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -667,7 +667,7 @@ static void disconnect_work(struct work_struct *work)
+ rtnl_unlock();
+ }
+
+-static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
++DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
+
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 5b59dbaee3590817ca2af7cd61ad5f6022ad2806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 14:42:59 +0530
+Subject: cfg80211: Prevent regulatory restore during STA disconnect in
+ concurrent interfaces
+
+From: Sriram R <srirrama@codeaurora.org>
+
+[ Upstream commit 113f3aaa81bd56aba02659786ed65cbd9cb9a6fc ]
+
+Currently when an AP and STA interfaces are active in the same or different
+radios, regulatory settings are restored whenever the STA disconnects. This
+restores all channel information including dfs states in all radios.
+For example, if an AP interface is active in one radio and STA in another,
+when radar is detected on the AP interface, the dfs state of the channel
+will be changed to UNAVAILABLE. But when the STA interface disconnects,
+this issues a regulatory disconnect hint which restores all regulatory
+settings in all the radios attached and thereby losing the stored dfs
+state on the other radio where the channel was marked as unavailable
+earlier. Hence prevent such regulatory restore whenever another active
+beaconing interface is present in the same or other radios.
+
+Signed-off-by: Sriram R <srirrama@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/sme.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index d014aea07160c..66cccd16c24af 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -642,11 +642,15 @@ static bool cfg80211_is_all_idle(void)
+ * All devices must be idle as otherwise if you are actively
+ * scanning some new beacon hints could be learned and would
+ * count as new regulatory hints.
++ * Also if there is any other active beaconing interface we
++ * need not issue a disconnect hint and reset any info such
++ * as chan dfs state, etc.
+ */
+ list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
+ wdev_lock(wdev);
+- if (wdev->conn || wdev->current_bss)
++ if (wdev->conn || wdev->current_bss ||
++ cfg80211_beaconing_iface_active(wdev))
+ is_all_idle = false;
+ wdev_unlock(wdev);
+ }
+--
+2.20.1
+
--- /dev/null
+From 2ef7827a778fd1b3a90cc4beb47ce993b094d672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 16:21:39 +0200
+Subject: clk: at91: audio-pll: fix audio pmc type
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 7fa75007b7d7421aea59ff2b12ab1bd65a5abfa6 ]
+
+The allocation for the audio pmc is using the size of struct clk_audio_pad
+instead of struct clk_audio_pmc. This works fine because the former is
+larger than the latter but it is safer to be correct.
+
+Fixes: ("0865805d82d4 clk: at91: add audio pll clock drivers")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-audio-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/at91/clk-audio-pll.c b/drivers/clk/at91/clk-audio-pll.c
+index da7bafcfbe706..b3eaf654fac98 100644
+--- a/drivers/clk/at91/clk-audio-pll.c
++++ b/drivers/clk/at91/clk-audio-pll.c
+@@ -509,7 +509,7 @@ static void __init of_sama5d2_clk_audio_pll_pad_setup(struct device_node *np)
+
+ static void __init of_sama5d2_clk_audio_pll_pmc_setup(struct device_node *np)
+ {
+- struct clk_audio_pad *apmc_ck;
++ struct clk_audio_pmc *apmc_ck;
+ struct clk_init_data init = {};
+
+ apmc_ck = kzalloc(sizeof(*apmc_ck), GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From c462fa44067053f9871812db2967f4d314cf603b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Sep 2018 14:01:44 +0200
+Subject: clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 4917fb90eec7c26dac1497ada3bd4a325f670fcc ]
+
+A typo that makes it impossible to get the correct clocks for
+MMP2_CLK_SDH2 and MMP2_CLK_SDH3.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Fixes: 1ec770d92a62 ("clk: mmp: add mmp2 DT support for clock driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mmp/clk-of-mmp2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
+index 0fc75c3959570..d083b860f0833 100644
+--- a/drivers/clk/mmp/clk-of-mmp2.c
++++ b/drivers/clk/mmp/clk-of-mmp2.c
+@@ -227,8 +227,8 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
+ /* The gate clocks has mux parent. */
+ {MMP2_CLK_SDH0, "sdh0_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH0, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+ {MMP2_CLK_SDH1, "sdh1_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH1, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+- {MMP2_CLK_SDH1, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+- {MMP2_CLK_SDH1, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
++ {MMP2_CLK_SDH2, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
++ {MMP2_CLK_SDH3, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
+ {MMP2_CLK_DISP0, "disp0_clk", "disp0_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1b, 0x1b, 0x0, 0, &disp0_lock},
+ {MMP2_CLK_DISP0_SPHY, "disp0_sphy_clk", "disp0_sphy_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1024, 0x1024, 0x0, 0, &disp0_lock},
+ {MMP2_CLK_DISP1, "disp1_clk", "disp1_div", CLK_SET_RATE_PARENT, APMU_DISP1, 0x1b, 0x1b, 0x0, 0, &disp1_lock},
+--
+2.20.1
+
--- /dev/null
+From d1eaac36cfcdfe4b10fb26f3cbb7ed63142a1f66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 15:07:29 +0800
+Subject: clk: sunxi-ng: enable so-said LDOs for A64 SoC's pll-mipi clock
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit 859783d1390035e29ba850963bded2b4ffdf43b5 ]
+
+In the user manual of A64 SoC, the bit 22 and 23 of pll-mipi control
+register is called "LDO{1,2}_EN", and according to the BSP source code
+from Allwinner , the LDOs are enabled during the clock's enabling
+process.
+
+The clock failed to generate output if the two LDOs are not enabled.
+
+Add the two bits to the clock's gate bits, so that the LDOs are enabled
+when the PLL is enabled.
+
+Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 2bb4cabf802f0..36a30a3cfad71 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -158,7 +158,12 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_gpu_clk, "pll-gpu",
+ #define SUN50I_A64_PLL_MIPI_REG 0x040
+
+ static struct ccu_nkm pll_mipi_clk = {
+- .enable = BIT(31),
++ /*
++ * The bit 23 and 22 are called "LDO{1,2}_EN" on the SoC's
++ * user manual, and by experiments the PLL doesn't work without
++ * these bits toggled.
++ */
++ .enable = BIT(31) | BIT(23) | BIT(22),
+ .lock = BIT(28),
+ .n = _SUNXI_CCU_MULT(8, 4),
+ .k = _SUNXI_CCU_MULT_MIN(4, 2, 2),
+--
+2.20.1
+
--- /dev/null
+From 85d55d9a4c7b55da0131e05be549b02b3d99aa05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 14:40:07 -0700
+Subject: crypto: ccree - avoid implicit enum conversion
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 18e732b8035d175181aae2ded127994cb01694f7 ]
+
+Clang warns when one enumerated type is implicitly converted to another
+and this happens in several locations in this driver, ultimately related
+to the set_cipher_{mode,config0} functions. set_cipher_mode expects a mode
+of type drv_cipher_mode and set_cipher_config0 expects a mode of type
+drv_crypto_direction.
+
+drivers/crypto/ccree/cc_ivgen.c:58:35: warning: implicit conversion from
+enumeration type 'enum cc_desc_direction' to different enumeration type
+'enum drv_crypto_direction' [-Wenum-conversion]
+ set_cipher_config0(&iv_seq[idx], DESC_DIRECTION_ENCRYPT_ENCRYPT);
+
+drivers/crypto/ccree/cc_hash.c:99:28: warning: implicit conversion from
+enumeration type 'enum cc_hash_conf_pad' to different enumeration type
+'enum drv_crypto_direction' [-Wenum-conversion]
+ set_cipher_config0(desc, HASH_DIGEST_RESULT_LITTLE_ENDIAN);
+
+drivers/crypto/ccree/cc_aead.c:1643:30: warning: implicit conversion
+from enumeration type 'enum drv_hash_hw_mode' to different enumeration
+type 'enum drv_cipher_mode' [-Wenum-conversion]
+ set_cipher_mode(&desc[idx], DRV_HASH_HW_GHASH);
+
+Since this fundamentally isn't a problem because these values just
+represent simple integers for a shift operation, make it clear to Clang
+that this is okay by making the mode parameter in both functions an int.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/46
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Gilad Ben-Yossef <gilad@benyossef.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/ccree/cc_hw_queue_defs.h | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/ccree/cc_hw_queue_defs.h b/drivers/staging/ccree/cc_hw_queue_defs.h
+index 2ae0f655e7a0e..b86f47712e303 100644
+--- a/drivers/staging/ccree/cc_hw_queue_defs.h
++++ b/drivers/staging/ccree/cc_hw_queue_defs.h
+@@ -467,8 +467,7 @@ static inline void set_flow_mode(struct cc_hw_desc *pdesc,
+ * @pdesc: pointer HW descriptor struct
+ * @mode: Any one of the modes defined in [CC7x-DESC]
+ */
+-static inline void set_cipher_mode(struct cc_hw_desc *pdesc,
+- enum drv_cipher_mode mode)
++static inline void set_cipher_mode(struct cc_hw_desc *pdesc, int mode)
+ {
+ pdesc->word[4] |= FIELD_PREP(WORD4_CIPHER_MODE, mode);
+ }
+@@ -479,8 +478,7 @@ static inline void set_cipher_mode(struct cc_hw_desc *pdesc,
+ * @pdesc: pointer HW descriptor struct
+ * @mode: Any one of the modes defined in [CC7x-DESC]
+ */
+-static inline void set_cipher_config0(struct cc_hw_desc *pdesc,
+- enum drv_crypto_direction mode)
++static inline void set_cipher_config0(struct cc_hw_desc *pdesc, int mode)
+ {
+ pdesc->word[4] |= FIELD_PREP(WORD4_CIPHER_CONF0, mode);
+ }
+--
+2.20.1
+
--- /dev/null
+From c8e5d43edd0f7eec77b911090c55ee24b9e513d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 14:18:22 -0600
+Subject: dlm: don't leak kernel pointer to userspace
+
+From: Tycho Andersen <tycho@tycho.ws>
+
+[ Upstream commit 9de30f3f7f4d31037cfbb7c787e1089c1944b3a7 ]
+
+In copy_result_to_user(), we first create a struct dlm_lock_result, which
+contains a struct dlm_lksb, the last member of which is a pointer to the
+lvb. Unfortunately, we copy the entire struct dlm_lksb to the result
+struct, which is then copied to userspace at the end of the function,
+leaking the contents of sb_lvbptr, which is a valid kernel pointer in some
+cases (indeed, later in the same function the data it points to is copied
+to userspace).
+
+It is an error to leak kernel pointers to userspace, as it undermines KASLR
+protections (see e.g. 65eea8edc31 ("floppy: Do not copy a kernel pointer to
+user memory in FDGETPRM ioctl") for another example of this).
+
+Signed-off-by: Tycho Andersen <tycho@tycho.ws>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index d18e7a539f116..1f0c071d4a861 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -702,7 +702,7 @@ static int copy_result_to_user(struct dlm_user_args *ua, int compat,
+ result.version[0] = DLM_DEVICE_VERSION_MAJOR;
+ result.version[1] = DLM_DEVICE_VERSION_MINOR;
+ result.version[2] = DLM_DEVICE_VERSION_PATCH;
+- memcpy(&result.lksb, &ua->lksb, sizeof(struct dlm_lksb));
++ memcpy(&result.lksb, &ua->lksb, offsetof(struct dlm_lksb, sb_lvbptr));
+ result.user_lksb = ua->user_lksb;
+
+ /* FIXME: dlm1 provides for the user's bastparam/addr to not be updated
+--
+2.20.1
+
--- /dev/null
+From ec79f027af557437d7addb01dc8141109d36255e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 14:18:20 -0600
+Subject: dlm: fix invalid free
+
+From: Tycho Andersen <tycho@tycho.ws>
+
+[ Upstream commit d968b4e240cfe39d39d80483bac8bca8716fd93c ]
+
+dlm_config_nodes() does not allocate nodes on failure, so we should not
+free() nodes when it fails.
+
+Signed-off-by: Tycho Andersen <tycho@tycho.ws>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/member.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/dlm/member.c b/fs/dlm/member.c
+index 3fda3832cf6a6..cad6d85911a80 100644
+--- a/fs/dlm/member.c
++++ b/fs/dlm/member.c
+@@ -680,7 +680,7 @@ int dlm_ls_start(struct dlm_ls *ls)
+
+ error = dlm_config_nodes(ls->ls_name, &nodes, &count);
+ if (error < 0)
+- goto fail;
++ goto fail_rv;
+
+ spin_lock(&ls->ls_recover_lock);
+
+@@ -712,8 +712,9 @@ int dlm_ls_start(struct dlm_ls *ls)
+ return 0;
+
+ fail:
+- kfree(rv);
+ kfree(nodes);
++ fail_rv:
++ kfree(rv);
+ return error;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6522c6339cdadaeb4d58be31e1eca4d30f4503eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 20:24:25 +0200
+Subject: dm raid: avoid bitmap with raid4/5/6 journal device
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+[ Upstream commit d857ad75edf3c0066fcd920746f9dc75382b3324 ]
+
+With raid4/5/6, journal device and write intent bitmap are mutually exclusive.
+
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-raid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 151211b4cb1ba..2c5912e755148 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -2441,7 +2441,7 @@ static int super_validate(struct raid_set *rs, struct md_rdev *rdev)
+ }
+
+ /* Enable bitmap creation for RAID levels != 0 */
+- mddev->bitmap_info.offset = rt_is_raid0(rs->raid_type) ? 0 : to_sector(4096);
++ mddev->bitmap_info.offset = (rt_is_raid0(rs->raid_type) || rs->journal_dev.dev) ? 0 : to_sector(4096);
+ mddev->bitmap_info.default_offset = mddev->bitmap_info.offset;
+
+ if (!test_and_clear_bit(FirstUse, &rdev->flags)) {
+--
+2.20.1
+
--- /dev/null
+From 4758bb4e23afb1027538f1f91bdac001d68e0318 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Oct 2018 13:28:43 +0300
+Subject: EDAC, thunderx: Fix memory leak in thunderx_l2c_threaded_isr()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d8c27ba86a2fd806d3957e5a9b30e66dfca2a61d ]
+
+Fix memory leak in L2c threaded interrupt handler.
+
+ [ bp: Rewrite commit message. ]
+
+Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: David Daney <david.daney@cavium.com>
+CC: Jan Glauber <jglauber@cavium.com>
+CC: Mauro Carvalho Chehab <mchehab@kernel.org>
+CC: Sergey Temerkhanov <s.temerkhanov@gmail.com>
+CC: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20181013102843.GG16086@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/thunderx_edac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
+index f35d87519a3e8..dfefa39e93519 100644
+--- a/drivers/edac/thunderx_edac.c
++++ b/drivers/edac/thunderx_edac.c
+@@ -1905,7 +1905,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
+ default:
+ dev_err(&l2c->pdev->dev, "Unsupported device: %04x\n",
+ l2c->pdev->device);
+- return IRQ_NONE;
++ goto err_free;
+ }
+
+ while (CIRC_CNT(l2c->ring_head, l2c->ring_tail,
+@@ -1927,7 +1927,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
+ l2c->ring_tail++;
+ }
+
+- return IRQ_HANDLED;
++ ret = IRQ_HANDLED;
+
+ err_free:
+ kfree(other);
+--
+2.20.1
+
--- /dev/null
+From f763f07bba2758ade3f5b62dcc37d65dd0a13757 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jul 2018 18:15:16 +0800
+Subject: f2fs: fix to spread clear_cold_data()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 2baf07818549c8bb8d7b3437e889b86eab56d38e ]
+
+We need to drop PG_checked flag on page as well when we clear PG_uptodate
+flag, in order to avoid treating the page as GCing one later.
+
+Signed-off-by: Weichao Guo <guoweichao@huawei.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 8 +++++++-
+ fs/f2fs/dir.c | 1 +
+ fs/f2fs/segment.c | 4 +++-
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index cc57294451940..ac3fa4bbed2d9 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1445,6 +1445,7 @@ int do_write_data_page(struct f2fs_io_info *fio)
+ /* This page is already truncated */
+ if (fio->old_blkaddr == NULL_ADDR) {
+ ClearPageUptodate(page);
++ clear_cold_data(page);
+ goto out_writepage;
+ }
+ got_it:
+@@ -1597,8 +1598,10 @@ static int __write_data_page(struct page *page, bool *submitted,
+
+ out:
+ inode_dec_dirty_pages(inode);
+- if (err)
++ if (err) {
+ ClearPageUptodate(page);
++ clear_cold_data(page);
++ }
+
+ if (wbc->for_reclaim) {
+ f2fs_submit_merged_write_cond(sbi, inode, 0, page->index, DATA);
+@@ -2158,6 +2161,8 @@ void f2fs_invalidate_page(struct page *page, unsigned int offset,
+ }
+ }
+
++ clear_cold_data(page);
++
+ /* This is atomic written page, keep Private */
+ if (IS_ATOMIC_WRITTEN_PAGE(page))
+ return drop_inmem_page(inode, page);
+@@ -2176,6 +2181,7 @@ int f2fs_release_page(struct page *page, gfp_t wait)
+ if (IS_ATOMIC_WRITTEN_PAGE(page))
+ return 0;
+
++ clear_cold_data(page);
+ set_page_private(page, 0);
+ ClearPagePrivate(page);
+ return 1;
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index c0c933ad43c8d..4abefd841b6c7 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -745,6 +745,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
+ clear_page_dirty_for_io(page);
+ ClearPagePrivate(page);
+ ClearPageUptodate(page);
++ clear_cold_data(page);
+ inode_dec_dirty_pages(dir);
+ remove_dirty_inode(dir);
+ }
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 9e5fca35e47d0..2cd0d126ef8fa 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -251,8 +251,10 @@ static int __revoke_inmem_pages(struct inode *inode,
+ }
+ next:
+ /* we don't need to invalidate this in the sccessful status */
+- if (drop || recover)
++ if (drop || recover) {
+ ClearPageUptodate(page);
++ clear_cold_data(page);
++ }
+ set_page_private(page, 0);
+ ClearPagePrivate(page);
+ f2fs_put_page(page, 1);
+--
+2.20.1
+
--- /dev/null
+From 8e48b7c2f6d167dfb31379bb99586abc0918dedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:35 -0700
+Subject: fs/hfs/extent.c: fix array out of bounds read of array extent
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 6c9a3f843a29d6894dfc40df338b91dbd78f0ae3 ]
+
+Currently extent and index i are both being incremented causing an array
+out of bounds read on extent[i]. Fix this by removing the extraneous
+increment of extent.
+
+Ernesto said:
+
+: This is only triggered when deleting a file with a resource fork. I
+: may be wrong because the documentation isn't clear, but I don't think
+: you can create those under linux. So I guess nobody was testing them.
+:
+: > A disk space leak, perhaps?
+:
+: That's what it looks like in general. hfs_free_extents() won't do
+: anything if the block count doesn't add up, and the error will be
+: ignored. Now, if the block count randomly does add up, we could see
+: some corruption.
+
+Detected by CoverityScan, CID#711541 ("Out of bounds read")
+
+Link: http://lkml.kernel.org/r/20180831140538.31566-1-colin.king@canonical.com
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Ernesto A. Fernndez <ernesto.mnd.fernandez@gmail.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Hin-Tak Leung <htl10@users.sourceforge.net>
+Cc: Vyacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/extent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
+index 5f1ff97a3b987..263d5028d9d18 100644
+--- a/fs/hfs/extent.c
++++ b/fs/hfs/extent.c
+@@ -304,7 +304,7 @@ int hfs_free_fork(struct super_block *sb, struct hfs_cat_file *file, int type)
+ return 0;
+
+ blocks = 0;
+- for (i = 0; i < 3; extent++, i++)
++ for (i = 0; i < 3; i++)
+ blocks += be16_to_cpu(extent[i].count);
+
+ res = hfs_free_extents(sb, extent, blocks, blocks);
+--
+2.20.1
+
--- /dev/null
+From bd26bd198055d84043d0583d6f778c1afa566378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 15:02:52 -0700
+Subject: fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in
+ dlm_print_one_mle()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 999865764f5f128896402572b439269acb471022 ]
+
+The kernel module may sleep with holding a spinlock.
+
+The function call paths (from bottom to top) in Linux-4.16 are:
+
+[FUNC] get_zeroed_page(GFP_NOFS)
+fs/ocfs2/dlm/dlmdebug.c, 332: get_zeroed_page in dlm_print_one_mle
+fs/ocfs2/dlm/dlmmaster.c, 240: dlm_print_one_mle in __dlm_put_mle
+fs/ocfs2/dlm/dlmmaster.c, 255: __dlm_put_mle in dlm_put_mle
+fs/ocfs2/dlm/dlmmaster.c, 254: spin_lock in dlm_put_ml
+
+[FUNC] get_zeroed_page(GFP_NOFS)
+fs/ocfs2/dlm/dlmdebug.c, 332: get_zeroed_page in dlm_print_one_mle
+fs/ocfs2/dlm/dlmmaster.c, 240: dlm_print_one_mle in __dlm_put_mle
+fs/ocfs2/dlm/dlmmaster.c, 222: __dlm_put_mle in dlm_put_mle_inuse
+fs/ocfs2/dlm/dlmmaster.c, 219: spin_lock in dlm_put_mle_inuse
+
+To fix this bug, GFP_NOFS is replaced with GFP_ATOMIC.
+
+This bug is found by my static analysis tool DSAC.
+
+Link: http://lkml.kernel.org/r/20180901112528.27025-1-baijiaju1990@gmail.com
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/dlm/dlmdebug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
+index 9b984cae4c4e0..1d6dc8422899b 100644
+--- a/fs/ocfs2/dlm/dlmdebug.c
++++ b/fs/ocfs2/dlm/dlmdebug.c
+@@ -329,7 +329,7 @@ void dlm_print_one_mle(struct dlm_master_list_entry *mle)
+ {
+ char *buf;
+
+- buf = (char *) get_zeroed_page(GFP_NOFS);
++ buf = (char *) get_zeroed_page(GFP_ATOMIC);
+ if (buf) {
+ dump_mle(mle, buf, PAGE_SIZE - 1);
+ free_page((unsigned long)buf);
+--
+2.20.1
+
--- /dev/null
+From 4b6ce1800dda68f0601c88f67610c4a0b2369b5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 15:30:25 +0100
+Subject: gfs2: Fix marking bitmaps non-full
+
+From: Andreas Gruenbacher <agruenba@redhat.com>
+
+[ Upstream commit ec23df2b0cf3e1620f5db77972b7fb735f267eff ]
+
+Reservations in gfs can span multiple gfs2_bitmaps (but they won't span
+multiple resource groups). When removing a reservation, we want to
+clear the GBF_FULL flags of all involved gfs2_bitmaps, not just that of
+the first bitmap.
+
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 0d72baae51509..7cb0672294dfc 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -623,7 +623,10 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
+ RB_CLEAR_NODE(&rs->rs_node);
+
+ if (rs->rs_free) {
+- struct gfs2_bitmap *bi = rbm_bi(&rs->rs_rbm);
++ u64 last_block = gfs2_rbm_to_block(&rs->rs_rbm) +
++ rs->rs_free - 1;
++ struct gfs2_rbm last_rbm = { .rgd = rs->rs_rbm.rgd, };
++ struct gfs2_bitmap *start, *last;
+
+ /* return reserved blocks to the rgrp */
+ BUG_ON(rs->rs_rbm.rgd->rd_reserved < rs->rs_free);
+@@ -634,7 +637,13 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
+ it will force the number to be recalculated later. */
+ rgd->rd_extfail_pt += rs->rs_free;
+ rs->rs_free = 0;
+- clear_bit(GBF_FULL, &bi->bi_flags);
++ if (gfs2_rbm_from_block(&last_rbm, last_block))
++ return;
++ start = rbm_bi(&rs->rs_rbm);
++ last = rbm_bi(&last_rbm);
++ do
++ clear_bit(GBF_FULL, &start->bi_flags);
++ while (start++ != last);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 255cfb9fd3752107efe316723e7026f80097e712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 10:04:45 -0600
+Subject: gsmi: Fix bug in append_to_eventlog sysfs handler
+
+From: Duncan Laurie <dlaurie@chromium.org>
+
+[ Upstream commit 655603de68469adaff16842ac17a5aec9c9ce89b ]
+
+The sysfs handler should return the number of bytes consumed, which in the
+case of a successful write is the entire buffer. Also fix a bug where
+param.data_len was being set to (count - (2 * sizeof(u32))) instead of just
+(count - sizeof(u32)). The latter is correct because we skip over the
+leading u32 which is our param.type, but we were also incorrectly
+subtracting sizeof(u32) on the line where we were actually setting
+param.data_len:
+
+ param.data_len = count - sizeof(u32);
+
+This meant that for our example event.kernel_software_watchdog with total
+length 10 bytes, param.data_len was just 2 prior to this change.
+
+To test, successfully append an event to the log with gsmi sysfs.
+This sample event is for a "Kernel Software Watchdog"
+
+> xxd -g 1 event.kernel_software_watchdog
+0000000: 01 00 00 00 ad de 06 00 00 00
+
+> cat event.kernel_software_watchdog > /sys/firmware/gsmi/append_to_eventlog
+
+> mosys eventlog list | tail -1
+14 | 2012-06-25 10:14:14 | Kernl Event | Software Watchdog
+
+Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
+Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
+Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
+Signed-off-by: Furquan Shaikh <furquan@google.com>
+Tested-by: Furquan Shaikh <furquan@chromium.org>
+Reviewed-by: Aaron Durbin <adurbin@chromium.org>
+Reviewed-by: Justin TerAvest <teravest@chromium.org>
+[zwisler: updated changelog for 2nd bug fix and upstream]
+Signed-off-by: Ross Zwisler <zwisler@google.com>
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/google/gsmi.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
+index c8f169bf2e27d..62337be07afcb 100644
+--- a/drivers/firmware/google/gsmi.c
++++ b/drivers/firmware/google/gsmi.c
+@@ -480,11 +480,10 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
+ if (count < sizeof(u32))
+ return -EINVAL;
+ param.type = *(u32 *)buf;
+- count -= sizeof(u32);
+ buf += sizeof(u32);
+
+ /* The remaining buffer is the data payload */
+- if (count > gsmi_dev.data_buf->length)
++ if ((count - sizeof(u32)) > gsmi_dev.data_buf->length)
+ return -EINVAL;
+ param.data_len = count - sizeof(u32);
+
+@@ -504,7 +503,7 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
+
+ spin_unlock_irqrestore(&gsmi_dev.lock, flags);
+
+- return rc;
++ return (rc == 0) ? count : rc;
+
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1949eb177e582c2d9dbb51ee4815a4aa86ceddb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:11 -0700
+Subject: hfs: fix BUG on bnode parent update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit ef75bcc5763d130451a99825f247d301088b790b ]
+
+hfs_brec_update_parent() may hit BUG_ON() if the first record of both a
+leaf node and its parent are changed, and if this forces the parent to
+be split. It is not possible for this to happen on a valid hfs
+filesystem because the index nodes have fixed length keys.
+
+For reasons I ignore, the hfs module does have support for a number of
+hfsplus features. A corrupt btree header may report variable length
+keys and trigger this BUG, so it's better to fix it.
+
+Link: http://lkml.kernel.org/r/cf9b02d57f806217a2b1bf5db8c3e39730d8f603.1535682463.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Viacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/brec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index da25c49203cc5..896396554bcc1 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -445,6 +445,7 @@ static int hfs_brec_update_parent(struct hfs_find_data *fd)
+ /* restore search_key */
+ hfs_bnode_read_key(node, fd->search_key, 14);
+ }
++ new_node = NULL;
+ }
+
+ if (!rec && node->parent)
+--
+2.20.1
+
--- /dev/null
+From d42351ab549a212e9cd10b1825c99dc7b2f6ad41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:24 -0700
+Subject: hfs: fix return value of hfs_get_block()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit 1267a07be5ebbff2d2739290f3d043ae137c15b4 ]
+
+Direct writes to empty inodes fail with EIO. The generic direct-io code
+is in part to blame (a patch has been submitted as "direct-io: allow
+direct writes to empty inodes"), but hfs is worse affected than the other
+filesystems because the fallback to buffered I/O doesn't happen.
+
+The problem is the return value of hfs_get_block() when called with
+!create. Change it to be more consistent with the other modules.
+
+Link: http://lkml.kernel.org/r/4538ab8c35ea37338490525f0f24cbc37227528c.1539195310.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/extent.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
+index 0c638c6121526..5f1ff97a3b987 100644
+--- a/fs/hfs/extent.c
++++ b/fs/hfs/extent.c
+@@ -345,7 +345,9 @@ int hfs_get_block(struct inode *inode, sector_t block,
+ ablock = (u32)block / HFS_SB(sb)->fs_div;
+
+ if (block >= HFS_I(inode)->fs_blocks) {
+- if (block > HFS_I(inode)->fs_blocks || !create)
++ if (!create)
++ return 0;
++ if (block > HFS_I(inode)->fs_blocks)
+ return -EIO;
+ if (ablock >= HFS_I(inode)->alloc_blocks) {
+ res = hfs_extend_file(inode);
+--
+2.20.1
+
--- /dev/null
+From b79fd0711d13fa533735e8f103dfd456101454b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:17 -0700
+Subject: hfs: prevent btree data loss on ENOSPC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit 54640c7502e5ed41fbf4eedd499e85f9acc9698f ]
+
+Inserting a new record in a btree may require splitting several of its
+nodes. If we hit ENOSPC halfway through, the new nodes will be left
+orphaned and their records will be lost. This could mean lost inodes or
+extents.
+
+Henceforth, check the available disk space before making any changes.
+This still leaves the potential problem of corruption on ENOMEM.
+
+There is no need to reserve space before deleting a catalog record, as we
+do for hfsplus. This difference is because hfs index nodes have fixed
+length keys.
+
+Link: http://lkml.kernel.org/r/ab5fc8a7d5ffccfd5f27b1cf2cb4ceb6c110da74.1536269131.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/btree.c | 41 +++++++++++++++++++++++++----------------
+ fs/hfs/btree.h | 1 +
+ fs/hfs/catalog.c | 16 ++++++++++++++++
+ fs/hfs/extent.c | 4 ++++
+ 4 files changed, 46 insertions(+), 16 deletions(-)
+
+diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
+index 9bdff5e406261..19017d2961734 100644
+--- a/fs/hfs/btree.c
++++ b/fs/hfs/btree.c
+@@ -220,25 +220,17 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
+ return node;
+ }
+
+-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++/* Make sure @tree has enough space for the @rsvd_nodes */
++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
+ {
+- struct hfs_bnode *node, *next_node;
+- struct page **pagep;
+- u32 nidx, idx;
+- unsigned off;
+- u16 off16;
+- u16 len;
+- u8 *data, byte, m;
+- int i;
+-
+- while (!tree->free_nodes) {
+- struct inode *inode = tree->inode;
+- u32 count;
+- int res;
++ struct inode *inode = tree->inode;
++ u32 count;
++ int res;
+
++ while (tree->free_nodes < rsvd_nodes) {
+ res = hfs_extend_file(inode);
+ if (res)
+- return ERR_PTR(res);
++ return res;
+ HFS_I(inode)->phys_size = inode->i_size =
+ (loff_t)HFS_I(inode)->alloc_blocks *
+ HFS_SB(tree->sb)->alloc_blksz;
+@@ -246,9 +238,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
+ tree->sb->s_blocksize_bits;
+ inode_set_bytes(inode, inode->i_size);
+ count = inode->i_size >> tree->node_size_shift;
+- tree->free_nodes = count - tree->node_count;
++ tree->free_nodes += count - tree->node_count;
+ tree->node_count = count;
+ }
++ return 0;
++}
++
++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++{
++ struct hfs_bnode *node, *next_node;
++ struct page **pagep;
++ u32 nidx, idx;
++ unsigned off;
++ u16 off16;
++ u16 len;
++ u8 *data, byte, m;
++ int i, res;
++
++ res = hfs_bmap_reserve(tree, 1);
++ if (res)
++ return ERR_PTR(res);
+
+ nidx = 0;
+ node = hfs_bnode_find(tree, nidx);
+diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h
+index c8b252dbb26c0..dcc2aab1b2c43 100644
+--- a/fs/hfs/btree.h
++++ b/fs/hfs/btree.h
+@@ -82,6 +82,7 @@ struct hfs_find_data {
+ extern struct hfs_btree *hfs_btree_open(struct super_block *, u32, btree_keycmp);
+ extern void hfs_btree_close(struct hfs_btree *);
+ extern void hfs_btree_write(struct hfs_btree *);
++extern int hfs_bmap_reserve(struct hfs_btree *, int);
+ extern struct hfs_bnode * hfs_bmap_alloc(struct hfs_btree *);
+ extern void hfs_bmap_free(struct hfs_bnode *node);
+
+diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
+index 8a66405b0f8b5..d365bf0b8c77d 100644
+--- a/fs/hfs/catalog.c
++++ b/fs/hfs/catalog.c
+@@ -97,6 +97,14 @@ int hfs_cat_create(u32 cnid, struct inode *dir, const struct qstr *str, struct i
+ if (err)
+ return err;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth);
++ if (err)
++ goto err2;
++
+ hfs_cat_build_key(sb, fd.search_key, cnid, NULL);
+ entry_size = hfs_cat_build_thread(sb, &entry, S_ISDIR(inode->i_mode) ?
+ HFS_CDR_THD : HFS_CDR_FTH,
+@@ -295,6 +303,14 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, const struct qstr *src_name,
+ return err;
+ dst_fd = src_fd;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(src_fd.tree, 2 * src_fd.tree->depth);
++ if (err)
++ goto out;
++
+ /* find the old dir entry and read the data */
+ hfs_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
+ err = hfs_brec_find(&src_fd);
+diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
+index 5d01826545809..0c638c6121526 100644
+--- a/fs/hfs/extent.c
++++ b/fs/hfs/extent.c
+@@ -117,6 +117,10 @@ static int __hfs_ext_write_extent(struct inode *inode, struct hfs_find_data *fd)
+ if (HFS_I(inode)->flags & HFS_FLG_EXT_NEW) {
+ if (res != -ENOENT)
+ return res;
++ /* Fail early and avoid ENOSPC during the btree operation */
++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1);
++ if (res)
++ return res;
+ hfs_brec_insert(fd, HFS_I(inode)->cached_extents, sizeof(hfs_extent_rec));
+ HFS_I(inode)->flags &= ~(HFS_FLG_EXT_DIRTY|HFS_FLG_EXT_NEW);
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 4bd3d938dfbafb2d3a723bec9c2b5f53674a07cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:31 -0700
+Subject: hfs: update timestamp on truncate()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit 8cd3cb5061730af085a3f9890a3352f162b4e20c ]
+
+The vfs takes care of updating mtime on ftruncate(), but on truncate() it
+must be done by the module.
+
+Link: http://lkml.kernel.org/r/e1611eda2985b672ed2d8677350b4ad8c2d07e8a.1539316825.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfs/inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
+index 2538b49cc349e..350afd67bd69e 100644
+--- a/fs/hfs/inode.c
++++ b/fs/hfs/inode.c
+@@ -642,6 +642,8 @@ int hfs_inode_setattr(struct dentry *dentry, struct iattr * attr)
+
+ truncate_setsize(inode, attr->ia_size);
+ hfs_file_truncate(inode);
++ inode->i_atime = inode->i_mtime = inode->i_ctime =
++ current_time(inode);
+ }
+
+ setattr_copy(inode, attr);
+--
+2.20.1
+
--- /dev/null
+From 0dbb7dc83f6e11b2f0f616f97c874e1092967cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:04 -0700
+Subject: hfsplus: fix BUG on bnode parent update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit 19a9d0f1acf75e8be8cfba19c1a34e941846fa2b ]
+
+Creating, renaming or deleting a file may hit BUG_ON() if the first
+record of both a leaf node and its parent are changed, and if this
+forces the parent to be split. This bug is triggered by xfstests
+generic/027, somewhat rarely; here is a more reliable reproducer:
+
+ truncate -s 50M fs.iso
+ mkfs.hfsplus fs.iso
+ mount fs.iso /mnt
+ i=1000
+ while [ $i -le 2400 ]; do
+ touch /mnt/$i &>/dev/null
+ ((++i))
+ done
+ i=2400
+ while [ $i -ge 1000 ]; do
+ mv /mnt/$i /mnt/$(perl -e "print $i x61") &>/dev/null
+ ((--i))
+ done
+
+The issue is that a newly created bnode is being put twice. Reset
+new_node to NULL in hfs_brec_update_parent() before reaching goto again.
+
+Link: http://lkml.kernel.org/r/5ee1db09b60373a15890f6a7c835d00e76bf601d.1535682461.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/brec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index d3f36982f6858..0f53a486d2c18 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -448,6 +448,7 @@ static int hfs_brec_update_parent(struct hfs_find_data *fd)
+ /* restore search_key */
+ hfs_bnode_read_key(node, fd->search_key, 14);
+ }
++ new_node = NULL;
+ }
+
+ if (!rec && node->parent)
+--
+2.20.1
+
--- /dev/null
+From 3d80c3a441cde16173a865bb7197b3a81e32bae3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:21 -0700
+Subject: hfsplus: fix return value of hfsplus_get_block()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit 839c3a6a5e1fbc8542d581911b35b2cb5cd29304 ]
+
+Direct writes to empty inodes fail with EIO. The generic direct-io code
+is in part to blame (a patch has been submitted as "direct-io: allow
+direct writes to empty inodes"), but hfsplus is worse affected than the
+other filesystems because the fallback to buffered I/O doesn't happen.
+
+The problem is the return value of hfsplus_get_block() when called with
+!create. Change it to be more consistent with the other modules.
+
+Link: http://lkml.kernel.org/r/2cd1301404ec7cf1e39c8f11a01a4302f1460ad6.1539195310.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/extents.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index 284d7fb73e863..58f296bfd4380 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -237,7 +237,9 @@ int hfsplus_get_block(struct inode *inode, sector_t iblock,
+ ablock = iblock >> sbi->fs_shift;
+
+ if (iblock >= hip->fs_blocks) {
+- if (iblock > hip->fs_blocks || !create)
++ if (!create)
++ return 0;
++ if (iblock > hip->fs_blocks)
+ return -EIO;
+ if (ablock >= hip->alloc_blocks) {
+ res = hfsplus_file_extend(inode, false);
+--
+2.20.1
+
--- /dev/null
+From b03c3be88bb6de8f976d828fc643df5f78b22b9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:14 -0700
+Subject: hfsplus: prevent btree data loss on ENOSPC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit d92915c35bfaf763d78bf1d5ac7f183420e3bd99 ]
+
+Inserting or deleting a record in a btree may require splitting several of
+its nodes. If we hit ENOSPC halfway through, the new nodes will be left
+orphaned and their records will be lost. This could mean lost inodes,
+extents or xattrs.
+
+Henceforth, check the available disk space before making any changes.
+This still leaves the potential problem of corruption on ENOMEM.
+
+The patch can be tested with xfstests generic/027.
+
+Link: http://lkml.kernel.org/r/4596eef22fbda137b4ffa0272d92f0da15364421.1536269129.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/attributes.c | 10 ++++++++++
+ fs/hfsplus/btree.c | 44 ++++++++++++++++++++++++++---------------
+ fs/hfsplus/catalog.c | 24 ++++++++++++++++++++++
+ fs/hfsplus/extents.c | 4 ++++
+ fs/hfsplus/hfsplus_fs.h | 2 ++
+ 5 files changed, 68 insertions(+), 16 deletions(-)
+
+diff --git a/fs/hfsplus/attributes.c b/fs/hfsplus/attributes.c
+index 2bab6b3cdba48..e6d554476db41 100644
+--- a/fs/hfsplus/attributes.c
++++ b/fs/hfsplus/attributes.c
+@@ -217,6 +217,11 @@ int hfsplus_create_attr(struct inode *inode,
+ if (err)
+ goto failed_init_create_attr;
+
++ /* Fail early and avoid ENOSPC during the btree operation */
++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth + 1);
++ if (err)
++ goto failed_create_attr;
++
+ if (name) {
+ err = hfsplus_attr_build_key(sb, fd.search_key,
+ inode->i_ino, name);
+@@ -313,6 +318,11 @@ int hfsplus_delete_attr(struct inode *inode, const char *name)
+ if (err)
+ return err;
+
++ /* Fail early and avoid ENOSPC during the btree operation */
++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth);
++ if (err)
++ goto out;
++
+ if (name) {
+ err = hfsplus_attr_build_key(sb, fd.search_key,
+ inode->i_ino, name);
+diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
+index 3de3bc4918b55..66774f4cb4fd5 100644
+--- a/fs/hfsplus/btree.c
++++ b/fs/hfsplus/btree.c
+@@ -342,26 +342,21 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
+ return node;
+ }
+
+-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++/* Make sure @tree has enough space for the @rsvd_nodes */
++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
+ {
+- struct hfs_bnode *node, *next_node;
+- struct page **pagep;
+- u32 nidx, idx;
+- unsigned off;
+- u16 off16;
+- u16 len;
+- u8 *data, byte, m;
+- int i;
++ struct inode *inode = tree->inode;
++ struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
++ u32 count;
++ int res;
+
+- while (!tree->free_nodes) {
+- struct inode *inode = tree->inode;
+- struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
+- u32 count;
+- int res;
++ if (rsvd_nodes <= 0)
++ return 0;
+
++ while (tree->free_nodes < rsvd_nodes) {
+ res = hfsplus_file_extend(inode, hfs_bnode_need_zeroout(tree));
+ if (res)
+- return ERR_PTR(res);
++ return res;
+ hip->phys_size = inode->i_size =
+ (loff_t)hip->alloc_blocks <<
+ HFSPLUS_SB(tree->sb)->alloc_blksz_shift;
+@@ -369,9 +364,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
+ hip->alloc_blocks << HFSPLUS_SB(tree->sb)->fs_shift;
+ inode_set_bytes(inode, inode->i_size);
+ count = inode->i_size >> tree->node_size_shift;
+- tree->free_nodes = count - tree->node_count;
++ tree->free_nodes += count - tree->node_count;
+ tree->node_count = count;
+ }
++ return 0;
++}
++
++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
++{
++ struct hfs_bnode *node, *next_node;
++ struct page **pagep;
++ u32 nidx, idx;
++ unsigned off;
++ u16 off16;
++ u16 len;
++ u8 *data, byte, m;
++ int i, res;
++
++ res = hfs_bmap_reserve(tree, 1);
++ if (res)
++ return ERR_PTR(res);
+
+ nidx = 0;
+ node = hfs_bnode_find(tree, nidx);
+diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
+index a196369ba779f..35472cba750e1 100644
+--- a/fs/hfsplus/catalog.c
++++ b/fs/hfsplus/catalog.c
+@@ -265,6 +265,14 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
+ if (err)
+ return err;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth);
++ if (err)
++ goto err2;
++
+ hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
+ entry_size = hfsplus_fill_cat_thread(sb, &entry,
+ S_ISDIR(inode->i_mode) ?
+@@ -333,6 +341,14 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
+ if (err)
+ return err;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most once.
++ */
++ err = hfs_bmap_reserve(fd.tree, 2 * (int)fd.tree->depth - 2);
++ if (err)
++ goto out;
++
+ if (!str) {
+ int len;
+
+@@ -433,6 +449,14 @@ int hfsplus_rename_cat(u32 cnid,
+ return err;
+ dst_fd = src_fd;
+
++ /*
++ * Fail early and avoid ENOSPC during the btree operations. We may
++ * have to split the root node at most twice.
++ */
++ err = hfs_bmap_reserve(src_fd.tree, 4 * (int)src_fd.tree->depth - 1);
++ if (err)
++ goto out;
++
+ /* find the old dir entry and read the data */
+ err = hfsplus_cat_build_key(sb, src_fd.search_key,
+ src_dir->i_ino, src_name);
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index e8770935ce6d8..284d7fb73e863 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -100,6 +100,10 @@ static int __hfsplus_ext_write_extent(struct inode *inode,
+ if (hip->extent_state & HFSPLUS_EXT_NEW) {
+ if (res != -ENOENT)
+ return res;
++ /* Fail early and avoid ENOSPC during the btree operation */
++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1);
++ if (res)
++ return res;
+ hfs_brec_insert(fd, hip->cached_extents,
+ sizeof(hfsplus_extent_rec));
+ hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW);
+diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
+index a015044daa053..dbb55d823385e 100644
+--- a/fs/hfsplus/hfsplus_fs.h
++++ b/fs/hfsplus/hfsplus_fs.h
+@@ -312,6 +312,7 @@ static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
+ #define hfs_btree_open hfsplus_btree_open
+ #define hfs_btree_close hfsplus_btree_close
+ #define hfs_btree_write hfsplus_btree_write
++#define hfs_bmap_reserve hfsplus_bmap_reserve
+ #define hfs_bmap_alloc hfsplus_bmap_alloc
+ #define hfs_bmap_free hfsplus_bmap_free
+ #define hfs_bnode_read hfsplus_bnode_read
+@@ -396,6 +397,7 @@ u32 hfsplus_calc_btree_clump_size(u32 block_size, u32 node_size, u64 sectors,
+ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id);
+ void hfs_btree_close(struct hfs_btree *tree);
+ int hfs_btree_write(struct hfs_btree *tree);
++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes);
+ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree);
+ void hfs_bmap_free(struct hfs_bnode *node);
+
+--
+2.20.1
+
--- /dev/null
+From 17ef6e540b6a476d1f87dd081f1a032d7e7c0fb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:06:27 -0700
+Subject: hfsplus: update timestamps on truncate()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+
+[ Upstream commit dc8844aada735890a6de109bef327f5df36a982e ]
+
+The vfs takes care of updating ctime and mtime on ftruncate(), but on
+truncate() it must be done by the module.
+
+This patch can be tested with xfstests generic/313.
+
+Link: http://lkml.kernel.org/r/9beb0913eea37288599e8e1b7cec8768fb52d1b8.1539316825.git.ernesto.mnd.fernandez@gmail.com
+Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
+Reviewed-by: Vyacheslav Dubeyko <slava@dubeyko.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
+index 190c60efbc998..5b31f4730ee9c 100644
+--- a/fs/hfsplus/inode.c
++++ b/fs/hfsplus/inode.c
+@@ -262,6 +262,7 @@ static int hfsplus_setattr(struct dentry *dentry, struct iattr *attr)
+ }
+ truncate_setsize(inode, attr->ia_size);
+ hfsplus_file_truncate(inode);
++ inode->i_mtime = inode->i_ctime = current_time(inode);
+ }
+
+ setattr_copy(inode, attr);
+--
+2.20.1
+
--- /dev/null
+From b30b46094f485cb16be40dd8ecfd0304bc1cffb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 12:01:48 +0900
+Subject: i2c: uniphier-f: fix occasional timeout error
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 39226aaa85f002d695e3cafade3309e12ffdaecd ]
+
+Currently, a timeout error could happen at a repeated START condition.
+
+For a (non-repeated) START condition, the controller starts sending
+data when the UNIPHIER_FI2C_CR_STA bit is set. However, for a repeated
+START condition, the hardware starts running when the slave address is
+written to the TX FIFO - the write to the UNIPHIER_FI2C_CR register is
+actually unneeded.
+
+Because the hardware is already running before the IRQ is enabled for
+a repeated START, the driver may miss the IRQ event. In most cases,
+this problem does not show up since modern CPUs are much faster than
+the I2C transfer. However, it is still possible that a context switch
+happens after the controller starts, but before the IRQ register is
+set up.
+
+To fix this,
+
+ - Do not write UNIPHIER_FI2C_CR for repeated START conditions.
+
+ - Enable IRQ *before* writing the slave address to the TX FIFO.
+
+ - Disable IRQ for the current CPU while queuing up the TX FIFO;
+ If the CPU is interrupted by some task, the interrupt handler
+ might be invoked due to the empty TX FIFO before completing the
+ setup.
+
+Fixes: 6a62974b667f ("i2c: uniphier_f: add UniPhier FIFO-builtin I2C driver")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-uniphier-f.c | 33 ++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index b9a0690b4fd73..bbd5b137aa216 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -260,6 +260,8 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ static void uniphier_fi2c_tx_init(struct uniphier_fi2c_priv *priv, u16 addr)
+ {
+ priv->enabled_irqs |= UNIPHIER_FI2C_INT_TE;
++ uniphier_fi2c_set_irqs(priv);
++
+ /* do not use TX byte counter */
+ writel(0, priv->membase + UNIPHIER_FI2C_TBC);
+ /* set slave address */
+@@ -292,6 +294,8 @@ static void uniphier_fi2c_rx_init(struct uniphier_fi2c_priv *priv, u16 addr)
+ priv->enabled_irqs |= UNIPHIER_FI2C_INT_RF;
+ }
+
++ uniphier_fi2c_set_irqs(priv);
++
+ /* set slave address with RD bit */
+ writel(UNIPHIER_FI2C_DTTX_CMD | UNIPHIER_FI2C_DTTX_RD | addr << 1,
+ priv->membase + UNIPHIER_FI2C_DTTX);
+@@ -315,14 +319,16 @@ static void uniphier_fi2c_recover(struct uniphier_fi2c_priv *priv)
+ }
+
+ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+- struct i2c_msg *msg, bool stop)
++ struct i2c_msg *msg, bool repeat,
++ bool stop)
+ {
+ struct uniphier_fi2c_priv *priv = i2c_get_adapdata(adap);
+ bool is_read = msg->flags & I2C_M_RD;
+ unsigned long time_left, flags;
+
+- dev_dbg(&adap->dev, "%s: addr=0x%02x, len=%d, stop=%d\n",
+- is_read ? "receive" : "transmit", msg->addr, msg->len, stop);
++ dev_dbg(&adap->dev, "%s: addr=0x%02x, len=%d, repeat=%d, stop=%d\n",
++ is_read ? "receive" : "transmit", msg->addr, msg->len,
++ repeat, stop);
+
+ priv->len = msg->len;
+ priv->buf = msg->buf;
+@@ -338,16 +344,24 @@ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+ writel(UNIPHIER_FI2C_RST_TBRST | UNIPHIER_FI2C_RST_RBRST,
+ priv->membase + UNIPHIER_FI2C_RST); /* reset TX/RX FIFO */
+
++ spin_lock_irqsave(&priv->lock, flags);
++
+ if (is_read)
+ uniphier_fi2c_rx_init(priv, msg->addr);
+ else
+ uniphier_fi2c_tx_init(priv, msg->addr);
+
+- uniphier_fi2c_set_irqs(priv);
+-
+ dev_dbg(&adap->dev, "start condition\n");
+- writel(UNIPHIER_FI2C_CR_MST | UNIPHIER_FI2C_CR_STA,
+- priv->membase + UNIPHIER_FI2C_CR);
++ /*
++ * For a repeated START condition, writing a slave address to the FIFO
++ * kicks the controller. So, the UNIPHIER_FI2C_CR register should be
++ * written only for a non-repeated START condition.
++ */
++ if (!repeat)
++ writel(UNIPHIER_FI2C_CR_MST | UNIPHIER_FI2C_CR_STA,
++ priv->membase + UNIPHIER_FI2C_CR);
++
++ spin_unlock_irqrestore(&priv->lock, flags);
+
+ time_left = wait_for_completion_timeout(&priv->comp, adap->timeout);
+
+@@ -408,6 +422,7 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
+ struct i2c_msg *msgs, int num)
+ {
+ struct i2c_msg *msg, *emsg = msgs + num;
++ bool repeat = false;
+ int ret;
+
+ ret = uniphier_fi2c_check_bus_busy(adap);
+@@ -418,9 +433,11 @@ static int uniphier_fi2c_master_xfer(struct i2c_adapter *adap,
+ /* Emit STOP if it is the last message or I2C_M_STOP is set. */
+ bool stop = (msg + 1 == emsg) || (msg->flags & I2C_M_STOP);
+
+- ret = uniphier_fi2c_master_xfer_one(adap, msg, stop);
++ ret = uniphier_fi2c_master_xfer_one(adap, msg, repeat, stop);
+ if (ret)
+ return ret;
++
++ repeat = !stop;
+ }
+
+ return num;
+--
+2.20.1
+
--- /dev/null
+From 01aeb5d39ffa7e48817c823cacf6bf7df48aebf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 12:01:49 +0900
+Subject: i2c: uniphier-f: fix race condition when IRQ is cleared
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit eaba68785c2d24ebf1f0d46c24e11b79cc2f94c7 ]
+
+The current IRQ handler clears all the IRQ status bits when it bails
+out. This is dangerous because it might clear away the status bits
+that have just been set while processing the current handler. If this
+happens, the IRQ event for the latest transfer is lost forever.
+
+The IRQ status bits must be cleared *before* the next transfer is
+kicked.
+
+Fixes: 6a62974b667f ("i2c: uniphier_f: add UniPhier FIFO-builtin I2C driver")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-uniphier-f.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index bbd5b137aa216..928ea9930d17e 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -143,9 +143,10 @@ static void uniphier_fi2c_set_irqs(struct uniphier_fi2c_priv *priv)
+ writel(priv->enabled_irqs, priv->membase + UNIPHIER_FI2C_IE);
+ }
+
+-static void uniphier_fi2c_clear_irqs(struct uniphier_fi2c_priv *priv)
++static void uniphier_fi2c_clear_irqs(struct uniphier_fi2c_priv *priv,
++ u32 mask)
+ {
+- writel(-1, priv->membase + UNIPHIER_FI2C_IC);
++ writel(mask, priv->membase + UNIPHIER_FI2C_IC);
+ }
+
+ static void uniphier_fi2c_stop(struct uniphier_fi2c_priv *priv)
+@@ -172,6 +173,8 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ "interrupt: enabled_irqs=%04x, irq_status=%04x\n",
+ priv->enabled_irqs, irq_status);
+
++ uniphier_fi2c_clear_irqs(priv, irq_status);
++
+ if (irq_status & UNIPHIER_FI2C_INT_STOP)
+ goto complete;
+
+@@ -250,8 +253,6 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ }
+
+ handled:
+- uniphier_fi2c_clear_irqs(priv);
+-
+ spin_unlock(&priv->lock);
+
+ return IRQ_HANDLED;
+@@ -340,7 +341,7 @@ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+ priv->flags |= UNIPHIER_FI2C_STOP;
+
+ reinit_completion(&priv->comp);
+- uniphier_fi2c_clear_irqs(priv);
++ uniphier_fi2c_clear_irqs(priv, U32_MAX);
+ writel(UNIPHIER_FI2C_RST_TBRST | UNIPHIER_FI2C_RST_RBRST,
+ priv->membase + UNIPHIER_FI2C_RST); /* reset TX/RX FIFO */
+
+--
+2.20.1
+
--- /dev/null
+From c8e57d3cf1ab1b39ecfa73f84eb712fe0921f02b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 12:55:25 +0900
+Subject: i2c: uniphier-f: fix timeout error after reading 8 bytes
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit c2a653deaa81f5a750c0dfcbaf9f8e5195cbe4a5 ]
+
+I was totally screwed up in commit eaba68785c2d ("i2c: uniphier-f:
+fix race condition when IRQ is cleared"). Since that commit, if the
+number of read bytes is multiple of the FIFO size (8, 16, 24... bytes),
+the STOP condition could be issued twice, depending on the timing.
+If this happens, the controller will go wrong, resulting in the timeout
+error.
+
+It was more than 3 years ago when I wrote this driver, so my memory
+about this hardware was vague. Please let me correct the description
+in the commit log of eaba68785c2d.
+
+Clearing the IRQ status on exiting the IRQ handler is absolutely
+fine. This controller makes a pause while any IRQ status is asserted.
+If the IRQ status is cleared first, the hardware may start the next
+transaction before the IRQ handler finishes what it supposed to do.
+
+This partially reverts the bad commit with clear comments so that I
+will never repeat this mistake.
+
+I also investigated what is happening at the last moment of the read
+mode. The UNIPHIER_FI2C_INT_RF interrupt is asserted a bit earlier
+(by half a period of the clock cycle) than UNIPHIER_FI2C_INT_RB.
+
+I consulted a hardware engineer, and I got the following information:
+
+UNIPHIER_FI2C_INT_RF
+ asserted at the falling edge of SCL at the 8th bit.
+
+UNIPHIER_FI2C_INT_RB
+ asserted at the rising edge of SCL at the 9th (ACK) bit.
+
+In order to avoid calling uniphier_fi2c_stop() twice, check the latter
+interrupt. I also commented this because it is obscure hardware internal.
+
+Fixes: eaba68785c2d ("i2c: uniphier-f: fix race condition when IRQ is cleared")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-uniphier-f.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index 928ea9930d17e..dd0687e36a47b 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -173,8 +173,6 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ "interrupt: enabled_irqs=%04x, irq_status=%04x\n",
+ priv->enabled_irqs, irq_status);
+
+- uniphier_fi2c_clear_irqs(priv, irq_status);
+-
+ if (irq_status & UNIPHIER_FI2C_INT_STOP)
+ goto complete;
+
+@@ -214,7 +212,13 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+
+ if (irq_status & (UNIPHIER_FI2C_INT_RF | UNIPHIER_FI2C_INT_RB)) {
+ uniphier_fi2c_drain_rxfifo(priv);
+- if (!priv->len)
++ /*
++ * If the number of bytes to read is multiple of the FIFO size
++ * (msg->len == 8, 16, 24, ...), the INT_RF bit is set a little
++ * earlier than INT_RB. We wait for INT_RB to confirm the
++ * completion of the current message.
++ */
++ if (!priv->len && (irq_status & UNIPHIER_FI2C_INT_RB))
+ goto data_done;
+
+ if (unlikely(priv->flags & UNIPHIER_FI2C_MANUAL_NACK)) {
+@@ -253,6 +257,13 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ }
+
+ handled:
++ /*
++ * This controller makes a pause while any bit of the IRQ status is
++ * asserted. Clear the asserted bit to kick the controller just before
++ * exiting the handler.
++ */
++ uniphier_fi2c_clear_irqs(priv, irq_status);
++
+ spin_unlock(&priv->lock);
+
+ return IRQ_HANDLED;
+--
+2.20.1
+
--- /dev/null
+From 2ade8992c5590120b612741f54dd4e2fde6205ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 12:01:47 +0900
+Subject: i2c: uniphier-f: make driver robust against concurrency
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit f1fdcbbdf45d9609f3d4063b67e9ea941ba3a58f ]
+
+This is unlikely to happen, but it is possible for a CPU to enter
+the interrupt handler just after wait_for_completion_timeout() has
+expired. If this happens, the hardware is accessed from multiple
+contexts concurrently.
+
+Disable the IRQ after wait_for_completion_timeout(), and do nothing
+from the handler when the IRQ is disabled.
+
+Fixes: 6a62974b667f ("i2c: uniphier_f: add UniPhier FIFO-builtin I2C driver")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-uniphier-f.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c
+index bc26ec822e268..b9a0690b4fd73 100644
+--- a/drivers/i2c/busses/i2c-uniphier-f.c
++++ b/drivers/i2c/busses/i2c-uniphier-f.c
+@@ -98,6 +98,7 @@ struct uniphier_fi2c_priv {
+ unsigned int flags;
+ unsigned int busy_cnt;
+ unsigned int clk_cycle;
++ spinlock_t lock; /* IRQ synchronization */
+ };
+
+ static void uniphier_fi2c_fill_txfifo(struct uniphier_fi2c_priv *priv,
+@@ -162,7 +163,10 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ struct uniphier_fi2c_priv *priv = dev_id;
+ u32 irq_status;
+
++ spin_lock(&priv->lock);
++
+ irq_status = readl(priv->membase + UNIPHIER_FI2C_INT);
++ irq_status &= priv->enabled_irqs;
+
+ dev_dbg(&priv->adap.dev,
+ "interrupt: enabled_irqs=%04x, irq_status=%04x\n",
+@@ -230,6 +234,8 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ goto handled;
+ }
+
++ spin_unlock(&priv->lock);
++
+ return IRQ_NONE;
+
+ data_done:
+@@ -246,6 +252,8 @@ static irqreturn_t uniphier_fi2c_interrupt(int irq, void *dev_id)
+ handled:
+ uniphier_fi2c_clear_irqs(priv);
+
++ spin_unlock(&priv->lock);
++
+ return IRQ_HANDLED;
+ }
+
+@@ -311,7 +319,7 @@ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+ {
+ struct uniphier_fi2c_priv *priv = i2c_get_adapdata(adap);
+ bool is_read = msg->flags & I2C_M_RD;
+- unsigned long time_left;
++ unsigned long time_left, flags;
+
+ dev_dbg(&adap->dev, "%s: addr=0x%02x, len=%d, stop=%d\n",
+ is_read ? "receive" : "transmit", msg->addr, msg->len, stop);
+@@ -342,6 +350,12 @@ static int uniphier_fi2c_master_xfer_one(struct i2c_adapter *adap,
+ priv->membase + UNIPHIER_FI2C_CR);
+
+ time_left = wait_for_completion_timeout(&priv->comp, adap->timeout);
++
++ spin_lock_irqsave(&priv->lock, flags);
++ priv->enabled_irqs = 0;
++ uniphier_fi2c_set_irqs(priv);
++ spin_unlock_irqrestore(&priv->lock, flags);
++
+ if (!time_left) {
+ dev_err(&adap->dev, "transaction timeout.\n");
+ uniphier_fi2c_recover(priv);
+@@ -546,6 +560,7 @@ static int uniphier_fi2c_probe(struct platform_device *pdev)
+
+ priv->clk_cycle = clk_rate / bus_speed;
+ init_completion(&priv->comp);
++ spin_lock_init(&priv->lock);
+ priv->adap.owner = THIS_MODULE;
+ priv->adap.algo = &uniphier_fi2c_algo;
+ priv->adap.dev.parent = dev;
+--
+2.20.1
+
--- /dev/null
+From e2bd89d433cc3563bc8c865218fbfbea61cee81d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 13:13:39 +0200
+Subject: igb: shorten maximum PHC timecounter update interval
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit 094bf4d0e9657f6ea1ee3d7e07ce3970796949ce ]
+
+The timecounter needs to be updated at least once per ~550 seconds in
+order to avoid a 40-bit SYSTIM timestamp to be misinterpreted as an old
+timestamp.
+
+Since commit 500462a9d ("timers: Switch to a non-cascading wheel"),
+scheduling of delayed work seems to be less accurate and a requested
+delay of 540 seconds may actually be longer than 550 seconds. Shorten
+the delay to 480 seconds to be sure the timecounter is updated in time.
+
+This fixes an issue with HW timestamps on 82580/I350/I354 being off by
+~1100 seconds for few seconds every ~9 minutes.
+
+Cc: Jacob Keller <jacob.e.keller@intel.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_ptp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
+index 0746b19ec6d37..295d27f331042 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
+@@ -65,9 +65,15 @@
+ *
+ * The 40 bit 82580 SYSTIM overflows every
+ * 2^40 * 10^-9 / 60 = 18.3 minutes.
++ *
++ * SYSTIM is converted to real time using a timecounter. As
++ * timecounter_cyc2time() allows old timestamps, the timecounter
++ * needs to be updated at least once per half of the SYSTIM interval.
++ * Scheduling of delayed work is not very accurate, so we aim for 8
++ * minutes to be sure the actual interval is shorter than 9.16 minutes.
+ */
+
+-#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 9)
++#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 8)
+ #define IGB_PTP_TX_TIMEOUT (HZ * 15)
+ #define INCPERIOD_82576 BIT(E1000_TIMINCA_16NS_SHIFT)
+ #define INCVALUE_82576_MASK GENMASK(E1000_TIMINCA_16NS_SHIFT - 1, 0)
+--
+2.20.1
+
--- /dev/null
+From b2b14f53f499c08922014a0d8319f5c5409c5648 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 15:27:38 -0800
+Subject: ipv6: Fix handling of LLA with VRF and sockets bound to VRF
+
+From: David Ahern <dsahern@gmail.com>
+
+[ Upstream commit c2027d1e17582903e368abf5d4838b22a98f2b7b ]
+
+A recent commit allows sockets bound to a VRF to receive ipv6 link local
+packets. However, it only works for UDP and worse TCP connection attempts
+to the LLA with the only listener bound to the VRF just hang where as
+before the client gets a reset and connection refused. Fix by adjusting
+ir_iif for LL addresses and packets received through a device enslaved
+to a VRF.
+
+Fixes: 6f12fa775530 ("vrf: mark skb for multicast or link-local as enslaved to VRF")
+Reported-by: Donald Sharp <sharpd@cumulusnetworks.com>
+Cc: Mike Manning <mmanning@vyatta.att-mail.com>
+Signed-off-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/tcp_ipv6.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 7b4ce3f9e2f4e..5ec73cf386dfe 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -718,6 +718,7 @@ static void tcp_v6_init_req(struct request_sock *req,
+ const struct sock *sk_listener,
+ struct sk_buff *skb)
+ {
++ bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags);
+ struct inet_request_sock *ireq = inet_rsk(req);
+ const struct ipv6_pinfo *np = inet6_sk(sk_listener);
+
+@@ -725,7 +726,7 @@ static void tcp_v6_init_req(struct request_sock *req,
+ ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr;
+
+ /* So that link locals have meaning */
+- if (!sk_listener->sk_bound_dev_if &&
++ if ((!sk_listener->sk_bound_dev_if || l3_slave) &&
+ ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
+ ireq->ir_iif = tcp_v6_iif(skb);
+
+--
+2.20.1
+
--- /dev/null
+From fd8522e34a3b8187688e9fd3292c93ffce5fdc3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Oct 2018 16:59:51 -0400
+Subject: kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on
+ bad stack
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit c2712b858187f5bcd7b042fe4daa3ba3a12635c0 ]
+
+Andy had some concerns about using regs_get_kernel_stack_nth() in a new
+function regs_get_kernel_argument() as if there's any error in the stack
+code, it could cause a bad memory access. To be on the safe side, call
+probe_kernel_read() on the stack address to be extra careful in accessing
+the memory. A helper function, regs_get_kernel_stack_nth_addr(), was added
+to just return the stack address (or NULL if not on the stack), that will be
+used to find the address (and could be used by other functions) and read the
+address with kernel_probe_read().
+
+Requested-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20181017165951.09119177@gandalf.local.home
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/ptrace.h | 42 +++++++++++++++++++++++++++++------
+ 1 file changed, 35 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
+index 14131dd06b290..8603d127f73c7 100644
+--- a/arch/x86/include/asm/ptrace.h
++++ b/arch/x86/include/asm/ptrace.h
+@@ -231,24 +231,52 @@ static inline int regs_within_kernel_stack(struct pt_regs *regs,
+ (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1)));
+ }
+
++/**
++ * regs_get_kernel_stack_nth_addr() - get the address of the Nth entry on stack
++ * @regs: pt_regs which contains kernel stack pointer.
++ * @n: stack entry number.
++ *
++ * regs_get_kernel_stack_nth() returns the address of the @n th entry of the
++ * kernel stack which is specified by @regs. If the @n th entry is NOT in
++ * the kernel stack, this returns NULL.
++ */
++static inline unsigned long *regs_get_kernel_stack_nth_addr(struct pt_regs *regs, unsigned int n)
++{
++ unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
++
++ addr += n;
++ if (regs_within_kernel_stack(regs, (unsigned long)addr))
++ return addr;
++ else
++ return NULL;
++}
++
++/* To avoid include hell, we can't include uaccess.h */
++extern long probe_kernel_read(void *dst, const void *src, size_t size);
++
+ /**
+ * regs_get_kernel_stack_nth() - get Nth entry of the stack
+ * @regs: pt_regs which contains kernel stack pointer.
+ * @n: stack entry number.
+ *
+ * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which
+- * is specified by @regs. If the @n th entry is NOT in the kernel stack,
++ * is specified by @regs. If the @n th entry is NOT in the kernel stack
+ * this returns 0.
+ */
+ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
+ unsigned int n)
+ {
+- unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
+- addr += n;
+- if (regs_within_kernel_stack(regs, (unsigned long)addr))
+- return *addr;
+- else
+- return 0;
++ unsigned long *addr;
++ unsigned long val;
++ long ret;
++
++ addr = regs_get_kernel_stack_nth_addr(regs, n);
++ if (addr) {
++ ret = probe_kernel_read(&val, addr, sizeof(val));
++ if (!ret)
++ return val;
++ }
++ return 0;
+ }
+
+ #define arch_has_single_step() (1)
+--
+2.20.1
+
--- /dev/null
+From 91a03245b6b108a87aea58a64a29ac61d3e4b21e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 09:23:42 -0700
+Subject: KVM: nVMX: reset cache/shadows when switching loaded VMCS
+
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+
+[ Upstream commit b7031fd40fcc741b0f9b0c04c8d844e445858b84 ]
+
+Reset the vm_{entry,exit}_controls_shadow variables as well as the
+segment cache after loading a new VMCS in vmx_switch_vmcs(). The
+shadows/cache track VMCS data, i.e. they're stale every time we
+switch to a new VMCS regardless of reason.
+
+This fixes a bug where stale control shadows would be consumed after
+a nested VMExit due to a failed consistency check.
+
+Suggested-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index ab6384efc7916..1c4e5eb8be835 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -10000,6 +10000,10 @@ static void vmx_switch_vmcs(struct kvm_vcpu *vcpu, struct loaded_vmcs *vmcs)
+ vmx_vcpu_load(vcpu, cpu);
+ vcpu->cpu = cpu;
+ put_cpu();
++
++ vm_entry_controls_reset_shadow(vmx);
++ vm_exit_controls_reset_shadow(vmx);
++ vmx_segment_cache_clear(vmx);
+ }
+
+ /*
+@@ -11428,7 +11432,6 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
+ vmx->nested.vmcs01_debugctl = vmcs_read64(GUEST_IA32_DEBUGCTL);
+
+ vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
+- vmx_segment_cache_clear(vmx);
+
+ if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual)) {
+ leave_guest_mode(vcpu);
+@@ -12172,9 +12175,6 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+ }
+
+ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+- vm_entry_controls_reset_shadow(vmx);
+- vm_exit_controls_reset_shadow(vmx);
+- vmx_segment_cache_clear(vmx);
+
+ /* Update any VMCS fields that might have changed while L2 ran */
+ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr);
+--
+2.20.1
+
--- /dev/null
+From 39e76c5c7dc94a85524a7e047e5bbcb96da8ef88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Oct 2018 19:40:43 +0200
+Subject: KVM/x86: Fix invvpid and invept register operand size in 64-bit mode
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit 5ebb272b2ea7e02911a03a893f8d922d49f9bb4a ]
+
+Register operand size of invvpid and invept instruction in 64-bit mode
+has always 64 bits. Adjust inline function argument type to reflect
+correct size.
+
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 1c4e5eb8be835..f67fc0f359ff3 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1602,7 +1602,7 @@ static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
+ return -1;
+ }
+
+-static inline void __invvpid(int ext, u16 vpid, gva_t gva)
++static inline void __invvpid(unsigned long ext, u16 vpid, gva_t gva)
+ {
+ struct {
+ u64 vpid : 16;
+@@ -1616,7 +1616,7 @@ static inline void __invvpid(int ext, u16 vpid, gva_t gva)
+ : : "a"(&operand), "c"(ext) : "cc", "memory");
+ }
+
+-static inline void __invept(int ext, u64 eptp, gpa_t gpa)
++static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa)
+ {
+ struct {
+ u64 eptp, gpa;
+--
+2.20.1
+
--- /dev/null
+From feec886fa4c483729d274aaa8c3aea6560f8f1c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:05:07 -0700
+Subject: linux/bitmap.h: fix type of nbits in bitmap_shift_right()
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit d9873969fa8725dc6a5a21ab788c057fd8719751 ]
+
+Most other bitmap API, including the OOL version __bitmap_shift_right,
+take unsigned nbits. This was accidentally left out from 2fbad29917c98.
+
+Link: http://lkml.kernel.org/r/20180818131623.8755-5-linux@rasmusvillemoes.dk
+Fixes: 2fbad29917c98 ("lib: bitmap: change bitmap_shift_right to take unsigned parameters")
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Reported-by: Yury Norov <ynorov@caviumnetworks.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bitmap.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
+index 1990b88bd0ab2..aec255fb62aad 100644
+--- a/include/linux/bitmap.h
++++ b/include/linux/bitmap.h
+@@ -355,7 +355,7 @@ static __always_inline void bitmap_clear(unsigned long *map, unsigned int start,
+ }
+
+ static inline void bitmap_shift_right(unsigned long *dst, const unsigned long *src,
+- unsigned int shift, int nbits)
++ unsigned int shift, unsigned int nbits)
+ {
+ if (small_const_nbits(nbits))
+ *dst = (*src & BITMAP_LAST_WORD_MASK(nbits)) >> shift;
+--
+2.20.1
+
--- /dev/null
+From 98871dcc579a9bb1573b4f67fc6dcaeb881fad1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:04:59 -0700
+Subject: linux/bitmap.h: handle constant zero-size bitmaps correctly
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 7275b097851a5e2e0dd4da039c7e96b59ac5314e ]
+
+The static inlines in bitmap.h do not handle a compile-time constant
+nbits==0 correctly (they dereference the passed src or dst pointers,
+despite only 0 words being valid to access). I had the 0-day buildbot
+chew on a patch [1] that would cause build failures for such cases without
+complaining, suggesting that we don't have any such users currently, at
+least for the 70 .config/arch combinations that was built. Should any
+turn up, make sure they use the out-of-line versions, which do handle
+nbits==0 correctly.
+
+This is of course not the most efficient, but it's much less churn than
+teaching all the static inlines an "if (zero_const_nbits())", and since we
+don't have any current instances, this doesn't affect existing code at
+all.
+
+[1] lkml.kernel.org/r/20180815085539.27485-1-linux@rasmusvillemoes.dk
+
+Link: http://lkml.kernel.org/r/20180818131623.8755-3-linux@rasmusvillemoes.dk
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Yury Norov <ynorov@caviumnetworks.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bitmap.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
+index 835c2271196a4..1990b88bd0ab2 100644
+--- a/include/linux/bitmap.h
++++ b/include/linux/bitmap.h
+@@ -185,8 +185,13 @@ extern int bitmap_print_to_pagebuf(bool list, char *buf,
+ #define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
+ #define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1)))
+
++/*
++ * The static inlines below do not handle constant nbits==0 correctly,
++ * so make such users (should any ever turn up) call the out-of-line
++ * versions.
++ */
+ #define small_const_nbits(nbits) \
+- (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG)
++ (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG && (nbits) > 0)
+
+ static inline void bitmap_zero(unsigned long *dst, unsigned int nbits)
+ {
+--
+2.20.1
+
--- /dev/null
+From 177fb2dc84f36e1973f934947267b586d711b605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 14:44:25 +0200
+Subject: m68k: fix command-line parsing when passed from u-boot
+
+From: Angelo Dureghello <angelo@sysam.it>
+
+[ Upstream commit 381fdd62c38344a771aed06adaf14aae65c47454 ]
+
+This patch fixes command_line array zero-terminated
+one byte over the end of the array, causing boot to hang.
+
+Signed-off-by: Angelo Dureghello <angelo@sysam.it>
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/uboot.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/m68k/kernel/uboot.c b/arch/m68k/kernel/uboot.c
+index b29c3b241e1bb..1070828770645 100644
+--- a/arch/m68k/kernel/uboot.c
++++ b/arch/m68k/kernel/uboot.c
+@@ -102,5 +102,5 @@ __init void process_uboot_commandline(char *commandp, int size)
+ }
+
+ parse_uboot_commandline(commandp, len);
+- commandp[size - 1] = 0;
++ commandp[len - 1] = 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 70bb575e3118b60f92bed4018bb9d22d6f259f75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Oct 2018 11:18:49 +1100
+Subject: macintosh/windfarm_smu_sat: Fix debug output
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit fc0c8b36d379a046525eacb9c3323ca635283757 ]
+
+There's some antiquated debug output that's trying
+to do a hand-made hexdump and turning into horrible
+1-byte-per-line output these days.
+
+Use print_hex_dump() instead
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/windfarm_smu_sat.c | 25 +++++++------------------
+ 1 file changed, 7 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index da7f4fc1a51d1..a0f61eb853c55 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -22,14 +22,6 @@
+
+ #define VERSION "1.0"
+
+-#define DEBUG
+-
+-#ifdef DEBUG
+-#define DBG(args...) printk(args)
+-#else
+-#define DBG(args...) do { } while(0)
+-#endif
+-
+ /* If the cache is older than 800ms we'll refetch it */
+ #define MAX_AGE msecs_to_jiffies(800)
+
+@@ -106,13 +98,10 @@ struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
+ buf[i+2] = data[3];
+ buf[i+3] = data[2];
+ }
+-#ifdef DEBUG
+- DBG(KERN_DEBUG "sat %d partition %x:", sat_id, id);
+- for (i = 0; i < len; ++i)
+- DBG(" %x", buf[i]);
+- DBG("\n");
+-#endif
+
++ printk(KERN_DEBUG "sat %d partition %x:", sat_id, id);
++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET,
++ 16, 1, buf, len, false);
+ if (size)
+ *size = len;
+ return (struct smu_sdbp_header *) buf;
+@@ -132,13 +121,13 @@ static int wf_sat_read_cache(struct wf_sat *sat)
+ if (err < 0)
+ return err;
+ sat->last_read = jiffies;
++
+ #ifdef LOTSA_DEBUG
+ {
+ int i;
+- DBG(KERN_DEBUG "wf_sat_get: data is");
+- for (i = 0; i < 16; ++i)
+- DBG(" %.2x", sat->cache[i]);
+- DBG("\n");
++ printk(KERN_DEBUG "wf_sat_get: data is");
++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET,
++ 16, 1, sat->cache, 16, false);
+ }
+ #endif
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 0841a7607564fe2082484d5b0be10879e4a430f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Oct 2018 09:33:10 +0100
+Subject: macsec: let the administrator set UP state even if lowerdev is down
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit 07bddef9839378bd6f95b393cf24c420529b4ef1 ]
+
+Currently, the kernel doesn't let the administrator set a macsec device
+up unless its lower device is currently up. This is inconsistent, as a
+macsec device that is up won't automatically go down when its lower
+device goes down.
+
+Now that linkstate propagation works, there's really no reason for this
+limitation, so let's remove it.
+
+Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
+Reported-by: Radu Rendec <radu.rendec@gmail.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macsec.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 40e8f11f20cbf..9bb65e0af7dd7 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2798,9 +2798,6 @@ static int macsec_dev_open(struct net_device *dev)
+ struct net_device *real_dev = macsec->real_dev;
+ int err;
+
+- if (!(real_dev->flags & IFF_UP))
+- return -ENETDOWN;
+-
+ err = dev_uc_add(real_dev, dev->dev_addr);
+ if (err < 0)
+ return err;
+--
+2.20.1
+
--- /dev/null
+From e42566dba96a8e44afb702c99b5a4f486edb9cf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Oct 2018 09:33:09 +0100
+Subject: macsec: update operstate when lower device changes
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit e6ac075882b2afcdf2d5ab328ce4ab42a1eb9593 ]
+
+Like all other virtual devices (macvlan, vlan), the operstate of a
+macsec device should match the state of its lower device. This is done
+by calling netif_stacked_transfer_operstate from its netdevice notifier.
+
+We also need to call netif_stacked_transfer_operstate when a new macsec
+device is created, so that its operstate is set properly. This is only
+relevant when we try to bring the device up directly when we create it.
+
+Radu Rendec proposed a similar patch, inspired from the 802.1q driver,
+that included changing the administrative state of the macsec device,
+instead of just the operstate. This version is similar to what the
+macvlan driver does, and updates only the operstate.
+
+Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver")
+Reported-by: Radu Rendec <radu.rendec@gmail.com>
+Reported-by: Patrick Talbert <ptalbert@redhat.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macsec.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 9bcb7c3e879f3..40e8f11f20cbf 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3273,6 +3273,9 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ if (err < 0)
+ goto del_dev;
+
++ netif_stacked_transfer_operstate(real_dev, dev);
++ linkwatch_fire_event(dev);
++
+ macsec_generation++;
+
+ return 0;
+@@ -3444,6 +3447,20 @@ static int macsec_notify(struct notifier_block *this, unsigned long event,
+ return NOTIFY_DONE;
+
+ switch (event) {
++ case NETDEV_DOWN:
++ case NETDEV_UP:
++ case NETDEV_CHANGE: {
++ struct macsec_dev *m, *n;
++ struct macsec_rxh_data *rxd;
++
++ rxd = macsec_data_rtnl(real_dev);
++ list_for_each_entry_safe(m, n, &rxd->secys, secys) {
++ struct net_device *dev = m->secy.netdev;
++
++ netif_stacked_transfer_operstate(real_dev, dev);
++ }
++ break;
++ }
+ case NETDEV_UNREGISTER: {
+ struct macsec_dev *m, *n;
+ struct macsec_rxh_data *rxd;
+--
+2.20.1
+
--- /dev/null
+From b0e69239a1799efb71e5bf653a6de9229e8d8b9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Aug 2018 19:52:44 +0530
+Subject: mfd: arizona: Correct calling of runtime_put_sync
+
+From: Sapthagiri Baratam <sapthagiri.baratam@cirrus.com>
+
+[ Upstream commit 6b269a41a4520f7eb639e61a45ebbb9c9267d5e0 ]
+
+Don't call runtime_put_sync when clk32k_ref is ARIZONA_32KZ_MCLK2
+as there is no corresponding runtime_get_sync call.
+
+MCLK1 is not in the AoD power domain so if it is used as 32kHz clock
+source we need to hold a runtime PM reference to keep the device from
+going into low power mode.
+
+Fixes: cdd8da8cc66b ("mfd: arizona: Add gating of external MCLKn clocks")
+Signed-off-by: Sapthagiri Baratam <sapthagiri.baratam@cirrus.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/arizona-core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index d8e3184bd27ca..ad8a5296c50ba 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -52,8 +52,10 @@ int arizona_clk32k_enable(struct arizona *arizona)
+ if (ret != 0)
+ goto err_ref;
+ ret = clk_prepare_enable(arizona->mclk[ARIZONA_MCLK1]);
+- if (ret != 0)
+- goto err_pm;
++ if (ret != 0) {
++ pm_runtime_put_sync(arizona->dev);
++ goto err_ref;
++ }
+ break;
+ case ARIZONA_32KZ_MCLK2:
+ ret = clk_prepare_enable(arizona->mclk[ARIZONA_MCLK2]);
+@@ -67,8 +69,6 @@ int arizona_clk32k_enable(struct arizona *arizona)
+ ARIZONA_CLK_32K_ENA);
+ }
+
+-err_pm:
+- pm_runtime_put_sync(arizona->dev);
+ err_ref:
+ if (ret != 0)
+ arizona->clk32k_ref--;
+--
+2.20.1
+
--- /dev/null
+From 63b8ccbc24dff9811235ab081a2d3feaf1c29e03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 19:52:52 +0300
+Subject: mfd: intel_soc_pmic_bxtwc: Chain power button IRQs as well
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 9f8ddee1dab836ca758ca8fc555ab5a3aaa5d3fd ]
+
+Power button IRQ actually has a second level of interrupts to
+distinguish between UI and POWER buttons. Moreover, current
+implementation looks awkward in approach to handle second level IRQs by
+first level related IRQ chip.
+
+To address above issues, split power button IRQ to be chained as well.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel_soc_pmic_bxtwc.c | 41 ++++++++++++++++++++++--------
+ include/linux/mfd/intel_soc_pmic.h | 1 +
+ 2 files changed, 32 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mfd/intel_soc_pmic_bxtwc.c b/drivers/mfd/intel_soc_pmic_bxtwc.c
+index 15bc052704a6d..9ca1f8c015de9 100644
+--- a/drivers/mfd/intel_soc_pmic_bxtwc.c
++++ b/drivers/mfd/intel_soc_pmic_bxtwc.c
+@@ -31,8 +31,8 @@
+
+ /* Interrupt Status Registers */
+ #define BXTWC_IRQLVL1 0x4E02
+-#define BXTWC_PWRBTNIRQ 0x4E03
+
++#define BXTWC_PWRBTNIRQ 0x4E03
+ #define BXTWC_THRM0IRQ 0x4E04
+ #define BXTWC_THRM1IRQ 0x4E05
+ #define BXTWC_THRM2IRQ 0x4E06
+@@ -47,10 +47,9 @@
+
+ /* Interrupt MASK Registers */
+ #define BXTWC_MIRQLVL1 0x4E0E
+-#define BXTWC_MPWRTNIRQ 0x4E0F
+-
+ #define BXTWC_MIRQLVL1_MCHGR BIT(5)
+
++#define BXTWC_MPWRBTNIRQ 0x4E0F
+ #define BXTWC_MTHRM0IRQ 0x4E12
+ #define BXTWC_MTHRM1IRQ 0x4E13
+ #define BXTWC_MTHRM2IRQ 0x4E14
+@@ -66,9 +65,7 @@
+ /* Whiskey Cove PMIC share same ACPI ID between different platforms */
+ #define BROXTON_PMIC_WC_HRV 4
+
+-/* Manage in two IRQ chips since mask registers are not consecutive */
+ enum bxtwc_irqs {
+- /* Level 1 */
+ BXTWC_PWRBTN_LVL1_IRQ = 0,
+ BXTWC_TMU_LVL1_IRQ,
+ BXTWC_THRM_LVL1_IRQ,
+@@ -77,9 +74,11 @@ enum bxtwc_irqs {
+ BXTWC_CHGR_LVL1_IRQ,
+ BXTWC_GPIO_LVL1_IRQ,
+ BXTWC_CRIT_LVL1_IRQ,
++};
+
+- /* Level 2 */
+- BXTWC_PWRBTN_IRQ,
++enum bxtwc_irqs_pwrbtn {
++ BXTWC_PWRBTN_IRQ = 0,
++ BXTWC_UIBTN_IRQ,
+ };
+
+ enum bxtwc_irqs_bcu {
+@@ -113,7 +112,10 @@ static const struct regmap_irq bxtwc_regmap_irqs[] = {
+ REGMAP_IRQ_REG(BXTWC_CHGR_LVL1_IRQ, 0, BIT(5)),
+ REGMAP_IRQ_REG(BXTWC_GPIO_LVL1_IRQ, 0, BIT(6)),
+ REGMAP_IRQ_REG(BXTWC_CRIT_LVL1_IRQ, 0, BIT(7)),
+- REGMAP_IRQ_REG(BXTWC_PWRBTN_IRQ, 1, 0x03),
++};
++
++static const struct regmap_irq bxtwc_regmap_irqs_pwrbtn[] = {
++ REGMAP_IRQ_REG(BXTWC_PWRBTN_IRQ, 0, 0x01),
+ };
+
+ static const struct regmap_irq bxtwc_regmap_irqs_bcu[] = {
+@@ -125,7 +127,7 @@ static const struct regmap_irq bxtwc_regmap_irqs_adc[] = {
+ };
+
+ static const struct regmap_irq bxtwc_regmap_irqs_chgr[] = {
+- REGMAP_IRQ_REG(BXTWC_USBC_IRQ, 0, BIT(5)),
++ REGMAP_IRQ_REG(BXTWC_USBC_IRQ, 0, 0x20),
+ REGMAP_IRQ_REG(BXTWC_CHGR0_IRQ, 0, 0x1f),
+ REGMAP_IRQ_REG(BXTWC_CHGR1_IRQ, 1, 0x1f),
+ };
+@@ -144,7 +146,16 @@ static struct regmap_irq_chip bxtwc_regmap_irq_chip = {
+ .mask_base = BXTWC_MIRQLVL1,
+ .irqs = bxtwc_regmap_irqs,
+ .num_irqs = ARRAY_SIZE(bxtwc_regmap_irqs),
+- .num_regs = 2,
++ .num_regs = 1,
++};
++
++static struct regmap_irq_chip bxtwc_regmap_irq_chip_pwrbtn = {
++ .name = "bxtwc_irq_chip_pwrbtn",
++ .status_base = BXTWC_PWRBTNIRQ,
++ .mask_base = BXTWC_MPWRBTNIRQ,
++ .irqs = bxtwc_regmap_irqs_pwrbtn,
++ .num_irqs = ARRAY_SIZE(bxtwc_regmap_irqs_pwrbtn),
++ .num_regs = 1,
+ };
+
+ static struct regmap_irq_chip bxtwc_regmap_irq_chip_tmu = {
+@@ -472,6 +483,16 @@ static int bxtwc_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
++ BXTWC_PWRBTN_LVL1_IRQ,
++ IRQF_ONESHOT,
++ &bxtwc_regmap_irq_chip_pwrbtn,
++ &pmic->irq_chip_data_pwrbtn);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to add PWRBTN IRQ chip\n");
++ return ret;
++ }
++
+ ret = bxtwc_add_chained_irq_chip(pmic, pmic->irq_chip_data,
+ BXTWC_TMU_LVL1_IRQ,
+ IRQF_ONESHOT,
+diff --git a/include/linux/mfd/intel_soc_pmic.h b/include/linux/mfd/intel_soc_pmic.h
+index 5aacdb017a9f6..806a4f095312b 100644
+--- a/include/linux/mfd/intel_soc_pmic.h
++++ b/include/linux/mfd/intel_soc_pmic.h
+@@ -25,6 +25,7 @@ struct intel_soc_pmic {
+ int irq;
+ struct regmap *regmap;
+ struct regmap_irq_chip_data *irq_chip_data;
++ struct regmap_irq_chip_data *irq_chip_data_pwrbtn;
+ struct regmap_irq_chip_data *irq_chip_data_tmu;
+ struct regmap_irq_chip_data *irq_chip_data_bcu;
+ struct regmap_irq_chip_data *irq_chip_data_adc;
+--
+2.20.1
+
--- /dev/null
+From 9974dc589c4a1f7b5e1e0baedd424cc6632e7961 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Sep 2018 13:54:07 +0200
+Subject: mfd: max8997: Enale irq-wakeup unconditionally
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit efddff27c886e729a7f84a7205bd84d7d4af7336 ]
+
+IRQ wake up support for MAX8997 driver was initially configured by
+respective property in pdata. However, after the driver conversion to
+device-tree, setting it was left as 'todo'. Nowadays most of other PMIC MFD
+drivers initialized from device-tree assume that they can be an irq wakeup
+source, so enable it also for MAX8997. This fixes support for wakeup from
+MAX8997 RTC alarm.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/max8997.c | 8 +-------
+ include/linux/mfd/max8997.h | 1 -
+ 2 files changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
+index 2d6e2c3927862..4a2fc59d59016 100644
+--- a/drivers/mfd/max8997.c
++++ b/drivers/mfd/max8997.c
+@@ -155,12 +155,6 @@ static struct max8997_platform_data *max8997_i2c_parse_dt_pdata(
+
+ pd->ono = irq_of_parse_and_map(dev->of_node, 1);
+
+- /*
+- * ToDo: the 'wakeup' member in the platform data is more of a linux
+- * specfic information. Hence, there is no binding for that yet and
+- * not parsed here.
+- */
+-
+ return pd;
+ }
+
+@@ -248,7 +242,7 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
+ */
+
+ /* MAX8997 has a power button input. */
+- device_init_wakeup(max8997->dev, pdata->wakeup);
++ device_init_wakeup(max8997->dev, true);
+
+ return ret;
+
+diff --git a/include/linux/mfd/max8997.h b/include/linux/mfd/max8997.h
+index cf815577bd686..3ae1fe743bc34 100644
+--- a/include/linux/mfd/max8997.h
++++ b/include/linux/mfd/max8997.h
+@@ -178,7 +178,6 @@ struct max8997_led_platform_data {
+ struct max8997_platform_data {
+ /* IRQ */
+ int ono;
+- int wakeup;
+
+ /* ---- PMIC ---- */
+ struct max8997_regulator_data *regulators;
+--
+2.20.1
+
--- /dev/null
+From 5b586aa36c104160e27cd7749364a3f64b43ea8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 17:02:40 -0300
+Subject: mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+[ Upstream commit 55143439b7b501882bea9d95a54adfe00ffc79a3 ]
+
+When trying to read any MC13892 ADC channel on a imx51-babbage board:
+
+The MC13892 PMIC shutdowns completely.
+
+After debugging this issue and comparing the MC13892 and MC13783
+initializations done in the vendor kernel, it was noticed that the
+CHRGRAWDIV bit of the ADC0 register was not being set.
+
+This bit is set by default after power on, but the driver was
+clearing it.
+
+After setting this bit it is possible to read the ADC values correctly.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Tested-by: Chris Healy <cphealy@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/mc13xxx-core.c | 3 ++-
+ include/linux/mfd/mc13xxx.h | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index 6c16f170529f5..75d52034f89da 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -278,7 +278,8 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+ if (ret)
+ goto out;
+
+- adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
++ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2 |
++ MC13XXX_ADC0_CHRGRAWDIV;
+ adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
+
+ if (channel > 7)
+diff --git a/include/linux/mfd/mc13xxx.h b/include/linux/mfd/mc13xxx.h
+index 638222e43e489..93011c61aafd2 100644
+--- a/include/linux/mfd/mc13xxx.h
++++ b/include/linux/mfd/mc13xxx.h
+@@ -247,6 +247,7 @@ struct mc13xxx_platform_data {
+ #define MC13XXX_ADC0_TSMOD0 (1 << 12)
+ #define MC13XXX_ADC0_TSMOD1 (1 << 13)
+ #define MC13XXX_ADC0_TSMOD2 (1 << 14)
++#define MC13XXX_ADC0_CHRGRAWDIV (1 << 15)
+ #define MC13XXX_ADC0_ADINC1 (1 << 16)
+ #define MC13XXX_ADC0_ADINC2 (1 << 17)
+
+--
+2.20.1
+
--- /dev/null
+From b2a3e4048399a843a47e85540869b4feb5fed883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 18:38:28 -0500
+Subject: misc: mic: fix a DMA pool free failure
+
+From: Wenwen Wang <wang6495@umn.edu>
+
+[ Upstream commit 6b995f4eec34745f6cb20d66d5277611f0b3c3fa ]
+
+In _scif_prog_signal(), the boolean variable 'x100' is used to indicate
+whether the MIC Coprocessor is X100. If 'x100' is true, the status
+descriptor will be used to write the value to the destination. Otherwise, a
+DMA pool will be allocated for this purpose. Specifically, if the DMA pool
+is allocated successfully, two memory addresses will be returned. One is
+for the CPU and the other is for the device to access the DMA pool. The
+former is stored to the variable 'status' and the latter is stored to the
+variable 'src'. After the allocation, the address in 'src' is saved to
+'status->src_dma_addr', which is actually in the DMA pool, and 'src' is
+then modified.
+
+Later on, if an error occurs, the execution flow will transfer to the label
+'dma_fail', which will check 'x100' and free up the allocated DMA pool if
+'x100' is false. The point here is that 'status->src_dma_addr' is used for
+freeing up the DMA pool. As mentioned before, 'status->src_dma_addr' is in
+the DMA pool. And thus, the device is able to modify this data. This can
+potentially cause failures when freeing up the DMA pool because of the
+modified device address.
+
+This patch avoids the above issue by using the variable 'src' (with
+necessary calculation) to free up the DMA pool.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mic/scif/scif_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c
+index cac3bcc308a7e..7bb929f05d852 100644
+--- a/drivers/misc/mic/scif/scif_fence.c
++++ b/drivers/misc/mic/scif/scif_fence.c
+@@ -272,7 +272,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
+ dma_fail:
+ if (!x100)
+ dma_pool_free(ep->remote_dev->signal_pool, status,
+- status->src_dma_addr);
++ src - offsetof(struct scif_status, val));
+ alloc_fail:
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From d9ca2473f3c4d5f3c633e498da5920134523356c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 11:00:30 -0700
+Subject: mISDN: Fix type of switch control variable in ctrl_teimanager
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit aeb5e02aca91522733eb1db595ac607d30c87767 ]
+
+Clang warns (trimmed for brevity):
+
+drivers/isdn/mISDN/tei.c:1193:7: warning: overflow converting case value
+to switch condition type (2147764552 to 18446744071562348872) [-Wswitch]
+ case IMHOLD_L1:
+ ^
+drivers/isdn/mISDN/tei.c:1187:7: warning: overflow converting case value
+to switch condition type (2147764550 to 18446744071562348870) [-Wswitch]
+ case IMCLEAR_L2:
+ ^
+2 warnings generated.
+
+The root cause is that the _IOC macro can generate really large numbers,
+which don't find into type int. My research into how GCC and Clang are
+handling this at a low level didn't prove fruitful and surveying the
+kernel tree shows that aside from here and a few places in the scsi
+subsystem, everything that uses _IOC is at least of type 'unsigned int'.
+Make that change here because as nothing in this function cares about
+the signedness of the variable and it removes ambiguity, which is never
+good when dealing with compilers.
+
+While we're here, remove the unnecessary local variable ret (just return
+-EINVAL and 0 directly).
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/67
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/mISDN/tei.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
+index 12d9e5f4beb1f..58635b5f296f0 100644
+--- a/drivers/isdn/mISDN/tei.c
++++ b/drivers/isdn/mISDN/tei.c
+@@ -1180,8 +1180,7 @@ static int
+ ctrl_teimanager(struct manager *mgr, void *arg)
+ {
+ /* currently we only have one option */
+- int *val = (int *)arg;
+- int ret = 0;
++ unsigned int *val = (unsigned int *)arg;
+
+ switch (val[0]) {
+ case IMCLEAR_L2:
+@@ -1197,9 +1196,9 @@ ctrl_teimanager(struct manager *mgr, void *arg)
+ test_and_clear_bit(OPTION_L1_HOLD, &mgr->options);
+ break;
+ default:
+- ret = -EINVAL;
++ return -EINVAL;
+ }
+- return ret;
++ return 0;
+ }
+
+ /* This function does create a L2 for fixed TEI in NT Mode */
+--
+2.20.1
+
--- /dev/null
+From b2f5ce8c2b486a3602827e89e49cf05af858cb30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 12:07:17 +0800
+Subject: mm/memory_hotplug: Do not unlock when fails to take the
+ device_hotplug_lock
+
+From: zhong jiang <zhongjiang@huawei.com>
+
+[ Upstream commit d2ab99403ee00d8014e651728a4702ea1ae5e52c ]
+
+When adding the memory by probing memory block in sysfs interface, there is an
+obvious issue that we will unlock the device_hotplug_lock when fails to takes it.
+
+That issue was introduced in Commit 8df1d0e4a265
+("mm/memory_hotplug: make add_memory() take the device_hotplug_lock")
+
+We should drop out in time when fails to take the device_hotplug_lock.
+
+Fixes: 8df1d0e4a265 ("mm/memory_hotplug: make add_memory() take the device_hotplug_lock")
+Reported-by: Yang yingliang <yangyingliang@huawei.com>
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 8e5818e735e2f..fe1557aa9b103 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -519,7 +519,7 @@ memory_probe_store(struct device *dev, struct device_attribute *attr,
+
+ ret = lock_device_hotplug_sysfs();
+ if (ret)
+- goto out;
++ return ret;
+
+ nid = memory_add_physaddr_to_nid(phys_addr);
+ ret = __add_memory(nid, phys_addr,
+--
+2.20.1
+
--- /dev/null
+From 96212017247ca60dafee9fc037874fce73e329f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:10:24 -0700
+Subject: mm/memory_hotplug: make add_memory() take the device_hotplug_lock
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit 8df1d0e4a265f25dc1e7e7624ccdbcb4a6630c89 ]
+
+add_memory() currently does not take the device_hotplug_lock, however
+is aleady called under the lock from
+ arch/powerpc/platforms/pseries/hotplug-memory.c
+ drivers/acpi/acpi_memhotplug.c
+to synchronize against CPU hot-remove and similar.
+
+In general, we should hold the device_hotplug_lock when adding memory to
+synchronize against online/offline request (e.g. from user space) - which
+already resulted in lock inversions due to device_lock() and
+mem_hotplug_lock - see 30467e0b3be ("mm, hotplug: fix concurrent memory
+hot-add deadlock"). add_memory()/add_memory_resource() will create memory
+block devices, so this really feels like the right thing to do.
+
+Holding the device_hotplug_lock makes sure that a memory block device
+can really only be accessed (e.g. via .online/.state) from user space,
+once the memory has been fully added to the system.
+
+The lock is not held yet in
+ drivers/xen/balloon.c
+ arch/powerpc/platforms/powernv/memtrace.c
+ drivers/s390/char/sclp_cmd.c
+ drivers/hv/hv_balloon.c
+So, let's either use the locked variants or take the lock.
+
+Don't export add_memory_resource(), as it once was exported to be used by
+XEN, which is never built as a module. If somebody requires it, we also
+have to export a locked variant (as device_hotplug_lock is never
+exported).
+
+Link: http://lkml.kernel.org/r/20180925091457.28651-3-david@redhat.com
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Pavel Tatashin <pavel.tatashin@microsoft.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Cc: John Allen <jallen@linux.vnet.ibm.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mathieu Malaterre <malat@debian.org>
+Cc: Pavel Tatashin <pavel.tatashin@microsoft.com>
+Cc: YASUAKI ISHIMATSU <yasu.isimatu@gmail.com>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Kate Stewart <kstewart@linuxfoundation.org>
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Michael Neuling <mikey@neuling.org>
+Cc: Philippe Ombredanne <pombredanne@nexb.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platforms/pseries/hotplug-memory.c | 2 +-
+ drivers/acpi/acpi_memhotplug.c | 2 +-
+ drivers/base/memory.c | 9 ++++++--
+ drivers/xen/balloon.c | 3 +++
+ include/linux/memory_hotplug.h | 1 +
+ mm/memory_hotplug.c | 22 ++++++++++++++++---
+ 6 files changed, 32 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 93e09f108ca17..99a3cf51c5ba4 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -787,7 +787,7 @@ static int dlpar_add_lmb(struct of_drconf_cell *lmb)
+ nid = memory_add_physaddr_to_nid(lmb->base_addr);
+
+ /* Add the memory */
+- rc = add_memory(nid, lmb->base_addr, block_sz);
++ rc = __add_memory(nid, lmb->base_addr, block_sz);
+ if (rc) {
+ dlpar_remove_device_tree_lmb(lmb);
+ return rc;
+diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
+index 6b0d3ef7309cb..2ccfbb61ca899 100644
+--- a/drivers/acpi/acpi_memhotplug.c
++++ b/drivers/acpi/acpi_memhotplug.c
+@@ -228,7 +228,7 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
+ if (node < 0)
+ node = memory_add_physaddr_to_nid(info->start_addr);
+
+- result = add_memory(node, info->start_addr, info->length);
++ result = __add_memory(node, info->start_addr, info->length);
+
+ /*
+ * If the memory block has been used by the kernel, add_memory()
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index c617e00f4361d..8e5818e735e2f 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -517,15 +517,20 @@ memory_probe_store(struct device *dev, struct device_attribute *attr,
+ if (phys_addr & ((pages_per_block << PAGE_SHIFT) - 1))
+ return -EINVAL;
+
++ ret = lock_device_hotplug_sysfs();
++ if (ret)
++ goto out;
++
+ nid = memory_add_physaddr_to_nid(phys_addr);
+- ret = add_memory(nid, phys_addr,
+- MIN_MEMORY_BLOCK_SIZE * sections_per_block);
++ ret = __add_memory(nid, phys_addr,
++ MIN_MEMORY_BLOCK_SIZE * sections_per_block);
+
+ if (ret)
+ goto out;
+
+ ret = count;
+ out:
++ unlock_device_hotplug();
+ return ret;
+ }
+
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 7d521babc020b..71a6deeb4e714 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -356,7 +356,10 @@ static enum bp_state reserve_additional_memory(void)
+ * callers drop the mutex before trying again.
+ */
+ mutex_unlock(&balloon_mutex);
++ /* add_memory_resource() requires the device_hotplug lock */
++ lock_device_hotplug();
+ rc = add_memory_resource(nid, resource, memhp_auto_online);
++ unlock_device_hotplug();
+ mutex_lock(&balloon_mutex);
+
+ if (rc) {
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 58e110aee7ab4..d36a029353915 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -316,6 +316,7 @@ static inline void remove_memory(int nid, u64 start, u64 size) {}
+
+ extern int walk_memory_range(unsigned long start_pfn, unsigned long end_pfn,
+ void *arg, int (*func)(struct memory_block *, void *));
++extern int __add_memory(int nid, u64 start, u64 size);
+ extern int add_memory(int nid, u64 start, u64 size);
+ extern int add_memory_resource(int nid, struct resource *resource, bool online);
+ extern int arch_add_memory(int nid, u64 start, u64 size, bool want_memblock);
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index d4affa9982cac..e368a4e0c7cbc 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1073,7 +1073,12 @@ static int online_memory_block(struct memory_block *mem, void *arg)
+ return device_online(&mem->dev);
+ }
+
+-/* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
++/*
++ * NOTE: The caller must call lock_device_hotplug() to serialize hotplug
++ * and online/offline operations (triggered e.g. by sysfs).
++ *
++ * we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG
++ */
+ int __ref add_memory_resource(int nid, struct resource *res, bool online)
+ {
+ u64 start, size;
+@@ -1166,9 +1171,9 @@ int __ref add_memory_resource(int nid, struct resource *res, bool online)
+ mem_hotplug_done();
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(add_memory_resource);
+
+-int __ref add_memory(int nid, u64 start, u64 size)
++/* requires device_hotplug_lock, see add_memory_resource() */
++int __ref __add_memory(int nid, u64 start, u64 size)
+ {
+ struct resource *res;
+ int ret;
+@@ -1182,6 +1187,17 @@ int __ref add_memory(int nid, u64 start, u64 size)
+ release_memory_resource(res);
+ return ret;
+ }
++
++int add_memory(int nid, u64 start, u64 size)
++{
++ int rc;
++
++ lock_device_hotplug();
++ rc = __add_memory(nid, start, size);
++ unlock_device_hotplug();
++
++ return rc;
++}
+ EXPORT_SYMBOL_GPL(add_memory);
+
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+--
+2.20.1
+
--- /dev/null
+From 10bb0ecf8fcc2ffd70ba7bc3d9e18a2e04ecf08b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 15:09:45 -0700
+Subject: mm/page-writeback.c: fix range_cyclic writeback vs writepages
+ deadlock
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 64081362e8ff4587b4554087f3cfc73d3e0a4cd7 ]
+
+We've recently seen a workload on XFS filesystems with a repeatable
+deadlock between background writeback and a multi-process application
+doing concurrent writes and fsyncs to a small range of a file.
+
+range_cyclic
+writeback Process 1 Process 2
+
+xfs_vm_writepages
+ write_cache_pages
+ writeback_index = 2
+ cycled = 0
+ ....
+ find page 2 dirty
+ lock Page 2
+ ->writepage
+ page 2 writeback
+ page 2 clean
+ page 2 added to bio
+ no more pages
+ write()
+ locks page 1
+ dirties page 1
+ locks page 2
+ dirties page 1
+ fsync()
+ ....
+ xfs_vm_writepages
+ write_cache_pages
+ start index 0
+ find page 1 towrite
+ lock Page 1
+ ->writepage
+ page 1 writeback
+ page 1 clean
+ page 1 added to bio
+ find page 2 towrite
+ lock Page 2
+ page 2 is writeback
+ <blocks>
+ write()
+ locks page 1
+ dirties page 1
+ fsync()
+ ....
+ xfs_vm_writepages
+ write_cache_pages
+ start index 0
+
+ !done && !cycled
+ sets index to 0, restarts lookup
+ find page 1 dirty
+ find page 1 towrite
+ lock Page 1
+ page 1 is writeback
+ <blocks>
+
+ lock Page 1
+ <blocks>
+
+DEADLOCK because:
+
+ - process 1 needs page 2 writeback to complete to make
+ enough progress to issue IO pending for page 1
+ - writeback needs page 1 writeback to complete so process 2
+ can progress and unlock the page it is blocked on, then it
+ can issue the IO pending for page 2
+ - process 2 can't make progress until process 1 issues IO
+ for page 1
+
+The underlying cause of the problem here is that range_cyclic writeback is
+processing pages in descending index order as we hold higher index pages
+in a structure controlled from above write_cache_pages(). The
+write_cache_pages() caller needs to be able to submit these pages for IO
+before write_cache_pages restarts writeback at mapping index 0 to avoid
+wcp inverting the page lock/writeback wait order.
+
+generic_writepages() is not susceptible to this bug as it has no private
+context held across write_cache_pages() - filesystems using this
+infrastructure always submit pages in ->writepage immediately and so there
+is no problem with range_cyclic going back to mapping index 0.
+
+However:
+ mpage_writepages() has a private bio context,
+ exofs_writepages() has page_collect
+ fuse_writepages() has fuse_fill_wb_data
+ nfs_writepages() has nfs_pageio_descriptor
+ xfs_vm_writepages() has xfs_writepage_ctx
+
+All of these ->writepages implementations can hold pages under writeback
+in their private structures until write_cache_pages() returns, and hence
+they are all susceptible to this deadlock.
+
+Also worth noting is that ext4 has it's own bastardised version of
+write_cache_pages() and so it /may/ have an equivalent deadlock. I looked
+at the code long enough to understand that it has a similar retry loop for
+range_cyclic writeback reaching the end of the file and then promptly ran
+away before my eyes bled too much. I'll leave it for the ext4 developers
+to determine if their code is actually has this deadlock and how to fix it
+if it has.
+
+There's a few ways I can see avoid this deadlock. There's probably more,
+but these are the first I've though of:
+
+1. get rid of range_cyclic altogether
+
+2. range_cyclic always stops at EOF, and we start again from
+writeback index 0 on the next call into write_cache_pages()
+
+2a. wcp also returns EAGAIN to ->writepages implementations to
+indicate range cyclic has hit EOF. writepages implementations can
+then flush the current context and call wpc again to continue. i.e.
+lift the retry into the ->writepages implementation
+
+3. range_cyclic uses trylock_page() rather than lock_page(), and it
+skips pages it can't lock without blocking. It will already do this
+for pages under writeback, so this seems like a no-brainer
+
+3a. all non-WB_SYNC_ALL writeback uses trylock_page() to avoid
+blocking as per pages under writeback.
+
+I don't think #1 is an option - range_cyclic prevents frequently
+dirtied lower file offset from starving background writeback of
+rarely touched higher file offsets.
+
+#2 is simple, and I don't think it will have any impact on
+performance as going back to the start of the file implies an
+immediate seek. We'll have exactly the same number of seeks if we
+switch writeback to another inode, and then come back to this one
+later and restart from index 0.
+
+#2a is pretty much "status quo without the deadlock". Moving the
+retry loop up into the wcp caller means we can issue IO on the
+pending pages before calling wcp again, and so avoid locking or
+waiting on pages in the wrong order. I'm not convinced we need to do
+this given that we get the same thing from #2 on the next writeback
+call from the writeback infrastructure.
+
+#3 is really just a band-aid - it doesn't fix the access/wait
+inversion problem, just prevents it from becoming a deadlock
+situation. I'd prefer we fix the inversion, not sweep it under the
+carpet like this.
+
+#3a is really an optimisation that just so happens to include the
+band-aid fix of #3.
+
+So it seems that the simplest way to fix this issue is to implement
+solution #2
+
+Link: http://lkml.kernel.org/r/20181005054526.21507-1-david@fromorbit.com
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.de>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page-writeback.c | 33 +++++++++++++++------------------
+ 1 file changed, 15 insertions(+), 18 deletions(-)
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index e001de5ac50cb..a40c075fd8f1e 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -2150,6 +2150,13 @@ EXPORT_SYMBOL(tag_pages_for_writeback);
+ * not miss some pages (e.g., because some other process has cleared TOWRITE
+ * tag we set). The rule we follow is that TOWRITE tag can be cleared only
+ * by the process clearing the DIRTY tag (and submitting the page for IO).
++ *
++ * To avoid deadlocks between range_cyclic writeback and callers that hold
++ * pages in PageWriteback to aggregate IO until write_cache_pages() returns,
++ * we do not loop back to the start of the file. Doing so causes a page
++ * lock/page writeback access order inversion - we should only ever lock
++ * multiple pages in ascending page->index order, and looping back to the start
++ * of the file violates that rule and causes deadlocks.
+ */
+ int write_cache_pages(struct address_space *mapping,
+ struct writeback_control *wbc, writepage_t writepage,
+@@ -2164,7 +2171,6 @@ int write_cache_pages(struct address_space *mapping,
+ pgoff_t index;
+ pgoff_t end; /* Inclusive */
+ pgoff_t done_index;
+- int cycled;
+ int range_whole = 0;
+ int tag;
+
+@@ -2172,23 +2178,17 @@ int write_cache_pages(struct address_space *mapping,
+ if (wbc->range_cyclic) {
+ writeback_index = mapping->writeback_index; /* prev offset */
+ index = writeback_index;
+- if (index == 0)
+- cycled = 1;
+- else
+- cycled = 0;
+ end = -1;
+ } else {
+ index = wbc->range_start >> PAGE_SHIFT;
+ end = wbc->range_end >> PAGE_SHIFT;
+ if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
+ range_whole = 1;
+- cycled = 1; /* ignore range_cyclic tests */
+ }
+ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
+ tag = PAGECACHE_TAG_TOWRITE;
+ else
+ tag = PAGECACHE_TAG_DIRTY;
+-retry:
+ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
+ tag_pages_for_writeback(mapping, index, end);
+ done_index = index;
+@@ -2296,17 +2296,14 @@ int write_cache_pages(struct address_space *mapping,
+ pagevec_release(&pvec);
+ cond_resched();
+ }
+- if (!cycled && !done) {
+- /*
+- * range_cyclic:
+- * We hit the last page and there is more work to be done: wrap
+- * back to the start of the file
+- */
+- cycled = 1;
+- index = 0;
+- end = writeback_index - 1;
+- goto retry;
+- }
++
++ /*
++ * If we hit the last page and there is more work to be done: wrap
++ * back the index back to the start of the file for the next
++ * time we are called.
++ */
++ if (wbc->range_cyclic && !done)
++ done_index = 0;
+ if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
+ mapping->writeback_index = done_index;
+
+--
+2.20.1
+
--- /dev/null
+From a12349bbdffbd8cc34b0eb0f43c2b1bdbcfbbc31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Oct 2018 15:20:47 +0800
+Subject: mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready
+ fail
+
+From: Chaotian Jing <chaotian.jing@mediatek.com>
+
+[ Upstream commit f38a9774ddde9d79b3487dd888edd8b8623552af ]
+
+when msdc_cmd_is_ready return fail, the req_timeout work has not been
+inited and cancel_delayed_work() will return false, then, the request
+return directly and never call mmc_request_done().
+
+so need call mod_delayed_work() before msdc_cmd_is_ready()
+
+Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mtk-sd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 267f7ab08420e..a2ac9938d9459 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -885,6 +885,7 @@ static void msdc_start_command(struct msdc_host *host,
+ WARN_ON(host->cmd);
+ host->cmd = cmd;
+
++ mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT);
+ if (!msdc_cmd_is_ready(host, mrq, cmd))
+ return;
+
+@@ -896,7 +897,6 @@ static void msdc_start_command(struct msdc_host *host,
+
+ cmd->error = 0;
+ rawcmd = msdc_cmd_prepare_raw_cmd(host, mrq, cmd);
+- mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT);
+
+ sdr_set_bits(host->base + MSDC_INTEN, cmd_ints_mask);
+ writel(cmd->arg, host->base + SDC_ARG);
+--
+2.20.1
+
--- /dev/null
+From aa18f6b8f94bdad1d864dc39ad9e65faa711c924 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Feb 2019 15:59:38 +0200
+Subject: mwifiex: Fix NL80211_TX_POWER_LIMITED
+
+From: Adrian Bunk <bunk@kernel.org>
+
+[ Upstream commit 65a576e27309120e0621f54d5c81eb9128bd56be ]
+
+NL80211_TX_POWER_LIMITED was treated as NL80211_TX_POWER_AUTOMATIC,
+which is the opposite of what should happen and can cause nasty
+regulatory problems.
+
+if/else converted to a switch without default to make gcc warn
+on unhandled enum values.
+
+Signed-off-by: Adrian Bunk <bunk@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c | 13 +++++++++++--
+ drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 +
+ drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 11 +++++++----
+ 3 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index dde47c5488184..5e8e34a08b2d6 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -362,11 +362,20 @@ mwifiex_cfg80211_set_tx_power(struct wiphy *wiphy,
+ struct mwifiex_power_cfg power_cfg;
+ int dbm = MBM_TO_DBM(mbm);
+
+- if (type == NL80211_TX_POWER_FIXED) {
++ switch (type) {
++ case NL80211_TX_POWER_FIXED:
+ power_cfg.is_power_auto = 0;
++ power_cfg.is_power_fixed = 1;
+ power_cfg.power_level = dbm;
+- } else {
++ break;
++ case NL80211_TX_POWER_LIMITED:
++ power_cfg.is_power_auto = 0;
++ power_cfg.is_power_fixed = 0;
++ power_cfg.power_level = dbm;
++ break;
++ case NL80211_TX_POWER_AUTOMATIC:
+ power_cfg.is_power_auto = 1;
++ break;
+ }
+
+ priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h
+index 48e154e1865df..0dd592ea6e833 100644
+--- a/drivers/net/wireless/marvell/mwifiex/ioctl.h
++++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h
+@@ -267,6 +267,7 @@ struct mwifiex_ds_encrypt_key {
+
+ struct mwifiex_power_cfg {
+ u32 is_power_auto;
++ u32 is_power_fixed;
+ u32 power_level;
+ };
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+index 82828a2079638..a8043d76152a4 100644
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -728,6 +728,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ txp_cfg = (struct host_cmd_ds_txpwr_cfg *) buf;
+ txp_cfg->action = cpu_to_le16(HostCmd_ACT_GEN_SET);
+ if (!power_cfg->is_power_auto) {
++ u16 dbm_min = power_cfg->is_power_fixed ?
++ dbm : priv->min_tx_power_level;
++
+ txp_cfg->mode = cpu_to_le32(1);
+ pg_tlv = (struct mwifiex_types_power_group *)
+ (buf + sizeof(struct host_cmd_ds_txpwr_cfg));
+@@ -742,7 +745,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x03;
+ pg->modulation_class = MOD_CLASS_HR_DSSS;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg++;
+ /* Power group for modulation class OFDM */
+@@ -750,7 +753,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x07;
+ pg->modulation_class = MOD_CLASS_OFDM;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg++;
+ /* Power group for modulation class HTBW20 */
+@@ -758,7 +761,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x20;
+ pg->modulation_class = MOD_CLASS_HT;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg->ht_bandwidth = HT_BW_20;
+ pg++;
+@@ -767,7 +770,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
+ pg->last_rate_code = 0x20;
+ pg->modulation_class = MOD_CLASS_HT;
+ pg->power_step = 0;
+- pg->power_min = (s8) dbm;
++ pg->power_min = (s8) dbm_min;
+ pg->power_max = (s8) dbm;
+ pg->ht_bandwidth = HT_BW_40;
+ }
+--
+2.20.1
+
--- /dev/null
+From 5792deae2eb9eaa7865ee70b3f8ea558db8925fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 02:08:43 +0000
+Subject: net: bcmgenet: return correct value 'ret' from bcmgenet_power_down
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0db55093b56618088b9a1d445eb6e43b311bea33 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/net/ethernet/broadcom/genet/bcmgenet.c: In function 'bcmgenet_power_down':
+drivers/net/ethernet/broadcom/genet/bcmgenet.c:1136:6: warning:
+ variable 'ret' set but not used [-Wunused-but-set-variable]
+
+bcmgenet_power_down should return 'ret' instead of 0.
+
+Fixes: ca8cf341903f ("net: bcmgenet: propagate errors from bcmgenet_power_down")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 1cc4fb27c13b3..b6af286fa5c7e 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1138,7 +1138,7 @@ static int bcmgenet_power_down(struct bcmgenet_priv *priv,
+ break;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static void bcmgenet_power_up(struct bcmgenet_priv *priv,
+--
+2.20.1
+
--- /dev/null
+From 6f9c0c3babd4f6c7a56f20dc3b0b1e2dcb6bebf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 08:39:13 -0700
+Subject: net: do not abort bulk send on BQL status
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit fe60faa5063822f2d555f4f326c7dd72a60929bf ]
+
+Before calling dev_hard_start_xmit(), upper layers tried
+to cook optimal skb list based on BQL budget.
+
+Problem is that GSO packets can end up comsuming more than
+the BQL budget.
+
+Breaking the loop is not useful, since requeued packets
+are ahead of any packets still in the qdisc.
+
+It is also more expensive, since next TX completion will
+push these packets later, while skbs are not in cpu caches.
+
+It is also a behavior difference with TSO packets, that can
+break the BQL limit by a large amount.
+
+Note that drivers should use __netdev_tx_sent_queue()
+in order to have optimal xmit_more support, and avoid
+useless atomic operations as shown in the following patch.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 9d6beb9de924b..3ce68484ed5aa 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3029,7 +3029,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *first, struct net_device *de
+ }
+
+ skb = next;
+- if (netif_xmit_stopped(txq) && skb) {
++ if (netif_tx_queue_stopped(txq) && skb) {
+ rc = NETDEV_TX_BUSY;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7c6231eae91bb61a6247dfa7c9a7fa03b34a6998 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 15:15:16 -0800
+Subject: net: dsa: bcm_sf2: Turn on PHY to allow successful registration
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit c04a17d2a9ccf1eaba1c5a56f83e997540a70556 ]
+
+We are binding to the PHY using the SF2 slave MDIO bus that we create,
+binding involves reading the PHY's MII_PHYSID1/2 which won't be possible
+if the PHY is turned off. Temporarily turn it on/off for the bus probing
+to succeeed. This fixes unbind/bind problems where the port connecting
+to that PHY would be in error since it could not connect to it.
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 604c5abc08eb8..af666951a9592 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1196,12 +1196,16 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)
+ return ret;
+ }
+
++ bcm_sf2_gphy_enable_set(priv->dev->ds, true);
++
+ ret = bcm_sf2_mdio_register(ds);
+ if (ret) {
+ pr_err("failed to register MDIO bus\n");
+ return ret;
+ }
+
++ bcm_sf2_gphy_enable_set(priv->dev->ds, false);
++
+ ret = bcm_sf2_cfp_rst(priv);
+ if (ret) {
+ pr_err("failed to reset CFP\n");
+--
+2.20.1
+
--- /dev/null
+From e1d265b6af15b325b513ab2967a70d6e5e77eef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Oct 2018 14:40:31 +0200
+Subject: net: dsa: mv88e6xxx: Fix 88E6141/6341 2500mbps SERDES speed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <marek.behun@nic.cz>
+
+[ Upstream commit 26422340da467538cd65eaa9c65538039ee99c8c ]
+
+This is a fix for the port_set_speed method for the Topaz family.
+Currently the same method is used as for the Peridot family, but
+this is wrong for the SERDES port.
+
+On Topaz, the SERDES port is port 5, not 9 and 10 as in Peridot.
+Moreover setting alt_bit on Topaz only makes sense for port 0 (for
+(differentiating 100mbps vs 200mbps). The SERDES port does not
+support more than 2500mbps, so alt_bit does not make any difference.
+
+Signed-off-by: Marek Behún <marek.behun@nic.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 4 ++--
+ drivers/net/dsa/mv88e6xxx/port.c | 25 +++++++++++++++++++++++--
+ drivers/net/dsa/mv88e6xxx/port.h | 1 +
+ 3 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 0fff1502267a4..be17194487c68 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2527,7 +2527,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
+ .port_set_link = mv88e6xxx_port_set_link,
+ .port_set_duplex = mv88e6xxx_port_set_duplex,
+ .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
+- .port_set_speed = mv88e6390_port_set_speed,
++ .port_set_speed = mv88e6341_port_set_speed,
+ .port_tag_remap = mv88e6095_port_tag_remap,
+ .port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ .port_set_egress_floods = mv88e6352_port_set_egress_floods,
+@@ -3029,7 +3029,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
+ .port_set_link = mv88e6xxx_port_set_link,
+ .port_set_duplex = mv88e6xxx_port_set_duplex,
+ .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
+- .port_set_speed = mv88e6390_port_set_speed,
++ .port_set_speed = mv88e6341_port_set_speed,
+ .port_tag_remap = mv88e6095_port_tag_remap,
+ .port_set_frame_mode = mv88e6351_port_set_frame_mode,
+ .port_set_egress_floods = mv88e6352_port_set_egress_floods,
+diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
+index 2cffecfe86e3b..fd0a88c56031a 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -203,8 +203,11 @@ static int mv88e6xxx_port_set_speed(struct mv88e6xxx_chip *chip, int port,
+ ctrl = MV88E6XXX_PORT_MAC_CTL_SPEED_1000;
+ break;
+ case 2500:
+- ctrl = MV88E6390_PORT_MAC_CTL_SPEED_10000 |
+- MV88E6390_PORT_MAC_CTL_ALTSPEED;
++ if (alt_bit)
++ ctrl = MV88E6390_PORT_MAC_CTL_SPEED_10000 |
++ MV88E6390_PORT_MAC_CTL_ALTSPEED;
++ else
++ ctrl = MV88E6390_PORT_MAC_CTL_SPEED_10000;
+ break;
+ case 10000:
+ /* all bits set, fall through... */
+@@ -266,6 +269,24 @@ int mv88e6185_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
+ return mv88e6xxx_port_set_speed(chip, port, speed, false, false);
+ }
+
++/* Support 10, 100, 200, 1000, 2500 Mbps (e.g. 88E6341) */
++int mv88e6341_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
++{
++ if (speed == SPEED_MAX)
++ speed = port < 5 ? 1000 : 2500;
++
++ if (speed > 2500)
++ return -EOPNOTSUPP;
++
++ if (speed == 200 && port != 0)
++ return -EOPNOTSUPP;
++
++ if (speed == 2500 && port < 5)
++ return -EOPNOTSUPP;
++
++ return mv88e6xxx_port_set_speed(chip, port, speed, !port, true);
++}
++
+ /* Support 10, 100, 200, 1000 Mbps (e.g. 88E6352 family) */
+ int mv88e6352_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
+ {
+diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
+index ccdc67fe90799..8a645683cf6b1 100644
+--- a/drivers/net/dsa/mv88e6xxx/port.h
++++ b/drivers/net/dsa/mv88e6xxx/port.h
+@@ -262,6 +262,7 @@ int mv88e6xxx_port_set_duplex(struct mv88e6xxx_chip *chip, int port, int dup);
+
+ int mv88e6065_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6185_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
++int mv88e6341_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6352_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6390_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+ int mv88e6390x_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
+--
+2.20.1
+
--- /dev/null
+From 1fd51d0a2e58e3863482fe2e7f0386871de2d28f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Oct 2018 10:04:21 +0000
+Subject: net: ena: Fix Kconfig dependency on X86
+
+From: Netanel Belgazal <netanel@amazon.com>
+
+[ Upstream commit 8c590f9776386b8f697fd0b7ed6142ae6e3de79e ]
+
+The Kconfig limitation of X86 is to too wide.
+The ENA driver only requires a little endian dependency.
+
+Change the dependency to be on little endian CPU.
+
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/Kconfig b/drivers/net/ethernet/amazon/Kconfig
+index 99b30353541ab..9e87d7b8360f5 100644
+--- a/drivers/net/ethernet/amazon/Kconfig
++++ b/drivers/net/ethernet/amazon/Kconfig
+@@ -17,7 +17,7 @@ if NET_VENDOR_AMAZON
+
+ config ENA_ETHERNET
+ tristate "Elastic Network Adapter (ENA) support"
+- depends on (PCI_MSI && X86)
++ depends on PCI_MSI && !CPU_BIG_ENDIAN
+ ---help---
+ This driver supports Elastic Network Adapter (ENA)"
+
+--
+2.20.1
+
--- /dev/null
+From deb791dc592316cc3caf570770df694c1b1c6c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Oct 2018 21:51:36 +0300
+Subject: net: ethernet: ti: cpsw: unsync mcast entries while switch promisc
+ mode
+
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+
+[ Upstream commit 9737cc99dd14b5b8b9d267618a6061feade8ea68 ]
+
+After flushing all mcast entries from the table, the ones contained in
+mc list of ndev are not restored when promisc mode is toggled off,
+because they are considered as synched with ALE, thus, in order to
+restore them after promisc mode - reset syncing info. This fix
+touches only switch mode devices, including single port boards
+like Beagle Bone.
+
+Fixes: commit 5da1948969bc
+("net: ethernet: ti: cpsw: fix lost of mcast packets while rx_mode update")
+
+Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpsw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 8cb44eabc2835..a44838aac97de 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -601,6 +601,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
+
+ /* Clear all mcast from ALE */
+ cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS, -1);
++ __dev_mc_unsync(ndev, NULL);
+
+ /* Flood All Unicast Packets to Host port */
+ cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
+--
+2.20.1
+
--- /dev/null
+From ed84ba719c47c7865c0f69fa26e1e2633ebb2be1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 14:57:26 +0900
+Subject: net: fix warning in af_unix
+
+From: Kyeongdon Kim <kyeongdon.kim@lge.com>
+
+[ Upstream commit 33c4368ee2589c165aebd8d388cbd91e9adb9688 ]
+
+This fixes the "'hash' may be used uninitialized in this function"
+
+net/unix/af_unix.c:1041:20: warning: 'hash' may be used uninitialized in this function [-Wmaybe-uninitialized]
+ addr->hash = hash ^ sk->sk_type;
+
+Signed-off-by: Kyeongdon Kim <kyeongdon.kim@lge.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/af_unix.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 4de9dfd14d09d..99f581a61cfac 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -225,6 +225,8 @@ static inline void unix_release_addr(struct unix_address *addr)
+
+ static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
+ {
++ *hashp = 0;
++
+ if (len <= sizeof(short) || len > sizeof(*sunaddr))
+ return -EINVAL;
+ if (!sunaddr || sunaddr->sun_family != AF_UNIX)
+--
+2.20.1
+
--- /dev/null
+From 1c7d8b782df43931fdfcec6f80149b9dd3a22452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 21:50:44 +0800
+Subject: net: hns3: bugfix for buffer not free problem during resetting
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit 73b907a083b8a8c1c62cb494bc9fbe6ae086c460 ]
+
+When hns3_get_ring_config()/hns3_queue_to_ring()/
+hns3_get_vector_ring_chain() failed during resetting, the allocated
+memory has not been freed before these three functions return. So
+this patch adds error handler in these functions to fix it.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../hisilicon/hns3/hns3pf/hns3_enet.c | 24 ++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
+index 5483cb23c08a3..e9cff8ed5e076 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c
+@@ -2300,7 +2300,7 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+ chain = devm_kzalloc(&pdev->dev, sizeof(*chain),
+ GFP_KERNEL);
+ if (!chain)
+- return -ENOMEM;
++ goto err_free_chain;
+
+ cur_chain->next = chain;
+ chain->tqp_index = tx_ring->tqp->tqp_index;
+@@ -2324,7 +2324,7 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+ while (rx_ring) {
+ chain = devm_kzalloc(&pdev->dev, sizeof(*chain), GFP_KERNEL);
+ if (!chain)
+- return -ENOMEM;
++ goto err_free_chain;
+
+ cur_chain->next = chain;
+ chain->tqp_index = rx_ring->tqp->tqp_index;
+@@ -2336,6 +2336,16 @@ static int hns3_get_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+ }
+
+ return 0;
++
++err_free_chain:
++ cur_chain = head->next;
++ while (cur_chain) {
++ chain = cur_chain->next;
++ devm_kfree(&pdev->dev, chain);
++ cur_chain = chain;
++ }
++
++ return -ENOMEM;
+ }
+
+ static void hns3_free_vector_ring_chain(struct hns3_enet_tqp_vector *tqp_vector,
+@@ -2530,8 +2540,10 @@ static int hns3_queue_to_ring(struct hnae3_queue *tqp,
+ return ret;
+
+ ret = hns3_ring_get_cfg(tqp, priv, HNAE3_RING_TYPE_RX);
+- if (ret)
++ if (ret) {
++ devm_kfree(priv->dev, priv->ring_data[tqp->tqp_index].ring);
+ return ret;
++ }
+
+ return 0;
+ }
+@@ -2556,6 +2568,12 @@ static int hns3_get_ring_config(struct hns3_nic_priv *priv)
+
+ return 0;
+ err:
++ while (i--) {
++ devm_kfree(priv->dev, priv->ring_data[i].ring);
++ devm_kfree(priv->dev,
++ priv->ring_data[i + h->kinfo.num_tqps].ring);
++ }
++
+ devm_kfree(&pdev->dev, priv->ring_data);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 9c86e0af2fca21fa686da10a7d0842f4491844b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 17:13:59 -0700
+Subject: ntb: intel: fix return value for ndev_vec_mask()
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 7756e2b5d68c36e170a111dceea22f7365f83256 ]
+
+ndev_vec_mask() should be returning u64 mask value instead of int.
+Otherwise the mask value returned can be incorrect for larger
+vectors.
+
+Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
+
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Tested-by: Lucas Van <lucas.van@intel.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/intel/ntb_hw_intel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
+index 2557e2c05b90c..58068f1447bb2 100644
+--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
++++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
+@@ -348,7 +348,7 @@ static inline int ndev_db_clear_mask(struct intel_ntb_dev *ndev, u64 db_bits,
+ return 0;
+ }
+
+-static inline int ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector)
++static inline u64 ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector)
+ {
+ u64 shift, mask;
+
+--
+2.20.1
+
--- /dev/null
+From f3111c77df0ce5096e35c6279ba886f2983031c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jun 2018 16:13:12 -0400
+Subject: ntb_netdev: fix sleep time mismatch
+
+From: Jon Mason <jdmason@kudzu.us>
+
+[ Upstream commit a861594b1b7ffd630f335b351c4e9f938feadb8e ]
+
+The tx_time should be in usecs (according to the comment above the
+variable), but the setting of the timer during the rearming is done in
+msecs. Change it to match the expected units.
+
+Fixes: e74bfeedad08 ("NTB: Add flow control to the ntb_netdev")
+Suggested-by: Gerd W. Haeussler <gerd.haeussler@cesys-it.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Acked-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ntb_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
+index 0250aa9ae2cbc..97bf49ad81a6d 100644
+--- a/drivers/net/ntb_netdev.c
++++ b/drivers/net/ntb_netdev.c
+@@ -236,7 +236,7 @@ static void ntb_netdev_tx_timer(unsigned long data)
+ struct ntb_netdev *dev = netdev_priv(ndev);
+
+ if (ntb_transport_tx_free_entry(dev->qp) < tx_stop) {
+- mod_timer(&dev->tx_timer, jiffies + msecs_to_jiffies(tx_time));
++ mod_timer(&dev->tx_timer, jiffies + usecs_to_jiffies(tx_time));
+ } else {
+ /* Make sure anybody stopping the queue after this sees the new
+ * value of ntb_transport_tx_free_entry()
+--
+2.20.1
+
--- /dev/null
+From 70e38af3ea2e00a742b813dcdd47e27355940cee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 08:08:20 -0700
+Subject: nvmet-fcloop: suppress a compiler warning
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 1216e9ef18b84f4fb5934792368fb01eb3540520 ]
+
+Building with W=1 enables the compiler warning -Wimplicit-fallthrough=3. That
+option does not recognize the fall-through comment in the fcloop driver. Add
+a fall-through comment that is recognized for -Wimplicit-fallthrough=3. This
+patch avoids that the compiler reports the following warning when building
+with W=1:
+
+drivers/nvme/target/fcloop.c:647:6: warning: this statement may fall through [-Wimplicit-fallthrough=]
+ if (op == NVMET_FCOP_READDATA)
+ ^
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fcloop.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 0b0a4825b3eb1..096523d8dd422 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -535,6 +535,7 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ break;
+
+ /* Fall-Thru to RSP handling */
++ /* FALLTHRU */
+
+ case NVMET_FCOP_RSP:
+ if (fcpreq) {
+--
+2.20.1
+
--- /dev/null
+From d9cd5fffa53ddafd1b3948193d73d2f3d7e7278d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 15:48:19 -0700
+Subject: ocfs2: don't put and assigning null to bh allocated outside
+
+From: Changwei Ge <ge.changwei@h3c.com>
+
+[ Upstream commit cf76c78595ca87548ca5e45c862ac9e0949c4687 ]
+
+ocfs2_read_blocks() and ocfs2_read_blocks_sync() are both used to read
+several blocks from disk. Currently, the input argument *bhs* can be
+NULL or NOT. It depends on the caller's behavior. If the function
+fails in reading blocks from disk, the corresponding bh will be assigned
+to NULL and put.
+
+Obviously, above process for non-NULL input bh is not appropriate.
+Because the caller doesn't even know its bhs are put and re-assigned.
+
+If buffer head is managed by caller, ocfs2_read_blocks and
+ocfs2_read_blocks_sync() should not evaluate it to NULL. It will cause
+caller accessing illegal memory, thus crash.
+
+Link: http://lkml.kernel.org/r/HK2PR06MB045285E0F4FBB561F9F2F9B3D5680@HK2PR06MB0452.apcprd06.prod.outlook.com
+Signed-off-by: Changwei Ge <ge.changwei@h3c.com>
+Reviewed-by: Guozhonghua <guozhonghua@h3c.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/buffer_head_io.c | 77 ++++++++++++++++++++++++++++++---------
+ 1 file changed, 59 insertions(+), 18 deletions(-)
+
+diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
+index 9f8250df99f1f..f9b84f7a3e4bb 100644
+--- a/fs/ocfs2/buffer_head_io.c
++++ b/fs/ocfs2/buffer_head_io.c
+@@ -99,25 +99,34 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh,
+ return ret;
+ }
+
++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it
++ * will be easier to handle read failure.
++ */
+ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ unsigned int nr, struct buffer_head *bhs[])
+ {
+ int status = 0;
+ unsigned int i;
+ struct buffer_head *bh;
++ int new_bh = 0;
+
+ trace_ocfs2_read_blocks_sync((unsigned long long)block, nr);
+
+ if (!nr)
+ goto bail;
+
++ /* Don't put buffer head and re-assign it to NULL if it is allocated
++ * outside since the caller can't be aware of this alternation!
++ */
++ new_bh = (bhs[0] == NULL);
++
+ for (i = 0 ; i < nr ; i++) {
+ if (bhs[i] == NULL) {
+ bhs[i] = sb_getblk(osb->sb, block++);
+ if (bhs[i] == NULL) {
+ status = -ENOMEM;
+ mlog_errno(status);
+- goto bail;
++ break;
+ }
+ }
+ bh = bhs[i];
+@@ -157,9 +166,26 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ submit_bh(REQ_OP_READ, 0, bh);
+ }
+
++read_failure:
+ for (i = nr; i > 0; i--) {
+ bh = bhs[i - 1];
+
++ if (unlikely(status)) {
++ if (new_bh && bh) {
++ /* If middle bh fails, let previous bh
++ * finish its read and then put it to
++ * aovoid bh leak
++ */
++ if (!buffer_jbd(bh))
++ wait_on_buffer(bh);
++ put_bh(bh);
++ bhs[i - 1] = NULL;
++ } else if (bh && buffer_uptodate(bh)) {
++ clear_buffer_uptodate(bh);
++ }
++ continue;
++ }
++
+ /* No need to wait on the buffer if it's managed by JBD. */
+ if (!buffer_jbd(bh))
+ wait_on_buffer(bh);
+@@ -169,8 +195,7 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ * so we can safely record this and loop back
+ * to cleanup the other buffers. */
+ status = -EIO;
+- put_bh(bh);
+- bhs[i - 1] = NULL;
++ goto read_failure;
+ }
+ }
+
+@@ -178,6 +203,9 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
+ return status;
+ }
+
++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it
++ * will be easier to handle read failure.
++ */
+ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ struct buffer_head *bhs[], int flags,
+ int (*validate)(struct super_block *sb,
+@@ -187,6 +215,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ int i, ignore_cache = 0;
+ struct buffer_head *bh;
+ struct super_block *sb = ocfs2_metadata_cache_get_super(ci);
++ int new_bh = 0;
+
+ trace_ocfs2_read_blocks_begin(ci, (unsigned long long)block, nr, flags);
+
+@@ -212,6 +241,11 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ goto bail;
+ }
+
++ /* Don't put buffer head and re-assign it to NULL if it is allocated
++ * outside since the caller can't be aware of this alternation!
++ */
++ new_bh = (bhs[0] == NULL);
++
+ ocfs2_metadata_cache_io_lock(ci);
+ for (i = 0 ; i < nr ; i++) {
+ if (bhs[i] == NULL) {
+@@ -220,7 +254,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ ocfs2_metadata_cache_io_unlock(ci);
+ status = -ENOMEM;
+ mlog_errno(status);
+- goto bail;
++ /* Don't forget to put previous bh! */
++ break;
+ }
+ }
+ bh = bhs[i];
+@@ -314,16 +349,27 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ }
+ }
+
+- status = 0;
+-
++read_failure:
+ for (i = (nr - 1); i >= 0; i--) {
+ bh = bhs[i];
+
+ if (!(flags & OCFS2_BH_READAHEAD)) {
+- if (status) {
+- /* Clear the rest of the buffers on error */
+- put_bh(bh);
+- bhs[i] = NULL;
++ if (unlikely(status)) {
++ /* Clear the buffers on error including those
++ * ever succeeded in reading
++ */
++ if (new_bh && bh) {
++ /* If middle bh fails, let previous bh
++ * finish its read and then put it to
++ * aovoid bh leak
++ */
++ if (!buffer_jbd(bh))
++ wait_on_buffer(bh);
++ put_bh(bh);
++ bhs[i] = NULL;
++ } else if (bh && buffer_uptodate(bh)) {
++ clear_buffer_uptodate(bh);
++ }
+ continue;
+ }
+ /* We know this can't have changed as we hold the
+@@ -341,9 +387,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ * uptodate. */
+ status = -EIO;
+ clear_buffer_needs_validate(bh);
+- put_bh(bh);
+- bhs[i] = NULL;
+- continue;
++ goto read_failure;
+ }
+
+ if (buffer_needs_validate(bh)) {
+@@ -353,11 +397,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ BUG_ON(buffer_jbd(bh));
+ clear_buffer_needs_validate(bh);
+ status = validate(sb, bh);
+- if (status) {
+- put_bh(bh);
+- bhs[i] = NULL;
+- continue;
+- }
++ if (status)
++ goto read_failure;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 77a8b3f473b05305d3b543e48755c60760a2a70d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 15:48:27 -0700
+Subject: ocfs2: fix clusters leak in ocfs2_defrag_extent()
+
+From: Larry Chen <lchen@suse.com>
+
+[ Upstream commit 6194ae4242dec0c9d604bc05df83aa9260a899e4 ]
+
+ocfs2_defrag_extent() might leak allocated clusters. When the file
+system has insufficient space, the number of claimed clusters might be
+less than the caller wants. If that happens, the original code might
+directly commit the transaction without returning clusters.
+
+This patch is based on code in ocfs2_add_clusters_in_btree().
+
+[akpm@linux-foundation.org: include localalloc.h, reduce scope of data_ac]
+Link: http://lkml.kernel.org/r/20180904041621.16874-3-lchen@suse.com
+Signed-off-by: Larry Chen <lchen@suse.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/move_extents.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
+index f55f82ca34250..1565dd8e8856e 100644
+--- a/fs/ocfs2/move_extents.c
++++ b/fs/ocfs2/move_extents.c
+@@ -25,6 +25,7 @@
+ #include "ocfs2_ioctl.h"
+
+ #include "alloc.h"
++#include "localalloc.h"
+ #include "aops.h"
+ #include "dlmglue.h"
+ #include "extent_map.h"
+@@ -222,6 +223,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ struct ocfs2_refcount_tree *ref_tree = NULL;
+ u32 new_phys_cpos, new_len;
+ u64 phys_blkno = ocfs2_clusters_to_blocks(inode->i_sb, phys_cpos);
++ int need_free = 0;
+
+ if ((ext_flags & OCFS2_EXT_REFCOUNTED) && *len) {
+ BUG_ON(!ocfs2_is_refcount_inode(inode));
+@@ -312,6 +314,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ if (!partial) {
+ context->range->me_flags &= ~OCFS2_MOVE_EXT_FL_COMPLETE;
+ ret = -ENOSPC;
++ need_free = 1;
+ goto out_commit;
+ }
+ }
+@@ -336,6 +339,20 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
+ mlog_errno(ret);
+
+ out_commit:
++ if (need_free && context->data_ac) {
++ struct ocfs2_alloc_context *data_ac = context->data_ac;
++
++ if (context->data_ac->ac_which == OCFS2_AC_USE_LOCAL)
++ ocfs2_free_local_alloc_bits(osb, handle, data_ac,
++ new_phys_cpos, new_len);
++ else
++ ocfs2_free_clusters(handle,
++ data_ac->ac_inode,
++ data_ac->ac_bh,
++ ocfs2_clusters_to_blocks(osb->sb, new_phys_cpos),
++ new_len);
++ }
++
+ ocfs2_commit_trans(osb, handle);
+
+ out_unlock_mutex:
+--
+2.20.1
+
--- /dev/null
+From f4be016b8db43e2f6bce5123f6f561abceb12559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 19:38:26 -0700
+Subject: of: unittest: allow base devicetree to have symbol metadata
+
+From: Frank Rowand <frank.rowand@sony.com>
+
+[ Upstream commit 5babefb7f7ab1f23861336d511cc666fa45ede82 ]
+
+The overlay metadata nodes in the FDT created from testcases.dts
+are not handled properly.
+
+The __fixups__ and __local_fixups__ node were added to the live
+devicetree, but should not be.
+
+Only the first property in the /__symbols__ node was added to the
+live devicetree if the live devicetree already contained a
+/__symbols node. All of the node's properties must be added.
+
+Tested-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 43 +++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 35 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 87650d42682fc..9d204649c963c 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -910,20 +910,44 @@ static void __init of_unittest_platform_populate(void)
+ * of np into dup node (present in live tree) and
+ * updates parent of children of np to dup.
+ *
+- * @np: node already present in live tree
++ * @np: node whose properties are being added to the live tree
+ * @dup: node present in live tree to be updated
+ */
+ static void update_node_properties(struct device_node *np,
+ struct device_node *dup)
+ {
+ struct property *prop;
++ struct property *save_next;
+ struct device_node *child;
+-
+- for_each_property_of_node(np, prop)
+- of_add_property(dup, prop);
++ int ret;
+
+ for_each_child_of_node(np, child)
+ child->parent = dup;
++
++ /*
++ * "unittest internal error: unable to add testdata property"
++ *
++ * If this message reports a property in node '/__symbols__' then
++ * the respective unittest overlay contains a label that has the
++ * same name as a label in the live devicetree. The label will
++ * be in the live devicetree only if the devicetree source was
++ * compiled with the '-@' option. If you encounter this error,
++ * please consider renaming __all__ of the labels in the unittest
++ * overlay dts files with an odd prefix that is unlikely to be
++ * used in a real devicetree.
++ */
++
++ /*
++ * open code for_each_property_of_node() because of_add_property()
++ * sets prop->next to NULL
++ */
++ for (prop = np->properties; prop != NULL; prop = save_next) {
++ save_next = prop->next;
++ ret = of_add_property(dup, prop);
++ if (ret)
++ pr_err("unittest internal error: unable to add testdata property %pOF/%s",
++ np, prop->name);
++ }
+ }
+
+ /**
+@@ -932,18 +956,23 @@ static void update_node_properties(struct device_node *np,
+ *
+ * @np: Node to attach to live tree
+ */
+-static int attach_node_and_children(struct device_node *np)
++static void attach_node_and_children(struct device_node *np)
+ {
+ struct device_node *next, *dup, *child;
+ unsigned long flags;
+ const char *full_name;
+
+ full_name = kasprintf(GFP_KERNEL, "%pOF", np);
++
++ if (!strcmp(full_name, "/__local_fixups__") ||
++ !strcmp(full_name, "/__fixups__"))
++ return;
++
+ dup = of_find_node_by_path(full_name);
+ kfree(full_name);
+ if (dup) {
+ update_node_properties(np, dup);
+- return 0;
++ return;
+ }
+
+ child = np->child;
+@@ -964,8 +993,6 @@ static int attach_node_and_children(struct device_node *np)
+ attach_node_and_children(child);
+ child = next;
+ }
+-
+- return 0;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 176b0930178c18b40964cb7218f96b354e3faaf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 16:36:55 +0100
+Subject: openvswitch: fix linking without CONFIG_NF_CONNTRACK_LABELS
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a277d516de5f498c91d91189717ef7e01102ad27 ]
+
+When CONFIG_CC_OPTIMIZE_FOR_DEBUGGING is enabled, the compiler
+fails to optimize out a dead code path, which leads to a link failure:
+
+net/openvswitch/conntrack.o: In function `ovs_ct_set_labels':
+conntrack.c:(.text+0x2e60): undefined reference to `nf_connlabels_replace'
+
+In this configuration, we can take a shortcut, and completely
+remove the contrack label code. This may also help the regular
+optimization.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/conntrack.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 0171b27a2b81b..48d81857961ca 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1083,7 +1083,8 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
+ &info->labels.mask);
+ if (err)
+ return err;
+- } else if (labels_nonzero(&info->labels.mask)) {
++ } else if (IS_ENABLED(CONFIG_NF_CONNTRACK_LABELS) &&
++ labels_nonzero(&info->labels.mask)) {
+ err = ovs_ct_set_labels(ct, key, &info->labels.value,
+ &info->labels.mask);
+ if (err)
+--
+2.20.1
+
--- /dev/null
+From 5d2c6b9d25f49b7fed9246ee538c573dc8f7239b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Oct 2018 13:10:54 +0530
+Subject: PCI: keystone: Use quirk to limit MRRS for K2G
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 148e340c0696369fadbbddc8f4bef801ed247d71 ]
+
+PCI controller in K2G also has a limitation that memory read request
+size (MRRS) must not exceed 256 bytes. Use the quirk to limit MRRS
+(added for K2HK, K2L and K2E) for K2G as well.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/dwc/pci-keystone.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/dwc/pci-keystone.c b/drivers/pci/dwc/pci-keystone.c
+index 9bc52e4cf52a0..3ea8288c16053 100644
+--- a/drivers/pci/dwc/pci-keystone.c
++++ b/drivers/pci/dwc/pci-keystone.c
+@@ -39,6 +39,7 @@
+ #define PCIE_RC_K2HK 0xb008
+ #define PCIE_RC_K2E 0xb009
+ #define PCIE_RC_K2L 0xb00a
++#define PCIE_RC_K2G 0xb00b
+
+ #define to_keystone_pcie(x) dev_get_drvdata((x)->dev)
+
+@@ -53,6 +54,8 @@ static void quirk_limit_mrrs(struct pci_dev *dev)
+ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
+ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2L),
+ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
++ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2G),
++ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
+ { 0, },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From fb97cad09cb8b224341231c36dfe17156b9c6a80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Oct 2018 18:48:07 -0600
+Subject: PCI: vmd: Detach resources after stopping root bus
+
+From: Jon Derrick <jonathan.derrick@intel.com>
+
+[ Upstream commit dc8af3a827df6d4bb925d3b81b7ec94a7cce9482 ]
+
+The VMD removal path calls pci_stop_root_busi(), which tears down the pcie
+tree, including detaching all of the attached drivers. During driver
+detachment, devices may use pci_release_region() to release resources.
+This path relies on the resource being accessible in resource tree.
+
+By detaching the child domain from the parent resource domain prior to
+stopping the bus, we are preventing the list traversal from finding the
+resource to be freed. If we instead detach the resource after stopping
+the bus, we will have properly freed the resource and detaching is
+simply accounting at that point.
+
+Without this order, the resource is never freed and is orphaned on VMD
+removal, leading to a warning:
+
+[ 181.940162] Trying to free nonexistent resource <e5a10000-e5a13fff>
+
+Fixes: 2c2c5c5cd213 ("x86/PCI: VMD: Attach VMD resources to parent domain's resource tree")
+Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
+[lorenzo.pieralisi@arm.com: updated commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/host/vmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/host/vmd.c b/drivers/pci/host/vmd.c
+index 2537b022f42d4..af6d5da10ea5f 100644
+--- a/drivers/pci/host/vmd.c
++++ b/drivers/pci/host/vmd.c
+@@ -753,12 +753,12 @@ static void vmd_remove(struct pci_dev *dev)
+ {
+ struct vmd_dev *vmd = pci_get_drvdata(dev);
+
+- vmd_detach_resources(vmd);
+ sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
+ pci_stop_root_bus(vmd->bus);
+ pci_remove_root_bus(vmd->bus);
+ vmd_cleanup_srcu(vmd);
+ vmd_teardown_dma_ops(vmd);
++ vmd_detach_resources(vmd);
+ irq_domain_remove(vmd->irq_domain);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 11dbdab0a72775e23e3a28ce69dabfc767f37c55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Nov 2018 08:00:08 -0700
+Subject: pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit f24bfb39975c241374cadebbd037c17960cf1412 ]
+
+Clang warns when one enumerated type is implicitly converted to another:
+
+drivers/pinctrl/pinctrl-lpc18xx.c:643:29: warning: implicit conversion
+from enumeration type 'enum lpc18xx_pin_config_param' to different
+enumeration type 'enum pin_config_param' [-Wenum-conversion]
+ {"nxp,gpio-pin-interrupt", PIN_CONFIG_GPIO_PIN_INT, 0},
+ ~ ^~~~~~~~~~~~~~~~~~~~~~~
+drivers/pinctrl/pinctrl-lpc18xx.c:648:12: warning: implicit conversion
+from enumeration type 'enum lpc18xx_pin_config_param' to different
+enumeration type 'enum pin_config_param' [-Wenum-conversion]
+ PCONFDUMP(PIN_CONFIG_GPIO_PIN_INT, "gpio pin int", NULL, true),
+ ~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+./include/linux/pinctrl/pinconf-generic.h:163:11: note: expanded from
+macro 'PCONFDUMP'
+ .param = a, .display = b, .format = c, .has_arg = d \
+ ^
+2 warnings generated.
+
+It is expected that pinctrl drivers can extend pin_config_param because
+of the gap between PIN_CONFIG_END and PIN_CONFIG_MAX so this conversion
+isn't an issue. Most drivers that take advantage of this define the
+PIN_CONFIG variables as constants, rather than enumerated values. Do the
+same thing here so that Clang no longer warns.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/140
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-lpc18xx.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-lpc18xx.c b/drivers/pinctrl/pinctrl-lpc18xx.c
+index d090f37ca4a11..8b4e3582af6e0 100644
+--- a/drivers/pinctrl/pinctrl-lpc18xx.c
++++ b/drivers/pinctrl/pinctrl-lpc18xx.c
+@@ -630,14 +630,8 @@ static const struct pinctrl_pin_desc lpc18xx_pins[] = {
+ LPC18XX_PIN(i2c0_sda, PIN_I2C0_SDA),
+ };
+
+-/**
+- * enum lpc18xx_pin_config_param - possible pin configuration parameters
+- * @PIN_CONFIG_GPIO_PIN_INT: route gpio to the gpio pin interrupt
+- * controller.
+- */
+-enum lpc18xx_pin_config_param {
+- PIN_CONFIG_GPIO_PIN_INT = PIN_CONFIG_END + 1,
+-};
++/* PIN_CONFIG_GPIO_PIN_INT: route gpio to the gpio pin interrupt controller */
++#define PIN_CONFIG_GPIO_PIN_INT (PIN_CONFIG_END + 1)
+
+ static const struct pinconf_generic_params lpc18xx_params[] = {
+ {"nxp,gpio-pin-interrupt", PIN_CONFIG_GPIO_PIN_INT, 0},
+--
+2.20.1
+
--- /dev/null
+From cc7f1ea3c08371b583f868cb6adb08ac971e9542 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 20:11:47 -0400
+Subject: pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit 149a96047237574b756d872007c006acd0cc6687 ]
+
+When attempting to setup up a gpio hog, device probing would repeatedly
+fail with -EPROBE_DEFERED errors. It was caused by a circular dependency
+between the gpio and pinctrl frameworks. If the gpio-ranges property is
+present in device tree, then the gpio framework will handle the gpio pin
+registration and eliminate the circular dependency.
+
+See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix
+gpio-hog related boot issues") for a detailed commit message that
+explains the issue in much more detail. The code comment in this commit
+came from Christian's commit.
+
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+index 22aaf4375fac0..0f0049dfaa3a1 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
+@@ -1023,10 +1023,23 @@ static int pmic_gpio_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0, npins);
+- if (ret) {
+- dev_err(dev, "failed to add pin range\n");
+- goto err_range;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0,
++ npins);
++ if (ret) {
++ dev_err(dev, "failed to add pin range\n");
++ goto err_range;
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 1ca9480704ca256a1e736335eebfb9838809ec3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 08:22:28 +0200
+Subject: pinctrl: sunxi: Fix a memory leak in 'sunxi_pinctrl_build_state()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit a93a676b079144009f55fff2ab0e34c3b7258c8a ]
+
+If 'krealloc()' fails, 'pctl->functions' is set to NULL.
+We should instead use a temp variable in order to be able to free the
+previously allocated memeory, in case of OOM.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sunxi/pinctrl-sunxi.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 52edf3b5988d5..cc8b86a16da0d 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1039,6 +1039,7 @@ static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl,
+ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ {
+ struct sunxi_pinctrl *pctl = platform_get_drvdata(pdev);
++ void *ptr;
+ int i;
+
+ /*
+@@ -1105,13 +1106,15 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ }
+
+ /* And now allocated and fill the array for real */
+- pctl->functions = krealloc(pctl->functions,
+- pctl->nfunctions * sizeof(*pctl->functions),
+- GFP_KERNEL);
+- if (!pctl->functions) {
++ ptr = krealloc(pctl->functions,
++ pctl->nfunctions * sizeof(*pctl->functions),
++ GFP_KERNEL);
++ if (!ptr) {
+ kfree(pctl->functions);
++ pctl->functions = NULL;
+ return -ENOMEM;
+ }
++ pctl->functions = ptr;
+
+ for (i = 0; i < pctl->desc->npins; i++) {
+ const struct sunxi_desc_pin *pin = pctl->desc->pins + i;
+--
+2.20.1
+
--- /dev/null
+From c32c4fcc1ba0b8127e999d01956a56968ea2c5c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 01:56:40 -0700
+Subject: pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit cd8a145a066a1a3beb0ae615c7cb2ee4217418d7 ]
+
+Clang warns when one enumerated type is implicitly converted to another:
+
+drivers/pinctrl/pinctrl-zynq.c:985:18: warning: implicit conversion from
+enumeration type 'enum zynq_pin_config_param' to different enumeration
+type 'enum pin_config_param' [-Wenum-conversion]
+ {"io-standard", PIN_CONFIG_IOSTANDARD, zynq_iostd_lvcmos18},
+ ~ ^~~~~~~~~~~~~~~~~~~~~
+drivers/pinctrl/pinctrl-zynq.c:990:16: warning: implicit conversion from
+enumeration type 'enum zynq_pin_config_param' to different enumeration
+type 'enum pin_config_param' [-Wenum-conversion]
+ = { PCONFDUMP(PIN_CONFIG_IOSTANDARD, "IO-standard", NULL, true),
+ ~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+./include/linux/pinctrl/pinconf-generic.h:163:11: note: expanded from
+macro 'PCONFDUMP'
+ .param = a, .display = b, .format = c, .has_arg = d \
+ ^
+2 warnings generated.
+
+It is expected that pinctrl drivers can extend pin_config_param because
+of the gap between PIN_CONFIG_END and PIN_CONFIG_MAX so this conversion
+isn't an issue. Most drivers that take advantage of this define the
+PIN_CONFIG variables as constants, rather than enumerated values. Do the
+same thing here so that Clang no longer warns.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-zynq.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c
+index a0daf27042bd0..90fd37e8207bf 100644
+--- a/drivers/pinctrl/pinctrl-zynq.c
++++ b/drivers/pinctrl/pinctrl-zynq.c
+@@ -971,15 +971,12 @@ enum zynq_io_standards {
+ zynq_iostd_max
+ };
+
+-/**
+- * enum zynq_pin_config_param - possible pin configuration parameters
+- * @PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to
++/*
++ * PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to
+ * this parameter (on a custom format) tells the driver which alternative
+ * IO standard to use.
+ */
+-enum zynq_pin_config_param {
+- PIN_CONFIG_IOSTANDARD = PIN_CONFIG_END + 1,
+-};
++#define PIN_CONFIG_IOSTANDARD (PIN_CONFIG_END + 1)
+
+ static const struct pinconf_generic_params zynq_dt_params[] = {
+ {"io-standard", PIN_CONFIG_IOSTANDARD, zynq_iostd_lvcmos18},
+--
+2.20.1
+
--- /dev/null
+From 228678b68b9bf03d912da3731bb332e34f20b126 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2017 14:18:44 -0700
+Subject: platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
+
+From: Kiernan Hager <kah.listaddress@gmail.com>
+
+[ Upstream commit db2582afa7444a0ce6bb1ebf1431715969a10b06 ]
+
+This patch adds support for ALS on the Zenbook UX430UQ to the asus_nb_wmi
+driver. It also renames "quirk_asus_ux330uak" to "quirk_asus_forceals"
+because it is now used for more than one model of computer, and should
+thus have a more general name.
+
+Signed-off-by: Kiernan Hager <kah.listaddress@gmail.com>
+[andy: massaged commit message, fixed indentation and commas in the code]
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 9c4b0d7f15c3b..b6f2ff95c3ed9 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -111,7 +111,7 @@ static struct quirk_entry quirk_asus_x550lb = {
+ .xusb2pr = 0x01D9,
+ };
+
+-static struct quirk_entry quirk_asus_ux330uak = {
++static struct quirk_entry quirk_asus_forceals = {
+ .wmi_force_als_set = true,
+ };
+
+@@ -387,7 +387,7 @@ static const struct dmi_system_id asus_quirks[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "UX330UAK"),
+ },
+- .driver_data = &quirk_asus_ux330uak,
++ .driver_data = &quirk_asus_forceals,
+ },
+ {
+ .callback = dmi_matched,
+@@ -398,6 +398,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_x550lb,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUSTeK COMPUTER INC. UX430UQ",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "UX430UQ"),
++ },
++ .driver_data = &quirk_asus_forceals,
++ },
+ {},
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 5e4e96b1cbdaeebbf9a33799e5f2ad205277627a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 09:02:02 +0200
+Subject: platform/x86: asus-wmi: Only Tell EC the OS will handle display
+ hotkeys from asus_nb_wmi
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 401fee8195d401b2b94dee57383f627050724d5b ]
+
+Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will
+handle the display off hotkey") causes the backlight to be permanently off
+on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC
+1015BX, Asus EeePC 1025C).
+
+The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added
+by that commit is made conditional in this commit and only enabled in
+the quirk_entry structs in the asus-nb-wmi driver fixing the broken
+display / backlight on various EeePC laptop models.
+
+Cc: João Paulo Rechi Vita <jprvita@endlessm.com>
+Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++
+ drivers/platform/x86/asus-wmi.c | 2 +-
+ drivers/platform/x86/asus-wmi.h | 1 +
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index b6f2ff95c3ed9..59f3a37a44d7a 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,
+
+ static struct quirk_entry quirk_asus_unknown = {
+ .wapf = 0,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_q500a = {
+ .i8042_filter = asus_q500a_i8042_filter,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ /*
+@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = {
+ static struct quirk_entry quirk_asus_x55u = {
+ .wapf = 4,
+ .wmi_backlight_power = true,
++ .wmi_backlight_set_devstate = true,
+ .no_display_toggle = true,
+ };
+
+ static struct quirk_entry quirk_asus_wapf4 = {
+ .wapf = 4,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_x200ca = {
+ .wapf = 2,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_ux303ub = {
+ .wmi_backlight_native = true,
++ .wmi_backlight_set_devstate = true,
+ };
+
+ static struct quirk_entry quirk_asus_x550lb = {
++ .wmi_backlight_set_devstate = true,
+ .xusb2pr = 0x01D9,
+ };
+
+ static struct quirk_entry quirk_asus_forceals = {
++ .wmi_backlight_set_devstate = true,
+ .wmi_force_als_set = true,
+ };
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 3f662cd774d7a..1c1999600717c 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -2147,7 +2147,7 @@ static int asus_wmi_add(struct platform_device *pdev)
+ err = asus_wmi_backlight_init(asus);
+ if (err && err != -ENODEV)
+ goto fail_backlight;
+- } else
++ } else if (asus->driver->quirks->wmi_backlight_set_devstate)
+ err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
+
+ status = wmi_install_notify_handler(asus->driver->event_guid,
+diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
+index 6c1311f4b04de..57a79bddb2861 100644
+--- a/drivers/platform/x86/asus-wmi.h
++++ b/drivers/platform/x86/asus-wmi.h
+@@ -44,6 +44,7 @@ struct quirk_entry {
+ bool store_backlight_power;
+ bool wmi_backlight_power;
+ bool wmi_backlight_native;
++ bool wmi_backlight_set_devstate;
+ bool wmi_force_als_set;
+ int wapf;
+ /*
+--
+2.20.1
+
--- /dev/null
+From 68cafd71c67a1ed532269e01e4b2c6879d1dab08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 16:38:15 +0200
+Subject: PM / Domains: Deal with multiple states but no governor in genpd
+
+From: Ulf Hansson <ulf.hansson@linaro.org>
+
+[ Upstream commit 2c9b7f8772033cc8bafbd4eefe2ca605bf3eb094 ]
+
+A caller of pm_genpd_init() that provides some states for the genpd via the
+->states pointer in the struct generic_pm_domain, should also provide a
+governor. This because it's the job of the governor to pick a state that
+satisfies the constraints.
+
+Therefore, let's print a warning to inform the user about such bogus
+configuration and avoid to bail out, by instead picking the shallowest
+state before genpd invokes the ->power_off() callback.
+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Lina Iyer <ilina@codeaurora.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index c276ba1c0a19e..e811f24148897 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -369,6 +369,10 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on,
+ return -EAGAIN;
+ }
+
++ /* Default to shallowest state. */
++ if (!genpd->gov)
++ genpd->state_idx = 0;
++
+ if (genpd->power_off) {
+ int ret;
+
+@@ -1598,6 +1602,8 @@ int pm_genpd_init(struct generic_pm_domain *genpd,
+ ret = genpd_set_default_power_state(genpd);
+ if (ret)
+ return ret;
++ } else if (!gov) {
++ pr_warn("%s : no governor for states\n", genpd->name);
+ }
+
+ mutex_lock(&gpd_list_lock);
+--
+2.20.1
+
--- /dev/null
+From 982ece7f4857eaeacc97feb67a1e85099bf98f43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 13:15:22 +1030
+Subject: powerpc/boot: Disable vector instructions
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit e8e132e6885962582784b6fa16a80d07ea739c0f ]
+
+This will avoid auto-vectorisation when building with higher
+optimisation levels.
+
+We don't know if the machine can support VSX and even if it's present
+it's probably not going to be enabled at this point in boot.
+
+These flag were both added prior to GCC 4.6 which is the minimum
+compiler version supported by upstream, thanks to Segher for the
+details.
+
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
+index e2a5a932c24a8..5807c9d8e56d5 100644
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -24,8 +24,8 @@ compress-$(CONFIG_KERNEL_GZIP) := CONFIG_KERNEL_GZIP
+ compress-$(CONFIG_KERNEL_XZ) := CONFIG_KERNEL_XZ
+
+ BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+- -fno-strict-aliasing -Os -msoft-float -pipe \
+- -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
++ -fno-strict-aliasing -Os -msoft-float -mno-altivec -mno-vsx \
++ -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
+ -D$(compress-y)
+
+ BOOTCC := $(CC)
+--
+2.20.1
+
--- /dev/null
+From cd74573638d5fe003367994fc781146c3898803a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 11:23:22 +1000
+Subject: powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 473af09b56dc4be68e4af33220ceca6be67aa60d ]
+
+eeh_add_to_parent_pe() sometimes removes the EEH_PE_KEEP flag, but it
+incorrectly removes it from pe->type, instead of pe->state.
+
+However, rather than clearing it from the correct field, remove it.
+Inspection of the code shows that it can't ever have had any effect
+(even if it had been cleared from the correct field), because the
+field is never tested after it is cleared by the statement in
+question.
+
+The clear statement was added by commit 807a827d4e74 ("powerpc/eeh:
+Keep PE during hotplug"), but it didn't explain why it was necessary.
+
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_pe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
+index 8545a9523b9bc..7339ca4fdc19e 100644
+--- a/arch/powerpc/kernel/eeh_pe.c
++++ b/arch/powerpc/kernel/eeh_pe.c
+@@ -381,7 +381,7 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
+ while (parent) {
+ if (!(parent->type & EEH_PE_INVALID))
+ break;
+- parent->type &= ~(EEH_PE_INVALID | EEH_PE_KEEP);
++ parent->type &= ~EEH_PE_INVALID;
+ parent = parent->parent;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0a9e6c4d03503719b978fec54d0e04d05a2e4060 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 19:44:58 +0300
+Subject: powerpc: Fix signedness bug in update_flash_db()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 014704e6f54189a203cc14c7c0bb411b940241bc ]
+
+The "count < sizeof(struct os_area_db)" comparison is type promoted to
+size_t so negative values of "count" are treated as very high values
+and we accidentally return success instead of a negative error code.
+
+This doesn't really change runtime much but it fixes a static checker
+warning.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Geoff Levand <geoff@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/ps3/os-area.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/ps3/os-area.c b/arch/powerpc/platforms/ps3/os-area.c
+index 3db53e8aff927..9b2ef76578f06 100644
+--- a/arch/powerpc/platforms/ps3/os-area.c
++++ b/arch/powerpc/platforms/ps3/os-area.c
+@@ -664,7 +664,7 @@ static int update_flash_db(void)
+ db_set_64(db, &os_area_db_id_rtc_diff, saved_params.rtc_diff);
+
+ count = os_area_flash_write(db, sizeof(struct os_area_db), pos);
+- if (count < sizeof(struct os_area_db)) {
++ if (count < 0 || count < sizeof(struct os_area_db)) {
+ pr_debug("%s: os_area_flash_write failed %zd\n", __func__,
+ count);
+ error = count < 0 ? count : -EIO;
+--
+2.20.1
+
--- /dev/null
+From d2513898f065f7bd854415597a9c2153e21f562f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Oct 2018 10:57:22 -0300
+Subject: powerpc/process: Fix flush_all_to_thread for SPE
+
+From: Felipe Rechia <felipe.rechia@datacom.com.br>
+
+[ Upstream commit e901378578c62202594cba0f6c076f3df365ec91 ]
+
+Fix a bug introduced by the creation of flush_all_to_thread() for
+processors that have SPE (Signal Processing Engine) and use it to
+compute floating-point operations.
+
+>From userspace perspective, the problem was seen in attempts of
+computing floating-point operations which should generate exceptions.
+For example:
+
+ fork();
+ float x = 0.0 / 0.0;
+ isnan(x); // forked process returns False (should be True)
+
+The operation above also should always cause the SPEFSCR FINV bit to
+be set. However, the SPE floating-point exceptions were turned off
+after a fork().
+
+Kernel versions prior to the bug used flush_spe_to_thread(), which
+first saves SPEFSCR register values in tsk->thread and then calls
+giveup_spe(tsk).
+
+After commit 579e633e764e, the save_all() function was called first
+to giveup_spe(), and then the SPEFSCR register values were saved in
+tsk->thread. This would save the SPEFSCR register values after
+disabling SPE for that thread, causing the bug described above.
+
+Fixes 579e633e764e ("powerpc: create flush_all_to_thread()")
+Signed-off-by: Felipe Rechia <felipe.rechia@datacom.com.br>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/process.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index 5e5da2073fdff..ba0d4f9a99bac 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -567,12 +567,11 @@ void flush_all_to_thread(struct task_struct *tsk)
+ if (tsk->thread.regs) {
+ preempt_disable();
+ BUG_ON(tsk != current);
+- save_all(tsk);
+-
+ #ifdef CONFIG_SPE
+ if (tsk->thread.regs->msr & MSR_SPE)
+ tsk->thread.spefscr = mfspr(SPRN_SPEFSCR);
+ #endif
++ save_all(tsk);
+
+ preempt_enable();
+ }
+--
+2.20.1
+
--- /dev/null
+From 9fea857ba69266a58a87ee426a10669476348cdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 17:20:05 +0530
+Subject: powerpc/pseries: Export raw per-CPU VPA data via debugfs
+
+From: Aravinda Prasad <aravinda@linux.vnet.ibm.com>
+
+[ Upstream commit c6c26fb55e8e4b3fc376be5611685990a17de27a ]
+
+This patch exports the raw per-CPU VPA data via debugfs.
+A per-CPU file is created which exports the VPA data of
+that CPU to help debug some of the VPA related issues or
+to analyze the per-CPU VPA related statistics.
+
+v3: Removed offline CPU check.
+
+v2: Included offline CPU check and other review comments.
+
+Signed-off-by: Aravinda Prasad <aravinda@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/lpar.c | 54 +++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index eb738ef577926..c0ae3847b8db5 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -48,6 +48,7 @@
+ #include <asm/kexec.h>
+ #include <asm/fadump.h>
+ #include <asm/asm-prototypes.h>
++#include <asm/debugfs.h>
+
+ #include "pseries.h"
+
+@@ -1036,3 +1037,56 @@ static int __init reserve_vrma_context_id(void)
+ return 0;
+ }
+ machine_device_initcall(pseries, reserve_vrma_context_id);
++
++#ifdef CONFIG_DEBUG_FS
++/* debugfs file interface for vpa data */
++static ssize_t vpa_file_read(struct file *filp, char __user *buf, size_t len,
++ loff_t *pos)
++{
++ int cpu = (long)filp->private_data;
++ struct lppaca *lppaca = &lppaca_of(cpu);
++
++ return simple_read_from_buffer(buf, len, pos, lppaca,
++ sizeof(struct lppaca));
++}
++
++static const struct file_operations vpa_fops = {
++ .open = simple_open,
++ .read = vpa_file_read,
++ .llseek = default_llseek,
++};
++
++static int __init vpa_debugfs_init(void)
++{
++ char name[16];
++ long i;
++ static struct dentry *vpa_dir;
++
++ if (!firmware_has_feature(FW_FEATURE_SPLPAR))
++ return 0;
++
++ vpa_dir = debugfs_create_dir("vpa", powerpc_debugfs_root);
++ if (!vpa_dir) {
++ pr_warn("%s: can't create vpa root dir\n", __func__);
++ return -ENOMEM;
++ }
++
++ /* set up the per-cpu vpa file*/
++ for_each_possible_cpu(i) {
++ struct dentry *d;
++
++ sprintf(name, "cpu-%ld", i);
++
++ d = debugfs_create_file(name, 0400, vpa_dir, (void *)i,
++ &vpa_fops);
++ if (!d) {
++ pr_warn("%s: can't create per-cpu vpa file\n",
++ __func__);
++ return -ENOMEM;
++ }
++ }
++
++ return 0;
++}
++machine_arch_initcall(pseries, vpa_debugfs_init);
++#endif /* CONFIG_DEBUG_FS */
+--
+2.20.1
+
--- /dev/null
+From a48a5b2cbe37de0b257d6c21a493a770ee512a6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 11:39:34 +1030
+Subject: powerpc/xmon: Relax frame size for clang
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 9c87156cce5a63735d1218f0096a65c50a7a32aa ]
+
+When building with clang (8 trunk, 7.0 release) the frame size limit is
+hit:
+
+ arch/powerpc/xmon/xmon.c:452:12: warning: stack frame size of 2576
+ bytes in function 'xmon_core' [-Wframe-larger-than=]
+
+Some investigation by Naveen indicates this is due to clang saving the
+addresses to printf format strings on the stack.
+
+While this issue is investigated, bump up the frame size limit for xmon
+when building with clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/252
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/Makefile | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/xmon/Makefile b/arch/powerpc/xmon/Makefile
+index 549e99e71112b..ac5ee067aa512 100644
+--- a/arch/powerpc/xmon/Makefile
++++ b/arch/powerpc/xmon/Makefile
+@@ -13,6 +13,12 @@ UBSAN_SANITIZE := n
+ ORIG_CFLAGS := $(KBUILD_CFLAGS)
+ KBUILD_CFLAGS = $(subst -mno-sched-epilog,,$(subst $(CC_FLAGS_FTRACE),,$(ORIG_CFLAGS)))
+
++ifdef CONFIG_CC_IS_CLANG
++# clang stores addresses on the stack causing the frame size to blow
++# out. See https://github.com/ClangBuiltLinux/linux/issues/252
++KBUILD_CFLAGS += -Wframe-larger-than=4096
++endif
++
+ ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC)
+
+ obj-y += xmon.o nonstdio.o spr_access.o
+--
+2.20.1
+
--- /dev/null
+From f899f97d368483659760a128e108f80812707f22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Oct 2018 20:33:08 +0900
+Subject: printk: fix integer overflow in setup_log_buf()
+
+From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+
+[ Upstream commit d2130e82e9454304e9b91ba9da551b5989af8c27 ]
+
+The way we calculate logbuf free space percentage overflows signed
+integer:
+
+ int free;
+
+ free = __LOG_BUF_LEN - log_next_idx;
+ pr_info("early log buf free: %u(%u%%)\n",
+ free, (free * 100) / __LOG_BUF_LEN);
+
+We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is
+called during early init, logbuf is mostly empty, so
+
+ __LOG_BUF_LEN - log_next_idx
+
+is close to 1<<25. Thus when we multiply it by 100, we overflow signed
+integer value range: 100 is 2^6 + 2^5 + 2^2.
+
+Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G
+boot param:
+
+[ 0.075317] log_buf_len: -2147483648 bytes
+[ 0.075319] early log buf free: 33549896(-28%)
+
+Make "free" unsigned integer and use appropriate printk() specifier.
+
+Link: http://lkml.kernel.org/r/20181010113308.9337-1-sergey.senozhatsky@gmail.com
+To: Steven Rostedt <rostedt@goodmis.org>
+Cc: linux-kernel@vger.kernel.org
+Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 5b33c14ab8b25..4e50beb162c00 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1099,7 +1099,7 @@ void __init setup_log_buf(int early)
+ {
+ unsigned long flags;
+ char *new_log_buf;
+- int free;
++ unsigned int free;
+
+ if (log_buf != __log_buf)
+ return;
+--
+2.20.1
+
--- /dev/null
+From cb509cd54a769c5e6b535e3675963f443e54c72e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 20:53:46 -0400
+Subject: pty: fix compat ioctls
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 50f45326afab723df529eca54095e2feac24da2d ]
+
+pointer-taking ones need compat_ptr(); int-taking one doesn't.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/pty.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index 9e26c530d2ddb..b3208b1b1028d 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -28,6 +28,7 @@
+ #include <linux/mount.h>
+ #include <linux/file.h>
+ #include <linux/ioctl.h>
++#include <linux/compat.h>
+
+ #undef TTY_DEBUG_HANGUP
+ #ifdef TTY_DEBUG_HANGUP
+@@ -488,6 +489,7 @@ static int pty_bsd_ioctl(struct tty_struct *tty,
+ return -ENOIOCTLCMD;
+ }
+
++#ifdef CONFIG_COMPAT
+ static long pty_bsd_compat_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -495,8 +497,11 @@ static long pty_bsd_compat_ioctl(struct tty_struct *tty,
+ * PTY ioctls don't require any special translation between 32-bit and
+ * 64-bit userspace, they are already compatible.
+ */
+- return pty_bsd_ioctl(tty, cmd, arg);
++ return pty_bsd_ioctl(tty, cmd, (unsigned long)compat_ptr(arg));
+ }
++#else
++#define pty_bsd_compat_ioctl NULL
++#endif
+
+ static int legacy_count = CONFIG_LEGACY_PTY_COUNT;
+ /*
+@@ -676,6 +681,7 @@ static int pty_unix98_ioctl(struct tty_struct *tty,
+ return -ENOIOCTLCMD;
+ }
+
++#ifdef CONFIG_COMPAT
+ static long pty_unix98_compat_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -683,8 +689,12 @@ static long pty_unix98_compat_ioctl(struct tty_struct *tty,
+ * PTY ioctls don't require any special translation between 32-bit and
+ * 64-bit userspace, they are already compatible.
+ */
+- return pty_unix98_ioctl(tty, cmd, arg);
++ return pty_unix98_ioctl(tty, cmd,
++ cmd == TIOCSIG ? arg : (unsigned long)compat_ptr(arg));
+ }
++#else
++#define pty_unix98_compat_ioctl NULL
++#endif
+
+ /**
+ * ptm_unix98_lookup - find a pty master
+--
+2.20.1
+
--- /dev/null
+From 5b831804143246555ab93eef84975de1b23c4198 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Oct 2018 17:12:02 +0200
+Subject: pwm: lpss: Only set update bit if we are actually changing the
+ settings
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 2153bbc12f77fb2203276befc0f0dddbfb023bb1 ]
+
+According to the datasheet the update bit must be set if the on-time-div
+or the base-unit changes.
+
+Now that we properly order device resume on Cherry Trail so that the GFX0
+_PS0 method no longer exits with an error, we end up with a sequence of
+events where we are writing the same values twice in a row.
+
+First the _PS0 method restores the duty cycle of 0% the GPU driver set
+on suspend and then the GPU driver first updates just the enabled bit in
+the pwm_state from 0 to 1, causing us to write the same values again,
+before restoring the pre-suspend duty-cycle in a separate pwm_apply call.
+
+When writing the update bit the second time, without changing any of
+the values the update bit clears immediately / instantly, instead of
+staying 1 for a while as usual. After this the next setting of the update
+bit seems to be ignored, causing the restoring of the pre-suspend
+duty-cycle to not get applied. This makes the backlight come up with
+a 0% dutycycle after suspend/resume.
+
+Any further brightness changes after this do work.
+
+This commit moves the setting of the update bit into pwm_lpss_prepare()
+and only sets the bit if we have actually changed any of the values.
+
+This avoids the setting of the update bit the second time we configure
+the PWM to 0% dutycycle, this fixes the backlight coming up with 0%
+duty-cycle after a suspend/resume.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lpss.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 4721a264bac25..1e69c1c9ec096 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -97,7 +97,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
+ unsigned long long on_time_div;
+ unsigned long c = lpwm->info->clk_rate, base_unit_range;
+ unsigned long long base_unit, freq = NSEC_PER_SEC;
+- u32 ctrl;
++ u32 orig_ctrl, ctrl;
+
+ do_div(freq, period_ns);
+
+@@ -114,13 +114,17 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
+ do_div(on_time_div, period_ns);
+ on_time_div = 255ULL - on_time_div;
+
+- ctrl = pwm_lpss_read(pwm);
++ orig_ctrl = ctrl = pwm_lpss_read(pwm);
+ ctrl &= ~PWM_ON_TIME_DIV_MASK;
+ ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT);
+ base_unit &= base_unit_range;
+ ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT;
+ ctrl |= on_time_div;
+- pwm_lpss_write(pwm, ctrl);
++
++ if (orig_ctrl != ctrl) {
++ pwm_lpss_write(pwm, ctrl);
++ pwm_lpss_write(pwm, ctrl | PWM_SW_UPDATE);
++ }
+ }
+
+ static inline void pwm_lpss_cond_enable(struct pwm_device *pwm, bool cond)
+@@ -144,7 +148,6 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ return ret;
+ }
+ pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
+- pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+ pwm_lpss_cond_enable(pwm, lpwm->info->bypass == false);
+ ret = pwm_lpss_wait_for_update(pwm);
+ if (ret) {
+@@ -157,7 +160,6 @@ static int pwm_lpss_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (ret)
+ return ret;
+ pwm_lpss_prepare(lpwm, pwm, state->duty_cycle, state->period);
+- pwm_lpss_write(pwm, pwm_lpss_read(pwm) | PWM_SW_UPDATE);
+ return pwm_lpss_wait_for_update(pwm);
+ }
+ } else if (pwm_is_enabled(pwm)) {
+--
+2.20.1
+
--- /dev/null
+From 82bf0f78a9b0112e2d8c4d294ae0ce783d437f73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 03:59:18 -0700
+Subject: qed: Align local and global PTT to propagate through the APIs.
+
+From: Rahul Verma <Rahul.Verma@cavium.com>
+
+[ Upstream commit 706d08913d1f68610c32b4a001026aa989878dd9 ]
+
+ Align the use of local PTT to propagate through the qed_mcp* API's.
+ Global ptt should not be used.
+
+ Register access should be done through layers. Register address is
+ mapped into a PTT, PF translation table. Several interface functions
+ require a PTT to direct read/write into register. There is a pool of
+ PTT maintained, and several PTT are used simultaneously to access
+ device registers in different flows. Same PTT should not be used in
+ flows that can run concurrently.
+ To avoid running out of PTT resources, too many PTT should not be
+ acquired without releasing them. Every PF has a global PTT, which is
+ used throughout the life of PF, in most important flows for register
+ access. Generic functions acquire the PTT locally and release after
+ the use. This patch aligns the use of Global PTT and Local PTT
+ accordingly.
+
+Signed-off-by: Rahul Verma <rahul.verma@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed.h | 2 +-
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 22 ++++++++++++++----
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 27 ++++++++++------------
+ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 5 ++--
+ drivers/net/ethernet/qlogic/qed/qed_vf.c | 2 +-
+ 5 files changed, 35 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
+index 91003bc6f00bd..6c4714a8b54ce 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed.h
++++ b/drivers/net/ethernet/qlogic/qed/qed.h
+@@ -829,7 +829,7 @@ u16 qed_get_cm_pq_idx_vf(struct qed_hwfn *p_hwfn, u16 vf);
+ /* Prototypes */
+ int qed_fill_dev_info(struct qed_dev *cdev,
+ struct qed_dev_info *dev_info);
+-void qed_link_update(struct qed_hwfn *hwfn);
++void qed_link_update(struct qed_hwfn *hwfn, struct qed_ptt *ptt);
+ u32 qed_unzip_data(struct qed_hwfn *p_hwfn,
+ u32 input_len, u8 *input_buf,
+ u32 max_size, u8 *unzip_buf);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 557332f1f886c..52e747fd9c839 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1389,6 +1389,7 @@ static int qed_get_link_data(struct qed_hwfn *hwfn,
+ }
+
+ static void qed_fill_link(struct qed_hwfn *hwfn,
++ struct qed_ptt *ptt,
+ struct qed_link_output *if_link)
+ {
+ struct qed_mcp_link_params params;
+@@ -1469,7 +1470,7 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
+
+ /* TODO - fill duplex properly */
+ if_link->duplex = DUPLEX_FULL;
+- qed_mcp_get_media_type(hwfn->cdev, &media_type);
++ qed_mcp_get_media_type(hwfn, ptt, &media_type);
+ if_link->port = qed_get_port_type(media_type);
+
+ if_link->autoneg = params.speed.autoneg;
+@@ -1525,21 +1526,34 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
+ static void qed_get_current_link(struct qed_dev *cdev,
+ struct qed_link_output *if_link)
+ {
++ struct qed_hwfn *hwfn;
++ struct qed_ptt *ptt;
+ int i;
+
+- qed_fill_link(&cdev->hwfns[0], if_link);
++ hwfn = &cdev->hwfns[0];
++ if (IS_PF(cdev)) {
++ ptt = qed_ptt_acquire(hwfn);
++ if (ptt) {
++ qed_fill_link(hwfn, ptt, if_link);
++ qed_ptt_release(hwfn, ptt);
++ } else {
++ DP_NOTICE(hwfn, "Failed to fill link; No PTT\n");
++ }
++ } else {
++ qed_fill_link(hwfn, NULL, if_link);
++ }
+
+ for_each_hwfn(cdev, i)
+ qed_inform_vf_link_state(&cdev->hwfns[i]);
+ }
+
+-void qed_link_update(struct qed_hwfn *hwfn)
++void qed_link_update(struct qed_hwfn *hwfn, struct qed_ptt *ptt)
+ {
+ void *cookie = hwfn->cdev->ops_cookie;
+ struct qed_common_cb_ops *op = hwfn->cdev->protocol_ops.common;
+ struct qed_link_output if_link;
+
+- qed_fill_link(hwfn, &if_link);
++ qed_fill_link(hwfn, ptt, &if_link);
+ qed_inform_vf_link_state(hwfn);
+
+ if (IS_LEAD_HWFN(hwfn) && cookie)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+index 7938abe9a3010..ef17ca09d3038 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -1352,7 +1352,7 @@ static void qed_mcp_handle_link_change(struct qed_hwfn *p_hwfn,
+ if (p_hwfn->mcp_info->capabilities & FW_MB_PARAM_FEATURE_SUPPORT_EEE)
+ qed_mcp_read_eee_config(p_hwfn, p_ptt, p_link);
+
+- qed_link_update(p_hwfn);
++ qed_link_update(p_hwfn, p_ptt);
+ out:
+ spin_unlock_bh(&p_hwfn->mcp_info->link_lock);
+ }
+@@ -1722,12 +1722,10 @@ int qed_mcp_get_mbi_ver(struct qed_hwfn *p_hwfn,
+ return 0;
+ }
+
+-int qed_mcp_get_media_type(struct qed_dev *cdev, u32 *p_media_type)
++int qed_mcp_get_media_type(struct qed_hwfn *p_hwfn,
++ struct qed_ptt *p_ptt, u32 *p_media_type)
+ {
+- struct qed_hwfn *p_hwfn = &cdev->hwfns[0];
+- struct qed_ptt *p_ptt;
+-
+- if (IS_VF(cdev))
++ if (IS_VF(p_hwfn->cdev))
+ return -EINVAL;
+
+ if (!qed_mcp_is_init(p_hwfn)) {
+@@ -1735,16 +1733,15 @@ int qed_mcp_get_media_type(struct qed_dev *cdev, u32 *p_media_type)
+ return -EBUSY;
+ }
+
+- *p_media_type = MEDIA_UNSPECIFIED;
+-
+- p_ptt = qed_ptt_acquire(p_hwfn);
+- if (!p_ptt)
+- return -EBUSY;
+-
+- *p_media_type = qed_rd(p_hwfn, p_ptt, p_hwfn->mcp_info->port_addr +
+- offsetof(struct public_port, media_type));
++ if (!p_ptt) {
++ *p_media_type = MEDIA_UNSPECIFIED;
++ return -EINVAL;
++ }
+
+- qed_ptt_release(p_hwfn, p_ptt);
++ *p_media_type = qed_rd(p_hwfn, p_ptt,
++ p_hwfn->mcp_info->port_addr +
++ offsetof(struct public_port,
++ media_type));
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.h b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+index f1fe5e3427ea5..8fcdb2c3e5dba 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+@@ -284,14 +284,15 @@ int qed_mcp_get_mbi_ver(struct qed_hwfn *p_hwfn,
+ * @brief Get media type value of the port.
+ *
+ * @param cdev - qed dev pointer
++ * @param p_ptt
+ * @param mfw_ver - media type value
+ *
+ * @return int -
+ * 0 - Operation was successul.
+ * -EBUSY - Operation failed
+ */
+-int qed_mcp_get_media_type(struct qed_dev *cdev,
+- u32 *media_type);
++int qed_mcp_get_media_type(struct qed_hwfn *p_hwfn,
++ struct qed_ptt *p_ptt, u32 *media_type);
+
+ /**
+ * @brief General function for sending commands to the MCP
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_vf.c b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+index 3220086f99dea..a2a9921b467b1 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -1669,7 +1669,7 @@ static void qed_handle_bulletin_change(struct qed_hwfn *hwfn)
+ ops->ports_update(cookie, vxlan_port, geneve_port);
+
+ /* Always update link configuration according to bulletin */
+- qed_link_update(hwfn);
++ qed_link_update(hwfn, NULL);
+ }
+
+ void qed_iov_vf_task(struct work_struct *work)
+--
+2.20.1
+
--- /dev/null
+From ba0012320603056662ea815deac0eb97e17e78f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 23:11:11 +0300
+Subject: qlcnic: fix a return in qlcnic_dcb_get_capability()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c94f026fb742b2d3199422751dbc4f6fc0e753d8 ]
+
+These functions are supposed to return one on failure and zero on
+success. Returning a zero here could cause uninitialized variable
+bugs in several of the callers. For example:
+
+ drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:1660 get_iscsi_dcb_priority()
+ error: uninitialized symbol 'caps'.
+
+Fixes: 48365e485275 ("qlcnic: dcb: Add support for CEE Netlink interface.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+index 4b76c69fe86d2..834208e55f7b8 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
+@@ -883,7 +883,7 @@ static u8 qlcnic_dcb_get_capability(struct net_device *netdev, int capid,
+ struct qlcnic_adapter *adapter = netdev_priv(netdev);
+
+ if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
+- return 0;
++ return 1;
+
+ switch (capid) {
+ case DCB_CAP_ATTR_PG:
+--
+2.20.1
+
--- /dev/null
+From 68affcf36e4f44df62ae11e53187752fb3fe57ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 03:28:01 -0700
+Subject: RDMA/bnxt_re: Fix qp async event reporting
+
+From: Devesh Sharma <devesh.sharma@broadcom.com>
+
+[ Upstream commit 4c01f2e3a906a0d2d798be5751c331cf501bc129 ]
+
+Reports affiliated async event on the qp-async event channel instead of
+global event channel.
+
+Signed-off-by: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index bf811b23bc953..7d00b6a53ed8c 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -782,12 +782,17 @@ static void bnxt_re_dispatch_event(struct ib_device *ibdev, struct ib_qp *qp,
+ struct ib_event ib_event;
+
+ ib_event.device = ibdev;
+- if (qp)
++ if (qp) {
+ ib_event.element.qp = qp;
+- else
++ ib_event.event = event;
++ if (qp->event_handler)
++ qp->event_handler(&ib_event, qp->qp_context);
++
++ } else {
+ ib_event.element.port_num = port_num;
+- ib_event.event = event;
+- ib_dispatch_event(&ib_event);
++ ib_event.event = event;
++ ib_dispatch_event(&ib_event);
++ }
+ }
+
+ #define HWRM_QUEUE_PRI2COS_QCFG_INPUT_FLAGS_IVLAN 0x02
+--
+2.20.1
+
--- /dev/null
+From bda5a66401c1a239c6044d02ddd6ddee07994d6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 13:43:45 -0700
+Subject: rtc: s35390a: Change buf's type to u8 in s35390a_init
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit ef0f02fd69a02b50e468a4ddbe33e3d81671e248 ]
+
+Clang warns:
+
+drivers/rtc/rtc-s35390a.c:124:27: warning: implicit conversion from
+'int' to 'char' changes value from 192 to -64 [-Wconstant-conversion]
+ buf = S35390A_FLAG_RESET | S35390A_FLAG_24H;
+ ~ ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~
+1 warning generated.
+
+Update buf to be an unsigned 8-bit integer, which matches the buf member
+in struct i2c_msg.
+
+https://github.com/ClangBuiltLinux/linux/issues/145
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-s35390a.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
+index 7067bca5c20d9..6bfff0a6d6552 100644
+--- a/drivers/rtc/rtc-s35390a.c
++++ b/drivers/rtc/rtc-s35390a.c
+@@ -108,7 +108,7 @@ static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len)
+
+ static int s35390a_init(struct s35390a *s35390a)
+ {
+- char buf;
++ u8 buf;
+ int ret;
+ unsigned initcount = 0;
+
+--
+2.20.1
+
--- /dev/null
+From dd8fe4720ee3f4a7172ef0e1cf1496015f79265f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Oct 2018 13:51:03 +0200
+Subject: rtl8xxxu: Fix missing break in switch
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 307b00c5e695857ca92fc6a4b8ab6c48f988a1b1 ]
+
+Add missing break statement in order to prevent the code from falling
+through to the default case.
+
+Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 7806a4d2b1fcd..91b01ca32e752 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -5691,6 +5691,7 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ break;
+ case WLAN_CIPHER_SUITE_TKIP:
+ key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
++ break;
+ default:
+ return -EOPNOTSUPP;
+ }
+--
+2.20.1
+
--- /dev/null
+From 274d473776760d903d86022b51e317fcff40f5b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 19:25:30 +0800
+Subject: rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information
+
+From: Shaokun Zhang <zhangshaokun@hisilicon.com>
+
+[ Upstream commit 7d129adff3afbd3a449bc3593f2064ac546d58d3 ]
+
+RT_TRACE shows REG_MCUFWDL value as a decimal value with a '0x'
+prefix, which is somewhat misleading.
+
+Fix it to print hexadecimal, as was intended.
+
+Cc: Ping-Ke Shih <pkshih@realtek.com>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
+index f4129cf96e7cb..bad70a4206fb2 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
+@@ -173,7 +173,7 @@ static int _rtl92d_fw_init(struct ieee80211_hw *hw)
+ rtl_read_byte(rtlpriv, FW_MAC1_READY));
+ }
+ RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG,
+- "Polling FW ready fail!! REG_MCUFWDL:0x%08ul\n",
++ "Polling FW ready fail!! REG_MCUFWDL:0x%08x\n",
+ rtl_read_dword(rtlpriv, REG_MCUFWDL));
+ return -1;
+ }
+--
+2.20.1
+
--- /dev/null
+From 925263fca9348ab9b90cffde1474886054637995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Oct 2018 14:39:29 +0100
+Subject: s390/perf: Return error when debug_register fails
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit ec0c0bb489727de0d4dca6a00be6970ab8a3b30a ]
+
+Return an error when the function debug_register() fails allocating
+the debug handle.
+Also remove the registered debug handle when the initialization fails
+later on.
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index d99155793c26e..2e2fd9535f865 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1610,14 +1610,17 @@ static int __init init_cpum_sampling_pmu(void)
+ }
+
+ sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80);
+- if (!sfdbg)
++ if (!sfdbg) {
+ pr_err("Registering for s390dbf failed\n");
++ return -ENOMEM;
++ }
+ debug_register_view(sfdbg, &debug_sprintf_view);
+
+ err = register_external_irq(EXT_IRQ_MEASURE_ALERT,
+ cpumf_measurement_alert);
+ if (err) {
+ pr_cpumsf_err(RS_INIT_FAILURE_ALRT);
++ debug_unregister(sfdbg);
+ goto out;
+ }
+
+@@ -1626,6 +1629,7 @@ static int __init init_cpum_sampling_pmu(void)
+ pr_cpumsf_err(RS_INIT_FAILURE_PERF);
+ unregister_external_irq(EXT_IRQ_MEASURE_ALERT,
+ cpumf_measurement_alert);
++ debug_unregister(sfdbg);
+ goto out;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 61e0ed61d4e24f23a0de4ee8f5b512ee1e9212b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 16:12:07 +0100
+Subject: sched/fair: Don't increase sd->balance_interval on newidle balance
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 3f130a37c442d5c4d66531b240ebe9abfef426b5 ]
+
+When load_balance() fails to move some load because of task affinity,
+we end up increasing sd->balance_interval to delay the next periodic
+balance in the hopes that next time we look, that annoying pinned
+task(s) will be gone.
+
+However, idle_balance() pays no attention to sd->balance_interval, yet
+it will still lead to an increase in balance_interval in case of
+pinned tasks.
+
+If we're going through several newidle balances (e.g. we have a
+periodic task), this can lead to a huge increase of the
+balance_interval in a very small amount of time.
+
+To prevent that, don't increase the balance interval when going
+through a newidle balance.
+
+This is a similar approach to what is done in commit 58b26c4c0257
+("sched: Increment cache_nice_tries only on periodic lb"), where we
+disregard newidle balance and rely on periodic balance for more stable
+results.
+
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Dietmar.Eggemann@arm.com
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: patrick.bellasi@arm.com
+Cc: vincent.guittot@linaro.org
+Link: http://lkml.kernel.org/r/1537974727-30788-2-git-send-email-valentin.schneider@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index feeb52880d353..67433fbdcb5a4 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -8319,13 +8319,22 @@ static int load_balance(int this_cpu, struct rq *this_rq,
+ sd->nr_balance_failed = 0;
+
+ out_one_pinned:
++ ld_moved = 0;
++
++ /*
++ * idle_balance() disregards balance intervals, so we could repeatedly
++ * reach this code, which would lead to balance_interval skyrocketting
++ * in a short amount of time. Skip the balance_interval increase logic
++ * to avoid that.
++ */
++ if (env.idle == CPU_NEWLY_IDLE)
++ goto out;
++
+ /* tune up the balancing interval */
+ if (((env.flags & LBF_ALL_PINNED) &&
+ sd->balance_interval < MAX_PINNED_INTERVAL) ||
+ (sd->balance_interval < sd->max_interval))
+ sd->balance_interval *= 2;
+-
+- ld_moved = 0;
+ out:
+ return ld_moved;
+ }
+--
+2.20.1
+
--- /dev/null
+From 9c32c4d4d6b0a7bb69ca1c5fc4c2394411796581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Nov 2018 14:22:25 +0100
+Subject: sched/topology: Fix off by one bug
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 993f0b0510dad98b4e6e39506834dab0d13fd539 ]
+
+With the addition of the NUMA identity level, we increased @level by
+one and will run off the end of the array in the distance sort loop.
+
+Fixed: 051f3ca02e46 ("sched/topology: Introduce NUMA identity node sched domain")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 9dcd80ed9d4c1..867d173dab482 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1347,7 +1347,7 @@ void sched_init_numa(void)
+ int level = 0;
+ int i, j, k;
+
+- sched_domains_numa_distance = kzalloc(sizeof(int) * nr_node_ids, GFP_KERNEL);
++ sched_domains_numa_distance = kzalloc(sizeof(int) * (nr_node_ids + 1), GFP_KERNEL);
+ if (!sched_domains_numa_distance)
+ return;
+
+--
+2.20.1
+
--- /dev/null
+From 24eba86df1a5526e4e8b98435849281ee2f0ac0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Oct 2018 16:17:15 +0200
+Subject: scsi: dc395x: fix DMA API usage in sg_update_list
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 6c404a68bf83b4135a8a9aa1c388ebdf98e8ba7f ]
+
+We need to transfer device ownership to the CPU before we can manipulate
+the mapped data.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/dc395x.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 9da0ac360848f..830b2d2dcf206 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -1972,6 +1972,11 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
+ xferred -= psge->length;
+ } else {
+ /* Partial SG entry done */
++ pci_dma_sync_single_for_cpu(srb->dcb->
++ acb->dev,
++ srb->sg_bus_addr,
++ SEGMENTX_LEN,
++ PCI_DMA_TODEVICE);
+ psge->length -= xferred;
+ psge->address += xferred;
+ srb->sg_index = idx;
+--
+2.20.1
+
--- /dev/null
+From 87f2999a9943b27b1905ef0fb2da27dcdb259b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Oct 2018 16:17:14 +0200
+Subject: scsi: dc395x: fix dma API usage in srb_done
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 3a5bd7021184dec2946f2a4d7a8943f8a5713e52 ]
+
+We can't just transfer ownership to the CPU and then unmap, as this will
+break with swiotlb.
+
+Instead unmap the command and sense buffer a little earlier in the I/O
+completion handler and get rid of the pci_dma_sync_sg_for_cpu call
+entirely.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/dc395x.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
+index 5ee7f44cf869b..9da0ac360848f 100644
+--- a/drivers/scsi/dc395x.c
++++ b/drivers/scsi/dc395x.c
+@@ -3450,14 +3450,12 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
+ }
+ }
+
+- if (dir != PCI_DMA_NONE && scsi_sg_count(cmd))
+- pci_dma_sync_sg_for_cpu(acb->dev, scsi_sglist(cmd),
+- scsi_sg_count(cmd), dir);
+-
+ ckc_only = 0;
+ /* Check Error Conditions */
+ ckc_e:
+
++ pci_unmap_srb(acb, srb);
++
+ if (cmd->cmnd[0] == INQUIRY) {
+ unsigned char *base = NULL;
+ struct ScsiInqData *ptr;
+@@ -3511,7 +3509,6 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
+ cmd, cmd->result);
+ srb_free_insert(acb, srb);
+ }
+- pci_unmap_srb(acb, srb);
+
+ cmd->scsi_done(cmd);
+ waiting_process_next(acb);
+--
+2.20.1
+
--- /dev/null
+From 07320180436b1d9bdc520af8af4091aea656660a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 11:12:23 +0200
+Subject: scsi: ips: fix missing break in switch
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 5d25ff7a544889bc4b749fda31778d6a18dddbcb ]
+
+Add missing break statement in order to prevent the code from falling
+through to case TEST_UNIT_READY.
+
+Addresses-Coverity-ID: 1357338 ("Missing break in switch")
+Suggested-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ips.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
+index 67621308eb9ca..ea652f1e2071e 100644
+--- a/drivers/scsi/ips.c
++++ b/drivers/scsi/ips.c
+@@ -3497,6 +3497,7 @@ ips_send_cmd(ips_ha_t * ha, ips_scb_t * scb)
+
+ case START_STOP:
+ scb->scsi_cmd->result = DID_OK << 16;
++ break;
+
+ case TEST_UNIT_READY:
+ case INQUIRY:
+--
+2.20.1
+
--- /dev/null
+From 053a2551e8f4cc6a428f4ddc017c3ef5bf82c4a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:12:00 -0700
+Subject: scsi: isci: Change sci_controller_start_task's return type to
+ sci_status
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 362b5da3dfceada6e74ecdd7af3991bbe42c0c0f ]
+
+Clang warns when an enumerated type is implicitly converted to another.
+
+drivers/scsi/isci/request.c:3476:13: warning: implicit conversion from
+enumeration type 'enum sci_task_status' to different enumeration type
+'enum sci_status' [-Wenum-conversion]
+ status = sci_controller_start_task(ihost,
+ ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/isci/host.c:2744:10: warning: implicit conversion from
+enumeration type 'enum sci_status' to different enumeration type 'enum
+sci_task_status' [-Wenum-conversion]
+ return SCI_SUCCESS;
+ ~~~~~~ ^~~~~~~~~~~
+drivers/scsi/isci/host.c:2753:9: warning: implicit conversion from
+enumeration type 'enum sci_status' to different enumeration type 'enum
+sci_task_status' [-Wenum-conversion]
+ return status;
+ ~~~~~~ ^~~~~~
+
+Avoid all of these implicit conversion by just making
+sci_controller_start_task use sci_status. This silences
+Clang and has no functional change since sci_task_status
+has all of its values mapped to something in sci_status.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/153
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/host.c | 8 ++++----
+ drivers/scsi/isci/host.h | 2 +-
+ drivers/scsi/isci/task.c | 4 ++--
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
+index 609dafd661d14..da4583a2fa23e 100644
+--- a/drivers/scsi/isci/host.c
++++ b/drivers/scsi/isci/host.c
+@@ -2717,9 +2717,9 @@ enum sci_status sci_controller_continue_io(struct isci_request *ireq)
+ * the task management request.
+ * @task_request: the handle to the task request object to start.
+ */
+-enum sci_task_status sci_controller_start_task(struct isci_host *ihost,
+- struct isci_remote_device *idev,
+- struct isci_request *ireq)
++enum sci_status sci_controller_start_task(struct isci_host *ihost,
++ struct isci_remote_device *idev,
++ struct isci_request *ireq)
+ {
+ enum sci_status status;
+
+@@ -2728,7 +2728,7 @@ enum sci_task_status sci_controller_start_task(struct isci_host *ihost,
+ "%s: SCIC Controller starting task from invalid "
+ "state\n",
+ __func__);
+- return SCI_TASK_FAILURE_INVALID_STATE;
++ return SCI_FAILURE_INVALID_STATE;
+ }
+
+ status = sci_remote_device_start_task(ihost, idev, ireq);
+diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
+index b3539928073c6..6bc3f022630a2 100644
+--- a/drivers/scsi/isci/host.h
++++ b/drivers/scsi/isci/host.h
+@@ -489,7 +489,7 @@ enum sci_status sci_controller_start_io(
+ struct isci_remote_device *idev,
+ struct isci_request *ireq);
+
+-enum sci_task_status sci_controller_start_task(
++enum sci_status sci_controller_start_task(
+ struct isci_host *ihost,
+ struct isci_remote_device *idev,
+ struct isci_request *ireq);
+diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
+index 6dcaed0c1fc8c..fb6eba331ac6e 100644
+--- a/drivers/scsi/isci/task.c
++++ b/drivers/scsi/isci/task.c
+@@ -258,7 +258,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost,
+ struct isci_tmf *tmf, unsigned long timeout_ms)
+ {
+ DECLARE_COMPLETION_ONSTACK(completion);
+- enum sci_task_status status = SCI_TASK_FAILURE;
++ enum sci_status status = SCI_FAILURE;
+ struct isci_request *ireq;
+ int ret = TMF_RESP_FUNC_FAILED;
+ unsigned long flags;
+@@ -301,7 +301,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost,
+ /* start the TMF io. */
+ status = sci_controller_start_task(ihost, idev, ireq);
+
+- if (status != SCI_TASK_SUCCESS) {
++ if (status != SCI_SUCCESS) {
+ dev_dbg(&ihost->pdev->dev,
+ "%s: start_io failed - status = 0x%x, request = %p\n",
+ __func__,
+--
+2.20.1
+
--- /dev/null
+From d0aefefe1ad6abcf9c3e3850787d25f9b6eb4958 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 17:11:50 -0700
+Subject: scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit e9e9a103528c7e199ead6e5374c9c52cf16b5802 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/scsi/isci/request.c:1629:13: warning: implicit conversion from
+enumeration type 'enum sci_io_status' to different enumeration type
+'enum sci_status' [-Wenum-conversion]
+ status = SCI_IO_FAILURE_RESPONSE_VALID;
+ ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/isci/request.c:1631:12: warning: implicit conversion from
+enumeration type 'enum sci_io_status' to different enumeration type
+'enum sci_status' [-Wenum-conversion]
+ status = SCI_IO_FAILURE_RESPONSE_VALID;
+ ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+status is of type sci_status but SCI_IO_FAILURE_RESPONSE_VALID is of
+type sci_io_status. Use SCI_FAILURE_IO_RESPONSE_VALID, which is from
+sci_status and has SCI_IO_FAILURE_RESPONSE_VALID's exact value since
+that is what SCI_IO_FAILURE_RESPONSE_VALID is mapped to in the isci.h
+file.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/153
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/request.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
+index ed197bc8e801a..2f151708b59ae 100644
+--- a/drivers/scsi/isci/request.c
++++ b/drivers/scsi/isci/request.c
+@@ -1626,9 +1626,9 @@ static enum sci_status atapi_d2h_reg_frame_handler(struct isci_request *ireq,
+
+ if (status == SCI_SUCCESS) {
+ if (ireq->stp.rsp.status & ATA_ERR)
+- status = SCI_IO_FAILURE_RESPONSE_VALID;
++ status = SCI_FAILURE_IO_RESPONSE_VALID;
+ } else {
+- status = SCI_IO_FAILURE_RESPONSE_VALID;
++ status = SCI_FAILURE_IO_RESPONSE_VALID;
+ }
+
+ if (status != SCI_SUCCESS) {
+--
+2.20.1
+
--- /dev/null
+From cf5633dfc4e61f863687791be96f1bb3343f71e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 18:06:15 -0700
+Subject: scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 20054597f169090109fc3f0dfa1a48583f4178a4 ]
+
+Clang warns when one enumerated type is implicitly converted to another.
+
+drivers/scsi/iscsi_tcp.c:803:15: warning: implicit conversion from
+enumeration type 'enum iscsi_host_param' to different enumeration type
+'enum iscsi_param' [-Wenum-conversion]
+ &addr, param, buf);
+ ^~~~~
+1 warning generated.
+
+iscsi_conn_get_addr_param handles ISCSI_HOST_PARAM_IPADDRESS just fine
+so add an explicit cast to iscsi_param to make it clear to Clang that
+this is expected behavior.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/153
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/iscsi_tcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index e11eff6b0e97d..045207b5560eb 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -798,7 +798,8 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
+ return rc;
+
+ return iscsi_conn_get_addr_param((struct sockaddr_storage *)
+- &addr, param, buf);
++ &addr,
++ (enum iscsi_param)param, buf);
+ default:
+ return iscsi_host_get_param(shost, param, buf);
+ }
+--
+2.20.1
+
--- /dev/null
+From a8220e90f12962c4974d5a43d4c31a3db3fc20fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Oct 2018 13:41:09 -0700
+Subject: scsi: lpfc: Correct loss of fc4 type on remote port address change
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit d83ca3ea833d7a66d49225e4191c4e37cab8f079 ]
+
+An address change for a remote port cause PRLI for the wrong protocol
+to be sent. The node copy done in the discovery code skipped copying
+the fc4 protocols supported as well.
+
+Fix the copy logic for the address change. Beefed up log messages in
+this area as well.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 26 +++++++++++++++++++++++---
+ drivers/scsi/lpfc/lpfc_nportdisc.c | 5 +++--
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 95449f97101d3..e5db20e8979d5 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1550,8 +1550,10 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ */
+ new_ndlp = lpfc_findnode_wwpn(vport, &sp->portName);
+
++ /* return immediately if the WWPN matches ndlp */
+ if (new_ndlp == ndlp && NLP_CHK_NODE_ACT(new_ndlp))
+ return ndlp;
++
+ if (phba->sli_rev == LPFC_SLI_REV4) {
+ active_rrqs_xri_bitmap = mempool_alloc(phba->active_rrq_pool,
+ GFP_KERNEL);
+@@ -1560,9 +1562,13 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ phba->cfg_rrq_xri_bitmap_sz);
+ }
+
+- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+- "3178 PLOGI confirm: ndlp %p x%x: new_ndlp %p\n",
+- ndlp, ndlp->nlp_DID, new_ndlp);
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_NODE,
++ "3178 PLOGI confirm: ndlp x%x x%x x%x: "
++ "new_ndlp x%x x%x x%x\n",
++ ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_fc4_type,
++ (new_ndlp ? new_ndlp->nlp_DID : 0),
++ (new_ndlp ? new_ndlp->nlp_flag : 0),
++ (new_ndlp ? new_ndlp->nlp_fc4_type : 0));
+
+ if (!new_ndlp) {
+ rc = memcmp(&ndlp->nlp_portname, name,
+@@ -1611,6 +1617,14 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ phba->cfg_rrq_xri_bitmap_sz);
+ }
+
++ /* At this point in this routine, we know new_ndlp will be
++ * returned. however, any previous GID_FTs that were done
++ * would have updated nlp_fc4_type in ndlp, so we must ensure
++ * new_ndlp has the right value.
++ */
++ if (vport->fc_flag & FC_FABRIC)
++ new_ndlp->nlp_fc4_type = ndlp->nlp_fc4_type;
++
+ lpfc_unreg_rpi(vport, new_ndlp);
+ new_ndlp->nlp_DID = ndlp->nlp_DID;
+ new_ndlp->nlp_prev_state = ndlp->nlp_prev_state;
+@@ -1732,6 +1746,12 @@ lpfc_plogi_confirm_nport(struct lpfc_hba *phba, uint32_t *prsp,
+ active_rrqs_xri_bitmap)
+ mempool_free(active_rrqs_xri_bitmap,
+ phba->active_rrq_pool);
++
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_NODE,
++ "3173 PLOGI confirm exit: new_ndlp x%x x%x x%x\n",
++ new_ndlp->nlp_DID, new_ndlp->nlp_flag,
++ new_ndlp->nlp_fc4_type);
++
+ return new_ndlp;
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index a0658d1582287..043bca6449cd0 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -2829,8 +2829,9 @@ lpfc_disc_state_machine(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
+ /* DSM in event <evt> on NPort <nlp_DID> in state <cur_state> */
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
+ "0211 DSM in event x%x on NPort x%x in "
+- "state %d Data: x%x\n",
+- evt, ndlp->nlp_DID, cur_state, ndlp->nlp_flag);
++ "state %d Data: x%x x%x\n",
++ evt, ndlp->nlp_DID, cur_state,
++ ndlp->nlp_flag, ndlp->nlp_fc4_type);
+
+ lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_DSM,
+ "DSM in: evt:%d ste:%d did:x%x",
+--
+2.20.1
+
--- /dev/null
+From 927f49278133d1bc97703f15bd1d4b1b9c91b37c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Oct 2018 13:41:06 -0700
+Subject: scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 036cad1f1ac9ce03e2db94b8460f98eaf1e1ee4c ]
+
+On FCoE adapters, when running link bounce test in a loop, initiator
+failed to login with switch switch and required driver reload to
+recover. Switch reached a point where all subsequent FLOGIs would be
+LS_RJT'd. Further testing showed the condition to be related to not
+performing FCF discovery between FLOGI's.
+
+Fix by monitoring FLOGI failures and once a repeated error is seen
+repeat FCF discovery.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 2 ++
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 20 ++++++++++++++++++++
+ drivers/scsi/lpfc/lpfc_init.c | 2 +-
+ drivers/scsi/lpfc/lpfc_sli.c | 11 ++---------
+ drivers/scsi/lpfc/lpfc_sli4.h | 1 +
+ 5 files changed, 26 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index ddd29752d96dc..95449f97101d3 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1152,6 +1152,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ phba->fcf.fcf_flag &= ~FCF_DISCOVERY;
+ phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO);
+ spin_unlock_irq(&phba->hbalock);
++ phba->fcf.fcf_redisc_attempted = 0; /* reset */
+ goto out;
+ }
+ if (!rc) {
+@@ -1166,6 +1167,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ phba->fcf.fcf_flag &= ~FCF_DISCOVERY;
+ phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO);
+ spin_unlock_irq(&phba->hbalock);
++ phba->fcf.fcf_redisc_attempted = 0; /* reset */
+ goto out;
+ }
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index b970933a218d5..d850077c5e226 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -1999,6 +1999,26 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *vport, uint16_t fcf_index)
+ "failover and change port state:x%x/x%x\n",
+ phba->pport->port_state, LPFC_VPORT_UNKNOWN);
+ phba->pport->port_state = LPFC_VPORT_UNKNOWN;
++
++ if (!phba->fcf.fcf_redisc_attempted) {
++ lpfc_unregister_fcf(phba);
++
++ rc = lpfc_sli4_redisc_fcf_table(phba);
++ if (!rc) {
++ lpfc_printf_log(phba, KERN_INFO, LOG_FIP,
++ "3195 Rediscover FCF table\n");
++ phba->fcf.fcf_redisc_attempted = 1;
++ lpfc_sli4_clear_fcf_rr_bmask(phba);
++ } else {
++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
++ "3196 Rediscover FCF table "
++ "failed. Status:x%x\n", rc);
++ }
++ } else {
++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
++ "3197 Already rediscover FCF table "
++ "attempted. No more retry\n");
++ }
+ goto stop_flogi_current_fcf;
+ } else {
+ lpfc_printf_log(phba, KERN_INFO, LOG_FIP | LOG_ELS,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 25612ccf6ff28..15bcd00dd7a23 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -4997,7 +4997,7 @@ lpfc_sli4_async_fip_evt(struct lpfc_hba *phba,
+ break;
+ }
+ /* If fast FCF failover rescan event is pending, do nothing */
+- if (phba->fcf.fcf_flag & FCF_REDISC_EVT) {
++ if (phba->fcf.fcf_flag & (FCF_REDISC_EVT | FCF_REDISC_PEND)) {
+ spin_unlock_irq(&phba->hbalock);
+ break;
+ }
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 6c2b098b76095..ebf7d3cda3677 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -18056,15 +18056,8 @@ lpfc_sli4_fcf_rr_next_index_get(struct lpfc_hba *phba)
+ goto initial_priority;
+ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
+ "2844 No roundrobin failover FCF available\n");
+- if (next_fcf_index >= LPFC_SLI4_FCF_TBL_INDX_MAX)
+- return LPFC_FCOE_FCF_NEXT_NONE;
+- else {
+- lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
+- "3063 Only FCF available idx %d, flag %x\n",
+- next_fcf_index,
+- phba->fcf.fcf_pri[next_fcf_index].fcf_rec.flag);
+- return next_fcf_index;
+- }
++
++ return LPFC_FCOE_FCF_NEXT_NONE;
+ }
+
+ if (next_fcf_index < LPFC_SLI4_FCF_TBL_INDX_MAX &&
+diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
+index 60200385fe009..a132a83ef233c 100644
+--- a/drivers/scsi/lpfc/lpfc_sli4.h
++++ b/drivers/scsi/lpfc/lpfc_sli4.h
+@@ -265,6 +265,7 @@ struct lpfc_fcf {
+ #define FCF_REDISC_EVT 0x100 /* FCF rediscovery event to worker thread */
+ #define FCF_REDISC_FOV 0x200 /* Post FCF rediscovery fast failover */
+ #define FCF_REDISC_PROG (FCF_REDISC_PEND | FCF_REDISC_EVT)
++ uint16_t fcf_redisc_attempted;
+ uint32_t addr_mode;
+ uint32_t eligible_fcf_cnt;
+ struct lpfc_fcf_rec current_rec;
+--
+2.20.1
+
--- /dev/null
+From 84e358359c034075a9a17870fb7f1517f2d5f0c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 23:37:44 -0700
+Subject: scsi: megaraid_sas: Fix goto labels in error handling
+
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+
+[ Upstream commit 8a25fa17b6ed6e6c8101e9c68a10ae68a9025f2c ]
+
+During init, if pci_alloc_irq_vectors() fails, the driver has not yet setup
+the IRQs. Fix the goto labels and error handling for this case.
+
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 23a9f0777fa62..577513649afbe 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5324,7 +5324,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ if (!instance->msix_vectors) {
+ i = pci_alloc_irq_vectors(instance->pdev, 1, 1, PCI_IRQ_LEGACY);
+ if (i < 0)
+- goto fail_setup_irqs;
++ goto fail_init_adapter;
+ }
+
+ megasas_setup_reply_map(instance);
+@@ -5541,9 +5541,8 @@ static int megasas_init_fw(struct megasas_instance *instance)
+
+ fail_get_ld_pd_list:
+ instance->instancet->disable_intr(instance);
+-fail_init_adapter:
+ megasas_destroy_irqs(instance);
+-fail_setup_irqs:
++fail_init_adapter:
+ if (instance->msix_vectors)
+ pci_free_irq_vectors(instance->pdev);
+ instance->msix_vectors = 0;
+--
+2.20.1
+
--- /dev/null
+From 2095072483eda61ef59b3fc00f6c98329dfa03bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 23:37:41 -0700
+Subject: scsi: megaraid_sas: Fix msleep granularity
+
+From: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+
+[ Upstream commit 9155cf30a3c4ef97e225d6daddf9bd4b173267e8 ]
+
+In megasas_transition_to_ready() driver waits 180seconds for controller to
+change FW state. Here we are calling msleep(1) in a loop for this. As
+explained in timers-howto.txt, msleep(1) will actually sleep longer than
+1ms. If a faulty controller is connected, we will end up waiting for much
+more than 180 seconds causing unnecessary delays during load.
+
+Change the granularity of msleep() call from 1ms to 1000ms.
+
+Signed-off-by: Shivasharan S <shivasharan.srikanteshwara@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 8595d83229b77..23a9f0777fa62 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3823,12 +3823,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+- for (i = 0; i < (max_wait * 1000); i++) {
++ for (i = 0; i < max_wait; i++) {
+ curr_abs_state = instance->instancet->
+ read_fw_status_reg(instance->reg_set);
+
+ if (abs_state == curr_abs_state) {
+- msleep(1);
++ msleep(1000);
+ } else
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 416efd05c699790bed29c0be026ac9b0b307dd4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 18:53:37 +0530
+Subject: scsi: mpt3sas: Don't modify EEDPTagMode field setting on SAS3.5 HBA
+ devices
+
+From: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
+
+[ Upstream commit 6cd1bc7b9b5075d395ba0120923903873fc7ea0e ]
+
+If EEDPTagMode field in manufacturing page11 is set then unset it. This is
+needed to fix a hardware bug only in SAS3/SAS2 cards. So, skipping
+EEDPTagMode changes in Manufacturing page11 for SAS 3.5 controllers.
+
+Signed-off-by: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 7bfe53f48d1d4..817a7963a038b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -3140,7 +3140,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc)
+ * flag unset in NVDATA.
+ */
+ mpt3sas_config_get_manufacturing_pg11(ioc, &mpi_reply, &ioc->manu_pg11);
+- if (ioc->manu_pg11.EEDPTagMode == 0) {
++ if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) {
+ pr_err("%s: overriding NVDATA EEDPTagMode setting\n",
+ ioc->name);
+ ioc->manu_pg11.EEDPTagMode &= ~0x3;
+--
+2.20.1
+
--- /dev/null
+From 1190dff1e8d061955b1ced2f62fb87230f33f38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 18:53:38 +0530
+Subject: scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing
+ page11
+
+From: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
+
+[ Upstream commit 97f35194093362a63b33caba2485521ddabe2c95 ]
+
+Currently driver is modifying both current & NVRAM/persistent data in
+Manufacturing page11. Driver should change only current copy of
+Manufacturing page11. It should not modify the persistent data.
+
+So removed the section of code where driver is modifying the persistent
+data of Manufacturing page11.
+
+Signed-off-by: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_config.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_config.c b/drivers/scsi/mpt3sas/mpt3sas_config.c
+index dd62701256142..58acbff40abc8 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_config.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_config.c
+@@ -674,10 +674,6 @@ mpt3sas_config_set_manufacturing_pg11(struct MPT3SAS_ADAPTER *ioc,
+ r = _config_request(ioc, &mpi_request, mpi_reply,
+ MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page,
+ sizeof(*config_page));
+- mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_WRITE_NVRAM;
+- r = _config_request(ioc, &mpi_request, mpi_reply,
+- MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page,
+- sizeof(*config_page));
+ out:
+ return r;
+ }
+--
+2.20.1
+
--- /dev/null
+From e986ac6f50ef9b648df0101d1d7962cb73e30748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 18:53:36 +0530
+Subject: scsi: mpt3sas: Fix Sync cache command failure during driver unload
+
+From: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
+
+[ Upstream commit 9029a72500b95578a35877a43473b82cb0386c53 ]
+
+This is to fix SYNC CACHE and START STOP command failures with
+DID_NO_CONNECT during driver unload.
+
+In driver's IO submission patch (i.e. in driver's .queuecommand()) driver
+won't allow any SCSI commands to the IOC when ioc->remove_host flag is set
+and hence SYNC CACHE commands which are issued to the target drives (where
+write cache is enabled) during driver unload time is failed with
+DID_NO_CONNECT status.
+
+Now modified the driver to allow SYNC CACHE and START STOP commands to IOC,
+even when remove_host flag is set.
+
+Signed-off-by: Suganath Prabu <suganath-prabu.subramani@broadcom.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 36 +++++++++++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index b28efddab7b1a..9ef0c6265cd2b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -3328,6 +3328,40 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
+ return _scsih_check_for_pending_tm(ioc, smid);
+ }
+
++/** _scsih_allow_scmd_to_device - check whether scmd needs to
++ * issue to IOC or not.
++ * @ioc: per adapter object
++ * @scmd: pointer to scsi command object
++ *
++ * Returns true if scmd can be issued to IOC otherwise returns false.
++ */
++inline bool _scsih_allow_scmd_to_device(struct MPT3SAS_ADAPTER *ioc,
++ struct scsi_cmnd *scmd)
++{
++
++ if (ioc->pci_error_recovery)
++ return false;
++
++ if (ioc->hba_mpi_version_belonged == MPI2_VERSION) {
++ if (ioc->remove_host)
++ return false;
++
++ return true;
++ }
++
++ if (ioc->remove_host) {
++
++ switch (scmd->cmnd[0]) {
++ case SYNCHRONIZE_CACHE:
++ case START_STOP:
++ return true;
++ default:
++ return false;
++ }
++ }
++
++ return true;
++}
+
+ /**
+ * _scsih_sas_control_complete - completion routine
+@@ -4100,7 +4134,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ return 0;
+ }
+
+- if (ioc->pci_error_recovery || ioc->remove_host) {
++ if (!(_scsih_allow_scmd_to_device(ioc, scmd))) {
+ scmd->result = DID_NO_CONNECT << 16;
+ scmd->scsi_done(scmd);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 17bca2ff3e7d1aa4f1f3a6515616cfe72047fcd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Aug 2018 23:16:13 +0900
+Subject: selftests/ftrace: Fix to test kprobe $comm arg only if available
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 2452c96e617a0ff6fb2692e55217a3fa57a7322c ]
+
+Test $comm in kprobe-event argument syntax testcase
+only if it is supported on the kernel because
+$comm has been introduced 4.8 kernel.
+So on older stable kernel, it should be skipped.
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
+index 231bcd2c4eb59..1e7ac6f3362ff 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
+@@ -71,8 +71,11 @@ test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
+ echo "r ${PROBEFUNC} \$retval" > kprobe_events
+ ! echo "p ${PROBEFUNC} \$retval" > kprobe_events
+
++# $comm was introduced in 4.8, older kernels reject it.
++if grep -A1 "fetcharg:" README | grep -q '\$comm' ; then
+ : "Comm access"
+ test_goodarg "\$comm"
++fi
+
+ : "Indirect memory access"
+ test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
+--
+2.20.1
+
--- /dev/null
+From 5bb89ef9dc03f405ef51b9205aabe737b6a8ca0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Oct 2018 22:23:53 +1100
+Subject: selftests/powerpc/cache_shape: Fix out-of-tree build
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 69f8117f17b332a68cd8f4bf8c2d0d3d5b84efc5 ]
+
+Use TEST_GEN_PROGS and don't redefine all, this makes the out-of-tree
+build work. We need to move the extra dependencies below the include
+of lib.mk, because it adds the $(OUTPUT) prefix if it's defined.
+
+We can also drop the clean rule, lib.mk does it for us.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/cache_shape/Makefile | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/cache_shape/Makefile b/tools/testing/selftests/powerpc/cache_shape/Makefile
+index 1be547434a49c..7e0c175b82978 100644
+--- a/tools/testing/selftests/powerpc/cache_shape/Makefile
++++ b/tools/testing/selftests/powerpc/cache_shape/Makefile
+@@ -1,11 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+-TEST_PROGS := cache_shape
+-
+-all: $(TEST_PROGS)
+-
+-$(TEST_PROGS): ../harness.c ../utils.c
++TEST_GEN_PROGS := cache_shape
+
+ include ../../lib.mk
+
+-clean:
+- rm -f $(TEST_PROGS) *.o
++$(TEST_GEN_PROGS): ../harness.c ../utils.c
+--
+2.20.1
+
--- /dev/null
+From 3836fe3d2a7c3632b47cc4784fa50a14be025b58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Oct 2018 22:23:50 +1100
+Subject: selftests/powerpc/signal: Fix out-of-tree build
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 27825349d7b238533a47e3d98b8bb0efd886b752 ]
+
+We should use TEST_GEN_PROGS, not TEST_PROGS. That tells the selftests
+makefile (lib.mk) that those tests are generated (built), and so it
+adds the $(OUTPUT) prefix for us, making the out-of-tree build work
+correctly.
+
+It also means we don't need our own clean rule, lib.mk does it.
+
+We also have to update the signal_tm rule to use $(OUTPUT).
+
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/signal/Makefile | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/signal/Makefile b/tools/testing/selftests/powerpc/signal/Makefile
+index a7cbd5082e271..4213978f3ee2c 100644
+--- a/tools/testing/selftests/powerpc/signal/Makefile
++++ b/tools/testing/selftests/powerpc/signal/Makefile
+@@ -1,14 +1,9 @@
+ # SPDX-License-Identifier: GPL-2.0
+-TEST_PROGS := signal signal_tm
+-
+-all: $(TEST_PROGS)
+-
+-$(TEST_PROGS): ../harness.c ../utils.c signal.S
++TEST_GEN_PROGS := signal signal_tm
+
+ CFLAGS += -maltivec
+-signal_tm: CFLAGS += -mhtm
++$(OUTPUT)/signal_tm: CFLAGS += -mhtm
+
+ include ../../lib.mk
+
+-clean:
+- rm -f $(TEST_PROGS) *.o
++$(TEST_GEN_PROGS): ../harness.c ../utils.c signal.S
+--
+2.20.1
+
--- /dev/null
+From aca6f36baa7aab8266ae2430390cbe396d80eb97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Oct 2018 22:23:52 +1100
+Subject: selftests/powerpc/switch_endian: Fix out-of-tree build
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 266bac361d5677e61a6815bd29abeb3bdced2b07 ]
+
+For the out-of-tree build to work we need to tell switch_endian_test
+to look for check-reversed.S in $(OUTPUT).
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/switch_endian/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/powerpc/switch_endian/Makefile b/tools/testing/selftests/powerpc/switch_endian/Makefile
+index 30b8ff8fb82e7..e4cedfe9753d7 100644
+--- a/tools/testing/selftests/powerpc/switch_endian/Makefile
++++ b/tools/testing/selftests/powerpc/switch_endian/Makefile
+@@ -7,6 +7,7 @@ EXTRA_CLEAN = $(OUTPUT)/*.o $(OUTPUT)/check-reversed.S
+
+ include ../../lib.mk
+
++$(OUTPUT)/switch_endian_test: ASFLAGS += -I $(OUTPUT)
+ $(OUTPUT)/switch_endian_test: $(OUTPUT)/check-reversed.S
+
+ $(OUTPUT)/check-reversed.o: $(OUTPUT)/check.o
+--
+2.20.1
+
--- /dev/null
+From 6e5b975346f1bcb1dd794a7830c285b3b52a5834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 15:23:08 -0600
+Subject: selftests: watchdog: Fix error message.
+
+From: Jerry Hoemann <jerry.hoemann@hpe.com>
+
+[ Upstream commit 04d5e4bd37516ad60854eb74592c7dbddd75d277 ]
+
+Printf's say errno but print the string version of error.
+Make consistent.
+
+Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index e029e2017280f..f1c6e025cbe54 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -109,7 +109,7 @@ int main(int argc, char *argv[])
+ printf("Last boot is caused by: %s.\n", (flags != 0) ?
+ "Watchdog" : "Power-On-Reset");
+ else
+- printf("WDIOC_GETBOOTSTATUS errno '%s'\n", strerror(errno));
++ printf("WDIOC_GETBOOTSTATUS error '%s'\n", strerror(errno));
+ break;
+ case 'd':
+ flags = WDIOS_DISABLECARD;
+@@ -117,7 +117,7 @@ int main(int argc, char *argv[])
+ if (!ret)
+ printf("Watchdog card disabled.\n");
+ else
+- printf("WDIOS_DISABLECARD errno '%s'\n", strerror(errno));
++ printf("WDIOS_DISABLECARD error '%s'\n", strerror(errno));
+ break;
+ case 'e':
+ flags = WDIOS_ENABLECARD;
+@@ -125,7 +125,7 @@ int main(int argc, char *argv[])
+ if (!ret)
+ printf("Watchdog card enabled.\n");
+ else
+- printf("WDIOS_ENABLECARD errno '%s'\n", strerror(errno));
++ printf("WDIOS_ENABLECARD error '%s'\n", strerror(errno));
+ break;
+ case 'p':
+ ping_rate = strtoul(optarg, NULL, 0);
+@@ -139,7 +139,7 @@ int main(int argc, char *argv[])
+ if (!ret)
+ printf("Watchdog timeout set to %u seconds.\n", flags);
+ else
+- printf("WDIOC_SETTIMEOUT errno '%s'\n", strerror(errno));
++ printf("WDIOC_SETTIMEOUT error '%s'\n", strerror(errno));
+ break;
+ default:
+ usage(argv[0]);
+--
+2.20.1
+
--- /dev/null
+From d83981cf8b0ba1ef073674d7a9141b6c550d271a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 13:07:11 -0600
+Subject: selftests: watchdog: fix message when /dev/watchdog open fails
+
+From: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+
+[ Upstream commit 9a244229a4b850b11952a0df79607c69b18fd8df ]
+
+When /dev/watchdog open fails, watchdog exits with "watchdog not enabled"
+message. This is incorrect when open fails due to insufficient privilege.
+
+Fix message to clearly state the reason when open fails with EACCESS when
+a non-root user runs it.
+
+Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/watchdog/watchdog-test.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/watchdog/watchdog-test.c b/tools/testing/selftests/watchdog/watchdog-test.c
+index 6e290874b70e2..e029e2017280f 100644
+--- a/tools/testing/selftests/watchdog/watchdog-test.c
++++ b/tools/testing/selftests/watchdog/watchdog-test.c
+@@ -89,7 +89,13 @@ int main(int argc, char *argv[])
+ fd = open("/dev/watchdog", O_WRONLY);
+
+ if (fd == -1) {
+- printf("Watchdog device not enabled.\n");
++ if (errno == ENOENT)
++ printf("Watchdog device not enabled.\n");
++ else if (errno == EACCES)
++ printf("Run watchdog as root.\n");
++ else
++ printf("Watchdog device open failed %s\n",
++ strerror(errno));
+ exit(-1);
+ }
+
+--
+2.20.1
+
revert-fs-ocfs2-fix-possible-null-pointer-dereferences-in-ocfs2_xa_prepare_entry.patch
mm-ksm.c-don-t-warn-if-page-is-still-mapped-in-remove_stable_node.patch
drm-i915-userptr-try-to-acquire-the-page-lock-around-set_page_dirty.patch
+platform-x86-asus-nb-wmi-support-als-on-the-zenbook-.patch
+platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch
+mwifiex-fix-nl80211_tx_power_limited.patch
+alsa-isight-fix-leak-of-reference-to-firewire-unit-i.patch
+printk-fix-integer-overflow-in-setup_log_buf.patch
+gfs2-fix-marking-bitmaps-non-full.patch
+pty-fix-compat-ioctls.patch
+synclink_gt-fix-compat_ioctl.patch
+powerpc-fix-signedness-bug-in-update_flash_db.patch
+powerpc-boot-disable-vector-instructions.patch
+powerpc-eeh-fix-use-of-eeh_pe_keep-on-wrong-field.patch
+edac-thunderx-fix-memory-leak-in-thunderx_l2c_thread.patch
+brcmsmac-ap-mode-update-beacon-when-tim-changes.patch
+ath10k-allocate-small-size-dma-memory-in-ath10k_pci_.patch
+skd-fixup-usage-of-legacy-io-api.patch
+cdrom-don-t-attempt-to-fiddle-with-cdo-capability.patch
+spi-sh-msiof-fix-deferred-probing.patch
+mmc-mediatek-fix-cannot-receive-new-request-when-msd.patch
+btrfs-handle-error-of-get_old_root.patch
+gsmi-fix-bug-in-append_to_eventlog-sysfs-handler.patch
+misc-mic-fix-a-dma-pool-free-failure.patch
+w1-iad-register-is-yet-readable-trough-iad-sys-file..patch
+m68k-fix-command-line-parsing-when-passed-from-u-boo.patch
+rdma-bnxt_re-fix-qp-async-event-reporting.patch
+pinctrl-sunxi-fix-a-memory-leak-in-sunxi_pinctrl_bui.patch
+pwm-lpss-only-set-update-bit-if-we-are-actually-chan.patch
+amiflop-clean-up-on-errors-during-setup.patch
+qed-align-local-and-global-ptt-to-propagate-through-.patch
+scsi-ips-fix-missing-break-in-switch.patch
+kvm-nvmx-reset-cache-shadows-when-switching-loaded-v.patch
+kvm-x86-fix-invvpid-and-invept-register-operand-size.patch
+scsi-isci-use-proper-enumerated-type-in-atapi_d2h_re.patch
+scsi-isci-change-sci_controller_start_task-s-return-.patch
+scsi-iscsi_tcp-explicitly-cast-param-in-iscsi_sw_tcp.patch
+crypto-ccree-avoid-implicit-enum-conversion.patch
+nvmet-fcloop-suppress-a-compiler-warning.patch
+clk-mmp2-fix-the-clock-id-for-sdh2_clk-and-sdh3_clk.patch
+clk-at91-audio-pll-fix-audio-pmc-type.patch
+asoc-tegra_sgtl5000-fix-device_node-refcounting.patch
+scsi-dc395x-fix-dma-api-usage-in-srb_done.patch
+scsi-dc395x-fix-dma-api-usage-in-sg_update_list.patch
+net-dsa-mv88e6xxx-fix-88e6141-6341-2500mbps-serdes-s.patch
+net-fix-warning-in-af_unix.patch
+net-ena-fix-kconfig-dependency-on-x86.patch
+xfs-fix-use-after-free-race-in-xfs_buf_rele.patch
+kprobes-x86-ptrace.h-make-regs_get_kernel_stack_nth-.patch
+pm-domains-deal-with-multiple-states-but-no-governor.patch
+alsa-i2c-cs8427-fix-int-to-char-conversion.patch
+macintosh-windfarm_smu_sat-fix-debug-output.patch
+pci-vmd-detach-resources-after-stopping-root-bus.patch
+usb-misc-appledisplay-fix-backlight-update_status-re.patch
+usbip-tools-fix-atoi-on-non-null-terminated-string.patch
+dm-raid-avoid-bitmap-with-raid4-5-6-journal-device.patch
+sunrpc-fix-a-compile-warning-for-cmpxchg64.patch
+sunrpc-safely-reallow-resvport-min-max-inversion.patch
+atm-zatm-fix-empty-body-clang-warnings.patch
+s390-perf-return-error-when-debug_register-fails.patch
+spi-omap2-mcspi-set-fifo-dma-trigger-level-to-word-l.patch
+sparc-fix-parport-build-warnings.patch
+powerpc-pseries-export-raw-per-cpu-vpa-data-via-debu.patch
+ceph-fix-dentry-leak-in-ceph_readdir_prepopulate.patch
+rtc-s35390a-change-buf-s-type-to-u8-in-s35390a_init.patch
+f2fs-fix-to-spread-clear_cold_data.patch
+misdn-fix-type-of-switch-control-variable-in-ctrl_te.patch
+qlcnic-fix-a-return-in-qlcnic_dcb_get_capability.patch
+net-ethernet-ti-cpsw-unsync-mcast-entries-while-swit.patch
+mfd-arizona-correct-calling-of-runtime_put_sync.patch
+mfd-mc13xxx-core-fix-pmic-shutdown-when-reading-adc-.patch
+mfd-intel_soc_pmic_bxtwc-chain-power-button-irqs-as-.patch
+mfd-max8997-enale-irq-wakeup-unconditionally.patch
+selftests-ftrace-fix-to-test-kprobe-comm-arg-only-if.patch
+selftests-watchdog-fix-message-when-dev-watchdog-ope.patch
+selftests-watchdog-fix-error-message.patch
+thermal-rcar_thermal-prevent-hardware-access-during-.patch
+bpf-devmap-fix-wrong-interface-selection-in-notifier.patch
+powerpc-process-fix-flush_all_to_thread-for-spe.patch
+sparc64-rework-xchg-definition-to-avoid-warnings.patch
+arm64-lib-use-c-string-functions-with-kasan-enabled.patch
+fs-ocfs2-dlm-dlmdebug.c-fix-a-sleep-in-atomic-contex.patch
+mm-page-writeback.c-fix-range_cyclic-writeback-vs-wr.patch
+macsec-update-operstate-when-lower-device-changes.patch
+macsec-let-the-administrator-set-up-state-even-if-lo.patch
+block-fix-the-discard-request-merge.patch
+i2c-uniphier-f-make-driver-robust-against-concurrenc.patch
+i2c-uniphier-f-fix-occasional-timeout-error.patch
+i2c-uniphier-f-fix-race-condition-when-irq-is-cleare.patch
+um-make-line-tty-semantics-use-true-write-irq.patch
+vfs-avoid-problematic-remapping-requests-into-partia.patch
+powerpc-xmon-relax-frame-size-for-clang.patch
+selftests-powerpc-signal-fix-out-of-tree-build.patch
+selftests-powerpc-switch_endian-fix-out-of-tree-buil.patch
+selftests-powerpc-cache_shape-fix-out-of-tree-build.patch
+linux-bitmap.h-handle-constant-zero-size-bitmaps-cor.patch
+linux-bitmap.h-fix-type-of-nbits-in-bitmap_shift_rig.patch
+hfsplus-fix-bug-on-bnode-parent-update.patch
+hfs-fix-bug-on-bnode-parent-update.patch
+hfsplus-prevent-btree-data-loss-on-enospc.patch
+hfs-prevent-btree-data-loss-on-enospc.patch
+hfsplus-fix-return-value-of-hfsplus_get_block.patch
+hfs-fix-return-value-of-hfs_get_block.patch
+hfsplus-update-timestamps-on-truncate.patch
+hfs-update-timestamp-on-truncate.patch
+fs-hfs-extent.c-fix-array-out-of-bounds-read-of-arra.patch
+mm-memory_hotplug-make-add_memory-take-the-device_ho.patch
+igb-shorten-maximum-phc-timecounter-update-interval.patch
+net-hns3-bugfix-for-buffer-not-free-problem-during-r.patch
+ntb_netdev-fix-sleep-time-mismatch.patch
+ntb-intel-fix-return-value-for-ndev_vec_mask.patch
+arm64-makefile-fix-build-of-.i-file-in-external-modu.patch
+ocfs2-don-t-put-and-assigning-null-to-bh-allocated-o.patch
+ocfs2-fix-clusters-leak-in-ocfs2_defrag_extent.patch
+net-do-not-abort-bulk-send-on-bql-status.patch
+sched-topology-fix-off-by-one-bug.patch
+sched-fair-don-t-increase-sd-balance_interval-on-new.patch
+openvswitch-fix-linking-without-config_nf_conntrack_.patch
+clk-sunxi-ng-enable-so-said-ldos-for-a64-soc-s-pll-m.patch
+audit-print-empty-execve-args.patch
+btrfs-avoid-link-error-with-config_no_auto_inline.patch
+wil6210-fix-locking-in-wmi_call.patch
+wlcore-fix-the-return-value-in-case-of-error-in-wlco.patch
+rtl8xxxu-fix-missing-break-in-switch.patch
+brcmsmac-never-log-tid-x-is-not-agg-able-by-default.patch
+wireless-airo-potential-buffer-overflow-in-sprintf.patch
+rtlwifi-rtl8192de-fix-misleading-reg_mcufwdl-informa.patch
+net-dsa-bcm_sf2-turn-on-phy-to-allow-successful-regi.patch
+scsi-mpt3sas-fix-sync-cache-command-failure-during-d.patch
+scsi-mpt3sas-don-t-modify-eedptagmode-field-setting-.patch
+scsi-mpt3sas-fix-driver-modifying-persistent-data-in.patch
+scsi-megaraid_sas-fix-msleep-granularity.patch
+scsi-megaraid_sas-fix-goto-labels-in-error-handling.patch
+scsi-lpfc-fcoe-fix-link-down-issue-after-1000-link-b.patch
+scsi-lpfc-correct-loss-of-fc4-type-on-remote-port-ad.patch
+dlm-fix-invalid-free.patch
+dlm-don-t-leak-kernel-pointer-to-userspace.patch
+vrf-mark-skb-for-multicast-or-link-local-as-enslaved.patch
+acpica-use-d-for-signed-int-print-formatting-instead.patch
+net-bcmgenet-return-correct-value-ret-from-bcmgenet_.patch
+sock-reset-dst-when-changing-sk_mark-via-setsockopt.patch
+of-unittest-allow-base-devicetree-to-have-symbol-met.patch
+cfg80211-prevent-regulatory-restore-during-sta-disco.patch
+pinctrl-qcom-spmi-gpio-fix-gpio-hog-related-boot-iss.patch
+pinctrl-lpc18xx-use-define-directive-for-pin_config_.patch
+pinctrl-zynq-use-define-directive-for-pin_config_io_.patch
+pci-keystone-use-quirk-to-limit-mrrs-for-k2g.patch
+spi-omap2-mcspi-fix-dma-and-fifo-event-trigger-size-.patch
+i2c-uniphier-f-fix-timeout-error-after-reading-8-byt.patch
+mm-memory_hotplug-do-not-unlock-when-fails-to-take-t.patch
+ipv6-fix-handling-of-lla-with-vrf-and-sockets-bound-.patch
+cfg80211-call-disconnect_wk-when-ap-stops.patch
--- /dev/null
+From 32ed0638ca2cb7933834d628e4651d5a7ab6a263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Oct 2018 14:56:14 -0600
+Subject: skd: fixup usage of legacy IO API
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 6d1f9dfde7343c4ebfb8f84dcb333af571bb3b22 ]
+
+We need to be using the mq variant of request requeue here.
+
+Fixes: ca33dd92968b ("skd: Convert to blk-mq")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/skd_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
+index 64d0fc17c1742..95649025cde77 100644
+--- a/drivers/block/skd_main.c
++++ b/drivers/block/skd_main.c
+@@ -1417,7 +1417,7 @@ static void skd_resolve_req_exception(struct skd_device *skdev,
+
+ case SKD_CHECK_STATUS_BUSY_IMMINENT:
+ skd_log_skreq(skdev, skreq, "retry(busy)");
+- blk_requeue_request(skdev->queue, req);
++ blk_mq_requeue_request(req, true);
+ dev_info(&skdev->pdev->dev, "drive BUSY imminent\n");
+ skdev->state = SKD_DRVR_STATE_BUSY_IMMINENT;
+ skdev->timer_countdown = SKD_TIMER_MINUTES(20);
+@@ -1427,7 +1427,7 @@ static void skd_resolve_req_exception(struct skd_device *skdev,
+ case SKD_CHECK_STATUS_REQUEUE_REQUEST:
+ if ((unsigned long) ++req->special < SKD_MAX_RETRIES) {
+ skd_log_skreq(skdev, skreq, "retry");
+- blk_requeue_request(skdev->queue, req);
++ blk_mq_requeue_request(req, true);
+ break;
+ }
+ /* fall through */
+--
+2.20.1
+
--- /dev/null
+From 3a659cc8c48839db1b07fd5b3c55b7598cd21c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 08:13:35 -0600
+Subject: sock: Reset dst when changing sk_mark via setsockopt
+
+From: David Barmann <david.barmann@stackpath.com>
+
+[ Upstream commit 50254256f382c56bde87d970f3d0d02fdb76ec70 ]
+
+When setting the SO_MARK socket option, if the mark changes, the dst
+needs to be reset so that a new route lookup is performed.
+
+This fixes the case where an application wants to change routing by
+setting a new sk_mark. If this is done after some packets have already
+been sent, the dst is cached and has no effect.
+
+Signed-off-by: David Barmann <david.barmann@stackpath.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 7ccbcd853cbce..78c9aa310ce6b 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -985,10 +985,12 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
+ clear_bit(SOCK_PASSSEC, &sock->flags);
+ break;
+ case SO_MARK:
+- if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
++ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+ ret = -EPERM;
+- else
++ } else if (val != sk->sk_mark) {
+ sk->sk_mark = val;
++ sk_dst_reset(sk);
++ }
+ break;
+
+ case SO_RXQ_OVFL:
+--
+2.20.1
+
--- /dev/null
+From 810838537456d71471960decf38b8f08075ef222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 10:52:52 -0700
+Subject: sparc: Fix parport build warnings.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 46b8306480fb424abd525acc1763da1c63a27d8a ]
+
+If PARPORT_PC_FIFO is not enabled, do not provide the dma lock
+macros and lock definition. Otherwise:
+
+./arch/sparc/include/asm/parport.h:24:24: warning: ‘dma_spin_lock’ defined but not used [-Wunused-variable]
+ static DEFINE_SPINLOCK(dma_spin_lock);
+ ^~~~~~~~~~~~~
+./include/linux/spinlock_types.h:81:39: note: in definition of macro ‘DEFINE_SPINLOCK’
+ #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x)
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/parport.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h
+index 05df5f0430535..3c5a1c620f0f7 100644
+--- a/arch/sparc/include/asm/parport.h
++++ b/arch/sparc/include/asm/parport.h
+@@ -21,6 +21,7 @@
+ */
+ #define HAS_DMA
+
++#ifdef CONFIG_PARPORT_PC_FIFO
+ static DEFINE_SPINLOCK(dma_spin_lock);
+
+ #define claim_dma_lock() \
+@@ -31,6 +32,7 @@ static DEFINE_SPINLOCK(dma_spin_lock);
+
+ #define release_dma_lock(__flags) \
+ spin_unlock_irqrestore(&dma_spin_lock, __flags);
++#endif
+
+ static struct sparc_ebus_info {
+ struct ebus_dma_info info;
+--
+2.20.1
+
--- /dev/null
+From 3af97f2daf295ec9697a143e6673d5644bf8bdd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 15:39:49 -0700
+Subject: sparc64: Rework xchg() definition to avoid warnings.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 6c2fc9cddc1ffdef8ada1dc8404e5affae849953 ]
+
+Such as:
+
+fs/ocfs2/file.c: In function ‘ocfs2_file_write_iter’:
+./arch/sparc/include/asm/cmpxchg_64.h:55:22: warning: value computed is not used [-Wunused-value]
+ #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
+
+and
+
+drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c: In function ‘ixgbevf_xdp_setup’:
+./arch/sparc/include/asm/cmpxchg_64.h:55:22: warning: value computed is not used [-Wunused-value]
+ #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/cmpxchg_64.h | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/sparc/include/asm/cmpxchg_64.h b/arch/sparc/include/asm/cmpxchg_64.h
+index f71ef3729888f..316faa0130bab 100644
+--- a/arch/sparc/include/asm/cmpxchg_64.h
++++ b/arch/sparc/include/asm/cmpxchg_64.h
+@@ -52,7 +52,12 @@ static inline unsigned long xchg64(__volatile__ unsigned long *m, unsigned long
+ return val;
+ }
+
+-#define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
++#define xchg(ptr,x) \
++({ __typeof__(*(ptr)) __ret; \
++ __ret = (__typeof__(*(ptr))) \
++ __xchg((unsigned long)(x), (ptr), sizeof(*(ptr))); \
++ __ret; \
++})
+
+ void __xchg_called_with_bad_pointer(void);
+
+--
+2.20.1
+
--- /dev/null
+From 97248698b468ad2593b084725baac96003ad2822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jan 2019 12:28:32 +0530
+Subject: spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
+
+From: Vignesh R <vigneshr@ti.com>
+
+[ Upstream commit baf8b9f8d260c55a86405f70a384c29cda888476 ]
+
+Commit b682cffa3ac6 ("spi: omap2-mcspi: Set FIFO DMA trigger level to word length")
+broke SPI transfers where bits_per_word != 8. This is because of
+mimsatch between McSPI FIFO level event trigger size (SPI word length) and
+DMA request size(word length * maxburst). This leads to data
+corruption, lockup and errors like:
+
+ spi1.0: EOW timed out
+
+Fix this by setting DMA maxburst size to 1 so that
+McSPI FIFO level event trigger size matches DMA request size.
+
+Fixes: b682cffa3ac6 ("spi: omap2-mcspi: Set FIFO DMA trigger level to word length")
+Cc: stable@vger.kernel.org
+Reported-by: David Lechner <david@lechnology.com>
+Tested-by: David Lechner <david@lechnology.com>
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 517d0ade586bd..1db4d3c1d2bfa 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -625,8 +625,8 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
+ cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0;
+ cfg.src_addr_width = width;
+ cfg.dst_addr_width = width;
+- cfg.src_maxburst = es;
+- cfg.dst_maxburst = es;
++ cfg.src_maxburst = 1;
++ cfg.dst_maxburst = 1;
+
+ rx = xfer->rx_buf;
+ tx = xfer->tx_buf;
+--
+2.20.1
+
--- /dev/null
+From 47ed9d9aaf92233a4bceb0e1872d35999fb70b53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Oct 2018 12:08:28 +0530
+Subject: spi: omap2-mcspi: Set FIFO DMA trigger level to word length
+
+From: Vignesh R <vigneshr@ti.com>
+
+[ Upstream commit b682cffa3ac6d9d9e16e9b413c45caee3b391fab ]
+
+McSPI has 32 byte FIFO in Transmit-Receive mode. Current code tries to
+configuration FIFO watermark level for DMA trigger to be GCD of transfer
+length and max FIFO size which would mean trigger level may be set to 32
+for transmit-receive mode if length is aligned. This does not work in
+case of SPI slave mode where FIFO always needs to have data ready
+whenever master starts the clock. With DMA trigger size of 32 there will
+be a small window during slave TX where DMA is still putting data into
+FIFO but master would have started clock for next byte, resulting in
+shifting out of stale data. Similarly, on Slave RX side there may be RX
+FIFO overflow
+Fix this by setting FIFO watermark for DMA trigger to word
+length. This means DMA is triggered as soon as FIFO has space for word
+length bytes and DMA would make sure FIFO is almost always full
+therefore improving FIFO occupancy in both master and slave mode.
+
+Signed-off-by: Vignesh R <vigneshr@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 26 +++++++-------------------
+ 1 file changed, 7 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 9bf64e6eca9ba..517d0ade586bd 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -298,7 +298,7 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
+ struct omap2_mcspi_cs *cs = spi->controller_state;
+ struct omap2_mcspi *mcspi;
+ unsigned int wcnt;
+- int max_fifo_depth, fifo_depth, bytes_per_word;
++ int max_fifo_depth, bytes_per_word;
+ u32 chconf, xferlevel;
+
+ mcspi = spi_master_get_devdata(master);
+@@ -314,10 +314,6 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
+ else
+ max_fifo_depth = OMAP2_MCSPI_MAX_FIFODEPTH;
+
+- fifo_depth = gcd(t->len, max_fifo_depth);
+- if (fifo_depth < 2 || fifo_depth % bytes_per_word != 0)
+- goto disable_fifo;
+-
+ wcnt = t->len / bytes_per_word;
+ if (wcnt > OMAP2_MCSPI_MAX_FIFOWCNT)
+ goto disable_fifo;
+@@ -325,16 +321,17 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
+ xferlevel = wcnt << 16;
+ if (t->rx_buf != NULL) {
+ chconf |= OMAP2_MCSPI_CHCONF_FFER;
+- xferlevel |= (fifo_depth - 1) << 8;
++ xferlevel |= (bytes_per_word - 1) << 8;
+ }
++
+ if (t->tx_buf != NULL) {
+ chconf |= OMAP2_MCSPI_CHCONF_FFET;
+- xferlevel |= fifo_depth - 1;
++ xferlevel |= bytes_per_word - 1;
+ }
+
+ mcspi_write_reg(master, OMAP2_MCSPI_XFERLEVEL, xferlevel);
+ mcspi_write_chconf0(spi, chconf);
+- mcspi->fifo_depth = fifo_depth;
++ mcspi->fifo_depth = max_fifo_depth;
+
+ return;
+ }
+@@ -601,7 +598,6 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
+ struct dma_slave_config cfg;
+ enum dma_slave_buswidth width;
+ unsigned es;
+- u32 burst;
+ void __iomem *chstat_reg;
+ void __iomem *irqstat_reg;
+ int wait_res;
+@@ -623,22 +619,14 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
+ }
+
+ count = xfer->len;
+- burst = 1;
+-
+- if (mcspi->fifo_depth > 0) {
+- if (count > mcspi->fifo_depth)
+- burst = mcspi->fifo_depth / es;
+- else
+- burst = count / es;
+- }
+
+ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr = cs->phys + OMAP2_MCSPI_RX0;
+ cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0;
+ cfg.src_addr_width = width;
+ cfg.dst_addr_width = width;
+- cfg.src_maxburst = burst;
+- cfg.dst_maxburst = burst;
++ cfg.src_maxburst = es;
++ cfg.dst_maxburst = es;
+
+ rx = xfer->rx_buf;
+ tx = xfer->tx_buf;
+--
+2.20.1
+
--- /dev/null
+From 7271d46be5ae6383910f8521f8009ecf868514de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 22:48:22 +0300
+Subject: spi: sh-msiof: fix deferred probing
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit f34c6e6257aa477cdfe7e9bbbecd3c5648ecda69 ]
+
+Since commit 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
+platform_get_irq() can return -EPROBE_DEFER. However, the driver overrides
+an error returned by that function with -ENOENT which breaks the deferred
+probing. Propagate upstream an error code returned by platform_get_irq()
+and remove the bogus "platform" from the error message, while at it...
+
+Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sh-msiof.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index db2a529accae8..a7bd3c92356be 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -1283,8 +1283,8 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
+
+ i = platform_get_irq(pdev, 0);
+ if (i < 0) {
+- dev_err(&pdev->dev, "cannot get platform IRQ\n");
+- ret = -ENOENT;
++ dev_err(&pdev->dev, "cannot get IRQ\n");
++ ret = i;
+ goto err1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a5478ba3275d912feb335376222215510571ddfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 17:03:56 -0400
+Subject: SUNRPC: Fix a compile warning for cmpxchg64()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit e732f4485a150492b286f3efc06f9b34dd6b9995 ]
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/gss_krb5_seal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
+index 1d74d653e6c05..ad0dcb69395d7 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
++++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
+@@ -63,6 +63,7 @@
+ #include <linux/sunrpc/gss_krb5.h>
+ #include <linux/random.h>
+ #include <linux/crypto.h>
++#include <linux/atomic.h>
+
+ #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
+ # define RPCDBG_FACILITY RPCDBG_AUTH
+--
+2.20.1
+
--- /dev/null
+From 190368ac008df8ab5e7788f7568a0a79337c3332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 15:27:02 -0400
+Subject: sunrpc: safely reallow resvport min/max inversion
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 826799e66e8683e5698e140bb9ef69afc8c0014e ]
+
+Commits ffb6ca33b04b and e08ea3a96fc7 prevent setting xprt_min_resvport
+greater than xprt_max_resvport, but may also break simple code that sets
+one parameter then the other, if the new range does not overlap the old.
+
+Also it looks racy to me, unless there's some serialization I'm not
+seeing. Granted it would probably require malicious privileged processes
+(unless there's a chance these might eventually be settable in unprivileged
+containers), but still it seems better not to let userspace panic the
+kernel.
+
+Simpler seems to be to allow setting the parameters to whatever you want
+but interpret xprt_min_resvport > xprt_max_resvport as the empty range.
+
+Fixes: ffb6ca33b04b "sunrpc: Prevent resvport min/max inversion..."
+Fixes: e08ea3a96fc7 "sunrpc: Prevent rexvport min/max inversion..."
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtsock.c | 34 ++++++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 16 deletions(-)
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index a42871a59f3b9..f75b5b7c1fc2a 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -127,7 +127,7 @@ static struct ctl_table xs_tunables_table[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = &xprt_min_resvport_limit,
+- .extra2 = &xprt_max_resvport
++ .extra2 = &xprt_max_resvport_limit
+ },
+ {
+ .procname = "max_resvport",
+@@ -135,7 +135,7 @@ static struct ctl_table xs_tunables_table[] = {
+ .maxlen = sizeof(unsigned int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &xprt_min_resvport,
++ .extra1 = &xprt_min_resvport_limit,
+ .extra2 = &xprt_max_resvport_limit
+ },
+ {
+@@ -1754,11 +1754,17 @@ static void xs_udp_timer(struct rpc_xprt *xprt, struct rpc_task *task)
+ spin_unlock_bh(&xprt->transport_lock);
+ }
+
+-static unsigned short xs_get_random_port(void)
++static int xs_get_random_port(void)
+ {
+- unsigned short range = xprt_max_resvport - xprt_min_resvport + 1;
+- unsigned short rand = (unsigned short) prandom_u32() % range;
+- return rand + xprt_min_resvport;
++ unsigned short min = xprt_min_resvport, max = xprt_max_resvport;
++ unsigned short range;
++ unsigned short rand;
++
++ if (max < min)
++ return -EADDRINUSE;
++ range = max - min + 1;
++ rand = (unsigned short) prandom_u32() % range;
++ return rand + min;
+ }
+
+ /**
+@@ -1815,9 +1821,9 @@ static void xs_set_srcport(struct sock_xprt *transport, struct socket *sock)
+ transport->srcport = xs_sock_getport(sock);
+ }
+
+-static unsigned short xs_get_srcport(struct sock_xprt *transport)
++static int xs_get_srcport(struct sock_xprt *transport)
+ {
+- unsigned short port = transport->srcport;
++ int port = transport->srcport;
+
+ if (port == 0 && transport->xprt.resvport)
+ port = xs_get_random_port();
+@@ -1838,7 +1844,7 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
+ {
+ struct sockaddr_storage myaddr;
+ int err, nloop = 0;
+- unsigned short port = xs_get_srcport(transport);
++ int port = xs_get_srcport(transport);
+ unsigned short last;
+
+ /*
+@@ -1856,8 +1862,8 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
+ * transport->xprt.resvport == 1) xs_get_srcport above will
+ * ensure that port is non-zero and we will bind as needed.
+ */
+- if (port == 0)
+- return 0;
++ if (port <= 0)
++ return port;
+
+ memcpy(&myaddr, &transport->srcaddr, transport->xprt.addrlen);
+ do {
+@@ -3286,12 +3292,8 @@ static int param_set_uint_minmax(const char *val,
+
+ static int param_set_portnr(const char *val, const struct kernel_param *kp)
+ {
+- if (kp->arg == &xprt_min_resvport)
+- return param_set_uint_minmax(val, kp,
+- RPC_MIN_RESVPORT,
+- xprt_max_resvport);
+ return param_set_uint_minmax(val, kp,
+- xprt_min_resvport,
++ RPC_MIN_RESVPORT,
+ RPC_MAX_RESVPORT);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1e0f7bd827984444084f22b51d114ec9e56224ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Sep 2018 20:57:18 -0400
+Subject: synclink_gt(): fix compat_ioctl()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 27230e51349fde075598c1b59d15e1ff802f3f6e ]
+
+compat_ptr() for pointer-taking ones...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclink_gt.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index 636b8ae29b465..344e8c427c7e2 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1187,14 +1187,13 @@ static long slgt_compat_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct slgt_info *info = tty->driver_data;
+- int rc = -ENOIOCTLCMD;
++ int rc;
+
+ if (sanity_check(info, tty->name, "compat_ioctl"))
+ return -ENODEV;
+ DBGINFO(("%s compat_ioctl() cmd=%08X\n", info->device_name, cmd));
+
+ switch (cmd) {
+-
+ case MGSL_IOCSPARAMS32:
+ rc = set_params32(info, compat_ptr(arg));
+ break;
+@@ -1214,18 +1213,11 @@ static long slgt_compat_ioctl(struct tty_struct *tty,
+ case MGSL_IOCWAITGPIO:
+ case MGSL_IOCGXSYNC:
+ case MGSL_IOCGXCTRL:
+- case MGSL_IOCSTXIDLE:
+- case MGSL_IOCTXENABLE:
+- case MGSL_IOCRXENABLE:
+- case MGSL_IOCTXABORT:
+- case TIOCMIWAIT:
+- case MGSL_IOCSIF:
+- case MGSL_IOCSXSYNC:
+- case MGSL_IOCSXCTRL:
+- rc = ioctl(tty, cmd, arg);
++ rc = ioctl(tty, cmd, (unsigned long)compat_ptr(arg));
+ break;
++ default:
++ rc = ioctl(tty, cmd, arg);
+ }
+-
+ DBGINFO(("%s compat_ioctl() cmd=%08X rc=%d\n", info->device_name, cmd, rc));
+ return rc;
+ }
+--
+2.20.1
+
--- /dev/null
+From a804ba26f45d941289acd950aa54575a847e045f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 09:20:15 +0200
+Subject: thermal: rcar_thermal: Prevent hardware access during system suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3a31386217628ffe2491695be2db933c25dde785 ]
+
+On r8a7791/koelsch, sometimes the following message is printed during
+system suspend:
+
+ rcar_thermal e61f0000.thermal: thermal sensor was broken
+
+This happens if the workqueue runs while the device is already
+suspended. Fix this by using the freezable system workqueue instead,
+cfr. commit 51e20d0e3a60cf46 ("thermal: Prevent polling from happening
+during system suspend").
+
+Fixes: e0a5172e9eec7f0d ("thermal: rcar: add interrupt support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/rcar_thermal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index 73e5fee6cf1d5..83126e2dce36d 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -401,8 +401,8 @@ static irqreturn_t rcar_thermal_irq(int irq, void *data)
+ rcar_thermal_for_each_priv(priv, common) {
+ if (rcar_thermal_had_changed(priv, status)) {
+ rcar_thermal_irq_disable(priv);
+- schedule_delayed_work(&priv->work,
+- msecs_to_jiffies(300));
++ queue_delayed_work(system_freezable_wq, &priv->work,
++ msecs_to_jiffies(300));
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5531e1c7e0a61b447699bcf9b2ba523e07afdb49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Sep 2018 08:47:13 +0100
+Subject: um: Make line/tty semantics use true write IRQ
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 917e2fd2c53eb3c4162f5397555cbd394390d4bc ]
+
+This fixes a long standing bug where large amounts of output
+could freeze the tty (most commonly seen on stdio console).
+While the bug has always been there it became more pronounced
+after moving to the new interrupt controller.
+
+The line semantics are now changed to have true IRQ write
+semantics which should further improve the tty/line subsystem
+stability and performance
+
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/line.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
+index 366e57f5e8d63..7e524efed5848 100644
+--- a/arch/um/drivers/line.c
++++ b/arch/um/drivers/line.c
+@@ -261,7 +261,7 @@ static irqreturn_t line_write_interrupt(int irq, void *data)
+ if (err == 0) {
+ spin_unlock(&line->lock);
+ return IRQ_NONE;
+- } else if (err < 0) {
++ } else if ((err < 0) && (err != -EAGAIN)) {
+ line->head = line->buffer;
+ line->tail = line->buffer;
+ }
+--
+2.20.1
+
--- /dev/null
+From 68a51d068472a689338bccd46646125455f5a982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 14:20:08 +0200
+Subject: USB: misc: appledisplay: fix backlight update_status return code
+
+From: Mattias Jacobsson <2pi@mok.nu>
+
+[ Upstream commit 090158555ff8d194a98616034100b16697dd80d0 ]
+
+Upon success the update_status handler returns a positive number
+corresponding to the number of bytes transferred by usb_control_msg.
+However the return code of the update_status handler should indicate if
+an error occurred(negative) or how many bytes of the user's input to sysfs
+that was consumed. Return code zero indicates all bytes were consumed.
+
+The bug can for example result in the update_status handler being called
+twice, the second time with only the "unconsumed" part of the user's input
+to sysfs. Effectively setting an incorrect brightness.
+
+Change the update_status handler to return zero for all successful
+transactions and forward usb_control_msg's error code upon failure.
+
+Signed-off-by: Mattias Jacobsson <2pi@mok.nu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/appledisplay.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index 03be7c75c5be7..3b59eaf81eefc 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -160,8 +160,11 @@ static int appledisplay_bl_update_status(struct backlight_device *bd)
+ pdata->msgdata, 2,
+ ACD_USB_TIMEOUT);
+ mutex_unlock(&pdata->sysfslock);
+-
+- return retval;
++
++ if (retval < 0)
++ return retval;
++ else
++ return 0;
+ }
+
+ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
+--
+2.20.1
+
--- /dev/null
+From 5377d711495657e5a4c17b629590faba517c281e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 19:03:43 +0100
+Subject: usbip: tools: fix atoi() on non-null terminated string
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e325808c0051b16729ffd472ff887c6cae5c6317 ]
+
+Currently the call to atoi is being passed a single char string
+that is not null terminated, so there is a potential read overrun
+along the stack when parsing for an integer value. Fix this by
+instead using a 2 char string that is initialized to all zeros
+to ensure that a 1 char read into the string is always terminated
+with a \0.
+
+Detected by cppcheck:
+"Invalid atoi() argument nr 1. A nul-terminated string is required."
+
+Fixes: 3391ba0e2792 ("usbip: tools: Extract generic code to be shared with vudc backend")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/usb/usbip/libsrc/usbip_host_common.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
+index 6ff7b601f8545..f5ad219a324e8 100644
+--- a/tools/usb/usbip/libsrc/usbip_host_common.c
++++ b/tools/usb/usbip/libsrc/usbip_host_common.c
+@@ -43,7 +43,7 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ int size;
+ int fd;
+ int length;
+- char status;
++ char status[2] = { 0 };
+ int value = 0;
+
+ size = snprintf(status_attr_path, sizeof(status_attr_path),
+@@ -61,14 +61,14 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ return -1;
+ }
+
+- length = read(fd, &status, 1);
++ length = read(fd, status, 1);
+ if (length < 0) {
+ err("error reading attribute %s", status_attr_path);
+ close(fd);
+ return -1;
+ }
+
+- value = atoi(&status);
++ value = atoi(status);
+
+ return value;
+ }
+--
+2.20.1
+
--- /dev/null
+From 728a531a1ee4dd456da1baf39b69f1248c798ee4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 10:40:55 +1100
+Subject: vfs: avoid problematic remapping requests into partial EOF block
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 07d19dc9fbe9128378b9e226abe886fd8fd473df ]
+
+A deduplication data corruption is exposed in XFS and btrfs. It is
+caused by extending the block match range to include the partial EOF
+block, but then allowing unknown data beyond EOF to be considered a
+"match" to data in the destination file because the comparison is only
+made to the end of the source file. This corrupts the destination file
+when the source extent is shared with it.
+
+The VFS remapping prep functions only support whole block dedupe, but
+we still need to appear to support whole file dedupe correctly. Hence
+if the dedupe request includes the last block of the souce file, don't
+include it in the actual dedupe operation. If the rest of the range
+dedupes successfully, then reject the entire request. A subsequent
+patch will enable us to shorten dedupe requests correctly.
+
+When reflinking sub-file ranges, a data corruption can occur when the
+source file range includes a partial EOF block. This shares the unknown
+data beyond EOF into the second file at a position inside EOF, exposing
+stale data in the second file.
+
+If the reflink request includes the last block of the souce file, only
+proceed with the reflink operation if it lands at or past the
+destination file's current EOF. If it lands within the destination file
+EOF, reject the entire request with -EINVAL and make the caller go the
+hard way. A subsequent patch will enable us to shorten reflink requests
+correctly.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/read_write.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 38a8bcccf0dd0..e8136a72c13f3 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -1709,6 +1709,34 @@ static int clone_verify_area(struct file *file, loff_t pos, u64 len, bool write)
+
+ return security_file_permission(file, write ? MAY_WRITE : MAY_READ);
+ }
++/*
++ * Ensure that we don't remap a partial EOF block in the middle of something
++ * else. Assume that the offsets have already been checked for block
++ * alignment.
++ *
++ * For deduplication we always scale down to the previous block because we
++ * can't meaningfully compare post-EOF contents.
++ *
++ * For clone we only link a partial EOF block above the destination file's EOF.
++ */
++static int generic_remap_check_len(struct inode *inode_in,
++ struct inode *inode_out,
++ loff_t pos_out,
++ u64 *len,
++ bool is_dedupe)
++{
++ u64 blkmask = i_blocksize(inode_in) - 1;
++
++ if ((*len & blkmask) == 0)
++ return 0;
++
++ if (is_dedupe)
++ *len &= ~blkmask;
++ else if (pos_out + *len < i_size_read(inode_out))
++ return -EINVAL;
++
++ return 0;
++}
+
+ /*
+ * Check that the two inodes are eligible for cloning, the ranges make
+@@ -1815,6 +1843,11 @@ int vfs_clone_file_prep_inodes(struct inode *inode_in, loff_t pos_in,
+ return -EBADE;
+ }
+
++ ret = generic_remap_check_len(inode_in, inode_out, pos_out, len,
++ is_dedupe);
++ if (ret)
++ return ret;
++
+ return 1;
+ }
+ EXPORT_SYMBOL(vfs_clone_file_prep_inodes);
+--
+2.20.1
+
--- /dev/null
+From e9eb60a8eef2a82926947ddfd293b45438d34f36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 15:36:07 +0000
+Subject: vrf: mark skb for multicast or link-local as enslaved to VRF
+
+From: Mike Manning <mmanning@vyatta.att-mail.com>
+
+[ Upstream commit 6f12fa775530195a501fb090d092c637f32d0cc5 ]
+
+The skb for packets that are multicast or to a link-local address are
+not marked as being enslaved to a VRF, if they are received on a socket
+bound to the VRF. This is needed for ND and it is preferable for the
+kernel not to have to deal with the additional use-cases if ll or mcast
+packets are handled as enslaved. However, this does not allow service
+instances listening on unbound and bound to VRF sockets to distinguish
+the VRF used, if packets are sent as multicast or to a link-local
+address. The fix is for the VRF driver to also mark these skb as being
+enslaved to the VRF.
+
+Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Tested-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vrf.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 03e4fcdfeab73..e0cea5c05f0e2 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -996,24 +996,23 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
+ struct sk_buff *skb)
+ {
+ int orig_iif = skb->skb_iif;
+- bool need_strict;
++ bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
++ bool is_ndisc = ipv6_ndisc_frame(skb);
+
+- /* loopback traffic; do not push through packet taps again.
+- * Reset pkt_type for upper layers to process skb
++ /* loopback, multicast & non-ND link-local traffic; do not push through
++ * packet taps again. Reset pkt_type for upper layers to process skb
+ */
+- if (skb->pkt_type == PACKET_LOOPBACK) {
++ if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
+ skb->dev = vrf_dev;
+ skb->skb_iif = vrf_dev->ifindex;
+ IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
+- skb->pkt_type = PACKET_HOST;
++ if (skb->pkt_type == PACKET_LOOPBACK)
++ skb->pkt_type = PACKET_HOST;
+ goto out;
+ }
+
+- /* if packet is NDISC or addressed to multicast or link-local
+- * then keep the ingress interface
+- */
+- need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
+- if (!ipv6_ndisc_frame(skb) && !need_strict) {
++ /* if packet is NDISC then keep the ingress interface */
++ if (!is_ndisc) {
+ vrf_rx_stats(vrf_dev, skb->len);
+ skb->dev = vrf_dev;
+ skb->skb_iif = vrf_dev->ifindex;
+--
+2.20.1
+
--- /dev/null
+From 0a33cee8d133bc66c9c3b485756f4b04bda754ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Oct 2018 19:47:45 +0200
+Subject: w1: IAD Register is yet readable trough iad sys file. Fix snprintf
+ (%u for unsigned, count for max size).
+
+From: Julien Folly <julien.folly@gmail.com>
+
+[ Upstream commit 6eaafbb6998e999467cf78a76e155ee00e372b14 ]
+
+IAD Register is yet readable trough the "iad" sys file.
+
+A write to the "iad" sys file enables or disables the current
+measurement, but it was not possible to get the measured value by
+reading it.
+Fix: %u in snprintf for unsigned values (vdd and vad)
+Fix: Avoid possibles overflows (Usage of the 'count' variables)
+
+Signed-off-by: Julien Folly <julien.folly@gmail.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/w1/slaves/w1_ds2438.c | 66 +++++++++++++++++++++++++++--------
+ 1 file changed, 52 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c
+index bf641a191d077..7c4e33dbee4d5 100644
+--- a/drivers/w1/slaves/w1_ds2438.c
++++ b/drivers/w1/slaves/w1_ds2438.c
+@@ -186,8 +186,8 @@ static int w1_ds2438_change_config_bit(struct w1_slave *sl, u8 mask, u8 value)
+ return -1;
+ }
+
+-static uint16_t w1_ds2438_get_voltage(struct w1_slave *sl,
+- int adc_input, uint16_t *voltage)
++static int w1_ds2438_get_voltage(struct w1_slave *sl,
++ int adc_input, uint16_t *voltage)
+ {
+ unsigned int retries = W1_DS2438_RETRIES;
+ u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];
+@@ -235,6 +235,25 @@ static uint16_t w1_ds2438_get_voltage(struct w1_slave *sl,
+ return ret;
+ }
+
++static int w1_ds2438_get_current(struct w1_slave *sl, int16_t *voltage)
++{
++ u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];
++ int ret;
++
++ mutex_lock(&sl->master->bus_mutex);
++
++ if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {
++ /* The voltage measured across current sense resistor RSENS. */
++ *voltage = (((int16_t) w1_buf[DS2438_CURRENT_MSB]) << 8) | ((int16_t) w1_buf[DS2438_CURRENT_LSB]);
++ ret = 0;
++ } else
++ ret = -1;
++
++ mutex_unlock(&sl->master->bus_mutex);
++
++ return ret;
++}
++
+ static ssize_t iad_write(struct file *filp, struct kobject *kobj,
+ struct bin_attribute *bin_attr, char *buf,
+ loff_t off, size_t count)
+@@ -257,6 +276,27 @@ static ssize_t iad_write(struct file *filp, struct kobject *kobj,
+ return ret;
+ }
+
++static ssize_t iad_read(struct file *filp, struct kobject *kobj,
++ struct bin_attribute *bin_attr, char *buf,
++ loff_t off, size_t count)
++{
++ struct w1_slave *sl = kobj_to_w1_slave(kobj);
++ int ret;
++ int16_t voltage;
++
++ if (off != 0)
++ return 0;
++ if (!buf)
++ return -EINVAL;
++
++ if (w1_ds2438_get_current(sl, &voltage) == 0) {
++ ret = snprintf(buf, count, "%i\n", voltage);
++ } else
++ ret = -EIO;
++
++ return ret;
++}
++
+ static ssize_t page0_read(struct file *filp, struct kobject *kobj,
+ struct bin_attribute *bin_attr, char *buf,
+ loff_t off, size_t count)
+@@ -272,9 +312,13 @@ static ssize_t page0_read(struct file *filp, struct kobject *kobj,
+
+ mutex_lock(&sl->master->bus_mutex);
+
++ /* Read no more than page0 size */
++ if (count > DS2438_PAGE_SIZE)
++ count = DS2438_PAGE_SIZE;
++
+ if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {
+- memcpy(buf, &w1_buf, DS2438_PAGE_SIZE);
+- ret = DS2438_PAGE_SIZE;
++ memcpy(buf, &w1_buf, count);
++ ret = count;
+ } else
+ ret = -EIO;
+
+@@ -289,7 +333,6 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj,
+ {
+ struct w1_slave *sl = kobj_to_w1_slave(kobj);
+ int ret;
+- ssize_t c = PAGE_SIZE;
+ int16_t temp;
+
+ if (off != 0)
+@@ -298,8 +341,7 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+
+ if (w1_ds2438_get_temperature(sl, &temp) == 0) {
+- c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", temp);
+- ret = PAGE_SIZE - c;
++ ret = snprintf(buf, count, "%i\n", temp);
+ } else
+ ret = -EIO;
+
+@@ -312,7 +354,6 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj,
+ {
+ struct w1_slave *sl = kobj_to_w1_slave(kobj);
+ int ret;
+- ssize_t c = PAGE_SIZE;
+ uint16_t voltage;
+
+ if (off != 0)
+@@ -321,8 +362,7 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+
+ if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VAD, &voltage) == 0) {
+- c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);
+- ret = PAGE_SIZE - c;
++ ret = snprintf(buf, count, "%u\n", voltage);
+ } else
+ ret = -EIO;
+
+@@ -335,7 +375,6 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj,
+ {
+ struct w1_slave *sl = kobj_to_w1_slave(kobj);
+ int ret;
+- ssize_t c = PAGE_SIZE;
+ uint16_t voltage;
+
+ if (off != 0)
+@@ -344,15 +383,14 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj,
+ return -EINVAL;
+
+ if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VDD, &voltage) == 0) {
+- c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);
+- ret = PAGE_SIZE - c;
++ ret = snprintf(buf, count, "%u\n", voltage);
+ } else
+ ret = -EIO;
+
+ return ret;
+ }
+
+-static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, NULL, iad_write, 1);
++static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, iad_read, iad_write, 0);
+ static BIN_ATTR_RO(page0, DS2438_PAGE_SIZE);
+ static BIN_ATTR_RO(temperature, 0/* real length varies */);
+ static BIN_ATTR_RO(vad, 0/* real length varies */);
+--
+2.20.1
+
--- /dev/null
+From 8b6cb50d03a445451310ada2a8fc92a65ace327b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 10:52:24 +0200
+Subject: wil6210: fix locking in wmi_call
+
+From: Lior David <liord@codeaurora.org>
+
+[ Upstream commit dc57731dbd535880fe6ced31c229262c34df7d64 ]
+
+Switch from spin_lock to spin_lock_irqsave, because
+wmi_ev_lock is used inside interrupt handler.
+
+Signed-off-by: Lior David <liord@codeaurora.org>
+Signed-off-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/wmi.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
+index d63d7c3268018..798516f42f2f9 100644
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -1002,15 +1002,16 @@ int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+ {
+ int rc;
+ unsigned long remain;
++ ulong flags;
+
+ mutex_lock(&wil->wmi_mutex);
+
+- spin_lock(&wil->wmi_ev_lock);
++ spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+ wil->reply_id = reply_id;
+ wil->reply_buf = reply;
+ wil->reply_size = reply_size;
+ reinit_completion(&wil->wmi_call);
+- spin_unlock(&wil->wmi_ev_lock);
++ spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+ rc = __wmi_send(wil, cmdid, buf, len);
+ if (rc)
+@@ -1030,11 +1031,11 @@ int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+ }
+
+ out:
+- spin_lock(&wil->wmi_ev_lock);
++ spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+ wil->reply_id = 0;
+ wil->reply_buf = NULL;
+ wil->reply_size = 0;
+- spin_unlock(&wil->wmi_ev_lock);
++ spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+ mutex_unlock(&wil->wmi_mutex);
+
+--
+2.20.1
+
--- /dev/null
+From ae10ff569382b5f68159d97bf1f5bbedffc50119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Oct 2018 11:33:34 +0300
+Subject: wireless: airo: potential buffer overflow in sprintf()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ]
+
+It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes
+of the ssid, but we accidentally use "%*s" (width) instead of "%.*s"
+(precision) so if the ssid doesn't have a NUL terminator this could lead
+to an overflow.
+
+Static analysis. Not tested.
+
+Fixes: e174961ca1a0 ("net: convert print_mac to %pM")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/cisco/airo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 54201c02fdb8b..fc49255bab009 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -5464,7 +5464,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
+ we have to add a spin lock... */
+ rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
+ while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
+- ptr += sprintf(ptr, "%pM %*s rssi = %d",
++ ptr += sprintf(ptr, "%pM %.*s rssi = %d",
+ BSSList_rid.bssid,
+ (int)BSSList_rid.ssidLen,
+ BSSList_rid.ssid,
+--
+2.20.1
+
--- /dev/null
+From e5e4da4935559627643151ab6ca6514bdcb1fad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 09:39:40 +0200
+Subject: wlcore: Fix the return value in case of error in
+ 'wlcore_vendor_cmd_smart_config_start()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3419348a97bcc256238101129d69b600ceb5cc70 ]
+
+We return 0 unconditionally at the end of
+'wlcore_vendor_cmd_smart_config_start()'.
+However, 'ret' is set to some error codes in several error handling paths
+and we already return some error codes at the beginning of the function.
+
+Return 'ret' instead to propagate the error code.
+
+Fixes: 80ff8063e87c ("wlcore: handle smart config vendor commands")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wlcore/vendor_cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+index 5c0bcb1fe1a1f..e75c3cee0252f 100644
+--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c
++++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+@@ -66,7 +66,7 @@ wlcore_vendor_cmd_smart_config_start(struct wiphy *wiphy,
+ out:
+ mutex_unlock(&wl->mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+--
+2.20.1
+
--- /dev/null
+From eb945effe342a46d31aa66b08b770f9e381c3789 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 17:21:29 +1100
+Subject: xfs: fix use-after-free race in xfs_buf_rele
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 37fd1678245f7a5898c1b05128bc481fb403c290 ]
+
+When looking at a 4.18 based KASAN use after free report, I noticed
+that racing xfs_buf_rele() may race on dropping the last reference
+to the buffer and taking the buffer lock. This was the symptom
+displayed by the KASAN report, but the actual issue that was
+reported had already been fixed in 4.19-rc1 by commit e339dd8d8b04
+("xfs: use sync buffer I/O for sync delwri queue submission").
+
+Despite this, I think there is still an issue with xfs_buf_rele()
+in this code:
+
+ release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
+ spin_lock(&bp->b_lock);
+ if (!release) {
+.....
+
+If two threads race on the b_lock after both dropping a reference
+and one getting dropping the last reference so release = true, we
+end up with:
+
+CPU 0 CPU 1
+atomic_dec_and_lock()
+ atomic_dec_and_lock()
+ spin_lock(&bp->b_lock)
+spin_lock(&bp->b_lock)
+<spins>
+ <release = true bp->b_lru_ref = 0>
+ <remove from lists>
+ freebuf = true
+ spin_unlock(&bp->b_lock)
+ xfs_buf_free(bp)
+<gets lock, reading and writing freed memory>
+<accesses freed memory>
+spin_unlock(&bp->b_lock) <reads/writes freed memory>
+
+IOWs, we can't safely take bp->b_lock after dropping the hold
+reference because the buffer may go away at any time after we
+drop that reference. However, this can be fixed simply by taking the
+bp->b_lock before we drop the reference.
+
+It is safe to nest the pag_buf_lock inside bp->b_lock as the
+pag_buf_lock is only used to serialise against lookup in
+xfs_buf_find() and no other locks are held over or under the
+pag_buf_lock there. Make this clear by documenting the buffer lock
+orders at the top of the file.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com
+Signed-off-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_buf.c | 38 +++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index e4a623956df57..e5970ecdfd585 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -58,6 +58,32 @@ static kmem_zone_t *xfs_buf_zone;
+ #define xb_to_gfp(flags) \
+ ((((flags) & XBF_READ_AHEAD) ? __GFP_NORETRY : GFP_NOFS) | __GFP_NOWARN)
+
++/*
++ * Locking orders
++ *
++ * xfs_buf_ioacct_inc:
++ * xfs_buf_ioacct_dec:
++ * b_sema (caller holds)
++ * b_lock
++ *
++ * xfs_buf_stale:
++ * b_sema (caller holds)
++ * b_lock
++ * lru_lock
++ *
++ * xfs_buf_rele:
++ * b_lock
++ * pag_buf_lock
++ * lru_lock
++ *
++ * xfs_buftarg_wait_rele
++ * lru_lock
++ * b_lock (trylock due to inversion)
++ *
++ * xfs_buftarg_isolate
++ * lru_lock
++ * b_lock (trylock due to inversion)
++ */
+
+ static inline int
+ xfs_buf_is_vmapped(
+@@ -983,8 +1009,18 @@ xfs_buf_rele(
+
+ ASSERT(atomic_read(&bp->b_hold) > 0);
+
+- release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
++ /*
++ * We grab the b_lock here first to serialise racing xfs_buf_rele()
++ * calls. The pag_buf_lock being taken on the last reference only
++ * serialises against racing lookups in xfs_buf_find(). IOWs, the second
++ * to last reference we drop here is not serialised against the last
++ * reference until we take bp->b_lock. Hence if we don't grab b_lock
++ * first, the last "release" reference can win the race to the lock and
++ * free the buffer before the second-to-last reference is processed,
++ * leading to a use-after-free scenario.
++ */
+ spin_lock(&bp->b_lock);
++ release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
+ if (!release) {
+ /*
+ * Drop the in-flight state if the buffer is already on the LRU
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
